diff --git a/CHANGES b/CHANGES
index 8e7382b4..1236a2ad 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,14 +1,445 @@
 
-Changes with nginx 1.16.1                                        13 Aug 2019
+Changes with nginx 1.21.0                                        25 May 2021
+
+    *) Security: 1-byte memory overwrite might occur during DNS server
+       response processing if the "resolver" directive was used, allowing an
+       attacker who is able to forge UDP packets from the DNS server to
+       cause worker process crash or, potentially, arbitrary code execution
+       (CVE-2021-23017).
+
+    *) Feature: variables support in the "proxy_ssl_certificate",
+       "proxy_ssl_certificate_key" "grpc_ssl_certificate",
+       "grpc_ssl_certificate_key", "uwsgi_ssl_certificate", and
+       "uwsgi_ssl_certificate_key" directives.
+
+    *) Feature: the "max_errors" directive in the mail proxy module.
+
+    *) Feature: the mail proxy module supports POP3 and IMAP pipelining.
+
+    *) Feature: the "fastopen" parameter of the "listen" directive in the
+       stream module.
+       Thanks to Anbang Wen.
+
+    *) Bugfix: special characters were not escaped during automatic redirect
+       with appended trailing slash.
+
+    *) Bugfix: connections with clients in the mail proxy module might be
+       closed unexpectedly when using SMTP pipelining.
+
+
+Changes with nginx 1.19.10                                       13 Apr 2021
+
+    *) Change: the default value of the "keepalive_requests" directive was
+       changed to 1000.
+
+    *) Feature: the "keepalive_time" directive.
+
+    *) Feature: the $connection_time variable.
+
+    *) Workaround: "gzip filter failed to use preallocated memory" alerts
+       appeared in logs when using zlib-ng.
+
+
+Changes with nginx 1.19.9                                        30 Mar 2021
+
+    *) Bugfix: nginx could not be built with the mail proxy module, but
+       without the ngx_mail_ssl_module; the bug had appeared in 1.19.8.
+
+    *) Bugfix: "upstream sent response body larger than indicated content
+       length" errors might occur when working with gRPC backends; the bug
+       had appeared in 1.19.1.
+
+    *) Bugfix: nginx might not close a connection till keepalive timeout
+       expiration if the connection was closed by the client while
+       discarding the request body.
+
+    *) Bugfix: nginx might not detect that a connection was already closed
+       by the client when waiting for auth_delay or limit_req delay, or when
+       working with backends.
+
+    *) Bugfix: in the eventport method.
+
+
+Changes with nginx 1.19.8                                        09 Mar 2021
+
+    *) Feature: flags in the "proxy_cookie_flags" directive can now contain
+       variables.
+
+    *) Feature: the "proxy_protocol" parameter of the "listen" directive,
+       the "proxy_protocol" and "set_real_ip_from" directives in mail proxy.
+
+    *) Bugfix: HTTP/2 connections were immediately closed when using
+       "keepalive_timeout 0"; the bug had appeared in 1.19.7.
+
+    *) Bugfix: some errors were logged as unknown if nginx was built with
+       glibc 2.32.
+
+    *) Bugfix: in the eventport method.
+
+
+Changes with nginx 1.19.7                                        16 Feb 2021
+
+    *) Change: connections handling in HTTP/2 has been changed to better
+       match HTTP/1.x; the "http2_recv_timeout", "http2_idle_timeout", and
+       "http2_max_requests" directives have been removed, the
+       "keepalive_timeout" and "keepalive_requests" directives should be
+       used instead.
+
+    *) Change: the "http2_max_field_size" and "http2_max_header_size"
+       directives have been removed, the "large_client_header_buffers"
+       directive should be used instead.
+
+    *) Feature: now, if free worker connections are exhausted, nginx starts
+       closing not only keepalive connections, but also connections in
+       lingering close.
+
+    *) Bugfix: "zero size buf in output" alerts might appear in logs if an
+       upstream server returned an incorrect response during unbuffered
+       proxying; the bug had appeared in 1.19.1.
+
+    *) Bugfix: HEAD requests were handled incorrectly if the "return"
+       directive was used with the "image_filter" or "xslt_stylesheet"
+       directives.
+
+    *) Bugfix: in the "add_trailer" directive.
+
+
+Changes with nginx 1.19.6                                        15 Dec 2020
+
+    *) Bugfix: "no live upstreams" errors if a "server" inside "upstream"
+       block was marked as "down".
+
+    *) Bugfix: a segmentation fault might occur in a worker process if HTTPS
+       was used; the bug had appeared in 1.19.5.
+
+    *) Bugfix: nginx returned the 400 response on requests like
+       "GET http://example.com?args HTTP/1.0".
+
+    *) Bugfix: in the ngx_http_flv_module and ngx_http_mp4_module.
+       Thanks to Chris Newton.
+
+
+Changes with nginx 1.19.5                                        24 Nov 2020
+
+    *) Feature: the -e switch.
+
+    *) Feature: the same source files can now be specified in different
+       modules while building addon modules.
+
+    *) Bugfix: SSL shutdown did not work when lingering close was used.
+
+    *) Bugfix: "upstream sent frame for closed stream" errors might occur
+       when working with gRPC backends.
+
+    *) Bugfix: in request body filters internal API.
+
+
+Changes with nginx 1.19.4                                        27 Oct 2020
+
+    *) Feature: the "ssl_conf_command", "proxy_ssl_conf_command",
+       "grpc_ssl_conf_command", and "uwsgi_ssl_conf_command" directives.
+
+    *) Feature: the "ssl_reject_handshake" directive.
+
+    *) Feature: the "proxy_smtp_auth" directive in mail proxy.
+
+
+Changes with nginx 1.19.3                                        29 Sep 2020
+
+    *) Feature: the ngx_stream_set_module.
+
+    *) Feature: the "proxy_cookie_flags" directive.
+
+    *) Feature: the "userid_flags" directive.
+
+    *) Bugfix: the "stale-if-error" cache control extension was erroneously
+       applied if backend returned a response with status code 500, 502,
+       503, 504, 403, 404, or 429.
+
+    *) Bugfix: "[crit] cache file ... has too long header" messages might
+       appear in logs if caching was used and the backend returned responses
+       with the "Vary" header line.
+
+    *) Workaround: "[crit] SSL_write() failed" messages might appear in logs
+       when using OpenSSL 1.1.1.
+
+    *) Bugfix: "SSL_shutdown() failed (SSL: ... bad write retry)" messages
+       might appear in logs; the bug had appeared in 1.19.2.
+
+    *) Bugfix: a segmentation fault might occur in a worker process when
+       using HTTP/2 if errors with code 400 were redirected to a proxied
+       location using the "error_page" directive.
+
+    *) Bugfix: socket leak when using HTTP/2 and subrequests in the njs
+       module.
+
+
+Changes with nginx 1.19.2                                        11 Aug 2020
+
+    *) Change: now nginx starts closing keepalive connections before all
+       free worker connections are exhausted, and logs a warning about this
+       to the error log.
+
+    *) Change: optimization of client request body reading when using
+       chunked transfer encoding.
+
+    *) Bugfix: memory leak if the "ssl_ocsp" directive was used.
+
+    *) Bugfix: "zero size buf in output" alerts might appear in logs if a
+       FastCGI server returned an incorrect response; the bug had appeared
+       in 1.19.1.
+
+    *) Bugfix: a segmentation fault might occur in a worker process if
+       different large_client_header_buffers sizes were used in different
+       virtual servers.
+
+    *) Bugfix: SSL shutdown might not work.
+
+    *) Bugfix: "SSL_shutdown() failed (SSL: ... bad write retry)" messages
+       might appear in logs.
+
+    *) Bugfix: in the ngx_http_slice_module.
+
+    *) Bugfix: in the ngx_http_xslt_filter_module.
+
+
+Changes with nginx 1.19.1                                        07 Jul 2020
+
+    *) Change: the "lingering_close", "lingering_time", and
+       "lingering_timeout" directives now work when using HTTP/2.
+
+    *) Change: now extra data sent by a backend are always discarded.
+
+    *) Change: now after receiving a too short response from a FastCGI
+       server nginx tries to send the available part of the response to the
+       client, and then closes the client connection.
+
+    *) Change: now after receiving a response with incorrect length from a
+       gRPC backend nginx stops response processing with an error.
+
+    *) Feature: the "min_free" parameter of the "proxy_cache_path",
+       "fastcgi_cache_path", "scgi_cache_path", and "uwsgi_cache_path"
+       directives.
+       Thanks to Adam Bambuch.
+
+    *) Bugfix: nginx did not delete unix domain listen sockets during
+       graceful shutdown on the SIGQUIT signal.
+
+    *) Bugfix: zero length UDP datagrams were not proxied.
+
+    *) Bugfix: proxying to uwsgi backends using SSL might not work.
+       Thanks to Guanzhong Chen.
+
+    *) Bugfix: in error handling when using the "ssl_ocsp" directive.
+
+    *) Bugfix: on XFS and NFS file systems disk cache size might be
+       calculated incorrectly.
+
+    *) Bugfix: "negative size buf in writer" alerts might appear in logs if
+       a memcached server returned a malformed response.
+
+
+Changes with nginx 1.19.0                                        26 May 2020
+
+    *) Feature: client certificate validation with OCSP.
+
+    *) Bugfix: "upstream sent frame for closed stream" errors might occur
+       when working with gRPC backends.
+
+    *) Bugfix: OCSP stapling might not work if the "resolver" directive was
+       not specified.
+
+    *) Bugfix: connections with incorrect HTTP/2 preface were not logged.
+
+
+Changes with nginx 1.17.10                                       14 Apr 2020
+
+    *) Feature: the "auth_delay" directive.
+
+
+Changes with nginx 1.17.9                                        03 Mar 2020
+
+    *) Change: now nginx does not allow several "Host" request header lines.
+
+    *) Bugfix: nginx ignored additional "Transfer-Encoding" request header
+       lines.
+
+    *) Bugfix: socket leak when using HTTP/2.
+
+    *) Bugfix: a segmentation fault might occur in a worker process if OCSP
+       stapling was used.
+
+    *) Bugfix: in the ngx_http_mp4_module.
+
+    *) Bugfix: nginx used status code 494 instead of 400 if errors with code
+       494 were redirected with the "error_page" directive.
+
+    *) Bugfix: socket leak when using subrequests in the njs module and the
+       "aio" directive.
+
+
+Changes with nginx 1.17.8                                        21 Jan 2020
+
+    *) Feature: variables support in the "grpc_pass" directive.
+
+    *) Bugfix: a timeout might occur while handling pipelined requests in an
+       SSL connection; the bug had appeared in 1.17.5.
+
+    *) Bugfix: in the "debug_points" directive when using HTTP/2.
+       Thanks to Daniil Bondarev.
+
+
+Changes with nginx 1.17.7                                        24 Dec 2019
+
+    *) Bugfix: a segmentation fault might occur on start or during
+       reconfiguration if the "rewrite" directive with an empty replacement
+       string was used in the configuration.
+
+    *) Bugfix: a segmentation fault might occur in a worker process if the
+       "break" directive was used with the "alias" directive or with the
+       "proxy_pass" directive with a URI.
+
+    *) Bugfix: the "Location" response header line might contain garbage if
+       the request URI was rewritten to the one containing a null character.
+
+    *) Bugfix: requests with bodies were handled incorrectly when returning
+       redirections with the "error_page" directive; the bug had appeared in
+       0.7.12.
+
+    *) Bugfix: socket leak when using HTTP/2.
+
+    *) Bugfix: a timeout might occur while handling pipelined requests in an
+       SSL connection; the bug had appeared in 1.17.5.
+
+    *) Bugfix: in the ngx_http_dav_module.
+
+
+Changes with nginx 1.17.6                                        19 Nov 2019
+
+    *) Feature: the $proxy_protocol_server_addr and
+       $proxy_protocol_server_port variables.
+
+    *) Feature: the "limit_conn_dry_run" directive.
+
+    *) Feature: the $limit_req_status and $limit_conn_status variables.
+
+
+Changes with nginx 1.17.5                                        22 Oct 2019
+
+    *) Feature: now nginx uses ioctl(FIONREAD), if available, to avoid
+       reading from a fast connection for a long time.
+
+    *) Bugfix: incomplete escaped characters at the end of the request URI
+       were ignored.
+
+    *) Bugfix: "/." and "/.." at the end of the request URI were not
+       normalized.
+
+    *) Bugfix: in the "merge_slashes" directive.
+
+    *) Bugfix: in the "ignore_invalid_headers" directive.
+       Thanks to Alan Kemp.
+
+    *) Bugfix: nginx could not be built with MinGW-w64 gcc 8.1 or newer.
+
+
+Changes with nginx 1.17.4                                        24 Sep 2019
+
+    *) Change: better detection of incorrect client behavior in HTTP/2.
+
+    *) Change: in handling of not fully read client request body when
+       returning errors in HTTP/2.
+
+    *) Bugfix: the "worker_shutdown_timeout" directive might not work when
+       using HTTP/2.
+
+    *) Bugfix: a segmentation fault might occur in a worker process when
+       using HTTP/2 and the "proxy_request_buffering" directive.
+
+    *) Bugfix: the ECONNABORTED error log level was "crit" instead of
+       "error" on Windows when using SSL.
+
+    *) Bugfix: nginx ignored extra data when using chunked transfer
+       encoding.
+
+    *) Bugfix: nginx always returned the 500 error if the "return" directive
+       was used and an error occurred during reading client request body.
+
+    *) Bugfix: in memory allocation error handling.
+
+
+Changes with nginx 1.17.3                                        13 Aug 2019
 
     *) Security: when using HTTP/2 a client might cause excessive memory
        consumption and CPU usage (CVE-2019-9511, CVE-2019-9513,
        CVE-2019-9516).
 
+    *) Bugfix: "zero size buf" alerts might appear in logs when using
+       gzipping; the bug had appeared in 1.17.2.
+
+    *) Bugfix: a segmentation fault might occur in a worker process if the
+       "resolver" directive was used in SMTP proxy.
+
+
+Changes with nginx 1.17.2                                        23 Jul 2019
+
+    *) Change: minimum supported zlib version is 1.2.0.4.
+       Thanks to Ilya Leoshkevich.
 
-Changes with nginx 1.16.0                                        23 Apr 2019
+    *) Change: the $r->internal_redirect() embedded perl method now expects
+       escaped URIs.
+
+    *) Feature: it is now possible to switch to a named location using the
+       $r->internal_redirect() embedded perl method.
+
+    *) Bugfix: in error handling in embedded perl.
+
+    *) Bugfix: a segmentation fault might occur on start or during
+       reconfiguration if hash bucket size larger than 64 kilobytes was used
+       in the configuration.
+
+    *) Bugfix: nginx might hog CPU during unbuffered proxying and when
+       proxying WebSocket connections if the select, poll, or /dev/poll
+       methods were used.
+
+    *) Bugfix: in the ngx_http_xslt_filter_module.
+
+    *) Bugfix: in the ngx_http_ssi_filter_module.
+
+
+Changes with nginx 1.17.1                                        25 Jun 2019
+
+    *) Feature: the "limit_req_dry_run" directive.
+
+    *) Feature: when using the "hash" directive inside the "upstream" block
+       an empty hash key now triggers round-robin balancing.
+       Thanks to Niklas Keller.
+
+    *) Bugfix: a segmentation fault might occur in a worker process if
+       caching was used along with the "image_filter" directive, and errors
+       with code 415 were redirected with the "error_page" directive; the
+       bug had appeared in 1.11.10.
+
+    *) Bugfix: a segmentation fault might occur in a worker process if
+       embedded perl was used; the bug had appeared in 1.7.3.
+
+
+Changes with nginx 1.17.0                                        21 May 2019
+
+    *) Feature: variables support in the "limit_rate" and "limit_rate_after"
+       directives.
+
+    *) Feature: variables support in the "proxy_upload_rate" and
+       "proxy_download_rate" directives in the stream module.
+
+    *) Change: minimum supported OpenSSL version is 0.9.8.
+
+    *) Change: now the postpone filter is always built.
+
+    *) Bugfix: the "include" directive did not work inside the "if" and
+       "limit_except" blocks.
 
-    *) 1.16.x stable branch.
+    *) Bugfix: in byte ranges processing.
 
 
 Changes with nginx 1.15.12                                       16 Apr 2019
diff --git a/CHANGES.ru b/CHANGES.ru
index 5d60f417..224aa048 100644
--- a/CHANGES.ru
+++ b/CHANGES.ru
@@ -1,14 +1,473 @@
 
-Изменения в nginx 1.16.1                                          13.08.2019
+<<<<<<< HEAD
+Изменения в nginx 1.21.0                                          25.05.2021
+
+    *) Безопасность: при использовании директивы resolver во время обработки
+       ответа DNS-сервера могла происходить перезапись одного байта памяти,
+       что позволяло атакующему, имеющему возможность подделывать UDP-пакеты
+       от DNS-сервера, вызвать падение рабочего процесса или, потенциально,
+       выполнение произвольного кода (CVE-2021-23017).
+
+    *) Добавление: директивы proxy_ssl_certificate,
+       proxy_ssl_certificate_key, grpc_ssl_certificate,
+       grpc_ssl_certificate_key, uwsgi_ssl_certificate и
+       uwsgi_ssl_certificate_key поддерживают переменные.
+
+    *) Добавление: директива max_errors в почтовом прокси-сервере.
+
+    *) Добавление: почтовый прокси-сервер поддерживает POP3 и IMAP
+       pipelining.
+
+    *) Добавление: параметр fastopen директивы listen в модуле stream.
+       Спасибо Anbang Wen.
+
+    *) Исправление: специальные символы не экранировались при автоматическом
+       перенаправлении с добавлением завершающего слэша.
+
+    *) Исправление: при использовании SMTP pipelining соединения с клиентами
+       в почтовом прокси-сервере могли неожиданно закрываться.
+
+
+Изменения в nginx 1.19.10                                         13.04.2021
+
+    *) Изменение: в директиве keepalive_requests значение по умолчанию
+       изменено на 1000.
+
+    *) Добавление: директива keepalive_time.
+
+    *) Добавление: переменная $connection_time.
+
+    *) Изменение: при использовании zlib-ng в логах появлялись сообщения
+       "gzip filter failed to use preallocated memory".
+
+
+Изменения в nginx 1.19.9                                          30.03.2021
+
+    *) Исправление: nginx не собирался с почтовым прокси-сервером, но без
+       модуля ngx_mail_ssl_module; ошибка появилась в 1.19.8.
+
+    *) Исправление: при работе с gRPC-бэкендами могли возникать ошибки
+       "upstream sent response body larger than indicated content length";
+       ошибка появилась в 1.19.1.
+
+    *) Исправление: если клиент закрывал соединение в момент отбрасывания
+       тела запроса, nginx мог не закрыть соединение до истечения
+       keepalive-таймаута.
+
+    *) Исправление: при ожидании задержки limit_req или auth_delay, а также
+       при работе с бэкендами nginx мог не обнаружить, что соединение уже
+       закрыто клиентом.
+
+    *) Исправление: в методе обработки соединений eventport.
+
+
+Изменения в nginx 1.19.8                                          09.03.2021
+
+    *) Добавление: в директиве proxy_cookie_flags теперь флаги можно
+       задавать с помощью переменных.
+
+    *) Добавление: параметр proxy_protocol в директиве listen, директивы
+       proxy_protocol и set_real_ip_from в почтовом прокси-сервере.
+
+    *) Исправление: HTTP/2-соединения сразу закрывались при использовании
+       "keepalive_timeout 0"; ошибка появилась в 1.19.7.
+
+    *) Исправление: некоторые ошибки логгировались как неизвестные, если
+       nginx был собран с glibc 2.32.
+
+    *) Исправление: в методе обработки соединений eventport.
+
+
+Изменения в nginx 1.19.7                                          16.02.2021
+
+    *) Изменение: обработка соединений в HTTP/2 была изменена и теперь более
+       соответствует HTTP/1.x; директивы http2_recv_timeout,
+       http2_idle_timeout и http2_max_requests упразднены, вместо них
+       следует использовать директивы keepalive_timeout и
+       keepalive_requests.
+
+    *) Изменение: директивы http2_max_field_size и http2_max_header_size
+       упразднены, вместо них следует использовать директиву
+       large_client_header_buffers.
+
+    *) Добавление: теперь при исчерпании свободных соединений nginx
+       закрывает не только keepalive-соединения, но и соединения в lingering
+       close.
+
+    *) Исправление: в логах могли появляться сообщения "zero size buf in
+       output", если бэкенд возвращал некорректный ответ при
+       небуферизированном проксировании; ошибка появилась в 1.19.1.
+
+    *) Исправление: при использовании директивы return вместе с image_filter
+       или xslt_stylesheet HEAD-запросы обрабатывались некорректно.
+
+    *) Исправление: в директиве add_trailer.
+
+
+Изменения в nginx 1.19.6                                          15.12.2020
+
+    *) Исправление: ошибки "no live upstreams", если server в блоке upstream
+       был помечен как down.
+
+    *) Исправление: при использовании HTTPS в рабочем процессе мог произойти
+       segmentation fault; ошибка появилась в 1.19.5.
+
+    *) Исправление: nginx возвращал ошибку 400 на запросы вида
+       "GET http://example.com?args HTTP/1.0".
+
+    *) Исправление: в модулях ngx_http_flv_module и ngx_http_mp4_module.
+       Спасибо Chris Newton.
+
+
+Изменения в nginx 1.19.5                                          24.11.2020
+
+    *) Добавление: ключ -e.
+
+    *) Добавление: при сборке дополнительных модулей теперь можно указывать
+       одни и те же исходные файлы в разных модулях.
+
+    *) Исправление: SSL shutdown не работал при закрытии соединений с
+       ожиданием дополнительных данных (lingering close).
+
+    *) Исправление: при работе с gRPC-бэкендами могли возникать ошибки
+       "upstream sent frame for closed stream".
+
+    *) Исправление: во внутреннем API для обработки тела запроса.
+
+
+Изменения в nginx 1.19.4                                          27.10.2020
+
+    *) Добавление: директивы ssl_conf_command, proxy_ssl_conf_command,
+       grpc_ssl_conf_command и uwsgi_ssl_conf_command.
+
+    *) Добавление: директива ssl_reject_handshake.
+
+    *) Добавление: директива proxy_smtp_auth в почтовом прокси-сервере.
+
+
+Изменения в nginx 1.19.3                                          29.09.2020
+
+    *) Добавление: модуль ngx_stream_set_module.
+
+    *) Добавление: директива proxy_cookie_flags.
+
+    *) Добавление: директива userid_flags.
+
+    *) Исправление: расширение управления кэшированием stale-if-error
+       ошибочно применялось, если бэкенд возвращал ответ с кодом 500, 502,
+       503, 504, 403, 404 или 429.
+
+    *) Исправление: если использовалось кэширование и бэкенд возвращал
+       ответы с строкой заголовка Vary, в логах могли появляться сообщения
+       "[crit] cache file ... has too long header".
+
+    *) Изменение: при использовании OpenSSL 1.1.1 в логах могли появляться
+       сообщения "[crit] SSL_write() failed".
+
+    *) Исправление: в логах могли появляться сообщения "SSL_shutdown()
+       failed (SSL: ... bad write retry)"; ошибка появилась в 1.19.2.
+
+    *) Исправление: при использовании HTTP/2 в рабочем процессе мог
+       произойти segmentation fault, если ошибки с кодом 400 с помощью
+       директивы error_page перенаправлялись в проксируемый location.
+
+    *) Исправление: утечки сокетов при использовании HTTP/2 и подзапросов в
+       модуле njs.
+
+
+Изменения в nginx 1.19.2                                          11.08.2020
+
+    *) Изменение: теперь nginx начинает закрывать keepalive-соединения, не
+       дожидаясь исчерпания всех свободных соединений, а также пишет об этом
+       предупреждение в лог ошибок.
+
+    *) Изменение: оптимизация чтения тела запроса при использовании chunked
+       transfer encoding.
+
+    *) Исправление: утечки памяти при использовании директивы ssl_ocsp.
+
+    *) Исправление: в логах могли появляться сообщения "zero size buf in
+       output", если FastCGI-сервер возвращал некорректный ответ; ошибка
+       появилась в 1.19.1.
+
+    *) Исправление: в рабочем процессе мог произойти segmentation fault,
+       если размеры large_client_header_buffers отличались в разных
+       виртуальных серверах.
+
+    *) Исправление: SSL shutdown мог не работать.
+
+    *) Исправление: в логах могли появляться сообщения "SSL_shutdown()
+       failed (SSL: ... bad write retry)".
+
+    *) Исправление: в модуле ngx_http_slice_module.
+
+    *) Исправление: в модуле ngx_http_xslt_filter_module.
+
+
+Изменения в nginx 1.19.1                                          07.07.2020
+
+    *) Изменение: директивы lingering_close, lingering_time и
+       lingering_timeout теперь работают при использовании HTTP/2.
+
+    *) Изменение: теперь лишние данные, присланные бэкендом, всегда
+       отбрасываются.
+
+    *) Изменение: теперь при получении слишком короткого ответа от
+       FastCGI-сервера nginx пытается отправить клиенту доступную часть
+       ответа, после чего закрывает соединение с клиентом.
+
+    *) Изменение: теперь при получении ответа некорректной длины от
+       gRPC-бэкенда nginx прекращает обработку ответа с ошибкой.
+
+    *) Добавление: параметр min_free в директивах proxy_cache_path,
+       fastcgi_cache_path, scgi_cache_path и uwsgi_cache_path.
+       Спасибо Adam Bambuch.
+
+    *) Исправление: nginx не удалял unix domain listen-сокеты при плавном
+       завершении по сигналу SIGQUIT.
+
+    *) Исправление: UDP-пакеты нулевого размера не проксировались.
+
+    *) Исправление: проксирование на uwsgi-бэкенды с использованием SSL
+       могло не работать.
+       Спасибо Guanzhong Chen.
+
+    *) Исправление: в обработке ошибок при использовании директивы ssl_ocsp.
+
+    *) Исправление: при использовании файловых систем XFS и NFS размер кэша
+       на диске мог считаться некорректно.
+
+    *) Исправление: если сервер memcached возвращал некорректный ответ, в
+       логах могли появляться сообщения "negative size buf in writer".
+
+
+Изменения в nginx 1.19.0                                          26.05.2020
+
+    *) Добавление: проверка клиентских сертификатов с помощью OCSP.
+
+    *) Исправление: при работе с gRPC-бэкендами могли возникать ошибки
+       "upstream sent frame for closed stream".
+
+    *) Исправление: OCSP stapling мог не работать, если не была указана
+       директива resolver.
+
+    *) Исправление: соединения с некорректным HTTP/2 preface не
+       логгировались.
+
+
+Изменения в nginx 1.17.10                                         14.04.2020
+
+    *) Добавление: директива auth_delay.
+
+
+Изменения в nginx 1.17.9                                          03.03.2020
+
+    *) Изменение: теперь nginx не разрешает несколько строк "Host" в
+       заголовке запроса.
+
+    *) Исправление: nginx игнорировал дополнительные строки
+       "Transfer-Encoding" в заголовке запроса.
+
+=======
+Изменения в nginx 1.18.0                                          21.04.2020
+
+    *) Стабильная ветка 1.18.x.
+
+
+Изменения в nginx 1.17.10                                         14.04.2020
+
+    *) Добавление: директива auth_delay.
+
+
+Изменения в nginx 1.17.9                                          03.03.2020
+
+    *) Изменение: теперь nginx не разрешает несколько строк "Host" в
+       заголовке запроса.
+
+    *) Исправление: nginx игнорировал дополнительные строки
+       "Transfer-Encoding" в заголовке запроса.
+
+>>>>>>> debian/1.18.0-5
+    *) Исправление: утечки сокетов при использовании HTTP/2.
+
+    *) Исправление: в рабочем процессе мог произойти segmentation fault,
+       если использовался OCSP stapling.
+
+    *) Исправление: в модуле ngx_http_mp4_module.
+
+    *) Исправление: при перенаправлении ошибок с кодом 494 с помощью
+       директивы error_page nginx возвращал ответ с кодом 494 вместо 400.
+
+    *) Исправление: утечки сокетов при использовании подзапросов в модуле
+       njs и директивы aio.
+
+
+Изменения в nginx 1.17.8                                          21.01.2020
+
+    *) Добавление: директива grpc_pass поддерживает переменные.
+
+    *) Исправление: при обработке pipelined-запросов по SSL-соединению мог
+       произойти таймаут; ошибка появилась в 1.17.5.
+
+    *) Исправление: в директиве debug_points при использовании HTTP/2.
+       Спасибо Даниилу Бондареву.
+
+
+Изменения в nginx 1.17.7                                          24.12.2019
+
+    *) Исправление: на старте или во время переконфигурации мог произойти
+       segmentation fault, если в конфигурации использовалась директива
+       rewrite с пустой строкой замены.
+
+    *) Исправление: в рабочем процессе мог произойти segmentation fault,
+       если директива break использовалась совместно с директивой alias или
+       директивой proxy_pass с URI.
+
+    *) Исправление: строка Location заголовка ответа могла содержать мусор,
+       если URI запроса был изменён на URI, содержащий нулевой символ.
+
+    *) Исправление: при возврате перенаправлений с помощью директивы
+       error_page запросы с телом обрабатывались некорректно; ошибка
+       появилась в 0.7.12.
+
+    *) Исправление: утечки сокетов при использовании HTTP/2.
+
+    *) Исправление: при обработке pipelined-запросов по SSL-соединению мог
+       произойти таймаут; ошибка появилась в 1.17.5.
+
+    *) Исправление: в модуле ngx_http_dav_module.
+
+
+Изменения в nginx 1.17.6                                          19.11.2019
+
+    *) Добавление: переменные $proxy_protocol_server_addr и
+       $proxy_protocol_server_port.
+
+    *) Добавление: директива limit_conn_dry_run.
+
+    *) Добавление: переменные $limit_req_status и $limit_conn_status.
+
+
+Изменения в nginx 1.17.5                                          22.10.2019
+
+    *) Добавление: теперь nginx использует вызов ioctl(FIONREAD), если он
+       доступен, чтобы избежать чтения из быстрого соединения в течение
+       долгого времени.
+
+    *) Исправление: неполные закодированные символы в конце URI запроса
+       игнорировались.
+
+    *) Исправление: "/." и "/.." в конце URI запроса не нормализовывались.
+
+    *) Исправление: в директиве merge_slashes.
+
+    *) Исправление: в директиве ignore_invalid_headers.
+       Спасибо Alan Kemp.
+
+    *) Исправление: nginx не собирался с MinGW-w64 gcc 8.1 и новее.
+
+
+Изменения в nginx 1.17.4                                          24.09.2019
+
+    *) Изменение: улучшено детектирование некорректного поведения клиентов в
+       HTTP/2.
+
+    *) Изменение: в обработке непрочитанного тела запроса при возврате
+       ошибок в HTTP/2.
+
+    *) Исправление: директива worker_shutdown_timeout могла не работать при
+       использовании HTTP/2.
+
+    *) Исправление: при использовании HTTP/2 и директивы
+       proxy_request_buffering в рабочем процессе мог произойти segmentation
+       fault.
+
+    *) Исправление: на Windows при использовании SSL уровень записи в лог
+       ошибки ECONNABORTED был "crit" вместо "error".
+
+    *) Исправление: nginx игнорировал лишние данные при использовании
+       chunked transfer encoding.
+
+    *) Исправление: если использовалась директива return и при чтении тела
+       запроса возникала ошибка, nginx всегда возвращал ошибку 500.
+
+    *) Исправление: в обработке ошибок выделения памяти.
+
+
+Изменения в nginx 1.17.3                                          13.08.2019
 
     *) Безопасность: при использовании HTTP/2 клиент мог вызвать чрезмерное
        потребление памяти и ресурсов процессора (CVE-2019-9511,
        CVE-2019-9513, CVE-2019-9516).
 
+    *) Исправление: при использовании сжатия в логах могли появляться
+       сообщения "zero size buf"; ошибка появилась в 1.17.2.
+
+    *) Исправление: при использовании директивы resolver в SMTP
+       прокси-сервере в рабочем процессе мог произойти segmentation fault.
+
+
+Изменения в nginx 1.17.2                                          23.07.2019
+
+    *) Изменение: минимальная поддерживаемая версия zlib - 1.2.0.4.
+       Спасибо Илье Леошкевичу.
+
+    *) Изменение: метод $r->internal_redirect() встроенного перла теперь
+       ожидает закодированный URI.
+
+    *) Добавление: теперь с помощью метода $r->internal_redirect()
+       встроенного перла можно перейти в именованный location.
+
+    *) Исправление: в обработке ошибок во встроенном перле.
+
+    *) Исправление: на старте или во время переконфигурации мог произойти
+       segmentation fault, если в конфигурации использовалось значение hash
+       bucket size больше 64 килобайт.
+
+    *) Исправление: при использовании методов обработки соединений select,
+       poll и /dev/poll nginx мог нагружать процессор во время
+       небуферизованного проксирования и при проксировании
+       WebSocket-соединений.
+
+    *) Исправление: в модуле ngx_http_xslt_filter_module.
+
+    *) Исправление: в модуле ngx_http_ssi_filter_module.
+
+
+Изменения в nginx 1.17.1                                          25.06.2019
+
+    *) Добавление: директива limit_req_dry_run.
 
-Изменения в nginx 1.16.0                                          23.04.2019
+    *) Добавление: при использовании директивы hash в блоке upstream пустой
+       ключ хэширования теперь приводит к переключению на round-robin
+       балансировку.
+       Спасибо Niklas Keller.
 
-    *) Стабильная ветка 1.16.x.
+    *) Исправление: в рабочем процессе мог произойти segmentation fault,
+       если использовалось кэширование и директива image_filter, а ошибки с
+       кодом 415 перенаправлялись с помощью директивы error_page; ошибка
+       появилась в 1.11.10.
+
+    *) Исправление: в рабочем процессе мог произойти segmentation fault,
+       если использовался встроенный перл; ошибка появилась в 1.7.3.
+
+
+Изменения в nginx 1.17.0                                          21.05.2019
+
+    *) Добавление: директивы limit_rate и limit_rate_after поддерживают
+       переменные.
+
+    *) Добавление: директивы proxy_upload_rate и proxy_download_rate в
+       модуле stream поддерживают переменные.
+
+    *) Изменение: минимальная поддерживаемая версия OpenSSL - 0.9.8.
+
+    *) Изменение: теперь postpone-фильтр собирается всегда.
+
+    *) Исправление: директива include не работала в блоках if и
+       limit_except.
+
+    *) Исправление: в обработке byte ranges.
 
 
 Изменения в nginx 1.15.12                                         16.04.2019
@@ -154,6 +613,60 @@
 
     *) Изменение: уровень логгирования ошибок SSL "no suitable key share" и
        "no suitable signature algorithm" понижен с уровня crit до info.
+<<<<<<< HEAD
+
+
+Изменения в nginx 1.15.3                                          28.08.2018
+
+    *) Добавление: теперь TLSv1.3 можно использовать с BoringSSL.
+
+    *) Добавление: директива ssl_early_data, сейчас доступна при
+       использовании BoringSSL.
+
+    *) Добавление: директивы keepalive_timeout и keepalive_requests в блоке
+       upstream.
+
+    *) Исправление: модуль ngx_http_dav_module при копировании файла поверх
+       существующего файла с помощью метода COPY не обнулял целевой файл.
+
+    *) Исправление: модуль ngx_http_dav_module при перемещении файла между
+       файловыми системами с помощью метода MOVE устанавливал нулевые права
+       доступа на результирующий файл и не сохранял время изменения файла.
+
+    *) Исправление: модуль ngx_http_dav_module при копировании файла с
+       помощью метода COPY для результирующего файла использовал права
+       доступа по умолчанию.
+
+    *) Изменение: некоторые клиенты могли не работать при использовании
+       HTTP/2; ошибка появилась в 1.13.5.
+
+    *) Исправление: nginx не собирался с LibreSSL 2.8.0.
+
+
+Изменения в nginx 1.15.2                                          24.07.2018
+
+    *) Добавление: переменная $ssl_preread_protocol в модуле
+       ngx_stream_ssl_preread_module.
+
+    *) Добавление: теперь при использовании директивы
+       reset_timedout_connection nginx сбрасывает соединения, закрываемые с
+       кодом 444.
+
+    *) Изменение: уровень логгирования ошибок SSL "http request", "https
+       proxy request", "unsupported protocol" и "version too low" понижен с
+       уровня crit до info.
+
+    *) Исправление: запросы к DNS-серверу не отправлялись повторно, если при
+       первой попытке отправки происходила ошибка.
+
+    *) Исправление: параметр reuseport директивы listen игнорировался, если
+       количество рабочих процессов было задано после директивы listen.
+
+    *) Исправление: при использовании OpenSSL 1.1.0 и новее директиву
+       ssl_prefer_server_ciphers нельзя было выключить в виртуальном
+       сервере, если она была включена в сервере по умолчанию.
+
+=======
 
 
 Изменения в nginx 1.15.3                                          28.08.2018
@@ -206,6 +719,7 @@
        ssl_prefer_server_ciphers нельзя было выключить в виртуальном
        сервере, если она была включена в сервере по умолчанию.
 
+>>>>>>> debian/1.18.0-5
     *) Исправление: повторное использование SSL-сессий к бэкендам не
        работало с протоколом TLS 1.3.
 
diff --git a/LICENSE b/LICENSE
index c63e0ba4..b1c558b5 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,11 @@
 /* 
+<<<<<<< HEAD
+ * Copyright (C) 2002-2021 Igor Sysoev
+ * Copyright (C) 2011-2021 Nginx, Inc.
+=======
  * Copyright (C) 2002-2019 Igor Sysoev
  * Copyright (C) 2011-2019 Nginx, Inc.
+>>>>>>> debian/1.18.0-5
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/auto/init b/auto/init
index 910f5294..f816dfc4 100644
--- a/auto/init
+++ b/auto/init
@@ -48,4 +48,6 @@ default:	build
 
 clean:
 	rm -rf Makefile $NGX_OBJS
+
+.PHONY:	default clean
 END
diff --git a/auto/install b/auto/install
index d884487a..c764fdd2 100644
--- a/auto/install
+++ b/auto/install
@@ -215,4 +215,6 @@ upgrade:
 	test -f $NGX_PID_PATH.oldbin
 
 	kill -QUIT \`cat $NGX_PID_PATH.oldbin\`
+
+.PHONY:	build install modules upgrade
 END
diff --git a/auto/make b/auto/make
index 34c40cdd..ef7c9f69 100644
--- a/auto/make
+++ b/auto/make
@@ -313,7 +313,7 @@ $ngx_obj:	\$(CORE_DEPS) \$(HTTP_DEPS)$ngx_cont$ngx_src
 END
 
         fi
-     done
+    done
 
 fi
 
@@ -343,7 +343,7 @@ $ngx_obj:	\$(CORE_DEPS) \$(MAIL_DEPS)$ngx_cont$ngx_src
 	$ngx_cc$ngx_tab$ngx_objout$ngx_obj$ngx_tab$ngx_src$NGX_AUX
 
 END
-     done
+    done
 
 fi
 
@@ -373,7 +373,7 @@ $ngx_obj:	\$(CORE_DEPS) \$(STREAM_DEPS)$ngx_cont$ngx_src
 	$ngx_cc$ngx_tab$ngx_objout$ngx_obj$ngx_tab$ngx_src$NGX_AUX
 
 END
-     done
+    done
 
 fi
 
@@ -399,7 +399,7 @@ $ngx_obj:	\$(CORE_DEPS) $ngx_cont$ngx_src
 	$ngx_cc$ngx_tab$ngx_objout$ngx_obj$ngx_tab$ngx_src$NGX_AUX
 
 END
-     done
+    done
 
 fi
 
@@ -431,7 +431,7 @@ $ngx_obj:	\$(ADDON_DEPS)$ngx_cont$ngx_src
 	$ngx_cc$ngx_tab$ngx_objout$ngx_obj$ngx_tab$ngx_src$NGX_AUX
 
 END
-     done
+    done
 
 fi
 
@@ -502,6 +502,7 @@ fi
 for ngx_module in $DYNAMIC_MODULES
 do
     eval ngx_module_srcs="\$${ngx_module}_SRCS"
+    eval ngx_module_shrd="\$${ngx_module}_SHRD"
     eval eval ngx_module_libs="\\\"\$${ngx_module}_LIBS\\\""
 
     eval ngx_module_modules="\$${ngx_module}_MODULES"
@@ -567,7 +568,7 @@ END
         | sed -e "s/\(.*\.\)c/\1$ngx_objext/"`
 
     ngx_module_objs=
-    for ngx_src in $ngx_module_srcs
+    for ngx_src in $ngx_module_srcs $ngx_module_shrd
     do
         case "$ngx_src" in
             src/*)
diff --git a/auto/module b/auto/module
index a2b578db..3857d04c 100644
--- a/auto/module
+++ b/auto/module
@@ -17,7 +17,6 @@ if [ "$ngx_module_link" = DYNAMIC ]; then
     done
 
     DYNAMIC_MODULES="$DYNAMIC_MODULES $ngx_module"
-    eval ${ngx_module}_SRCS=\"$ngx_module_srcs\"
 
     eval ${ngx_module}_MODULES=\"$ngx_module_name\"
 
@@ -31,6 +30,30 @@ if [ "$ngx_module_link" = DYNAMIC ]; then
         eval ${ngx_module}_ORDER=\"$ngx_module_order\"
     fi
 
+    srcs=
+    shrd=
+    for src in $ngx_module_srcs
+    do
+        found=no
+        for old in $DYNAMIC_MODULES_SRCS
+        do
+            if [ $src = $old ]; then
+                found=yes
+                break
+            fi
+        done
+
+        if [ $found = no ]; then
+            srcs="$srcs $src"
+        else
+            shrd="$shrd $src"
+        fi
+    done
+    eval ${ngx_module}_SRCS=\"$srcs\"
+    eval ${ngx_module}_SHRD=\"$shrd\"
+
+    DYNAMIC_MODULES_SRCS="$DYNAMIC_MODULES_SRCS $srcs"
+
     if test -n "$ngx_module_incs"; then
         CORE_INCS="$CORE_INCS $ngx_module_incs"
     fi
@@ -107,7 +130,24 @@ elif [ "$ngx_module_link" = ADDON ]; then
     eval ${ngx_module_type}_MODULES=\"\$${ngx_module_type}_MODULES \
                                       $ngx_module_name\"
 
-    NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_module_srcs"
+    srcs=
+    for src in $ngx_module_srcs
+    do
+        found=no
+        for old in $NGX_ADDON_SRCS
+        do
+            if [ $src = $old ]; then
+                found=yes
+                break
+            fi
+        done
+
+        if [ $found = no ]; then
+            srcs="$srcs $src"
+        fi
+    done
+
+    NGX_ADDON_SRCS="$NGX_ADDON_SRCS $srcs"
 
     if test -n "$ngx_module_incs"; then
         eval ${ngx_var}_INCS=\"\$${ngx_var}_INCS $ngx_module_incs\"
diff --git a/auto/modules b/auto/modules
index 09bfcb08..f5a45978 100644
--- a/auto/modules
+++ b/auto/modules
@@ -102,21 +102,6 @@ if [ $HTTP = YES ]; then
     fi
 
 
-    if [ $HTTP_SSI = YES ]; then
-        HTTP_POSTPONE=YES
-    fi
-
-
-    if [ $HTTP_SLICE = YES ]; then
-        HTTP_POSTPONE=YES
-    fi
-
-
-    if [ $HTTP_ADDITION = YES ]; then
-        HTTP_POSTPONE=YES
-    fi
-
-
     # the module order is important
     #     ngx_http_static_module
     #     ngx_http_gzip_static_module
@@ -252,13 +237,13 @@ if [ $HTTP = YES ]; then
         . auto/module
     fi
 
-    if [ $HTTP_POSTPONE = YES ]; then
+    if :; then
         ngx_module_name=ngx_http_postpone_filter_module
         ngx_module_incs=
         ngx_module_deps=
         ngx_module_srcs=src/http/ngx_http_postpone_filter_module.c
         ngx_module_libs=
-        ngx_module_link=$HTTP_POSTPONE
+        ngx_module_link=YES
 
         . auto/module
     fi
@@ -1000,6 +985,12 @@ if [ $MAIL != NO ]; then
     ngx_module_srcs=src/mail/ngx_mail_proxy_module.c
 
     . auto/module
+
+    ngx_module_name=ngx_mail_realip_module
+    ngx_module_deps=
+    ngx_module_srcs=src/mail/ngx_mail_realip_module.c
+
+    . auto/module
 fi
 
 
@@ -1134,6 +1125,16 @@ if [ $STREAM != NO ]; then
         . auto/module
     fi
 
+    if [ $STREAM_SET = YES ]; then
+        ngx_module_name=ngx_stream_set_module
+        ngx_module_deps=
+        ngx_module_srcs=src/stream/ngx_stream_set_module.c
+        ngx_module_libs=
+        ngx_module_link=$STREAM_SET
+
+        . auto/module
+    fi
+
     if [ $STREAM_UPSTREAM_HASH = YES ]; then
         ngx_module_name=ngx_stream_upstream_hash_module
         ngx_module_deps=
diff --git a/auto/options b/auto/options
index d8b421b0..80be906e 100644
--- a/auto/options
+++ b/auto/options
@@ -60,7 +60,6 @@ HTTP_GZIP=YES
 HTTP_SSL=NO
 HTTP_V2=NO
 HTTP_SSI=YES
-HTTP_POSTPONE=NO
 HTTP_REALIP=NO
 HTTP_XSLT=NO
 HTTP_IMAGE_FILTER=NO
@@ -125,6 +124,7 @@ STREAM_GEOIP=NO
 STREAM_MAP=YES
 STREAM_SPLIT_CLIENTS=YES
 STREAM_RETURN=YES
+STREAM_SET=YES
 STREAM_UPSTREAM_HASH=YES
 STREAM_UPSTREAM_LEAST_CONN=YES
 STREAM_UPSTREAM_RANDOM=YES
@@ -132,8 +132,10 @@ STREAM_UPSTREAM_ZONE=YES
 STREAM_SSL_PREREAD=NO
 
 DYNAMIC_MODULES=
+DYNAMIC_MODULES_SRCS=
 
 NGX_ADDONS=
+NGX_ADDON_SRCS=
 NGX_ADDON_DEPS=
 DYNAMIC_ADDONS=
 
@@ -325,6 +327,7 @@ use the \"--with-mail_ssl_module\" option instead"
         --without-stream_split_clients_module)
                                          STREAM_SPLIT_CLIENTS=NO    ;;
         --without-stream_return_module)  STREAM_RETURN=NO           ;;
+        --without-stream_set_module)     STREAM_SET=NO              ;;
         --without-stream_upstream_hash_module)
                                          STREAM_UPSTREAM_HASH=NO    ;;
         --without-stream_upstream_least_conn_module)
@@ -539,6 +542,7 @@ cat << END
   --without-stream_split_clients_module
                                      disable ngx_stream_split_clients_module
   --without-stream_return_module     disable ngx_stream_return_module
+  --without-stream_set_module        disable ngx_stream_set_module
   --without-stream_upstream_hash_module
                                      disable ngx_stream_upstream_hash_module
   --without-stream_upstream_least_conn_module
diff --git a/auto/os/linux b/auto/os/linux
index 5e280eca..74b58702 100644
--- a/auto/os/linux
+++ b/auto/os/linux
@@ -86,6 +86,31 @@ if [ $ngx_found = yes ]; then
                       ee.data.ptr = NULL;
                       epoll_ctl(efd, EPOLL_CTL_ADD, fd, &ee)"
     . auto/feature
+
+
+    # eventfd()
+
+    ngx_feature="eventfd()"
+    ngx_feature_name="NGX_HAVE_EVENTFD"
+    ngx_feature_run=no
+    ngx_feature_incs="#include <sys/eventfd.h>"
+    ngx_feature_path=
+    ngx_feature_libs=
+    ngx_feature_test="(void) eventfd(0, 0)"
+    . auto/feature
+
+    if [ $ngx_found = yes ]; then
+        have=NGX_HAVE_SYS_EVENTFD_H . auto/have
+    fi
+
+
+    if [ $ngx_found = no ]; then
+
+        ngx_feature="eventfd() (SYS_eventfd)"
+        ngx_feature_incs="#include <sys/syscall.h>"
+        ngx_feature_test="(void) SYS_eventfd"
+        . auto/feature
+    fi
 fi
 
 
diff --git a/auto/unix b/auto/unix
index 43d3b25a..86710198 100644
--- a/auto/unix
+++ b/auto/unix
@@ -582,29 +582,6 @@ Currently file AIO is supported on FreeBSD 4.3+ and Linux 2.6.22+ only
 END
         exit 1
     fi
-
-else
-
-    ngx_feature="eventfd()"
-    ngx_feature_name="NGX_HAVE_EVENTFD"
-    ngx_feature_run=no
-    ngx_feature_incs="#include <sys/eventfd.h>"
-    ngx_feature_path=
-    ngx_feature_libs=
-    ngx_feature_test="(void) eventfd(0, 0)"
-    . auto/feature
-
-    if [ $ngx_found = yes ]; then
-        have=NGX_HAVE_SYS_EVENTFD_H . auto/have
-    fi
-
-    if [ $ngx_found = no ]; then
-
-        ngx_feature="eventfd() (SYS_eventfd)"
-        ngx_feature_incs="#include <sys/syscall.h>"
-        ngx_feature_test="(void) SYS_eventfd"
-        . auto/feature
-    fi
 fi
 
 
@@ -727,56 +704,44 @@ ngx_feature_test="char buf[1]; struct iovec vec[1]; ssize_t n;
 . auto/feature
 
 
-ngx_feature="sys_nerr"
-ngx_feature_name="NGX_SYS_NERR"
-ngx_feature_run=value
-ngx_feature_incs='#include <errno.h>
-                  #include <stdio.h>'
+# strerrordesc_np(), introduced in glibc 2.32
+
+ngx_feature="strerrordesc_np()"
+ngx_feature_name="NGX_HAVE_STRERRORDESC_NP"
+ngx_feature_run=no
+ngx_feature_incs='#include <string.h>'
 ngx_feature_path=
 ngx_feature_libs=
-ngx_feature_test='printf("%d", sys_nerr);'
+ngx_feature_test="char *p; p = strerrordesc_np(0);
+                  if (p == NULL) return 1"
 . auto/feature
 
 
 if [ $ngx_found = no ]; then
 
-    # Cygiwn defines _sys_nerr
-    ngx_feature="_sys_nerr"
+    ngx_feature="sys_nerr"
     ngx_feature_name="NGX_SYS_NERR"
     ngx_feature_run=value
     ngx_feature_incs='#include <errno.h>
                       #include <stdio.h>'
     ngx_feature_path=
     ngx_feature_libs=
-    ngx_feature_test='printf("%d", _sys_nerr);'
+    ngx_feature_test='printf("%d", sys_nerr);'
     . auto/feature
 fi
 
 
 if [ $ngx_found = no ]; then
 
-    # Solaris has no sys_nerr
-    ngx_feature='maximum errno'
-    ngx_feature_name=NGX_SYS_NERR
+    # Cygiwn defines _sys_nerr
+    ngx_feature="_sys_nerr"
+    ngx_feature_name="NGX_SYS_NERR"
     ngx_feature_run=value
     ngx_feature_incs='#include <errno.h>
-                      #include <string.h>
                       #include <stdio.h>'
     ngx_feature_path=
     ngx_feature_libs=
-    ngx_feature_test='int  n;
-                      char *p;
-                      for (n = 1; n < 1000; n++) {
-                          errno = 0;
-                          p = strerror(n);
-                          if (errno == EINVAL
-                              || p == NULL
-                              || strncmp(p, "Unknown error", 13) == 0)
-                          {
-                              break;
-                          }
-                      }
-                      printf("%d", n);'
+    ngx_feature_test='printf("%d", _sys_nerr);'
     . auto/feature
 fi
 
@@ -943,6 +908,18 @@ ngx_feature_test="int i = FIONBIO; printf(\"%d\", i)"
 . auto/feature
 
 
+ngx_feature="ioctl(FIONREAD)"
+ngx_feature_name="NGX_HAVE_FIONREAD"
+ngx_feature_run=no
+ngx_feature_incs="#include <sys/ioctl.h>
+                  #include <stdio.h>
+                  $NGX_INCLUDE_SYS_FILIO_H"
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_test="int i = FIONREAD; printf(\"%d\", i)"
+. auto/feature
+
+
 ngx_feature="struct tm.tm_gmtoff"
 ngx_feature_name="NGX_HAVE_GMTOFF"
 ngx_feature_run=no
diff --git a/conf/mime.types b/conf/mime.types
index 29612569..b53f7f7e 100644
--- a/conf/mime.types
+++ b/conf/mime.types
@@ -51,6 +51,7 @@ types {
     application/vnd.openxmlformats-officedocument.wordprocessingml.document
                                                      docx;
     application/vnd.wap.wmlc                         wmlc;
+    application/wasm                                 wasm;
     application/x-7z-compressed                      7z;
     application/x-cocoa                              cco;
     application/x-java-archive-diff                  jardiff;
diff --git a/configure b/configure
index 7e6e33a7..b7c507a7 100755
--- a/configure
+++ b/configure
@@ -58,6 +58,10 @@ if [ "$NGX_PLATFORM" != win32 ]; then
     . auto/unix
 fi
 
+# Debian
+# Make sure signature stays the same on all nginx flavors
+have=NGX_HTTP_HEADERS . auto/have
+
 . auto/threads
 . auto/modules
 . auto/lib/conf
@@ -87,6 +91,10 @@ have=NGX_PID_PATH value="\"$NGX_PID_PATH\"" . auto/define
 have=NGX_LOCK_PATH value="\"$NGX_LOCK_PATH\"" . auto/define
 have=NGX_ERROR_LOG_PATH value="\"$NGX_ERROR_LOG_PATH\"" . auto/define
 
+if [ ".$NGX_ERROR_LOG_PATH" = "." ]; then
+    have=NGX_ERROR_LOG_STDERR . auto/have
+fi
+
 have=NGX_HTTP_LOG_PATH value="\"$NGX_HTTP_LOG_PATH\"" . auto/define
 have=NGX_HTTP_CLIENT_TEMP_PATH value="\"$NGX_HTTP_CLIENT_TEMP_PATH\""
 . auto/define
diff --git a/contrib/vim/syntax/nginx.vim b/contrib/vim/syntax/nginx.vim
index 6bee7a2e..1a3a7b7d 100644
--- a/contrib/vim/syntax/nginx.vim
+++ b/contrib/vim/syntax/nginx.vim
@@ -333,6 +333,7 @@ syn keyword ngxDirective contained js_access
 syn keyword ngxDirective contained js_content
 syn keyword ngxDirective contained js_filter
 syn keyword ngxDirective contained js_include
+syn keyword ngxDirective contained js_path
 syn keyword ngxDirective contained js_preread
 syn keyword ngxDirective contained js_set
 syn keyword ngxDirective contained keepalive
@@ -353,6 +354,7 @@ syn keyword ngxDirective contained limit_conn_zone
 syn keyword ngxDirective contained limit_rate
 syn keyword ngxDirective contained limit_rate_after
 syn keyword ngxDirective contained limit_req
+syn keyword ngxDirective contained limit_req_dry_run
 syn keyword ngxDirective contained limit_req_log_level
 syn keyword ngxDirective contained limit_req_status
 syn keyword ngxDirective contained limit_req_zone
@@ -472,6 +474,7 @@ syn keyword ngxDirective contained proxy_requests
 syn keyword ngxDirective contained proxy_responses
 syn keyword ngxDirective contained proxy_send_lowat
 syn keyword ngxDirective contained proxy_send_timeout
+syn keyword ngxDirective contained proxy_session_drop
 syn keyword ngxDirective contained proxy_set_body
 syn keyword ngxDirective contained proxy_set_header
 syn keyword ngxDirective contained proxy_socket_keepalive
@@ -1325,6 +1328,7 @@ syn keyword ngxDirectiveThirdParty contained lua_check_client_abort
 syn keyword ngxDirectiveThirdParty contained lua_code_cache
 syn keyword ngxDirectiveThirdParty contained lua_fake_shm
 syn keyword ngxDirectiveThirdParty contained lua_http10_buffering
+syn keyword ngxDirectiveThirdParty contained lua_load_resty_core
 syn keyword ngxDirectiveThirdParty contained lua_malloc_trim
 syn keyword ngxDirectiveThirdParty contained lua_max_pending_timers
 syn keyword ngxDirectiveThirdParty contained lua_max_running_timers
@@ -1779,6 +1783,7 @@ syn keyword ngxDirectiveThirdParty contained vod_expires_live_time_dependent
 syn keyword ngxDirectiveThirdParty contained vod_fallback_upstream_location
 syn keyword ngxDirectiveThirdParty contained vod_force_continuous_timestamps
 syn keyword ngxDirectiveThirdParty contained vod_force_playlist_type_vod
+syn keyword ngxDirectiveThirdParty contained vod_force_sequence_index
 syn keyword ngxDirectiveThirdParty contained vod_gop_look_ahead
 syn keyword ngxDirectiveThirdParty contained vod_gop_look_behind
 syn keyword ngxDirectiveThirdParty contained vod_ignore_edit_list
diff --git a/debian/changelog b/debian/changelog
index a692f860..b2c8dc3d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,28 +1,11 @@
-nginx (1.16.1-2) unstable; urgency=medium
-
-  * http-lua: Downgrade to 0.10.13 (Closes: #941917)
-    Temporary fix FTBFS on architectures where Luajit is not available.
-
- -- Christos Trochalakis <ctrochalakis@debian.org>  Sat, 12 Oct 2019 17:59:23 +0300
-
-nginx (1.16.1-1) unstable; urgency=medium
-
-  * New upstream version (Closes: #929200)
-  * Follow stable 1.16 releases (Closes: #929199)
-  * Drop already included debian patches
-  * http-ndk: Upgrade to 0.3.1
-  * http-lua: Upgrade to 0.10.15
-
- -- Christos Trochalakis <ctrochalakis@debian.org>  Mon, 09 Sep 2019 18:24:43 +0300
-
-nginx (1.14.2-3) unstable; urgency=high
+nginx (1.14.2-2+deb10u1) buster-security; urgency=high
 
   * Backport upstream fixes for 3 CVEs (Closes: #935037)
     Those fixes affect Nginx HTTP/2 implementation, which might cause
     excessive memory consumption and CPU usage.
     (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516).
 
- -- Christos Trochalakis <ctrochalakis@debian.org>  Mon, 19 Aug 2019 11:30:08 +0300
+ -- Christos Trochalakis <ctrochalakis@debian.org>  Tue, 13 Aug 2019 21:10:28 +0300
 
 nginx (1.14.2-2) unstable; urgency=medium
 
diff --git a/debian/compat b/debian/compat
deleted file mode 100644
index f599e28b..00000000
--- a/debian/compat
+++ /dev/null
@@ -1 +0,0 @@
-10
diff --git a/debian/conf/fastcgi.conf b/debian/conf/fastcgi.conf
index 091738c6..d53a628d 100644
--- a/debian/conf/fastcgi.conf
+++ b/debian/conf/fastcgi.conf
@@ -18,6 +18,7 @@ fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
 
 fastcgi_param  REMOTE_ADDR        $remote_addr;
 fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  REMOTE_USER        $remote_user;
 fastcgi_param  SERVER_ADDR        $server_addr;
 fastcgi_param  SERVER_PORT        $server_port;
 fastcgi_param  SERVER_NAME        $server_name;
diff --git a/debian/conf/fastcgi_params b/debian/conf/fastcgi_params
index 28decb95..69c43877 100644
--- a/debian/conf/fastcgi_params
+++ b/debian/conf/fastcgi_params
@@ -17,6 +17,7 @@ fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
 
 fastcgi_param  REMOTE_ADDR        $remote_addr;
 fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  REMOTE_USER        $remote_user;
 fastcgi_param  SERVER_ADDR        $server_addr;
 fastcgi_param  SERVER_PORT        $server_port;
 fastcgi_param  SERVER_NAME        $server_name;
diff --git a/debian/conf/nginx.conf b/debian/conf/nginx.conf
index 132f680d..136753ea 100644
--- a/debian/conf/nginx.conf
+++ b/debian/conf/nginx.conf
@@ -16,8 +16,6 @@ http {
 
 	sendfile on;
 	tcp_nopush on;
-	tcp_nodelay on;
-	keepalive_timeout 65;
 	types_hash_max_size 2048;
 	# server_tokens off;
 
@@ -31,7 +29,7 @@ http {
 	# SSL Settings
 	##
 
-	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
 	ssl_prefer_server_ciphers on;
 
 	##
@@ -66,17 +64,17 @@ http {
 #mail {
 #	# See sample authentication script at:
 #	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
-# 
+#
 #	# auth_http localhost/auth.php;
 #	# pop3_capabilities "TOP" "USER";
 #	# imap_capabilities "IMAP4rev1" "UIDPLUS";
-# 
+#
 #	server {
 #		listen     localhost:110;
 #		protocol   pop3;
 #		proxy      on;
 #	}
-# 
+#
 #	server {
 #		listen     localhost:143;
 #		protocol   imap;
diff --git a/debian/conf/sites-available/default b/debian/conf/sites-available/default
index f5c5e1b7..c5af9146 100644
--- a/debian/conf/sites-available/default
+++ b/debian/conf/sites-available/default
@@ -57,7 +57,7 @@ server {
 	#	include snippets/fastcgi-php.conf;
 	#
 	#	# With php-fpm (or other unix sockets):
-	#	fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
 	#	# With php-cgi (or other tcp sockets):
 	#	fastcgi_pass 127.0.0.1:9000;
 	#}
diff --git a/debian/control b/debian/control
index 409dc22b..fe24d3e6 100644
--- a/debian/control
+++ b/debian/control
@@ -2,8 +2,9 @@ Source: nginx
 Section: httpd
 Priority: optional
 Maintainer: Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-lists.debian.net>
-Uploaders: Christos Trochalakis <ctrochalakis@debian.org>
-Build-Depends: debhelper (>= 10),
+Uploaders: Christos Trochalakis <ctrochalakis@debian.org>,
+           Ondřej Nový <onovy@debian.org>,
+Build-Depends: debhelper-compat (= 13),
                dpkg-dev (>= 1.15.5),
                libexpat-dev,
                libgd-dev,
@@ -11,6 +12,7 @@ Build-Depends: debhelper (>= 10),
                libhiredis-dev,
                liblua5.1-0-dev [!i386 !amd64 !kfreebsd-i386 !armel !armhf !powerpc !powerpcspe !mips !mipsel],
                libluajit-5.1-dev [i386 amd64 kfreebsd-i386 armel armhf powerpc powerpcspe mips mipsel],
+               libmaxminddb-dev,
                libmhash-dev,
                libpam0g-dev,
                libpcre3-dev,
@@ -20,23 +22,24 @@ Build-Depends: debhelper (>= 10),
                po-debconf,
                quilt,
                zlib1g-dev
-Standards-Version: 4.3.0
+Standards-Version: 4.5.0
 Homepage: https://nginx.net
 Vcs-Git: https://salsa.debian.org/nginx-team/nginx.git
 Vcs-Browser: https://salsa.debian.org/nginx-team/nginx
+Rules-Requires-Root: no
 
 Package: nginx
 Architecture: all
-Depends: nginx-full (<< ${source:Version}.1~) | nginx-light (<< ${source:Version}.1~) | nginx-extras (<< ${source:Version}.1~),
-         nginx-full (>= ${source:Version}) | nginx-light (>= ${source:Version}) | nginx-extras (>= ${source:Version}),
+Depends: nginx-core (<< ${source:Version}.1~) | nginx-full (<< ${source:Version}.1~) | nginx-light (<< ${source:Version}.1~) | nginx-extras (<< ${source:Version}.1~),
+         nginx-core (>= ${source:Version}) | nginx-full (>= ${source:Version}) | nginx-light (>= ${source:Version}) | nginx-extras (>= ${source:Version}),
          ${misc:Depends}
 Description: small, powerful, scalable web/proxy server
  Nginx ("engine X") is a high-performance web and reverse proxy server
  created by Igor Sysoev. It can be used both as a standalone web server
  and as a proxy to reduce the load on back-end HTTP or mail servers.
  .
- This is a dependency package to install either nginx-full (by default),
- nginx-light or nginx-extras.
+ This is a dependency package to install either nginx-core (by default),
+ nginx-full, nginx-light or nginx-extras.
 
 Package: nginx-doc
 Architecture: all
@@ -63,22 +66,21 @@ Description: small, powerful, scalable web/proxy server - common files
  This package contains base configuration files used by all versions of
  nginx.
 
-Package: nginx-full
+Package: nginx-core
 Architecture: any
-Depends: libnginx-mod-http-auth-pam (= ${binary:Version}),
-         libnginx-mod-http-dav-ext (= ${binary:Version}),
-         libnginx-mod-http-echo (= ${binary:Version}),
-         libnginx-mod-http-geoip (= ${binary:Version}),
+Depends: libnginx-mod-http-geoip (= ${binary:Version}),
          libnginx-mod-http-image-filter (= ${binary:Version}),
-         libnginx-mod-http-subs-filter (= ${binary:Version}),
-         libnginx-mod-http-upstream-fair (= ${binary:Version}),
          libnginx-mod-http-xslt-filter (= ${binary:Version}),
          libnginx-mod-mail (= ${binary:Version}),
          libnginx-mod-stream (= ${binary:Version}),
+         libnginx-mod-stream-geoip (= ${binary:Version}),
          nginx-common (= ${source:Version}),
+         iproute2,
          ${misc:Depends},
          ${shlibs:Depends}
-Breaks: nginx (<< 1.4.5-1)
+Breaks: nginx (<< 1.4.5-1),
+        nginx-full (<< 1.18.0-1),
+Replaces: nginx-full (<< 1.18.0-1),
 Provides: httpd, httpd-cgi, nginx
 Conflicts: nginx-extras, nginx-light
 Suggests: nginx-doc (= ${source:Version})
@@ -87,9 +89,47 @@ Description: nginx web/proxy server (standard version)
  created by Igor Sysoev. It can be used both as a standalone web server
  and as a proxy to reduce the load on back-end HTTP or mail servers.
  .
- This package provides a version of nginx with the complete set of
+ This package provides a version of nginx identical to that of nginx-full,
+ but without any third-party modules, and only modules in the original
+ nginx code base.
+ .
+ STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Empty
+ GIF, FastCGI, Geo, Limit Connections, Limit Requests, Map, Memcached, Proxy,
+ Referer, Rewrite, SCGI, Split Clients, UWSGI.
+ .
+ OPTIONAL HTTP MODULES: Addition, Auth Request, Charset, WebDAV, GeoIP, Gunzip,
+ Gzip, Gzip Precompression, Headers, HTTP/2, Image Filter, Index, Log, Real IP,
+ Slice, SSI, SSL, SSL Preread, Stub Status, Substitution, Thread  Pool,
+ Upstream, User ID, XSLT.
+ .
+ OPTIONAL MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ .
+ OPTIONAL STREAM MODULES: Stream Core, GeoIP
+
+Package: nginx-full
+Architecture: all
+Depends: libnginx-mod-http-auth-pam,
+         libnginx-mod-http-dav-ext,
+         libnginx-mod-http-echo,
+         libnginx-mod-http-geoip2,
+         libnginx-mod-http-subs-filter,
+         libnginx-mod-http-upstream-fair,
+         libnginx-mod-stream-geoip2,
+         nginx-core (>= ${source:Version}),
+         nginx-core (<< ${source:Version}.1~),
+         ${misc:Depends},
+         ${shlibs:Depends}
+Breaks: nginx (<< 1.4.5-1)
+Provides: httpd, httpd-cgi, nginx
+Suggests: nginx-doc (= ${source:Version})
+Description: nginx web/proxy server (standard version with 3rd parties)
+ Nginx ("engine X") is a high-performance web and reverse proxy server
+ created by Igor Sysoev. It can be used both as a standalone web server
+ and as a proxy to reduce the load on back-end HTTP or mail servers.
+ .
+ This metapackage provides a version of nginx with the complete set of
  standard modules included (but omitting some of those included in
- nginx-extra).
+ nginx-extras).
  .
  STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Empty
  GIF, FastCGI, Geo, Limit Connections, Limit Requests, Map, Memcached, Proxy,
@@ -100,20 +140,23 @@ Description: nginx web/proxy server (standard version)
  Slice, SSI, SSL, Stream, SSL Preread, Stub Status, Substitution, Thread  Pool,
  Upstream, User ID, XSLT.
  .
- MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ OPTIONAL MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ .
+ OPTIONAL STREAM MODULES: Stream Core, GeoIP, GeoIP2
  .
- THIRD PARTY MODULES: Auth PAM, DAV Ext, Echo, HTTP Substitutions, Upstream
- Fair Queue.
+ THIRD PARTY MODULES: Auth PAM, DAV Ext, Echo, GeoIP2, HTTP Substitutions
+ Upstream Fair Queue.
 
 Package: nginx-light
 Architecture: any
 Depends: libnginx-mod-http-echo (= ${binary:Version}),
          nginx-common (= ${source:Version}),
+         iproute2,
          ${misc:Depends},
          ${shlibs:Depends}
 Breaks: nginx (<< 1.4.5-1)
 Provides: httpd, httpd-cgi, nginx
-Conflicts: nginx-extras, nginx-full
+Conflicts: nginx-extras, nginx-core
 Suggests: nginx-doc (= ${source:Version})
 Description: nginx web/proxy server (basic version)
  Nginx ("engine X") is a high-performance web and reverse proxy server
@@ -140,6 +183,7 @@ Depends: libnginx-mod-http-auth-pam (= ${binary:Version}),
          libnginx-mod-http-echo (= ${binary:Version}),
          libnginx-mod-http-fancyindex (= ${binary:Version}),
          libnginx-mod-http-geoip (= ${binary:Version}),
+         libnginx-mod-http-geoip2 (= ${binary:Version}),
          libnginx-mod-http-headers-more-filter (= ${binary:Version}),
          libnginx-mod-http-image-filter (= ${binary:Version}),
          libnginx-mod-http-lua (= ${binary:Version}),
@@ -151,12 +195,15 @@ Depends: libnginx-mod-http-auth-pam (= ${binary:Version}),
          libnginx-mod-mail (= ${binary:Version}),
          libnginx-mod-nchan (= ${binary:Version}),
          libnginx-mod-stream (= ${binary:Version}),
+         libnginx-mod-stream-geoip (= ${binary:Version}),
+         libnginx-mod-stream-geoip2 (= ${binary:Version}),
          nginx-common (= ${source:Version}),
+         iproute2,
          ${misc:Depends},
          ${shlibs:Depends}
 Breaks: nginx (<< 1.4.5-1)
 Provides: httpd, httpd-cgi, nginx
-Conflicts: nginx-full, nginx-light
+Conflicts: nginx-core, nginx-light
 Suggests: nginx-doc (= ${source:Version})
 Description: nginx web/proxy server (extended version)
  Nginx ("engine X") is a high-performance web and reverse proxy server
@@ -174,18 +221,20 @@ Description: nginx web/proxy server (extended version)
  OPTIONAL HTTP MODULES: Addition, Auth Request, Charset, WebDAV, FLV, GeoIP,
  Gunzip, Gzip, Gzip Precompression, Headers, HTTP/2, Image Filter, Index, Log,
  MP4, Embedded Perl, Random Index, Real IP, Slice, Secure Link, SSI, SSL,
- Stream, SSL Preread, Stub Status, Substitution, Thread Pool, Upstream,
- User ID, XSLT.
+ SSL Preread, Stub Status, Substitution, Thread Pool, Upstream, User ID, XSLT.
  .
- MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ OPTIONAL MAIL MODULES: Mail Core, Auth HTTP, Proxy, SSL, IMAP, POP3, SMTP.
+ .
+ OPTIONAL STREAM MODULES: Stream, GeoIP, GeoIP2
  .
  THIRD PARTY MODULES: Auth PAM, Cache Purge, DAV Ext, Echo, Fancy Index,
- Headers More, Embedded Lua, HTTP Substitutions, Nchan, Upload Progress,
+ GeoIP2, Headers More, Embedded Lua, HTTP Substitutions, Nchan, Upload Progress,
  Upstream Fair Queue.
 
 Package: libnginx-mod-http-geoip
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: GeoIP HTTP module for Nginx
  The ngx_http_geoip module creates variables with values depending on the
  client IP address, using the precompiled MaxMind databases.
@@ -193,9 +242,21 @@ Description: GeoIP HTTP module for Nginx
  Those variables include country, region, city, latitude, longitude, postal
  code, etc.
 
+Package: libnginx-mod-http-geoip2
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
+Description: GeoIP2 HTTP module for Nginx
+ The ngx_http_geoip2 module creates variables with values depending on the
+ client IP address, using the precompiled MaxMind GeoIP2 databases.
+ .
+ Those variables include country, region, city, latitude, longitude, postal
+ code, etc.
+
 Package: libnginx-mod-http-image-filter
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: HTTP image filter module for Nginx
  The ngx_http_image_filter module is a filter that transforms images in JPEG,
  GIF, and PNG formats.
@@ -205,7 +266,8 @@ Description: HTTP image filter module for Nginx
 
 Package: libnginx-mod-http-xslt-filter
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: XSLT Transformation module for Nginx
  The ngx_http_xslt_filter module is a filter that transforms XML responses
  using one or more XSLT stylesheets.
@@ -215,7 +277,8 @@ Description: XSLT Transformation module for Nginx
 
 Package: libnginx-mod-mail
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Mail module for Nginx
  The nginx_mail module adds mail proxy support to nginx.
  .
@@ -224,7 +287,8 @@ Description: Mail module for Nginx
 
 Package: libnginx-mod-stream
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Stream module for Nginx
  The nginx_stream module adds stream proxy support to nginx.
  .
@@ -232,9 +296,34 @@ Description: Stream module for Nginx
  also supports ACLs/connection limiting and configuring multiple operational
  parameters.
 
+Package: libnginx-mod-stream-geoip
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+ libnginx-mod-stream (= ${binary:Version}),
+Recommends: nginx,
+Description: GeoIP Stream module for Nginx
+ The ngx_stream_geoip module creates variables with values depending on the
+ client IP address, using the precompiled MaxMind databases.
+ .
+ Those variables include country, region, city, latitude, longitude, postal
+ code, etc.
+
+Package: libnginx-mod-stream-geoip2
+Architecture: any
+Depends: ${misc:Depends}, ${shlibs:Depends},
+ libnginx-mod-stream (= ${binary:Version}),
+Recommends: nginx,
+Description: GeoIP2 Stream module for Nginx
+ The ngx_stream_geoip2 module creates variables with values depending on the
+ client IP address, using the precompiled MaxMind GeoIP2 databases.
+ .
+ Those variables include country, region, city, latitude, longitude, postal
+ code, etc.
+
 Package: libnginx-mod-http-perl
 Architecture: any
-Depends: ${misc:Depends}, ${perl:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${perl:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Replaces: nginx-extras (<< 1.9.14-1)
 Description: Perl module for Nginx
  Embed Perl runtime into nginx.
@@ -246,7 +335,8 @@ Description: Perl module for Nginx
 
 Package: libnginx-mod-http-auth-pam
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: PAM authentication module for Nginx
  The nginx_http_auth_pam module enables authentication using PAM.
  .
@@ -257,7 +347,8 @@ Package: libnginx-mod-http-lua
 Architecture: any
 Depends: libnginx-mod-http-ndk (= ${binary:Version}),
          ${misc:Depends},
-         ${shlibs:Depends}
+         ${shlibs:Depends},
+Recommends: nginx,
 Description: Lua module for Nginx
  Embed Lua runtime into nginx.
  .
@@ -268,7 +359,8 @@ Description: Lua module for Nginx
 
 Package: libnginx-mod-http-ndk
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Nginx Development Kit module
  The NDK is an Nginx module that is designed to extend the core functionality of
  the excellent Nginx webserver in a way that can be used as a basis of other
@@ -281,7 +373,8 @@ Description: Nginx Development Kit module
 
 Package: libnginx-mod-nchan
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Fast, flexible pub/sub server for Nginx
  Nchan is a scalable, flexible pub/sub server for the modern web, It can be
  configured as a standalone server, or as a shim between your application and
@@ -294,7 +387,8 @@ Description: Fast, flexible pub/sub server for Nginx
 
 Package: libnginx-mod-http-echo
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Bring echo and more shell style goodies to Nginx
  Echo module wraps lots of Nginx internal APIs for streaming input and output,
  parallel/sequential subrequests, timers and sleeping, as well as various meta
@@ -315,7 +409,8 @@ Description: Bring echo and more shell style goodies to Nginx
 
 Package: libnginx-mod-http-upstream-fair
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Nginx Upstream Fair Proxy Load Balancer
  The Nginx fair proxy balancer enhances the standard round-robin load balancer
  provided with Nginx so that it tracks busy backend servers and adjusts
@@ -323,7 +418,8 @@ Description: Nginx Upstream Fair Proxy Load Balancer
 
 Package: libnginx-mod-http-headers-more-filter
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Set and clear input and output headers for Nginx
  The Headers More module allows you to add, set, or clear any output or input
  header that you specify.
@@ -334,7 +430,8 @@ Description: Set and clear input and output headers for Nginx
 
 Package: libnginx-mod-http-cache-purge
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Purge content from Nginx caches
  Cache Purge module adds purging capabilities to Nginx. It allows purging
  content from caches used by all of Nginx proxy modules, like FastCGI, Proxy,
@@ -342,7 +439,8 @@ Description: Purge content from Nginx caches
 
 Package: libnginx-mod-http-fancyindex
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Suggests: nginx,
 Description: Fancy indexes module for the Nginx
  The Fancy Index module makes possible the generation of file listings, like
  the built-in autoindex module does, but adding a touch of style by introducing
@@ -350,7 +448,8 @@ Description: Fancy indexes module for the Nginx
 
 Package: libnginx-mod-http-uploadprogress
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Upload progress system for Nginx
  Upload progress module is an implementation of an upload progress system, that
  monitors RFC1867 POST uploads as they are transmitted to upstream servers.
@@ -361,7 +460,8 @@ Description: Upload progress system for Nginx
 
 Package: libnginx-mod-http-subs-filter
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: Substitution filter module for Nginx
  Subsitution Nginx module can do both regular expression and fixed string
  substitutions on response bodies. The module is quite different from Nginx's
@@ -370,7 +470,8 @@ Description: Substitution filter module for Nginx
 
 Package: libnginx-mod-http-dav-ext
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: WebDAV missing commands support for Nginx
  WebDAV Ext module complements the Nginx WebDAV module to provide a full
  WebDAV support.
@@ -379,7 +480,8 @@ Description: WebDAV missing commands support for Nginx
 
 Package: libnginx-mod-rtmp
 Architecture: any
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends},
+Recommends: nginx,
 Description: RTMP support for Nginx
  The nginx RTMP module is a fully-featured streaming solution implemented in
  nginx.
diff --git a/debian/copyright b/debian/copyright
index 66a44d87..c2a5f970 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -3,12 +3,12 @@ Upstream-Name: nginx
 Source: https://nginx.org/en/download.html
 
 Files: *
-Copyright: 2002-2014 Igor Sysoev
-           2011-2014 Nginx, Inc.
-                     Maxim Dounin
-                     Valentin V. Bartenev
-                     Roman Arutyunyan
-                     Ruslan Ermilov
+Copyright: 2002-2019, Igor Sysoev
+           2011-2019, Nginx, Inc.
+                      Maxim Dounin
+                      Valentin V. Bartenev
+                      Roman Arutyunyan
+                      Ruslan Ermilov
 License: BSD-2-clause
 
 Files: src/core/ngx_murmurhash.c
@@ -17,10 +17,16 @@ License: BSD-2-clause
 
 Files: src/http/modules/ngx_http_scgi_module.c
        src/http/modules/ngx_http_uwsgi_module.c
-Copyright: Copyright (C) Igor Sysoev
-           Copyright (C) Nginx, Inc.
-           2009-2010 Unbit S.a.s.
-           2008      Manlio Perillo (manlio.perillo@gmail.com)
+Copyright: 2009-2010, Unbit S.a.s.
+           2008,      Manlio Perillo (manlio.perillo@gmail.com)
+                      Igor Sysoev
+                      Nginx, Inc.
+License: BSD-2-clause
+
+Files: src/http/v2/ngx_http_v2_huff_encode.c
+Copyright: 2015, Vlad Krasnov
+                 Nginx, Inc.
+                 Valentin V. Bartenev
 License: BSD-2-clause
 
 Files: contrib/geo2nginx.pl
@@ -35,73 +41,103 @@ Copyright: 2007-2009, Fabio Tranchitella <kobold@debian.org>
            2011       Dmitry E. Oboukhov <unera@debian.org>
            2011-2013, Cyril Lavier <cyril.lavier@davromaniak.eu>
            2013-2016, Christos Trochalakis <ctrochalakis@debian.org>
+           2019-2020, Thomas Ward <teward@ubuntu.com>
+           2020,      Ondřej Nový <onovy@debian.org>
 License: BSD-2-clause
 
 Files: debian/modules/http-headers-more-filter/*
-Copyright: Copyright (c) 2009-2014, Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, CloudFlare Inc.
-           Copyright (c) 2010-2013, Bernd Dorn
-           Copyright (c) Igor Sysoev
+Copyright: 2009-2017, Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, CloudFlare Inc.
+           2010-2013, Bernd Dorn
+                      Igor Sysoev
+License: BSD-2-clause
+
+Files: debian/modules/http-geoip2/*
+Copyright: 2014, Lee Valentine <lee@leev.net>
 License: BSD-2-clause
 
 Files: debian/modules/http-ndk/*
-Copyright: Marcus Clyne
+Copyright: 2010-2018, Marcus Clyne
 License: BSD-3-clause
 
 Files: debian/modules/http-ndk/src/hash/md5.h
        debian/modules/http-ndk/src/hash/sha.h
-Copyright: Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+Copyright: 1995-1998, Eric Young <eay@cryptsoft.com>
 License: BSD-4-clause
 
+Files: debian/modules/http-ndk/src/hash/murmurhash2.c
+Copyright: Austin Appleby
+License: BSD-3-clause
+
 Files: debian/modules/http-auth-pam/*
-Copyright: 2008-2013, Sergio Talens Oliag
+Copyright: 2008-2020, Sergio Talens Oliag
 License: BSD-2-clause
 
 Files: debian/modules/http-echo/*
-Copyright: Copyright (c) 2009-2014, Yichun "agentzh" Zhang <agentzh@gmail.com>
+Copyright: 2009-2014, Yichun "agentzh" Zhang <agentzh@gmail.com>
 License: BSD-2-clause
 
 Files: debian/modules/http-lua/*
-Copyright: Copyright (C) 2009-2014, by Xiaozhe Wang (chaoslawful) <chaoslawful@gmail.com>.
-           Copyright (C) 2009-2014, by Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, CloudFlare Inc.
+Copyright: 2009-2017, by Xiaozhe Wang (chaoslawful) <chaoslawful@gmail.com>.
+           2009-2018, by Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, OpenResty Inc.
 License: BSD-2-clause
 
+Files: debian/modules/http-lua/t/lib/CRC32.lua
+Copyright: 2007-2008, Neil Richardson (nrich@iinet.net.au)
+License: Expat
+
 Files: debian/modules/http-upstream-fair/*
-Copyright: Copyright (c) 2007 Grzegorz Nosek
-           Igor Sysoev
+Copyright: 2007, Grzegorz Nosek
+                 Igor Sysoev
 License: BSD-2-clause
 
 Files: debian/modules/nchan/*
-Copyright: 2009-2016 Leo Ponomarev
-License: MIT
+Copyright: 2009-2016, Leo Ponomarev (slact)
+           2014,      Wandenberg Peixoto
+                      Alexander Lyalin
+                      Rogério Carvalho Schneider <stockrt@gmail.com>
+License: Expat
+
+Files: debian/modules/nchan/src/store/redis/hiredis/*
+Copyright: 2006-2014, Salvatore Sanfilippo <antirez@gmail.com>
+           2010-2011, Pieter Noordhuis <pcnoordhuis@gmail.com>
+           2015,      Matt Stancliff <matt@genges.com>
+                      Jan-Erik Rediger <janerik.fnordig.com>
+License: BSD-3-clause
 
 Files: debian/modules/nchan/src/store/redis/cmp.*
-Copyright: 2015 Charles Gunyon
-License: MIT
+Copyright: 2017, Charles Gunyon
+License: Expat
 
 Files: debian/modules/http-uploadprogress/*
-Copyright: Brice Figureau
+Copyright: 2007, Brice Figureau
            2002-2007, Igor Sysoev
 License: BSD-2-clause
 
 Files: debian/modules/http-cache-purge/*
-Copyright: 2009-2012, FRiCKLE <info@frickle.com>,
-           2009-2012, Piotr Sikora <piotr.sikora@frickle.com>
+Copyright: 2009-2014, FRiCKLE <info@frickle.com>,
+           2009-2014, Piotr Sikora <piotr.sikora@frickle.com>
 License: BSD-2-clause
 
 Files: debian/modules/http-dav-ext/*
-Copyright: Arutyunyan Roman <arut@qip.ru>
+Copyright: 2012-2018, Roman Arutyunyan <arut@qip.ru>
 License: BSD-2-clause
 
 Files: debian/modules/http-fancyindex/*
-Copyright: Copyright (c) Adrian Perez <aperez@igalia.com>
+Copyright: 2007-2016, Adrian Perez <aperez@igalia.com>
 License: BSD-2-clause
 
 Files: debian/modules/http-subs-filter/*
-Copyright: Copyright (C) 2014 by Weibin Yao <yaoweibin@gmail.com>
+Copyright: 2014, Weibin Yao <yaoweibin@gmail.com>
 License: BSD-2-clause
 
+Files: debian/modules/http-subs-filter/test/*
+Copyright: 2009-2011, Taobao Inc., Alibaba Group
+                      Antoine BONAVITA "<antoine.bonavita@gmail.com>"
+                      agentzh (章亦春) "<agentzh@gmail.com>"
+License: BSD-3-clause
+
 Files: debian/modules/rtmp/*
-Copyright: Copyright (C) 2012-2014, Roman Arutyunyan
+Copyright: 2012-2014, Roman Arutyunyan
 License: BSD-2-clause
 
 License: BSD-2-clause
@@ -181,7 +217,7 @@ License: BSD-4-clause
  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  SUCH DAMAGE.
 
-License: MIT
+License: Expat
  Permission is hereby granted, free of charge, to any person obtaining a copy
  of this software and associated documentation files (the "Software"), to
  deal in the Software without restriction, including without limitation the
diff --git a/debian/gbp.conf b/debian/gbp.conf
index a14a6992..b5fb2c91 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -2,3 +2,5 @@
 pristine-tar = True
 upstream-branch = upstream
 upstream-tag = upstream/%(version)s
+dist=buster
+debian-branch=buster
diff --git a/debian/gitlab-ci.yml b/debian/gitlab-ci.yml
new file mode 100644
index 00000000..557434c8
--- /dev/null
+++ b/debian/gitlab-ci.yml
@@ -0,0 +1,8 @@
+---
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
+
+# Disable reprotest which is failing now
+variables:
+  SALSA_CI_DISABLE_REPROTEST: 1
diff --git a/debian/libnginx-mod-http-geoip2.nginx b/debian/libnginx-mod-http-geoip2.nginx
new file mode 100755
index 00000000..78c206f2
--- /dev/null
+++ b/debian/libnginx-mod-http-geoip2.nginx
@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-extras/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf\n";
diff --git a/debian/libnginx-mod-stream-geoip.nginx b/debian/libnginx-mod-stream-geoip.nginx
new file mode 100755
index 00000000..9acb1030
--- /dev/null
+++ b/debian/libnginx-mod-stream-geoip.nginx
@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-extras/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf 70\n";
diff --git a/debian/libnginx-mod-stream-geoip2.nginx b/debian/libnginx-mod-stream-geoip2.nginx
new file mode 100755
index 00000000..9acb1030
--- /dev/null
+++ b/debian/libnginx-mod-stream-geoip2.nginx
@@ -0,0 +1,13 @@
+#!/usr/bin/perl -w
+
+use File::Basename;
+
+# Guess module name
+$module = basename($0, '.nginx');
+$module =~ s/^libnginx-mod-//;
+
+$modulepath = $module;
+$modulepath =~ s/-/_/g;
+
+print "mod debian/build-extras/objs/ngx_${modulepath}_module.so\n";
+print "mod debian/libnginx-mod.conf/mod-${module}.conf 70\n";
diff --git a/debian/libnginx-mod.conf/mod-http-geoip2.conf b/debian/libnginx-mod.conf/mod-http-geoip2.conf
new file mode 100644
index 00000000..9441b290
--- /dev/null
+++ b/debian/libnginx-mod.conf/mod-http-geoip2.conf
@@ -0,0 +1 @@
+load_module modules/ngx_http_geoip2_module.so;
diff --git a/debian/libnginx-mod.conf/mod-stream-geoip.conf b/debian/libnginx-mod.conf/mod-stream-geoip.conf
new file mode 100644
index 00000000..7195856a
--- /dev/null
+++ b/debian/libnginx-mod.conf/mod-stream-geoip.conf
@@ -0,0 +1 @@
+load_module modules/ngx_stream_geoip_module.so;
diff --git a/debian/libnginx-mod.conf/mod-stream-geoip2.conf b/debian/libnginx-mod.conf/mod-stream-geoip2.conf
new file mode 100644
index 00000000..4072597a
--- /dev/null
+++ b/debian/libnginx-mod.conf/mod-stream-geoip2.conf
@@ -0,0 +1 @@
+load_module modules/ngx_stream_geoip2_module.so;
diff --git a/debian/modules/control b/debian/modules/control
index f27ca7c9..e980b2ff 100644
--- a/debian/modules/control
+++ b/debian/modules/control
@@ -8,14 +8,18 @@ Homepage: https://github.com/simpl/ngx_devel_kit/
 Version: 0.3.1
 
 Module: http-auth-pam
-Homepage: https://github.com/stogh/ngx_http_auth_pam_module
-Version: 1.5.1
+Homepage: https://github.com/sto/ngx_http_auth_pam_module
+Version: 1.5.2
 
 Module: http-echo
 Homepage: https://github.com/agentzh/echo-nginx-module
 Version: v0.61
 Files-Excluded: .gitignore .gitattributes .travis.yml
 
+Module: http-geoip2
+Homepage: https://github.com/leev/ngx_http_geoip2_module
+Version: 3.3
+
 Module: http-lua
 Homepage: https://github.com/openresty/lua-nginx-module
 Version: 0.10.13
@@ -34,8 +38,8 @@ Patch:
 
 Module: nchan
 Homepage: https://github.com/slact/nchan
-Version: 1.0.8
-Files-Excluded: dev nchan_logo.png NchanSubscriber.js src/hiredis
+Version: 1.2.7
+Files-Excluded: dev nchan_logo.png NchanSubscriber.js src/hiredis nchan
 
 Module: http-uploadprogress
 Homepage: https://github.com/masterzen/nginx-upload-progress-module
@@ -55,7 +59,7 @@ Version: 3.0.0
 
 Module: http-fancyindex
 Homepage: https://github.com/aperezdc/ngx-fancyindex
-Version: 0.4.3
+Version: 0.4.4
 Files-Excluded: .gitignore .travis.yml
 
 Module: http-subs-filter
diff --git a/debian/modules/http-auth-pam/ChangeLog b/debian/modules/http-auth-pam/ChangeLog
index d45eae40..084c99a9 100644
--- a/debian/modules/http-auth-pam/ChangeLog
+++ b/debian/modules/http-auth-pam/ChangeLog
@@ -1,6 +1,14 @@
+2020-06-23  sto@mixinet.net
+
+	* Version 1.5.2.
+	* Log authentication errors as errors instead of debug (patch provided by
+	  Juha Koho, see https://github.com/sto/ngx_http_auth_pam_module/pull/11)
+	* Send client IP address to PAM (patch provided by Marcin Łojewski, see
+	  https://github.com/sto/ngx_http_auth_pam_module/pull/14)
+
 2016-04-06  sto@iti.es
 
-    * Version 1.5.1.
+	* Version 1.5.1.
 	* Fix building alongside other modules in nginx 1.9.11+ (patch provided by
 	  Graham Edgecombe <grahamedgecombe@gmail.com>)
 
diff --git a/debian/modules/http-auth-pam/LICENSE b/debian/modules/http-auth-pam/LICENSE
index b2d93242..a9d6313d 100644
--- a/debian/modules/http-auth-pam/LICENSE
+++ b/debian/modules/http-auth-pam/LICENSE
@@ -1,5 +1,5 @@
 /* 
- * Copyright (C) 2008-2016 Sergio Talens Oliag
+ * Copyright (C) 2008-2020 Sergio Talens Oliag
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/debian/modules/http-auth-pam/README.md b/debian/modules/http-auth-pam/README.md
index a4eea455..975bafe2 100644
--- a/debian/modules/http-auth-pam/README.md
+++ b/debian/modules/http-auth-pam/README.md
@@ -75,11 +75,11 @@ If you want use the ``pam_exec.so`` plugin for request based authentication the
 module can add to the PAM environment the ``HOST`` and ``REQUEST`` variables if
 you set the ``auth_pam_set_pam_env`` flag::
 
-  location /pam_exec_protected {
-    auth_pam              "Exec Zone";
-    auth_pam_service_name "nginx_exec";
-    auth_pam_set_pam_env  on;
-  }
+	location /pam_exec_protected {
+	  auth_pam              "Exec Zone";
+	  auth_pam_service_name "nginx_exec";
+	  auth_pam_set_pam_env  on;
+	}
 
 With this configuration if you access an URL like:
 
diff --git a/debian/modules/http-auth-pam/VERSION b/debian/modules/http-auth-pam/VERSION
index c239c60c..4cda8f19 100644
--- a/debian/modules/http-auth-pam/VERSION
+++ b/debian/modules/http-auth-pam/VERSION
@@ -1 +1 @@
-1.5
+1.5.2
diff --git a/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c b/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c
index 167a37fe..55eeb928 100644
--- a/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c
+++ b/debian/modules/http-auth-pam/ngx_http_auth_pam_module.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2016 Sergio Talens-Oliag <sto@iti.es>
+ * Copyright (C) 2008-2020 Sergio Talens-Oliag <sto@mixinet.net>
  *
  * Based on nginx's 'ngx_http_auth_basic_module.c' by Igor Sysoev and apache's
  * 'mod_auth_pam.c' by Ingo Luetkebolhe.
@@ -182,7 +182,7 @@ ngx_auth_pam_talker(int num_msg, const struct pam_message ** msg,
         case PAM_PROMPT_ECHO_OFF:
             response[i].resp = strdup((const char *)ainfo->password.data);
             break;
-	case PAM_ERROR_MSG:
+        case PAM_ERROR_MSG:
             ngx_log_error(NGX_LOG_ERR, ainfo->log, 0,
                           "PAM: \'%s\'.", msg[i]->msg);
             break;
@@ -335,12 +335,21 @@ ngx_http_auth_pam_authenticate(ngx_http_request_t *r,
                         (const char *) ainfo.username.data,
                         &conv_info,
                         &pamh)) != PAM_SUCCESS) {
-        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+        ngx_log_error(NGX_LOG_CRIT, r->connection->log, 0,
                       "PAM: Could not start pam service: %s",
                       pam_strerror(pamh, rc));
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
     }
 
+    /* send client IP address to PAM */
+    char *client_ip_addr = ngx_strncpy_s(r->connection->addr_text, r->pool);
+    if ((rc = pam_set_item(pamh, PAM_RHOST, client_ip_addr)) != PAM_SUCCESS) {
+        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                      "PAM: Could not set item PAM_RHOST: %s",
+                      pam_strerror(pamh, rc));
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+  }
+
     if (alcf->set_pam_env) {
         add_request_info_to_pam_env(pamh, r);
     }
@@ -348,7 +357,7 @@ ngx_http_auth_pam_authenticate(ngx_http_request_t *r,
     /* try to authenticate user, log error on failure */
     if ((rc = pam_authenticate(pamh,
                                PAM_DISALLOW_NULL_AUTHTOK)) != PAM_SUCCESS) {
-        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                       "PAM: user '%s' - not authenticated: %s",
                       ainfo.username.data, pam_strerror(pamh, rc));
         pam_end(pamh, PAM_SUCCESS);
@@ -357,8 +366,8 @@ ngx_http_auth_pam_authenticate(ngx_http_request_t *r,
 
     /* check that the account is healthy */
     if ((rc = pam_acct_mgmt(pamh, PAM_DISALLOW_NULL_AUTHTOK)) != PAM_SUCCESS) {
-        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
-                      "PAM: user '%s'  - invalid account: %s",
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                      "PAM: user '%s' - invalid account: %s",
                       ainfo.username.data, pam_strerror(pamh, rc));
         pam_end(pamh, PAM_SUCCESS);
         return ngx_http_auth_pam_set_realm(r, &alcf->realm);
diff --git a/debian/modules/http-fancyindex/CHANGELOG.md b/debian/modules/http-fancyindex/CHANGELOG.md
index 580ec92a..57569e8f 100644
--- a/debian/modules/http-fancyindex/CHANGELOG.md
+++ b/debian/modules/http-fancyindex/CHANGELOG.md
@@ -3,6 +3,24 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.4.4] - 2020-02-19
+### Added
+- New option `fancyindex_hide_parent_dir`, which disables generating
+  links to parent directories in listings. (Patch by Kawai Ryota
+  <<admin@mail.kr-kp.com>>.)
+
+### Changed
+- Each table row is now separated by a new line (as a matter of fact,
+  a `CRLF` sequence), which makes it easier to parse output using simple
+  text tools. (Patch by Anders Trier <<anders.trier.olesen@gmail.com>>.)
+- Some corrections and additions to the README file. (Patches by Nicolas
+  Carpi <<nicolas.carpi@curie.fr>> and David Beitey <<david@davidjb.com>>.)
+
+### Fixed
+- Use correct character references for `&` characters in table sorter URLs
+  within the template (Patch by David Beitey <<david@davidjb.com>>.)
+- Properly encode filenames when used as URI components.
+
 ## [0.4.3] - 2018-07-03
 ### Added
 - Table cells now have class names, which allows for better CSS styling.
@@ -130,7 +148,8 @@ All notable changes to this project will be documented in this file.
 - `NEWS.rst` file, to act as change log.
 
 
-[Unreleased]: https://github.com/aperezdc/ngx-fancyindex/compare/v0.4.3...HEAD
+[Unreleased]: https://github.com/aperezdc/ngx-fancyindex/compare/v0.4.4...HEAD
+[0.4.4]: https://github.com/aperezdc/ngx-fancyindex/compare/v0.4.3...v0.4.4
 [0.4.3]: https://github.com/aperezdc/ngx-fancyindex/compare/v0.4.2...v0.4.3
 [0.4.2]: https://github.com/aperezdc/ngx-fancyindex/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/aperezdc/ngx-fancyindex/compare/v0.4.0...v0.4.1
diff --git a/debian/modules/http-fancyindex/HACKING.md b/debian/modules/http-fancyindex/HACKING.md
index 07485174..4c8608a1 100644
--- a/debian/modules/http-fancyindex/HACKING.md
+++ b/debian/modules/http-fancyindex/HACKING.md
@@ -21,4 +21,9 @@ is known to work flawlessly. Just do:
     $ awk -f template.awk template.html > template.h
 
 If your copy of `awk` is not the GNU implementation, you will need to
-install it and use `gawk` instead in the command line above.
+install it and use `gawk` instead in the command line above. 
+
+This includes macOS where the current built-in `awk` (currently version
+20070501 at time of testing on 10.13.6) doesn't apply correctly and causes
+characters to be omitted from the output. `gawk` can be installed with a 
+package manager such as [Homebrew](https://brew.sh).
diff --git a/debian/modules/http-fancyindex/README.rst b/debian/modules/http-fancyindex/README.rst
index b282b8b1..4d178da1 100644
--- a/debian/modules/http-fancyindex/README.rst
+++ b/debian/modules/http-fancyindex/README.rst
@@ -11,7 +11,7 @@ Nginx Fancy Index module
 The Fancy Index module makes possible the generation of file listings, like
 the built-in `autoindex <http://wiki.nginx.org/NginxHttpAutoindexModule>`__
 module does, but adding a touch of style. This is possible because the module
-module allows a certain degree of customization of the generated content:
+allows a certain degree of customization of the generated content:
 
 * Custom headers. Either local or stored remotely.
 * Custom footers. Either local or stored remotely.
@@ -52,7 +52,7 @@ versions in the 0.6 series by applying ``nginx-0.6-support.patch``, but this
 is unsupported (YMMV).
 
 In order to use the ``fancyindex_header_`` and ``fancyindex_footer_`` directives
-you will also need the `ngx_http_addition_module <http://nginx.org/en/docs/http/ngx_http_addition_module.html>`_
+you will also need the `ngx_http_addition_module <https://nginx.org/en/docs/http/ngx_http_addition_module.html>`_
 built into Nginx.
 
 
@@ -217,7 +217,7 @@ fancyindex_header
    into Nginx.
 
 fancyindex_show_path
-~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~
 :Syntax: *fancyindex_show_path* [*on* | *off*]
 :Default: fancyindex_show_path on
 :Context: http, server, location
@@ -247,6 +247,14 @@ fancyindex_hide_symlinks
 :Description:
   When enabled, generated listings will not contain symbolic links.
 
+fancyindex_hide_parent_dir
+~~~~~~~~~~~~~~~~~~~~~~~~
+:Syntax: *fancyindex_hide_parent_dir* [*on* | *off*]
+:Default: fancyindex_hide_parent_dir off
+:Context: http, server, location
+:Description:
+  When enabled, it will not show parent directory.
+
 fancyindex_localtime
 ~~~~~~~~~~~~~~~~~~~~
 :Syntax: *fancyindex_localtime* [*on* | *off*]
@@ -262,7 +270,7 @@ fancyindex_time_format
 :Context: http, server, location
 :Description:
   Format string used for timestamps. The format specifiers are a subset of
-  those supported by the `strftime <http://linux.die.net/man/3/strftime>`_
+  those supported by the `strftime <https://linux.die.net/man/3/strftime>`_
   function, and the behavior is locale-independent (for example, day and month
   names are always in English). The supported formats are:
 
@@ -295,6 +303,6 @@ fancyindex_time_format
   * ``%Y``: Year as a decimal number including the century.
 
 
-.. _nginx: http://nginx.net
+.. _nginx: https://nginx.org
 
 .. vim:ft=rst:spell:spelllang=en:
diff --git a/debian/modules/http-fancyindex/ngx_http_fancyindex_module.c b/debian/modules/http-fancyindex/ngx_http_fancyindex_module.c
index 64f98a12..9ce5a381 100644
--- a/debian/modules/http-fancyindex/ngx_http_fancyindex_module.c
+++ b/debian/modules/http-fancyindex/ngx_http_fancyindex_module.c
@@ -154,6 +154,7 @@ typedef struct {
     ngx_uint_t name_length;  /**< Maximum length of file names in bytes. */
     ngx_flag_t hide_symlinks;/**< Hide symbolic links in listings. */
     ngx_flag_t show_path;    /**< Whether to display or not the path + '</h1>' after the header */
+    ngx_flag_t hide_parent;  /**< Hide parent directory. */
 
     ngx_str_t  header;       /**< File name for header, or empty if none. */
     ngx_str_t  footer;       /**< File name for footer, or empty if none. */
@@ -258,7 +259,7 @@ static char *ngx_http_fancyindex_ignore(ngx_conf_t    *cf,
                                         void          *conf);
 
 static uintptr_t
-    ngx_fancyindex_escape_uri(u_char *dst, u_char*src, size_t size);
+    ngx_fancyindex_escape_filename(u_char *dst, u_char*src, size_t size);
 
 /*
  * These are used only once per handler invocation. We can tell GCC to
@@ -361,6 +362,13 @@ static ngx_command_t  ngx_http_fancyindex_commands[] = {
       offsetof(ngx_http_fancyindex_loc_conf_t, show_path),
       NULL },
 
+    { ngx_string("fancyindex_hide_parent_dir"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_fancyindex_loc_conf_t, hide_parent),
+      NULL },
+
     { ngx_string("fancyindex_time_format"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
       ngx_conf_set_str_slot,
@@ -410,8 +418,15 @@ static const ngx_str_t css_href_post =
     ngx_string("\" type=\"text/css\"/>\n");
 
 
+#ifdef NGX_ESCAPE_URI_COMPONENT
+static inline uintptr_t
+ngx_fancyindex_escape_filename(u_char *dst, u_char *src, size_t size)
+{
+    return ngx_escape_uri(dst, src, size, NGX_ESCAPE_URI_COMPONENT);
+}
+#else /* !NGX_ESCAPE_URI_COMPONENT */
 static uintptr_t
-ngx_fancyindex_escape_uri(u_char *dst, u_char *src, size_t size)
+ngx_fancyindex_escape_filename(u_char *dst, u_char *src, size_t size)
 {
     /*
      * The ngx_escape_uri() function will not escape colons or the
@@ -483,6 +498,7 @@ ngx_fancyindex_escape_uri(u_char *dst, u_char *src, size_t size)
         return escapes + uescapes;
     }
 }
+#endif /* NGX_ESCAPE_URI_COMPONENT */
 
 
 static ngx_inline ngx_buf_t*
@@ -716,9 +732,9 @@ make_content_buf(
             return ngx_http_fancyindex_error(r, &dir, &path);
 
         ngx_cpystrn(entry->name.data, ngx_de_name(&dir), len + 1);
-        entry->escape = 2 * ngx_fancyindex_escape_uri(NULL,
-                                                      ngx_de_name(&dir),
-                                                      len);
+        entry->escape = 2 * ngx_fancyindex_escape_filename(NULL,
+                                                           ngx_de_name(&dir),
+                                                           len);
 
         entry->dir     = ngx_de_is_dir(&dir);
         entry->mtime   = ngx_de_mtime(&dir);
@@ -901,7 +917,7 @@ make_content_buf(
     tp = ngx_timeofday();
 
     /* "Parent dir" entry, always first if displayed */
-    if (r->uri.len > 1) {
+    if (r->uri.len > 1 && alcf->hide_parent == 0) {
         b->last = ngx_cpymem_ssz(b->last,
                                  "<tr>"
                                  "<td class=\"link\"><a href=\"../");
@@ -914,7 +930,8 @@ make_content_buf(
                                  "\">Parent directory/</a></td>"
                                  "<td class=\"size\">-</td>"
                                  "<td class=\"date\">-</td>"
-                                 "</tr>");
+                                 "</tr>"
+                                 CRLF);
     }
 
     /* Entries for directories and files */
@@ -922,9 +939,9 @@ make_content_buf(
         b->last = ngx_cpymem_ssz(b->last, "<tr><td class=\"link\"><a href=\"");
 
         if (entry[i].escape) {
-            ngx_fancyindex_escape_uri(b->last,
-                                      entry[i].name.data,
-                                      entry[i].name.len);
+            ngx_fancyindex_escape_filename(b->last,
+                                           entry[i].name.data,
+                                           entry[i].name.len);
 
             b->last += entry[i].name.len + entry[i].escape;
 
@@ -1315,6 +1332,7 @@ ngx_http_fancyindex_create_loc_conf(ngx_conf_t *cf)
     conf->ignore        = NGX_CONF_UNSET_PTR;
     conf->hide_symlinks = NGX_CONF_UNSET;
     conf->show_path     = NGX_CONF_UNSET;
+    conf->hide_parent   = NGX_CONF_UNSET;
 
     return conf;
 }
@@ -1343,6 +1361,7 @@ ngx_http_fancyindex_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_ptr_value(conf->ignore, prev->ignore, NULL);
     ngx_conf_merge_value(conf->hide_symlinks, prev->hide_symlinks, 0);
+    ngx_conf_merge_value(conf->hide_parent, prev->hide_parent, 0);
 
     /* Just make sure we haven't disabled the show_path directive without providing a custom header */
     if (conf->show_path == 0 && conf->header.len == 0)
diff --git a/debian/modules/http-fancyindex/t/06-hide_parent.test b/debian/modules/http-fancyindex/t/06-hide_parent.test
new file mode 100644
index 00000000..494c9587
--- /dev/null
+++ b/debian/modules/http-fancyindex/t/06-hide_parent.test
@@ -0,0 +1,23 @@
+#! /bin/bash
+cat <<---
+This test check the output using "fancyindex_hide_parent_dir on"
+--
+use pup
+nginx_start 'fancyindex_hide_parent_dir on;'
+
+content=$( fetch /child-directory/ )
+
+# Check page title
+[[ $(pup -p title text{} <<< "${content}") = "Index of /child-directory/" ]]
+
+# Check table headers
+[[ $(pup -n body table tbody tr:first-child td <<< "${content}") -eq 3 ]]
+{
+	read -r name_label
+	read -r size_label
+	read -r date_label
+} < <(  pup -p body table tbody tr:first-child td text{} <<< "${content}" )
+[[ ${name_label} != Parent\ Directory/ ]]
+[[ ${name_label} = empty-file.txt ]]
+[[ ${size_label} != - ]]
+[[ ${date_label} != - ]]
diff --git a/debian/modules/http-fancyindex/t/bug95-square-brackets.test b/debian/modules/http-fancyindex/t/bug95-square-brackets.test
new file mode 100644
index 00000000..16e1ddc0
--- /dev/null
+++ b/debian/modules/http-fancyindex/t/bug95-square-brackets.test
@@ -0,0 +1,19 @@
+#! /bin/bash
+cat <<---
+Bug #95: FancyIndex does not encode square brackets
+https://github.com/aperezdc/ngx-fancyindex/issues/95
+--
+use pup
+
+# Prepare a directory with a file that contains square brackets in the name.
+mkdir -p "${TESTDIR}/bug95"
+touch "${TESTDIR}"/bug95/'bug[95].txt'
+
+nginx_start
+content=$(fetch /bug95/)
+test -n "${content}" || fail 'Empty response'
+
+expected_href='bug%5B95%5D.txt'
+obtained_href=$(pup -p body tbody 'tr:nth-child(2)' a 'attr{href}' <<< "${content}")
+test "${expected_href}" = "${obtained_href}" || \
+	fail 'Expected: %s - Obtained: %s' "${expected_href}" "${obtained_href}"
diff --git a/debian/modules/http-fancyindex/t/child-directory/empty-file.txt b/debian/modules/http-fancyindex/t/child-directory/empty-file.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/debian/modules/http-fancyindex/template.h b/debian/modules/http-fancyindex/template.h
index 27b95006..2d6604be 100644
--- a/debian/modules/http-fancyindex/template.h
+++ b/debian/modules/http-fancyindex/template.h
@@ -57,9 +57,9 @@ static const u_char t06_list1[] = ""
 "<table id=\"list\">"
 "<thead>"
 "<tr>"
-"<th style=\"width:55%\"><a href=\"?C=N&O=A\">File Name</a>&nbsp;<a href=\"?C=N&O=D\">&nbsp;&darr;&nbsp;</a></th>"
-"<th style=\"width:20%\"><a href=\"?C=S&O=A\">File Size</a>&nbsp;<a href=\"?C=S&O=D\">&nbsp;&darr;&nbsp;</a></th>"
-"<th style=\"width:25%\"><a href=\"?C=M&O=A\">Date</a>&nbsp;<a href=\"?C=M&O=D\">&nbsp;&darr;&nbsp;</a></th>"
+"<th style=\"width:55%\"><a href=\"?C=N&amp;O=A\">File Name</a>&nbsp;<a href=\"?C=N&amp;O=D\">&nbsp;&darr;&nbsp;</a></th>"
+"<th style=\"width:20%\"><a href=\"?C=S&amp;O=A\">File Size</a>&nbsp;<a href=\"?C=S&amp;O=D\">&nbsp;&darr;&nbsp;</a></th>"
+"<th style=\"width:25%\"><a href=\"?C=M&amp;O=A\">Date</a>&nbsp;<a href=\"?C=M&amp;O=D\">&nbsp;&darr;&nbsp;</a></th>"
 "</tr>"
 "</thead>"
 "\n"
diff --git a/debian/modules/http-fancyindex/template.html b/debian/modules/http-fancyindex/template.html
index 8e478f81..b2a31745 100644
--- a/debian/modules/http-fancyindex/template.html
+++ b/debian/modules/http-fancyindex/template.html
@@ -55,9 +55,9 @@ <h1>Index of
 		<table id="list">
 			<thead>
 				<tr>
-					<th style="width:55%"><a href="?C=N&O=A">File Name</a>&nbsp;<a href="?C=N&O=D">&nbsp;&darr;&nbsp;</a></th>
-					<th style="width:20%"><a href="?C=S&O=A">File Size</a>&nbsp;<a href="?C=S&O=D">&nbsp;&darr;&nbsp;</a></th>
-					<th style="width:25%"><a href="?C=M&O=A">Date</a>&nbsp;<a href="?C=M&O=D">&nbsp;&darr;&nbsp;</a></th>
+					<th style="width:55%"><a href="?C=N&amp;O=A">File Name</a>&nbsp;<a href="?C=N&amp;O=D">&nbsp;&darr;&nbsp;</a></th>
+					<th style="width:20%"><a href="?C=S&amp;O=A">File Size</a>&nbsp;<a href="?C=S&amp;O=D">&nbsp;&darr;&nbsp;</a></th>
+					<th style="width:25%"><a href="?C=M&amp;O=A">Date</a>&nbsp;<a href="?C=M&amp;O=D">&nbsp;&darr;&nbsp;</a></th>
 				</tr>
 			</thead>
 
diff --git a/debian/modules/http-geoip2/LICENSE b/debian/modules/http-geoip2/LICENSE
new file mode 100644
index 00000000..fdc13a7f
--- /dev/null
+++ b/debian/modules/http-geoip2/LICENSE
@@ -0,0 +1,23 @@
+Copyright (c) 2014, Lee Valentine <lee@leev.net>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this
+  list of conditions and the following disclaimer in the documentation and/or
+  other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/debian/modules/http-geoip2/README.md b/debian/modules/http-geoip2/README.md
new file mode 100644
index 00000000..a5aec977
--- /dev/null
+++ b/debian/modules/http-geoip2/README.md
@@ -0,0 +1,133 @@
+Description
+===========
+
+**ngx_http_geoip2_module** - creates variables with values from the maxmind geoip2 databases based on the client IP (default) or from a specific variable (supports both IPv4 and IPv6)
+
+The module now supports nginx streams and can be used in the same way the http module can be used.
+
+## Installing
+First install [libmaxminddb](https://github.com/maxmind/libmaxminddb) as described in its [README.md
+file](https://github.com/maxmind/libmaxminddb/blob/master/README.md#installing-from-a-tarball).
+
+#### Download nginx source
+```
+wget http://nginx.org/download/nginx-VERSION.tar.gz
+tar zxvf nginx-VERSION.tar.gz
+cd nginx-VERSION
+```
+
+##### To build as a dynamic module (nginx 1.9.11+):
+```
+./configure --add-dynamic-module=/path/to/ngx_http_geoip2_module
+make
+make install
+```
+
+This will produce ```objs/ngx_http_geoip2_module.so```. It can be copied to your nginx module path manually if you wish.
+
+Add the following line to your nginx.conf:
+```
+load_module modules/ngx_http_geoip2_module.so;
+```
+
+##### To build as a static module:
+```
+./configure --add-module=/path/to/ngx_http_geoip2_module
+make
+make install
+```
+
+## Download Maxmind GeoLite2 Database (optional)
+The free GeoLite2 databases are available from [Maxminds website](http://dev.maxmind.com/geoip/geoip2/geolite2/)
+
+[GeoLite2 City](http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz)
+[GeoLite2 Country](http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz)
+
+## Example Usage:
+```
+http {
+    ...
+    geoip2 /etc/maxmind-country.mmdb {
+        auto_reload 5m;
+        $geoip2_metadata_country_build metadata build_epoch;
+        $geoip2_data_country_code default=US source=$variable_with_ip country iso_code;
+        $geoip2_data_country_name country names en;
+    }
+
+    geoip2 /etc/maxmind-city.mmdb {
+        $geoip2_data_city_name default=London city names en;
+    }
+    ....
+
+    fastcgi_param COUNTRY_CODE $geoip2_data_country_code;
+    fastcgi_param COUNTRY_NAME $geoip2_data_country_name;
+    fastcgi_param CITY_NAME    $geoip2_data_city_name;
+    ....
+}
+
+stream {
+    ...
+    geoip2 /etc/maxmind-country.mmdb {
+        $geoip2_data_country_code default=US source=$remote_addr country iso_code;
+    }
+    ...
+}
+```
+
+##### Metadata:
+Retrieve metadata regarding the geoip database.
+```
+$variable_name metadata <field>
+```
+Available fields:
+  - build_epoch: the build timestamp of the maxmind database.
+  - last_check: the last time the database was checked for changes (when using auto_reload)
+  - last_change: the last time the database was reloaded (when using auto_reload)
+
+##### Autoreload (default: disabled):
+Enabling auto reload will have nginx check the modification time of the database at the specified
+interval and reload it if it has changed.
+```
+auto_reload <interval>
+```
+
+##### GeoIP:
+```
+$variable_name [default=<value] [source=$variable_with_ip] path ...
+```
+If default is not specified, the variable will be empty if not found.
+
+If source is not specified, $remote_addr will be used to perform the lookup.
+
+To find the path of the data you want (eg: country names en), use the [mmdblookup tool](https://maxmind.github.io/libmaxminddb/mmdblookup.html):
+
+```
+$ mmdblookup --file /usr/share/GeoIP/GeoIP2-Country.mmdb --ip 8.8.8.8
+
+  {
+    "country":
+      {
+        "geoname_id":
+          6252001 <uint32>
+        "iso_code":
+          "US" <utf8_string>
+        "names":
+          {
+            "de":
+              "USA" <utf8_string>
+            "en":
+              "United States" <utf8_string>
+          }
+      }
+  }
+
+$ mmdblookup --file /usr/share/GeoIP/GeoIP2-Country.mmdb --ip 8.8.8.8 country names en
+
+  "United States" <utf8_string>
+```
+
+This translates to:
+
+```
+$country_name "default=United States" source=$remote_addr country names en
+```
diff --git a/debian/modules/http-geoip2/config b/debian/modules/http-geoip2/config
new file mode 100644
index 00000000..48bf15d3
--- /dev/null
+++ b/debian/modules/http-geoip2/config
@@ -0,0 +1,43 @@
+ngx_feature="MaxmindDB library"
+ngx_feature_name=
+ngx_feature_run=no
+ngx_feature_incs="#include <maxminddb.h>"
+ngx_feature_libs=-lmaxminddb
+ngx_feature_test="MMDB_s mmdb"
+. auto/feature
+
+ngx_addon_name="ngx_geoip2_module"
+
+if [ $ngx_found = yes ]; then
+	if test -n "$ngx_module_link"; then
+		if [ $HTTP != NO ]; then
+			ngx_module_type=HTTP
+			ngx_module_name="ngx_http_geoip2_module"
+			ngx_module_incs=
+			ngx_module_deps=
+			ngx_module_srcs="$ngx_addon_dir/ngx_http_geoip2_module.c"
+			ngx_module_libs="$ngx_feature_libs"
+			. auto/module
+		fi
+
+		nginx_version=`awk '/^#define nginx_version / {print $3}' src/core/nginx.h`
+		if [ $STREAM != NO -a $nginx_version -gt 1011001 ]; then
+			ngx_module_type=STREAM
+			ngx_module_name="ngx_stream_geoip2_module"
+			ngx_module_incs=
+			ngx_module_deps=
+			ngx_module_srcs="$ngx_addon_dir/ngx_stream_geoip2_module.c"
+			ngx_module_libs="$ngx_feature_libs"
+			. auto/module
+		fi
+	else
+		HTTP_MODULES="$HTTP_MODULES ngx_http_geoip2_module"
+		NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_geoip2_module.c"
+		CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
+	fi
+else   
+	cat << END
+$0: error: the geoip2 module requires the maxminddb library.
+END
+	exit 1
+fi
diff --git a/debian/modules/http-geoip2/ngx_http_geoip2_module.c b/debian/modules/http-geoip2/ngx_http_geoip2_module.c
new file mode 100644
index 00000000..d27c94d4
--- /dev/null
+++ b/debian/modules/http-geoip2/ngx_http_geoip2_module.c
@@ -0,0 +1,793 @@
+/*
+ * Copyright (C) Lee Valentine <lee@leev.net>
+ *
+ * Based on nginx's 'ngx_http_geoip_module.c' by Igor Sysoev
+ */
+
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_http.h>
+
+#include <maxminddb.h>
+
+
+typedef struct {
+    MMDB_s                   mmdb;
+    MMDB_lookup_result_s     result;
+    time_t                   last_check;
+    time_t                   last_change;
+    time_t                   check_interval;
+#if (NGX_HAVE_INET6)
+    uint8_t                  address[16];
+#else
+    unsigned long            address;
+#endif
+    ngx_queue_t              queue;
+} ngx_http_geoip2_db_t;
+
+typedef struct {
+    ngx_queue_t              databases;
+    ngx_array_t              *proxies;
+    ngx_flag_t               proxy_recursive;
+} ngx_http_geoip2_conf_t;
+
+typedef struct {
+    ngx_http_geoip2_db_t     *database;
+    const char               **lookup;
+    ngx_str_t                default_value;
+    ngx_http_complex_value_t source;
+} ngx_http_geoip2_ctx_t;
+
+typedef struct {
+    ngx_http_geoip2_db_t     *database;
+    ngx_str_t                metavalue;
+} ngx_http_geoip2_metadata_t;
+
+
+static ngx_int_t ngx_http_geoip2_variable(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data);
+static ngx_int_t ngx_http_geoip2_metadata(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data);
+static void *ngx_http_geoip2_create_conf(ngx_conf_t *cf);
+static char *ngx_http_geoip2_init_conf(ngx_conf_t *cf, void *conf);
+static char *ngx_http_geoip2(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+static char *ngx_http_geoip2_parse_config(ngx_conf_t *cf, ngx_command_t *dummy,
+    void *conf);
+static char *ngx_http_geoip2_add_variable(ngx_conf_t *cf, ngx_command_t *dummy,
+    void *conf);
+static char *ngx_http_geoip2_add_variable_geodata(ngx_conf_t *cf,
+    ngx_http_geoip2_db_t *database);
+static char *ngx_http_geoip2_add_variable_metadata(ngx_conf_t *cf,
+    ngx_http_geoip2_db_t *database);
+static char *ngx_http_geoip2_proxy(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+static ngx_int_t ngx_http_geoip2_cidr_value(ngx_conf_t *cf, ngx_str_t *net,
+    ngx_cidr_t *cidr);
+static void ngx_http_geoip2_cleanup(void *data);
+static ngx_int_t ngx_http_geoip2_init(ngx_conf_t *cf);
+
+
+#define FORMAT(fmt, ...) do {                           \
+        p = ngx_palloc(r->pool, NGX_OFF_T_LEN);         \
+        if (p == NULL) {                                \
+            return NGX_ERROR;                           \
+        }                                               \
+        v->len = ngx_sprintf(p, fmt, __VA_ARGS__) - p;  \
+        v->data = p;                                    \
+} while (0)
+
+static ngx_command_t  ngx_http_geoip2_commands[] = {
+
+    { ngx_string("geoip2"),
+        NGX_HTTP_MAIN_CONF|NGX_CONF_BLOCK|NGX_CONF_TAKE1,
+        ngx_http_geoip2,
+        NGX_HTTP_MAIN_CONF_OFFSET,
+        0,
+        NULL },
+
+    { ngx_string("geoip2_proxy"),
+        NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+        ngx_http_geoip2_proxy,
+        NGX_HTTP_MAIN_CONF_OFFSET,
+        0,
+        NULL },
+
+    { ngx_string("geoip2_proxy_recursive"),
+        NGX_HTTP_MAIN_CONF|NGX_CONF_FLAG,
+        ngx_conf_set_flag_slot,
+        NGX_HTTP_MAIN_CONF_OFFSET,
+        offsetof(ngx_http_geoip2_conf_t, proxy_recursive),
+        NULL },
+
+    ngx_null_command
+};
+
+
+static ngx_http_module_t  ngx_http_geoip2_module_ctx = {
+    NULL,                                  /* preconfiguration */
+    ngx_http_geoip2_init,                  /* postconfiguration */
+
+    ngx_http_geoip2_create_conf,           /* create main configuration */
+    ngx_http_geoip2_init_conf,             /* init main configuration */
+
+    NULL,                                  /* create server configuration */
+    NULL,                                  /* merge server configuration */
+
+    NULL,                                  /* create location configuration */
+    NULL                                   /* merge location configuration */
+};
+
+
+ngx_module_t  ngx_http_geoip2_module = {
+    NGX_MODULE_V1,
+    &ngx_http_geoip2_module_ctx,           /* module context */
+    ngx_http_geoip2_commands,              /* module directives */
+    NGX_HTTP_MODULE,                       /* module type */
+    NULL,                                  /* init master */
+    NULL,                                  /* init module */
+    NULL,                                  /* init process */
+    NULL,                                  /* init thread */
+    NULL,                                  /* exit thread */
+    NULL,                                  /* exit process */
+    NULL,                                  /* exit master */
+    NGX_MODULE_V1_PADDING
+};
+
+
+static ngx_int_t
+ngx_http_geoip2_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v,
+    uintptr_t data)
+{
+    ngx_http_geoip2_ctx_t   *geoip2 = (ngx_http_geoip2_ctx_t *) data;
+    ngx_http_geoip2_db_t    *database = geoip2->database;
+    int                     mmdb_error;
+    MMDB_entry_data_s       entry_data;
+    ngx_http_geoip2_conf_t  *gcf;
+    ngx_addr_t              addr;
+    ngx_array_t             *xfwd;
+    u_char                  *p;
+    ngx_str_t               val;
+
+#if (NGX_HAVE_INET6)
+    uint8_t address[16], *addressp = address;
+#else
+    unsigned long address;
+#endif
+
+    if (geoip2->source.value.len > 0) {
+         if (ngx_http_complex_value(r, &geoip2->source, &val) != NGX_OK) {
+             goto not_found;
+         }
+
+        if (ngx_parse_addr(r->pool, &addr, val.data, val.len) != NGX_OK) {
+            goto not_found;
+        }
+    } else {
+        gcf = ngx_http_get_module_main_conf(r, ngx_http_geoip2_module);
+        addr.sockaddr = r->connection->sockaddr;
+        addr.socklen = r->connection->socklen;
+
+        xfwd = &r->headers_in.x_forwarded_for;
+
+        if (xfwd->nelts > 0 && gcf->proxies != NULL) {
+            (void) ngx_http_get_forwarded_addr(r, &addr, xfwd, NULL,
+                                               gcf->proxies, gcf->proxy_recursive);
+        }
+    }
+
+    switch (addr.sockaddr->sa_family) {
+        case AF_INET:
+#if (NGX_HAVE_INET6)
+            ngx_memset(addressp, 0, 12);
+            ngx_memcpy(addressp + 12, &((struct sockaddr_in *)
+                                        addr.sockaddr)->sin_addr.s_addr, 4);
+            break;
+
+        case AF_INET6:
+            ngx_memcpy(addressp, &((struct sockaddr_in6 *)
+                                   addr.sockaddr)->sin6_addr.s6_addr, 16);
+#else
+            address = ((struct sockaddr_in *)addr.sockaddr)->sin_addr.s_addr;
+#endif
+            break;
+
+        default:
+            goto not_found;
+    }
+
+#if (NGX_HAVE_INET6)
+    if (ngx_memcmp(&address, &database->address, sizeof(address))
+        != 0) {
+#else
+    if (address != database->address) {
+#endif
+        memcpy(&database->address, &address, sizeof(address));
+        database->result = MMDB_lookup_sockaddr(&database->mmdb,
+                                           addr.sockaddr, &mmdb_error);
+
+        if (mmdb_error != MMDB_SUCCESS) {
+            goto not_found;
+        }
+    }
+
+    if (!database->result.found_entry
+            || MMDB_aget_value(&database->result.entry, &entry_data,
+                               geoip2->lookup) != MMDB_SUCCESS) {
+        goto not_found;
+    }
+
+    if (!entry_data.has_data) {
+        goto not_found;
+    }
+
+    switch (entry_data.type) {
+        case MMDB_DATA_TYPE_BOOLEAN:
+            FORMAT("%d", entry_data.boolean);
+            break;
+        case MMDB_DATA_TYPE_UTF8_STRING:
+            v->len = entry_data.data_size;
+            v->data = ngx_pnalloc(r->pool, v->len);
+            if (v->data == NULL) {
+                return NGX_ERROR;
+            }
+            ngx_memcpy(v->data, (u_char *) entry_data.utf8_string, v->len);
+            break;
+        case MMDB_DATA_TYPE_BYTES:
+            v->len = entry_data.data_size;
+            v->data = ngx_pnalloc(r->pool, v->len);
+            if (v->data == NULL) {
+                return NGX_ERROR;
+            }
+            ngx_memcpy(v->data, (u_char *) entry_data.bytes, v->len);
+            break;
+        case MMDB_DATA_TYPE_FLOAT:
+            FORMAT("%.5f", entry_data.float_value);
+            break;
+        case MMDB_DATA_TYPE_DOUBLE:
+            FORMAT("%.5f", entry_data.double_value);
+            break;
+        case MMDB_DATA_TYPE_UINT16:
+            FORMAT("%uD", entry_data.uint16);
+            break;
+        case MMDB_DATA_TYPE_UINT32:
+            FORMAT("%uD", entry_data.uint32);
+            break;
+        case MMDB_DATA_TYPE_INT32:
+            FORMAT("%D", entry_data.int32);
+            break;
+        case MMDB_DATA_TYPE_UINT64:
+            FORMAT("%uL", entry_data.uint64);
+            break;
+        case MMDB_DATA_TYPE_UINT128: ;
+#if MMDB_UINT128_IS_BYTE_ARRAY
+            uint8_t *val = (uint8_t *)entry_data.uint128;
+            FORMAT( "0x%02x%02x%02x%02x%02x%02x%02x%02x"
+                      "%02x%02x%02x%02x%02x%02x%02x%02x",
+                    val[0], val[1], val[2], val[3],
+                    val[4], val[5], val[6], val[7],
+                    val[8], val[9], val[10], val[11],
+                    val[12], val[13], val[14], val[15]);
+#else
+            mmdb_uint128_t val = entry_data.uint128;
+            FORMAT("0x%016uxL%016uxL",
+                    (uint64_t) (val >> 64), (uint64_t) val);
+#endif
+            break;
+        default:
+            goto not_found;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+
+    return NGX_OK;
+
+not_found:
+    if (geoip2->default_value.len > 0) {
+        v->data = geoip2->default_value.data;
+        v->len = geoip2->default_value.len;
+
+        v->valid = 1;
+        v->no_cacheable = 0;
+        v->not_found = 0;
+    } else {
+        v->not_found = 1;
+    }
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_http_geoip2_metadata(ngx_http_request_t *r, ngx_http_variable_value_t *v,
+    uintptr_t data)
+{
+    ngx_http_geoip2_metadata_t  *metadata = (ngx_http_geoip2_metadata_t *) data;
+    ngx_http_geoip2_db_t        *database = metadata->database;
+    u_char                      *p;
+
+    if (ngx_strncmp(metadata->metavalue.data, "build_epoch", 11) == 0) {
+        FORMAT("%uL", database->mmdb.metadata.build_epoch);
+    } else if (ngx_strncmp(metadata->metavalue.data, "last_check", 10) == 0) {
+        FORMAT("%T", database->last_check);
+    } else if (ngx_strncmp(metadata->metavalue.data, "last_change", 11) == 0) {
+        FORMAT("%T", database->last_change);
+    } else {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+
+    return NGX_OK;
+}
+
+
+static void *
+ngx_http_geoip2_create_conf(ngx_conf_t *cf)
+{
+    ngx_pool_cleanup_t      *cln;
+    ngx_http_geoip2_conf_t  *conf;
+
+    conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_geoip2_conf_t));
+    if (conf == NULL) {
+        return NULL;
+    }
+
+    conf->proxy_recursive = NGX_CONF_UNSET;
+
+    cln = ngx_pool_cleanup_add(cf->pool, 0);
+    if (cln == NULL) {
+        return NULL;
+    }
+
+    ngx_queue_init(&conf->databases);
+
+    cln->handler = ngx_http_geoip2_cleanup;
+    cln->data = conf;
+
+    return conf;
+}
+
+
+static char *
+ngx_http_geoip2(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+    ngx_http_geoip2_conf_t  *gcf = conf;
+    ngx_str_t               *value;
+    int                     status;
+    ngx_http_geoip2_db_t    *database;
+    char                    *rv;
+    ngx_conf_t              save;
+    ngx_queue_t             *q;
+
+    value = cf->args->elts;
+
+    if (value[1].data && value[1].data[0] != '/') {
+        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+    if (!ngx_queue_empty(&gcf->databases)) {
+        for (q = ngx_queue_head(&gcf->databases);
+             q != ngx_queue_sentinel(&gcf->databases);
+             q = ngx_queue_next(q))
+        {
+            database = ngx_queue_data(q, ngx_http_geoip2_db_t, queue);
+            if (ngx_strcmp(value[1].data, database->mmdb.filename) == 0) {
+                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                   "Duplicate GeoIP2 mmdb - %V", &value[1]);
+                return NGX_CONF_ERROR;
+            }
+        }
+    }
+
+    database = ngx_pcalloc(cf->pool, sizeof(ngx_http_geoip2_db_t));
+    if (database == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    ngx_queue_insert_tail(&gcf->databases, &database->queue);
+    database->last_check = database->last_change = ngx_time();
+
+    status = MMDB_open((char *) value[1].data, MMDB_MODE_MMAP, &database->mmdb);
+
+    if (status != MMDB_SUCCESS) {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "MMDB_open(\"%V\") failed - %s", &value[1],
+                           MMDB_strerror(status));
+        return NGX_CONF_ERROR;
+    }
+
+    save = *cf;
+    cf->handler = ngx_http_geoip2_parse_config;
+    cf->handler_conf = (void *) database;
+
+    rv = ngx_conf_parse(cf, NULL);
+    *cf = save;
+    return rv;
+}
+
+
+static char *
+ngx_http_geoip2_parse_config(ngx_conf_t *cf, ngx_command_t *dummy, void *conf)
+{
+    ngx_http_geoip2_db_t  *database;
+    ngx_str_t             *value;
+    time_t                interval;
+
+    value = cf->args->elts;
+
+    if (value[0].data[0] == '$') {
+        return ngx_http_geoip2_add_variable(cf, dummy, conf);
+    }
+
+    if (value[0].len == 11
+            && ngx_strncmp(value[0].data, "auto_reload", 11) == 0) {
+        if ((int) cf->args->nelts != 2) {
+            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                               "invalid number of arguments for auto_reload");
+            return NGX_CONF_ERROR;
+        }
+
+        interval = ngx_parse_time(&value[1], true);
+
+        if (interval == (time_t) NGX_ERROR) {
+            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                               "invalid interval for auto_reload \"%V\"",
+                               value[1]);
+            return NGX_CONF_ERROR;
+        }
+
+
+        database = (ngx_http_geoip2_db_t *) conf;
+        database->check_interval = interval;
+        return NGX_CONF_OK;
+    }
+
+    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                       "invalid setting \"%V\"", &value[0]);
+    return NGX_CONF_ERROR;
+}
+
+
+static char *
+ngx_http_geoip2_add_variable(ngx_conf_t *cf, ngx_command_t *dummy, void *conf)
+{
+    ngx_http_geoip2_db_t  *database;
+    ngx_str_t             *value;
+    int                   nelts;
+
+    value = cf->args->elts;
+
+    if (value[0].data[0] != '$') {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "invalid variable name \"%V\"", &value[0]);
+        return NGX_CONF_ERROR;
+    }
+
+    value[0].len--;
+    value[0].data++;
+
+    nelts = (int) cf->args->nelts;
+    database = (ngx_http_geoip2_db_t *) conf;
+
+    if (nelts > 0 && value[1].len == 8 && ngx_strncmp(value[1].data, "metadata", 8) == 0) {
+        return ngx_http_geoip2_add_variable_metadata(cf, database);
+    }
+
+    return ngx_http_geoip2_add_variable_geodata(cf, database);
+}
+
+
+static char *
+ngx_http_geoip2_add_variable_metadata(ngx_conf_t *cf, ngx_http_geoip2_db_t *database)
+{
+    ngx_http_geoip2_metadata_t  *metadata;
+    ngx_str_t                   *value, name;
+    ngx_http_variable_t         *var;
+
+    metadata = ngx_pcalloc(cf->pool, sizeof(ngx_http_geoip2_metadata_t));
+    if (metadata == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    value = cf->args->elts;
+    name = value[0];
+
+    metadata->database = database;
+    metadata->metavalue = value[2];
+
+    var = ngx_http_add_variable(cf, &name, NGX_HTTP_VAR_CHANGEABLE);
+    if (var == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    var->get_handler = ngx_http_geoip2_metadata;
+    var->data = (uintptr_t) metadata;
+
+    return NGX_CONF_OK;
+}
+
+
+static char *
+ngx_http_geoip2_add_variable_geodata(ngx_conf_t *cf, ngx_http_geoip2_db_t *database)
+{
+    ngx_http_geoip2_ctx_t             *geoip2;
+    ngx_http_compile_complex_value_t  ccv;
+    ngx_str_t                         *value, name, source;
+    ngx_http_variable_t               *var;
+    int                               i, nelts, idx;
+
+    geoip2 = ngx_pcalloc(cf->pool, sizeof(ngx_http_geoip2_ctx_t));
+    if (geoip2 == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    geoip2->database = database;
+    ngx_str_null(&source);
+
+    value = cf->args->elts;
+    name = value[0];
+
+    nelts = (int) cf->args->nelts;
+    idx = 1;
+
+    if (nelts > idx) {
+        for (i = idx; i < nelts; i++) {
+            if (ngx_strnstr(value[idx].data, "=", value[idx].len) == NULL) {
+                break;
+            }
+
+            if (value[idx].len > 8 && ngx_strncmp(value[idx].data, "default=", 8) == 0) {
+                if (geoip2->default_value.len > 0) {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "default has already been declared for  \"$%V\"", &name);
+                    return NGX_CONF_ERROR;
+                }
+
+                geoip2->default_value.len  = value[idx].len - 8;
+                geoip2->default_value.data = value[idx].data + 8;
+            } else if (value[idx].len > 7 && ngx_strncmp(value[idx].data, "source=", 7) == 0) {
+                if (source.len > 0) {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "source has already been declared for  \"$%V\"", &name);
+                    return NGX_CONF_ERROR;
+                }
+
+                source.len  = value[idx].len - 7;
+                source.data = value[idx].data + 7;
+
+                if (source.data[0] != '$') {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "invalid source variable name \"%V\"", &source);
+                    return NGX_CONF_ERROR;
+                }
+
+                ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
+                ccv.cf = cf;
+                ccv.value = &source;
+                ccv.complex_value = &geoip2->source;
+
+                if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "unable to compile \"%V\" for \"$%V\"", &source, &name);
+                    return NGX_CONF_ERROR;
+                }
+            } else {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "invalid setting \"%V\" for \"$%V\"", &value[idx], &name);
+                    return NGX_CONF_ERROR;
+            }
+
+            idx++;
+        }
+    }
+
+    var = ngx_http_add_variable(cf, &name, NGX_HTTP_VAR_CHANGEABLE);
+    if (var == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    geoip2->lookup = ngx_pcalloc(cf->pool, sizeof(const char *) *
+                                 (cf->args->nelts - (idx - 1)));
+
+    if (geoip2->lookup == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    for (i = idx; i < nelts; i++) {
+        geoip2->lookup[i - idx] = (char *) value[i].data;
+    }
+    geoip2->lookup[i - idx] = NULL;
+
+    var->get_handler = ngx_http_geoip2_variable;
+    var->data = (uintptr_t) geoip2;
+
+    return NGX_CONF_OK;
+}
+
+
+static char *
+ngx_http_geoip2_init_conf(ngx_conf_t *cf, void *conf)
+{
+    ngx_http_geoip2_conf_t  *gcf = conf;
+    ngx_conf_init_value(gcf->proxy_recursive, 0);
+    return NGX_CONF_OK;
+}
+
+
+static char *
+ngx_http_geoip2_proxy(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+    ngx_http_geoip2_conf_t  *gcf = conf;
+    ngx_str_t               *value;
+    ngx_cidr_t              cidr, *c;
+
+    value = cf->args->elts;
+
+    if (ngx_http_geoip2_cidr_value(cf, &value[1], &cidr) != NGX_OK) {
+        return NGX_CONF_ERROR;
+    }
+
+    if (gcf->proxies == NULL) {
+        gcf->proxies = ngx_array_create(cf->pool, 4, sizeof(ngx_cidr_t));
+        if (gcf->proxies == NULL) {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+    c = ngx_array_push(gcf->proxies);
+    if (c == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    *c = cidr;
+
+    return NGX_CONF_OK;
+}
+
+
+static ngx_int_t
+ngx_http_geoip2_cidr_value(ngx_conf_t *cf, ngx_str_t *net, ngx_cidr_t *cidr)
+{
+    ngx_int_t  rc;
+
+    if (ngx_strcmp(net->data, "255.255.255.255") == 0) {
+        cidr->family = AF_INET;
+        cidr->u.in.addr = 0xffffffff;
+        cidr->u.in.mask = 0xffffffff;
+
+        return NGX_OK;
+    }
+
+    rc = ngx_ptocidr(net, cidr);
+
+    if (rc == NGX_ERROR) {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "invalid network \"%V\"", net);
+        return NGX_ERROR;
+    }
+
+    if (rc == NGX_DONE) {
+        ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
+                           "low address bits of %V are meaningless", net);
+    }
+
+    return NGX_OK;
+}
+
+
+static void
+ngx_http_geoip2_cleanup(void *data)
+{
+    ngx_http_geoip2_conf_t  *gcf = data;
+    ngx_queue_t             *q;
+    ngx_http_geoip2_db_t    *database;
+
+    while (!ngx_queue_empty(&gcf->databases)) {
+        q = ngx_queue_head(&gcf->databases);
+        ngx_queue_remove(q);
+        database = ngx_queue_data(q, ngx_http_geoip2_db_t, queue);
+        MMDB_close(&database->mmdb);
+    }
+}
+
+
+static ngx_int_t
+ngx_http_geoip2_log_handler(ngx_http_request_t *r)
+{
+    int                      status;
+    MMDB_s                   tmpdb;
+    ngx_queue_t              *q;
+    ngx_file_info_t          fi;
+    ngx_http_geoip2_db_t    *database;
+    ngx_http_geoip2_conf_t  *gcf;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   "geoip2 http log handler");
+
+    gcf = ngx_http_get_module_main_conf(r, ngx_http_geoip2_module);
+
+    if (ngx_queue_empty(&gcf->databases)) {
+        return NGX_OK;
+    }
+
+    for (q = ngx_queue_head(&gcf->databases);
+         q != ngx_queue_sentinel(&gcf->databases);
+         q = ngx_queue_next(q))
+    {
+        database = ngx_queue_data(q, ngx_http_geoip2_db_t, queue);
+        if (database->check_interval == 0) {
+            continue;
+        }
+
+        if ((database->last_check + database->check_interval)
+            > ngx_time())
+        {
+            continue;
+        }
+
+        database->last_check = ngx_time();
+
+        if (ngx_file_info(database->mmdb.filename, &fi) == NGX_FILE_ERROR) {
+            ngx_log_error(NGX_LOG_EMERG, r->connection->log, ngx_errno,
+                          ngx_file_info_n " \"%s\" failed",
+                          database->mmdb.filename);
+
+            continue;
+        }
+
+        if (ngx_file_mtime(&fi) <= database->last_change) {
+            continue;
+        }
+
+        /* do the reload */
+
+        ngx_memzero(&tmpdb, sizeof(MMDB_s));
+        status = MMDB_open(database->mmdb.filename, MMDB_MODE_MMAP, &tmpdb);
+
+        if (status != MMDB_SUCCESS) {
+            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                          "MMDB_open(\"%s\") failed to reload - %s",
+                          database->mmdb.filename, MMDB_strerror(status));
+
+            continue;
+        }
+
+        database->last_change = ngx_file_mtime(&fi);
+        MMDB_close(&database->mmdb);
+        database->mmdb = tmpdb;
+
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "Reload MMDB \"%s\"",
+                      database->mmdb.filename);
+    }
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_http_geoip2_init(ngx_conf_t *cf)
+{
+    ngx_http_handler_pt        *h;
+    ngx_http_core_main_conf_t  *cmcf;
+
+    cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
+
+    h = ngx_array_push(&cmcf->phases[NGX_HTTP_LOG_PHASE].handlers);
+    if (h == NULL) {
+        return NGX_ERROR;
+    }
+
+    *h = ngx_http_geoip2_log_handler;
+
+    return NGX_OK;
+}
diff --git a/debian/modules/http-geoip2/ngx_stream_geoip2_module.c b/debian/modules/http-geoip2/ngx_stream_geoip2_module.c
new file mode 100644
index 00000000..eb590827
--- /dev/null
+++ b/debian/modules/http-geoip2/ngx_stream_geoip2_module.c
@@ -0,0 +1,694 @@
+/*
+ * Copyright (C) Lee Valentine <lee@leev.net>
+ * Copyright (C) Andrei Belov <defanator@gmail.com>
+ *
+ * Based on nginx's 'ngx_stream_geoip_module.c' by Igor Sysoev
+ */
+
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_stream.h>
+
+#include <maxminddb.h>
+
+
+typedef struct {
+    MMDB_s                   mmdb;
+    MMDB_lookup_result_s     result;
+    time_t                   last_check;
+    time_t                   last_change;
+    time_t                   check_interval;
+#if (NGX_HAVE_INET6)
+    uint8_t                  address[16];
+#else
+    unsigned long            address;
+#endif
+    ngx_queue_t              queue;
+} ngx_stream_geoip2_db_t;
+
+typedef struct {
+    ngx_queue_t              databases;
+} ngx_stream_geoip2_conf_t;
+
+typedef struct {
+    ngx_stream_geoip2_db_t   *database;
+    const char               **lookup;
+    ngx_str_t                default_value;
+    ngx_stream_complex_value_t source;
+} ngx_stream_geoip2_ctx_t;
+
+typedef struct {
+    ngx_stream_geoip2_db_t   *database;
+    ngx_str_t                metavalue;
+} ngx_stream_geoip2_metadata_t;
+
+
+static ngx_int_t ngx_stream_geoip2_variable(ngx_stream_session_t *s,
+    ngx_stream_variable_value_t *v, uintptr_t data);
+static ngx_int_t ngx_stream_geoip2_metadata(ngx_stream_session_t *s,
+    ngx_stream_variable_value_t *v, uintptr_t data);
+static void *ngx_stream_geoip2_create_conf(ngx_conf_t *cf);
+static char *ngx_stream_geoip2(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+static char *ngx_stream_geoip2_parse_config(ngx_conf_t *cf, ngx_command_t *dummy,
+    void *conf);
+static char *ngx_stream_geoip2(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+static char *ngx_stream_geoip2_add_variable(ngx_conf_t *cf, ngx_command_t *dummy,
+    void *conf);
+static char *ngx_stream_geoip2_add_variable_geodata(ngx_conf_t *cf,
+    ngx_stream_geoip2_db_t *database);
+static char *ngx_stream_geoip2_add_variable_metadata(ngx_conf_t *cf,
+    ngx_stream_geoip2_db_t *database);
+static void ngx_stream_geoip2_cleanup(void *data);
+static ngx_int_t ngx_stream_geoip2_init(ngx_conf_t *cf);
+
+
+#define FORMAT(fmt, ...) do {                               \
+        p = ngx_palloc(s->connection->pool, NGX_OFF_T_LEN); \
+        if (p == NULL) {                                    \
+            return NGX_ERROR;                               \
+        }                                                   \
+        v->len = ngx_sprintf(p, fmt, __VA_ARGS__) - p;      \
+        v->data = p;                                        \
+} while (0)
+
+static ngx_command_t  ngx_stream_geoip2_commands[] = {
+
+    { ngx_string("geoip2"),
+        NGX_STREAM_MAIN_CONF|NGX_CONF_BLOCK|NGX_CONF_TAKE1,
+        ngx_stream_geoip2,
+        NGX_STREAM_MAIN_CONF_OFFSET,
+        0,
+        NULL },
+
+    ngx_null_command
+};
+
+
+static ngx_stream_module_t  ngx_stream_geoip2_module_ctx = {
+    NULL,                                  /* preconfiguration */
+    ngx_stream_geoip2_init,                /* postconfiguration */
+
+    ngx_stream_geoip2_create_conf,         /* create main configuration */
+    NULL,                                  /* init main configuration */
+
+    NULL,                                  /* create server configuration */
+    NULL                                   /* merge server configuration */
+};
+
+
+ngx_module_t  ngx_stream_geoip2_module = {
+    NGX_MODULE_V1,
+    &ngx_stream_geoip2_module_ctx,         /* module context */
+    ngx_stream_geoip2_commands,            /* module directives */
+    NGX_STREAM_MODULE,                     /* module type */
+    NULL,                                  /* init master */
+    NULL,                                  /* init module */
+    NULL,                                  /* init process */
+    NULL,                                  /* init thread */
+    NULL,                                  /* exit thread */
+    NULL,                                  /* exit process */
+    NULL,                                  /* exit master */
+    NGX_MODULE_V1_PADDING
+};
+
+
+static ngx_int_t
+ngx_stream_geoip2_variable(ngx_stream_session_t *s, ngx_stream_variable_value_t *v,
+    uintptr_t data)
+{
+    int                       mmdb_error;
+    u_char                   *p;
+    ngx_str_t                 val;
+    ngx_addr_t                addr;
+    MMDB_entry_data_s         entry_data;
+    ngx_stream_geoip2_ctx_t  *geoip2 = (ngx_stream_geoip2_ctx_t *) data;
+    ngx_stream_geoip2_db_t   *database = geoip2->database;
+
+#if (NGX_HAVE_INET6)
+    uint8_t address[16], *addressp = address;
+#else
+    unsigned long address;
+#endif
+
+    if (geoip2->source.value.len > 0) {
+         if (ngx_stream_complex_value(s, &geoip2->source, &val) != NGX_OK) {
+             goto not_found;
+         }
+
+        if (ngx_parse_addr(s->connection->pool, &addr, val.data, val.len) != NGX_OK) {
+            goto not_found;
+        }
+    } else {
+        addr.sockaddr = s->connection->sockaddr;
+        addr.socklen = s->connection->socklen;
+    }
+
+    switch (addr.sockaddr->sa_family) {
+        case AF_INET:
+#if (NGX_HAVE_INET6)
+            ngx_memset(addressp, 0, 12);
+            ngx_memcpy(addressp + 12, &((struct sockaddr_in *)
+                                        addr.sockaddr)->sin_addr.s_addr, 4);
+            break;
+
+        case AF_INET6:
+            ngx_memcpy(addressp, &((struct sockaddr_in6 *)
+                                   addr.sockaddr)->sin6_addr.s6_addr, 16);
+#else
+            address = ((struct sockaddr_in *)addr.sockaddr)->sin_addr.s_addr;
+#endif
+            break;
+
+        default:
+            goto not_found;
+    }
+
+#if (NGX_HAVE_INET6)
+    if (ngx_memcmp(&address, &database->address, sizeof(address)) != 0) {
+#else
+    if (address != database->address) {
+#endif
+        memcpy(&database->address, &address, sizeof(address));
+        database->result = MMDB_lookup_sockaddr(&database->mmdb,
+                                                addr.sockaddr, &mmdb_error);
+
+        if (mmdb_error != MMDB_SUCCESS) {
+            goto not_found;
+        }
+    }
+
+    if (!database->result.found_entry
+        || MMDB_aget_value(&database->result.entry, &entry_data, geoip2->lookup)
+        != MMDB_SUCCESS)
+    {
+        goto not_found;
+    }
+
+    if (!entry_data.has_data) {
+        goto not_found;
+    }
+
+    switch (entry_data.type) {
+        case MMDB_DATA_TYPE_BOOLEAN:
+            FORMAT("%d", entry_data.boolean);
+            break;
+        case MMDB_DATA_TYPE_UTF8_STRING:
+            v->len = entry_data.data_size;
+            v->data = ngx_pnalloc(s->connection->pool, v->len);
+            if (v->data == NULL) {
+                return NGX_ERROR;
+            }
+            ngx_memcpy(v->data, (u_char *) entry_data.utf8_string, v->len);
+            break;
+        case MMDB_DATA_TYPE_BYTES:
+            v->len = entry_data.data_size;
+            v->data = ngx_pnalloc(s->connection->pool, v->len);
+            if (v->data == NULL) {
+                return NGX_ERROR;
+            }
+            ngx_memcpy(v->data, (u_char *) entry_data.bytes, v->len);
+            break;
+        case MMDB_DATA_TYPE_FLOAT:
+            FORMAT("%.5f", entry_data.float_value);
+            break;
+        case MMDB_DATA_TYPE_DOUBLE:
+            FORMAT("%.5f", entry_data.double_value);
+            break;
+        case MMDB_DATA_TYPE_UINT16:
+            FORMAT("%uD", entry_data.uint16);
+            break;
+        case MMDB_DATA_TYPE_UINT32:
+            FORMAT("%uD", entry_data.uint32);
+            break;
+        case MMDB_DATA_TYPE_INT32:
+            FORMAT("%D", entry_data.int32);
+            break;
+        case MMDB_DATA_TYPE_UINT64:
+            FORMAT("%uL", entry_data.uint64);
+            break;
+        case MMDB_DATA_TYPE_UINT128: ;
+#if MMDB_UINT128_IS_BYTE_ARRAY
+            uint8_t *val = (uint8_t *) entry_data.uint128;
+            FORMAT("0x%02x%02x%02x%02x%02x%02x%02x%02x"
+                   "%02x%02x%02x%02x%02x%02x%02x%02x",
+                   val[0], val[1], val[2], val[3],
+                   val[4], val[5], val[6], val[7],
+                   val[8], val[9], val[10], val[11],
+                   val[12], val[13], val[14], val[15]);
+#else
+            mmdb_uint128_t val = entry_data.uint128;
+            FORMAT("0x%016uxL%016uxL",
+                   (uint64_t) (val >> 64), (uint64_t) val);
+#endif
+            break;
+        default:
+            goto not_found;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+
+    return NGX_OK;
+
+not_found:
+    if (geoip2->default_value.len > 0) {
+        v->data = geoip2->default_value.data;
+        v->len = geoip2->default_value.len;
+
+        v->valid = 1;
+        v->no_cacheable = 0;
+        v->not_found = 0;
+
+        return NGX_OK;
+    }
+
+    v->not_found = 1;
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_stream_geoip2_metadata(ngx_stream_session_t *s, ngx_stream_variable_value_t *v,
+    uintptr_t data)
+{
+    ngx_stream_geoip2_metadata_t  *metadata = (ngx_stream_geoip2_metadata_t *) data;
+    ngx_stream_geoip2_db_t        *database = metadata->database;
+    u_char                        *p;
+
+    if (ngx_strncmp(metadata->metavalue.data, "build_epoch", 11) == 0) {
+        FORMAT("%uL", database->mmdb.metadata.build_epoch);
+    } else if (ngx_strncmp(metadata->metavalue.data, "last_check", 10) == 0) {
+        FORMAT("%T", database->last_check);
+    } else if (ngx_strncmp(metadata->metavalue.data, "last_change", 11) == 0) {
+        FORMAT("%T", database->last_change);
+    } else {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+
+    return NGX_OK;
+}
+
+
+static void *
+ngx_stream_geoip2_create_conf(ngx_conf_t *cf)
+{
+    ngx_pool_cleanup_t        *cln;
+    ngx_stream_geoip2_conf_t  *conf;
+
+    conf = ngx_pcalloc(cf->pool, sizeof(ngx_stream_geoip2_conf_t));
+    if (conf == NULL) {
+        return NULL;
+    }
+
+    cln = ngx_pool_cleanup_add(cf->pool, 0);
+    if (cln == NULL) {
+        return NULL;
+    }
+
+    ngx_queue_init(&conf->databases);
+
+    cln->handler = ngx_stream_geoip2_cleanup;
+    cln->data = conf;
+
+    return conf;
+}
+
+
+static char *
+ngx_stream_geoip2(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+    int                       status;
+    char                      *rv;
+    ngx_str_t                 *value;
+    ngx_conf_t                save;
+    ngx_stream_geoip2_db_t    *database;
+    ngx_stream_geoip2_conf_t  *gcf = conf;
+    ngx_queue_t               *q;
+
+    value = cf->args->elts;
+
+    if (value[1].data && value[1].data[0] != '/') {
+        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+    if (!ngx_queue_empty(&gcf->databases)) {
+        for (q = ngx_queue_head(&gcf->databases);
+             q != ngx_queue_sentinel(&gcf->databases);
+             q = ngx_queue_next(q))
+        {
+            database = ngx_queue_data(q, ngx_stream_geoip2_db_t, queue);
+            if (ngx_strcmp(value[1].data, database->mmdb.filename) == 0) {
+                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                   "Duplicate GeoIP2 mmdb - %V", &value[1]);
+                return NGX_CONF_ERROR;
+            }
+        }
+    }
+
+    database = ngx_pcalloc(cf->pool, sizeof(ngx_stream_geoip2_db_t));
+    if (database == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    ngx_queue_insert_tail(&gcf->databases, &database->queue);
+    database->last_check = database->last_change = ngx_time();
+
+    status = MMDB_open((char *) value[1].data, MMDB_MODE_MMAP, &database->mmdb);
+
+    if (status != MMDB_SUCCESS) {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "MMDB_open(\"%V\") failed - %s", &value[1],
+                           MMDB_strerror(status));
+        return NGX_CONF_ERROR;
+    }
+
+    save = *cf;
+    cf->handler = ngx_stream_geoip2_parse_config;
+    cf->handler_conf = (void *) database;
+
+    rv = ngx_conf_parse(cf, NULL);
+    *cf = save;
+    return rv;
+}
+
+
+static char *
+ngx_stream_geoip2_parse_config(ngx_conf_t *cf, ngx_command_t *dummy, void *conf)
+{
+    ngx_stream_geoip2_db_t  *database;
+    ngx_str_t             *value;
+    time_t                interval;
+
+    value = cf->args->elts;
+
+    if (value[0].data[0] == '$') {
+        return ngx_stream_geoip2_add_variable(cf, dummy, conf);
+    }
+
+    if (value[0].len == 11
+            && ngx_strncmp(value[0].data, "auto_reload", 11) == 0) {
+        if ((int) cf->args->nelts != 2) {
+            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                               "invalid number of arguments for auto_reload");
+            return NGX_CONF_ERROR;
+        }
+
+        interval = ngx_parse_time(&value[1], true);
+
+        if (interval == (time_t) NGX_ERROR) {
+            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                               "invalid interval for auto_reload \"%V\"",
+                               value[1]);
+            return NGX_CONF_ERROR;
+        }
+
+
+        database = (ngx_stream_geoip2_db_t *) conf;
+        database->check_interval = interval;
+        return NGX_CONF_OK;
+    }
+
+    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                       "invalid setting \"%V\"", &value[0]);
+    return NGX_CONF_ERROR;
+}
+
+
+static char *
+ngx_stream_geoip2_add_variable(ngx_conf_t *cf, ngx_command_t *dummy, void *conf)
+{
+    ngx_stream_geoip2_db_t  *database;
+    ngx_str_t               *value;
+    int                     nelts;
+
+    value = cf->args->elts;
+
+    if (value[0].data[0] != '$') {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "invalid variable name \"%V\"", &value[0]);
+        return NGX_CONF_ERROR;
+    }
+
+    value[0].len--;
+    value[0].data++;
+
+    nelts = (int) cf->args->nelts;
+    database = (ngx_stream_geoip2_db_t *) conf;
+
+    if (nelts > 0 && value[1].len == 8 && ngx_strncmp(value[1].data, "metadata", 8) == 0) {
+        return ngx_stream_geoip2_add_variable_metadata(cf, database);
+    }
+
+    return ngx_stream_geoip2_add_variable_geodata(cf, database);
+}
+
+
+static char *
+ngx_stream_geoip2_add_variable_metadata(ngx_conf_t *cf, ngx_stream_geoip2_db_t *database)
+{
+    ngx_stream_geoip2_metadata_t  *metadata;
+    ngx_str_t                     *value, name;
+    ngx_stream_variable_t         *var;
+
+    metadata = ngx_pcalloc(cf->pool, sizeof(ngx_stream_geoip2_metadata_t));
+    if (metadata == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    value = cf->args->elts;
+    name = value[0];
+
+    metadata->database = database;
+    metadata->metavalue = value[2];
+
+    var = ngx_stream_add_variable(cf, &name, NGX_STREAM_VAR_CHANGEABLE);
+    if (var == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    var->get_handler = ngx_stream_geoip2_metadata;
+    var->data = (uintptr_t) metadata;
+
+    return NGX_CONF_OK;
+}
+
+
+static char *
+ngx_stream_geoip2_add_variable_geodata(ngx_conf_t *cf, ngx_stream_geoip2_db_t *database)
+{
+    ngx_stream_geoip2_ctx_t             *geoip2;
+    ngx_stream_compile_complex_value_t  ccv;
+    ngx_str_t                           *value, name, source;
+    ngx_stream_variable_t               *var;
+    int                                 i, nelts, idx;
+
+    geoip2 = ngx_pcalloc(cf->pool, sizeof(ngx_stream_geoip2_ctx_t));
+    if (geoip2 == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    geoip2->database = database;
+    ngx_str_null(&source);
+
+    value = cf->args->elts;
+    name = value[0];
+
+    nelts = (int) cf->args->nelts;
+    idx = 1;
+
+    if (nelts > idx) {
+        for (i = idx; i < nelts; i++) {
+            if (ngx_strnstr(value[idx].data, "=", value[idx].len) == NULL) {
+                break;
+            }
+
+            if (value[idx].len > 8 && ngx_strncmp(value[idx].data, "default=", 8) == 0) {
+                if (geoip2->default_value.len > 0) {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "default has already been declared for  \"$%V\"", &name);
+                    return NGX_CONF_ERROR;
+                }
+
+                geoip2->default_value.len  = value[idx].len - 8;
+                geoip2->default_value.data = value[idx].data + 8;
+
+            } else if (value[idx].len > 7 && ngx_strncmp(value[idx].data, "source=", 7) == 0) {
+                if (source.len > 0) {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "source has already been declared for  \"$%V\"", &name);
+                    return NGX_CONF_ERROR;
+                }
+
+                source.len  = value[idx].len - 7;
+                source.data = value[idx].data + 7;
+
+                if (source.data[0] != '$') {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "invalid source variable name \"%V\"", &source);
+                    return NGX_CONF_ERROR;
+                }
+
+                ngx_memzero(&ccv, sizeof(ngx_stream_compile_complex_value_t));
+                ccv.cf = cf;
+                ccv.value = &source;
+                ccv.complex_value = &geoip2->source;
+
+                if (ngx_stream_compile_complex_value(&ccv) != NGX_OK) {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "unable to compile \"%V\" for \"$%V\"", &source, &name);
+                    return NGX_CONF_ERROR;
+                }
+
+            } else {
+                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                       "invalid setting \"%V\" for \"$%V\"", &value[idx], &name);
+                    return NGX_CONF_ERROR;
+            }
+
+            idx++;
+        }
+    }
+
+    var = ngx_stream_add_variable(cf, &name, NGX_STREAM_VAR_CHANGEABLE);
+    if (var == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    geoip2->lookup = ngx_pcalloc(cf->pool,
+                         sizeof(const char *) * (cf->args->nelts - (idx - 1)));
+
+    if (geoip2->lookup == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    for (i = idx; i < nelts; i++) {
+        geoip2->lookup[i - idx] = (char *) value[i].data;
+    }
+    geoip2->lookup[i - idx] = NULL;
+
+    var->get_handler = ngx_stream_geoip2_variable;
+    var->data = (uintptr_t) geoip2;
+
+    return NGX_CONF_OK;
+}
+
+
+static void
+ngx_stream_geoip2_cleanup(void *data)
+{
+    ngx_queue_t               *q;
+    ngx_stream_geoip2_db_t    *database;
+    ngx_stream_geoip2_conf_t  *gcf = data;
+
+    while (!ngx_queue_empty(&gcf->databases)) {
+        q = ngx_queue_head(&gcf->databases);
+        ngx_queue_remove(q);
+        database = ngx_queue_data(q, ngx_stream_geoip2_db_t, queue);
+        MMDB_close(&database->mmdb);
+    }
+}
+
+
+static ngx_int_t
+ngx_stream_geoip2_log_handler(ngx_stream_session_t *s)
+{
+    int                        status;
+    MMDB_s                     tmpdb;
+    ngx_queue_t                *q;
+    ngx_file_info_t            fi;
+    ngx_stream_geoip2_db_t    *database;
+    ngx_stream_geoip2_conf_t  *gcf;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_STREAM, s->connection->log, 0,
+                   "geoip2 stream log handler");
+
+    gcf = ngx_stream_get_module_main_conf(s, ngx_stream_geoip2_module);
+
+    if (ngx_queue_empty(&gcf->databases)) {
+        return NGX_OK;
+    }
+
+    for (q = ngx_queue_head(&gcf->databases);
+         q != ngx_queue_sentinel(&gcf->databases);
+         q = ngx_queue_next(q))
+    {
+        database = ngx_queue_data(q, ngx_stream_geoip2_db_t, queue);
+        if (database->check_interval == 0) {
+            continue;
+        }
+
+        if ((database->last_check + database->check_interval)
+            > ngx_time())
+        {
+            continue;
+        }
+
+        database->last_check = ngx_time();
+
+        if (ngx_file_info(database->mmdb.filename, &fi) == NGX_FILE_ERROR) {
+            ngx_log_error(NGX_LOG_EMERG, s->connection->log, ngx_errno,
+                          ngx_file_info_n " \"%s\" failed",
+                          database->mmdb.filename);
+
+            continue;
+        }
+
+        if (ngx_file_mtime(&fi) <= database->last_change) {
+            continue;
+        }
+
+        /* do the reload */
+
+        ngx_memzero(&tmpdb, sizeof(MMDB_s));
+        status = MMDB_open(database->mmdb.filename, MMDB_MODE_MMAP, &tmpdb);
+
+        if (status != MMDB_SUCCESS) {
+            ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
+                          "MMDB_open(\"%s\") failed to reload - %s",
+                          database->mmdb.filename, MMDB_strerror(status));
+
+            continue;
+        }
+
+        database->last_change = ngx_file_mtime(&fi);
+        MMDB_close(&database->mmdb);
+        database->mmdb = tmpdb;
+
+        ngx_log_error(NGX_LOG_INFO, s->connection->log, 0,
+                      "Reload MMDB \"%s\"",
+                      database->mmdb.filename);
+    }
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_stream_geoip2_init(ngx_conf_t *cf)
+{
+    ngx_stream_handler_pt        *h;
+    ngx_stream_core_main_conf_t  *cmcf;
+
+    cmcf = ngx_stream_conf_get_module_main_conf(cf, ngx_stream_core_module);
+
+    h = ngx_array_push(&cmcf->phases[NGX_STREAM_LOG_PHASE].handlers);
+    if (h == NULL) {
+        return NGX_ERROR;
+    }
+
+    *h = ngx_stream_geoip2_log_handler;
+
+    return NGX_OK;
+}
diff --git a/debian/modules/nchan/README.md b/debian/modules/nchan/README.md
index ee43ac9c..152396d0 100644
--- a/debian/modules/nchan/README.md
+++ b/debian/modules/nchan/README.md
@@ -1,57 +1,56 @@
-<img class="logo" alt="NCHAN" src="https://nchan.slact.net/github-logo.png" />
+<img class="logo" alt="NCHAN" src="https://nchan.io/github-logo.png" />
 
-https://nchan.slact.net
+https://nchan.io
 
 Nchan is a scalable, flexible pub/sub server for the modern web, built as a module for the [Nginx](http://nginx.org) web server. It can be configured as a standalone server, or as a shim between your application and hundreds, thousands, or millions of live subscribers. It can buffer messages in memory, on-disk, or via [Redis](http://redis.io). All connections are handled asynchronously and distributed among any number of worker processes. It can also scale to many Nginx servers with [Redis](http://redis.io).
 
 Messages are [published](#publisher-endpoints) to channels with HTTP `POST` requests or Websocket, and [subscribed](#subscriber-endpoint) also through [Websocket](#websocket), [long-polling](#long-polling), [EventSource](#eventsource) (SSE), old-fashioned [interval polling](#interval-polling), [and](#http-chunked-transfer) [more](#http-multipart-mixed).
 
-In a web browser, you can use Websocket or EventSource directly, or the [NchanSubscriber.js](https://github.com/slact/nchan/blob/master/NchanSubscriber.js) wrapper library. It supports Long-Polling, EventSource, and resumable Websockets, and has a few other added convenience options.
+In a web browser, you can use Websocket or EventSource natively, or the [NchanSubscriber.js](https://github.com/slact/nchan.js) wrapper library. It supports Long-Polling, EventSource, and resumable Websockets, and has a few other added convenience options. It's also available on [NPM](https://www.npmjs.com/package/nchan).
 
 ## Features
- - RESTful, HTTP-native API.
- - Supports [Websocket](https://nchan.slact.net/#websocket), [EventSource (Server-Sent Events)](https://nchan.slact.net/#eventsource), [Long-Polling](https://nchan.slact.net/#long-polling) and other HTTP-based subscribers.
- - No-repeat, no-loss message delivery guarantees with per-channel configurable message buffers.
+ - RESTful, HTTP-native [API](#publishing-messages).
+ - Supports [Websocket](#websocket), [EventSource (Server-Sent Events)](#eventsource), [Long-Polling](#long-polling) and other HTTP-based subscribers.
+ - Per-channel configurable message buffers with no-repeat, no-loss message delivery guarantees.
  - Subscribe to [hundreds of channels](#channel-multiplexing) over a single subscriber connection.
- - HTTP request [callbacks and hooks](https://nchan.slact.net/details#application-callbacks) for easy integration.
- - Introspection with [channel events](https://nchan.slact.net/details#channel-events) and [url for monitoring performance statistics](https://nchan.slact.net/details#nchan_stub_status).
- - Fast ephemeral local message storage and optional, slower, persistent storage with [Redis](https://nchan.slact.net/details#connecting-to-a-redis-server).
- - Horizontally scalable (using [Redis](https://nchan.slact.net/details#connecting-to-a-redis-server)).
- - Highly Available with no single point of failure (using [Redis Cluster](https://nchan.slact.net/details#redis-cluster)).
- 
-<!-- toc -->
+ - HTTP request [callbacks and hooks](#hooks-and-callbacks) for easy integration.
+ - Introspection with [channel events](#channel-events) and [url for monitoring performance statistics](#nchan_stub_status-stats).
+ - Channel [group](#channel-groups) usage [accounting and limits](#limits-and-accounting).
+ - Fast, nonblocking [shared-memory local message storage](#memory-storage) and optional, slower, persistent storage with [Redis](#redis).
+ - Horizontally scalable (using [Redis](#redis)).
+ - Auto-failover and [high availability](#high-availability) with no single point of failure using [Redis Cluster](#redis-cluster).
 
 ## Status and History
 
-The latest Nchan release is v1.0.8 (November 28, 2016) ([changelog](https://nchan.slact.net/changelog)).
+The latest Nchan release is 1.2.7 (March 17, 2020) ([changelog](https://nchan.io/changelog)).
 
-The first iteration of Nchan was written in 2009-2010 as the [Nginx HTTP Push Module](https://pushmodule.slact.net), and was vastly refactored into its present state in 2014-2016. The present release is in the **testing** phase. The core features and old functionality are thoroughly tested and stable. Some of the new functionality, especially Redis Cluster may be a bit buggy.
+The first iteration of Nchan was written in 2009-2010 as the [Nginx HTTP Push Module](https://pushmodule.slact.net), and was vastly refactored into its present state in 2014-2016.
 
 #### Upgrade from Nginx HTTP Push Module
 
-Although Nchan is backwards-compatible with all Push Module configuration directives, some of the more unusual and rarely used settings have been disabled and will be ignored (with a warning). See the [upgrade page](https://nchan.slact.net/upgrade) for a detailed list of changes and improvements, as well as a full list of incompatibilities.
+Although Nchan is backwards-compatible with all Push Module configuration directives, some of the more unusual and rarely used settings have been disabled and will be ignored (with a warning). See the [upgrade page](https://nchan.io/upgrade) for a detailed list of changes and improvements, as well as a full list of incompatibilities.
 
 
 ## Does it scale?
 
-<img class="benchmark_graph" alt="benchmarking internal subscriber response times" src="https://nchan.slact.net/img/benchmark_internal_total.png" />
+<img class="benchmark_graph" alt="benchmarking internal subscriber response times" src="https://nchan.io/img/benchmark_internal_total.png" />
 
 Yes it does. Like Nginx, Nchan can easily handle as much traffic as you can throw at it. I've tried to benchmark it, but my benchmarking tools are much slower than Nchan. The data I've gathered is on how long Nchan itself takes to respond to every subscriber after publishing a message -- this excludes TCP handshake times and internal HTTP request parsing. Basically, it measures how Nchan scales assuming all other components are already tuned for scalability. The graphed data are averages of 5 runs with 50-byte messages.
 
-With a well-tuned OS and network stack on commodity server hardware, expect to handle upwards of 300K concurrent subscribers per second at minimal CPU load. Nchan can also be scaled out to multiple Nginx instances using the [Redis storage engine](#nchan_use_redis), and that too can be scaled up beyond a single-point-of-failure by using [Redis Cluster](https://nchan.slact.net/details#using-redis).
+With a well-tuned OS and network stack on commodity server hardware, expect to handle upwards of 300K concurrent subscribers per second at minimal CPU load. Nchan can also be scaled out to multiple Nginx instances using the [Redis storage engine](#nchan_use_redis), and that too can be scaled up beyond a single-point-of-failure by using [Redis Cluster](#redis-cluster).
 
-Currently, Nchan's main bottleneck is not CPU load but memory bandwidth. This can be improved significantly in future versions with fewer allocations and better use of contiguous memory pools. Please consider supporting Nchan to speed up the work of memory cache optimization.
 
 ## Install
 
 #### Download Packages
- - [Arch Linux](https://archlinux.org): [nginx-nchan](https://aur.archlinux.org/packages/nginx-nchan/) and [nginx-nchan-git](https://aur.archlinux.org/packages/nginx-nchan-git/) are available in the Arch User Repository.  
- - Mac OS X: a [homebrew](http://brew.sh) package is available. `brew tap homebrew/nginx; brew install nginx-full --with-nchan-module`
- - [Debian](https://www.debian.org/): A dynamic module build for is available in the Debian package repository: [libnginx-mod-nchan](https://packages.debian.org/sid/libnginx-mod-nchan).  
- Additionally, you can use the pre-built static module packages [nginx-common.deb](https://nchan.slact.net/download/nginx-common.deb) and [nginx-extras.deb](https://nchan.slact.net/download/nginx-extras.deb). Download both and install them with `dpkg -i`, followed by `sudo apt-get -f install`.
- - [Ubuntu](http://www.ubuntu.com/):  [nginx-common.ubuntu.deb](https://nchan.slact.net/download/nginx-common.ubuntu.deb) and [nginx-extras.ubuntu.deb](https://nchan.slact.net/download/nginx-extras.ubuntu.deb). Download both and install them with `dpkg -i`, followed by `sudo apt-get -f install`. Who knows when Ubuntu will add them to their repository?...
- - [Fedora](https://fedoraproject.org): Dynamic module builds for Nginx > 1.10.0 are available: [nginx-mod-nchan.x86_64.rpm](https://nchan.slact.net/download/nginx-mod-nchan.x86-64.rpm), [nginx-mod-nchan.src.rpm](https://nchan.slact.net/download/nginx-mod-nchan.src.rpm). 
- - A statically compiled binary and associated linux nginx installation files are also [available as a tarball](https://nchan.slact.net/download/nginx-nchan-latest.tar.gz).
+ - [Arch Linux](https://archlinux.org): [nginx-mod-nchan](https://aur.archlinux.org/packages/nginx-mod-nchan/) and [nginx-mainline-mod-nchan](https://aur.archlinux.org/packages/nginx-mainline-mod-nchan/) are available in the Arch User Repository.
+ - Mac OS X: a [homebrew](http://brew.sh) package is available. `brew tap denji/nginx; brew install nginx-full --with-nchan-module`
+ - [Debian](https://www.debian.org/): A dynamic module build is available in the Debian package repository: [libnginx-mod-nchan](https://packages.debian.org/sid/libnginx-mod-nchan).  
+ Additionally, you can use the pre-built static module packages [nginx-common.deb](https://nchan.io/download/nginx-common.deb) and [nginx-extras.deb](https://nchan.io/download/nginx-extras.deb). Download both and install them with `dpkg -i`, followed by `sudo apt-get -f install`.
+ - [Ubuntu](http://www.ubuntu.com/):  [nginx-common.ubuntu.deb](https://nchan.io/download/nginx-common.ubuntu.deb) and [nginx-extras.ubuntu.deb](https://nchan.io/download/nginx-extras.ubuntu.deb). Download both and install them with `dpkg -i`, followed by `sudo apt-get -f install`. Who knows when Ubuntu will add Nchan to their repository?...
+ - [Fedora](https://fedoraproject.org): Dynamic module builds for Nginx > 1.10.0 are available: [nginx-mod-nchan.x86_64.rpm](https://nchan.io/download/nginx-mod-nchan.x86-64.rpm), [nginx-mod-nchan.src.rpm](https://nchan.io/download/nginx-mod-nchan.src.rpm). 
+ - [Heroku](https://heroku.com): A buildpack for compiling Nchan into Nginx is available: [nchan-buildpack](https://github.com/andjosh/nchan-buildpack). A one-click, readily-deployable app is also available: [nchan-heroku](https://github.com/andjosh/nchan-heroku).
+ - A statically compiled binary and associated linux nginx installation files are also [available as a tarball](https://nchan.io/download/nginx-nchan-latest.tar.gz).
 
 
 #### Build From Source
@@ -62,7 +61,7 @@ Grab the latest copy of Nginx from [nginx.org](http://nginx.org). Grab the lates
 
 If you're using Nginx  > 1.9.11, you can build Nchan as a [dynamic module](https://www.nginx.com/blog/dynamic-modules-nginx-1-9-11/) with `--add-dynamic-module=path/to/nchan`
 
-Run `make`, `make install`, and enjoy. (Caution, contents may be hot.)
+Run `make`, then `make install`.
 
 ## Getting Started
 
@@ -87,11 +86,11 @@ http {
 }
 ```
 
-You can now publish messages to channels by `POST`ing data to `/sub?id=channel_id` , and subscribe by pointing Websocket, EventSource, or [NchanSubscriber.js](https://github.com/slact/nchan/blob/master/NchanSubscriber.js) to `sub/?id=channel_id`. It's that simple.
+You can now publish messages to channels by `POST`ing data to `/pub?id=channel_id` , and subscribe by pointing Websocket, EventSource, or [NchanSubscriber.js](https://github.com/slact/nchan.js) to `sub/?id=channel_id`. It's that simple.
 
 But Nchan is very flexible and highly configurable. So, of course, it can get a lot more complicated...
 
-## Conceptual Overview
+### Conceptual Overview
 
 The basic unit of most pub/sub solutions is the messaging *channel*. Nchan is no different. Publishers send messages to channels with a certain *channel id*, and subscribers subscribed to those channels receive them. Some number of messages may be buffered for a time in a channel's message buffer before they are deleted. Pretty simple, right? 
 
@@ -121,15 +120,26 @@ http {
 The above maps requests to the URI `/sub` onto the channel `foobar`'s *subscriber endpoint* , and similarly `/pub` onto channel `foobar`'s *publisher endpoint*.
 
 
-#### Publisher Endpoints
+## Publisher Endpoints
 
 Publisher endpoints are Nginx config *locations* with the [*`nchan_publisher`*](#nchan_publisher) directive.
 
 Messages can be published to a channel by sending HTTP **POST** requests with the message contents to the *publisher endpoint* locations. You can also publish messages through a **Websocket** connection to the same location.
 
+```nginx
+  location /pub {
+    #example publisher location
+    nchan_publisher;
+    nchan_channel_id foo;
+    nchan_channel_group test;
+    nchan_message_buffer_length 50;
+    nchan_message_timeout 5m;
+  }
+```
+
 <!-- tag:publisher -->
 
-##### Publishing Messages
+### Publishing Messages
 
 Requests and websocket messages are responded to with information about the channel at time of message publication. Here's an example from publishing with `curl`:
 
@@ -147,7 +157,7 @@ The response can be in plaintext (as above), JSON, or XML, based on the request'
 ```console
 > curl --request POST --data "test message" -H "Accept: text/json" http://127.0.0.2:80/pub
 
- {"messages": 6, "requested": 55, "subscribers": 0, "last_message_id": "1450755317:0" }
+ {"messages": 5, "requested": 18, "subscribers": 0, "last_message_id": "1450755280:0" }
 ```
 
 Websocket publishers also receive the same responses when publishing, with the encoding determined by the *`Accept`* header present during the handshake.
@@ -156,7 +166,7 @@ The response code for an HTTP request is *`202` Accepted* if no subscribers are
 
 Metadata can be added to a message when using an HTTP POST request for publishing. A `Content-Type` header will be associated as the message's content type (and output to Long-Poll, Interval-Poll, and multipart/mixed subscribers). A `X-EventSource-Event` header can also be used to associate an EventSource `event:` line value with a message.
 
-##### Other Publisher Endpoint Actions
+### Other Publisher Endpoint Actions
 
 **HTTP `GET`** requests return channel information without publishing a message. The response code is `200` if the channel exists, and `404` otherwise:  
 ```console
@@ -171,15 +181,32 @@ Metadata can be added to a message when using an HTTP POST request for publishin
 
 **HTTP `DELETE`** requests delete a channel and end all subscriber connections. Like the `GET` requests, this returns a `200` status response with channel info if the channel existed, and a `404` otherwise.
 
-For an in-depth explanation of how settings are applied to channels from publisher locations, see the [details page](https://nchan.slact.net/details#publisher-endpoint-configs).
+### How Channel Settings Work
+
+*A channel's configuration is set to the that of its last-used publishing location.*
+So, if you want a channel to behave consistently, and want to publish to it from multiple locations, *make sure those locations have the same configuration*.
 
-#### Subscriber Endpoints
+You can also can use differently-configured publisher locations to dynamically update a channel's message buffer settings. This can be used to erase messages or to scale an existing channel's message buffer as desired.
+
+## Subscriber Endpoints
 
 Subscriber endpoints are Nginx config *locations* with the [*`nchan_subscriber`*](#nchan_subscriber) directive.
 
 Nchan supports several different kinds of subscribers for receiving messages: [*Websocket*](#websocket), [*EventSource*](#eventsource) (Server Sent Events),  [*Long-Poll*](#long-polling), [*Interval-Poll*](#interval-polling). [*HTTP chunked transfer*](#http-chunked-transfer), and [*HTTP multipart/mixed*](#http-multipart-mixed).
 
-- ##### Long-Polling
+```nginx
+  location /sub {
+    #example subscriber location
+    nchan_subscriber;
+    nchan_channel_id foo;
+    nchan_channel_group test;
+    nchan_subscriber_first_message oldest;
+  }
+```
+
+<!-- tag:subscriber -->
+
+- ### Long-Polling
   The tried-and-true server-push method supported by every browser out there.  
   Initiated by sending an HTTP `GET` request to a channel subscriber endpoint.  
   The long-polling subscriber walks through a channel's message queue via the built-in cache mechanism of HTTP clients, namely with the "`Last-Modified`" and "`Etag`" headers. Explicitly, to receive the next message for given a long-poll subscriber response, send a request with the "`If-Modified-Since`" header set to the previous response's "`Last-Modified`" header, and "`If-None-Match`" likewise set to the previous response's "`Etag`" header.  
@@ -187,15 +214,16 @@ Nchan supports several different kinds of subscribers for receiving messages: [*
   A message's associated content type, if present, will be sent to this subscriber with the `Content-Type` header.
   <!-- tag:subscriber-longpoll -->
   
-- ##### Interval-Polling
+- ### Interval-Polling
   Works just like long-polling, except if the requested message is not yet available, immediately responds with a `304 Not Modified`.
-  There is no way to differentiate between long-poll and interval-poll subscriber requests, so long-polling must be disabled for a subscriber location if you wish to use interval-polling.
+  Nchan cannot automatically distinguish between long-poll and interval-poll subscriber requests, so long-polling must be disabled for a subscriber location if you wish to use interval-polling.
 
-- ##### Websocket
+- ### Websocket
   Bidirectional communication for web browsers. Part of the [HTML5 spec](http://www.w3.org/TR/2014/REC-html5-20141028/single-page.html). Nchan supports the latest protocol version 13 ([RFC 6455](https://tools.ietf.org/html/rfc6455)).  
   Initiated by sending a websocket handshake to the desired subscriber endpoint location.  
-  If the websocket connection is closed by the server, the `close` frame will contain the HTTP response code and status line describing the reason for closing the connection. Server-initiated keep-alive pings can be configured with the [`nchan_websocket_ping_interval`](#nchan_websocket_ping_interval) config directive. Websocket extensions are not yet supported.  
-  Messages published through a websocket connection can be forwarded to an upstream application with the [`nchan_publisher_upstream_request`](#nchan_publisher_upstream_request) config directive.   
+  If the websocket connection is closed by the server, the `close` frame will contain the HTTP response code and status line describing the reason for closing the connection. Server-initiated keep-alive pings can be configured with the [`nchan_websocket_ping_interval`](#nchan_websocket_ping_interval) config directive.
+  Messages are delivered to subscribers in `text` websocket frames, except if a message's `content-type` is "`application/octet-stream`" -- then it is delivered in a `binary` frame.
+  <br />
   Websocket subscribers can use the custom `ws+meta.nchan` subprotocol to receive message metadata with messages, making websocket connections resumable. Messages received with this subprotocol are of the form
   <pre>
   id: message_id
@@ -204,9 +232,24 @@ Nchan supports several different kinds of subscribers for receiving messages: [*
   message_data
   </pre>   
   The `content-type:` line may be omitted.
+  <br />
+  #### Websocket Publisher
+  Messages published through a websocket connection can be forwarded to an upstream application with the [`nchan_publisher_upstream_request`](#nchan_publisher_upstream_request) config directive.   
+  Messages published in a binary frame are automatically given the `content-type` "`application/octet-stream`".
+  #### Permessage-deflate
+  Nchan version 1.1.8 and above supports the [permessage-deflate protocol extension](https://tools.ietf.org/html/rfc7692). Messages are deflated once when they are published, and then can be broadcast to any number of compatible websocket subscribers. Message deflation is enabled by setting the [`nchan_deflate_message_for_websocket on;`](#nchan_deflate_message_for_websocket) directive in a publisher location.
+  <br />
+  The deflated data is stored alongside the original message in memory, or, if large enough, on disk. This means more [shared memory](#nchan_shared_memory_size) is necessary when using `nchan_deflate_message_for_websocket`.
+  <br />
+  Deflation parameters (speed, memory use, strategy, etc.), can be tweaked using the [`nchan_permessage_deflate_compression_window`](#nchan_permessage_deflate_compression_window), [`nchan_permessage_deflate_compression_level`](#nchan_permessage_deflate_compression_level),
+  [`nchan_permessage_deflate_compression_strategy`](#nchan_permessage_deflate_compression_strategy), and 
+  [`nchan_permessage_deflate_compression_window`](#nchan_permessage_deflate_compression_window) settings.
+  <br />
+  Nchan also supports the (deprecated) [perframe-deflate extension](https://tools.ietf.org/html/draft-tyoshino-hybi-websocket-perframe-deflate-06) still in use by Safari as `x-webkit-perframe-deflate`.
+  <br />
   <!-- tag:subscriber-websocket -->
   
-- ##### EventSource
+- ### EventSource
   Also known as [Server-Sent Events](https://en.wikipedia.org/wiki/Server-sent_events) or SSE, it predates Websockets in the [HTML5 spec](http://www.w3.org/TR/2014/REC-html5-20141028/single-page.html), and is a [very simple protocol](http://www.w3.org/TR/eventsource/#event-stream-interpretation).  
   Initiated by sending an HTTP `GET` request to a channel subscriber endpoint with the "`Accept: text/event-stream`" header.    
   Each message `data: ` segment will be prefaced by the message `id: `.  
@@ -217,7 +260,7 @@ Nchan supports several different kinds of subscribers for receiving messages: [*
   A message's associated `event` type, if present, will be sent to this subscriber with the `event:` line.  
   <!-- tag:subscriber-eventsource -->
   
-- ##### HTTP [multipart/mixed](http://www.w3.org/Protocols/rfc1341/7_2_Multipart.html#z0)
+- ### HTTP [multipart/mixed](http://www.w3.org/Protocols/rfc1341/7_2_Multipart.html#z0)
   The `multipart/mixed` MIMEtype was conceived for emails, but hey, why not use it for HTTP? It's easy to parse and includes metadata with each message.  
   Initiated by including an `Accept: multipart/mixed` header.  
   The response headers and the unused "preamble" portion of the response body are sent right away, with the boundary string generated randomly for each subscriber.  Each subsequent message will be sent as one part of the multipart message, and will include the message time and tag (`Last-Modified` and `Etag`) as well as the optional `Content-Type` headers.  
@@ -225,11 +268,11 @@ Nchan supports several different kinds of subscribers for receiving messages: [*
   A message's associated content type, if present, will be sent to this subscriber with the `Content-Type` header.
   <!-- tag:subscriber-multipart -->
   
-- ##### HTTP Raw Stream
+- ### HTTP Raw Stream
   A simple subscription method similar to the [streaming subscriber](https://github.com/wandenberg/nginx-push-stream-module/blob/master/docs/directives/subscribers.textile#push_stream_subscriber) of the [Nginx HTTP Push Stream Module](https://github.com/wandenberg/nginx-push-stream-module). Messages are appended to the response body, separated by a newline or configurable by `nchan_subscriber_http_raw_stream_separator`.
   <!-- tag:subscriber-rawstream -->
 
-- ##### HTTP [Chunked Transfer](http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.6.1)
+- ### HTTP [Chunked Transfer](http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.6.1)
   This subscription method uses the `chunked` `Transfer-Encoding` to receive messages.   
   Initiated by explicitly including `chunked` in the [`TE` header](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.39):  
   `TE: chunked` (or `TE: chunked;q=??` where the qval > 0)  
@@ -237,9 +280,7 @@ Nchan supports several different kinds of subscribers for receiving messages: [*
   Unlike the other subscriber types, the `chunked` subscriber cannot be used with http/2 because it dissallows chunked encoding.
   <!-- tag:subscriber-chunked -->
 
-<!-- tag:subscriber -->
-
-#### PubSub Endpoint  
+## PubSub Endpoint  
 
 PubSub endpoints are Nginx config *locations* with the [*`nchan_pubsub`*](#nchan_pubsub) directive.
 
@@ -249,17 +290,19 @@ requests as subscribers, and all HTTP `POST` as publishers. One simple use case
 ```nginx
   location = /pubsub {
     nchan_pubsub;
-    nchan_channel_id foobar;
+    nchan_channel_id foo;
+    nchan_channel_group test;
   }
 ```
 
-A more applicable setup may set different publisher and subscriber channel ids:
+A more interesting setup may set different publisher and subscriber channel ids:
 
 ```nginx
   location = /pubsub {
     nchan_pubsub;
     nchan_publisher_channel_id foo;
     nchan_subscriber_channel_id bar;
+    nchan_channel_group test;
   }
 ```
 
@@ -267,9 +310,9 @@ Here, subscribers will listen for messages on channel `foo`, and publishers will
 
 <!-- tag:pubsub -->
 
-### The Channel ID
+## The Channel ID
 
-So far the examples have used static channel ids, which is not very useful in practice. It can be set to any nginx *variable*, such as a querystring argument, a header value, or a part of the location url:
+So far the examples have used static channel ids, which is not very useful. In practice, the channel id can be set to any nginx *variable*, such as a querystring argument, a header value, or a part of the location url:
 
 ```nginx
   location = /sub_by_ip {
@@ -294,9 +337,11 @@ So far the examples have used static channel ids, which is not very useful in pr
   }
 ```
 
+I recommend using the last option, a channel id derived from the request URL via a regular expression. It makes things nice and RESTful.
+
 <!-- tag:channel-id -->
 
-#### Channel Multiplexing
+### Channel Multiplexing
 
 With channel multiplexing, subscribers can subscribe to up to 255 channels per connection. Messages published to all the specified channels will be delivered in-order to the subscriber. There are two ways to enable multiplexing:
 
@@ -325,68 +370,626 @@ For more than 7 channels, `nchan_channel_id_split_delimiter` can be used to spli
   }
 ```
 
-Publishing to multiple channels with a single request is also possible, with similar configuration:
+It is also possible to publish to multiple channels with a single request as well as delete multiple channels with a single request, with similar configuration:
 
 ```nginx
   location ~ /multipub/(\w+)/(\w+)$ {
     nchan_publisher;
     nchan_channel_id "$1" "$2" "another_channel";
+    #POST /multipub/foo/bar will publish to:
+    # channels 'foo', 'bar', 'another_channel'
+    #DELETE /multipub/foo/bar will delete:
+    # channels 'foo', 'bar', 'another_channel'
   }
 ```
 
-`DELETE` requests to a multiplexed channel broadcast the deletion to each of the channels it multiplexes, deletes all their messages and kicks out all clients subscribed to any of the channel ids.
+When a channel is deleted, all of its messages are deleted, and all of its subscribers' connection are closed -- including ones subscribing through a multiplexed location. For example, suppose a subscriber is subscribed to channels "foo" and "bar" via a single multiplexed connection. If "foo" is deleted, the connection is closed, and the subscriber therefore loses the "bar" subscription as well.
 
-See the [details page](https://nchan.slact.net/details#securing-channels) for more information about using good IDs and keeping channels secure.
+See the [Channel Security](#securing-channels) section about using good IDs and keeping private channels secure.
 
 <!-- tag:channel-multiplexing -->
 
+### Channel Groups
+
+Channels can be associated with groups to avoid channel ID conflicts:
+
+```nginx
+  location /test_pubsub {
+    nchan_pubsub;
+    nchan_channel_group "test";
+    nchan_channel_id "foo";
+  }
+  
+  location /pubsub {
+    nchan_pubsub;
+    nchan_channel_group "production";
+    nchan_channel_id "foo";
+    #same channel id, different channel group. Thus, different channel.
+  }
+  
+  location /flexgroup_pubsub {
+    nchan_pubsub;
+    nchan_channel_group $arg_group;
+    nchan_channel_id "foo";
+    #group can be set with request variables too
+  }
+```
+
+#### Limits and Accounting
+
+Groups can be used to track aggregate channel usage, as well as set limits on the number of channels, subscribers, stored messages, memory use, etc:
+
+```nginx
+  #enable group accounting
+  nchan_channel_group_accounting on;
+  
+  location ~ /pubsub/(\w+)$ {
+    nchan_pubsub;
+    nchan_channel_group "limited";
+    nchan_channel_id $1;
+  }
+  
+  location ~ /prelimited_pubsub/(\w+)$ {
+    nchan_pubsub;
+    nchan_channel_group "limited";
+    nchan_channel_id $1;
+    nchan_group_max_subscribers 100;
+    nchan_group_max_messages_memory 50M;
+  }
+  
+  location /group {
+    nchan_channel_group limited;
+    nchan_group_location;
+    nchan_group_max_channels $arg_max_channels;
+    nchan_group_max_messages $arg_max_messages;
+    nchan_group_max_messages_memory $arg_max_messages_mem;
+    nchan_group_max_messages_disk $arg_max_messages_disk;
+    nchan_group_max_subscribers $arg_max_subs;
+  }
+```
+
+Here, `/group` is an `nchan_group_location`, which is used for accessing and modifying group data. To get group data, send a `GET` request to a `nchan_group_location`:
+
+```sh
+>  curl http://localhost/group
+
+channels: 10
+subscribers: 0
+messages: 219
+shared memory used by messages: 42362 bytes
+disk space used by messages: 0 bytes
+limits:
+  max channels: 0
+  max subscribers: 0
+  max messages: 0
+  max messages shared memory: 0
+  max messages disk space: 0  
+```
+
+By default, the data is returned in human-readable plaintext, but can also be formatted as JSON, XML, or YAML:
+
+```sh
+>  curl -H "Accept: text/json" http://localhost/group
+
+{
+  "channels": 21,
+  "subscribers": 40,
+  "messages": 53,
+  "messages_memory": 19941,
+  "messages_disk": 0,
+  "limits": {
+    "channels": 0,
+    "subscribers": 0,
+    "messages": 0,
+    "messages_memory": 0,
+    "messages_disk": 0
+  }
+}
+```
+
+The data in the response are for the single Nchan instance only, regardless of whether Redis is used. A limit of 0 means 'unlimited'.
+
+Limits can be set per-location, as with the above `/prelimited_pubsub/...` location, or with a POST request to the `nchan_group_location`:
+```sh
+>  curl -X POST "http://localhost/group?max_channels=15&max_subs=1000&max_messages_disk=0.5G"
+
+channels: 0
+subscribers: 0
+messages: 0
+shared memory used by messages: 0 bytes
+disk space used by messages: 0 bytes
+limits:
+  max channels: 15
+  max subscribers: 1000
+  max messages: 0
+  max messages shared memory: 0
+  max messages disk space: 536870912
+
+```
+
+Limits are only applied locally, regardless of whether Redis is enabled. 
+If a publisher or subscriber request exceeds a group limit, Nchan will respond to it with a `403 Forbidden` response.
+
+<!-- tag:group -->
+
+## Hooks and Callbacks
+
+<!-- tag:hook -->
+  
+### Request Authorization
+
+This feature, configured with [`nchan_authorize_request`](#nchan_authorize_request), behaves just like the Nginx [http_auth_request module](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html#auth_request_set).
+
+Consider the configuration:
+```nginx
+  upstream my_app {
+    server 127.0.0.1:8080;
+  }
+  location = /auth {
+    proxy_pass http://my_app/pubsub_authorize;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    proxy_set_header X-Subscriber-Type $nchan_subscriber_type;
+    proxy_set_header X-Publisher-Type $nchan_publisher_type;
+    proxy_set_header X-Prev-Message-Id $nchan_prev_message_id;
+    proxy_set_header X-Channel-Id $nchan_channel_id;
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header X-Forwarded-For $remote_addr;
+  }
+  
+  location ~ /pubsub/auth/(\w+)$ {
+    nchan_channel_id $1;
+    nchan_authorize_request /auth;
+    nchan_pubsub;
+    nchan_channel_group test;
+  }
+```
+
+Here, any request to the location `/pubsub/auth/<...>` will need to be authorized by your application (`my_app`). Nginx will generate a `GET /pubsub_authorize` request to the application, with additional headers set by the `proxy_set_header` directives. Note that Nchan-specific variables are available for this authorization request. Once your application receives this request, it should decide whether or not to authorize the subscriber. This can be done based on a forwarded session cookie, IP address, or any set of parameters of your choosing. If authorized, it should respond with an empty `200 OK` response.  
+All non-`2xx` response codes (such as `403 Forbidden`) are intepreted as authorization failures. In this case, the failing response is proxied to the client. 
+
+Note that Websocket and EventSource clients will only try to authorize during the initial handshake request, whereas Long-Poll and Interval-Poll subscribers will need to be authorized each time they request the next message, which may flood your application with too many authorization requests.
+
+<!-- commands: nchan_authorize_request -->
+
+### Subscriber Presence
+
+Subscribers can notify an application when they have subscribed and unsubscribed to a channel using the [`nchan_subscribe_request`](#nchan_subscribe_request)
+and [`nchan_unsubscribe_request`](#nchan_unsubscribe_request) settings. 
+These should point to Nginx locations configured to forward requests to an upstream proxy (your application):
+
+```nginx
+  location ~ /sub/(\w+)$ {
+    nchan_channel_id $1;
+    nchan_subscribe_request /upstream/sub;
+    nchan_unsubscribe_request /upstream/unsub;
+    nchan_subscriber;
+    nchan_channel_group test;
+  }
+
+  location = /upstream/unsub {
+    proxy_pass http://127.0.0.1:9292/unsub;
+    proxy_ignore_client_abort on;  #!!!important!!!!
+    proxy_set_header X-Subscriber-Type $nchan_subscriber_type;
+    proxy_set_header X-Channel-Id $nchan_channel_id;
+    proxy_set_header X-Original-URI $request_uri;
+  } 
+  location = /upstream/sub {
+    proxy_pass http://127.0.0.1:9292/sub;
+    proxy_set_header X-Subscriber-Type $nchan_subscriber_type;
+    proxy_set_header X-Message-Id $nchan_message_id;
+    proxy_set_header X-Channel-Id $nchan_channel_id;
+    proxy_set_header X-Original-URI $request_uri;
+  } 
+```
+
+In order for `nchan_unsubscribe_request` to work correctly, the location it points to must have `proxy_ignore_client_abort on;`. Otherwise, suddenly aborted subscribers may not trigger an unsubscribe request.
+
+Note that the subscribe/unsubscribe hooks are **disabled for long-poll and interval-poll clients**, because they would trigger these hooks each time they receive a message.
+
+<!-- commands: nchan_subscribe_request nchan_unsubscribe_request -->
+
+### Message Forwarding
+
+Messages can be forwarded to an upstream application before being published using the `nchan_publisher_upstream_request` setting:
+
+```nginx
+  location ~ /pub/(\w+)$ {
+    #publisher endpoint
+    nchan_channel_id $1;
+    nchan_pubsub;
+    nchan_publisher_upstream_request /upstream_pub;
+  }
+  
+  location = /upstream_pub {
+    proxy_pass http://127.0.0.1:9292/pub;
+    proxy_set_header X-Publisher-Type $nchan_publisher_type;
+    proxy_set_header X-Prev-Message-Id $nchan_prev_message_id;
+    proxy_set_header X-Channel-Id $nchan_channel_id;
+    proxy_set_header X-Original-URI $request_uri;
+  } 
+```
+With this configuration, incoming messages are first `POST`ed to `http://127.0.0.1:9292/pub`.
+The upstream response code determines how publishing will proceed:
+  - `304 Not Modified` publishes the message as received, without modifification.
+  - `204 No Content` discards the message
+  - `200 OK` is used for modifying the message. Instead of the original incoming message, the message contained in this HTTP response is published.
+
+There are two main use cases for `nchan_publisher_upstream_request`: forwarding incoming data from Websocket publishers to an application, and mutating incoming messages.
+
+<!-- commands: nchan_publisher_upstream_request -->
+
 ## Storage
 
 Nchan can stores messages in memory, on disk, or via Redis. Memory storage is much faster, whereas Redis has additional overhead as is considerably slower for publishing messages, but offers near unlimited scalability for broadcast use cases with far more subscribers than publishers.
 
-<!-- tag:storage -->
-
 ### Memory Storage
 
-This storage method uses a segment of shared memory to store messages and channel data. Large messages as determined by Nginx's caching layer are stored on-disk. The size of the memory segment is configured with `nchan_max_reserved_memory`. Data stored here is not persistent, and is lost if Nginx is restarted or reloaded.
+This default storage method uses a segment of shared memory to store messages and channel data. Large messages as determined by Nginx's caching layer are stored on-disk. The size of the memory segment is configured with `nchan_shared_memory_size`. Data stored here is not persistent, and is lost if Nginx is restarted or reloaded.
 
 <!-- tag:memstore -->
 
 ### Redis
 
-Nchan can also store messages and channels on a Redis server, or in a Redis cluster. To use a Redis server, set `nchan_use_redis on;` and set the server url with `nchan_redis_url`. These two settings are inheritable by nested locations, so it is enough to set them within an `http { }` block to enable Redis for all Nchan locations in that block. Different locations can also use different Redis servers.
+[Redis](http://redis.io) can be used to add **data persistence** and **horizontal scalability**, **failover** and **high availability** to your Nchan setup. 
+
+<!-- tag:redis -->
 
-To use a Redis Cluster, the Redis servers acting as cluster nodes need to be configured in an `upstream { }` block:
+#### Connecting to a Redis Server
+To connect to a single Redis master server, use an `upstream` with `nchan_redis_server` and `nchan_redis_pass` settings:
 
 ```nginx
+http {
+  upstream my_redis_server {
+    nchan_redis_server 127.0.0.1;
+  }
+  server {
+    listen 80;
+    
+    location ~ /redis_sub/(\w+)$ {
+      nchan_subscriber;
+      nchan_channel_id $1;
+      nchan_redis_pass my_redis_server;
+    }
+    location ~ /redis_pub/(\w+)$ {
+      nchan_redis_pass my_redis_server;
+      nchan_publisher;
+      nchan_channel_id $1;
+    }
+  }
+} 
+```
+
+All servers with the above configuration connecting to the same redis server share channel and message data.
+
+Channels that don't use Redis can be configured side-by-side with Redis-backed channels, provided the endpoints never overlap. (This can be ensured, as above, by setting separate `nchan_channel_group`s.). Different locations can also connect to different Redis servers.
+
+Nchan can work with a single Redis master. It can also auto-discover and use Redis slaves to balance PUBSUB traffic.
+
+<!-- commands: nchan_redis_server nchan_redis_pass -->
+
+#### Redis Cluster
+Nchan also supports using Redis Cluster, which adds scalability via sharding channels among cluster nodes. Redis cluster also provides **automatic failover**, **high availability**, and eliminates the single point of failure of one shared Redis server. It is configred and used like so:
+
+```nginx
+http {
   upstream redis_cluster {
     nchan_redis_server redis://127.0.0.1:7000;
     nchan_redis_server redis://127.0.0.1:7001;
     nchan_redis_server redis://127.0.0.1:7002;
+    # you don't need to specify all the nodes, they will be autodiscovered
+    # however, it's recommended that you do specify at least a few master nodes.
   }
+  server {
+    listen 80;
+    
+    location ~ /sub/(\w+)$ {
+      nchan_subscriber;
+      nchan_channel_id $1;
+      nchan_redis_pass redis_cluster;
+    }
+    location ~ /pub/(\w+)$ {
+      nchan_publisher;
+      nchan_channel_id $1;
+      nchan_redis_pass redis_cluster;
+    }
+  }
+} 
 ```
 
-It is best to specify all master cluster nodes, but this is not required -- as long as Nchan can connect to at least 1 node, it will discover and connect to the whole cluster.
+<!-- commands: nchan_redis_server nchan_redis_pass -->
+
+##### High Availability
+Redis Cluster connections are designed to be resilient and try to recover from errors. Interrupted connections will have their commands queued until reconnection, and Nchan will publish any messages it successfully received while disconnected. Nchan is also adaptive to cluster modifications. It will add new nodes and remove them as needed.
+
+All Nchan servers sharing a Redis server or cluster should have their times synchronized (via ntpd or your favorite ntp daemon). Failure to do so may result in missed or duplicate messages.
+
+#### Tweaks and Optimizations
+
+As of version 1.2.0, Nchan uses Redis slaves to load-balance PUBSUB traffic. By default, there is an equal chance that a channel's PUBSUB subscription will go to any master or slave. The [`nchan_redis_subscribe_weights`](#nchan_redis_subscribe_weights) setting is available to fine-tune this load-balancing.
+
+Also from 1.2.0 onward, [`nchan_redis_optimize_target`](#nchan_redis_optimize_target) can be used to prefer optimizing Redis slaves for CPU or bandwidth. For heavy publishing loads, the tradeoff is very roughly 35% replication bandwidth per slave to 30% CPU load on slaves.
+
+## Introspection
+
+There are several ways to see what's happening inside Nchan. These are useful for debugging application integration and for measuring performance.
 
-To use Redis Cluster in an Nchan location, use the `nchan_redis_pass` setting:
+### Channel Events
+
+Channel events are messages automatically published by Nchan when certain events occur in a channel. These are very useful for debugging the use of channels. However, they carry a significant performance overhead and should be used during development, and not in production.
+
+Channel events are published to special 'meta' channels associated with normal channels. Here's how to configure them:
 
 ```nginx
-  location ~ /pubsub/(\w+)$ {
+location ~ /pubsub/(.+)$ {
+  nchan_pubsub;
+  nchan_channel_id $1;
+  nchan_channel_events_channel_id $1; #enables channel events for this location
+}
+
+location ~ /channel_events/(.+) {
+  #channel events subscriber location
+  nchan_subscriber;
+  nchan_channel_group meta; #"meta" is a SPECIAL channel group
+  nchan_channel_id $1;
+}
+```
+
+Note the `/channel_events/...` location has a *special* `nchan_channel_group`, `meta`. This group is reserved for accessing "channel events channels", or"metachannels".
+
+Now, say I subscribe to `/channel_events/foo` I will refer to this as the channel events subscriber.
+
+Let's see what this channel events subscriber receives when I publish messages to 
+
+Subscribing to `/pubsub/foo` produces the channel event
+```
+subscriber_enqueue foo
+```
+
+Publishing a message to `/pubsub/foo`:
+```
+channel_publish foo
+```
+
+Unsubscribing from `/pubsub/foo`:
+```
+subscriber_dequeue foo
+```
+
+Deleting `/pubsub/foo` (with HTTP `DELETE /pubsub/foo`):
+```
+channel_delete foo
+```
+
+The event string itself is configirable with [nchan_channel_event_string](#nchan_channel_event_string). By default, it is set to `$nchan_channel_event $nchan_channel_id`. 
+This string can use any Nginx and [Nchan variables](/#variables).
+
+
+### nchan_stub_status Stats
+
+Like Nginx's [stub_status](https://nginx.org/en/docs/http/ngx_http_stub_status_module.html),
+`nchan_stub_status` is used to get performance metrics.
+
+```nginx
+  location /nchan_stub_status {
+    nchan_stub_status;
+  }
+```
+
+Sending a GET request to this location produces the response:
+
+```text
+total published messages: 1906
+stored messages: 1249
+shared memory used: 1824K
+channels: 80
+subscribers: 90
+redis pending commands: 0
+redis connected servers: 0
+total interprocess alerts received: 1059634
+interprocess alerts in transit: 0
+interprocess queued alerts: 0
+total interprocess send delay: 0
+total interprocess receive delay: 0
+nchan version: 1.1.5
+```
+
+Here's what each line means, and how to interpret it:
+  - `total published messages`: Number of messages published to all channels through this Nchan server.
+  - `stored messages`: Number of messages currently buffered in memory
+  - `shared memory used`: Total shared memory used for buffering messages, storing channel information, and other purposes. This value should be comfortably below `nchan_shared_memory_size`.
+  - `channels`: Number of channels present on this Nchan server.
+  - `subscribers`: Number of subscribers to all channels on this Nchan server.
+  - `redis pending commands`: Number of commands sent to Redis that are awaiting a reply. May spike during high load, especially if the Redis server is overloaded. Should tend towards 0.
+  - `redis connected servers`: Number of redis servers to which Nchan is currently connected.
+  - `total interprocess alerts received`: Number of interprocess communication packets transmitted between Nginx workers processes for Nchan. Can grow at 100-10000 per second at high load.
+  - `interprocess alerts in transit`: Number of interprocess communication packets in transit between Nginx workers. May be nonzero during high load, but should always tend toward 0 over time.
+  - `interprocess queued alerts`: Number of interprocess communication packets waiting to be sent. May be nonzero during high load, but should always tend toward 0 over time.
+  - `total interprocess send delay`: Total amount of time interprocess communication packets spend being queued if delayed. May increase during high load.
+  - `total interprocess receive delay`: Total amount of time interprocess communication packets spend in transit if delayed. May increase during high load.
+  - `nchan_version`: current version of Nchan. Available for version 1.1.5 and above.
+
+Additionally, when there is at least one `nchan_stub_status` location, the following Nginx variables are available:
+  - `$nchan_stub_status_total_published_messages`  
+  - `$nchan_stub_status_stored_messages`  
+  - `$nchan_stub_status_shared_memory_used`  
+  - `$nchan_stub_status_channels`  
+  - `$nchan_stub_status_subscribers`  
+  - `$nchan_stub_status_redis_pending_commands`  
+  - `$nchan_stub_status_redis_connected_servers`  
+  - `$nchan_stub_status_total_ipc_alerts_received`  
+  - `$nchan_stub_status_ipc_queued_alerts`  
+  - `$nchan_stub_status_total_ipc_send_delay`  
+  - `$nchan_stub_status_total_ipc_receive_delay`  
+
+  
+## Securing Channels
+
+### Securing Publisher Endpoints
+Consider the use case of an application where authenticated users each use a private, dedicated channel for live updates. The configuration might look like this:
+
+```nginx
+http {
+  server {
+    #available only on localhost
+    listen  127.0.0.1:8080;
+    location ~ /pub/(\w+)$ {
+      nchan_publisher;
+      nchan_channel_group my_app_group;
+      nchan_channel_id $1;
+    }
+  }
+  
+  server {
+    #available to the world
+    listen 80;
+    
+    location ~ /sub/(\w+)$ {
+      nchan_subscriber;
+      nchan_channel_group my_app_group;
+      nchan_channel_id $1;
+    }
+  }
+}
+
+```
+
+Here, the subscriber endpoint is available on a public-facing port 80, and the publisher endpoint is only available on localhost, so can be accessed only by applications residing on that machine. Another way to limit access to the publisher endpoint is by using the allow/deny settings:
+
+```nginx
+
+  server {
+    #available to the world
+    listen 80; 
+    location ~ /pub/(\w+)$ {
+      allow 127.0.0.1;
+      deny all;
+      nchan_publisher;
+      nchan_channel_group my_app_group;
+      nchan_channel_id $1;
+    }
+```
+
+Here, only the local IP 127.0.0.1 is allowed to use the publisher location, even though it is defined in a non-localhost server block.
+
+### Keeping a Channel Private
+
+A Channel ID that is meant to be private should be treated with the same care as a session ID token. Considering the above use case of one-channel-per-user, how can we ensure that only the authenticated user, and no one else, is able to access his channel? 
+
+First, if you intend on securing the channel contents, you must use TLS/SSL:
+
+```nginx 
+http {
+  server {
+    #available only on localhost
+    listen  127.0.0.1:8080;
+    #...publisher endpoint config
+  }
+  server {
+    #available to the world
+    listen 443 ssl;
+    #SSL config goes here
+    location ~ /sub/(\w+)$ {
+      nchan_subscriber;
+      nchan_channel_group my_app_group;
+      nchan_channel_id $1;
+    }
+  }
+}
+```
+
+Now that you have a secure connection between the subscriber client and the server, you don't need to worry about the channel ID or messages being passively intercepted. This is a minimum requirement for secure message delivery, but it is not sufficient. 
+
+You must also take care to do at least one of the following:
+  - [Generate good, high-entropy Channel IDs](#good-ids).
+  - [Authorize all subscribers with the `nchan_authorize_request` config directive](#request-authorization).
+  - [Authorize subscribers and hide channel IDs with the "`X-Accel-Redirect`" mechanism](#x-accel-redirect).
+  
+#### Good IDs
+
+An ID that can be guessed is an ID that can be hijacked. If you are not authenticating subscribers (as described below), a channel ID should be impossible to guess. Use at least 128 bits of entropy to generate a random token, associate it with the authenticated user, and share it only with the user's client. Do not reuse tokens, just as you would not reuse session IDs.
+
+#### X-Accel-Redirect
+
+This feature uses the [X-Accel feature](https://www.nginx.com/resources/wiki/start/topics/examples/x-accel) of Nginx upstream proxies to perform an internal request to a subscriber endpoint.
+It allows a subscriber client to be authenticated by your application, and then redirected by nginx internally to a location chosen by your appplication (such as a publisher or subscriber endpoint). This makes it possible to have securely authenticated clients that are unaware of the channel id they are subscribed to.
+
+Consider the following configuration:
+```nginx 
+upstream upstream_app {
+  server 127.0.0.1:8080;
+}
+
+server {
+  listen 80; 
+  
+  location = /sub_upstream {
+    proxy_pass http://upstream_app/subscriber_x_accel_redirect;
+    proxy_set_header X-Forwarded-For $remote_addr;
+  }
+  
+  location ~ /sub/internal/(\w+)$ {
+    internal; #this location only accessible for internal nginx redirects
+    nchan_subscriber;
     nchan_channel_id $1;
-    nchan_pubsub;
-    nchan_redis_pass redis_cluster;
+    nchan_channel_group test;
   }
+}
+```
 
+As commented, `/sub/internal/` is inaccessible from the outside:
+```console
+> curl  -v  http://127.0.0.1/sub/internal/foo
+  
+  < HTTP/1.1 404 Not Found
+  < Server: nginx/1.9.5
+  <
+  <html>
+  <head><title>404 Not Found</title></head>
+  <body bgcolor="white">
+  <center><h1>404 Not Found</h1></center>
+  <hr><center>nginx/1.9.5</center>
+  </body>
+  </html>
 ```
 
-Note that `nchan_redis_pass` implies `nchan_use_redis on;`, and that this setting is *not* inherited by nested locations.
+But if a request is made to `/sub_upstream`, it gets forwarded to your application (`my_app`) on port 8080 with the url `/subscriber_x_accel_redirect`.
+Note that you can set any forwarded headers here like any [`proxy_pass`](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass) Nginx location, 
+but unlike the case with `nchan_authorize_request`, Nchan-specific variables are not available.
 
-When connecting several Nchan servers to the same Redis server (or cluster), the servers **must have their times synced up**. Failure to do so may result in missing and duplicated messages.
+Now, your application must be set up to handle the request to `/subscriber_x_accel_redirect`. You should make sure the client is properly authenticated (maybe using a session cookie), and generate an associated channel id. If authentication fails, respond with a normal `403 Forbidden` response. You can also pass extra information about the failure in the response body and headers.
 
-See the [details page](https://nchan.slact.net/details#using-redis) for more information on using Redis.
+If your application successfully authenticates the subscriber request, you now need to instruct Nginx to issue an internal redirect to `/sub/internal/my_channel_id`.
+This is accomplished by responding with an empty `200 OK` response that includes two headers:
+- `X-Accel-Redirect: /sub/internal/my_channel_id`
+- `X-Accel-Buffering: no`
 
-<!-- tag:redis -->
+In the presence of these headers, Nginx will not forward your app's response to the client, and instead will *internally* redirect to `/sub/internal/my_channel_id`. 
+This will behave as if the client had requested the subscriber endpoint location directly.
+
+Thus using X-Accel-Redirect it is possible to both authenticate all subscribers *and* keep channel IDs completely hidden from subscribers.
+
+This method is especially useful for EventSource and Websocket subscribers. Long-Polling subscribers will need to be re-authenticated for every new message, which may flood your application with too many authentication requests.
+
+### Revoking Channel Authorization
+
+In some cases, you may want to revoke a particular subscriber's authorization for a given channel (e.g., if the user's permissions are changed). If the channel is unique to the subscriber, this is simply accomplished by deleting the channel. The same can be achieved for shared channels by subscribing each subscriber to both the shared channel and a subscriber-specific channel via a multiplexed connection. Deleting the subscriber-specific channel will terminate the subscriber''s connection, thereby also terminating their subscription to the shared channel. Consider the following configuration:
+
+```nginx
+location ~ /sub/(\w+) {
+  nchan_subscriber;
+  nchan_channel_id shared_$1 user_$arg_userid;
+  nchan_authorize_request /authorize;
+}
 
+location /pub/user {
+  nchan_publisher;
+  nchan_channel_id user_$arg_userid;
+}
+```
+
+A request to `/sub/foo?userid=1234` will subscribe to channels "shared_foo" and "user_1234" via a multiplexed connection. If you later send a `DELETE` request to `/pub/user?userid=1234`, this subscriber will be disconnected and therefore unsubscribed from both "user_1234" and "shared_foo".
+  
 ## Variables
 
 Nchan makes several variables usabled in the config file:
@@ -401,13 +1004,16 @@ Nchan makes several variables usabled in the config file:
   For subscriber locations, this variable is set to the subscriber type (websocket, longpoll, etc.).
 
 - `$nchan_publisher_type`  
-  For subscriber locations, this variable is set to the subscriber type (http or websocket).
+  For publisher locations, this variable is set to the subscriber type (http or websocket).
   
 - `$nchan_prev_message_id`, `$nchan_message_id`
   The current and previous (if applicable) message id for publisher request or subscriber response.
 
 - `$nchan_channel_event`
   For channel events, this is the event name. Useful when configuring `nchan_channel_event_string`.
+
+- `$nchan_version`
+  Current Nchan version. Available since 1.1.5.
   
 Additionally, `nchan_stub_status` data is also exposed as variables. These are available only when `nchan_stub_status` is enabled on at least one location:
 
@@ -440,18 +1046,72 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   > Split the channel id into several ids for multiplexing using the delimiter string provided.    
   [more details](#channel-multiplexing)  
 
+- **nchan_deflate_message_for_websocket** `[ on | off ]`  
+  arguments: 1  
+  default: `off`  
+  context: server, location  
+  > Store a compressed (deflated) copy of the message along with the original to be sent to websocket clients supporting the permessage-deflate protocol extension    
+
 - **nchan_eventsource_event**  
   arguments: 1  
   default: `(none)`  
   context: server, location, if  
   > Set the EventSource `event:` line to this value. When used in a publisher location, overrides the published message's `X-EventSource-Event` header and associates the message with the given value. When used in a subscriber location, overrides all messages' associated `event:` string with the given value.    
 
+- **nchan_eventsource_ping_comment**  
+  arguments: 1  
+  default: `(empty)`  
+  context: server, location, if  
+  > Set the EventSource comment `: ...` line for periodic pings from server to client. Newlines are not allowed. If empty, no comment is sent with the ping.    
+
+- **nchan_eventsource_ping_data**  
+  arguments: 1  
+  default: `(empty)`  
+  context: server, location, if  
+  > Set the EventSource `data:` line for periodic pings from server to client. Newlines are not allowed. If empty, no data is sent with the ping.    
+
+- **nchan_eventsource_ping_event**  
+  arguments: 1  
+  default: `ping`  
+  context: server, location, if  
+  > Set the EventSource `event:` line for periodic pings from server to client. Newlines are not allowed. If empty, no event type is sent with the ping.    
+
+- **nchan_eventsource_ping_interval** `<number> (seconds)`  
+  arguments: 1  
+  default: `0 (none)`  
+  context: server, location, if  
+  > Interval for sending ping messages to EventSource subscribers. Disabled by default.    
+
 - **nchan_longpoll_multipart_response** `[ off | on | raw ]`  
   arguments: 1  
   default: `off`  
   context: server, location, if  
   > when set to 'on', enable sending multiple messages in a single longpoll response, separated using the multipart/mixed content-type scheme. If there is only one available message in response to a long-poll request, it is sent unmodified. This is useful for high-latency long-polling connections as a way to minimize round-trips to the server. When set to 'raw', sends multiple messages using the http-raw-stream message separator.    
 
+- **nchan_permessage_deflate_compression_level** `[ 0-9 ]`  
+  arguments: 1  
+  default: `6`  
+  context: http  
+  > Compression level for the `deflate` algorithm used in websocket's permessage-deflate extension. 0: no compression, 1: fastest, worst, 9: slowest, best    
+
+- **nchan_permessage_deflate_compression_memlevel** `[ 1-9 ]`  
+  arguments: 1  
+  default: `8`  
+  context: http  
+  > Memory level for the `deflate` algorithm used in websocket's permessage-deflate extension. How much memory should be allocated for the internal compression state. 1 - minimum memory, slow and reduces compression ratio; 9 - maximum memory for optimal speed    
+
+- **nchan_permessage_deflate_compression_strategy** `[ default | filtered | huffman-only | rle | fixed ]`  
+  arguments: 1  
+  default: `default`  
+  context: http  
+  > Compression strategy for the `deflate` algorithm used in websocket's permessage-deflate extension. Use 'default' for normal data, For details see [zlib's section on copression strategies](http://zlib.net/manual.html#Advanced)    
+
+- **nchan_permessage_deflate_compression_window** `[ 9-15 ]`  
+  arguments: 1  
+  default: `10`  
+  context: http  
+  > Compression window for the `deflate` algorithm used in websocket's permessage-deflate extension. The base two logarithm of the window size (the size of the history buffer). The bigger the window, the better the compression, but the more memory used by the compressor.    
+
 - **nchan_publisher** `[ http | websocket ]`  
   arguments: 0 - 2  
   default: `http websocket`  
@@ -471,7 +1131,7 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   context: server, location, if  
   > Send POST request to internal location (which may proxy to an upstream server) with published message in the request body. Useful for bridging websocket publishers with HTTP applications, or for transforming message via upstream application before publishing to a channel.    
   > The upstream response code determines how publishing will proceed. A `200 OK` will publish the message from the upstream response's body. A `304 Not Modified` will publish the message as it was received from the publisher. A `204 No Content` will result in the message not being published.    
-  [more details](https://nchan.slact.net/details#message-publishing-callbacks)  
+  [more details](#message-forwarding)  
 
 - **nchan_pubsub** `[ http | websocket | eventsource | longpoll | intervalpoll | chunked | multipart-mixed | http-raw-stream ]`  
   arguments: 0 - 6  
@@ -480,6 +1140,12 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   > Defines a server or location as a pubsub endpoint. For long-polling, GETs subscribe. and POSTs publish. For Websockets, publishing data on a connection does not yield a channel metadata response. Without additional configuration, this turns a location into an echo server.    
   [more details](#pubsub-endpoint)  
 
+- **nchan_subscribe_request** `<url>`  
+  arguments: 1  
+  context: server, location, if  
+  > Send GET request to internal location (which may proxy to an upstream server) after subscribing. Disabled for longpoll and interval-polling subscribers.    
+  [more details](#subscriber-presence)  
+
 - **nchan_subscriber** `[ websocket | eventsource | longpoll | intervalpoll | chunked | multipart-mixed | http-raw-stream ]`  
   arguments: 0 - 5  
   default: `websocket eventsource longpoll chunked multipart-mixed`  
@@ -535,37 +1201,111 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   legacy name: push_subscriber_timeout  
   > Maximum time a subscriber may wait for a message before being disconnected. If you don't want a subscriber's connection to timeout, set this to 0. When possible, the subscriber will get a response with a `408 Request Timeout` status; otherwise the subscriber will simply be disconnected.    
 
+- **nchan_unsubscribe_request** `<url>`  
+  arguments: 1  
+  context: server, location, if  
+  > Send GET request to internal location (which may proxy to an upstream server) after unsubscribing. Disabled for longpoll and interval-polling subscribers.    
+  [more details](#subscriber-presence)  
+
+- **nchan_websocket_client_heartbeat** `<heartbeat_in> <heartbeat_out>`  
+  arguments: 2  
+  default: `none (disabled)`  
+  context: server, location, if  
+  > Most browser Websocket clients do not allow manually sending PINGs to the server. To overcome this limitation, this setting can be used to set up a PING/PONG message/response connection heartbeat. When the client sends the server message *heartbeat_in* (PING), the server automatically responds with *heartbeat_out* (PONG).    
+
 - **nchan_websocket_ping_interval** `<number> (seconds)`  
   arguments: 1  
   default: `0 (none)`  
   context: server, location, if  
   > Interval for sending websocket ping frames. Disabled by default.    
 
+- **nchan_access_control_allow_credentials**  
+  arguments: 1  
+  default: `on`  
+  context: http, server, location, if  
+  > When enabled, sets the [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) `Access-Control-Allow-Credentials` header to `true`.    
+
+- **nchan_access_control_allow_origin** `<string>`  
+  arguments: 1  
+  default: `$http_origin`  
+  context: http, server, location, if  
+  > Set the [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) `Access-Control-Allow-Origin` header to this value. If the incoming request's `Origin` header does not match this value, respond with a `403 Forbidden`. Multiple origins can be provided in a single argument separated with a space.    
+
 - **nchan_authorize_request** `<url>`  
   arguments: 1  
   context: server, location, if  
   > Send GET request to internal location (which may proxy to an upstream server) for authorization of a publisher or subscriber request. A 200 response authorizes the request, a 403 response forbids it.    
-  [more details](https://nchan.slact.net/details#request-authorization)  
+  [more details](#request-authorization)  
 
-- **nchan_subscribe_request** `<url>`  
+- **nchan_channel_group** `<string>`  
   arguments: 1  
+  default: `(none)`  
   context: server, location, if  
-  > Send GET request to internal location (which may proxy to an upstream server) after subscribing. Disabled for longpoll and interval-polling subscribers.    
-  [more details](https://nchan.slact.net/details#subsribe-and-unsubscribe-callbacks)  
+  legacy name: push_channel_group  
+  > The accounting and security group a channel belongs to. Works like a prefix string to the channel id. Can be set with nginx variables.    
 
-- **nchan_unsubscribe_request** `<url>`  
+- **nchan_channel_group_accounting**  
   arguments: 1  
-  context: server, location, if  
-  > Send GET request to internal location (which may proxy to an upstream server) after unsubscribing. Disabled for longpoll and interval-polling subscribers.    
-  [more details](https://nchan.slact.net/details#subsribe-and-unsubscribe-callbacks)  
+  default: `off`  
+  context: server, location  
+  > Enable tracking channel, subscriber, and message information on a per-channel-group basis. Can be used to place upper limits on channel groups.    
+
+- **nchan_group_location** `[ get | set | delete | off ]`  
+  arguments: 0 - 3  
+  default: `get set delete`  
+  context: location  
+  > Group information and configuration location. GET request for group info, POST to set limits, DELETE to delete all channels in group.    
 
-- **nchan_max_reserved_memory** `<size>`  
+- **nchan_group_max_channels** `<number>`  
   arguments: 1  
-  default: `32M`  
-  context: http  
-  legacy name: push_max_reserved_memory  
-  > The size of the shared memory chunk this module will use for message queuing and buffering.    
-  [more details](#memory-storage)  
+  default: `0 (unlimited)`  
+  context: location  
+  > Maximum number of channels allowed in the group.    
+
+- **nchan_group_max_messages** `<number>`  
+  arguments: 1  
+  default: `0 (unlimited)`  
+  context: location  
+  > Maximum number of messages allowed for all the channels in the group.    
+
+- **nchan_group_max_messages_disk** `<number>`  
+  arguments: 1  
+  default: `0 (unlimited)`  
+  context: location  
+  > Maximum amount of disk space allowed for the messages of all the channels in the group.    
+
+- **nchan_group_max_messages_memory** `<number>`  
+  arguments: 1  
+  default: `0 (unlimited)`  
+  context: location  
+  > Maximum amount of shared memory allowed for the messages of all the channels in the group.    
+
+- **nchan_group_max_subscribers** `<number>`  
+  arguments: 1  
+  default: `0 (unlimited)`  
+  context: location  
+  > Maximum number of subscribers allowed for the messages of all the channels in the group.    
+
+- **nchan_max_channel_id_length** `<number>`  
+  arguments: 1  
+  default: `1024`  
+  context: http, server, location  
+  legacy name: push_max_channel_id_length  
+  > Maximum permissible channel id length (number of characters). This settings applies to ids before they may be split by the `nchan_channel_id_split_delimiter` Requests with a channel id that is too long will receive a `403 Forbidden` response.    
+
+- **nchan_max_channel_subscribers** `<number>`  
+  arguments: 1  
+  default: `0 (unlimited)`  
+  context: http, server, location  
+  legacy name: push_max_channel_subscribers  
+  > Maximum concurrent subscribers to the channel on this Nchan server. Does not include subscribers on other Nchan instances when using a shared Redis server.    
+
+- **nchan_subscribe_existing_channels_only** `[ on | off ]`  
+  arguments: 1  
+  default: `off`  
+  context: http, server, location  
+  legacy name: push_authorized_channels_only  
+  > Whether or not a subscriber may create a channel by sending a request to a subscriber location. If set to on, a publisher must send a POST or PUT request before a subscriber can request messages on the channel. Otherwise, all subscriber requests to nonexistent channels will get a 403 Forbidden response.    
 
 - **nchan_message_buffer_length** `[ <number> | <variable> ]`  
   arguments: 1  
@@ -574,6 +1314,12 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   legacy names: push_max_message_buffer_length, push_message_buffer_length  
   > Publisher configuration setting the maximum number of messages to store per channel. A channel's message buffer will retain a maximum of this many most recent messages. An Nginx variable can also be used to set the buffer length dynamically.    
 
+- **nchan_message_temp_path** `<path>`  
+  arguments: 1  
+  default: `<client_body_temp_path>`  
+  context: http  
+  > Large messages are stored in temporary files in the `client_body_temp_path` or the `nchan_message_temp_path` if the former is unavailable. Default is the built-in default `client_body_temp_path`    
+
 - **nchan_message_timeout** `[ <time> | <variable> ]`  
   arguments: 1  
   default: `1h`  
@@ -581,36 +1327,83 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   legacy name: push_message_timeout  
   > Publisher configuration setting the length of time a message may be queued before it is considered expired. If you do not want messages to expire, set this to 0. Note that messages always expire from oldest to newest, so an older message may prevent a newer one with a shorter timeout from expiring. An Nginx variable can also be used to set the timeout dynamically.    
 
+- **nchan_redis_connect_timeout**  
+  arguments: 1  
+  default: `600ms`  
+  context: upstream  
+  > Redis server connection timeout.    
+
 - **nchan_redis_idle_channel_cache_timeout** `<time>`  
   arguments: 1  
   default: `30s`  
   context: http, server, location  
   > A Redis-stored channel and its messages are removed from memory (local cache) after this timeout, provided there are no local subscribers.    
 
-- **nchan_redis_pass**  
+- **nchan_redis_namespace** `<string>`  
+  arguments: 1  
+  context: http, server, upstream, location  
+  > Prefix all Redis keys with this string. All Nchan-related keys in redis will be of the form "nchan_redis_namespace:*" . Default is empty.    
+
+- **nchan_redis_nostore_fastpublish** `[ on | off ]`  
+  arguments: 1  
+  default: `off`  
+  context: http, server, upstream  
+  > Increases publishing capacity by 2-3x for Redis nostore mode at the expense of inaccurate subscriber counts in the publisher response.    
+
+- **nchan_redis_optimize_target** `[ cpu | bandwidth ]`  
+  arguments: 1  
+  default: `cpu`  
+  context: upstream  
+  > This tweaks whether [effect replication](https://redis.io/commands/eval#replicating-commands-instead-of-scripts) is enabled. Optimizing for CPU usage enables effect replication, costing additional bandwidth (between 1.2 and 2 times more) between all master->slave links. Optimizing for bandwidth increases CPU load on slaves, but keeps outgoing bandwidth used for replication the same as the incoming bandwidth on Master.    
+
+- **nchan_redis_pass** `<upstream-name>`  
   arguments: 1  
   context: http, server, location  
   > Use an upstream config block for Redis servers.    
-  [more details](https://nchan.slact.net/details#using-redis)  
+  [more details](#connecting-to-a-redis-server)  
 
 - **nchan_redis_ping_interval**  
   arguments: 1  
   default: `4m`  
-  context: http, server, location  
+  context: http, server, upstream, location  
   > Send a keepalive command to redis to keep the Nchan redis clients from disconnecting. Set to 0 to disable.    
 
-- **nchan_redis_server**  
+- **nchan_redis_server** `<redis-url>`  
+  arguments: 1  
+  context: upstream  
+  > Used in upstream { } blocks to set redis servers. Redis url is in the form 'redis://:password@hostname:6379/0'. Shorthands 'host:port' or 'host' are permitted.    
+  [more details](#connecting-to-a-redis-server)  
+
+- **nchan_redis_storage_mode** `[ distributed | backup | nostore ]`  
   arguments: 1  
+  default: `distributed`  
+  context: http, server, upstream  
+  > The mode of operation of the Redis server. In `distributed` mode, messages are published directly to Redis, and retrieved in real-time. Any number of Nchan servers in distributed mode can share the Redis server (or cluster). Useful for horizontal scalability, but suffers the latency penalty of all message publishing going through Redis first.  
+  >   
+  > In `backup` mode, messages are published locally first, then later forwarded to Redis, and are retrieved only upon chanel initialization. Only one Nchan server should use a Redis server (or cluster) in this mode. Useful for data persistence without sacrificing response times to the latency of a round-trip to Redis.  
+  >   
+  > In `nostore` mode, messages are published as in `distributed` mode, but are not stored. Thus Redis is used to broadcast messages to many Nchan instances with no delivery guarantees during connection failure, and only local in-memory storage. This means that there are also no message delivery guarantees for subscribers switching from one Nchan instance to another connected to the same Redis server or cluster. Nostore mode increases Redis publishing capacity by an order of magnitude.    
+
+- **nchan_redis_subscribe_weights** `master=<integer> slave=<integer>`  
+  arguments: 1 - 2  
+  default: `master=1 slave=1`  
   context: upstream  
-  > Used in upstream { } blocks to set redis servers.    
-  [more details](https://nchan.slact.net/details#using-redis)  
+  > Determines how subscriptions to Redis PUBSUB channels are distributed between master and slave nodes. The higher the number, the more likely that each node of that type will be chosen for each new channel. The weights for slave nodes are cumulative, so an equal 1:1 master:slave weight ratio with two slaves would have a 1/3 chance of picking a master, and 2/3 chance of picking one of the slaves. The weight must be a non-negative integer.    
 
-- **nchan_redis_url**  
+- **nchan_redis_url** `<redis-url>`  
   arguments: 1  
   default: `127.0.0.1:6379`  
   context: http, server, location  
-  > The path to a redis server, of the form 'redis://:password@hostname:6379/0'. Shorthand of the form 'host:port' or just 'host' is also accepted.    
-  [more details](https://nchan.slact.net/details#using-redis)  
+  > Use of this command is discouraged in favor of upstreams blocks with (`nchan_redis_server`)[#nchan_redis_server]. The path to a redis server, of the form 'redis://:password@hostname:6379/0'. Shorthand of the form 'host:port' or just 'host' is also accepted.    
+  [more details](#connecting-to-a-redis-server)  
+
+- **nchan_shared_memory_size** `<size>`  
+  arguments: 1  
+  default: `128M`  
+  context: http  
+  legacy names: push_max_reserved_memory, nchan_max_reserved_memory  
+  > Shared memory slab pre-allocated for Nchan. Used for channel statistics, message storage, and interprocess communication.    
+  [more details](#memory-storage)  
 
 - **nchan_store_messages** `[ on | off ]`  
   arguments: 1  
@@ -623,28 +1416,8 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   arguments: 1  
   default: `off`  
   context: http, server, location  
-  > Use redis for message storage at this location.    
-  [more details](https://nchan.slact.net/details#using-redis)  
-
-- **nchan_access_control_allow_origin** `<string>`  
-  arguments: 1  
-  default: `*`  
-  context: http, server, location  
-  > Set the [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) `Access-Control-Allow-Origin` header to this value. If the publisher or subscriber request's `Origin` header does not match this value, respond with a `403 Forbidden`.    
-
-- **nchan_channel_group** `<string>`  
-  arguments: 1  
-  default: `(none)`  
-  context: server, location, if  
-  legacy name: push_channel_group  
-  > Because settings are bound to locations and not individual channels, it is useful to be able to have channels that can be reached only from some locations and never others. That's where this setting comes in. Think of it as a prefix string for the channel id.    
-
-- **nchan_subscribe_existing_channels_only** `[ on | off ]`  
-  arguments: 1  
-  default: `off`  
-  context: http, server, location  
-  legacy name: push_authorized_channels_only  
-  > Whether or not a subscriber may create a channel by sending a request to a subscriber location. If set to on, a publisher must send a POST or PUT request before a subscriber can request messages on the channel. Otherwise, all subscriber requests to nonexistent channels will get a 403 Forbidden response.    
+  > Use of this command is discouraged in favor of (`nchan_redis_pass`)[#nchan_redis_pass]. Use Redis for message storage at this location.    
+  [more details](#connecting-to-a-redis-server)  
 
 - **nchan_channel_event_string** `<string>`  
   arguments: 1  
@@ -656,27 +1429,13 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   arguments: 1  
   context: server, location, if  
   > Channel id where `nchan_channel_id`'s events should be sent. Events like subscriber enqueue/dequeue, publishing messages, etc. Useful for application debugging. The channel event message is configurable via nchan_channel_event_string. The channel group for events is hardcoded to 'meta'.    
-  [more details](https://nchan.slact.net/details#channel-events)  
+  [more details](#channel-events)  
 
 - **nchan_stub_status**  
   arguments: 0  
   context: location  
   > Similar to Nginx's stub_status directive, requests to an `nchan_stub_status` location get a response with some vital Nchan statistics. This data does not account for information from other Nchan instances, and monitors only local connections, published messages, etc.    
-  [more details](https://nchan.slact.net/details#nchan_stub_status)  
-
-- **nchan_max_channel_id_length** `<number>`  
-  arguments: 1  
-  default: `512`  
-  context: http, server, location  
-  legacy name: push_max_channel_id_length  
-  > Maximum permissible channel id length (number of characters). Longer ids will be truncated.    
-
-- **nchan_max_channel_subscribers** `<number>`  
-  arguments: 1  
-  default: `0 (unlimited)`  
-  context: http, server, location  
-  legacy name: push_max_channel_subscribers  
-  > Maximum concurrent subscribers to the channel on this Nchan server. Does not include subscribers on other Nchan instances when using a shared Redis server.    
+  [more details](#nchan_stub_status)  
 
 - **nchan_channel_timeout**  
   arguments: 1  
@@ -690,5 +1449,9 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a
   context: http, server, location  
   > Development directive to completely replace default storage engine. Don't use unless you are an Nchan developer.    
 
+- **nchan_redis_wait_after_connecting**  
+  arguments: 1  
+  context: http, server, location  
+
 ## Contribute
-Please support this project with a donation to keep me warm through the winter. I accept bitcoin at 15dLBzRS4HLRwCCVjx4emYkxXcyAPmGxM3 . Other donation methods can be found at https://nchan.slact.net
+Please support this project with a donation to keep me warm through the winter. I accept bitcoin at 15dLBzRS4HLRwCCVjx4emYkxXcyAPmGxM3 . Other donation methods can be found at https://nchan.io
diff --git a/debian/modules/nchan/changelog.txt b/debian/modules/nchan/changelog.txt
index 8eba6215..88f481ec 100644
--- a/debian/modules/nchan/changelog.txt
+++ b/debian/modules/nchan/changelog.txt
@@ -1,3 +1,208 @@
+1.2.7 (Mar. 17 2020)
+ fix: unidirectional subscribers have their connection terminated if they send any data to the server
+      after the initial request handshake. This applies to all subscribers except Websocket
+ feature: periodic pings for EventSource subscribers
+ fix: Redis pending commands count may be incorrect in nchan's stub status page
+ fix: channel deletion fails to propagate to Redis slaves
+ fix: possible stack overflow when using websocket subscribers
+1.2.6 (Jun. 18 2019)
+ fix: when using Redis, a channel can stop receiving new messages if 
+      they are published faster than they can be sent to subscribers and the 
+      message buffer is sufficiently small
+ fix: websocket PONG response did not contain PING frame data
+ fix: multiplexed channels may stop receiving messages
+ fix (security): specially crafted websocket publisher requests when using Redis
+      may result in use-after-free memory access
+ fix: Nginx config reload may result in crash when using Redis cluster
+1.2.5 (Mar. 20 2019)
+ fix: using multiplexed channels with Redis in backup mode may result in worker crash
+ fix: nchan_publisher_channel_id could not be set exclusively in a publisher location
+ fix: Google pagespeed module compatibility
+ fix: nchan prevents nginx from starting if no http {} block is configured
+1.2.4 (Feb. 25 2019)
+ fix: Redis cluster info with zero-length hostname may result in worker crash
+ fix: build problems with included hiredis lib in FreeBSD
+ feature: nchan_redis_namespace and nchan_redis_ping_interval now work in upstream blocks
+ fix: websocket publisher did not publishing channel events
+ fix: Redis namespace was limited to 8 bytes
+1.2.3 (Oct. 15 2018)
+ fix: possible invalid memory access when the initial connection to a Redis cluster node times out
+1.2.2 (Oct. 9 2018)
+ fix (security): using an unresponsive, overloaded Redis server may result in invalid memory access
+ fix: incorrect logging of discovered Redis cluster nodes
+ fix: better handling of connection loss when Redis server is unresponsive
+ fix: presence of Redis cluster nodes with no known address ("noaddr") nodes could result in worker crash
+ fix (security): subscriber may erroneously receive a 400 Bad Request or crash a worker 
+      based on data from a previous subscriber
+ feature: built-in backend benchmark
+ feature: add optimized fastpublish option to Redis nostore mode for maximum
+      message publishing thoroughput via Redis
+ feature: add no-store Redis mode that uses Redis for broadcasting messages, not storage
+ fix: connecting to load-balancing Redis proxy resulted in crash
+ fix: using longpoll-multipart in "raw" mode cound result in worker crash
+ fix: channel events used with Redis resulted in segfault
+1.2.1 (Aug. 2 2018)
+ fix: channel last_requested was set to 0 instead of -1 on channel creation
+ fix: authentication failure body not forwarded for Nginx > 1.13.10
+ fix: possible invalid memory access for websocket unsubscribe requests
+ fix: building Nchan could interfere with building other modules
+1.2.0 (Jul. 23 2018)
+ feature: configurable support for CORS Access-Control-Allow-Credentials header
+ fix: better compliance with RFC7692  Websocket permessage-deflate parameter negotiation
+ fix (security): possible busy-loop denial-of-service for specially crafted 
+      handshakes from Websocket subscribers using permessage-deflate
+      (Thanks, Benjamin Michéle)
+ fix: nchan_permessage_deflate_compression_memlevel was not applied when set
+ refactor: all publisher and subscriber upstream requests are now more memory-efficient
+ fix: Using websocket publisher upstream requests may result in invalid memory access
+ fix: publishing Redis-backed messages with 1-second expiration may fail after
+      cluster restart
+ change: nchan_redis_wait_after_connecting directive is now obsolete, and is ignored
+ feature: nchan_redis_optimize_target for "cpu" or "bandwidth". Trades off CPU
+      load on Redis slaves for syncronization bandwidth.
+ feature: configurable Redis master/slave channel subscribe weights with
+      nchan_redis_subscribe_weights
+ fix: Compilation issues on OS X and systems lacking non-POSIX memrchr()
+ fix: nchan_pubsub CORS Allowed headers did not include headers used by subscribers
+ fix: Redis-backed channel buffer length could exceed nchan_message_buffer_length
+ fix: Publisher upstream compatibility for Nginx > 1.13.10
+ feature: nchan_redis_connect_timeout to configure maximum connection time 
+      to Redis servers
+ feature: Offload Redis SUBSCRIBE traffic to slaves 
+      (one SUBSCRIBE per channel per worker)
+ fix: Redis cluster and master/slave failover and reconnection issues
+ refactor: Redis connection handling rewritten from scratch
+ fix: subscribers may not receive new messages after reconnecting to Redis
+ fix: publishing to an unavailable Redis-backed channel may result in a 
+      following 400 Bad Request
+ change: Old Redis-backed channel messages are now delivered after the message
+      buffer is fully loaded into memory. Previously they were delivered
+      incrementally while the buffer loaded.
+ fix: multiplexed Redis-backed channels may not deliver messages if one or
+      more channels' messages all expire
+ fix: possible crash when catching up to reconnected Redis channel with
+      subscribers waiting for consecutive messages
+ fix: possible crash from rapidly creating and deleting channels
+1.1.15 (Apr. 27 2018)
+ fix: A disconnect from a Redis cluster node can result in a segfault
+ fix: Using Redis-backed multiplexed channels can result in a segfault
+1.1.14 (Jan. 10 2018)
+ feature: added nchan_redis_wait_after_connecting setting
+ fix: compatibility with Redis >= 4.0 cluster
+1.1.13 (Dec. 4 2017)
+ fix: added Redis backwards compatibility with Nchan 1.1.7 and below
+      for online upgrades with mixed-version Nchan cluster
+1.1.12 (Dec. 1 2017)
+ fix: possible "Unexpected spool == nuspool" worker crash
+ fix: subscriber messages delivered during active nchan_subscribe subrequest
+      may be garbled
+1.1.11 (Nov. 29 2017)
+ fix: Redis backup-mode not working (since 1.1.9)
+ fix: incorrect handling of Redis permessage-deflated messages results in
+      missing first char of eventsource event type
+ fix: worker crash when unable to create temp file for large websocket
+      permessage-deflate message
+ fix: CPU-bound overloaded Nginx may result in worker crashes
+      (may occur with large Openresty Lua load)
+ change: default nchan_shared_memory_size is now 128M
+ fix: some channel info from publisher GET requests may be incorrect with Redis
+ fix: file descriptor leak when reconnecting to Redis
+1.1.10 (Nov. 13 2017)
+ feature: nchan_authorize_request failure response forwarded back to subscriber
+      Sponsored by Symless (https://symless.com/)
+ fix: allow nchan_access_control_allow_origin in if blocks
+ fix: longpoll-multipart may read uninitialized memory when receiving 
+      zero-length message
+ fix (security): invalid memory access for aborted websocket subscriber 
+      after channel existence check via Redis
+ fix: websocket handhshake failure handled incorrectly when messages 
+      are available
+ fix (security): websocket subscriber disconnecting before handshake may
+      result in invalid memory access
+ fix (security): possible invalid memory access for disappearing longpoll sub
+ feature: add "shared memory limit" to nchan_stub_status output
+1.1.9 (Oct. 30 2017)
+ fix: more proper websocket extension negotiation with more 
+      informative failure messages
+ fix: websocket handshake failure response included superfluous CLOSE frame
+ feature: websocket deflate-frame and x-webkit-deflate-frame support
+1.1.8 (Oct. 26 2017)
+ feature: websocket permessage-deflate support
+      Sponsored by HYFN (https://hyfn.com/)
+ fix (security): websocket publisher may crash worker when publishing with
+      channel group accounting on to a new group
+ fix: messages published to Nchan via websocket binary frames 
+      should have content-type set to "application/octet-stream"
+ fix: accept websocket publisher binary frames (thanks @rponczkowski)
+ fix: multiplexing over exactly 255 channels results in worker crash
+ fix (security): Specially crafted invalid subscriber msgid may crash worker
+ fix: nchan_subscriber_first_message <= 0 (newest) with existing Redis data
+      incorrectly treated as "oldest" for initial subscribers
+ fix: 0-length channel name may crash worker
+ fix: subscribe/unsubscribe callback requests do not work when used with
+      authorization callback request
+ fix (security): Messages published with Redis through websocket publisher 
+      may result in worker crash (bug introduced in 1.1.5)
+ fix: nchan_pubsub setting may not be parsed correctly
+1.1.7 (Jul. 3 2017)
+ fix: possible read-after-free after redis disconnect
+ fix: publishing to redis cluster before it is connected results in worker crash
+ fix: possible use-after-free for suddenly disconnected longpoll-multipart subscriber
+ fix: possible use-after-free when using nchan_authorize_request for slow subscribers and slow upstream
+ fix: nchan_stub_status "stored messages" value could be incorrect when using Redis
+1.1.6 (May 9 2017)
+ fix: messages published through Redis may crash worker (introduced in 1.1.5)
+ fix (security): urlencoded message id in url parsed incorrectly can result in worker crash
+1.1.5 (May 3 2017)
+ feature: get current Nchan version through $nchan_version variable 
+      and nchan_stub_status
+ fix (security): invalid memory access for multiplexed channel subscribers 
+      with buffered output (Thanks Casey Forbes (@caseyf) for debugging.)
+ fix: "redis pending commands" nchan_stub_status stat could be wrong after 
+      deleting channels
+ fix: invalid memory access when using Redis under high load
+ fix: possible "message from the past" errors under high publishing load
+ fix: graceful publisher/subscriber notifications when out of shared memory
+      (via HTTP 507 Insufficient Storage status code)
+ fix: compatibility with limit_except directive
+1.1.4 (Apr. 25 2017)
+ fix (security): possible memory corruption using multiplexed channels 
+      at high load (Thanks Giovanni Caporaletti (@TrustNoOne) for debugging.)
+ fix: possible crash when reconnecting to Redis cluster (introduced in 1.1.3)
+1.1.3 (Mar. 25 2017)
+ fix (security): incorrect handling of WS optimization could trigger SIGABRT
+ fix: Redis cluster reconnect readiness verification
+1.1.2 (Mar. 1 2017)
+ change: "interprocess alert X delayed by Y sec" log messages downgraded 
+      from ERROR to NOTICE
+ fix: "group info string too short" error
+ fix: Incorrect handling of connections to Redis cluster nodes with round-robin
+      DNS hostnames (Thanks to ring.com for sponsoring this fix!)
+1.1.1 (Feb. 8 2017)
+ fix: incorrect stats for nchan_stub_status after reload.
+      (Stats are no longer reset after reload)
+ fix: websocket subscriber may receive two CLOSE frames
+ fix: websocket with ws+meta.nchan subprotocol did not receive empty messages
+ feature: websocket client heartbeats with nchan_websocket_client_heartbeat
+ fix: websocket now echoes code and reason when connection close initiated from client
+1.1.0 (Jan. 4 2017)
+ feature: websocket subscribers now receive "application/octet-stream" messages
+      in binary frame rather than text
+ fix: publisher request variables not always passed to nchan_publisher_upstream_request
+ feature: Redis storage 'backup' mode strictly for data persistence
+ fix: possible lingering subscriber if connection is closed just before subscribing
+ fix: possible memory leak when using multiplexed channels
+ security fix: subscribing with If-Modified-Since and without If-None-Match headers
+      crashed the Nginx worker (thanks @supertong)
+ security fix: sending an empty message to multipart/mixed subscriber crashed Nginx worker
+ fix: publisher & subscriber response codes were logged incorrectly
+ fix: websocket subscriber memory leak on upstream authentication failure
+ fix: possible crash after reloading when using several instances of Nchan with Redis
+ feature: nchan_access_control_allow_origin can accept nginx variables
+ feature: Redis key namespaces
+ feature: all size configurations can now parse decimal values
+ fix: off-by-one subscriber count when using multiplexed channels
+ feature: accounting and dynamic limits for channel groups
 1.0.8 (Nov. 28 2016)
  fix: possible crash under severely heavy load, introduced in 1.0.7 with stack-overflow fix
 1.0.7 (Nov. 27 2016)
diff --git a/debian/modules/nchan/cloc-exclude.txt b/debian/modules/nchan/cloc-exclude.txt
index c72f3728..fdf0e34a 100644
--- a/debian/modules/nchan/cloc-exclude.txt
+++ b/debian/modules/nchan/cloc-exclude.txt
@@ -1,17 +1,16 @@
 src/uthash.h
 src/hiredis
-src/store/redis/cmp.*
+src/util/ngx_nchan_hacked_slab.c
+src/util/hdr_histogram.c
+src/util/hdr_histogram.h
+src/store/redis/cmp.c
+src/store/redis/cmp.h
+src/store/redis/redis_lua_commands.h
 src/nginx-source
-dev/package
-dev/nginx-nchan/*.patch
-dev/nginx-nchan/pkg
-dev/nginx-nchan/src
-dev/nginx-nchan/*.txt
-dev/nginx-nchan/nginx.conf
-dev/nginx-nchan/nginx.logrotate
-dev/nginx-nchan/*.tar
-dev/nginx-nchan/*.gz
+src/nchan_config_commands.c
+dev/bench
+dev/nginx-pkg
 dev/clang-analyzer
 dev/package
 dev/src
-
+dev/redis-trib.rb
diff --git a/debian/modules/nchan/config b/debian/modules/nchan/config
index 5776d296..324deefd 100644
--- a/debian/modules/nchan/config
+++ b/debian/modules/nchan/config
@@ -1,25 +1,68 @@
 ngx_addon_name=ngx_nchan_module
 
+nchan_libs=""
 #do we have hiredis on the platform?
-ngx_feature="hiredis"
+# it's currently no longer possible to link the platform's hiredis lib, 
+# because we now use a hacked connect function
+# maybe it can be brought back at some later time...
+ngx_feature="hiredis with stored sockaddr"
+ngx_feature_name="NCHAN_HAVE_HIREDIS_WITH_SOCKADDR"
 ngx_feature_run=yes
-ngx_feature_incs="#include <hiredis/hiredis.h>"
-ngx_feature_test="if(HIREDIS_SONAME < 0.13) { return 1; }"
+ngx_feature_path=
+ngx_feature_incs=" \
+  #include <hiredis/hiredis.h>
+  #include <sys/socket.h>
+"
 ngx_feature_libs="-lhiredis"
+ngx_feature_test=" \
+  redisContext c; \
+  if(HIREDIS_SONAME < 0.13) { return 1; } \
+  if(sizeof(c.sockaddr) != sizeof(struct sockaddr)) { return 1;} \
+"
 . auto/feature
 if [ $ngx_found = no ]; then
   _NCHAN_HIREDIS_SRCS="\
-    ${ngx_addon_dir}/src/hiredis/hiredis.c \
-    ${ngx_addon_dir}/src/hiredis/read.c \
-    ${ngx_addon_dir}/src/hiredis/async.c \
-    ${ngx_addon_dir}/src/hiredis/sds.c \
-    ${ngx_addon_dir}/src/hiredis/net.c \
+    ${ngx_addon_dir}/src/store/redis/hiredis/hiredis.c \
+    ${ngx_addon_dir}/src/store/redis/hiredis/read.c \
+    ${ngx_addon_dir}/src/store/redis/hiredis/async.c \
+    ${ngx_addon_dir}/src/store/redis/hiredis/sds.c \
+    ${ngx_addon_dir}/src/store/redis/hiredis/net.c \
   "
   ngx_feature_libs=""
 else
+  nchan_libs="$nchan_libs $ngx_feature_libs"
   _NCHAN_HIREDIS_SRCS=""
 fi
 
+ngx_feature="math lib"
+ngx_feature_name="NCHAN_HAVE_MATH"
+ngx_feature_run=yes
+ngx_feature_path=
+ngx_feature_incs="#include <math.h>"
+ngx_feature_libs="-lm"
+ngx_feature_test="sqrt(20);"
+. auto/feature
+if [ $ngx_found = yes ]; then
+  nchan_libs="$nchan_libs $ngx_feature_libs"
+fi
+
+#do we have memrchr() on the platform?
+ngx_feature="memrchr()"
+ngx_feature_name="NCHAN_HAVE_MEMRCHR"
+ngx_feature_run=yes
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_incs=" \
+  #include <string.h> 
+  #include <stddef.h> 
+"
+ngx_feature_test=" \
+  const char *str = \"aboobar\"; \
+  const void *place = &str[4]; \
+  const void *found = memrchr(str, 'b', strlen(str)); \
+  if(place != found) { return 1; } \
+"
+. auto/feature
 
 _NCHAN_SUBSCRIBERS_SRCS="\
   ${ngx_addon_dir}/src/subscribers/common.c \
@@ -35,24 +78,31 @@ _NCHAN_SUBSCRIBERS_SRCS="\
   ${ngx_addon_dir}/src/subscribers/memstore_ipc.c \
   ${ngx_addon_dir}/src/subscribers/memstore_multi.c \
   ${ngx_addon_dir}/src/subscribers/memstore_redis.c \
+  ${ngx_addon_dir}/src/subscribers/getmsg_proxy.c \
+  ${ngx_addon_dir}/src/subscribers/benchmark.c \
 "
 
 _NCHAN_REDIS_STORE_SRCS="\
   ${_NCHAN_HIREDIS_SRCS} \
   ${ngx_addon_dir}/src/store/redis/cmp.c \
-  ${ngx_addon_dir}/src/store/redis/cluster.c \
+  ${ngx_addon_dir}/src/store/redis/redis_lua_commands.c \
+  ${ngx_addon_dir}/src/store/redis/redis_nodeset_parser.c \
+  ${ngx_addon_dir}/src/store/redis/redis_nodeset.c \
   ${ngx_addon_dir}/src/store/redis/rdsstore.c \
   ${ngx_addon_dir}/src/store/redis/redis_nginx_adapter.c \
 "
 _NCHAN_MEMORY_STORE_SRCS="\
   ${ngx_addon_dir}/src/store/memory/ipc.c \
   ${ngx_addon_dir}/src/store/memory/ipc-handlers.c \
+  ${ngx_addon_dir}/src/store/memory/groups.c \
   ${ngx_addon_dir}/src/store/memory/memstore.c \
 "
 
 _nchan_util_dir="${ngx_addon_dir}/src/util"
 _NCHAN_UTIL_SRCS=" \
+  $_nchan_util_dir/nchan_debug.c \
   $_nchan_util_dir/nchan_list.c \
+  $_nchan_util_dir/nchan_slist.c \
   $_nchan_util_dir/ngx_nchan_hacked_slab.c \
   $_nchan_util_dir/shmem.c \
   $_nchan_util_dir/nchan_rbtree.c \
@@ -62,31 +112,32 @@ _NCHAN_UTIL_SRCS=" \
   $_nchan_util_dir/nchan_fake_request.c \
   $_nchan_util_dir/nchan_bufchainpool.c \
   $_nchan_util_dir/nchan_channel_id.c \
-  $_nchan_util_dir/nchan_channel_info.c \
-  $_nchan_util_dir/nchan_msgid.c \
+  $_nchan_util_dir/nchan_output_info.c \
+  $_nchan_util_dir/nchan_msg.c \
   $_nchan_util_dir/nchan_thingcache.c \
   $_nchan_util_dir/nchan_reaper.c \
   $_nchan_util_dir/nchan_subrequest.c \
+  $_nchan_util_dir/nchan_benchmark.c \
+  $_nchan_util_dir/hdr_histogram.c \
 "
 
 _NCHAN_STORE_SRCS="\
   ${ngx_addon_dir}/src/store/spool.c \
   ${ngx_addon_dir}/src/store/ngx_rwlock.c \
   ${ngx_addon_dir}/src/store/store_common.c \
-  $_NCHAN_REDIS_STORE_SRCS \
   $_NCHAN_MEMORY_STORE_SRCS \
+  $_NCHAN_REDIS_STORE_SRCS \
 "
 
 _NCHAN_SRCS="\
-  $_NCHAN_UTIL_SRCS \
-  $_NCHAN_SUBSCRIBERS_SRCS \
-  $_NCHAN_STORE_SRCS \
   ${ngx_addon_dir}/src/nchan_defs.c \
   ${ngx_addon_dir}/src/nchan_variables.c \
   ${ngx_addon_dir}/src/nchan_module.c \
+  $_NCHAN_UTIL_SRCS \
+  $_NCHAN_SUBSCRIBERS_SRCS \
+  $_NCHAN_STORE_SRCS \
 "
 
-
 ngx_module_incs=$ngx_addon_dir/src
 
 have=NGX_HTTP_HEADERS . auto/have
@@ -95,11 +146,11 @@ if test -n "$ngx_module_link"; then
   ngx_module_type=HTTP
   ngx_module_name=$ngx_addon_name
   ngx_module_srcs="$_NCHAN_SRCS"
-  ngx_module_libs=$ngx_feature_libs
+  ngx_module_libs=$nchan_libs
   . auto/module
 else
   NGX_ADDON_SRCS="$NGX_ADDON_SRCS $_NCHAN_SRCS"
-  CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
+  CORE_LIBS="$CORE_LIBS $nchan_libs"
   CORE_INCS="$CORE_INCS $ngx_module_incs"
   HTTP_MODULES="$HTTP_MODULES $ngx_addon_name"
 fi
diff --git a/debian/modules/nchan/src/nchan_commands.rb b/debian/modules/nchan/src/nchan_commands.rb
index 12a88f1c..eae0ea97 100644
--- a/debian/modules/nchan/src/nchan_commands.rb
+++ b/debian/modules/nchan/src/nchan_commands.rb
@@ -30,13 +30,24 @@
       group: "pubsub",
       tags: [ 'publisher', 'hook' ],
       value: "<url>",
-      uri: "/details#message-publishing-callbacks",
+      uri: "#message-forwarding",
       info: <<-EOS.gsub(/^ {8}/, '')
         Send POST request to internal location (which may proxy to an upstream server) with published message in the request body. Useful for bridging websocket publishers with HTTP applications, or for transforming message via upstream application before publishing to a channel.  
         The upstream response code determines how publishing will proceed. A `200 OK` will publish the message from the upstream response's body. A `304 Not Modified` will publish the message as it was received from the publisher. A `204 No Content` will result in the message not being published.
       EOS
-      
   
+      
+  nchan_deflate_message_for_websocket [:srv, :loc],
+      :nchan_set_message_compression_slot,
+      :loc_conf,
+      args: 1,
+      
+      group: "pubsub",
+      tags: ["publisher", 'subscriber-websocket'],
+      value: ['on', 'off'],
+      default: "off",
+      info: "Store a compressed (deflated) copy of the message along with the original to be sent to websocket clients supporting the permessage-deflate protocol extension"
+      
   nchan_channel_id_split_delimiter [:srv, :loc, :if],
       :ngx_conf_set_str_slot,
       [:loc_conf, :channel_id_split_delimiter],
@@ -62,6 +73,7 @@
       :nchan_pubsub_directive,
       :loc_conf,
       args: 0..6,
+      alt: ["nchan_pubsub_location"],
       
       group: "pubsub",
       tags: [ 'publisher', 'subscriber', 'pubsub' ],
@@ -91,13 +103,53 @@
       tags: ['subscriber-eventsource'],
       default: "(none)",
       info: "Set the EventSource `event:` line to this value. When used in a publisher location, overrides the published message's `X-EventSource-Event` header and associates the message with the given value. When used in a subscriber location, overrides all messages' associated `event:` string with the given value."
+  
+  nchan_eventsource_ping_comment [:srv, :loc, :if],
+      :ngx_conf_set_str_slot_no_newlines,
+      [:loc_conf, :"eventsource_ping.comment"],
+      args: 1,
+      
+      group: "pubsub",
+      tags: ['subscriber-eventsource'],
+      default: "(empty)",
+      info: "Set the EventSource comment `: ...` line for periodic pings from server to client. Newlines are not allowed. If empty, no comment is sent with the ping."
+  
+  nchan_eventsource_ping_event [:srv, :loc, :if],
+      :ngx_conf_set_str_slot_no_newlines,
+      [:loc_conf, :"eventsource_ping.event"],
+      args: 1,
+      
+      group: "pubsub",
+      tags: ['subscriber-eventsource'],
+      default: "ping",
+      info: "Set the EventSource `event:` line for periodic pings from server to client. Newlines are not allowed. If empty, no event type is sent with the ping."
+  
+  nchan_eventsource_ping_data [:srv, :loc, :if],
+      :ngx_conf_set_str_slot_no_newlines,
+      [:loc_conf, :"eventsource_ping.data"],
+      args: 1,
+      
+      group: "pubsub",
+      tags: ['subscriber-eventsource'],
+      default: "(empty)",
+      info: "Set the EventSource `data:` line for periodic pings from server to client. Newlines are not allowed. If empty, no data is sent with the ping."
+  
+    nchan_eventsource_ping_interval [:srv, :loc, :if],
+      :ngx_conf_set_sec_slot,
+      [:loc_conf, :"eventsource_ping.interval"],
       
+      group: "pubsub",
+      tags: ['subscriber-eventsource'],
+      value: "<number> (seconds)",
+      default: "0 (none)",
+      info: "Interval for sending ping messages to EventSource subscribers. Disabled by default."
   
   nchan_subscriber [:srv, :loc, :if],
       :nchan_subscriber_directive,
       :loc_conf,
       args: 0..5,
       legacy: "push_subscriber",
+      alt: ["nchan_subscriber_location"],
       
       group: "pubsub",
       tags: ['subscriber'],
@@ -188,11 +240,23 @@
       default: "0 (none)",
       info: "Interval for sending websocket ping frames. Disabled by default."
   
+  nchan_websocket_client_heartbeat [:srv, :loc, :if],
+      :nchan_websocket_heartbeat_directive,
+      [:loc_conf, :websocket_heartbeat],
+      args: 2,
+      
+      group: "pubsub",
+      tags:['subscriber-websocket'],
+      value: "<heartbeat_in> <heartbeat_out>",
+      default: "none (disabled)",
+      info: "Most browser Websocket clients do not allow manually sending PINGs to the server. To overcome this limitation, this setting can be used to set up a PING/PONG message/response connection heartbeat. When the client sends the server message *heartbeat_in* (PING), the server automatically responds with *heartbeat_out* (PONG)."
+  
   nchan_publisher [:srv, :loc, :if],
       :nchan_publisher_directive,
       :loc_conf,
       args: 0..2,
       legacy: "push_publisher",
+      alt: ["nchan_publisher_location"],
       
       group: "pubsub",
       tags: ['publisher'],
@@ -221,7 +285,7 @@
       tags: ['publisher', 'subscriber', 'hook'],
       value: "<url>",
       info: "Send GET request to internal location (which may proxy to an upstream server) for authorization of a publisher or subscriber request. A 200 response authorizes the request, a 403 response forbids it.",
-      uri: "/details#request-authorization"
+      uri: "#request-authorization"
   
   nchan_subscribe_request [:srv, :loc, :if], 
       :ngx_http_set_complex_value_slot,
@@ -231,7 +295,7 @@
       tags: ['subscriber', 'hook'],
       value: "<url>",
       info: "Send GET request to internal location (which may proxy to an upstream server) after subscribing. Disabled for longpoll and interval-polling subscribers.",
-      uri: "/details#subsribe-and-unsubscribe-callbacks"
+      uri: "#subscriber-presence"
   
   nchan_unsubscribe_request [:srv, :loc, :if], 
       :ngx_http_set_unsubscribe_request_url,
@@ -241,7 +305,18 @@
       tags: ['subscriber', 'hook'],
       value: "<url>",
       info: "Send GET request to internal location (which may proxy to an upstream server) after unsubscribing. Disabled for longpoll and interval-polling subscribers.",
-      uri: "/details#subsribe-and-unsubscribe-callbacks"
+      uri: "#subscriber-presence"
+  
+  nchan_message_temp_path [:main],
+      :ngx_conf_set_path_slot,
+      [:main_conf, :message_temp_path],
+      
+      group: "storage",
+      tags: ["memstore"],
+      value: "<path>",
+      default: "<client_body_temp_path>",
+      info: "Large messages are stored in temporary files in the `client_body_temp_path` or the `nchan_message_temp_path` if the former is unavailable. Default is the built-in default `client_body_temp_path`"
+      
   
   nchan_store_messages [:main, :srv, :loc, :if],
       :nchan_store_messages_directive,
@@ -254,27 +329,68 @@
       default: :on,
       info: "Publisher configuration. \"`off`\" is equivalent to setting `nchan_message_buffer_length 0`, which disables the buffering of old messages. Using this setting is not recommended when publishing very quickly, as it may result in missed messages."
     
-  nchan_max_reserved_memory [:main],
-      :ngx_conf_set_size_slot,
+  nchan_shared_memory_size [:main],
+      :nchan_conf_set_size_slot,
       [:main_conf, :shm_size],
-      legacy: "push_max_reserved_memory",
+      legacy: ["push_max_reserved_memory", "nchan_max_reserved_memory"],
       
       group: "storage",
       tags: ['memstore'],
       value: "<size>",
-      default: "32M",
-      info: "The size of the shared memory chunk this module will use for message queuing and buffering.",
+      default: "128M",
+      info: "Shared memory slab pre-allocated for Nchan. Used for channel statistics, message storage, and interprocess communication.",
       uri: "#memory-storage"
-    
+  
+  nchan_permessage_deflate_compression_level [:main],
+      :nchan_conf_deflate_compression_level_directive,
+      :main_conf,
+      
+      group: "pubsub",
+      tags: ['subscriber-websocket'],
+      value: ["0-9"],
+      default: "6",
+      info: "Compression level for the `deflate` algorithm used in websocket's permessage-deflate extension. 0: no compression, 1: fastest, worst, 9: slowest, best"
+  
+  nchan_permessage_deflate_compression_strategy [:main],
+      :nchan_conf_deflate_compression_strategy_directive,
+      :main_conf,
+      
+      group: "pubsub",
+      tags: ['subscriber-websocket'],
+      value: ["default", "filtered", "huffman-only", "rle", "fixed"],
+      default: "default",
+      info: "Compression strategy for the `deflate` algorithm used in websocket's permessage-deflate extension. Use 'default' for normal data, For details see [zlib's section on copression strategies](http://zlib.net/manual.html#Advanced)"
+  
+  nchan_permessage_deflate_compression_window [:main],
+      :nchan_conf_deflate_compression_window_directive,
+      :main_conf,
+      
+      group: "pubsub",
+      tags: ['subscriber-websocket'],
+      value: ["9-15"],
+      default: "10",
+      info: "Compression window for the `deflate` algorithm used in websocket's permessage-deflate extension. The base two logarithm of the window size (the size of the history buffer). The bigger the window, the better the compression, but the more memory used by the compressor."
+  
+  nchan_permessage_deflate_compression_memlevel [:main],
+      :nchan_conf_deflate_compression_memlevel_directive,
+      :main_conf,
+      
+      group: "pubsub",
+      tags: ['subscriber-websocket'],
+      value: ["1-9"],
+      default: "8",
+      info: "Memory level for the `deflate` algorithm used in websocket's permessage-deflate extension. How much memory should be allocated for the internal compression state. 1 - minimum memory, slow and reduces compression ratio; 9 - maximum memory for optimal speed"
+  
   nchan_redis_url [:main, :srv, :loc],
       :ngx_conf_set_redis_url,
       [:loc_conf, :"redis.url"],
       
       group: "storage",
       tags: ['redis'],
+      value: "<redis-url>",
       default: "127.0.0.1:6379",
-      info: "The path to a redis server, of the form 'redis://:password@hostname:6379/0'. Shorthand of the form 'host:port' or just 'host' is also accepted.",
-      uri: "/details#using-redis"
+      info: "Use of this command is discouraged in favor of upstreams blocks with (`nchan_redis_server`)[#nchan_redis_server]. The path to a redis server, of the form 'redis://:password@hostname:6379/0'. Shorthand of the form 'host:port' or just 'host' is also accepted.",
+      uri: "#connecting-to-a-redis-server"
   
   nchan_redis_pass [:main, :srv, :loc],
       :ngx_conf_set_redis_upstream_pass,
@@ -282,8 +398,9 @@
       
       group: "storage",
       tags: ['publisher', 'subscriber', 'redis'],
+      value: "<upstream-name>",
       info: "Use an upstream config block for Redis servers.",
-      uri: "/details#using-redis"
+      uri: "#connecting-to-a-redis-server"
   
   nchan_redis_pass_inheritable [:main, :srv, :loc],
       :ngx_conf_set_flag_slot,
@@ -303,8 +420,36 @@
       :loc_conf,
       group: "storage",
       tags: ['redis'],
-      info: "Used in upstream { } blocks to set redis servers.",
-      uri: "/details#using-redis"
+      value: "<redis-url>",
+      info: "Used in upstream { } blocks to set redis servers. Redis url is in the form 'redis://:password@hostname:6379/0'. Shorthands 'host:port' or 'host' are permitted.",
+      uri: "#connecting-to-a-redis-server"
+  
+  nchan_redis_storage_mode [:main, :srv, :upstream], 
+      :ngx_conf_set_redis_storage_mode_slot,
+      [:loc_conf, :"redis.storage_mode"],
+      
+      group: "storage",
+      tags: ['redis'],
+      value: ["distributed", "backup", "nostore"],
+      default: "distributed",
+      info: <<-EOS.gsub(/^ {8}/, '')
+        The mode of operation of the Redis server. In `distributed` mode, messages are published directly to Redis, and retrieved in real-time. Any number of Nchan servers in distributed mode can share the Redis server (or cluster). Useful for horizontal scalability, but suffers the latency penalty of all message publishing going through Redis first.
+        
+        In `backup` mode, messages are published locally first, then later forwarded to Redis, and are retrieved only upon chanel initialization. Only one Nchan server should use a Redis server (or cluster) in this mode. Useful for data persistence without sacrificing response times to the latency of a round-trip to Redis.
+        
+        In `nostore` mode, messages are published as in `distributed` mode, but are not stored. Thus Redis is used to broadcast messages to many Nchan instances with no delivery guarantees during connection failure, and only local in-memory storage. This means that there are also no message delivery guarantees for subscribers switching from one Nchan instance to another connected to the same Redis server or cluster. Nostore mode increases Redis publishing capacity by an order of magnitude.
+      EOS
+  
+  nchan_redis_nostore_fastpublish [:main, :srv, :upstream],
+      :ngx_conf_set_flag_slot,
+      [:loc_conf, :"redis.nostore_fastpublish"],
+      
+      group: "storage",
+      tags: ['redis', 'publisher'],
+      value: [:on, :off],
+      default: :off,
+      info: "Increases publishing capacity by 2-3x for Redis nostore mode at the expense of inaccurate subscriber counts in the publisher response."
+  
   
   nchan_use_redis [:main, :srv, :loc],
       :ngx_conf_enable_redis,
@@ -314,10 +459,10 @@
       tags: ['redis', 'publisher', 'subscriber'],
       value: [ :on, :off ],
       default: :off,
-      info: "Use redis for message storage at this location.", 
-      uri: "/details#using-redis"
+      info: "Use of this command is discouraged in favor of (`nchan_redis_pass`)[#nchan_redis_pass]. Use Redis for message storage at this location.",
+      uri: "#connecting-to-a-redis-server"
   
-  nchan_redis_ping_interval [:main, :srv, :loc],
+  nchan_redis_ping_interval [:main, :srv, :upstream, :loc],
       :ngx_conf_set_sec_slot,
       [:loc_conf, :"redis.ping_interval"],
       
@@ -326,6 +471,55 @@
       default: "4m",
       info: "Send a keepalive command to redis to keep the Nchan redis clients from disconnecting. Set to 0 to disable."
   
+  nchan_redis_wait_after_connecting [:main, :srv, :loc],
+      :nchan_ignore_obsolete_setting,
+      :loc_conf,
+      
+      group: "obsolete",
+      tags: ['redis'],
+      uncocumented: true
+  
+  nchan_redis_connect_timeout [:upstream],
+      :ngx_conf_set_msec_slot,
+      [:srv_conf, :"redis.connect_timeout"],
+      
+      group: "storage",
+      tags: ['redis'],
+      default: "600ms",
+      info: "Redis server connection timeout."
+  
+  nchan_redis_subscribe_weights [:upstream],
+      :ngx_conf_set_redis_subscribe_weights,
+      :srv_conf,
+      args: 1..2,
+      
+      group: "storage",
+      tags: ['redis'],
+      value: "master=<integer> slave=<integer>",
+      default: "master=1 slave=1",
+      info: "Determines how subscriptions to Redis PUBSUB channels are distributed between master and slave nodes. The higher the number, the more likely that each node of that type will be chosen for each new channel. The weights for slave nodes are cumulative, so an equal 1:1 master:slave weight ratio with two slaves would have a 1/3 chance of picking a master, and 2/3 chance of picking one of the slaves. The weight must be a non-negative integer."
+  
+  nchan_redis_optimize_target [:upstream],
+      :ngx_conf_set_redis_optimize_target,
+      :srv_conf,
+      
+      group: "storage",
+      tags: ['redis'],
+      value: [:cpu, :bandwidth],
+      default: "cpu",
+      info: "This tweaks whether [effect replication](https://redis.io/commands/eval#replicating-commands-instead-of-scripts) is enabled. Optimizing for CPU usage enables effect replication, costing additional bandwidth (between 1.2 and 2 times more) between all master->slave links. Optimizing for bandwidth increases CPU load on slaves, but keeps outgoing bandwidth used for replication the same as the incoming bandwidth on Master."
+  
+  nchan_redis_namespace [:main, :srv, :upstream, :loc], 
+      :ngx_conf_set_str_slot,
+      [:loc_conf, :"redis.namespace"],
+      args: 1,
+      post_handler: "ngx_conf_process_redis_namespace_slot",
+      
+      group: "storage",
+      value: "<string>",
+      tags: ['redis'],
+      info: "Prefix all Redis keys with this string. All Nchan-related keys in redis will be of the form \"nchan_redis_namespace:*\" . Default is empty."
+  
   nchan_redis_fakesub_timer_interval [:main],
       :ngx_conf_set_msec_slot,
       [:main_conf, :redis_fakesub_timer_interval],
@@ -378,27 +572,108 @@
       default: :off,
       info: "Whether or not a subscriber may create a channel by sending a request to a subscriber location. If set to on, a publisher must send a POST or PUT request before a subscriber can request messages on the channel. Otherwise, all subscriber requests to nonexistent channels will get a 403 Forbidden response."
   
-  nchan_access_control_allow_origin [:main, :srv, :loc], 
-      :ngx_conf_set_str_slot,
+  nchan_access_control_allow_origin [:main, :srv, :loc, :if], 
+      :ngx_http_set_complex_value_slot,
       [:loc_conf, :allow_origin],
       args: 1,
       
       group: "security",
       value: "<string>",
       tags: ['publisher', 'subscriber'],
-      default: "*",
-      info: "Set the [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) `Access-Control-Allow-Origin` header to this value. If the publisher or subscriber request's `Origin` header does not match this value, respond with a `403 Forbidden`."
+      default: "$http_origin",
+      info: "Set the [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) `Access-Control-Allow-Origin` header to this value. If the incoming request's `Origin` header does not match this value, respond with a `403 Forbidden`. Multiple origins can be provided in a single argument separated with a space."
+
+  nchan_access_control_allow_credentials [:main, :srv, :loc, :if], 
+      :ngx_conf_set_flag_slot,
+      [:loc_conf, :allow_credentials],
+      args: 1,
+      
+      group: "security",
+      tags: ['publisher', 'subscriber'],
+      default: "on",
+      info: "When enabled, sets the [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) `Access-Control-Allow-Credentials` header to `true`."
+  
   
   nchan_channel_group [:srv, :loc, :if], 
-      :ngx_conf_set_str_slot, 
+      :ngx_http_set_complex_value_slot, 
       [:loc_conf, :channel_group],
       legacy: "push_channel_group",
       
       group: "security",
-      tags: ['publisher', 'subscriber', 'channel-events'],
+      tags: ['publisher', 'subscriber', 'channel-events', 'group'],
       value: "<string>",
       default: "(none)",
-      info: "Because settings are bound to locations and not individual channels, it is useful to be able to have channels that can be reached only from some locations and never others. That's where this setting comes in. Think of it as a prefix string for the channel id."
+      info: "The accounting and security group a channel belongs to. Works like a prefix string to the channel id. Can be set with nginx variables."
+  
+  nchan_channel_group_accounting [:srv, :loc], 
+      :ngx_conf_set_flag_slot,
+      [:loc_conf, "group.enable_accounting"],
+      
+      group: "security",
+      tags: ['group', 'security'],
+      default: "off",
+      info: "Enable tracking channel, subscriber, and message information on a per-channel-group basis. Can be used to place upper limits on channel groups."
+  
+  nchan_group_location [:loc], 
+      :nchan_group_directive, 
+      [:loc_conf],
+      args: 0..3,
+      
+      group: "security",
+      tags: ['group'],
+      value: ["get", "set", "delete", "off"],
+      default: ["get", "set", "delete"],
+      info: "Group information and configuration location. GET request for group info, POST to set limits, DELETE to delete all channels in group."
+  
+  nchan_group_max_channels [:loc], 
+      :ngx_http_set_complex_value_slot, 
+      [:loc_conf, "group.max_channels"],
+      
+      group: "security",
+      tags: ['group', 'security'],
+      value: "<number>",
+      default: "0 (unlimited)",
+      info: "Maximum number of channels allowed in the group."
+  
+  nchan_group_max_messages [:loc], 
+      :ngx_http_set_complex_value_slot, 
+      [:loc_conf, "group.max_messages"],
+      
+      group: "security",
+      tags: ['group', 'security'],
+      value: "<number>",
+      default: "0 (unlimited)",
+      info: "Maximum number of messages allowed for all the channels in the group."
+  
+  nchan_group_max_messages_memory [:loc], 
+      :ngx_http_set_complex_value_slot, 
+      [:loc_conf, "group.max_messages_shm_bytes"],
+      
+      group: "security",
+      tags: ['group', 'security'],
+      value: "<number>",
+      default: "0 (unlimited)",
+      info: "Maximum amount of shared memory allowed for the messages of all the channels in the group."
+  
+  nchan_group_max_messages_disk [:loc], 
+      :ngx_http_set_complex_value_slot, 
+      [:loc_conf, "group.max_messages_file_bytes"],
+      
+      group: "security",
+      tags: ['group', 'security'],
+      value: "<number>",
+      default: "0 (unlimited)",
+      info: "Maximum amount of disk space allowed for the messages of all the channels in the group."
+  
+  nchan_group_max_subscribers [:loc], 
+      :ngx_http_set_complex_value_slot, 
+      [:loc_conf, "group.max_subscribers"],
+      
+      group: "security",
+      tags: ['group', 'security'],
+      value: "<number>",
+      default: "0 (unlimited)",
+      info: "Maximum number of subscribers allowed for the messages of all the channels in the group."
   
   nchan_channel_events_channel_id [:srv, :loc, :if],
       :nchan_set_channel_events_channel_id,
@@ -406,8 +681,8 @@
       args: 1,
       
       group: "meta",
-      tags: ['publisher', 'subscriber', 'channel-events'],
-      uri: "/details#channel-events",
+      tags: ['publisher', 'subscriber', 'channel-events', 'introspection'],
+      uri: "#channel-events",
       info: "Channel id where `nchan_channel_id`'s events should be sent. Events like subscriber enqueue/dequeue, publishing messages, etc. Useful for application debugging. The channel event message is configurable via nchan_channel_event_string. The channel group for events is hardcoded to 'meta'."
   
   nchan_stub_status [:loc],
@@ -416,15 +691,16 @@
       args: 0,
       
       group: "meta",
+      tags: ['introspection'],
       info: "Similar to Nginx's stub_status directive, requests to an `nchan_stub_status` location get a response with some vital Nchan statistics. This data does not account for information from other Nchan instances, and monitors only local connections, published messages, etc.",
-      uri: "/details#nchan_stub_status"
+      uri: "#nchan_stub_status"
   
   nchan_channel_event_string [:srv, :loc, :if], 
       :ngx_http_set_complex_value_slot,
       [:loc_conf, :channel_event_string],
       
       group: "meta",
-      tags: ['publisher', 'subscriber', 'channel-events'],
+      tags: ['publisher', 'subscriber', 'channel-events', 'introspection'],
       value: "<string>",
       default: "\"$nchan_channel_event $nchan_channel_id\"",
       info: "Contents of channel event message"
@@ -437,8 +713,8 @@
       group: "security",
       tags: ['publisher', 'subscriber', 'channel-id' ],
       value: "<number>",
-      default: 512,
-      info: "Maximum permissible channel id length (number of characters). Longer ids will be truncated."
+      default: 1024,
+      info: "Maximum permissible channel id length (number of characters). This settings applies to ids before they may be split by the `nchan_channel_id_split_delimiter` Requests with a channel id that is too long will receive a `403 Forbidden` response."
   
   nchan_max_channel_subscribers [:main, :srv, :loc],
       :ngx_conf_set_num_slot,
@@ -468,6 +744,49 @@
       default: "memory",
       info: "Development directive to completely replace default storage engine. Don't use unless you are an Nchan developer."
   
+  nchan_benchmark [:loc],
+      :nchan_benchmark_directive,
+      [:loc_conf],
+      group: "development",
+      undocumented: true,
+      args: 0
+  nchan_benchmark_time [:loc],
+      :ngx_conf_set_sec_slot,
+      [:loc_conf, "benchmark.time"],
+      group: "development",
+      undocumented: true
+  nchan_benchmark_messages_per_channel_per_minute [:loc],
+      :ngx_conf_set_num_slot,
+      [:loc_conf, "benchmark.msgs_per_minute"],
+      group: "development",
+      undocumented: true
+  nchan_benchmark_message_padding_bytes [:loc],
+      :ngx_conf_set_num_slot,
+      [:loc_conf, "benchmark.msg_padding"],
+      group: "development",
+      undocumented: true
+  nchan_benchmark_channels [:loc],
+      :ngx_conf_set_num_slot,
+      [:loc_conf, "benchmark.channels"],
+      group: "development",
+      undocumented: true
+  nchan_benchmark_subscribers_per_channel [:loc],
+      :ngx_conf_set_num_slot,
+      [:loc_conf, "benchmark.subscribers_per_channel"],
+      group: "development",
+      undocumented: true
+    nchan_benchmark_subscriber_distribution [:loc],
+      :nchan_benchmark_subscriber_distribution_directive,
+      [:loc_conf, "benchmark.subscriber_distribution"],
+      group: "development",
+      undocumented: true
+    nchan_benchmark_publisher_distribution [:loc],
+      :nchan_benchmark_publisher_distribution_directive,
+      [:loc_conf, "benchmark.publisher_distribution"],
+      group: "development",
+      undocumented: true
+
+  
   push_min_message_buffer_length [:srv, :loc, :if],
       :nchan_ignore_obsolete_setting,
       :loc_conf,
diff --git a/debian/modules/nchan/src/nchan_config_commands.c b/debian/modules/nchan/src/nchan_config_commands.c
index 3051f09b..4cbde2a3 100644
--- a/debian/modules/nchan/src/nchan_config_commands.c
+++ b/debian/modules/nchan/src/nchan_config_commands.c
@@ -1,4 +1,8 @@
 //AUTOGENERATED, do not edit! see nchan_commands.rb
+static ngx_conf_post_t nchan_redis_namespace__post_handler = {
+  ngx_conf_process_redis_namespace_slot
+};
+
 static ngx_command_t  nchan_commands[] = {
     { ngx_string("nchan_channel_id"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1|NGX_CONF_TAKE2|NGX_CONF_TAKE3|NGX_CONF_TAKE4|NGX_CONF_TAKE5|NGX_CONF_TAKE6|NGX_CONF_TAKE7,
@@ -33,6 +37,13 @@ static ngx_command_t  nchan_commands[] = {
     offsetof(nchan_loc_conf_t, publisher_upstream_request_url),
     NULL } ,
 
+  { ngx_string("nchan_deflate_message_for_websocket"),
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    nchan_set_message_compression_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    0,
+    NULL } ,
+
   { ngx_string("nchan_channel_id_split_delimiter"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
     ngx_conf_set_str_slot,
@@ -59,6 +70,12 @@ static ngx_command_t  nchan_commands[] = {
     NGX_HTTP_LOC_CONF_OFFSET,
     0,
     NULL } ,
+  { ngx_string("nchan_pubsub_location"), //alt for nchan_pubsub
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_NOARGS|NGX_CONF_TAKE1|NGX_CONF_TAKE2|NGX_CONF_TAKE3|NGX_CONF_TAKE4|NGX_CONF_TAKE5|NGX_CONF_TAKE6,
+    nchan_pubsub_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    0,
+    NULL } ,
 
   { ngx_string("nchan_longpoll_multipart_response"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
@@ -74,6 +91,34 @@ static ngx_command_t  nchan_commands[] = {
     offsetof(nchan_loc_conf_t, eventsource_event),
     NULL } ,
 
+  { ngx_string("nchan_eventsource_ping_comment"),
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_str_slot_no_newlines,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, eventsource_ping.comment),
+    NULL } ,
+
+  { ngx_string("nchan_eventsource_ping_event"),
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_str_slot_no_newlines,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, eventsource_ping.event),
+    NULL } ,
+
+  { ngx_string("nchan_eventsource_ping_data"),
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_str_slot_no_newlines,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, eventsource_ping.data),
+    NULL } ,
+
+  { ngx_string("nchan_eventsource_ping_interval"),
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_sec_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, eventsource_ping.interval),
+    NULL } ,
+
   { ngx_string("nchan_subscriber"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_NOARGS|NGX_CONF_TAKE1|NGX_CONF_TAKE2|NGX_CONF_TAKE3|NGX_CONF_TAKE4|NGX_CONF_TAKE5,
     nchan_subscriber_directive,
@@ -86,6 +131,12 @@ static ngx_command_t  nchan_commands[] = {
     NGX_HTTP_LOC_CONF_OFFSET,
     0,
     NULL } ,
+  { ngx_string("nchan_subscriber_location"), //alt for nchan_subscriber
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_NOARGS|NGX_CONF_TAKE1|NGX_CONF_TAKE2|NGX_CONF_TAKE3|NGX_CONF_TAKE4|NGX_CONF_TAKE5,
+    nchan_subscriber_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    0,
+    NULL } ,
 
   { ngx_string("nchan_subscriber_compound_etag_message_id"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
@@ -129,6 +180,13 @@ static ngx_command_t  nchan_commands[] = {
     offsetof(nchan_loc_conf_t, websocket_ping_interval),
     NULL } ,
 
+  { ngx_string("nchan_websocket_client_heartbeat"),
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE2,
+    nchan_websocket_heartbeat_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, websocket_heartbeat),
+    NULL } ,
+
   { ngx_string("nchan_publisher"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_NOARGS|NGX_CONF_TAKE1|NGX_CONF_TAKE2,
     nchan_publisher_directive,
@@ -141,6 +199,12 @@ static ngx_command_t  nchan_commands[] = {
     NGX_HTTP_LOC_CONF_OFFSET,
     0,
     NULL } ,
+  { ngx_string("nchan_publisher_location"), //alt for nchan_publisher
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_NOARGS|NGX_CONF_TAKE1|NGX_CONF_TAKE2,
+    nchan_publisher_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    0,
+    NULL } ,
 
   { ngx_string("nchan_subscriber_timeout"),
     NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
@@ -176,6 +240,13 @@ static ngx_command_t  nchan_commands[] = {
     offsetof(nchan_loc_conf_t, unsubscribe_request_url),
     NULL } ,
 
+  { ngx_string("nchan_message_temp_path"),
+    NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_path_slot,
+    NGX_HTTP_MAIN_CONF_OFFSET,
+    offsetof(nchan_main_conf_t, message_temp_path),
+    NULL } ,
+
   { ngx_string("nchan_store_messages"),
     NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
     nchan_store_messages_directive,
@@ -189,18 +260,52 @@ static ngx_command_t  nchan_commands[] = {
     0,
     NULL } ,
 
-  { ngx_string("nchan_max_reserved_memory"),
+  { ngx_string("nchan_shared_memory_size"),
     NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
-    ngx_conf_set_size_slot,
+    nchan_conf_set_size_slot,
     NGX_HTTP_MAIN_CONF_OFFSET,
     offsetof(nchan_main_conf_t, shm_size),
     NULL } ,
-  { ngx_string("push_max_reserved_memory"), //legacy for nchan_max_reserved_memory
+  { ngx_string("push_max_reserved_memory"), //legacy for nchan_shared_memory_size
     NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
-    ngx_conf_set_size_slot,
+    nchan_conf_set_size_slot,
     NGX_HTTP_MAIN_CONF_OFFSET,
     offsetof(nchan_main_conf_t, shm_size),
     NULL } ,
+  { ngx_string("nchan_max_reserved_memory"), //legacy for nchan_shared_memory_size
+    NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+    nchan_conf_set_size_slot,
+    NGX_HTTP_MAIN_CONF_OFFSET,
+    offsetof(nchan_main_conf_t, shm_size),
+    NULL } ,
+
+  { ngx_string("nchan_permessage_deflate_compression_level"),
+    NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+    nchan_conf_deflate_compression_level_directive,
+    NGX_HTTP_MAIN_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_permessage_deflate_compression_strategy"),
+    NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+    nchan_conf_deflate_compression_strategy_directive,
+    NGX_HTTP_MAIN_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_permessage_deflate_compression_window"),
+    NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+    nchan_conf_deflate_compression_window_directive,
+    NGX_HTTP_MAIN_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_permessage_deflate_compression_memlevel"),
+    NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
+    nchan_conf_deflate_compression_memlevel_directive,
+    NGX_HTTP_MAIN_CONF_OFFSET,
+    0,
+    NULL } ,
 
   { ngx_string("nchan_redis_url"),
     NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
@@ -237,6 +342,20 @@ static ngx_command_t  nchan_commands[] = {
     0,
     NULL } ,
 
+  { ngx_string("nchan_redis_storage_mode"),
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_redis_storage_mode_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, redis.storage_mode),
+    NULL } ,
+
+  { ngx_string("nchan_redis_nostore_fastpublish"),
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_flag_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, redis.nostore_fastpublish),
+    NULL } ,
+
   { ngx_string("nchan_use_redis"),
     NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     ngx_conf_enable_redis,
@@ -245,12 +364,47 @@ static ngx_command_t  nchan_commands[] = {
     NULL } ,
 
   { ngx_string("nchan_redis_ping_interval"),
-    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_UPS_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     ngx_conf_set_sec_slot,
     NGX_HTTP_LOC_CONF_OFFSET,
     offsetof(nchan_loc_conf_t, redis.ping_interval),
     NULL } ,
 
+  { ngx_string("nchan_redis_wait_after_connecting"),
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    nchan_ignore_obsolete_setting,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_redis_connect_timeout"),
+    NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_msec_slot,
+    NGX_HTTP_SRV_CONF_OFFSET,
+    offsetof(nchan_srv_conf_t, redis.connect_timeout),
+    NULL } ,
+
+  { ngx_string("nchan_redis_subscribe_weights"),
+    NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1|NGX_CONF_TAKE2,
+    ngx_conf_set_redis_subscribe_weights,
+    NGX_HTTP_SRV_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_redis_optimize_target"),
+    NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_redis_optimize_target,
+    NGX_HTTP_SRV_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_redis_namespace"),
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_UPS_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_str_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, redis.namespace),
+    &nchan_redis_namespace__post_handler } ,
+
   { ngx_string("nchan_redis_fakesub_timer_interval"),
     NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
     ngx_conf_set_msec_slot,
@@ -317,25 +471,81 @@ static ngx_command_t  nchan_commands[] = {
     NULL } ,
 
   { ngx_string("nchan_access_control_allow_origin"),
-    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-    ngx_conf_set_str_slot,
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+    ngx_http_set_complex_value_slot,
     NGX_HTTP_LOC_CONF_OFFSET,
     offsetof(nchan_loc_conf_t, allow_origin),
     NULL } ,
 
+  { ngx_string("nchan_access_control_allow_credentials"),
+    NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_flag_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, allow_credentials),
+    NULL } ,
+
   { ngx_string("nchan_channel_group"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
-    ngx_conf_set_str_slot,
+    ngx_http_set_complex_value_slot,
     NGX_HTTP_LOC_CONF_OFFSET,
     offsetof(nchan_loc_conf_t, channel_group),
     NULL } ,
   { ngx_string("push_channel_group"), //legacy for nchan_channel_group
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
-    ngx_conf_set_str_slot,
+    ngx_http_set_complex_value_slot,
     NGX_HTTP_LOC_CONF_OFFSET,
     offsetof(nchan_loc_conf_t, channel_group),
     NULL } ,
 
+  { ngx_string("nchan_channel_group_accounting"),
+    NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_flag_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, group.enable_accounting),
+    NULL } ,
+
+  { ngx_string("nchan_group_location"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_NOARGS|NGX_CONF_TAKE1|NGX_CONF_TAKE2|NGX_CONF_TAKE3,
+    nchan_group_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_group_max_channels"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_http_set_complex_value_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, group.max_channels),
+    NULL } ,
+
+  { ngx_string("nchan_group_max_messages"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_http_set_complex_value_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, group.max_messages),
+    NULL } ,
+
+  { ngx_string("nchan_group_max_messages_memory"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_http_set_complex_value_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, group.max_messages_shm_bytes),
+    NULL } ,
+
+  { ngx_string("nchan_group_max_messages_disk"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_http_set_complex_value_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, group.max_messages_file_bytes),
+    NULL } ,
+
+  { ngx_string("nchan_group_max_subscribers"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_http_set_complex_value_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, group.max_subscribers),
+    NULL } ,
+
   { ngx_string("nchan_channel_events_channel_id"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
     nchan_set_channel_events_channel_id,
@@ -403,6 +613,62 @@ static ngx_command_t  nchan_commands[] = {
     offsetof(nchan_loc_conf_t, storage_engine),
     NULL } ,
 
+  { ngx_string("nchan_benchmark"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_NOARGS,
+    nchan_benchmark_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    0,
+    NULL } ,
+
+  { ngx_string("nchan_benchmark_time"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_sec_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, benchmark.time),
+    NULL } ,
+
+  { ngx_string("nchan_benchmark_messages_per_channel_per_minute"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_num_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, benchmark.msgs_per_minute),
+    NULL } ,
+
+  { ngx_string("nchan_benchmark_message_padding_bytes"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_num_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, benchmark.msg_padding),
+    NULL } ,
+
+  { ngx_string("nchan_benchmark_channels"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_num_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, benchmark.channels),
+    NULL } ,
+
+  { ngx_string("nchan_benchmark_subscribers_per_channel"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    ngx_conf_set_num_slot,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, benchmark.subscribers_per_channel),
+    NULL } ,
+
+  { ngx_string("nchan_benchmark_subscriber_distribution"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    nchan_benchmark_subscriber_distribution_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, benchmark.subscriber_distribution),
+    NULL } ,
+
+  { ngx_string("nchan_benchmark_publisher_distribution"),
+    NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+    nchan_benchmark_publisher_distribution_directive,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(nchan_loc_conf_t, benchmark.publisher_distribution),
+    NULL } ,
+
   { ngx_string("push_min_message_buffer_length"),
     NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
     nchan_ignore_obsolete_setting,
diff --git a/debian/modules/nchan/src/nchan_defs.c b/debian/modules/nchan/src/nchan_defs.c
index c9e07e14..8dbd49c3 100644
--- a/debian/modules/nchan/src/nchan_defs.c
+++ b/debian/modules/nchan/src/nchan_defs.c
@@ -15,6 +15,7 @@ const  ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_HEADERS = ngx_string("Access-
 const  ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_METHODS = ngx_string("Access-Control-Allow-Methods");
 const  ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN = ngx_string("Access-Control-Allow-Origin");
 const  ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS = ngx_string("Access-Control-Expose-Headers");
+const  ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS = ngx_string("Access-Control-Allow-Credentials");
 
 const  ngx_str_t NCHAN_HEADER_EVENTSOURCE_EVENT = ngx_string("X-EventSource-Event");
 
@@ -26,6 +27,7 @@ const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_KEY = ngx_string("Sec-WebSocket-Key")
 const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_ACCEPT = ngx_string("Sec-WebSocket-Accept");
 const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_VERSION = ngx_string("Sec-WebSocket-Version");
 const ngx_str_t NCHAN_HEADERS_SEC_WEBSOCKET_PROTOCOL = ngx_string("Sec-WebSocket-Protocol");
+const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_EXTENSIONS = ngx_string("Sec-WebSocket-Extensions");
 
 //and some wobsockety values
 const ngx_str_t NCHAN_UPGRADE = ngx_string("Upgrade");
@@ -39,6 +41,7 @@ const  ngx_str_t NCHAN_CACHE_CONTROL_VALUE = ngx_string("no-cache");
 const  ngx_str_t NCHAN_HTTP_STATUS_101 = ngx_string("101 Switching Protocols");
 const  ngx_str_t NCHAN_HTTP_STATUS_204 = ngx_string("204 No Content");
 const  ngx_str_t NCHAN_HTTP_STATUS_304 = ngx_string("304 Not Modified");
+const  ngx_str_t NCHAN_HTTP_STATUS_400 = ngx_string("400 Bad Request");
 const  ngx_str_t NCHAN_HTTP_STATUS_408 = ngx_string("408 Request Timeout");
 const  ngx_str_t NCHAN_HTTP_STATUS_409 = ngx_string("409 Conflict");
 const  ngx_str_t NCHAN_HTTP_STATUS_410 = ngx_string("410 Gone");
@@ -46,10 +49,14 @@ const  ngx_str_t NCHAN_HTTP_STATUS_410 = ngx_string("410 Gone");
 //other stuff
 const  ngx_str_t NCHAN_SUBSCRIBER_TIMEOUT= ngx_string("Subscriber Timeout");
 const  ngx_str_t NCHAN_ANYSTRING= ngx_string("*");
+const  ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_GROUP_HEADERS = ngx_string("Accept, Content-Type");
 const  ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_PUBLISHER_HEADERS = ngx_string("Content-Type");
 const  ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_SUBSCRIBER_HEADERS = ngx_string("If-None-Match, If-Modified-Since, Content-Type, Cache-Control, X-EventSource-Event");
+const  ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_PUBSUB_HEADERS = ngx_string("If-None-Match, If-Modified-Since, Content-Type, Cache-Control, X-EventSource-Event");
 const  ngx_str_t NCHAN_ALLOW_GET_POST_PUT_DELETE= ngx_string("GET, POST, PUT, DELETE");
 const  ngx_str_t NCHAN_ALLOW_GET= ngx_string("GET");
+const  ngx_str_t NCHAN_ALLOW_GET_POST_DELETE= ngx_string("GET, POST, DELETE");
+
 
 const  ngx_str_t NCHAN_VARY_HEADER_VALUE = ngx_string("If-None-Match, If-Modified-Since");
 const  ngx_str_t NCHAN_MSG_RESPONSE_ALLOWED_HEADERS = ngx_string("Last-Modified, Etag, Content-Type");
@@ -86,6 +93,6 @@ const ngx_str_t NCHAN_CHANNEL_INFO_YAML = ngx_string(
   "messages: %ui" CRLF
   "requested: %d" CRLF
   "subscribers: %ui" CRLF
-  "last_message_id: %V" CRLF
+  "last_message_id: \"%V\"" CRLF
   CRLF
   "\0");
diff --git a/debian/modules/nchan/src/nchan_defs.h b/debian/modules/nchan/src/nchan_defs.h
index 8e1af05b..0809080e 100644
--- a/debian/modules/nchan/src/nchan_defs.h
+++ b/debian/modules/nchan/src/nchan_defs.h
@@ -1,12 +1,13 @@
 #ifndef NCHAN_DEFS_H
 #define NCHAN_DEFS_H
 
-#define NCHAN_DEFAULT_SHM_SIZE 33554432 //32 megs
+#define NCHAN_DEFAULT_SHM_SIZE 134217728 //128 megs
 #define NCHAN_DEFAULT_MESSAGE_TIMEOUT 3600
 #define NCHAN_DEFAULT_REDIS_IDLE_CHANNEL_CACHE_TIMEOUT 30
 #define NCHAN_DEFAULT_SUBSCRIBER_TIMEOUT 0  //default: never timeout
+#define NCHAN_DEFAULT_REDIS_NODE_CONNECT_TIMEOUT_MSEC 600
 //(liucougar: this is a bit confusing, but it is what's the default behavior before this option is introducecd)
-#define NCHAN_DEFAULT_WEBSOCKET_PING_INTERVAL 0
+#define NCHAN_DEFAULT_SUBSCRIBER_PING_INTERVAL 0
 
 #define NCHAN_DEFAULT_CHANNEL_TIMEOUT 5 //default: timeout in 5 seconds
 
@@ -62,6 +63,7 @@ extern const ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_HEADERS;
 extern const ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_METHODS;
 extern const ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN;
 extern const ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS;
+extern const ngx_str_t NCHAN_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS;
 
 extern const ngx_str_t NCHAN_HEADER_EVENTSOURCE_EVENT;
 
@@ -71,6 +73,7 @@ extern const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_KEY;
 extern const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_ACCEPT;
 extern const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_VERSION;
 extern const ngx_str_t NCHAN_HEADERS_SEC_WEBSOCKET_PROTOCOL;
+extern const ngx_str_t NCHAN_HEADER_SEC_WEBSOCKET_EXTENSIONS;
 
 //header values
 extern const  ngx_str_t NCHAN_CACHE_CONTROL_VALUE;
@@ -79,6 +82,7 @@ extern const  ngx_str_t NCHAN_CACHE_CONTROL_VALUE;
 extern const  ngx_str_t NCHAN_HTTP_STATUS_101;
 extern const  ngx_str_t NCHAN_HTTP_STATUS_204;
 extern const  ngx_str_t NCHAN_HTTP_STATUS_304;
+extern const  ngx_str_t NCHAN_HTTP_STATUS_400;
 extern const  ngx_str_t NCHAN_HTTP_STATUS_408;
 extern const  ngx_str_t NCHAN_HTTP_STATUS_409;
 extern const  ngx_str_t NCHAN_HTTP_STATUS_410;
@@ -91,7 +95,10 @@ extern const ngx_str_t NCHAN_WEBSOCKET;
 extern const ngx_str_t NCHAN_ANYSTRING;
 extern const ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_PUBLISHER_HEADERS;
 extern const ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_SUBSCRIBER_HEADERS;
+extern const ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_PUBSUB_HEADERS;
+extern const ngx_str_t NCHAN_ACCESS_CONTROL_ALLOWED_GROUP_HEADERS;
 extern const ngx_str_t NCHAN_ALLOW_GET_POST_PUT_DELETE;
+extern const ngx_str_t NCHAN_ALLOW_GET_POST_DELETE;
 extern const ngx_str_t NCHAN_ALLOW_GET;
 extern const ngx_str_t NCHAN_VARY_HEADER_VALUE;
 extern const ngx_str_t NCHAN_MSG_RESPONSE_ALLOWED_HEADERS;
diff --git a/debian/modules/nchan/src/nchan_module.c b/debian/modules/nchan/src/nchan_module.c
old mode 100755
new mode 100644
index ff978520..4555c5d1
--- a/debian/modules/nchan/src/nchan_module.c
+++ b/debian/modules/nchan/src/nchan_module.c
@@ -13,11 +13,17 @@
 #include <subscribers/http-multipart-mixed.h>
 #include <subscribers/http-raw-stream.h>
 #include <subscribers/websocket.h>
+#include <subscribers/benchmark.h>
 #include <store/memory/store.h>
 #include <store/redis/store.h>
 
 #include <nchan_setup.c>
 
+#if (NGX_ZLIB)
+#include <zlib.h>
+#endif
+
+
 #if FAKESHARD
 #include <store/memory/ipc.h>
 #include <store/memory/shmem.h>
@@ -30,6 +36,9 @@ ngx_int_t           nchan_worker_processes;
 int                 nchan_stub_status_enabled = 0;
 
 
+static void nchan_publisher_body_handler(ngx_http_request_t *r);
+static void nchan_publisher_unavailable_body_handler(ngx_http_request_t *r);
+
 //#define DEBUG_LEVEL NGX_LOG_WARN
 //#define DEBUG_LEVEL NGX_LOG_DEBUG
 
@@ -55,8 +64,6 @@ ngx_int_t nchan_maybe_send_channel_event_message(ngx_http_request_t *r, channel_
   static ngx_str_t evt_chan_publish= ngx_string("channel_publish");
   static ngx_str_t evt_chan_delete = ngx_string("channel_delete");
 
-  struct timeval             tv;
-  
   nchan_loc_conf_t          *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
   ngx_http_complex_value_t  *cv = cf->channel_events_channel_id;
   if(cv==NULL) {
@@ -70,7 +77,6 @@ ngx_int_t nchan_maybe_send_channel_event_message(ngx_http_request_t *r, channel_
   ngx_str_t                 *id;
   u_char                    *cur;
   ngx_str_t                  evstr;
-  ngx_buf_t                  buf;
   nchan_msg_t                msg;
   
   switch(event_type) {
@@ -113,21 +119,22 @@ ngx_int_t nchan_maybe_send_channel_event_message(ngx_http_request_t *r, channel_
   
   //the event message
   ngx_http_complex_value(r, cf->channel_event_string, &evstr);
-  ngx_memzero(&buf, sizeof(buf)); //do we really need this?...
-  buf.temporary = 1;
-  buf.memory = 1;
-  buf.last_buf = 1;
-  buf.pos = evstr.data;
-  buf.last = evstr.data + evstr.len;
-  buf.start = buf.pos;
-  buf.end = buf.last;
   
   ngx_memzero(&msg, sizeof(msg));
-  ngx_gettimeofday(&tv);
-  msg.id.time = tv.tv_sec;
-  msg.id.tagcount = 1;
-  msg.buf = &buf;
   
+  msg.buf.temporary = 1;
+  msg.buf.memory = 1;
+  msg.buf.last_buf = 1;
+  msg.buf.pos = evstr.data;
+  msg.buf.last = evstr.data + evstr.len;
+  msg.buf.start = msg.buf.pos;
+  msg.buf.end = msg.buf.last;
+  
+  msg.id.time = 0;
+  msg.id.tag.fixed[0] = 0;
+  msg.id.tagactive = 0;
+  msg.id.tagcount = 1;
+  msg.storage = NCHAN_MSG_STACK;
   
   if(evcf == NULL) {
     evcf = &evcf_data;
@@ -201,9 +208,7 @@ ngx_int_t nchan_loc_conf_max_messages(nchan_loc_conf_t *cf) {
   return num;
 }
 
-static void nchan_publisher_body_handler(ngx_http_request_t *r);
-
-static ngx_int_t nchan_http_publisher_handler(ngx_http_request_t * r) {
+static ngx_int_t nchan_http_publisher_handler(ngx_http_request_t * r, void (*body_handler)(ngx_http_request_t *r)) {
   ngx_int_t                       rc;
   nchan_request_ctx_t            *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
   
@@ -211,7 +216,7 @@ static ngx_int_t nchan_http_publisher_handler(ngx_http_request_t * r) {
   
   if(ctx) ctx->publisher_type = &publisher_name;
   
-  /* Instruct ngx_http_read_subscriber_request_body to store the request
+  /* Instruct ngx_http_read_client_request_body to store the request
      body entirely in a memory buffer or in a file */
   r->request_body_in_single_buf = 1;
   r->request_body_in_persistent_file = 1;
@@ -221,7 +226,7 @@ static ngx_int_t nchan_http_publisher_handler(ngx_http_request_t * r) {
   //don't buffer the request body --send it right on through
   //r->request_body_no_buffering = 1;
 
-  rc = ngx_http_read_client_request_body(r, nchan_publisher_body_handler);
+  rc = ngx_http_read_client_request_body(r, body_handler);
   if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
     return rc;
   }
@@ -233,11 +238,14 @@ ngx_int_t nchan_stub_status_handler(ngx_http_request_t *r) {
   ngx_chain_t          out;
   nchan_stub_status_t *stats;
   
-  float                shmem_used;
+  nchan_main_conf_t   *mcf = ngx_http_get_module_main_conf(r, ngx_nchan_module);
+  
+  float                shmem_used, shmem_max;
   
   char     *buf_fmt = "total published messages: %ui\n"
                       "stored messages: %ui\n"
                       "shared memory used: %fK\n"
+                      "shared memory limit: %fK\n"
                       "channels: %ui\n"
                       "subscribers: %ui\n"
                       "redis pending commands: %ui\n"
@@ -246,7 +254,8 @@ ngx_int_t nchan_stub_status_handler(ngx_http_request_t *r) {
                       "interprocess alerts in transit: %ui\n"
                       "interprocess queued alerts: %ui\n"
                       "total interprocess send delay: %ui\n"
-                      "total interprocess receive delay: %ui\n";
+                      "total interprocess receive delay: %ui\n"
+                      "nchan version: %s\n";
   
   if ((b = ngx_pcalloc(r->pool, sizeof(*b) + 800)) == NULL) {
     nchan_log_request_error(r, "Failed to allocate response buffer for nchan_stub_status.");
@@ -254,13 +263,14 @@ ngx_int_t nchan_stub_status_handler(ngx_http_request_t *r) {
   }
   
   shmem_used = (float )((float )nchan_get_used_shmem() / 1024.0);
+  shmem_max = (float )((float )mcf->shm_size / 1024.0);
   
   stats = nchan_get_stub_status_stats();
   
   b->start = (u_char *)&b[1];
   b->pos = b->start;
   
-  b->end = ngx_snprintf(b->start, 800, buf_fmt, stats->total_published_messages, stats->messages, shmem_used, stats->channels, stats->subscribers, stats->redis_pending_commands, stats->redis_connected_servers, stats->ipc_total_alerts_received, stats->ipc_total_alerts_sent - stats->ipc_total_alerts_received, stats->ipc_queue_size, stats->ipc_total_send_delay, stats->ipc_total_receive_delay);
+  b->end = ngx_snprintf(b->start, 800, buf_fmt, stats->total_published_messages, stats->messages, shmem_used, shmem_max, stats->channels, stats->subscribers, stats->redis_pending_commands, stats->redis_connected_servers, stats->ipc_total_alerts_received, stats->ipc_total_alerts_sent - stats->ipc_total_alerts_received, stats->ipc_queue_size, stats->ipc_total_send_delay, stats->ipc_total_receive_delay, NCHAN_VERSION);
   b->last = b->end;
 
   b->memory = 1;
@@ -336,6 +346,133 @@ int nchan_parse_message_buffer_config(ngx_http_request_t *r, nchan_loc_conf_t *c
   return 1;
 }
 
+static ngx_int_t group_handler_callback(ngx_int_t status, nchan_group_t *group, ngx_http_request_t *r) {
+  nchan_request_ctx_t    *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  
+  if(!group) {
+    group = ngx_pcalloc(r->pool, sizeof(*group));
+  }
+  
+  if(!ctx->request_ran_content_handler) {
+    r->main->count--;
+    nchan_group_info(r, group);
+  }
+  else {
+    nchan_http_finalize_request(r, nchan_group_info(r, group));
+  }
+  
+  
+  
+  return NGX_OK;
+}
+
+
+static ngx_int_t parse_size_limit(u_char *data, size_t len) {
+  ngx_str_t  str;
+  str.data = data;
+  str.len = len;
+  return nchan_parse_size(&str);
+}
+
+static ngx_int_t set_group_num_limit(ngx_http_request_t *r, ngx_http_complex_value_t *cv, ngx_atomic_int_t *dst, ngx_int_t (*parsefunc)(u_char *, size_t), char *errstr) {
+  ngx_str_t               tmp;
+  ngx_int_t               num;
+  if(cv) {
+    ngx_http_complex_value(r, cv, &tmp);
+    if(tmp.len == 0) {
+      *dst = -1;
+      return 1;
+    }
+    else if((num = parsefunc(tmp.data, tmp.len)) == NGX_ERROR || num < 0) {
+      nchan_respond_cstring(r, NGX_HTTP_FORBIDDEN, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, errstr, 0);
+      return 0;
+    }
+    *dst = num;
+  }
+  else {
+    *dst = -1;
+  }
+  return 1;
+}
+
+static ngx_int_t parse_group_limits(ngx_http_request_t *r, nchan_loc_conf_t *cf, nchan_group_limits_t *limits) {
+  set_group_num_limit(r, cf->group.max_channels, &limits->channels, ngx_atoi, "invalid nchan_group_max_channels value");
+  set_group_num_limit(r, cf->group.max_subscribers, &limits->subscribers, ngx_atoi, "invalid nchan_group_max_subscribers value");
+  set_group_num_limit(r, cf->group.max_messages, &limits->messages, ngx_atoi, "invalid nchan_group_max_messages value");
+  set_group_num_limit(r, cf->group.max_messages_shm_bytes, &limits->messages_shmem_bytes, parse_size_limit, "invalid nchan_group_max_messages_memory value");
+  set_group_num_limit(r, cf->group.max_messages_file_bytes, &limits->messages_file_bytes, parse_size_limit, "invalid nchan_group_max_messages_disk value");
+  
+  return r->headers_out.status != NGX_HTTP_FORBIDDEN ? NGX_OK : NGX_ERROR;
+}
+
+ngx_int_t nchan_group_handler(ngx_http_request_t *r) {
+  nchan_loc_conf_t       *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
+  nchan_request_ctx_t    *ctx;
+  ngx_int_t               rc = NGX_DONE;
+  ngx_str_t              *group;
+  
+  if((ctx = ngx_pcalloc(r->pool, sizeof(nchan_request_ctx_t))) == NULL) {
+    return NGX_HTTP_INTERNAL_SERVER_ERROR;
+  }
+  ngx_http_set_ctx(r, ctx, ngx_nchan_module);
+  
+  if(r->connection && (r->connection->read->eof || r->connection->read->pending_eof)) {
+    ngx_http_finalize_request(r, NGX_HTTP_CLIENT_CLOSED_REQUEST);
+    return NGX_ERROR;
+  }
+  
+  if(!cf->group.enable_accounting) {
+    nchan_respond_cstring(r, NGX_HTTP_FORBIDDEN, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, "Channel group accounting is disabled.", 0);
+    return NGX_OK;
+  }
+  
+  group = nchan_get_group_name(r, cf, ctx);
+  if(group == NULL) {
+    nchan_respond_cstring(r, NGX_HTTP_BAD_REQUEST, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, "No group specified", 0);
+    return NGX_OK;
+  }
+  
+  switch(r->method) {
+    case NGX_HTTP_GET:
+      if(!cf->group.get) {
+        rc = nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, NULL, 0);
+      }
+      r->main->count++;
+      cf->storage_engine->get_group(group, cf, (callback_pt )group_handler_callback, r);
+      
+      break;
+      
+    case NGX_HTTP_POST:
+      if(!cf->group.set) {
+        rc = nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, NULL, 0);
+      }
+      
+      nchan_group_limits_t     limits;
+      
+      if(parse_group_limits(r, cf, &limits) != NGX_OK) {
+        return NGX_OK;
+      }
+      
+      r->main->count++;
+      cf->storage_engine->set_group_limits(group, cf, &limits, (callback_pt )group_handler_callback, r);
+      break;
+      
+    case NGX_HTTP_DELETE:
+      if(!cf->group.delete) {
+        rc = nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, NULL, 0);
+      }
+      r->main->count++;
+      cf->storage_engine->delete_group(group, cf, (callback_pt )group_handler_callback, r);
+      break;
+      
+    case NGX_HTTP_OPTIONS:
+        rc= nchan_OPTIONS_respond(r, &NCHAN_ACCESS_CONTROL_ALLOWED_GROUP_HEADERS, &NCHAN_ALLOW_GET_POST_DELETE);
+      break;
+  }
+  ctx->request_ran_content_handler = 1;
+  return rc;
+}
+
 ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
   nchan_loc_conf_t       *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
   ngx_str_t              *channel_id;
@@ -343,47 +480,55 @@ ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
   nchan_msg_id_t         *msg_id;
   ngx_int_t               rc = NGX_DONE;
   nchan_request_ctx_t    *ctx;
-  ngx_str_t              *origin_header;
+  nchan_group_limits_t    group_limits;
   
-#if NCHAN_BENCHMARK
-  struct timeval          tv;
-  ngx_gettimeofday(&tv);
-#endif
+  if(r->connection && (r->connection->read->eof || r->connection->read->pending_eof)) {
+    ngx_http_finalize_request(r, NGX_HTTP_CLIENT_CLOSED_REQUEST);
+    return NGX_ERROR;
+  }  
   
   if((ctx = ngx_pcalloc(r->pool, sizeof(nchan_request_ctx_t))) == NULL) {
     return NGX_HTTP_INTERNAL_SERVER_ERROR;
   }
   ngx_http_set_ctx(r, ctx, ngx_nchan_module);
 
-#if NCHAN_BENCHMARK
-  ctx->start_tv = tv;
-#endif
-  
   //X-Accel-Redirected requests get their method mangled to GET. De-mangle it if necessary
   if(r->upstream && r->upstream->headers_in.x_accel_redirect) {
     //yep, we got x-accel-redirected. what was the original method?...
     nchan_recover_x_accel_redirected_request_method(r);
   }
   
-  if((origin_header = nchan_get_header_value(r, NCHAN_HEADER_ORIGIN)) != NULL) {
-    ctx->request_origin_header = *origin_header;
-    if(!(cf->allow_origin.len == 1 && cf->allow_origin.data[0] == '*')) {
-      if(!(origin_header->len == cf->allow_origin.len && ngx_strnstr(origin_header->data, (char *)cf->allow_origin.data, origin_header->len) != NULL)) {
-        //CORS origin match failed! return a 403 forbidden
-        goto forbidden;
-      }
-    }
+  if(!nchan_match_origin_header(r, cf, ctx)) {
+    goto forbidden;
+  }
+  
+  if((msg_id = nchan_subscriber_get_msg_id(r)) == NULL) {
+    goto bad_msgid;
+  }
+  
+  if(parse_group_limits(r, cf, &group_limits) == NGX_OK) {
+    // unless the group already exists, these limits may only be set after this incoming request.
+    // TODO: fix this, although that will lead to even gnarlier control flow.
+    cf->storage_engine->set_group_limits(nchan_get_group_name(r, cf, ctx), cf, &group_limits, NULL, NULL);
   }
   else {
-    ctx->request_origin_header.len=0;
-    ctx->request_origin_header.data=NULL;
+    // there waas an error parsing group limit strings, and it has already been sent in the response. 
+    // just quit.
+    return NGX_OK;
   }
   
-  if((channel_id = nchan_get_channel_id(r, SUB, 1)) == NULL) {
-    //just get the subscriber_channel_id for now. the publisher one is handled elsewhere
-    return r->headers_out.status ? NGX_OK : NGX_HTTP_INTERNAL_SERVER_ERROR;
+  if(cf->redis.enabled && !nchan_store_redis_ready(cf)) {
+    //using redis, and it's not ready yet
+    if(r->method == NGX_HTTP_POST || r->method == NGX_HTTP_PUT) {
+      //discard request body before responding
+      nchan_http_publisher_handler(r, nchan_publisher_unavailable_body_handler);
+    }
+    else {
+      nchan_respond_status(r, NGX_HTTP_SERVICE_UNAVAILABLE, NULL, NULL, 0);
+    }
+    return NGX_OK;
   }
-
+  
   if(cf->pub.websocket || cf->pub.http) {
     char *err;
     if(!nchan_parse_message_buffer_config(r, cf, &err)) {
@@ -392,7 +537,7 @@ ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
         return NGX_OK;
       }
       else {
-        nchan_respond_status(r, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, 0);
+        nchan_respond_status(r, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL, 0);
         return NGX_OK;
       }
     }
@@ -402,6 +547,10 @@ ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
     //want websocket?
     if(cf->sub.websocket) {
       //we prefer to subscribe
+      if((channel_id = nchan_get_channel_id(r, SUB, 1)) == NULL) {
+        return r->headers_out.status ? NGX_OK : NGX_HTTP_INTERNAL_SERVER_ERROR;
+      }
+      
 #if FAKESHARD
       memstore_sub_debug_start();
 #endif
@@ -412,7 +561,9 @@ ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
         nchan_log_request_error(r, "unable to create websocket subscriber");
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
       }
-      sub->fn->subscribe(sub, channel_id);
+      if(sub->fn->subscribe(sub, channel_id) != NGX_OK) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+      }
 #if FAKESHARD      
       memstore_sub_debug_end();
 #endif
@@ -448,25 +599,31 @@ ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
           sub_create = longpoll_subscriber_create;
         }
         else if(cf->pub.http) {
-          nchan_http_publisher_handler(r);
+          nchan_http_publisher_handler(r, nchan_publisher_body_handler);
         }
         else {
           goto forbidden;
         }
         
         if(sub_create) {
+          if((channel_id = nchan_get_channel_id(r, SUB, 1)) == NULL) {
+            return r->headers_out.status ? NGX_OK : NGX_HTTP_INTERNAL_SERVER_ERROR;
+          }
 #if FAKESHARD
           memstore_sub_debug_start();
 #endif
           if((msg_id = nchan_subscriber_get_msg_id(r)) == NULL) {
             goto bad_msgid;
           }
+          
           if((sub = sub_create(r, msg_id)) == NULL) {
             nchan_log_request_error(r, "unable to create subscriber");
             return NGX_HTTP_INTERNAL_SERVER_ERROR;
           }
           
-          sub->fn->subscribe(sub, channel_id);
+          if(sub->fn->subscribe(sub, channel_id) != NGX_OK) {
+            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+          }
 #if FAKESHARD
           memstore_sub_debug_end();
 #endif
@@ -477,24 +634,27 @@ ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
       case NGX_HTTP_POST:
       case NGX_HTTP_PUT:
         if(cf->pub.http) {
-          nchan_http_publisher_handler(r);
+          nchan_http_publisher_handler(r, nchan_publisher_body_handler);
         }
         else goto forbidden;
         break;
       
       case NGX_HTTP_DELETE:
         if(cf->pub.http) {
-          nchan_http_publisher_handler(r);
+          nchan_http_publisher_handler(r, nchan_publisher_body_handler);
         }
         else goto forbidden;
         break;
       
       case NGX_HTTP_OPTIONS:
-        if(cf->pub.http) {
-          nchan_OPTIONS_respond(r, &cf->allow_origin, &NCHAN_ACCESS_CONTROL_ALLOWED_PUBLISHER_HEADERS, &NCHAN_ALLOW_GET_POST_PUT_DELETE);
+        if(cf->pub.http && (cf->sub.poll || cf->sub.longpoll || cf->sub.eventsource || cf->sub.websocket)) {
+          nchan_OPTIONS_respond(r, &NCHAN_ACCESS_CONTROL_ALLOWED_PUBSUB_HEADERS, &NCHAN_ALLOW_GET_POST_PUT_DELETE);
+        }
+        else if(cf->pub.http) {
+          nchan_OPTIONS_respond(r, &NCHAN_ACCESS_CONTROL_ALLOWED_PUBLISHER_HEADERS, &NCHAN_ALLOW_GET_POST_PUT_DELETE);
         }
         else if(cf->sub.poll || cf->sub.longpoll || cf->sub.eventsource || cf->sub.websocket) {
-          nchan_OPTIONS_respond(r, &cf->allow_origin, &NCHAN_ACCESS_CONTROL_ALLOWED_SUBSCRIBER_HEADERS, &NCHAN_ALLOW_GET);
+          nchan_OPTIONS_respond(r, &NCHAN_ACCESS_CONTROL_ALLOWED_SUBSCRIBER_HEADERS, &NCHAN_ALLOW_GET);
         }
         else goto forbidden;
         break;
@@ -504,7 +664,7 @@ ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r) {
   return rc;
   
 forbidden:
-  nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, 0);
+  nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, NULL, 0);
   ctx->request_ran_content_handler = 1;
   return NGX_OK;
 
@@ -520,7 +680,12 @@ static ngx_int_t channel_info_callback(ngx_int_t status, void *rptr, void *pd) {
   if(r == NULL) {
     return NGX_ERROR;
   }
-  nchan_http_finalize_request(r, nchan_response_channel_ptr_info( (nchan_channel_t *)rptr, r, 0));
+  if(status>=500 && status <= 599) {
+    nchan_http_finalize_request(r, status);
+  }
+  else {
+    nchan_http_finalize_request(r, nchan_response_channel_ptr_info( (nchan_channel_t *)rptr, r, 0));
+  }
   return NGX_OK;
 }
 
@@ -567,9 +732,10 @@ static ngx_http_request_t *nchan_get_safe_request_ptr(safe_request_ptr_t *d) {
 }
 
 
-static ngx_int_t publish_callback(ngx_int_t status, nchan_channel_t *ch, safe_request_ptr_t *pd) {
+static ngx_int_t publish_callback(ngx_int_t status, void *data, safe_request_ptr_t *pd) {
   nchan_request_ctx_t   *ctx;
   static nchan_msg_id_t  empty_msgid = NCHAN_ZERO_MSGID;
+  nchan_channel_t       *ch = data;
   
   ngx_http_request_t    *r = nchan_get_safe_request_ptr(pd);
   
@@ -599,19 +765,34 @@ static ngx_int_t publish_callback(ngx_int_t status, nchan_channel_t *ch, safe_re
       return NGX_OK;
       
     case NGX_ERROR:
+      status = NGX_HTTP_INTERNAL_SERVER_ERROR;
+      /*fallthrough*/
+    case NGX_HTTP_INSUFFICIENT_STORAGE:
     case NGX_HTTP_INTERNAL_SERVER_ERROR:
+    case NGX_HTTP_SERVICE_UNAVAILABLE:
       //WTF?
-      nchan_log_request_error(r, "error publishing message");
-      ctx->prev_msg_id = empty_msgid;;
+      nchan_log_request_error(r, "error publishing message (HTTP status code %i)", status);
+      ctx->prev_msg_id = empty_msgid;
       ctx->msg_id = empty_msgid;
-      nchan_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+      nchan_http_finalize_request(r, status);
       return NGX_ERROR;
       
+    case NGX_HTTP_FORBIDDEN:
+      ctx->prev_msg_id = empty_msgid;
+      ctx->msg_id = empty_msgid;
+      if(data) {
+        nchan_respond_cstring(r, NGX_HTTP_FORBIDDEN, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, (char *)data, 1);
+      }
+      else {
+        nchan_http_finalize_request(r, NGX_HTTP_FORBIDDEN);
+      }
+      return NGX_OK;
+      
     default:
       //for debugging, mostly. I don't expect this branch to behit during regular operation
       ctx->prev_msg_id = empty_msgid;;
       ctx->msg_id = empty_msgid;
-      nchan_log_request_error(r, "TOTALLY UNEXPECTED error publishing message, status code %i", status);
+      nchan_log_request_error(r, "TOTALLY UNEXPECTED error publishing message (HTTP status code %i)", status);
       nchan_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
       return NGX_ERROR;
   }
@@ -619,7 +800,6 @@ static ngx_int_t publish_callback(ngx_int_t status, nchan_channel_t *ch, safe_re
 
 static void nchan_publisher_post_request(ngx_http_request_t *r, ngx_str_t *content_type, size_t content_length, ngx_chain_t *request_body_chain, ngx_str_t *channel_id, nchan_loc_conf_t *cf) {
   ngx_buf_t                      *buf;
-  struct timeval                  tv;
   nchan_msg_t                    *msg;
   ngx_str_t                      *eventsource_event;
   
@@ -633,19 +813,19 @@ static void nchan_publisher_post_request(ngx_http_request_t *r, ngx_str_t *conte
     nchan_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
     return; 
   }
-  msg->shared = 0;
+  msg->storage = NCHAN_MSG_POOL;
   
   
   if(cf->eventsource_event.len > 0) {
-    msg->eventsource_event = cf->eventsource_event;
+    msg->eventsource_event = &cf->eventsource_event;
   }
   else if((eventsource_event = nchan_get_header_value(r, NCHAN_HEADER_EVENTSOURCE_EVENT)) != NULL) {
-    msg->eventsource_event = *eventsource_event;
+    msg->eventsource_event = eventsource_event;
   }
   
   //content type
   if(content_type) {
-    msg->content_type = *content_type;
+    msg->content_type = content_type;
   }
   
   if(content_length == 0) {
@@ -660,22 +840,16 @@ static void nchan_publisher_post_request(ngx_http_request_t *r, ngx_str_t *conte
     return;
   }
   
-  ngx_gettimeofday(&tv);
-  msg->id.time = tv.tv_sec;
+  msg->id.time = 0;
   msg->id.tag.fixed[0] = 0;
   msg->id.tagactive = 0;
   msg->id.tagcount = 1;
   
-  msg->buf = buf;
+  msg->buf = *buf;
 #if NCHAN_MSG_LEAK_DEBUG
   msg->lbl = r->uri;
 #endif
-#if NCHAN_BENCHMARK
-  nchan_request_ctx_t            *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
-  msg->start_tv = ctx->start_tv;
-#endif
-  
-  
+  nchan_deflate_message_if_needed(msg, cf, r, r->pool);
   if((pd = nchan_set_safe_request_ptr(r)) == NULL) {
     return;
   }
@@ -715,7 +889,11 @@ static ngx_int_t nchan_publisher_upstream_handler(ngx_http_request_t *sr, void *
         if(sr->upstream) {
           content_type = (sr->upstream->headers_in.content_type ? &sr->upstream->headers_in.content_type->value : NULL);
           content_length = nchan_subrequest_content_length(sr);
+#if nginx_version >= 1013010
+          request_chain = sr->out;
+#else
           request_chain = sr->upstream->out_bufs;
+#endif
         }
         else {
           content_type = NULL;
@@ -793,7 +971,8 @@ static void nchan_publisher_body_handler_continued(ngx_http_request_t *r, ngx_st
         psrd->ch_id = channel_id;
         
         ngx_http_subrequest(r, &publisher_upstream_request_url, NULL, &sr, psr, NGX_HTTP_SUBREQUEST_IN_MEMORY);
-        nchan_adjust_subrequest(sr, NGX_HTTP_POST, &POST_REQUEST_STRING, r->request_body, r->headers_in.content_length_n, NULL);
+        nchan_adjust_subrequest(sr, NGX_HTTP_POST, &POST_REQUEST_STRING, r->request_body, r->headers_in.content_length_n);
+        sr->args = r->args;
       }
       break;
       
@@ -806,7 +985,7 @@ static void nchan_publisher_body_handler_continued(ngx_http_request_t *r, ngx_st
       break;
       
     default: 
-      nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, 0);
+      nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, NULL, 0);
   }
   
 }
@@ -841,6 +1020,11 @@ static ngx_int_t nchan_publisher_body_authorize_handler(ngx_http_request_t *r, v
   return NGX_OK;
 }
 
+static void nchan_publisher_unavailable_body_handler(ngx_http_request_t *r) {
+  nchan_http_finalize_request(r, NGX_HTTP_SERVICE_UNAVAILABLE);
+  return;
+}
+
 static void nchan_publisher_body_handler(ngx_http_request_t *r) {
   ngx_str_t                      *channel_id;
   nchan_loc_conf_t               *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
@@ -902,72 +1086,22 @@ static void nchan_publisher_body_handler(ngx_http_request_t *r) {
   }
 }
 
-#if NCHAN_BENCHMARK
-int nchan_timeval_subtract(struct timeval *result, struct timeval *x, struct timeval *y) {
-  /* Perform the carry for the later subtraction by updating y. */
-  if (x->tv_usec < y->tv_usec) {
-    int nsec = (y->tv_usec - x->tv_usec) / 1000000 + 1;
-    y->tv_usec -= 1000000 * nsec;
-    y->tv_sec += nsec;
-  }
-  if (x->tv_usec - y->tv_usec > 1000000) {
-    int nsec = (x->tv_usec - y->tv_usec) / 1000000;
-    y->tv_usec += 1000000 * nsec;
-    y->tv_sec -= nsec;
-  }
-
-  /* Compute the time remaining to wait.
-     tv_usec is certainly positive. */
-  result->tv_sec = x->tv_sec - y->tv_sec;
-  result->tv_usec = x->tv_usec - y->tv_usec;
-
-  /* Return 1 if result is negative. */
-  return x->tv_sec < y->tv_sec;
-}
-#endif
-
-
-#if NCHAN_SUBSCRIBER_LEAK_DEBUG
-
-subscriber_t *subdebug_head = NULL;
-
-void subscriber_debug_add(subscriber_t *sub) {
-  if(subdebug_head == NULL) {
-    sub->dbg_next = NULL;
-    sub->dbg_prev = NULL;
-  }
-  else {
-    sub->dbg_next = subdebug_head;
-    sub->dbg_prev = NULL;
-    assert(subdebug_head->dbg_prev == NULL);
-    subdebug_head->dbg_prev = sub;
-  }
-  subdebug_head = sub;
-}
-void subscriber_debug_remove(subscriber_t *sub) {
-  subscriber_t *prev, *next;
-  prev = sub->dbg_prev;
-  next = sub->dbg_next;
-  if(subdebug_head == sub) {
-    assert(sub->dbg_prev == NULL);
-    if(next) {
-      next->dbg_prev = NULL;
-    }
-    subdebug_head = next;
+ngx_int_t nchan_benchmark_handler(ngx_http_request_t *r) {
+  nchan_request_ctx_t    *ctx;
+  
+  if(r->connection && (r->connection->read->eof || r->connection->read->pending_eof)) {
+    return NGX_HTTP_INTERNAL_SERVER_ERROR;
   }
-  else {
-    if(prev) {
-      prev->dbg_next = next;
-    }
-    if(next) {
-      next->dbg_prev = prev;
-    }
+  if((ctx = ngx_pcalloc(r->pool, sizeof(nchan_request_ctx_t))) == NULL) {
+    return NGX_HTTP_INTERNAL_SERVER_ERROR;
   }
+  ngx_http_set_ctx(r, ctx, ngx_nchan_module);
   
-  sub->dbg_next = NULL;
-  sub->dbg_prev = NULL;
-}
-void subscriber_debug_assert_isempty(void) {
-  assert(subdebug_head == NULL);
+  return nchan_benchmark_ws_initialize(r);
+  
+  /*
+  ctx->bcp = ngx_palloc(r->pool, sizeof(nchan_bufchain_pool_t));
+  nchan_bufchain_pool_init(ctx->bcp, r->pool);
+  return nchan_benchmark_initialize(r);
+  */
 }
-#endif
diff --git a/debian/modules/nchan/src/nchan_module.h b/debian/modules/nchan/src/nchan_module.h
index 8c1aafbe..b337e54e 100644
--- a/debian/modules/nchan/src/nchan_module.h
+++ b/debian/modules/nchan/src/nchan_module.h
@@ -3,17 +3,17 @@
 //#define NCHAN_SUBSCRIBER_LEAK_DEBUG 1
 //#define NCHAN_MSG_RESERVE_DEBUG 1
 //#define NCHAN_MSG_LEAK_DEBUG 1
-//#define NCHAN_BENCHMARK 1
 
 //debugging config
 //#define FAKESHARD 1
+//#define FAKE_SHMEM 1
 #if FAKESHARD
 //#define PUB_FAKE_WORKER 0
 //#define SUB_FAKE_WORKER 1
 //#define ONE_FAKE_CHANNEL_OWNER 2
 #define MAX_FAKE_WORKERS 5
 #endif
-
+#include <nchan_version.h>
 #include <ngx_http.h>
 
 //building for old versions
@@ -30,9 +30,10 @@
 #include <nchan_defs.h>
 #include <util/nchan_util.h>
 #include <util/nchan_channel_id.h>
-#include <util/nchan_channel_info.h>
-#include <util/nchan_msgid.h>
+#include <util/nchan_output_info.h>
+#include <util/nchan_msg.h>
 #include <util/nchan_output.h>
+#include <util/nchan_debug.h>
 
 extern ngx_pool_t *nchan_pool;
 extern ngx_int_t nchan_worker_processes;
@@ -43,7 +44,8 @@ extern int nchan_stub_status_enabled;
 
 ngx_int_t nchan_stub_status_handler(ngx_http_request_t *r);
 ngx_int_t nchan_pubsub_handler(ngx_http_request_t *r);
-ngx_buf_t *nchan_channel_info_buf(ngx_str_t *accept_header, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *last_msgid, ngx_str_t **generated_content_type);
+ngx_int_t nchan_group_handler(ngx_http_request_t *r);
+ngx_int_t nchan_benchmark_handler(ngx_http_request_t *r);
 
 time_t nchan_loc_conf_message_timeout(nchan_loc_conf_t *cf);
 ngx_int_t nchan_loc_conf_max_messages(nchan_loc_conf_t *cf);
@@ -55,23 +57,13 @@ void __memstore_update_stub_status(off_t offset, int count);
 nchan_stub_status_t *nchan_get_stub_status_stats(void);
 size_t nchan_get_used_shmem(void);
 
-#if NCHAN_SUBSCRIBER_LEAK_DEBUG
-void subscriber_debug_add(subscriber_t *);
-void subscriber_debug_remove(subscriber_t *);
-void subscriber_debug_assert_isempty(void);
-#endif
-
-#if NCHAN_BENCHMARK
-int nchan_timeval_subtract(struct timeval *result, struct timeval *x, struct timeval *y);
-#endif
-
-#define nchan_log_notice(fmt, args...)  ngx_log_error(NGX_LOG_NOTICE, ngx_cycle->log, 0, "nchan: " fmt, ##args)
-#define nchan_log_warning(fmt, args...) ngx_log_error(NGX_LOG_WARN,   ngx_cycle->log, 0, "nchan: " fmt, ##args)
-#define nchan_log_error(fmt, args...)   ngx_log_error(NGX_LOG_ERR,    ngx_cycle->log, 0, "nchan: " fmt, ##args)
-#define nchan_log_request_warning(request, fmt, args...) ngx_log_error(NGX_LOG_WARN, (request)->connection->log, 0, "nchan: " fmt, ##args)
-#define nchan_log_request_error(request, fmt, args...)    ngx_log_error(NGX_LOG_ERR, (request)->connection->log, 0, "nchan: " fmt, ##args)
-
 #define nchan_log(level, log, errno, fmt, args...) ngx_log_error(level, log, errno, "nchan: " fmt, ##args)
+#define nchan_log_notice(fmt, args...) nchan_log(NGX_LOG_NOTICE, ngx_cycle->log, 0, fmt, ##args)
+#define nchan_log_warning(fmt, args...) nchan_log(NGX_LOG_WARN, ngx_cycle->log, 0, fmt, ##args)
+#define nchan_log_error(fmt, args...) nchan_log(NGX_LOG_ERR, ngx_cycle->log, 0, fmt, ##args)
+#define nchan_log_ooshm_error(fmt, args...) nchan_log(NGX_LOG_ERR, ngx_cycle->log, 0, "Out of shared memory while " fmt ". Increase nchan_max_reserved_memory.", ##args)
 
+#define nchan_log_request_warning(request, fmt, args...) ngx_log_error(NGX_LOG_WARN, (request)->connection->log, 0, "nchan: " fmt, ##args)
+#define nchan_log_request_error(request, fmt, args...)    ngx_log_error(NGX_LOG_ERR, ((request) ? (request)->connection->log : ngx_cycle->log), 0, "nchan: " fmt, ##args)
 
 #endif /*NCHAN_MODULE_H*/
diff --git a/debian/modules/nchan/src/nchan_setup.c b/debian/modules/nchan/src/nchan_setup.c
index e083e31c..8d416a0c 100644
--- a/debian/modules/nchan/src/nchan_setup.c
+++ b/debian/modules/nchan/src/nchan_setup.c
@@ -4,20 +4,46 @@
 #include <nchan_variables.h>
 #include <store/memory/store.h>
 #include <store/redis/store.h>
+#if (NGX_ZLIB)
+#include <zlib.h>
+#endif
 
 static ngx_str_t      DEFAULT_CHANNEL_EVENT_STRING = ngx_string("$nchan_channel_event $nchan_channel_id");
 
 nchan_store_t   *default_storage_engine = &nchan_store_memory;
+ngx_flag_t       global_nchan_enabled = 0;
 ngx_flag_t       global_redis_enabled = 0;
+ngx_flag_t       global_zstream_needed = 0;
+ngx_flag_t       global_benchmark_enabled = 0;
+void            *global_owner_cycle = NULL;
+
+#define MERGE_UNSET_CONF(conf, prev, unset, default)         \
+if (conf == unset) {                                         \
+  conf = (prev == unset) ? default : prev;                   \
+}
 
 #define MERGE_CONF(cf, prev_cf, name) if((cf)->name == NULL) { (cf)->name = (prev_cf)->name; }
 
 static ngx_int_t nchan_init_module(ngx_cycle_t *cycle) {
-  ngx_core_conf_t                *ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);
+  if(global_owner_cycle && global_owner_cycle != ngx_cycle) {
+    global_nchan_enabled = 0;
+    global_redis_enabled = 0;
+    global_zstream_needed = 0;
+    global_benchmark_enabled = 0;
+  }
+  global_owner_cycle = (void *)ngx_cycle;
+  
+  if(!global_nchan_enabled) {
+    return NGX_OK;
+  }
+  ngx_core_conf_t         *ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);
   nchan_worker_processes = ccf->worker_processes;
   
   //initialize storage engines
   nchan_store_memory.init_module(cycle);
+  if(global_benchmark_enabled) {
+    nchan_benchmark_init_module(cycle);
+  }
   if(global_redis_enabled) {
     nchan_store_redis.init_module(cycle);
   }
@@ -25,6 +51,9 @@ static ngx_int_t nchan_init_module(ngx_cycle_t *cycle) {
 }
 
 static ngx_int_t nchan_init_worker(ngx_cycle_t *cycle) {
+  if(!global_nchan_enabled) {
+    return NGX_OK;
+  }
   if (ngx_process != NGX_PROCESS_WORKER && ngx_process != NGX_PROCESS_SINGLE) {
     //not a worker, stop initializing stuff.
     return NGX_OK;
@@ -33,6 +62,9 @@ static ngx_int_t nchan_init_worker(ngx_cycle_t *cycle) {
   if(nchan_store_memory.init_worker(cycle)!=NGX_OK) {
     return NGX_ERROR;
   }
+  if(global_benchmark_enabled) {
+    nchan_benchmark_init_worker(cycle);
+  }
   
   if(global_redis_enabled && nchan_store_redis.init_worker(cycle)!=NGX_OK) {
     return NGX_ERROR;
@@ -44,13 +76,30 @@ static ngx_int_t nchan_init_worker(ngx_cycle_t *cycle) {
   return NGX_OK;
 }
 
+static ngx_int_t nchan_preconfig(ngx_conf_t *cf) {
+  global_owner_cycle = (void *)ngx_cycle;
+  global_nchan_enabled = 0;
+  return nchan_add_variables(cf);
+}
+
 static ngx_int_t nchan_postconfig(ngx_conf_t *cf) {
+  global_owner_cycle = (void *)ngx_cycle;
   if(nchan_store_memory.init_postconfig(cf)!=NGX_OK) {
     return NGX_ERROR;
   }
   if(global_redis_enabled && nchan_store_redis.init_postconfig(cf)!=NGX_OK) {
     return NGX_ERROR;
   }
+  
+#if (NGX_ZLIB)
+  if(global_zstream_needed) {
+    nchan_main_conf_t  *mcf = ngx_http_conf_get_module_main_conf(cf, ngx_nchan_module);
+    nchan_common_deflate_init(mcf);
+  }
+#endif
+  
+  global_nchan_enabled = 1;
+  
   return NGX_OK;
 }
 
@@ -60,12 +109,45 @@ static void * nchan_create_main_conf(ngx_conf_t *cf) {
   if(mcf == NULL) {
     return NGX_CONF_ERROR;
   }
+  
+  static ngx_path_init_t nchan_temp_path = { ngx_string(NGX_HTTP_CLIENT_TEMP_PATH), { 0, 0, 0 } };
+  ngx_conf_merge_path_value(cf, &mcf->message_temp_path, NULL, &nchan_temp_path);
+  
   nchan_store_memory.create_main_conf(cf, mcf);
   nchan_store_redis.create_main_conf(cf, mcf);
   
+#if (NGX_ZLIB)
+  mcf->zlib_params.level = Z_DEFAULT_COMPRESSION;
+  mcf->zlib_params.windowBits = 10;
+  mcf->zlib_params.memLevel = 8;
+  mcf->zlib_params.strategy = Z_DEFAULT_STRATEGY;
+#endif
+  
   return mcf;
 }
 
+static void *nchan_create_srv_conf(ngx_conf_t *cf) {
+  nchan_srv_conf_t       *scf = ngx_pcalloc(cf->pool, sizeof(*scf));
+  if(scf == NULL) {
+    return NGX_CONF_ERROR;
+  }
+  scf->redis.connect_timeout = NGX_CONF_UNSET_MSEC;
+  scf->redis.optimize_target = NCHAN_REDIS_OPTIMIZE_UNSET;
+  scf->redis.master_weight = NGX_CONF_UNSET;
+  scf->redis.slave_weight = NGX_CONF_UNSET;
+  scf->upstream_nchan_loc_conf = NULL;
+  return scf;
+}
+
+static char *nchan_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) {
+  nchan_srv_conf_t       *prev = parent, *conf = child;
+  ngx_conf_merge_msec_value(conf->redis.connect_timeout, prev->redis.connect_timeout, NCHAN_DEFAULT_REDIS_NODE_CONNECT_TIMEOUT_MSEC);
+  MERGE_UNSET_CONF(conf->redis.optimize_target, prev->redis.optimize_target, NCHAN_REDIS_OPTIMIZE_UNSET, NCHAN_REDIS_OPTIMIZE_CPU);
+  ngx_conf_merge_value(conf->redis.master_weight, prev->redis.master_weight, 1);
+  ngx_conf_merge_value(conf->redis.slave_weight, prev->redis.slave_weight, 1);
+  return NGX_CONF_OK;
+}
+
 //location config stuff
 static void *nchan_create_loc_conf(ngx_conf_t *cf) {
   nchan_loc_conf_t       *lcf = ngx_pcalloc(cf->pool, sizeof(*lcf));
@@ -82,12 +164,16 @@ static void *nchan_create_loc_conf(ngx_conf_t *cf) {
   lcf->sub.websocket=0;
   lcf->sub.http_chunked=0;
   
+  // lcf->group is already zeroed
+  lcf->group.enable_accounting = NGX_CONF_UNSET;
+  
   lcf->shared_data_index=NGX_CONF_UNSET;
   
   lcf->authorize_request_url = NULL;
   lcf->publisher_upstream_request_url = NULL;
   lcf->unsubscribe_request_url = NULL;
   lcf->subscribe_request_url = NULL;
+  lcf->channel_group = NULL;
   
   lcf->message_timeout=NGX_CONF_UNSET;
   lcf->max_messages=NGX_CONF_UNSET;
@@ -107,11 +193,19 @@ static void *nchan_create_loc_conf(ngx_conf_t *cf) {
   
   lcf->websocket_ping_interval=NGX_CONF_UNSET;
   
+  lcf->eventsource_ping.interval=NGX_CONF_UNSET;
+  
   lcf->msg_in_etag_only = NGX_CONF_UNSET;
   
+  lcf->allow_origin = NULL;
+  lcf->allow_credentials = NGX_CONF_UNSET;
+  
   lcf->channel_events_channel_id = NULL;
   lcf->channel_event_string = NULL;
   
+  lcf->websocket_heartbeat.enabled=NGX_CONF_UNSET;
+  
+  lcf->message_compression = NCHAN_MSG_COMPRESSION_INVALID;
   
   lcf->longpoll_multimsg=NGX_CONF_UNSET;
   lcf->longpoll_multimsg_use_raw_stream_separator=NGX_CONF_UNSET;
@@ -125,7 +219,20 @@ static void *nchan_create_loc_conf(ngx_conf_t *cf) {
   lcf->redis.url_enabled=NGX_CONF_UNSET;
   lcf->redis.ping_interval = NGX_CONF_UNSET;
   lcf->redis.upstream_inheritable=NGX_CONF_UNSET;
-  
+  lcf->redis.storage_mode = REDIS_MODE_CONF_UNSET;
+  lcf->redis.nostore_fastpublish = NGX_CONF_UNSET;
+  lcf->redis.privdata = NULL;
+  lcf->redis.nodeset = NULL;
+  
+  lcf->request_handler = NULL;
+  
+  lcf->benchmark.time = NGX_CONF_UNSET;
+  lcf->benchmark.msgs_per_minute = NGX_CONF_UNSET;
+  lcf->benchmark.msg_padding = NGX_CONF_UNSET;
+  lcf->benchmark.channels = NGX_CONF_UNSET;
+  lcf->benchmark.subscribers_per_channel = NGX_CONF_UNSET;
+  lcf->benchmark.subscriber_distribution = NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_UNSET;
+  lcf->benchmark.publisher_distribution = NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_UNSET;
   return lcf;
 }
 
@@ -153,6 +260,36 @@ static char * create_complex_value_from_ngx_str(ngx_conf_t *cf, ngx_http_complex
   return NGX_CONF_OK;
 }
 
+static int is_pub_location(nchan_loc_conf_t *lcf) {
+  return lcf->pub.http || lcf->pub.websocket;
+}
+static int is_sub_location(nchan_loc_conf_t *lcf) {
+  nchan_conf_subscriber_types_t s = lcf->sub;
+  return s.poll || s.http_raw_stream || s.longpoll || s.http_chunked || s.http_multipart || s.eventsource || s.websocket;
+}
+static int is_group_location(nchan_loc_conf_t *lcf) {
+  return lcf->group.get || lcf->group.set || lcf->group.delete;
+}
+
+static int is_valid_location(ngx_conf_t *cf, nchan_loc_conf_t *lcf) {
+  
+  if(is_group_location(lcf)) {
+    if(is_pub_location(lcf) && is_sub_location(lcf)) {
+      ngx_conf_log_error(NGX_LOG_ERR, cf, 0, "Can't have a publisher and subscriber location and also be a group access location (nchan_group + nchan_publisher, nchan_subscriber or nchan_pubsub)");
+      return 0;
+    }
+    else if(is_pub_location(lcf)) {
+      ngx_conf_log_error(NGX_LOG_ERR, cf, 0, "Can't have a publisher location and also be a group access location (nchan_group + nchan_publisher)");
+      return 0;
+    }
+    else if(is_sub_location(lcf)) {
+      ngx_conf_log_error(NGX_LOG_ERR, cf, 0, "Can't have a subscriber location and also be a group access location (nchan_group + nchan_subscriber)");
+      return 0;
+    }
+  }
+  return 1;
+}
+
 static char *ngx_conf_set_redis_upstream(ngx_conf_t *cf, ngx_str_t *url, void *conf) {  
   ngx_url_t             upstream_url;
   nchan_loc_conf_t     *lcf = conf;
@@ -170,14 +307,43 @@ static char *ngx_conf_set_redis_upstream(ngx_conf_t *cf, ngx_str_t *url, void *c
   
   lcf->redis.enabled = 1;
   global_redis_enabled = 1;
-  nchan_store_redis_add_server_conf(cf, &lcf->redis, lcf);
+  nchan_store_redis_add_active_loc_conf(cf, lcf);
+  
+  return NGX_CONF_OK;
+}
+
+static char *nchan_setup_handler(ngx_conf_t *cf, ngx_int_t (*handler)(ngx_http_request_t *)) {
+  ngx_http_core_loc_conf_t       *clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module);
+  //nchan_loc_conf_t               *plcf = conf;
+  clcf->handler = handler;
+  clcf->if_modified_since = NGX_HTTP_IMS_OFF;
   
   return NGX_CONF_OK;
 }
 
+static nchan_loc_conf_t *nchan_loc_conf_get_upstream_lcf(nchan_loc_conf_t *conf, nchan_loc_conf_t *prev) {
+  nchan_redis_conf_t *rcf = &conf->redis, *prev_rcf = &prev->redis;
+  if(rcf->upstream == prev_rcf->upstream || rcf->upstream == NULL) {
+    //same or no upstream, so don't bother
+    return NULL;
+  }
+  else {
+    assert(rcf->upstream);
+    nchan_srv_conf_t      *upstream_scf = ngx_http_conf_upstream_srv_conf(rcf->upstream, ngx_nchan_module);
+    if(upstream_scf && upstream_scf->upstream_nchan_loc_conf) {
+      return upstream_scf->upstream_nchan_loc_conf;
+    }
+    else {
+      //ngx_conf_log_error(NGX_LOG_WARN, cf, 0, "nchan upstream srv_conf loc_conf ptr is null");
+      return NULL;
+    }
+  }
+}
+
+
 static char * nchan_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) {
   nchan_loc_conf_t       *prev = parent, *conf = child;
-  
+  nchan_loc_conf_t       *up = nchan_loc_conf_get_upstream_lcf(conf, prev);
   //publisher types
   ngx_conf_merge_bitmask_value(conf->pub.http, prev->pub.http, 0);
   ngx_conf_merge_bitmask_value(conf->pub.websocket, prev->pub.websocket, 0);
@@ -189,6 +355,20 @@ static char * nchan_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) {
   ngx_conf_merge_bitmask_value(conf->sub.http_chunked, prev->sub.http_chunked, 0);
   ngx_conf_merge_bitmask_value(conf->sub.websocket, prev->sub.websocket, 0);
   
+  //group request types
+  ngx_conf_merge_bitmask_value(conf->group.get, prev->group.get, 0);
+  ngx_conf_merge_bitmask_value(conf->group.set, prev->group.set, 0);
+  ngx_conf_merge_bitmask_value(conf->group.delete, prev->group.delete, 0);
+  
+  ngx_conf_merge_value(conf->group.enable_accounting, prev->group.enable_accounting, 0);
+  
+  //validate location
+  if(!is_valid_location(cf, conf)) {
+    return NGX_CONF_ERROR;
+  }
+  
+  MERGE_UNSET_CONF(conf->message_compression, prev->message_compression, NCHAN_MSG_COMPRESSION_INVALID, NCHAN_MSG_NO_COMPRESSION);
+  
   ngx_conf_merge_sec_value(conf->message_timeout, prev->message_timeout, NCHAN_DEFAULT_MESSAGE_TIMEOUT);
   ngx_conf_merge_value(conf->max_messages, prev->max_messages, NCHAN_DEFAULT_MAX_MESSAGES);
   
@@ -199,7 +379,12 @@ static char * nchan_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) {
     conf->subscriber_first_message = (prev->subscriber_first_message == NCHAN_SUBSCRIBER_FIRST_MESSAGE_UNSET) ? NCHAN_SUBSCRIBER_DEFAULT_FIRST_MESSAGE : prev->subscriber_first_message;
   }
   
-  ngx_conf_merge_sec_value(conf->websocket_ping_interval, prev->websocket_ping_interval, NCHAN_DEFAULT_WEBSOCKET_PING_INTERVAL);
+  ngx_conf_merge_sec_value(conf->websocket_ping_interval, prev->websocket_ping_interval, NCHAN_DEFAULT_SUBSCRIBER_PING_INTERVAL);
+  
+  ngx_conf_merge_sec_value(conf->eventsource_ping.interval, prev->eventsource_ping.interval, NCHAN_DEFAULT_SUBSCRIBER_PING_INTERVAL);
+  ngx_conf_merge_str_value(conf->eventsource_ping.data, prev->eventsource_ping.comment, "");
+  ngx_conf_merge_str_value(conf->eventsource_ping.event, prev->eventsource_ping.event, "ping");
+  ngx_conf_merge_str_value(conf->eventsource_ping.data, prev->eventsource_ping.data, "");
   
   ngx_conf_merge_sec_value(conf->subscriber_timeout, prev->subscriber_timeout, NCHAN_DEFAULT_SUBSCRIBER_TIMEOUT);
   ngx_conf_merge_sec_value(conf->redis_idle_channel_cache_timeout, prev->redis_idle_channel_cache_timeout, NCHAN_DEFAULT_REDIS_IDLE_CHANNEL_CACHE_TIMEOUT);
@@ -212,13 +397,18 @@ static char * nchan_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) {
   ngx_conf_merge_str_value(conf->subscriber_http_raw_stream_separator, prev->subscriber_http_raw_stream_separator, "\n");
   
   ngx_conf_merge_str_value(conf->channel_id_split_delimiter, prev->channel_id_split_delimiter, "");
-  ngx_conf_merge_str_value(conf->channel_group, prev->channel_group, "");
-  ngx_conf_merge_str_value(conf->allow_origin, prev->allow_origin, "*");
+  MERGE_CONF(conf, prev, allow_origin);
+  ngx_conf_merge_value(conf->allow_credentials, prev->allow_credentials, 1);
   ngx_conf_merge_str_value(conf->eventsource_event, prev->eventsource_event, "");
   ngx_conf_merge_str_value(conf->custom_msgtag_header, prev->custom_msgtag_header, "");
   ngx_conf_merge_value(conf->msg_in_etag_only, prev->msg_in_etag_only, 0);
   ngx_conf_merge_value(conf->longpoll_multimsg, prev->longpoll_multimsg, 0);
   ngx_conf_merge_value(conf->longpoll_multimsg_use_raw_stream_separator, prev->longpoll_multimsg_use_raw_stream_separator, 0);
+  
+  ngx_conf_merge_value(conf->websocket_heartbeat.enabled, prev->websocket_heartbeat.enabled, 0);
+  MERGE_CONF(conf, prev, websocket_heartbeat.in);
+  MERGE_CONF(conf, prev, websocket_heartbeat.out);
+  
   MERGE_CONF(conf, prev, channel_events_channel_id);
   MERGE_CONF(conf, prev, channel_event_string);
   
@@ -236,6 +426,13 @@ static char * nchan_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) {
   MERGE_CONF(conf, prev, publisher_upstream_request_url);
   MERGE_CONF(conf, prev, unsubscribe_request_url);
   MERGE_CONF(conf, prev, subscribe_request_url);
+  MERGE_CONF(conf, prev, channel_group);
+  
+  MERGE_CONF(conf, prev, group.max_channels);
+  MERGE_CONF(conf, prev, group.max_subscribers);
+  MERGE_CONF(conf, prev, group.max_messages);
+  MERGE_CONF(conf, prev, group.max_messages_shm_bytes);
+  MERGE_CONF(conf, prev, group.max_messages_file_bytes);
   
   if(conf->pub_chid.n == 0) {
     conf->pub_chid = prev->pub_chid;
@@ -261,30 +458,54 @@ static char * nchan_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) {
     }
     conf->last_message_id.n = 2;
   }
-  
+    
   ngx_conf_merge_value(conf->redis.url_enabled, prev->redis.url_enabled, 0);
+  
   ngx_conf_merge_value(conf->redis.upstream_inheritable, prev->redis.upstream_inheritable, 0);
   ngx_conf_merge_str_value(conf->redis.url, prev->redis.url, NCHAN_REDIS_DEFAULT_URL);
+  
+  if(up && up->redis.namespace.len > 0) { //upstream has a namespace set
+    ngx_conf_merge_str_value(conf->redis.namespace, up->redis.namespace, ""); 
+  }
+  else {
+    ngx_conf_merge_str_value(conf->redis.namespace, prev->redis.namespace, "");
+  }
+  
+  if(up)
+    ngx_conf_merge_value(conf->redis.ping_interval, up->redis.ping_interval, NGX_CONF_UNSET);
   ngx_conf_merge_value(conf->redis.ping_interval, prev->redis.ping_interval, NCHAN_REDIS_DEFAULT_PING_INTERVAL_TIME);
+  
+  if(up)
+    ngx_conf_merge_value(conf->redis.nostore_fastpublish, up->redis.nostore_fastpublish, NGX_CONF_UNSET);
+  ngx_conf_merge_value(conf->redis.nostore_fastpublish, prev->redis.nostore_fastpublish, 0);
+  
   if(conf->redis.url_enabled) {
     conf->redis.enabled = 1;
-    nchan_store_redis_add_server_conf(cf, &conf->redis, conf);
+    nchan_store_redis_add_active_loc_conf(cf, conf);
   }
   if(conf->redis.upstream_inheritable && !conf->redis.upstream && prev->redis.upstream && prev->redis.upstream_url.len > 0) {
     conf->redis.upstream_url = prev->redis.upstream_url;
     ngx_conf_set_redis_upstream(cf, &conf->redis.upstream_url, conf);
   }
   
-  return NGX_CONF_OK;
-}
-
- //channel id variable
-//publisher and subscriber handlers now.
-static char *nchan_setup_handler(ngx_conf_t *cf, void * conf, ngx_int_t (*handler)(ngx_http_request_t *)) {
-  ngx_http_core_loc_conf_t       *clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module);
-  //nchan_loc_conf_t               *plcf = conf;
-  clcf->handler = handler;
-  clcf->if_modified_since = NGX_HTTP_IMS_OFF;
+  if(up)
+    MERGE_UNSET_CONF(conf->redis.storage_mode, up->redis.storage_mode, REDIS_MODE_CONF_UNSET, REDIS_MODE_CONF_UNSET);
+  MERGE_UNSET_CONF(conf->redis.storage_mode, prev->redis.storage_mode, REDIS_MODE_CONF_UNSET, REDIS_MODE_DISTRIBUTED);
+  
+  if(prev->request_handler != NULL && conf->request_handler == NULL) {
+    conf->request_handler = prev->request_handler;
+  }
+  if(conf->request_handler != NULL) {
+    nchan_setup_handler(cf, conf->request_handler);
+  }
+  
+  ngx_conf_merge_value(conf->benchmark.time, prev->benchmark.time, 10);
+  ngx_conf_merge_value(conf->benchmark.msgs_per_minute, prev->benchmark.msgs_per_minute, 120);
+  ngx_conf_merge_value(conf->benchmark.msg_padding, prev->benchmark.msg_padding, 0);
+  ngx_conf_merge_value(conf->benchmark.channels, prev->benchmark.channels, 1000);
+  ngx_conf_merge_value(conf->benchmark.subscribers_per_channel, prev->benchmark.subscribers_per_channel, 100);
+  MERGE_UNSET_CONF(conf->benchmark.subscriber_distribution, prev->benchmark.subscriber_distribution, NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_UNSET, NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_RANDOM);
+  MERGE_UNSET_CONF(conf->benchmark.publisher_distribution, prev->benchmark.publisher_distribution, NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_UNSET, NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_RANDOM);
   
   return NGX_CONF_OK;
 }
@@ -332,12 +553,12 @@ static char *nchan_set_storage_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *
 #define DISABLED_STRINGS "none", "off", "disabled"
 #define DISABLED_STRINGS_N 3
 
-
 static char *nchan_publisher_directive_parse(ngx_conf_t *cf, ngx_command_t *cmd, void *conf, ngx_int_t fail) {
   nchan_loc_conf_t     *lcf = conf;
   ngx_str_t            *val;
   ngx_uint_t            i;
   
+  
   nchan_conf_publisher_types_t *pubt = &lcf->pub;
   
   if(cf->args->nelts == 1){ //no arguments
@@ -362,7 +583,11 @@ static char *nchan_publisher_directive_parse(ngx_conf_t *cf, ngx_command_t *cmd,
     }
   }
   
-  return nchan_setup_handler(cf, conf, &nchan_pubsub_handler);
+  if(!is_valid_location(cf, lcf)) {
+    return NGX_CONF_ERROR;
+  }
+  lcf->request_handler = &nchan_pubsub_handler;
+  return NGX_CONF_OK;
 }
 
 static char *nchan_publisher_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
@@ -425,7 +650,12 @@ static char *nchan_subscriber_directive_parse(ngx_conf_t *cf, ngx_command_t *cmd
       }
     }
   }
-  return nchan_setup_handler(cf, conf, &nchan_pubsub_handler);
+  
+  if(!is_valid_location(cf, lcf)) {
+    return NGX_CONF_ERROR;
+  }
+  lcf->request_handler = &nchan_pubsub_handler;
+  return NGX_CONF_OK;
 }
 
 static char *nchan_subscriber_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
@@ -435,18 +665,147 @@ static char *nchan_subscriber_directive(ngx_conf_t *cf, ngx_command_t *cmd, void
 static char *nchan_pubsub_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
   ngx_str_t            *val;
   ngx_uint_t            i;
+  nchan_loc_conf_t     *lcf = conf;
   nchan_publisher_directive_parse(cf, cmd, conf, 0);
   nchan_subscriber_directive_parse(cf, cmd, conf, 0);
   for(i=1; i < cf->args->nelts; i++) {
     val = &((ngx_str_t *) cf->args->elts)[i];
     if(! nchan_strmatch(val, 
-      WEBSOCKET_STRINGS_N + EVENTSOURCE_STRINGS_N + HTTP_CHUNKED_STRINGS_N + HTTP_MULTIPART_STRINGS_N + LONGPOLL_STRINGS_N + INTERVALPOLL_STRINGS_N + DISABLED_STRINGS_N,
-      WEBSOCKET_STRINGS, EVENTSOURCE_STRINGS, HTTP_CHUNKED_STRINGS, HTTP_MULTIPART_STRINGS, LONGPOLL_STRINGS_N, INTERVALPOLL_STRINGS_N, DISABLED_STRINGS_N)) {
+      WEBSOCKET_STRINGS_N + EVENTSOURCE_STRINGS_N + HTTP_CHUNKED_STRINGS_N + HTTP_MULTIPART_STRINGS_N + LONGPOLL_STRINGS_N + INTERVALPOLL_STRINGS_N + HTTP_RAW_STREAM_STRINGS_N + DISABLED_STRINGS_N,
+      WEBSOCKET_STRINGS, EVENTSOURCE_STRINGS, HTTP_CHUNKED_STRINGS, HTTP_MULTIPART_STRINGS, LONGPOLL_STRINGS, INTERVALPOLL_STRINGS, HTTP_RAW_STREAM_STRINGS, DISABLED_STRINGS)) {
       ngx_conf_log_error(NGX_LOG_ERR, cf, 0, "invalid %V value: %V", &cmd->name, val);
       return NGX_CONF_ERROR;
     }
   }
-  return nchan_setup_handler(cf, conf, &nchan_pubsub_handler);
+  
+  if(!is_valid_location(cf, lcf)) {
+    return NGX_CONF_ERROR;
+  }
+  
+  return NGX_CONF_OK;
+}
+
+static char *nchan_group_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  nchan_loc_conf_t     *lcf = conf;
+  ngx_str_t            *val;
+  ngx_uint_t            i;
+  nchan_conf_group_t   *group = &lcf->group;
+  
+  if(cf->args->nelts == 1){ //no arguments
+    group->get=1;
+    group->set=1;
+    group->delete=1;
+  }
+  else {
+    for(i=1; i < cf->args->nelts; i++) {
+      val = &((ngx_str_t *) cf->args->elts)[i];
+      if(nchan_strmatch(val, 1, "get")) {
+        group->get=1;
+      }
+      else if(nchan_strmatch(val, 1, "set")) {
+        group->set=1;
+      }
+      else if(nchan_strmatch(val, 1, "delete")) {
+        group->delete=1;
+      }
+      else if(nchan_strmatch(val, 1, "off")) {
+        group->get=0;
+        group->set=0;
+        group->delete=0;
+      }
+      else {
+        ngx_conf_log_error(NGX_LOG_ERR, cf, 0, "invalid %V value: %V", &cmd->name, val);
+        return NGX_CONF_ERROR;
+      }
+    }
+  }
+  
+  if(!is_valid_location(cf, lcf)) {
+    return NGX_CONF_ERROR;
+  }
+  lcf->request_handler = &nchan_group_handler;
+  return NGX_CONF_OK;
+}
+
+static ngx_int_t set_complex_value(ngx_conf_t *cf, ngx_http_complex_value_t **cv, char *val) {
+  ngx_http_compile_complex_value_t    ccv;
+  ngx_str_t                          *value = ngx_palloc(cf->pool, sizeof(ngx_str_t));;
+  if(value == NULL) {
+    return NGX_ERROR;
+  }
+  value->data = (u_char *)val;
+  value->len = strlen(val);
+  *cv = ngx_palloc(cf->pool, sizeof(ngx_http_complex_value_t));
+  if (*cv == NULL) {
+    return NGX_ERROR;
+  } 
+  ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
+  ccv.cf = cf;
+  ccv.value = value;
+  ccv.complex_value = *cv;
+  if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
+    return NGX_ERROR;
+  }
+  
+  return NGX_OK;
+}
+
+static ngx_int_t set_complex_value_array_size1(ngx_conf_t *cf, nchan_complex_value_arr_t *chid, char *val) {
+  chid->n = 1;
+  return set_complex_value(cf, &chid->cv[0], val);
+}
+
+static char *nchan_benchmark_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  nchan_loc_conf_t     *lcf = conf;
+  global_benchmark_enabled = 1;
+  lcf->request_handler = &nchan_benchmark_handler;
+  
+  
+  //set group
+  if(set_complex_value(cf, &lcf->channel_group, "benchmark") != NGX_OK) {
+    return "error setting benchmark channel group";
+  }
+  //set pub and sub channel ids
+  if(set_complex_value_array_size1(cf, &lcf->pub_chid, "control") != NGX_OK) {
+    return "error setting benchmark control channel";
+  }
+  if(set_complex_value_array_size1(cf, &lcf->sub_chid, "data") != NGX_OK) {
+    return "error setting benchmark data channel";
+  }
+  
+  lcf->sub.websocket = 1;
+  lcf->pub.websocket = 1;
+  
+  return NGX_CONF_OK;
+}
+
+static char *nchan_benchmark_subscriber_distribution_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  ngx_str_t          *val = &((ngx_str_t *) cf->args->elts)[1];
+  nchan_loc_conf_t   *lcf = conf;
+  if(nchan_strmatch(val, 1, "random")) {
+    lcf->benchmark.subscriber_distribution = NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_RANDOM;
+  }
+  else if(nchan_strmatch(val, 2, "optimal", "best")) {
+    lcf->benchmark.subscriber_distribution = NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_OPTIMAL;
+  }
+  else {
+    return "invalid value, must be \"random\" or \"optimal\"";
+  }
+  return NGX_CONF_OK;
+}
+static char *nchan_benchmark_publisher_distribution_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  ngx_str_t          *val = &((ngx_str_t *) cf->args->elts)[1];
+  nchan_loc_conf_t   *lcf = conf;
+  if(nchan_strmatch(val, 1, "random")) {
+    lcf->benchmark.publisher_distribution = NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_RANDOM;
+  }
+  else if(nchan_strmatch(val, 2, "optimal", "best")) {
+    lcf->benchmark.publisher_distribution = NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_OPTIMAL;
+  }
+  else {
+    return "invalid value, must be \"random\" or \"optimal\"";
+  }
+  return NGX_CONF_OK;
 }
 
 static char *nchan_subscriber_first_message_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
@@ -482,7 +841,113 @@ static char *nchan_subscriber_first_message_directive(ngx_conf_t *cf, ngx_comman
   return NGX_CONF_OK;
 }
 
+static char *nchan_websocket_heartbeat_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  nchan_loc_conf_t   *lcf = (nchan_loc_conf_t *)conf;
+  ngx_str_t          *heartbeat_in = &((ngx_str_t *) cf->args->elts)[1];
+  ngx_str_t          *heartbeat_out = &((ngx_str_t *) cf->args->elts)[2];
+  ngx_str_t          *in, *out;
+  lcf->websocket_heartbeat.enabled = 1;
+  
+  in = ngx_pcalloc(cf->pool, sizeof(ngx_str_t) + heartbeat_in->len);
+  in->data = (u_char *)&in[1];
+  in->len = heartbeat_in->len;
+  ngx_memcpy(in->data, heartbeat_in->data, heartbeat_in->len);
+  lcf->websocket_heartbeat.in = in;
+  
+  out = ngx_pcalloc(cf->pool, sizeof(ngx_str_t) + heartbeat_out->len);
+  out->data = (u_char *)&out[1];
+  out->len = heartbeat_out->len;
+  ngx_memcpy(out->data, heartbeat_out->data, heartbeat_out->len);
+  lcf->websocket_heartbeat.out = out;
+  
+  return NGX_CONF_OK;
+}
+
+static char *nchan_conf_deflate_compression_level_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+#if (NGX_ZLIB)
+  nchan_main_conf_t  *mcf = (nchan_main_conf_t *)conf;
+  ngx_int_t           np;
+  ngx_str_t           *value = cf->args->elts;
+  np = ngx_atoi(value[1].data, value[1].len);
+  if (np == NGX_ERROR) {
+    return "invalid number";
+  }
+  if(np < 0 || np > 9) {
+    return "must be between 0 and 9";
+  }
+  
+  mcf->zlib_params.level = np;
+#endif
+  return NGX_CONF_OK;
+}
+
+static char *nchan_conf_deflate_compression_strategy_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+#if (NGX_ZLIB)
+  nchan_main_conf_t   *mcf = (nchan_main_conf_t *)conf;
+  ngx_str_t           *val = cf->args->elts;
+  if(nchan_strmatch(val, 1, "default")) {
+    mcf->zlib_params.strategy = Z_DEFAULT_STRATEGY;
+  }
+  else if(nchan_strmatch(val, 1, "filtered")) {
+    mcf->zlib_params.strategy = Z_FILTERED;
+  }
+  else if(nchan_strmatch(val, 1, "huffman-only")) {
+    mcf->zlib_params.strategy = Z_HUFFMAN_ONLY;
+  }
+  else if(nchan_strmatch(val, 1, "rle")) {
+    mcf->zlib_params.strategy = Z_RLE;
+  }
+  else if(nchan_strmatch(val, 1, "fixed")) {
+    mcf->zlib_params.strategy = Z_FIXED;
+  }
+  else {
+    return "invalid compression strategy";
+  }
+#endif
+  return NGX_CONF_OK;
+}
+
+static char *nchan_conf_deflate_compression_window_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+#if (NGX_ZLIB)
+  nchan_main_conf_t  *mcf = (nchan_main_conf_t *)conf;
+  ngx_int_t           np;
+  ngx_str_t           *value = cf->args->elts;
+  np = ngx_atoi(value[1].data, value[1].len);
+  if (np == NGX_ERROR) {
+    return "invalid number";
+  }
+  if(np < 9 || np > 15) {
+    return "must be between 9 and 15";
+  }
+  
+  mcf->zlib_params.windowBits = np;
+#endif
+  return NGX_CONF_OK;
+}
+
+static char *nchan_conf_deflate_compression_memlevel_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+#if (NGX_ZLIB)
+  nchan_main_conf_t  *mcf = (nchan_main_conf_t *)conf;
+  ngx_int_t           np;
+  ngx_str_t           *value = cf->args->elts;
+  np = ngx_atoi(value[1].data, value[1].len);
+  if (np == NGX_ERROR) {
+    return "invalid number";
+  }
+  if(np < 1 || np > 9) {
+    return "must be between 1 and 9";
+  }
+  
+  mcf->zlib_params.memLevel = np;
+#endif
+  return NGX_CONF_OK;
+}
+
+
 static void nchan_exit_worker(ngx_cycle_t *cycle) {
+  if(!global_nchan_enabled) {
+    return;
+  }
   if(global_redis_enabled) {
     redis_store_prepare_to_exit_worker();
   }
@@ -491,16 +956,32 @@ static void nchan_exit_worker(ngx_cycle_t *cycle) {
     nchan_store_redis.exit_worker(cycle);
   }
   nchan_output_shutdown();
+#if (NGX_ZLIB)
+  if(global_zstream_needed) {
+    nchan_common_deflate_shutdown();
+  }
+#endif
 #if NCHAN_SUBSCRIBER_LEAK_DEBUG
   subscriber_debug_assert_isempty();
 #endif
 }
 
 static void nchan_exit_master(ngx_cycle_t *cycle) {
+  if(!global_nchan_enabled) {
+    return;
+  }
+  if(global_benchmark_enabled) {
+    nchan_benchmark_exit_master(cycle);
+  }
   nchan_store_memory.exit_master(cycle);
   if(global_redis_enabled) {
     nchan_store_redis.exit_master(cycle);
   }
+#if (NGX_ZLIB)
+  if(global_zstream_needed) {
+    nchan_common_deflate_shutdown();
+  }
+#endif
 }
 
 static char *nchan_set_complex_value_array(ngx_conf_t *cf, ngx_command_t *cmd, void *conf, nchan_complex_value_arr_t *chid) {
@@ -668,6 +1149,26 @@ static char *nchan_set_raw_subscriber_separator(ngx_conf_t *cf, ngx_command_t *c
   return NGX_CONF_OK;
 }
 
+static char *nchan_set_message_compression_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  ngx_str_t          *val = &((ngx_str_t *) cf->args->elts)[1];
+  nchan_loc_conf_t   *lcf = conf;
+#if (NGX_ZLIB)
+  if(nchan_strmatch(val, 1, "on")) {
+    lcf->message_compression = 1;
+    global_zstream_needed = 1;
+  }
+  else if(nchan_strmatch(val, 1, "off")) {
+    lcf->message_compression = 0;
+  }
+  else {
+    return "invalid value: must be 'on' or 'off'";
+  }
+  return NGX_CONF_OK;
+#else
+  return "cannot use compression, Nginx was built without zlib";
+#endif
+}
+
 static char *nchan_set_longpoll_multipart(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
   ngx_str_t          *val = &((ngx_str_t *) cf->args->elts)[1];
   nchan_loc_conf_t   *lcf = conf;
@@ -688,11 +1189,59 @@ static char *nchan_set_longpoll_multipart(ngx_conf_t *cf, ngx_command_t *cmd, vo
   return NGX_CONF_OK;
 }
 
+static char *ngx_conf_set_redis_subscribe_weights(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  ngx_int_t  master = NGX_CONF_UNSET;
+  ngx_int_t  slave = NGX_CONF_UNSET;
+  ngx_str_t *val = cf->args->elts;
+  ngx_str_t *cur;
+  unsigned   i;
+  nchan_srv_conf_t *scf = conf;
+  for(i=1; i < cf->args->nelts; i++) {
+    cur = &val[i];
+    if(nchan_str_after(&cur, "master=")) {
+      if((master = ngx_atoi(cur->data, cur->len)) == NGX_ERROR) {
+        return "has invalid weight for master";
+      }
+    }
+    else if(nchan_str_after(&cur, "slave=")) {
+      if((slave = ngx_atoi(cur->data, cur->len)) == NGX_ERROR) {
+        return "has invalid weight for slave";
+      }
+    }
+  }
+  
+  if(master != NGX_CONF_UNSET) {
+    scf->redis.master_weight = master;
+  }
+  if(slave != NGX_CONF_UNSET) {
+    scf->redis.slave_weight = slave;
+  }
+  
+  return NGX_CONF_OK;
+}
+
+static char *ngx_conf_set_redis_optimize_target(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  ngx_str_t          *val = &((ngx_str_t *) cf->args->elts)[1];
+  nchan_srv_conf_t   *scf = conf;
+  if(nchan_strmatch(val, 2, "bandwidth", "bw")) {
+    scf->redis.optimize_target = NCHAN_REDIS_OPTIMIZE_BANDWIDTH;
+  }
+  else if(nchan_strmatch(val, 2, "cpu", "CPU")) {
+    scf->redis.optimize_target = NCHAN_REDIS_OPTIMIZE_CPU;
+  }
+  else {
+    return "invalid value, must be \"bandwidth\" or \"cpu\"";
+  }
+  return NGX_CONF_OK;
+}
+
 static char *ngx_conf_enable_redis(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
   char                *rc;
   ngx_flag_t          *fp;
   char                *p = conf;
-  nchan_loc_conf_t    *lcf = (nchan_loc_conf_t *)conf;
+  nchan_loc_conf_t    *lcf = conf;
+  
+  ngx_conf_log_error(NGX_LOG_WARN, cf, 0, "Use of %V is discouraged in favor of nchan_redis_pass.", &cmd->name);
   
   rc = ngx_conf_set_flag_slot(cf, cmd, conf);
   if(rc == NGX_CONF_ERROR) {
@@ -703,20 +1252,22 @@ static char *ngx_conf_enable_redis(ngx_conf_t *cf, ngx_command_t *cmd, void *con
   if(*fp) {
     if(!lcf->redis.enabled) {
       lcf->redis.enabled = 1;
-      nchan_store_redis_add_server_conf(cf, &lcf->redis, lcf);
+      nchan_store_redis_add_active_loc_conf(cf, lcf);
     }
     global_redis_enabled = 1;
   }
   else {
-    nchan_store_redis_remove_server_conf(cf, &lcf->redis);
+    nchan_store_redis_remove_active_loc_conf(cf, lcf);
   }
   
   return rc;
 }
 
 static char *nchan_stub_status_directive(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  nchan_loc_conf_t    *lcf = conf;
   nchan_stub_status_enabled = 1;
-  return nchan_setup_handler(cf, conf, &nchan_stub_status_handler);
+  lcf->request_handler = &nchan_stub_status_handler;
+  return NGX_CONF_OK;
 }
 
 
@@ -728,8 +1279,18 @@ static char *ngx_conf_upstream_redis_server(ngx_conf_t *cf, ngx_command_t *cmd,
   ngx_http_upstream_srv_conf_t        *uscf;
   ngx_str_t                           *value;
   ngx_http_upstream_server_t          *usrv;
-  
+  nchan_loc_conf_t                    *lcf = conf;
   uscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_upstream_module);  
+  nchan_srv_conf_t                    *scf = NULL;
+  scf = ngx_http_conf_upstream_srv_conf(uscf, ngx_nchan_module);
+  if(scf->upstream_nchan_loc_conf) {
+    assert(scf->upstream_nchan_loc_conf == lcf);
+  }
+  else {
+    //is this even a safe technique? it might break in the future...
+    scf->upstream_nchan_loc_conf = lcf;
+  }
+  
   
   if(uscf->servers == NULL) {
         uscf->servers = ngx_array_create(cf->pool, 4, sizeof(ngx_http_upstream_server_t));
@@ -738,6 +1299,11 @@ static char *ngx_conf_upstream_redis_server(ngx_conf_t *cf, ngx_command_t *cmd,
     return NGX_CONF_ERROR;
   }
   value = cf->args->elts;
+  
+  if(!nchan_store_redis_validate_url(&value[1])) {
+    return "url is invalid";
+  }
+  
   ngx_memzero(usrv, sizeof(*usrv));
 #if nginx_version >= 1007002
   usrv->name = value[1];
@@ -749,16 +1315,89 @@ static char *ngx_conf_upstream_redis_server(ngx_conf_t *cf, ngx_command_t *cmd,
   return NGX_CONF_OK;
 }
 
+static char *ngx_conf_set_str_slot_no_newlines(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  ngx_str_t *val = cf->args->elts;
+  ngx_str_t *arg = &val[1];
+  
+  if(nchan_ngx_str_substr(arg, "\n")) {
+    return "can't contain any newline characters";
+  }
+  
+  return ngx_conf_set_str_slot(cf, cmd, conf);
+}
+
 static char *ngx_conf_set_redis_url(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
   nchan_loc_conf_t  *lcf = conf;
+  ngx_str_t *val = cf->args->elts;
+  ngx_str_t *arg = &val[1];
+  
+  ngx_conf_log_error(NGX_LOG_WARN, cf, 0, "Use of %V is discouraged in favor of an upstream { } block with nchan_redis_server %V;", &cmd->name, arg);
   
   if(lcf->redis.upstream) {
     return "can't be set here: already using nchan_redis_pass";
   }
+  if(!nchan_store_redis_validate_url(arg)) {
+    return "url is invalid";
+  }
   
   return ngx_conf_set_str_slot(cf, cmd, conf);
 }
 
+static char *ngx_conf_process_redis_namespace_slot(ngx_conf_t *cf, void *post, void *fld) {
+  ngx_str_t *arg = fld;
+
+  if(memchr(arg->data, '{', arg->len)) {
+    return "can't contain character '{'";
+  }
+  
+  if(memchr(arg->data, '}', arg->len)) {
+    return "can't contain character '}'";
+  }
+  
+  if(arg->len > 0 && arg->data[arg->len-1] != ':') {
+    u_char  *nns;
+    if((nns = ngx_palloc(cf->pool, arg->len + 2)) == NULL) {
+      return "couldn't allocate redis namespace data";
+    }
+    ngx_memcpy(nns, arg->data, arg->len);
+    nns[arg->len]=':';
+    nns[arg->len+1]='\0';
+    arg->len++;
+    arg->data=nns;
+  }
+  
+  return NGX_CONF_OK;
+}
+
+static char *ngx_conf_set_redis_storage_mode_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  char                         *p = conf;
+  ngx_str_t                    *val = cf->args->elts;
+  ngx_str_t                    *arg = &val[1];
+  
+  nchan_redis_storage_mode_t   *field;
+
+  field = (nchan_redis_storage_mode_t *) (p + cmd->offset);
+  
+  if(*field != REDIS_MODE_CONF_UNSET) {
+    return "is duplicate";
+  }
+  
+  if(nchan_strmatch(arg, 1, "backup")) {
+    *field = REDIS_MODE_BACKUP;
+  }
+  else if(nchan_strmatch(arg, 1, "distributed")) {
+    *field = REDIS_MODE_DISTRIBUTED;
+  }
+  else if(nchan_strmatch(arg, 1, "nostore") ||  nchan_strmatch(arg, 1, "distributed-nostore")) {
+    *field = REDIS_MODE_DISTRIBUTED_NOSTORE;
+  }
+  else {
+    return "is invalid, must be one of 'distributed',  'backup' or 'nostore'";
+  }
+  
+  return NGX_CONF_OK;
+}
+
 static char *ngx_conf_set_redis_upstream_pass(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
   nchan_loc_conf_t  *lcf = conf;
   ngx_str_t         *value = cf->args->elts;
@@ -771,12 +1410,12 @@ static char *ngx_conf_set_redis_upstream_pass(ngx_conf_t *cf, ngx_command_t *cmd
 #include "nchan_config_commands.c" //hideous but hey, it works
 
 static ngx_http_module_t  nchan_module_ctx = {
-    nchan_add_variables,           /* preconfiguration */
+    nchan_preconfig,               /* preconfiguration */
     nchan_postconfig,              /* postconfiguration */
     nchan_create_main_conf,        /* create main configuration */
     NULL,                          /* init main configuration */
-    NULL,                          /* create server configuration */
-    NULL,                          /* merge server configuration */
+    nchan_create_srv_conf,         /* create server configuration */
+    nchan_merge_srv_conf,          /* merge server configuration */
     nchan_create_loc_conf,         /* create location configuration */
     nchan_merge_loc_conf,          /* merge location configuration */
 };
diff --git a/debian/modules/nchan/src/nchan_types.h b/debian/modules/nchan/src/nchan_types.h
index 58b8ee1c..d8733c02 100644
--- a/debian/modules/nchan/src/nchan_types.h
+++ b/debian/modules/nchan/src/nchan_types.h
@@ -5,8 +5,14 @@
 
 typedef ngx_int_t (*callback_pt)(ngx_int_t, void *, void *);
 
-typedef enum {MSG_CHANNEL_NOTREADY, MSG_NORESPONSE, MSG_INVALID, MSG_PENDING, MSG_NOTFOUND, MSG_FOUND, MSG_EXPECTED, MSG_EXPIRED} nchan_msg_status_t;
-typedef enum {INACTIVE, NOTREADY, WAITING, STUBBED, READY} chanhead_pubsub_status_t;
+#include <util/nchan_fake_request.h>
+
+typedef enum {MSG_ERROR, MSG_CHANNEL_NOTREADY, MSG_INVALID, MSG_PENDING, MSG_NOTFOUND, MSG_FOUND, MSG_EXPECTED, MSG_EXPIRED} nchan_msg_status_t;
+typedef enum {INACTIVE, NOTREADY, WAITING, STUBBED, READY, DELETED} chanhead_pubsub_status_t;
+
+typedef enum {NCHAN_CONTENT_TYPE_PLAIN, NCHAN_CONTENT_TYPE_JSON, NCHAN_CONTENT_TYPE_XML, NCHAN_CONTENT_TYPE_YAML, NCHAN_CONTENT_TYPE_HTML} nchan_content_type_t;
+
+typedef enum {REDIS_MODE_CONF_UNSET = NGX_CONF_UNSET, REDIS_MODE_BACKUP = 1, REDIS_MODE_DISTRIBUTED = 2, REDIS_MODE_DISTRIBUTED_NOSTORE = 3} nchan_redis_storage_mode_t;
 
 typedef enum {
   SUB_ENQUEUE, SUB_DEQUEUE, SUB_RECEIVE_MESSAGE, SUB_RECEIVE_STATUS, 
@@ -17,6 +23,15 @@ typedef struct {
   size_t                          shm_size;
   ngx_msec_t                      redis_fakesub_timer_interval;
   size_t                          redis_publish_message_msgkey_size;
+#if (NGX_ZLIB)
+  struct {
+                                    int level;
+                                    int windowBits;
+                                    int memLevel;
+                                    int strategy;
+  }                               zlib_params;
+#endif
+  ngx_path_t                     *message_temp_path;
 } nchan_main_conf_t;
 
 
@@ -24,10 +39,14 @@ typedef struct {
   ngx_str_t                     url;
   ngx_flag_t                    url_enabled;
   time_t                        ping_interval;
+  ngx_str_t                     namespace;
+  nchan_redis_storage_mode_t    storage_mode;
+  ngx_int_t                     nostore_fastpublish;
   ngx_str_t                     upstream_url;
   ngx_http_upstream_srv_conf_t *upstream;
   ngx_flag_t                    upstream_inheritable;
   unsigned                      enabled:1;
+  void                         *nodeset;
   void                         *privdata;
 } nchan_redis_conf_t;
 
@@ -57,8 +76,8 @@ union nchan_msg_multitag {
 typedef struct {
   time_t                          time; //tag message by time
   union nchan_msg_multitag        tag;
-  unsigned                        tagactive:16;
-  unsigned                        tagcount:16;
+  int16_t                         tagactive;
+  int16_t                         tagcount;
 } nchan_msg_id_t;
 
 typedef struct {
@@ -80,20 +99,35 @@ struct msg_rsv_dbg_s {
 typedef struct nchan_loc_conf_s nchan_loc_conf_t;
 typedef struct nchan_msg_s nchan_msg_t;
 
+typedef enum {NCHAN_MSG_SHARED, NCHAN_MSG_HEAP, NCHAN_MSG_POOL, NCHAN_MSG_STACK} nchan_msg_storage_t;
+
+typedef enum {
+  NCHAN_MSG_COMPRESSION_INVALID = -1,
+  NCHAN_MSG_NO_COMPRESSION = 0, 
+  NCHAN_MSG_COMPRESSION_WEBSOCKET_PERMESSAGE_DEFLATE
+} nchan_msg_compression_type_t;
+  
+typedef struct {
+  ngx_buf_t                       buf;
+  nchan_msg_compression_type_t    compression;
+} nchan_compressed_msg_t;
+
 struct nchan_msg_s {
   nchan_msg_id_t                  id;
   nchan_msg_id_t                  prev_id;
-  ngx_str_t                       content_type;
-  ngx_str_t                       eventsource_event;
+  ngx_str_t                      *content_type;
+  ngx_str_t                      *eventsource_event;
   //  ngx_str_t                   charset;
-  ngx_buf_t                      *buf;
+  ngx_buf_t                       buf;
   time_t                          expires;
+  
   ngx_atomic_int_t                refcount;
+  nchan_msg_t                    *parent;
+  nchan_compressed_msg_t         *compressed;
+  //struct nchan_msg_s             *reload_next;
   
-  struct nchan_msg_s             *reload_next;
+  nchan_msg_storage_t             storage;
   
-  unsigned                        shared:1; //for debugging
-  unsigned                        temp_allocd:1;
 #if NCHAN_MSG_RESERVE_DEBUG
   struct msg_rsv_dbg_s           *rsv;
 #endif
@@ -102,16 +136,8 @@ struct nchan_msg_s {
   struct nchan_msg_s             *dbg_prev;
   struct nchan_msg_s             *dbg_next;
 #endif
-#if NCHAN_BENCHMARK
-  struct timeval                  start_tv;
-#endif
 }; // nchan_msg_t
 
-typedef struct {
-  nchan_msg_t       copy;
-  nchan_msg_t      *original;
-} nchan_msg_copy_t;
-
 typedef struct {
   ngx_str_t                       id;
   ngx_int_t                       messages;
@@ -150,6 +176,26 @@ typedef struct {
 
 typedef struct subscriber_s subscriber_t;
 
+typedef struct {
+  //must be made entirely of ngx_atomic_int_t
+  ngx_atomic_int_t                channels;
+  ngx_atomic_int_t                subscribers;
+  ngx_atomic_int_t                messages;
+  ngx_atomic_int_t                messages_shmem_bytes;
+  ngx_atomic_int_t                messages_file_bytes;
+} nchan_group_limits_t;
+
+typedef struct {
+  ngx_atomic_int_t               channels;
+  ngx_atomic_int_t               multiplexed_channels;
+  ngx_atomic_int_t               subscribers;
+  ngx_atomic_int_t               messages;
+  ngx_atomic_int_t               messages_shmem_bytes;
+  ngx_atomic_int_t               messages_file_bytes;
+  nchan_group_limits_t           limit;
+  ngx_str_t                      name;
+} nchan_group_t;
+
 typedef struct{
   //init
   ngx_int_t (*init_module)(ngx_cycle_t *cycle);
@@ -166,16 +212,14 @@ typedef struct{
   ngx_int_t (*subscribe)   (ngx_str_t *, subscriber_t *);
   ngx_int_t (*publish)     (ngx_str_t *, nchan_msg_t *, nchan_loc_conf_t *, callback_pt, void *);
   
+    //channel actions
   ngx_int_t (*delete_channel)(ngx_str_t *, nchan_loc_conf_t *, callback_pt, void *);
-  
-  //channel actions
   ngx_int_t (*find_channel)(ngx_str_t *, nchan_loc_conf_t *, callback_pt, void*);
   
-  
-  
-  //message actions and properties
-  ngx_str_t * (*message_etag)(nchan_msg_t *msg, ngx_pool_t *pool);
-  ngx_str_t * (*message_content_type)(nchan_msg_t *msg, ngx_pool_t *pool);
+  //group actions
+  ngx_int_t (*get_group)(ngx_str_t *name, nchan_loc_conf_t *, callback_pt, void *);
+  ngx_int_t (*set_group_limits)(ngx_str_t *name, nchan_loc_conf_t *, nchan_group_limits_t *limits, callback_pt, void *);
+  ngx_int_t (*delete_group)(ngx_str_t *name, nchan_loc_conf_t *, callback_pt, void *);
 
 } nchan_store_t;
 
@@ -196,6 +240,20 @@ typedef struct {
   unsigned                        websocket:1;
 } nchan_conf_subscriber_types_t;
 
+typedef struct {
+  unsigned                        get:1;
+  unsigned                        set:1;
+  unsigned                        delete:1;
+  
+  ngx_int_t                       enable_accounting;
+  
+  ngx_http_complex_value_t       *max_channels;
+  ngx_http_complex_value_t       *max_subscribers;
+  ngx_http_complex_value_t       *max_messages;
+  ngx_http_complex_value_t       *max_messages_shm_bytes;
+  ngx_http_complex_value_t       *max_messages_file_bytes;
+} nchan_conf_group_t;
+
 #define NCHAN_COMPLEX_VALUE_ARRAY_MAX 8
 typedef struct {
   ngx_http_complex_value_t       *cv[NCHAN_COMPLEX_VALUE_ARRAY_MAX];
@@ -207,6 +265,40 @@ typedef struct {
  ngx_atomic_uint_t               max_messages;
 } nchan_loc_conf_shared_data_t;
 
+typedef enum {
+  NCHAN_REDIS_OPTIMIZE_UNSET = -1,
+  NCHAN_REDIS_OPTIMIZE_CPU = 1,
+  NCHAN_REDIS_OPTIMIZE_BANDWIDTH = 2
+} nchan_redis_optimize_t;
+
+typedef struct {
+  struct {
+      ngx_msec_t                    connect_timeout;
+      nchan_redis_optimize_t        optimize_target;
+      ngx_int_t                     master_weight;
+      ngx_int_t                     slave_weight;
+  }                               redis;
+  nchan_loc_conf_t                *upstream_nchan_loc_conf;
+} nchan_srv_conf_t;
+
+typedef struct {
+  time_t                          time;
+  ngx_int_t                       msgs_per_minute;
+  ngx_int_t                       msg_padding;
+  ngx_int_t                       channels;
+  ngx_int_t                       subscribers_per_channel;
+  enum {
+    NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_UNSET = -1,
+    NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_RANDOM = 1,
+    NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_OPTIMAL = 2
+  }                               subscriber_distribution;
+  enum {
+    NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_UNSET = -1,
+    NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_RANDOM = 1,
+    NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_OPTIMAL = 2
+  }                               publisher_distribution;
+} nchan_benchmark_conf_t;
+
 struct nchan_loc_conf_s { //nchan_loc_conf_t
   
   ngx_int_t                       shared_data_index;
@@ -226,12 +318,14 @@ struct nchan_loc_conf_s { //nchan_loc_conf_t
   nchan_complex_value_arr_t       pub_chid;
   nchan_complex_value_arr_t       sub_chid;
   nchan_complex_value_arr_t       pubsub_chid;
-  ngx_str_t                       channel_group;
+  ngx_http_complex_value_t       *channel_group;
+  
   ngx_str_t                       channel_id_split_delimiter;
   
   ngx_str_t                       subscriber_http_raw_stream_separator;
 
-  ngx_str_t                       allow_origin;
+  ngx_http_complex_value_t       *allow_origin;
+  ngx_int_t                       allow_credentials;
   
   nchan_complex_value_arr_t       last_message_id;
   ngx_str_t                       custom_msgtag_header;
@@ -239,7 +333,7 @@ struct nchan_loc_conf_s { //nchan_loc_conf_t
   
   nchan_conf_publisher_types_t    pub;
   nchan_conf_subscriber_types_t   sub; 
-  
+  nchan_conf_group_t              group;
   time_t                          subscriber_timeout;
   
   ngx_int_t                       longpoll_multimsg;
@@ -248,6 +342,20 @@ struct nchan_loc_conf_s { //nchan_loc_conf_t
   ngx_str_t                       eventsource_event;
   
   time_t                          websocket_ping_interval;
+  struct {
+    time_t                          interval;
+    ngx_str_t                       event;
+    ngx_str_t                       data;
+    ngx_str_t                       comment;
+  }                               eventsource_ping;
+  
+  struct {
+    ngx_int_t   enabled;
+    ngx_str_t  *in;
+    ngx_str_t  *out;
+  }                               websocket_heartbeat;
+  
+  nchan_msg_compression_type_t    message_compression;
   
   ngx_int_t                       subscriber_first_message;
   
@@ -263,14 +371,12 @@ struct nchan_loc_conf_s { //nchan_loc_conf_t
   ngx_int_t                       max_channel_subscribers;
   time_t                          channel_timeout;
   nchan_store_t                  *storage_engine;
+  
+  nchan_benchmark_conf_t          benchmark;
+  
+  ngx_int_t                     (*request_handler)(ngx_http_request_t *r);
 };// nchan_loc_conf_t;
 
-typedef struct {
-  char              *subtype;
-  size_t             len;
-  const ngx_str_t   *format;
-} nchan_content_subtype_t;
-
 typedef struct nchan_llist_timed_s {
   struct nchan_llist_timed_s     *prev;
   void                           *data;
@@ -286,7 +392,7 @@ typedef struct {
   ngx_int_t              (*enqueue)(struct subscriber_s *);
   ngx_int_t              (*dequeue)(struct subscriber_s *);
   ngx_int_t              (*respond_message)(struct subscriber_s *, nchan_msg_t *);
-  ngx_int_t              (*respond_status)(struct subscriber_s *, ngx_int_t, const ngx_str_t *);
+  ngx_int_t              (*respond_status)(struct subscriber_s *, ngx_int_t, const ngx_str_t *, ngx_chain_t *);
   ngx_int_t              (*set_dequeue_callback)(subscriber_t *self, subscriber_callback_pt cb, void *privdata);
   ngx_int_t              (*reserve)(struct subscriber_s *);
   ngx_int_t              (*release)(struct subscriber_s *, uint8_t nodestroy);
@@ -305,10 +411,14 @@ struct subscriber_s {
   nchan_msg_id_t             last_msgid;
   nchan_loc_conf_t          *cf;
   ngx_http_request_t        *request;
+  void                      *upstream_requestmachine;
   ngx_uint_t                 reserved;
+  
+  unsigned                   enable_sub_unsub_callbacks;
   unsigned                   dequeue_after_response:1;
   unsigned                   destroy_after_dequeue:1;
   unsigned                   enqueued:1;
+  
 #if FAKESHARD
   ngx_int_t                  owner;
 #endif
@@ -334,16 +444,23 @@ typedef struct {
   ngx_str_t                     *channel_event_name;
   ngx_str_t                      channel_id[NCHAN_MULTITAG_REQUEST_CTX_MAX];
   int                            channel_id_count;
-  ngx_str_t                      request_origin_header;
+  ngx_str_t                     *channel_group_name;
+  
+  ngx_str_t                     *request_origin_header;
+  ngx_str_t                     *allow_origin;
   
-  ngx_int_t                      unsubscribe_request_callback_finalize_code;
   unsigned                       sent_unsubscribe_request:1;
   unsigned                       request_ran_content_handler:1;
-#if NCHAN_BENCHMARK
-  struct timeval                 start_tv;
-#endif
   
 } nchan_request_ctx_t;
 
 
+typedef struct {
+  ngx_str_t     hostname;
+  ngx_str_t     peername; // resolved hostname (ip address)
+  ngx_int_t     port;
+  ngx_str_t     password;
+  ngx_int_t     db;
+} redis_connect_params_t;
+
 #endif  /* NCHAN_TYPES_H */
diff --git a/debian/modules/nchan/src/nchan_variables.c b/debian/modules/nchan/src/nchan_variables.c
index f1b0da70..fbf2944d 100644
--- a/debian/modules/nchan/src/nchan_variables.c
+++ b/debian/modules/nchan/src/nchan_variables.c
@@ -171,6 +171,11 @@ static ngx_int_t nchan_stub_status_shared_memory_used(ngx_http_request_t *r, ngx
   return NGX_OK;
 }
 
+static ngx_int_t nchan_version_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t d) {
+  set_varval(v, (u_char *)NCHAN_VERSION, strlen(NCHAN_VERSION));
+  return NGX_OK;
+}
+
 
 
 #define STUB_STATUS_VARIABLE(counter) \
@@ -205,6 +210,7 @@ nchan_variable_t nchan_vars[] = {
   STUB_STATUS_NAMED_VARIABLE("ipc_queued_alerts", ipc_queue_size),
   STUB_STATUS_NAMED_VARIABLE("total_ipc_send_delay", ipc_total_send_delay),
   STUB_STATUS_NAMED_VARIABLE("total_ipc_receive_delay", ipc_total_receive_delay),
+  { ngx_string("nchan_version"), nchan_version_variable, 0},
   
 //  { ngx_string("nchan_message_alert_type"), nchan_message_alert_type_variable, 0},
   
diff --git a/debian/modules/nchan/src/nchan_version.h b/debian/modules/nchan/src/nchan_version.h
new file mode 100644
index 00000000..a8c02ae4
--- /dev/null
+++ b/debian/modules/nchan/src/nchan_version.h
@@ -0,0 +1 @@
+#define NCHAN_VERSION "1.2.7"
diff --git a/debian/modules/nchan/src/store/memory/groups.c b/debian/modules/nchan/src/store/memory/groups.c
new file mode 100644
index 00000000..9691b0ac
--- /dev/null
+++ b/debian/modules/nchan/src/store/memory/groups.c
@@ -0,0 +1,570 @@
+#include "groups.h"
+#include "store.h"
+#include "ipc-handlers.h"
+#include <assert.h>
+
+//#define DEBUG_LEVEL NGX_LOG_WARN
+#define DEBUG_LEVEL NGX_LOG_DEBUG
+#define DBG(fmt, args...) ngx_log_error(DEBUG_LEVEL, ngx_cycle->log, 0, "MEMSTORE:GROUPS: " fmt, ##args)
+#define ERR(fmt, args...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "MEMSTORE:GROUPS: " fmt, ##args)
+
+//#define NCHAN_DEBUG_GROUP_NOCACAHE 1
+#define MAX_GETGROUP_WAIT_TIME_BEFORE_RETRY 5
+
+static void *group_id(void *d) {
+  return &((group_tree_node_t *)d)->name;
+}
+
+#if NCHAN_DEBUG_GROUP_NOCACAHE
+ngx_int_t clear_group_if_not_owner(rbtree_seed_t *seed, void *node_data, void *pd) {
+  group_tree_node_t *gtn = node_data;
+  ngx_int_t          myslot = memstore_slot();
+  
+  if(memstore_str_owner(&gtn->name) != myslot) {
+    gtn->group = NULL; //asshole.
+    //DBG("cleared group %V shared data", &gtn->name);
+  }
+  return NGX_OK;
+}
+
+ngx_int_t jerk_group_clearer(void *pd) {
+  memstore_groups_t *gp = pd;
+  
+  rbtree_walk(&gp->tree, clear_group_if_not_owner, NULL);
+  
+  return NGX_OK;
+}
+#endif
+
+ngx_int_t memstore_groups_init(memstore_groups_t *gp) {
+  return rbtree_init(&gp->tree, "memstore groups", group_id, NULL, NULL);
+}
+
+ngx_int_t shutdown_walker(rbtree_seed_t *seed, void *node_data, void *privdata) {
+  group_tree_node_t *gtn = (group_tree_node_t *)node_data;
+  shmem_t *          shm = nchan_store_memory_shmem;
+  ngx_int_t          myslot = memstore_slot();
+  DBG("shutdown_walker %V group %p", &gtn->name, gtn->group);
+  if(memstore_str_owner(&gtn->name) == myslot) {
+    shm_free(shm, gtn->group);
+  }
+  return NGX_OK;
+}
+
+ngx_int_t memstore_groups_shutdown(memstore_groups_t *gp) {
+  rbtree_empty(&gp->tree, shutdown_walker, NULL);
+  DBG("empties rbtree");
+  return NGX_OK;
+}
+
+static group_tree_node_t *group_create_node(memstore_groups_t *gp, ngx_str_t *name, nchan_group_t *shm_group) {
+  //assumes node does not yet exist
+  ngx_rbtree_node_t      *node;
+  group_tree_node_t      *gtn;
+  
+  if((node = rbtree_create_node(&gp->tree, sizeof(group_tree_node_t) + name->len)) == NULL) {
+    ERR("couldn't alloc rbtree node for group %V", name);
+    return NULL;
+  }
+  gtn = rbtree_data_from_node(node);
+  gtn->name.len = name->len;
+  gtn->name.data = (u_char *)(&gtn[1]);
+  ngx_memcpy(gtn->name.data, name->data, name->len);
+  
+  gtn->group = shm_group;
+  
+  gtn->when_ready_head = NULL;
+  gtn->when_ready_tail = NULL;
+  
+  gtn->owned_chanhead_head = NULL;
+  
+  gtn->getting_group = 0;
+  
+  rbtree_insert_node(&gp->tree, node);
+  
+  return gtn;
+}
+
+static group_tree_node_t *group_owner_create_node(memstore_groups_t *gp, ngx_str_t *name) {
+  //ASSUMES group name is owned by current worker, AND node does not yet exist
+  group_tree_node_t      *gtn;
+  nchan_group_t          *group;
+  group = shm_calloc(nchan_store_memory_shmem, sizeof(*group) + name->len, "group");
+  if(group == NULL) {
+    nchan_log_ooshm_error("creating group %V", name);
+    return NULL;
+  }
+  
+  group->name.len = name->len;
+  group->name.data = (u_char *)(&group[1]);
+  ngx_memcpy(group->name.data, name->data, name->len);
+  
+  DBG("created group %p %V", group, &group->name);
+  
+  if((gtn = group_create_node(gp, name, group)) == NULL) {
+    shm_free(nchan_store_memory_shmem, group);
+    return NULL;
+  }
+  
+  memstore_ipc_broadcast_group(group);
+  
+  return gtn;
+}
+
+nchan_group_t *memstore_group_owner_find(memstore_groups_t *gp, ngx_str_t *name, int *group_just_created) {
+  ngx_rbtree_node_t      *node;
+  group_tree_node_t      *gtn;
+  assert(memstore_str_owner(name) == memstore_slot());
+  if((node = rbtree_find_node(&gp->tree, name)) != NULL) {
+    gtn = rbtree_data_from_node(node);
+    if(group_just_created) *group_just_created = 0;
+  }
+  else {
+    gtn = group_owner_create_node(gp, name);
+    if(group_just_created) *group_just_created = 1;
+  }
+  
+  return gtn ? gtn->group : NULL;
+}
+
+
+static ngx_int_t add_whenready_callback(group_tree_node_t *gtn, char *lbl, callback_pt cb, void *pd) {
+  //not ready yet, queue up the callback
+  group_callback_t  *gcb;
+  DBG("add to %p whenready %s for group %V", gtn, lbl, &gtn->name);
+  if((gcb = ngx_alloc(sizeof(*gcb), ngx_cycle->log)) == NULL) {
+    ERR("couldn't allocate callback link for group %V", &gtn->name);
+    cb(NGX_ERROR, NULL, pd);
+    return NGX_ERROR;
+  }
+  
+  gcb->cb = cb;
+  gcb->pd = pd;
+  gcb->label = lbl;
+  gcb->next = NULL;
+  
+  if(gtn->when_ready_tail) {
+    gtn->when_ready_tail->next = gcb;
+  }
+  
+  if(!gtn->when_ready_head) {
+    gtn->when_ready_head = gcb;
+  }
+  
+  
+  gtn->when_ready_tail = gcb;
+  
+  for(gcb = gtn->when_ready_head; gcb != NULL; gcb = gcb->next){
+    DBG("  whenready %s", gcb->label);
+  }
+  
+  if(ngx_time() - gtn->getting_group > MAX_GETGROUP_WAIT_TIME_BEFORE_RETRY) {
+    gtn->getting_group = ngx_time();
+    memstore_ipc_send_get_group(memstore_str_owner(&gtn->name), &gtn->name);    
+  }
+  
+  return NGX_OK;
+}
+
+static void call_whenready_callbacks(group_tree_node_t *gtn, nchan_group_t *shm_group) {
+  group_callback_t       *gcb, *next_gcb;
+  
+  for(gcb = gtn->when_ready_head; gcb != NULL; gcb = next_gcb) {
+    DBG("whenready for %p callback %s for group %V", gtn, gcb->label, &gtn->name);
+    next_gcb = gcb->next;
+    gcb->cb(shm_group ? NGX_OK : NGX_ERROR, shm_group , gcb->pd);
+    ngx_free(gcb);
+  }
+  gtn->when_ready_head = NULL;
+  gtn->when_ready_tail = NULL;
+}
+
+ngx_int_t memstore_group_find_from_groupnode(memstore_groups_t *gp, group_tree_node_t *gtn, callback_pt cb, void *pd) {
+  if(!gtn) {
+    cb(NGX_ERROR, NULL, pd);
+    return NGX_ERROR;
+  }
+  if(gtn->group) {
+    cb(NGX_OK, gtn->group, pd);
+  }
+  else {
+    add_whenready_callback(gtn, "group find", cb, pd);
+  }
+  return NGX_OK;
+}
+
+ngx_int_t memstore_group_find(memstore_groups_t *gp, ngx_str_t *name, callback_pt cb, void *pd) {
+#if NCHAN_DEBUG_GROUP_NOCACAHE
+  static int hmm = 0;
+  if(!hmm) {
+    nchan_add_interval_timer(jerk_group_clearer, gp, 100);
+    hmm = 1; 
+  }
+#endif
+  group_tree_node_t  *gtn = memstore_groupnode_get(gp, name);
+  return memstore_group_find_from_groupnode(gp, gtn, cb, pd);
+}
+
+group_tree_node_t *memstore_groupnode_get(memstore_groups_t *gp, ngx_str_t *name) {
+  ngx_rbtree_node_t      *node;
+  group_tree_node_t      *gtn = NULL;
+  ngx_int_t               owner;
+  if((node = rbtree_find_node(&gp->tree, name)) != NULL) {
+    gtn = rbtree_data_from_node(node);
+  }
+  else {
+    owner = memstore_str_owner(name);
+    if(owner == memstore_slot()) {
+      gtn = group_owner_create_node(gp, name);
+    }
+    else {
+      if((gtn = group_create_node(gp, name, NULL))!=NULL) {
+        gtn->getting_group=1;
+        memstore_ipc_send_get_group(memstore_str_owner(name), name);
+      }
+    }
+    if(!gtn) {
+      ERR("couldn't create groupnode for group %V", name);
+    }
+  }
+  return gtn;
+}
+
+ngx_int_t memstore_group_receive(memstore_groups_t *gp, nchan_group_t *shm_group) {
+  ngx_rbtree_node_t      *node;
+  group_tree_node_t      *gtn = NULL;
+  
+  assert(memstore_str_owner(&shm_group->name) != memstore_slot());
+  
+  DBG("memstore group receive %V", &shm_group->name);
+  
+  if((node = rbtree_find_node(&gp->tree, &shm_group->name)) != NULL) {
+    gtn = rbtree_data_from_node(node);  
+    gtn->group = shm_group;
+    gtn->getting_group = 0;
+    call_whenready_callbacks(gtn, shm_group);
+    
+#if NCHAN_DEBUG_GROUP_NOCACAHE
+    gtn->group = NULL;
+#endif
+    
+  }
+  else {
+    gtn = group_create_node(gp, &shm_group->name, shm_group);
+    DBG("created node %p", gtn);
+  }
+  
+  return NGX_OK;
+}
+
+ngx_int_t memstore_group_receive_delete(memstore_groups_t *gp, nchan_group_t *shm_group) {
+  memstore_channel_head_t    *cur;
+  group_tree_node_t          *gtn = NULL;
+  ngx_rbtree_node_t          *node;
+  DBG("receive GROUP DELETE for %V", &shm_group->name);
+  if((node = rbtree_find_node(&gp->tree, &shm_group->name)) != NULL) {
+    gtn = rbtree_data_from_node(node);
+  }
+  DBG("gtn is %V", gtn);
+  if(gtn) {
+    
+    call_whenready_callbacks(gtn, NULL);
+    
+    while((cur = gtn->owned_chanhead_head) != NULL) {
+      memstore_group_dissociate_own_channel(cur);
+      nchan_store_memory.delete_channel(&cur->id, cur->cf, NULL, NULL);
+    }
+  }
+  
+  return NGX_OK;
+}
+
+typedef struct {
+  callback_pt        cb;
+  void              *pd;
+  memstore_groups_t *gp;
+  unsigned           owned;
+} group_delete_callback_data_t;
+
+static ngx_int_t group_delete_callback(ngx_int_t rc, nchan_group_t *shm_group, group_delete_callback_data_t *d) {
+  static nchan_group_t  group;
+  if(shm_group) {
+    DBG("GROUP DELETE find_group callback for %V", &shm_group->name);
+    group = *shm_group;
+    if(d->owned) {
+      memstore_group_receive_delete(d->gp, shm_group);
+    }
+    memstore_ipc_broadcast_group_delete(shm_group);
+  }
+  else {
+    ERR("group for delete callback is NULL");
+    ngx_memzero(&group, sizeof(group));
+  }
+  d->cb(rc, &group, d->pd);
+  ngx_free(d);
+  return NGX_OK;
+}
+
+ngx_int_t memstore_group_delete(memstore_groups_t *gp, ngx_str_t *name, callback_pt cb, void *pd) {
+  group_tree_node_t            *gtn = NULL;
+  ngx_int_t                     owner = memstore_str_owner(name);
+  group_delete_callback_data_t *d;
+  
+  if((gtn = memstore_groupnode_get(gp, name)) == NULL) {
+    ERR("couldn't get groupnode for deletion");
+    cb(NGX_ERROR, NULL, pd);
+    return NGX_ERROR;
+  }
+  
+  if((d = ngx_alloc(sizeof(*d), ngx_cycle->log)) == NULL) {
+    ERR("couldn't alloc callback data for group deletion");
+    cb(NGX_ERROR, NULL, pd);
+    return NGX_ERROR;
+  }
+  
+  d->cb = cb;
+  d->pd = pd;
+  d->gp = gp;
+  d->owned = owner == memstore_slot();
+  DBG("start DELETE GROUP %V", &gtn->name);
+  return memstore_group_find(gp, &gtn->name, (callback_pt )group_delete_callback, d);
+}
+
+
+static void verify_gnd(memstore_channel_head_t *ch) {
+  /*
+  memstore_channel_head_t *cur;
+  int n=0, n2=0;
+  for(cur = ch; cur != NULL; cur = cur->groupnode_next) {
+    if(cur->groupnode_next) {
+      assert(cur->groupnode_next->groupnode_prev == cur);
+      n++;
+    }
+  }
+  for(cur = ch; cur != NULL; cur = cur->groupnode_prev) {
+    if(cur->groupnode_prev) {
+      assert(cur->groupnode_prev->groupnode_next == cur);
+      n++;
+    }
+  }
+
+  if(ch->groupnode) {
+    int prevnulls = 0;
+    int nextnulls = 0;
+    for(cur = ch->groupnode->owned_chanhead_head; cur != NULL; cur = cur->groupnode_next) {
+      n2++;
+      if(!cur->groupnode_prev) {
+        assert(++prevnulls <= 1);
+      }
+      else {
+        assert(cur->groupnode_prev->groupnode_next == cur);
+      }
+      
+      if(!cur->groupnode_next) {
+        assert(++nextnulls <= 1);
+      }
+      else {
+        assert(cur->groupnode_next->groupnode_prev == cur);
+      }
+    }
+    if(n>0) {
+      assert(n2 - 1 == n);
+    }
+  }
+  */
+}
+
+static void verify_gnd_ch_absent(memstore_channel_head_t *ch) {
+  /*memstore_channel_head_t *cur;
+  for(cur = ch->groupnode->owned_chanhead_head; cur != NULL; cur = cur->groupnode_next) {
+    assert(cur != ch);
+    if(cur->groupnode_prev) {      
+      assert(cur->groupnode_prev != ch);
+    }
+  }
+  */
+  /*memstore_channel_head_t *tmp;
+  HASH_ITER(hh, mpt->hash, cur, tmp) {
+    assert(cur->groupnode_prev != ch);
+    assert(cur->groupnode_next != ch);
+  }*/
+}
+
+
+void memstore_group_associate_own_channel(memstore_channel_head_t *ch) {
+  group_tree_node_t *gtn = ch->groupnode;
+  
+  verify_gnd(ch);
+  verify_gnd_ch_absent(ch);
+  
+  assert(ch->owner == memstore_slot());
+  
+  if(!ch->multi) {
+    ch->groupnode_next = gtn->owned_chanhead_head;
+    if(gtn->owned_chanhead_head) {
+      gtn->owned_chanhead_head->groupnode_prev = ch;
+    }
+    gtn->owned_chanhead_head = ch;
+    
+  }
+  
+  verify_gnd(ch);
+}
+
+void memstore_group_dissociate_own_channel(memstore_channel_head_t *ch) {
+  verify_gnd(ch);
+  assert(ch->owner == memstore_slot());
+  if(!ch->multi) {
+    if(ch->groupnode->owned_chanhead_head == ch) {
+      ch->groupnode->owned_chanhead_head = ch->groupnode_next;
+    }
+    if(ch->groupnode_prev) {
+      assert(ch->groupnode_prev->groupnode_next == ch);
+      ch->groupnode_prev->groupnode_next = ch->groupnode_next;
+    }
+    if(ch->groupnode_next) {
+      assert(ch->groupnode_next->groupnode_prev == ch);
+      ch->groupnode_next->groupnode_prev = ch->groupnode_prev;
+    }
+    
+    ch->groupnode_prev = NULL;
+    ch->groupnode_next = NULL;
+  }
+  assert(ch->groupnode->owned_chanhead_head != ch);
+  verify_gnd(ch);
+  verify_gnd_ch_absent(ch);
+}
+
+
+
+static ngx_int_t group_add_channel_internal(nchan_group_t *shm_group, int multi, int self_owned, int n) {
+  if(shm_group) {
+    if(multi) {
+      ngx_atomic_fetch_add((ngx_atomic_uint_t *)&shm_group->multiplexed_channels, n);
+    }
+    else if (self_owned) {
+      ngx_atomic_fetch_add((ngx_atomic_uint_t *)&shm_group->channels, n);
+    }
+  }
+  return NGX_OK;
+}
+
+typedef struct {
+  int       n;
+  unsigned  multi:1;
+  unsigned  self_owned:1;
+} add_channel_count_callback_data_t;
+
+static ngx_int_t group_add_channel_callback(ngx_int_t rc, nchan_group_t *shm_group, add_channel_count_callback_data_t *d) {
+  group_add_channel_internal(shm_group, d->multi, d->self_owned, d->n);
+  ngx_free(d);
+  return NGX_OK;
+}
+
+static ngx_int_t memstore_group_add_channel_generic(memstore_channel_head_t *ch, int n) {
+  int self_owned = ch->owner == memstore_slot();
+  if(ch->groupnode->group) {
+    group_add_channel_internal(ch->groupnode->group, ch->multi != NULL, self_owned, n);
+  }
+  else {
+    add_channel_count_callback_data_t             *d = ngx_alloc(sizeof(*d), ngx_cycle->log);
+    if(!d) {
+      ERR("Couldn't allocate group_add_channel data");
+      return NGX_ERROR;
+    }
+    else {
+      d->n = n;
+      d->multi = ch->multi != NULL;
+      d->self_owned = self_owned;
+      add_whenready_callback(ch->groupnode, "add channel", (callback_pt )group_add_channel_callback, d);
+    }
+  }
+  return NGX_OK;
+}
+
+ngx_int_t memstore_group_add_channel(memstore_channel_head_t *ch) {
+  return memstore_group_add_channel_generic(ch, 1);
+}
+
+ngx_int_t memstore_group_remove_channel(memstore_channel_head_t *ch) {
+  return memstore_group_add_channel_generic(ch, -1);
+}
+
+static ngx_int_t group_add_message_internal(nchan_group_t *shm_group, size_t mem_sz, size_t file_sz, int n) {
+  
+  if(shm_group) {
+    ngx_atomic_fetch_add((ngx_atomic_uint_t *)&shm_group->messages, n);
+    ngx_atomic_fetch_add((ngx_atomic_uint_t *)&shm_group->messages_shmem_bytes, n * mem_sz);
+    if(file_sz > 0) {
+      ngx_atomic_fetch_add((ngx_atomic_uint_t *)&shm_group->messages_file_bytes, n * file_sz);
+    }
+  }
+  return NGX_OK;
+}
+
+typedef struct {
+  int n;
+  size_t mem_sz;
+  size_t file_sz;
+} add_message_callback_data_t;
+
+static ngx_int_t group_add_message_callback(ngx_int_t rc, nchan_group_t *shm_group, add_message_callback_data_t *d) {
+  group_add_message_internal(shm_group, d->mem_sz, d->file_sz, d->n);
+  ngx_free(d);
+  return NGX_OK;
+}
+
+static ngx_int_t memstore_group_add_message_generic(group_tree_node_t *gtn, nchan_msg_t *msg, int n) {
+  size_t         mem_sz = memstore_msg_memsize(msg);
+  size_t         file_sz = ngx_buf_in_memory_only((&msg->buf)) ? 0 : ngx_buf_size((&msg->buf));
+  if(gtn->group) {
+    group_add_message_internal(gtn->group, mem_sz, file_sz, n);
+  }
+  else {
+    add_message_callback_data_t *d = ngx_alloc(sizeof(*d), ngx_cycle->log);
+    if(!d) {
+      ERR("Couldn't allocate group_add_message data");
+      return NGX_ERROR;
+    }
+    else {
+      d->n = n;
+      d->mem_sz = mem_sz;
+      d->file_sz = file_sz;
+      add_whenready_callback(gtn, "add message", (callback_pt )group_add_message_callback, d);
+    }
+  }
+  return NGX_OK;
+}
+
+ngx_int_t memstore_group_add_message(group_tree_node_t *gtn, nchan_msg_t *msg) {
+  return memstore_group_add_message_generic(gtn, msg, 1);
+}
+
+ngx_int_t memstore_group_remove_message(group_tree_node_t *gtn, nchan_msg_t *msg) {
+  return memstore_group_add_message_generic(gtn, msg, -1);
+}
+
+
+
+static ngx_int_t group_add_subscribers_internal(nchan_group_t *shm_group, int n) {
+  if(shm_group) {
+    ngx_atomic_fetch_add((ngx_atomic_uint_t *)&shm_group->subscribers, n);
+  }
+  return NGX_OK;
+}
+
+static ngx_int_t group_add_subscribers_callback(ngx_int_t rc, nchan_group_t *shm_group, void *pd) {
+  intptr_t    n = (intptr_t )pd;
+  group_add_subscribers_internal(shm_group, n);
+  return NGX_OK;
+}
+
+ngx_int_t memstore_group_add_subscribers(group_tree_node_t *gtn, int count) {
+  if(gtn->group) {
+    group_add_subscribers_internal(gtn->group, count);
+  }
+  else {
+    add_whenready_callback(gtn, "add subscribers", (callback_pt )group_add_subscribers_callback, (void *)(intptr_t )count);
+  }
+  return NGX_OK;
+}
diff --git a/debian/modules/nchan/src/store/memory/groups.h b/debian/modules/nchan/src/store/memory/groups.h
new file mode 100644
index 00000000..6fc80dd6
--- /dev/null
+++ b/debian/modules/nchan/src/store/memory/groups.h
@@ -0,0 +1,55 @@
+ #ifndef MEMSTORE_GROUPS_HEADER
+#define MEMSTORE_GROUPS_HEADER
+#include <nchan_module.h>
+#include <util/nchan_rbtree.h>
+
+typedef struct {
+  rbtree_seed_t           tree;
+} memstore_groups_t;
+
+typedef struct group_tree_node_s group_tree_node_t ;
+
+#include "store-private.h"
+
+typedef struct group_callback_s group_callback_t ;
+struct group_callback_s {
+  callback_pt         cb;
+  void               *pd;
+  group_callback_t   *next;
+  char               *label;
+};
+
+struct group_tree_node_s {
+  ngx_str_t                 name; //local memory copy of group name
+  nchan_group_t            *group;
+  group_callback_t         *when_ready_head;
+  group_callback_t         *when_ready_tail;
+  memstore_channel_head_t  *owned_chanhead_head;
+  time_t                    getting_group;
+};
+
+ngx_int_t memstore_groups_init(memstore_groups_t *);
+ngx_int_t memstore_groups_shutdown(memstore_groups_t *);
+
+
+ngx_int_t memstore_group_find(memstore_groups_t *gp, ngx_str_t *name, callback_pt cb, void *pd);
+ngx_int_t memstore_group_find_from_groupnode(memstore_groups_t *gp, group_tree_node_t *gtn, callback_pt cb, void *pd);
+
+
+group_tree_node_t *memstore_groupnode_get(memstore_groups_t *gp, ngx_str_t *name);
+nchan_group_t *memstore_group_owner_find(memstore_groups_t *gp, ngx_str_t *name, int *group_just_created);
+ngx_int_t memstore_group_receive(memstore_groups_t *gp, nchan_group_t *shm_group);
+ngx_int_t memstore_group_delete(memstore_groups_t *gp, ngx_str_t *name, callback_pt cb, void *pd);
+ngx_int_t memstore_group_receive_delete(memstore_groups_t *gp, nchan_group_t *shm_group);
+
+ngx_int_t memstore_group_add_channel(memstore_channel_head_t *ch);
+ngx_int_t memstore_group_remove_channel(memstore_channel_head_t *ch);
+
+void memstore_group_associate_own_channel(memstore_channel_head_t *ch);
+void memstore_group_dissociate_own_channel(memstore_channel_head_t *ch);
+
+ngx_int_t memstore_group_add_message(group_tree_node_t *gtn, nchan_msg_t *msg);
+ngx_int_t memstore_group_remove_message(group_tree_node_t *gtn, nchan_msg_t *msg);
+
+ngx_int_t memstore_group_add_subscribers(group_tree_node_t *gtn, int count);
+#endif //MEMSTORE_GROUPS_HEADER
diff --git a/debian/modules/nchan/src/store/memory/ipc-handlers.c b/debian/modules/nchan/src/store/memory/ipc-handlers.c
index 6656b076..8203b0c7 100644
--- a/debian/modules/nchan/src/store/memory/ipc-handlers.c
+++ b/debian/modules/nchan/src/store/memory/ipc-handlers.c
@@ -7,30 +7,65 @@
 #include <assert.h>
 #include <store/redis/store.h>
 #include <subscribers/memstore_ipc.h>
+#include <subscribers/getmsg_proxy.h>
 #include <subscribers/memstore_redis.h>
-#include <util/nchan_msgid.h>
-
-#define IPC_SUBSCRIBE               1
-#define IPC_SUBSCRIBE_REPLY         2
-#define IPC_UNSUBSCRIBE             3  //NOT USED
-#define IPC_UNSUBSCRIBED            4
-#define IPC_PUBLISH_MESSAGE         5
-#define IPC_PUBLISH_MESSAGE_REPLY   6
-#define IPC_PUBLISH_STATUS          7
-#define IPC_PUBLISH_STATUS_REPLY    8
-#define IPC_GET_MESSAGE             9
-#define IPC_GET_MESSAGE_REPLY       10
-#define IPC_DELETE                  11
-#define IPC_DELETE_REPLY            12
-#define IPC_GET_CHANNEL_INFO        13
-#define IPC_GET_CHANNEL_INFO_REPLY  14
-#define IPC_GET_CHANNEL_AUTHCHECK   15
-#define IPC_GET_CHANNEL_AUTHCHECK_REPLY 16
-#define IPC_SUBSCRIBER_KEEPALIVE    17
-#define IPC_SUBSCRIBER_KEEPALIVE_REPLY 18
-
-#define IPC_TEST_FLOOD                 30
+#include <util/nchan_msg.h>
+#include <util/nchan_benchmark.h>
+
+
+//macro black magic, AKA X-Macros
+#define LIST_IPC_COMMANDS(L) \
+  L(subscribe) \
+  L(subscribe_reply) \
+  L(subscribe_chanhead_release) \
+  L(subscribe_chanhead_nevermind_release) \
+  L(unsubscribed) \
+  L(publish_message) \
+  L(publish_message_reply) \
+  L(publish_status) \
+  L(publish_notice) \
+  L(get_message) \
+  L(get_message_reply) \
+  L(delete) \
+  L(delete_reply) \
+  L(get_channel_info) \
+  L(get_channel_info_reply) \
+  L(channel_auth_check) \
+  L(channel_auth_check_reply) \
+  L(subscriber_keepalive) \
+  L(subscriber_keepalive_reply) \
+  L(get_group) \
+  L(group) \
+  L(group_delete) \
+  L(flood_test) \
+  L(benchmark_initialize) \
+  L(benchmark_start) \
+  L(benchmark_stop) \
+  L(benchmark_abort) \
+  L(benchmark_finish) \
+  L(benchmark_finish_reply) \
+
+
+
+#define MAKE_ipc_handlers_t(val) ipc_handler_pt val;
+typedef struct {
+  LIST_IPC_COMMANDS(MAKE_ipc_handlers_t)
+} ipc_handlers_t;
+
+#define MAKE_ipc_command_codes_t(val) int val;
+typedef struct {
+  LIST_IPC_COMMANDS(MAKE_ipc_command_codes_t);
+} ipc_command_codes_t;
 
+#define MAKE_ipc_cmd(val) offsetof(ipc_handlers_t, val)/sizeof(ipc_handler_pt),
+static ipc_command_codes_t ipc_cmd = {
+  LIST_IPC_COMMANDS(MAKE_ipc_cmd)
+};
+
+#define IPC_CMDS (sizeof(ipc_handlers_t)/sizeof(ipc_handler_pt))
+
+#define ipc_cmd(cmd, dst, data) ipc_alert(nchan_memstore_get_ipc(), dst, ipc_cmd.cmd, data, sizeof(*(data)))
+#define ipc_broadcast_cmd(cmd, data) ipc_broadcast_alert(nchan_memstore_get_ipc(), ipc_cmd.cmd, data, sizeof(*(data)))
 
 //#define DEBUG_LEVEL NGX_LOG_WARN
 #define DEBUG_LEVEL NGX_LOG_DEBUG
@@ -53,28 +88,27 @@ static nchan_msg_id_t zero_msgid = NCHAN_ZERO_MSGID;
 
 static ngx_str_t *str_shm_copy(ngx_str_t *str){
   ngx_str_t *out;
-  out = shm_copy_immutable_string(nchan_memstore_get_shm(), str);
-  DBG("create shm_str %p (data@ %p) %V", out, out->data, out);
+  out = shm_copy_immutable_string(nchan_store_memory_shmem, str);
+  if(out) {
+    DBG("create shm_str %p (data@ %p) %V", out, out->data, out);
+  }
   return out;
 }
 
 static void str_shm_free(ngx_str_t *str) {
   DBG("free shm_str %V @ %p", str, str->data);
-  shm_free_immutable_string(nchan_memstore_get_shm(), str);
+  shm_free_immutable_string(nchan_store_memory_shmem, str);
 }
 
 ////////// SUBSCRIBE ////////////////
-union subdata_u {
-  memstore_channel_head_t     *origin_chanhead;
-  subscriber_t                *subscriber;
-};
-
 typedef struct {
   ngx_str_t                   *shm_chid;
   store_channel_head_shm_t    *shared_channel_data;
   nchan_loc_conf_t            *cf;
-  union subdata_u              d;
-  
+  memstore_channel_head_t     *origin_chanhead;
+  memstore_channel_head_t     *owner_chanhead;
+  subscriber_t                *subscriber;
+  ngx_int_t                    rc;
 } subscribe_data_t;
 
 ngx_int_t memstore_ipc_send_subscribe(ngx_int_t dst, ngx_str_t *chid, memstore_channel_head_t *origin_chanhead, nchan_loc_conf_t *cf) {
@@ -84,40 +118,53 @@ ngx_int_t memstore_ipc_send_subscribe(ngx_int_t dst, ngx_str_t *chid, memstore_c
   DEBUG_MEMZERO(&data);
   
   if((data.shm_chid = str_shm_copy(chid)) == NULL) {
-    ERR("Out of shared memory, can't send IPC subscrive alert");
+    nchan_log_ooshm_error("sending IPC subscribe alert for channel %V", chid);
     return NGX_DECLINED;
   }
   data.shared_channel_data = NULL;
-  data.d.origin_chanhead = origin_chanhead;
+  data.origin_chanhead = origin_chanhead;
+  data.owner_chanhead = NULL;
   data.cf = cf;
   
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_SUBSCRIBE, &data, sizeof(data));
+  assert(memstore_str_owner(data.shm_chid) == dst);
+  
+  return ipc_cmd(subscribe, dst, &data);
 }
 static void receive_subscribe(ngx_int_t sender, subscribe_data_t *d) {
   memstore_channel_head_t    *head;
   subscriber_t               *ipc_sub = NULL;
+  ngx_int_t                   rc;
   
   DBG("received subscribe request for channel %V", d->shm_chid);
   head = nchan_memstore_get_chanhead(d->shm_chid, d->cf);
   
   if(head == NULL) {
-    ERR("couldn't get chanhead while receiving subscribe ipc msg");
+    //ERR("couldn't get chanhead while receiving subscribe ipc msg");
     d->shared_channel_data = NULL;
-    d->d.subscriber = NULL;
+    d->subscriber = NULL;
   }
   else {
-    ipc_sub = memstore_ipc_subscriber_create(sender, &head->id, d->cf, d->d.origin_chanhead);
-    d->d.subscriber = ipc_sub;
+    ipc_sub = memstore_ipc_subscriber_create(sender, &head->id, d->cf, d->origin_chanhead);
+    d->subscriber = ipc_sub;
     d->shared_channel_data = head->shared;
+    d->owner_chanhead = head;
+    memstore_chanhead_reserve(head, "interprocess subscribe");
+    
+    ngx_atomic_fetch_add(&head->shared->gc.outside_refcount, 1); //it's awkward to put this refcount here, but necessary.
+    
     assert(d->shared_channel_data);
   }
   
-  ipc_alert(nchan_memstore_get_ipc(), sender, IPC_SUBSCRIBE_REPLY, d, sizeof(*d));
-  DBG("sent subscribe reply for channel %V to %i", d->shm_chid, sender);
-  
   if(ipc_sub) {
-    head->spooler.fn->add(&head->spooler, ipc_sub);
+    rc = head->spooler.fn->add(&head->spooler, ipc_sub);
+    d->rc = rc;
   }
+  else {
+    d->rc = NGX_ERROR;
+  }
+  
+  ipc_cmd(subscribe_reply, sender, d);
+  DBG("sent subscribe reply for channel %V to %i", d->shm_chid, sender);
 }
 static void receive_subscribe_reply(ngx_int_t sender, subscribe_data_t *d) {
   memstore_channel_head_t      *head;
@@ -125,48 +172,87 @@ static void receive_subscribe_reply(ngx_int_t sender, subscribe_data_t *d) {
   DBG("received subscribe reply for channel %V", d->shm_chid);
   //we have the chanhead address, but are too afraid to use it.
   
-  if(!d->shared_channel_data && !d->d.subscriber) {
-    ERR("failed to subscribe");
-    return;
-  }
-  
   if((head = nchan_memstore_get_chanhead_no_ipc_sub(d->shm_chid, d->cf)) == NULL) {
     ERR("Error regarding an aspect of life or maybe freshly fallen cookie crumbles");
+    str_shm_free(d->shm_chid);
     return;
   }
   
-  old_shared = head->shared;
-  if(old_shared) {
-    assert(old_shared == d->shared_channel_data);
+  if(head != d->origin_chanhead) {    
+    assert(d->owner_chanhead);
+    ipc_cmd(subscribe_chanhead_nevermind_release, sender, d);
+    return;
   }
-  DBG("receive subscribe proceed to do ipc_sub stuff");
-  head->shared = d->shared_channel_data;
   
-  if(old_shared == NULL) {
-    //ERR("%V local total_sub_count %i, internal_sub_count %i", &head->id,  head->sub_count, head->internal_sub_count);
-    assert(head->total_sub_count >= head->internal_sub_count);
-    ngx_atomic_fetch_add(&head->shared->sub_count, head->total_sub_count - head->internal_sub_count);
-    ngx_atomic_fetch_add(&head->shared->internal_sub_count, head->internal_sub_count);
+  if(!d->shared_channel_data && !d->subscriber) {
+    //ERR("failed to subscribe");
+    nchan_memstore_publish_generic(head, NULL, NGX_HTTP_INSUFFICIENT_STORAGE, NULL);
+    head->status = NOTREADY;
+    chanhead_gc_add(head, "failed to subscribe to channel owner worker");
   }
   else {
-    ERR("%V sub count already shared, don't update", &head->id);
+    old_shared = head->shared;
+    if(old_shared) {
+      assert(old_shared == d->shared_channel_data);
+    }
+    DBG("receive subscribe proceed to do ipc_sub stuff");
+    head->shared = d->shared_channel_data;
+    
+    if(old_shared == NULL) {
+      //ERR("%V local total_sub_count %i, internal_sub_count %i", &head->id,  head->sub_count, head->internal_sub_count);
+      assert(head->total_sub_count >= head->internal_sub_count);
+      ngx_atomic_fetch_add(&head->shared->sub_count, head->total_sub_count - head->internal_sub_count);
+      ngx_atomic_fetch_add(&head->shared->internal_sub_count, head->internal_sub_count);
+    }
+    else {
+      ERR("%V sub count already shared, don't update", &head->id);
+    }
+    
+    assert(head->shared != NULL);
+    if(head->foreign_owner_ipc_sub && head->foreign_owner_ipc_sub != d->subscriber) {
+      // we got another subscriber for this chanhead, probably due to some very heavy delays
+      // discard it, keeping the old one.
+      // (It might be nice to discard the _old_ subscriber, but the owner worker may have already deleted it
+      // or may have changed altogether due to a previous worker crash)
+      ERR("Got ipc-subscriber for an already subscribed channel %V", &head->id);
+      memstore_ready_chanhead_unless_stub(head);
+      ipc_cmd(subscribe_chanhead_nevermind_release, sender, d);
+      return;
+    }
+    else {
+      head->foreign_owner_ipc_sub = d->subscriber;
+    }
+    
+    memstore_ready_chanhead_unless_stub(head);
   }
   
-  assert(head->shared != NULL);
-  if(head->foreign_owner_ipc_sub) {
-    assert(head->foreign_owner_ipc_sub == d->d.subscriber);
+  str_shm_free(d->shm_chid);
+  if(d->owner_chanhead) {
+    ipc_cmd(subscribe_chanhead_release, sender, d);
   }
-  else {
-    head->foreign_owner_ipc_sub = d->d.subscriber;
+}
+
+static void receive_subscribe_chanhead_release(ngx_int_t sender, subscribe_data_t *d) {
+  DBG("release the %V", &d->owner_chanhead->id);
+  memstore_chanhead_release(d->owner_chanhead, "interprocess subscribe");
+}
+static void receive_subscribe_chanhead_nevermind_release(ngx_int_t sender, subscribe_data_t *d) {
+  ERR("release & nevermind the %V", &d->owner_chanhead->id);
+  memstore_channel_head_t      *head;
+  head = nchan_memstore_find_chanhead(d->shm_chid);
+  if(head == NULL || head != d->owner_chanhead) {
+    ERR("wrong chanhead on receive_subscribe_chanhead_nevermind_release ( expected %p, got %p)", d->owner_chanhead, head);
+    return;
   }
   
-  memstore_ready_chanhead_unless_stub(head);
+  memstore_ipc_subscriber_unhook(d->subscriber);
+  d->subscriber->fn->respond_status(d->subscriber, NGX_HTTP_GONE, NULL, NULL);
   
+  memstore_chanhead_release(d->owner_chanhead, "interprocess subscribe");
   str_shm_free(d->shm_chid);
 }
 
 
-
 ////////// UNSUBSCRIBED ////////////////
 typedef struct {
   ngx_str_t    *shm_chid;
@@ -177,10 +263,10 @@ ngx_int_t memstore_ipc_send_unsubscribed(ngx_int_t dst, ngx_str_t *chid, void* p
   DBG("send unsubscribed to %i %V", dst, chid);
   unsubscribed_data_t        data = {str_shm_copy(chid), privdata};
   if(data.shm_chid == NULL) {
-    ERR("Out of shared memory, can't send IPC unsubscribe alert");
+    nchan_log_ooshm_error("sending IPC unsubscribe alert for channel %V", chid);
     return NGX_DECLINED;
   }
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_UNSUBSCRIBED, &data, sizeof(data));
+  return ipc_cmd(unsubscribed, dst, &data);
 }
 static void receive_unsubscribed(ngx_int_t sender, unsubscribed_data_t *d) {
   DBG("received unsubscribed request for channel %V privdata %p", d->shm_chid, d->privdata);
@@ -213,23 +299,23 @@ static void receive_unsubscribed(ngx_int_t sender, unsubscribed_data_t *d) {
 ////////// PUBLISH STATUS ////////////////
 typedef struct {
   ngx_str_t                 *shm_chid;
-  ngx_int_t                  status_code;
-  const ngx_str_t           *status_line;
+  ngx_int_t                  code;
+  const ngx_str_t           *data;
   callback_pt                callback;
   void                      *callback_privdata;
-} publish_status_data_t;
+} publish_code_data_t;
 
 ngx_int_t memstore_ipc_send_publish_status(ngx_int_t dst, ngx_str_t *chid, ngx_int_t status_code, const ngx_str_t *status_line, callback_pt callback, void *privdata) {
   DBG("IPC: send publish status to %i ch %V", dst, chid);
-  publish_status_data_t  data = {str_shm_copy(chid), status_code, status_line, callback, privdata};
+  publish_code_data_t  data = {str_shm_copy(chid), status_code, status_line, callback, privdata};
   if(data.shm_chid == NULL) {
+    nchan_log_ooshm_error("sending IPC status alert for channel %V", chid);
     return NGX_DECLINED;
   }
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_PUBLISH_STATUS, &data, sizeof(data));
+  return ipc_cmd(publish_status, dst, &data);
 }
 
-static void receive_publish_status(ngx_int_t sender, publish_status_data_t *d) {
-  static ngx_str_t               nullstring = ngx_null_string;
+static void receive_publish_status(ngx_int_t sender, publish_code_data_t *d) {
   memstore_channel_head_t       *chead;
   
   if((chead = nchan_memstore_find_chanhead(d->shm_chid)) == NULL) {
@@ -237,20 +323,52 @@ static void receive_publish_status(ngx_int_t sender, publish_status_data_t *d) {
       ERR("can't find chanhead for id %V, but it's okay.", d->shm_chid);
     }
     else {
-      ERR("can't find chanhead for id %V", d->shm_chid);
-      assert(0);
+      ERR("Can't find chanhead for id %V while publishing status %i. This is not a big deal if you just reloaded Nchan.", d->shm_chid, d->code);
     }
+    str_shm_free(d->shm_chid);
     return;
   }
   
-  DBG("IPC: received publish status for channel %V status %i %s", d->shm_chid, d->status_code, d->status_line == NULL ? &nullstring : d->status_line);
+  DBG("IPC: received publish status for channel %V status %i", d->shm_chid, d->code);
   
-  nchan_memstore_publish_generic(chead, NULL, d->status_code, d->status_line);
+  nchan_memstore_publish_generic(chead, NULL, d->code, d->data);
   
   str_shm_free(d->shm_chid);
   d->shm_chid=NULL;
 }
 
+////////// PUBLISH_NOTICE ////////////////
+ngx_int_t memstore_ipc_send_publish_notice(ngx_int_t dst, ngx_str_t *chid, ngx_int_t notice_code, void *notice_data) {
+  DBG("IPC: send publish notice to %i ch %V", dst, chid);
+  publish_code_data_t  data = {str_shm_copy(chid), notice_code, notice_data, NULL, NULL};
+  if(data.shm_chid == NULL) {
+    nchan_log_ooshm_error("sending IPC notice alert for channel %V", chid);
+    return NGX_DECLINED;
+  }
+  return ipc_cmd(publish_notice, dst, &data);
+}
+
+static void receive_publish_notice(ngx_int_t sender, publish_code_data_t *d) {
+  memstore_channel_head_t       *chead;
+  
+  if((chead = nchan_memstore_find_chanhead(d->shm_chid)) == NULL) {
+    if(ngx_exiting || ngx_quit) {
+      ERR("can't find chanhead for id %V, but it's okay.", d->shm_chid);
+    }
+    else {
+      ERR("Can't find chanhead for id %V while publishing status %i. This is not a big deal if you just reloaded Nchan.", d->shm_chid, d->code);
+    }
+    str_shm_free(d->shm_chid);
+    return;
+  }
+  
+  DBG("IPC: received publish notice for channel %V notice %i", d->shm_chid, d->code);
+  
+  nchan_memstore_publish_notice(chead, d->code, d->data);
+  
+  str_shm_free(d->shm_chid);
+}
+
 ////////// PUBLISH  ////////////////
 typedef struct {
   ngx_str_t                 *shm_chid;
@@ -266,11 +384,11 @@ ngx_int_t memstore_ipc_send_publish_message(ngx_int_t dst, ngx_str_t *chid, ncha
   DEBUG_MEMZERO(&data);
   
   DBG("IPC: send publish message to %i ch %V", dst, chid);
-  assert(shm_msg->shared == 1);
-  assert(shm_msg->temp_allocd == 0);
+  assert(shm_msg->storage == NCHAN_MSG_SHARED);
   assert(chid->data != NULL);
   data.shm_chid = str_shm_copy(chid);
   if(data.shm_chid == NULL) {
+    nchan_log_ooshm_error("sending IPC publish-message alert for channel %V", chid);
     return NGX_DECLINED;
   }
   data.shm_msg = shm_msg;
@@ -281,7 +399,7 @@ ngx_int_t memstore_ipc_send_publish_message(ngx_int_t dst, ngx_str_t *chid, ncha
   assert(data.shm_chid->data != NULL);
   assert(msg_reserve(shm_msg, "publish_message") == NGX_OK);
   
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_PUBLISH_MESSAGE, &data, sizeof(data));
+  return ipc_cmd(publish_message, dst, &data);
 }
 
 typedef struct {
@@ -365,7 +483,7 @@ static ngx_int_t publish_message_generic_callback(ngx_int_t status, void *rptr,
     rd.msg_time = ch->last_published_msg_id.time;
     rd.msg_tag = ch->last_published_msg_id.tag.fixed[0];
   }
-  ipc_alert(nchan_memstore_get_ipc(), cd->sender, IPC_PUBLISH_MESSAGE_REPLY, &rd, sizeof(rd));
+  ipc_cmd(publish_message_reply, cd->sender, &rd);
   if(cd->allocd) {
     ngx_free(cd);
   }
@@ -407,29 +525,34 @@ typedef struct {
 ngx_int_t memstore_ipc_send_get_message(ngx_int_t dst, ngx_str_t *chid, nchan_msg_id_t *msgid, void *privdata) {
   getmessage_data_t      data;
   
-  if((data.shm_chid= str_shm_copy(chid)) == NULL) {
-    return NGX_ERROR;
+  if((data.shm_chid = str_shm_copy(chid)) == NULL) {
+    nchan_log_ooshm_error("sending IPC get-message alert for channel %V", chid);
+    return NGX_DECLINED;
   }
   data.privdata = privdata;
   data.d.req.msgid = *msgid;
   
   DBG("IPC: send get message from %i ch %V", dst, chid);
-  assert(data.shm_chid->len>1);
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_GET_MESSAGE, &data, sizeof(data));
+  assert(data.shm_chid->len >= 1);
+  return ipc_cmd(get_message, dst, &data);
 }
 
 
 typedef struct {
   ngx_int_t            sender;
   getmessage_data_t    data;
-} getmessage_data_rsub_pd_t;
-
-static void ipc_handler_notify_on_MSG_EXPECTED_callback(nchan_msg_status_t status, void *pd) {
-  assert(status == MSG_EXPECTED || status == MSG_NORESPONSE);
-  getmessage_data_rsub_pd_t *gd = (getmessage_data_rsub_pd_t *)pd;
-  gd->data.d.resp.getmsg_code = status;
-  gd->data.d.resp.shm_msg = NULL;
-  ipc_alert(nchan_memstore_get_ipc(), gd->sender, IPC_GET_MESSAGE_REPLY, &gd->data, sizeof(gd->data));
+} getmessage_data_proxy_pd_t;
+
+//for retrieving messages from unready buffers
+static ngx_int_t ipc_getmsg_proxy_callback(ngx_int_t code, nchan_msg_t *msg, getmessage_data_proxy_pd_t *ppd) {
+  ppd->data.d.resp.getmsg_code = code;
+  ppd->data.d.resp.shm_msg = msg;
+  if(msg) {
+    assert(msg_reserve(msg, "get_message_reply") == NGX_OK);
+  }
+  ipc_cmd(get_message_reply, ppd->sender, &ppd->data);
+  ngx_free(ppd);
+  return NGX_OK;
 }
 
 static void receive_get_message(ngx_int_t sender, getmessage_data_t *d) {
@@ -437,7 +560,7 @@ static void receive_get_message(ngx_int_t sender, getmessage_data_t *d) {
   store_message_t             *msg = NULL;
   
   
-  assert(d->shm_chid->len>1);
+  assert(d->shm_chid->len >= 1);
   assert(d->shm_chid->data!=NULL);
   DBG("IPC: received get_message request for channel %V privdata %p", d->shm_chid, d->privdata);
   
@@ -447,32 +570,47 @@ static void receive_get_message(ngx_int_t sender, getmessage_data_t *d) {
     d->d.resp.getmsg_code = MSG_NOTFOUND;
     d->d.resp.shm_msg = NULL;
   }
+  else if(head->msg_buffer_complete) {
+    msg = chanhead_find_next_message(head, &d->d.req.msgid, &d->d.resp.getmsg_code);
+    d->d.resp.shm_msg = msg == NULL ? NULL : msg->msg;
+  }
   else {
-    nchan_msg_status_t           status;
-    msg = chanhead_find_next_message(head, &d->d.req.msgid, &status);
-    
-    if(msg == NULL && head->cf && head->cf->redis.enabled) {
-      //messages from redis are not requested explicitly, but are delivered from oldest to newest
-      //by the memmstore-redis subscriber. 
-      getmessage_data_rsub_pd_t  rdata = {sender, *d};
-      
-      nchan_memstore_redis_subscriber_notify_on_MSG_EXPECTED(head->redis_sub, &d->d.req.msgid, ipc_handler_notify_on_MSG_EXPECTED_callback, sizeof(rdata), &rdata);
-      return;
+    //buffer is not ready. reply when it's ready
+    getmessage_data_proxy_pd_t *ppd = ngx_alloc(sizeof(*ppd), ngx_cycle->log);
+    if(ppd == NULL) {
+      ERR("couldn't allocate getmessage proxy data for ipc get_message");
+      goto err;
     }
+    ppd->data = *d;
+    ppd->sender = sender;
     
-    d->d.resp.getmsg_code = status;
-    d->d.resp.shm_msg = msg == NULL ? NULL : msg->msg;
+    subscriber_t *getmsg_sub = getmsg_proxy_subscriber_create(&d->d.req.msgid, (callback_pt )ipc_getmsg_proxy_callback, ppd);
+    if(!getmsg_sub) {
+      ERR("couldn't allocate getmessage proxy subscriber for ipc get_message");
+      goto err;
+    }
+    if(head->spooler.fn->add(&head->spooler, getmsg_sub) != NGX_OK) {
+      ERR("couldn't enqueue getmsg proxy subscriber for ipc get_message");
+      goto err;
+    }
+    return;
   }
   if(d->d.resp.shm_msg) {
     assert(msg_reserve(d->d.resp.shm_msg, "get_message_reply") == NGX_OK);
   }
   DBG("IPC: send get_message_reply for channel %V  msg %p, privdata: %p", d->shm_chid, msg, d->privdata);
-  ipc_alert(nchan_memstore_get_ipc(), sender, IPC_GET_MESSAGE_REPLY, d, sizeof(*d));
+  ipc_cmd(get_message_reply, sender, d);
+  return;
+
+err:
+  d->d.resp.getmsg_code = MSG_ERROR;
+  d->d.resp.shm_msg = NULL;
+  ipc_cmd(get_message_reply, sender, d);
 }
 
 static void receive_get_message_reply(ngx_int_t sender, getmessage_data_t *d) {
   
-  assert(d->shm_chid->len>1);
+  assert(d->shm_chid->len >= 1);
   assert(d->shm_chid->data!=NULL);
   DBG("IPC: received get_message reply for channel %V msg %p privdata %p", d->shm_chid, d->d.resp.shm_msg, d->privdata);
   nchan_memstore_handle_get_message_reply(d->d.resp.shm_msg, d->d.resp.getmsg_code, d->privdata);
@@ -498,10 +636,11 @@ typedef struct {
 ngx_int_t memstore_ipc_send_delete(ngx_int_t dst, ngx_str_t *chid, callback_pt callback,void *privdata) {
   delete_data_t  data = {str_shm_copy(chid), 0, NULL, 0, callback, privdata};
   if(data.shm_chid == NULL) {
-    return NGX_ERROR;
+    nchan_log_ooshm_error("sending IPC send-delete alert for channel %V", chid);
+    return NGX_DECLINED;
   }
   DBG("IPC: send delete to %i ch %V", dst, chid);
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_DELETE, &data, sizeof(data));
+  return ipc_cmd(delete, dst, &data);
 }
 
 static ngx_int_t delete_callback_handler(ngx_int_t, nchan_channel_t *, delete_data_t *);
@@ -517,10 +656,10 @@ static ngx_int_t delete_callback_handler(ngx_int_t code, nchan_channel_t *chan,
   
   d->code = code;
   if (chan) {
-    if((chan_info = shm_alloc(nchan_memstore_get_shm(), sizeof(*chan_info), "channel info for delete IPC response")) == NULL) {
+    if((chan_info = shm_alloc(nchan_store_memory_shmem, sizeof(*chan_info), "channel info for delete IPC response")) == NULL) {
       d->shm_channel_info = NULL;
-      //yeah
-      ERR("unable to allocate chan_info");
+      d->code = NGX_HTTP_INSUFFICIENT_STORAGE;
+      nchan_log_ooshm_error("sending IPC delete-reply alert for channel %V", d->shm_chid);
     }
     else {
       d->shm_channel_info= chan_info;
@@ -541,7 +680,7 @@ static ngx_int_t delete_callback_handler(ngx_int_t code, nchan_channel_t *chan,
   else {
     d->shm_channel_info = NULL;
   }
-  ipc_alert(nchan_memstore_get_ipc(), d->sender, IPC_DELETE_REPLY, d, sizeof(*d));
+  ipc_cmd(delete_reply, d->sender, d);
   return NGX_OK;
 }
 static void receive_delete_reply(ngx_int_t sender, delete_data_t *d) {
@@ -550,7 +689,7 @@ static void receive_delete_reply(ngx_int_t sender, delete_data_t *d) {
   d->callback(d->code, d->shm_channel_info, d->privdata);
   
   if(d->shm_channel_info != NULL) {
-    shm_free(nchan_memstore_get_shm(), d->shm_channel_info);
+    shm_free(nchan_store_memory_shmem, d->shm_channel_info);
   }
   str_shm_free(d->shm_chid);
 }
@@ -561,31 +700,36 @@ static void receive_delete_reply(ngx_int_t sender, delete_data_t *d) {
 ////////// GET CHANNEL INFO ////////////////
 typedef struct {
   ngx_str_t                 *shm_chid;
+  nchan_loc_conf_t          *cf;
   store_channel_head_shm_t  *channel_info;
   nchan_msg_id_t             last_msgid;
   callback_pt                callback;
   void                      *privdata;
 } channel_info_data_t;
 
-ngx_int_t memstore_ipc_send_get_channel_info(ngx_int_t dst, ngx_str_t *chid, callback_pt callback, void* privdata) {
+ngx_int_t memstore_ipc_send_get_channel_info(ngx_int_t dst, ngx_str_t *chid, nchan_loc_conf_t *cf, callback_pt callback, void* privdata) {
   DBG("send get_channel_info to %i %V", dst, chid);
   channel_info_data_t        data;
   DEBUG_MEMZERO(&data);
   if((data.shm_chid = str_shm_copy(chid)) == NULL) {
-    return NGX_ERROR;
+    nchan_log_ooshm_error("sending IPC get-channel-info alert for channel %V", chid);
+    return NGX_DECLINED;
   }
 
   data.channel_info = NULL;
   data.last_msgid = zero_msgid;
+  data.cf = cf;
   data.callback = callback;
   data.privdata = privdata;
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_GET_CHANNEL_INFO, &data, sizeof(data));
+  return ipc_cmd(get_channel_info, dst, &data);
 }
-static void receive_get_channel_info(ngx_int_t sender, channel_info_data_t *d) {
-  memstore_channel_head_t    *head;
-  
-  DBG("received get_channel_info request for channel %V privdata %p", d->shm_chid, d->privdata);
-  head = nchan_memstore_find_chanhead(d->shm_chid);
+
+typedef struct {
+  channel_info_data_t   d;
+  ngx_int_t             sender;
+} channel_info_find_chanhead_backup_data_t;
+
+static void receive_get_channel_info_continued(ngx_int_t sender, channel_info_data_t *d, memstore_channel_head_t *head) {
   assert(memstore_slot() == memstore_channel_owner(d->shm_chid));
   if(head == NULL) {
     //already deleted maybe?
@@ -597,7 +741,33 @@ static void receive_get_channel_info(ngx_int_t sender, channel_info_data_t *d) {
     assert(head->latest_msgid.tagcount <= 1);
     d->last_msgid = head->latest_msgid;
   }
-  ipc_alert(nchan_memstore_get_ipc(), sender, IPC_GET_CHANNEL_INFO_REPLY, d, sizeof(*d));
+  ipc_cmd(get_channel_info_reply, sender, d);
+}
+
+static ngx_int_t find_chanhead_w_backup_callback(ngx_int_t rc, void *vd, void *pd) {
+  channel_info_find_chanhead_backup_data_t *d = pd;
+  memstore_channel_head_t                  *head = vd;
+  
+  receive_get_channel_info_continued(d->sender, &d->d, head);
+  
+  ngx_free(d);
+  return NGX_OK;
+}
+
+static void receive_get_channel_info(ngx_int_t sender, channel_info_data_t *d) {
+  memstore_channel_head_t    *head;
+  
+  DBG("received get_channel_info request for channel %V privdata %p", d->shm_chid, d->privdata);
+  if(d->cf->redis.enabled && d->cf->redis.storage_mode == REDIS_MODE_BACKUP) {
+    channel_info_find_chanhead_backup_data_t *dd = ngx_alloc(sizeof(*dd), ngx_cycle->log);
+    dd->d = *d;
+    dd->sender = sender;
+    nchan_memstore_find_chanhead_with_backup(d->shm_chid, d->cf, find_chanhead_w_backup_callback, dd);
+  }
+  else {
+    head = nchan_memstore_find_chanhead(d->shm_chid);
+    receive_get_channel_info_continued(sender, d, head);
+  }
 }
 
 static void receive_get_channel_info_reply(ngx_int_t sender, channel_info_data_t *d) {
@@ -632,11 +802,13 @@ typedef struct {
   void                    *privdata;
 } channel_authcheck_data_t;
 
-ngx_int_t memstore_ipc_send_channel_auth_check(ngx_int_t dst, ngx_str_t *chid, nchan_loc_conf_t *cf, callback_pt callback, void* privdata) {
+ngx_int_t memstore_ipc_send_channel_existence_check(ngx_int_t dst, ngx_str_t *chid, nchan_loc_conf_t *cf, callback_pt callback, void* privdata) {
   DBG("send channel_auth_check to %i %V", dst, chid);
   channel_authcheck_data_t        data;
+  DEBUG_MEMZERO(&data);
   if((data.shm_chid = str_shm_copy(chid)) == NULL) {
-    return NGX_ERROR;
+    nchan_log_ooshm_error("sending IPC channel-existence-check alert for channel %V", chid);
+    return NGX_DECLINED;
   }
   data.auth_ok = 0;
   data.channel_must_exist = cf->subscribe_only_existing_channel;
@@ -645,7 +817,7 @@ ngx_int_t memstore_ipc_send_channel_auth_check(ngx_int_t dst, ngx_str_t *chid, n
   data.callback = callback;
   data.privdata = privdata;
   
-  return ipc_alert(nchan_memstore_get_ipc(), dst, IPC_GET_CHANNEL_AUTHCHECK, &data, sizeof(data));
+  return ipc_cmd(channel_auth_check, dst, &data);
 }
 
 typedef struct {
@@ -656,7 +828,6 @@ typedef struct {
 static ngx_int_t redis_receive_channel_auth_check_callback(ngx_int_t status, void *ch, void *d) {
   nchan_channel_t                     *channel = (nchan_channel_t *)ch;
   channel_authcheck_data_callback_t   *data = (channel_authcheck_data_callback_t *)d;
-  assert(status == NGX_OK);
   if(channel == NULL) {
     data->d.auth_ok = !data->d.channel_must_exist;
   }
@@ -666,7 +837,7 @@ static ngx_int_t redis_receive_channel_auth_check_callback(ngx_int_t status, voi
   else {
     data->d.auth_ok = channel->subscribers < data->d.max_subscribers;
   }
-  ipc_alert(nchan_memstore_get_ipc(), data->sender, IPC_GET_CHANNEL_AUTHCHECK_REPLY, &data->d, sizeof(data->d));
+  ipc_cmd(channel_auth_check_reply, data->sender, &data->d);
   ngx_free(d);
   return NGX_OK;
 }
@@ -689,7 +860,7 @@ static void receive_channel_auth_check(ngx_int_t sender, channel_authcheck_data_
       assert(head->shared);
       d->auth_ok = head->shared->sub_count < (ngx_uint_t )d->max_subscribers;
     }
-    ipc_alert(nchan_memstore_get_ipc(), sender, IPC_GET_CHANNEL_AUTHCHECK_REPLY, d, sizeof(*d));
+    ipc_cmd(channel_auth_check_reply, sender, d);
   }
   else {
     channel_authcheck_data_callback_t    *dd = ngx_alloc(sizeof(*dd), ngx_cycle->log);
@@ -705,56 +876,162 @@ static void receive_channel_auth_check_reply(ngx_int_t sender, channel_authcheck
 }
 
 /////////// SUBSCRIBER KEEPALIVE ///////////
+typedef enum {
+  KA_REPLY_NORENEW = 0, 
+  KA_REPLY_RENEW,
+  KA_REPLY_UNHOOK_NORENEW,
+} keepalive_reply_action_t;
+
 typedef struct {
   ngx_str_t                   *shm_chid;
   subscriber_t                *ipc_sub;
   memstore_channel_head_t     *originator;
-  ngx_uint_t                   renew;
-  callback_pt                  callback;
-  void                        *privdata;
+  keepalive_reply_action_t     reply_action;  
 } sub_keepalive_data_t;
 
-ngx_int_t memstore_ipc_send_memstore_subscriber_keepalive(ngx_int_t dst, ngx_str_t *chid, subscriber_t *sub, memstore_channel_head_t *ch, callback_pt callback, void *privdata) {
-  sub_keepalive_data_t        data = {str_shm_copy(chid), sub, ch, 0, callback, privdata};
-  if(data.shm_chid == NULL) {
-    return NGX_ERROR;
+ngx_int_t memstore_ipc_send_memstore_subscriber_keepalive(ngx_int_t dst, ngx_str_t *chid, subscriber_t *sub, memstore_channel_head_t *ch) {
+  sub_keepalive_data_t        data;
+  DEBUG_MEMZERO(&data);
+  if((data.shm_chid = str_shm_copy(chid)) == NULL) {
+    nchan_log_ooshm_error("sending IPC keepalive alert for channel %V", chid);
+    return NGX_DECLINED;
   }
+  data.ipc_sub = sub;
+  data.originator = ch;
+  
+  data.reply_action = KA_REPLY_NORENEW;
+  
+  sub->fn->reserve(sub);
+  
   DBG("send SUBSCRIBER KEEPALIVE to %i %V", dst, chid);
-  ipc_alert(nchan_memstore_get_ipc(), dst, IPC_SUBSCRIBER_KEEPALIVE, &data, sizeof(data));
+  
+  ipc_cmd(subscriber_keepalive, dst, &data);
   return NGX_OK;
 }
 static void receive_subscriber_keepalive(ngx_int_t sender, sub_keepalive_data_t *d) {
   memstore_channel_head_t    *head;
   DBG("received SUBSCRIBER KEEPALIVE from %i for channel %V", sender, d->shm_chid);
   head = nchan_memstore_find_chanhead(d->shm_chid);
+  str_shm_free(d->shm_chid);
+  
   if(head == NULL) {
     DBG("not subscribed anymore");
-    d->renew = 0;
+    d->reply_action = KA_REPLY_NORENEW;
   }
   else {
-    assert(head == d->originator);
-    assert(head->status == READY || head->status == STUBBED);
-    assert(head->foreign_owner_ipc_sub == d->ipc_sub);
-    if(head->total_sub_count == 0) {
+    if(head != d->originator) {
+      ERR("Got keepalive for expired channel %V", &head->id);
+      d->reply_action = KA_REPLY_UNHOOK_NORENEW;
+    }
+    else if(head->status != READY && head->status != STUBBED) {
+      if(head->status == WAITING && head->foreign_owner_ipc_sub == NULL) {
+        //wrong-status head. don't renew, get rid of this chanhead
+        nchan_memstore_publish_generic(head, NULL, NGX_HTTP_SERVICE_UNAVAILABLE, NULL);
+        nchan_memstore_force_delete_channel(d->shm_chid, NULL, NULL);
+        d->reply_action = KA_REPLY_UNHOOK_NORENEW;
+      }
+      else {
+        //something's gone extra weird. 
+        //kick out these subs, delete chanhead... just in case
+        nchan_memstore_publish_generic(head, NULL, NGX_HTTP_SERVICE_UNAVAILABLE, NULL);
+        nchan_memstore_force_delete_channel(d->shm_chid, NULL, NULL);
+        d->reply_action = KA_REPLY_UNHOOK_NORENEW;
+      }
+    }
+    else if(head->foreign_owner_ipc_sub != d->ipc_sub) {
+      // we got another subscriber for this chanhead, probably due to some very heavy delays
+      // discard it, keeping the old one.
+      // (It might be nice to discard the _old_ subscriber, but the owner worker may have already deleted it
+      ERR("Got ipc-subscriber during keepalive for an already subscribed channel %V", &head->id);
+      d->reply_action = KA_REPLY_UNHOOK_NORENEW;
+    }
+    else if(head->total_sub_count == 0) {
       if(ngx_time() - head->last_subscribed_local > MEMSTORE_IPC_SUBSCRIBER_TIMEOUT) {
-        d->renew = 0;
+        d->reply_action = KA_REPLY_NORENEW;
         DBG("No subscribers lately. Time... to die.");
       }
       else {
         DBG("No subscribers, but there was one %i sec ago. don't unsubscribe.", ngx_time() - head->last_subscribed_local);
-        d->renew = 1;
+        d->reply_action = KA_REPLY_RENEW;
       }
     }
     else {
-      d->renew = 1;
+      d->reply_action = KA_REPLY_RENEW;
     }
   }
-  ipc_alert(nchan_memstore_get_ipc(), sender, IPC_SUBSCRIBER_KEEPALIVE_REPLY, d, sizeof(*d));
+  ipc_cmd(subscriber_keepalive_reply, sender, d);
 }
 
 static void receive_subscriber_keepalive_reply(ngx_int_t sender, sub_keepalive_data_t *d) {
-  d->callback(d->renew, NULL, d->privdata);
-  str_shm_free(d->shm_chid);
+  subscriber_t     *sub = d->ipc_sub;
+  switch(d->reply_action) {
+    case KA_REPLY_NORENEW:
+      sub->fn->dequeue(sub);
+      sub->fn->release(sub, 0);
+      break;
+    case KA_REPLY_RENEW:
+      memstore_ipc_subscriber_keepalive_renew(sub);
+      sub->fn->release(sub, 0);
+      break;
+    case KA_REPLY_UNHOOK_NORENEW:
+      memstore_ipc_subscriber_unhook(sub);
+      sub->fn->release(sub, 0);
+      break;
+    default:
+      raise(SIGABRT);
+  }
+}
+
+
+/////////// GROUPS ///////////
+
+ngx_int_t memstore_ipc_send_get_group(ngx_int_t dst, ngx_str_t *group_id) {
+  ngx_str_t         *shm_id = str_shm_copy(group_id);
+  if(shm_id == NULL) {
+    nchan_log_ooshm_error("sending IPC get-group alert for group %V", group_id);
+    return NGX_DECLINED;
+  }
+  DBG("send GET GROUP to %i %p %V", dst, shm_id, shm_id);
+  ipc_cmd(get_group, dst, &shm_id);
+  return NGX_OK;
+}
+
+static void receive_get_group(ngx_int_t sender, ngx_str_t **group_id) {
+  nchan_group_t  *shared_group;
+  int             new_group;
+  DBG("received GET GROUP from %i %p %V", sender, *group_id, *group_id);
+  
+  shared_group = memstore_group_owner_find(nchan_memstore_get_groups(), *group_id, &new_group);
+  if(!new_group) { //new group is automatically broadcast to everyone, this one already exists.
+    ipc_cmd(group, sender, &shared_group);
+  }
+  
+  str_shm_free(*group_id);
+}
+
+ngx_int_t memstore_ipc_broadcast_group(nchan_group_t *shared_group) {
+  DBG("broadcast GROUP %V to everyone but me", &shared_group->name);
+  ipc_broadcast_cmd(group, &shared_group);
+  
+  return NGX_OK;
+}
+
+static void receive_group(ngx_int_t sender, nchan_group_t **shared_group) {
+  DBG("receive GROUP %V", &(*shared_group)->name);
+  
+  memstore_group_receive(nchan_memstore_get_groups(), *shared_group);
+}
+
+ngx_int_t memstore_ipc_broadcast_group_delete(nchan_group_t *shared_group) {
+  DBG("send DELETE GROUP");
+  ipc_broadcast_cmd(group_delete, &shared_group);
+  return NGX_OK;
+}
+
+static void receive_group_delete(ngx_int_t sender, nchan_group_t **shared_group) {
+  DBG("receive GROUP DELETE %V", &(*shared_group)->name);
+  
+  memstore_group_receive_delete(nchan_memstore_get_groups(), *shared_group);
 }
 
 /////////// FLOOD TEST ///////////
@@ -766,7 +1043,7 @@ typedef struct {
 static int  flood_seq = 0;
 ngx_int_t memstore_ipc_send_flood_test(ngx_int_t dst) {
   flood_data_t        data = {flood_seq++};
-  ipc_alert(nchan_memstore_get_ipc(), dst, IPC_TEST_FLOOD, &data, sizeof(data));
+  ipc_cmd(flood_test, dst, &data);
   return NGX_OK;
 }
 
@@ -779,26 +1056,104 @@ static void receive_flood_test(ngx_int_t sender, flood_data_t *d) {
   nanosleep(&tv, NULL);
 }
 
-static ipc_handler_pt ipc_alert_handler[] = {
-  [IPC_SUBSCRIBE] =                   (ipc_handler_pt )receive_subscribe,
-  [IPC_SUBSCRIBE_REPLY] =             (ipc_handler_pt )receive_subscribe_reply,
-  [IPC_UNSUBSCRIBED] =                (ipc_handler_pt )receive_unsubscribed,
-  [IPC_PUBLISH_MESSAGE] =             (ipc_handler_pt )receive_publish_message,
-  [IPC_PUBLISH_MESSAGE_REPLY] =       (ipc_handler_pt )receive_publish_message_reply,
-  [IPC_PUBLISH_STATUS] =              (ipc_handler_pt )receive_publish_status,
-  [IPC_GET_MESSAGE] =                 (ipc_handler_pt )receive_get_message,
-  [IPC_GET_MESSAGE_REPLY] =           (ipc_handler_pt )receive_get_message_reply,
-  [IPC_DELETE] =                      (ipc_handler_pt )receive_delete,
-  [IPC_DELETE_REPLY] =                (ipc_handler_pt )receive_delete_reply,
-  [IPC_GET_CHANNEL_INFO] =            (ipc_handler_pt )receive_get_channel_info,
-  [IPC_GET_CHANNEL_INFO_REPLY]=       (ipc_handler_pt )receive_get_channel_info_reply,
-  [IPC_GET_CHANNEL_AUTHCHECK] =       (ipc_handler_pt )receive_channel_auth_check,
-  [IPC_GET_CHANNEL_AUTHCHECK_REPLY]=  (ipc_handler_pt )receive_channel_auth_check_reply,
-  [IPC_SUBSCRIBER_KEEPALIVE] =        (ipc_handler_pt )receive_subscriber_keepalive,
-  [IPC_SUBSCRIBER_KEEPALIVE_REPLY] =  (ipc_handler_pt )receive_subscriber_keepalive_reply,
-  [IPC_TEST_FLOOD]                 =  (ipc_handler_pt )receive_flood_test
+////////// BENCHMARK INITIALIZE //////////////
+typedef struct {
+  nchan_loc_conf_t *loc_conf;
+  time_t        time;
+  uint32_t      id;
+  nchan_benchmark_shared_t shared;
+} benchmark_initialize_data_t;
+
+ngx_int_t memstore_ipc_broadcast_benchmark_initialize(void *bench_pd) {
+  nchan_benchmark_t            *bench = bench_pd;
+  benchmark_initialize_data_t   data;
+  DEBUG_MEMZERO(&data);
+  data.loc_conf = bench->loc_conf;
+  data.id = bench->id;
+  data.time = bench->time.init;
+  data.shared = bench->shared;
+  
+  return ipc_broadcast_cmd(benchmark_initialize, &data);
+}
+static void receive_benchmark_initialize(ngx_int_t sender, benchmark_initialize_data_t *d) {
+  nchan_benchmark_initialize_from_ipc(sender, d->loc_conf, d->time, d->id, &d->shared);
+}
+
+////////// BENCHMARK RUN ////////////////
+typedef struct {
+  nchan_loc_conf_t *loc_conf;
+} benchmark_run_data_t;
+
+ngx_int_t memstore_ipc_broadcast_benchmark_run(void) {
+  benchmark_run_data_t        data;
+  DEBUG_MEMZERO(&data);
+  return ipc_broadcast_cmd(benchmark_start, &data);
+}
+static void receive_benchmark_start(ngx_int_t sender, benchmark_run_data_t *d) {
+  nchan_benchmark_run();
+}
+
+////////// BENCHMARK STOP ////////////////
+typedef struct {
+  nchan_loc_conf_t *loc_conf;
+} benchmark_stop_data_t;
+
+ngx_int_t memstore_ipc_broadcast_benchmark_stop(void) {
+  benchmark_stop_data_t        data;
+  DEBUG_MEMZERO(&data);
+  return ipc_broadcast_cmd(benchmark_stop, &data);
+}
+static void receive_benchmark_stop(ngx_int_t sender, benchmark_stop_data_t *d) {
+  nchan_benchmark_stop();
+}
+
+////////// BENCHMARK FINISH ////////////////
+typedef struct {
+  nchan_benchmark_data_t data;
+} benchmark_finish_data_t;
+
+ngx_int_t memstore_ipc_broadcast_benchmark_finish(void) {
+  benchmark_finish_data_t        data;
+  DEBUG_MEMZERO(&data);
+  return ipc_broadcast_cmd(benchmark_finish, &data);
+}
+static void receive_benchmark_finish(ngx_int_t sender, benchmark_finish_data_t *d) {
+  nchan_benchmark_t        *bench = nchan_benchmark_get_active();
+  benchmark_finish_data_t   data;
+  DEBUG_MEMZERO(&data);
+  nchan_benchmark_dequeue_subscribers();
+  data.data = bench->data;
+  ipc_cmd(benchmark_finish_reply, sender, &data);
+  nchan_benchmark_cleanup();
+}
+
+static void receive_benchmark_finish_reply(ngx_int_t sender, benchmark_finish_data_t *d) {
+  nchan_benchmark_receive_finished_data(&d->data);
+}
+
+////////// BENCHMARK ABORT ////////////////
+typedef struct {
+  nchan_benchmark_data_t data;
+} benchmark_abort_data_t;
+
+ngx_int_t memstore_ipc_broadcast_benchmark_abort(void) {
+  benchmark_abort_data_t        data;
+  DEBUG_MEMZERO(&data);
+  return ipc_broadcast_cmd(benchmark_abort, &data);
+}
+static void receive_benchmark_abort(ngx_int_t sender, benchmark_abort_data_t *d) {
+  nchan_benchmark_abort();
+}
+
+#define MAKE_ipc_cmd_handler(val) [offsetof(ipc_handlers_t, val)/sizeof(ipc_handler_pt)] = (ipc_handler_pt )receive_ ## val,
+static ipc_handler_pt ipc_cmd_handler[] = {
+  LIST_IPC_COMMANDS(MAKE_ipc_cmd_handler)
 };
 
 void memstore_ipc_alert_handler(ngx_int_t sender, ngx_uint_t code, void *data) {
-  ipc_alert_handler[code](sender, data);
+  if(code >= IPC_CMDS) {
+    ERR("received invalid code %ui from sender %i", code, sender);
+    return;
+  }
+  ipc_cmd_handler[code](sender, data);
 }
diff --git a/debian/modules/nchan/src/store/memory/ipc-handlers.h b/debian/modules/nchan/src/store/memory/ipc-handlers.h
index a245c4f2..412974fe 100644
--- a/debian/modules/nchan/src/store/memory/ipc-handlers.h
+++ b/debian/modules/nchan/src/store/memory/ipc-handlers.h
@@ -3,14 +3,24 @@
 typedef void (*ipc_handler_pt)(ngx_int_t, void *);
 
 ngx_int_t memstore_ipc_send_subscribe(ngx_int_t owner, ngx_str_t *shm_chid, memstore_channel_head_t *, nchan_loc_conf_t *);
-ngx_int_t memstore_ipc_send_memstore_subscriber_keepalive(ngx_int_t dst, ngx_str_t *chid, subscriber_t *sub, memstore_channel_head_t *ch, callback_pt callback, void *privdata);
+ngx_int_t memstore_ipc_send_memstore_subscriber_keepalive(ngx_int_t dst, ngx_str_t *chid, subscriber_t *sub, memstore_channel_head_t *ch);
 ngx_int_t memstore_ipc_send_unsubscribe(ngx_int_t dst, ngx_str_t *chid, void *subscriber, void* privdata);
 ngx_int_t memstore_ipc_send_unsubscribed(ngx_int_t dst, ngx_str_t *chid, void* privdata);
 ngx_int_t memstore_ipc_send_publish_message(ngx_int_t dst, ngx_str_t *chid, nchan_msg_t *shm_msg, nchan_loc_conf_t *cf, callback_pt callback, void *privdata);
 ngx_int_t memstore_ipc_send_publish_status(ngx_int_t dst, ngx_str_t *chid, ngx_int_t status_code, const ngx_str_t *status_line, callback_pt callback, void *privdata);
+ngx_int_t memstore_ipc_send_publish_notice(ngx_int_t dst, ngx_str_t *chid, ngx_int_t notice_code, void *notice_data);
 ngx_int_t memstore_ipc_send_get_message(ngx_int_t owner, ngx_str_t *shm_chid, nchan_msg_id_t *msgid, void * privdata);
 ngx_int_t memstore_ipc_send_delete(ngx_int_t owner, ngx_str_t *shm_chid, callback_pt callback, void *privdata);
 void memstore_ipc_alert_handler(ngx_int_t sender, ngx_uint_t code, void *data);
-ngx_int_t memstore_ipc_send_get_channel_info(ngx_int_t dst, ngx_str_t *chid, callback_pt callback, void* privdata);
-ngx_int_t memstore_ipc_send_channel_auth_check(ngx_int_t dst, ngx_str_t *chid, nchan_loc_conf_t *cf, callback_pt callback, void* privdata);
+ngx_int_t memstore_ipc_send_get_channel_info(ngx_int_t dst, ngx_str_t *chid, nchan_loc_conf_t *cf, callback_pt callback, void* privdata);
+ngx_int_t memstore_ipc_send_channel_existence_check(ngx_int_t dst, ngx_str_t *chid, nchan_loc_conf_t *cf, callback_pt callback, void* privdata);
+ngx_int_t memstore_ipc_broadcast_group(nchan_group_t *shared_group);
+ngx_int_t memstore_ipc_send_get_group(ngx_int_t dst, ngx_str_t *group_id);
+ngx_int_t memstore_ipc_broadcast_group_delete(nchan_group_t *shared_group);
 ngx_int_t memstore_ipc_send_flood_test(ngx_int_t dst);
+
+ngx_int_t memstore_ipc_broadcast_benchmark_initialize(void *bench);
+ngx_int_t memstore_ipc_broadcast_benchmark_run(void);
+ngx_int_t memstore_ipc_broadcast_benchmark_stop(void);
+ngx_int_t memstore_ipc_broadcast_benchmark_finish(void);
+ngx_int_t memstore_ipc_broadcast_benchmark_abort(void);
diff --git a/debian/modules/nchan/src/store/memory/ipc.c b/debian/modules/nchan/src/store/memory/ipc.c
index dbdce5e4..f7152dae 100755
--- a/debian/modules/nchan/src/store/memory/ipc.c
+++ b/debian/modules/nchan/src/store/memory/ipc.c
@@ -3,6 +3,7 @@
 #include <ngx_channel.h>
 #include <assert.h>
 #include "ipc.h"
+#include "groups.h"
 
 #include "store-private.h"
 
@@ -19,7 +20,6 @@ static ngx_event_t  send_alert_delay_log_timer;
 static void receive_alert_delay_log_timer_handler(ngx_event_t *ev);
 static void send_alert_delay_log_timer_handler(ngx_event_t *ev);
 
-
 static void ipc_read_handler(ngx_event_t *ev);
 
 ngx_int_t ipc_init(ipc_t *ipc) {
@@ -42,7 +42,9 @@ ngx_int_t ipc_init(ipc_t *ipc) {
     proc->wbuf.overflow_first = NULL;
     proc->wbuf.overflow_last = NULL;
     proc->wbuf.overflow_n = 0;
+    ipc->worker_slots[i]=NGX_ERROR;
   }
+  ipc->workers = NGX_ERROR;
   return NGX_OK;
 }
 
@@ -86,6 +88,8 @@ ngx_int_t ipc_open(ipc_t *ipc, ngx_cycle_t *cycle, ngx_int_t workers, void (*slo
       slot_callback(s, i);
     }
     
+    ipc->worker_slots[i] = s;
+    
     proc = &ipc->process[s];
 
     socks = proc->pipe;
@@ -120,6 +124,7 @@ ngx_int_t ipc_open(ipc_t *ipc, ngx_cycle_t *cycle, ngx_int_t workers, void (*slo
     
     s++; //NEXT!!
   }
+  ipc->workers = workers;
   
   //ERR("ipc_alert_t size %i bytes", sizeof(ipc_alert_t));
   
@@ -133,6 +138,8 @@ ngx_int_t ipc_close(ipc_t *ipc, ngx_cycle_t *cycle) {
   ipc_process_t            *proc;
   ipc_writebuf_overflow_t  *of, *of_next;
   
+  DBG("start closing");
+  
   for (i=0; i<NGX_MAX_PROCESSES; i++) {
     proc = &ipc->process[i];
     if(!proc->active) continue;
@@ -151,6 +158,7 @@ ngx_int_t ipc_close(ipc_t *ipc, ngx_cycle_t *cycle) {
     ipc_try_close_fd(&proc->pipe[1]);
     ipc->process[i].active = 0;
   }
+  DBG("done closing");
   return NGX_OK;
 }
 
@@ -158,7 +166,7 @@ static ngx_uint_t delayed_sent_alerts_count;
 static ngx_uint_t delayed_sent_alerts_delay;
 
 static void send_alert_delay_log_timer_handler(ngx_event_t *ev) {
-  nchan_log_error("Sending %ui interprocess alert%s delayed by %ui sec.", delayed_sent_alerts_count, delayed_sent_alerts_count == 1 ? "" : "s", (ngx_uint_t)(delayed_sent_alerts_count > 0 ? delayed_sent_alerts_delay / delayed_sent_alerts_count : 0));
+  nchan_log_notice("Sending %ui interprocess alert%s delayed by %ui sec.", delayed_sent_alerts_count, delayed_sent_alerts_count == 1 ? "" : "s", (ngx_uint_t)(delayed_sent_alerts_count > 0 ? delayed_sent_alerts_delay / delayed_sent_alerts_count : 0));
   
   delayed_sent_alerts_count = 0;
   delayed_sent_alerts_delay = 0;
@@ -367,7 +375,7 @@ static ngx_uint_t delayed_received_alerts_count;
 static ngx_uint_t delayed_received_alerts_delay;
 
 static void receive_alert_delay_log_timer_handler(ngx_event_t *ev) {
-  nchan_log_error("Received %ui interprocess alert%s delayed by %ui sec.", delayed_received_alerts_count, delayed_received_alerts_count == 1 ? "" : "s", (ngx_uint_t)(delayed_received_alerts_count > 0 ? delayed_received_alerts_delay / delayed_received_alerts_count : 0));
+  nchan_log_notice("Received %ui interprocess alert%s delayed by %ui sec.", delayed_received_alerts_count, delayed_received_alerts_count == 1 ? "" : "s", (ngx_uint_t)(delayed_received_alerts_count > 0 ? delayed_received_alerts_delay / delayed_received_alerts_count : 0));
   
   delayed_received_alerts_count = 0;
   delayed_received_alerts_delay = 0;
@@ -453,6 +461,22 @@ static void ipc_read_handler(ngx_event_t *ev) {
 }
 
 
+ngx_int_t ipc_broadcast_alert(ipc_t *ipc, ngx_uint_t code, void *data, size_t data_size) {
+  ngx_int_t   i, slot, rc, ret = NGX_OK;
+  ngx_int_t   my_slot = memstore_slot();
+  DBG("broadcast alert");
+  for(i=0; i < ipc->workers; i++) {
+    slot = ipc->worker_slots[i];
+    if(my_slot != slot) {
+      if((rc = ipc_alert(ipc, slot, code, data, data_size)) != NGX_OK)  {
+        ERR("Error sending alert to slot %i", slot);
+        ret = NGX_ERROR;
+      }
+    }
+  }
+  return ret;
+}
+
 ngx_int_t ipc_alert(ipc_t *ipc, ngx_int_t slot, ngx_uint_t code, void *data, size_t data_size) {
   DBG("IPC send alert code %i to slot %i", code, slot);
   
diff --git a/debian/modules/nchan/src/store/memory/ipc.h b/debian/modules/nchan/src/store/memory/ipc.h
index 361bbd71..522dcc5d 100755
--- a/debian/modules/nchan/src/store/memory/ipc.h
+++ b/debian/modules/nchan/src/store/memory/ipc.h
@@ -1,4 +1,7 @@
-#define IPC_DATA_SIZE 56
+#ifndef NCHAN_IPC_H
+#define NCHAN_IPC_H
+
+#define IPC_DATA_SIZE 64
 //#define IPC_DATA_SIZE 80
 
 typedef struct {
@@ -44,6 +47,9 @@ struct ipc_s {
   ipc_process_t         process[NGX_MAX_PROCESSES];
   
   void                  (*handler)(ngx_int_t, ngx_uint_t, void*);
+  
+  ngx_int_t             workers;
+  ngx_int_t             worker_slots[NGX_MAX_PROCESSES];
 }; //ipc_t
 
 ngx_int_t ipc_init(ipc_t *ipc);
@@ -52,4 +58,7 @@ ngx_int_t ipc_set_handler(ipc_t *ipc, void (*alert_handler)(ngx_int_t, ngx_uint_
 ngx_int_t ipc_register_worker(ipc_t *ipc, ngx_cycle_t *cycle);
 ngx_int_t ipc_close(ipc_t *ipc, ngx_cycle_t *cycle);
 
+ngx_int_t ipc_broadcast_alert(ipc_t *ipc, ngx_uint_t code, void *data, size_t data_size);
 ngx_int_t ipc_alert(ipc_t *ipc, ngx_int_t slot, ngx_uint_t code,  void *data, size_t data_size);
+
+#endif //NCHAN_IPC_H
diff --git a/debian/modules/nchan/src/store/memory/memstore.c b/debian/modules/nchan/src/store/memory/memstore.c
index a8b309b9..2844220c 100755
--- a/debian/modules/nchan/src/store/memory/memstore.c
+++ b/debian/modules/nchan/src/store/memory/memstore.c
@@ -8,13 +8,16 @@
 #include "ipc.h"
 #include "ipc-handlers.h"
 #include "store-private.h"
+#include "groups.h"
 #include <store/spool.h>
 
 #include <util/nchan_reaper.h>
+#include <util/nchan_debug.h>
 
 #include <store/redis/store.h>
 #include <store/store_common.h>
 #include <subscribers/memstore_redis.h>
+#include <subscribers/getmsg_proxy.h>
 #include <subscribers/memstore_multi.h>
 
 #define NCHAN_CHANHEAD_EXPIRE_SEC 5
@@ -66,17 +69,17 @@ static ngx_int_t nchan_memstore_store_msg_ready_to_reap_generic(store_message_t
       return NGX_DECLINED;
     }
     
-    if(ngx_atomic_cmp_set((ngx_atomic_uint_t *)&smsg->msg->refcount, 0, MSG_REFCOUNT_INVALID)) {
+    if(msg_refcount_invalidate_if_zero(smsg->msg)) {
       return NGX_OK;
     }
     return NGX_DECLINED;
   }
   else {
-    if(! ngx_atomic_cmp_set((ngx_atomic_uint_t *)&smsg->msg->refcount, 0, MSG_REFCOUNT_INVALID)) {
+    if(!msg_refcount_invalidate_if_zero(smsg->msg)) {
       if(smsg->msg->refcount > 0) {
         ERR("force-reaping msg with refcount %d", smsg->msg->refcount);
       }
-      smsg->msg->refcount = MSG_REFCOUNT_INVALID;
+      msg_refcount_invalidate(smsg->msg);
     }
     return NGX_OK;
   }
@@ -90,38 +93,37 @@ static ngx_int_t nchan_memstore_store_msg_ready_to_reap_wait_util_expired(store_
   return nchan_memstore_store_msg_ready_to_reap_generic(smsg, 1, force);
 }
 
-static ngx_int_t memstore_reap_message( nchan_msg_t *msg );
-static ngx_int_t memstore_reap_store_message( store_message_t *smsg );
+static void memstore_reap_message( nchan_msg_t *msg );
+static void memstore_reap_store_message( store_message_t *smsg );
 
 static ngx_int_t chanhead_messages_delete(memstore_channel_head_t *ch);
 
-
-/*
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
 static void log_memstore_chanhead_reservations(memstore_channel_head_t *ch) {
-#if MESTORE_CHANHEAD_RESERVE_DEBUG
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
   nchan_list_el_t  *cur;
   char            **lbl;
-  ERR("%p %V reservations: %i", ch, &ch->id, ch->reserved.n);
+  DBG("%p %V reservations: %i", ch, &ch->id, ch->reserved.n);
   for(cur = ch->reserved.head; cur != NULL; cur = cur->next) {
     lbl = nchan_list_data_from_el(cur);
-    ERR("   %s", *lbl);
+    DBG("   %s", *lbl);
   }
 #else
-  ERR("%p %V reservations: %i", ch, &ch->id, ch->reserved);
+  DBG("%p %V reservations: %i", ch, &ch->id, ch->reserved);
 #endif
 }
-*/
+#endif
 
 static int memstore_chanhead_reservations(memstore_channel_head_t *ch) {
-#if MESTORE_CHANHEAD_RESERVE_DEBUG
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
   return ch->reserved.n;
 #else
   return ch->reserved;
 #endif
 }
 
-static void memstore_chanhead_reserve(memstore_channel_head_t *ch, const char *lbl) {
-#if MESTORE_CHANHEAD_RESERVE_DEBUG
+void memstore_chanhead_reserve(memstore_channel_head_t *ch, const char *lbl) {
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
   char   **label = nchan_list_append(&ch->reserved);
   *label = (char *)lbl;
 #else
@@ -129,8 +131,8 @@ static void memstore_chanhead_reserve(memstore_channel_head_t *ch, const char *l
 #endif
 }
 
-static void memstore_chanhead_release(memstore_channel_head_t *ch, char *label) {
-#if MESTORE_CHANHEAD_RESERVE_DEBUG
+void memstore_chanhead_release(memstore_channel_head_t *ch, char *label) {
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
   nchan_list_el_t  *cur;
   char            **lbl;
   for(cur = ch->reserved.head; cur != NULL; cur = cur->next) {
@@ -147,97 +149,82 @@ static void memstore_chanhead_release(memstore_channel_head_t *ch, char *label)
 #endif
 }
 
+static ngx_int_t memstore_chanhead_reserved_or_in_use(memstore_channel_head_t *ch) {
+  if (ch->total_sub_count > 0) { //there are subscribers
+    DBG("not ready to reap %V, %i subs left", &ch->id, ch->total_sub_count);
+    return 1;
+  }
+  
+  if(memstore_chanhead_reservations(ch) > 0) {
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
+    DBG("not ready to reap %V, still reserved:", &ch->id);
+    log_memstore_chanhead_reservations(ch);
+#endif
+    return 1;
+  }
+  
+  if(ch->cf && ch->cf->redis.enabled && ch->churn_start_time + ch->redis_idle_cache_ttl < ngx_time()) {
+    DBG("idle redis cache channel %p %V (msgs: %i)", ch, &ch->id, ch->channel.messages);
+    // any stored messages are unimportant, they're backed up in redis
+  }
+  else if(ch->channel.messages > 0) {
+    assert(ch->msg_first != NULL);
+    DBG("not ready to reap %V, %i messages left", &ch->id, ch->channel.messages);
+    return 1;
+  }
+  
+  if(ch->owner == ch->slot && ch->shared && ch->shared->gc.outside_refcount > 0) {
+    DBG("channel %p %V shared data still used by %i workers.", ch, &ch->id, ch->shared->gc.outside_refcount);
+    return 1;
+  }
+  
+  return 0;
+}
 
 static ngx_int_t nchan_memstore_chanhead_ready_to_reap(memstore_channel_head_t *ch, uint8_t force) {
   
   memstore_chanhead_messages_gc(ch);
-  if(!force) {
-    if(ch->status != INACTIVE) {
-      char *sts;
-      switch(ch->status) {
-        case NOTREADY:
-          sts = "NOTREADY";
-          break;
-        case WAITING:
-          sts = "WAITING";
-          break;
-        case STUBBED:
-          sts = "STUBBED";
-          break;
-        case READY:
-          sts = "READY";
-          break;
-        case INACTIVE:
-          sts = "INACTIVE";
-          break;
-        default:
-          sts = "????";
-      }
-      DBG("not ready to reap %V : status %s", &ch->id, sts);
-      return NGX_DECLINED;
-    }
-    
-    if(ch->gc_start_time + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time() > 0) {
-      DBG("not ready to reap %V, %i sec left", &ch->id, ch->gc_start_time  + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time());
-      return NGX_DECLINED;
-    }
-    
-    if (ch->total_sub_count > 0) { //there are subscribers
-      DBG("not ready to reap %V, %i subs left", &ch->id, ch->total_sub_count);
-      return NGX_DECLINED;
-    }
-    
-    if(memstore_chanhead_reservations(ch) > 0) {
-      DBG("not ready to reap %V, still reserved:", &ch->id);
-      //log_memstore_chanhead_reservations(ch);
-      return NGX_DECLINED;
-    }
-    
-    if(ch->cf && ch->cf->redis.enabled && ch->churn_start_time + ch->redis_idle_cache_ttl < ngx_time()) {
-      DBG("get rid of idle redis cache channel %p %V (msgs: %i)", ch, &ch->id, ch->channel.messages);
-      return NGX_OK;
-    }
-    else if(ch->channel.messages > 0) {
-      assert(ch->msg_first != NULL);
-      DBG("not ready to reap %V, %i messages left", &ch->id, ch->channel.messages);
-      return NGX_DECLINED;
-    }
-    //DBG("ok to delete channel %V", &ch->id);
-    return NGX_OK;
-  }
-  else {
+  
+  if(force) {
     //force delete is always ok
     return NGX_OK;
   }
+  
+  if(ch->status != INACTIVE) {
+    DBG("not ready to reap %V : status %i", &ch->id, ch->status);
+    return NGX_DECLINED;
+  }
+  
+  if(ch->gc_start_time + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time() > 0) {
+    DBG("not ready to reap %V, %i sec left", &ch->id, ch->gc_start_time  + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time());
+    return NGX_DECLINED;
+  }
+    
+  if(memstore_chanhead_reserved_or_in_use(ch)) {
+    return NGX_DECLINED;
+  }
+    
+  DBG("ok to delete channel %V", &ch->id);
+  return NGX_OK;
 }
 
 static ngx_int_t nchan_memstore_chanhead_ready_to_reap_slowly(memstore_channel_head_t *ch, uint8_t force) {
   
   memstore_chanhead_messages_gc(ch);
-  if(!force) {
-    if(ch->churn_start_time + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time() > 0) {
-      DBG("not ready to reap %p %V, %i sec left", ch, &ch->id, ch->churn_start_time  + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time());
-      return NGX_DECLINED;
-    }
-    
-    if (ch->total_sub_count > 0) { //there are subscribers
-      DBG("not ready to reap %V, %i subs left", &ch->id, ch->total_sub_count);
-      //ERR("not ready to reap %p %V, %i [%i] {%i} subs (%i {%i} internal) left", ch, &ch->id, ch->total_sub_count, ch->channel.subscribers, ch->shared->sub_count, ch->internal_sub_count, ch->shared->internal_sub_count);
-      return NGX_DECLINED;
-    }
+  if(force) {
+    return NGX_OK;
+  }
+  
+  if(ch->churn_start_time + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time() > 0) {
+    DBG("not ready to reap %p %V, %i sec left", ch, &ch->id, ch->churn_start_time  + NCHAN_CHANHEAD_EXPIRE_SEC - ngx_time());
+    return NGX_DECLINED;
+  }
     
-    if(ch->cf && ch->cf->redis.enabled && ch->churn_start_time + ch->redis_idle_cache_ttl < ngx_time()) {
-      DBG("get rid of idle redis cache channel %p %V (msgs: %i)", ch, &ch->id, ch->channel.messages);
-      return NGX_OK;
-    }
-    else if(ch->channel.messages > 0) {
-      assert(ch->msg_first != NULL);
-      DBG("not ready to reap %p %V, %i messages left", ch, &ch->id, ch->channel.messages);
-      return NGX_DECLINED;
-    }
+  if(memstore_chanhead_reserved_or_in_use(ch)) {
+    return NGX_DECLINED;
   }
   
-  //DBG("ok to delete channel %V", &ch->id);
+  DBG("ok to slow-delete channel %V", &ch->id);
   return NGX_OK;
 }
 
@@ -291,10 +278,14 @@ static void init_mpt(memstore_data_t *m) {
 }
 
 static shmem_t         *shm = NULL;
+void                   *nchan_store_memory_shmem = NULL;
 static shm_data_t      *shdata = NULL;
 static ipc_t            ipc_data;
 static ipc_t           *ipc = NULL;
 
+static memstore_groups_t groups_data;
+static memstore_groups_t *groups = NULL;
+
 #if FAKESHARD
 
 static memstore_data_t  mdata[MAX_FAKE_WORKERS];
@@ -329,14 +320,14 @@ int memstore_ready(void) {
 }
 #endif
 
-shmem_t *nchan_memstore_get_shm(void){
-  return shm;
-}
-
 ipc_t *nchan_memstore_get_ipc(void){
   return ipc;
 }
 
+memstore_groups_t *nchan_memstore_get_groups(void) {
+  return groups;
+}
+
 static ngx_int_t                  shared_loc_conf_count = 0;
 ngx_int_t memstore_reserve_conf_shared_data(nchan_loc_conf_t *cf) {
   if(cf->shared_data_index == NGX_CONF_UNSET) {
@@ -401,18 +392,12 @@ void memstore_fakeprocess_push_random(void) {
 
 #endif
 
-static ngx_int_t is_multi_id(ngx_str_t *id);
-
-ngx_int_t memstore_channel_owner(ngx_str_t *id) {
+ngx_int_t memstore_str_owner(ngx_str_t *str) {
   uint32_t        h;
   ngx_int_t       workers;
-  //multi is always self-owned
-  if(is_multi_id(id)) {
-    return memstore_slot();
-  }
   
   workers = shdata->max_workers;
-  h = ngx_crc32_short(id->data, id->len);
+  h = ngx_crc32_short(str->data, str->len);
 #if FAKESHARD
   #ifdef ONE_FAKE_CHANNEL_OWNER
   h++; //just to avoid the unused variable warning
@@ -425,7 +410,7 @@ ngx_int_t memstore_channel_owner(ngx_str_t *id) {
   i = h % workers;
   assert(i >= 0);
   slot = shdata->procslot[i + memstore_procslot_offset];
-  //DBG("channel owner for %V workers=%i (max=%i active=%i) h=%ui m_p_off=%i i=%i slot=%i", id, workers, shdata->max_workers, shdata->total_active_workers, h, memstore_procslot_offset, i, slot);
+  //DBG("owner for %V workers=%i (max=%i active=%i) h=%ui m_p_off=%i i=%i slot=%i", str, workers, shdata->max_workers, shdata->total_active_workers, h, memstore_procslot_offset, i, slot);
   if(slot == NCHAN_INVALID_SLOT) {
     ERR("something went wrong, the channel owner is invalid. i: %i h: %ui, workers: %i", i, h, workers);
     assert(0);
@@ -435,7 +420,16 @@ ngx_int_t memstore_channel_owner(ngx_str_t *id) {
 #endif
 }
 
+ngx_int_t nchan_nginx_worker_procslot(ngx_int_t worker_number) {
+  if( worker_number < 0 || worker_number > shdata->max_workers) {
+    return NGX_ERROR;
+  }
+  return shdata->procslot[worker_number + memstore_procslot_offset];
+}
 
+ngx_int_t memstore_channel_owner(ngx_str_t *id) {
+  return nchan_channel_id_is_multi(id) ? memstore_slot() : memstore_str_owner(id);
+}
 
 #if NCHAN_MSG_LEAK_DEBUG
 
@@ -532,7 +526,6 @@ static ngx_int_t initialize_shm(ngx_shm_zone_t *zone, void *data) {
     zone->data = data;
     d = zone->data;
     DBG("reattached shm data at %p", data);
-    shm_reinit(shm);
     shmtx_lock(shm);
     d->generation ++;
     d->current_active_workers = 0;
@@ -542,8 +535,13 @@ static ngx_int_t initialize_shm(ngx_shm_zone_t *zone, void *data) {
       d->conf_data = NULL;
     }
     
-    ngx_memzero(&d->stats, sizeof(d->stats));
-    shm_set_allocd_pages_tracker(shm, &d->shmem_pages_used);
+    // don't reinitialize stub stats, because this may happen before the
+    // old workers shut down. Rather than add a generational conditional
+    // to __memstore_update_stub_status, we just don't reset the stats.
+    //ngx_memzero(&d->stats, sizeof(d->stats));
+#if nginx_version <= 1011006
+  shm_set_allocd_pages_tracker(shm, &d->shmem_pages_used);
+#endif
     shmtx_unlock(shm);
   }
   else {
@@ -564,15 +562,15 @@ static ngx_int_t initialize_shm(ngx_shm_zone_t *zone, void *data) {
     shdata->reloading = 0;
     
     
-    
     for(i=0; i< NGX_MAX_PROCESSES; i++) {
       shdata->procslot[i]=NCHAN_INVALID_SLOT;
     }
     ngx_memzero(&d->stats, sizeof(d->stats));
     
+#if nginx_version <= 1011006
     shdata->shmem_pages_used=0;
-    shm_set_allocd_pages_tracker(shm, &shdata->shmem_pages_used);
-    
+    shm_set_allocd_pages_tracker(shm, &d->shmem_pages_used);
+#endif
     DBG("Shm created with data at %p", d);
 #if NCHAN_MSG_LEAK_DEBUG
     shdata->msgdebug_head = NULL;
@@ -600,7 +598,11 @@ nchan_stub_status_t *nchan_get_stub_status_stats(void) {
 }
 
 size_t nchan_get_used_shmem(void) {
+#if nginx_version <= 1011006
   return shdata->shmem_pages_used * ngx_pagesize;
+#else
+  return shm_used_pages(shm) * ngx_pagesize;
+#endif
 }
 
 static int send_redis_fakesub_delta(memstore_channel_head_t *head) {
@@ -621,7 +623,7 @@ static void memstore_reap_chanhead(memstore_channel_head_t *ch) {
     ch->spooler.fn->broadcast_status(&ch->spooler, NGX_HTTP_GONE, &NCHAN_HTTP_STATUS_410);
   }
   stop_spooler(&ch->spooler, 0);
-  if(ch->cf && ch->cf->redis.enabled && !ch->multi) {
+  if(ch->cf && ch->cf->redis.enabled && ch->cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED && !ch->multi) {
     send_redis_fakesub_delta(ch);
     if(ch->delta_fakesubs_timer_ev.timer_set) {
       ngx_del_timer(&ch->delta_fakesubs_timer_ev);
@@ -632,6 +634,7 @@ static void memstore_reap_chanhead(memstore_channel_head_t *ch) {
     if(ch->shared)
       shm_free(shm, ch->shared);
   }
+  
   DBG("chanhead %p (%V) is empty and expired. DELETE.", ch, &ch->id);
   CHANNEL_HASH_DEL(ch);
   if(ch->redis_sub) {
@@ -640,6 +643,17 @@ static void memstore_reap_chanhead(memstore_channel_head_t *ch) {
     }
     memstore_redis_subscriber_destroy(ch->redis_sub);
   }
+  
+  if(ch->groupnode) {
+    if(ch->owner == memstore_slot()) {
+      memstore_group_dissociate_own_channel(ch);
+    }
+    memstore_group_remove_channel(ch);
+  }
+  assert(ch->groupnode_prev == NULL);
+  assert(ch->groupnode_next == NULL);
+  
+  
   if(ch->multi) {
     for(i=0; i < ch->multi_count; i++) {
       if(ch->multi[i].sub) {
@@ -650,6 +664,9 @@ static void memstore_reap_chanhead(memstore_channel_head_t *ch) {
     nchan_free_msg_id(&ch->latest_msgid);
     nchan_free_msg_id(&ch->oldest_msgid);
   }
+  
+  ch->status = DELETED;
+  
   ngx_free(ch);
 }
 
@@ -711,12 +728,14 @@ static ngx_int_t nchan_store_init_worker(ngx_cycle_t *cycle) {
   
   DBG("shm: %p, shdata: %p", shm, shdata);
   shmtx_unlock(shm);
+  
   return NGX_OK;
 }
 
 #define CHANHEAD_SHARED_OKAY(head) head->status == READY || head->status == STUBBED || (!head->stub && head->cf->redis.enabled == 1 && head->status == WAITING && head->owner == head->slot)
 
 void memstore_fakesub_add(memstore_channel_head_t *head, ngx_int_t n) {
+  assert(head->cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED);
   if(redis_fakesub_timer_interval == 0) {
     nchan_store_redis_fakesub_add(&head->id, head->cf, n, head->shutting_down);
   }
@@ -743,7 +762,6 @@ static void memstore_spooler_use_handler(channel_spooler_t *spl, void *d) {
 static void memstore_spooler_add_handler(channel_spooler_t *spl, subscriber_t *sub, void *privdata) {
   memstore_channel_head_t   *head = (memstore_channel_head_t *)privdata;
   head->total_sub_count++;
-  head->channel.subscribers++;
   if(sub->type == INTERNAL) {
     head->internal_sub_count++;
     if(head->shared) {
@@ -756,10 +774,13 @@ static void memstore_spooler_add_handler(channel_spooler_t *spl, subscriber_t *s
       assert(CHANHEAD_SHARED_OKAY(head));
       ngx_atomic_fetch_add(&head->shared->sub_count, 1);
     }
-    if(head->cf && head->cf->redis.enabled && !head->multi) {
+    if(head->cf && head->cf->redis.enabled && head->cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED && !head->multi) {
       memstore_fakesub_add(head, 1);
     }
     nchan_update_stub_status(subscribers, 1);
+    if(head->groupnode) {
+      memstore_group_add_subscribers(head->groupnode, 1);
+    }
     if(head->multi) {
       ngx_int_t      i, max = head->multi_count;
       subscriber_t  *msub;
@@ -770,9 +791,8 @@ static void memstore_spooler_add_handler(channel_spooler_t *spl, subscriber_t *s
         }
       }
     }
-    
   }
-
+  head->channel.subscribers = head->total_sub_count - head->internal_sub_count;
   assert(head->total_sub_count >= head->internal_sub_count);
 }
 
@@ -794,7 +814,7 @@ static void memstore_spooler_bulk_dequeue_handler(channel_spooler_t *spl, subscr
       assert(head->shutting_down == 1);
     }
     */
-    if(head->cf && head->cf->redis.enabled && !head->multi) {
+    if(head->cf && head->cf->redis.enabled && head->cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED && !head->multi) {
       memstore_fakesub_add(head, -count);
     }
     
@@ -810,6 +830,9 @@ static void memstore_spooler_bulk_dequeue_handler(channel_spooler_t *spl, subscr
         }
       }
     }
+    if(head->groupnode) {
+      memstore_group_add_subscribers(head->groupnode, -(count));
+    }
   }
   head->total_sub_count -= count;
   head->channel.subscribers = head->total_sub_count - head->internal_sub_count;
@@ -834,9 +857,7 @@ static ngx_int_t start_chanhead_spooler(memstore_channel_head_t *head) {
     NULL
   };
   
-  
-  //(head->use_redis && head->owner == memstore_slot()) ? FETCH_IGNORE_MSG_NOTFOUND : FETCH
-  start_spooler(&head->spooler, &head->id, &head->status, &nchan_store_memory, head->cf, (head->cf && head->cf->redis.enabled) ? FETCH_IGNORE_MSG_NOTFOUND : FETCH, &handlers, head);
+  start_spooler(&head->spooler, &head->id, &head->status, &head->msg_buffer_complete, &nchan_store_memory, head->cf, NCHAN_SPOOL_FETCH, &handlers, head);
   if(head->meta) {
     head->spooler.publish_events = 0;
   }
@@ -906,7 +927,7 @@ ngx_int_t memstore_ensure_chanhead_is_ready(memstore_channel_head_t *head, uint8
     }
   }
   else {
-    if(head->cf && head->cf->redis.enabled && !head->multi && head->status != READY) {
+    if(head->cf && head->cf->redis.enabled && !head->multi && head->status != READY) { //both redis BACKUP and DISTRIBUTED storage modes
       if(head->redis_sub == NULL) {
         head->redis_sub = memstore_redis_subscriber_create(head);
         nchan_store_redis.subscribe(&head->id, head->redis_sub);
@@ -929,18 +950,13 @@ ngx_int_t memstore_ensure_chanhead_is_ready(memstore_channel_head_t *head, uint8
 }
 
 
-static ngx_int_t is_multi_id(ngx_str_t *id) {
-  u_char         *cur = id->data;
-  return (cur[0] == 'm' && cur[1] == '/' && cur[2] == NCHAN_MULTI_SEP_CHR);
-}
-
 static ngx_int_t parse_multi_id(ngx_str_t *id, ngx_str_t ids[]) {
   ngx_int_t       n = 0;
   u_char         *cur = id->data;
   u_char         *last = cur + id->len;
   u_char         *sep;
   
-  if(is_multi_id(id)) {
+  if(nchan_channel_id_is_multi(id)) {
     cur += 3;
     while((sep = ngx_strlchr(cur, last, NCHAN_MULTI_SEP_CHR)) != NULL) {
       ids[n].data=cur;
@@ -953,6 +969,25 @@ static ngx_int_t parse_multi_id(ngx_str_t *id, ngx_str_t ids[]) {
   return 0;
 }
 
+static int count_channel_id(ngx_str_t *id) {
+  int       n = 0;
+  u_char   *cur = id->data;
+  u_char   *last = cur + id->len;
+  u_char   *sep;
+  
+  if(nchan_channel_id_is_multi(id)) {
+    cur += 3;
+    while((sep = ngx_strlchr(cur, last, NCHAN_MULTI_SEP_CHR)) != NULL) {
+      cur = sep + 1;
+      n++;
+    }
+    return n;
+  }
+  else {
+    return 1;
+  }
+}
+
 static void delta_fakesubs_timer_handler(ngx_event_t *ev) {
   memstore_channel_head_t *head = (memstore_channel_head_t *)ev->data;
   if(send_redis_fakesub_delta(head) && !ngx_exiting && !ngx_quit && ev->timedout) {
@@ -966,6 +1001,8 @@ static memstore_channel_head_t *chanhead_memstore_create(ngx_str_t *channel_id,
   ngx_int_t                     owner = memstore_channel_owner(channel_id);
   ngx_str_t                     ids[NCHAN_MULTITAG_MAX];
   ngx_int_t                     i, n = 0;
+  ngx_str_t                     group_name;
+  group_tree_node_t            *groupnode;
   
   head=ngx_calloc(sizeof(*head) + sizeof(u_char)*(channel_id->len), ngx_cycle->log);
   
@@ -995,26 +1032,18 @@ static memstore_channel_head_t *chanhead_memstore_create(ngx_str_t *channel_id,
     head->cf = NULL;
   }
   
-  if(head->cf && head->cf->redis.enabled && !head->multi) {
-    head->delta_fakesubs = 0;
-    nchan_init_timer(&head->delta_fakesubs_timer_ev, delta_fakesubs_timer_handler, head);
-    head->redis_idle_cache_ttl = cf->redis_idle_channel_cache_timeout;
-  }
-  else {
-    head->redis_idle_cache_ttl = 0;
-  }
-  
   if(head->slot == owner) {
     if((head->shared = shm_alloc(shm, sizeof(*head->shared), "channel shared data")) == NULL) {
-      ERR("can't allocate shared memory for (new) chanhead");
+      ngx_free(head);
+      nchan_log_ooshm_error("allocating channel %V", channel_id);
       return NULL;
     }
     head->shared->sub_count = 0;
     head->shared->internal_sub_count = 0;
     head->shared->total_message_count = 0;
     head->shared->stored_message_count = 0;
-    head->shared->last_seen = ngx_time();
-    
+    head->shared->last_seen = 0;
+    head->shared->gc.outside_refcount=0;
     nchan_update_stub_status(channels, 1);
   }
   else {
@@ -1033,20 +1062,20 @@ static memstore_channel_head_t *chanhead_memstore_create(ngx_str_t *channel_id,
   head->foreign_owner_ipc_sub = NULL;
   head->last_subscribed_local = 0;
   
-#if MESTORE_CHANHEAD_RESERVE_DEBUG
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
   nchan_list_init(&head->reserved, sizeof(char *), "chanhead reserve (debug)");
 #else
   head->reserved = 0;
 #endif
   head->multi=NULL;
   head->multi_count = 0;
-  head->multi_waiting = 0;
+  head->multi_subscribers_pending = 0;
   
   //set channel
   ngx_memcpy(&head->channel.id, &head->id, sizeof(ngx_str_t));
   head->channel.messages = 0;
   head->channel.subscribers = 0;
-  head->channel.last_seen = ngx_time();
+  head->channel.last_seen = 0;
   head->max_messages = (ngx_int_t) -1;
   
   if(head->id.len >= 5 && ngx_strncmp(head->id.data, "meta/", 5) == 0) {
@@ -1059,13 +1088,13 @@ static memstore_channel_head_t *chanhead_memstore_create(ngx_str_t *channel_id,
   
   head->spooler.running=0;
   
-  head->multi_waiting = 0;
   if((n = parse_multi_id(&head->id, ids)) > 0) {
     memstore_multi_t          *multi;
     int16_t                   *tags_latest, *tags_oldest;
     
     if((multi = ngx_calloc(sizeof(*multi) * n, ngx_cycle->log)) == NULL) {
       ERR("can't allocate multi array for multi-channel %p", head);
+      return NULL;
     }
     
     head->latest_msgid.time = 0;
@@ -1097,11 +1126,13 @@ static memstore_channel_head_t *chanhead_memstore_create(ngx_str_t *channel_id,
     }
     
     head->multi_count = n;
+    head->multi_subscribers_pending = n;
     head->multi = multi;
     head->owner = head->slot; //multis are always self-owned
   }
   else {
     head->multi_count = 0;
+    head->multi_subscribers_pending = n;
     
     head->latest_msgid.time = 0;
     head->latest_msgid.tag.fixed[0] = 0;
@@ -1114,8 +1145,41 @@ static memstore_channel_head_t *chanhead_memstore_create(ngx_str_t *channel_id,
     head->multi = NULL;
   }
   
+  if(head->cf && head->cf->redis.enabled && !head->multi) { // both DISTRIBUTED and BACKUP redis storage modes
+    nchan_init_timer(&head->delta_fakesubs_timer_ev, delta_fakesubs_timer_handler, head);
+    head->delta_fakesubs = 0;
+    head->redis_idle_cache_ttl = cf->redis_idle_channel_cache_timeout;
+    
+    
+    if(head->slot == owner) {
+      head->msg_buffer_complete = 0;
+    }
+    else {
+      head->msg_buffer_complete = 1; //always assume buffer is complete, and let the owner figure out the details
+    }
+  }
+  else {
+    head->redis_idle_cache_ttl = 0;
+    head->msg_buffer_complete = 1;
+  }
+  
   start_chanhead_spooler(head);
 
+  //get group
+  if(cf && cf->group.enable_accounting) {
+    group_name = nchan_get_group_from_channel_id(&head->id);
+    if((groupnode = memstore_groupnode_get(groups, &group_name)) == NULL) {
+      ERR("couldn't get groupnode %V for chanhead %V", &group_name, &head->id);
+    }
+    else {
+      head->groupnode = groupnode;
+      memstore_group_add_channel(head);
+      if(head->owner == head->slot) {
+        memstore_group_associate_own_channel(head);
+      }
+    }
+  }
+  
   CHANNEL_HASH_ADD(head);
   
   return head;
@@ -1134,10 +1198,56 @@ static ngx_inline memstore_channel_head_t *ensure_chanhead_ready_or_trash_chanhe
 
 memstore_channel_head_t * nchan_memstore_find_chanhead(ngx_str_t *channel_id) {
   memstore_channel_head_t     *head = NULL;
+  //ERR("channel id %V", channel_id);
   CHANNEL_HASH_FIND(channel_id, head);
   return ensure_chanhead_ready_or_trash_chanhead(head, 1);
 }
 
+typedef struct {
+  ngx_str_t        *chid;
+  nchan_loc_conf_t *cf;
+  callback_pt       cb;
+  void             *pd;
+} find_ch_backup_data_t;
+
+
+static ngx_int_t memstore_find_chanhead_with_backup_callback(ngx_int_t rc, void *vd, void *pd) {
+  nchan_channel_t             *chinfo = vd;
+  find_ch_backup_data_t       *d = pd;
+  memstore_channel_head_t     *ch = NULL;
+  if(chinfo) {
+    ch = nchan_memstore_get_chanhead(d->chid, d->cf);
+    d->cb(ch ? NGX_OK : NGX_ERROR, ch, d->pd);
+  }
+  else {
+    d->cb(NGX_OK, NULL, d->pd);
+  }
+  
+  ngx_free(d);
+  return NGX_OK;
+}
+
+ngx_int_t nchan_memstore_find_chanhead_with_backup(ngx_str_t *channel_id, nchan_loc_conf_t *cf, callback_pt cb, void *pd) {
+  memstore_channel_head_t     *head = NULL;
+  if((head = nchan_memstore_find_chanhead(channel_id)) == NULL) {
+    find_ch_backup_data_t     *d = ngx_alloc(sizeof(*d), ngx_cycle->log);
+    if(!d) {
+      ERR("couldn't allocate data for nchan_memstore_find_chanhead_with_backup");
+      cb(NGX_ERROR, NULL, pd);
+      return NGX_ERROR;
+    }
+    d->chid = channel_id;
+    d->cf = cf;
+    d->cb = cb;
+    d->pd = pd;
+    
+    return nchan_store_redis.find_channel(channel_id, cf, memstore_find_chanhead_with_backup_callback, d);
+  }
+  
+  cb(NGX_OK, head, pd);
+  return NGX_OK;
+}
+
 memstore_channel_head_t *nchan_memstore_get_chanhead(ngx_str_t *channel_id, nchan_loc_conf_t *cf) {
   memstore_channel_head_t          *head;
   head = nchan_memstore_find_chanhead(channel_id);
@@ -1174,7 +1284,8 @@ ngx_int_t chanhead_gc_add(memstore_channel_head_t *ch, const char *reason) {
     assert(ch->foreign_owner_ipc_sub == NULL); //we don't accept still-subscribed chanheads
   }
   
-  if(ch->slot != ch->owner) {
+  if(ch->slot != ch->owner && ch->shared) {
+    ngx_atomic_fetch_add(&ch->shared->gc.outside_refcount, -1);
     ch->shared = NULL;
   }
   if(ch->status == WAITING && !(ch->cf && ch->cf->redis.enabled) && !(ngx_exiting || ngx_quit)) {
@@ -1184,6 +1295,7 @@ ngx_int_t chanhead_gc_add(memstore_channel_head_t *ch, const char *reason) {
   }
   
   assert(ch->slot == slot);
+  
   if(! ch->in_gc_queue) {
     ch->gc_start_time = ngx_time();
     ch->status = INACTIVE;
@@ -1244,16 +1356,31 @@ static ngx_str_t *chanhead_msg_to_str(store_message_t *msg) {
 }
 */
 
-ngx_int_t nchan_memstore_publish_generic(memstore_channel_head_t *head, nchan_msg_t *msg, ngx_int_t status_code, const ngx_str_t *status_line) {
+ngx_int_t nchan_memstore_publish_notice(memstore_channel_head_t *head, ngx_int_t notice_code, const void *notice_data) {
   
-  ngx_int_t          shared_sub_count = 0;
+  DBG("tried publishing notice %i to chanhead %p (subs: %i)", notice_code, head, head->total_sub_count);
   
-  if(head->shared) {
-    if(!(head->cf && head->cf->redis.enabled) && !head->multi) {
-      assert(head->status == READY || head->status == STUBBED);
-    }
-    shared_sub_count = head->shared->sub_count;
+  switch(notice_code) {
+    case NCHAN_NOTICE_BUFFER_LOADED:
+      //DBG("buffer loaded from Redis");
+      if(head->msg_buffer_complete == 0) {
+        head->msg_buffer_complete = 1;
+        ensure_chanhead_ready_or_trash_chanhead(head, 0);
+        head->spooler.fn->handle_channel_status_change(&head->spooler);
+      }
+      break;
+    
+    default:
+      //do nothing
+      break;
   }
+  
+  return head->spooler.fn->broadcast_notice(&head->spooler, notice_code, (void *)notice_data);
+}
+
+ngx_int_t nchan_memstore_publish_generic(memstore_channel_head_t *head, nchan_msg_t *msg, ngx_int_t status_code, const ngx_str_t *status_line) {
+  
+  ngx_int_t          shared_sub_count = 0;
 
   if(head==NULL) {
     /*
@@ -1266,26 +1393,22 @@ ngx_int_t nchan_memstore_publish_generic(memstore_channel_head_t *head, nchan_ms
     */
     return NCHAN_MESSAGE_QUEUED;
   }
+  
+  if(head->shared) {
+    if(!(head->cf && head->cf->redis.enabled) && !head->multi) {
+      assert(head->status == READY || head->status == STUBBED);
+    }
+    shared_sub_count = head->shared->sub_count;
+  }
 
   if(msg) {
     //DBG("tried publishing %V to chanhead %p (subs: %i)", msgid_to_str(&msg->id), head, head->total_sub_count);
     head->spooler.fn->respond_message(&head->spooler, msg);
-
-#if NCHAN_BENCHMARK
-    struct timeval          tv, diff;
-    ngx_gettimeofday(&tv);
-    nchan_timeval_subtract(&diff, &tv, &msg->start_tv);
-    
-    ngx_str_t              *msgid_str = msgid_to_str(&msg->id);
-    
-    assert(diff.tv_sec < 10);
-    
-    ERR("::BENCH:: channel %V msg %p <%V> len %i responded to %i in %l.%06l sec", &head->id, msg, msgid_str, ngx_buf_size(msg->buf), head->spooler.last_responded_subscriber_count, (long int)(diff.tv_sec), (long int)(diff.tv_usec));
-#endif
     
-    if(msg->temp_allocd) {
-      ngx_free(msg);
-    }
+    //wait what?...
+    //if(msg->temp_allocd) {
+    //  ngx_free(msg);
+    //}
   }
   else {
     DBG("tried publishing status %i to chanhead %p (subs: %i)", status_code, head, head->total_sub_count);
@@ -1340,27 +1463,39 @@ static ngx_int_t delete_multi_callback_handler(ngx_int_t code, nchan_channel_t*
   return NGX_OK;
 }
 
-static ngx_int_t nchan_memstore_force_delete_chanhead(memstore_channel_head_t *ch, callback_pt callback, void *privdata);
-
 static ngx_int_t nchan_store_delete_single_channel_id(ngx_str_t *channel_id, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
   ngx_int_t                owner;
-
-  assert(!is_multi_id(channel_id));
+  ngx_int_t                rc;
+  
+  assert(!nchan_channel_id_is_multi(channel_id));
   owner = memstore_channel_owner(channel_id);
   
   if(cf->redis.enabled) {
-    return nchan_store_redis.delete_channel(channel_id, cf, callback, privdata);
+    if(cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED) {
+      return nchan_store_redis.delete_channel(channel_id, cf, callback, privdata);
+    }
+    else {
+      nchan_store_redis.delete_channel(channel_id, cf, NULL, NULL);
+    }
   }
-  else if(owner == memstore_slot()) {
+  
+  if(owner == memstore_slot()) {
     return nchan_memstore_force_delete_channel(channel_id, callback, privdata);
   }
   else {
-    return memstore_ipc_send_delete(owner, channel_id, callback, privdata);
+    rc = memstore_ipc_send_delete(owner, channel_id, callback, privdata);
+    if(rc == NGX_DECLINED) {
+      callback(NGX_HTTP_INSUFFICIENT_STORAGE, NULL, privdata);
+      return NGX_ERROR;
+    }
+    else {
+      return NGX_OK;
+    }
   }
 }
 
 static ngx_int_t nchan_store_delete_channel(ngx_str_t *channel_id, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
-  if(!is_multi_id(channel_id)) {
+  if(!nchan_channel_id_is_multi(channel_id)) {
     return nchan_store_delete_single_channel_id(channel_id, cf, callback, privdata);
   }
   else {
@@ -1435,13 +1570,20 @@ static ngx_int_t nchan_store_find_channel(ngx_str_t *channel_id, nchan_loc_conf_
   ngx_int_t                    owner = memstore_channel_owner(channel_id);
   memstore_channel_head_t     *ch;
   nchan_channel_t              chaninfo;
-  if(cf->redis.enabled) {
+  
+  if(cf->redis.enabled && cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED) {
     return nchan_store_redis.find_channel(channel_id, cf, callback, privdata);
   }
   else if(memstore_slot() == owner) {
     ch = nchan_memstore_find_chanhead(channel_id);
     if(ch == NULL) {
-      callback(NGX_OK, NULL, privdata);
+      if(cf->redis.enabled && cf->redis.storage_mode == REDIS_MODE_BACKUP) {
+        DBG("channel %V not found in backup mode. Try Redis...", channel_id);
+        return nchan_store_redis.find_channel(channel_id, cf, callback, privdata);
+      }
+      else {
+        callback(NGX_OK, NULL, privdata);
+      }
     }
     else {
       chaninfo = ch->channel;
@@ -1454,7 +1596,9 @@ static ngx_int_t nchan_store_find_channel(ngx_str_t *channel_id, nchan_loc_conf_
     
   }
   else {
-    memstore_ipc_send_get_channel_info(owner, channel_id, callback, privdata);
+    if(memstore_ipc_send_get_channel_info(owner, channel_id, cf, callback, privdata) == NGX_DECLINED) {
+      callback(NGX_HTTP_INSUFFICIENT_STORAGE, NULL, privdata);
+    }
   }
   return NGX_OK;
 }
@@ -1530,6 +1674,11 @@ static ngx_int_t nchan_store_init_module(ngx_cycle_t *cycle) {
   }
   ipc_open(ipc, cycle, shdata->max_workers, &init_shdata_procslots);
 
+  if(groups == NULL) {
+    groups = &groups_data;
+    memstore_groups_init(groups);
+  }
+  
   //initialize default shared multi-channel config
   ngx_memzero(&default_multiconf, sizeof(default_multiconf));
   default_multiconf.complex_message_timeout = NULL;
@@ -1555,6 +1704,7 @@ static ngx_int_t nchan_store_init_postconfig(ngx_conf_t *cf) {
   redis_fakesub_timer_interval = conf->redis_fakesub_timer_interval;
   
   shm = shm_create(&name, cf, conf->shm_size, initialize_shm, &ngx_nchan_module);
+  nchan_store_memory_shmem = shm;
   return NGX_OK;
 }
 
@@ -1596,6 +1746,8 @@ static void nchan_store_exit_worker(ngx_cycle_t *cycle) {
   }
 #endif
   
+  memstore_groups_shutdown(groups);
+  
   shmtx_lock(shm);
   
   if(shdata->old_max_workers == NGX_CONF_UNSET) {
@@ -1615,7 +1767,6 @@ static void nchan_store_exit_worker(ngx_cycle_t *cycle) {
     ERR("my procslot not found! I don't know what to do!");
     assert(0);
   }
-  
   ipc_close(ipc, cycle);
   
   if(shdata->reloading == 0) {
@@ -1678,11 +1829,11 @@ static ngx_int_t validate_chanhead_messages(memstore_channel_head_t *ch) {
   return NGX_OK;
 }
 
-static ngx_int_t memstore_reap_message( nchan_msg_t *msg ) {
-  ngx_buf_t         *buf = msg->buf;
+static void memstore_reap_message( nchan_msg_t *msg ) {
+  ngx_buf_t         *buf = &msg->buf;
   ngx_file_t        *f = buf->file;
   
-  assert(msg->refcount == MSG_REFCOUNT_INVALID);
+  assert(!msg_refcount_valid(msg));
   
   if(f != NULL) {
     if(f->fd != NGX_INVALID_FILE) {
@@ -1694,6 +1845,14 @@ static ngx_int_t memstore_reap_message( nchan_msg_t *msg ) {
     }
     ngx_delete_file(f->name.data); // assumes string is zero-terminated, which required trickery during allocation
   }
+  
+  if(msg->compressed && msg->compressed->buf.file) {
+    f = msg->compressed->buf.file;
+    if(f->fd != NGX_INVALID_FILE) {
+      ngx_close_file(f->fd);
+    }
+    ngx_delete_file(f->name.data); // assumes string is zero-terminated, which required trickery during allocation
+  }
   //DBG("free smsg %p",s msg);
 #if NCHAN_MSG_LEAK_DEBUG  
   msg_debug_remove(msg);
@@ -1705,16 +1864,14 @@ static ngx_int_t memstore_reap_message( nchan_msg_t *msg ) {
   ngx_memset(msg, 0xFA, sizeof(*msg)); //debug stuff
   shm_free(shm, msg);
   nchan_update_stub_status(messages, -1);
-  return NGX_OK;
 }
 
-static ngx_int_t memstore_reap_store_message( store_message_t *smsg ) {
+static void memstore_reap_store_message( store_message_t *smsg ) {
   
   memstore_reap_message(smsg->msg);
   
   ngx_memset(smsg, 0xBC, sizeof(*smsg)); //debug stuff
   ngx_free(smsg);
-  return NGX_OK;
 }
 
 
@@ -1745,6 +1902,10 @@ static ngx_int_t chanhead_delete_message(memstore_channel_head_t *ch, store_mess
   
   ngx_atomic_fetch_add(&ch->shared->stored_message_count, -1);
   
+  if(ch->groupnode) {
+    memstore_group_remove_message(ch->groupnode, msg->msg);
+  }
+  
   if(ch->channel.messages == 0) {
     assert(ch->msg_first == NULL);
     assert(ch->msg_last == NULL);
@@ -1803,6 +1964,8 @@ store_message_t *chanhead_find_next_message(memstore_channel_head_t *ch, nchan_m
   time_t           mid_time; //optimization yeah
   int16_t          mid_tag; //optimization yeah
   
+  assert(ch->msg_buffer_complete); //we only deal with complete buffers here
+  
   //DBG("find next message %V", msgid_to_str(msgid));
   if(ch == NULL) {
     *status = MSG_NOTFOUND;
@@ -1838,6 +2001,7 @@ store_message_t *chanhead_find_next_message(memstore_channel_head_t *ch, nchan_m
     store_message_t  *prev = NULL;
     
     assert(mid_tag != 0);
+    
     for(cur = (direction>0 ? ch->msg_first : ch->msg_last); cur != NULL && n > 1; cur = (direction>0 ? cur->next : cur->prev)) {
       prev = cur;
       n--;
@@ -1891,6 +2055,8 @@ typedef struct {
   nchan_msg_id_t               msg_id;
   callback_pt                  cb;
   void                        *cb_privdata;
+  unsigned                     channel_exists:1;
+  unsigned                     group_channel_limit_pass:1;
   unsigned                     reserved:1;
   unsigned                     subbed:1;
   unsigned                     allocd:1;
@@ -1925,7 +2091,7 @@ static void subscribe_data_free(subscribe_data_t *d) {
 #define SUB_CHANNEL_AUTHORIZED 1
 #define SUB_CHANNEL_NOTSURE 2
 
-static ngx_int_t nchan_store_subscribe_sub_auth_check_callback(ngx_int_t channel_status, void* _, subscribe_data_t *d);
+static ngx_int_t nchan_store_subscribe_channel_existence_check_callback(ngx_int_t channel_status, void* _, subscribe_data_t *d);
 static ngx_int_t nchan_store_subscribe_continued(ngx_int_t channel_status, void* _, subscribe_data_t *d);
 
 static ngx_int_t nchan_store_subscribe(ngx_str_t *channel_id, subscriber_t *sub) {
@@ -1939,42 +2105,50 @@ static ngx_int_t nchan_store_subscribe(ngx_str_t *channel_id, subscriber_t *sub)
   d->sub = sub;
   d->subbed = 0;
   d->reserved = 0;
+  d->channel_exists = 0;
+  d->group_channel_limit_pass = 0;
   d->msg_id = sub->last_msgid;
   
   if(sub->cf->subscribe_only_existing_channel || sub->cf->max_channel_subscribers > 0) {
     sub->fn->reserve(sub);
     d->reserved = 1;
     if(memstore_slot() != owner) {
-      memstore_ipc_send_channel_auth_check(owner, channel_id, sub->cf, (callback_pt )nchan_store_subscribe_sub_auth_check_callback, d);
+      ngx_int_t rc;
+      rc = memstore_ipc_send_channel_existence_check(owner, channel_id, sub->cf, (callback_pt )nchan_store_subscribe_channel_existence_check_callback, d);
+      if(rc == NGX_DECLINED) { // out of memory
+        nchan_store_subscribe_channel_existence_check_callback(SUB_CHANNEL_UNAUTHORIZED, NULL, d);
+        return NGX_ERROR;
+      }
     }
     else {
-      nchan_store_subscribe_continued(SUB_CHANNEL_NOTSURE, NULL, d);
+      return nchan_store_subscribe_continued(SUB_CHANNEL_NOTSURE, NULL, d);
     }
   }
   else {
-    nchan_store_subscribe_continued(SUB_CHANNEL_AUTHORIZED, NULL, d);
+    return nchan_store_subscribe_continued(SUB_CHANNEL_AUTHORIZED, NULL, d);
   }
-  
   return NGX_OK;
 }
 
-static ngx_int_t nchan_store_subscribe_sub_auth_check_callback(ngx_int_t channel_status, void* _, subscribe_data_t *d) {
+static ngx_int_t nchan_store_subscribe_channel_existence_check_callback(ngx_int_t channel_status, void* _, subscribe_data_t *d) {
   if(d->sub->fn->release(d->sub, 0) == NGX_OK) {
     d->reserved = 0;
     return nchan_store_subscribe_continued(channel_status, _, d);
   }
   else {//don't go any further, the sub has been deleted
-    assert(d->sub->reserved == 0);
     subscribe_data_free(d);
     return NGX_OK;
   }
 }
 
-static ngx_int_t redis_subscribe_channel_authcheck_callback(ngx_int_t status, void *ch, void *d) {
+static ngx_int_t redis_subscribe_channel_existence_callback(ngx_int_t status, void *ch, void *d) {
   nchan_channel_t    *channel = (nchan_channel_t *)ch;
   subscribe_data_t   *data = (subscribe_data_t *)d;
   nchan_loc_conf_t   *cf = data->sub->cf;
   ngx_int_t           channel_status;
+  
+  data->channel_exists = channel != NULL;
+  
   if(status == NGX_OK) {
     if(channel == NULL) {
       channel_status = cf->subscribe_only_existing_channel ? SUB_CHANNEL_UNAUTHORIZED : SUB_CHANNEL_AUTHORIZED;
@@ -1989,6 +2163,7 @@ static ngx_int_t redis_subscribe_channel_authcheck_callback(ngx_int_t status, vo
     */
     else {
       channel_status = SUB_CHANNEL_AUTHORIZED;
+
     }
     nchan_store_subscribe_continued(channel_status, NULL, data);
   }
@@ -1999,26 +2174,159 @@ static ngx_int_t redis_subscribe_channel_authcheck_callback(ngx_int_t status, vo
   return NGX_OK;
 }
 
-static ngx_int_t nchan_store_subscribe_continued(ngx_int_t channel_status, void* _, subscribe_data_t *d) {
-  memstore_channel_head_t       *chanhead = NULL;
-  //store_message_t             *chmsg;
-  //nchan_msg_status_t           findmsg_status;
-  ngx_int_t                      not_dead;
-  ngx_int_t                      use_redis = d->sub->cf->redis.enabled;
-  nchan_loc_conf_t              *cf = d->sub->cf;
-  ngx_int_t                      rc = NGX_OK;
+static ngx_int_t group_subscribe_accounting_check(ngx_int_t rc, nchan_group_t *shm_group, subscribe_data_t *d) {
   
-  switch(channel_status) {
-    case SUB_CHANNEL_AUTHORIZED:
-      chanhead = nchan_memstore_get_chanhead(d->channel_id, cf);
-      break;
-    
-    case SUB_CHANNEL_UNAUTHORIZED:
-      chanhead = NULL;
+  memstore_channel_head_t  *ch = ensure_chanhead_ready_or_trash_chanhead(d->chanhead, 0);
+  
+  if(ch && d->sub->status != DEAD) {
+    if(shm_group) {
+      if(!shm_group->limit.subscribers || shm_group->subscribers < shm_group->limit.subscribers) { 
+        //not an atomic comparison but we don't really care
+        d->chanhead->spooler.fn->add(&d->chanhead->spooler, d->sub);
+      }
+      else {
+        d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL, NULL);
+      }
+    }
+    else {
+      ERR("coldn't find group for group_subscribe_accounting_check");
+      d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL, NULL);
+    }
+  }
+  
+  if(d->reserved) {
+    d->sub->fn->release(d->sub, 0);
+  }
+  memstore_chanhead_release(d->chanhead, "group accounting check");
+  
+  subscribe_data_free(d);
+  return NGX_OK;
+}
+
+
+static ngx_int_t group_subscribe_channel_limit_reached(ngx_int_t rc, nchan_channel_t *chaninfo, subscribe_data_t *d) {
+  //no new hannels!
+  if(d->sub->status != DEAD) {
+    if(chaninfo) {
+      //ok, channel already exists.
+      nchan_store_subscribe_continued(SUB_CHANNEL_AUTHORIZED, NULL, d);
+    }
+    else {
+      //nope. no channel, no subscribing.
+      d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL, NULL);
+      if(d->reserved)  d->sub->fn->release(d->sub, 0);
+      subscribe_data_free(d);
+    }
+  }
+  else {
+    if(d->reserved)  d->sub->fn->release(d->sub, 0);
+    subscribe_data_free(d);
+  }
+  return NGX_OK;
+}
+
+static ngx_int_t group_subscribe_channel_limit_check(ngx_int_t _, nchan_group_t *shm_group, subscribe_data_t *d) {
+  ngx_int_t    rc = NGX_OK;
+  DBG("group subscribe limit check");
+  if(d->sub->status != DEAD) {
+    if(shm_group) {
+      if(!shm_group->limit.channels || (shm_group->channels < shm_group->limit.channels)) {
+        d->group_channel_limit_pass = 1;
+        rc = nchan_store_subscribe_continued(SUB_CHANNEL_AUTHORIZED, NULL, d);
+      }
+      else if (shm_group->limit.channels && shm_group->channels == shm_group->limit.channels){
+        //no new channels!
+        rc = nchan_store_find_channel(d->channel_id, d->sub->cf, (callback_pt )group_subscribe_channel_limit_reached, d);
+      }
+      else {
+        rc = nchan_store_subscribe_continued(SUB_CHANNEL_UNAUTHORIZED, NULL, d);
+      }
+      
+    }
+    else {
+      //well that's unusual...
+      ERR("coldn't find group for group_subscribe_channel_limit_check");
+      d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL, NULL);
+      if(d->reserved)  d->sub->fn->release(d->sub, 0);
+      subscribe_data_free(d);
+      rc = NGX_ERROR;
+    }
+  }
+  else {
+    if(d->reserved)  d->sub->fn->release(d->sub, 0);
+    subscribe_data_free(d);
+  }
+  return rc;
+}
+
+static ngx_int_t nchan_store_subscribe_continued(ngx_int_t channel_status, void* _, subscribe_data_t *d) {
+  memstore_channel_head_t       *chanhead = NULL;
+  int                            retry_null_chanhead = 1;
+  //store_message_t             *chmsg;
+  //nchan_msg_status_t           findmsg_status;
+  ngx_int_t                      check_redis = d->sub->cf->redis.enabled; // for BACKUP and DISTRIBUTED mode
+  nchan_loc_conf_t              *cf = d->sub->cf;
+  ngx_int_t                      rc = NGX_OK;
+  nchan_request_ctx_t           *ctx = NULL;
+  
+  if(d->sub->status == DEAD) {
+    if(d->reserved) {
+      d->sub->fn->release(d->sub, 0);
+      d->reserved = 0;
+    }
+    subscribe_data_free(d);
+    return rc;
+  }
+  
+  if(d->sub->request) {
+    ctx = ngx_http_get_module_ctx(d->sub->request, ngx_nchan_module);
+  }
+  
+  switch(channel_status) {
+    case SUB_CHANNEL_AUTHORIZED:
+      if(cf->group.enable_accounting) {
+        //now we dance the careful dance of making sure the group channel limit is not exceeded
+        //it isn't a pretty dance.
+        if(d->group_channel_limit_pass || d->channel_exists) {
+          //already checked, or no need to check
+          chanhead = nchan_memstore_get_chanhead(d->channel_id, cf);
+          retry_null_chanhead = 0;
+          if(!chanhead) rc = NGX_ERROR;
+        }
+        else if((chanhead = nchan_memstore_find_chanhead(d->channel_id)) != NULL) {
+          //well, the channel exists already, so using it won't exceed the limit
+          d->group_channel_limit_pass = 1;
+        }
+        else {
+          //can't find the channel. gotta check if it really does exist
+          DBG("can't find the channel. gotta check if it really does exist");
+          if(ctx) {
+            if(!d->reserved) {
+              d->sub->fn->reserve(d->sub);
+              d->reserved = 1;
+            }
+            return memstore_group_find(groups, nchan_get_group_name(d->sub->request, cf, ctx), (callback_pt )group_subscribe_channel_limit_check, d);
+          }
+          else {
+            retry_null_chanhead = 0;
+            rc = NGX_ERROR;
+            chanhead = NULL;
+          }
+        }
+      }
+      else {
+        chanhead = nchan_memstore_get_chanhead(d->channel_id, cf);
+        if(!chanhead) rc = NGX_ERROR;
+        retry_null_chanhead = 0;
+      }
+      break;
+    
+    case SUB_CHANNEL_UNAUTHORIZED:
+      chanhead = NULL;
       break;
     
     case SUB_CHANNEL_NOTSURE:
-      if(use_redis) {
+      if(check_redis) {
         if(cf->subscribe_only_existing_channel) {
           //we used to also check if cf->max_channel_subscribers == 0 here, but that's
           //no longer necessary, as the shared subscriber total check is now disabled
@@ -2026,8 +2334,8 @@ static ngx_int_t nchan_store_subscribe_continued(ngx_int_t channel_status, void*
             break;
           }
         }
-        nchan_store_redis.find_channel(d->channel_id, cf, redis_subscribe_channel_authcheck_callback, d);
-        return NGX_OK;
+        nchan_store_redis.find_channel(d->channel_id, cf, redis_subscribe_channel_existence_callback, d);
+        return rc;
       }
       else {
         chanhead = nchan_memstore_find_chanhead(d->channel_id);
@@ -2035,14 +2343,12 @@ static ngx_int_t nchan_store_subscribe_continued(ngx_int_t channel_status, void*
       break;
   }
   
-  not_dead = d->sub->status != DEAD;
 
   if ((channel_status == SUB_CHANNEL_UNAUTHORIZED) || 
       (!chanhead && cf->subscribe_only_existing_channel) ||
       (chanhead && cf->max_channel_subscribers > 0 && chanhead->shared && chanhead->shared->sub_count >= (ngx_uint_t )cf->max_channel_subscribers)) {
-    if(not_dead) {
-      d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL);
-    }
+    
+    d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL, NULL);
     
     if(d->reserved) {
       d->sub->fn->release(d->sub, 0);
@@ -2054,19 +2360,14 @@ static ngx_int_t nchan_store_subscribe_continued(ngx_int_t channel_status, void*
     d->sub = NULL; //debug
     //d->cb(NGX_HTTP_NOT_FOUND, NULL, d->cb_privdata);
     subscribe_data_free(d);
-    return NGX_OK;
+    return rc;
   }
-  else if(!chanhead) {
+  else if(!chanhead && retry_null_chanhead) {
     chanhead = nchan_memstore_get_chanhead(d->channel_id, cf);
   }
   
   if(!chanhead) { //nchan_memstore_get_chanhead could fail when out of shared memory
-    if(not_dead) {
-      //this response does something funny (i.e. crashy) to the finalize_request function
-      //no response for now, but TODO: get this right
-      //d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL);
       rc = NGX_ERROR;
-    }
   }
   
   d->chanhead = chanhead;
@@ -2075,8 +2376,47 @@ static ngx_int_t nchan_store_subscribe_continued(ngx_int_t channel_status, void*
     d->sub->fn->release(d->sub, 1);
     d->reserved = 0;
   }
-  if(chanhead && not_dead) {
-    chanhead->spooler.fn->add(&chanhead->spooler, d->sub);
+  if(chanhead) {
+    
+    //check message id appropriateness
+    if(!nchan_msgid_tagcount_match(&d->sub->last_msgid, chanhead->multi ? chanhead->multi_count : 1)) {
+      d->sub->fn->reserve(d->sub);
+      d->sub->fn->respond_status(d->sub, NGX_HTTP_BAD_REQUEST, NULL, NULL);
+      d->sub->fn->release(d->sub, 0);
+    }
+    else if(cf->group.enable_accounting || chanhead->groupnode) {
+      //per-group max subscriber check
+      DBG("per-group max subscriber check");
+      assert(d->allocd);
+      d->sub->fn->reserve(d->sub);
+      d->reserved = 1;
+      memstore_chanhead_reserve(chanhead, "group accounting check");
+      if(chanhead->groupnode) {
+        DBG("memstore_group_find_from_groupnode(groups, chanhead->groupnode, (callback_pt )group_subscribe_accounting_check, d) sub: %p", d->sub);
+        memstore_group_find_from_groupnode(groups, chanhead->groupnode, (callback_pt )group_subscribe_accounting_check, d);
+      }
+      else {
+        if(ctx) {
+          // this means group accounting was disabled when the channel was created.
+          // that's okay though, we should check it anyway.
+          DBG("memstore_group_find(groups, nchan_get_group_name(d->sub->request, cf, ctx), (callback_pt )group_subscribe_accounting_check, d); sub: %p", d->sub);
+          memstore_group_find(groups, nchan_get_group_name(d->sub->request, cf, ctx), (callback_pt )group_subscribe_accounting_check, d);
+        }
+        else {
+          d->sub->fn->respond_status(d->sub, NGX_HTTP_BAD_REQUEST, NULL, NULL);
+          subscribe_data_free(d);
+          return NGX_ERROR;
+        }
+      }
+      return rc;
+    }
+    else {
+      chanhead->spooler.fn->add(&chanhead->spooler, d->sub);
+    }
+  }
+  else {
+    //out-of-memory condition
+    d->sub->fn->respond_status(d->sub, NGX_HTTP_INSUFFICIENT_STORAGE, NULL, NULL);
   }
 
   subscribe_data_free(d);
@@ -2124,21 +2464,28 @@ static ngx_inline void set_multimsg_msg(get_multi_message_data_t *d, get_multi_m
   d->msg_status = status;
 }
 
-static ngx_int_t nchan_store_async_get_multi_message_callback(nchan_msg_status_t status, nchan_msg_t *msg, get_multi_message_data_single_t *sd);
+static ngx_int_t nchan_store_async_get_multi_message_callback(ngx_int_t code, void *d, void *pd);
 
-static void retry_get_multi_message_after_MSG_NORESPONSE(void *pd) {
-  get_multi_message_data_single_t  *sd = pd;
-  get_multi_message_data_t         *d = sd->d;
-  nchan_msg_id_t                    retry_msgid = NCHAN_ZERO_MSGID;
-  assert(nchan_extract_from_multi_msgid(&d->wanted_msgid, sd->n, &retry_msgid) == NGX_OK);
-  nchan_store_async_get_message(&d->chanhead->multi[sd->n].id, &retry_msgid, d->chanhead->cf, (callback_pt )nchan_store_async_get_multi_message_callback, sd);
+static ngx_int_t nchan_store_async_get_multi_message_callback_cleanup(get_multi_message_data_t *d) {
+  if(d->getting == 0) {
+    nchan_free_msg_id(&d->wanted_msgid);
+    if(d->timer.timer_set) {
+      ngx_del_timer(&d->timer);
+    }
+    ngx_free(d);
+  }
+  return NGX_OK;
 }
 
-static ngx_int_t nchan_store_async_get_multi_message_callback(nchan_msg_status_t status, nchan_msg_t *msg, get_multi_message_data_single_t *sd) {
+static ngx_int_t nchan_store_async_get_multi_message_callback(ngx_int_t code, void *ptr, void *pd) {
+  nchan_msg_status_t          status = code;
+  nchan_msg_t                *msg = ptr;
+  get_multi_message_data_single_t *sd = pd;
+  
   static int16_t              multi_largetag[NCHAN_MULTITAG_MAX], multi_prevlargetag[NCHAN_MULTITAG_MAX];
   //ngx_str_t                   empty_id_str = ngx_string("-");
   get_multi_message_data_t   *d = sd->d;
-  nchan_msg_copy_t            retmsg;
+  nchan_msg_t                 retmsg;
   
   /*
   switch(status) {
@@ -2152,15 +2499,7 @@ static ngx_int_t nchan_store_async_get_multi_message_callback(nchan_msg_status_t
   if(d->expired) {
     ERR("multimsg callback #%i for %p received after expiring at %ui status %i msg %p", d->n, d, d->expired, status, msg);
     d->getting--;
-    goto cleanup;
-  }
-  
-  if(status == MSG_NORESPONSE) {
-    //retry featching that message
-    //this isn't clean, nor is it efficient
-    //buf fuck it, we're doing it live.
-    nchan_add_oneshot_timer(retry_get_multi_message_after_MSG_NORESPONSE, sd, 10);
-    return NGX_OK;
+    return nchan_store_async_get_multi_message_callback_cleanup(d);
   }
   d->getting--;
   
@@ -2200,40 +2539,38 @@ static ngx_int_t nchan_store_async_get_multi_message_callback(nchan_msg_status_t
     memstore_chanhead_release(d->chanhead, "multimsg");
     if(d->msg) {
       int16_t      *muhtags;
-      
       ngx_int_t     n = d->n;
-      retmsg.copy = *d->msg;
-      retmsg.copy.shared = 0;
-      retmsg.copy.temp_allocd = 0;
-      retmsg.original = d->msg;
       
-      nchan_copy_msg_id(&retmsg.copy.prev_id, &d->wanted_msgid, multi_prevlargetag);
+      assert(d->msg->id.tagcount == 1);
+      
+      nchan_msg_derive_stack(d->msg, &retmsg, NULL);
+      
+      nchan_copy_msg_id(&retmsg.prev_id, &d->wanted_msgid, multi_prevlargetag);
       
       //TODO: some kind of missed-message check maybe?
       
       if (d->wanted_msgid.time != d->msg->id.time) {
-        nchan_copy_msg_id(&retmsg.copy.id, &d->msg->id, multi_largetag);
+        nchan_copy_msg_id(&retmsg.id, &d->msg->id, NULL);
         
         if(d->multi_count > NCHAN_FIXED_MULTITAG_MAX) {
-          retmsg.copy.id.tag.allocd = multi_largetag;
-          assert(d->msg->id.tagcount == 1);
-          retmsg.copy.id.tag.allocd[0] = d->msg->id.tag.fixed[0];
+          retmsg.id.tag.allocd = multi_largetag;
+          retmsg.id.tag.allocd[0] = d->msg->id.tag.fixed[0];
         }
-        retmsg.copy.id.tagcount = d->multi_count;
-        nchan_expand_msg_id_multi_tag(&retmsg.copy.id, 0, n, -1);
+        retmsg.id.tagcount = d->multi_count;
+        nchan_expand_msg_id_multi_tag(&retmsg.id, 0, n, -1);
       }
       else {
-        nchan_copy_msg_id(&retmsg.copy.id, &d->wanted_msgid, multi_largetag); 
+        nchan_copy_msg_id(&retmsg.id, &d->wanted_msgid, multi_largetag); 
       }
       
-      muhtags = (d->multi_count > NCHAN_FIXED_MULTITAG_MAX) ? retmsg.copy.id.tag.allocd : retmsg.copy.id.tag.fixed;
+      muhtags = (d->multi_count > NCHAN_FIXED_MULTITAG_MAX) ? retmsg.id.tag.allocd : retmsg.id.tag.fixed;
       muhtags[n] = d->msg->id.tag.fixed[0];
       
-      retmsg.copy.id.tagactive = n;
+      retmsg.id.tagactive = n;
       
       //DBG("respond msg id transformed into %p %V", &retmsg.copy, msgid_to_str(&retmsg.copy.id));
       
-      d->cb(d->msg_status, &retmsg.copy, d->privdata);
+      d->cb(d->msg_status, &retmsg, d->privdata);
       
       msg_release(d->msg, "get multi msg");
     }
@@ -2242,15 +2579,7 @@ static ngx_int_t nchan_store_async_get_multi_message_callback(nchan_msg_status_t
     }
   }
 
-cleanup:
-  if(d->getting == 0) {
-    nchan_free_msg_id(&d->wanted_msgid);
-    if(d->timer.timer_set) {
-      ngx_del_timer(&d->timer);
-    }
-    ngx_free(d);
-  }
-  return NGX_OK;
+  return nchan_store_async_get_multi_message_callback_cleanup(d);
 }
 
 static void get_multimsg_timeout(ngx_event_t *ev) {
@@ -2280,22 +2609,22 @@ static ngx_int_t nchan_store_async_get_multi_message(ngx_str_t *chid, nchan_msg_
   
   ngx_memzero(req_msgid, sizeof(req_msgid));
   
-  chead = nchan_memstore_get_chanhead(chid, &default_multiconf);
-  assert(chead);
+  if((chead = nchan_memstore_get_chanhead(chid, &default_multiconf)) == NULL) {
+    //probably out of memory
+    callback(MSG_EXPECTED, NULL, privdata); // this is a lie.
+    return NGX_ERROR;
+  }
+  
   n = chead->multi_count;
   
   multi = chead->multi;
   
-  memstore_chanhead_reserve(chead, "multimsg");
-  
   //init loop
   for(i = 0; i < n; i++) {
     want[i] = 0;
   }
   
   //DBG("get multi msg %V (count: %i)", msgid_to_str(msg_id), n);
-  
-  
   if(msg_id->time == 0) {
     for(i = 0; i < n; i++) {
       assert(nchan_extract_from_multi_msgid(msg_id, i, &req_msgid[i]) == NGX_OK);
@@ -2329,6 +2658,13 @@ static ngx_int_t nchan_store_async_get_multi_message(ngx_str_t *chid, nchan_msg_
     }
   }
   
+  if(getting == 0) { //don't need to explicitly fetch messages, we know all the responses will be MSG_EXPECTED
+    DBG("don't need to explicitly fetch messages for %V (msgid %V), we know all the responses will be MSG_EXPECTED", chid, msgid_to_str(msg_id));
+    callback(MSG_EXPECTED, NULL, privdata);
+    return NGX_OK;
+  }
+  
+  memstore_chanhead_reserve(chead, "multimsg");
   
   get_multi_message_data_t         *d;
   get_multi_message_data_single_t  *sd;
@@ -2362,7 +2698,7 @@ static ngx_int_t nchan_store_async_get_multi_message(ngx_str_t *chid, nchan_msg_
       
       getmsg_chid = (multi == NULL) ? &ids[i] : &multi[i].id;
       //DBG("get message from %V (n: %i) %V", getmsg_chid, i, msgid_to_str(&req_msgid[i]));
-      nchan_store_async_get_message(getmsg_chid, &req_msgid[i], chead->cf, (callback_pt )nchan_store_async_get_multi_message_callback, sd);
+      nchan_store_async_get_message(getmsg_chid, &req_msgid[i], chead->cf, nchan_store_async_get_multi_message_callback, sd);
       sd++;
     }
   }
@@ -2370,9 +2706,8 @@ static ngx_int_t nchan_store_async_get_multi_message(ngx_str_t *chid, nchan_msg_
   return NGX_OK;
 }
 
-void async_get_message_notify_on_MSG_EXPECTED_callback(nchan_msg_status_t status, void *pd){
-  subscribe_data_t            *d = (subscribe_data_t *) pd; 
-  nchan_memstore_handle_get_message_reply(NULL, status, d);
+static ngx_int_t getmsg_proxy_completebuffer_callback(ngx_int_t code, nchan_msg_t *msg, void *data) {
+  return nchan_memstore_handle_get_message_reply(msg, code, data);
 }
 
 static ngx_int_t nchan_store_async_get_message(ngx_str_t *channel_id, nchan_msg_id_t *msg_id, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
@@ -2382,21 +2717,17 @@ static ngx_int_t nchan_store_async_get_message(ngx_str_t *channel_id, nchan_msg_
   nchan_msg_status_t           findmsg_status;
   memstore_channel_head_t     *chead;
   
-  ngx_int_t                    use_redis = 0;
-  
   if(callback==NULL) {
     ERR("no callback given for async get_message. someone's using the API wrong!");
     return NGX_ERROR;
   }
   
-  if(is_multi_id(channel_id)) {
+  if(nchan_channel_id_is_multi(channel_id)) {
     return nchan_store_async_get_multi_message(channel_id, msg_id, callback, privdata);
   }
   
   chead = nchan_memstore_find_chanhead(channel_id);
-  if(chead) {
-    use_redis = chead->cf && chead->cf->redis.enabled;
-  }
+  
   d = subscribe_data_alloc(owner);
   d->channel_owner = owner;
   d->channel_id = channel_id;
@@ -2408,19 +2739,31 @@ static ngx_int_t nchan_store_async_get_message(ngx_str_t *channel_id, nchan_msg_
   
   if(memstore_slot() != owner) {
     //check if we need to ask for a message
-    memstore_ipc_send_get_message(d->channel_owner, d->channel_id, &d->msg_id, d);
+    if(memstore_ipc_send_get_message(d->channel_owner, d->channel_id, &d->msg_id, d) == NGX_DECLINED) {
+      subscribe_data_free(d);
+      callback(MSG_ERROR, NULL, privdata);
+      return NGX_ERROR;
+    }
   }
-  else {
-    chmsg = chanhead_find_next_message(d->chanhead, &d->msg_id, &findmsg_status);
-    
-    if(chmsg == NULL && use_redis) {
-      int       was_it_allocd = d->allocd;
-      d->allocd = 0;
-      nchan_memstore_redis_subscriber_notify_on_MSG_EXPECTED(chead->redis_sub, msg_id, async_get_message_notify_on_MSG_EXPECTED_callback, sizeof(*d), d);
-      d->allocd = was_it_allocd;
+  else if(!chead->msg_buffer_complete) {
+    assert(d->allocd == 1); //let's assume subscribe_data_alloc always allocates
+    subscriber_t *getmsg_sub = getmsg_proxy_subscriber_create(msg_id, (callback_pt )getmsg_proxy_completebuffer_callback, d);
+    if(getmsg_sub == NULL) {
+      ERR("Unable to create getmsg proxy sub for async get_message");
       subscribe_data_free(d);
-      return NGX_OK;
+      callback(MSG_ERROR, NULL, privdata);
+      return NGX_ERROR;
     }
+    if(chead->spooler.fn->add(&chead->spooler, getmsg_sub) != NGX_OK) {
+      ERR("Unable to subscribe getmsg sub for async get_message");
+      subscribe_data_free(d);
+      callback(MSG_ERROR, NULL, privdata);
+      return NGX_ERROR;
+    }
+    return NGX_OK;
+  }
+  else {
+    chmsg = chanhead_find_next_message(d->chanhead, &d->msg_id, &findmsg_status);
     return nchan_memstore_handle_get_message_reply(chmsg == NULL ? NULL : chmsg->msg, findmsg_status, d);
   }
   
@@ -2459,7 +2802,7 @@ static ngx_int_t chanhead_push_message(memstore_channel_head_t *ch, store_messag
   if(ch->msg_last && ch->msg_last->msg->id.time == msg->msg->id.time) {
     msg->msg->id.tag.fixed[0] = ch->msg_last->msg->id.tag.fixed[0] + 1;
   }
-  else if(!ch->cf->redis.enabled) {
+  else if(!ch->cf->redis.enabled || ch->cf->redis.storage_mode < REDIS_MODE_DISTRIBUTED) { //TODO: check this logic
     msg->msg->id.tag.fixed[0] = 0;
   }
 
@@ -2470,6 +2813,10 @@ static ngx_int_t chanhead_push_message(memstore_channel_head_t *ch, store_messag
   ngx_atomic_fetch_add(&ch->shared->stored_message_count, 1);
   ngx_atomic_fetch_add(&ch->shared->total_message_count, 1);
 
+  if(ch->groupnode) {
+    memstore_group_add_message(ch->groupnode, msg->msg);
+  }
+  
   ch->msg_last = msg;
   
   //DBG("create %V %V", msgid_to_str(&msg->msg->id), chanhead_msg_to_str(msg));
@@ -2480,12 +2827,6 @@ static ngx_int_t chanhead_push_message(memstore_channel_head_t *ch, store_messag
   return ch->msg_last == msg ? NGX_OK : NGX_ERROR;
 }
 
-typedef struct {
-  nchan_msg_t             msg;
-  ngx_buf_t               buf;
-  ngx_file_t              file;
-} shmsg_memspace_t;
-
 static u_char* copy_preallocated_str_to_cur(ngx_str_t *dst, ngx_str_t *src, u_char *cur) {
   size_t   sz = src->len;
   dst->len = sz; 
@@ -2499,152 +2840,151 @@ static u_char* copy_preallocated_str_to_cur(ngx_str_t *dst, ngx_str_t *src, u_ch
   return cur + sz;
 }
 
-static nchan_msg_t *create_shm_msg(nchan_msg_t *m) {
-  shmsg_memspace_t        *stuff;
-  nchan_msg_t             *msg;
-  ngx_buf_t               *mbuf = NULL, *buf=NULL;
-  u_char                  *cur;
-  mbuf = m->buf;
+static size_t memstore_buf_memsize(ngx_buf_t *buf) {
+  size_t buf_size = 0;
+  if(ngx_buf_in_memory_only(buf)) {
+    buf_size += ngx_buf_size(buf);
+  }
+  if(buf->in_file && buf->file != NULL) {
+    buf_size = sizeof(ngx_file_t) + buf->file->name.len + 1; //+1 to ensure NUL-terminated filename string
+  }
+  return buf_size;
+}
+
+size_t memstore_msg_memsize(nchan_msg_t *m) {
+  size_t                  total_sz, buf_contents_size = 0, content_type_size = 0, eventsource_event_size = 0, compressed_sz = 0;
+  ngx_buf_t              *mbuf = &m->buf;
+  if(m->eventsource_event)
+    eventsource_event_size += m->eventsource_event->len + sizeof(ngx_str_t);
+  if(m->content_type)
+    content_type_size += m->content_type->len + sizeof(ngx_str_t);
   
-  size_t                  total_sz, buf_body_size = 0, content_type_size = 0, buf_filename_size = 0, eventsource_event_size = 0;
+  buf_contents_size = memstore_buf_memsize(mbuf);
   
-  eventsource_event_size += m->eventsource_event.len;
-  content_type_size += m->content_type.len;
-  if(ngx_buf_in_memory_only(mbuf)) {
-    buf_body_size = ngx_buf_size(mbuf);
-  }
-  if(mbuf->in_file && mbuf->file != NULL) {
-    buf_filename_size = mbuf->file->name.len + 1; //+1 to ensure NUL-terminated filename string
+  if(m->compressed) {
+    compressed_sz += sizeof(nchan_compressed_msg_t) + memstore_buf_memsize(&m->compressed->buf);
   }
   
-  total_sz = sizeof(*stuff) + (buf_filename_size + content_type_size + eventsource_event_size +  buf_body_size);
+  total_sz = sizeof(nchan_msg_t) + (buf_contents_size + content_type_size + eventsource_event_size + compressed_sz);
 #if NCHAN_MSG_LEAK_DEBUG
   size_t    debug_sz = m->lbl.len;
   total_sz += debug_sz;
 #endif
   
-  if((stuff = shm_alloc(shm, total_sz, "message")) == NULL) {
-    ERR("can't allocate 'shared' memory for msg for channel id");
-    return NULL;
+  return total_sz;
+}
+
+static u_char *copy_buf_contents(ngx_buf_t *in, ngx_buf_t *out, u_char *rest) {
+  size_t buf_mem_body_size = 0;
+  
+  if(in->file!=NULL) {
+    out->file = (ngx_file_t *)rest;
+    *out->file = *in->file;
+    out->file->fd = NGX_INVALID_FILE;
+    out->file->log = ngx_cycle->log;
+    
+    rest = (u_char *)&out->file[1];
+    rest = copy_preallocated_str_to_cur(&out->file->name, &in->file->name, rest);
+    //ensure last char is NUL
+    *(rest++) = '\0';
   }
-  cur = (u_char *)&stuff[1];
   
-  assert(m->id.tagcount == 1);
+  if(ngx_buf_in_memory_only(in)) {
+    buf_mem_body_size = ngx_buf_size(in);
+  }
   
-  msg = &stuff->msg;
-  buf = &stuff->buf;
+  if(buf_mem_body_size > 0) {
+    ngx_str_t   dst_str, src_str = {buf_mem_body_size, in->pos};
+    
+    rest = copy_preallocated_str_to_cur(&dst_str, &src_str, rest);
+    
+    out->pos = dst_str.data;
+    out->last = out->pos + dst_str.len;
+    out->start = out->pos;
+    out->end = out->last;
+  }
   
-  ngx_memcpy(msg, m, sizeof(*msg));
-  ngx_memcpy(buf, mbuf, sizeof(*buf));
+  return rest;
+}
+
+//#define NCHAN_CREATE_SHM_MSG_DEBUG 1
+
+static nchan_msg_t *create_shm_msg(nchan_msg_t *m) {
+  nchan_msg_t             *msg;
+  ngx_buf_t               *mbuf = NULL;
+  u_char                  *cur;
+  size_t                   memsize = memstore_msg_memsize(m);
+
+#if NCHAN_CREATE_SHM_MSG_DEBUG
+  memsize += 5;
+#endif
+  mbuf = &m->buf;
+    
+  if((msg = shm_alloc(shm, memsize, "message")) == NULL) {
+    nchan_log_ooshm_error("allocating message of size %i", memsize);
+    return NULL;
+  }
   
-  msg->buf = buf;
+#if NCHAN_CREATE_SHM_MSG_DEBUG
+  cur = (u_char *)msg;
+  cur[memsize+1]='e';
+  cur[memsize+2]='n';
+  cur[memsize+3]='d';
+  cur[memsize+4]='\0';
+#endif
   
-  cur = copy_preallocated_str_to_cur(&msg->content_type, &m->content_type, cur);
+  cur = (u_char *)&msg[1];
+  assert(m->id.tagcount == 1);
   
-  cur = copy_preallocated_str_to_cur(&msg->eventsource_event, &m->eventsource_event, cur);
+  *msg = *m;
   
-  if(mbuf->file!=NULL) {
-    buf->file = &stuff->file;
-    *buf->file = *mbuf->file;
-    buf->file->fd =NGX_INVALID_FILE;
-    buf->file->log = ngx_cycle->log;
-    
-    cur = copy_preallocated_str_to_cur(&buf->file->name, &mbuf->file->name, cur);
-    //ensure last char is NUL
-    *(cur++) = '\0';
+  if(m->content_type) {
+    msg->content_type = (ngx_str_t *)cur;
+    cur = (u_char *)(&msg->content_type[1]);
+    cur = copy_preallocated_str_to_cur(msg->content_type, m->content_type, cur);
+  }
+  else {
+    msg->content_type = NULL;
   }
   
-  if(buf_body_size > 0) {
-    ngx_str_t   dst_str, src_str = {buf_body_size, mbuf->pos};
-    
-    //cur = copy_preallocated_str_to_cur(&dst_str, &src_str, cur);
-    copy_preallocated_str_to_cur(&dst_str, &src_str, cur);
-    
-    buf->pos = dst_str.data;
-    buf->last = buf->pos + dst_str.len;
-    buf->start = buf->pos;
-    buf->end = buf->last;
+  if(m->eventsource_event) {
+    msg->eventsource_event = (ngx_str_t *)cur;
+    cur = (u_char *)(&msg->eventsource_event[1]);
+    cur = copy_preallocated_str_to_cur(msg->eventsource_event, m->eventsource_event, cur);
   }
+  else {
+    msg->eventsource_event = NULL;
+  }
+  
+  cur = copy_buf_contents(mbuf, &msg->buf, cur);
+  msg->buf.last_buf = 1;
   
-  msg->shared = 1;
-  msg->temp_allocd = 0;
+  msg->storage = NCHAN_MSG_SHARED;
+  msg->parent = NULL;
+  
+  if(m->compressed) {
+    msg->compressed = (nchan_compressed_msg_t *)cur;
+    cur = (u_char *)&msg->compressed[1];
+    *msg->compressed = *m->compressed;    
+    cur = copy_buf_contents(&m->compressed->buf, &msg->compressed->buf, cur);
+    msg->compressed->buf.last_buf = 1;
+  }
   
 #if NCHAN_MSG_RESERVE_DEBUG
   msg->rsv = NULL;
 #endif
-#if NCHAN_MSG_LEAK_DEBUG  
+#if NCHAN_MSG_LEAK_DEBUG 
+  assert((u_char *)msg + memsize == cur + m->lbl.len);
   msg->lbl.len = m->lbl.len;
-  msg->lbl.data = (u_char *)stuff + (total_sz - debug_sz);
+  msg->lbl.data = cur;
   ngx_memcpy(msg->lbl.data, m->lbl.data, msg->lbl.len);
   
   msg_debug_add(msg);
 #endif
-  
-  return msg;
-}
-
-ngx_int_t msg_reserve(nchan_msg_t *msg, char *lbl) {
-  ngx_atomic_fetch_add((ngx_atomic_uint_t *)&msg->refcount, 1);
-  assert(msg->refcount >= 0);
-  if(msg->refcount < 0) {
-    msg->refcount = MSG_REFCOUNT_INVALID;
-    return NGX_ERROR;
-  }
-#if NCHAN_MSG_RESERVE_DEBUG  
-  msg_rsv_dbg_t     *rsv;
-  shmtx_lock(shm);
-  rsv=shm_locked_calloc(shm, sizeof(*rsv) + ngx_strlen(lbl) + 1, "msgdebug");
-  rsv->lbl = (char *)(&rsv[1]);
-  ngx_memcpy(rsv->lbl, lbl, ngx_strlen(lbl));
-  if(msg->rsv == NULL) {
-    msg->rsv = rsv;
-    rsv->prev = NULL;
-    rsv->next = NULL;
-  }
-  else {
-    msg->rsv->prev = rsv;
-    rsv->next = msg->rsv;
-    rsv->prev = NULL;
-    msg->rsv = rsv;
-  }
-  shmtx_unlock(shm);
+#if NCHAN_CREATE_SHM_MSG_DEBUG
+  assert(ngx_memcmp(((u_char *)msg) + memsize + 1, "end", 4) == 0);
 #endif
-  //DBG("msg %p reserved (%i) %s", msg, msg->refcount, lbl);
-  return NGX_OK;
-}
-
-ngx_int_t msg_release(nchan_msg_t *msg, char *lbl) {
-#if NCHAN_MSG_RESERVE_DEBUG
-  msg_rsv_dbg_t     *cur, *prev, *next;
-  size_t             sz = ngx_strlen(lbl);
-  ngx_int_t          rsv_found=0;
-  shmtx_lock(shm);
-  assert(msg->refcount > 0);
-  for(cur = msg->rsv; cur != NULL; cur = cur->next) {
-    if(ngx_memcmp(lbl, cur->lbl, sz) == 0) {
-      prev = cur->prev;
-      next = cur->next;
-      if(prev) {
-        prev->next = next;
-      }
-      if(next) {
-        next->prev = prev;
-      }
-      if(cur == msg->rsv) {
-        msg->rsv = next;
-      }
-      shm_locked_free(shm, cur);
-      rsv_found = 1;
-      break;
-    }
-  }
-  assert(rsv_found);
-  shmtx_unlock(shm);
-#endif
-  assert(msg->refcount > 0);
-  ngx_atomic_fetch_add((ngx_atomic_uint_t *)&msg->refcount, -1);
-  //DBG("msg %p released (%i) %s", msg, msg->refcount, lbl);
-  return NGX_OK;
+  return msg;
 }
 
 static store_message_t *create_shared_message(nchan_msg_t *m, ngx_int_t msg_already_in_shm) {
@@ -2705,13 +3045,128 @@ static ngx_int_t publish_multi_callback(ngx_int_t status, void *rptr, void *priv
   return NGX_OK;
 }
 
+typedef struct {
+  ngx_str_t        *chid;
+  ngx_str_t         groupname;
+  nchan_msg_t      *msg;
+  nchan_loc_conf_t *cf;
+  callback_pt       cb;
+  void             *pd;
+} group_publish_accounting_check_data_t;
+
+static ngx_int_t group_publish_accounting_channelcheck(ngx_int_t rc, nchan_channel_t *chaninfo, group_publish_accounting_check_data_t *d) {
+  if(chaninfo) {
+    //channel already exists. we may proceed.
+    nchan_store_publish_message_generic(d->chid, d->msg, 0, d->cf, d->cb, d->pd);
+  }
+  else {
+    char *err = "Group limit reached for number of channels.";
+    nchan_log_warning("%s (group %V)", err, &d->groupname);
+    d->cb(NGX_HTTP_FORBIDDEN, err, d->pd);
+  }
+  ngx_free(d);
+  return NGX_OK;
+}
+
+static ngx_int_t group_publish_accounting_check(ngx_int_t rc, nchan_group_t *shm_group, group_publish_accounting_check_data_t *d) {
+  int     n;
+  int     ok = 0;
+  ssize_t msg_sz;
+  char   *err = "unknown error";
+  
+  
+  if(!shm_group) {
+    ERR("couldn't find group %V for publishing accounting check.", &d->groupname);
+    d->cb(NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, d->pd);
+    ngx_free(d);
+    return NGX_ERROR;
+  }
+  
+  if((ok = !shm_group->limit.messages || shm_group->messages < shm_group->limit.messages) == 0) {
+    err = "Group limit reached for number of messages.";
+  }
+
+  if(ok && shm_group->limit.messages_shmem_bytes) {
+    n = count_channel_id(d->chid);
+    msg_sz = memstore_msg_memsize(d->msg);
+    ok = (shm_group->messages_shmem_bytes + n * msg_sz) <= shm_group->limit.messages_shmem_bytes;
+    if(!ok) err = "Group limit reached for memory used by messages.";
+  }
+  
+  if(ok && shm_group->limit.messages_file_bytes) {
+    ok = shm_group->messages_file_bytes + ngx_buf_size((&d->msg->buf)) <= shm_group->limit.messages_file_bytes;
+    // no need to multiply ngx_buf_size by n because the file is shared for all the messages.
+    if(!ok) err = "Group limit reached for disk space used by messages.";
+  }
+  
+  if(ok && shm_group->limit.channels) {
+    //channel check
+    if(shm_group->channels + 1 == shm_group->limit.channels) {
+      //need to check if publishing will create a channel
+      memstore_channel_head_t *ch;
+      
+      //first try it the easy way
+      ch = nchan_memstore_find_chanhead(d->chid);
+      if(!ch) {
+        //this is going to be kind of costly...
+        nchan_store_find_channel(d->chid, d->cf, (callback_pt )group_publish_accounting_channelcheck, d);
+        return NGX_OK;
+      }
+    }
+    else if(shm_group->channels >= shm_group->limit.channels) {
+      ok = 0;
+      err = "Group limit reached for number of channels.";
+    }
+  }
+  
+  if(ok) {
+    ngx_int_t pub_rc = nchan_store_publish_message_generic(d->chid, d->msg, 0, d->cf, d->cb, d->pd);
+    if(pub_rc == NGX_DECLINED) { //out of memory probably
+      d->cb(NGX_HTTP_INSUFFICIENT_STORAGE, NULL, d->pd);
+    }
+  }
+  else {
+    nchan_log_warning("%s (group %V)", err, &d->groupname);
+    d->cb(NGX_HTTP_FORBIDDEN, err, d->pd);
+  }
+  
+  ngx_free(d);
+  return NGX_OK;
+}
+
 static ngx_int_t nchan_store_publish_message(ngx_str_t *channel_id, nchan_msg_t *msg, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
-  return nchan_store_publish_message_generic(channel_id, msg, 0, cf, callback, privdata);
+  if(cf->group.enable_accounting) {
+    // it might be better to do this later when a chanhead is available,
+    // so we can avoid the group lookup in the group-tree and use chanhead->groupnode.
+    
+    // but the code is much cleaner doing it the less efficient way, and I don't think
+    // publishing is really going to be a bottleneck. Still, a possible TODO for later.
+    group_publish_accounting_check_data_t  *d = ngx_alloc(sizeof(*d), ngx_cycle->log);
+    if(d == NULL) {
+      ERR("Couldn't allocate data for group publishing check");
+      callback(NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, privdata);
+      return NGX_ERROR;
+    }
+    
+    d->chid = channel_id;
+    d->groupname = nchan_get_group_from_channel_id(channel_id);
+    d->msg = msg;
+    d->cf = cf;
+    d->cb = callback;
+    d->pd = privdata;
+    
+    return memstore_group_find(groups, &d->groupname, (callback_pt )group_publish_accounting_check, d);
+  }
+  else {
+    return nchan_store_publish_message_generic(channel_id, msg, 0, cf, callback, privdata);
+  }
 }
 
 static void fill_message_timedata(nchan_msg_t *msg, time_t timeout) {
-  //this coould be dangerous!!
   if(msg->id.time == 0) {
+    // cached time is okay to use here, because this is the channel owner.
+    // even if it's a second behind, so will the previous messages. 
+    // monotonicity is still preserved.
     msg->id.time = ngx_time();
   }
   if(msg->expires == 0) {
@@ -2720,32 +3175,38 @@ static void fill_message_timedata(nchan_msg_t *msg, time_t timeout) {
 }
 
 static ngx_int_t nchan_store_publish_message_to_single_channel_id(ngx_str_t *channel_id, nchan_msg_t *msg, ngx_int_t msg_in_shm, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
+  memstore_channel_head_t  *chead;
+  
+  if(callback == NULL) {
+    callback = empty_callback;
+  }
+  
   if(cf->redis.enabled) {
-    assert(!msg_in_shm);
-    nchan_update_stub_status(messages, 1);
     fill_message_timedata(msg, nchan_loc_conf_message_timeout(cf));
-    if(callback == NULL) {
-      callback = empty_callback;
+    
+    if(cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED) {
+      assert(!msg_in_shm);
+      return nchan_store_redis.publish(channel_id, msg, cf, callback, privdata);
     }
-    return nchan_store_redis.publish(channel_id, msg, cf, callback, privdata);
+    //BACKUP mode gets published later
   }
-  else {
-    memstore_channel_head_t  *chead;
-    if((chead = nchan_memstore_get_chanhead(channel_id, cf)) == NULL) {
-      ERR("can't get chanhead for id %V", channel_id);
-      //we probably just ran out of shared memory
-      callback(NGX_HTTP_INSUFFICIENT_STORAGE, NULL, privdata);
-      return NGX_ERROR;
-    }
-    return nchan_store_chanhead_publish_message_generic(chead, msg, msg_in_shm, cf, callback, privdata);
+  
+  if((chead = nchan_memstore_get_chanhead(channel_id, cf)) == NULL) {
+    //ERR("can't get chanhead for id %V", channel_id);
+    //we probably just ran out of shared memory
+    callback(NGX_HTTP_INSUFFICIENT_STORAGE, NULL, privdata);
+    return NGX_ERROR;
   }
+  
+  return nchan_store_chanhead_publish_message_generic(chead, msg, msg_in_shm, cf, callback, privdata);
 }
 
 ngx_int_t nchan_store_publish_message_generic(ngx_str_t *channel_id, nchan_msg_t *msg, ngx_int_t msg_in_shm, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
-  
-  if(is_multi_id(channel_id)) {
+  ngx_int_t   rc;
+  if(nchan_channel_id_is_multi(channel_id)) {
     ngx_int_t             i, n = 0;
     ngx_str_t             ids[NCHAN_MULTITAG_MAX];
+    ngx_int_t             trc=NGX_OK;
     publish_multi_data_t *pd;
     if((pd = ngx_alloc(sizeof(*pd), ngx_cycle->log)) == NULL) {
       ERR("can't allocate publish multi chanhead data");
@@ -2761,9 +3222,12 @@ ngx_int_t nchan_store_publish_message_generic(ngx_str_t *channel_id, nchan_msg_t
     ngx_memzero(&pd->ch, sizeof(pd->ch));
     
     for(i=0; i<n; i++) {
-      nchan_store_publish_message_to_single_channel_id(&ids[i], msg, msg_in_shm, cf, publish_multi_callback, pd);
+      rc = nchan_store_publish_message_to_single_channel_id(&ids[i], msg, msg_in_shm, cf, publish_multi_callback, pd);
+      if(rc != NGX_OK) {
+        trc = rc;
+      }
     }
-    return NGX_OK;
+    return trc;
   }
   else {
     return nchan_store_publish_message_to_single_channel_id(channel_id, msg, msg_in_shm, cf, callback, privdata);
@@ -2786,9 +3250,7 @@ ngx_int_t nchan_store_chanhead_publish_message_generic(memstore_channel_head_t *
 
   assert(msg->id.tagcount == 1);
   
-  fill_message_timedata(msg, timeout);
-  
-  assert(!cf->redis.enabled);
+  assert(!cf->redis.enabled || cf->redis.storage_mode == REDIS_MODE_BACKUP);
   
   if(memstore_slot() != owner) {
     if((publish_msg = create_shm_msg(msg)) == NULL) {
@@ -2798,6 +3260,12 @@ ngx_int_t nchan_store_chanhead_publish_message_generic(memstore_channel_head_t *
     return memstore_ipc_send_publish_message(owner, &chead->id, publish_msg, cf, callback, privdata);
   }
   
+  if(cf->redis.enabled && cf->redis.storage_mode == REDIS_MODE_BACKUP) {
+    nchan_store_redis.publish(&chead->id, msg, cf, empty_callback, NULL);
+  }
+  
+  fill_message_timedata(msg, timeout);
+  
   chan_expire = ngx_time() + timeout;
   chead->channel.expires = chan_expire > msg->expires + 5 ? chan_expire : msg->expires + 5;
   if( chan_expire > chead->channel.expires) {
@@ -2807,6 +3275,7 @@ ngx_int_t nchan_store_chanhead_publish_message_generic(memstore_channel_head_t *
   
   chead->max_messages = nchan_loc_conf_max_messages(cf);
   
+  
   if(chead->latest_msgid.time > msg->id.time) {
     if(cf->redis.enabled) {
       nchan_log_error("A message from the past has just been published. At least one of your servers running Nchan using Redis does not have its time synchronized.");
@@ -2873,34 +3342,118 @@ ngx_int_t nchan_store_chanhead_publish_message_generic(memstore_channel_head_t *
   
   rc = nchan_memstore_publish_generic(chead, publish_msg, 0, NULL);
   
-  assert(!cf->redis.enabled);
   callback(rc, channel_copy, privdata);
 
   return rc;
 }
 
+static ngx_int_t nchan_store_get_group(ngx_str_t *name, nchan_loc_conf_t *cf, callback_pt cb, void *pd) {
+  if(cf->group.enable_accounting) {
+    return memstore_group_find(groups, name, cb, pd);
+  }
+  else {
+    cb(NGX_ERROR, NULL, pd);
+    return NGX_ERROR;
+  }
+}
+
+typedef struct {
+  callback_pt           cb;
+  void                 *pd;
+  nchan_group_limits_t  limits;
+} group_callback_data_pt;
+
+#define APPLY_GROUP_LIMIT_IF_SET(limits, group, limit_name) \
+if((limits).limit_name != -1) (group)->limit.limit_name = (limits).limit_name
+
+static ngx_int_t set_group_limits_callback(ngx_int_t rc, nchan_group_t *group, group_callback_data_pt *ppd) {
+  
+  if(group) {
+    APPLY_GROUP_LIMIT_IF_SET(ppd->limits, group, channels);
+    APPLY_GROUP_LIMIT_IF_SET(ppd->limits, group, subscribers);
+    APPLY_GROUP_LIMIT_IF_SET(ppd->limits, group, messages);
+    APPLY_GROUP_LIMIT_IF_SET(ppd->limits, group, messages_shmem_bytes);
+    APPLY_GROUP_LIMIT_IF_SET(ppd->limits, group, messages_file_bytes);
+  }
+  
+  if(ppd->cb) {
+    ppd->cb(rc, group, ppd->pd);
+  }
+  ngx_free(ppd);
+  return NGX_OK;
+}
+
+#define INIT_GROUP_DOUBLE_CALLBACK(double_privdata, callback, privdata) \
+  if((double_privdata = ngx_alloc(sizeof(*double_privdata), ngx_cycle->log)) == NULL) { \
+    callback(NGX_ERROR, NULL, privdata);                                \
+    return NGX_ERROR;                                                   \
+  }                                                                     \
+  double_privdata->cb = callback;                                       \
+  double_privdata->pd = privdata
+
+
+static ngx_int_t nchan_store_set_group_limits(ngx_str_t *name, nchan_loc_conf_t *cf, nchan_group_limits_t *limits, callback_pt cb, void *pd) {
+  group_callback_data_pt   *ppd;
+  
+  if(!cf->group.enable_accounting) {
+    if(cb)
+      cb(NGX_ERROR, NULL, pd);
+    return NGX_OK;
+  }
+  
+  if(cb == NULL) {
+    ngx_atomic_int_t         *limit;
+    int                       limit_set = 0;
+    //do we even have any limits to set?...
+    //because if not, this whole thing can be bypassed, as there's no callback to run afterwards
+    for(limit = (ngx_atomic_int_t *)limits; limit < (ngx_atomic_int_t *)(limits + 1); limit++) {
+      if (*limit != -1) {
+        limit_set ++;
+        break;
+      }
+    }
+    if(limit_set == 0) {
+      return NGX_OK;
+    }
+  }
+  
+  INIT_GROUP_DOUBLE_CALLBACK(ppd, cb, pd);
+  ppd->limits = *limits;
+  
+  return memstore_group_find(groups, name, (callback_pt )set_group_limits_callback, ppd);
+}
+static ngx_int_t nchan_store_delete_group(ngx_str_t *name, nchan_loc_conf_t *cf, callback_pt cb, void *pd) {
+  
+  if(!cf->group.enable_accounting) {
+    cb(NGX_ERROR, NULL, pd);
+    return NGX_OK;
+  }
+  
+  return memstore_group_delete(groups, name, cb, pd);
+}
+
 nchan_store_t  nchan_store_memory = {
-    //init
-    &nchan_store_init_module,
-    &nchan_store_init_worker,
-    &nchan_store_init_postconfig,
-    &nchan_store_create_main_conf,
-    
-    //shutdown
-    &nchan_store_exit_worker,
-    &nchan_store_exit_master,
-    
-    //async-friendly functions with callbacks
-    &nchan_store_async_get_message, //+callback
-    &nchan_store_subscribe, //+callback
-    &nchan_store_publish_message, //+callback
-    
-    &nchan_store_delete_channel, //+callback
-    &nchan_store_find_channel, //+callback
-    
-    //message stuff
-    NULL,
-    NULL,
+   //init
+  &nchan_store_init_module,
+  &nchan_store_init_worker,
+  &nchan_store_init_postconfig,
+  &nchan_store_create_main_conf,
+  
+  //shutdown
+  &nchan_store_exit_worker,
+  &nchan_store_exit_master,
+  
+  //async-friendly functions with callbacks
+  &nchan_store_async_get_message, //+callback
+  &nchan_store_subscribe, //+callback
+  &nchan_store_publish_message, //+callback
+  
+  &nchan_store_delete_channel, //+callback
+  &nchan_store_find_channel, //+callback
+  
+  &nchan_store_get_group, //+callback
+  &nchan_store_set_group_limits, //+callback
+  &nchan_store_delete_group, //+callback
     
 };
 
diff --git a/debian/modules/nchan/src/store/memory/store-private.h b/debian/modules/nchan/src/store/memory/store-private.h
index b8f414fd..e4a426a3 100644
--- a/debian/modules/nchan/src/store/memory/store-private.h
+++ b/debian/modules/nchan/src/store/memory/store-private.h
@@ -1,10 +1,20 @@
  #ifndef MEMSTORE_PRIVATE_HEADER
 #define MEMSTORE_PRIVATE_HEADER
 #include <util/shmem.h>
-//#define MESTORE_CHANHEAD_RESERVE_DEBUG 0
+#include "ipc.h"
+//#define MEMSTORE_CHANHEAD_RESERVE_DEBUG 1
+
+#define NCHAN_NOTICE_BUFFER_LOADED 0x356F
+
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
+#include <util/nchan_list.h>
+#endif
 #include "uthash.h"
 typedef struct memstore_channel_head_s memstore_channel_head_t;
 typedef struct store_message_s store_message_t;
+size_t memstore_msg_memsize(nchan_msg_t *m);
+
+#include "groups.h"
 
 struct store_message_s {
   nchan_msg_t               *msg;
@@ -20,10 +30,11 @@ typedef struct {
   ngx_atomic_t                total_message_count;
   ngx_atomic_t                stored_message_count;
   ngx_atomic_t                last_seen;
+  struct {
+    ngx_atomic_t                outside_refcount;
+  }                           gc;
 } store_channel_head_shm_t;
 
-#define MSG_REFCOUNT_INVALID -9000
-
 typedef struct {
   ngx_str_t            id;
   subscriber_t        *sub;
@@ -40,13 +51,13 @@ struct memstore_channel_head_s {
   ngx_int_t                       internal_sub_count;
   time_t                          last_subscribed_local;
 
-#if MESTORE_CHANHEAD_RESERVE_DEBUG
+#if MEMSTORE_CHANHEAD_RESERVE_DEBUG
   nchan_list_t                    reserved;
 #else
   uint16_t                        reserved;
 #endif
   
-  uint8_t                         multi_waiting;
+  uint8_t                         multi_subscribers_pending;
   uint8_t                         multi_count;
   memstore_multi_t               *multi;
   
@@ -64,7 +75,13 @@ struct memstore_channel_head_s {
   unsigned                        shutting_down:1;
   unsigned                        meta:1;
   
+  uint8_t                         msg_buffer_complete; //must be a byte because we need to reference it in the spooler
+  
   nchan_loc_conf_t               *cf;
+  
+  group_tree_node_t              *groupnode;
+  memstore_channel_head_t        *groupnode_prev;
+  memstore_channel_head_t        *groupnode_next;
 
   subscriber_t                   *redis_sub;
   ngx_int_t                       delta_fakesubs;
@@ -109,8 +126,9 @@ typedef struct {
   nchan_loc_conf_shared_data_t      *conf_data;
   
   nchan_stub_status_t                stats;
-  
+#if nginx_version <= 1011006
   ngx_atomic_uint_t                  shmem_pages_used;
+#endif
 
 #if NCHAN_MSG_LEAK_DEBUG
   nchan_msg_t                       *msgdebug_head;
@@ -118,22 +136,25 @@ typedef struct {
 } shm_data_t;
 
 memstore_channel_head_t *nchan_memstore_find_chanhead(ngx_str_t *channel_id);
+ngx_int_t nchan_memstore_find_chanhead_with_backup(ngx_str_t *channel_id, nchan_loc_conf_t *cf, callback_pt cb, void *pd);
 memstore_channel_head_t *nchan_memstore_get_chanhead(ngx_str_t *channel_id, nchan_loc_conf_t *cf);
 memstore_channel_head_t *nchan_memstore_get_chanhead_no_ipc_sub(ngx_str_t *channel_id, nchan_loc_conf_t *cf);
 store_message_t *chanhead_find_next_message(memstore_channel_head_t *ch, nchan_msg_id_t *msgid, nchan_msg_status_t *status);
-shmem_t *nchan_memstore_get_shm(void);
 ipc_t *nchan_memstore_get_ipc(void);
+memstore_groups_t *nchan_memstore_get_groups(void);
 ngx_int_t nchan_memstore_handle_get_message_reply(nchan_msg_t *msg, nchan_msg_status_t findmsg_status, void *d);
 
 ngx_int_t nchan_store_publish_message_generic(ngx_str_t *channel_id, nchan_msg_t *msg, ngx_int_t msg_in_shm, nchan_loc_conf_t *cf, callback_pt callback, void *privdata);
 ngx_int_t nchan_memstore_publish_generic(memstore_channel_head_t *head, nchan_msg_t *msg, ngx_int_t status_code, const ngx_str_t *status_line);
 ngx_int_t nchan_store_chanhead_publish_message_generic(memstore_channel_head_t *chead, nchan_msg_t *msg, ngx_int_t msg_in_shm, nchan_loc_conf_t *cf, callback_pt callback, void *privdata);
+ngx_int_t nchan_memstore_publish_notice(memstore_channel_head_t *head, ngx_int_t notice_code, const void *notice_data);
 ngx_int_t nchan_memstore_force_delete_channel(ngx_str_t *channel_id, callback_pt callback, void *privdata);
 ngx_int_t memstore_ensure_chanhead_is_ready(memstore_channel_head_t *head, uint8_t ipc_subscribe_if_needed);
 ngx_int_t memstore_ready_chanhead_unless_stub(memstore_channel_head_t *head);
 void memstore_fakesub_add(memstore_channel_head_t *head, ngx_int_t n);
 ngx_int_t memstore_chanhead_messages_gc(memstore_channel_head_t *ch);
 
+
 #if FAKESHARD
 void memstore_fakeprocess_push(ngx_int_t slot);
 void memstore_fakeprocess_push_random(void);
@@ -141,10 +162,16 @@ ngx_int_t memstore_fakeprocess_pop(void);
 #endif
 
 ngx_int_t memstore_slot(void);
+ngx_int_t memstore_str_owner(ngx_str_t *str);
+
 int memstore_ready(void);
 ngx_int_t chanhead_gc_add(memstore_channel_head_t *head, const char *);
 ngx_int_t chanhead_gc_withdraw(memstore_channel_head_t *chanhead, const char *);
 
+
+void memstore_chanhead_release(memstore_channel_head_t *ch, char *label);
+void memstore_chanhead_reserve(memstore_channel_head_t *ch, const char *label);
+
 uint16_t  memstore_worker_generation; //times nginx has been restarted + 1
 
 #endif /*MEMSTORE_PRIVATE_HEADER*/
diff --git a/debian/modules/nchan/src/store/memory/store.h b/debian/modules/nchan/src/store/memory/store.h
index b4bf5d9d..c1b9eef2 100644
--- a/debian/modules/nchan/src/store/memory/store.h
+++ b/debian/modules/nchan/src/store/memory/store.h
@@ -3,11 +3,11 @@
 
 extern nchan_store_t  nchan_store_memory;
 
-ngx_int_t msg_reserve(nchan_msg_t *msg, char *lbl);
-ngx_int_t msg_release(nchan_msg_t *msg, char *lbl);
-
 ngx_int_t memstore_channel_owner(ngx_str_t *id);
 
+extern void  *nchan_store_memory_shmem;
+
 nchan_loc_conf_shared_data_t *memstore_get_conf_shared_data(nchan_loc_conf_t *cf);
 ngx_int_t memstore_reserve_conf_shared_data(nchan_loc_conf_t *cf);
+ngx_int_t nchan_nginx_worker_procslot(ngx_int_t worker_number);
 #endif //NCHAN_MEMSTORE_H
diff --git a/debian/modules/nchan/src/store/redis/cluster.c b/debian/modules/nchan/src/store/redis/cluster.c
deleted file mode 100644
index 9d1322d0..00000000
--- a/debian/modules/nchan/src/store/redis/cluster.c
+++ /dev/null
@@ -1,1257 +0,0 @@
-#include <nchan_module.h>
-#include <assert.h>
-
-#include "redis_nginx_adapter.h"
-
-#include <util/nchan_msgid.h>
-#include <util/nchan_rbtree.h>
-#include <store/store_common.h>
-
-#include "cluster.h"
-
-//#define DBG(fmt, args...) ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "REDISTORE(CLUSTER): " fmt, ##args)
-#define DBG(args...) //
-
-#define ERR(fmt, args...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDISTORE(CLUSTER): " fmt, ##args)
-
-
-#define CLUSTER_NOTREADY_RETRY_TIME 1000
-
-static rbtree_seed_t              redis_cluster_node_id_tree;
-static nchan_list_t               redis_cluster_list;
-
-typedef struct {
-  ngx_str_t      line;
-  ngx_str_t      id;         //node id
-  ngx_str_t      address;    //address as known by redis
-  ngx_str_t      flags;
-  
-  ngx_str_t      master_id;  //if slave
-  ngx_str_t      ping_sent;
-  ngx_str_t      pong_recv;
-  ngx_str_t      config_epoch;
-  ngx_str_t      link_state; //connected or disconnected
-  
-  ngx_str_t      slots;
-  
-  unsigned       connected:1;
-  unsigned       master:1;
-  unsigned       failed:1;
-  unsigned       self:1;
-} cluster_nodes_line_t;
-
-static ngx_int_t index_rdata_by_cluster_node_id(rdstore_data_t *rdata, cluster_nodes_line_t *line);
-static ngx_int_t unindex_rdata_by_cluster_node_id(rdstore_data_t *rdata);
-
-static void redis_cluster_node_drop_keyslots(rdstore_data_t *rdata);
-static void rdata_set_cluster_node_flags(rdstore_data_t *rdata, cluster_nodes_line_t *l);
-
-static ngx_int_t associate_rdata_with_cluster(rdstore_data_t *rdata, redis_cluster_t *cluster);
-static ngx_int_t dissociate_rdata_from_cluster(rdstore_data_t *rdata);
-
-static void *redis_data_rbtree_node_cluster_id(void *data) {
-  return &(*(rdstore_data_t **)data)->node.id;
-}
-void redis_cluster_init_postconfig(ngx_conf_t *cf) {
-  rbtree_init(&redis_cluster_node_id_tree, "redis cluster node (by id) data", redis_data_rbtree_node_cluster_id, NULL, NULL);
-  nchan_list_init(&redis_cluster_list, sizeof(redis_cluster_t), "clusters");
-}
-
-void redis_cluster_exit_worker(ngx_cycle_t *cycle) {
-  nchan_list_el_t  *cur;
-  redis_cluster_t  *cluster;
-  for(cur = redis_cluster_list.head; cur != NULL; cur = cur->next) {
-    cluster = nchan_list_data_from_el(cur);
-    nchan_list_empty(&cluster->nodes.master);
-    nchan_list_empty(&cluster->nodes.slave);
-    nchan_list_empty(&cluster->nodes.disconnected);
-    
-    nchan_list_empty(&cluster->retry_commands);
-    
-    rbtree_empty(&cluster->hashslots, NULL, NULL);
-    
-    cluster->status = CLUSTER_NOTREADY;
-    nchan_reaper_stop(&cluster->chanhead_reaper);
-    if(cluster->still_notready_timer.timer_set) {
-      ngx_del_timer(&cluster->still_notready_timer);
-    }
-    if(cluster->pool) {
-      ngx_destroy_pool(cluster->pool);
-    }
-  }
-  nchan_list_empty(&redis_cluster_list);
-  rbtree_empty(&redis_cluster_node_id_tree, NULL, NULL);
-}
-
-static ngx_int_t cluster_set_status(redis_cluster_t *cluster, redis_cluster_status_t status);
-
-static void redis_cluster_info_callback(redisAsyncContext *ac, void *rep, void *privdata);
-static void redis_get_cluster_nodes_callback(redisAsyncContext *ac, void *rep, void *privdata);
-static uint16_t redis_crc16(uint16_t crc, const char *buf, int len);
-
-static void redis_check_if_cluster_ready_handler(ngx_event_t *ev) {
-  rdstore_data_t   *rdata = ev->data;
-  if(rdata->status != DISCONNECTED && rdata->ctx) {
-    redis_get_cluster_info(rdata);
-  }
-  
-  ngx_free(ev);
-}
-
-static void nchan_list_rdata_init(nchan_list_t *list, char *name) {
-  nchan_list_init(list, sizeof(rdstore_data_t *), name);
-}
-
-static ngx_int_t nchan_cluster_nodes_list_rdata_remove(rdstore_data_t *rdata) {
-  if(rdata->node.in_node_list) {
-    assert(rdata->node.node_list_el_data && *rdata->node.node_list_el_data == rdata);
-    nchan_list_remove(rdata->node.in_node_list, rdata->node.node_list_el_data);
-    rdata->node.in_node_list = NULL;
-    rdata->node.node_list_el_data = NULL;
-    return NGX_OK;
-  }
-  return NGX_DECLINED;
-}
-
-#define nchan_list_rdata_from_el(cur) *(rdstore_data_t **)nchan_list_data_from_el(cur)
-
-
-void redis_get_cluster_info(rdstore_data_t *rdata) {
-  redisAsyncCommand(rdata->ctx, redis_cluster_info_callback, NULL, "CLUSTER INFO");
-}
-
-static void redis_cluster_info_callback(redisAsyncContext *ac, void *rep, void *privdata) {
-  redisReply        *reply = rep;
-  rdstore_data_t    *rdata = ac->data;
-  //uintptr_t          cluster_size = 0;
-  //u_char            *cluster_size_start, *cluster_size_end;
-  if(!redisReplyOk(ac, reply) || reply->type != REDIS_REPLY_STRING) {
-    return;
-  }
-  
-  //what's the cluster size (# of master nodes)
-  /*
-  if((cluster_size_start = ngx_strstrn((u_char *)reply->str, "cluster_size:", 12)) != 0) {
-    cluster_size_start += 13;
-    cluster_size_end = (u_char *)ngx_strchr(cluster_size_start, '\r');
-    cluster_size = ngx_atoi(cluster_size_start, cluster_size_end - cluster_size_start);
-  }
-  */
-  
-  if(ngx_strstrn((u_char *)reply->str, "cluster_state:ok", 15)) {
-    redis_get_cluster_nodes(rdata);
-  }
-  else {
-    nchan_log_warning("Redis cluster not ready, says node %V", rdata->connect_url);
-    ngx_event_t      *evt = ngx_calloc(sizeof(*evt), ngx_cycle->log);
-    nchan_init_timer(evt, redis_check_if_cluster_ready_handler, rdata);
-    //rdt_set_status(rdata, WAITING_FOR_CLUSTER_READY, ac);
-    ngx_add_timer(evt, 1000);
-  }
-}
-
-
-static void *rbtree_cluster_hashslots_id(void *data) {
-  return &((redis_cluster_keyslot_range_node_t *)data)->range;
-}
-static uint32_t rbtree_cluster_hashslots_bucketer(void *vid) {
-  return 1; //no buckets
-}
-static ngx_int_t rbtree_cluster_hashslots_compare(void *v1, void *v2) {
-  redis_cluster_slot_range_t   *r1 = v1;
-  redis_cluster_slot_range_t   *r2 = v2;
-  
-  if(r2->max < r1->min) {
-    //r2 is strictly left of r1
-    return -1;
-  }
-  else if(r2->min > r1->max) {
-    //r2 is structly right of r1
-    return 1;
-  }
-  else {
-    //there's an overlap
-    return 0;
-  }
-}
-
-
-void redis_get_cluster_nodes(rdstore_data_t *rdata) {
-  redisAsyncCommand(rdata->ctx, redis_get_cluster_nodes_callback, NULL, "CLUSTER NODES");
-}
-
-#define nchan_scan_str(str_src, cur, chr, str)\
-  (str)->data = (u_char *)memchr(cur, chr, (str_src)->len - (cur - (str_src)->data));\
-  if(!(str)->data)                            \
-    (str)->data = (str_src)->data + (str_src)->len;\
-  if((str)->data) {                           \
-    (str)->len = (str)->data - cur;           \
-    (str)->data = cur;                        \
-    cur+=(str)->len+1;                        \
-  }                                           \
-  else                                        \
-    goto fail
-
-static rdstore_data_t *find_rdata_by_node_id(ngx_str_t *id) {
-  ngx_rbtree_node_t   *rbtree_node;
-  if((rbtree_node = rbtree_find_node(&redis_cluster_node_id_tree, id)) != NULL) {
-    //do any other nodes already have the cluster set? if so, use that cluster struct.
-    return *(rdstore_data_t **)rbtree_data_from_node(rbtree_node);
-  }
-  return NULL;
-}
-
-static char *redis_scan_cluster_nodes_line(char *line, cluster_nodes_line_t *l) {
-  u_char     *cur = (u_char *)line;
-  u_char     *max = cur;
-  ngx_str_t   rest_line;
-  
-  if(cur[0]=='\0')
-    return NULL;
-  
-  nchan_scan_nearest_chr(&max, &rest_line, 2, '\n', '\0');
-  l->line = rest_line;
-  
-  nchan_scan_until_chr_on_line(&rest_line, &l->id,           ' ');
-  nchan_scan_until_chr_on_line(&rest_line, &l->address,      ' ');
-  nchan_scan_until_chr_on_line(&rest_line, &l->flags,        ' ');
-  
-  nchan_scan_until_chr_on_line(&rest_line, &l->master_id,    ' ');
-  nchan_scan_until_chr_on_line(&rest_line, &l->ping_sent,    ' ');
-  nchan_scan_until_chr_on_line(&rest_line, &l->pong_recv,    ' ');
-  nchan_scan_until_chr_on_line(&rest_line, &l->config_epoch, ' ');
-  nchan_scan_until_chr_on_line(&rest_line, &l->link_state,   ' ');
-  
-  if(nchan_ngx_str_substr((&l->flags), "master")) {
-    l->slots = rest_line;
-    l->master = 1;
-  }
-  else {
-    l->slots.data = NULL;
-    l->slots.len = 0;
-    l->master = 0;
-  }
-  l->failed = nchan_ngx_str_substr((&l->flags), "fail");
-  l->self = nchan_ngx_str_substr((&l->flags), "myself") ? 1 : 0;
-  
-  l->connected = l->link_state.data[0]=='c' ? 1 : 0; //[c]onnected
-  
-  cur = max;
-  if(&cur[-1] > (u_char *)line && cur[-1] == '\0')
-    cur--;
-  return (char *)cur;
-}
-
-static u_char *redis_scan_cluster_nodes_slots_string(ngx_str_t *str, u_char *cur, redis_cluster_slot_range_t *r) {
-  ngx_str_t       slot_min_str, slot_max_str, slot;
-  ngx_int_t       slot_min,     slot_max;
-  u_char         *dash;
-  
-  if(cur == NULL) {
-    cur = str->data;
-  }
-  else if(cur >= str->data + str->len) {
-    return NULL;
-  }
-  if(str->len == 0) {
-    return NULL;
-  }
-  
-  nchan_scan_str(str, cur, ' ', &slot);
-  if(slot.data[0] == '[') {
-    //transitional special slot. ignore it.
-    return redis_scan_cluster_nodes_slots_string(str, cur, r);
-  }
-  
-  dash = (u_char *)memchr(slot.data, '-', slot.len);
-  if(dash) {
-    slot_min_str.data = slot.data;
-    slot_min_str.len = dash - slot.data;
-    
-    slot_max_str.data = dash + 1;
-    slot_max_str.len = slot.len - (slot_max_str.data - slot.data);
-  }
-  else {
-    slot_min_str = slot;
-    slot_max_str = slot;
-  }
-  
-  slot_min = ngx_atoi(slot_min_str.data, slot_min_str.len);
-  slot_max = ngx_atoi(slot_max_str.data, slot_max_str.len);
-  
-  DBG("slots: %i - %i", slot_min, slot_max);
-  
-  r->min = slot_min;
-  r->max = slot_max;
-  
-  return cur;
-  
-fail:
-  return NULL;
-}
-
-static void redis_cluster_discover_and_connect_to_missing_nodes(redisReply *reply, nchan_loc_conf_t *cf, redis_cluster_t *cluster) {
-  char                  *line;
-  redis_connect_params_t rcp;
-  rdstore_data_t        *rdata;
-  cluster_nodes_line_t   l;
-  ngx_str_t             *url;
-  
-  DBG("discover new nodes");
-  line = reply->str;
-  while((line = redis_scan_cluster_nodes_line(line, &l)) != NULL) {
-    if(l.master && !l.failed) {
-      if((rdata = find_rdata_by_node_id(&l.id)) == NULL) {
-        DBG("found a new node %V %V", &l.id, &l.address);
-        url = ngx_palloc(ngx_cycle->pool, sizeof(*url) + l.address.len + 1); //TODO: pallocate from a more fitting pool
-        url->data = (u_char *)&url[1];
-        nchan_strcpy(url, &l.address, 0);
-        url->data[url->len] = '\0';
-        parse_redis_url(url, &rcp);
-        rdata = redis_create_rdata(url, &rcp, &cf->redis, cf);
-        index_rdata_by_cluster_node_id(rdata, &l);
-      }
-      assert(rdata);
-      
-      if(rdata->node.cluster && rdata->node.cluster != cluster) {
-        dissociate_rdata_from_cluster(rdata);
-      }
-      
-      if(!nchan_ngx_str_match(&rdata->node.slots, &l.slots)) {
-        if(rdata->node.cluster) {
-          redis_cluster_node_drop_keyslots(rdata);
-        }
-        
-        unindex_rdata_by_cluster_node_id(rdata);
-        index_rdata_by_cluster_node_id(rdata, &l);
-      }
-      
-      rdata_set_cluster_node_flags(rdata, &l);
-      
-      associate_rdata_with_cluster(rdata, cluster);
-      
-      if(!rdata->node.failed && rdata->status != CONNECTED) {
-        cluster->node_connections_pending++;
-        redis_ensure_connected(rdata);
-      }
-    }
-    else if(!l.master && !l.failed && (rdata = find_rdata_by_node_id(&l.id)) != NULL) {
-      if(rdata->node.master) {
-        //master got downgraded to slave
-        rdata_set_cluster_node_flags(rdata, &l);
-      }
-    }
-  }
-}
-
-static rdstore_data_t *get_any_connected_cluster_node(redis_cluster_t *cluster) {
-  rdstore_data_t     *rdata;
-  nchan_list_el_t    *cur;
-  nchan_list_el_t   *node_head[] = {cluster->nodes.master.head, cluster->nodes.slave.head};
-  int                 i;
-  
-  for(i = 0; i < 2; i++) {
-    for(cur = node_head[i]; cur != NULL; cur = cur->next) {
-      rdata = nchan_list_rdata_from_el(cur);
-      if(rdata->status == CONNECTED) {
-        return rdata;
-      }
-    }
-  }
-  
-  return NULL;
-}
-
-static void cluster_not_ready_timer_handler(ngx_event_t *ev) {
-  redis_cluster_t               *cluster = ev->data;
-  rdstore_data_t                *rdata;
-  
-  if(ngx_exiting || ngx_quit) {
-    return;
-  }
-  
-  if(ev->timedout) {
-    ev->timedout=0;
-    if((rdata = get_any_connected_cluster_node(cluster)) != NULL) {
-      cluster->node_connections_pending = 0; //enough waiting. assume no more pending connections
-      redis_get_cluster_nodes(rdata);
-    }
-    else {
-      nchan_log_warning("No connected Redis cluster nodes. Wait until a connection can be established to at least one...");
-    }
-  }
-  
-  ngx_add_timer(ev, CLUSTER_NOTREADY_RETRY_TIME);
-}
-
-static ngx_int_t index_rdata_by_cluster_node_id(rdstore_data_t *rdata, cluster_nodes_line_t *line) {
-  struct {
-    rdstore_data_t   *rdata;
-    u_char            chr;
-  } *rdata_ptr_and_buf;
-  
-  ngx_rbtree_node_t      *rbtree_node;
-  
-  if(rdata->node.indexed)
-    return NGX_OK;
-  
-  if((rbtree_node = rbtree_create_node(&redis_cluster_node_id_tree, sizeof(*rdata) + line->id.len + line->address.len + line->slots.len)) == NULL) {
-    ERR("can't create rbtree node for redis connection");
-    return NGX_ERROR;
-  }
-  
-  rdata_ptr_and_buf = rbtree_data_from_node(rbtree_node);
-  rdata_ptr_and_buf->rdata = rdata;
-  
-  rdata->node.id.data = &rdata_ptr_and_buf->chr;
-  nchan_strcpy(&rdata->node.id, &line->id, 0);
-  
-  rdata->node.address.data = &rdata_ptr_and_buf->chr + line->id.len;
-  nchan_strcpy(&rdata->node.address, &line->address, 0);
-  
-  rdata->node.slots.data = &rdata_ptr_and_buf->chr + line->id.len + line->address.len;
-  nchan_strcpy(&rdata->node.slots, &line->slots, 0);
-  
-  if(rbtree_insert_node(&redis_cluster_node_id_tree, rbtree_node) != NGX_OK) {
-    ERR("couldn't insert redis cluster node ");
-    rbtree_destroy_node(&redis_cluster_node_id_tree, rbtree_node);
-    return NGX_ERROR;
-  }
-  
-  rdata->node.indexed = 1;
-  
-  return NGX_OK;
-}
-
-static ngx_int_t unindex_rdata_by_cluster_node_id(rdstore_data_t *rdata) {
-  ngx_rbtree_node_t    *node = rbtree_find_node(&redis_cluster_node_id_tree, &rdata->node.id);
-  if(node) {
-    rbtree_remove_node(&redis_cluster_node_id_tree, node);
-    rbtree_destroy_node(&redis_cluster_node_id_tree, node);
-    ngx_memzero(&rdata->node.id, sizeof(rdata->node.id));
-    ngx_memzero(&rdata->node.address, sizeof(rdata->node.address));
-    ngx_memzero(&rdata->node.slots, sizeof(rdata->node.slots));
-    rdata->node.indexed = 0;
-  }
-  return NGX_OK;
-}
-
-
-#define script_nonlocal_key_error "Lua script attempted to access a non local key in a cluster node"
-
-int clusterKeySlotOk(redisAsyncContext *c, void *r) {
-  redisReply *reply = (redisReply *)r;
-  if(reply && reply->type == REDIS_REPLY_ERROR) {
-    char    *script_error_start = "ERR Error running script";
-    char    *command_move_error = "MOVED ";
-    char    *command_ask_error = "ASK ";
-    
-    if((nchan_cstr_startswith(reply->str, script_error_start) && nchan_strstrn(reply->str, script_nonlocal_key_error))
-     || nchan_cstr_startswith(reply->str, command_move_error)
-     || nchan_cstr_startswith(reply->str, command_ask_error)) {
-      rdstore_data_t  *rdata = c->data;
-      
-      rbtree_empty(&rdata->node.cluster->hashslots, NULL, NULL);
-      cluster_set_status(rdata->node.cluster, CLUSTER_NOTREADY);
-      
-      return 0;
-    }
-    else
-      return 1;
-  }
-  return 1;
-}
-
-void *cluster_retry_palloc(redis_cluster_t *cluster, size_t sz) {
-  return ngx_palloc(nchan_list_get_pool(&cluster->retry_commands), sz);
-}
-void  cluster_retry_pfree(redis_cluster_t *cluster, void *ptr) {
-  ngx_pfree(cluster->retry_commands.pool, ptr);
-}
-
-static redis_cluster_retry_t *cluster_create_retry_command(redis_cluster_t *cluster, void (*handler)(rdstore_data_t *, void *), void *pd) {
-  redis_cluster_retry_t *retry;
-  if((retry = nchan_list_append(&cluster->retry_commands)) == NULL)
-    return NULL;
-  retry->retry = handler;
-  retry->data = pd;
-  return retry;
-}
-
-ngx_int_t cluster_add_retry_command_with_chanhead(rdstore_channel_head_t *chanhead, void (*handler)(rdstore_data_t *, void *), void *pd) {
-  redis_cluster_retry_t         *retry;
-  if((retry = cluster_create_retry_command(chanhead->rdt->node.cluster, handler, pd)) == NULL)
-    return NGX_ERROR;
-  
-  retry->type = CLUSTER_RETRY_BY_CHANHEAD;
-  retry->chanhead = chanhead;
-  chanhead->reserved++;
-  
-  return NGX_OK;
-}
-
-ngx_int_t cluster_add_retry_command_with_key(redis_cluster_t *cluster, ngx_str_t *key, void (*handler)(rdstore_data_t *, void *pd), void *pd) {
-  redis_cluster_retry_t         *retry;
-  if((retry = cluster_create_retry_command(cluster, handler, pd)) == NULL)
-    return NGX_ERROR;
-  
-  retry->type = CLUSTER_RETRY_BY_KEY;
-  retry->str.data = cluster_retry_palloc(cluster, key->len);
-  nchan_strcpy(&retry->str, key, 0);
-  
-  return NGX_OK;
-}
-
-ngx_int_t cluster_add_retry_command_with_channel_id(redis_cluster_t *cluster, ngx_str_t *chid, void (*handler)(rdstore_data_t *, void *pd), void *pd) {
-  redis_cluster_retry_t         *retry;
-  if((retry = cluster_create_retry_command(cluster, handler, pd)) == NULL)
-    return NGX_ERROR;
-  
-  retry->type = CLUSTER_RETRY_BY_CHANNEL_ID;
-  retry->str.data = cluster_retry_palloc(cluster, chid->len);
-  nchan_strcpy(&retry->str, chid, 0);
-  
-  return NGX_OK;
-}
-
-ngx_int_t cluster_add_retry_command_with_cstr(redis_cluster_t *cluster, u_char *cstr, void (*handler)(rdstore_data_t *, void *pd), void *pd) {
-  redis_cluster_retry_t         *retry;
-  size_t                         str_sz = strlen((char *)cstr);
-  
-  if((retry = cluster_create_retry_command(cluster, handler, pd)) == NULL)
-    return NGX_ERROR;
-  
-  retry->type = CLUSTER_RETRY_BY_CSTR;
-  retry->cstr = cluster_retry_palloc(cluster, str_sz + 1);
-  strcpy((char *)retry->cstr, (char *)cstr);
-  
-  return NGX_OK;
-}
-
-static void retry_commands_traverse_callback(void *data, void *pd) {
-  redis_cluster_t         *cluster = pd;
-  redis_cluster_retry_t   *retry = data;
-  rdstore_data_t          *rdata = NULL;
-  rdstore_data_t          *any_rdata = get_any_connected_cluster_node(cluster);
-  switch(retry->type) {
-    case CLUSTER_RETRY_BY_CHANHEAD:
-      retry->chanhead->reserved--;
-      rdata = redis_cluster_rdata_from_channel(retry->chanhead);
-      break;
-    
-    case CLUSTER_RETRY_BY_CHANNEL_ID:
-      rdata = redis_cluster_rdata_from_channel_id(any_rdata, &retry->str);
-      break;
-      
-    case CLUSTER_RETRY_BY_KEY:
-      rdata = redis_cluster_rdata_from_key(any_rdata, &retry->str);
-      break;
-      
-    case CLUSTER_RETRY_BY_CSTR:
-      rdata = redis_cluster_rdata_from_cstr(any_rdata, retry->cstr);
-      break;
-    
-  }
-  retry->retry(rdata, retry->data);
-}
-
-static ngx_int_t cluster_run_retry_commands(redis_cluster_t *cluster) {
-  assert(cluster->status = CLUSTER_READY);
-  nchan_list_traverse_and_empty(&cluster->retry_commands, retry_commands_traverse_callback, cluster);
-  return NGX_OK;
-}
-
-static void retry_commands_traverse_abort_callback(void *data, void *pd) {
-  redis_cluster_retry_t   *retry = data;
-  if(retry->type == CLUSTER_RETRY_BY_CHANHEAD) {
-    retry->chanhead->reserved--;
-  }
-  retry->retry(NULL, retry->data);
-}
-
-static ngx_int_t cluster_abort_retry_commands(redis_cluster_t *cluster) {
-  nchan_list_traverse_and_empty(&cluster->retry_commands, retry_commands_traverse_abort_callback, cluster);
-  return NGX_OK;
-}
-
-
-static redis_cluster_t *create_cluster_data(rdstore_data_t *node_rdata, int num_master_nodes, uint32_t homebrew_cluster_id, int configured_unverified_nodes) {
-  redis_cluster_t               *cluster = NULL;
-  size_t                         reaper_name_len = strlen("redis channel (cluster orphans) ()   ") + 60; //whatever
-  char                          *reaper_name;
-  
-  if((cluster = nchan_list_append_sized(&redis_cluster_list, sizeof(*cluster) + reaper_name_len )) == NULL) { //TODO: don't allocate from heap, use a pool or something
-    ERR("can't allocate cluster data");
-    return NULL;
-  }
-  ngx_memzero(cluster, sizeof(*cluster));
-  
-  rbtree_init(&cluster->hashslots, "redis cluster node (by id) data", rbtree_cluster_hashslots_id, rbtree_cluster_hashslots_bucketer, rbtree_cluster_hashslots_compare);
-  
-  cluster->size = num_master_nodes;
-  cluster->uscf = node_rdata->lcf->redis.upstream;
-  cluster->pool = NULL;
-  cluster->homebrew_id = homebrew_cluster_id;
-  nchan_list_rdata_init(&cluster->nodes.master, "connected master nodes");
-  nchan_list_rdata_init(&cluster->nodes.slave, "connected slave nodes");
-  nchan_list_rdata_init(&cluster->nodes.disconnected, "disconnected nodes");
-  //nchan_list_rdata_init(&cluster->failed_nodes, "failed nodes");
-  
-  nchan_list_pool_init(&cluster->retry_commands, sizeof(redis_cluster_retry_t), NGX_DEFAULT_POOL_SIZE, "retry commands");
-  
-  nchan_init_timer(&cluster->still_notready_timer, cluster_not_ready_timer_handler, cluster);
-  ngx_add_timer(&cluster->still_notready_timer, CLUSTER_NOTREADY_RETRY_TIME);
-  
-  cluster->node_connections_pending = configured_unverified_nodes;
-  
-  reaper_name = (char *)&cluster[1];
-  ngx_sprintf((u_char *)reaper_name, "redis channel (cluster orphans) (%p hid=%i)%Z", cluster, cluster->homebrew_id);
-  
-  rdstore_initialize_chanhead_reaper(&cluster->chanhead_reaper, reaper_name);
-  return cluster;
-}
-/*
-static void print_cluster_slots(redis_cluster_t *cluster) {
-  ngx_rbtree_node_t                   *node;
-  redis_cluster_slot_range_t           range = {0, 0};
-  redis_cluster_keyslot_range_node_t  *keyslot_tree_node;
-  
-  while(range.min <= 16383) {
-    if((node = rbtree_find_node(&cluster->hashslots, &range)) == NULL) {
-      DBG("cluster slots range incomplete: can't find slot %i", range.min);
-      return;
-    }
-    keyslot_tree_node = rbtree_data_from_node(node);
-    
-    if(keyslot_tree_node->rdata->status != CONNECTED) {
-      DBG("cluster node for range %i - %i not connected", keyslot_tree_node->range.min, keyslot_tree_node->range.max);
-      return;
-    }
-    
-    DBG("%p %V : range %i - %i", keyslot_tree_node->rdata, keyslot_tree_node->rdata->connect_url, keyslot_tree_node->range.min, keyslot_tree_node->range.max);
-    range.min = keyslot_tree_node->range.max + 1;
-    range.max = range.min;
-  }
-  DBG("cluster range complete");
-}
-*/
-static int check_cluster_slots_range_ok(redis_cluster_t *cluster) {
-  ngx_rbtree_node_t                   *node;
-  redis_cluster_slot_range_t           range = {0, 0};
-  redis_cluster_keyslot_range_node_t  *keyslot_tree_node;
-  
-  while(range.min <= 16383) {
-    if((node = rbtree_find_node(&cluster->hashslots, &range)) == NULL) {
-      DBG("cluster slots range incomplete: can't find slot %i", range.min);
-      return 0;
-    }
-    keyslot_tree_node = rbtree_data_from_node(node);
-    
-    if(keyslot_tree_node->rdata->status != CONNECTED) {
-      DBG("cluster node for range %i - %i not connected", keyslot_tree_node->range.min, keyslot_tree_node->range.max);
-      return 0;
-    }
-    
-    range.min = keyslot_tree_node->range.max + 1;
-    range.max = range.min;
-  }
-  DBG("cluster range complete");
-  //print_cluster_slots(cluster);
-  return 1;
-}
-
-static rdstore_data_t  **nchan_list_rdata_append(nchan_list_t *list, rdstore_data_t *rdata) {
-  rdstore_data_t   **ptr_rdata;
-  assert(rdata);
-  ptr_rdata = nchan_list_append(list);
-  *ptr_rdata = rdata;
-  return ptr_rdata;
-}
-
-static ngx_int_t update_rdata_cluster_node_lists(rdstore_data_t *rdata) {
-  nchan_list_t      *list;
-  rdstore_data_t   **ptr_rdata;
-  redis_cluster_t   *cluster = rdata->node.cluster;
-  
-  if(!cluster) {
-    nchan_cluster_nodes_list_rdata_remove(rdata);
-    return NGX_DECLINED;
-  }
-  
-  if(rdata->status != CONNECTED)
-    list = &cluster->nodes.disconnected;
-  else if(rdata->node.master)
-    list = &cluster->nodes.master;
-  else
-    list = &cluster->nodes.slave;
-  
-  if(rdata->node.in_node_list != list) {
-    nchan_cluster_nodes_list_rdata_remove(rdata);
-    
-    assert(rdata->node.in_node_list == NULL);
-    assert(rdata->node.node_list_el_data == NULL);
-    
-    ptr_rdata = nchan_list_rdata_append(list, rdata);
-    
-    rdata->node.in_node_list = list;
-    rdata->node.node_list_el_data = ptr_rdata;
-  }
-  return NGX_OK;
-}
-
-
-static ngx_int_t associate_rdata_with_cluster(rdstore_data_t *rdata, redis_cluster_t *cluster) {
-  u_char                              *cur;
-  redis_cluster_slot_range_t           range;
-  ngx_rbtree_node_t                   *rbtree_node;
-  redis_cluster_keyslot_range_node_t  *keyslot_tree_node;
-  
-  if(!rdata->node.cluster) {
-    rdata->node.cluster = cluster;
-  }
-  
-  update_rdata_cluster_node_lists(rdata);
-  
-  if(rdata->node.master) {
-    //hash slots
-    cur = NULL;
-    while((cur = redis_scan_cluster_nodes_slots_string(&rdata->node.slots, cur, &range)) != NULL) {
-      
-      rbtree_node = rbtree_find_node(&cluster->hashslots, &range);
-      if(rbtree_node) {
-        keyslot_tree_node = rbtree_data_from_node(rbtree_node);
-        if(keyslot_tree_node->rdata == rdata && keyslot_tree_node->range.min == range.min && keyslot_tree_node->range.max == range.max) {
-          DBG("cluster node keyslot range already exists. no problem here.");
-        }
-        else {
-          DBG("this slot range is a little different. get rid of the old one");
-          rbtree_remove_node(&cluster->hashslots, rbtree_node);
-          rbtree_destroy_node(&cluster->hashslots, rbtree_node);
-          rbtree_node = NULL;
-        }
-      }
-      
-      if(rbtree_node == NULL) {
-        rbtree_node = rbtree_create_node(&cluster->hashslots, sizeof(*keyslot_tree_node));
-        keyslot_tree_node = rbtree_data_from_node(rbtree_node);
-        keyslot_tree_node->range = range;
-        keyslot_tree_node->rdata = rdata;
-        
-        if(rbtree_insert_node(&cluster->hashslots, rbtree_node) != NGX_OK) {
-          ERR("couldn't insert redis cluster hashslots node ");
-          rbtree_destroy_node(&cluster->hashslots, rbtree_node);
-          assert(0);
-        }
-      }
-    }
-  }
-  
-  if(check_cluster_slots_range_ok(cluster)) {
-    cluster_set_status(cluster, CLUSTER_READY);
-  }
-  return NGX_OK;
-}
-
-static void rdata_set_cluster_node_flags(rdstore_data_t *rdata, cluster_nodes_line_t *l) {
-  if(l->failed != rdata->node.failed) {
-    rdata->node.failed = l->failed;
-  }
-  
-  if(l->master != rdata->node.master) {
-    if(rdata->node.cluster && rdata->node.master)
-      redis_cluster_node_drop_keyslots(rdata);
-    
-    rdata->node.master = l->master;
-  }
-  
-  update_rdata_cluster_node_lists(rdata);
-}
-
-static void redis_get_cluster_nodes_callback(redisAsyncContext *ac, void *rep, void *privdata) {
-  redisReply                    *reply = rep;
-  rdstore_data_t                *rdata = ac->data;
-  rdstore_data_t                *found_rdata = NULL, *unassoc_rdata, *my_rdata = NULL; //cluster tree node
-  redis_cluster_t               *cluster = NULL;
-  ngx_uint_t                     num_master_nodes = 0;
-  uint32_t                       homebrew_cluster_id = 0;
-  int                            configured_unverified_nodes = 0;
-  
-  nchan_list_t                   unassociated_nodes;
-  nchan_list_el_t               *cur;
-  nchan_list_rdata_init(&unassociated_nodes, "unassociated nodes");
-  
-  
-  nchan_loc_conf_t              *cf = rdata->lcf;
-  
-  DBG("redis_get_cluster_nodes_callback for %p", rdata);
-  
-  if(cf->redis.upstream) {
-    configured_unverified_nodes = cf->redis.upstream->servers->nelts;
-  }
-  else {
-    assert(0);
-  }
-  
-  if(!redisReplyOk(ac, reply) || reply->type != REDIS_REPLY_STRING) {
-    return;
-  }
-  
-  char                 *line;
-  cluster_nodes_line_t  l;
-  
-  line = reply->str;
-  DBG("\n%s", reply->str);
-  while((line = redis_scan_cluster_nodes_line(line, &l)) != NULL) {
-    found_rdata = NULL;
-    
-    if(l.master && !l.failed) {
-      num_master_nodes++;
-      homebrew_cluster_id += redis_crc16(0, (const char*)l.id.data, l.id.len);
-    }
-      
-    if((found_rdata = find_rdata_by_node_id(&l.id)) == NULL) {
-      redis_connect_params_t rcp;
-      parse_redis_url(&l.address, &rcp);
-      found_rdata = find_rdata_by_connect_params(&rcp);
-    }
-    
-    if(found_rdata) {
-      rdata_set_cluster_node_flags(found_rdata, &l);
-      index_rdata_by_cluster_node_id(found_rdata, &l);
-      if(found_rdata->node.cluster) {
-        if(cluster)
-          assert(cluster == found_rdata->node.cluster);
-        else
-          cluster = found_rdata->node.cluster;
-      }
-      else {
-        nchan_list_rdata_append(&unassociated_nodes, found_rdata);
-      }
-      if(cluster)
-        associate_rdata_with_cluster(found_rdata, cluster);
-    }
-    
-    if(l.self) {
-      //myself
-      rdata_set_cluster_node_flags(rdata, &l);
-      index_rdata_by_cluster_node_id(rdata, &l);
-      if(found_rdata) {
-        assert(found_rdata == rdata);
-        DBG("%p %V %V already added to redis_cluster_node_id_tree... weird... how?...", rdata, &rdata->node.id, &rdata->node.id);
-      }
-      
-      my_rdata = rdata;
-    }
-  }
-  
-  if(my_rdata) {
-    if(!cluster) {
-      cluster = create_cluster_data(my_rdata, num_master_nodes, homebrew_cluster_id, configured_unverified_nodes);
-    }
-    if(cluster->homebrew_id != homebrew_cluster_id && cluster->status != CLUSTER_READY) {
-      DBG("Cluster homebrew_id changed maybe");
-      cluster->homebrew_id = homebrew_cluster_id;
-    }
-    
-    associate_rdata_with_cluster(my_rdata, cluster);
-    
-    if(cluster->node_connections_pending > 0) {
-      cluster->node_connections_pending --;
-    }
-    if(cluster->node_connections_pending == 0 && cluster->nodes.master.n < cluster->size) {
-      redis_cluster_discover_and_connect_to_missing_nodes(reply, cf, cluster);
-    }
-    
-  }
-  else {
-    DBG("my_rdata was blank... eh?...");
-  }
-  
-  if(cluster) {
-    for(cur = unassociated_nodes.head; cur != NULL; cur = cur->next) {
-      unassoc_rdata = nchan_list_rdata_from_el(cur);
-      associate_rdata_with_cluster(unassoc_rdata, cluster);
-    }
-  }
-  nchan_list_empty(&unassociated_nodes);
-  
-}
-
-static ngx_int_t cluster_set_status(redis_cluster_t *cluster, redis_cluster_status_t status) {
-  redis_cluster_status_t     prev_status = cluster->status;
-  rdstore_channel_head_t    *ch_cur;
-  
-  
-  if(status == CLUSTER_READY && prev_status != CLUSTER_READY) {
-    assert(check_cluster_slots_range_ok(cluster));
-    while((ch_cur = cluster->orphan_channels_head) != NULL) {
-      redis_chanhead_gc_withdraw(ch_cur);
-      
-      ensure_chanhead_pubsub_subscribed(ch_cur);
-      
-      cluster->orphan_channels_head = ch_cur->rd_next;
-      if(cluster->orphan_channels_head) {
-        cluster->orphan_channels_head->rd_prev = NULL;
-      }
-      
-      ch_cur->rd_prev = NULL;
-      ch_cur->rd_next = NULL;
-      assert(redis_cluster_associate_chanhead_with_rdata(ch_cur) == NGX_OK);
-      redis_chanhead_catch_up_after_reconnect(ch_cur);
-    }
-    
-    //stop any still running rdata reconnect timers
-    rdstore_data_t    *rcur;
-    nchan_list_el_t   *cur;
-    nchan_list_t     **list;
-    nchan_list_t      *lists[] = {&cluster->nodes.master, &cluster->nodes.slave, &cluster->nodes.disconnected, NULL};
-    for(list = lists; *list != NULL; list++) {
-      for(cur = (*list)->head; cur != NULL; cur = cur->next) {
-        rcur = nchan_list_rdata_from_el(cur);
-        if(rcur->reconnect_timer.timer_set) {
-          ngx_del_timer(&rcur->reconnect_timer);
-        }
-      }
-    }
-    
-    if(cluster->still_notready_timer.timer_set) {
-      ngx_del_timer(&cluster->still_notready_timer);
-    }
-    
-    cluster_run_retry_commands(cluster);
-    
-    nchan_log_notice("Redis cluster ready.");
-    
-  }
-  else if(status != CLUSTER_READY && prev_status == CLUSTER_READY) {
-    for(ch_cur = cluster->orphan_channels_head; ch_cur != NULL; ch_cur = ch_cur->rd_next) {
-      if(ch_cur->in_gc_reaper) {
-        redis_chanhead_gc_withdraw(ch_cur);
-        redis_chanhead_gc_add_to_reaper(&cluster->chanhead_reaper, ch_cur, NCHAN_CHANHEAD_CLUSTER_ORPHAN_EXPIRE_SEC, "redis connection to cluster node gone"); //automatically added to cluster's gc
-      }
-    }
-    
-    if(!cluster->still_notready_timer.timer_set) {
-      ngx_add_timer(&cluster->still_notready_timer, CLUSTER_NOTREADY_RETRY_TIME);
-    }
-    
-  }
-  
-  else if(status == CLUSTER_FAILED && prev_status != CLUSTER_FAILED) {
-    cluster_abort_retry_commands(cluster);
-  }
-  
-  cluster->status = status;
-  
-  return NGX_OK;
-}
-
-static ngx_int_t rdata_make_chanheads_cluster_orphans(rdstore_data_t *rdata) {
-  redis_cluster_t            *cluster = rdata->node.cluster;
-  if(rdata->channels_head) {
-    rdstore_channel_head_t  *cur, *last = NULL;
-    for(cur = rdata->channels_head; cur != NULL; cur = cur->rd_next){
-      last = cur;
-      redis_chanhead_gc_withdraw(cur);
-      cur->status = NOTREADY;
-      cur->pubsub_status = UNSUBBED;
-      cur->cluster.node_rdt = NULL;
-    }
-    if(last) {
-      last->rd_next = cluster->orphan_channels_head;
-      if(cluster->orphan_channels_head)
-        cluster->orphan_channels_head->rd_prev = last;
-      cluster->orphan_channels_head = last;
-    }
-    rdata->channels_head = NULL;
-  }
-  return NGX_OK;
-}
-
-ngx_int_t redis_cluster_node_change_status(rdstore_data_t *rdata, redis_connection_status_t status) {
-  redis_connection_status_t   prev_status = rdata->status;
-  redis_cluster_t            *cluster = rdata->node.cluster;
-  
-  if(status == CONNECTED && prev_status != CONNECTED) {
-    cluster->nodes_connected++;
-  }
-  else if(status != CONNECTED && prev_status == CONNECTED) {
-    
-    cluster->nodes_connected--;
-    //add to orphan chanheads list
-    
-    //wait to reconnect maybe?
-    rdata_make_chanheads_cluster_orphans(rdata);
-    
-    cluster_set_status(cluster, CLUSTER_NOTREADY);
-  }
-
-  return NGX_OK; 
-}
-
-typedef struct {
-  rdstore_data_t      *rdata;
-  ngx_rbtree_node_t   *found;
-} rdata_node_finder_data_t;
-
-rbtree_walk_direction_t rdata_node_finder(rbtree_seed_t *seed, void *data, void *privdata) {
-  redis_cluster_keyslot_range_node_t *d = data;
-  rdata_node_finder_data_t           *pd = privdata;
-  
-  if(d->rdata == pd->rdata) {
-    pd->found = rbtree_node_from_data(d);
-    return RBTREE_WALK_STOP;
-  }
-  else {
-    return RBTREE_WALK_LEFT_RIGHT;
-  }
-}
-
-static void redis_cluster_node_drop_keyslots(rdstore_data_t *rdata) {
-  rdata_node_finder_data_t   finder_data;
-  redis_cluster_t           *cluster = rdata->node.cluster;
-  
-  //remove from hashslots. this is a little tricky, we walk the hashslots tree 
-  // until we can's find this rdata
-  
-  finder_data.rdata = rdata;
-  while(1) {
-    finder_data.found = NULL;
-    rbtree_conditional_walk(&cluster->hashslots, rdata_node_finder, &finder_data);
-    if(finder_data.found != NULL) {
-      DBG("destroyed node %p", finder_data.found);
-      rbtree_remove_node(&cluster->hashslots, finder_data.found);
-      rbtree_destroy_node(&cluster->hashslots, finder_data.found);
-    }
-    else {
-      break;
-    }
-  }
-  
-  rdata_make_chanheads_cluster_orphans(rdata);
-}
-
-
-static ngx_int_t dissociate_rdata_from_cluster(rdstore_data_t *rdata) {
-  assert(rdata->node.cluster != NULL);
-  if((rdata->node.failed || !rdata->node.master) && rdata->reconnect_timer.timer_set) {
-    ngx_del_timer(&rdata->reconnect_timer);
-  }
-  
-  rdata_make_chanheads_cluster_orphans(rdata);
-  
-  redis_cluster_node_drop_keyslots(rdata);
-  
-  rdata->node.cluster = NULL;
-  update_rdata_cluster_node_lists(rdata);
-  return NGX_OK;
-}
-
-
-
-static uint16_t redis_crc16(uint16_t crc, const char *buf, int len);
-static rdstore_data_t *redis_cluster_rdata_from_keyslot(rdstore_data_t *rdata, uint16_t slot);
-
-
-ngx_int_t redis_cluster_associate_chanhead_with_rdata(rdstore_channel_head_t *ch) {
-  if(redis_cluster_rdata_from_channel(ch)) {
-    return NGX_OK;
-  }
-  else {
-    return NGX_ERROR;
-  }
-}
-
-rdstore_data_t *redis_cluster_rdata_from_channel(rdstore_channel_head_t *ch) {
-  rdstore_data_t  *rdata;
-  if(!ch->cluster.enabled) {
-    return ch->rdt;
-  }
-  
-  if(ch->cluster.node_rdt) {
-    return ch->cluster.node_rdt;
-  }
-  
-  rdata = redis_cluster_rdata_from_channel_id(ch->rdt, &ch->id);
-  
-  assert(ch->rd_prev == NULL);
-  assert(ch->rd_next == NULL);
-  
-  if(rdata) {
-    redis_associate_chanhead_with_rdata(ch, rdata);
-  }
-  else {
-    redis_cluster_t   *cluster = ch->rdt->node.cluster;
-    ch->rd_prev = NULL;
-    
-    if(cluster->orphan_channels_head) {
-      cluster->orphan_channels_head = ch;
-    }
-    cluster->orphan_channels_head = ch;
-  }
-  
-  ch->cluster.node_rdt = rdata;
-  return rdata;
-  
-}
-
-rdstore_data_t *redis_cluster_rdata_from_channel_id(rdstore_data_t *rdata, ngx_str_t *str){
-  if(!rdata->node.cluster)
-    return rdata;
-  
-  static uint16_t  prefix_crc = 0;
-  if(prefix_crc == 0) {
-    prefix_crc = redis_crc16(0, "channel:", 8);
-  }
-  uint16_t   slot = redis_crc16(prefix_crc, (const char *)str->data, str->len) % 16384;
-  //DBG("channel id %V (key {channel:%V}) slot %i", str, str, slot);
-  
-  return redis_cluster_rdata_from_keyslot(rdata, slot);
-}
-
-rdstore_data_t *redis_cluster_rdata_from_key(rdstore_data_t *rdata, ngx_str_t *key) {
-  char        *start, *end;
-  ngx_str_t    hashable;
-  
-  if(((start = memchr(key->data, '{', key->len))) != NULL) {
-    start++;
-    end = memchr(start, '}', key->len - ((u_char *)start - key->data));
-    if(end && end - start > 1) {
-      hashable.data = (u_char *)start;
-      hashable.len = (end - start);
-    }
-    else {
-      hashable = *key;
-      // not quite right -- need to ignore zero-length {} and scan to the next {
-      // but it's good enough for the keys we're using
-    }
-    return redis_cluster_rdata(rdata, &hashable);
-  }
-  return redis_cluster_rdata(rdata, key);
-}
-
-rdstore_data_t *redis_cluster_rdata(rdstore_data_t *rdata, ngx_str_t *str) {
-  if(!rdata->node.cluster)
-    return rdata;
-  
-  uint16_t   slot = redis_crc16(0, (const char *)str->data, str->len) % 16384;
-  DBG("str %V slot %i", str, slot);
-  
-  return redis_cluster_rdata_from_keyslot(rdata, slot);
-}
-
-rdstore_data_t *redis_cluster_rdata_from_cstr(rdstore_data_t *rdata, u_char *str) {
-  if(!rdata->node.cluster)
-    return rdata;
-  
-  uint16_t   slot = redis_crc16(0, (const char *)str, strlen((char *)str)) % 16384;
-  DBG("cstr %s slot %i", str, slot);
-  
-  return redis_cluster_rdata_from_keyslot(rdata, slot);
-}
-
-static rdstore_data_t *redis_cluster_rdata_from_keyslot(rdstore_data_t *rdata, uint16_t slot) {
-  
-
-  redis_cluster_slot_range_t           range = {slot, slot};
-  ngx_rbtree_node_t                   *rbtree_node;
-  redis_cluster_keyslot_range_node_t  *keyslot_tree_node;
-  
-  if((rbtree_node = rbtree_find_node(&rdata->node.cluster->hashslots, &range)) == NULL) {
-    DBG("hashslot not found. what do?!");
-    return NULL;
-  }
-  
-  keyslot_tree_node = rbtree_data_from_node(rbtree_node);
-  assert(keyslot_tree_node->range.min <= slot && keyslot_tree_node->range.max >= slot);
-  return keyslot_tree_node->rdata;
-}
-
-
-
-
-
-/*
- * Copyright 2001-2010 Georges Menie (www.menie.org)
- * Copyright 2010 Salvatore Sanfilippo (adapted to Redis coding style)
- * All rights reserved.
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- *     * Redistributions of source code must retain the above copyright
- *       notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above copyright
- *       notice, this list of conditions and the following disclaimer in the
- *       documentation and/or other materials provided with the distribution.
- *     * Neither the name of the University of California, Berkeley nor the
- *       names of its contributors may be used to endorse or promote products
- *       derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE REGENTS AND CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* CRC16 implementation according to CCITT standards.
- *
- * Note by @antirez: this is actually the XMODEM CRC 16 algorithm, using the
- * following parameters:
- *
- * Name                       : "XMODEM", also known as "ZMODEM", "CRC-16/ACORN"
- * Width                      : 16 bit
- * Poly                       : 1021 (That is actually x^16 + x^12 + x^5 + 1)
- * Initialization             : 0000
- * Reflect Input byte         : False
- * Reflect Output CRC         : False
- * Xor constant to output CRC : 0000
- * Output for "123456789"     : 31C3
- */
-
-static const uint16_t crc16tab[256]= {
-    0x0000,0x1021,0x2042,0x3063,0x4084,0x50a5,0x60c6,0x70e7,
-    0x8108,0x9129,0xa14a,0xb16b,0xc18c,0xd1ad,0xe1ce,0xf1ef,
-    0x1231,0x0210,0x3273,0x2252,0x52b5,0x4294,0x72f7,0x62d6,
-    0x9339,0x8318,0xb37b,0xa35a,0xd3bd,0xc39c,0xf3ff,0xe3de,
-    0x2462,0x3443,0x0420,0x1401,0x64e6,0x74c7,0x44a4,0x5485,
-    0xa56a,0xb54b,0x8528,0x9509,0xe5ee,0xf5cf,0xc5ac,0xd58d,
-    0x3653,0x2672,0x1611,0x0630,0x76d7,0x66f6,0x5695,0x46b4,
-    0xb75b,0xa77a,0x9719,0x8738,0xf7df,0xe7fe,0xd79d,0xc7bc,
-    0x48c4,0x58e5,0x6886,0x78a7,0x0840,0x1861,0x2802,0x3823,
-    0xc9cc,0xd9ed,0xe98e,0xf9af,0x8948,0x9969,0xa90a,0xb92b,
-    0x5af5,0x4ad4,0x7ab7,0x6a96,0x1a71,0x0a50,0x3a33,0x2a12,
-    0xdbfd,0xcbdc,0xfbbf,0xeb9e,0x9b79,0x8b58,0xbb3b,0xab1a,
-    0x6ca6,0x7c87,0x4ce4,0x5cc5,0x2c22,0x3c03,0x0c60,0x1c41,
-    0xedae,0xfd8f,0xcdec,0xddcd,0xad2a,0xbd0b,0x8d68,0x9d49,
-    0x7e97,0x6eb6,0x5ed5,0x4ef4,0x3e13,0x2e32,0x1e51,0x0e70,
-    0xff9f,0xefbe,0xdfdd,0xcffc,0xbf1b,0xaf3a,0x9f59,0x8f78,
-    0x9188,0x81a9,0xb1ca,0xa1eb,0xd10c,0xc12d,0xf14e,0xe16f,
-    0x1080,0x00a1,0x30c2,0x20e3,0x5004,0x4025,0x7046,0x6067,
-    0x83b9,0x9398,0xa3fb,0xb3da,0xc33d,0xd31c,0xe37f,0xf35e,
-    0x02b1,0x1290,0x22f3,0x32d2,0x4235,0x5214,0x6277,0x7256,
-    0xb5ea,0xa5cb,0x95a8,0x8589,0xf56e,0xe54f,0xd52c,0xc50d,
-    0x34e2,0x24c3,0x14a0,0x0481,0x7466,0x6447,0x5424,0x4405,
-    0xa7db,0xb7fa,0x8799,0x97b8,0xe75f,0xf77e,0xc71d,0xd73c,
-    0x26d3,0x36f2,0x0691,0x16b0,0x6657,0x7676,0x4615,0x5634,
-    0xd94c,0xc96d,0xf90e,0xe92f,0x99c8,0x89e9,0xb98a,0xa9ab,
-    0x5844,0x4865,0x7806,0x6827,0x18c0,0x08e1,0x3882,0x28a3,
-    0xcb7d,0xdb5c,0xeb3f,0xfb1e,0x8bf9,0x9bd8,0xabbb,0xbb9a,
-    0x4a75,0x5a54,0x6a37,0x7a16,0x0af1,0x1ad0,0x2ab3,0x3a92,
-    0xfd2e,0xed0f,0xdd6c,0xcd4d,0xbdaa,0xad8b,0x9de8,0x8dc9,
-    0x7c26,0x6c07,0x5c64,0x4c45,0x3ca2,0x2c83,0x1ce0,0x0cc1,
-    0xef1f,0xff3e,0xcf5d,0xdf7c,0xaf9b,0xbfba,0x8fd9,0x9ff8,
-    0x6e17,0x7e36,0x4e55,0x5e74,0x2e93,0x3eb2,0x0ed1,0x1ef0
-};
-
-static uint16_t redis_crc16(uint16_t crc, const char *buf, int len) {
-    int counter;
-    for (counter = 0; counter < len; counter++)
-            crc = (crc<<8) ^ crc16tab[((crc>>8) ^ *buf++)&0x00FF];
-    return crc;
-}
diff --git a/debian/modules/nchan/src/store/redis/cluster.h b/debian/modules/nchan/src/store/redis/cluster.h
deleted file mode 100644
index b09b70d1..00000000
--- a/debian/modules/nchan/src/store/redis/cluster.h
+++ /dev/null
@@ -1,30 +0,0 @@
-#ifndef NCHAN_REDIS_CLUSTER_H
-#define NCHAN_REDIS_CLUSTER_H
-
-#include "store-private.h"
-#include "store.h"
-
-void redis_cluster_init_postconfig(ngx_conf_t *cf);
-void redis_cluster_exit_worker(ngx_cycle_t *cycle);
-
-void redis_get_cluster_info(rdstore_data_t *rdata);
-void redis_get_cluster_nodes(rdstore_data_t *rdata);
-
-rdstore_data_t *redis_cluster_rdata(rdstore_data_t *rdata, ngx_str_t *str);
-rdstore_data_t *redis_cluster_rdata_from_cstr(rdstore_data_t *rdata, u_char *str);
-rdstore_data_t *redis_cluster_rdata_from_key(rdstore_data_t *rdata, ngx_str_t *key);
-rdstore_data_t *redis_cluster_rdata_from_channel_id(rdstore_data_t *rdata, ngx_str_t *str);
-rdstore_data_t *redis_cluster_rdata_from_channel(rdstore_channel_head_t *ch);
-ngx_int_t redis_cluster_associate_chanhead_with_rdata(rdstore_channel_head_t *ch);
-
-void *cluster_retry_palloc(redis_cluster_t *, size_t);
-void  cluster_retry_pfree(redis_cluster_t *, void *);
-ngx_int_t cluster_add_retry_command_with_chanhead(rdstore_channel_head_t *, void (*)(rdstore_data_t *, void *), void *);
-ngx_int_t cluster_add_retry_command_with_key(redis_cluster_t *, ngx_str_t *, void (*)(rdstore_data_t *, void *pd), void *pd);
-ngx_int_t cluster_add_retry_command_with_channel_id(redis_cluster_t *, ngx_str_t *, void (*)(rdstore_data_t *, void *pd), void *pd);
-ngx_int_t cluster_add_retry_command_with_cstr(redis_cluster_t *, u_char *, void (*)(rdstore_data_t *, void *pd), void *pd);
-
-int clusterKeySlotOk(redisAsyncContext *c, void *r);
-
-ngx_int_t redis_cluster_node_change_status(rdstore_data_t *rdata, redis_connection_status_t status);
-#endif //NCHAN_REDIS_CLUSTER_H
diff --git a/debian/modules/nchan/src/store/redis/cmp.c b/debian/modules/nchan/src/store/redis/cmp.c
index 4a7fe061..a75bdb15 100644
--- a/debian/modules/nchan/src/store/redis/cmp.c
+++ b/debian/modules/nchan/src/store/redis/cmp.c
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2015 Charles Gunyon
+Copyright (c) 2017 Charles Gunyon
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -28,7 +28,7 @@ THE SOFTWARE.
 
 #include "cmp.h"
 
-static const uint32_t version = 14;
+static const uint32_t version = 17;
 static const uint32_t mp_version = 5;
 
 enum {
@@ -71,9 +71,9 @@ enum {
 };
 
 enum {
-  FIXARRAY_SIZE        = 0xF,
-  FIXMAP_SIZE          = 0xF,
-  FIXSTR_SIZE          = 0x1F
+  FIXARRAY_SIZE = 0xF,
+  FIXMAP_SIZE   = 0xF,
+  FIXSTR_SIZE   = 0x1F
 };
 
 enum {
@@ -93,6 +93,8 @@ enum {
   INVALID_TYPE_ERROR,
   LENGTH_READING_ERROR,
   LENGTH_WRITING_ERROR,
+  SKIP_DEPTH_LIMIT_EXCEEDED_ERROR,
+  INTERNAL_ERROR,
   ERROR_MAX
 };
 
@@ -113,6 +115,8 @@ const char *cmp_error_messages[ERROR_MAX + 1] = {
   "Invalid type",
   "Error reading size",
   "Error writing size",
+  "Depth limit exceeded while skipping",
+  "Internal error",
   "Max Error"
 };
 
@@ -177,86 +181,582 @@ static uint64_t be64(uint64_t x) {
   return x;
 }
 
-static float befloat(float x) {
-  char *b = (char *)&x;
+static float decode_befloat(char *b) {
+  float f = 0.;
+  char *fb = (char *)&f;
 
   if (!is_bigendian()) {
-    char swap = 0;
+    fb[0] = b[3];
+    fb[1] = b[2];
+    fb[2] = b[1];
+    fb[3] = b[0];
+  }
 
-    swap = b[0];
-    b[0] = b[3];
-    b[3] = swap;
+  return f;
+}
 
-    swap = b[1];
-    b[1] = b[2];
-    b[2] = swap;
+static double decode_bedouble(char *b) {
+  double d = 0.;
+  char *db = (char *)&d;
+
+  if (!is_bigendian()) {
+    db[0] = b[7];
+    db[1] = b[6];
+    db[2] = b[5];
+    db[3] = b[4];
+    db[4] = b[3];
+    db[5] = b[2];
+    db[6] = b[1];
+    db[7] = b[0];
   }
 
-  return x;
+  return d;
 }
 
-static double bedouble(double x) {
-  char *b = (char *)&x;
+static bool read_byte(cmp_ctx_t *ctx, uint8_t *x) {
+  return ctx->read(ctx, x, sizeof(uint8_t));
+}
 
-  if (!is_bigendian()) {
-    char swap = 0;
+static bool write_byte(cmp_ctx_t *ctx, uint8_t x) {
+  return (ctx->write(ctx, &x, sizeof(uint8_t)) == (sizeof(uint8_t)));
+}
 
-    swap = b[0];
-    b[0] = b[7];
-    b[7] = swap;
+static bool skip_bytes(cmp_ctx_t *ctx, size_t count) {
+  if (ctx->skip) {
+    return ctx->skip(ctx, count);
+  }
+  else {
+    uint8_t floor;
+    size_t i;
 
-    swap = b[1];
-    b[1] = b[6];
-    b[6] = swap;
+    for (i = 0; i < count; i++) {
+      if (!ctx->read(ctx, &floor, sizeof(uint8_t))) {
+        return false;
+      }
+    }
 
-    swap = b[2];
-    b[2] = b[5];
-    b[5] = swap;
+    return true;
+  }
+}
 
-    swap = b[3];
-    b[3] = b[4];
-    b[4] = swap;
+static bool read_type_marker(cmp_ctx_t *ctx, uint8_t *marker) {
+  if (read_byte(ctx, marker)) {
+    return true;
+  }
+
+  ctx->error = TYPE_MARKER_READING_ERROR;
+  return false;
+}
+
+static bool write_type_marker(cmp_ctx_t *ctx, uint8_t marker) {
+  if (write_byte(ctx, marker))
+    return true;
+
+  ctx->error = TYPE_MARKER_WRITING_ERROR;
+  return false;
+}
+
+static bool write_fixed_value(cmp_ctx_t *ctx, uint8_t value) {
+  if (write_byte(ctx, value))
+    return true;
+
+  ctx->error = FIXED_VALUE_WRITING_ERROR;
+  return false;
+}
+
+static bool type_marker_to_cmp_type(uint8_t type_marker, uint8_t *cmp_type) {
+  if (type_marker <= 0x7F) {
+    *cmp_type = CMP_TYPE_POSITIVE_FIXNUM;
+    return true;
+  }
+
+  if (type_marker <= 0x8F) {
+    *cmp_type = CMP_TYPE_FIXMAP;
+    return true;
+  }
+
+  if (type_marker <= 0x9F) {
+    *cmp_type = CMP_TYPE_FIXARRAY;
+    return true;
+  }
+
+  if (type_marker <= 0xBF) {
+    *cmp_type = CMP_TYPE_FIXSTR;
+    return true;
+  }
+
+  if (type_marker >= 0xE0) {
+    *cmp_type = CMP_TYPE_NEGATIVE_FIXNUM;
+    return true;
+  }
+
+  switch (type_marker) {
+    case NIL_MARKER:
+      *cmp_type = CMP_TYPE_NIL;
+      return true;
+    case FALSE_MARKER:
+      *cmp_type = CMP_TYPE_BOOLEAN;
+      return true;
+    case TRUE_MARKER:
+      *cmp_type = CMP_TYPE_BOOLEAN;
+      return true;
+    case BIN8_MARKER:
+      *cmp_type = CMP_TYPE_BIN8;
+      return true;
+    case BIN16_MARKER:
+      *cmp_type = CMP_TYPE_BIN16;
+      return true;
+    case BIN32_MARKER:
+      *cmp_type = CMP_TYPE_BIN32;
+      return true;
+    case EXT8_MARKER:
+      *cmp_type = CMP_TYPE_EXT8;
+      return true;
+    case EXT16_MARKER:
+      *cmp_type = CMP_TYPE_EXT16;
+      return true;
+    case EXT32_MARKER:
+      *cmp_type = CMP_TYPE_EXT32;
+      return true;
+    case FLOAT_MARKER:
+      *cmp_type = CMP_TYPE_FLOAT;
+      return true;
+    case DOUBLE_MARKER:
+      *cmp_type = CMP_TYPE_DOUBLE;
+      return true;
+    case U8_MARKER:
+      *cmp_type = CMP_TYPE_UINT8;
+      return true;
+    case U16_MARKER:
+      *cmp_type = CMP_TYPE_UINT16;
+      return true;
+    case U32_MARKER:
+      *cmp_type = CMP_TYPE_UINT32;
+      return true;
+    case U64_MARKER:
+      *cmp_type = CMP_TYPE_UINT64;
+      return true;
+    case S8_MARKER:
+      *cmp_type = CMP_TYPE_SINT8;
+      return true;
+    case S16_MARKER:
+      *cmp_type = CMP_TYPE_SINT16;
+      return true;
+    case S32_MARKER:
+      *cmp_type = CMP_TYPE_SINT32;
+      return true;
+    case S64_MARKER:
+      *cmp_type = CMP_TYPE_SINT64;
+      return true;
+    case FIXEXT1_MARKER:
+      *cmp_type = CMP_TYPE_FIXEXT1;
+      return true;
+    case FIXEXT2_MARKER:
+      *cmp_type = CMP_TYPE_FIXEXT2;
+      return true;
+    case FIXEXT4_MARKER:
+      *cmp_type = CMP_TYPE_FIXEXT4;
+      return true;
+    case FIXEXT8_MARKER:
+      *cmp_type = CMP_TYPE_FIXEXT8;
+      return true;
+    case FIXEXT16_MARKER:
+      *cmp_type = CMP_TYPE_FIXEXT16;
+      return true;
+    case STR8_MARKER:
+      *cmp_type = CMP_TYPE_STR8;
+      return true;
+    case STR16_MARKER:
+      *cmp_type = CMP_TYPE_STR16;
+      return true;
+    case STR32_MARKER:
+      *cmp_type = CMP_TYPE_STR32;
+      return true;
+    case ARRAY16_MARKER:
+      *cmp_type = CMP_TYPE_ARRAY16;
+      return true;
+    case ARRAY32_MARKER:
+      *cmp_type = CMP_TYPE_ARRAY32;
+      return true;
+    case MAP16_MARKER:
+      *cmp_type = CMP_TYPE_MAP16;
+      return true;
+    case MAP32_MARKER:
+      *cmp_type = CMP_TYPE_MAP32;
+      return true;
+    default:
+      return false;
+  }
+}
+
+static bool read_type_size(cmp_ctx_t *ctx, uint8_t type_marker,
+                                           uint8_t cmp_type,
+                                           uint32_t *size) {
+  uint8_t u8temp = 0;
+  uint16_t u16temp = 0;
+  uint32_t u32temp = 0;
+
+  switch (cmp_type) {
+    case CMP_TYPE_POSITIVE_FIXNUM:
+      *size = 0;
+      return true;
+    case CMP_TYPE_FIXMAP:
+      *size = (type_marker & FIXMAP_SIZE);
+      return true;
+    case CMP_TYPE_FIXARRAY:
+      *size = (type_marker & FIXARRAY_SIZE);
+      return true;
+    case CMP_TYPE_FIXSTR:
+      *size = (type_marker & FIXSTR_SIZE);
+      return true;
+    case CMP_TYPE_NIL:
+      *size = 0;
+      return true;
+    case CMP_TYPE_BOOLEAN:
+      *size = 0;
+      return true;
+    case CMP_TYPE_BIN8:
+      if (!ctx->read(ctx, &u8temp, sizeof(uint8_t))) {
+        ctx->error = LENGTH_READING_ERROR;
+        return false;
+      }
+      *size = u8temp;
+      return true;
+    case CMP_TYPE_BIN16:
+      if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
+        ctx->error = LENGTH_READING_ERROR;
+        return false;
+      }
+      *size = be16(u16temp);
+      return true;
+    case CMP_TYPE_BIN32:
+      if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
+        ctx->error = LENGTH_READING_ERROR;
+        return false;
+      }
+      *size = be32(u32temp);
+      return true;
+    case CMP_TYPE_EXT8:
+      if (!ctx->read(ctx, &u8temp, sizeof(uint8_t))) {
+        ctx->error = LENGTH_READING_ERROR;
+        return false;
+      }
+      *size = u8temp;
+      return true;
+    case CMP_TYPE_EXT16:
+      if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
+        ctx->error = LENGTH_READING_ERROR;
+        return false;
+      }
+      *size = be16(u16temp);
+      return true;
+    case CMP_TYPE_EXT32:
+      if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
+        ctx->error = LENGTH_READING_ERROR;
+        return false;
+      }
+      *size = be32(u32temp);
+      return true;
+    case CMP_TYPE_FLOAT:
+      *size = 4;
+      return true;
+    case CMP_TYPE_DOUBLE:
+      *size = 8;
+      return true;
+    case CMP_TYPE_UINT8:
+      *size = 1;
+      return true;
+    case CMP_TYPE_UINT16:
+      *size = 2;
+      return true;
+    case CMP_TYPE_UINT32:
+      *size = 4;
+      return true;
+    case CMP_TYPE_UINT64:
+      *size = 8;
+      return true;
+    case CMP_TYPE_SINT8:
+      *size = 1;
+      return true;
+    case CMP_TYPE_SINT16:
+      *size = 2;
+      return true;
+    case CMP_TYPE_SINT32:
+      *size = 4;
+      return true;
+    case CMP_TYPE_SINT64:
+      *size = 8;
+      return true;
+    case CMP_TYPE_FIXEXT1:
+      *size = 1;
+      return true;
+    case CMP_TYPE_FIXEXT2:
+      *size = 2;
+      return true;
+    case CMP_TYPE_FIXEXT4:
+      *size = 4;
+      return true;
+    case CMP_TYPE_FIXEXT8:
+      *size = 8;
+      return true;
+    case CMP_TYPE_FIXEXT16:
+      *size = 16;
+      return true;
+    case CMP_TYPE_STR8:
+      if (!ctx->read(ctx, &u8temp, sizeof(uint8_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      *size = u8temp;
+      return true;
+    case CMP_TYPE_STR16:
+      if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      *size = be16(u16temp);
+      return true;
+    case CMP_TYPE_STR32:
+      if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      *size = be32(u32temp);
+      return true;
+    case CMP_TYPE_ARRAY16:
+      if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      *size = be16(u16temp);
+      return true;
+    case CMP_TYPE_ARRAY32:
+      if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      *size = be32(u32temp);
+      return true;
+    case CMP_TYPE_MAP16:
+      if (!ctx->read(ctx, &u16temp, sizeof(uint16_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      *size = be16(u16temp);
+      return true;
+    case CMP_TYPE_MAP32:
+      if (!ctx->read(ctx, &u32temp, sizeof(uint32_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      *size = be32(u32temp);
+      return true;
+    case CMP_TYPE_NEGATIVE_FIXNUM:
+      *size = 0;
+      return true;
+    default:
+      ctx->error = INVALID_TYPE_ERROR;
+      return false;
+  }
+}
+
+static bool read_obj_data(cmp_ctx_t *ctx, uint8_t type_marker,
+                                          cmp_object_t *obj) {
+  switch (obj->type) {
+    case CMP_TYPE_POSITIVE_FIXNUM:
+      obj->as.u8 = type_marker;
+      return true;
+    case CMP_TYPE_NEGATIVE_FIXNUM:
+      obj->as.s8 = type_marker;
+      return true;
+    case CMP_TYPE_NIL:
+      obj->as.u8 = 0;
+      return true;
+    case CMP_TYPE_BOOLEAN:
+      switch (type_marker) {
+        case TRUE_MARKER:
+          obj->as.boolean = true;
+          return true;
+        case FALSE_MARKER:
+          obj->as.boolean = false;
+          return true;
+        default:
+          break;
+      }
+      ctx->error = INTERNAL_ERROR;
+      return false;
+    case CMP_TYPE_UINT8:
+      if (!ctx->read(ctx, &obj->as.u8, sizeof(uint8_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      return true;
+    case CMP_TYPE_UINT16:
+      if (!ctx->read(ctx, &obj->as.u16, sizeof(uint16_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.u16 = be16(obj->as.u16);
+      return true;
+    case CMP_TYPE_UINT32:
+      if (!ctx->read(ctx, &obj->as.u32, sizeof(uint32_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.u32 = be32(obj->as.u32);
+      return true;
+    case CMP_TYPE_UINT64:
+      if (!ctx->read(ctx, &obj->as.u64, sizeof(uint64_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.u64 = be64(obj->as.u64);
+      return true;
+    case CMP_TYPE_SINT8:
+      if (!ctx->read(ctx, &obj->as.s8, sizeof(int8_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      return true;
+    case CMP_TYPE_SINT16:
+      if (!ctx->read(ctx, &obj->as.s16, sizeof(int16_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.s16 = be16(obj->as.s16);
+      return true;
+    case CMP_TYPE_SINT32:
+      if (!ctx->read(ctx, &obj->as.s32, sizeof(int32_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.s32 = be32(obj->as.s32);
+      return true;
+    case CMP_TYPE_SINT64:
+      if (!ctx->read(ctx, &obj->as.s64, sizeof(int64_t))) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.s64 = be64(obj->as.s64);
+      return true;
+    case CMP_TYPE_FLOAT:
+    {
+      char bytes[4];
+
+      if (!ctx->read(ctx, bytes, 4)) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.flt = decode_befloat(bytes);
+      return true;
+    }
+    case CMP_TYPE_DOUBLE:
+    {
+      char bytes[8];
+
+      if (!ctx->read(ctx, bytes, 8)) {
+        ctx->error = DATA_READING_ERROR;
+        return false;
+      }
+      obj->as.dbl = decode_bedouble(bytes);
+      return true;
+    }
+    case CMP_TYPE_BIN8:
+    case CMP_TYPE_BIN16:
+    case CMP_TYPE_BIN32:
+      return read_type_size(ctx, type_marker, obj->type, &obj->as.bin_size);
+    case CMP_TYPE_FIXSTR:
+    case CMP_TYPE_STR8:
+    case CMP_TYPE_STR16:
+    case CMP_TYPE_STR32:
+      return read_type_size(ctx, type_marker, obj->type, &obj->as.str_size);
+    case CMP_TYPE_FIXARRAY:
+    case CMP_TYPE_ARRAY16:
+    case CMP_TYPE_ARRAY32:
+      return read_type_size(ctx, type_marker, obj->type, &obj->as.array_size);
+    case CMP_TYPE_FIXMAP:
+    case CMP_TYPE_MAP16:
+    case CMP_TYPE_MAP32:
+      return read_type_size(ctx, type_marker, obj->type, &obj->as.map_size);
+    case CMP_TYPE_FIXEXT1:
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      obj->as.ext.size = 1;
+      return true;
+    case CMP_TYPE_FIXEXT2:
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      obj->as.ext.size = 2;
+      return true;
+    case CMP_TYPE_FIXEXT4:
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      obj->as.ext.size = 4;
+      return true;
+    case CMP_TYPE_FIXEXT8:
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      obj->as.ext.size = 8;
+      return true;
+    case CMP_TYPE_FIXEXT16:
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      obj->as.ext.size = 16;
+      return true;
+    case CMP_TYPE_EXT8:
+      if (!read_type_size(ctx, type_marker, obj->type, &obj->as.ext.size)) {
+        return false;
+      }
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      return true;
+    case CMP_TYPE_EXT16:
+      if (!read_type_size(ctx, type_marker, obj->type, &obj->as.ext.size)) {
+        return false;
+      }
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      obj->as.ext.type = obj->as.ext.type;
+      return true;
+    case CMP_TYPE_EXT32:
+      if (!read_type_size(ctx, type_marker, obj->type, &obj->as.ext.size)) {
+        return false;
+      }
+      if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
+        ctx->error = EXT_TYPE_READING_ERROR;
+        return false;
+      }
+      obj->as.ext.type = obj->as.ext.type;
+      return true;
+    default:
+      break;
   }
 
-  return x;
-}
-
-static bool read_byte(cmp_ctx_t *ctx, uint8_t *x) {
-  return ctx->read(ctx, x, sizeof(uint8_t));
-}
-
-static bool write_byte(cmp_ctx_t *ctx, uint8_t x) {
-  return (ctx->write(ctx, &x, sizeof(uint8_t)) == (sizeof(uint8_t)));
-}
-
-static bool read_type_marker(cmp_ctx_t *ctx, uint8_t *marker) {
-  if (read_byte(ctx, marker))
-    return true;
-
-  ctx->error = TYPE_MARKER_READING_ERROR;
-  return false;
-}
-
-static bool write_type_marker(cmp_ctx_t *ctx, uint8_t marker) {
-  if (write_byte(ctx, marker))
-    return true;
-
-  ctx->error = TYPE_MARKER_WRITING_ERROR;
-  return false;
-}
-
-static bool write_fixed_value(cmp_ctx_t *ctx, uint8_t value) {
-  if (write_byte(ctx, value))
-    return true;
-
-  ctx->error = FIXED_VALUE_WRITING_ERROR;
+  ctx->error = INVALID_TYPE_ERROR;
   return false;
 }
 
-void cmp_init(cmp_ctx_t *ctx, void *buf, cmp_reader read, cmp_writer write) {
+void cmp_init(cmp_ctx_t *ctx, void *buf, cmp_reader read,
+                                         cmp_skipper skip,
+                                         cmp_writer write) {
   ctx->error = ERROR_NONE;
   ctx->buf = buf;
   ctx->read = read;
+  ctx->skip = skip;
   ctx->write = write;
 }
 
@@ -339,13 +839,13 @@ bool cmp_write_integer(cmp_ctx_t *ctx, int64_t d) {
   if (d >= 0)
     return cmp_write_uinteger(ctx, d);
   if (d >= -32)
-    return cmp_write_nfix(ctx, d);
+    return cmp_write_nfix(ctx, (int8_t)d);
   if (d >= -128)
-    return cmp_write_s8(ctx, d);
+    return cmp_write_s8(ctx, (int8_t)d);
   if (d >= -32768)
-    return cmp_write_s16(ctx, d);
+    return cmp_write_s16(ctx, (int16_t)d);
   if (d >= (-2147483647 - 1))
-    return cmp_write_s32(ctx, (int32_t) d);
+    return cmp_write_s32(ctx, (int32_t)d);
 
   return cmp_write_s64(ctx, d);
 }
@@ -390,13 +890,13 @@ bool cmp_write_u64(cmp_ctx_t *ctx, uint64_t l) {
 
 bool cmp_write_uinteger(cmp_ctx_t *ctx, uint64_t u) {
   if (u <= 0x7F)
-    return cmp_write_pfix(ctx, u);
+    return cmp_write_pfix(ctx, (uint8_t)u);
   if (u <= 0xFF)
-    return cmp_write_u8(ctx, u);
+    return cmp_write_u8(ctx, (uint8_t)u);
   if (u <= 0xFFFF)
-    return cmp_write_u16(ctx, u);
+    return cmp_write_u16(ctx, (uint16_t)u);
   if (u <= 0xFFFFFFFF)
-    return cmp_write_u32(ctx, (uint32_t) u);
+    return cmp_write_u32(ctx, (uint32_t)u);
 
   return cmp_write_u64(ctx, u);
 }
@@ -405,7 +905,21 @@ bool cmp_write_float(cmp_ctx_t *ctx, float f) {
   if (!write_type_marker(ctx, FLOAT_MARKER))
     return false;
 
-  f = befloat(f);
+  /*
+   * We may need to swap the float's bytes, but we can't just swap them inside
+   * the float because the swapped bytes may not constitute a valid float.
+   * Therefore, we have to create a buffer and swap the bytes there.
+   */
+  if (!is_bigendian()) {
+    char swapped[sizeof(float)];
+    char *fbuf = (char *)&f;
+    size_t i;
+
+    for (i = 0; i < sizeof(float); i++)
+      swapped[i] = fbuf[sizeof(float) - i - 1];
+
+    return ctx->write(ctx, swapped, sizeof(float));
+  }
 
   return ctx->write(ctx, &f, sizeof(float));
 }
@@ -414,14 +928,24 @@ bool cmp_write_double(cmp_ctx_t *ctx, double d) {
   if (!write_type_marker(ctx, DOUBLE_MARKER))
     return false;
 
-  d = bedouble(d);
+  /* Same deal for doubles */
+  if (!is_bigendian()) {
+    char swapped[sizeof(double)];
+    char *dbuf = (char *)&d;
+    size_t i;
+
+    for (i = 0; i < sizeof(double); i++)
+      swapped[i] = dbuf[sizeof(double) - i - 1];
+
+    return ctx->write(ctx, swapped, sizeof(double));
+  }
 
   return ctx->write(ctx, &d, sizeof(double));
 }
 
 bool cmp_write_decimal(cmp_ctx_t *ctx, double d) {
   float f = (float)d;
-  float df = (double)f;
+  double df = (double)f;
 
   if (df == d)
     return cmp_write_float(ctx, f);
@@ -558,40 +1082,40 @@ bool cmp_write_str32(cmp_ctx_t *ctx, const char *data, uint32_t size) {
 
 bool cmp_write_str_marker(cmp_ctx_t *ctx, uint32_t size) {
   if (size <= FIXSTR_SIZE)
-    return cmp_write_fixstr_marker(ctx, size);
+    return cmp_write_fixstr_marker(ctx, (uint8_t)size);
   if (size <= 0xFF)
-    return cmp_write_str8_marker(ctx, size);
+    return cmp_write_str8_marker(ctx, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_str16_marker(ctx, size);
+    return cmp_write_str16_marker(ctx, (uint16_t)size);
 
   return cmp_write_str32_marker(ctx, size);
 }
 
 bool cmp_write_str_marker_v4(cmp_ctx_t *ctx, uint32_t size) {
   if (size <= FIXSTR_SIZE)
-    return cmp_write_fixstr_marker(ctx, size);
+    return cmp_write_fixstr_marker(ctx, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_str16_marker(ctx, size);
+    return cmp_write_str16_marker(ctx, (uint16_t)size);
 
   return cmp_write_str32_marker(ctx, size);
 }
 
 bool cmp_write_str(cmp_ctx_t *ctx, const char *data, uint32_t size) {
   if (size <= FIXSTR_SIZE)
-    return cmp_write_fixstr(ctx, data, size);
+    return cmp_write_fixstr(ctx, data, (uint8_t)size);
   if (size <= 0xFF)
-    return cmp_write_str8(ctx, data, size);
+    return cmp_write_str8(ctx, data, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_str16(ctx, data, size);
+    return cmp_write_str16(ctx, data, (uint16_t)size);
 
   return cmp_write_str32(ctx, data, size);
 }
 
 bool cmp_write_str_v4(cmp_ctx_t *ctx, const char *data, uint32_t size) {
   if (size <= FIXSTR_SIZE)
-    return cmp_write_fixstr(ctx, data, size);
+    return cmp_write_fixstr(ctx, data, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_str16(ctx, data, size);
+    return cmp_write_str16(ctx, data, (uint16_t)size);
 
   return cmp_write_str32(ctx, data, size);
 }
@@ -677,18 +1201,18 @@ bool cmp_write_bin32(cmp_ctx_t *ctx, const void *data, uint32_t size) {
 
 bool cmp_write_bin_marker(cmp_ctx_t *ctx, uint32_t size) {
   if (size <= 0xFF)
-    return cmp_write_bin8_marker(ctx, size);
+    return cmp_write_bin8_marker(ctx, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_bin16_marker(ctx, size);
+    return cmp_write_bin16_marker(ctx, (uint16_t)size);
 
   return cmp_write_bin32_marker(ctx, size);
 }
 
 bool cmp_write_bin(cmp_ctx_t *ctx, const void *data, uint32_t size) {
   if (size <= 0xFF)
-    return cmp_write_bin8(ctx, data, size);
+    return cmp_write_bin8(ctx, data, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_bin16(ctx, data, size);
+    return cmp_write_bin16(ctx, data, (uint16_t)size);
 
   return cmp_write_bin32(ctx, data, size);
 }
@@ -729,9 +1253,9 @@ bool cmp_write_array32(cmp_ctx_t *ctx, uint32_t size) {
 
 bool cmp_write_array(cmp_ctx_t *ctx, uint32_t size) {
   if (size <= FIXARRAY_SIZE)
-    return cmp_write_fixarray(ctx, size);
+    return cmp_write_fixarray(ctx, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_array16(ctx, size);
+    return cmp_write_array16(ctx, (uint16_t)size);
 
   return cmp_write_array32(ctx, size);
 }
@@ -772,9 +1296,9 @@ bool cmp_write_map32(cmp_ctx_t *ctx, uint32_t size) {
 
 bool cmp_write_map(cmp_ctx_t *ctx, uint32_t size) {
   if (size <= FIXMAP_SIZE)
-    return cmp_write_fixmap(ctx, size);
+    return cmp_write_fixmap(ctx, (uint8_t)size);
   if (size <= 0xFFFF)
-    return cmp_write_map16(ctx, size);
+    return cmp_write_map16(ctx, (uint16_t)size);
 
   return cmp_write_map32(ctx, size);
 }
@@ -986,9 +1510,9 @@ bool cmp_write_ext_marker(cmp_ctx_t *ctx, int8_t tp, uint32_t sz) {
   if (sz == 16)
     return cmp_write_fixext16_marker(ctx, tp);
   if (sz <= 0xFF)
-    return cmp_write_ext8_marker(ctx, tp, sz);
+    return cmp_write_ext8_marker(ctx, tp, (uint8_t)sz);
   if (sz <= 0xFFFF)
-    return cmp_write_ext16_marker(ctx, tp, sz);
+    return cmp_write_ext16_marker(ctx, tp, (uint16_t)sz);
 
   return cmp_write_ext32_marker(ctx, tp, sz);
 }
@@ -1005,9 +1529,9 @@ bool cmp_write_ext(cmp_ctx_t *ctx, int8_t tp, uint32_t sz, const void *data) {
   if (sz == 16)
     return cmp_write_fixext16(ctx, tp, data);
   if (sz <= 0xFF)
-    return cmp_write_ext8(ctx, tp, sz, data);
+    return cmp_write_ext8(ctx, tp, (uint8_t)sz, data);
   if (sz <= 0xFFFF)
-    return cmp_write_ext16(ctx, tp, sz, data);
+    return cmp_write_ext16(ctx, tp, (uint16_t)sz, data);
 
   return cmp_write_ext32(ctx, tp, sz, data);
 }
@@ -1017,11 +1541,11 @@ bool cmp_write_object(cmp_ctx_t *ctx, cmp_object_t *obj) {
     case CMP_TYPE_POSITIVE_FIXNUM:
       return cmp_write_pfix(ctx, obj->as.u8);
     case CMP_TYPE_FIXMAP:
-      return cmp_write_fixmap(ctx, obj->as.map_size);
+      return cmp_write_fixmap(ctx, (uint8_t)obj->as.map_size);
     case CMP_TYPE_FIXARRAY:
-      return cmp_write_fixarray(ctx, obj->as.array_size);
+      return cmp_write_fixarray(ctx, (uint8_t)obj->as.array_size);
     case CMP_TYPE_FIXSTR:
-      return cmp_write_fixstr_marker(ctx, obj->as.str_size);
+      return cmp_write_fixstr_marker(ctx, (uint8_t)obj->as.str_size);
     case CMP_TYPE_NIL:
       return cmp_write_nil(ctx);
     case CMP_TYPE_BOOLEAN:
@@ -1029,15 +1553,19 @@ bool cmp_write_object(cmp_ctx_t *ctx, cmp_object_t *obj) {
         return cmp_write_true(ctx);
       return cmp_write_false(ctx);
     case CMP_TYPE_BIN8:
-      return cmp_write_bin8_marker(ctx, obj->as.bin_size);
+      return cmp_write_bin8_marker(ctx, (uint8_t)obj->as.bin_size);
     case CMP_TYPE_BIN16:
-      return cmp_write_bin16_marker(ctx, obj->as.bin_size);
+      return cmp_write_bin16_marker(ctx, (uint16_t)obj->as.bin_size);
     case CMP_TYPE_BIN32:
       return cmp_write_bin32_marker(ctx, obj->as.bin_size);
     case CMP_TYPE_EXT8:
-      return cmp_write_ext8_marker(ctx, obj->as.ext.type, obj->as.ext.size);
+      return cmp_write_ext8_marker(
+        ctx, obj->as.ext.type, (uint8_t)obj->as.ext.size
+      );
     case CMP_TYPE_EXT16:
-      return cmp_write_ext16_marker(ctx, obj->as.ext.type, obj->as.ext.size);
+      return cmp_write_ext16_marker(
+        ctx, obj->as.ext.type, (uint16_t)obj->as.ext.size
+      );
     case CMP_TYPE_EXT32:
       return cmp_write_ext32_marker(ctx, obj->as.ext.type, obj->as.ext.size);
     case CMP_TYPE_FLOAT:
@@ -1071,17 +1599,17 @@ bool cmp_write_object(cmp_ctx_t *ctx, cmp_object_t *obj) {
     case CMP_TYPE_FIXEXT16:
       return cmp_write_fixext16_marker(ctx, obj->as.ext.type);
     case CMP_TYPE_STR8:
-      return cmp_write_str8_marker(ctx, obj->as.str_size);
+      return cmp_write_str8_marker(ctx, (uint8_t)obj->as.str_size);
     case CMP_TYPE_STR16:
-      return cmp_write_str16_marker(ctx, obj->as.str_size);
+      return cmp_write_str16_marker(ctx, (uint16_t)obj->as.str_size);
     case CMP_TYPE_STR32:
       return cmp_write_str32_marker(ctx, obj->as.str_size);
     case CMP_TYPE_ARRAY16:
-      return cmp_write_array16(ctx, obj->as.array_size);
+      return cmp_write_array16(ctx, (uint16_t)obj->as.array_size);
     case CMP_TYPE_ARRAY32:
       return cmp_write_array32(ctx, obj->as.array_size);
     case CMP_TYPE_MAP16:
-      return cmp_write_map16(ctx, obj->as.map_size);
+      return cmp_write_map16(ctx, (uint16_t)obj->as.map_size);
     case CMP_TYPE_MAP32:
       return cmp_write_map32(ctx, obj->as.map_size);
     case CMP_TYPE_NEGATIVE_FIXNUM:
@@ -1097,27 +1625,23 @@ bool cmp_write_object_v4(cmp_ctx_t *ctx, cmp_object_t *obj) {
     case CMP_TYPE_POSITIVE_FIXNUM:
       return cmp_write_pfix(ctx, obj->as.u8);
     case CMP_TYPE_FIXMAP:
-      return cmp_write_fixmap(ctx, obj->as.map_size);
+      return cmp_write_fixmap(ctx, (uint8_t)obj->as.map_size);
     case CMP_TYPE_FIXARRAY:
-      return cmp_write_fixarray(ctx, obj->as.array_size);
+      return cmp_write_fixarray(ctx, (uint8_t)obj->as.array_size);
     case CMP_TYPE_FIXSTR:
-      return cmp_write_fixstr_marker(ctx, obj->as.str_size);
+      return cmp_write_fixstr_marker(ctx, (uint8_t)obj->as.str_size);
     case CMP_TYPE_NIL:
       return cmp_write_nil(ctx);
     case CMP_TYPE_BOOLEAN:
       if (obj->as.boolean)
         return cmp_write_true(ctx);
       return cmp_write_false(ctx);
-    case CMP_TYPE_BIN8:
-      return cmp_write_bin8_marker(ctx, obj->as.bin_size);
-    case CMP_TYPE_BIN16:
-      return cmp_write_bin16_marker(ctx, obj->as.bin_size);
-    case CMP_TYPE_BIN32:
-      return cmp_write_bin32_marker(ctx, obj->as.bin_size);
     case CMP_TYPE_EXT8:
-      return cmp_write_ext8_marker(ctx, obj->as.ext.type, obj->as.ext.size);
+      return cmp_write_ext8_marker(ctx, obj->as.ext.type, (uint8_t)obj->as.ext.size);
     case CMP_TYPE_EXT16:
-      return cmp_write_ext16_marker(ctx, obj->as.ext.type, obj->as.ext.size);
+      return cmp_write_ext16_marker(
+        ctx, obj->as.ext.type, (uint16_t)obj->as.ext.size
+      );
     case CMP_TYPE_EXT32:
       return cmp_write_ext32_marker(ctx, obj->as.ext.type, obj->as.ext.size);
     case CMP_TYPE_FLOAT:
@@ -1151,15 +1675,15 @@ bool cmp_write_object_v4(cmp_ctx_t *ctx, cmp_object_t *obj) {
     case CMP_TYPE_FIXEXT16:
       return cmp_write_fixext16_marker(ctx, obj->as.ext.type);
     case CMP_TYPE_STR16:
-      return cmp_write_str16_marker(ctx, obj->as.str_size);
+      return cmp_write_str16_marker(ctx, (uint16_t)obj->as.str_size);
     case CMP_TYPE_STR32:
       return cmp_write_str32_marker(ctx, obj->as.str_size);
     case CMP_TYPE_ARRAY16:
-      return cmp_write_array16(ctx, obj->as.array_size);
+      return cmp_write_array16(ctx, (uint16_t)obj->as.array_size);
     case CMP_TYPE_ARRAY32:
       return cmp_write_array32(ctx, obj->as.array_size);
     case CMP_TYPE_MAP16:
-      return cmp_write_map16(ctx, obj->as.map_size);
+      return cmp_write_map16(ctx, (uint16_t)obj->as.map_size);
     case CMP_TYPE_MAP32:
       return cmp_write_map32(ctx, obj->as.map_size);
     case CMP_TYPE_NEGATIVE_FIXNUM:
@@ -1294,10 +1818,13 @@ bool cmp_read_char(cmp_ctx_t *ctx, int8_t *c) {
         *c = obj.as.u8;
         return true;
       }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_short(cmp_ctx_t *ctx, int16_t *s) {
@@ -1323,10 +1850,13 @@ bool cmp_read_short(cmp_ctx_t *ctx, int16_t *s) {
         *s = obj.as.u16;
         return true;
       }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_int(cmp_ctx_t *ctx, int32_t *i) {
@@ -1358,10 +1888,13 @@ bool cmp_read_int(cmp_ctx_t *ctx, int32_t *i) {
         *i = obj.as.u32;
         return true;
       }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_long(cmp_ctx_t *ctx, int64_t *d) {
@@ -1399,10 +1932,13 @@ bool cmp_read_long(cmp_ctx_t *ctx, int64_t *d) {
         *d = obj.as.u64;
         return true;
       }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_integer(cmp_ctx_t *ctx, int64_t *d) {
@@ -1484,10 +2020,19 @@ bool cmp_read_uchar(cmp_ctx_t *ctx, uint8_t *c) {
     case CMP_TYPE_UINT8:
       *c = obj.as.u8;
       return true;
+    case CMP_TYPE_NEGATIVE_FIXNUM:
+    case CMP_TYPE_SINT8:
+      if (obj.as.s8 >= 0) {
+        *c = obj.as.s8;
+        return true;
+      }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_ushort(cmp_ctx_t *ctx, uint16_t *s) {
@@ -1504,10 +2049,25 @@ bool cmp_read_ushort(cmp_ctx_t *ctx, uint16_t *s) {
     case CMP_TYPE_UINT16:
       *s = obj.as.u16;
       return true;
+    case CMP_TYPE_NEGATIVE_FIXNUM:
+    case CMP_TYPE_SINT8:
+      if (obj.as.s8 >= 0) {
+        *s = obj.as.s8;
+        return true;
+      }
+      break;
+    case CMP_TYPE_SINT16:
+      if (obj.as.s16 >= 0) {
+        *s = obj.as.s16;
+        return true;
+      }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_uint(cmp_ctx_t *ctx, uint32_t *i) {
@@ -1527,10 +2087,31 @@ bool cmp_read_uint(cmp_ctx_t *ctx, uint32_t *i) {
     case CMP_TYPE_UINT32:
       *i = obj.as.u32;
       return true;
+    case CMP_TYPE_NEGATIVE_FIXNUM:
+    case CMP_TYPE_SINT8:
+      if (obj.as.s8 >= 0) {
+        *i = obj.as.s8;
+        return true;
+      }
+      break;
+    case CMP_TYPE_SINT16:
+      if (obj.as.s16 >= 0) {
+        *i = obj.as.s16;
+        return true;
+      }
+      break;
+    case CMP_TYPE_SINT32:
+      if (obj.as.s32 >= 0) {
+        *i = obj.as.s32;
+        return true;
+      }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_ulong(cmp_ctx_t *ctx, uint64_t *u) {
@@ -1553,10 +2134,37 @@ bool cmp_read_ulong(cmp_ctx_t *ctx, uint64_t *u) {
     case CMP_TYPE_UINT64:
       *u = obj.as.u64;
       return true;
+    case CMP_TYPE_NEGATIVE_FIXNUM:
+    case CMP_TYPE_SINT8:
+      if (obj.as.s8 >= 0) {
+        *u = obj.as.s8;
+        return true;
+      }
+      break;
+    case CMP_TYPE_SINT16:
+      if (obj.as.s16 >= 0) {
+        *u = obj.as.s16;
+        return true;
+      }
+      break;
+    case CMP_TYPE_SINT32:
+      if (obj.as.s32 >= 0) {
+        *u = obj.as.s32;
+        return true;
+      }
+      break;
+    case CMP_TYPE_SINT64:
+      if (obj.as.s64 >= 0) {
+        *u = obj.as.s64;
+        return true;
+      }
+      break;
     default:
-      ctx->error = INVALID_TYPE_ERROR;
-      return false;
+      break;
   }
+
+  ctx->error = INVALID_TYPE_ERROR;
+  return false;
 }
 
 bool cmp_read_uinteger(cmp_ctx_t *ctx, uint64_t *d) {
@@ -1923,7 +2531,7 @@ bool cmp_read_ext8_marker(cmp_ctx_t *ctx, int8_t *type, uint8_t *size) {
   }
 
   *type = obj.as.ext.type;
-  *size = obj.as.ext.size;
+  *size = (uint8_t)obj.as.ext.size;
 
   return true;
 }
@@ -1951,7 +2559,7 @@ bool cmp_read_ext16_marker(cmp_ctx_t *ctx, int8_t *type, uint16_t *size) {
   }
 
   *type = obj.as.ext.type;
-  *size = obj.as.ext.size;
+  *size = (uint16_t)obj.as.ext.size;
 
   return true;
 }
@@ -2036,287 +2644,180 @@ bool cmp_read_object(cmp_ctx_t *ctx, cmp_object_t *obj) {
   if (!read_type_marker(ctx, &type_marker))
     return false;
 
-  if (type_marker <= 0x7F) {
-    obj->type = CMP_TYPE_POSITIVE_FIXNUM;
-    obj->as.u8 = type_marker;
-  }
-  else if (type_marker <= 0x8F) {
-    obj->type = CMP_TYPE_FIXMAP;
-    obj->as.map_size = type_marker & FIXMAP_SIZE;
-  }
-  else if (type_marker <= 0x9F) {
-    obj->type = CMP_TYPE_FIXARRAY;
-    obj->as.array_size = type_marker & FIXARRAY_SIZE;
-  }
-  else if (type_marker <= 0xBF) {
-    obj->type = CMP_TYPE_FIXSTR;
-    obj->as.str_size = type_marker & FIXSTR_SIZE;
-  }
-  else if (type_marker == NIL_MARKER) {
-    obj->type = CMP_TYPE_NIL;
-    obj->as.u8 = 0;
-  }
-  else if (type_marker == FALSE_MARKER) {
-    obj->type = CMP_TYPE_BOOLEAN;
-    obj->as.boolean = false;
-  }
-  else if (type_marker == TRUE_MARKER) {
-    obj->type = CMP_TYPE_BOOLEAN;
-    obj->as.boolean = true;
-  }
-  else if (type_marker == BIN8_MARKER) {
-    obj->type = CMP_TYPE_BIN8;
-    if (!ctx->read(ctx, &obj->as.u8, sizeof(uint8_t))) {
-      ctx->error = LENGTH_READING_ERROR;
-      return false;
-    }
-    obj->as.bin_size = obj->as.u8;
-  }
-  else if (type_marker == BIN16_MARKER) {
-    obj->type = CMP_TYPE_BIN16;
-    if (!ctx->read(ctx, &obj->as.u16, sizeof(uint16_t))) {
-      ctx->error = LENGTH_READING_ERROR;
-      return false;
-    }
-    obj->as.bin_size = be16(obj->as.u16);
-  }
-  else if (type_marker == BIN32_MARKER) {
-    obj->type = CMP_TYPE_BIN32;
-    if (!ctx->read(ctx, &obj->as.u32, sizeof(uint32_t))) {
-      ctx->error = LENGTH_READING_ERROR;
-      return false;
-    }
-    obj->as.bin_size = be32(obj->as.u32);
+  if (!type_marker_to_cmp_type(type_marker, &obj->type)) {
+    ctx->error = INVALID_TYPE_ERROR;
+    return false;
   }
-  else if (type_marker == EXT8_MARKER) {
-    uint8_t ext_size;
-    int8_t ext_type;
 
-    obj->type = CMP_TYPE_EXT8;
-    if (!ctx->read(ctx, &ext_size, sizeof(uint8_t))) {
-      ctx->error = LENGTH_READING_ERROR;
-      return false;
-    }
-    if (!ctx->read(ctx, &ext_type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
-      return false;
-    }
-    obj->as.ext.size = ext_size;
-    obj->as.ext.type = ext_type;
-  }
-  else if (type_marker == EXT16_MARKER) {
-    int8_t ext_type;
-    uint16_t ext_size;
+  return read_obj_data(ctx, type_marker, obj);
+}
 
-    obj->type = CMP_TYPE_EXT16;
-    if (!ctx->read(ctx, &ext_size, sizeof(uint16_t))) {
-      ctx->error = LENGTH_READING_ERROR;
-      return false;
-    }
-    if (!ctx->read(ctx, &ext_type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
-      return false;
-    }
-    obj->as.ext.size = be16(ext_size);
-    obj->as.ext.type = ext_type;
-  }
-  else if (type_marker == EXT32_MARKER) {
-    int8_t ext_type;
-    uint32_t ext_size;
+bool cmp_skip_object(cmp_ctx_t *ctx, cmp_object_t *obj) {
+  return cmp_skip_object_limit(ctx, obj, 0);
+}
 
-    obj->type = CMP_TYPE_EXT32;
-    if (!ctx->read(ctx, &ext_size, sizeof(uint32_t))) {
-      ctx->error = LENGTH_READING_ERROR;
-      return false;
-    }
-    if (!ctx->read(ctx, &ext_type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
-      return false;
-    }
-    obj->as.ext.size = be32(ext_size);
-    obj->as.ext.type = ext_type;
-  }
-  else if (type_marker == FLOAT_MARKER) {
-    obj->type = CMP_TYPE_FLOAT;
-    if (!ctx->read(ctx, &obj->as.flt, sizeof(float))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.flt = befloat(obj->as.flt);
-  }
-  else if (type_marker == DOUBLE_MARKER) {
-    obj->type = CMP_TYPE_DOUBLE;
-    if (!ctx->read(ctx, &obj->as.dbl, sizeof(double))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.dbl = bedouble(obj->as.dbl);
-  }
-  else if (type_marker == U8_MARKER) {
-    obj->type = CMP_TYPE_UINT8;
-    if (!ctx->read(ctx, &obj->as.u8, sizeof(uint8_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-  }
-  else if (type_marker == U16_MARKER) {
-    obj->type = CMP_TYPE_UINT16;
-    if (!ctx->read(ctx, &obj->as.u16, sizeof(uint16_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.u16 = be16(obj->as.u16);
-  }
-  else if (type_marker == U32_MARKER) {
-    obj->type = CMP_TYPE_UINT32;
-    if (!ctx->read(ctx, &obj->as.u32, sizeof(uint32_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.u32 = be32(obj->as.u32);
-  }
-  else if (type_marker == U64_MARKER) {
-    obj->type = CMP_TYPE_UINT64;
-    if (!ctx->read(ctx, &obj->as.u64, sizeof(uint64_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.u64 = be64(obj->as.u64);
-  }
-  else if (type_marker == S8_MARKER) {
-    obj->type = CMP_TYPE_SINT8;
-    if (!ctx->read(ctx, &obj->as.s8, sizeof(int8_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-  }
-  else if (type_marker == S16_MARKER) {
-    obj->type = CMP_TYPE_SINT16;
-    if (!ctx->read(ctx, &obj->as.s16, sizeof(int16_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.s16 = be16(obj->as.s16);
-  }
-  else if (type_marker == S32_MARKER) {
-    obj->type = CMP_TYPE_SINT32;
-    if (!ctx->read(ctx, &obj->as.s32, sizeof(int32_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.s32 = be32(obj->as.s32);
-  }
-  else if (type_marker == S64_MARKER) {
-    obj->type = CMP_TYPE_SINT64;
-    if (!ctx->read(ctx, &obj->as.s64, sizeof(int64_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
-    }
-    obj->as.s64 = be64(obj->as.s64);
-  }
-  else if (type_marker == FIXEXT1_MARKER) {
-    obj->type = CMP_TYPE_FIXEXT1;
-    if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
-      return false;
-    }
-    obj->as.ext.size = 1;
-  }
-  else if (type_marker == FIXEXT2_MARKER) {
-    obj->type = CMP_TYPE_FIXEXT2;
-    if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
-      return false;
-    }
-    obj->as.ext.size = 2;
-  }
-  else if (type_marker == FIXEXT4_MARKER) {
-    obj->type = CMP_TYPE_FIXEXT4;
-    if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
-      return false;
-    }
-    obj->as.ext.size = 4;
-  }
-  else if (type_marker == FIXEXT8_MARKER) {
-    obj->type = CMP_TYPE_FIXEXT8;
-    if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
-      return false;
-    }
-    obj->as.ext.size = 8;
-  }
-  else if (type_marker == FIXEXT16_MARKER) {
-    obj->type = CMP_TYPE_FIXEXT16;
-    if (!ctx->read(ctx, &obj->as.ext.type, sizeof(int8_t))) {
-      ctx->error = EXT_TYPE_READING_ERROR;
+bool cmp_skip_object_limit(cmp_ctx_t *ctx, cmp_object_t *obj, uint32_t limit) {
+  size_t element_count = 1;
+  uint32_t depth = 0;
+
+  while (element_count) {
+    uint8_t type_marker = 0;
+    uint8_t cmp_type;
+    uint32_t size = 0;
+
+    if (!read_type_marker(ctx, &type_marker)) {
       return false;
     }
-    obj->as.ext.size = 16;
-  }
-  else if (type_marker == STR8_MARKER) {
-    obj->type = CMP_TYPE_STR8;
-    if (!ctx->read(ctx, &obj->as.u8, sizeof(uint8_t))) {
-      ctx->error = DATA_READING_ERROR;
+
+    if (!type_marker_to_cmp_type(type_marker, &cmp_type)) {
+      ctx->error = INVALID_TYPE_ERROR;
       return false;
     }
-    obj->as.str_size = obj->as.u8;
-  }
-  else if (type_marker == STR16_MARKER) {
-    obj->type = CMP_TYPE_STR16;
-    if (!ctx->read(ctx, &obj->as.u16, sizeof(uint16_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
+
+    switch (cmp_type) {
+      case CMP_TYPE_FIXARRAY:
+      case CMP_TYPE_ARRAY16:
+      case CMP_TYPE_ARRAY32:
+      case CMP_TYPE_FIXMAP:
+      case CMP_TYPE_MAP16:
+      case CMP_TYPE_MAP32:
+        depth++;
+
+        if (depth > limit) {
+          obj->type = cmp_type;
+
+          if (!read_obj_data(ctx, type_marker, obj)) {
+            return false;
+          }
+
+          ctx->error = SKIP_DEPTH_LIMIT_EXCEEDED_ERROR;
+
+          return false;
+        }
+
+        break;
+      default:
+        if (!read_type_size(ctx, type_marker, cmp_type, &size)) {
+          return false;
+        }
+
+        if (size) {
+          switch (cmp_type) {
+            case CMP_TYPE_FIXEXT1:
+            case CMP_TYPE_FIXEXT2:
+            case CMP_TYPE_FIXEXT4:
+            case CMP_TYPE_FIXEXT8:
+            case CMP_TYPE_FIXEXT16:
+            case CMP_TYPE_EXT8:
+            case CMP_TYPE_EXT16:
+            case CMP_TYPE_EXT32:
+              size++;
+            default:
+              break;
+          }
+
+          skip_bytes(ctx, size);
+        }
     }
-    obj->as.str_size = be16(obj->as.u16);
-  }
-  else if (type_marker == STR32_MARKER) {
-    obj->type = CMP_TYPE_STR32;
-    if (!ctx->read(ctx, &obj->as.u32, sizeof(uint32_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
+
+    element_count--;
+
+    switch (cmp_type) {
+      case CMP_TYPE_FIXARRAY:
+      case CMP_TYPE_ARRAY16:
+      case CMP_TYPE_ARRAY32:
+        if (!read_type_size(ctx, type_marker, cmp_type, &size)) {
+          return false;
+        }
+        element_count += size;
+        break;
+      case CMP_TYPE_FIXMAP:
+      case CMP_TYPE_MAP16:
+      case CMP_TYPE_MAP32:
+        if (!read_type_size(ctx, type_marker, cmp_type, &size)) {
+          return false;
+        }
+        element_count += ((size_t)size) * 2;
+        break;
+      default:
+        break;
     }
-    obj->as.str_size = be32(obj->as.u32);
   }
-  else if (type_marker == ARRAY16_MARKER) {
-    obj->type = CMP_TYPE_ARRAY16;
-    if (!ctx->read(ctx, &obj->as.u16, sizeof(uint16_t))) {
-      ctx->error = DATA_READING_ERROR;
+
+  return true;
+}
+
+bool cmp_skip_object_no_limit(cmp_ctx_t *ctx) {
+  size_t element_count = 1;
+
+  while (element_count) {
+    uint8_t type_marker = 0;
+    uint8_t cmp_type = 0;
+    uint32_t size = 0;
+
+    if (!read_type_marker(ctx, &type_marker)) {
       return false;
     }
-    obj->as.array_size = be16(obj->as.u16);
-  }
-  else if (type_marker == ARRAY32_MARKER) {
-    obj->type = CMP_TYPE_ARRAY32;
-    if (!ctx->read(ctx, &obj->as.u32, sizeof(uint32_t))) {
-      ctx->error = DATA_READING_ERROR;
+
+    if (!type_marker_to_cmp_type(type_marker, &cmp_type)) {
+      ctx->error = INVALID_TYPE_ERROR;
       return false;
     }
-    obj->as.array_size = be32(obj->as.u32);
-  }
-  else if (type_marker == MAP16_MARKER) {
-    obj->type = CMP_TYPE_MAP16;
-    if (!ctx->read(ctx, &obj->as.u16, sizeof(uint16_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
+
+    switch (cmp_type) {
+      case CMP_TYPE_FIXARRAY:
+      case CMP_TYPE_ARRAY16:
+      case CMP_TYPE_ARRAY32:
+      case CMP_TYPE_FIXMAP:
+      case CMP_TYPE_MAP16:
+      case CMP_TYPE_MAP32:
+        break;
+      default:
+        if (!read_type_size(ctx, type_marker, cmp_type, &size)) {
+          return false;
+        }
+
+        if (size) {
+          switch (cmp_type) {
+            case CMP_TYPE_FIXEXT1:
+            case CMP_TYPE_FIXEXT2:
+            case CMP_TYPE_FIXEXT4:
+            case CMP_TYPE_FIXEXT8:
+            case CMP_TYPE_FIXEXT16:
+            case CMP_TYPE_EXT8:
+            case CMP_TYPE_EXT16:
+            case CMP_TYPE_EXT32:
+              size++;
+            default:
+              break;
+          }
+
+          skip_bytes(ctx, size);
+        }
     }
-    obj->as.map_size = be16(obj->as.u16);
-  }
-  else if (type_marker == MAP32_MARKER) {
-    obj->type = CMP_TYPE_MAP32;
-    if (!ctx->read(ctx, &obj->as.u32, sizeof(uint32_t))) {
-      ctx->error = DATA_READING_ERROR;
-      return false;
+
+    element_count--;
+
+    switch (cmp_type) {
+      case CMP_TYPE_FIXARRAY:
+      case CMP_TYPE_ARRAY16:
+      case CMP_TYPE_ARRAY32:
+        if (!read_type_size(ctx, type_marker, cmp_type, &size)) {
+          return false;
+        }
+        element_count += size;
+        break;
+      case CMP_TYPE_FIXMAP:
+      case CMP_TYPE_MAP16:
+      case CMP_TYPE_MAP32:
+        if (!read_type_size(ctx, type_marker, cmp_type, &size)) {
+          return false;
+        }
+        element_count += ((size_t)size) * 2;
+        break;
+      default:
+        break;
     }
-    obj->as.map_size = be32(obj->as.u32);
-  }
-  else if (type_marker >= NEGATIVE_FIXNUM_MARKER) {
-    obj->type = CMP_TYPE_NEGATIVE_FIXNUM;
-    obj->as.s8 = type_marker;
-  }
-  else {
-    ctx->error = INVALID_TYPE_ERROR;
-    return false;
   }
 
   return true;
@@ -2524,6 +3025,9 @@ bool cmp_object_as_char(cmp_object_t *obj, int8_t *c) {
         *c = obj->as.s8;
         return true;
       }
+      else {
+        return false;
+      }
     default:
         return false;
   }
@@ -2547,6 +3051,9 @@ bool cmp_object_as_short(cmp_object_t *obj, int16_t *s) {
         *s = obj->as.u16;
         return true;
       }
+      else {
+        return false;
+      }
     default:
         return false;
   }
@@ -2576,6 +3083,9 @@ bool cmp_object_as_int(cmp_object_t *obj, int32_t *i) {
         *i = obj->as.u32;
         return true;
       }
+      else {
+        return false;
+      }
     default:
         return false;
   }
@@ -2611,6 +3121,9 @@ bool cmp_object_as_long(cmp_object_t *obj, int64_t *d) {
         *d = obj->as.u64;
         return true;
       }
+      else {
+        return false;
+      }
     default:
         return false;
   }
@@ -2784,9 +3297,11 @@ bool cmp_object_as_ext(cmp_object_t *obj, int8_t *type, uint32_t *size) {
   }
 }
 
-bool cmp_object_to_str(cmp_ctx_t *ctx, cmp_object_t *obj, char *data, uint32_t buf_size) {
+bool cmp_object_to_str(cmp_ctx_t *ctx, cmp_object_t *obj, char *data,
+                                                          uint32_t buf_size) {
   uint32_t str_size = 0;
-   switch (obj->type) {
+
+  switch (obj->type) {
     case CMP_TYPE_FIXSTR:
     case CMP_TYPE_STR8:
     case CMP_TYPE_STR16:
@@ -2806,12 +3321,14 @@ bool cmp_object_to_str(cmp_ctx_t *ctx, cmp_object_t *obj, char *data, uint32_t b
       return true;
     default:
       return false;
-   }
+  }
 }
 
-bool cmp_object_to_bin(cmp_ctx_t *ctx, cmp_object_t *obj, void *data, uint32_t buf_size) {
+bool cmp_object_to_bin(cmp_ctx_t *ctx, cmp_object_t *obj, void *data,
+                                                          uint32_t buf_size) {
   uint32_t bin_size = 0;
-   switch (obj->type) {
+
+  switch (obj->type) {
     case CMP_TYPE_BIN8:
     case CMP_TYPE_BIN16:
     case CMP_TYPE_BIN32:
@@ -2828,7 +3345,7 @@ bool cmp_object_to_bin(cmp_ctx_t *ctx, cmp_object_t *obj, void *data, uint32_t b
       return true;
     default:
       return false;
-   }
+  }
 }
 
 /* vi: set et ts=2 sw=2: */
diff --git a/debian/modules/nchan/src/store/redis/cmp.h b/debian/modules/nchan/src/store/redis/cmp.h
index 8397588b..c78b37be 100644
--- a/debian/modules/nchan/src/store/redis/cmp.h
+++ b/debian/modules/nchan/src/store/redis/cmp.h
@@ -1,7 +1,7 @@
 /*
 The MIT License (MIT)
 
-Copyright (c) 2015 Charles Gunyon
+Copyright (c) 2017 Charles Gunyon
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -28,6 +28,7 @@ THE SOFTWARE.
 struct cmp_ctx_s;
 
 typedef bool   (*cmp_reader)(struct cmp_ctx_s *ctx, void *data, size_t limit);
+typedef bool   (*cmp_skipper)(struct cmp_ctx_s *ctx, size_t count);
 typedef size_t (*cmp_writer)(struct cmp_ctx_s *ctx, const void *data,
                                                     size_t count);
 
@@ -94,10 +95,11 @@ union cmp_object_data_u {
 };
 
 typedef struct cmp_ctx_s {
-  uint8_t     error;
-  void       *buf;
-  cmp_reader  read;
-  cmp_writer  write;
+  uint8_t      error;
+  void        *buf;
+  cmp_reader   read;
+  cmp_skipper  skip;
+  cmp_writer   write;
 } cmp_ctx_t;
 
 typedef struct cmp_object_s {
@@ -115,8 +117,20 @@ extern "C" {
  * ============================================================================
  */
 
-/* Initializes a CMP context */
-void cmp_init(cmp_ctx_t *ctx, void *buf, cmp_reader read, cmp_writer write);
+/*
+ * Initializes a CMP context
+ *
+ * If you don't intend to read, `read` may be NULL, but calling `*read*`
+ * functions will crash; there is no check.
+ *
+ * `skip` may be NULL, in which case skipping functions will use `read`.
+ *
+ * If you don't intend to write, `write` may be NULL, but calling `*write*`
+ * functions will crash; there is no check.
+ */
+void cmp_init(cmp_ctx_t *ctx, void *buf, cmp_reader read,
+                                         cmp_skipper skip,
+                                         cmp_writer write);
 
 /* Returns CMP's version */
 uint32_t cmp_version(void);
@@ -299,6 +313,44 @@ bool cmp_read_ext(cmp_ctx_t *ctx, int8_t *type, uint32_t *size, void *data);
 /* Reads an object from the backend */
 bool cmp_read_object(cmp_ctx_t *ctx, cmp_object_t *obj);
 
+/*
+ * Skips the next object from the backend.  If that object is an array or map,
+ * this function will:
+ *   - If `obj` is not `NULL`, fill in `obj` with that object
+ *   - Set `ctx->error` to `SKIP_DEPTH_LIMIT_EXCEEDED_ERROR`
+ *   - Return `false`
+ * Otherwise:
+ *   - (Don't touch `obj`)
+ *   - Return `true`
+ */
+bool cmp_skip_object(cmp_ctx_t *ctx, cmp_object_t *obj);
+
+/*
+ * This is similar to `cmp_skip_object`, except it tolerates up to `limit`
+ * levels of nesting.  For example, in order to skip an array that contains a
+ * map, call `cmp_skip_object_limit(ctx, &obj, 2)`.  Or in other words,
+ * `cmp_skip_object(ctx, &obj)` acts similarly to `cmp_skip_object_limit(ctx,
+ * &obj, 0)`
+ *
+ * Specifically, `limit` refers to depth, not breadth.  So in order to skip an
+ * array that contains two arrays that each contain 3 strings, you would call
+ * `cmp_skip_object_limit(ctx, &obj, 2).  In order to skip an array that
+ * contains 4 arrays that each contain 1 string, you would still call
+ * `cmp_skip_object_limit(ctx, &obj, 2).
+ */
+bool cmp_skip_object_limit(cmp_ctx_t *ctx, cmp_object_t *obj, uint32_t limit);
+
+/*
+ * This is similar to `cmp_skip_object`, except it will continually skip
+ * nested data structures.
+ *
+ * WARNING: This can cause your application to spend an unbounded amount of
+ *          time reading nested data structures.  Unless you completely trust
+ *          the data source, you should strongly consider `cmp_skip_object` or
+ *          `cmp_skip_object_limit`.
+ */
+bool cmp_skip_object_no_limit(cmp_ctx_t *ctx);
+
 /*
  * ============================================================================
  * === Specific API
diff --git a/debian/modules/nchan/src/store/redis/hiredis/.gitignore b/debian/modules/nchan/src/store/redis/hiredis/.gitignore
new file mode 100644
index 00000000..c44b5c53
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/.gitignore
@@ -0,0 +1,7 @@
+/hiredis-test
+/examples/hiredis-example*
+/*.o
+/*.so
+/*.dylib
+/*.a
+/*.pc
diff --git a/debian/modules/nchan/src/store/redis/hiredis/.travis.yml b/debian/modules/nchan/src/store/redis/hiredis/.travis.yml
new file mode 100644
index 00000000..1e1ce300
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/.travis.yml
@@ -0,0 +1,24 @@
+language: c
+sudo: false
+compiler:
+  - gcc
+  - clang
+
+addons:
+  apt:
+    packages:
+    - libc6-dbg
+    - libc6-dev
+    - libc6:i386
+    - libc6-dev-i386
+    - libc6-dbg:i386
+    - gcc-multilib
+    - valgrind
+
+env:
+    - CFLAGS="-Werror"
+    - PRE="valgrind --track-origins=yes --leak-check=full"
+    - TARGET="32bit" TARGET_VARS="32bit-vars" CFLAGS="-Werror"
+    - TARGET="32bit" TARGET_VARS="32bit-vars" PRE="valgrind --track-origins=yes --leak-check=full"
+
+script: make $TARGET CFLAGS="$CFLAGS" && make check PRE="$PRE" && make $TARGET_VARS hiredis-example
diff --git a/debian/modules/nchan/src/store/redis/hiredis/CHANGELOG.md b/debian/modules/nchan/src/store/redis/hiredis/CHANGELOG.md
new file mode 100644
index 00000000..a5015c5d
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/CHANGELOG.md
@@ -0,0 +1,110 @@
+### 0.13.3 (2015-09-16)
+
+* Revert "Clear `REDIS_CONNECTED` flag when connection is closed".
+* Make tests pass on FreeBSD (Thanks, Giacomo Olgeni)
+
+
+If the `REDIS_CONNECTED` flag is cleared,
+the async onDisconnect callback function will never be called.
+This causes problems as the disconnect is never reported back to the user.
+
+### 0.13.2 (2015-08-25)
+
+* Prevent crash on pending replies in async code (Thanks, @switch-st)
+* Clear `REDIS_CONNECTED` flag when connection is closed (Thanks, Jerry Jacobs)
+* Add MacOS X addapter (Thanks, @dizzus)
+* Add Qt adapter (Thanks, Pietro Cerutti)
+* Add Ivykis adapter (Thanks, Gergely Nagy)
+
+All adapters are provided as is and are only tested where possible.
+
+### 0.13.1 (2015-05-03)
+
+This is a bug fix release.
+The new `reconnect` method introduced new struct members, which clashed with pre-defined names in pre-C99 code.
+Another commit forced C99 compilation just to make it work, but of course this is not desirable for outside projects.
+Other non-C99 code can now use hiredis as usual again.
+Sorry for the inconvenience.
+
+* Fix memory leak in async reply handling (Salvatore Sanfilippo)
+* Rename struct member to avoid name clash with pre-c99 code (Alex Balashov, ncopa)
+
+### 0.13.0 (2015-04-16)
+
+This release adds a minimal Windows compatibility layer.
+The parser, standalone since v0.12.0, can now be compiled on Windows
+(and thus used in other client libraries as well)
+
+* Windows compatibility layer for parser code (tzickel)
+* Properly escape data printed to PKGCONF file (Dan Skorupski)
+* Fix tests when assert() undefined (Keith Bennett, Matt Stancliff)
+* Implement a reconnect method for the client context, this changes the structure of `redisContext` (Aaron Bedra)
+
+### 0.12.1 (2015-01-26)
+
+* Fix `make install`: DESTDIR support, install all required files, install PKGCONF in proper location
+* Fix `make test` as 32 bit build on 64 bit platform
+
+### 0.12.0 (2015-01-22)
+
+* Add optional KeepAlive support
+
+* Try again on EINTR errors
+
+* Add libuv adapter
+
+* Add IPv6 support
+
+* Remove possiblity of multiple close on same fd
+
+* Add ability to bind source address on connect
+
+* Add redisConnectFd() and redisFreeKeepFd()
+
+* Fix getaddrinfo() memory leak
+
+* Free string if it is unused (fixes memory leak)
+
+* Improve redisAppendCommandArgv performance 2.5x
+
+* Add support for SO_REUSEADDR
+
+* Fix redisvFormatCommand format parsing
+
+* Add GLib 2.0 adapter
+
+* Refactor reading code into read.c
+
+* Fix errno error buffers to not clobber errors
+
+* Generate pkgconf during build
+
+* Silence _BSD_SOURCE warnings
+
+* Improve digit counting for multibulk creation
+
+
+### 0.11.0
+
+* Increase the maximum multi-bulk reply depth to 7.
+
+* Increase the read buffer size from 2k to 16k.
+
+* Use poll(2) instead of select(2) to support large fds (>= 1024).
+
+### 0.10.1
+
+* Makefile overhaul. Important to check out if you override one or more
+  variables using environment variables or via arguments to the "make" tool.
+
+* Issue #45: Fix potential memory leak for a multi bulk reply with 0 elements
+  being created by the default reply object functions.
+
+* Issue #43: Don't crash in an asynchronous context when Redis returns an error
+  reply after the connection has been made (this happens when the maximum
+  number of connections is reached).
+
+### 0.10.0
+
+* See commit log.
+
diff --git a/debian/modules/nchan/src/store/redis/hiredis/COPYING b/debian/modules/nchan/src/store/redis/hiredis/COPYING
new file mode 100644
index 00000000..a5fc9739
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/COPYING
@@ -0,0 +1,29 @@
+Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice,
+  this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of Redis nor the names of its contributors may be used
+  to endorse or promote products derived from this software without specific
+  prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/debian/modules/nchan/src/store/redis/hiredis/Makefile b/debian/modules/nchan/src/store/redis/hiredis/Makefile
new file mode 100644
index 00000000..cff2a84c
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/Makefile
@@ -0,0 +1,217 @@
+# Hiredis Makefile
+# Copyright (C) 2010-2011 Salvatore Sanfilippo <antirez at gmail dot com>
+# Copyright (C) 2010-2011 Pieter Noordhuis <pcnoordhuis at gmail dot com>
+# This file is released under the BSD license, see the COPYING file
+
+OBJ=net.o hiredis.o sds.o async.o read.o
+EXAMPLES=hiredis-example hiredis-example-libevent hiredis-example-libev hiredis-example-glib
+TESTS=hiredis-test
+LIBNAME=libhiredis
+PKGCONFNAME=hiredis.pc
+
+HIREDIS_MAJOR=$(shell grep HIREDIS_MAJOR hiredis.h | awk '{print $$3}')
+HIREDIS_MINOR=$(shell grep HIREDIS_MINOR hiredis.h | awk '{print $$3}')
+HIREDIS_PATCH=$(shell grep HIREDIS_PATCH hiredis.h | awk '{print $$3}')
+HIREDIS_SONAME=$(shell grep HIREDIS_SONAME hiredis.h | awk '{print $$3}')
+
+# Installation related variables and target
+PREFIX?=/usr/local
+INCLUDE_PATH?=include/hiredis
+LIBRARY_PATH?=lib
+PKGCONF_PATH?=pkgconfig
+INSTALL_INCLUDE_PATH= $(DESTDIR)$(PREFIX)/$(INCLUDE_PATH)
+INSTALL_LIBRARY_PATH= $(DESTDIR)$(PREFIX)/$(LIBRARY_PATH)
+INSTALL_PKGCONF_PATH= $(INSTALL_LIBRARY_PATH)/$(PKGCONF_PATH)
+
+# redis-server configuration used for testing
+REDIS_PORT=56379
+REDIS_SERVER=redis-server
+define REDIS_TEST_CONFIG
+	daemonize yes
+	pidfile /tmp/hiredis-test-redis.pid
+	port $(REDIS_PORT)
+	bind 127.0.0.1
+	unixsocket /tmp/hiredis-test-redis.sock
+endef
+export REDIS_TEST_CONFIG
+
+# Fallback to gcc when $CC is not in $PATH.
+CC:=$(shell sh -c 'type $(CC) >/dev/null 2>/dev/null && echo $(CC) || echo gcc')
+CXX:=$(shell sh -c 'type $(CXX) >/dev/null 2>/dev/null && echo $(CXX) || echo g++')
+OPTIMIZATION?=-O3
+WARNINGS=-Wall -W -Wstrict-prototypes -Wwrite-strings
+DEBUG?= -g -ggdb
+REAL_CFLAGS=$(OPTIMIZATION) -fPIC $(CFLAGS) $(WARNINGS) $(DEBUG) $(ARCH)
+REAL_LDFLAGS=$(LDFLAGS) $(ARCH)
+
+DYLIBSUFFIX=so
+STLIBSUFFIX=a
+DYLIB_MINOR_NAME=$(LIBNAME).$(DYLIBSUFFIX).$(HIREDIS_SONAME)
+DYLIB_MAJOR_NAME=$(LIBNAME).$(DYLIBSUFFIX).$(HIREDIS_MAJOR)
+DYLIBNAME=$(LIBNAME).$(DYLIBSUFFIX)
+DYLIB_MAKE_CMD=$(CC) -shared -Wl,-soname,$(DYLIB_MINOR_NAME) -o $(DYLIBNAME) $(LDFLAGS)
+STLIBNAME=$(LIBNAME).$(STLIBSUFFIX)
+STLIB_MAKE_CMD=ar rcs $(STLIBNAME)
+
+# Platform-specific overrides
+uname_S := $(shell sh -c 'uname -s 2>/dev/null || echo not')
+ifeq ($(uname_S),SunOS)
+  REAL_LDFLAGS+= -ldl -lnsl -lsocket
+  DYLIB_MAKE_CMD=$(CC) -G -o $(DYLIBNAME) -h $(DYLIB_MINOR_NAME) $(LDFLAGS)
+  INSTALL= cp -r
+endif
+ifeq ($(uname_S),Darwin)
+  DYLIBSUFFIX=dylib
+  DYLIB_MINOR_NAME=$(LIBNAME).$(HIREDIS_SONAME).$(DYLIBSUFFIX)
+  DYLIB_MAKE_CMD=$(CC) -shared -Wl,-install_name,$(DYLIB_MINOR_NAME) -o $(DYLIBNAME) $(LDFLAGS)
+endif
+
+all: $(DYLIBNAME) $(STLIBNAME) hiredis-test $(PKGCONFNAME)
+
+# Deps (use make dep to generate this)
+async.o: async.c fmacros.h async.h hiredis.h read.h sds.h net.h dict.c dict.h
+dict.o: dict.c fmacros.h dict.h
+hiredis.o: hiredis.c fmacros.h hiredis.h read.h sds.h net.h
+net.o: net.c fmacros.h net.h hiredis.h read.h sds.h
+read.o: read.c fmacros.h read.h sds.h
+sds.o: sds.c sds.h
+test.o: test.c fmacros.h hiredis.h read.h sds.h
+
+$(DYLIBNAME): $(OBJ)
+	$(DYLIB_MAKE_CMD) $(OBJ)
+
+$(STLIBNAME): $(OBJ)
+	$(STLIB_MAKE_CMD) $(OBJ)
+
+dynamic: $(DYLIBNAME)
+static: $(STLIBNAME)
+
+# Binaries:
+hiredis-example-libevent: examples/example-libevent.c adapters/libevent.h $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. $< -levent $(STLIBNAME)
+
+hiredis-example-libev: examples/example-libev.c adapters/libev.h $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. $< -lev $(STLIBNAME)
+
+hiredis-example-glib: examples/example-glib.c adapters/glib.h $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) $(shell pkg-config --cflags --libs glib-2.0) -I. $< $(STLIBNAME)
+
+hiredis-example-ivykis: examples/example-ivykis.c adapters/ivykis.h $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. $< -livykis $(STLIBNAME)
+
+hiredis-example-macosx: examples/example-macosx.c adapters/macosx.h $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. $< -framework CoreFoundation $(STLIBNAME)
+
+ifndef AE_DIR
+hiredis-example-ae:
+	@echo "Please specify AE_DIR (e.g. <redis repository>/src)"
+	@false
+else
+hiredis-example-ae: examples/example-ae.c adapters/ae.h $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. -I$(AE_DIR) $< $(AE_DIR)/ae.o $(AE_DIR)/zmalloc.o $(AE_DIR)/../deps/jemalloc/lib/libjemalloc.a -pthread $(STLIBNAME)
+endif
+
+ifndef LIBUV_DIR
+hiredis-example-libuv:
+	@echo "Please specify LIBUV_DIR (e.g. ../libuv/)"
+	@false
+else
+hiredis-example-libuv: examples/example-libuv.c adapters/libuv.h $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. -I$(LIBUV_DIR)/include $< $(LIBUV_DIR)/.libs/libuv.a -lpthread -lrt $(STLIBNAME)
+endif
+
+ifeq ($(and $(QT_MOC),$(QT_INCLUDE_DIR),$(QT_LIBRARY_DIR)),)
+hiredis-example-qt:
+	@echo "Please specify QT_MOC, QT_INCLUDE_DIR AND QT_LIBRARY_DIR"
+	@false
+else
+hiredis-example-qt: examples/example-qt.cpp adapters/qt.h $(STLIBNAME)
+	$(QT_MOC) adapters/qt.h -I. -I$(QT_INCLUDE_DIR) -I$(QT_INCLUDE_DIR)/QtCore | \
+	    $(CXX) -x c++ -o qt-adapter-moc.o -c - $(REAL_CFLAGS) -I. -I$(QT_INCLUDE_DIR) -I$(QT_INCLUDE_DIR)/QtCore
+	$(QT_MOC) examples/example-qt.h -I. -I$(QT_INCLUDE_DIR) -I$(QT_INCLUDE_DIR)/QtCore | \
+	    $(CXX) -x c++ -o qt-example-moc.o -c - $(REAL_CFLAGS) -I. -I$(QT_INCLUDE_DIR) -I$(QT_INCLUDE_DIR)/QtCore
+	$(CXX) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. -I$(QT_INCLUDE_DIR) -I$(QT_INCLUDE_DIR)/QtCore -L$(QT_LIBRARY_DIR) qt-adapter-moc.o qt-example-moc.o $< -pthread $(STLIBNAME) -lQtCore
+endif
+
+hiredis-example: examples/example.c $(STLIBNAME)
+	$(CC) -o examples/$@ $(REAL_CFLAGS) $(REAL_LDFLAGS) -I. $< $(STLIBNAME)
+
+examples: $(EXAMPLES)
+
+hiredis-test: test.o $(STLIBNAME)
+
+hiredis-%: %.o $(STLIBNAME)
+	$(CC) $(REAL_CFLAGS) -o $@ $(REAL_LDFLAGS) $< $(STLIBNAME)
+
+test: hiredis-test
+	./hiredis-test
+
+check: hiredis-test
+	@echo "$$REDIS_TEST_CONFIG" | $(REDIS_SERVER) -
+	$(PRE) ./hiredis-test -h 127.0.0.1 -p $(REDIS_PORT) -s /tmp/hiredis-test-redis.sock || \
+			( kill `cat /tmp/hiredis-test-redis.pid` && false )
+	kill `cat /tmp/hiredis-test-redis.pid`
+
+.c.o:
+	$(CC) -std=c99 -pedantic -c $(REAL_CFLAGS) $<
+
+clean:
+	rm -rf $(DYLIBNAME) $(STLIBNAME) $(TESTS) $(PKGCONFNAME) examples/hiredis-example* *.o *.gcda *.gcno *.gcov
+
+dep:
+	$(CC) -MM *.c
+
+ifeq ($(uname_S),SunOS)
+  INSTALL?= cp -r
+endif
+
+INSTALL?= cp -a
+
+$(PKGCONFNAME): hiredis.h
+	@echo "Generating $@ for pkgconfig..."
+	@echo prefix=$(PREFIX) > $@
+	@echo exec_prefix=\$${prefix} >> $@
+	@echo libdir=$(PREFIX)/$(LIBRARY_PATH) >> $@
+	@echo includedir=$(PREFIX)/$(INCLUDE_PATH) >> $@
+	@echo >> $@
+	@echo Name: hiredis >> $@
+	@echo Description: Minimalistic C client library for Redis. >> $@
+	@echo Version: $(HIREDIS_MAJOR).$(HIREDIS_MINOR).$(HIREDIS_PATCH) >> $@
+	@echo Libs: -L\$${libdir} -lhiredis >> $@
+	@echo Cflags: -I\$${includedir} -D_FILE_OFFSET_BITS=64 >> $@
+
+install: $(DYLIBNAME) $(STLIBNAME) $(PKGCONFNAME)
+	mkdir -p $(INSTALL_INCLUDE_PATH) $(INSTALL_LIBRARY_PATH)
+	$(INSTALL) hiredis.h async.h read.h sds.h adapters $(INSTALL_INCLUDE_PATH)
+	$(INSTALL) $(DYLIBNAME) $(INSTALL_LIBRARY_PATH)/$(DYLIB_MINOR_NAME)
+	cd $(INSTALL_LIBRARY_PATH) && ln -sf $(DYLIB_MINOR_NAME) $(DYLIBNAME)
+	$(INSTALL) $(STLIBNAME) $(INSTALL_LIBRARY_PATH)
+	mkdir -p $(INSTALL_PKGCONF_PATH)
+	$(INSTALL) $(PKGCONFNAME) $(INSTALL_PKGCONF_PATH)
+
+32bit:
+	@echo ""
+	@echo "WARNING: if this fails under Linux you probably need to install libc6-dev-i386"
+	@echo ""
+	$(MAKE) CFLAGS="-m32" LDFLAGS="-m32"
+
+32bit-vars:
+	$(eval CFLAGS=-m32)
+	$(eval LDFLAGS=-m32)
+
+gprof:
+	$(MAKE) CFLAGS="-pg" LDFLAGS="-pg"
+
+gcov:
+	$(MAKE) CFLAGS="-fprofile-arcs -ftest-coverage" LDFLAGS="-fprofile-arcs"
+
+coverage: gcov
+	make check
+	mkdir -p tmp/lcov
+	lcov -d . -c -o tmp/lcov/hiredis.info
+	genhtml --legend -o tmp/lcov/report tmp/lcov/hiredis.info
+
+noopt:
+	$(MAKE) OPTIMIZATION=""
+
+.PHONY: all test check clean dep install 32bit 32bit-vars gprof gcov noopt
diff --git a/debian/modules/nchan/src/store/redis/hiredis/README.md b/debian/modules/nchan/src/store/redis/hiredis/README.md
new file mode 100644
index 00000000..4f1a58d2
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/README.md
@@ -0,0 +1,392 @@
+[![Build Status](https://travis-ci.org/redis/hiredis.png)](https://travis-ci.org/redis/hiredis)
+
+# HIREDIS
+
+Hiredis is a minimalistic C client library for the [Redis](http://redis.io/) database.
+
+It is minimalistic because it just adds minimal support for the protocol, but
+at the same time it uses a high level printf-alike API in order to make it
+much higher level than otherwise suggested by its minimal code base and the
+lack of explicit bindings for every Redis command.
+
+Apart from supporting sending commands and receiving replies, it comes with
+a reply parser that is decoupled from the I/O layer. It
+is a stream parser designed for easy reusability, which can for instance be used
+in higher level language bindings for efficient reply parsing.
+
+Hiredis only supports the binary-safe Redis protocol, so you can use it with any
+Redis version >= 1.2.0.
+
+The library comes with multiple APIs. There is the
+*synchronous API*, the *asynchronous API* and the *reply parsing API*.
+
+## UPGRADING
+
+Version 0.9.0 is a major overhaul of hiredis in every aspect. However, upgrading existing
+code using hiredis should not be a big pain. The key thing to keep in mind when
+upgrading is that hiredis >= 0.9.0 uses a `redisContext*` to keep state, in contrast to
+the stateless 0.0.1 that only has a file descriptor to work with.
+
+## Synchronous API
+
+To consume the synchronous API, there are only a few function calls that need to be introduced:
+
+```c
+redisContext *redisConnect(const char *ip, int port);
+void *redisCommand(redisContext *c, const char *format, ...);
+void freeReplyObject(void *reply);
+```
+
+### Connecting
+
+The function `redisConnect` is used to create a so-called `redisContext`. The
+context is where Hiredis holds state for a connection. The `redisContext`
+struct has an integer `err` field that is non-zero when the connection is in
+an error state. The field `errstr` will contain a string with a description of
+the error. More information on errors can be found in the **Errors** section.
+After trying to connect to Redis using `redisConnect` you should
+check the `err` field to see if establishing the connection was successful:
+```c
+redisContext *c = redisConnect("127.0.0.1", 6379);
+if (c != NULL && c->err) {
+    printf("Error: %s\n", c->errstr);
+    // handle error
+}
+```
+
+### Sending commands
+
+There are several ways to issue commands to Redis. The first that will be introduced is
+`redisCommand`. This function takes a format similar to printf. In the simplest form,
+it is used like this:
+```c
+reply = redisCommand(context, "SET foo bar");
+```
+
+The specifier `%s` interpolates a string in the command, and uses `strlen` to
+determine the length of the string:
+```c
+reply = redisCommand(context, "SET foo %s", value);
+```
+When you need to pass binary safe strings in a command, the `%b` specifier can be
+used. Together with a pointer to the string, it requires a `size_t` length argument
+of the string:
+```c
+reply = redisCommand(context, "SET foo %b", value, (size_t) valuelen);
+```
+Internally, Hiredis splits the command in different arguments and will
+convert it to the protocol used to communicate with Redis.
+One or more spaces separates arguments, so you can use the specifiers
+anywhere in an argument:
+```c
+reply = redisCommand(context, "SET key:%s %s", myid, value);
+```
+
+### Using replies
+
+The return value of `redisCommand` holds a reply when the command was
+successfully executed. When an error occurs, the return value is `NULL` and
+the `err` field in the context will be set (see section on **Errors**).
+Once an error is returned the context cannot be reused and you should set up
+a new connection.
+
+The standard replies that `redisCommand` are of the type `redisReply`. The
+`type` field in the `redisReply` should be used to test what kind of reply
+was received:
+
+* **`REDIS_REPLY_STATUS`**:
+    * The command replied with a status reply. The status string can be accessed using `reply->str`.
+      The length of this string can be accessed using `reply->len`.
+
+* **`REDIS_REPLY_ERROR`**:
+    *  The command replied with an error. The error string can be accessed identical to `REDIS_REPLY_STATUS`.
+
+* **`REDIS_REPLY_INTEGER`**:
+    * The command replied with an integer. The integer value can be accessed using the
+      `reply->integer` field of type `long long`.
+
+* **`REDIS_REPLY_NIL`**:
+    * The command replied with a **nil** object. There is no data to access.
+
+* **`REDIS_REPLY_STRING`**:
+    * A bulk (string) reply. The value of the reply can be accessed using `reply->str`.
+      The length of this string can be accessed using `reply->len`.
+
+* **`REDIS_REPLY_ARRAY`**:
+    * A multi bulk reply. The number of elements in the multi bulk reply is stored in
+      `reply->elements`. Every element in the multi bulk reply is a `redisReply` object as well
+      and can be accessed via `reply->element[..index..]`.
+      Redis may reply with nested arrays but this is fully supported.
+
+Replies should be freed using the `freeReplyObject()` function.
+Note that this function will take care of freeing sub-reply objects
+contained in arrays and nested arrays, so there is no need for the user to
+free the sub replies (it is actually harmful and will corrupt the memory).
+
+**Important:** the current version of hiredis (0.10.0) frees replies when the
+asynchronous API is used. This means you should not call `freeReplyObject` when
+you use this API. The reply is cleaned up by hiredis _after_ the callback
+returns. This behavior will probably change in future releases, so make sure to
+keep an eye on the changelog when upgrading (see issue #39).
+
+### Cleaning up
+
+To disconnect and free the context the following function can be used:
+```c
+void redisFree(redisContext *c);
+```
+This function immediately closes the socket and then frees the allocations done in
+creating the context.
+
+### Sending commands (cont'd)
+
+Together with `redisCommand`, the function `redisCommandArgv` can be used to issue commands.
+It has the following prototype:
+```c
+void *redisCommandArgv(redisContext *c, int argc, const char **argv, const size_t *argvlen);
+```
+It takes the number of arguments `argc`, an array of strings `argv` and the lengths of the
+arguments `argvlen`. For convenience, `argvlen` may be set to `NULL` and the function will
+use `strlen(3)` on every argument to determine its length. Obviously, when any of the arguments
+need to be binary safe, the entire array of lengths `argvlen` should be provided.
+
+The return value has the same semantic as `redisCommand`.
+
+### Pipelining
+
+To explain how Hiredis supports pipelining in a blocking connection, there needs to be
+understanding of the internal execution flow.
+
+When any of the functions in the `redisCommand` family is called, Hiredis first formats the
+command according to the Redis protocol. The formatted command is then put in the output buffer
+of the context. This output buffer is dynamic, so it can hold any number of commands.
+After the command is put in the output buffer, `redisGetReply` is called. This function has the
+following two execution paths:
+
+1. The input buffer is non-empty:
+    * Try to parse a single reply from the input buffer and return it
+    * If no reply could be parsed, continue at *2*
+2. The input buffer is empty:
+    * Write the **entire** output buffer to the socket
+    * Read from the socket until a single reply could be parsed
+
+The function `redisGetReply` is exported as part of the Hiredis API and can be used when a reply
+is expected on the socket. To pipeline commands, the only things that needs to be done is
+filling up the output buffer. For this cause, two commands can be used that are identical
+to the `redisCommand` family, apart from not returning a reply:
+```c
+void redisAppendCommand(redisContext *c, const char *format, ...);
+void redisAppendCommandArgv(redisContext *c, int argc, const char **argv, const size_t *argvlen);
+```
+After calling either function one or more times, `redisGetReply` can be used to receive the
+subsequent replies. The return value for this function is either `REDIS_OK` or `REDIS_ERR`, where
+the latter means an error occurred while reading a reply. Just as with the other commands,
+the `err` field in the context can be used to find out what the cause of this error is.
+
+The following examples shows a simple pipeline (resulting in only a single call to `write(2)` and
+a single call to `read(2)`):
+```c
+redisReply *reply;
+redisAppendCommand(context,"SET foo bar");
+redisAppendCommand(context,"GET foo");
+redisGetReply(context,&reply); // reply for SET
+freeReplyObject(reply);
+redisGetReply(context,&reply); // reply for GET
+freeReplyObject(reply);
+```
+This API can also be used to implement a blocking subscriber:
+```c
+reply = redisCommand(context,"SUBSCRIBE foo");
+freeReplyObject(reply);
+while(redisGetReply(context,&reply) == REDIS_OK) {
+    // consume message
+    freeReplyObject(reply);
+}
+```
+### Errors
+
+When a function call is not successful, depending on the function either `NULL` or `REDIS_ERR` is
+returned. The `err` field inside the context will be non-zero and set to one of the
+following constants:
+
+* **`REDIS_ERR_IO`**:
+    There was an I/O error while creating the connection, trying to write
+    to the socket or read from the socket. If you included `errno.h` in your
+    application, you can use the global `errno` variable to find out what is
+    wrong.
+
+* **`REDIS_ERR_EOF`**:
+    The server closed the connection which resulted in an empty read.
+
+* **`REDIS_ERR_PROTOCOL`**:
+    There was an error while parsing the protocol.
+
+* **`REDIS_ERR_OTHER`**:
+    Any other error. Currently, it is only used when a specified hostname to connect
+    to cannot be resolved.
+
+In every case, the `errstr` field in the context will be set to hold a string representation
+of the error.
+
+## Asynchronous API
+
+Hiredis comes with an asynchronous API that works easily with any event library.
+Examples are bundled that show using Hiredis with [libev](http://software.schmorp.de/pkg/libev.html)
+and [libevent](http://monkey.org/~provos/libevent/).
+
+### Connecting
+
+The function `redisAsyncConnect` can be used to establish a non-blocking connection to
+Redis. It returns a pointer to the newly created `redisAsyncContext` struct. The `err` field
+should be checked after creation to see if there were errors creating the connection.
+Because the connection that will be created is non-blocking, the kernel is not able to
+instantly return if the specified host and port is able to accept a connection.
+```c
+redisAsyncContext *c = redisAsyncConnect("127.0.0.1", 6379);
+if (c->err) {
+    printf("Error: %s\n", c->errstr);
+    // handle error
+}
+```
+
+The asynchronous context can hold a disconnect callback function that is called when the
+connection is disconnected (either because of an error or per user request). This function should
+have the following prototype:
+```c
+void(const redisAsyncContext *c, int status);
+```
+On a disconnect, the `status` argument is set to `REDIS_OK` when disconnection was initiated by the
+user, or `REDIS_ERR` when the disconnection was caused by an error. When it is `REDIS_ERR`, the `err`
+field in the context can be accessed to find out the cause of the error.
+
+The context object is always freed after the disconnect callback fired. When a reconnect is needed,
+the disconnect callback is a good point to do so.
+
+Setting the disconnect callback can only be done once per context. For subsequent calls it will
+return `REDIS_ERR`. The function to set the disconnect callback has the following prototype:
+```c
+int redisAsyncSetDisconnectCallback(redisAsyncContext *ac, redisDisconnectCallback *fn);
+```
+### Sending commands and their callbacks
+
+In an asynchronous context, commands are automatically pipelined due to the nature of an event loop.
+Therefore, unlike the synchronous API, there is only a single way to send commands.
+Because commands are sent to Redis asynchronously, issuing a command requires a callback function
+that is called when the reply is received. Reply callbacks should have the following prototype:
+```c
+void(redisAsyncContext *c, void *reply, void *privdata);
+```
+The `privdata` argument can be used to curry arbitrary data to the callback from the point where
+the command is initially queued for execution.
+
+The functions that can be used to issue commands in an asynchronous context are:
+```c
+int redisAsyncCommand(
+  redisAsyncContext *ac, redisCallbackFn *fn, void *privdata,
+  const char *format, ...);
+int redisAsyncCommandArgv(
+  redisAsyncContext *ac, redisCallbackFn *fn, void *privdata,
+  int argc, const char **argv, const size_t *argvlen);
+```
+Both functions work like their blocking counterparts. The return value is `REDIS_OK` when the command
+was successfully added to the output buffer and `REDIS_ERR` otherwise. Example: when the connection
+is being disconnected per user-request, no new commands may be added to the output buffer and `REDIS_ERR` is
+returned on calls to the `redisAsyncCommand` family.
+
+If the reply for a command with a `NULL` callback is read, it is immediately freed. When the callback
+for a command is non-`NULL`, the memory is freed immediately following the callback: the reply is only
+valid for the duration of the callback.
+
+All pending callbacks are called with a `NULL` reply when the context encountered an error.
+
+### Disconnecting
+
+An asynchronous connection can be terminated using:
+```c
+void redisAsyncDisconnect(redisAsyncContext *ac);
+```
+When this function is called, the connection is **not** immediately terminated. Instead, new
+commands are no longer accepted and the connection is only terminated when all pending commands
+have been written to the socket, their respective replies have been read and their respective
+callbacks have been executed. After this, the disconnection callback is executed with the
+`REDIS_OK` status and the context object is freed.
+
+### Hooking it up to event library *X*
+
+There are a few hooks that need to be set on the context object after it is created.
+See the `adapters/` directory for bindings to *libev* and *libevent*.
+
+## Reply parsing API
+
+Hiredis comes with a reply parsing API that makes it easy for writing higher
+level language bindings.
+
+The reply parsing API consists of the following functions:
+```c
+redisReader *redisReaderCreate(void);
+void redisReaderFree(redisReader *reader);
+int redisReaderFeed(redisReader *reader, const char *buf, size_t len);
+int redisReaderGetReply(redisReader *reader, void **reply);
+```
+The same set of functions are used internally by hiredis when creating a
+normal Redis context, the above API just exposes it to the user for a direct
+usage.
+
+### Usage
+
+The function `redisReaderCreate` creates a `redisReader` structure that holds a
+buffer with unparsed data and state for the protocol parser.
+
+Incoming data -- most likely from a socket -- can be placed in the internal
+buffer of the `redisReader` using `redisReaderFeed`. This function will make a
+copy of the buffer pointed to by `buf` for `len` bytes. This data is parsed
+when `redisReaderGetReply` is called. This function returns an integer status
+and a reply object (as described above) via `void **reply`. The returned status
+can be either `REDIS_OK` or `REDIS_ERR`, where the latter means something went
+wrong (either a protocol error, or an out of memory error).
+
+The parser limits the level of nesting for multi bulk payloads to 7. If the
+multi bulk nesting level is higher than this, the parser returns an error.
+
+### Customizing replies
+
+The function `redisReaderGetReply` creates `redisReply` and makes the function
+argument `reply` point to the created `redisReply` variable. For instance, if
+the response of type `REDIS_REPLY_STATUS` then the `str` field of `redisReply`
+will hold the status as a vanilla C string. However, the functions that are
+responsible for creating instances of the `redisReply` can be customized by
+setting the `fn` field on the `redisReader` struct. This should be done
+immediately after creating the `redisReader`.
+
+For example, [hiredis-rb](https://github.com/pietern/hiredis-rb/blob/master/ext/hiredis_ext/reader.c)
+uses customized reply object functions to create Ruby objects.
+
+### Reader max buffer
+
+Both when using the Reader API directly or when using it indirectly via a
+normal Redis context, the redisReader structure uses a buffer in order to
+accumulate data from the server.
+Usually this buffer is destroyed when it is empty and is larger than 16
+KiB in order to avoid wasting memory in unused buffers
+
+However when working with very big payloads destroying the buffer may slow
+down performances considerably, so it is possible to modify the max size of
+an idle buffer changing the value of the `maxbuf` field of the reader structure
+to the desired value. The special value of 0 means that there is no maximum
+value for an idle buffer, so the buffer will never get freed.
+
+For instance if you have a normal Redis context you can set the maximum idle
+buffer to zero (unlimited) just with:
+```c
+context->reader->maxbuf = 0;
+```
+This should be done only in order to maximize performances when working with
+large payloads. The context should be set back to `REDIS_READER_MAX_BUF` again
+as soon as possible in order to prevent allocation of useless memory.
+
+## AUTHORS
+
+Hiredis was written by Salvatore Sanfilippo (antirez at gmail) and
+Pieter Noordhuis (pcnoordhuis at gmail) and is released under the BSD license.  
+Hiredis is currently maintained by Matt Stancliff (matt at genges dot com) and
+Jan-Erik Rediger (janerik at fnordig dot com)
diff --git a/debian/modules/nchan/src/store/redis/hiredis/adapters/ae.h b/debian/modules/nchan/src/store/redis/hiredis/adapters/ae.h
new file mode 100644
index 00000000..5c551c2e
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/adapters/ae.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __HIREDIS_AE_H__
+#define __HIREDIS_AE_H__
+#include <sys/types.h>
+#include <ae.h>
+#include "../hiredis.h"
+#include "../async.h"
+
+typedef struct redisAeEvents {
+    redisAsyncContext *context;
+    aeEventLoop *loop;
+    int fd;
+    int reading, writing;
+} redisAeEvents;
+
+static void redisAeReadEvent(aeEventLoop *el, int fd, void *privdata, int mask) {
+    ((void)el); ((void)fd); ((void)mask);
+
+    redisAeEvents *e = (redisAeEvents*)privdata;
+    redisAsyncHandleRead(e->context);
+}
+
+static void redisAeWriteEvent(aeEventLoop *el, int fd, void *privdata, int mask) {
+    ((void)el); ((void)fd); ((void)mask);
+
+    redisAeEvents *e = (redisAeEvents*)privdata;
+    redisAsyncHandleWrite(e->context);
+}
+
+static void redisAeAddRead(void *privdata) {
+    redisAeEvents *e = (redisAeEvents*)privdata;
+    aeEventLoop *loop = e->loop;
+    if (!e->reading) {
+        e->reading = 1;
+        aeCreateFileEvent(loop,e->fd,AE_READABLE,redisAeReadEvent,e);
+    }
+}
+
+static void redisAeDelRead(void *privdata) {
+    redisAeEvents *e = (redisAeEvents*)privdata;
+    aeEventLoop *loop = e->loop;
+    if (e->reading) {
+        e->reading = 0;
+        aeDeleteFileEvent(loop,e->fd,AE_READABLE);
+    }
+}
+
+static void redisAeAddWrite(void *privdata) {
+    redisAeEvents *e = (redisAeEvents*)privdata;
+    aeEventLoop *loop = e->loop;
+    if (!e->writing) {
+        e->writing = 1;
+        aeCreateFileEvent(loop,e->fd,AE_WRITABLE,redisAeWriteEvent,e);
+    }
+}
+
+static void redisAeDelWrite(void *privdata) {
+    redisAeEvents *e = (redisAeEvents*)privdata;
+    aeEventLoop *loop = e->loop;
+    if (e->writing) {
+        e->writing = 0;
+        aeDeleteFileEvent(loop,e->fd,AE_WRITABLE);
+    }
+}
+
+static void redisAeCleanup(void *privdata) {
+    redisAeEvents *e = (redisAeEvents*)privdata;
+    redisAeDelRead(privdata);
+    redisAeDelWrite(privdata);
+    free(e);
+}
+
+static int redisAeAttach(aeEventLoop *loop, redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+    redisAeEvents *e;
+
+    /* Nothing should be attached when something is already attached */
+    if (ac->ev.data != NULL)
+        return REDIS_ERR;
+
+    /* Create container for context and r/w events */
+    e = (redisAeEvents*)malloc(sizeof(*e));
+    e->context = ac;
+    e->loop = loop;
+    e->fd = c->fd;
+    e->reading = e->writing = 0;
+
+    /* Register functions to start/stop listening for events */
+    ac->ev.addRead = redisAeAddRead;
+    ac->ev.delRead = redisAeDelRead;
+    ac->ev.addWrite = redisAeAddWrite;
+    ac->ev.delWrite = redisAeDelWrite;
+    ac->ev.cleanup = redisAeCleanup;
+    ac->ev.data = e;
+
+    return REDIS_OK;
+}
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/adapters/libev.h b/debian/modules/nchan/src/store/redis/hiredis/adapters/libev.h
new file mode 100644
index 00000000..2bf8d521
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/adapters/libev.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __HIREDIS_LIBEV_H__
+#define __HIREDIS_LIBEV_H__
+#include <stdlib.h>
+#include <sys/types.h>
+#include <ev.h>
+#include "../hiredis.h"
+#include "../async.h"
+
+typedef struct redisLibevEvents {
+    redisAsyncContext *context;
+    struct ev_loop *loop;
+    int reading, writing;
+    ev_io rev, wev;
+} redisLibevEvents;
+
+static void redisLibevReadEvent(EV_P_ ev_io *watcher, int revents) {
+#if EV_MULTIPLICITY
+    ((void)loop);
+#endif
+    ((void)revents);
+
+    redisLibevEvents *e = (redisLibevEvents*)watcher->data;
+    redisAsyncHandleRead(e->context);
+}
+
+static void redisLibevWriteEvent(EV_P_ ev_io *watcher, int revents) {
+#if EV_MULTIPLICITY
+    ((void)loop);
+#endif
+    ((void)revents);
+
+    redisLibevEvents *e = (redisLibevEvents*)watcher->data;
+    redisAsyncHandleWrite(e->context);
+}
+
+static void redisLibevAddRead(void *privdata) {
+    redisLibevEvents *e = (redisLibevEvents*)privdata;
+    struct ev_loop *loop = e->loop;
+    ((void)loop);
+    if (!e->reading) {
+        e->reading = 1;
+        ev_io_start(EV_A_ &e->rev);
+    }
+}
+
+static void redisLibevDelRead(void *privdata) {
+    redisLibevEvents *e = (redisLibevEvents*)privdata;
+    struct ev_loop *loop = e->loop;
+    ((void)loop);
+    if (e->reading) {
+        e->reading = 0;
+        ev_io_stop(EV_A_ &e->rev);
+    }
+}
+
+static void redisLibevAddWrite(void *privdata) {
+    redisLibevEvents *e = (redisLibevEvents*)privdata;
+    struct ev_loop *loop = e->loop;
+    ((void)loop);
+    if (!e->writing) {
+        e->writing = 1;
+        ev_io_start(EV_A_ &e->wev);
+    }
+}
+
+static void redisLibevDelWrite(void *privdata) {
+    redisLibevEvents *e = (redisLibevEvents*)privdata;
+    struct ev_loop *loop = e->loop;
+    ((void)loop);
+    if (e->writing) {
+        e->writing = 0;
+        ev_io_stop(EV_A_ &e->wev);
+    }
+}
+
+static void redisLibevCleanup(void *privdata) {
+    redisLibevEvents *e = (redisLibevEvents*)privdata;
+    redisLibevDelRead(privdata);
+    redisLibevDelWrite(privdata);
+    free(e);
+}
+
+static int redisLibevAttach(EV_P_ redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+    redisLibevEvents *e;
+
+    /* Nothing should be attached when something is already attached */
+    if (ac->ev.data != NULL)
+        return REDIS_ERR;
+
+    /* Create container for context and r/w events */
+    e = (redisLibevEvents*)malloc(sizeof(*e));
+    e->context = ac;
+#if EV_MULTIPLICITY
+    e->loop = loop;
+#else
+    e->loop = NULL;
+#endif
+    e->reading = e->writing = 0;
+    e->rev.data = e;
+    e->wev.data = e;
+
+    /* Register functions to start/stop listening for events */
+    ac->ev.addRead = redisLibevAddRead;
+    ac->ev.delRead = redisLibevDelRead;
+    ac->ev.addWrite = redisLibevAddWrite;
+    ac->ev.delWrite = redisLibevDelWrite;
+    ac->ev.cleanup = redisLibevCleanup;
+    ac->ev.data = e;
+
+    /* Initialize read/write events */
+    ev_io_init(&e->rev,redisLibevReadEvent,c->fd,EV_READ);
+    ev_io_init(&e->wev,redisLibevWriteEvent,c->fd,EV_WRITE);
+    return REDIS_OK;
+}
+
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/adapters/libevent.h b/debian/modules/nchan/src/store/redis/hiredis/adapters/libevent.h
new file mode 100644
index 00000000..1c2b271b
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/adapters/libevent.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __HIREDIS_LIBEVENT_H__
+#define __HIREDIS_LIBEVENT_H__
+#include <event.h>
+#include "../hiredis.h"
+#include "../async.h"
+
+typedef struct redisLibeventEvents {
+    redisAsyncContext *context;
+    struct event rev, wev;
+} redisLibeventEvents;
+
+static void redisLibeventReadEvent(int fd, short event, void *arg) {
+    ((void)fd); ((void)event);
+    redisLibeventEvents *e = (redisLibeventEvents*)arg;
+    redisAsyncHandleRead(e->context);
+}
+
+static void redisLibeventWriteEvent(int fd, short event, void *arg) {
+    ((void)fd); ((void)event);
+    redisLibeventEvents *e = (redisLibeventEvents*)arg;
+    redisAsyncHandleWrite(e->context);
+}
+
+static void redisLibeventAddRead(void *privdata) {
+    redisLibeventEvents *e = (redisLibeventEvents*)privdata;
+    event_add(&e->rev,NULL);
+}
+
+static void redisLibeventDelRead(void *privdata) {
+    redisLibeventEvents *e = (redisLibeventEvents*)privdata;
+    event_del(&e->rev);
+}
+
+static void redisLibeventAddWrite(void *privdata) {
+    redisLibeventEvents *e = (redisLibeventEvents*)privdata;
+    event_add(&e->wev,NULL);
+}
+
+static void redisLibeventDelWrite(void *privdata) {
+    redisLibeventEvents *e = (redisLibeventEvents*)privdata;
+    event_del(&e->wev);
+}
+
+static void redisLibeventCleanup(void *privdata) {
+    redisLibeventEvents *e = (redisLibeventEvents*)privdata;
+    event_del(&e->rev);
+    event_del(&e->wev);
+    free(e);
+}
+
+static int redisLibeventAttach(redisAsyncContext *ac, struct event_base *base) {
+    redisContext *c = &(ac->c);
+    redisLibeventEvents *e;
+
+    /* Nothing should be attached when something is already attached */
+    if (ac->ev.data != NULL)
+        return REDIS_ERR;
+
+    /* Create container for context and r/w events */
+    e = (redisLibeventEvents*)malloc(sizeof(*e));
+    e->context = ac;
+
+    /* Register functions to start/stop listening for events */
+    ac->ev.addRead = redisLibeventAddRead;
+    ac->ev.delRead = redisLibeventDelRead;
+    ac->ev.addWrite = redisLibeventAddWrite;
+    ac->ev.delWrite = redisLibeventDelWrite;
+    ac->ev.cleanup = redisLibeventCleanup;
+    ac->ev.data = e;
+
+    /* Initialize and install read/write events */
+    event_set(&e->rev,c->fd,EV_READ,redisLibeventReadEvent,e);
+    event_set(&e->wev,c->fd,EV_WRITE,redisLibeventWriteEvent,e);
+    event_base_set(base,&e->rev);
+    event_base_set(base,&e->wev);
+    return REDIS_OK;
+}
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/adapters/libuv.h b/debian/modules/nchan/src/store/redis/hiredis/adapters/libuv.h
new file mode 100644
index 00000000..3cdf3d39
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/adapters/libuv.h
@@ -0,0 +1,121 @@
+#ifndef __HIREDIS_LIBUV_H__
+#define __HIREDIS_LIBUV_H__
+#include <stdlib.h>
+#include <uv.h>
+#include "../hiredis.h"
+#include "../async.h"
+#include <string.h>
+
+typedef struct redisLibuvEvents {
+  redisAsyncContext* context;
+  uv_poll_t          handle;
+  int                events;
+} redisLibuvEvents;
+
+
+static void redisLibuvPoll(uv_poll_t* handle, int status, int events) {
+  redisLibuvEvents* p = (redisLibuvEvents*)handle->data;
+
+  if (status != 0) {
+    return;
+  }
+
+  if (events & UV_READABLE) {
+    redisAsyncHandleRead(p->context);
+  }
+  if (events & UV_WRITABLE) {
+    redisAsyncHandleWrite(p->context);
+  }
+}
+
+
+static void redisLibuvAddRead(void *privdata) {
+  redisLibuvEvents* p = (redisLibuvEvents*)privdata;
+
+  p->events |= UV_READABLE;
+
+  uv_poll_start(&p->handle, p->events, redisLibuvPoll);
+}
+
+
+static void redisLibuvDelRead(void *privdata) {
+  redisLibuvEvents* p = (redisLibuvEvents*)privdata;
+
+  p->events &= ~UV_READABLE;
+
+  if (p->events) {
+    uv_poll_start(&p->handle, p->events, redisLibuvPoll);
+  } else {
+    uv_poll_stop(&p->handle);
+  }
+}
+
+
+static void redisLibuvAddWrite(void *privdata) {
+  redisLibuvEvents* p = (redisLibuvEvents*)privdata;
+
+  p->events |= UV_WRITABLE;
+
+  uv_poll_start(&p->handle, p->events, redisLibuvPoll);
+}
+
+
+static void redisLibuvDelWrite(void *privdata) {
+  redisLibuvEvents* p = (redisLibuvEvents*)privdata;
+
+  p->events &= ~UV_WRITABLE;
+
+  if (p->events) {
+    uv_poll_start(&p->handle, p->events, redisLibuvPoll);
+  } else {
+    uv_poll_stop(&p->handle);
+  }
+}
+
+
+static void on_close(uv_handle_t* handle) {
+  redisLibuvEvents* p = (redisLibuvEvents*)handle->data;
+
+  free(p);
+}
+
+
+static void redisLibuvCleanup(void *privdata) {
+  redisLibuvEvents* p = (redisLibuvEvents*)privdata;
+
+  uv_close((uv_handle_t*)&p->handle, on_close);
+}
+
+
+static int redisLibuvAttach(redisAsyncContext* ac, uv_loop_t* loop) {
+  redisContext *c = &(ac->c);
+
+  if (ac->ev.data != NULL) {
+    return REDIS_ERR;
+  }
+
+  ac->ev.addRead  = redisLibuvAddRead;
+  ac->ev.delRead  = redisLibuvDelRead;
+  ac->ev.addWrite = redisLibuvAddWrite;
+  ac->ev.delWrite = redisLibuvDelWrite;
+  ac->ev.cleanup  = redisLibuvCleanup;
+
+  redisLibuvEvents* p = (redisLibuvEvents*)malloc(sizeof(*p));
+
+  if (!p) {
+    return REDIS_ERR;
+  }
+
+  memset(p, 0, sizeof(*p));
+
+  if (uv_poll_init(loop, &p->handle, c->fd) != 0) {
+    return REDIS_ERR;
+  }
+
+  ac->ev.data    = p;
+  p->handle.data = p;
+  p->context     = ac;
+
+  return REDIS_OK;
+}
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/async.c b/debian/modules/nchan/src/store/redis/hiredis/async.c
new file mode 100644
index 00000000..d955203f
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/async.c
@@ -0,0 +1,687 @@
+/*
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "fmacros.h"
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <assert.h>
+#include <ctype.h>
+#include <errno.h>
+#include "async.h"
+#include "net.h"
+#include "dict.c"
+#include "sds.h"
+
+#define _EL_ADD_READ(ctx) do { \
+        if ((ctx)->ev.addRead) (ctx)->ev.addRead((ctx)->ev.data); \
+    } while(0)
+#define _EL_DEL_READ(ctx) do { \
+        if ((ctx)->ev.delRead) (ctx)->ev.delRead((ctx)->ev.data); \
+    } while(0)
+#define _EL_ADD_WRITE(ctx) do { \
+        if ((ctx)->ev.addWrite) (ctx)->ev.addWrite((ctx)->ev.data); \
+    } while(0)
+#define _EL_DEL_WRITE(ctx) do { \
+        if ((ctx)->ev.delWrite) (ctx)->ev.delWrite((ctx)->ev.data); \
+    } while(0)
+#define _EL_CLEANUP(ctx) do { \
+        if ((ctx)->ev.cleanup) (ctx)->ev.cleanup((ctx)->ev.data); \
+    } while(0);
+
+/* Forward declaration of function in hiredis.c */
+int __redisAppendCommand(redisContext *c, const char *cmd, size_t len);
+
+/* Functions managing dictionary of callbacks for pub/sub. */
+static unsigned int callbackHash(const void *key) {
+    return dictGenHashFunction((const unsigned char *)key,
+                               sdslen((const sds)key));
+}
+
+static void *callbackValDup(void *privdata, const void *src) {
+    ((void) privdata);
+    redisCallback *dup = malloc(sizeof(*dup));
+    memcpy(dup,src,sizeof(*dup));
+    return dup;
+}
+
+static int callbackKeyCompare(void *privdata, const void *key1, const void *key2) {
+    int l1, l2;
+    ((void) privdata);
+
+    l1 = sdslen((const sds)key1);
+    l2 = sdslen((const sds)key2);
+    if (l1 != l2) return 0;
+    return memcmp(key1,key2,l1) == 0;
+}
+
+static void callbackKeyDestructor(void *privdata, void *key) {
+    ((void) privdata);
+    sdsfree((sds)key);
+}
+
+static void callbackValDestructor(void *privdata, void *val) {
+    ((void) privdata);
+    free(val);
+}
+
+static dictType callbackDict = {
+    callbackHash,
+    NULL,
+    callbackValDup,
+    callbackKeyCompare,
+    callbackKeyDestructor,
+    callbackValDestructor
+};
+
+static redisAsyncContext *redisAsyncInitialize(redisContext *c) {
+    redisAsyncContext *ac;
+
+    ac = realloc(c,sizeof(redisAsyncContext));
+    if (ac == NULL)
+        return NULL;
+
+    c = &(ac->c);
+
+    /* The regular connect functions will always set the flag REDIS_CONNECTED.
+     * For the async API, we want to wait until the first write event is
+     * received up before setting this flag, so reset it here. */
+    c->flags &= ~REDIS_CONNECTED;
+
+    ac->err = 0;
+    ac->errstr = NULL;
+    ac->data = NULL;
+
+    ac->ev.data = NULL;
+    ac->ev.addRead = NULL;
+    ac->ev.delRead = NULL;
+    ac->ev.addWrite = NULL;
+    ac->ev.delWrite = NULL;
+    ac->ev.cleanup = NULL;
+
+    ac->onConnect = NULL;
+    ac->onDisconnect = NULL;
+
+    ac->replies.head = NULL;
+    ac->replies.tail = NULL;
+    ac->sub.invalid.head = NULL;
+    ac->sub.invalid.tail = NULL;
+    ac->sub.channels = dictCreate(&callbackDict,NULL);
+    ac->sub.patterns = dictCreate(&callbackDict,NULL);
+    return ac;
+}
+
+/* We want the error field to be accessible directly instead of requiring
+ * an indirection to the redisContext struct. */
+static void __redisAsyncCopyError(redisAsyncContext *ac) {
+    if (!ac)
+        return;
+
+    redisContext *c = &(ac->c);
+    ac->err = c->err;
+    ac->errstr = c->errstr;
+}
+
+redisAsyncContext *redisAsyncConnect(const char *ip, int port) {
+    redisContext *c;
+    redisAsyncContext *ac;
+
+    c = redisConnectNonBlock(ip,port);
+    if (c == NULL)
+        return NULL;
+
+    ac = redisAsyncInitialize(c);
+    if (ac == NULL) {
+        redisFree(c);
+        return NULL;
+    }
+
+    __redisAsyncCopyError(ac);
+    return ac;
+}
+
+redisAsyncContext *redisAsyncConnectBind(const char *ip, int port,
+                                         const char *source_addr) {
+    redisContext *c = redisConnectBindNonBlock(ip,port,source_addr);
+    redisAsyncContext *ac = redisAsyncInitialize(c);
+    __redisAsyncCopyError(ac);
+    return ac;
+}
+
+redisAsyncContext *redisAsyncConnectBindWithReuse(const char *ip, int port,
+                                                  const char *source_addr) {
+    redisContext *c = redisConnectBindNonBlockWithReuse(ip,port,source_addr);
+    redisAsyncContext *ac = redisAsyncInitialize(c);
+    __redisAsyncCopyError(ac);
+    return ac;
+}
+
+redisAsyncContext *redisAsyncConnectUnix(const char *path) {
+    redisContext *c;
+    redisAsyncContext *ac;
+
+    c = redisConnectUnixNonBlock(path);
+    if (c == NULL)
+        return NULL;
+
+    ac = redisAsyncInitialize(c);
+    if (ac == NULL) {
+        redisFree(c);
+        return NULL;
+    }
+
+    __redisAsyncCopyError(ac);
+    return ac;
+}
+
+int redisAsyncSetConnectCallback(redisAsyncContext *ac, redisConnectCallback *fn) {
+    if (ac->onConnect == NULL) {
+        ac->onConnect = fn;
+
+        /* The common way to detect an established connection is to wait for
+         * the first write event to be fired. This assumes the related event
+         * library functions are already set. */
+        _EL_ADD_WRITE(ac);
+        return REDIS_OK;
+    }
+    return REDIS_ERR;
+}
+
+int redisAsyncSetDisconnectCallback(redisAsyncContext *ac, redisDisconnectCallback *fn) {
+    if (ac->onDisconnect == NULL) {
+        ac->onDisconnect = fn;
+        return REDIS_OK;
+    }
+    return REDIS_ERR;
+}
+
+/* Helper functions to push/shift callbacks */
+static int __redisPushCallback(redisCallbackList *list, redisCallback *source) {
+    redisCallback *cb;
+
+    /* Copy callback from stack to heap */
+    cb = malloc(sizeof(*cb));
+    if (cb == NULL)
+        return REDIS_ERR_OOM;
+
+    if (source != NULL) {
+        memcpy(cb,source,sizeof(*cb));
+        cb->next = NULL;
+    }
+
+    /* Store callback in list */
+    if (list->head == NULL)
+        list->head = cb;
+    if (list->tail != NULL)
+        list->tail->next = cb;
+    list->tail = cb;
+    return REDIS_OK;
+}
+
+static int __redisShiftCallback(redisCallbackList *list, redisCallback *target) {
+    redisCallback *cb = list->head;
+    if (cb != NULL) {
+        list->head = cb->next;
+        if (cb == list->tail)
+            list->tail = NULL;
+
+        /* Copy callback from heap to stack */
+        if (target != NULL)
+            memcpy(target,cb,sizeof(*cb));
+        free(cb);
+        return REDIS_OK;
+    }
+    return REDIS_ERR;
+}
+
+static void __redisRunCallback(redisAsyncContext *ac, redisCallback *cb, redisReply *reply) {
+    redisContext *c = &(ac->c);
+    if (cb->fn != NULL) {
+        c->flags |= REDIS_IN_CALLBACK;
+        cb->fn(ac,reply,cb->privdata);
+        c->flags &= ~REDIS_IN_CALLBACK;
+    }
+}
+
+/* Helper function to free the context. */
+static void __redisAsyncFree(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+    redisCallback cb;
+    dictIterator *it;
+    dictEntry *de;
+
+    /* Execute pending callbacks with NULL reply. */
+    while (__redisShiftCallback(&ac->replies,&cb) == REDIS_OK)
+        __redisRunCallback(ac,&cb,NULL);
+
+    /* Execute callbacks for invalid commands */
+    while (__redisShiftCallback(&ac->sub.invalid,&cb) == REDIS_OK)
+        __redisRunCallback(ac,&cb,NULL);
+
+    /* Run subscription callbacks callbacks with NULL reply */
+    it = dictGetIterator(ac->sub.channels);
+    while ((de = dictNext(it)) != NULL)
+        __redisRunCallback(ac,dictGetEntryVal(de),NULL);
+    dictReleaseIterator(it);
+    dictRelease(ac->sub.channels);
+
+    it = dictGetIterator(ac->sub.patterns);
+    while ((de = dictNext(it)) != NULL)
+        __redisRunCallback(ac,dictGetEntryVal(de),NULL);
+    dictReleaseIterator(it);
+    dictRelease(ac->sub.patterns);
+
+    /* Signal event lib to clean up */
+    _EL_CLEANUP(ac);
+
+    /* Execute disconnect callback. When redisAsyncFree() initiated destroying
+     * this context, the status will always be REDIS_OK. */
+    if (ac->onDisconnect && (c->flags & REDIS_CONNECTED)) {
+        if (c->flags & REDIS_FREEING) {
+            ac->onDisconnect(ac,REDIS_OK);
+        } else {
+            ac->onDisconnect(ac,(ac->err == 0) ? REDIS_OK : REDIS_ERR);
+        }
+    }
+
+    /* Cleanup self */
+    redisFree(c);
+}
+
+/* Free the async context. When this function is called from a callback,
+ * control needs to be returned to redisProcessCallbacks() before actual
+ * free'ing. To do so, a flag is set on the context which is picked up by
+ * redisProcessCallbacks(). Otherwise, the context is immediately free'd. */
+void redisAsyncFree(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+    c->flags |= REDIS_FREEING;
+    if (!(c->flags & REDIS_IN_CALLBACK))
+        __redisAsyncFree(ac);
+}
+
+/* Helper function to make the disconnect happen and clean up. */
+static void __redisAsyncDisconnect(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+
+    /* Make sure error is accessible if there is any */
+    __redisAsyncCopyError(ac);
+
+    if (ac->err == 0) {
+        /* For clean disconnects, there should be no pending callbacks. */
+        assert(__redisShiftCallback(&ac->replies,NULL) == REDIS_ERR);
+    } else {
+        /* Disconnection is caused by an error, make sure that pending
+         * callbacks cannot call new commands. */
+        c->flags |= REDIS_DISCONNECTING;
+    }
+
+    /* For non-clean disconnects, __redisAsyncFree() will execute pending
+     * callbacks with a NULL-reply. */
+    __redisAsyncFree(ac);
+}
+
+/* Tries to do a clean disconnect from Redis, meaning it stops new commands
+ * from being issued, but tries to flush the output buffer and execute
+ * callbacks for all remaining replies. When this function is called from a
+ * callback, there might be more replies and we can safely defer disconnecting
+ * to redisProcessCallbacks(). Otherwise, we can only disconnect immediately
+ * when there are no pending callbacks. */
+void redisAsyncDisconnect(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+    c->flags |= REDIS_DISCONNECTING;
+    if (!(c->flags & REDIS_IN_CALLBACK) && ac->replies.head == NULL)
+        __redisAsyncDisconnect(ac);
+}
+
+static int __redisGetSubscribeCallback(redisAsyncContext *ac, redisReply *reply, redisCallback *dstcb) {
+    redisContext *c = &(ac->c);
+    dict *callbacks;
+    dictEntry *de;
+    int pvariant;
+    char *stype;
+    sds sname;
+
+    /* Custom reply functions are not supported for pub/sub. This will fail
+     * very hard when they are used... */
+    if (reply->type == REDIS_REPLY_ARRAY) {
+        assert(reply->elements >= 2);
+        assert(reply->element[0]->type == REDIS_REPLY_STRING);
+        stype = reply->element[0]->str;
+        pvariant = (tolower(stype[0]) == 'p') ? 1 : 0;
+
+        if (pvariant)
+            callbacks = ac->sub.patterns;
+        else
+            callbacks = ac->sub.channels;
+
+        /* Locate the right callback */
+        assert(reply->element[1]->type == REDIS_REPLY_STRING);
+        sname = sdsnewlen(reply->element[1]->str,reply->element[1]->len);
+        de = dictFind(callbacks,sname);
+        if (de != NULL) {
+            memcpy(dstcb,dictGetEntryVal(de),sizeof(*dstcb));
+
+            /* If this is an unsubscribe message, remove it. */
+            if (strcasecmp(stype+pvariant,"unsubscribe") == 0) {
+                dictDelete(callbacks,sname);
+
+                /* If this was the last unsubscribe message, revert to
+                 * non-subscribe mode. */
+                assert(reply->element[2]->type == REDIS_REPLY_INTEGER);
+                if (reply->element[2]->integer == 0)
+                    c->flags &= ~REDIS_SUBSCRIBED;
+            }
+        }
+        sdsfree(sname);
+    } else {
+        /* Shift callback for invalid commands. */
+        __redisShiftCallback(&ac->sub.invalid,dstcb);
+    }
+    return REDIS_OK;
+}
+
+void redisProcessCallbacks(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+    redisCallback cb = {NULL, NULL, NULL};
+    void *reply = NULL;
+    int status;
+
+    while((status = redisGetReply(c,&reply)) == REDIS_OK) {
+        if (reply == NULL) {
+            /* When the connection is being disconnected and there are
+             * no more replies, this is the cue to really disconnect. */
+            if (c->flags & REDIS_DISCONNECTING && sdslen(c->obuf) == 0
+                && ac->replies.head == NULL) {
+                __redisAsyncDisconnect(ac);
+                return;
+            }
+
+            /* If monitor mode, repush callback */
+            if(c->flags & REDIS_MONITORING) {
+                __redisPushCallback(&ac->replies,&cb);
+            }
+
+            /* When the connection is not being disconnected, simply stop
+             * trying to get replies and wait for the next loop tick. */
+            break;
+        }
+
+        /* Even if the context is subscribed, pending regular callbacks will
+         * get a reply before pub/sub messages arrive. */
+        if (__redisShiftCallback(&ac->replies,&cb) != REDIS_OK) {
+            /*
+             * A spontaneous reply in a not-subscribed context can be the error
+             * reply that is sent when a new connection exceeds the maximum
+             * number of allowed connections on the server side.
+             *
+             * This is seen as an error instead of a regular reply because the
+             * server closes the connection after sending it.
+             *
+             * To prevent the error from being overwritten by an EOF error the
+             * connection is closed here. See issue #43.
+             *
+             * Another possibility is that the server is loading its dataset.
+             * In this case we also want to close the connection, and have the
+             * user wait until the server is ready to take our request.
+             */
+            if (((redisReply*)reply)->type == REDIS_REPLY_ERROR) {
+                c->err = REDIS_ERR_OTHER;
+                snprintf(c->errstr,sizeof(c->errstr),"%s",((redisReply*)reply)->str);
+                c->reader->fn->freeObject(reply);
+                __redisAsyncDisconnect(ac);
+                return;
+            }
+            /* No more regular callbacks and no errors, the context *must* be subscribed or monitoring. */
+            assert((c->flags & REDIS_SUBSCRIBED || c->flags & REDIS_MONITORING));
+            if(c->flags & REDIS_SUBSCRIBED)
+                __redisGetSubscribeCallback(ac,reply,&cb);
+        }
+
+        if (cb.fn != NULL) {
+            __redisRunCallback(ac,&cb,reply);
+            c->reader->fn->freeObject(reply);
+
+            /* Proceed with free'ing when redisAsyncFree() was called. */
+            if (c->flags & REDIS_FREEING) {
+                __redisAsyncFree(ac);
+                return;
+            }
+        } else {
+            /* No callback for this reply. This can either be a NULL callback,
+             * or there were no callbacks to begin with. Either way, don't
+             * abort with an error, but simply ignore it because the client
+             * doesn't know what the server will spit out over the wire. */
+            c->reader->fn->freeObject(reply);
+        }
+    }
+
+    /* Disconnect when there was an error reading the reply */
+    if (status != REDIS_OK)
+        __redisAsyncDisconnect(ac);
+}
+
+/* Internal helper function to detect socket status the first time a read or
+ * write event fires. When connecting was not successful, the connect callback
+ * is called with a REDIS_ERR status and the context is free'd. */
+static int __redisAsyncHandleConnect(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+
+    if (redisCheckSocketError(c) == REDIS_ERR) {
+        /* Try again later when connect(2) is still in progress. */
+        if (errno == EINPROGRESS)
+            return REDIS_OK;
+
+        if (ac->onConnect) ac->onConnect(ac,REDIS_ERR);
+        __redisAsyncDisconnect(ac);
+        return REDIS_ERR;
+    }
+
+    /* Mark context as connected. */
+    c->flags |= REDIS_CONNECTED;
+    if (ac->onConnect) ac->onConnect(ac,REDIS_OK);
+    return REDIS_OK;
+}
+
+/* This function should be called when the socket is readable.
+ * It processes all replies that can be read and executes their callbacks.
+ */
+void redisAsyncHandleRead(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+
+    if (!(c->flags & REDIS_CONNECTED)) {
+        /* Abort connect was not successful. */
+        if (__redisAsyncHandleConnect(ac) != REDIS_OK)
+            return;
+        /* Try again later when the context is still not connected. */
+        if (!(c->flags & REDIS_CONNECTED))
+            return;
+    }
+
+    if (redisBufferRead(c) == REDIS_ERR) {
+        __redisAsyncDisconnect(ac);
+    } else {
+        /* Always re-schedule reads */
+        _EL_ADD_READ(ac);
+        redisProcessCallbacks(ac);
+    }
+}
+
+void redisAsyncHandleWrite(redisAsyncContext *ac) {
+    redisContext *c = &(ac->c);
+    int done = 0;
+
+    if (!(c->flags & REDIS_CONNECTED)) {
+        /* Abort connect was not successful. */
+        if (__redisAsyncHandleConnect(ac) != REDIS_OK)
+            return;
+        /* Try again later when the context is still not connected. */
+        if (!(c->flags & REDIS_CONNECTED))
+            return;
+    }
+
+    if (redisBufferWrite(c,&done) == REDIS_ERR) {
+        __redisAsyncDisconnect(ac);
+    } else {
+        /* Continue writing when not done, stop writing otherwise */
+        if (!done)
+            _EL_ADD_WRITE(ac);
+        else
+            _EL_DEL_WRITE(ac);
+
+        /* Always schedule reads after writes */
+        _EL_ADD_READ(ac);
+    }
+}
+
+/* Sets a pointer to the first argument and its length starting at p. Returns
+ * the number of bytes to skip to get to the following argument. */
+static const char *nextArgument(const char *start, const char **str, size_t *len) {
+    const char *p = start;
+    if (p[0] != '$') {
+        p = strchr(p,'$');
+        if (p == NULL) return NULL;
+    }
+
+    *len = (int)strtol(p+1,NULL,10);
+    p = strchr(p,'\r');
+    assert(p);
+    *str = p+2;
+    return p+2+(*len)+2;
+}
+
+/* Helper function for the redisAsyncCommand* family of functions. Writes a
+ * formatted command to the output buffer and registers the provided callback
+ * function with the context. */
+static int __redisAsyncCommand(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, const char *cmd, size_t len) {
+    redisContext *c = &(ac->c);
+    redisCallback cb;
+    int pvariant, hasnext;
+    const char *cstr, *astr;
+    size_t clen, alen;
+    const char *p;
+    sds sname;
+    int ret;
+
+    /* Don't accept new commands when the connection is about to be closed. */
+    if (c->flags & (REDIS_DISCONNECTING | REDIS_FREEING)) return REDIS_ERR;
+
+    /* Setup callback */
+    cb.fn = fn;
+    cb.privdata = privdata;
+
+    /* Find out which command will be appended. */
+    p = nextArgument(cmd,&cstr,&clen);
+    assert(p != NULL);
+    hasnext = (p[0] == '$');
+    pvariant = (tolower(cstr[0]) == 'p') ? 1 : 0;
+    cstr += pvariant;
+    clen -= pvariant;
+
+    if (hasnext && strncasecmp(cstr,"subscribe\r\n",11) == 0) {
+        c->flags |= REDIS_SUBSCRIBED;
+
+        /* Add every channel/pattern to the list of subscription callbacks. */
+        while ((p = nextArgument(p,&astr,&alen)) != NULL) {
+            sname = sdsnewlen(astr,alen);
+            if (pvariant)
+                ret = dictReplace(ac->sub.patterns,sname,&cb);
+            else
+                ret = dictReplace(ac->sub.channels,sname,&cb);
+
+            if (ret == 0) sdsfree(sname);
+        }
+    } else if (strncasecmp(cstr,"unsubscribe\r\n",13) == 0) {
+        /* It is only useful to call (P)UNSUBSCRIBE when the context is
+         * subscribed to one or more channels or patterns. */
+        if (!(c->flags & REDIS_SUBSCRIBED)) return REDIS_ERR;
+
+        /* (P)UNSUBSCRIBE does not have its own response: every channel or
+         * pattern that is unsubscribed will receive a message. This means we
+         * should not append a callback function for this command. */
+     } else if(strncasecmp(cstr,"monitor\r\n",9) == 0) {
+         /* Set monitor flag and push callback */
+         c->flags |= REDIS_MONITORING;
+         __redisPushCallback(&ac->replies,&cb);
+    } else {
+        if (c->flags & REDIS_SUBSCRIBED)
+            /* This will likely result in an error reply, but it needs to be
+             * received and passed to the callback. */
+            __redisPushCallback(&ac->sub.invalid,&cb);
+        else
+            __redisPushCallback(&ac->replies,&cb);
+    }
+
+    __redisAppendCommand(c,cmd,len);
+
+    /* Always schedule a write when the write buffer is non-empty */
+    _EL_ADD_WRITE(ac);
+
+    return REDIS_OK;
+}
+
+int redisvAsyncCommand(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, const char *format, va_list ap) {
+    char *cmd;
+    int len;
+    int status;
+    len = redisvFormatCommand(&cmd,format,ap);
+
+    /* We don't want to pass -1 or -2 to future functions as a length. */
+    if (len < 0)
+        return REDIS_ERR;
+
+    status = __redisAsyncCommand(ac,fn,privdata,cmd,len);
+    free(cmd);
+    return status;
+}
+
+int redisAsyncCommand(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, const char *format, ...) {
+    va_list ap;
+    int status;
+    va_start(ap,format);
+    status = redisvAsyncCommand(ac,fn,privdata,format,ap);
+    va_end(ap);
+    return status;
+}
+
+int redisAsyncCommandArgv(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, int argc, const char **argv, const size_t *argvlen) {
+    sds cmd;
+    int len;
+    int status;
+    len = redisFormatSdsCommandArgv(&cmd,argc,argv,argvlen);
+    status = __redisAsyncCommand(ac,fn,privdata,cmd,len);
+    sdsfree(cmd);
+    return status;
+}
+
+int redisAsyncFormattedCommand(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, const char *cmd, size_t len) {
+    int status = __redisAsyncCommand(ac,fn,privdata,cmd,len);
+    return status;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/async.h b/debian/modules/nchan/src/store/redis/hiredis/async.h
new file mode 100644
index 00000000..59cbf469
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/async.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __HIREDIS_ASYNC_H
+#define __HIREDIS_ASYNC_H
+#include "hiredis.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct redisAsyncContext; /* need forward declaration of redisAsyncContext */
+struct dict; /* dictionary header is included in async.c */
+
+/* Reply callback prototype and container */
+typedef void (redisCallbackFn)(struct redisAsyncContext*, void*, void*);
+typedef struct redisCallback {
+    struct redisCallback *next; /* simple singly linked list */
+    redisCallbackFn *fn;
+    void *privdata;
+} redisCallback;
+
+/* List of callbacks for either regular replies or pub/sub */
+typedef struct redisCallbackList {
+    redisCallback *head, *tail;
+} redisCallbackList;
+
+/* Connection callback prototypes */
+typedef void (redisDisconnectCallback)(const struct redisAsyncContext*, int status);
+typedef void (redisConnectCallback)(const struct redisAsyncContext*, int status);
+
+/* Context for an async connection to Redis */
+typedef struct redisAsyncContext {
+    /* Hold the regular context, so it can be realloc'ed. */
+    redisContext c;
+
+    /* Setup error flags so they can be used directly. */
+    int err;
+    char *errstr;
+
+    /* Not used by hiredis */
+    void *data;
+
+    /* Event library data and hooks */
+    struct {
+        void *data;
+
+        /* Hooks that are called when the library expects to start
+         * reading/writing. These functions should be idempotent. */
+        void (*addRead)(void *privdata);
+        void (*delRead)(void *privdata);
+        void (*addWrite)(void *privdata);
+        void (*delWrite)(void *privdata);
+        void (*cleanup)(void *privdata);
+    } ev;
+
+    /* Called when either the connection is terminated due to an error or per
+     * user request. The status is set accordingly (REDIS_OK, REDIS_ERR). */
+    redisDisconnectCallback *onDisconnect;
+
+    /* Called when the first write event was received. */
+    redisConnectCallback *onConnect;
+
+    /* Regular command callbacks */
+    redisCallbackList replies;
+
+    /* Subscription callbacks */
+    struct {
+        redisCallbackList invalid;
+        struct dict *channels;
+        struct dict *patterns;
+    } sub;
+} redisAsyncContext;
+
+/* Functions that proxy to hiredis */
+redisAsyncContext *redisAsyncConnect(const char *ip, int port);
+redisAsyncContext *redisAsyncConnectBind(const char *ip, int port, const char *source_addr);
+redisAsyncContext *redisAsyncConnectBindWithReuse(const char *ip, int port,
+                                                  const char *source_addr);
+redisAsyncContext *redisAsyncConnectUnix(const char *path);
+int redisAsyncSetConnectCallback(redisAsyncContext *ac, redisConnectCallback *fn);
+int redisAsyncSetDisconnectCallback(redisAsyncContext *ac, redisDisconnectCallback *fn);
+void redisAsyncDisconnect(redisAsyncContext *ac);
+void redisAsyncFree(redisAsyncContext *ac);
+
+/* Handle read/write events */
+void redisAsyncHandleRead(redisAsyncContext *ac);
+void redisAsyncHandleWrite(redisAsyncContext *ac);
+
+/* Command functions for an async context. Write the command to the
+ * output buffer and register the provided callback. */
+int redisvAsyncCommand(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, const char *format, va_list ap);
+int redisAsyncCommand(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, const char *format, ...);
+int redisAsyncCommandArgv(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, int argc, const char **argv, const size_t *argvlen);
+int redisAsyncFormattedCommand(redisAsyncContext *ac, redisCallbackFn *fn, void *privdata, const char *cmd, size_t len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/dict.c b/debian/modules/nchan/src/store/redis/hiredis/dict.c
new file mode 100644
index 00000000..e17a6254
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/dict.c
@@ -0,0 +1,338 @@
+/* Hash table implementation.
+ *
+ * This file implements in memory hash tables with insert/del/replace/find/
+ * get-random-element operations. Hash tables will auto resize if needed
+ * tables of power of two in size are used, collisions are handled by
+ * chaining. See the source code for more information... :)
+ *
+ * Copyright (c) 2006-2010, Salvatore Sanfilippo <antirez at gmail dot com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "fmacros.h"
+#include <stdlib.h>
+#include <assert.h>
+#include <limits.h>
+#include "dict.h"
+
+/* -------------------------- private prototypes ---------------------------- */
+
+static int _dictExpandIfNeeded(dict *ht);
+static unsigned long _dictNextPower(unsigned long size);
+static int _dictKeyIndex(dict *ht, const void *key);
+static int _dictInit(dict *ht, dictType *type, void *privDataPtr);
+
+/* -------------------------- hash functions -------------------------------- */
+
+/* Generic hash function (a popular one from Bernstein).
+ * I tested a few and this was the best. */
+static unsigned int dictGenHashFunction(const unsigned char *buf, int len) {
+    unsigned int hash = 5381;
+
+    while (len--)
+        hash = ((hash << 5) + hash) + (*buf++); /* hash * 33 + c */
+    return hash;
+}
+
+/* ----------------------------- API implementation ------------------------- */
+
+/* Reset an hashtable already initialized with ht_init().
+ * NOTE: This function should only called by ht_destroy(). */
+static void _dictReset(dict *ht) {
+    ht->table = NULL;
+    ht->size = 0;
+    ht->sizemask = 0;
+    ht->used = 0;
+}
+
+/* Create a new hash table */
+static dict *dictCreate(dictType *type, void *privDataPtr) {
+    dict *ht = malloc(sizeof(*ht));
+    _dictInit(ht,type,privDataPtr);
+    return ht;
+}
+
+/* Initialize the hash table */
+static int _dictInit(dict *ht, dictType *type, void *privDataPtr) {
+    _dictReset(ht);
+    ht->type = type;
+    ht->privdata = privDataPtr;
+    return DICT_OK;
+}
+
+/* Expand or create the hashtable */
+static int dictExpand(dict *ht, unsigned long size) {
+    dict n; /* the new hashtable */
+    unsigned long realsize = _dictNextPower(size), i;
+
+    /* the size is invalid if it is smaller than the number of
+     * elements already inside the hashtable */
+    if (ht->used > size)
+        return DICT_ERR;
+
+    _dictInit(&n, ht->type, ht->privdata);
+    n.size = realsize;
+    n.sizemask = realsize-1;
+    n.table = calloc(realsize,sizeof(dictEntry*));
+
+    /* Copy all the elements from the old to the new table:
+     * note that if the old hash table is empty ht->size is zero,
+     * so dictExpand just creates an hash table. */
+    n.used = ht->used;
+    for (i = 0; i < ht->size && ht->used > 0; i++) {
+        dictEntry *he, *nextHe;
+
+        if (ht->table[i] == NULL) continue;
+
+        /* For each hash entry on this slot... */
+        he = ht->table[i];
+        while(he) {
+            unsigned int h;
+
+            nextHe = he->next;
+            /* Get the new element index */
+            h = dictHashKey(ht, he->key) & n.sizemask;
+            he->next = n.table[h];
+            n.table[h] = he;
+            ht->used--;
+            /* Pass to the next element */
+            he = nextHe;
+        }
+    }
+    assert(ht->used == 0);
+    free(ht->table);
+
+    /* Remap the new hashtable in the old */
+    *ht = n;
+    return DICT_OK;
+}
+
+/* Add an element to the target hash table */
+static int dictAdd(dict *ht, void *key, void *val) {
+    int index;
+    dictEntry *entry;
+
+    /* Get the index of the new element, or -1 if
+     * the element already exists. */
+    if ((index = _dictKeyIndex(ht, key)) == -1)
+        return DICT_ERR;
+
+    /* Allocates the memory and stores key */
+    entry = malloc(sizeof(*entry));
+    entry->next = ht->table[index];
+    ht->table[index] = entry;
+
+    /* Set the hash entry fields. */
+    dictSetHashKey(ht, entry, key);
+    dictSetHashVal(ht, entry, val);
+    ht->used++;
+    return DICT_OK;
+}
+
+/* Add an element, discarding the old if the key already exists.
+ * Return 1 if the key was added from scratch, 0 if there was already an
+ * element with such key and dictReplace() just performed a value update
+ * operation. */
+static int dictReplace(dict *ht, void *key, void *val) {
+    dictEntry *entry, auxentry;
+
+    /* Try to add the element. If the key
+     * does not exists dictAdd will succeed. */
+    if (dictAdd(ht, key, val) == DICT_OK)
+        return 1;
+    /* It already exists, get the entry */
+    entry = dictFind(ht, key);
+    /* Free the old value and set the new one */
+    /* Set the new value and free the old one. Note that it is important
+     * to do that in this order, as the value may just be exactly the same
+     * as the previous one. In this context, think to reference counting,
+     * you want to increment (set), and then decrement (free), and not the
+     * reverse. */
+    auxentry = *entry;
+    dictSetHashVal(ht, entry, val);
+    dictFreeEntryVal(ht, &auxentry);
+    return 0;
+}
+
+/* Search and remove an element */
+static int dictDelete(dict *ht, const void *key) {
+    unsigned int h;
+    dictEntry *de, *prevde;
+
+    if (ht->size == 0)
+        return DICT_ERR;
+    h = dictHashKey(ht, key) & ht->sizemask;
+    de = ht->table[h];
+
+    prevde = NULL;
+    while(de) {
+        if (dictCompareHashKeys(ht,key,de->key)) {
+            /* Unlink the element from the list */
+            if (prevde)
+                prevde->next = de->next;
+            else
+                ht->table[h] = de->next;
+
+            dictFreeEntryKey(ht,de);
+            dictFreeEntryVal(ht,de);
+            free(de);
+            ht->used--;
+            return DICT_OK;
+        }
+        prevde = de;
+        de = de->next;
+    }
+    return DICT_ERR; /* not found */
+}
+
+/* Destroy an entire hash table */
+static int _dictClear(dict *ht) {
+    unsigned long i;
+
+    /* Free all the elements */
+    for (i = 0; i < ht->size && ht->used > 0; i++) {
+        dictEntry *he, *nextHe;
+
+        if ((he = ht->table[i]) == NULL) continue;
+        while(he) {
+            nextHe = he->next;
+            dictFreeEntryKey(ht, he);
+            dictFreeEntryVal(ht, he);
+            free(he);
+            ht->used--;
+            he = nextHe;
+        }
+    }
+    /* Free the table and the allocated cache structure */
+    free(ht->table);
+    /* Re-initialize the table */
+    _dictReset(ht);
+    return DICT_OK; /* never fails */
+}
+
+/* Clear & Release the hash table */
+static void dictRelease(dict *ht) {
+    _dictClear(ht);
+    free(ht);
+}
+
+static dictEntry *dictFind(dict *ht, const void *key) {
+    dictEntry *he;
+    unsigned int h;
+
+    if (ht->size == 0) return NULL;
+    h = dictHashKey(ht, key) & ht->sizemask;
+    he = ht->table[h];
+    while(he) {
+        if (dictCompareHashKeys(ht, key, he->key))
+            return he;
+        he = he->next;
+    }
+    return NULL;
+}
+
+static dictIterator *dictGetIterator(dict *ht) {
+    dictIterator *iter = malloc(sizeof(*iter));
+
+    iter->ht = ht;
+    iter->index = -1;
+    iter->entry = NULL;
+    iter->nextEntry = NULL;
+    return iter;
+}
+
+static dictEntry *dictNext(dictIterator *iter) {
+    while (1) {
+        if (iter->entry == NULL) {
+            iter->index++;
+            if (iter->index >=
+                    (signed)iter->ht->size) break;
+            iter->entry = iter->ht->table[iter->index];
+        } else {
+            iter->entry = iter->nextEntry;
+        }
+        if (iter->entry) {
+            /* We need to save the 'next' here, the iterator user
+             * may delete the entry we are returning. */
+            iter->nextEntry = iter->entry->next;
+            return iter->entry;
+        }
+    }
+    return NULL;
+}
+
+static void dictReleaseIterator(dictIterator *iter) {
+    free(iter);
+}
+
+/* ------------------------- private functions ------------------------------ */
+
+/* Expand the hash table if needed */
+static int _dictExpandIfNeeded(dict *ht) {
+    /* If the hash table is empty expand it to the initial size,
+     * if the table is "full" dobule its size. */
+    if (ht->size == 0)
+        return dictExpand(ht, DICT_HT_INITIAL_SIZE);
+    if (ht->used == ht->size)
+        return dictExpand(ht, ht->size*2);
+    return DICT_OK;
+}
+
+/* Our hash table capability is a power of two */
+static unsigned long _dictNextPower(unsigned long size) {
+    unsigned long i = DICT_HT_INITIAL_SIZE;
+
+    if (size >= LONG_MAX) return LONG_MAX;
+    while(1) {
+        if (i >= size)
+            return i;
+        i *= 2;
+    }
+}
+
+/* Returns the index of a free slot that can be populated with
+ * an hash entry for the given 'key'.
+ * If the key already exists, -1 is returned. */
+static int _dictKeyIndex(dict *ht, const void *key) {
+    unsigned int h;
+    dictEntry *he;
+
+    /* Expand the hashtable if needed */
+    if (_dictExpandIfNeeded(ht) == DICT_ERR)
+        return -1;
+    /* Compute the key hash value */
+    h = dictHashKey(ht, key) & ht->sizemask;
+    /* Search if this slot does not already contain the given key */
+    he = ht->table[h];
+    while(he) {
+        if (dictCompareHashKeys(ht, key, he->key))
+            return -1;
+        he = he->next;
+    }
+    return h;
+}
+
diff --git a/debian/modules/nchan/src/store/redis/hiredis/dict.h b/debian/modules/nchan/src/store/redis/hiredis/dict.h
new file mode 100644
index 00000000..95fcd280
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/dict.h
@@ -0,0 +1,126 @@
+/* Hash table implementation.
+ *
+ * This file implements in memory hash tables with insert/del/replace/find/
+ * get-random-element operations. Hash tables will auto resize if needed
+ * tables of power of two in size are used, collisions are handled by
+ * chaining. See the source code for more information... :)
+ *
+ * Copyright (c) 2006-2010, Salvatore Sanfilippo <antirez at gmail dot com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __DICT_H
+#define __DICT_H
+
+#define DICT_OK 0
+#define DICT_ERR 1
+
+/* Unused arguments generate annoying warnings... */
+#define DICT_NOTUSED(V) ((void) V)
+
+typedef struct dictEntry {
+    void *key;
+    void *val;
+    struct dictEntry *next;
+} dictEntry;
+
+typedef struct dictType {
+    unsigned int (*hashFunction)(const void *key);
+    void *(*keyDup)(void *privdata, const void *key);
+    void *(*valDup)(void *privdata, const void *obj);
+    int (*keyCompare)(void *privdata, const void *key1, const void *key2);
+    void (*keyDestructor)(void *privdata, void *key);
+    void (*valDestructor)(void *privdata, void *obj);
+} dictType;
+
+typedef struct dict {
+    dictEntry **table;
+    dictType *type;
+    unsigned long size;
+    unsigned long sizemask;
+    unsigned long used;
+    void *privdata;
+} dict;
+
+typedef struct dictIterator {
+    dict *ht;
+    int index;
+    dictEntry *entry, *nextEntry;
+} dictIterator;
+
+/* This is the initial size of every hash table */
+#define DICT_HT_INITIAL_SIZE     4
+
+/* ------------------------------- Macros ------------------------------------*/
+#define dictFreeEntryVal(ht, entry) \
+    if ((ht)->type->valDestructor) \
+        (ht)->type->valDestructor((ht)->privdata, (entry)->val)
+
+#define dictSetHashVal(ht, entry, _val_) do { \
+    if ((ht)->type->valDup) \
+        entry->val = (ht)->type->valDup((ht)->privdata, _val_); \
+    else \
+        entry->val = (_val_); \
+} while(0)
+
+#define dictFreeEntryKey(ht, entry) \
+    if ((ht)->type->keyDestructor) \
+        (ht)->type->keyDestructor((ht)->privdata, (entry)->key)
+
+#define dictSetHashKey(ht, entry, _key_) do { \
+    if ((ht)->type->keyDup) \
+        entry->key = (ht)->type->keyDup((ht)->privdata, _key_); \
+    else \
+        entry->key = (_key_); \
+} while(0)
+
+#define dictCompareHashKeys(ht, key1, key2) \
+    (((ht)->type->keyCompare) ? \
+        (ht)->type->keyCompare((ht)->privdata, key1, key2) : \
+        (key1) == (key2))
+
+#define dictHashKey(ht, key) (ht)->type->hashFunction(key)
+
+#define dictGetEntryKey(he) ((he)->key)
+#define dictGetEntryVal(he) ((he)->val)
+#define dictSlots(ht) ((ht)->size)
+#define dictSize(ht) ((ht)->used)
+
+/* API */
+static unsigned int dictGenHashFunction(const unsigned char *buf, int len);
+static dict *dictCreate(dictType *type, void *privDataPtr);
+static int dictExpand(dict *ht, unsigned long size);
+static int dictAdd(dict *ht, void *key, void *val);
+static int dictReplace(dict *ht, void *key, void *val);
+static int dictDelete(dict *ht, const void *key);
+static void dictRelease(dict *ht);
+static dictEntry * dictFind(dict *ht, const void *key);
+static dictIterator *dictGetIterator(dict *ht);
+static dictEntry *dictNext(dictIterator *iter);
+static void dictReleaseIterator(dictIterator *iter);
+
+#endif /* __DICT_H */
diff --git a/debian/modules/nchan/src/store/redis/hiredis/examples/example-ae.c b/debian/modules/nchan/src/store/redis/hiredis/examples/example-ae.c
new file mode 100644
index 00000000..8efa7306
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/examples/example-ae.c
@@ -0,0 +1,62 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <signal.h>
+
+#include <hiredis.h>
+#include <async.h>
+#include <adapters/ae.h>
+
+/* Put event loop in the global scope, so it can be explicitly stopped */
+static aeEventLoop *loop;
+
+void getCallback(redisAsyncContext *c, void *r, void *privdata) {
+    redisReply *reply = r;
+    if (reply == NULL) return;
+    printf("argv[%s]: %s\n", (char*)privdata, reply->str);
+
+    /* Disconnect after receiving the reply to GET */
+    redisAsyncDisconnect(c);
+}
+
+void connectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        aeStop(loop);
+        return;
+    }
+
+    printf("Connected...\n");
+}
+
+void disconnectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        aeStop(loop);
+        return;
+    }
+
+    printf("Disconnected...\n");
+    aeStop(loop);
+}
+
+int main (int argc, char **argv) {
+    signal(SIGPIPE, SIG_IGN);
+
+    redisAsyncContext *c = redisAsyncConnect("127.0.0.1", 6379);
+    if (c->err) {
+        /* Let *c leak for now... */
+        printf("Error: %s\n", c->errstr);
+        return 1;
+    }
+
+    loop = aeCreateEventLoop(64);
+    redisAeAttach(loop, c);
+    redisAsyncSetConnectCallback(c,connectCallback);
+    redisAsyncSetDisconnectCallback(c,disconnectCallback);
+    redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
+    redisAsyncCommand(c, getCallback, (char*)"end-1", "GET key");
+    aeMain(loop);
+    return 0;
+}
+
diff --git a/debian/modules/nchan/src/store/redis/hiredis/examples/example-libev.c b/debian/modules/nchan/src/store/redis/hiredis/examples/example-libev.c
new file mode 100644
index 00000000..cc8b166e
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/examples/example-libev.c
@@ -0,0 +1,52 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <signal.h>
+
+#include <hiredis.h>
+#include <async.h>
+#include <adapters/libev.h>
+
+void getCallback(redisAsyncContext *c, void *r, void *privdata) {
+    redisReply *reply = r;
+    if (reply == NULL) return;
+    printf("argv[%s]: %s\n", (char*)privdata, reply->str);
+
+    /* Disconnect after receiving the reply to GET */
+    redisAsyncDisconnect(c);
+}
+
+void connectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        return;
+    }
+    printf("Connected...\n");
+}
+
+void disconnectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        return;
+    }
+    printf("Disconnected...\n");
+}
+
+int main (int argc, char **argv) {
+    signal(SIGPIPE, SIG_IGN);
+
+    redisAsyncContext *c = redisAsyncConnect("127.0.0.1", 6379);
+    if (c->err) {
+        /* Let *c leak for now... */
+        printf("Error: %s\n", c->errstr);
+        return 1;
+    }
+
+    redisLibevAttach(EV_DEFAULT_ c);
+    redisAsyncSetConnectCallback(c,connectCallback);
+    redisAsyncSetDisconnectCallback(c,disconnectCallback);
+    redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
+    redisAsyncCommand(c, getCallback, (char*)"end-1", "GET key");
+    ev_loop(EV_DEFAULT_ 0);
+    return 0;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/examples/example-libevent.c b/debian/modules/nchan/src/store/redis/hiredis/examples/example-libevent.c
new file mode 100644
index 00000000..d333c22b
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/examples/example-libevent.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <signal.h>
+
+#include <hiredis.h>
+#include <async.h>
+#include <adapters/libevent.h>
+
+void getCallback(redisAsyncContext *c, void *r, void *privdata) {
+    redisReply *reply = r;
+    if (reply == NULL) return;
+    printf("argv[%s]: %s\n", (char*)privdata, reply->str);
+
+    /* Disconnect after receiving the reply to GET */
+    redisAsyncDisconnect(c);
+}
+
+void connectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        return;
+    }
+    printf("Connected...\n");
+}
+
+void disconnectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        return;
+    }
+    printf("Disconnected...\n");
+}
+
+int main (int argc, char **argv) {
+    signal(SIGPIPE, SIG_IGN);
+    struct event_base *base = event_base_new();
+
+    redisAsyncContext *c = redisAsyncConnect("127.0.0.1", 6379);
+    if (c->err) {
+        /* Let *c leak for now... */
+        printf("Error: %s\n", c->errstr);
+        return 1;
+    }
+
+    redisLibeventAttach(c,base);
+    redisAsyncSetConnectCallback(c,connectCallback);
+    redisAsyncSetDisconnectCallback(c,disconnectCallback);
+    redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
+    redisAsyncCommand(c, getCallback, (char*)"end-1", "GET key");
+    event_base_dispatch(base);
+    return 0;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/examples/example-libuv.c b/debian/modules/nchan/src/store/redis/hiredis/examples/example-libuv.c
new file mode 100644
index 00000000..a5462d41
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/examples/example-libuv.c
@@ -0,0 +1,53 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <signal.h>
+
+#include <hiredis.h>
+#include <async.h>
+#include <adapters/libuv.h>
+
+void getCallback(redisAsyncContext *c, void *r, void *privdata) {
+    redisReply *reply = r;
+    if (reply == NULL) return;
+    printf("argv[%s]: %s\n", (char*)privdata, reply->str);
+
+    /* Disconnect after receiving the reply to GET */
+    redisAsyncDisconnect(c);
+}
+
+void connectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        return;
+    }
+    printf("Connected...\n");
+}
+
+void disconnectCallback(const redisAsyncContext *c, int status) {
+    if (status != REDIS_OK) {
+        printf("Error: %s\n", c->errstr);
+        return;
+    }
+    printf("Disconnected...\n");
+}
+
+int main (int argc, char **argv) {
+    signal(SIGPIPE, SIG_IGN);
+    uv_loop_t* loop = uv_default_loop();
+
+    redisAsyncContext *c = redisAsyncConnect("127.0.0.1", 6379);
+    if (c->err) {
+        /* Let *c leak for now... */
+        printf("Error: %s\n", c->errstr);
+        return 1;
+    }
+
+    redisLibuvAttach(c,loop);
+    redisAsyncSetConnectCallback(c,connectCallback);
+    redisAsyncSetDisconnectCallback(c,disconnectCallback);
+    redisAsyncCommand(c, NULL, NULL, "SET key %b", argv[argc-1], strlen(argv[argc-1]));
+    redisAsyncCommand(c, getCallback, (char*)"end-1", "GET key");
+    uv_run(loop, UV_RUN_DEFAULT);
+    return 0;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/examples/example.c b/debian/modules/nchan/src/store/redis/hiredis/examples/example.c
new file mode 100644
index 00000000..4d494c55
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/examples/example.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <hiredis.h>
+
+int main(int argc, char **argv) {
+    unsigned int j;
+    redisContext *c;
+    redisReply *reply;
+    const char *hostname = (argc > 1) ? argv[1] : "127.0.0.1";
+    int port = (argc > 2) ? atoi(argv[2]) : 6379;
+
+    struct timeval timeout = { 1, 500000 }; // 1.5 seconds
+    c = redisConnectWithTimeout(hostname, port, timeout);
+    if (c == NULL || c->err) {
+        if (c) {
+            printf("Connection error: %s\n", c->errstr);
+            redisFree(c);
+        } else {
+            printf("Connection error: can't allocate redis context\n");
+        }
+        exit(1);
+    }
+
+    /* PING server */
+    reply = redisCommand(c,"PING");
+    printf("PING: %s\n", reply->str);
+    freeReplyObject(reply);
+
+    /* Set a key */
+    reply = redisCommand(c,"SET %s %s", "foo", "hello world");
+    printf("SET: %s\n", reply->str);
+    freeReplyObject(reply);
+
+    /* Set a key using binary safe API */
+    reply = redisCommand(c,"SET %b %b", "bar", (size_t) 3, "hello", (size_t) 5);
+    printf("SET (binary API): %s\n", reply->str);
+    freeReplyObject(reply);
+
+    /* Try a GET and two INCR */
+    reply = redisCommand(c,"GET foo");
+    printf("GET foo: %s\n", reply->str);
+    freeReplyObject(reply);
+
+    reply = redisCommand(c,"INCR counter");
+    printf("INCR counter: %lld\n", reply->integer);
+    freeReplyObject(reply);
+    /* again ... */
+    reply = redisCommand(c,"INCR counter");
+    printf("INCR counter: %lld\n", reply->integer);
+    freeReplyObject(reply);
+
+    /* Create a list of numbers, from 0 to 9 */
+    reply = redisCommand(c,"DEL mylist");
+    freeReplyObject(reply);
+    for (j = 0; j < 10; j++) {
+        char buf[64];
+
+        snprintf(buf,64,"%u",j);
+        reply = redisCommand(c,"LPUSH mylist element-%s", buf);
+        freeReplyObject(reply);
+    }
+
+    /* Let's check what we have inside the list */
+    reply = redisCommand(c,"LRANGE mylist 0 -1");
+    if (reply->type == REDIS_REPLY_ARRAY) {
+        for (j = 0; j < reply->elements; j++) {
+            printf("%u) %s\n", j, reply->element[j]->str);
+        }
+    }
+    freeReplyObject(reply);
+
+    /* Disconnects and frees the context */
+    redisFree(c);
+
+    return 0;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/fmacros.h b/debian/modules/nchan/src/store/redis/hiredis/fmacros.h
new file mode 100644
index 00000000..19d7b219
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/fmacros.h
@@ -0,0 +1,21 @@
+#ifndef __HIREDIS_FMACRO_H
+#define __HIREDIS_FMACRO_H
+
+#if defined(__linux__)
+#define _BSD_SOURCE
+#define _DEFAULT_SOURCE
+#endif
+
+#if defined(__sun__)
+#define _POSIX_C_SOURCE 200112L
+#elif defined(__linux__) || defined(__OpenBSD__) || defined(__NetBSD__)
+#define _XOPEN_SOURCE 600
+#else
+#define _XOPEN_SOURCE
+#endif
+
+#if __APPLE__ && __MACH__
+#define _OSX
+#endif
+
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/hiredis.c b/debian/modules/nchan/src/store/redis/hiredis/hiredis.c
new file mode 100644
index 00000000..2b876d91
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/hiredis.c
@@ -0,0 +1,1021 @@
+/*
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2014, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ * Copyright (c) 2015, Matt Stancliff <matt at genges dot com>,
+ *                     Jan-Erik Rediger <janerik at fnordig dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "fmacros.h"
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <assert.h>
+#include <errno.h>
+#include <ctype.h>
+
+#include "hiredis.h"
+#include "net.h"
+#include "sds.h"
+
+static redisReply *createReplyObject(int type);
+static void *createStringObject(const redisReadTask *task, char *str, size_t len);
+static void *createArrayObject(const redisReadTask *task, int elements);
+static void *createIntegerObject(const redisReadTask *task, long long value);
+static void *createNilObject(const redisReadTask *task);
+
+/* Default set of functions to build the reply. Keep in mind that such a
+ * function returning NULL is interpreted as OOM. */
+static redisReplyObjectFunctions defaultFunctions = {
+    createStringObject,
+    createArrayObject,
+    createIntegerObject,
+    createNilObject,
+    freeReplyObject
+};
+
+/* Create a reply object */
+static redisReply *createReplyObject(int type) {
+    redisReply *r = calloc(1,sizeof(*r));
+
+    if (r == NULL)
+        return NULL;
+
+    r->type = type;
+    return r;
+}
+
+/* Free a reply object */
+void freeReplyObject(void *reply) {
+    redisReply *r = reply;
+    size_t j;
+
+    if (r == NULL)
+        return;
+
+    switch(r->type) {
+    case REDIS_REPLY_INTEGER:
+        break; /* Nothing to free */
+    case REDIS_REPLY_ARRAY:
+        if (r->element != NULL) {
+            for (j = 0; j < r->elements; j++)
+                if (r->element[j] != NULL)
+                    freeReplyObject(r->element[j]);
+            free(r->element);
+        }
+        break;
+    case REDIS_REPLY_ERROR:
+    case REDIS_REPLY_STATUS:
+    case REDIS_REPLY_STRING:
+        if (r->str != NULL)
+            free(r->str);
+        break;
+    }
+    free(r);
+}
+
+static void *createStringObject(const redisReadTask *task, char *str, size_t len) {
+    redisReply *r, *parent;
+    char *buf;
+
+    r = createReplyObject(task->type);
+    if (r == NULL)
+        return NULL;
+
+    buf = malloc(len+1);
+    if (buf == NULL) {
+        freeReplyObject(r);
+        return NULL;
+    }
+
+    assert(task->type == REDIS_REPLY_ERROR  ||
+           task->type == REDIS_REPLY_STATUS ||
+           task->type == REDIS_REPLY_STRING);
+
+    /* Copy string value */
+    memcpy(buf,str,len);
+    buf[len] = '\0';
+    r->str = buf;
+    r->len = len;
+
+    if (task->parent) {
+        parent = task->parent->obj;
+        assert(parent->type == REDIS_REPLY_ARRAY);
+        parent->element[task->idx] = r;
+    }
+    return r;
+}
+
+static void *createArrayObject(const redisReadTask *task, int elements) {
+    redisReply *r, *parent;
+
+    r = createReplyObject(REDIS_REPLY_ARRAY);
+    if (r == NULL)
+        return NULL;
+
+    if (elements > 0) {
+        r->element = calloc(elements,sizeof(redisReply*));
+        if (r->element == NULL) {
+            freeReplyObject(r);
+            return NULL;
+        }
+    }
+
+    r->elements = elements;
+
+    if (task->parent) {
+        parent = task->parent->obj;
+        assert(parent->type == REDIS_REPLY_ARRAY);
+        parent->element[task->idx] = r;
+    }
+    return r;
+}
+
+static void *createIntegerObject(const redisReadTask *task, long long value) {
+    redisReply *r, *parent;
+
+    r = createReplyObject(REDIS_REPLY_INTEGER);
+    if (r == NULL)
+        return NULL;
+
+    r->integer = value;
+
+    if (task->parent) {
+        parent = task->parent->obj;
+        assert(parent->type == REDIS_REPLY_ARRAY);
+        parent->element[task->idx] = r;
+    }
+    return r;
+}
+
+static void *createNilObject(const redisReadTask *task) {
+    redisReply *r, *parent;
+
+    r = createReplyObject(REDIS_REPLY_NIL);
+    if (r == NULL)
+        return NULL;
+
+    if (task->parent) {
+        parent = task->parent->obj;
+        assert(parent->type == REDIS_REPLY_ARRAY);
+        parent->element[task->idx] = r;
+    }
+    return r;
+}
+
+/* Return the number of digits of 'v' when converted to string in radix 10.
+ * Implementation borrowed from link in redis/src/util.c:string2ll(). */
+static uint32_t countDigits(uint64_t v) {
+  uint32_t result = 1;
+  for (;;) {
+    if (v < 10) return result;
+    if (v < 100) return result + 1;
+    if (v < 1000) return result + 2;
+    if (v < 10000) return result + 3;
+    v /= 10000U;
+    result += 4;
+  }
+}
+
+/* Helper that calculates the bulk length given a certain string length. */
+static size_t bulklen(size_t len) {
+    return 1+countDigits(len)+2+len+2;
+}
+
+int redisvFormatCommand(char **target, const char *format, va_list ap) {
+    const char *c = format;
+    char *cmd = NULL; /* final command */
+    int pos; /* position in final command */
+    sds curarg, newarg; /* current argument */
+    int touched = 0; /* was the current argument touched? */
+    char **curargv = NULL, **newargv = NULL;
+    int argc = 0;
+    int totlen = 0;
+    int error_type = 0; /* 0 = no error; -1 = memory error; -2 = format error */
+    int j;
+
+    /* Abort if there is not target to set */
+    if (target == NULL)
+        return -1;
+
+    /* Build the command string accordingly to protocol */
+    curarg = sdsempty();
+    if (curarg == NULL)
+        return -1;
+
+    while(*c != '\0') {
+        if (*c != '%' || c[1] == '\0') {
+            if (*c == ' ') {
+                if (touched) {
+                    newargv = realloc(curargv,sizeof(char*)*(argc+1));
+                    if (newargv == NULL) goto memory_err;
+                    curargv = newargv;
+                    curargv[argc++] = curarg;
+                    totlen += bulklen(sdslen(curarg));
+
+                    /* curarg is put in argv so it can be overwritten. */
+                    curarg = sdsempty();
+                    if (curarg == NULL) goto memory_err;
+                    touched = 0;
+                }
+            } else {
+                newarg = sdscatlen(curarg,c,1);
+                if (newarg == NULL) goto memory_err;
+                curarg = newarg;
+                touched = 1;
+            }
+        } else {
+            char *arg;
+            size_t size;
+
+            /* Set newarg so it can be checked even if it is not touched. */
+            newarg = curarg;
+
+            switch(c[1]) {
+            case 's':
+                arg = va_arg(ap,char*);
+                size = strlen(arg);
+                if (size > 0)
+                    newarg = sdscatlen(curarg,arg,size);
+                break;
+            case 'b':
+                arg = va_arg(ap,char*);
+                size = va_arg(ap,size_t);
+                if (size > 0)
+                    newarg = sdscatlen(curarg,arg,size);
+                break;
+            case '%':
+                newarg = sdscat(curarg,"%");
+                break;
+            default:
+                /* Try to detect printf format */
+                {
+                    static const char intfmts[] = "diouxX";
+                    static const char flags[] = "#0-+ ";
+                    char _format[16];
+                    const char *_p = c+1;
+                    size_t _l = 0;
+                    va_list _cpy;
+
+                    /* Flags */
+                    while (*_p != '\0' && strchr(flags,*_p) != NULL) _p++;
+
+                    /* Field width */
+                    while (*_p != '\0' && isdigit(*_p)) _p++;
+
+                    /* Precision */
+                    if (*_p == '.') {
+                        _p++;
+                        while (*_p != '\0' && isdigit(*_p)) _p++;
+                    }
+
+                    /* Copy va_list before consuming with va_arg */
+                    va_copy(_cpy,ap);
+
+                    /* Integer conversion (without modifiers) */
+                    if (strchr(intfmts,*_p) != NULL) {
+                        va_arg(ap,int);
+                        goto fmt_valid;
+                    }
+
+                    /* Double conversion (without modifiers) */
+                    if (strchr("eEfFgGaA",*_p) != NULL) {
+                        va_arg(ap,double);
+                        goto fmt_valid;
+                    }
+
+                    /* Size: char */
+                    if (_p[0] == 'h' && _p[1] == 'h') {
+                        _p += 2;
+                        if (*_p != '\0' && strchr(intfmts,*_p) != NULL) {
+                            va_arg(ap,int); /* char gets promoted to int */
+                            goto fmt_valid;
+                        }
+                        goto fmt_invalid;
+                    }
+
+                    /* Size: short */
+                    if (_p[0] == 'h') {
+                        _p += 1;
+                        if (*_p != '\0' && strchr(intfmts,*_p) != NULL) {
+                            va_arg(ap,int); /* short gets promoted to int */
+                            goto fmt_valid;
+                        }
+                        goto fmt_invalid;
+                    }
+
+                    /* Size: long long */
+                    if (_p[0] == 'l' && _p[1] == 'l') {
+                        _p += 2;
+                        if (*_p != '\0' && strchr(intfmts,*_p) != NULL) {
+                            va_arg(ap,long long);
+                            goto fmt_valid;
+                        }
+                        goto fmt_invalid;
+                    }
+
+                    /* Size: long */
+                    if (_p[0] == 'l') {
+                        _p += 1;
+                        if (*_p != '\0' && strchr(intfmts,*_p) != NULL) {
+                            va_arg(ap,long);
+                            goto fmt_valid;
+                        }
+                        goto fmt_invalid;
+                    }
+
+                fmt_invalid:
+                    va_end(_cpy);
+                    goto format_err;
+
+                fmt_valid:
+                    _l = (_p+1)-c;
+                    if (_l < sizeof(_format)-2) {
+                        memcpy(_format,c,_l);
+                        _format[_l] = '\0';
+                        newarg = sdscatvprintf(curarg,_format,_cpy);
+
+                        /* Update current position (note: outer blocks
+                         * increment c twice so compensate here) */
+                        c = _p-1;
+                    }
+
+                    va_end(_cpy);
+                    break;
+                }
+            }
+
+            if (newarg == NULL) goto memory_err;
+            curarg = newarg;
+
+            touched = 1;
+            c++;
+        }
+        c++;
+    }
+
+    /* Add the last argument if needed */
+    if (touched) {
+        newargv = realloc(curargv,sizeof(char*)*(argc+1));
+        if (newargv == NULL) goto memory_err;
+        curargv = newargv;
+        curargv[argc++] = curarg;
+        totlen += bulklen(sdslen(curarg));
+    } else {
+        sdsfree(curarg);
+    }
+
+    /* Clear curarg because it was put in curargv or was free'd. */
+    curarg = NULL;
+
+    /* Add bytes needed to hold multi bulk count */
+    totlen += 1+countDigits(argc)+2;
+
+    /* Build the command at protocol level */
+    cmd = malloc(totlen+1);
+    if (cmd == NULL) goto memory_err;
+
+    pos = sprintf(cmd,"*%d\r\n",argc);
+    for (j = 0; j < argc; j++) {
+        pos += sprintf(cmd+pos,"$%zu\r\n",sdslen(curargv[j]));
+        memcpy(cmd+pos,curargv[j],sdslen(curargv[j]));
+        pos += sdslen(curargv[j]);
+        sdsfree(curargv[j]);
+        cmd[pos++] = '\r';
+        cmd[pos++] = '\n';
+    }
+    assert(pos == totlen);
+    cmd[pos] = '\0';
+
+    free(curargv);
+    *target = cmd;
+    return totlen;
+
+format_err:
+    error_type = -2;
+    goto cleanup;
+
+memory_err:
+    error_type = -1;
+    goto cleanup;
+
+cleanup:
+    if (curargv) {
+        while(argc--)
+            sdsfree(curargv[argc]);
+        free(curargv);
+    }
+
+    sdsfree(curarg);
+
+    /* No need to check cmd since it is the last statement that can fail,
+     * but do it anyway to be as defensive as possible. */
+    if (cmd != NULL)
+        free(cmd);
+
+    return error_type;
+}
+
+/* Format a command according to the Redis protocol. This function
+ * takes a format similar to printf:
+ *
+ * %s represents a C null terminated string you want to interpolate
+ * %b represents a binary safe string
+ *
+ * When using %b you need to provide both the pointer to the string
+ * and the length in bytes as a size_t. Examples:
+ *
+ * len = redisFormatCommand(target, "GET %s", mykey);
+ * len = redisFormatCommand(target, "SET %s %b", mykey, myval, myvallen);
+ */
+int redisFormatCommand(char **target, const char *format, ...) {
+    va_list ap;
+    int len;
+    va_start(ap,format);
+    len = redisvFormatCommand(target,format,ap);
+    va_end(ap);
+
+    /* The API says "-1" means bad result, but we now also return "-2" in some
+     * cases.  Force the return value to always be -1. */
+    if (len < 0)
+        len = -1;
+
+    return len;
+}
+
+/* Format a command according to the Redis protocol using an sds string and
+ * sdscatfmt for the processing of arguments. This function takes the
+ * number of arguments, an array with arguments and an array with their
+ * lengths. If the latter is set to NULL, strlen will be used to compute the
+ * argument lengths.
+ */
+int redisFormatSdsCommandArgv(sds *target, int argc, const char **argv,
+                              const size_t *argvlen)
+{
+    sds cmd;
+    unsigned long long totlen;
+    int j;
+    size_t len;
+
+    /* Abort on a NULL target */
+    if (target == NULL)
+        return -1;
+
+    /* Calculate our total size */
+    totlen = 1+countDigits(argc)+2;
+    for (j = 0; j < argc; j++) {
+        len = argvlen ? argvlen[j] : strlen(argv[j]);
+        totlen += bulklen(len);
+    }
+
+    /* Use an SDS string for command construction */
+    cmd = sdsempty();
+    if (cmd == NULL)
+        return -1;
+
+    /* We already know how much storage we need */
+    cmd = sdsMakeRoomFor(cmd, totlen);
+    if (cmd == NULL)
+        return -1;
+
+    /* Construct command */
+    cmd = sdscatfmt(cmd, "*%i\r\n", argc);
+    for (j=0; j < argc; j++) {
+        len = argvlen ? argvlen[j] : strlen(argv[j]);
+        cmd = sdscatfmt(cmd, "$%T\r\n", len);
+        cmd = sdscatlen(cmd, argv[j], len);
+        cmd = sdscatlen(cmd, "\r\n", sizeof("\r\n")-1);
+    }
+
+    assert(sdslen(cmd)==totlen);
+
+    *target = cmd;
+    return totlen;
+}
+
+void redisFreeSdsCommand(sds cmd) {
+    sdsfree(cmd);
+}
+
+/* Format a command according to the Redis protocol. This function takes the
+ * number of arguments, an array with arguments and an array with their
+ * lengths. If the latter is set to NULL, strlen will be used to compute the
+ * argument lengths.
+ */
+int redisFormatCommandArgv(char **target, int argc, const char **argv, const size_t *argvlen) {
+    char *cmd = NULL; /* final command */
+    int pos; /* position in final command */
+    size_t len;
+    int totlen, j;
+
+    /* Abort on a NULL target */
+    if (target == NULL)
+        return -1;
+
+    /* Calculate number of bytes needed for the command */
+    totlen = 1+countDigits(argc)+2;
+    for (j = 0; j < argc; j++) {
+        len = argvlen ? argvlen[j] : strlen(argv[j]);
+        totlen += bulklen(len);
+    }
+
+    /* Build the command at protocol level */
+    cmd = malloc(totlen+1);
+    if (cmd == NULL)
+        return -1;
+
+    pos = sprintf(cmd,"*%d\r\n",argc);
+    for (j = 0; j < argc; j++) {
+        len = argvlen ? argvlen[j] : strlen(argv[j]);
+        pos += sprintf(cmd+pos,"$%zu\r\n",len);
+        memcpy(cmd+pos,argv[j],len);
+        pos += len;
+        cmd[pos++] = '\r';
+        cmd[pos++] = '\n';
+    }
+    assert(pos == totlen);
+    cmd[pos] = '\0';
+
+    *target = cmd;
+    return totlen;
+}
+
+void redisFreeCommand(char *cmd) {
+    free(cmd);
+}
+
+void __redisSetError(redisContext *c, int type, const char *str) {
+    size_t len;
+
+    c->err = type;
+    if (str != NULL) {
+        len = strlen(str);
+        len = len < (sizeof(c->errstr)-1) ? len : (sizeof(c->errstr)-1);
+        memcpy(c->errstr,str,len);
+        c->errstr[len] = '\0';
+    } else {
+        /* Only REDIS_ERR_IO may lack a description! */
+        assert(type == REDIS_ERR_IO);
+        __redis_strerror_r(errno, c->errstr, sizeof(c->errstr));
+    }
+}
+
+redisReader *redisReaderCreate(void) {
+    return redisReaderCreateWithFunctions(&defaultFunctions);
+}
+
+static redisContext *redisContextInit(void) {
+    redisContext *c;
+
+    c = calloc(1,sizeof(redisContext));
+    if (c == NULL)
+        return NULL;
+
+    c->err = 0;
+    c->errstr[0] = '\0';
+    c->obuf = sdsempty();
+    c->reader = redisReaderCreate();
+    c->tcp.host = NULL;
+    c->tcp.source_addr = NULL;
+    c->unix_sock.path = NULL;
+    c->timeout = NULL;
+
+    if (c->obuf == NULL || c->reader == NULL) {
+        redisFree(c);
+        return NULL;
+    }
+
+    return c;
+}
+
+void redisFree(redisContext *c) {
+    if (c == NULL)
+        return;
+    if (c->fd > 0)
+        close(c->fd);
+    if (c->obuf != NULL)
+        sdsfree(c->obuf);
+    if (c->reader != NULL)
+        redisReaderFree(c->reader);
+    if (c->tcp.host)
+        free(c->tcp.host);
+    if (c->tcp.source_addr)
+        free(c->tcp.source_addr);
+    if (c->unix_sock.path)
+        free(c->unix_sock.path);
+    if (c->timeout)
+        free(c->timeout);
+    free(c);
+}
+
+int redisFreeKeepFd(redisContext *c) {
+    int fd = c->fd;
+    c->fd = -1;
+    redisFree(c);
+    return fd;
+}
+
+int redisReconnect(redisContext *c) {
+    c->err = 0;
+    memset(c->errstr, '\0', strlen(c->errstr));
+
+    if (c->fd > 0) {
+        close(c->fd);
+    }
+
+    sdsfree(c->obuf);
+    redisReaderFree(c->reader);
+
+    c->obuf = sdsempty();
+    c->reader = redisReaderCreate();
+
+    if (c->connection_type == REDIS_CONN_TCP) {
+        return redisContextConnectBindTcp(c, c->tcp.host, c->tcp.port,
+                c->timeout, c->tcp.source_addr);
+    } else if (c->connection_type == REDIS_CONN_UNIX) {
+        return redisContextConnectUnix(c, c->unix_sock.path, c->timeout);
+    } else {
+        /* Something bad happened here and shouldn't have. There isn't
+           enough information in the context to reconnect. */
+        __redisSetError(c,REDIS_ERR_OTHER,"Not enough information to reconnect");
+    }
+
+    return REDIS_ERR;
+}
+
+/* Connect to a Redis instance. On error the field error in the returned
+ * context will be set to the return value of the error function.
+ * When no set of reply functions is given, the default set will be used. */
+redisContext *redisConnect(const char *ip, int port) {
+    redisContext *c;
+
+    c = redisContextInit();
+    if (c == NULL)
+        return NULL;
+
+    c->flags |= REDIS_BLOCK;
+    redisContextConnectTcp(c,ip,port,NULL);
+    return c;
+}
+
+redisContext *redisConnectWithTimeout(const char *ip, int port, const struct timeval tv) {
+    redisContext *c;
+
+    c = redisContextInit();
+    if (c == NULL)
+        return NULL;
+
+    c->flags |= REDIS_BLOCK;
+    redisContextConnectTcp(c,ip,port,&tv);
+    return c;
+}
+
+redisContext *redisConnectNonBlock(const char *ip, int port) {
+    redisContext *c;
+
+    c = redisContextInit();
+    if (c == NULL)
+        return NULL;
+
+    c->flags &= ~REDIS_BLOCK;
+    redisContextConnectTcp(c,ip,port,NULL);
+    return c;
+}
+
+redisContext *redisConnectBindNonBlock(const char *ip, int port,
+                                       const char *source_addr) {
+    redisContext *c = redisContextInit();
+    c->flags &= ~REDIS_BLOCK;
+    redisContextConnectBindTcp(c,ip,port,NULL,source_addr);
+    return c;
+}
+
+redisContext *redisConnectBindNonBlockWithReuse(const char *ip, int port,
+                                                const char *source_addr) {
+    redisContext *c = redisContextInit();
+    c->flags &= ~REDIS_BLOCK;
+    c->flags |= REDIS_REUSEADDR;
+    redisContextConnectBindTcp(c,ip,port,NULL,source_addr);
+    return c;
+}
+
+redisContext *redisConnectUnix(const char *path) {
+    redisContext *c;
+
+    c = redisContextInit();
+    if (c == NULL)
+        return NULL;
+
+    c->flags |= REDIS_BLOCK;
+    redisContextConnectUnix(c,path,NULL);
+    return c;
+}
+
+redisContext *redisConnectUnixWithTimeout(const char *path, const struct timeval tv) {
+    redisContext *c;
+
+    c = redisContextInit();
+    if (c == NULL)
+        return NULL;
+
+    c->flags |= REDIS_BLOCK;
+    redisContextConnectUnix(c,path,&tv);
+    return c;
+}
+
+redisContext *redisConnectUnixNonBlock(const char *path) {
+    redisContext *c;
+
+    c = redisContextInit();
+    if (c == NULL)
+        return NULL;
+
+    c->flags &= ~REDIS_BLOCK;
+    redisContextConnectUnix(c,path,NULL);
+    return c;
+}
+
+redisContext *redisConnectFd(int fd) {
+    redisContext *c;
+
+    c = redisContextInit();
+    if (c == NULL)
+        return NULL;
+
+    c->fd = fd;
+    c->flags |= REDIS_BLOCK | REDIS_CONNECTED;
+    return c;
+}
+
+/* Set read/write timeout on a blocking socket. */
+int redisSetTimeout(redisContext *c, const struct timeval tv) {
+    if (c->flags & REDIS_BLOCK)
+        return redisContextSetTimeout(c,tv);
+    return REDIS_ERR;
+}
+
+/* Enable connection KeepAlive. */
+int redisEnableKeepAlive(redisContext *c) {
+    if (redisKeepAlive(c, REDIS_KEEPALIVE_INTERVAL) != REDIS_OK)
+        return REDIS_ERR;
+    return REDIS_OK;
+}
+
+/* Use this function to handle a read event on the descriptor. It will try
+ * and read some bytes from the socket and feed them to the reply parser.
+ *
+ * After this function is called, you may use redisContextReadReply to
+ * see if there is a reply available. */
+int redisBufferRead(redisContext *c) {
+    char buf[1024*16];
+    int nread;
+
+    /* Return early when the context has seen an error. */
+    if (c->err)
+        return REDIS_ERR;
+
+    nread = read(c->fd,buf,sizeof(buf));
+    if (nread == -1) {
+        if ((errno == EAGAIN && !(c->flags & REDIS_BLOCK)) || (errno == EINTR)) {
+            /* Try again later */
+        } else {
+            __redisSetError(c,REDIS_ERR_IO,NULL);
+            return REDIS_ERR;
+        }
+    } else if (nread == 0) {
+        __redisSetError(c,REDIS_ERR_EOF,"Server closed the connection");
+        return REDIS_ERR;
+    } else {
+        if (redisReaderFeed(c->reader,buf,nread) != REDIS_OK) {
+            __redisSetError(c,c->reader->err,c->reader->errstr);
+            return REDIS_ERR;
+        }
+    }
+    return REDIS_OK;
+}
+
+/* Write the output buffer to the socket.
+ *
+ * Returns REDIS_OK when the buffer is empty, or (a part of) the buffer was
+ * successfully written to the socket. When the buffer is empty after the
+ * write operation, "done" is set to 1 (if given).
+ *
+ * Returns REDIS_ERR if an error occurred trying to write and sets
+ * c->errstr to hold the appropriate error string.
+ */
+int redisBufferWrite(redisContext *c, int *done) {
+    int nwritten;
+
+    /* Return early when the context has seen an error. */
+    if (c->err)
+        return REDIS_ERR;
+
+    if (sdslen(c->obuf) > 0) {
+        nwritten = write(c->fd,c->obuf,sdslen(c->obuf));
+        if (nwritten == -1) {
+            if ((errno == EAGAIN && !(c->flags & REDIS_BLOCK)) || (errno == EINTR)) {
+                /* Try again later */
+            } else {
+                __redisSetError(c,REDIS_ERR_IO,NULL);
+                return REDIS_ERR;
+            }
+        } else if (nwritten > 0) {
+            if (nwritten == (signed)sdslen(c->obuf)) {
+                sdsfree(c->obuf);
+                c->obuf = sdsempty();
+            } else {
+                sdsrange(c->obuf,nwritten,-1);
+            }
+        }
+    }
+    if (done != NULL) *done = (sdslen(c->obuf) == 0);
+    return REDIS_OK;
+}
+
+/* Internal helper function to try and get a reply from the reader,
+ * or set an error in the context otherwise. */
+int redisGetReplyFromReader(redisContext *c, void **reply) {
+    if (redisReaderGetReply(c->reader,reply) == REDIS_ERR) {
+        __redisSetError(c,c->reader->err,c->reader->errstr);
+        return REDIS_ERR;
+    }
+    return REDIS_OK;
+}
+
+int redisGetReply(redisContext *c, void **reply) {
+    int wdone = 0;
+    void *aux = NULL;
+
+    /* Try to read pending replies */
+    if (redisGetReplyFromReader(c,&aux) == REDIS_ERR)
+        return REDIS_ERR;
+
+    /* For the blocking context, flush output buffer and read reply */
+    if (aux == NULL && c->flags & REDIS_BLOCK) {
+        /* Write until done */
+        do {
+            if (redisBufferWrite(c,&wdone) == REDIS_ERR)
+                return REDIS_ERR;
+        } while (!wdone);
+
+        /* Read until there is a reply */
+        do {
+            if (redisBufferRead(c) == REDIS_ERR)
+                return REDIS_ERR;
+            if (redisGetReplyFromReader(c,&aux) == REDIS_ERR)
+                return REDIS_ERR;
+        } while (aux == NULL);
+    }
+
+    /* Set reply object */
+    if (reply != NULL) *reply = aux;
+    return REDIS_OK;
+}
+
+
+/* Helper function for the redisAppendCommand* family of functions.
+ *
+ * Write a formatted command to the output buffer. When this family
+ * is used, you need to call redisGetReply yourself to retrieve
+ * the reply (or replies in pub/sub).
+ */
+int __redisAppendCommand(redisContext *c, const char *cmd, size_t len) {
+    sds newbuf;
+
+    newbuf = sdscatlen(c->obuf,cmd,len);
+    if (newbuf == NULL) {
+        __redisSetError(c,REDIS_ERR_OOM,"Out of memory");
+        return REDIS_ERR;
+    }
+
+    c->obuf = newbuf;
+    return REDIS_OK;
+}
+
+int redisAppendFormattedCommand(redisContext *c, const char *cmd, size_t len) {
+
+    if (__redisAppendCommand(c, cmd, len) != REDIS_OK) {
+        return REDIS_ERR;
+    }
+
+    return REDIS_OK;
+}
+
+int redisvAppendCommand(redisContext *c, const char *format, va_list ap) {
+    char *cmd;
+    int len;
+
+    len = redisvFormatCommand(&cmd,format,ap);
+    if (len == -1) {
+        __redisSetError(c,REDIS_ERR_OOM,"Out of memory");
+        return REDIS_ERR;
+    } else if (len == -2) {
+        __redisSetError(c,REDIS_ERR_OTHER,"Invalid format string");
+        return REDIS_ERR;
+    }
+
+    if (__redisAppendCommand(c,cmd,len) != REDIS_OK) {
+        free(cmd);
+        return REDIS_ERR;
+    }
+
+    free(cmd);
+    return REDIS_OK;
+}
+
+int redisAppendCommand(redisContext *c, const char *format, ...) {
+    va_list ap;
+    int ret;
+
+    va_start(ap,format);
+    ret = redisvAppendCommand(c,format,ap);
+    va_end(ap);
+    return ret;
+}
+
+int redisAppendCommandArgv(redisContext *c, int argc, const char **argv, const size_t *argvlen) {
+    sds cmd;
+    int len;
+
+    len = redisFormatSdsCommandArgv(&cmd,argc,argv,argvlen);
+    if (len == -1) {
+        __redisSetError(c,REDIS_ERR_OOM,"Out of memory");
+        return REDIS_ERR;
+    }
+
+    if (__redisAppendCommand(c,cmd,len) != REDIS_OK) {
+        sdsfree(cmd);
+        return REDIS_ERR;
+    }
+
+    sdsfree(cmd);
+    return REDIS_OK;
+}
+
+/* Helper function for the redisCommand* family of functions.
+ *
+ * Write a formatted command to the output buffer. If the given context is
+ * blocking, immediately read the reply into the "reply" pointer. When the
+ * context is non-blocking, the "reply" pointer will not be used and the
+ * command is simply appended to the write buffer.
+ *
+ * Returns the reply when a reply was successfully retrieved. Returns NULL
+ * otherwise. When NULL is returned in a blocking context, the error field
+ * in the context will be set.
+ */
+static void *__redisBlockForReply(redisContext *c) {
+    void *reply;
+
+    if (c->flags & REDIS_BLOCK) {
+        if (redisGetReply(c,&reply) != REDIS_OK)
+            return NULL;
+        return reply;
+    }
+    return NULL;
+}
+
+void *redisvCommand(redisContext *c, const char *format, va_list ap) {
+    if (redisvAppendCommand(c,format,ap) != REDIS_OK)
+        return NULL;
+    return __redisBlockForReply(c);
+}
+
+void *redisCommand(redisContext *c, const char *format, ...) {
+    va_list ap;
+    void *reply = NULL;
+    va_start(ap,format);
+    reply = redisvCommand(c,format,ap);
+    va_end(ap);
+    return reply;
+}
+
+void *redisCommandArgv(redisContext *c, int argc, const char **argv, const size_t *argvlen) {
+    if (redisAppendCommandArgv(c,argc,argv,argvlen) != REDIS_OK)
+        return NULL;
+    return __redisBlockForReply(c);
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/hiredis.h b/debian/modules/nchan/src/store/redis/hiredis/hiredis.h
new file mode 100644
index 00000000..11a75c16
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/hiredis.h
@@ -0,0 +1,226 @@
+/*
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2014, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ * Copyright (c) 2015, Matt Stancliff <matt at genges dot com>,
+ *                     Jan-Erik Rediger <janerik at fnordig dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __HIREDIS_H
+#define __HIREDIS_H
+#include "read.h"
+#include <stdarg.h> /* for va_list */
+#include <sys/time.h> /* for struct timeval */
+#include <stdint.h> /* uintXX_t, etc */
+#include "sds.h" /* for sds */
+
+#include <sys/socket.h> /* for struct sockaddr */
+
+#define HIREDIS_MAJOR 0
+#define HIREDIS_MINOR 13
+#define HIREDIS_PATCH 3
+#define HIREDIS_SONAME 0.13
+
+/* Connection type can be blocking or non-blocking and is set in the
+ * least significant bit of the flags field in redisContext. */
+#define REDIS_BLOCK 0x1
+
+/* Connection may be disconnected before being free'd. The second bit
+ * in the flags field is set when the context is connected. */
+#define REDIS_CONNECTED 0x2
+
+/* The async API might try to disconnect cleanly and flush the output
+ * buffer and read all subsequent replies before disconnecting.
+ * This flag means no new commands can come in and the connection
+ * should be terminated once all replies have been read. */
+#define REDIS_DISCONNECTING 0x4
+
+/* Flag specific to the async API which means that the context should be clean
+ * up as soon as possible. */
+#define REDIS_FREEING 0x8
+
+/* Flag that is set when an async callback is executed. */
+#define REDIS_IN_CALLBACK 0x10
+
+/* Flag that is set when the async context has one or more subscriptions. */
+#define REDIS_SUBSCRIBED 0x20
+
+/* Flag that is set when monitor mode is active */
+#define REDIS_MONITORING 0x40
+
+/* Flag that is set when we should set SO_REUSEADDR before calling bind() */
+#define REDIS_REUSEADDR 0x80
+
+#define REDIS_KEEPALIVE_INTERVAL 15 /* seconds */
+
+/* number of times we retry to connect in the case of EADDRNOTAVAIL and
+ * SO_REUSEADDR is being used. */
+#define REDIS_CONNECT_RETRIES  10
+
+/* strerror_r has two completely different prototypes and behaviors
+ * depending on system issues, so we need to operate on the error buffer
+ * differently depending on which strerror_r we're using. */
+#ifndef _GNU_SOURCE
+/* "regular" POSIX strerror_r that does the right thing. */
+#define __redis_strerror_r(errno, buf, len)                                    \
+    do {                                                                       \
+        strerror_r((errno), (buf), (len));                                     \
+    } while (0)
+#else
+/* "bad" GNU strerror_r we need to clean up after. */
+#define __redis_strerror_r(errno, buf, len)                                    \
+    do {                                                                       \
+        char *err_str = strerror_r((errno), (buf), (len));                     \
+        /* If return value _isn't_ the start of the buffer we passed in,       \
+         * then GNU strerror_r returned an internal static buffer and we       \
+         * need to copy the result into our private buffer. */                 \
+        if (err_str != (buf)) {                                                \
+            buf[(len)] = '\0';                                                 \
+            strncat((buf), err_str, ((len) - 1));                              \
+        }                                                                      \
+    } while (0)
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* This is the reply object returned by redisCommand() */
+typedef struct redisReply {
+    int type; /* REDIS_REPLY_* */
+    long long integer; /* The integer when type is REDIS_REPLY_INTEGER */
+    int len; /* Length of string */
+    char *str; /* Used for both REDIS_REPLY_ERROR and REDIS_REPLY_STRING */
+    size_t elements; /* number of elements, for REDIS_REPLY_ARRAY */
+    struct redisReply **element; /* elements vector for REDIS_REPLY_ARRAY */
+} redisReply;
+
+redisReader *redisReaderCreate(void);
+
+/* Function to free the reply objects hiredis returns by default. */
+void freeReplyObject(void *reply);
+
+/* Functions to format a command according to the protocol. */
+int redisvFormatCommand(char **target, const char *format, va_list ap);
+int redisFormatCommand(char **target, const char *format, ...);
+int redisFormatCommandArgv(char **target, int argc, const char **argv, const size_t *argvlen);
+int redisFormatSdsCommandArgv(sds *target, int argc, const char ** argv, const size_t *argvlen);
+void redisFreeCommand(char *cmd);
+void redisFreeSdsCommand(sds cmd);
+
+enum redisConnectionType {
+    REDIS_CONN_TCP,
+    REDIS_CONN_UNIX,
+};
+
+/* Context for a connection to Redis */
+typedef struct redisContext {
+    int err; /* Error flags, 0 when there is no error */
+    char errstr[128]; /* String representation of error when applicable */
+    int fd;
+    struct sockaddr sockaddr;
+    int flags;
+    char *obuf; /* Write buffer */
+    redisReader *reader; /* Protocol reader */
+
+    enum redisConnectionType connection_type;
+    struct timeval *timeout;
+
+    struct {
+        char *host;
+        char *source_addr;
+        int port;
+    } tcp;
+
+    struct {
+        char *path;
+    } unix_sock;
+
+} redisContext;
+
+redisContext *redisConnect(const char *ip, int port);
+redisContext *redisConnectWithTimeout(const char *ip, int port, const struct timeval tv);
+redisContext *redisConnectNonBlock(const char *ip, int port);
+redisContext *redisConnectBindNonBlock(const char *ip, int port,
+                                       const char *source_addr);
+redisContext *redisConnectBindNonBlockWithReuse(const char *ip, int port,
+                                                const char *source_addr);
+redisContext *redisConnectUnix(const char *path);
+redisContext *redisConnectUnixWithTimeout(const char *path, const struct timeval tv);
+redisContext *redisConnectUnixNonBlock(const char *path);
+redisContext *redisConnectFd(int fd);
+
+/**
+ * Reconnect the given context using the saved information.
+ *
+ * This re-uses the exact same connect options as in the initial connection.
+ * host, ip (or path), timeout and bind address are reused,
+ * flags are used unmodified from the existing context.
+ *
+ * Returns REDIS_OK on successful connect or REDIS_ERR otherwise.
+ */
+int redisReconnect(redisContext *c);
+
+int redisSetTimeout(redisContext *c, const struct timeval tv);
+int redisEnableKeepAlive(redisContext *c);
+void redisFree(redisContext *c);
+int redisFreeKeepFd(redisContext *c);
+int redisBufferRead(redisContext *c);
+int redisBufferWrite(redisContext *c, int *done);
+
+/* In a blocking context, this function first checks if there are unconsumed
+ * replies to return and returns one if so. Otherwise, it flushes the output
+ * buffer to the socket and reads until it has a reply. In a non-blocking
+ * context, it will return unconsumed replies until there are no more. */
+int redisGetReply(redisContext *c, void **reply);
+int redisGetReplyFromReader(redisContext *c, void **reply);
+
+/* Write a formatted command to the output buffer. Use these functions in blocking mode
+ * to get a pipeline of commands. */
+int redisAppendFormattedCommand(redisContext *c, const char *cmd, size_t len);
+
+/* Write a command to the output buffer. Use these functions in blocking mode
+ * to get a pipeline of commands. */
+int redisvAppendCommand(redisContext *c, const char *format, va_list ap);
+int redisAppendCommand(redisContext *c, const char *format, ...);
+int redisAppendCommandArgv(redisContext *c, int argc, const char **argv, const size_t *argvlen);
+
+/* Issue a command to Redis. In a blocking context, it is identical to calling
+ * redisAppendCommand, followed by redisGetReply. The function will return
+ * NULL if there was an error in performing the request, otherwise it will
+ * return the reply. In a non-blocking context, it is identical to calling
+ * only redisAppendCommand and will always return NULL. */
+void *redisvCommand(redisContext *c, const char *format, va_list ap);
+void *redisCommand(redisContext *c, const char *format, ...);
+void *redisCommandArgv(redisContext *c, int argc, const char **argv, const size_t *argvlen);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/net.c b/debian/modules/nchan/src/store/redis/hiredis/net.c
new file mode 100644
index 00000000..f874901c
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/net.c
@@ -0,0 +1,461 @@
+/* Extracted from anet.c to work properly with Hiredis error reporting.
+ *
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2014, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ * Copyright (c) 2015, Matt Stancliff <matt at genges dot com>,
+ *                     Jan-Erik Rediger <janerik at fnordig dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "fmacros.h"
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <sys/un.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <string.h>
+#include <netdb.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <poll.h>
+#include <limits.h>
+#include <stdlib.h>
+
+#include "net.h"
+#include "sds.h"
+
+/* Defined in hiredis.c */
+void __redisSetError(redisContext *c, int type, const char *str);
+
+static void redisContextCloseFd(redisContext *c) {
+    if (c && c->fd >= 0) {
+        close(c->fd);
+        c->fd = -1;
+    }
+}
+
+static void __redisSetErrorFromErrno(redisContext *c, int type, const char *prefix) {
+    char buf[128] = { 0 };
+    size_t len = 0;
+
+    if (prefix != NULL)
+        len = snprintf(buf,sizeof(buf),"%s: ",prefix);
+    __redis_strerror_r(errno, (char *)(buf + len), sizeof(buf) - len);
+    __redisSetError(c,type,buf);
+}
+
+static int redisSetReuseAddr(redisContext *c) {
+    int on = 1;
+    if (setsockopt(c->fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,NULL);
+        redisContextCloseFd(c);
+        return REDIS_ERR;
+    }
+    return REDIS_OK;
+}
+
+static int redisCreateSocket(redisContext *c, int type) {
+    int s;
+    if ((s = socket(type, SOCK_STREAM, 0)) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,NULL);
+        return REDIS_ERR;
+    }
+    c->fd = s;
+    if (type == AF_INET) {
+        if (redisSetReuseAddr(c) == REDIS_ERR) {
+            return REDIS_ERR;
+        }
+    }
+    return REDIS_OK;
+}
+
+static int redisSetBlocking(redisContext *c, int blocking) {
+    int flags;
+
+    /* Set the socket nonblocking.
+     * Note that fcntl(2) for F_GETFL and F_SETFL can't be
+     * interrupted by a signal. */
+    if ((flags = fcntl(c->fd, F_GETFL)) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,"fcntl(F_GETFL)");
+        redisContextCloseFd(c);
+        return REDIS_ERR;
+    }
+
+    if (blocking)
+        flags &= ~O_NONBLOCK;
+    else
+        flags |= O_NONBLOCK;
+
+    if (fcntl(c->fd, F_SETFL, flags) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,"fcntl(F_SETFL)");
+        redisContextCloseFd(c);
+        return REDIS_ERR;
+    }
+    return REDIS_OK;
+}
+
+int redisKeepAlive(redisContext *c, int interval) {
+    int val = 1;
+    int fd = c->fd;
+
+    if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &val, sizeof(val)) == -1){
+        __redisSetError(c,REDIS_ERR_OTHER,strerror(errno));
+        return REDIS_ERR;
+    }
+
+    val = interval;
+
+#ifdef _OSX
+    if (setsockopt(fd, IPPROTO_TCP, TCP_KEEPALIVE, &val, sizeof(val)) < 0) {
+        __redisSetError(c,REDIS_ERR_OTHER,strerror(errno));
+        return REDIS_ERR;
+    }
+#else
+#if defined(__GLIBC__) && !defined(__FreeBSD_kernel__)
+    val = interval;
+    if (setsockopt(fd, IPPROTO_TCP, TCP_KEEPIDLE, &val, sizeof(val)) < 0) {
+        __redisSetError(c,REDIS_ERR_OTHER,strerror(errno));
+        return REDIS_ERR;
+    }
+
+    val = interval/3;
+    if (val == 0) val = 1;
+    if (setsockopt(fd, IPPROTO_TCP, TCP_KEEPINTVL, &val, sizeof(val)) < 0) {
+        __redisSetError(c,REDIS_ERR_OTHER,strerror(errno));
+        return REDIS_ERR;
+    }
+
+    val = 3;
+    if (setsockopt(fd, IPPROTO_TCP, TCP_KEEPCNT, &val, sizeof(val)) < 0) {
+        __redisSetError(c,REDIS_ERR_OTHER,strerror(errno));
+        return REDIS_ERR;
+    }
+#endif
+#endif
+
+    return REDIS_OK;
+}
+
+static int redisSetTcpNoDelay(redisContext *c) {
+    int yes = 1;
+    if (setsockopt(c->fd, IPPROTO_TCP, TCP_NODELAY, &yes, sizeof(yes)) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,"setsockopt(TCP_NODELAY)");
+        redisContextCloseFd(c);
+        return REDIS_ERR;
+    }
+    return REDIS_OK;
+}
+
+#define __MAX_MSEC (((LONG_MAX) - 999) / 1000)
+
+static int redisContextWaitReady(redisContext *c, const struct timeval *timeout) {
+    struct pollfd   wfd[1];
+    long msec;
+
+    msec          = -1;
+    wfd[0].fd     = c->fd;
+    wfd[0].events = POLLOUT;
+
+    /* Only use timeout when not NULL. */
+    if (timeout != NULL) {
+        if (timeout->tv_usec > 1000000 || timeout->tv_sec > __MAX_MSEC) {
+            __redisSetErrorFromErrno(c, REDIS_ERR_IO, NULL);
+            redisContextCloseFd(c);
+            return REDIS_ERR;
+        }
+
+        msec = (timeout->tv_sec * 1000) + ((timeout->tv_usec + 999) / 1000);
+
+        if (msec < 0 || msec > INT_MAX) {
+            msec = INT_MAX;
+        }
+    }
+
+    if (errno == EINPROGRESS) {
+        int res;
+
+        if ((res = poll(wfd, 1, msec)) == -1) {
+            __redisSetErrorFromErrno(c, REDIS_ERR_IO, "poll(2)");
+            redisContextCloseFd(c);
+            return REDIS_ERR;
+        } else if (res == 0) {
+            errno = ETIMEDOUT;
+            __redisSetErrorFromErrno(c,REDIS_ERR_IO,NULL);
+            redisContextCloseFd(c);
+            return REDIS_ERR;
+        }
+
+        if (redisCheckSocketError(c) != REDIS_OK)
+            return REDIS_ERR;
+
+        return REDIS_OK;
+    }
+
+    __redisSetErrorFromErrno(c,REDIS_ERR_IO,NULL);
+    redisContextCloseFd(c);
+    return REDIS_ERR;
+}
+
+int redisCheckSocketError(redisContext *c) {
+    int err = 0;
+    socklen_t errlen = sizeof(err);
+
+    if (getsockopt(c->fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,"getsockopt(SO_ERROR)");
+        return REDIS_ERR;
+    }
+
+    if (err) {
+        errno = err;
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,NULL);
+        return REDIS_ERR;
+    }
+
+    return REDIS_OK;
+}
+
+int redisContextSetTimeout(redisContext *c, const struct timeval tv) {
+    if (setsockopt(c->fd,SOL_SOCKET,SO_RCVTIMEO,&tv,sizeof(tv)) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,"setsockopt(SO_RCVTIMEO)");
+        return REDIS_ERR;
+    }
+    if (setsockopt(c->fd,SOL_SOCKET,SO_SNDTIMEO,&tv,sizeof(tv)) == -1) {
+        __redisSetErrorFromErrno(c,REDIS_ERR_IO,"setsockopt(SO_SNDTIMEO)");
+        return REDIS_ERR;
+    }
+    return REDIS_OK;
+}
+
+static int _redisContextConnectTcp(redisContext *c, const char *addr, int port,
+                                   const struct timeval *timeout,
+                                   const char *source_addr) {
+    int s, rv, n;
+    char _port[6];  /* strlen("65535"); */
+    struct addrinfo hints, *servinfo, *bservinfo, *p, *b;
+    int blocking = (c->flags & REDIS_BLOCK);
+    int reuseaddr = (c->flags & REDIS_REUSEADDR);
+    int reuses = 0;
+
+    c->connection_type = REDIS_CONN_TCP;
+    c->tcp.port = port;
+
+    /* We need to take possession of the passed parameters
+     * to make them reusable for a reconnect.
+     * We also carefully check we don't free data we already own,
+     * as in the case of the reconnect method.
+     *
+     * This is a bit ugly, but atleast it works and doesn't leak memory.
+     **/
+    if (c->tcp.host != addr) {
+        if (c->tcp.host)
+            free(c->tcp.host);
+
+        c->tcp.host = strdup(addr);
+    }
+
+    if (timeout) {
+        if (c->timeout != timeout) {
+            if (c->timeout == NULL)
+                c->timeout = malloc(sizeof(struct timeval));
+
+            memcpy(c->timeout, timeout, sizeof(struct timeval));
+        }
+    } else {
+        if (c->timeout)
+            free(c->timeout);
+        c->timeout = NULL;
+    }
+
+    if (source_addr == NULL) {
+        free(c->tcp.source_addr);
+        c->tcp.source_addr = NULL;
+    } else if (c->tcp.source_addr != source_addr) {
+        free(c->tcp.source_addr);
+        c->tcp.source_addr = strdup(source_addr);
+    }
+    c->sockaddr.sa_family = AF_UNSPEC;
+    
+    snprintf(_port, 6, "%d", port);
+    memset(&hints,0,sizeof(hints));
+    hints.ai_family = AF_INET;
+    hints.ai_socktype = SOCK_STREAM;
+
+    /* Try with IPv6 if no IPv4 address was found. We do it in this order since
+     * in a Redis client you can't afford to test if you have IPv6 connectivity
+     * as this would add latency to every connect. Otherwise a more sensible
+     * route could be: Use IPv6 if both addresses are available and there is IPv6
+     * connectivity. */
+    if ((rv = getaddrinfo(c->tcp.host,_port,&hints,&servinfo)) != 0) {
+         hints.ai_family = AF_INET6;
+         if ((rv = getaddrinfo(addr,_port,&hints,&servinfo)) != 0) {
+            __redisSetError(c,REDIS_ERR_OTHER,gai_strerror(rv));
+            return REDIS_ERR;
+        }
+    }
+    for (p = servinfo; p != NULL; p = p->ai_next) {
+addrretry:
+        if ((s = socket(p->ai_family,p->ai_socktype,p->ai_protocol)) == -1)
+            continue;
+
+        c->fd = s;
+        if (redisSetBlocking(c,0) != REDIS_OK)
+            goto error;
+        if (c->tcp.source_addr) {
+            int bound = 0;
+            /* Using getaddrinfo saves us from self-determining IPv4 vs IPv6 */
+            if ((rv = getaddrinfo(c->tcp.source_addr, NULL, &hints, &bservinfo)) != 0) {
+                char buf[128];
+                snprintf(buf,sizeof(buf),"Can't get addr: %s",gai_strerror(rv));
+                __redisSetError(c,REDIS_ERR_OTHER,buf);
+                goto error;
+            }
+
+            if (reuseaddr) {
+                n = 1;
+                if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (char*) &n,
+                               sizeof(n)) < 0) {
+                    goto error;
+                }
+            }
+
+            for (b = bservinfo; b != NULL; b = b->ai_next) {
+                if (bind(s,b->ai_addr,b->ai_addrlen) != -1) {
+                    bound = 1;
+                    break;
+                }
+            }
+            freeaddrinfo(bservinfo);
+            if (!bound) {
+                char buf[128];
+                snprintf(buf,sizeof(buf),"Can't bind socket: %s",strerror(errno));
+                __redisSetError(c,REDIS_ERR_OTHER,buf);
+                goto error;
+            }
+        }
+        if (connect(s,p->ai_addr,p->ai_addrlen) == -1) {
+            if (errno == EHOSTUNREACH) {
+                redisContextCloseFd(c);
+                continue;
+            } else if (errno == EINPROGRESS && !blocking) {
+                /* This is ok. */
+            } else if (errno == EADDRNOTAVAIL && reuseaddr) {
+                if (++reuses >= REDIS_CONNECT_RETRIES) {
+                    goto error;
+                } else {
+                    goto addrretry;
+                }
+            } else {
+                if (redisContextWaitReady(c,c->timeout) != REDIS_OK)
+                    goto error;
+            }
+        }
+        if (blocking && redisSetBlocking(c,1) != REDIS_OK)
+            goto error;
+        if (redisSetTcpNoDelay(c) != REDIS_OK)
+            goto error;
+        
+        c->sockaddr = *p->ai_addr;
+        
+        c->flags |= REDIS_CONNECTED;
+        rv = REDIS_OK;
+        goto end;
+    }
+    if (p == NULL) {
+        char buf[128];
+        snprintf(buf,sizeof(buf),"Can't create socket: %s",strerror(errno));
+        __redisSetError(c,REDIS_ERR_OTHER,buf);
+        goto error;
+    }
+
+error:
+    rv = REDIS_ERR;
+end:
+    freeaddrinfo(servinfo);
+    return rv;  // Need to return REDIS_OK if alright
+}
+
+int redisContextConnectTcp(redisContext *c, const char *addr, int port,
+                           const struct timeval *timeout) {
+    return _redisContextConnectTcp(c, addr, port, timeout, NULL);
+}
+
+int redisContextConnectBindTcp(redisContext *c, const char *addr, int port,
+                               const struct timeval *timeout,
+                               const char *source_addr) {
+    return _redisContextConnectTcp(c, addr, port, timeout, source_addr);
+}
+
+int redisContextConnectUnix(redisContext *c, const char *path, const struct timeval *timeout) {
+    int blocking = (c->flags & REDIS_BLOCK);
+    struct sockaddr_un sa;
+
+    if (redisCreateSocket(c,AF_LOCAL) < 0)
+        return REDIS_ERR;
+    if (redisSetBlocking(c,0) != REDIS_OK)
+        return REDIS_ERR;
+
+    c->connection_type = REDIS_CONN_UNIX;
+    if (c->unix_sock.path != path)
+        c->unix_sock.path = strdup(path);
+
+    if (timeout) {
+        if (c->timeout != timeout) {
+            if (c->timeout == NULL)
+                c->timeout = malloc(sizeof(struct timeval));
+
+            memcpy(c->timeout, timeout, sizeof(struct timeval));
+        }
+    } else {
+        if (c->timeout)
+            free(c->timeout);
+        c->timeout = NULL;
+    }
+
+    sa.sun_family = AF_LOCAL;
+    strncpy(sa.sun_path,path,sizeof(sa.sun_path)-1);
+    if (connect(c->fd, (struct sockaddr*)&sa, sizeof(sa)) == -1) {
+        if (errno == EINPROGRESS && !blocking) {
+            /* This is ok. */
+        } else {
+            if (redisContextWaitReady(c,c->timeout) != REDIS_OK)
+                return REDIS_ERR;
+        }
+    }
+
+    /* Reset socket to be blocking after connect(2). */
+    if (blocking && redisSetBlocking(c,1) != REDIS_OK)
+        return REDIS_ERR;
+
+    c->flags |= REDIS_CONNECTED;
+    return REDIS_OK;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/net.h b/debian/modules/nchan/src/store/redis/hiredis/net.h
new file mode 100644
index 00000000..2f1a0bf8
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/net.h
@@ -0,0 +1,53 @@
+/* Extracted from anet.c to work properly with Hiredis error reporting.
+ *
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2014, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ * Copyright (c) 2015, Matt Stancliff <matt at genges dot com>,
+ *                     Jan-Erik Rediger <janerik at fnordig dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __NET_H
+#define __NET_H
+
+#include "hiredis.h"
+
+#if defined(__sun)
+#define AF_LOCAL AF_UNIX
+#endif
+
+int redisCheckSocketError(redisContext *c);
+int redisContextSetTimeout(redisContext *c, const struct timeval tv);
+int redisContextConnectTcp(redisContext *c, const char *addr, int port, const struct timeval *timeout);
+int redisContextConnectBindTcp(redisContext *c, const char *addr, int port,
+                               const struct timeval *timeout,
+                               const char *source_addr);
+int redisContextConnectUnix(redisContext *c, const char *path, const struct timeval *timeout);
+int redisKeepAlive(redisContext *c, int interval);
+
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/read.c b/debian/modules/nchan/src/store/redis/hiredis/read.c
new file mode 100644
index 00000000..df1a467a
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/read.c
@@ -0,0 +1,525 @@
+/*
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "fmacros.h"
+#include <string.h>
+#include <stdlib.h>
+#ifndef _MSC_VER
+#include <unistd.h>
+#endif
+#include <assert.h>
+#include <errno.h>
+#include <ctype.h>
+
+#include "read.h"
+#include "sds.h"
+
+static void __redisReaderSetError(redisReader *r, int type, const char *str) {
+    size_t len;
+
+    if (r->reply != NULL && r->fn && r->fn->freeObject) {
+        r->fn->freeObject(r->reply);
+        r->reply = NULL;
+    }
+
+    /* Clear input buffer on errors. */
+    if (r->buf != NULL) {
+        sdsfree(r->buf);
+        r->buf = NULL;
+        r->pos = r->len = 0;
+    }
+
+    /* Reset task stack. */
+    r->ridx = -1;
+
+    /* Set error. */
+    r->err = type;
+    len = strlen(str);
+    len = len < (sizeof(r->errstr)-1) ? len : (sizeof(r->errstr)-1);
+    memcpy(r->errstr,str,len);
+    r->errstr[len] = '\0';
+}
+
+static size_t chrtos(char *buf, size_t size, char byte) {
+    size_t len = 0;
+
+    switch(byte) {
+    case '\\':
+    case '"':
+        len = snprintf(buf,size,"\"\\%c\"",byte);
+        break;
+    case '\n': len = snprintf(buf,size,"\"\\n\""); break;
+    case '\r': len = snprintf(buf,size,"\"\\r\""); break;
+    case '\t': len = snprintf(buf,size,"\"\\t\""); break;
+    case '\a': len = snprintf(buf,size,"\"\\a\""); break;
+    case '\b': len = snprintf(buf,size,"\"\\b\""); break;
+    default:
+        if (isprint(byte))
+            len = snprintf(buf,size,"\"%c\"",byte);
+        else
+            len = snprintf(buf,size,"\"\\x%02x\"",(unsigned char)byte);
+        break;
+    }
+
+    return len;
+}
+
+static void __redisReaderSetErrorProtocolByte(redisReader *r, char byte) {
+    char cbuf[8], sbuf[128];
+
+    chrtos(cbuf,sizeof(cbuf),byte);
+    snprintf(sbuf,sizeof(sbuf),
+        "Protocol error, got %s as reply type byte", cbuf);
+    __redisReaderSetError(r,REDIS_ERR_PROTOCOL,sbuf);
+}
+
+static void __redisReaderSetErrorOOM(redisReader *r) {
+    __redisReaderSetError(r,REDIS_ERR_OOM,"Out of memory");
+}
+
+static char *readBytes(redisReader *r, unsigned int bytes) {
+    char *p;
+    if (r->len-r->pos >= bytes) {
+        p = r->buf+r->pos;
+        r->pos += bytes;
+        return p;
+    }
+    return NULL;
+}
+
+/* Find pointer to \r\n. */
+static char *seekNewline(char *s, size_t len) {
+    int pos = 0;
+    int _len = len-1;
+
+    /* Position should be < len-1 because the character at "pos" should be
+     * followed by a \n. Note that strchr cannot be used because it doesn't
+     * allow to search a limited length and the buffer that is being searched
+     * might not have a trailing NULL character. */
+    while (pos < _len) {
+        while(pos < _len && s[pos] != '\r') pos++;
+        if (s[pos] != '\r') {
+            /* Not found. */
+            return NULL;
+        } else {
+            if (s[pos+1] == '\n') {
+                /* Found. */
+                return s+pos;
+            } else {
+                /* Continue searching. */
+                pos++;
+            }
+        }
+    }
+    return NULL;
+}
+
+/* Read a long long value starting at *s, under the assumption that it will be
+ * terminated by \r\n. Ambiguously returns -1 for unexpected input. */
+static long long readLongLong(char *s) {
+    long long v = 0;
+    int dec, mult = 1;
+    char c;
+
+    if (*s == '-') {
+        mult = -1;
+        s++;
+    } else if (*s == '+') {
+        mult = 1;
+        s++;
+    }
+
+    while ((c = *(s++)) != '\r') {
+        dec = c - '0';
+        if (dec >= 0 && dec < 10) {
+            v *= 10;
+            v += dec;
+        } else {
+            /* Should not happen... */
+            return -1;
+        }
+    }
+
+    return mult*v;
+}
+
+static char *readLine(redisReader *r, int *_len) {
+    char *p, *s;
+    int len;
+
+    p = r->buf+r->pos;
+    s = seekNewline(p,(r->len-r->pos));
+    if (s != NULL) {
+        len = s-(r->buf+r->pos);
+        r->pos += len+2; /* skip \r\n */
+        if (_len) *_len = len;
+        return p;
+    }
+    return NULL;
+}
+
+static void moveToNextTask(redisReader *r) {
+    redisReadTask *cur, *prv;
+    while (r->ridx >= 0) {
+        /* Return a.s.a.p. when the stack is now empty. */
+        if (r->ridx == 0) {
+            r->ridx--;
+            return;
+        }
+
+        cur = &(r->rstack[r->ridx]);
+        prv = &(r->rstack[r->ridx-1]);
+        assert(prv->type == REDIS_REPLY_ARRAY);
+        if (cur->idx == prv->elements-1) {
+            r->ridx--;
+        } else {
+            /* Reset the type because the next item can be anything */
+            assert(cur->idx < prv->elements);
+            cur->type = -1;
+            cur->elements = -1;
+            cur->idx++;
+            return;
+        }
+    }
+}
+
+static int processLineItem(redisReader *r) {
+    redisReadTask *cur = &(r->rstack[r->ridx]);
+    void *obj;
+    char *p;
+    int len;
+
+    if ((p = readLine(r,&len)) != NULL) {
+        if (cur->type == REDIS_REPLY_INTEGER) {
+            if (r->fn && r->fn->createInteger)
+                obj = r->fn->createInteger(cur,readLongLong(p));
+            else
+                obj = (void*)REDIS_REPLY_INTEGER;
+        } else {
+            /* Type will be error or status. */
+            if (r->fn && r->fn->createString)
+                obj = r->fn->createString(cur,p,len);
+            else
+                obj = (void*)(size_t)(cur->type);
+        }
+
+        if (obj == NULL) {
+            __redisReaderSetErrorOOM(r);
+            return REDIS_ERR;
+        }
+
+        /* Set reply if this is the root object. */
+        if (r->ridx == 0) r->reply = obj;
+        moveToNextTask(r);
+        return REDIS_OK;
+    }
+
+    return REDIS_ERR;
+}
+
+static int processBulkItem(redisReader *r) {
+    redisReadTask *cur = &(r->rstack[r->ridx]);
+    void *obj = NULL;
+    char *p, *s;
+    long len;
+    unsigned long bytelen;
+    int success = 0;
+
+    p = r->buf+r->pos;
+    s = seekNewline(p,r->len-r->pos);
+    if (s != NULL) {
+        p = r->buf+r->pos;
+        bytelen = s-(r->buf+r->pos)+2; /* include \r\n */
+        len = readLongLong(p);
+
+        if (len < 0) {
+            /* The nil object can always be created. */
+            if (r->fn && r->fn->createNil)
+                obj = r->fn->createNil(cur);
+            else
+                obj = (void*)REDIS_REPLY_NIL;
+            success = 1;
+        } else {
+            /* Only continue when the buffer contains the entire bulk item. */
+            bytelen += len+2; /* include \r\n */
+            if (r->pos+bytelen <= r->len) {
+                if (r->fn && r->fn->createString)
+                    obj = r->fn->createString(cur,s+2,len);
+                else
+                    obj = (void*)REDIS_REPLY_STRING;
+                success = 1;
+            }
+        }
+
+        /* Proceed when obj was created. */
+        if (success) {
+            if (obj == NULL) {
+                __redisReaderSetErrorOOM(r);
+                return REDIS_ERR;
+            }
+
+            r->pos += bytelen;
+
+            /* Set reply if this is the root object. */
+            if (r->ridx == 0) r->reply = obj;
+            moveToNextTask(r);
+            return REDIS_OK;
+        }
+    }
+
+    return REDIS_ERR;
+}
+
+static int processMultiBulkItem(redisReader *r) {
+    redisReadTask *cur = &(r->rstack[r->ridx]);
+    void *obj;
+    char *p;
+    long elements;
+    int root = 0;
+
+    /* Set error for nested multi bulks with depth > 7 */
+    if (r->ridx == 8) {
+        __redisReaderSetError(r,REDIS_ERR_PROTOCOL,
+            "No support for nested multi bulk replies with depth > 7");
+        return REDIS_ERR;
+    }
+
+    if ((p = readLine(r,NULL)) != NULL) {
+        elements = readLongLong(p);
+        root = (r->ridx == 0);
+
+        if (elements == -1) {
+            if (r->fn && r->fn->createNil)
+                obj = r->fn->createNil(cur);
+            else
+                obj = (void*)REDIS_REPLY_NIL;
+
+            if (obj == NULL) {
+                __redisReaderSetErrorOOM(r);
+                return REDIS_ERR;
+            }
+
+            moveToNextTask(r);
+        } else {
+            if (r->fn && r->fn->createArray)
+                obj = r->fn->createArray(cur,elements);
+            else
+                obj = (void*)REDIS_REPLY_ARRAY;
+
+            if (obj == NULL) {
+                __redisReaderSetErrorOOM(r);
+                return REDIS_ERR;
+            }
+
+            /* Modify task stack when there are more than 0 elements. */
+            if (elements > 0) {
+                cur->elements = elements;
+                cur->obj = obj;
+                r->ridx++;
+                r->rstack[r->ridx].type = -1;
+                r->rstack[r->ridx].elements = -1;
+                r->rstack[r->ridx].idx = 0;
+                r->rstack[r->ridx].obj = NULL;
+                r->rstack[r->ridx].parent = cur;
+                r->rstack[r->ridx].privdata = r->privdata;
+            } else {
+                moveToNextTask(r);
+            }
+        }
+
+        /* Set reply if this is the root object. */
+        if (root) r->reply = obj;
+        return REDIS_OK;
+    }
+
+    return REDIS_ERR;
+}
+
+static int processItem(redisReader *r) {
+    redisReadTask *cur = &(r->rstack[r->ridx]);
+    char *p;
+
+    /* check if we need to read type */
+    if (cur->type < 0) {
+        if ((p = readBytes(r,1)) != NULL) {
+            switch (p[0]) {
+            case '-':
+                cur->type = REDIS_REPLY_ERROR;
+                break;
+            case '+':
+                cur->type = REDIS_REPLY_STATUS;
+                break;
+            case ':':
+                cur->type = REDIS_REPLY_INTEGER;
+                break;
+            case '$':
+                cur->type = REDIS_REPLY_STRING;
+                break;
+            case '*':
+                cur->type = REDIS_REPLY_ARRAY;
+                break;
+            default:
+                __redisReaderSetErrorProtocolByte(r,*p);
+                return REDIS_ERR;
+            }
+        } else {
+            /* could not consume 1 byte */
+            return REDIS_ERR;
+        }
+    }
+
+    /* process typed item */
+    switch(cur->type) {
+    case REDIS_REPLY_ERROR:
+    case REDIS_REPLY_STATUS:
+    case REDIS_REPLY_INTEGER:
+        return processLineItem(r);
+    case REDIS_REPLY_STRING:
+        return processBulkItem(r);
+    case REDIS_REPLY_ARRAY:
+        return processMultiBulkItem(r);
+    default:
+        assert(NULL);
+        return REDIS_ERR; /* Avoid warning. */
+    }
+}
+
+redisReader *redisReaderCreateWithFunctions(redisReplyObjectFunctions *fn) {
+    redisReader *r;
+
+    r = calloc(sizeof(redisReader),1);
+    if (r == NULL)
+        return NULL;
+
+    r->err = 0;
+    r->errstr[0] = '\0';
+    r->fn = fn;
+    r->buf = sdsempty();
+    r->maxbuf = REDIS_READER_MAX_BUF;
+    if (r->buf == NULL) {
+        free(r);
+        return NULL;
+    }
+
+    r->ridx = -1;
+    return r;
+}
+
+void redisReaderFree(redisReader *r) {
+    if (r->reply != NULL && r->fn && r->fn->freeObject)
+        r->fn->freeObject(r->reply);
+    if (r->buf != NULL)
+        sdsfree(r->buf);
+    free(r);
+}
+
+int redisReaderFeed(redisReader *r, const char *buf, size_t len) {
+    sds newbuf;
+
+    /* Return early when this reader is in an erroneous state. */
+    if (r->err)
+        return REDIS_ERR;
+
+    /* Copy the provided buffer. */
+    if (buf != NULL && len >= 1) {
+        /* Destroy internal buffer when it is empty and is quite large. */
+        if (r->len == 0 && r->maxbuf != 0 && sdsavail(r->buf) > r->maxbuf) {
+            sdsfree(r->buf);
+            r->buf = sdsempty();
+            r->pos = 0;
+
+            /* r->buf should not be NULL since we just free'd a larger one. */
+            assert(r->buf != NULL);
+        }
+
+        newbuf = sdscatlen(r->buf,buf,len);
+        if (newbuf == NULL) {
+            __redisReaderSetErrorOOM(r);
+            return REDIS_ERR;
+        }
+
+        r->buf = newbuf;
+        r->len = sdslen(r->buf);
+    }
+
+    return REDIS_OK;
+}
+
+int redisReaderGetReply(redisReader *r, void **reply) {
+    /* Default target pointer to NULL. */
+    if (reply != NULL)
+        *reply = NULL;
+
+    /* Return early when this reader is in an erroneous state. */
+    if (r->err)
+        return REDIS_ERR;
+
+    /* When the buffer is empty, there will never be a reply. */
+    if (r->len == 0)
+        return REDIS_OK;
+
+    /* Set first item to process when the stack is empty. */
+    if (r->ridx == -1) {
+        r->rstack[0].type = -1;
+        r->rstack[0].elements = -1;
+        r->rstack[0].idx = -1;
+        r->rstack[0].obj = NULL;
+        r->rstack[0].parent = NULL;
+        r->rstack[0].privdata = r->privdata;
+        r->ridx = 0;
+    }
+
+    /* Process items in reply. */
+    while (r->ridx >= 0)
+        if (processItem(r) != REDIS_OK)
+            break;
+
+    /* Return ASAP when an error occurred. */
+    if (r->err)
+        return REDIS_ERR;
+
+    /* Discard part of the buffer when we've consumed at least 1k, to avoid
+     * doing unnecessary calls to memmove() in sds.c. */
+    if (r->pos >= 1024) {
+        sdsrange(r->buf,r->pos,-1);
+        r->pos = 0;
+        r->len = sdslen(r->buf);
+    }
+
+    /* Emit a reply when there is one. */
+    if (r->ridx == -1) {
+        if (reply != NULL)
+            *reply = r->reply;
+        r->reply = NULL;
+    }
+    return REDIS_OK;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/read.h b/debian/modules/nchan/src/store/redis/hiredis/read.h
new file mode 100644
index 00000000..180e6c6b
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/read.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+ * Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef __HIREDIS_READ_H
+#define __HIREDIS_READ_H
+#include <stdio.h> /* for size_t */
+
+#define REDIS_ERR -1
+#define REDIS_OK 0
+
+/* When an error occurs, the err flag in a context is set to hold the type of
+ * error that occurred. REDIS_ERR_IO means there was an I/O error and you
+ * should use the "errno" variable to find out what is wrong.
+ * For other values, the "errstr" field will hold a description. */
+#define REDIS_ERR_IO 1 /* Error in read or write */
+#define REDIS_ERR_EOF 3 /* End of file */
+#define REDIS_ERR_PROTOCOL 4 /* Protocol error */
+#define REDIS_ERR_OOM 5 /* Out of memory */
+#define REDIS_ERR_OTHER 2 /* Everything else... */
+
+#define REDIS_REPLY_STRING 1
+#define REDIS_REPLY_ARRAY 2
+#define REDIS_REPLY_INTEGER 3
+#define REDIS_REPLY_NIL 4
+#define REDIS_REPLY_STATUS 5
+#define REDIS_REPLY_ERROR 6
+
+#define REDIS_READER_MAX_BUF (1024*16)  /* Default max unused reader buffer. */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct redisReadTask {
+    int type;
+    int elements; /* number of elements in multibulk container */
+    int idx; /* index in parent (array) object */
+    void *obj; /* holds user-generated value for a read task */
+    struct redisReadTask *parent; /* parent task */
+    void *privdata; /* user-settable arbitrary field */
+} redisReadTask;
+
+typedef struct redisReplyObjectFunctions {
+    void *(*createString)(const redisReadTask*, char*, size_t);
+    void *(*createArray)(const redisReadTask*, int);
+    void *(*createInteger)(const redisReadTask*, long long);
+    void *(*createNil)(const redisReadTask*);
+    void (*freeObject)(void*);
+} redisReplyObjectFunctions;
+
+typedef struct redisReader {
+    int err; /* Error flags, 0 when there is no error */
+    char errstr[128]; /* String representation of error when applicable */
+
+    char *buf; /* Read buffer */
+    size_t pos; /* Buffer cursor */
+    size_t len; /* Buffer length */
+    size_t maxbuf; /* Max length of unused buffer */
+
+    redisReadTask rstack[9];
+    int ridx; /* Index of current read task */
+    void *reply; /* Temporary reply pointer */
+
+    redisReplyObjectFunctions *fn;
+    void *privdata;
+} redisReader;
+
+/* Public API for the protocol parser. */
+redisReader *redisReaderCreateWithFunctions(redisReplyObjectFunctions *fn);
+void redisReaderFree(redisReader *r);
+int redisReaderFeed(redisReader *r, const char *buf, size_t len);
+int redisReaderGetReply(redisReader *r, void **reply);
+
+/* Backwards compatibility, can be removed on big version bump. */
+#define redisReplyReaderCreate redisReaderCreate
+#define redisReplyReaderFree redisReaderFree
+#define redisReplyReaderFeed redisReaderFeed
+#define redisReplyReaderGetReply redisReaderGetReply
+#define redisReplyReaderSetPrivdata(_r, _p) (int)(((redisReader*)(_r))->privdata = (_p))
+#define redisReplyReaderGetObject(_r) (((redisReader*)(_r))->reply)
+#define redisReplyReaderGetError(_r) (((redisReader*)(_r))->errstr)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/sds.c b/debian/modules/nchan/src/store/redis/hiredis/sds.c
new file mode 100644
index 00000000..f01247de
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/sds.c
@@ -0,0 +1,1095 @@
+/* SDS (Simple Dynamic Strings), A C dynamic strings library.
+ *
+ * Copyright (c) 2006-2014, Salvatore Sanfilippo <antirez at gmail dot com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <assert.h>
+
+#include "sds.h"
+
+/* Create a new sds string with the content specified by the 'init' pointer
+ * and 'initlen'.
+ * If NULL is used for 'init' the string is initialized with zero bytes.
+ *
+ * The string is always null-termined (all the sds strings are, always) so
+ * even if you create an sds string with:
+ *
+ * mystring = sdsnewlen("abc",3");
+ *
+ * You can print the string with printf() as there is an implicit \0 at the
+ * end of the string. However the string is binary safe and can contain
+ * \0 characters in the middle, as the length is stored in the sds header. */
+sds sdsnewlen(const void *init, size_t initlen) {
+    struct sdshdr *sh;
+
+    if (init) {
+        sh = malloc(sizeof *sh+initlen+1);
+    } else {
+        sh = calloc(sizeof *sh+initlen+1,1);
+    }
+    if (sh == NULL) return NULL;
+    sh->len = initlen;
+    sh->free = 0;
+    if (initlen && init)
+        memcpy(sh->buf, init, initlen);
+    sh->buf[initlen] = '\0';
+    return (char*)sh->buf;
+}
+
+/* Create an empty (zero length) sds string. Even in this case the string
+ * always has an implicit null term. */
+sds sdsempty(void) {
+    return sdsnewlen("",0);
+}
+
+/* Create a new sds string starting from a null termined C string. */
+sds sdsnew(const char *init) {
+    size_t initlen = (init == NULL) ? 0 : strlen(init);
+    return sdsnewlen(init, initlen);
+}
+
+/* Duplicate an sds string. */
+sds sdsdup(const sds s) {
+    return sdsnewlen(s, sdslen(s));
+}
+
+/* Free an sds string. No operation is performed if 's' is NULL. */
+void sdsfree(sds s) {
+    if (s == NULL) return;
+    free(s-sizeof(struct sdshdr));
+}
+
+/* Set the sds string length to the length as obtained with strlen(), so
+ * considering as content only up to the first null term character.
+ *
+ * This function is useful when the sds string is hacked manually in some
+ * way, like in the following example:
+ *
+ * s = sdsnew("foobar");
+ * s[2] = '\0';
+ * sdsupdatelen(s);
+ * printf("%d\n", sdslen(s));
+ *
+ * The output will be "2", but if we comment out the call to sdsupdatelen()
+ * the output will be "6" as the string was modified but the logical length
+ * remains 6 bytes. */
+void sdsupdatelen(sds s) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+    int reallen = strlen(s);
+    sh->free += (sh->len-reallen);
+    sh->len = reallen;
+}
+
+/* Modify an sds string on-place to make it empty (zero length).
+ * However all the existing buffer is not discarded but set as free space
+ * so that next append operations will not require allocations up to the
+ * number of bytes previously available. */
+void sdsclear(sds s) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+    sh->free += sh->len;
+    sh->len = 0;
+    sh->buf[0] = '\0';
+}
+
+/* Enlarge the free space at the end of the sds string so that the caller
+ * is sure that after calling this function can overwrite up to addlen
+ * bytes after the end of the string, plus one more byte for nul term.
+ *
+ * Note: this does not change the *length* of the sds string as returned
+ * by sdslen(), but only the free buffer space we have. */
+sds sdsMakeRoomFor(sds s, size_t addlen) {
+    struct sdshdr *sh, *newsh;
+    size_t free = sdsavail(s);
+    size_t len, newlen;
+
+    if (free >= addlen) return s;
+    len = sdslen(s);
+    sh = (void*) (s-sizeof *sh);
+    newlen = (len+addlen);
+    if (newlen < SDS_MAX_PREALLOC)
+        newlen *= 2;
+    else
+        newlen += SDS_MAX_PREALLOC;
+    newsh = realloc(sh, sizeof *newsh+newlen+1);
+    if (newsh == NULL) return NULL;
+
+    newsh->free = newlen - len;
+    return newsh->buf;
+}
+
+/* Reallocate the sds string so that it has no free space at the end. The
+ * contained string remains not altered, but next concatenation operations
+ * will require a reallocation.
+ *
+ * After the call, the passed sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdsRemoveFreeSpace(sds s) {
+    struct sdshdr *sh;
+
+    sh = (void*) (s-sizeof *sh);
+    sh = realloc(sh, sizeof *sh+sh->len+1);
+    sh->free = 0;
+    return sh->buf;
+}
+
+/* Return the total size of the allocation of the specifed sds string,
+ * including:
+ * 1) The sds header before the pointer.
+ * 2) The string.
+ * 3) The free buffer at the end if any.
+ * 4) The implicit null term.
+ */
+size_t sdsAllocSize(sds s) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+
+    return sizeof(*sh)+sh->len+sh->free+1;
+}
+
+/* Increment the sds length and decrements the left free space at the
+ * end of the string according to 'incr'. Also set the null term
+ * in the new end of the string.
+ *
+ * This function is used in order to fix the string length after the
+ * user calls sdsMakeRoomFor(), writes something after the end of
+ * the current string, and finally needs to set the new length.
+ *
+ * Note: it is possible to use a negative increment in order to
+ * right-trim the string.
+ *
+ * Usage example:
+ *
+ * Using sdsIncrLen() and sdsMakeRoomFor() it is possible to mount the
+ * following schema, to cat bytes coming from the kernel to the end of an
+ * sds string without copying into an intermediate buffer:
+ *
+ * oldlen = sdslen(s);
+ * s = sdsMakeRoomFor(s, BUFFER_SIZE);
+ * nread = read(fd, s+oldlen, BUFFER_SIZE);
+ * ... check for nread <= 0 and handle it ...
+ * sdsIncrLen(s, nread);
+ */
+void sdsIncrLen(sds s, int incr) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+
+    assert(sh->free >= incr);
+    sh->len += incr;
+    sh->free -= incr;
+    assert(sh->free >= 0);
+    s[sh->len] = '\0';
+}
+
+/* Grow the sds to have the specified length. Bytes that were not part of
+ * the original length of the sds will be set to zero.
+ *
+ * if the specified length is smaller than the current length, no operation
+ * is performed. */
+sds sdsgrowzero(sds s, size_t len) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+    size_t totlen, curlen = sh->len;
+
+    if (len <= curlen) return s;
+    s = sdsMakeRoomFor(s,len-curlen);
+    if (s == NULL) return NULL;
+
+    /* Make sure added region doesn't contain garbage */
+    sh = (void*)(s-sizeof *sh);
+    memset(s+curlen,0,(len-curlen+1)); /* also set trailing \0 byte */
+    totlen = sh->len+sh->free;
+    sh->len = len;
+    sh->free = totlen-sh->len;
+    return s;
+}
+
+/* Append the specified binary-safe string pointed by 't' of 'len' bytes to the
+ * end of the specified sds string 's'.
+ *
+ * After the call, the passed sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscatlen(sds s, const void *t, size_t len) {
+    struct sdshdr *sh;
+    size_t curlen = sdslen(s);
+
+    s = sdsMakeRoomFor(s,len);
+    if (s == NULL) return NULL;
+    sh = (void*) (s-sizeof *sh);
+    memcpy(s+curlen, t, len);
+    sh->len = curlen+len;
+    sh->free = sh->free-len;
+    s[curlen+len] = '\0';
+    return s;
+}
+
+/* Append the specified null termianted C string to the sds string 's'.
+ *
+ * After the call, the passed sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscat(sds s, const char *t) {
+    return sdscatlen(s, t, strlen(t));
+}
+
+/* Append the specified sds 't' to the existing sds 's'.
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscatsds(sds s, const sds t) {
+    return sdscatlen(s, t, sdslen(t));
+}
+
+/* Destructively modify the sds string 's' to hold the specified binary
+ * safe string pointed by 't' of length 'len' bytes. */
+sds sdscpylen(sds s, const char *t, size_t len) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+    size_t totlen = sh->free+sh->len;
+
+    if (totlen < len) {
+        s = sdsMakeRoomFor(s,len-sh->len);
+        if (s == NULL) return NULL;
+        sh = (void*) (s-sizeof *sh);
+        totlen = sh->free+sh->len;
+    }
+    memcpy(s, t, len);
+    s[len] = '\0';
+    sh->len = len;
+    sh->free = totlen-len;
+    return s;
+}
+
+/* Like sdscpylen() but 't' must be a null-termined string so that the length
+ * of the string is obtained with strlen(). */
+sds sdscpy(sds s, const char *t) {
+    return sdscpylen(s, t, strlen(t));
+}
+
+/* Helper for sdscatlonglong() doing the actual number -> string
+ * conversion. 's' must point to a string with room for at least
+ * SDS_LLSTR_SIZE bytes.
+ *
+ * The function returns the length of the null-terminated string
+ * representation stored at 's'. */
+#define SDS_LLSTR_SIZE 21
+int sdsll2str(char *s, long long value) {
+    char *p, aux;
+    unsigned long long v;
+    size_t l;
+
+    /* Generate the string representation, this method produces
+     * an reversed string. */
+    v = (value < 0) ? -value : value;
+    p = s;
+    do {
+        *p++ = '0'+(v%10);
+        v /= 10;
+    } while(v);
+    if (value < 0) *p++ = '-';
+
+    /* Compute length and add null term. */
+    l = p-s;
+    *p = '\0';
+
+    /* Reverse the string. */
+    p--;
+    while(s < p) {
+        aux = *s;
+        *s = *p;
+        *p = aux;
+        s++;
+        p--;
+    }
+    return l;
+}
+
+/* Identical sdsll2str(), but for unsigned long long type. */
+int sdsull2str(char *s, unsigned long long v) {
+    char *p, aux;
+    size_t l;
+
+    /* Generate the string representation, this method produces
+     * an reversed string. */
+    p = s;
+    do {
+        *p++ = '0'+(v%10);
+        v /= 10;
+    } while(v);
+
+    /* Compute length and add null term. */
+    l = p-s;
+    *p = '\0';
+
+    /* Reverse the string. */
+    p--;
+    while(s < p) {
+        aux = *s;
+        *s = *p;
+        *p = aux;
+        s++;
+        p--;
+    }
+    return l;
+}
+
+/* Like sdscatpritf() but gets va_list instead of being variadic. */
+sds sdscatvprintf(sds s, const char *fmt, va_list ap) {
+    va_list cpy;
+    char *buf, *t;
+    size_t buflen = 16;
+
+    while(1) {
+        buf = malloc(buflen);
+        if (buf == NULL) return NULL;
+        buf[buflen-2] = '\0';
+        va_copy(cpy,ap);
+        vsnprintf(buf, buflen, fmt, cpy);
+        if (buf[buflen-2] != '\0') {
+            free(buf);
+            buflen *= 2;
+            continue;
+        }
+        break;
+    }
+    t = sdscat(s, buf);
+    free(buf);
+    return t;
+}
+
+/* Append to the sds string 's' a string obtained using printf-alike format
+ * specifier.
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call.
+ *
+ * Example:
+ *
+ * s = sdsnew("Sum is: ");
+ * s = sdscatprintf(s,"%d+%d = %d",a,b,a+b);
+ *
+ * Often you need to create a string from scratch with the printf-alike
+ * format. When this is the need, just use sdsempty() as the target string:
+ *
+ * s = sdscatprintf(sdsempty(), "... your format ...", args);
+ */
+sds sdscatprintf(sds s, const char *fmt, ...) {
+    va_list ap;
+    char *t;
+    va_start(ap, fmt);
+    t = sdscatvprintf(s,fmt,ap);
+    va_end(ap);
+    return t;
+}
+
+/* This function is similar to sdscatprintf, but much faster as it does
+ * not rely on sprintf() family functions implemented by the libc that
+ * are often very slow. Moreover directly handling the sds string as
+ * new data is concatenated provides a performance improvement.
+ *
+ * However this function only handles an incompatible subset of printf-alike
+ * format specifiers:
+ *
+ * %s - C String
+ * %S - SDS string
+ * %i - signed int
+ * %I - 64 bit signed integer (long long, int64_t)
+ * %u - unsigned int
+ * %U - 64 bit unsigned integer (unsigned long long, uint64_t)
+ * %T - A size_t variable.
+ * %% - Verbatim "%" character.
+ */
+sds sdscatfmt(sds s, char const *fmt, ...) {
+    struct sdshdr *sh = (void*) (s-(sizeof(struct sdshdr)));
+    size_t initlen = sdslen(s);
+    const char *f = fmt;
+    int i;
+    va_list ap;
+
+    va_start(ap,fmt);
+    f = fmt;    /* Next format specifier byte to process. */
+    i = initlen; /* Position of the next byte to write to dest str. */
+    while(*f) {
+        char next, *str;
+        int l;
+        long long num;
+        unsigned long long unum;
+
+        /* Make sure there is always space for at least 1 char. */
+        if (sh->free == 0) {
+            s = sdsMakeRoomFor(s,1);
+            sh = (void*) (s-(sizeof(struct sdshdr)));
+        }
+
+        switch(*f) {
+        case '%':
+            next = *(f+1);
+            f++;
+            switch(next) {
+            case 's':
+            case 'S':
+                str = va_arg(ap,char*);
+                l = (next == 's') ? strlen(str) : sdslen(str);
+                if (sh->free < l) {
+                    s = sdsMakeRoomFor(s,l);
+                    sh = (void*) (s-(sizeof(struct sdshdr)));
+                }
+                memcpy(s+i,str,l);
+                sh->len += l;
+                sh->free -= l;
+                i += l;
+                break;
+            case 'i':
+            case 'I':
+                if (next == 'i')
+                    num = va_arg(ap,int);
+                else
+                    num = va_arg(ap,long long);
+                {
+                    char buf[SDS_LLSTR_SIZE];
+                    l = sdsll2str(buf,num);
+                    if (sh->free < l) {
+                        s = sdsMakeRoomFor(s,l);
+                        sh = (void*) (s-(sizeof(struct sdshdr)));
+                    }
+                    memcpy(s+i,buf,l);
+                    sh->len += l;
+                    sh->free -= l;
+                    i += l;
+                }
+                break;
+            case 'u':
+            case 'U':
+            case 'T':
+                if (next == 'u')
+                    unum = va_arg(ap,unsigned int);
+                else if(next == 'U')
+                    unum = va_arg(ap,unsigned long long);
+                else
+                    unum = (unsigned long long)va_arg(ap,size_t);
+                {
+                    char buf[SDS_LLSTR_SIZE];
+                    l = sdsull2str(buf,unum);
+                    if (sh->free < l) {
+                        s = sdsMakeRoomFor(s,l);
+                        sh = (void*) (s-(sizeof(struct sdshdr)));
+                    }
+                    memcpy(s+i,buf,l);
+                    sh->len += l;
+                    sh->free -= l;
+                    i += l;
+                }
+                break;
+            default: /* Handle %% and generally %<unknown>. */
+                s[i++] = next;
+                sh->len += 1;
+                sh->free -= 1;
+                break;
+            }
+            break;
+        default:
+            s[i++] = *f;
+            sh->len += 1;
+            sh->free -= 1;
+            break;
+        }
+        f++;
+    }
+    va_end(ap);
+
+    /* Add null-term */
+    s[i] = '\0';
+    return s;
+}
+
+
+/* Remove the part of the string from left and from right composed just of
+ * contiguous characters found in 'cset', that is a null terminted C string.
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call.
+ *
+ * Example:
+ *
+ * s = sdsnew("AA...AA.a.aa.aHelloWorld     :::");
+ * s = sdstrim(s,"A. :");
+ * printf("%s\n", s);
+ *
+ * Output will be just "Hello World".
+ */
+void sdstrim(sds s, const char *cset) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+    char *start, *end, *sp, *ep;
+    size_t len;
+
+    sp = start = s;
+    ep = end = s+sdslen(s)-1;
+    while(sp <= end && strchr(cset, *sp)) sp++;
+    while(ep > start && strchr(cset, *ep)) ep--;
+    len = (sp > ep) ? 0 : ((ep-sp)+1);
+    if (sh->buf != sp) memmove(sh->buf, sp, len);
+    sh->buf[len] = '\0';
+    sh->free = sh->free+(sh->len-len);
+    sh->len = len;
+}
+
+/* Turn the string into a smaller (or equal) string containing only the
+ * substring specified by the 'start' and 'end' indexes.
+ *
+ * start and end can be negative, where -1 means the last character of the
+ * string, -2 the penultimate character, and so forth.
+ *
+ * The interval is inclusive, so the start and end characters will be part
+ * of the resulting string.
+ *
+ * The string is modified in-place.
+ *
+ * Example:
+ *
+ * s = sdsnew("Hello World");
+ * sdsrange(s,1,-1); => "ello World"
+ */
+void sdsrange(sds s, int start, int end) {
+    struct sdshdr *sh = (void*) (s-sizeof *sh);
+    size_t newlen, len = sdslen(s);
+
+    if (len == 0) return;
+    if (start < 0) {
+        start = len+start;
+        if (start < 0) start = 0;
+    }
+    if (end < 0) {
+        end = len+end;
+        if (end < 0) end = 0;
+    }
+    newlen = (start > end) ? 0 : (end-start)+1;
+    if (newlen != 0) {
+        if (start >= (signed)len) {
+            newlen = 0;
+        } else if (end >= (signed)len) {
+            end = len-1;
+            newlen = (start > end) ? 0 : (end-start)+1;
+        }
+    } else {
+        start = 0;
+    }
+    if (start && newlen) memmove(sh->buf, sh->buf+start, newlen);
+    sh->buf[newlen] = 0;
+    sh->free = sh->free+(sh->len-newlen);
+    sh->len = newlen;
+}
+
+/* Apply tolower() to every character of the sds string 's'. */
+void sdstolower(sds s) {
+    int len = sdslen(s), j;
+
+    for (j = 0; j < len; j++) s[j] = tolower(s[j]);
+}
+
+/* Apply toupper() to every character of the sds string 's'. */
+void sdstoupper(sds s) {
+    int len = sdslen(s), j;
+
+    for (j = 0; j < len; j++) s[j] = toupper(s[j]);
+}
+
+/* Compare two sds strings s1 and s2 with memcmp().
+ *
+ * Return value:
+ *
+ *     1 if s1 > s2.
+ *    -1 if s1 < s2.
+ *     0 if s1 and s2 are exactly the same binary string.
+ *
+ * If two strings share exactly the same prefix, but one of the two has
+ * additional characters, the longer string is considered to be greater than
+ * the smaller one. */
+int sdscmp(const sds s1, const sds s2) {
+    size_t l1, l2, minlen;
+    int cmp;
+
+    l1 = sdslen(s1);
+    l2 = sdslen(s2);
+    minlen = (l1 < l2) ? l1 : l2;
+    cmp = memcmp(s1,s2,minlen);
+    if (cmp == 0) return l1-l2;
+    return cmp;
+}
+
+/* Split 's' with separator in 'sep'. An array
+ * of sds strings is returned. *count will be set
+ * by reference to the number of tokens returned.
+ *
+ * On out of memory, zero length string, zero length
+ * separator, NULL is returned.
+ *
+ * Note that 'sep' is able to split a string using
+ * a multi-character separator. For example
+ * sdssplit("foo_-_bar","_-_"); will return two
+ * elements "foo" and "bar".
+ *
+ * This version of the function is binary-safe but
+ * requires length arguments. sdssplit() is just the
+ * same function but for zero-terminated strings.
+ */
+sds *sdssplitlen(const char *s, int len, const char *sep, int seplen, int *count) {
+    int elements = 0, slots = 5, start = 0, j;
+    sds *tokens;
+
+    if (seplen < 1 || len < 0) return NULL;
+
+    tokens = malloc(sizeof(sds)*slots);
+    if (tokens == NULL) return NULL;
+
+    if (len == 0) {
+        *count = 0;
+        return tokens;
+    }
+    for (j = 0; j < (len-(seplen-1)); j++) {
+        /* make sure there is room for the next element and the final one */
+        if (slots < elements+2) {
+            sds *newtokens;
+
+            slots *= 2;
+            newtokens = realloc(tokens,sizeof(sds)*slots);
+            if (newtokens == NULL) goto cleanup;
+            tokens = newtokens;
+        }
+        /* search the separator */
+        if ((seplen == 1 && *(s+j) == sep[0]) || (memcmp(s+j,sep,seplen) == 0)) {
+            tokens[elements] = sdsnewlen(s+start,j-start);
+            if (tokens[elements] == NULL) goto cleanup;
+            elements++;
+            start = j+seplen;
+            j = j+seplen-1; /* skip the separator */
+        }
+    }
+    /* Add the final element. We are sure there is room in the tokens array. */
+    tokens[elements] = sdsnewlen(s+start,len-start);
+    if (tokens[elements] == NULL) goto cleanup;
+    elements++;
+    *count = elements;
+    return tokens;
+
+cleanup:
+    {
+        int i;
+        for (i = 0; i < elements; i++) sdsfree(tokens[i]);
+        free(tokens);
+        *count = 0;
+        return NULL;
+    }
+}
+
+/* Free the result returned by sdssplitlen(), or do nothing if 'tokens' is NULL. */
+void sdsfreesplitres(sds *tokens, int count) {
+    if (!tokens) return;
+    while(count--)
+        sdsfree(tokens[count]);
+    free(tokens);
+}
+
+/* Create an sds string from a long long value. It is much faster than:
+ *
+ * sdscatprintf(sdsempty(),"%lld\n", value);
+ */
+sds sdsfromlonglong(long long value) {
+    char buf[32], *p;
+    unsigned long long v;
+
+    v = (value < 0) ? -value : value;
+    p = buf+31; /* point to the last character */
+    do {
+        *p-- = '0'+(v%10);
+        v /= 10;
+    } while(v);
+    if (value < 0) *p-- = '-';
+    p++;
+    return sdsnewlen(p,32-(p-buf));
+}
+
+/* Append to the sds string "s" an escaped string representation where
+ * all the non-printable characters (tested with isprint()) are turned into
+ * escapes in the form "\n\r\a...." or "\x<hex-number>".
+ *
+ * After the call, the modified sds string is no longer valid and all the
+ * references must be substituted with the new pointer returned by the call. */
+sds sdscatrepr(sds s, const char *p, size_t len) {
+    s = sdscatlen(s,"\"",1);
+    while(len--) {
+        switch(*p) {
+        case '\\':
+        case '"':
+            s = sdscatprintf(s,"\\%c",*p);
+            break;
+        case '\n': s = sdscatlen(s,"\\n",2); break;
+        case '\r': s = sdscatlen(s,"\\r",2); break;
+        case '\t': s = sdscatlen(s,"\\t",2); break;
+        case '\a': s = sdscatlen(s,"\\a",2); break;
+        case '\b': s = sdscatlen(s,"\\b",2); break;
+        default:
+            if (isprint(*p))
+                s = sdscatprintf(s,"%c",*p);
+            else
+                s = sdscatprintf(s,"\\x%02x",(unsigned char)*p);
+            break;
+        }
+        p++;
+    }
+    return sdscatlen(s,"\"",1);
+}
+
+/* Helper function for sdssplitargs() that returns non zero if 'c'
+ * is a valid hex digit. */
+int is_hex_digit(char c) {
+    return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') ||
+           (c >= 'A' && c <= 'F');
+}
+
+/* Helper function for sdssplitargs() that converts a hex digit into an
+ * integer from 0 to 15 */
+int hex_digit_to_int(char c) {
+    switch(c) {
+    case '0': return 0;
+    case '1': return 1;
+    case '2': return 2;
+    case '3': return 3;
+    case '4': return 4;
+    case '5': return 5;
+    case '6': return 6;
+    case '7': return 7;
+    case '8': return 8;
+    case '9': return 9;
+    case 'a': case 'A': return 10;
+    case 'b': case 'B': return 11;
+    case 'c': case 'C': return 12;
+    case 'd': case 'D': return 13;
+    case 'e': case 'E': return 14;
+    case 'f': case 'F': return 15;
+    default: return 0;
+    }
+}
+
+/* Split a line into arguments, where every argument can be in the
+ * following programming-language REPL-alike form:
+ *
+ * foo bar "newline are supported\n" and "\xff\x00otherstuff"
+ *
+ * The number of arguments is stored into *argc, and an array
+ * of sds is returned.
+ *
+ * The caller should free the resulting array of sds strings with
+ * sdsfreesplitres().
+ *
+ * Note that sdscatrepr() is able to convert back a string into
+ * a quoted string in the same format sdssplitargs() is able to parse.
+ *
+ * The function returns the allocated tokens on success, even when the
+ * input string is empty, or NULL if the input contains unbalanced
+ * quotes or closed quotes followed by non space characters
+ * as in: "foo"bar or "foo'
+ */
+sds *sdssplitargs(const char *line, int *argc) {
+    const char *p = line;
+    char *current = NULL;
+    char **vector = NULL;
+
+    *argc = 0;
+    while(1) {
+        /* skip blanks */
+        while(*p && isspace(*p)) p++;
+        if (*p) {
+            /* get a token */
+            int inq=0;  /* set to 1 if we are in "quotes" */
+            int insq=0; /* set to 1 if we are in 'single quotes' */
+            int done=0;
+
+            if (current == NULL) current = sdsempty();
+            while(!done) {
+                if (inq) {
+                    if (*p == '\\' && *(p+1) == 'x' &&
+                                             is_hex_digit(*(p+2)) &&
+                                             is_hex_digit(*(p+3)))
+                    {
+                        unsigned char byte;
+
+                        byte = (hex_digit_to_int(*(p+2))*16)+
+                                hex_digit_to_int(*(p+3));
+                        current = sdscatlen(current,(char*)&byte,1);
+                        p += 3;
+                    } else if (*p == '\\' && *(p+1)) {
+                        char c;
+
+                        p++;
+                        switch(*p) {
+                        case 'n': c = '\n'; break;
+                        case 'r': c = '\r'; break;
+                        case 't': c = '\t'; break;
+                        case 'b': c = '\b'; break;
+                        case 'a': c = '\a'; break;
+                        default: c = *p; break;
+                        }
+                        current = sdscatlen(current,&c,1);
+                    } else if (*p == '"') {
+                        /* closing quote must be followed by a space or
+                         * nothing at all. */
+                        if (*(p+1) && !isspace(*(p+1))) goto err;
+                        done=1;
+                    } else if (!*p) {
+                        /* unterminated quotes */
+                        goto err;
+                    } else {
+                        current = sdscatlen(current,p,1);
+                    }
+                } else if (insq) {
+                    if (*p == '\\' && *(p+1) == '\'') {
+                        p++;
+                        current = sdscatlen(current,"'",1);
+                    } else if (*p == '\'') {
+                        /* closing quote must be followed by a space or
+                         * nothing at all. */
+                        if (*(p+1) && !isspace(*(p+1))) goto err;
+                        done=1;
+                    } else if (!*p) {
+                        /* unterminated quotes */
+                        goto err;
+                    } else {
+                        current = sdscatlen(current,p,1);
+                    }
+                } else {
+                    switch(*p) {
+                    case ' ':
+                    case '\n':
+                    case '\r':
+                    case '\t':
+                    case '\0':
+                        done=1;
+                        break;
+                    case '"':
+                        inq=1;
+                        break;
+                    case '\'':
+                        insq=1;
+                        break;
+                    default:
+                        current = sdscatlen(current,p,1);
+                        break;
+                    }
+                }
+                if (*p) p++;
+            }
+            /* add the token to the vector */
+            vector = realloc(vector,((*argc)+1)*sizeof(char*));
+            vector[*argc] = current;
+            (*argc)++;
+            current = NULL;
+        } else {
+            /* Even on empty input string return something not NULL. */
+            if (vector == NULL) vector = malloc(sizeof(void*));
+            return vector;
+        }
+    }
+
+err:
+    while((*argc)--)
+        sdsfree(vector[*argc]);
+    free(vector);
+    if (current) sdsfree(current);
+    *argc = 0;
+    return NULL;
+}
+
+/* Modify the string substituting all the occurrences of the set of
+ * characters specified in the 'from' string to the corresponding character
+ * in the 'to' array.
+ *
+ * For instance: sdsmapchars(mystring, "ho", "01", 2)
+ * will have the effect of turning the string "hello" into "0ell1".
+ *
+ * The function returns the sds string pointer, that is always the same
+ * as the input pointer since no resize is needed. */
+sds sdsmapchars(sds s, const char *from, const char *to, size_t setlen) {
+    size_t j, i, l = sdslen(s);
+
+    for (j = 0; j < l; j++) {
+        for (i = 0; i < setlen; i++) {
+            if (s[j] == from[i]) {
+                s[j] = to[i];
+                break;
+            }
+        }
+    }
+    return s;
+}
+
+/* Join an array of C strings using the specified separator (also a C string).
+ * Returns the result as an sds string. */
+sds sdsjoin(char **argv, int argc, char *sep, size_t seplen) {
+    sds join = sdsempty();
+    int j;
+
+    for (j = 0; j < argc; j++) {
+        join = sdscat(join, argv[j]);
+        if (j != argc-1) join = sdscatlen(join,sep,seplen);
+    }
+    return join;
+}
+
+/* Like sdsjoin, but joins an array of SDS strings. */
+sds sdsjoinsds(sds *argv, int argc, const char *sep, size_t seplen) {
+    sds join = sdsempty();
+    int j;
+
+    for (j = 0; j < argc; j++) {
+        join = sdscatsds(join, argv[j]);
+        if (j != argc-1) join = sdscatlen(join,sep,seplen);
+    }
+    return join;
+}
+
+#ifdef SDS_TEST_MAIN
+#include <stdio.h>
+#include "testhelp.h"
+
+int main(void) {
+    {
+        struct sdshdr *sh;
+        sds x = sdsnew("foo"), y;
+
+        test_cond("Create a string and obtain the length",
+            sdslen(x) == 3 && memcmp(x,"foo\0",4) == 0)
+
+        sdsfree(x);
+        x = sdsnewlen("foo",2);
+        test_cond("Create a string with specified length",
+            sdslen(x) == 2 && memcmp(x,"fo\0",3) == 0)
+
+        x = sdscat(x,"bar");
+        test_cond("Strings concatenation",
+            sdslen(x) == 5 && memcmp(x,"fobar\0",6) == 0);
+
+        x = sdscpy(x,"a");
+        test_cond("sdscpy() against an originally longer string",
+            sdslen(x) == 1 && memcmp(x,"a\0",2) == 0)
+
+        x = sdscpy(x,"xyzxxxxxxxxxxyyyyyyyyyykkkkkkkkkk");
+        test_cond("sdscpy() against an originally shorter string",
+            sdslen(x) == 33 &&
+            memcmp(x,"xyzxxxxxxxxxxyyyyyyyyyykkkkkkkkkk\0",33) == 0)
+
+        sdsfree(x);
+        x = sdscatprintf(sdsempty(),"%d",123);
+        test_cond("sdscatprintf() seems working in the base case",
+            sdslen(x) == 3 && memcmp(x,"123\0",4) ==0)
+
+        sdsfree(x);
+        x = sdsnew("xxciaoyyy");
+        sdstrim(x,"xy");
+        test_cond("sdstrim() correctly trims characters",
+            sdslen(x) == 4 && memcmp(x,"ciao\0",5) == 0)
+
+        y = sdsdup(x);
+        sdsrange(y,1,1);
+        test_cond("sdsrange(...,1,1)",
+            sdslen(y) == 1 && memcmp(y,"i\0",2) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,1,-1);
+        test_cond("sdsrange(...,1,-1)",
+            sdslen(y) == 3 && memcmp(y,"iao\0",4) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,-2,-1);
+        test_cond("sdsrange(...,-2,-1)",
+            sdslen(y) == 2 && memcmp(y,"ao\0",3) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,2,1);
+        test_cond("sdsrange(...,2,1)",
+            sdslen(y) == 0 && memcmp(y,"\0",1) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,1,100);
+        test_cond("sdsrange(...,1,100)",
+            sdslen(y) == 3 && memcmp(y,"iao\0",4) == 0)
+
+        sdsfree(y);
+        y = sdsdup(x);
+        sdsrange(y,100,100);
+        test_cond("sdsrange(...,100,100)",
+            sdslen(y) == 0 && memcmp(y,"\0",1) == 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnew("foo");
+        y = sdsnew("foa");
+        test_cond("sdscmp(foo,foa)", sdscmp(x,y) > 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnew("bar");
+        y = sdsnew("bar");
+        test_cond("sdscmp(bar,bar)", sdscmp(x,y) == 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnew("aar");
+        y = sdsnew("bar");
+        test_cond("sdscmp(bar,bar)", sdscmp(x,y) < 0)
+
+        sdsfree(y);
+        sdsfree(x);
+        x = sdsnewlen("\a\n\0foo\r",7);
+        y = sdscatrepr(sdsempty(),x,sdslen(x));
+        test_cond("sdscatrepr(...data...)",
+            memcmp(y,"\"\\a\\n\\x00foo\\r\"",15) == 0)
+
+        {
+            int oldfree;
+
+            sdsfree(x);
+            x = sdsnew("0");
+            sh = (void*) (x-(sizeof(struct sdshdr)));
+            test_cond("sdsnew() free/len buffers", sh->len == 1 && sh->free == 0);
+            x = sdsMakeRoomFor(x,1);
+            sh = (void*) (x-(sizeof(struct sdshdr)));
+            test_cond("sdsMakeRoomFor()", sh->len == 1 && sh->free > 0);
+            oldfree = sh->free;
+            x[1] = '1';
+            sdsIncrLen(x,1);
+            test_cond("sdsIncrLen() -- content", x[0] == '0' && x[1] == '1');
+            test_cond("sdsIncrLen() -- len", sh->len == 2);
+            test_cond("sdsIncrLen() -- free", sh->free == oldfree-1);
+        }
+    }
+    test_report()
+    return 0;
+}
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/sds.h b/debian/modules/nchan/src/store/redis/hiredis/sds.h
new file mode 100644
index 00000000..19a2abd3
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/sds.h
@@ -0,0 +1,105 @@
+/* SDS (Simple Dynamic Strings), A C dynamic strings library.
+ *
+ * Copyright (c) 2006-2014, Salvatore Sanfilippo <antirez at gmail dot com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *   * Redistributions of source code must retain the above copyright notice,
+ *     this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *   * Neither the name of Redis nor the names of its contributors may be used
+ *     to endorse or promote products derived from this software without
+ *     specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __SDS_H
+#define __SDS_H
+
+#define SDS_MAX_PREALLOC (1024*1024)
+
+#include <sys/types.h>
+#include <stdarg.h>
+#ifdef _MSC_VER
+#include "win32.h"
+#endif
+
+typedef char *sds;
+
+struct sdshdr {
+    int len;
+    int free;
+    char buf[];
+};
+
+static inline size_t sdslen(const sds s) {
+    struct sdshdr *sh = (struct sdshdr *)(s-sizeof *sh);
+    return sh->len;
+}
+
+static inline size_t sdsavail(const sds s) {
+    struct sdshdr *sh = (struct sdshdr *)(s-sizeof *sh);
+    return sh->free;
+}
+
+sds sdsnewlen(const void *init, size_t initlen);
+sds sdsnew(const char *init);
+sds sdsempty(void);
+size_t sdslen(const sds s);
+sds sdsdup(const sds s);
+void sdsfree(sds s);
+size_t sdsavail(const sds s);
+sds sdsgrowzero(sds s, size_t len);
+sds sdscatlen(sds s, const void *t, size_t len);
+sds sdscat(sds s, const char *t);
+sds sdscatsds(sds s, const sds t);
+sds sdscpylen(sds s, const char *t, size_t len);
+sds sdscpy(sds s, const char *t);
+
+sds sdscatvprintf(sds s, const char *fmt, va_list ap);
+#ifdef __GNUC__
+sds sdscatprintf(sds s, const char *fmt, ...)
+    __attribute__((format(printf, 2, 3)));
+#else
+sds sdscatprintf(sds s, const char *fmt, ...);
+#endif
+
+sds sdscatfmt(sds s, char const *fmt, ...);
+void sdstrim(sds s, const char *cset);
+void sdsrange(sds s, int start, int end);
+void sdsupdatelen(sds s);
+void sdsclear(sds s);
+int sdscmp(const sds s1, const sds s2);
+sds *sdssplitlen(const char *s, int len, const char *sep, int seplen, int *count);
+void sdsfreesplitres(sds *tokens, int count);
+void sdstolower(sds s);
+void sdstoupper(sds s);
+sds sdsfromlonglong(long long value);
+sds sdscatrepr(sds s, const char *p, size_t len);
+sds *sdssplitargs(const char *line, int *argc);
+sds sdsmapchars(sds s, const char *from, const char *to, size_t setlen);
+sds sdsjoin(char **argv, int argc, char *sep, size_t seplen);
+sds sdsjoinsds(sds *argv, int argc, const char *sep, size_t seplen);
+
+/* Low level functions exposed to the user API */
+sds sdsMakeRoomFor(sds s, size_t addlen);
+void sdsIncrLen(sds s, int incr);
+sds sdsRemoveFreeSpace(sds s);
+size_t sdsAllocSize(sds s);
+
+#endif
diff --git a/debian/modules/nchan/src/store/redis/hiredis/test.c b/debian/modules/nchan/src/store/redis/hiredis/test.c
new file mode 100644
index 00000000..d5e82170
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/test.c
@@ -0,0 +1,807 @@
+#include "fmacros.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <sys/time.h>
+#include <assert.h>
+#include <unistd.h>
+#include <signal.h>
+#include <errno.h>
+#include <limits.h>
+
+#include "hiredis.h"
+#include "net.h"
+
+enum connection_type {
+    CONN_TCP,
+    CONN_UNIX,
+    CONN_FD
+};
+
+struct config {
+    enum connection_type type;
+
+    struct {
+        const char *host;
+        int port;
+        struct timeval timeout;
+    } tcp;
+
+    struct {
+        const char *path;
+    } unix;
+};
+
+/* The following lines make up our testing "framework" :) */
+static int tests = 0, fails = 0;
+#define test(_s) { printf("#%02d ", ++tests); printf(_s); }
+#define test_cond(_c) if(_c) printf("\033[0;32mPASSED\033[0;0m\n"); else {printf("\033[0;31mFAILED\033[0;0m\n"); fails++;}
+
+static long long usec(void) {
+    struct timeval tv;
+    gettimeofday(&tv,NULL);
+    return (((long long)tv.tv_sec)*1000000)+tv.tv_usec;
+}
+
+/* The assert() calls below have side effects, so we need assert()
+ * even if we are compiling without asserts (-DNDEBUG). */
+#ifdef NDEBUG
+#undef assert
+#define assert(e) (void)(e)
+#endif
+
+static redisContext *select_database(redisContext *c) {
+    redisReply *reply;
+
+    /* Switch to DB 9 for testing, now that we know we can chat. */
+    reply = redisCommand(c,"SELECT 9");
+    assert(reply != NULL);
+    freeReplyObject(reply);
+
+    /* Make sure the DB is emtpy */
+    reply = redisCommand(c,"DBSIZE");
+    assert(reply != NULL);
+    if (reply->type == REDIS_REPLY_INTEGER && reply->integer == 0) {
+        /* Awesome, DB 9 is empty and we can continue. */
+        freeReplyObject(reply);
+    } else {
+        printf("Database #9 is not empty, test can not continue\n");
+        exit(1);
+    }
+
+    return c;
+}
+
+static int disconnect(redisContext *c, int keep_fd) {
+    redisReply *reply;
+
+    /* Make sure we're on DB 9. */
+    reply = redisCommand(c,"SELECT 9");
+    assert(reply != NULL);
+    freeReplyObject(reply);
+    reply = redisCommand(c,"FLUSHDB");
+    assert(reply != NULL);
+    freeReplyObject(reply);
+
+    /* Free the context as well, but keep the fd if requested. */
+    if (keep_fd)
+        return redisFreeKeepFd(c);
+    redisFree(c);
+    return -1;
+}
+
+static redisContext *connect(struct config config) {
+    redisContext *c = NULL;
+
+    if (config.type == CONN_TCP) {
+        c = redisConnect(config.tcp.host, config.tcp.port);
+    } else if (config.type == CONN_UNIX) {
+        c = redisConnectUnix(config.unix.path);
+    } else if (config.type == CONN_FD) {
+        /* Create a dummy connection just to get an fd to inherit */
+        redisContext *dummy_ctx = redisConnectUnix(config.unix.path);
+        if (dummy_ctx) {
+            int fd = disconnect(dummy_ctx, 1);
+            printf("Connecting to inherited fd %d\n", fd);
+            c = redisConnectFd(fd);
+        }
+    } else {
+        assert(NULL);
+    }
+
+    if (c == NULL) {
+        printf("Connection error: can't allocate redis context\n");
+        exit(1);
+    } else if (c->err) {
+        printf("Connection error: %s\n", c->errstr);
+        redisFree(c);
+        exit(1);
+    }
+
+    return select_database(c);
+}
+
+static void test_format_commands(void) {
+    char *cmd;
+    int len;
+
+    test("Format command without interpolation: ");
+    len = redisFormatCommand(&cmd,"SET foo bar");
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$3\r\nfoo\r\n$3\r\nbar\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(3+2)+4+(3+2));
+    free(cmd);
+
+    test("Format command with %%s string interpolation: ");
+    len = redisFormatCommand(&cmd,"SET %s %s","foo","bar");
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$3\r\nfoo\r\n$3\r\nbar\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(3+2)+4+(3+2));
+    free(cmd);
+
+    test("Format command with %%s and an empty string: ");
+    len = redisFormatCommand(&cmd,"SET %s %s","foo","");
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$3\r\nfoo\r\n$0\r\n\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(3+2)+4+(0+2));
+    free(cmd);
+
+    test("Format command with an empty string in between proper interpolations: ");
+    len = redisFormatCommand(&cmd,"SET %s %s","","foo");
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$0\r\n\r\n$3\r\nfoo\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(0+2)+4+(3+2));
+    free(cmd);
+
+    test("Format command with %%b string interpolation: ");
+    len = redisFormatCommand(&cmd,"SET %b %b","foo",(size_t)3,"b\0r",(size_t)3);
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$3\r\nfoo\r\n$3\r\nb\0r\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(3+2)+4+(3+2));
+    free(cmd);
+
+    test("Format command with %%b and an empty string: ");
+    len = redisFormatCommand(&cmd,"SET %b %b","foo",(size_t)3,"",(size_t)0);
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$3\r\nfoo\r\n$0\r\n\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(3+2)+4+(0+2));
+    free(cmd);
+
+    test("Format command with literal %%: ");
+    len = redisFormatCommand(&cmd,"SET %% %%");
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$1\r\n%\r\n$1\r\n%\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(1+2)+4+(1+2));
+    free(cmd);
+
+    /* Vararg width depends on the type. These tests make sure that the
+     * width is correctly determined using the format and subsequent varargs
+     * can correctly be interpolated. */
+#define INTEGER_WIDTH_TEST(fmt, type) do {                                                \
+    type value = 123;                                                                     \
+    test("Format command with printf-delegation (" #type "): ");                          \
+    len = redisFormatCommand(&cmd,"key:%08" fmt " str:%s", value, "hello");               \
+    test_cond(strncmp(cmd,"*2\r\n$12\r\nkey:00000123\r\n$9\r\nstr:hello\r\n",len) == 0 && \
+        len == 4+5+(12+2)+4+(9+2));                                                       \
+    free(cmd);                                                                            \
+} while(0)
+
+#define FLOAT_WIDTH_TEST(type) do {                                                       \
+    type value = 123.0;                                                                   \
+    test("Format command with printf-delegation (" #type "): ");                          \
+    len = redisFormatCommand(&cmd,"key:%08.3f str:%s", value, "hello");                   \
+    test_cond(strncmp(cmd,"*2\r\n$12\r\nkey:0123.000\r\n$9\r\nstr:hello\r\n",len) == 0 && \
+        len == 4+5+(12+2)+4+(9+2));                                                       \
+    free(cmd);                                                                            \
+} while(0)
+
+    INTEGER_WIDTH_TEST("d", int);
+    INTEGER_WIDTH_TEST("hhd", char);
+    INTEGER_WIDTH_TEST("hd", short);
+    INTEGER_WIDTH_TEST("ld", long);
+    INTEGER_WIDTH_TEST("lld", long long);
+    INTEGER_WIDTH_TEST("u", unsigned int);
+    INTEGER_WIDTH_TEST("hhu", unsigned char);
+    INTEGER_WIDTH_TEST("hu", unsigned short);
+    INTEGER_WIDTH_TEST("lu", unsigned long);
+    INTEGER_WIDTH_TEST("llu", unsigned long long);
+    FLOAT_WIDTH_TEST(float);
+    FLOAT_WIDTH_TEST(double);
+
+    test("Format command with invalid printf format: ");
+    len = redisFormatCommand(&cmd,"key:%08p %b",(void*)1234,"foo",(size_t)3);
+    test_cond(len == -1);
+
+    const char *argv[3];
+    argv[0] = "SET";
+    argv[1] = "foo\0xxx";
+    argv[2] = "bar";
+    size_t lens[3] = { 3, 7, 3 };
+    int argc = 3;
+
+    test("Format command by passing argc/argv without lengths: ");
+    len = redisFormatCommandArgv(&cmd,argc,argv,NULL);
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$3\r\nfoo\r\n$3\r\nbar\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(3+2)+4+(3+2));
+    free(cmd);
+
+    test("Format command by passing argc/argv with lengths: ");
+    len = redisFormatCommandArgv(&cmd,argc,argv,lens);
+    test_cond(strncmp(cmd,"*3\r\n$3\r\nSET\r\n$7\r\nfoo\0xxx\r\n$3\r\nbar\r\n",len) == 0 &&
+        len == 4+4+(3+2)+4+(7+2)+4+(3+2));
+    free(cmd);
+}
+
+static void test_append_formatted_commands(struct config config) {
+    redisContext *c;
+    redisReply *reply;
+    char *cmd;
+    int len;
+
+    c = connect(config);
+
+    test("Append format command: ");
+
+    len = redisFormatCommand(&cmd, "SET foo bar");
+
+    test_cond(redisAppendFormattedCommand(c, cmd, len) == REDIS_OK);
+
+    assert(redisGetReply(c, (void*)&reply) == REDIS_OK);
+
+    free(cmd);
+    freeReplyObject(reply);
+
+    disconnect(c, 0);
+}
+
+static void test_reply_reader(void) {
+    redisReader *reader;
+    void *reply;
+    int ret;
+    int i;
+
+    test("Error handling in reply parser: ");
+    reader = redisReaderCreate();
+    redisReaderFeed(reader,(char*)"@foo\r\n",6);
+    ret = redisReaderGetReply(reader,NULL);
+    test_cond(ret == REDIS_ERR &&
+              strcasecmp(reader->errstr,"Protocol error, got \"@\" as reply type byte") == 0);
+    redisReaderFree(reader);
+
+    /* when the reply already contains multiple items, they must be free'd
+     * on an error. valgrind will bark when this doesn't happen. */
+    test("Memory cleanup in reply parser: ");
+    reader = redisReaderCreate();
+    redisReaderFeed(reader,(char*)"*2\r\n",4);
+    redisReaderFeed(reader,(char*)"$5\r\nhello\r\n",11);
+    redisReaderFeed(reader,(char*)"@foo\r\n",6);
+    ret = redisReaderGetReply(reader,NULL);
+    test_cond(ret == REDIS_ERR &&
+              strcasecmp(reader->errstr,"Protocol error, got \"@\" as reply type byte") == 0);
+    redisReaderFree(reader);
+
+    test("Set error on nested multi bulks with depth > 7: ");
+    reader = redisReaderCreate();
+
+    for (i = 0; i < 9; i++) {
+        redisReaderFeed(reader,(char*)"*1\r\n",4);
+    }
+
+    ret = redisReaderGetReply(reader,NULL);
+    test_cond(ret == REDIS_ERR &&
+              strncasecmp(reader->errstr,"No support for",14) == 0);
+    redisReaderFree(reader);
+
+    test("Works with NULL functions for reply: ");
+    reader = redisReaderCreate();
+    reader->fn = NULL;
+    redisReaderFeed(reader,(char*)"+OK\r\n",5);
+    ret = redisReaderGetReply(reader,&reply);
+    test_cond(ret == REDIS_OK && reply == (void*)REDIS_REPLY_STATUS);
+    redisReaderFree(reader);
+
+    test("Works when a single newline (\\r\\n) covers two calls to feed: ");
+    reader = redisReaderCreate();
+    reader->fn = NULL;
+    redisReaderFeed(reader,(char*)"+OK\r",4);
+    ret = redisReaderGetReply(reader,&reply);
+    assert(ret == REDIS_OK && reply == NULL);
+    redisReaderFeed(reader,(char*)"\n",1);
+    ret = redisReaderGetReply(reader,&reply);
+    test_cond(ret == REDIS_OK && reply == (void*)REDIS_REPLY_STATUS);
+    redisReaderFree(reader);
+
+    test("Don't reset state after protocol error: ");
+    reader = redisReaderCreate();
+    reader->fn = NULL;
+    redisReaderFeed(reader,(char*)"x",1);
+    ret = redisReaderGetReply(reader,&reply);
+    assert(ret == REDIS_ERR);
+    ret = redisReaderGetReply(reader,&reply);
+    test_cond(ret == REDIS_ERR && reply == NULL);
+    redisReaderFree(reader);
+
+    /* Regression test for issue #45 on GitHub. */
+    test("Don't do empty allocation for empty multi bulk: ");
+    reader = redisReaderCreate();
+    redisReaderFeed(reader,(char*)"*0\r\n",4);
+    ret = redisReaderGetReply(reader,&reply);
+    test_cond(ret == REDIS_OK &&
+        ((redisReply*)reply)->type == REDIS_REPLY_ARRAY &&
+        ((redisReply*)reply)->elements == 0);
+    freeReplyObject(reply);
+    redisReaderFree(reader);
+}
+
+static void test_free_null(void) {
+    void *redisContext = NULL;
+    void *reply = NULL;
+
+    test("Don't fail when redisFree is passed a NULL value: ");
+    redisFree(redisContext);
+    test_cond(redisContext == NULL);
+
+    test("Don't fail when freeReplyObject is passed a NULL value: ");
+    freeReplyObject(reply);
+    test_cond(reply == NULL);
+}
+
+static void test_blocking_connection_errors(void) {
+    redisContext *c;
+
+    test("Returns error when host cannot be resolved: ");
+    c = redisConnect((char*)"idontexist.test", 6379);
+    test_cond(c->err == REDIS_ERR_OTHER &&
+        (strcmp(c->errstr,"Name or service not known") == 0 ||
+         strcmp(c->errstr,"Can't resolve: idontexist.test") == 0 ||
+         strcmp(c->errstr,"nodename nor servname provided, or not known") == 0 ||
+         strcmp(c->errstr,"No address associated with hostname") == 0 ||
+         strcmp(c->errstr,"Temporary failure in name resolution") == 0 ||
+         strcmp(c->errstr,"hostname nor servname provided, or not known") == 0 ||
+         strcmp(c->errstr,"no address associated with name") == 0));
+    redisFree(c);
+
+    test("Returns error when the port is not open: ");
+    c = redisConnect((char*)"localhost", 1);
+    test_cond(c->err == REDIS_ERR_IO &&
+        strcmp(c->errstr,"Connection refused") == 0);
+    redisFree(c);
+
+    test("Returns error when the unix socket path doesn't accept connections: ");
+    c = redisConnectUnix((char*)"/tmp/idontexist.sock");
+    test_cond(c->err == REDIS_ERR_IO); /* Don't care about the message... */
+    redisFree(c);
+}
+
+static void test_blocking_connection(struct config config) {
+    redisContext *c;
+    redisReply *reply;
+
+    c = connect(config);
+
+    test("Is able to deliver commands: ");
+    reply = redisCommand(c,"PING");
+    test_cond(reply->type == REDIS_REPLY_STATUS &&
+        strcasecmp(reply->str,"pong") == 0)
+    freeReplyObject(reply);
+
+    test("Is a able to send commands verbatim: ");
+    reply = redisCommand(c,"SET foo bar");
+    test_cond (reply->type == REDIS_REPLY_STATUS &&
+        strcasecmp(reply->str,"ok") == 0)
+    freeReplyObject(reply);
+
+    test("%%s String interpolation works: ");
+    reply = redisCommand(c,"SET %s %s","foo","hello world");
+    freeReplyObject(reply);
+    reply = redisCommand(c,"GET foo");
+    test_cond(reply->type == REDIS_REPLY_STRING &&
+        strcmp(reply->str,"hello world") == 0);
+    freeReplyObject(reply);
+
+    test("%%b String interpolation works: ");
+    reply = redisCommand(c,"SET %b %b","foo",(size_t)3,"hello\x00world",(size_t)11);
+    freeReplyObject(reply);
+    reply = redisCommand(c,"GET foo");
+    test_cond(reply->type == REDIS_REPLY_STRING &&
+        memcmp(reply->str,"hello\x00world",11) == 0)
+
+    test("Binary reply length is correct: ");
+    test_cond(reply->len == 11)
+    freeReplyObject(reply);
+
+    test("Can parse nil replies: ");
+    reply = redisCommand(c,"GET nokey");
+    test_cond(reply->type == REDIS_REPLY_NIL)
+    freeReplyObject(reply);
+
+    /* test 7 */
+    test("Can parse integer replies: ");
+    reply = redisCommand(c,"INCR mycounter");
+    test_cond(reply->type == REDIS_REPLY_INTEGER && reply->integer == 1)
+    freeReplyObject(reply);
+
+    test("Can parse multi bulk replies: ");
+    freeReplyObject(redisCommand(c,"LPUSH mylist foo"));
+    freeReplyObject(redisCommand(c,"LPUSH mylist bar"));
+    reply = redisCommand(c,"LRANGE mylist 0 -1");
+    test_cond(reply->type == REDIS_REPLY_ARRAY &&
+              reply->elements == 2 &&
+              !memcmp(reply->element[0]->str,"bar",3) &&
+              !memcmp(reply->element[1]->str,"foo",3))
+    freeReplyObject(reply);
+
+    /* m/e with multi bulk reply *before* other reply.
+     * specifically test ordering of reply items to parse. */
+    test("Can handle nested multi bulk replies: ");
+    freeReplyObject(redisCommand(c,"MULTI"));
+    freeReplyObject(redisCommand(c,"LRANGE mylist 0 -1"));
+    freeReplyObject(redisCommand(c,"PING"));
+    reply = (redisCommand(c,"EXEC"));
+    test_cond(reply->type == REDIS_REPLY_ARRAY &&
+              reply->elements == 2 &&
+              reply->element[0]->type == REDIS_REPLY_ARRAY &&
+              reply->element[0]->elements == 2 &&
+              !memcmp(reply->element[0]->element[0]->str,"bar",3) &&
+              !memcmp(reply->element[0]->element[1]->str,"foo",3) &&
+              reply->element[1]->type == REDIS_REPLY_STATUS &&
+              strcasecmp(reply->element[1]->str,"pong") == 0);
+    freeReplyObject(reply);
+
+    disconnect(c, 0);
+}
+
+static void test_blocking_connection_timeouts(struct config config) {
+    redisContext *c;
+    redisReply *reply;
+    ssize_t s;
+    const char *cmd = "DEBUG SLEEP 3\r\n";
+    struct timeval tv;
+
+    c = connect(config);
+    test("Successfully completes a command when the timeout is not exceeded: ");
+    reply = redisCommand(c,"SET foo fast");
+    freeReplyObject(reply);
+    tv.tv_sec = 0;
+    tv.tv_usec = 10000;
+    redisSetTimeout(c, tv);
+    reply = redisCommand(c, "GET foo");
+    test_cond(reply != NULL && reply->type == REDIS_REPLY_STRING && memcmp(reply->str, "fast", 4) == 0);
+    freeReplyObject(reply);
+    disconnect(c, 0);
+
+    c = connect(config);
+    test("Does not return a reply when the command times out: ");
+    s = write(c->fd, cmd, strlen(cmd));
+    tv.tv_sec = 0;
+    tv.tv_usec = 10000;
+    redisSetTimeout(c, tv);
+    reply = redisCommand(c, "GET foo");
+    test_cond(s > 0 && reply == NULL && c->err == REDIS_ERR_IO && strcmp(c->errstr, "Resource temporarily unavailable") == 0);
+    freeReplyObject(reply);
+
+    test("Reconnect properly reconnects after a timeout: ");
+    redisReconnect(c);
+    reply = redisCommand(c, "PING");
+    test_cond(reply != NULL && reply->type == REDIS_REPLY_STATUS && strcmp(reply->str, "PONG") == 0);
+    freeReplyObject(reply);
+
+    test("Reconnect properly uses owned parameters: ");
+    config.tcp.host = "foo";
+    config.unix.path = "foo";
+    redisReconnect(c);
+    reply = redisCommand(c, "PING");
+    test_cond(reply != NULL && reply->type == REDIS_REPLY_STATUS && strcmp(reply->str, "PONG") == 0);
+    freeReplyObject(reply);
+
+    disconnect(c, 0);
+}
+
+static void test_blocking_io_errors(struct config config) {
+    redisContext *c;
+    redisReply *reply;
+    void *_reply;
+    int major, minor;
+
+    /* Connect to target given by config. */
+    c = connect(config);
+    {
+        /* Find out Redis version to determine the path for the next test */
+        const char *field = "redis_version:";
+        char *p, *eptr;
+
+        reply = redisCommand(c,"INFO");
+        p = strstr(reply->str,field);
+        major = strtol(p+strlen(field),&eptr,10);
+        p = eptr+1; /* char next to the first "." */
+        minor = strtol(p,&eptr,10);
+        freeReplyObject(reply);
+    }
+
+    test("Returns I/O error when the connection is lost: ");
+    reply = redisCommand(c,"QUIT");
+    if (major > 2 || (major == 2 && minor > 0)) {
+        /* > 2.0 returns OK on QUIT and read() should be issued once more
+         * to know the descriptor is at EOF. */
+        test_cond(strcasecmp(reply->str,"OK") == 0 &&
+            redisGetReply(c,&_reply) == REDIS_ERR);
+        freeReplyObject(reply);
+    } else {
+        test_cond(reply == NULL);
+    }
+
+    /* On 2.0, QUIT will cause the connection to be closed immediately and
+     * the read(2) for the reply on QUIT will set the error to EOF.
+     * On >2.0, QUIT will return with OK and another read(2) needed to be
+     * issued to find out the socket was closed by the server. In both
+     * conditions, the error will be set to EOF. */
+    assert(c->err == REDIS_ERR_EOF &&
+        strcmp(c->errstr,"Server closed the connection") == 0);
+    redisFree(c);
+
+    c = connect(config);
+    test("Returns I/O error on socket timeout: ");
+    struct timeval tv = { 0, 1000 };
+    assert(redisSetTimeout(c,tv) == REDIS_OK);
+    test_cond(redisGetReply(c,&_reply) == REDIS_ERR &&
+        c->err == REDIS_ERR_IO && errno == EAGAIN);
+    redisFree(c);
+}
+
+static void test_invalid_timeout_errors(struct config config) {
+    redisContext *c;
+
+    test("Set error when an invalid timeout usec value is given to redisConnectWithTimeout: ");
+
+    config.tcp.timeout.tv_sec = 0;
+    config.tcp.timeout.tv_usec = 10000001;
+
+    c = redisConnectWithTimeout(config.tcp.host, config.tcp.port, config.tcp.timeout);
+
+    test_cond(c->err == REDIS_ERR_IO);
+    redisFree(c);
+
+    test("Set error when an invalid timeout sec value is given to redisConnectWithTimeout: ");
+
+    config.tcp.timeout.tv_sec = (((LONG_MAX) - 999) / 1000) + 1;
+    config.tcp.timeout.tv_usec = 0;
+
+    c = redisConnectWithTimeout(config.tcp.host, config.tcp.port, config.tcp.timeout);
+
+    test_cond(c->err == REDIS_ERR_IO);
+    redisFree(c);
+}
+
+static void test_throughput(struct config config) {
+    redisContext *c = connect(config);
+    redisReply **replies;
+    int i, num;
+    long long t1, t2;
+
+    test("Throughput:\n");
+    for (i = 0; i < 500; i++)
+        freeReplyObject(redisCommand(c,"LPUSH mylist foo"));
+
+    num = 1000;
+    replies = malloc(sizeof(redisReply*)*num);
+    t1 = usec();
+    for (i = 0; i < num; i++) {
+        replies[i] = redisCommand(c,"PING");
+        assert(replies[i] != NULL && replies[i]->type == REDIS_REPLY_STATUS);
+    }
+    t2 = usec();
+    for (i = 0; i < num; i++) freeReplyObject(replies[i]);
+    free(replies);
+    printf("\t(%dx PING: %.3fs)\n", num, (t2-t1)/1000000.0);
+
+    replies = malloc(sizeof(redisReply*)*num);
+    t1 = usec();
+    for (i = 0; i < num; i++) {
+        replies[i] = redisCommand(c,"LRANGE mylist 0 499");
+        assert(replies[i] != NULL && replies[i]->type == REDIS_REPLY_ARRAY);
+        assert(replies[i] != NULL && replies[i]->elements == 500);
+    }
+    t2 = usec();
+    for (i = 0; i < num; i++) freeReplyObject(replies[i]);
+    free(replies);
+    printf("\t(%dx LRANGE with 500 elements: %.3fs)\n", num, (t2-t1)/1000000.0);
+
+    num = 10000;
+    replies = malloc(sizeof(redisReply*)*num);
+    for (i = 0; i < num; i++)
+        redisAppendCommand(c,"PING");
+    t1 = usec();
+    for (i = 0; i < num; i++) {
+        assert(redisGetReply(c, (void*)&replies[i]) == REDIS_OK);
+        assert(replies[i] != NULL && replies[i]->type == REDIS_REPLY_STATUS);
+    }
+    t2 = usec();
+    for (i = 0; i < num; i++) freeReplyObject(replies[i]);
+    free(replies);
+    printf("\t(%dx PING (pipelined): %.3fs)\n", num, (t2-t1)/1000000.0);
+
+    replies = malloc(sizeof(redisReply*)*num);
+    for (i = 0; i < num; i++)
+        redisAppendCommand(c,"LRANGE mylist 0 499");
+    t1 = usec();
+    for (i = 0; i < num; i++) {
+        assert(redisGetReply(c, (void*)&replies[i]) == REDIS_OK);
+        assert(replies[i] != NULL && replies[i]->type == REDIS_REPLY_ARRAY);
+        assert(replies[i] != NULL && replies[i]->elements == 500);
+    }
+    t2 = usec();
+    for (i = 0; i < num; i++) freeReplyObject(replies[i]);
+    free(replies);
+    printf("\t(%dx LRANGE with 500 elements (pipelined): %.3fs)\n", num, (t2-t1)/1000000.0);
+
+    disconnect(c, 0);
+}
+
+// static long __test_callback_flags = 0;
+// static void __test_callback(redisContext *c, void *privdata) {
+//     ((void)c);
+//     /* Shift to detect execution order */
+//     __test_callback_flags <<= 8;
+//     __test_callback_flags |= (long)privdata;
+// }
+//
+// static void __test_reply_callback(redisContext *c, redisReply *reply, void *privdata) {
+//     ((void)c);
+//     /* Shift to detect execution order */
+//     __test_callback_flags <<= 8;
+//     __test_callback_flags |= (long)privdata;
+//     if (reply) freeReplyObject(reply);
+// }
+//
+// static redisContext *__connect_nonblock() {
+//     /* Reset callback flags */
+//     __test_callback_flags = 0;
+//     return redisConnectNonBlock("127.0.0.1", port, NULL);
+// }
+//
+// static void test_nonblocking_connection() {
+//     redisContext *c;
+//     int wdone = 0;
+//
+//     test("Calls command callback when command is issued: ");
+//     c = __connect_nonblock();
+//     redisSetCommandCallback(c,__test_callback,(void*)1);
+//     redisCommand(c,"PING");
+//     test_cond(__test_callback_flags == 1);
+//     redisFree(c);
+//
+//     test("Calls disconnect callback on redisDisconnect: ");
+//     c = __connect_nonblock();
+//     redisSetDisconnectCallback(c,__test_callback,(void*)2);
+//     redisDisconnect(c);
+//     test_cond(__test_callback_flags == 2);
+//     redisFree(c);
+//
+//     test("Calls disconnect callback and free callback on redisFree: ");
+//     c = __connect_nonblock();
+//     redisSetDisconnectCallback(c,__test_callback,(void*)2);
+//     redisSetFreeCallback(c,__test_callback,(void*)4);
+//     redisFree(c);
+//     test_cond(__test_callback_flags == ((2 << 8) | 4));
+//
+//     test("redisBufferWrite against empty write buffer: ");
+//     c = __connect_nonblock();
+//     test_cond(redisBufferWrite(c,&wdone) == REDIS_OK && wdone == 1);
+//     redisFree(c);
+//
+//     test("redisBufferWrite against not yet connected fd: ");
+//     c = __connect_nonblock();
+//     redisCommand(c,"PING");
+//     test_cond(redisBufferWrite(c,NULL) == REDIS_ERR &&
+//               strncmp(c->error,"write:",6) == 0);
+//     redisFree(c);
+//
+//     test("redisBufferWrite against closed fd: ");
+//     c = __connect_nonblock();
+//     redisCommand(c,"PING");
+//     redisDisconnect(c);
+//     test_cond(redisBufferWrite(c,NULL) == REDIS_ERR &&
+//               strncmp(c->error,"write:",6) == 0);
+//     redisFree(c);
+//
+//     test("Process callbacks in the right sequence: ");
+//     c = __connect_nonblock();
+//     redisCommandWithCallback(c,__test_reply_callback,(void*)1,"PING");
+//     redisCommandWithCallback(c,__test_reply_callback,(void*)2,"PING");
+//     redisCommandWithCallback(c,__test_reply_callback,(void*)3,"PING");
+//
+//     /* Write output buffer */
+//     wdone = 0;
+//     while(!wdone) {
+//         usleep(500);
+//         redisBufferWrite(c,&wdone);
+//     }
+//
+//     /* Read until at least one callback is executed (the 3 replies will
+//      * arrive in a single packet, causing all callbacks to be executed in
+//      * a single pass). */
+//     while(__test_callback_flags == 0) {
+//         assert(redisBufferRead(c) == REDIS_OK);
+//         redisProcessCallbacks(c);
+//     }
+//     test_cond(__test_callback_flags == 0x010203);
+//     redisFree(c);
+//
+//     test("redisDisconnect executes pending callbacks with NULL reply: ");
+//     c = __connect_nonblock();
+//     redisSetDisconnectCallback(c,__test_callback,(void*)1);
+//     redisCommandWithCallback(c,__test_reply_callback,(void*)2,"PING");
+//     redisDisconnect(c);
+//     test_cond(__test_callback_flags == 0x0201);
+//     redisFree(c);
+// }
+
+int main(int argc, char **argv) {
+    struct config cfg = {
+        .tcp = {
+            .host = "127.0.0.1",
+            .port = 6379
+        },
+        .unix = {
+            .path = "/tmp/redis.sock"
+        }
+    };
+    int throughput = 1;
+    int test_inherit_fd = 1;
+
+    /* Ignore broken pipe signal (for I/O error tests). */
+    signal(SIGPIPE, SIG_IGN);
+
+    /* Parse command line options. */
+    argv++; argc--;
+    while (argc) {
+        if (argc >= 2 && !strcmp(argv[0],"-h")) {
+            argv++; argc--;
+            cfg.tcp.host = argv[0];
+        } else if (argc >= 2 && !strcmp(argv[0],"-p")) {
+            argv++; argc--;
+            cfg.tcp.port = atoi(argv[0]);
+        } else if (argc >= 2 && !strcmp(argv[0],"-s")) {
+            argv++; argc--;
+            cfg.unix.path = argv[0];
+        } else if (argc >= 1 && !strcmp(argv[0],"--skip-throughput")) {
+            throughput = 0;
+        } else if (argc >= 1 && !strcmp(argv[0],"--skip-inherit-fd")) {
+            test_inherit_fd = 0;
+        } else {
+            fprintf(stderr, "Invalid argument: %s\n", argv[0]);
+            exit(1);
+        }
+        argv++; argc--;
+    }
+
+    test_format_commands();
+    test_reply_reader();
+    test_blocking_connection_errors();
+    test_free_null();
+
+    printf("\nTesting against TCP connection (%s:%d):\n", cfg.tcp.host, cfg.tcp.port);
+    cfg.type = CONN_TCP;
+    test_blocking_connection(cfg);
+    test_blocking_connection_timeouts(cfg);
+    test_blocking_io_errors(cfg);
+    test_invalid_timeout_errors(cfg);
+    test_append_formatted_commands(cfg);
+    if (throughput) test_throughput(cfg);
+
+    printf("\nTesting against Unix socket connection (%s):\n", cfg.unix.path);
+    cfg.type = CONN_UNIX;
+    test_blocking_connection(cfg);
+    test_blocking_connection_timeouts(cfg);
+    test_blocking_io_errors(cfg);
+    if (throughput) test_throughput(cfg);
+
+    if (test_inherit_fd) {
+        printf("\nTesting against inherited fd (%s):\n", cfg.unix.path);
+        cfg.type = CONN_FD;
+        test_blocking_connection(cfg);
+    }
+
+
+    if (fails) {
+        printf("*** %d TESTS FAILED ***\n", fails);
+        return 1;
+    }
+
+    printf("ALL TESTS PASSED\n");
+    return 0;
+}
diff --git a/debian/modules/nchan/src/store/redis/hiredis/win32.h b/debian/modules/nchan/src/store/redis/hiredis/win32.h
new file mode 100644
index 00000000..1a27c18f
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/hiredis/win32.h
@@ -0,0 +1,42 @@
+#ifndef _WIN32_HELPER_INCLUDE
+#define _WIN32_HELPER_INCLUDE
+#ifdef _MSC_VER
+
+#ifndef inline
+#define inline __inline
+#endif
+
+#ifndef va_copy
+#define va_copy(d,s) ((d) = (s))
+#endif
+
+#ifndef snprintf
+#define snprintf c99_snprintf
+
+__inline int c99_vsnprintf(char* str, size_t size, const char* format, va_list ap)
+{
+    int count = -1;
+
+    if (size != 0)
+        count = _vsnprintf_s(str, size, _TRUNCATE, format, ap);
+    if (count == -1)
+        count = _vscprintf(format, ap);
+
+    return count;
+}
+
+__inline int c99_snprintf(char* str, size_t size, const char* format, ...)
+{
+    int count;
+    va_list ap;
+
+    va_start(ap, format);
+    count = c99_vsnprintf(str, size, format, ap);
+    va_end(ap);
+
+    return count;
+}
+#endif
+
+#endif
+#endif
\ No newline at end of file
diff --git a/debian/modules/nchan/src/store/redis/rdsstore.c b/debian/modules/nchan/src/store/redis/rdsstore.c
index cffffeb3..8fbf17fe 100755
--- a/debian/modules/nchan/src/store/redis/rdsstore.c
+++ b/debian/modules/nchan/src/store/redis/rdsstore.c
@@ -1,22 +1,23 @@
 #include <nchan_module.h>
 
 #include <assert.h>
+#include <netinet/ip.h>
 #include "store-private.h"
 #include "store.h"
-#include "cluster.h"
 
 #include "redis_nginx_adapter.h"
 
-#include <util/nchan_msgid.h>
+#include <util/nchan_msg.h>
 #include <util/nchan_rbtree.h>
 #include <store/store_common.h>
 
 #include <store/memory/store.h>
 
+#include "redis_nodeset.h"
 #include "redis_lua_commands.h"
 
-#define REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL 300
-#define REDIS_LUA_HASH_LENGTH 40
+#define REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL_STEP 600 //10min
+#define REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL_MAX 2628000 //whole month
 
 #define REDIS_RECONNECT_TIME 5000
 
@@ -28,35 +29,14 @@
 #define DBG(fmt, args...) ngx_log_error(DEBUG_LEVEL, ngx_cycle->log, 0, "REDISTORE: " fmt, ##args)
 #define ERR(fmt, args...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDISTORE: " fmt, ##args)
 
+#define REDIS_CONNECTION_FOR_PUBLISH_WAIT 5000
+
 u_char            redis_subscriber_id[255];
-u_char            redis_subscriber_channel[255];
+size_t            redis_subscriber_id_len;
 
-static rbtree_seed_t              redis_data_tree;
 static rdstore_channel_head_t    *chanhead_hash = NULL;
 static size_t                     redis_publish_message_msgkey_size;
 
-redis_connection_status_t redis_connection_status(nchan_loc_conf_t *cf) {
-  rdstore_data_t  *rdata = cf->redis.privdata;
-  return rdata->status;
-}
-
-ngx_int_t redis_store_callback_on_connected(nchan_loc_conf_t *cf, callback_pt cb, void *privdata) {
-  rdstore_data_t    *rdata = cf->redis.privdata;
-  callback_chain_t  *d;
-  
-  if(rdata->status == CONNECTED) {
-    cb(NGX_OK, NULL, privdata);
-  }
-  
-  d = ngx_alloc(sizeof(*d), ngx_cycle->log);
-  
-  d->cb = cb;
-  d->pd = privdata;
-  d->next = rdata->on_connected;
-  
-  rdata->on_connected = d;
-  return NGX_OK;
-}
 
 #define CHANNEL_HASH_FIND(id_buf, p)    HASH_FIND( hh, chanhead_hash, (id_buf)->data, (id_buf)->len, p)
 #define CHANNEL_HASH_ADD(chanhead)      HASH_ADD_KEYPTR( hh, chanhead_hash, (chanhead->id).data, (chanhead->id).len, chanhead)
@@ -65,39 +45,59 @@ ngx_int_t redis_store_callback_on_connected(nchan_loc_conf_t *cf, callback_pt cb
 #include <stdbool.h>
 #include "cmp.h"
 
-#define redis_command(rdata, cb, pd, fmt, args...)                   \
-  do {                                                               \
-    if(redis_ensure_connected(rdata) == NGX_OK) {                    \
-      rdata->pending_commands++;                                     \
-      nchan_update_stub_status(redis_pending_commands, 1);           \
-      redisAsyncCommand((rdata)->ctx, cb, pd, fmt, ##args);          \
-    } else {                                                         \
-      ERR("Can't run redis command: no connection to redis server.");\
-    }                                                                \
-  }while(0)                                                          \
 
-#define redis_subscriber_command(rdata, cb, pd, fmt, args...)        \
+#define redis_subscriber_command(node, cb, pd, fmt, args...)        \
   do {                                                               \
-    if(redis_ensure_connected(rdata) == NGX_OK) {                    \
-      redisAsyncCommand((rdata)->sub_ctx, cb, pd, fmt, ##args);      \
+    if((node)->state >= REDIS_NODE_READY) {                    \
+      redisAsyncCommand((node)->ctx.pubsub, cb, pd, fmt, ##args);      \
     } else {                                                         \
       ERR("Can't run redis command: no connection to redis server.");\
     }                                                                \
   }while(0)                                                          \
   
-#define redis_sync_command(rdata, fmt, args...)                      \
+  
+  
+#define redis_sync_command(node, fmt, args...)                       \
   do {                                                               \
-    if((rdata)->sync_ctx == NULL) {                                  \
-      redis_nginx_open_sync_context(&(rdata)->connect_params.host, (rdata)->connect_params.port, (rdata)->connect_params.db, &(rdata)->connect_params.password, &(rdata)->sync_ctx); \
+    if((node)->ctx.sync == NULL) {                                   \
+      redis_nginx_open_sync_context(((node)->connect_params.peername.len > 0 ? &(node)->connect_params.peername : &(node)->connect_params.hostname), (node)->connect_params.port, (node)->connect_params.db, &(node)->connect_params.password, &(node)->ctx.sync); \
     }                                                                \
-    if((rdata)->sync_ctx) {                                          \
-      redisCommand((rdata)->sync_ctx, fmt, ##args);                  \
+    if((node)->ctx.sync) {                                          \
+      redisCommand((node)->ctx.sync, fmt, ##args);                  \
     } else {                                                         \
       ERR("Can't run redis command: no connection to redis server.");\
     }                                                                \
   }while(0)
+
+#define redis_sync_script(script_name, node, fmt, args...)                    \
+  redis_sync_command(node, "EVALSHA %s " fmt, redis_lua_scripts.script_name.hash, ##args)
+
+#define nchan_redis_sync_script(script_name, node, channel_id, fmt, args...)  \
+  redis_sync_script(script_name, node, "0 %b %b " fmt, STR(node->nodeset->settings.namespace), STR(channel_id), ##args)
+
+  
+  
+#define redis_command(node, cb, pd, fmt, args...)                 \
+  do {                                                               \
+    if(node->state >= REDIS_NODE_READY) {                            \
+      if((cb) != NULL) {                                               \
+        /* a reply is expected, so track this command */             \
+        node->pending_commands++;                                    \
+        nchan_update_stub_status(redis_pending_commands, 1);         \
+      }                                                              \
+      redisAsyncCommand((node)->ctx.cmd, cb, pd, fmt, ##args);       \
+    } else {                                                         \
+      node_log_error(node, "Can't run redis command: no connection to redis server.");\
+    }                                                                \
+  }while(0)                                                          \
   
+#define redis_script(script_name, node, cb, pd, fmt, args...)                         \
+  redis_command(node, cb, pd, "EVALSHA %s " fmt, redis_lua_scripts.script_name.hash, ##args)
 
+#define nchan_redis_script(script_name, node, cb, pd, channel_id, fmt, args...)       \
+  redis_script(script_name, node, cb, pd, "0 %b %b " fmt, STR((node)->nodeset->settings.namespace), STR(channel_id), ##args)
+
+  
 #define CHECK_REPLY_STR(reply) ((reply)->type == REDIS_REPLY_STRING)
 #define CHECK_REPLY_STRVAL(reply, v) ( CHECK_REPLY_STR(reply) && ngx_strcmp((reply)->str, v) == 0 )
 #define CHECK_REPLY_STRNVAL(reply, v, n) ( CHECK_REPLY_STR(reply) && ngx_strncmp((reply)->str, v, n) == 0 )
@@ -107,11 +107,9 @@ ngx_int_t redis_store_callback_on_connected(nchan_loc_conf_t *cf, callback_pt cb
 #define CHECK_REPLY_NIL(reply) ((reply)->type == REDIS_REPLY_NIL)
 #define CHECK_REPLY_INT_OR_STR(reply) ((reply)->type == REDIS_REPLY_INTEGER || (reply)->type == REDIS_REPLY_STRING)
   
-static ngx_int_t nchan_store_publish_generic(ngx_str_t *, rdstore_data_t *, nchan_msg_t *, ngx_int_t, const ngx_str_t *);
-static ngx_str_t * nchan_store_content_type_from_message(nchan_msg_t *, ngx_pool_t *);
-static ngx_str_t * nchan_store_etag_from_message(nchan_msg_t *, ngx_pool_t *);
+static ngx_int_t nchan_store_publish_generic(ngx_str_t *, redis_nodeset_t *, nchan_msg_t *, ngx_int_t, const ngx_str_t *);
 
-static rdstore_channel_head_t * nchan_store_get_chanhead(ngx_str_t *channel_id, rdstore_data_t *rdata);
+static rdstore_channel_head_t * nchan_store_get_chanhead(ngx_str_t *channel_id, redis_nodeset_t *);
 
 static ngx_buf_t *set_buf(ngx_buf_t *buf, u_char *start, off_t len){
   ngx_memzero(buf, sizeof(*buf));
@@ -164,8 +162,12 @@ static size_t ngx_buf_writer(cmp_ctx_t *ctx, const void *data, size_t count) {
   return 0;
 }
 
-ngx_int_t parse_redis_url(ngx_str_t *url, redis_connect_params_t *rcp) {
+int nchan_store_redis_validate_url(ngx_str_t *url) {
+  redis_connect_params_t rcp;
+  return parse_redis_url(url, &rcp) == NGX_OK;
+}
 
+ngx_int_t parse_redis_url(ngx_str_t *url, redis_connect_params_t *rcp) {
   u_char                  *cur, *last, *ret;
   
   cur = url->data;
@@ -182,6 +184,7 @@ ngx_int_t parse_redis_url(ngx_str_t *url, redis_connect_params_t *rcp) {
     if((ret = ngx_strlchr(cur, last, '@')) == NULL) {
       rcp->password.data = NULL;
       rcp->password.len = 0;
+      return NGX_ERROR;
     }
     else {
       rcp->password.data = cur;
@@ -201,22 +204,21 @@ ngx_int_t parse_redis_url(ngx_str_t *url, redis_connect_params_t *rcp) {
     if((ret = ngx_strlchr(cur, last, '/')) == NULL) {
       ret = last;
     }
-    rcp->host.data = cur;
-    rcp->host.len = ret - cur;
+    rcp->hostname.data = cur;
+    rcp->hostname.len = ret - cur;
   }
   else {
-    rcp->host.data = cur;
-    rcp->host.len = ret - cur;
+    rcp->hostname.data = cur;
+    rcp->hostname.len = ret - cur;
     cur = ret + 1;
     
     //port
     if((ret = ngx_strlchr(cur, last, '/')) == NULL) {
       ret = last;
     }
-    
     rcp->port = ngx_atoi(cur, ret-cur);
     if(rcp->port == NGX_ERROR) {
-      rcp->port = 6379;
+      return NGX_ERROR;
     }
   }
   cur = ret;
@@ -236,44 +238,58 @@ ngx_int_t parse_redis_url(ngx_str_t *url, redis_connect_params_t *rcp) {
 }
 
 static void redis_store_reap_chanhead(rdstore_channel_head_t *ch) {
-  rdstore_data_t   *rdata;
   if(!ch->shutting_down) {
     assert(ch->sub_count == 0 && ch->fetching_message_count == 0);
   }
   
   DBG("reap channel %V", &ch->id);
 
-  rdata = redis_cluster_rdata_from_channel(ch);
-  if(ch->pubsub_status == SUBBED) {
-    ch->pubsub_status = UNSUBBING;
-    redis_subscriber_command(rdata, NULL, NULL, "UNSUBSCRIBE {channel:%b}:pubsub", STR(&ch->id));
+  if(ch->pubsub_status == REDIS_PUBSUB_SUBSCRIBED) {
+    assert(ch->redis.nodeset->settings.storage_mode >= REDIS_MODE_DISTRIBUTED);
+    assert(ch->redis.node.pubsub);
+    ch->pubsub_status = REDIS_PUBSUB_UNSUBSCRIBED;
+    redis_subscriber_command(ch->redis.node.pubsub, NULL, NULL, "UNSUBSCRIBE %b{channel:%b}:pubsub", STR(ch->redis.nodeset->settings.namespace), STR(&ch->id));
   }
+
+  /*
+  redis_nodeset_t *ns = ch->redis.nodeset;
+  redis_node_t *cmd = ch->redis.node.cmd;
+  redis_node_t *pubsub = ch->redis.node.pubsub;
+  */
+  
+  nodeset_dissociate_chanhead(ch);
   
-  if(ch->rd_prev) {
-    ch->rd_prev->rd_next = ch->rd_next;
+  /*  
+  rdstore_channel_head_t *cur;
+
+
+  for(cur = nchan_slist_first(&ns->channels.all); cur != NULL; cur = nchan_slist_next(&ns->channels.all, cur)) {
+    assert(cur != ch);
   }
-  if(ch->rd_next) {
-    ch->rd_next->rd_prev = ch->rd_prev;
+  for(cur = nchan_slist_first(&ns->channels.disconnected_cmd); cur != NULL; cur = nchan_slist_next(&ns->channels.disconnected_cmd, cur)) {
+    assert(cur != ch);
   }
-  if(rdata->channels_head == ch) {
-    rdata->channels_head = ch->rd_next;
+  for(cur = nchan_slist_first(&ns->channels.disconnected_pubsub); cur != NULL; cur = nchan_slist_next(&ns->channels.disconnected_pubsub, cur)) {
+    assert(cur != ch);
   }
-  
-  if(rdata->almost_deleted_channels_head) {
-    rdata->almost_deleted_channels_head->rd_prev = ch;
-    ch->rd_next = rdata->almost_deleted_channels_head;
-    ch->rd_prev = NULL;
+  if(cmd) {
+    for(cur = nchan_slist_first(&cmd->channels.cmd); cur != NULL; cur = nchan_slist_next(&cmd->channels.cmd, cur)) {
+      assert(cur != ch);
+    }
+    for(cur = nchan_slist_first(&cmd->channels.pubsub); cur != NULL; cur = nchan_slist_next(&cmd->channels.pubsub, cur)) {
+      assert(cur != ch);
+    }
   }
-  else {
-    ch->rd_next = NULL;
-    ch->rd_prev = NULL;
+  if(pubsub) {
+    for(cur = nchan_slist_first(&pubsub->channels.cmd); cur != NULL; cur = nchan_slist_next(&pubsub->channels.cmd, cur)) {
+      assert(cur != ch);
+    }
+    for(cur = nchan_slist_first(&pubsub->channels.pubsub); cur != NULL; cur = nchan_slist_next(&pubsub->channels.pubsub, cur)) {
+      assert(cur != ch);
+    }
   }
+*/  
   
-  rdata->almost_deleted_channels_head = ch;
-  
-  if(rdata->node.cluster && rdata->node.cluster->orphan_channels_head == ch) {
-    rdata->node.cluster->orphan_channels_head = ch->rd_next;
-  }
   
   DBG("chanhead %p (%V) is empty and expired. delete.", ch, &ch->id);
   if(ch->keepalive_timer.timer_set) {
@@ -282,26 +298,7 @@ static void redis_store_reap_chanhead(rdstore_channel_head_t *ch) {
   stop_spooler(&ch->spooler, 1);
   CHANNEL_HASH_DEL(ch);
   
-  
-  //don't free the actual chanhead. That will be done once an UNSUBSCRIBE reply is received.
-}
-
-static void free_chanhead(rdstore_channel_head_t *ch) {
-  rdstore_data_t   *rdata = redis_cluster_rdata_from_channel(ch);
-  if(ch->rd_prev) {
-    ch->rd_prev->rd_next = ch->rd_next;
-  }
-  if(ch->rd_next) {
-    ch->rd_next->rd_prev = ch->rd_prev;
-  }
-  if(rdata->almost_deleted_channels_head == ch) {
-    rdata->almost_deleted_channels_head = ch->rd_next;
-  }
-
-  DBG("freed channel %V %p", &ch->id, ch);
-  
   ngx_free(ch);
-
 }
 
 static ngx_int_t nchan_redis_chanhead_ready_to_reap(rdstore_channel_head_t *ch, uint8_t force) {
@@ -315,8 +312,8 @@ static ngx_int_t nchan_redis_chanhead_ready_to_reap(rdstore_channel_head_t *ch,
       return NGX_DECLINED;
     }
     
-    if(ch->gc_time - ngx_time() > 0) {
-      DBG("not yet time to reap %V, %i sec left", &ch->id, ch->gc_time - ngx_time());
+    if(ch->gc.time - ngx_time() > 0) {
+      DBG("not yet time to reap %V, %i sec left", &ch->id, ch->gc.time - ngx_time());
       return NGX_DECLINED;
     }
     
@@ -330,7 +327,7 @@ static ngx_int_t nchan_redis_chanhead_ready_to_reap(rdstore_channel_head_t *ch,
       return NGX_DECLINED;
     }
     
-    //if(ch->pubsub_status == SUBBING) {
+    //if(ch->pubsub_status == REDIS_PUBSUB_SUBSCRIBING) {
     //  return NGX_DECLINED;
     //}
     
@@ -343,171 +340,39 @@ static ngx_int_t nchan_redis_chanhead_ready_to_reap(rdstore_channel_head_t *ch,
   }
 }
 
-static redisAsyncContext **whichRedisContext(rdstore_data_t *rdata, const redisAsyncContext *ac) {
-  if(rdata->ctx == ac) {
-    return &rdata->ctx;
-  }
-  else if(rdata->sub_ctx == ac) {
-    return &rdata->sub_ctx;
-  }
-  return NULL;
-}
-
-static void rdt_set_status(rdstore_data_t *rdata, redis_connection_status_t status, const redisAsyncContext *ac) {
-  redis_connection_status_t prev_status = rdata->status;
-  
-  if(rdata->node.cluster) {
-    redis_cluster_node_change_status(rdata, status);
-  }
-  
-  rdata->status = status;
-  
-  if(status == DISCONNECTED) {
-    if(!rdata->shutting_down && !rdata->reconnect_timer.timer_set) {
-      ngx_add_timer(&rdata->reconnect_timer, REDIS_RECONNECT_TIME);
-    }
-    if(rdata->ping_timer.timer_set) {
-      ngx_del_timer(&rdata->ping_timer);
-    }
-    if(rdata->stall_timer.timer_set) {
-      ngx_del_timer(&rdata->stall_timer);
-    }
-    
-    if(prev_status == CONNECTED) {
-      rdstore_channel_head_t   *cur;
-      
-      //nchan_update_stub_status(redis_pending_commands, -(rdata->pending_commands)); // not  necessary, callbacks will be called
-      nchan_update_stub_status(redis_connected_servers, -1);
-      
-      if(!rdata->node.cluster) {
-        //not in a cluster -- disconnect all subs right away
-        for(cur = rdata->channels_head; cur != NULL; cur = cur->rd_next) {
-          cur->spooler.fn->broadcast_status(&cur->spooler, NGX_HTTP_GONE, &NCHAN_HTTP_STATUS_410);
-          if(!cur->in_gc_reaper) {
-            redis_chanhead_gc_add(cur, 0, "redis connection gone");
-          }
-        }
-        
-        nchan_reaper_flush(&rdata->chanhead_reaper);
-        
-        while((cur = rdata->almost_deleted_channels_head) != NULL) {
-          free_chanhead(cur);
-        }
-      }
-    }
-    
-    if(ac) {
-      redisAsyncContext **pac = whichRedisContext(rdata, ac);
-      if(pac)
-        *pac = NULL;
-    }
-  }
-  else if(status == CONNECTED && prev_status != CONNECTED) {
-    callback_chain_t    *cur, *next;
-    
-    nchan_update_stub_status(redis_connected_servers, 1);
-    
-    if(!rdata->ping_timer.timer_set && rdata->ping_interval > 0) {
-      ngx_add_timer(&rdata->ping_timer, rdata->ping_interval * 1000);
-    }
-    
-    rdata->pending_commands = 0;
-    if(!rdata->stall_timer.timer_set && REDIS_STALL_CHECK_TIME > 0) {
-      ngx_add_timer(&rdata->stall_timer, REDIS_STALL_CHECK_TIME);
-    }
-    
-    //on_connected callbacks
-    cur = rdata->on_connected;
-    rdata->on_connected = NULL;
-    
-    while(cur != NULL) {
-      next = cur->next;
-      cur->cb(NGX_OK, NULL, cur->pd);
-      ngx_free(cur);
-      cur = next;
-    }
-    rdata->generation++;
-  }
-}
-
-static void redis_reconnect_timer_handler(ngx_event_t *ev) {
-  if(!ev->timedout || ngx_exiting || ngx_quit)
-    return;
-  ev->timedout = 0;
-  redis_ensure_connected((rdstore_data_t *)ev->data);
-}
-
-static void redis_ping_callback(redisAsyncContext *c, void *r, void *privdata) {
-  redisReply         *reply = (redisReply *)r;
-  rdstore_data_t     *rdata = c->data;
-  
-  rdata->pending_commands--;
-  nchan_update_stub_status(redis_pending_commands, -1);
-  
-  if(redisReplyOk(c, r)) {
-    if(CHECK_REPLY_INT(reply)) {
-      if(reply->integer < 1) {
-        ERR("failed to forward ping to sub_ctx");
-      }
-    }
-    else {
-      ERR("unexpected reply type for redis_ping_callback");
-    }
-  }
-}
-
-static void redis_ping_timer_handler(ngx_event_t *ev) {
-  rdstore_data_t  *rdata = ev->data, *cmd_rdata;
-  if(!ev->timedout || ngx_exiting || ngx_quit)
-    return;
-  
-  ev->timedout = 0;
-  if(rdata->status == CONNECTED && rdata->ctx && rdata->sub_ctx) {
-    if((cmd_rdata = redis_cluster_rdata_from_cstr(rdata, redis_subscriber_channel)) != NULL) {
-      redis_command(cmd_rdata, redis_ping_callback, NULL, "PUBLISH %s ping", redis_subscriber_channel);
-    }
-    else {
-      //TODO: what to do?...
-    }
-    if(rdata->ping_interval > 0) {
-      ngx_add_timer(ev, rdata->ping_interval * 1000);
-    }
-  }
-}
-
-static ngx_int_t redis_data_tree_connector(rbtree_seed_t *seed, rdstore_data_t *rdata, ngx_int_t *total_rc) {
-  ngx_int_t  rc = redis_ensure_connected(rdata);
-  if(rc != NGX_OK) {
-    *total_rc = rc;
-  }
-  return NGX_OK;
-}
+static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privdata);
 
 static ngx_int_t nchan_store_init_worker(ngx_cycle_t *cycle) {
   ngx_int_t rc = NGX_OK;
-  ngx_memzero(&redis_subscriber_id, sizeof(redis_subscriber_id));
-  ngx_memzero(&redis_subscriber_channel, sizeof(redis_subscriber_channel));
-  ngx_snprintf(redis_subscriber_id, 255, "worker:%i:time:%i", ngx_pid, ngx_time());
-  ngx_snprintf(redis_subscriber_channel, 255, "nchan:%s", redis_subscriber_id);
+  u_char *cur;
+  cur = ngx_snprintf(redis_subscriber_id, 512, "nchan_worker:{%i:time:%i}%Z", ngx_pid, ngx_time());
+  redis_subscriber_id_len = cur - redis_subscriber_id;
+  
+  //DBG("worker id %s len %i", redis_subscriber_id, redis_subscriber_id_len);
   
   redis_nginx_init();
   
-  rbtree_walk(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_connector, &rc);
+  nodeset_initialize((char *)redis_subscriber_id, redis_subscriber_callback);
+  nodeset_connect_all();
+  
+  //OLD
+  //rbtree_walk(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_connector, &rc);
   return rc;
 }
 
 void redisCheckErrorCallback(redisAsyncContext *c, void *r, void *privdata) {
   redisReplyOk(c, r);
 }
-int redisReplyOk(redisAsyncContext *c, void *r) {
+int redisReplyOk(redisAsyncContext *ac, void *r) {
   static const ngx_str_t script_error_start= ngx_string("ERR Error running script (call to f_");
+  redis_node_t         *node = ac->data;
   redisReply *reply = (redisReply *)r;
   if(reply == NULL) { //redis disconnected?...
-    if(c->err) {
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "connection to redis failed while waiting for reply - %s", c->errstr);
+    if(ac->err) {
+      node_log_error(node, "connection to redis failed while waiting for reply - %s", ac->errstr);
     }
     else {
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "got a NULL redis reply for unknown reason");
+      node_log_error(node, "got a NULL redis reply for unknown reason");
     }
     return 0;
   }
@@ -517,14 +382,14 @@ int redisReplyOk(redisAsyncContext *c, void *r) {
       redis_lua_script_t  *script;
       REDIS_LUA_SCRIPTS_EACH(script) {
         if (ngx_strncmp(script->hash, hash, REDIS_LUA_HASH_LENGTH)==0) {
-          ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS SCRIPT ERROR: %s :%s", script->name, &reply->str[script_error_start.len + REDIS_LUA_HASH_LENGTH + 2]);
+          node_log_error(node, "REDIS SCRIPT ERROR: %s :%s", script->name, &reply->str[script_error_start.len + REDIS_LUA_HASH_LENGTH + 2]);
           return 0;
         }
       }
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS SCRIPT ERROR: (unknown): %s", reply->str);
+      node_log_error(node, "REDIS SCRIPT ERROR: (unknown): %s", reply->str);
     }
     else {
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS REPLY ERROR: %s", reply->str);
+      node_log_error(node, "REDIS REPLY ERROR: %s", reply->str);
     }
     return 0;
   }
@@ -535,31 +400,28 @@ int redisReplyOk(redisAsyncContext *c, void *r) {
 
 static void redisEchoCallback(redisAsyncContext *ac, void *r, void *privdata) {
   redisReply      *reply = r;
-  rdstore_data_t  *rdata;
+  redis_node_t    *node = NULL;
   unsigned    i;
   //nchan_channel_t * channel = (nchan_channel_t *)privdata;
   if(ac) {
-    rdata = ac->data;
+    node = ac->data;
     if(ac->err) {
-      if(rdata->status != DISCONNECTED) {
-        ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "connection to redis failed - %s", ac->errstr);
-        rdt_set_status(rdata, DISCONNECTED, ac);
-      }
+      node_log_error(node, "connection to redis failed - %s", ac->errstr);
       return;
     }
   }
   else {
-    ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "connection to redis was terminated");
+    node_log_error(node, "connection to redis was terminated");
     return;
   }
   if(reply == NULL) {
-    ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS REPLY is NULL");
+    node_log_error(node, "REDIS REPLY is NULL");
     return;
   }  
   
   switch(reply->type) {
     case REDIS_REPLY_STATUS:
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS_REPLY_STATUS  %s", reply->str);
+      node_log_error(node, "REDIS_REPLY_STATUS  %s", reply->str);
       break;
       
     case REDIS_REPLY_ERROR:
@@ -567,19 +429,19 @@ static void redisEchoCallback(redisAsyncContext *ac, void *r, void *privdata) {
       break;
       
     case REDIS_REPLY_INTEGER:
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS_REPLY_INTEGER: %i", reply->integer);
+      node_log_error(node, "REDIS_REPLY_INTEGER: %i", reply->integer);
       break;
       
     case REDIS_REPLY_NIL:
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS_REPLY_NIL: nil");
+      node_log_error(node, "REDIS_REPLY_NIL: nil");
       break;
       
     case REDIS_REPLY_STRING:
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS_REPLY_STRING: %s", reply->str);
+      node_log_error(node, "REDIS_REPLY_STRING: %s", reply->str);
       break;
       
     case REDIS_REPLY_ARRAY:
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS_REPLY_ARRAY: %i", reply->elements);
+      node_log_error(node, "REDIS_REPLY_ARRAY: %i", reply->elements);
       for(i=0; i< reply->elements; i++) {
         redisEchoCallback(ac, reply->element[i], "  ");
       }
@@ -588,231 +450,7 @@ static void redisEchoCallback(redisAsyncContext *ac, void *r, void *privdata) {
   //redis_subscriber_command(NULL, NULL, "UNSUBSCRIBE {channel:%b}:pubsub", str(&(channel->id)));
 }
 
-static void redis_load_script_callback(redisAsyncContext *ac, void *r, void *privdata) {
-  redis_lua_script_t  *script = privdata;
-
-  redisReply *reply = r;
-  if (reply == NULL) return;
-  switch(reply->type) {
-    case REDIS_REPLY_ERROR:
-      nchan_log_error("Failed loading redis lua script %s :%s", script->name, reply->str);
-      break;
-    case REDIS_REPLY_STRING:
-      if(ngx_strncmp(reply->str, script->hash, REDIS_LUA_HASH_LENGTH)!=0) {
-        nchan_log_error("Redis lua script %s has unexpected hash %s (expected %s)", script->name, reply->str, script->hash);
-      }
-      else {
-        //everything went well
-        rdstore_data_t  *rdata = ac->data;
-        if(rdata->status == LOADING_SCRIPTS) {
-          rdata->scripts_loaded_count++;
-          if(rdata->scripts_loaded_count == redis_lua_scripts_count) {
-            
-            if(rdata->generation == 0) {
-              nchan_log_notice( "Established connection to redis at %V.",    rdata->connect_url);
-            }
-            else {
-              nchan_log_warning("Re-established connection to redis at %V.", rdata->connect_url);
-            }
-            
-            rdt_set_status(rdata, CONNECTED, NULL);
-          }
-        }
-      }
-      break;
-  }
-}
-
-static void redisInitScripts(rdstore_data_t *rdata){
-  redis_lua_script_t  *script;
-  if(rdata->ctx == NULL) {
-    ERR("unable to init lua scripts: redis connection not initialized.");
-  }
-  else {
-    rdt_set_status(rdata, LOADING_SCRIPTS, NULL);
-    rdata->scripts_loaded_count = 0;
-    REDIS_LUA_SCRIPTS_EACH(script) {
-      redisAsyncCommand(rdata->ctx, &redis_load_script_callback, script, "SCRIPT LOAD %s", script->script);
-    }
-  }
-}
-
-static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privdata);
-
-static void redis_nginx_connect_event_handler(const redisAsyncContext *ac, int status) {
-  //ERR("redis_nginx_connect_event_handler %v: %i", rdt.connect_url, status);
-  rdstore_data_t    *rdata = ac->data;
-  if(status != REDIS_OK) {
-    if(rdata->status != DISCONNECTED) {
-      char *action = rdata->generation == 0 ? "connect" : "reconnect";
-      if(ac->errstr) {
-        nchan_log_error("Can't %s to redis at %V: %s.", action, rdata->connect_url, ac->errstr);
-      }
-      else {
-        nchan_log_error("Can't %s to redis at %V.", action, rdata->connect_url);
-      }
-    }
-    rdt_set_status(rdata, DISCONNECTED, ac);
-  }
-}
-
-static void redis_nginx_disconnect_event_handler(const redisAsyncContext *ac, int status) {
-  rdstore_data_t    *rdata = ac->data;
-  
-  DBG("connection to redis for %V closed: %s", rdata->connect_url, ac->errstr);
-  
-  if(rdata->status == CONNECTED && !ngx_exiting && !ngx_quit && !rdata->shutting_down) {
-    if(ac->err) {
-      nchan_log_error("Lost connection to redis at %V: %s.", rdata->connect_url, ac->errstr);
-    }
-    else {
-      nchan_log_error("Lost connection to redis at %V.", rdata->connect_url);
-    }
-  }
-  rdt_set_status(rdata, DISCONNECTED, ac);
-  
-}
-
-static void redis_get_server_info(redisAsyncContext *ac);
-
-static void redis_check_if_still_loading_handler(ngx_event_t *ev) {
-  DBG("still loading?,,.");
-  rdstore_data_t   *rdata = ev->data;
-  if(rdata->status != DISCONNECTED && rdata->ctx) {
-    redis_get_server_info(rdata->ctx);
-  }
-  
-  ngx_free(ev);
-}
-
-void redis_get_server_info_callback(redisAsyncContext *ac, void *rep, void *privdata);
-
-
-static void redis_get_server_info(redisAsyncContext *ac) {
-  redisAsyncCommand(ac, redis_get_server_info_callback, NULL, "INFO");
-}
-
-
-
-
-void redis_get_server_info_callback(redisAsyncContext *ac, void *rep, void *privdata) {
-  redisReply             *reply = rep;
-  rdstore_data_t         *rdata = ac->data;
-  
-  //DBG("redis_get_server_info_callback %p", ac);
-  if(ac->err || !redisReplyOk(ac, rep) || reply->type != REDIS_REPLY_STRING) {
-    return;
-  }
-  
-  //is it loading?
-  if(ngx_strstrn((u_char *)reply->str, "loading:1", 8)) {
-    nchan_log_warning("Redis server at %V is still loading data.", rdata->connect_url);
-    ngx_event_t      *evt = ngx_calloc(sizeof(*evt), ngx_cycle->log);
-    nchan_init_timer(evt, redis_check_if_still_loading_handler, rdata);
-    rdt_set_status(rdata, LOADING, ac);
-    ngx_add_timer(evt, 1000);
-  }
-  else {
-    DBG("everything loaded and good to go");
-    redisInitScripts(rdata);
-    if(rdata->sub_ctx) {
-      //ERR("rdata->sub_ctx OK, subscribing for %V", rdata->connect_url);
-      if(redis_cluster_rdata_from_cstr(rdata, redis_subscriber_channel) == rdata) {
-        redisAsyncCommand(rdata->sub_ctx, redis_subscriber_callback, NULL, "SUBSCRIBE %s", redis_subscriber_channel);
-      }
-    }
-    else {
-      ERR("rdata->sub_ctx NULL, can't subscribe for %V", rdata->connect_url);
-    }
-  }
-  
-  //is it part of a cluster?
-  if(ac == rdata->ctx && ngx_strstrn((u_char *)reply->str, "cluster_enabled:1", 16)) {
-    DBG("is part of a cluster. learn more.");
-    redis_get_cluster_info(rdata);
-  }
-}
-
-void redis_nginx_select_callback(redisAsyncContext *ac, void *rep, void *privdata) {
-  redisReply             *reply = rep;
-  rdstore_data_t         *rdata = ac->data;
-  if ((reply == NULL) || (reply->type == REDIS_REPLY_ERROR)) {
-    if(rdata->status == CONNECTING) {
-      ERR("could not select redis database");
-    }
-    rdt_set_status(rdata, DISCONNECTED, ac);
-    redisAsyncFree(ac);
-  }
-  else if(rdata->ctx && rdata->sub_ctx && rdata->status == CONNECTING && !rdata->ctx->err && !rdata->sub_ctx->err) {
-    rdt_set_status(rdata, AUTHENTICATING, NULL);
-    
-    if(rdata->ctx == ac) {
-      redis_get_server_info(ac);
-    }
-  }
-}
-
-void redis_nginx_auth_callback(redisAsyncContext *ac, void *rep, void *privdata) {
-  redisReply             *reply = rep;
-  rdstore_data_t         *rdata = ac->data;
-  if ((reply == NULL) || (reply->type == REDIS_REPLY_ERROR)) {
-    if(rdata->status == CONNECTING) {
-      ERR("AUTH command failed, probably because the password is incorrect");
-      rdt_set_status(rdata, DISCONNECTED, ac);
-    }
-  }
-}
-
-static int redis_initialize_ctx(redisAsyncContext **ctx, rdstore_data_t *rdata) {
-  if(*ctx == NULL) {
-    redis_nginx_open_context(&rdata->connect_params.host, rdata->connect_params.port, rdata->connect_params.db, &rdata->connect_params.password, rdata, ctx);
-    if(*ctx != NULL) {
-      if(rdata->connect_params.password.len > 0) {
-        redisAsyncCommand(*ctx, redis_nginx_auth_callback, NULL, "AUTH %b", STR(&rdata->connect_params.password));
-      }
-      if(rdata->connect_params.db > 0) {
-        redisAsyncCommand(*ctx, redis_nginx_select_callback, NULL, "SELECT %d", rdata->connect_params.db);
-      }
-      else {
-        redis_get_server_info(*ctx);
-      }
-      redisAsyncSetConnectCallback(*ctx, redis_nginx_connect_event_handler);
-      redisAsyncSetDisconnectCallback(*ctx, redis_nginx_disconnect_event_handler);
-      return 1;
-    }
-    else {
-      ERR("can't initialize redis ctx %p", ctx);
-      return 0;
-    }
-  }
-  else {
-    return 0;
-  }
-}
-
-ngx_int_t redis_ensure_connected(rdstore_data_t *rdata) {
-  int connecting = 0;
-  if(redis_initialize_ctx(&rdata->ctx, rdata)) {
-    connecting = 1;
-  }
-  
-  if(redis_initialize_ctx(&rdata->sub_ctx, rdata)) {
-    connecting = 1;
-  }
-    
-  if(rdata->ctx && rdata->sub_ctx) {
-    if(connecting) {
-      rdt_set_status(rdata, CONNECTING, NULL);
-    }
-    return NGX_OK;
-  }
-  else {
-    return NGX_DECLINED;
-  }
-
-}
-
-static ngx_int_t msg_from_redis_get_message_reply(nchan_msg_t *msg, ngx_buf_t *buf, redisReply *r, uint16_t offset);
+static ngx_int_t msg_from_redis_get_message_reply(nchan_msg_t *msg, nchan_compressed_msg_t *cmsg, ngx_str_t *content_type, ngx_str_t *eventsource_event, redisReply *r, uint16_t offset);
 
 #define SLOW_REDIS_REPLY 100 //ms
 
@@ -824,7 +462,7 @@ static ngx_int_t log_redis_reply(char *name, ngx_msec_t t) {
   return NGX_OK;
 }
 
-static ngx_int_t redisReply_to_int(redisReply *el, ngx_int_t *integer) {
+static ngx_int_t redisReply_to_ngx_int(redisReply *el, ngx_int_t *integer) {
   if(CHECK_REPLY_INT(el)) {
     *integer=el->integer;
   }
@@ -843,38 +481,41 @@ typedef struct {
   ngx_str_t                     channel_id;
   nchan_msg_id_t               *msg_id;
   ngx_str_t                     msg_key;
-  rdstore_data_t               *rdata;
 } redis_get_message_from_key_data_t;
 
-static void get_msg_from_msgkey_callback(redisAsyncContext *c, void *r, void *privdata);
+static void get_msg_from_msgkey_callback(redisAsyncContext *ac, void *r, void *privdata);
 
-static void get_msg_from_msgkey_send(rdstore_data_t *rdata, void *pd) {
+static ngx_int_t get_msg_from_msgkey_send(redis_nodeset_t *ns, void *pd) {
   redis_get_message_from_key_data_t *d = pd;
-  if(rdata) {
-    redis_command(rdata, &get_msg_from_msgkey_callback, d, "EVALSHA %s 1 %b", redis_lua_scripts.get_message_from_key.hash, STR(&d->msg_key));
+  if(nodeset_ready(ns)) {
+    redis_node_t  *node = nodeset_node_find_by_key(ns, &d->msg_key);
+    redis_script(get_message_from_key, node, &get_msg_from_msgkey_callback, d, "1 %b", STR(&d->msg_key));
   }
   else {
     ngx_free(d);
   }
+  return NGX_OK;
 }
 
-static void get_msg_from_msgkey_callback(redisAsyncContext *c, void *r, void *privdata) {
+static void get_msg_from_msgkey_callback(redisAsyncContext *ac, void *r, void *privdata) {
   redis_get_message_from_key_data_t *d = (redis_get_message_from_key_data_t *)privdata;
   redisReply           *reply = r;
   nchan_msg_t           msg;
-  ngx_buf_t             msgbuf;
+  nchan_compressed_msg_t cmsg;
+  ngx_str_t             content_type;
+  ngx_str_t             eventsource_event;
   ngx_str_t            *chid = &d->channel_id;
-  rdstore_data_t       *rdata = c->data;
+  redis_node_t         *node = ac->data;
   
-  rdata->pending_commands--;
+  node->pending_commands--;
   nchan_update_stub_status(redis_pending_commands, -1);
   
   DBG("get_msg_from_msgkey_callback");
   
   log_redis_reply(d->name, d->t);
   
-  if(!clusterKeySlotOk(c, r)) {
-    cluster_add_retry_command_with_channel_id(rdata->node.cluster, chid, get_msg_from_msgkey_send, d);
+  if(!nodeset_node_reply_keyslot_ok(node, reply)) {
+    nodeset_callback_on_ready(node->nodeset, 1000, get_msg_from_msgkey_send, d);
     return;
   }
   
@@ -883,11 +524,11 @@ static void get_msg_from_msgkey_callback(redisAsyncContext *c, void *r, void *pr
       ERR("get_msg_from_msgkey channel id is NULL");
       return;
     }
-    if(msg_from_redis_get_message_reply(&msg, &msgbuf, reply, 0) != NGX_OK) {
+    if(msg_from_redis_get_message_reply(&msg, &cmsg, &content_type, &eventsource_event, reply, 0) != NGX_OK) {
       ERR("invalid message or message absent after get_msg_from_key");
       return;
     }
-    nchan_store_publish_generic(chid, d->rdata, &msg, 0, NULL);
+    nchan_store_publish_generic(chid, node->nodeset, &msg, 0, NULL);
   }
   else {
     //reply is NULL
@@ -914,11 +555,12 @@ static bool cmp_to_str(cmp_ctx_t *cmp, ngx_str_t *str) {
   }
 }
 
-static bool cmp_to_msg(cmp_ctx_t *cmp, nchan_msg_t *msg, ngx_buf_t *buf) {
+static bool cmp_to_msg(cmp_ctx_t *cmp, nchan_msg_t *msg, nchan_compressed_msg_t *cmsg, ngx_str_t *content_type, ngx_str_t *eventsource_event) {
   ngx_buf_t  *mpb = (ngx_buf_t *)cmp->buf;
   uint32_t    sz;
   uint64_t    msgtag;
   int32_t     ttl;
+  int32_t     compression;
   //ttl 
   if(!cmp_read_int(cmp, &ttl)) {
     return cmp_err(cmp);
@@ -959,34 +601,48 @@ static bool cmp_to_msg(cmp_ctx_t *cmp, nchan_msg_t *msg, ngx_buf_t *buf) {
   if(!cmp_read_str_size(cmp, &sz)) {
     return cmp_err(cmp);
   }
-  set_buf(buf, mpb->pos, sz);
+  set_buf(&msg->buf, mpb->pos, sz);
   fwd_buf(mpb, sz);
-  buf->memory = 1;
-  buf->last_buf = 1;
-  buf->last_in_chain = 1;
-  msg->buf = buf;
+  msg->buf.memory = 1;
+  msg->buf.last_buf = 1;
+  msg->buf.last_in_chain = 1;
 
   //content-type
   if(!cmp_read_str_size(cmp, &sz)) {
     return cmp_err(cmp);
   }
-  fwd_buf_to_str(mpb, sz, &msg->content_type);
+  fwd_buf_to_str(mpb, sz, content_type);
+  msg->content_type = sz > 0 ? content_type : NULL;
   
   //eventsource_event
   if(!cmp_read_str_size(cmp, &sz)) {
     return cmp_err(cmp);
   }
-  fwd_buf_to_str(mpb, sz, &msg->eventsource_event);
+  fwd_buf_to_str(mpb, sz, eventsource_event);
+  msg->eventsource_event = sz > 0 ? eventsource_event : NULL;
+  
+  //compression
+  if(!cmp_read_int(cmp, &compression)) {
+    msg->compressed = NULL;
+  }
+  if(compression > 0) {
+    msg->compressed = cmsg;
+    ngx_memzero(&cmsg->buf, sizeof(cmsg->buf));
+    cmsg->compression = compression;
+  }
+  else {
+    msg->compressed = NULL;
+  }
   
   return true;
 }
 
-static ngx_int_t get_msg_from_msgkey(ngx_str_t *channel_id, rdstore_data_t *rdata, nchan_msg_id_t *msgid, ngx_str_t *msg_redis_hash_key) {
+static ngx_int_t get_msg_from_msgkey(ngx_str_t *channel_id, redis_nodeset_t *nodeset, nchan_msg_id_t *msgid, ngx_str_t *msg_redis_hash_key) {
   rdstore_channel_head_t              *head;
   redis_get_message_from_key_data_t   *d;
   DBG("Get message from msgkey %V", msg_redis_hash_key);
   
-  head = nchan_store_get_chanhead(channel_id, rdata);
+  head = nchan_store_get_chanhead(channel_id, nodeset);
   if(head->sub_count == 0) {
     DBG("Nobody wants this message we'll need to grab with an HMGET");
     return NGX_OK;
@@ -1003,27 +659,56 @@ static ngx_int_t get_msg_from_msgkey(ngx_str_t *channel_id, rdstore_data_t *rdat
   nchan_strcpy(&d->msg_key, msg_redis_hash_key, 0);
   
   d->t = ngx_current_msec;
-  d->rdata = rdata;
   
   d->name = "get_message_from_key";
   
   //d->hcln = put_current_subscribers_in_limbo(head);
   //assert(d->hcln != 0);
-  if((rdata = redis_cluster_rdata_from_key(rdata, msg_redis_hash_key)) == NULL) {
-    return NGX_ERROR;
-  }
-  get_msg_from_msgkey_send(rdata, d);
+  get_msg_from_msgkey_send(nodeset, d);
 
   return NGX_OK;
 }
 
 static ngx_int_t redis_subscriber_register(rdstore_channel_head_t *chanhead, subscriber_t *sub);
 
+static int str_match_redis_subscriber_channel(ngx_str_t *pubsub_channel, ngx_str_t *ns) {
+  ngx_str_t psch = *pubsub_channel;
+  if(pubsub_channel->len != ns->len + redis_subscriber_id_len || psch.len < ns->len) {
+    return 0;
+  }
+  if(ngx_memcmp(psch.data, ns->data, ns->len) != 0) {
+    return 0;
+  }
+  psch.data += ns->len;
+  psch.len -= ns->len;
+  
+  return ngx_strmatch(&psch, (char *)redis_subscriber_id);
+}
+
+static ngx_str_t *get_channel_id_from_pubsub_channel(ngx_str_t *pubsub_channel, ngx_str_t *ns, ngx_str_t *str_in) {
+  if(str_match_redis_subscriber_channel(pubsub_channel, ns)) {
+    return NULL;
+  }
+  str_in->data = pubsub_channel->data + ns->len + 9; //"<namespace>{channel:"
+  str_in->len = pubsub_channel->len - ns->len - 9;
+  str_in->len -= 8;//"}:pubsub"
+  return str_in;
+}
+
+static rdstore_channel_head_t *find_chanhead_for_pubsub_callback(ngx_str_t *chid) {
+  rdstore_channel_head_t *head;
+  CHANNEL_HASH_FIND(chid, head);
+  return head;
+}
+
 static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privdata) {
   redisReply             *reply = r;
   redisReply             *el = NULL;
   nchan_msg_t             msg;
-  ngx_buf_t               buf;
+  nchan_compressed_msg_t  cmsg;
+  ngx_str_t               content_type;
+  ngx_str_t               eventsource_event;
+  ngx_str_t               chid_str;
   ngx_str_t              *chid = NULL;
   ngx_str_t               pubsub_channel; 
   ngx_str_t               msg_redis_hash_key = ngx_null_string;
@@ -1032,32 +717,37 @@ static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privd
   ngx_buf_t               mpbuf;
   cmp_ctx_t               cmp;
   
-  rdstore_channel_head_t     *chanhead;
-  rdstore_data_t             *rdata = c->data;
-  
-  ngx_memzero(&buf, sizeof(buf)); 
-  
-  //ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "redis_subscriber_callback,  privdata=%p", privdata);
-  
-  chanhead = (rdstore_channel_head_t *)privdata;
+  rdstore_channel_head_t     *chanhead = NULL;
+  redis_node_t               *node = c->data;
+  redis_nodeset_t            *nodeset = node->nodeset;
+  ngx_str_t                  *namespace = nodeset->settings.namespace;
   
   msg.expires = 0;
   msg.refcount = 0;
-  msg.buf = NULL;
+  msg.parent = NULL;
+  msg.storage = NCHAN_MSG_STACK;
 
   if(reply == NULL) return;
+  
   if(CHECK_REPLY_ARRAY_MIN_SIZE(reply, 3)
-    && CHECK_REPLY_STRVAL(reply->element[0], "message")
-    && CHECK_REPLY_STR(reply->element[1])
-    && CHECK_REPLY_STR(reply->element[2])) {
-    
+   && CHECK_REPLY_STR(reply->element[0])
+   && CHECK_REPLY_STR(reply->element[1])) {
     pubsub_channel.data = (u_char *)reply->element[1]->str;
     pubsub_channel.len = reply->element[1]->len;
+    chid = get_channel_id_from_pubsub_channel(&pubsub_channel, namespace, &chid_str);
+  }
+  else {
+    ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "no PUBSUB message, something else");
+    redisEchoCallback(c,r,privdata);
+    return;
+  }
   
+  if(CHECK_REPLY_STRVAL(reply->element[0], "message") && CHECK_REPLY_STR(reply->element[2])) {
+    
     //reply->element[1] is the pubsub channel name
     el = reply->element[2];
     
-    if(CHECK_REPLY_STRVAL(el, "ping") && ngx_strmatch(&pubsub_channel, (char *)&redis_subscriber_channel)) {
+    if(CHECK_REPLY_STRVAL(el, "ping") && str_match_redis_subscriber_channel(&pubsub_channel, namespace)) {
       DBG("got pinged");
     }
     else if(CHECK_REPLY_STR(el)) {
@@ -1068,7 +758,7 @@ static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privd
       int64_t     msgbuf_size = 0;
       //maybe a message?
       set_buf(&mpbuf, (u_char *)el->str, el->len);
-      cmp_init(&cmp, &mpbuf, ngx_buf_reader, ngx_buf_writer);
+      cmp_init(&cmp, &mpbuf, ngx_buf_reader, NULL, ngx_buf_writer);
       if(cmp_read_array(&cmp, &array_sz)) {
         
         if(array_sz != 0) {
@@ -1093,22 +783,26 @@ static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privd
               cmp_err(&cmp);
             }
           }
-          else if(chanhead) {
-            chid = &chanhead->id;
-          }
+          //else {
+          //  chid already set from the pubsub channel name
+          //}
           
-          if(msgbuf_size_changed && (chanhead || ((chanhead = nchan_store_get_chanhead(chid, rdata)) != NULL))) {
+          if(msgbuf_size_changed && (chanhead = nchan_store_get_chanhead(chid, nodeset)) != NULL) {
             chanhead->spooler.fn->broadcast_notice(&chanhead->spooler, NCHAN_NOTICE_REDIS_CHANNEL_MESSAGE_BUFFER_SIZE_CHANGE, (void *)(intptr_t )msgbuf_size);
           }
           
+          if(!chanhead) {
+            chanhead = find_chanhead_for_pubsub_callback(chid);
+          }
+          
           if(ngx_strmatch(&msg_type, "msg")) {
-            assert(array_sz == 9 + msgbuf_size_changed + chid_present);
-            if(chanhead != NULL && cmp_to_msg(&cmp, &msg, &buf)) {
+            assert(array_sz >= 9 + msgbuf_size_changed + chid_present);
+            if(chanhead && cmp_to_msg(&cmp, &msg, &cmsg, &content_type, &eventsource_event)) {
               //ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "got msg %V", msgid_to_str(&msg));
-              nchan_store_publish_generic(chid, chanhead ? chanhead->rdt : rdata, &msg, 0, NULL);
+              nchan_store_publish_generic(chid, chanhead ? chanhead->redis.nodeset : nodeset, &msg, 0, NULL);
             }
             else {
-              ERR("thought there'd be a channel id around for msg");
+              ERR("thought there'd be a channel for msg");
             }
           }
           else if(ngx_strmatch(&msg_type, "msgkey")) {
@@ -1133,7 +827,7 @@ static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privd
               }
               
               if(cmp_to_str(&cmp, &msg_redis_hash_key)) {
-                get_msg_from_msgkey(chid, chanhead ? chanhead->rdt : rdata, &msgid, &msg_redis_hash_key);
+                get_msg_from_msgkey(chid, chanhead ? chanhead->redis.nodeset : node->nodeset, &msgid, &msg_redis_hash_key);
               }
             }
             else {
@@ -1150,8 +844,8 @@ static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privd
             if(ngx_strmatch(&alerttype, "delete channel") && array_sz > 2) {
               if(cmp_to_str(&cmp, &extracted_channel_id)) {
                 rdstore_channel_head_t *doomed_channel;
-                nchan_store_publish_generic(&extracted_channel_id, rdata, NULL, NGX_HTTP_GONE, &NCHAN_HTTP_STATUS_410);
-                doomed_channel = nchan_store_get_chanhead(&extracted_channel_id, rdata);
+                nchan_store_publish_generic(&extracted_channel_id, nodeset, NULL, NGX_HTTP_GONE, &NCHAN_HTTP_STATUS_410);
+                doomed_channel = nchan_store_get_chanhead(&extracted_channel_id, nodeset);
                 redis_chanhead_gc_add(doomed_channel, 0, "channel deleted");
               }
               else {
@@ -1169,7 +863,7 @@ static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privd
             }
             else if(ngx_strmatch(&alerttype, "unsub all") && array_sz > 1) {
               if(cmp_to_str(&cmp, &extracted_channel_id)) {
-                nchan_store_publish_generic(&extracted_channel_id, rdata, NULL, NGX_HTTP_CONFLICT, &NCHAN_HTTP_STATUS_409);
+                nchan_store_publish_generic(&extracted_channel_id, nodeset, NULL, NGX_HTTP_CONFLICT, &NCHAN_HTTP_STATUS_409);
               }
             }
             else if(ngx_strmatch(&alerttype, "unsub all except")) {
@@ -1205,52 +899,57 @@ static void redis_subscriber_callback(redisAsyncContext *c, void *r, void *privd
     }
   }
 
-  else if(CHECK_REPLY_ARRAY_MIN_SIZE(reply, 3)
-    && CHECK_REPLY_STRVAL(reply->element[0], "subscribe")
-    && CHECK_REPLY_STR(reply->element[1])
-    && CHECK_REPLY_INT(reply->element[2])) {
-
-    if(chanhead != NULL){
-      if(chanhead->pubsub_status != SUBBING) {
-        ERR("expected previous pubsub_status for channel %p (id: %V) to be SUBBING (%i), was %i", chanhead, &chanhead->id, SUBBING, chanhead->pubsub_status);
+  else if(CHECK_REPLY_STRVAL(reply->element[0], "subscribe") && CHECK_REPLY_INT(reply->element[2])) {
+    
+    if(chid) {
+      chanhead = find_chanhead_for_pubsub_callback(chid);
+      if(chanhead != NULL) {
+        if(chanhead->pubsub_status != REDIS_PUBSUB_SUBSCRIBING) {
+          ERR("expected previous pubsub_status for channel %p (id: %V) to be REDIS_PUBSUB_SUBSCRIBING (%i), was %i", chanhead, &chanhead->id, REDIS_PUBSUB_SUBSCRIBING, chanhead->pubsub_status);
+        }
+        chanhead->pubsub_status = REDIS_PUBSUB_SUBSCRIBED;
+        
+        switch(chanhead->status) {
+          case NOTREADY:
+            chanhead->status = READY;
+            chanhead->spooler.fn->handle_channel_status_change(&chanhead->spooler);
+            //ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "REDIS: PUB/SUB subscribed to %s, chanhead %p now READY.", reply->element[1]->str, chanhead);
+            break;
+          case READY:
+            ERR("REDIS: PUB/SUB already subscribed to %s, chanhead %p (id %V) already READY.", reply->element[1]->str, chanhead, &chanhead->id);
+            break;
+          case INACTIVE:
+            // this is fine, inactive channels can be pubsubbed, they will be garbage collected
+            // later if needed
+            break;
+          default:
+            ERR("REDIS: PUB/SUB really unexpected chanhead status %i", chanhead->status);
+            assert(0);
+            //not sposed to happen
+        }
       }
-      chanhead->pubsub_status = SUBBED;
-      
-      switch(chanhead->status) {
-        case NOTREADY:
-          chanhead->status = READY;
-          chanhead->spooler.fn->handle_channel_status_change(&chanhead->spooler);
-          //ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "REDIS: PUB/SUB subscribed to %s, chanhead %p now READY.", reply->element[1]->str, chanhead);
-          break;
-        case READY:
-          ERR("REDIS: PUB/SUB already subscribed to %s, chanhead %p (id %V) already READY.", reply->element[1]->str, chanhead, &chanhead->id);
-          break;
-        case INACTIVE:
-          ERR("REDIS: PUB/SUB already unsubscribed from %s, chanhead %p (id %V) INACTIVE.", reply->element[1]->str, chanhead, &chanhead->id);
-          break;
-        default:
-          ERR("REDIS: PUB/SUB really unexpected chanhead status %i", chanhead->status);
-          assert(0);
-          //not sposed to happen
+      else {
+        ERR("received SUBSCRIBE acknowledgement for unknown channel %V", chid);
       }
     }
+    else {
+      DBG("subscribed to worker channel %s", redis_subscriber_id);
+    }
     
     DBG("REDIS: PUB/SUB subscribed to %s (%i total)", reply->element[1]->str, reply->element[2]->integer);
   }
-  else if(CHECK_REPLY_ARRAY_MIN_SIZE(reply, 3)
-    && CHECK_REPLY_STRVAL(reply->element[0], "unsubscribe")
-    && CHECK_REPLY_STR(reply->element[1])
-    && CHECK_REPLY_INT(reply->element[2])) {
-
-    DBG("REDIS: PUB/SUB unsubscribed from %s (%i total)", reply->element[1]->str, reply->element[2]->integer);
-    if(chanhead->pubsub_status == UNSUBBING) {
-      chanhead->pubsub_status = UNSUBBED;
-      free_chanhead(chanhead);
+  else if(CHECK_REPLY_STRVAL(reply->element[0], "unsubscribe") && CHECK_REPLY_INT(reply->element[2])) {
+    
+    if(chid) {
+      DBG("received UNSUBSCRIBE acknowledgement for channel %V", chid);
+    }
+    else {
+      DBG("received UNSUBSCRIBE acknowledgement for worker channel %s", redis_subscriber_id);
     }
   }
   
   else {
-    ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "no message, something else");
+    ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "Unexpected PUBSUB message %s", reply->element[0]);
     redisEchoCallback(c,r,privdata);
   }
 }
@@ -1276,9 +975,7 @@ static void spooler_dequeue_handler(channel_spooler_t *spl, subscriber_t *sub, v
     head->internal_sub_count--;
   }
   
-  if(head->rdt->status == CONNECTED) {
-    redis_subscriber_unregister(head, sub, head->shutting_down);
-  }
+  redis_subscriber_unregister(head, sub, head->shutting_down);
   
   if(head->sub_count == 0 && head->fetching_message_count == 0) {
     redis_chanhead_gc_add(head, 0, "sub count == 0 and fetching_message_count == 0 after spooler dequeue");
@@ -1300,6 +997,8 @@ void spooler_get_message_finish_handler(channel_spooler_t *spl, void *pd) {
 }
 
 static ngx_int_t start_chanhead_spooler(rdstore_channel_head_t *head) {
+  static uint8_t channel_buffer_complete = 1;
+  spooler_fetching_strategy_t spooling_strategy;
   static channel_spooler_handlers_t handlers = {
     spooler_add_handler,
     spooler_dequeue_handler,
@@ -1308,11 +1007,20 @@ static ngx_int_t start_chanhead_spooler(rdstore_channel_head_t *head) {
     spooler_get_message_start_handler,
     spooler_get_message_finish_handler
   };
-  start_spooler(&head->spooler, &head->id, &head->status, &nchan_store_redis, head->rdt->lcf, FETCH, &handlers, head);
+  nchan_loc_conf_t *lcf = head->redis.nodeset->first_loc_conf; //any loc_conf that refers to this nodeset will work. 
+  //the spooler needs it to pass to get_message calls, which in rdstore's case only cares about the nodeset referenced in the loc_conf
+  if(head->redis.nodeset->settings.storage_mode == REDIS_MODE_DISTRIBUTED_NOSTORE) {
+    spooling_strategy = NCHAN_SPOOL_PASSTHROUGH;
+  }
+  else {
+    spooling_strategy = NCHAN_SPOOL_FETCH;
+  }
+  
+  start_spooler(&head->spooler, &head->id, &head->status, &channel_buffer_complete, &nchan_store_redis, lcf, spooling_strategy, &handlers, head);
   return NGX_OK;
 }
 
-static void redis_subscriber_register_callback(redisAsyncContext *c, void *vr, void *privdata);
+static void redis_subscriber_register_cb(redisAsyncContext *c, void *vr, void *privdata);
 
 typedef struct {
   rdstore_channel_head_t *chanhead;
@@ -1320,22 +1028,28 @@ typedef struct {
   subscriber_t           *sub;
 } redis_subscriber_register_t;
 
-static void redis_subscriber_register_send(rdstore_data_t *rdata, void *pd) {
+static ngx_int_t redis_subscriber_register_send(redis_nodeset_t *nodeset, void *pd) {
   redis_subscriber_register_t   *d = pd;
-  if(rdata) {
+  if(nodeset_ready(nodeset)) {
     d->chanhead->reserved++;
-    redis_command(rdata, &redis_subscriber_register_callback, d, "EVALSHA %s 0 %b - %i", redis_lua_scripts.subscriber_register.hash, STR(&d->chanhead->id), REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL);
+    redis_node_t *node = nodeset_node_find_by_chanhead(d->chanhead);
+    
+    nchan_redis_script(subscriber_register, node, &redis_subscriber_register_cb, d, &d->chanhead->id,
+                       "- %i %i 1",
+                       REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL_STEP,
+                       ngx_time()
+                      );
   }
   else {
     d->sub->fn->release(d->sub, 0);
     ngx_free(d);
   }
+  return NGX_OK;
 }
 
 
 static ngx_int_t redis_subscriber_register(rdstore_channel_head_t *chanhead, subscriber_t *sub) {
   redis_subscriber_register_t *sdata=NULL;
-  rdstore_data_t              *rdata;
   if((sdata = ngx_alloc(sizeof(*sdata), ngx_cycle->log)) == NULL) {
     ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "No memory for sdata. Part IV, subparagraph 12 of the Cryptic Error Series.");
     return NGX_ERROR;
@@ -1350,46 +1064,65 @@ static ngx_int_t redis_subscriber_register(rdstore_channel_head_t *chanhead, sub
   //  'subscriber_id' can be '-' for new id, or an existing id
   //  'active_ttl' is channel ttl with non-zero subscribers. -1 to persist, >0 ttl in sec
   //output: subscriber_id, num_current_subscribers, next_keepalive_time
-  if((rdata = redis_cluster_rdata_from_channel(chanhead)) == NULL) {
-    return NGX_ERROR;
-  }
-  redis_subscriber_register_send(rdata, sdata);
+  redis_subscriber_register_send(chanhead->redis.nodeset, sdata);
   
   return NGX_OK;
 }
 
-static void redis_subscriber_register_callback(redisAsyncContext *c, void *vr, void *privdata) {
+static ngx_int_t redis_subscriber_register_send_retry_wrapper(redis_nodeset_t *nodeset, void *pd) {
+  redis_subscriber_register_t   *d = pd;
+  d->chanhead->reserved--;
+  return redis_subscriber_register_send(nodeset, pd);
+}
+
+static void redis_subscriber_register_cb(redisAsyncContext *c, void *vr, void *privdata) {
   redis_subscriber_register_t *sdata= (redis_subscriber_register_t *) privdata;
   redisReply                  *reply = (redisReply *)vr;
-  rdstore_data_t              *rdata = c->data;
+  redis_node_t                *node = c->data;
   int                          keepalive_ttl;
   
-  rdata->pending_commands--;
+  node->pending_commands--;
   nchan_update_stub_status(redis_pending_commands, -1);
   
   sdata->chanhead->reserved--;
-  sdata->sub->fn->release(sdata->sub, 0);
   
-  if(!clusterKeySlotOk(c, reply)) {
-    cluster_add_retry_command_with_chanhead(sdata->chanhead, redis_subscriber_register_send, sdata);
+  if(!nodeset_node_reply_keyslot_ok(node, reply)) {
+    sdata->chanhead->reserved++;
+    nodeset_callback_on_ready(node->nodeset, 1000, redis_subscriber_register_send_retry_wrapper, sdata);
     return; 
   }
   
   if (!redisReplyOk(c, reply)) {
+    //TODO: fail less silently, maybe retry subscriber registration?
+    sdata->sub->fn->release(sdata->sub, 0);
     ngx_free(sdata);
     return;
   }
   
-  if ( !CHECK_REPLY_ARRAY_MIN_SIZE(reply, 3) || !CHECK_REPLY_INT(reply->element[1]) || !CHECK_REPLY_INT(reply->element[2])) {
-    //no good
-    redisEchoCallback(c,reply,privdata);
-    return;
+  if(  CHECK_REPLY_ARRAY_MIN_SIZE(reply, 4)
+    && CHECK_REPLY_INT(reply->element[3])
+  ) {
+    //notify about channel buffer size if it's present
+    sdata->sub->fn->notify(sdata->sub, NCHAN_NOTICE_REDIS_CHANNEL_MESSAGE_BUFFER_SIZE_CHANGE, (void *)(intptr_t )reply->element[3]->integer);
   }
+  
   if(sdata->generation == sdata->chanhead->generation) {
     //is the subscriber     
     //TODO: set subscriber id
     //sdata->sub->id = reply->element[1]->integer;
   }
+  
+  sdata->sub->fn->release(sdata->sub, 0);
+  sdata->sub = NULL; //don't use it anymore, it might have been freed
+  
+  if ( !CHECK_REPLY_ARRAY_MIN_SIZE(reply, 3) || !CHECK_REPLY_INT(reply->element[1]) || !CHECK_REPLY_INT(reply->element[2])) {
+    //no good
+    //TODO: fail less silently, maybe retry subscriber registration?
+    redisEchoCallback(c,reply,privdata);
+    ngx_free(sdata);
+    return;
+  }
+  
   keepalive_ttl = reply->element[2]->integer;
   if(keepalive_ttl > 0) {
     if(!sdata->chanhead->keepalive_timer.timer_set) {
@@ -1403,24 +1136,35 @@ static void redis_subscriber_register_callback(redisAsyncContext *c, void *vr, v
 typedef struct {
   ngx_str_t    *channel_id;
   time_t        channel_timeout;
+  unsigned      allocd:1;
 } subscriber_unregister_data_t;
 
-static void redis_subscriber_unregister_callback(redisAsyncContext *c, void *r, void *privdata);
-static void redis_subscriber_unregister_send(rdstore_data_t *rdata, void *pd) {
-  //input: keys: [], values: [channel_id, subscriber_id, empty_ttl]
+static void redis_subscriber_unregister_cb(redisAsyncContext *c, void *r, void *privdata);
+static ngx_int_t redis_subscriber_unregister_send(redis_nodeset_t *nodeset, void *pd) {
+  //input: keys: [], values: [namespace, channel_id, subscriber_id, empty_ttl]
   // 'subscriber_id' is an existing id
   // 'empty_ttl' is channel ttl when without subscribers. 0 to delete immediately, -1 to persist, >0 ttl in sec
   //output: subscriber_id, num_current_subscribers
-  if(rdata) {
-    redis_command(rdata, &redis_subscriber_unregister_callback, NULL, "EVALSHA %s 0 %b %i %i", redis_lua_scripts.subscriber_unregister.hash, STR(((subscriber_unregister_data_t *)pd)->channel_id), 0/*TODO: sub->id*/, ((subscriber_unregister_data_t *)pd)->channel_timeout);
+  subscriber_unregister_data_t *d = pd;
+  if(nodeset_ready(nodeset)) {
+    redis_node_t *node = nodeset_node_find_by_channel_id(nodeset, d->channel_id);
+    nchan_redis_script( subscriber_unregister, node, &redis_subscriber_unregister_cb, NULL, 
+      d->channel_id, "%i %i", 
+                       0/*TODO: sub->id*/,
+                       d->channel_timeout
+                      );
+  }
+  if(d->allocd) {
+    ngx_free(d);
   }
+  return NGX_OK;
 }
 
-static void redis_subscriber_unregister_callback(redisAsyncContext *c, void *r, void *privdata) {
+static void redis_subscriber_unregister_cb(redisAsyncContext *c, void *r, void *privdata) {
   redisReply      *reply = r;
-  rdstore_data_t  *rdata = c->data;
+  redis_node_t    *node = c->data;
   
-  rdata->pending_commands--;
+  node->pending_commands--;
   nchan_update_stub_status(redis_pending_commands, -1);
   
   if(reply && reply->type == REDIS_REPLY_ERROR) {
@@ -1433,12 +1177,12 @@ static void redis_subscriber_unregister_callback(redisAsyncContext *c, void *r,
     errstr.len = strlen(reply->str);
     
     if(ngx_str_chop_if_startswith(&errstr, "CLUSTER KEYSLOT ERROR. ")) {
-      
+      nodeset_node_keyslot_changed(node);
       nchan_scan_until_chr_on_line(&errstr, &countstr, ' ');
       channel_timeout = ngx_atoi(countstr.data, countstr.len);
       channel_id = errstr;
       
-      subscriber_unregister_data_t  *d = cluster_retry_palloc(rdata->node.cluster, sizeof(*d) + sizeof(ngx_str_t) + channel_id.len);
+      subscriber_unregister_data_t  *d = ngx_alloc(sizeof(*d) + sizeof(ngx_str_t) + channel_id.len, ngx_cycle->log);
       if(!d) {
         ERR("can't allocate add_fakesub_data for CLUSTER KEYSLOT ERROR retry");
         return;
@@ -1446,9 +1190,9 @@ static void redis_subscriber_unregister_callback(redisAsyncContext *c, void *r,
       d->channel_timeout = channel_timeout;
       d->channel_id = (ngx_str_t *)&d[1];
       d->channel_id->data = (u_char *)&d->channel_id[1];
+      d->allocd = 1;
       nchan_strcpy(d->channel_id, &channel_id, 0);
-      cluster_add_retry_command_with_channel_id(rdata->node.cluster, &channel_id, redis_subscriber_unregister_send, d);
-      
+      nodeset_callback_on_ready(node->nodeset, 1000, redis_subscriber_unregister_send, d);
       return;
     }
     
@@ -1457,20 +1201,23 @@ static void redis_subscriber_unregister_callback(redisAsyncContext *c, void *r,
 }
 
 static ngx_int_t redis_subscriber_unregister(rdstore_channel_head_t *chanhead, subscriber_t *sub, uint8_t shutting_down) {
-  nchan_loc_conf_t  *cf = sub->cf;
-  rdstore_data_t    *rdata;
+  nchan_loc_conf_t  *cf = sub->cf;;
   
-  if((rdata = redis_cluster_rdata_from_channel(chanhead)) == NULL) {
-    return NGX_ERROR;
-  }
   if(!shutting_down) {
     subscriber_unregister_data_t d;
     d.channel_id = &chanhead->id;
     d.channel_timeout = cf->channel_timeout;
-    redis_subscriber_unregister_send(rdata, &d);
+    d.allocd = 0;
+    redis_subscriber_unregister_send(chanhead->redis.nodeset, &d);
   }
   else {
-    redis_sync_command(rdata, "EVALSHA %s 0 %b %i %i", redis_lua_scripts.subscriber_unregister.hash, STR(&chanhead->id), 0/*TODO: sub->id*/, cf->channel_timeout);
+    if(nodeset_ready(chanhead->redis.nodeset)) {
+      redis_node_t   *node = nodeset_node_find_by_chanhead(chanhead);
+      nchan_redis_sync_script(subscriber_unregister, node, &chanhead->id, "%i %i", 
+                              0/*TODO: sub->id*/,
+                              cf->channel_timeout
+                            );
+    }
   }
   return NGX_OK;
 }
@@ -1478,27 +1225,45 @@ static ngx_int_t redis_subscriber_unregister(rdstore_channel_head_t *chanhead, s
 
 static void redisChannelKeepaliveCallback(redisAsyncContext *c, void *vr, void *privdata);
 
-static void redisChannelKeepaliveCallback_send(rdstore_data_t *rdata, void *pd) {
+static ngx_int_t redisChannelKeepaliveCallback_send(redis_nodeset_t *ns, void *pd) {
   rdstore_channel_head_t   *head = pd;
-  if(rdata) {
+  time_t                    ttl;
+  //TODO: optimize this
+  redis_node_t *node = nodeset_node_find_by_channel_id(head->redis.nodeset, &head->id);
+  if(nodeset_ready(ns)) {
     head->reserved++;
-    redis_command(rdata, &redisChannelKeepaliveCallback, head, "EVALSHA %s 0 %b %i", redis_lua_scripts.channel_keepalive.hash, STR(&head->id), REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL);
+    ttl = REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL_STEP * (1+head->keepalive_times_sent);
+    if(ttl > REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL_MAX) { //1 week at most
+      ttl = REDIS_CHANNEL_EMPTY_BUT_SUBSCRIBED_TTL_MAX;
+    }
+    nchan_redis_script(channel_keepalive, node, &redisChannelKeepaliveCallback, head, &head->id, "%i", ttl);
   }
+  return NGX_OK;
+}
+
+static ngx_int_t redisChannelKeepaliveCallback_retry_wrapper(redis_nodeset_t *ns, void *pd) {
+  rdstore_channel_head_t   *head = pd;
+  head->reserved--;
+  return redisChannelKeepaliveCallback_send(ns, pd);
 }
 
 static void redisChannelKeepaliveCallback(redisAsyncContext *c, void *vr, void *privdata) {
   rdstore_channel_head_t   *head = (rdstore_channel_head_t *)privdata;
   redisReply               *reply = (redisReply *)vr;
-  rdstore_data_t           *rdata = c->data;
+  redis_node_t             *node = c->data;
   
   head->reserved--;
-  rdata->pending_commands--;
+  node->pending_commands--;
   nchan_update_stub_status(redis_pending_commands, -1);
   
-  if(!clusterKeySlotOk(c, vr)) {
-    cluster_add_retry_command_with_chanhead(head, redisChannelKeepaliveCallback_send, head);
+  if(!nodeset_node_reply_keyslot_ok(node, reply)) {
+    head->reserved++;
+    nodeset_callback_on_ready(node->nodeset, 1000, redisChannelKeepaliveCallback_retry_wrapper, head);
     return;
   }
+  else {
+    head->keepalive_times_sent++;
+  }
   
   if(redisReplyOk(c, vr)) {
     assert(CHECK_REPLY_INT(reply));
@@ -1514,29 +1279,31 @@ static void redisChannelKeepaliveCallback(redisAsyncContext *c, void *vr, void *
 
 static void redis_channel_keepalive_timer_handler(ngx_event_t *ev) {
   rdstore_channel_head_t   *head = ev->data;
-  rdstore_data_t           *rdata;
   if(ev->timedout) {
     ev->timedout=0;
-    if((rdata = redis_cluster_rdata_from_channel(head)) != NULL) {
-      redisChannelKeepaliveCallback_send(rdata, head);
+    if(head->pubsub_status != REDIS_PUBSUB_SUBSCRIBED || head->status == NOTREADY) {
+      //no use trying to keepalive a not-ready (possibly disconnected) chanhead
+      DBG("Tried sending channel keepalive when channel is not ready");
+      ngx_add_timer(ev, REDIS_RECONNECT_TIME); //retry after reconnect timeout
+    }
+    else {
+      redisChannelKeepaliveCallback_send(head->redis.nodeset, head);
     }
   }
 }
 
-void redis_associate_chanhead_with_rdata(rdstore_channel_head_t *head, rdstore_data_t *rdata) {
-  head->rd_prev = NULL;
-  head->rd_next = rdata->channels_head;
-  if(rdata->channels_head) {
-    rdata->channels_head->rd_prev = head;
-  }
-  rdata->channels_head = head;
-}
-
-ngx_int_t ensure_chanhead_pubsub_subscribed(rdstore_channel_head_t *ch) {
-  rdstore_data_t     *rdata;
-  if(ch->pubsub_status != SUBBED && (rdata = redis_cluster_rdata_from_channel(ch)) != NULL) {
-    ch->pubsub_status = SUBBING;
-    redis_subscriber_command(rdata, redis_subscriber_callback, ch, "SUBSCRIBE {channel:%b}:pubsub", STR(&ch->id));
+ngx_int_t ensure_chanhead_pubsub_subscribed_if_needed(rdstore_channel_head_t *ch) {
+  redis_node_t       *pubsub_node;
+  ngx_str_t          *namespace;
+  if( ch->pubsub_status != REDIS_PUBSUB_SUBSCRIBED && ch->pubsub_status != REDIS_PUBSUB_SUBSCRIBING
+   && ch->redis.nodeset->settings.storage_mode >= REDIS_MODE_DISTRIBUTED
+   && nodeset_ready(ch->redis.nodeset)
+  ) {
+    pubsub_node = nodeset_node_pubsub_find_by_chanhead(ch);
+    namespace = ch->redis.nodeset->settings.namespace;
+    DBG("SUBSCRIBING to %V{channel:%V}:pubsub", namespace, &ch->id);
+    ch->pubsub_status = REDIS_PUBSUB_SUBSCRIBING;
+    redis_subscriber_command(pubsub_node, redis_subscriber_callback, NULL, "SUBSCRIBE %b{channel:%b}:pubsub", STR(namespace), STR(&ch->id));
   }
   return NGX_OK;
 }
@@ -1545,7 +1312,7 @@ ngx_int_t redis_chanhead_catch_up_after_reconnect(rdstore_channel_head_t *ch) {
   return spooler_catch_up(&ch->spooler);
 }
 
-static rdstore_channel_head_t *create_chanhead(ngx_str_t *channel_id, rdstore_data_t *rdata) {
+static rdstore_channel_head_t *create_chanhead(ngx_str_t *channel_id, redis_nodeset_t *ns) {
   rdstore_channel_head_t   *head;
   
   head=ngx_calloc(sizeof(*head) + sizeof(u_char)*(channel_id->len), ngx_cycle->log);
@@ -1560,7 +1327,7 @@ static rdstore_channel_head_t *create_chanhead(ngx_str_t *channel_id, rdstore_da
   head->fetching_message_count=0;
   head->redis_subscriber_privdata = NULL;
   head->status = NOTREADY;
-  head->pubsub_status = UNSUBBED;
+  head->pubsub_status = REDIS_PUBSUB_UNSUBSCRIBED;
   head->generation = 0;
   head->last_msgid.time=0;
   head->last_msgid.tag.fixed[0]=0;
@@ -1568,8 +1335,12 @@ static rdstore_channel_head_t *create_chanhead(ngx_str_t *channel_id, rdstore_da
   head->last_msgid.tagactive = 0;
   head->shutting_down = 0;
   head->reserved = 0;
+  head->keepalive_times_sent = 0;
   
-  head->in_gc_reaper = NULL;
+  head->gc.in_reaper = 0;
+  head->gc.time = 0;
+  head->gc.prev = NULL;
+  head->gc.next = NULL;
   
   if(head->id.len >= 5 && ngx_strncmp(head->id.data, "meta/", 5) == 0) {
     head->meta = 1;
@@ -1585,15 +1356,14 @@ static rdstore_channel_head_t *create_chanhead(ngx_str_t *channel_id, rdstore_da
     assert(ngx_strncmp(head->id.data, "m/", 2) != 0);
   }
   
-  head->rd_next = NULL;
-  head->rd_prev = NULL;
-  head->rdt = rdata;
-  if(rdata->node.cluster) {
-    head->cluster.enabled = 1;
-    redis_cluster_associate_chanhead_with_rdata(head);
-  }
-  else {
-    redis_associate_chanhead_with_rdata(head, rdata);
+  head->redis.nodeset = ns;
+  head->redis.generation = 0;
+  head->redis.node.cmd = NULL;
+  head->redis.node.pubsub = NULL;
+  ngx_memzero(&head->redis.slist, sizeof(head->redis.slist));
+  
+  if(head->redis.nodeset->settings.storage_mode == REDIS_MODE_BACKUP) {
+    head->status = READY;
   }
   
   head->spooler.running=0;
@@ -1602,19 +1372,18 @@ static rdstore_channel_head_t *create_chanhead(ngx_str_t *channel_id, rdstore_da
     head->spooler.publish_events = 0;
   }
   
-  DBG("SUBSCRIBING to {channel:%V}:pubsub", channel_id);
-  ensure_chanhead_pubsub_subscribed(head);
+  ensure_chanhead_pubsub_subscribed_if_needed(head);
   CHANNEL_HASH_ADD(head);
   
   return head;
 }
 
-static rdstore_channel_head_t * nchan_store_get_chanhead(ngx_str_t *channel_id, rdstore_data_t *rdata) {
+static rdstore_channel_head_t * nchan_store_get_chanhead(ngx_str_t *channel_id, redis_nodeset_t *nodeset) {
   rdstore_channel_head_t    *head;
   
-  CHANNEL_HASH_FIND(channel_id, head);
+  CHANNEL_HASH_FIND(channel_id, head); //BUG: this doesn't account for namespacing!!
   if(head==NULL) {
-    head = create_chanhead(channel_id, rdata);
+    head = create_chanhead(channel_id, nodeset);
   }
   if(head == NULL) {
     ERR("can't create chanhead for redis store");
@@ -1622,10 +1391,15 @@ static rdstore_channel_head_t * nchan_store_get_chanhead(ngx_str_t *channel_id,
   }
   
   if (head->status == INACTIVE) { //recycled chanhead
-    ensure_chanhead_pubsub_subscribed(head);
+    ensure_chanhead_pubsub_subscribed_if_needed(head);
     redis_chanhead_gc_withdraw(head);
     
-    head->status = head->pubsub_status == SUBBED ? READY : NOTREADY;
+    if(head->redis.nodeset->settings.storage_mode == REDIS_MODE_BACKUP) {
+      head->status = READY;
+    }
+    else {
+      head->status = head->pubsub_status == REDIS_PUBSUB_SUBSCRIBED ? READY : NOTREADY;
+    }
   }
 
   if(!head->spooler.running) {
@@ -1636,58 +1410,34 @@ static rdstore_channel_head_t * nchan_store_get_chanhead(ngx_str_t *channel_id,
   return head;
 }
 
-nchan_reaper_t *rdstore_get_chanhead_reaper(rdstore_channel_head_t *ch) {
-  if(ch->cluster.enabled) {
-    rdstore_data_t *rdata;
-    if((rdata = redis_cluster_rdata_from_channel(ch)) != NULL && rdata->status == CONNECTED) {
-      return &rdata->chanhead_reaper;
-    }
-    else {
-      return &ch->rdt->node.cluster->chanhead_reaper;
-    }
-  }
-  else {
-    return &ch->rdt->chanhead_reaper;
-  }
-}
-
-ngx_int_t redis_chanhead_gc_add_to_reaper(nchan_reaper_t *reaper, rdstore_channel_head_t *head, ngx_int_t expire, const char *reason) {
+ngx_int_t redis_chanhead_gc_add(rdstore_channel_head_t *head, ngx_int_t expire, const char *reason) {
   assert(head->sub_count == 0);
-    
-  if(head->in_gc_reaper && head->in_gc_reaper != reaper) {
-    redis_chanhead_gc_withdraw(head);
-  }
-    
-  if(!head->in_gc_reaper) {
+  nchan_reaper_t *reaper = &head->redis.nodeset->chanhead_reaper;
+  if(!head->gc.in_reaper) {
     assert(head->status != INACTIVE);
     head->status = INACTIVE;
-    head->gc_time = ngx_time() + (expire == 0 ? NCHAN_CHANHEAD_EXPIRE_SEC : expire);
-    head->in_gc_reaper = reaper;
+    head->gc.time = ngx_time() + (expire == 0 ? NCHAN_CHANHEAD_EXPIRE_SEC : expire);
+    head->gc.in_reaper = 1;
     
     nchan_reaper_add(reaper, head);
     
     DBG("gc_add chanhead %V to %s (%s)", &head->id, reaper->name, reason);
   }
   else {
-    assert(head->in_gc_reaper == reaper);
     ERR("gc_add chanhead %V to %s: already added (%s)", &head->id, reaper->name, reason);
   }
 
   return NGX_OK;
 }
 
-
-ngx_int_t redis_chanhead_gc_add(rdstore_channel_head_t *head, ngx_int_t expire, const char *reason) {
-  return redis_chanhead_gc_add_to_reaper(rdstore_get_chanhead_reaper(head), head, expire, reason);
-}
-
 ngx_int_t redis_chanhead_gc_withdraw(rdstore_channel_head_t *chanhead) {
-  if(chanhead->in_gc_reaper) {
-    DBG("gc_withdraw chanhead %s from %V", chanhead->in_gc_reaper->name, &chanhead->id);
+  if(chanhead->gc.in_reaper) {
+    nchan_reaper_t *reaper = &chanhead->redis.nodeset->chanhead_reaper;
+    DBG("gc_withdraw chanhead %s from %V", reaper->name, &chanhead->id);
     assert(chanhead->status == INACTIVE);
     
-    nchan_reaper_withdraw(chanhead->in_gc_reaper, chanhead);
-    chanhead->in_gc_reaper = NULL;
+    nchan_reaper_withdraw(reaper, chanhead);
+    chanhead->gc.in_reaper = 0;
   }
   else {
     DBG("gc_withdraw chanhead (%V), but not in gc reaper", &chanhead->id);
@@ -1695,12 +1445,14 @@ ngx_int_t redis_chanhead_gc_withdraw(rdstore_channel_head_t *chanhead) {
   return NGX_OK;
 }
 
-static ngx_int_t nchan_store_publish_generic(ngx_str_t *channel_id, rdstore_data_t *rdata, nchan_msg_t *msg, ngx_int_t status_code, const ngx_str_t *status_line){
+static ngx_int_t nchan_store_publish_generic(ngx_str_t *channel_id, redis_nodeset_t *nodeset, nchan_msg_t *msg, ngx_int_t status_code, const ngx_str_t *status_line){
   rdstore_channel_head_t   *head;
   ngx_int_t                 ret;
   //redis_channel_head_cleanup_t *hcln;
   
-  head = nchan_store_get_chanhead(channel_id, rdata);
+  
+  
+  head = nchan_store_get_chanhead(channel_id, nodeset);
   
   if(head->sub_count > 0) {
     if(msg) {
@@ -1723,39 +1475,39 @@ static ngx_int_t nchan_store_publish_generic(ngx_str_t *channel_id, rdstore_data
   return ret;
 }
 
+
 static ngx_int_t redis_array_to_channel(redisReply *r, nchan_channel_t *ch) {
-  if ( CHECK_REPLY_ARRAY_MIN_SIZE(r, 4)
+  ngx_str_t       msgid;
+  nchan_msg_id_t  zeroid = NCHAN_OLDEST_MSGID;
+  
+  if ( CHECK_REPLY_ARRAY_MIN_SIZE(r, 5)
     && CHECK_REPLY_INT(r->element[0])
     && CHECK_REPLY_INT(r->element[1])
-    && CHECK_REPLY_INT(r->element[2]) ) {
+    && CHECK_REPLY_INT(r->element[2])
+    && CHECK_REPLY_STR(r->element[3])
+    && CHECK_REPLY_INT(r->element[4])) {
     
     //channel info
     ch->expires = ngx_time() + r->element[0]->integer;
     ch->last_seen = r->element[1]->integer;
     ch->subscribers = r->element[2]->integer;
-    ch->messages = r->element[3]->integer;
+  
+    msgid.data = (u_char *)r->element[3]->str;
+    msgid.len = r->element[3]->len;
+      
+    if(msgid.len == 0) {
+      ch->last_published_msg_id = zeroid;
+    }
+    else if(nchan_parse_compound_msgid(&ch->last_published_msg_id, &msgid, 1) != NGX_OK) {
+      ERR("failed to parse last-msgid %V from redis", &msgid);
+    }
+  
+    ch->messages = r->element[4]->integer;
     
     //no id?..
     ch->id.len=0;
     ch->id.data=NULL;
     
-    //last message id
-    if( CHECK_REPLY_ARRAY_MIN_SIZE(r, 5)
-      && CHECK_REPLY_STR(r->element[4])) {
-      
-      ngx_str_t      msgid;
-      msgid.data = (u_char *)r->element[4]->str;
-      msgid.len = r->element[4]->len;
-      
-      if(msgid.len > 0 && nchan_parse_compound_msgid(&ch->last_published_msg_id, &msgid, 1) != NGX_OK) {
-        ERR("failed to parse last-msgid %V from redis", &msgid);
-      }
-      else {
-        nchan_msg_id_t  zeroid = NCHAN_OLDEST_MSGID;
-        ch->last_published_msg_id = zeroid;
-      }
-    }
-    
     //queued messages
     if( CHECK_REPLY_ARRAY_MIN_SIZE(r, 6)
       && CHECK_REPLY_INT(r->element[5])) {
@@ -1781,15 +1533,15 @@ typedef struct {
   void                *privdata;
 } redis_channel_callback_data_t;
 
-#define CREATE_CALLBACK_DATA(d, rdata, namestr, channel_id, callback, privdata) \
+#define CREATE_CALLBACK_DATA(d, nodeset, cf, namestr, channel_id, callback, privdata) \
   do {                                                                       \
-    if ((d = ngx_alloc(sizeof(*d) + ((rdata->node.cluster != NULL) ? (sizeof(*channel_id) + channel_id->len) : 0), ngx_cycle->log)) == NULL) { \
+    if ((d = ngx_alloc(sizeof(*d) + ((nodeset)->cluster.enabled ? (sizeof(*channel_id) + channel_id->len) : 0), ngx_cycle->log)) == NULL) { \
       ERR("Can't allocate redis %s channel callback data", namestr);         \
       return NGX_ERROR;                                                      \
     }                                                                        \
     d->t = ngx_current_msec;                                                 \
     d->name = namestr;                                                       \
-    if(rdata->node.cluster != NULL) {                                        \
+    if((nodeset)->cluster.enabled) {                                            \
       /* might need to use channel id later to retry the command */          \
       d->channel_id = (ngx_str_t *)&d[1];                                    \
       d->channel_id->data = (u_char *)&d->channel_id[1];                     \
@@ -1833,27 +1585,29 @@ static void redisChannelInfoCallback(redisAsyncContext *c, void *r, void *privda
 
 static void redisChannelDeleteCallback(redisAsyncContext *c, void *r, void *privdata);
 
-static void nchan_store_delete_channel_send(rdstore_data_t *rdata, void *pd) {
+static ngx_int_t nchan_store_delete_channel_send(redis_nodeset_t *ns, void *pd) {
   redis_channel_callback_data_t *d = pd;
-  if(rdata) {
-    redis_command(rdata, &redisChannelDeleteCallback, d, "EVALSHA %s 0 %b", redis_lua_scripts.delete.hash, STR(d->channel_id));
+  if(nodeset_ready(ns)) {
+    redis_node_t *node = nodeset_node_find_by_channel_id(ns, d->channel_id);
+    nchan_redis_script(delete, node, &redisChannelDeleteCallback, d, d->channel_id, "");
+    return NGX_OK;
   }
   else {
     redisChannelDeleteCallback(NULL, NULL, d);
+    return NGX_ERROR;
   }
 }
 
 static void redisChannelDeleteCallback(redisAsyncContext *ac, void *r, void *privdata) {
-  rdstore_data_t  *rdata;
+  redis_node_t  *node;
   
+  nchan_update_stub_status(redis_pending_commands, -1);
   if(ac) {
-    rdata = ac->data;
-    rdata->pending_commands--;
+    node = ac->data;
+    node->pending_commands--;
     
-    if(!clusterKeySlotOk(ac, r)) {
-      redis_channel_callback_data_t  *d = privdata;
-      
-      cluster_add_retry_command_with_channel_id(rdata->node.cluster, d->channel_id, nchan_store_delete_channel_send, privdata);
+    if(!nodeset_node_reply_keyslot_ok(node, (redisReply *)r)) {
+      nodeset_callback_on_ready(node->nodeset, 1000, nchan_store_delete_channel_send, privdata);
       return;
     }
   }
@@ -1863,45 +1617,39 @@ static void redisChannelDeleteCallback(redisAsyncContext *ac, void *r, void *pri
 
 static ngx_int_t nchan_store_delete_channel(ngx_str_t *channel_id, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
   redis_channel_callback_data_t *d;
-  rdstore_data_t                *rdata = cf->redis.privdata;
-  
-  CREATE_CALLBACK_DATA(d, rdata, "delete", channel_id, callback, privdata);
-  
-  if((rdata = redis_cluster_rdata_from_channel_id(rdata, channel_id)) == NULL) {
-    return NGX_ERROR;
-  }
-  
-  nchan_store_delete_channel_send(rdata, d);
-  
-  return NGX_OK;
+  redis_nodeset_t               *ns = nodeset_find(&cf->redis);
+  CREATE_CALLBACK_DATA(d, ns, cf, "delete", channel_id, callback, privdata);
+
+  return nchan_store_delete_channel_send(ns, d);
 }
 
 
 static void redisChannelFindCallback(redisAsyncContext *c, void *r, void *privdata);
 
-static void nchan_store_find_channel_send(rdstore_data_t *rdata, void *pd) {
+static ngx_int_t nchan_store_find_channel_send(redis_nodeset_t *ns, void *pd) {
   redis_channel_callback_data_t *d = pd;
-  if(rdata) {
-    redis_command(rdata, &redisChannelFindCallback, d, "EVALSHA %s 0 %b", redis_lua_scripts.find_channel.hash, STR(d->channel_id));
+  if(nodeset_ready(ns)) {
+    redis_node_t *node = nodeset_node_find_by_channel_id(ns, d->channel_id);
+    nchan_redis_script(find_channel, node, &redisChannelFindCallback, d, d->channel_id, "");
   }
   else {
     redisChannelFindCallback(NULL, NULL, d);
   }
+  return NGX_OK;
 }
 
 static void redisChannelFindCallback(redisAsyncContext *ac, void *r, void *privdata) {
-  rdstore_data_t                 *rdata = NULL;
+  redis_node_t                 *node = NULL;
   
   if(ac) {
-    rdata = ac->data;
-    rdata->pending_commands--;
+    node = ac->data;
+    node->pending_commands--;
     nchan_update_stub_status(redis_pending_commands, -1);
-  }
-  
-  if(ac && !clusterKeySlotOk(ac, r)) {
-    redis_channel_callback_data_t  *d = privdata;
-    cluster_add_retry_command_with_channel_id(rdata->node.cluster, d->channel_id, nchan_store_find_channel_send, privdata);
-    return;
+    
+    if(!nodeset_node_reply_keyslot_ok(node, (redisReply *)r)) {
+      nodeset_callback_on_ready(node->nodeset, 1000, nchan_store_find_channel_send, privdata);
+      return;
+    }
   }
   
   redisChannelInfoCallback(ac, r, privdata);
@@ -1910,29 +1658,22 @@ static void redisChannelFindCallback(redisAsyncContext *ac, void *r, void *privd
 
 static ngx_int_t nchan_store_find_channel(ngx_str_t *channel_id, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
   redis_channel_callback_data_t *d;
-  rdstore_data_t                *rdata = cf->redis.privdata;
-  CREATE_CALLBACK_DATA(d, rdata, "find_channel", channel_id, callback, privdata);
+  redis_nodeset_t               *ns = nodeset_find(&cf->redis);
+  CREATE_CALLBACK_DATA(d, ns, cf, "find_channel", channel_id, callback, privdata);
   
-  if((rdata = redis_cluster_rdata_from_channel_id(rdata, channel_id)) == NULL) {
-    return NGX_ERROR;
-  }
-  nchan_store_find_channel_send(rdata, d);
+  nchan_store_find_channel_send(ns, d);
   
   return NGX_OK;
 }
 
-typedef struct {
-  nchan_msg_t   msg;
-  ngx_buf_t     buf;
-} getmessage_blob_t;
-
-static ngx_int_t msg_from_redis_get_message_reply(nchan_msg_t *msg, ngx_buf_t *buf, redisReply *r, uint16_t offset) {
+static ngx_int_t msg_from_redis_get_message_reply(nchan_msg_t *msg, nchan_compressed_msg_t *cmsg, ngx_str_t *content_type, ngx_str_t *eventsource_event, redisReply *r, uint16_t offset) {
   
   redisReply         **els = r->element;
   size_t               content_type_len = 0, es_event_len = 0;
-  ngx_int_t            time_int, ttl;
+  ngx_int_t            time_int = 0, ttl;
+  ngx_int_t            compression;
   
-  if(CHECK_REPLY_ARRAY_MIN_SIZE(r, offset + 7)
+  if(CHECK_REPLY_ARRAY_MIN_SIZE(r, offset + 8)
    && CHECK_REPLY_INT(els[offset])            //msg TTL
    && CHECK_REPLY_INT_OR_STR(els[offset+1])   //id - time
    && CHECK_REPLY_INT_OR_STR(els[offset+2])   //id - tag
@@ -1940,43 +1681,62 @@ static ngx_int_t msg_from_redis_get_message_reply(nchan_msg_t *msg, ngx_buf_t *b
    && CHECK_REPLY_INT_OR_STR(els[offset+4])   //prev_id - tag
    && CHECK_REPLY_STR(els[offset+5])   //message
    && CHECK_REPLY_STR(els[offset+6])   //content-type
-   && CHECK_REPLY_STR(els[offset+7])){ //eventsource event
-     
+   && CHECK_REPLY_STR(els[offset+7])  //eventsource event
+  ) {
+  
     content_type_len=els[offset+6]->len;
     es_event_len = els[offset+7]->len;
     
     ngx_memzero(msg, sizeof(*msg));
-    ngx_memzero(buf, sizeof(*buf));
-    //set up message buffer;
-    msg->buf = buf;
     
-    buf->start = buf->pos = (u_char *)els[offset+5]->str;
-    buf->end = buf->last = buf->start + els[offset+5]->len;
-    buf->memory = 1;
-    buf->last_buf = 1;
-    buf->last_in_chain = 1;
+    msg->buf.start = msg->buf.pos = (u_char *)els[offset+5]->str;
+    msg->buf.end = msg->buf.last = msg->buf.start + els[offset+5]->len;
+    msg->buf.memory = 1;
+    msg->buf.last_buf = 1;
+    msg->buf.last_in_chain = 1;
     
-    if(redisReply_to_int(els[offset], &ttl) != NGX_OK) {
-      ERR("invalid ttl integer value is msg response from redis");
+    if(redisReply_to_ngx_int(els[offset], &ttl) != NGX_OK) {
+      ERR("invalid ttl integer value in msg response from redis");
       return NGX_ERROR;
     }
     assert(ttl >= 0);
     if(ttl == 0)
       ttl++; // less than a second left for this message... give it a second's lease on life
-
+    
     msg->expires = ngx_time() + ttl;
     
+    msg->compressed = NULL;
+    if(r->elements >= (uint16_t )(offset + 8)) {
+      if(!CHECK_REPLY_INT_OR_STR(els[offset+8]) || redisReply_to_ngx_int(els[offset+8], &compression) != NGX_OK) {
+        ERR("invalid compression type integer value in msg response from redis");
+        return NGX_ERROR;
+      }
+      if((nchan_msg_compression_type_t )compression != NCHAN_MSG_COMPRESSION_INVALID && (nchan_msg_compression_type_t )compression != NCHAN_MSG_NO_COMPRESSION) {
+        msg->compressed = cmsg;
+        ngx_memzero(&cmsg->buf, sizeof(cmsg->buf));
+        cmsg->compression = (nchan_msg_compression_type_t )compression;
+      }
+    }
+    
     if(content_type_len > 0) {
-      msg->content_type.len=content_type_len;
-      msg->content_type.data=(u_char *)els[offset+6]->str;
+      msg->content_type = content_type;
+      msg->content_type->len=content_type_len;
+      msg->content_type->data=(u_char *)els[offset+6]->str;
+    }
+    else {
+      msg->content_type = NULL;
     }
     
     if(es_event_len > 0) {
-      msg->eventsource_event.len=es_event_len;
-      msg->eventsource_event.data=(u_char *)els[offset+7]->str;
+      msg->eventsource_event = eventsource_event;
+      msg->eventsource_event->len=es_event_len;
+      msg->eventsource_event->data=(u_char *)els[offset+7]->str;
+    }
+    else {
+      msg->eventsource_event = NULL;
     }
     
-    if(redisReply_to_int(els[offset+1], &time_int) == NGX_OK) {
+    if(redisReply_to_ngx_int(els[offset+1], &time_int) == NGX_OK) {
       msg->id.time = time_int;
     }
     else {
@@ -1984,13 +1744,13 @@ static ngx_int_t msg_from_redis_get_message_reply(nchan_msg_t *msg, ngx_buf_t *b
       ERR("invalid msg time from redis");
     }
     
-    redisReply_to_int(els[offset+2], (ngx_int_t *)&msg->id.tag.fixed[0]); // tag is a uint, meh.
+    redisReply_to_ngx_int(els[offset+2], (ngx_int_t *)&msg->id.tag.fixed[0]); // tag is a uint, meh.
     msg->id.tagcount = 1;
     msg->id.tagactive = 0;
     
-    redisReply_to_int(els[offset+3], &time_int);
+    redisReply_to_ngx_int(els[offset+3], &time_int);
     msg->prev_id.time = time_int;
-    redisReply_to_int(els[offset+4], (ngx_int_t *)&msg->prev_id.tag.fixed[0]);
+    redisReply_to_ngx_int(els[offset+4], (ngx_int_t *)&msg->prev_id.tag.fixed[0]);
     msg->prev_id.tagcount = 1;
     msg->prev_id.tagactive = 0;
     
@@ -2013,74 +1773,88 @@ typedef struct {
 
 static void redis_get_message_callback(redisAsyncContext *c, void *r, void *privdata);
 
-static void nchan_store_async_get_message_send(rdstore_data_t *rdata, void *pd) {
+static ngx_int_t nchan_store_async_get_message_send(redis_nodeset_t *ns, void *pd) {
   redis_get_message_data_t           *d = pd;
-  //input:  keys: [], values: [channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl, subscriber_channel]
-  //subscriber channel is not given, because we don't care to subscribe
-  if(rdata) {
-    redis_command(rdata, &redis_get_message_callback, d, "EVALSHA %s 0 %b %i %i %s", redis_lua_scripts.get_message.hash, STR(d->channel_id), d->msg_id.time, d->msg_id.tag, "FILO", 0);
+  //input:  keys: [], values: [namespace, channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl]
+  //output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, channel_subscriber_count
+  if(nodeset_ready(ns)) {
+    redis_node_t *node = nodeset_node_find_by_channel_id(ns, d->channel_id);
+    nchan_redis_script(get_message, node, &redis_get_message_callback, d, d->channel_id, "%i %i FILO 0", 
+                       d->msg_id.time, 
+                       d->msg_id.tag
+                      );
   }
   else {
     //TODO: pass on a get_msg error status maybe?
     ngx_free(d);
   }
+  return NGX_OK;
 }
 
-static void redis_get_message_callback(redisAsyncContext *c, void *r, void *privdata) {
+static void redis_get_message_callback(redisAsyncContext *ac, void *r, void *privdata) {
   redisReply                *reply= r;
   redis_get_message_data_t  *d= (redis_get_message_data_t *)privdata;
   nchan_msg_t                msg;
-  ngx_buf_t                  msgbuf;
-  rdstore_data_t            *rdata = c->data;
-  
-  rdata->pending_commands--;
-  nchan_update_stub_status(redis_pending_commands, -1);
-  
-  if(!clusterKeySlotOk(c, r)) {
-    cluster_add_retry_command_with_channel_id(rdata->node.cluster, d->channel_id, nchan_store_async_get_message_send, d);
-    return;
-  }
-  
+  nchan_compressed_msg_t     cmsg;
+  ngx_str_t                  content_type;
+  ngx_str_t                  eventsource_event;
+  redis_node_t              *node;
+
   if(d == NULL) {
     ERR("redis_get_mesage_callback has NULL userdata");
     return;
   }
   
-  log_redis_reply(d->name, d->t);
+  if(ac) {
+    node = ac->data;
+    
+    node->pending_commands--;
+    nchan_update_stub_status(redis_pending_commands, -1);
+    
+    if(!nodeset_ready(node->nodeset) || !nodeset_node_reply_keyslot_ok(node, reply)) {
+      nodeset_callback_on_ready(node->nodeset, 1000, nchan_store_async_get_message_send, privdata);
+      return;
+    }
   
-  //output: result_code, msg_time, msg_tag, message, content_type,  channel-subscriber-count
-  // result_code can be: 200 - ok, 403 - channel not found, 404 - not found, 410 - gone, 418 - not yet available
+    log_redis_reply(d->name, d->t);
   
-  if (!redisReplyOk(c, r) || !CHECK_REPLY_ARRAY_MIN_SIZE(reply, 1) || !CHECK_REPLY_INT(reply->element[0]) ) {
-    //no good
-    ngx_free(d);
-    return;
-  }
+    //output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, compression_type, channel_subscriber_count
+    // result_code can be: 200 - ok, 403 - channel not found, 404 - not found, 410 - gone, 418 - not yet available
   
-  switch(reply->element[0]->integer) {
-    case 200: //ok
-      if(msg_from_redis_get_message_reply(&msg, &msgbuf, reply, 1) == NGX_OK) {
-        d->callback(MSG_FOUND, &msg, d->privdata);
-      }
-      break;
-    case 403: //channel not found
-    case 404: //not found
-      d->callback(MSG_NOTFOUND, NULL, d->privdata);
-      break;
-    case 410: //gone
-      d->callback(MSG_EXPIRED, NULL, d->privdata);
-      break;
-    case 418: //not yet available
-      d->callback(MSG_EXPECTED, NULL, d->privdata);
-      break;
+    if (!redisReplyOk(ac, r) || !CHECK_REPLY_ARRAY_MIN_SIZE(reply, 1) || !CHECK_REPLY_INT(reply->element[0]) ) {
+      //no good
+      ngx_free(d);
+      return;
+    }
+  
+    switch(reply->element[0]->integer) {
+      case 200: //ok
+        if(msg_from_redis_get_message_reply(&msg, &cmsg, &content_type, &eventsource_event, reply, 1) == NGX_OK) {
+          d->callback(MSG_FOUND, &msg, d->privdata);
+        }
+        break;
+      case 403: //channel not found
+      case 404: //not found
+        d->callback(MSG_NOTFOUND, NULL, d->privdata);
+        break;
+      case 410: //gone
+        d->callback(MSG_EXPIRED, NULL, d->privdata);
+        break;
+      case 418: //not yet available
+        d->callback(MSG_EXPECTED, NULL, d->privdata);
+        break;
+    }
+  }
+  else {
+    ERR("redisAsyncContext NULL for redis_get_message_callback");
   }
   
   ngx_free(d);
 }
 
 static ngx_int_t nchan_store_async_get_message(ngx_str_t *channel_id, nchan_msg_id_t *msg_id, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
-  redis_get_message_data_t           *d;
-  rdstore_data_t                     *rdata = cf->redis.privdata;
+  redis_get_message_data_t      *d;
+  redis_nodeset_t               *ns = nodeset_find(&cf->redis);
   if(callback==NULL) {
     ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "no callback given for async get_message. someone's using the API wrong!");
     return NGX_ERROR;
@@ -2088,41 +1862,36 @@ static ngx_int_t nchan_store_async_get_message(ngx_str_t *channel_id, nchan_msg_
   
   assert(msg_id->tagcount == 1);
   
-  CREATE_CALLBACK_DATA(d, rdata, "get_message", channel_id, callback, privdata);
+  CREATE_CALLBACK_DATA(d, ns, cf, "get_message", channel_id, callback, privdata);
   d->msg_id.time = msg_id->time;
   d->msg_id.tag = msg_id->tag.fixed[0];
   
-  if((rdata = redis_cluster_rdata_from_channel_id(rdata, channel_id)) == NULL) {
-    return NGX_ERROR;
-  }
-  nchan_store_async_get_message_send(rdata, d);
+  nchan_store_async_get_message_send(ns, d);
   return NGX_OK; //async only now!
 }
 
 
 typedef struct nchan_redis_conf_ll_s nchan_redis_conf_ll_t;
 struct nchan_redis_conf_ll_s {
-  nchan_redis_conf_t     *cf;
-  nchan_loc_conf_t       *loc_conf;
+  nchan_loc_conf_t       *lcf;
   nchan_redis_conf_ll_t  *next;
 };
 
 nchan_redis_conf_ll_t   *redis_conf_head;
 
-ngx_int_t nchan_store_redis_add_server_conf(ngx_conf_t *cf, nchan_redis_conf_t *rcf, nchan_loc_conf_t *loc_conf) {
+ngx_int_t nchan_store_redis_add_active_loc_conf(ngx_conf_t *cf, nchan_loc_conf_t *loc_conf) {
   nchan_redis_conf_ll_t  *rcf_ll = ngx_palloc(cf->pool, sizeof(*rcf_ll));
-  rcf_ll->cf = rcf;
-  rcf_ll->loc_conf = loc_conf;
+  rcf_ll->lcf = loc_conf;
   rcf_ll->next = redis_conf_head;
   redis_conf_head = rcf_ll;
   return NGX_OK;
 }
 
-ngx_int_t nchan_store_redis_remove_server_conf(ngx_conf_t *cf, nchan_redis_conf_t *rcf) {
+ngx_int_t nchan_store_redis_remove_active_loc_conf(ngx_conf_t *cf, nchan_loc_conf_t *loc_conf) {
   nchan_redis_conf_ll_t  *cur, *prev;
   
   for(cur = redis_conf_head, prev = NULL; cur != NULL; prev = cur, cur = cur->next) {
-    if(cur->cf == rcf) { //found it
+    if(cur->lcf == loc_conf) { //found it
       if(prev == NULL) {
         redis_conf_head = cur->next;
       }
@@ -2144,42 +1913,12 @@ static ngx_int_t nchan_store_init_module(ngx_cycle_t *cycle) {
 }
 
 
-//rbtree for all redis connections
-static void *redis_data_rbtree_node_id(void *data) {
-  return &((rdstore_data_t *)data)->connect_params;
-}
-static uint32_t redis_data_rbtree_bucketer(void *vid) {
-  redis_connect_params_t   *id = (redis_connect_params_t *)vid;
-  return (uint32_t )id->port;
-}
-static ngx_int_t redis_data_rbtree_compare(void *v1, void *v2) {
-  redis_connect_params_t   *id1 = (redis_connect_params_t *)v1;
-  redis_connect_params_t   *id2 = (redis_connect_params_t *)v2;
-  
-  if(id1->port > id2->port)
-    return 1;
-  else if (id1->port < id2->port)
-    return -1;
-  
-  if(id1->db > id2->db)
-    return 1;
-  else if (id1->db < id2->db)
-    return -1;
-  
-  if(id1->host.len > id2->host.len)
-    return 1;
-  else if(id1->host.len < id2->host.len)
-    return -1;
-  
-  return ngx_strncmp(id1->host.data, id2->host.data, id1->host.len);
-}
-
 ngx_int_t rdstore_initialize_chanhead_reaper(nchan_reaper_t *reaper, char *name) {
   
   nchan_reaper_start(reaper, 
               name, 
-              offsetof(rdstore_channel_head_t, gc_prev), 
-              offsetof(rdstore_channel_head_t, gc_next), 
+              offsetof(rdstore_channel_head_t, gc.prev), 
+              offsetof(rdstore_channel_head_t, gc.next), 
   (ngx_int_t (*)(void *, uint8_t)) nchan_redis_chanhead_ready_to_reap,
   (void (*)(void *)) redis_store_reap_chanhead,
               4
@@ -2188,183 +1927,48 @@ ngx_int_t rdstore_initialize_chanhead_reaper(nchan_reaper_t *reaper, char *name)
   return NGX_OK;
 }
 
-static void redis_stall_timer_handler(ngx_event_t *ev) {
-  /*rdstore_data_t  *rdata = ev->data;
-  
-  
-  if(!ev->timedout || ngx_exiting || ngx_quit || rdata->shutting_down)
-    return;
-  //ERR("redis_stall_timer_handler PRE  ctr: %d ctr_while_checking: %d, chk: %i", rdata->stall_counter, rdata->stall_counter_while_checking, rdata->stall_count_check);
-  ev->timedout = 0;
-  if(rdata->status != CONNECTED) {
-   return;
-  }
-  if( 0 ) { //stalled
-    if(rdata->stall_counter > 0) {
-      //yep, it stalled
-      if(rdata->ctx) {
-        redisAsyncFree(rdata->ctx);
-        rdata->ctx = NULL;
-      }
-      if(rdata->sub_ctx) {
-        redisAsyncFree(rdata->sub_ctx);
-        rdata->sub_ctx = NULL;
-      }
-      if(rdata->sync_ctx) {
-        redisFree(rdata->sync_ctx);
-        rdata->sync_ctx = NULL;
-      }
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "Detected stalled connection to Redis server %V.", rdata->connect_url);
-      rdt_set_status(rdata, DISCONNECTED, NULL);
-      //ERR("redis_stall_timer_handler DSCN ctr: %d ctr_while_checking: %d, chk: %i", rdata->stall_counter, rdata->stall_counter_while_checking, rdata->stall_count_check);
-      return;
-    }
-    else {
-      //ERR("all good");
-    }
-  }
-  else if(rdata->stall_counter != 0) {
-    //ERR("will check");
-    rdata->stall_count_check = 1;
-  }
-  //ERR("redis_stall_timer_handler POST ctr: %d ctr_while_checking: %d, chk: %i", rdata->stall_counter, rdata->stall_counter_while_checking, rdata->stall_count_check);
-  if(REDIS_STALL_CHECK_TIME > 0) {
-    ngx_add_timer(ev, REDIS_STALL_CHECK_TIME);
-  }
-  */
-}
-
-rdstore_data_t *redis_create_rdata(ngx_str_t *url, redis_connect_params_t *rcp, nchan_redis_conf_t *rcf, nchan_loc_conf_t *lcf) {
-  ngx_rbtree_node_t     *node;
-  rdstore_data_t        *rdata;
-  size_t                 reaper_name_len;
-  char                  *reaper_name;
-  
-  reaper_name_len = strlen("redis chanhead ()  ") + url->len;
-  
-  if((node = rbtree_create_node(&redis_data_tree, sizeof(*rdata) + reaper_name_len)) == NULL) {
-    ERR("can't create rbtree node for redis connection");
-    return NULL;
-  }
-  
-  rdata = (rdstore_data_t *)rbtree_data_from_node(node);
-  ngx_memzero(rdata, sizeof(*rdata));
-  rdata->connect_params = *rcp;
-  rdata->status = DISCONNECTED;
-  rdata->generation = 0;
-  rdata->shutting_down = 0;
-  rdata->lcf = lcf;
-  nchan_init_timer(&rdata->reconnect_timer, redis_reconnect_timer_handler, rdata);
-  nchan_init_timer(&rdata->ping_timer, redis_ping_timer_handler, rdata);
-
-  rdata->pending_commands = 0;  
-  nchan_init_timer(&rdata->stall_timer, redis_stall_timer_handler, rdata);
-  
-  rdata->channels_head = NULL;
-  rdata->almost_deleted_channels_head = NULL;
-  
-  reaper_name = (char *)&rdata[1];
-  ngx_sprintf((u_char *)reaper_name, "redis chanhead (%V)%Z", url);
-  rdstore_initialize_chanhead_reaper(&rdata->chanhead_reaper, reaper_name);
-  
-  rdata->ping_interval = rcf->ping_interval;
-  rdata->connect_url = url;
-  
-  if(rbtree_insert_node(&redis_data_tree, node) != NGX_OK) {
-    ERR("couldn't insert redis date node");
-    rbtree_destroy_node(&redis_data_tree, node);
-    return NULL;
-  }
-  
-  return rdata;
-}
-
-rdstore_data_t *find_rdata_by_url(ngx_str_t *url) {
-  redis_connect_params_t rcp;
-  parse_redis_url(url, &rcp);
-  return find_rdata_by_connect_params(&rcp);
-}
-
-rdstore_data_t *find_rdata_by_connect_params(redis_connect_params_t *rcp) {
-  rdstore_data_t        *rdata;
-  ngx_rbtree_node_t     *node;
-  if((node = rbtree_find_node(&redis_data_tree, rcp)) == NULL) {
-    return NULL;
-  }
-  rdata = (rdstore_data_t *)rbtree_data_from_node(node);
-  return rdata;
-}
-
-ngx_int_t redis_add_connection_data(nchan_redis_conf_t *rcf, nchan_loc_conf_t *lcf, ngx_str_t *override_url) {
-  rdstore_data_t          *rdata;
-  redis_connect_params_t   rcp;
-  static ngx_str_t         default_redis_url = ngx_string(NCHAN_REDIS_DEFAULT_URL);
-  ngx_str_t               *url;
+static ngx_int_t nchan_store_init_redis_loc_conf_postconfig(nchan_loc_conf_t *lcf) {
+  nchan_redis_conf_t    *rcf = &lcf->redis;
   
-  if(rcf->url.len == 0) {
-    rcf->url = default_redis_url;
-  }
-  url = override_url ? override_url : &rcf->url;
+  assert(rcf->enabled);
   
-  if(url->len == 0) {
-    url = &default_redis_url;
+  //server-scope loc_conf may have some undefined values (because it was never merged with a prev)
+  //thus we must reduntantly check for unser values
+  if(rcf->ping_interval == NGX_CONF_UNSET) {
+    rcf->ping_interval = NCHAN_REDIS_DEFAULT_PING_INTERVAL_TIME;
   }
-  
-  parse_redis_url(url, &rcp);
-  
-  if((rdata = find_rdata_by_connect_params(&rcp)) == NULL) {
-    rdata = redis_create_rdata(url, &rcp, rcf, lcf);
+  if(rcf->storage_mode == REDIS_MODE_CONF_UNSET) {
+    rcf->storage_mode = REDIS_MODE_DISTRIBUTED;
   }
-  else {
-    if(rcf->ping_interval > 0 && rcf->ping_interval < rdata->ping_interval) {
-      //shorter ping interval wins
-      rdata->ping_interval = rcf->ping_interval;
-    }
+  if(rcf->nostore_fastpublish == NGX_CONF_UNSET) {
+    rcf->nostore_fastpublish = 0;
   }
   
-  rcf->privdata = rdata;
-  
   return NGX_OK;
 }
 
 static ngx_int_t nchan_store_init_postconfig(ngx_conf_t *cf) {
-  nchan_redis_conf_t    *rcf;
+  nchan_loc_conf_t      *lcf;
   nchan_redis_conf_ll_t *cur;
   nchan_main_conf_t     *mcf = ngx_http_conf_get_module_main_conf(cf, ngx_nchan_module);
+  redis_nodeset_t       *nodeset;
   
   if(mcf->redis_publish_message_msgkey_size == NGX_CONF_UNSET_SIZE) {
     mcf->redis_publish_message_msgkey_size = NCHAN_REDIS_DEFAULT_PUBSUB_MESSAGE_MSGKEY_SIZE;
   }
   redis_publish_message_msgkey_size = mcf->redis_publish_message_msgkey_size;
   
-  rbtree_init(&redis_data_tree, "redis connection data", redis_data_rbtree_node_id, redis_data_rbtree_bucketer, redis_data_rbtree_compare);
-  
-  redis_cluster_init_postconfig(cf);
-  
   for(cur = redis_conf_head; cur != NULL; cur = cur->next) {
-    rcf = cur->cf;
-    if(!rcf->enabled) {
-      ERR("there's a non-enabled redis_conf_t here");
-      continue;
-    }
+    lcf = cur->lcf;
+    nchan_store_init_redis_loc_conf_postconfig(lcf);
     
-    if(rcf->upstream) {
-      ngx_uint_t                   i;
-      ngx_array_t                 *servers = rcf->upstream->servers;
-      ngx_http_upstream_server_t  *usrv = servers->elts;
-      ngx_str_t                   *upstream_url;
-      
-      for(i=0; i < servers->nelts; i++) {
-#if nginx_version >= 1007002
-        upstream_url = &usrv[i].name;
-#else
-        upstream_url = &usrv[i].addrs->name;
-#endif
-        redis_add_connection_data(rcf, cur->loc_conf, upstream_url);
-      }
+    if((nodeset = nodeset_find(&lcf->redis)) == NULL) {
+      nodeset = nodeset_create(lcf);
+      rdstore_initialize_chanhead_reaper(&nodeset->chanhead_reaper, "Redis channel reaper");
     }
-    else {
-      redis_add_connection_data(rcf, cur->loc_conf, NULL);
+    if(!nodeset) {
+      ERR("Unable to create Redis nodeset.");
+      continue;
     }
   }
   
@@ -2376,6 +1980,7 @@ static void nchan_store_create_main_conf(ngx_conf_t *cf, nchan_main_conf_t *mcf)
   
   //reset redis_conf_head for reloads
   redis_conf_head = NULL;
+  nodeset_destroy_all(); //reset all nodesets before loading config
 }
 
 void redis_store_prepare_to_exit_worker() {
@@ -2385,86 +1990,51 @@ void redis_store_prepare_to_exit_worker() {
   }
 }
 
-static ngx_int_t redis_data_tree_exiter_stage1(rbtree_seed_t *seed, rdstore_data_t *rdata, void *pd) {
-  rdata->shutting_down = 1;
-  
-  callback_chain_t     *ccur, *cnext;  
-  for(ccur = rdata->on_connected; ccur != NULL; ccur = cnext) {
-    cnext = ccur->next;
-    ngx_free(ccur);
-  }
-  rdata->on_connected = NULL;
-
-  return NGX_OK;
+void nodeset_exiter_stage1(redis_nodeset_t *ns, void *pd) {
+  nodeset_abort_on_ready_callbacks(ns);
 }
-
-static ngx_int_t redis_data_tree_exiter_stage2(rbtree_seed_t *seed, rdstore_data_t *rdata, unsigned *chanheads) {
-  
-  *chanheads += rdata->chanhead_reaper.count;
-  
-  nchan_reaper_stop(&rdata->chanhead_reaper);
-  
-  if(rdata->ctx)
-    redis_nginx_force_close_context(&rdata->ctx);
-  if(rdata->sub_ctx)
-    redis_nginx_force_close_context(&rdata->sub_ctx);
-  if(rdata->sync_ctx) {
-    redisFree(rdata->sync_ctx);
-    rdata->sync_ctx = NULL;
-  }
-
-  return NGX_OK;
+void nodeset_exiter_stage2(redis_nodeset_t *ns, void *pd) {
+  unsigned *chanheads = pd;
+  *chanheads += ns->chanhead_reaper.count;
+  nchan_reaper_stop(&ns->chanhead_reaper);
 }
 
-static ngx_int_t redis_data_tree_exiter_stage3(rbtree_seed_t *seed, rdstore_data_t *rdata, unsigned *chanheads) {
-  
-  DBG("exiting3 rdata %p %V", rdata, rdata->connect_url);
-  
-  if(rdata->ctx)
-    redis_nginx_force_close_context(&rdata->ctx);
-  if(rdata->sub_ctx)
-    redis_nginx_force_close_context(&rdata->sub_ctx);
-  if(rdata->sync_ctx) {
-    redisFree(rdata->sync_ctx);
-    rdata->sync_ctx = NULL;
-  }
-  if(rdata->ping_timer.timer_set) {
-    ngx_del_timer(&rdata->ping_timer);
-  }
-  if(rdata->stall_timer.timer_set) {
-    ngx_del_timer(&rdata->stall_timer);
-  }
-  if(rdata->reconnect_timer.timer_set) {
-    ngx_del_timer(&rdata->reconnect_timer);
-  }
-
-  return NGX_OK;
+void nodeset_exiter_stage3(redis_nodeset_t *ns, void *pd) {
+  nodeset_disconnect(ns);
 }
 
 static void nchan_store_exit_worker(ngx_cycle_t *cycle) {
   rdstore_channel_head_t     *cur, *tmp;
   unsigned                    chanheads = 0;
   DBG("redis exit worker");
-  rbtree_walk(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_exiter_stage1, NULL);
+  
+  //old
+  //rbtree_walk(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_exiter_stage1, NULL);
+  
+  nodeset_each(nodeset_exiter_stage1, NULL);
   
   HASH_ITER(hh, chanhead_hash, cur, tmp) {
     cur->shutting_down = 1;
-    if(!cur->in_gc_reaper) {
+    if(!cur->gc.in_reaper) {
       cur->spooler.fn->broadcast_status(&cur->spooler, NGX_HTTP_GONE, &NCHAN_HTTP_STATUS_410);
       redis_chanhead_gc_add(cur, 0, "exit worker");
     }
   }
   
-  rbtree_walk(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_exiter_stage2, &chanheads);
+  nodeset_each(nodeset_exiter_stage2, &chanheads);
   
-  rbtree_empty(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_exiter_stage3, NULL);
-  nchan_exit_notice_about_remaining_things("redis channel", "", chanheads);
+  //OLD
+  //rbtree_walk(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_exiter_stage2, &chanheads);
+  nodeset_destroy_all();
+  
+  //OLD
+  //rbtree_empty(&redis_data_tree, (rbtree_walk_callback_pt )redis_data_tree_exiter_stage3, NULL);
   
-  redis_cluster_exit_worker(cycle);
+  nchan_exit_notice_about_remaining_things("redis channel", "", chanheads);
 }
 
 static void nchan_store_exit_master(ngx_cycle_t *cycle) {
-  rbtree_empty(&redis_data_tree, NULL, NULL);
+  nodeset_destroy_all();
 }
 
 typedef struct {
@@ -2480,7 +2050,7 @@ static ngx_int_t subscribe_existing_channel_callback(ngx_int_t status, void *ch,
   redis_subscribe_data_t       *data = (redis_subscribe_data_t *)d;
   
   if(channel == NULL) {
-    data->sub->fn->respond_status(data->sub, NGX_HTTP_FORBIDDEN, NULL);
+    data->sub->fn->respond_status(data->sub, NGX_HTTP_FORBIDDEN, NULL, NULL);
     data->sub->fn->release(data->sub, 0);
   }
   else {
@@ -2525,46 +2095,17 @@ static ngx_int_t nchan_store_subscribe_continued(redis_subscribe_data_t *d) {
   //nchan_loc_conf_t           *cf = d->sub->cf;
   rdstore_channel_head_t       *ch;
   //ngx_int_t                   create_channel_ttl = cf->subscribe_only_existing_channel==1 ? 0 : cf->channel_timeout;
-  rdstore_data_t               *rdata = d->sub->cf->redis.privdata;
+  assert(d->sub->cf->redis.enabled);
+  redis_nodeset_t              *nodeset = nodeset_find(&d->sub->cf->redis);
+  ngx_int_t                     rc;
   
-  ch = nchan_store_get_chanhead(d->channel_id, rdata);
+  ch = nchan_store_get_chanhead(d->channel_id, nodeset);
   
   assert(ch != NULL);
   
-  ch->spooler.fn->add(&ch->spooler, d->sub);
+  rc = ch->spooler.fn->add(&ch->spooler, d->sub);
   //redisAsyncCommand(rds_ctx(), &redis_getmessage_callback, (void *)d, "EVALSHA %s 0 %b %i %i %s %i", redis_lua_scripts.get_message.hash, STR(d->channel_id), d->msg_id->time, d->msg_id->tag[0], "FILO", create_channel_ttl);
-  return NGX_OK;
-}
-
-static ngx_str_t * nchan_store_etag_from_message(nchan_msg_t *msg, ngx_pool_t *pool){
-  ngx_str_t       *etag = NULL;
-  if(pool!=NULL && (etag = ngx_palloc(pool, sizeof(*etag) + NGX_INT_T_LEN))==NULL) {
-    nchan_log_error("unable to allocate memory for Etag header in pool");
-    return NULL;
-  }
-  else if(pool==NULL && (etag = ngx_alloc(sizeof(*etag) + NGX_INT_T_LEN, ngx_cycle->log))==NULL) {
-    nchan_log_error("unable to allocate memory for Etag header");
-    return NULL;
-  }
-  etag->data = (u_char *)(etag+1);
-  etag->len = ngx_sprintf(etag->data,"%i", msg->id.tag.fixed[0])- etag->data;
-  return etag;
-}
-
-static ngx_str_t * nchan_store_content_type_from_message(nchan_msg_t *msg, ngx_pool_t *pool){
-  ngx_str_t        *content_type = NULL;
-  if(pool != NULL && (content_type = ngx_palloc(pool, sizeof(*content_type) + msg->content_type.len))==NULL) {
-    nchan_log_error("unable to allocate memory for Content Type header in pool");
-    return NULL;
-  }
-  else if(pool == NULL && (content_type = ngx_alloc(sizeof(*content_type) + msg->content_type.len, ngx_cycle->log))==NULL) {
-    nchan_log_error("unable to allocate memory for Content Type header");
-    return NULL;
-  }
-  content_type->data = (u_char *)(content_type+1);
-  content_type->len = msg->content_type.len;
-  ngx_memcpy(content_type->data, msg->content_type.data, content_type->len);
-  return content_type;
+  return rc;
 }
 
 typedef struct {
@@ -2576,95 +2117,252 @@ typedef struct {
   unsigned              shared_msg:1;
   time_t                message_timeout;
   ngx_int_t             max_messages;
+  nchan_msg_compression_type_t compression;
   ngx_int_t             msglen;
   callback_pt           callback;
   void                 *privdata;
+  uint8_t               retry;
 } redis_publish_callback_data_t;
 
 static void redisPublishCallback(redisAsyncContext *, void *, void *);
+static void redisPublishNostoreCallback(redisAsyncContext *, void *, void *);
+static ngx_int_t redis_publish_message_send(redis_nodeset_t *nodeset, void *pd);
+
+static ngx_int_t redis_publish_message_nodeset_maybe_retry(redis_nodeset_t *ns, redis_publish_callback_data_t *d) {
+  //retry maybe
+  if(d->retry < REDIS_NODESET_NOT_READY_MAX_RETRIES) {
+    d->retry++;
+    nodeset_callback_on_ready(ns, 1000, redis_publish_message_send, d);
+  }
+  else {
+    d->callback(NGX_HTTP_SERVICE_UNAVAILABLE, NULL, d->privdata);
+    ngx_free(d);
+  }
+  return NGX_DECLINED;
+}
 
-static void redis_publish_message_send(rdstore_data_t *rdata, void *pd) {
+static ngx_int_t redis_publish_message_send(redis_nodeset_t *nodeset, void *pd) {
   redis_publish_callback_data_t  *d = pd;
   ngx_int_t                       mmapped = 0;
   ngx_buf_t                      *buf;
-  u_char                         *msgstart;
-  size_t                          msglen;
+  ngx_str_t                       msgstr;
   nchan_msg_t                    *msg = d->msg;
+  const ngx_str_t                 empty=ngx_string("");
+  
+  if(!nodeset_ready(nodeset)) {
+    return redis_publish_message_nodeset_maybe_retry(nodeset, d);
+  }
+  
+  redis_node_t *node = nodeset_node_find_by_channel_id(nodeset, d->channel_id);
   
-  buf = msg->buf;
+  buf = &msg->buf;
   if(ngx_buf_in_memory(buf)) {
-    msgstart = buf->pos;
-    msglen = buf->last - msgstart;
+    msgstr.data = buf->pos;
+    msgstr.len = buf->last - msgstr.data;
   }
   else { //in a file
     ngx_fd_t fd = buf->file->fd == NGX_INVALID_FILE ? nchan_fdcache_get(&buf->file->name) : buf->file->fd;
     
-    msglen = buf->file_last - buf->file_pos;
-    msgstart = mmap(NULL, msglen, PROT_READ, MAP_SHARED, fd, 0);
-    if (msgstart != MAP_FAILED) {
+    msgstr.len = buf->file_last - buf->file_pos;
+    msgstr.data = mmap(NULL, msgstr.len, PROT_READ, MAP_SHARED, fd, 0);
+    if (msgstr.data != MAP_FAILED) {
       mmapped = 1;
     }
     else {
-      msgstart = NULL;
-      msglen = 0;
+      msgstr.data = NULL;
+      msgstr.len = 0;
       ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, ngx_errno, "Redis store: Couldn't mmap file %V", &buf->file->name);
     }
   }
-  d->msglen = msglen;
-  
-  
-  //input:  keys: [], values: [channel_id, time, message, content_type, eventsource_event, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff]
-  //output: message_tag, channel_hash {ttl, time_last_seen, subscribers, messages}
-  redis_command(rdata, &redisPublishCallback, d, "EVALSHA %s 0 %b %i %b %b %b %i %i %i", redis_lua_scripts.publish.hash, STR(d->channel_id), msg->id.time, msgstart, msglen, STR(&(msg->content_type)), STR(&(msg->eventsource_event)), d->message_timeout, d->max_messages, redis_publish_message_msgkey_size);
-  if(mmapped && munmap(msgstart, msglen) == -1) {
-    ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "munmap was a problem");
+  d->msglen = msgstr.len;
+  
+  if(nodeset->settings.storage_mode == REDIS_MODE_DISTRIBUTED_NOSTORE) {
+    //hand-roll the msgpacked message
+    /*
+    9A A3"msg" CE<ttl> CE<time> 00 00 00 DB<len><str> D9<len><str> D9<len><str> 0X
+    |  |       |       |        |  |  |  |            |            |            |
+    |  |       |       |        |  |  |  |            |            |    fixint0/1 compression
+    |  |       |       |        |  |  |  |            |    bin8 <uint8 len> eventsource-event
+    |  |       |       |        |  |  |  |     bin8 <uint8 len> content type
+    |  |       |       |        |  |  |  bin32 <uint32 BE len> msg data
+    |  |       |       |      fixint=0 tag=0, prev_time=0, prev_tag=0
+    |  |       |    uint32 (BE) message time
+    |  |     uint32 (BE) message ttl
+    |  fixstr[3]
+    fixarray[10]
+    */
+    
+    uint32_t ttl, time;
+    uint32_t msglen;
+    uint8_t  content_type_len, eventsource_event_len, compression;
+    char     zero='\0';
+    int      fastpublish = nodeset->settings.nostore_fastpublish;
+    void   (*publish_callback)(redisAsyncContext *, void *, void *) = NULL;
+    void    *publish_pd = NULL;
+    
+    
+    ttl = htonl(d->message_timeout);
+    time = htonl(msg->id.time);
+    msglen = htonl(d->msglen);
+    content_type_len = msg->content_type ? (msg->content_type->len > 255 ? 255 : msg->content_type->len) : 0;
+    eventsource_event_len = msg->eventsource_event ? (msg->eventsource_event->len > 255 ? 255 : msg->eventsource_event->len) : 0;
+    compression = d->compression;
+    
+    if(!fastpublish) {
+      redis_command(node, NULL, NULL, "MULTI");
+    }
+    else {
+      publish_callback = redisPublishNostoreCallback;
+      publish_pd = d;
+    }
+    redis_command(node, publish_callback, publish_pd,
+      "PUBLISH %b{channel:%b}:pubsub "
+      "\x9A\xA3msg\xCE%b\xCE%b%b%b%b\xDB%b%b\xD9%b%b\xD9%b%b%b",
+      
+      STR(nodeset->settings.namespace),
+      STR(d->channel_id),
+      
+      (char *)&ttl, (size_t )4,
+      (char *)&time, (size_t )4,
+      (char *)&zero, (size_t )1,
+      (char *)&zero, (size_t )1,
+      (char *)&zero, (size_t )1,
+      (char *)&msglen, (size_t )4,
+      STR(&msgstr),
+      (char *)&content_type_len, (size_t )1,
+      STR((msg->content_type ? msg->content_type : &empty)),
+      (char *)&eventsource_event_len, (size_t )1,
+      STR((msg->eventsource_event ? msg->eventsource_event : &empty)),
+      (char *)&compression, (size_t )1
+    );
+    if(!fastpublish) {
+      redis_command(node, NULL, NULL, "HMGET %b{channel:%b} last_seen_fake_subscriber fake_subscribers", 
+        STR(nodeset->settings.namespace),
+        STR(d->channel_id)
+      );
+      redis_command(node, &redisPublishNostoreCallback, d, "EXEC");
+    }
+    
+  }
+  else {  
+    //input:  keys: [], values: [namespace, channel_id, time, message, content_type, eventsource_event, compression, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff]
+    //output: message_time, message_tag, channel_hash {ttl, time_last_seen, subscribers, messages}
+    nchan_redis_script(publish, node, &redisPublishCallback, d, d->channel_id, 
+                      "%i %b %b %b %i %i %i %i %i", 
+                      msg->id.time, 
+                      STR(&msgstr), 
+                      STR((msg->content_type ? msg->content_type : &empty)), 
+                      STR((msg->eventsource_event ? msg->eventsource_event : &empty)), 
+                      d->compression,
+                      d->message_timeout, 
+                      d->max_messages, 
+                      redis_publish_message_msgkey_size,
+                      nodeset->settings.optimize_target
+                      );
+  }
+  if(mmapped && munmap(msgstr.data, msgstr.len) == -1) {
+    ERR("munmap was a problem");
+    return NGX_ERROR;
   }
+  return NGX_OK;
 }
 
 static ngx_int_t nchan_store_publish_message(ngx_str_t *channel_id, nchan_msg_t *msg, nchan_loc_conf_t *cf, callback_pt callback, void *privdata) {
   redis_publish_callback_data_t  *d=NULL;
-  rdstore_data_t                 *rdata = cf->redis.privdata;
-  
+  redis_nodeset_t                *ns = nodeset_find(&cf->redis);
   assert(callback != NULL);
 
-  CREATE_CALLBACK_DATA(d, rdata, "publish_message", channel_id, callback, privdata);
+  CREATE_CALLBACK_DATA(d, ns, cf, "publish_message", channel_id, callback, privdata);
   
-  d->channel_id=channel_id;
   d->msg_time=msg->id.time;
   if(d->msg_time == 0) {
     d->msg_time = ngx_time();
   }
   d->msg = msg;
-  d->shared_msg = msg->shared;
+  d->shared_msg = msg->storage == NCHAN_MSG_SHARED;
   d->message_timeout = nchan_loc_conf_message_timeout(cf);
   d->max_messages = nchan_loc_conf_max_messages(cf);
+  d->compression = cf->message_compression;
+  d->retry = 0;
   
   assert(msg->id.tagcount == 1);
-  if((rdata = redis_cluster_rdata_from_channel_id(rdata, channel_id)) == NULL) {
-    return NGX_ERROR;
-  }
   
   if(d->shared_msg) {
     msg_reserve(d->msg, "redis publish");
   }
-  redis_publish_message_send(rdata, d);
+  redis_publish_message_send(ns, d);
   
   return NGX_OK;
 }
 
+static int64_t redisReply_to_int(redisReply *reply, int nil_value, int wrong_datatype_value) {
+  switch(reply->type) {
+    case REDIS_REPLY_INTEGER:
+      return reply->integer;
+    case REDIS_REPLY_STRING:
+      return atol(reply->str);
+    case REDIS_REPLY_NIL:
+      return nil_value;
+    default:
+      return wrong_datatype_value;
+  }
+}
+
+static void redisPublishNostoreCallback(redisAsyncContext *c, void *r, void *privdata) {
+  redis_publish_callback_data_t *d=(redis_publish_callback_data_t *)privdata;
+  redisReply                    *reply=r;
+  redisReply                   **els;
+  nchan_channel_t                ch;
+  
+  
+  
+  redis_node_t                 *node = c->data;
+  node->pending_commands--;
+  nchan_update_stub_status(redis_pending_commands, -1);
+  
+  if(d->shared_msg) {
+    msg_release(d->msg, "redis publish");
+  }
+  
+  ngx_memzero(&ch, sizeof(ch)); //for debugging basically. should be removed in the future and zeroed as-needed
+  
+  if(reply) {
+    if(reply->type == REDIS_REPLY_ARRAY && reply->elements == 2 && reply->element[1]->type == REDIS_REPLY_ARRAY && reply->element[1]->elements == 2) {
+      els = reply->element[1]->element;
+      ch.last_seen = redisReply_to_int(els[0], 0, 0);
+      ch.subscribers = redisReply_to_int(els[1], 0, 0);
+    }
+    else if(reply->type == REDIS_REPLY_INTEGER) {
+      ch.last_seen = 0;
+      ch.subscribers = redisReply_to_int(reply, 0, 0);
+    }
+    else {
+      DBG("nonsense nostore-publish reply");
+    }
+    
+    d->callback(ch.subscribers > 0 ? NCHAN_MESSAGE_RECEIVED : NCHAN_MESSAGE_QUEUED, &ch, d->privdata);
+  }
+  else {
+    redisEchoCallback(c, r, privdata);
+    d->callback(NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, d->privdata);
+  }
+  
+  ngx_free(d);
+}
+
 static void redisPublishCallback(redisAsyncContext *c, void *r, void *privdata) {
   redis_publish_callback_data_t *d=(redis_publish_callback_data_t *)privdata;
   redisReply                    *reply=r;
   redisReply                    *cur;
   nchan_channel_t                ch;
   
-  rdstore_data_t                *rdata = c->data;
-  rdata->pending_commands--;
+  redis_node_t                 *node = c->data;
+  node->pending_commands--;
   nchan_update_stub_status(redis_pending_commands, -1);
   
-  if(!clusterKeySlotOk(c, r)) {
+  if(!nodeset_node_reply_keyslot_ok(node, reply)) {
     if(d->shared_msg) {
-      cluster_add_retry_command_with_channel_id(rdata->node.cluster, d->channel_id, redis_publish_message_send, d);
+      redis_publish_message_nodeset_maybe_retry(node->nodeset, d);
     }
     else {
       //message probably isn't available anymore...
@@ -2682,12 +2380,7 @@ static void redisPublishCallback(redisAsyncContext *c, void *r, void *privdata)
   ngx_memzero(&ch, sizeof(ch)); //for debugging basically. should be removed in the future and zeroed as-needed
   
   if(reply && CHECK_REPLY_ARRAY_MIN_SIZE(reply, 2)) {
-    ch.last_published_msg_id.time=d->msg_time;
-    ch.last_published_msg_id.tag.fixed[0]=reply->element[0]->integer;
-    ch.last_published_msg_id.tagcount = 1;
-    ch.last_published_msg_id.tagactive = 0;
-    
-    cur=reply->element[1];
+    cur=reply->element[0];
     switch(redis_array_to_channel(cur, &ch)) {
       case NGX_OK:
         d->callback(ch.subscribers > 0 ? NCHAN_MESSAGE_RECEIVED : NCHAN_MESSAGE_QUEUED, &ch, d->privdata);
@@ -2717,17 +2410,35 @@ typedef struct {
 
 
 static void nchan_store_redis_add_fakesub_callback(redisAsyncContext *c, void *r, void *privdata);
-static void nchan_store_redis_add_fakesub_send(rdstore_data_t *rdata, void *pd) {
-  if(rdata) {
-    redis_command(rdata, &nchan_store_redis_add_fakesub_callback, NULL, "EVALSHA %s 0 %b %i", redis_lua_scripts.add_fakesub.hash, STR(((add_fakesub_data_t *)pd)->channel_id), ((add_fakesub_data_t *)pd)->count);
+static ngx_int_t nchan_store_redis_add_fakesub_send(redis_nodeset_t *nodeset, void *pd) {
+  add_fakesub_data_t *d = pd;
+  if(nodeset_ready(nodeset)) {
+    redis_node_t *node = nodeset_node_find_by_channel_id(nodeset, d->channel_id);
+    nchan_redis_script(add_fakesub, node, &nchan_store_redis_add_fakesub_callback, NULL, 
+                       d->channel_id,
+                       "%i %i",
+                       d->count,
+                       ngx_time()
+                      );
+    return NGX_OK;
+  }
+  else {
+    return NGX_ERROR;
   }
 }
 
+static ngx_int_t nchan_store_redis_add_fakesub_send_retry_wrapper(redis_nodeset_t *nodeset, void *pd) {
+  add_fakesub_data_t *d = pd;
+  ngx_int_t rc = nchan_store_redis_add_fakesub_send(nodeset, pd);
+  ngx_free(d);
+  return rc;
+}
+
 static void nchan_store_redis_add_fakesub_callback(redisAsyncContext *c, void *r, void *privdata) {
   redisReply      *reply = r;
-  rdstore_data_t  *rdata = c->data;
+  redis_node_t    *node = c->data;
   
-  rdata->pending_commands--;
+  node->pending_commands--;
   nchan_update_stub_status(redis_pending_commands, -1);
   
   if(reply && reply->type == REDIS_REPLY_ERROR) {
@@ -2740,12 +2451,12 @@ static void nchan_store_redis_add_fakesub_callback(redisAsyncContext *c, void *r
     errstr.len = strlen(reply->str);
     
     if(ngx_str_chop_if_startswith(&errstr, "CLUSTER KEYSLOT ERROR. ")) {
-      
+      nodeset_node_keyslot_changed(node);
       nchan_scan_until_chr_on_line(&errstr, &countstr, ' ');
       count = ngx_atoi(countstr.data, countstr.len);
       channel_id = errstr;
       
-      add_fakesub_data_t  *d = cluster_retry_palloc(rdata->node.cluster, sizeof(*d) + sizeof(ngx_str_t) + channel_id.len);
+      add_fakesub_data_t  *d = ngx_alloc(sizeof(*d) + sizeof(ngx_str_t) + channel_id.len, ngx_cycle->log);
       if(!d) {
         ERR("can't allocate add_fakesub_data for CLUSTER KEYSLOT ERROR retry");
         return;
@@ -2754,7 +2465,7 @@ static void nchan_store_redis_add_fakesub_callback(redisAsyncContext *c, void *r
       d->channel_id = (ngx_str_t *)&d[1];
       d->channel_id->data = (u_char *)&d->channel_id[1];
       nchan_strcpy(d->channel_id, &channel_id, 0);
-      cluster_add_retry_command_with_channel_id(rdata->node.cluster, &channel_id, nchan_store_redis_add_fakesub_send, d);
+      nodeset_callback_on_ready(node->nodeset, 1000, nchan_store_redis_add_fakesub_send_retry_wrapper, d);
       
       return;
     }
@@ -2764,43 +2475,47 @@ static void nchan_store_redis_add_fakesub_callback(redisAsyncContext *c, void *r
 }
 
 ngx_int_t nchan_store_redis_fakesub_add(ngx_str_t *channel_id, nchan_loc_conf_t *cf, ngx_int_t count, uint8_t shutting_down) {
-  rdstore_data_t                 *rdata;
+  redis_nodeset_t  *nodeset = nodeset_find(&cf->redis);
   
-  if((rdata = redis_cluster_rdata_from_channel_id(cf->redis.privdata, channel_id)) == NULL) {
-    return NGX_ERROR;
-  }
   if(!shutting_down) {
     add_fakesub_data_t   data = {channel_id, count};
-    nchan_store_redis_add_fakesub_send(rdata, &data);
+    nchan_store_redis_add_fakesub_send(nodeset, &data);
   }
   else {
-    redis_sync_command(rdata, "EVALSHA %s 0 %b %i", redis_lua_scripts.add_fakesub.hash, STR(channel_id), count);
+    if(nodeset_ready(nodeset)) {
+      redis_node_t *node = nodeset_node_find_by_channel_id(nodeset, channel_id);
+      redis_sync_command(node, "EVALSHA %s 0 %b %i", redis_lua_scripts.add_fakesub.hash, STR(channel_id), count);
+    }
   }
   return NGX_OK;
 }
 
+int nchan_store_redis_ready(nchan_loc_conf_t *cf) {
+  redis_nodeset_t   *nodeset = nodeset_find(&cf->redis);
+  return nodeset && nodeset_ready(nodeset);
+}
+
 nchan_store_t nchan_store_redis = {
-    //init
-    &nchan_store_init_module,
-    &nchan_store_init_worker,
-    &nchan_store_init_postconfig,
-    &nchan_store_create_main_conf,
-    
-    //shutdown
-    &nchan_store_exit_worker,
-    &nchan_store_exit_master,
-    
-    //async-friendly functions with callbacks
-    &nchan_store_async_get_message, //+callback
-    &nchan_store_subscribe, //+callback
-    &nchan_store_publish_message, //+callback
-    
-    &nchan_store_delete_channel, //+callback
-    &nchan_store_find_channel, //+callback
-    
-    //message stuff
-    &nchan_store_etag_from_message,
-    &nchan_store_content_type_from_message,
-    
+  //init
+  &nchan_store_init_module,
+  &nchan_store_init_worker,
+  &nchan_store_init_postconfig,
+  &nchan_store_create_main_conf,
+  
+  //shutdown
+  &nchan_store_exit_worker,
+  &nchan_store_exit_master,
+  
+  //async-friendly functions with callbacks
+  &nchan_store_async_get_message, //+callback
+  &nchan_store_subscribe, //+callback
+  &nchan_store_publish_message, //+callback
+  
+  &nchan_store_delete_channel, //+callback
+  &nchan_store_find_channel, //+callback
+  
+  NULL, //get_group
+  NULL,
+  NULL
 };
 
diff --git a/debian/modules/nchan/src/store/redis/scripts/.gitignore b/debian/modules/nchan/src/store/redis/redis-lua-scripts/.gitignore
similarity index 100%
rename from debian/modules/nchan/src/store/redis/scripts/.gitignore
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/.gitignore
diff --git a/debian/modules/nchan/src/store/redis/scripts/Gemfile b/debian/modules/nchan/src/store/redis/redis-lua-scripts/Gemfile
similarity index 100%
rename from debian/modules/nchan/src/store/redis/scripts/Gemfile
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/Gemfile
diff --git a/debian/modules/nchan/src/store/redis/scripts/add_fakesub.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/add_fakesub.lua
similarity index 65%
rename from debian/modules/nchan/src/store/redis/scripts/add_fakesub.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/add_fakesub.lua
index dfee879d..ee2b95f9 100644
--- a/debian/modules/nchan/src/store/redis/scripts/add_fakesub.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/add_fakesub.lua
@@ -1,14 +1,16 @@
---input:  keys: [], values: [channel_id, number]
+--input:  keys: [], values: [namespace, channel_id, number, time]
 --output: current_fake_subscribers
   
 redis.call('echo', ' ####### FAKESUBS ####### ')
-local id=ARGV[1]
-local num=tonumber(ARGV[2])
+local ns=ARGV[1]
+local id=ARGV[2]
+local num=tonumber(ARGV[3])
+local time = tonumber(ARGV[4])
 if num==nil then
   return {err="fakesub number not given"}
 end
 
-local chan_key = ('{channel:%s}'):format(id)
+local chan_key = ('%s{channel:%s}'):format(ns, id)
 
 local res = redis.pcall('EXISTS', chan_key)
 if type(res) == "table" and res["err"] then
@@ -21,6 +23,9 @@ local cur = 0
 
 if exists or (not exists and num > 0) then
   cur = redis.call('HINCRBY', chan_key, 'fake_subscribers', num)
+  if time then
+    redis.call('HSET', chan_key, 'last_seen_fake_subscriber', time)
+  end
   if not exists then
     redis.call('EXPIRE', chan_key, 5) --something small
   end
diff --git a/debian/modules/nchan/src/store/redis/scripts/channel_keepalive.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/channel_keepalive.lua
similarity index 85%
rename from debian/modules/nchan/src/store/redis/scripts/channel_keepalive.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/channel_keepalive.lua
index b4950870..4d21548d 100644
--- a/debian/modules/nchan/src/store/redis/scripts/channel_keepalive.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/channel_keepalive.lua
@@ -1,9 +1,10 @@
---input:  keys: [], values: [channel_id, ttl]
+--input:  keys: [], values: [namespace, channel_id, ttl]
 -- ttl is for when there are no messages but at least 1 subscriber.
 --output: seconds until next keepalive is expected, or -1 for "let it disappear"
 redis.call('ECHO', ' ####### CHANNEL KEEPALIVE ####### ')
-local id=ARGV[1]
-local ttl=tonumber(ARGV[2])
+local ns=ARGV[1]
+local id=ARGV[2]
+local ttl=tonumber(ARGV[3])
 if not ttl then
   return {err="Invalid channel keepalive TTL (2nd arg)"}
 end
@@ -11,7 +12,7 @@ end
 local random_safe_next_ttl = function(ttl)
   return math.floor(ttl/2 + ttl/2.1 * math.random())
 end
-local ch = ('{channel:%s}'):format(id)
+local ch = ('%s{channel:%s}'):format(ns, id)
 local key={
   channel=   ch, --hash
   messages=  ch..':messages', --list
diff --git a/debian/modules/nchan/src/store/redis/scripts/delete.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/delete.lua
similarity index 54%
rename from debian/modules/nchan/src/store/redis/scripts/delete.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/delete.lua
index 382c9dba..d951395d 100644
--- a/debian/modules/nchan/src/store/redis/scripts/delete.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/delete.lua
@@ -1,8 +1,9 @@
---input: keys: [],  values: [ channel_id ]
+--input: keys: [],  values: [ namespace, channel_id ]
 --output: channel_hash {ttl, time_last_seen, subscribers, messages} or nil
 -- delete this channel and all its messages
-local id = ARGV[1]
-local ch = ('{channel:%s}'):format(id)
+local ns = ARGV[1]
+local id = ARGV[2]
+local ch = ('%s{channel:%s}'):format(ns, id)
 local key_msg=    ch..':msg:%s' --not finished yet
 local key_channel=ch
 local messages=   ch..':messages'
@@ -28,31 +29,40 @@ for k,channel_key in pairs(redis.call('SMEMBERS', subscribers)) do
   redis.call('PUBLISH', channel_key, del_msgpack)
 end
 
-local nearly_departed = nil
-if redis.call('EXISTS', key_channel) ~= 0 then
-  nearly_departed = redis.call('hmget', key_channel, 'ttl', 'time_last_seen', 'subscribers', 'fake_subscribers', 'current_message')
-  if(nearly_departed[4]) then
-    --replace subscribers count with fake_subscribers
-    nearly_departed[3]=nearly_departed[4]
-    table.remove(nearly_departed, 4)
-  end
-  for i = 1, 4 do
-    nearly_departed[i]=tonumber(nearly_departed[i]) or 0
+local tohash=function(arr)
+  if type(arr)~="table" then
+    return nil
   end
-  if type(nearly_departed[5]) ~= "string" then
-    nearly_departed[5]=""
+  local h = {}
+  local k=nil
+  for i, v in ipairs(arr) do
+    if k == nil then
+      k=v
+    else
+      h[k]=v; k=nil
+    end
   end
-  
+  return h
+end
+
+local channel = nil
+if redis.call('EXISTS', key_channel) ~= 0 then
+  channel = tohash(redis.call('hgetall', key_channel))
   --leave some crumbs behind showing this channel was just deleted
-  redis.call('setex', ch..":deleted", 5, 1)
-  
-  table.insert(nearly_departed, num_messages)
+  redis.call('setex', ch..":deleted", 5, 1)  
 end
 
 redis.call('DEL', key_channel, messages, subscribers)
+redis.call('PUBLISH', pubsub, del_msgpack)
 
-if redis.call('PUBSUB','NUMSUB', pubsub)[2] > 0 then
-  redis.call('PUBLISH', pubsub, del_msgpack)
+if channel then
+  return {
+    tonumber(channel.ttl) or 0,
+    tonumber(channel.last_seen_fake_subscriber) or 0,
+    tonumber(channel.fake_subscribers or channel.subscribers) or 0,
+    channel.current_message or "",
+    tonumber(num_messages)
+  }
+else
+  return nil
 end
-
-return nearly_departed
diff --git a/debian/modules/nchan/src/store/redis/redis-lua-scripts/find_channel.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/find_channel.lua
new file mode 100644
index 00000000..4e095983
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/find_channel.lua
@@ -0,0 +1,70 @@
+--input: keys: [],  values: [ namespace, channel_id ]
+--output: channel_hash {ttl, time_last_seen, subscribers, last_channel_id, messages} or nil
+-- finds and return the info hash of a channel, or nil of channel not found
+local ns = ARGV[1]
+local id = ARGV[2]
+local channel_key = ('%s{channel:%s}'):format(ns, id)
+local messages_key = channel_key..':messages'
+
+redis.call('echo', ' #######  FIND_CHANNEL ######## ')
+
+--check old entries
+local oldestmsg=function(list_key, old_fmt)
+  local old, oldkey
+  local n, del=0,0
+  while true do
+    n=n+1
+    old=redis.call('lindex', list_key, -1)
+    if old then
+      oldkey=old_fmt:format(old)
+      local ex=redis.call('exists', oldkey)
+      if ex==1 then
+        return oldkey
+      else
+        redis.call('rpop', list_key)
+        del=del+1
+      end
+    else
+      break
+    end
+  end
+end
+
+local tohash=function(arr)
+  if type(arr)~="table" then
+    return nil
+  end
+  local h = {}
+  local k=nil
+  for i, v in ipairs(arr) do
+    if k == nil then
+      k=v
+    else
+      --dbg(k.."="..v)
+      h[k]=v; k=nil
+    end
+  end
+  return h
+end
+
+if redis.call('EXISTS', channel_key) ~= 0 then
+  local ch = tohash(redis.call('hgetall', channel_key))
+    
+  local msgs_count
+  if redis.call("TYPE", messages_key)['ok'] == 'list' then
+    oldestmsg(messages_key, channel_key ..':msg:%s')
+    msgs_count = tonumber(redis.call('llen', messages_key))
+  else
+    msgs_count = 0
+  end
+  
+  return {
+    tonumber(ch.ttl) or 0,
+    tonumber(ch.last_seen_fake_subscriber) or 0,
+    tonumber(ch.fake_subscribers or ch.subscribers) or 0,
+    ch.current_message or "",
+    msgs_count
+  }
+else
+  return nil
+end
diff --git a/debian/modules/nchan/src/store/redis/scripts/get_message.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/get_message.lua
similarity index 80%
rename from debian/modules/nchan/src/store/redis/scripts/get_message.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/get_message.lua
index 4cb84e68..986368f9 100644
--- a/debian/modules/nchan/src/store/redis/scripts/get_message.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/get_message.lua
@@ -1,11 +1,11 @@
---input:  keys: [], values: [channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl]
---output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, channel_subscriber_count
+--input:  keys: [], values: [namespace, channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl]
+--output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, compression_type, channel_subscriber_count
 -- no_msgid_order: 'FILO' for oldest message, 'FIFO' for most recent
 -- create_channel_ttl - make new channel if it's absent, with ttl set to this. 0 to disable.
 -- result_code can be: 200 - ok, 404 - not found, 410 - gone, 418 - not yet available
-local id, time, tag, subscribe_if_current = ARGV[1], tonumber(ARGV[2]), tonumber(ARGV[3])
-local no_msgid_order=ARGV[4]
-local create_channel_ttl=tonumber(ARGV[5]) or 0
+local ns, id, time, tag, subscribe_if_current = ARGV[1], ARGV[2], tonumber(ARGV[3]), tonumber(ARGV[4])
+local no_msgid_order=ARGV[5]
+local create_channel_ttl=tonumber(ARGV[6]) or 0
 local msg_id
 if time and time ~= 0 and tag then
   msg_id=("%s:%s"):format(time, tag)
@@ -20,7 +20,7 @@ end
 -- redis doesn't do includes. It could be generated pre-insertion into redis, 
 -- but then error messages become less useful, complicating debugging. If you 
 -- have a solution to this, please help.
-local ch=('{channel:%s}'):format(id)
+local ch=('%s{channel:%s}'):format(ns, id)
 local msgkey_fmt=ch..':msg:%s'
 local key={
   next_message= msgkey_fmt, --hash
@@ -91,8 +91,8 @@ end
 
 local subs_count = tonumber(channel.subscribers)
 
-local found_msg_id
 if msg_id==nil then
+  local found_msg_key
   if new_channel then
     --dbg("new channel")
     return {418, "", "", "", "", subs_count}
@@ -101,24 +101,23 @@ if msg_id==nil then
     
     if no_msgid_order == 'FIFO' then --most recent message
       --dbg("get most recent")
-      found_msg_id=channel.current_message
+      found_msg_key=channel.current_message
     elseif no_msgid_order == 'FILO' then --oldest message
       --dbg("get oldest")
-      
-      found_msg_id=oldestmsg(key.messages, msgkey_fmt)
+      found_msg_key=oldestmsg(key.messages, msgkey_fmt)
     end
-    if found_msg_id == nil then
+    
+    if found_msg_key == nil then
       --we await a message
       return {418, "", "", "", "", subs_count}
     else
-      msg_id = found_msg_id
-      local msg=tohash(redis.call('HGETALL', msg_id))
+      local msg=tohash(redis.call('HGETALL', found_msg_key))
       if not next(msg) then --empty
         return {404, "", "", "", "", subs_count}
       else
         --dbg(("found msg %s:%s  after %s:%s"):format(tostring(msg.time), tostring(msg.tag), tostring(time), tostring(tag)))
-        local ttl = redis.call('TTL', msg_id)
-        return {200, ttl, tonumber(msg.time) or "", tonumber(msg.tag) or "", tonumber(msg.prev_time) or "", tonumber(msg.prev_tag) or "", msg.data or "", msg.content_type or "", msg.eventsource_event or "", subs_count}
+        local ttl = redis.call('TTL', found_msg_key)
+        return {200, ttl, tonumber(msg.time) or "", tonumber(msg.tag) or "", tonumber(msg.prev_time) or "", tonumber(msg.prev_tag) or "", msg.data or "", msg.content_type or "", msg.eventsource_event or "", tonumber(msg.compression or 0), subs_count}
       end
     end
   end
@@ -144,10 +143,10 @@ else
     --dbg("NEXT MESSAGE KEY PRESENT: " .. msg.next)
     key.next_message=key.next_message:format(msg.next)
     if redis.call('EXISTS', key.next_message)~=0 then
-      local ntime, ntag, prev_time, prev_tag, ndata, ncontenttype, neventsource_event=unpack(redis.call('HMGET', key.next_message, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event'))
+      local ntime, ntag, prev_time, prev_tag, ndata, ncontenttype, neventsource_event, ncompression=unpack(redis.call('HMGET', key.next_message, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event', 'compression'))
       local ttl = redis.call('TTL', key.next_message)
       --dbg(("found msg2 %i:%i  after %i:%i"):format(ntime, ntag, time, tag))
-      return {200, ttl, tonumber(ntime) or "", tonumber(ntag) or "", tonumber(prev_time) or "", tonumber(prev_tag) or "", ndata or "", ncontenttype or "", neventsource_event or "", subs_count}
+      return {200, ttl, tonumber(ntime) or "", tonumber(ntag) or "", tonumber(prev_time) or "", tonumber(prev_tag) or "", ndata or "", ncontenttype or "", neventsource_event or "", ncompression or 0, subs_count}
     else
       --dbg("NEXT MESSAGE NOT FOUND")
       return {404, nil}
diff --git a/debian/modules/nchan/src/store/redis/redis-lua-scripts/get_message_from_key.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/get_message_from_key.lua
new file mode 100644
index 00000000..ad0d742e
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/get_message_from_key.lua
@@ -0,0 +1,8 @@
+--input:  keys: [message_key], values: []
+--output: msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, compression, channel_subscriber_count
+local key = KEYS[1]
+
+local ttl = redis.call('TTL', key)
+local time, tag, prev_time, prev_tag, data, content_type, es_event, compression = unpack(redis.call('HMGET', key, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event', 'compression'))
+
+return {ttl, time, tag, prev_time or 0, prev_tag or 0, data or "", content_type or "", es_event or "", tonumber(compression or 0)}
diff --git a/debian/modules/nchan/src/store/redis/scripts/publish.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/publish.lua
similarity index 71%
rename from debian/modules/nchan/src/store/redis/scripts/publish.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/publish.lua
index 23da3bb9..1d8e4166 100644
--- a/debian/modules/nchan/src/store/redis/scripts/publish.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/publish.lua
@@ -1,9 +1,24 @@
---input:  keys: [], values: [channel_id, time, message, content_type, eventsource_event, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff]
---output: message_tag, channel_hash {ttl, time_last_seen, subscribers, messages}
+--input:  keys: [], values: [namespace, channel_id, time, message, content_type, eventsource_event, compression_setting, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff, optimize_target]
+--output: channel_hash {ttl, time_last_subscriber_seen, subscribers, last_message_id, messages}, channel_created_just_now?
+
+local ns, id=ARGV[1], ARGV[2]
+
+local msg = {}
+
+local store_at_most_n_messages = tonumber(ARGV[9])
+if store_at_most_n_messages == nil or store_at_most_n_messages == "" then
+  return {err="Argument 9, max_msg_buf_size, can't be empty"}
+end
+if store_at_most_n_messages == 0 then
+  msg.unbuffered = 1
+end
+
+local msgpacked_pubsub_cutoff = tonumber(ARGV[10])
+
+local optimize_target = tonumber(ARGV[11]) == 2 and "bandwidth" or "cpu"
 
-local id=ARGV[1]
 local time
-if redis.replicate_commands then
+if optimize_target == "cpu" and redis.replicate_commands then
   -- we're on redis >= 3.2. We can use We can use 'script effects replication' to allow
   -- writing nondeterministic command values like TIME.
   -- That's exactly what we want to do, use Redis' TIME rather than the given time from Nginx
@@ -12,39 +27,30 @@ if redis.replicate_commands then
   time = tonumber(redis.call('TIME')[1])
 else
   --fallback to the provided time
-  time = tonumber(ARGV[2])
+  time = tonumber(ARGV[3])
 end
 
-local msg={
-  id=nil,
-  data= ARGV[3],
-  content_type=ARGV[4],
-  eventsource_event=ARGV[5],
-  ttl= tonumber(ARGV[6]),
-  time= time,
-  tag= 0
-}
+msg.id=nil
+msg.data= ARGV[4]
+msg.content_type=ARGV[5]
+msg.eventsource_event=ARGV[6]
+msg.compression=tonumber(ARGV[7])
+msg.ttl= tonumber(ARGV[8])
+msg.time= time
+msg.tag= 0
+
 if msg.ttl == 0 then
   msg.ttl = 126144000 --4 years
 end
-local store_at_most_n_messages = tonumber(ARGV[7])
-if store_at_most_n_messages == nil or store_at_most_n_messages == "" then
-  return {err="Argument 7, max_msg_buf_size, can't be empty"}
-end
-if store_at_most_n_messages == 0 then
-  msg.unbuffered = 1
-end
-
-local msgpacked_pubsub_cutoff = tonumber(ARGV[8])
 
 --[[local dbg = function(...)
   local arg = {...}
   for i = 1, #arg do
     arg[i]=tostring(arg[i])
   end
-  redis.call('echo', table.concat(arg))
-end
-]]
+  redis.call('echo', table.concat(arg, ", "))
+end]]
+
 if type(msg.content_type)=='string' and msg.content_type:find(':') then
   return {err='Message content-type cannot contain ":" character.'}
 end
@@ -62,16 +68,6 @@ local hmset = function (key, dict)
   return redis.call('HMSET', key, unpack(bulk))
 end
 
---[[
-local hash_tostr=function(h)
-  local tt = {}
-  for k, v in pairs(h) do
-    table.insert(tt, ("%s: %s"):format(k, v))
-  end
-  return "{" .. table.concat(tt,", ") .. "}"
-end
-]]
-
 local tohash=function(arr)
   if type(arr)~="table" then
     return nil
@@ -88,7 +84,7 @@ local tohash=function(arr)
   return h
 end
 
-local ch = ('{channel:%s}'):format(id)
+local ch = ('%s{channel:%s}'):format(ns, id)
 local msg_fmt = ch..':msg:%s'
 local key={
   last_message= msg_fmt, --not finished yet
@@ -130,7 +126,7 @@ if key.last_message then
   lasttime, lasttag = tonumber(lastmsg[1]), tonumber(lastmsg[2])
   --dbg("New message id: last_time ", lasttime, " last_tag ", lasttag, " msg_time ", msg.time)
   if lasttime and tonumber(lasttime) > tonumber(msg.time) then
-    redis.log(redis.LOG_WARNING, "Nchan: message for " .. id .. " arrived a little late and may be delivered out of order. Redis must be very busy.")
+    redis.log(redis.LOG_WARNING, "Nchan: message for " .. id .. " arrived a little late and may be delivered out of order. Redis must be very busy, or the Nginx servers do not have their times synchronized.")
     msg.time = lasttime
     time = lasttime
   end
@@ -147,11 +143,16 @@ msg.id=('%i:%i'):format(msg.time, msg.tag)
 
 key.message=key.message:format(msg.id)
 if redis.call('EXISTS', key.message) ~= 0 then
-  local errmsg = "Message %s for channel %s id %s already exists. time: %s lasttime: %s lasttag: %s"
-  errmsg = errmsg:format(key.message, id, msg.id, time, lasttime, lasttag)
-  --redis.log(redis.LOG_WARNING, errmsg)
-  --redis.log(redis.LOG_WARNING, "channel: " .. key.channel .. hash_tostr(channel))
-  --redis.log(redis.LOG_WARNING, ("messages: %s {%s}"):format(key.messages, table.concat(redis.call('LRANGE', key.messages, 0, -1), ", ")))
+  local hash_tostr=function(h)
+    local tt = {}
+    for k, v in pairs(h) do
+      table.insert(tt, ("%s: %s"):format(k, v))
+    end
+    return "{" .. table.concat(tt,", ") .. "}"
+  end
+  local existing_msg = tohash(redis.call('HGETALL', key.message))
+  local errmsg = "Message %s for channel %s id %s already exists. time: %s lasttime: %s lasttag: %s. dbg: channel: %s, messages_key: %s, msglist: %s, msg: %s, msg_expire: %s."
+  errmsg = errmsg:format(key.message, id, msg.id or "-", time or "-", lasttime or "-", lasttag or "-", hash_tostr(channel), key.messages, "["..table.concat(redis.call('LRANGE', key.messages, 0, -1), ", ").."]", hash_tostr(existing_msg), redis.call('TTL', key.message))
   return {err=errmsg}
 end
 
@@ -226,10 +227,10 @@ end
 --set expiration times for all the things
 local channel_ttl = tonumber(redis.call('TTL',  key.channel))
 redis.call('EXPIRE', key.message, msg.ttl)
-if msg.ttl > channel_ttl then
-  redis.call('EXPIRE', key.channel, msg.ttl)
-  redis.call('EXPIRE', key.messages, msg.ttl)
-  redis.call('EXPIRE', key.subscribers, msg.ttl)
+if msg.ttl + 1 > channel_ttl then -- a little extra time for failover weirdness for 1-second TTL messages
+  redis.call('EXPIRE', key.channel, msg.ttl + 1)
+  redis.call('EXPIRE', key.messages, msg.ttl + 1)
+  redis.call('EXPIRE', key.subscribers, msg.ttl + 1)
 end
 
 --publish message
@@ -245,7 +246,8 @@ if msg.unbuffered or #msg.data < msgpacked_pubsub_cutoff then
     (msg.unbuffered and 0 or msg.prev_tag) or 0,
     msg.data or "",
     msg.content_type or "",
-    msg.eventsource_event or ""
+    msg.eventsource_event or "",
+    msg.compression or 0
   }
 else
   unpacked= {
@@ -265,14 +267,21 @@ local msgpacked
 
 --dbg(("Stored message with id %i:%i => %s"):format(msg.time, msg.tag, msg.data))
 
---now publish to the efficient channel
-local numsub = redis.call('PUBSUB','NUMSUB', channel_pubsub)[2]
-if tonumber(numsub) > 0 then
-  msgpacked = cmsgpack.pack(unpacked)
-  redis.call('PUBLISH', channel_pubsub, msgpacked)
-end
+--we used to publish conditionally on subscribers on the Redis pubsub channel
+--but now that we're subscribing to slaves this is not possible
+--so just PUBLISH always.
+msgpacked = cmsgpack.pack(unpacked)
+redis.call('PUBLISH', channel_pubsub, msgpacked)
 
 local num_messages = redis.call('llen', key.messages)
 
 --dbg("channel ", id, " ttl: ",channel.ttl, ", subscribers: ", channel.subscribers, "(fake: ", channel.fake_subscribers or "nil", "), messages: ", num_messages)
-return { msg.tag, {tonumber(channel.ttl or msg.ttl), tonumber(channel.time or msg.time), tonumber(channel.fake_subscribers or channel.subscribers or 0), tonumber(num_messages)}, new_channel}
+local ch = {
+  tonumber(channel.ttl or msg.ttl),
+  tonumber(channel.last_seen_fake_subscriber) or 0,
+  tonumber(channel.fake_subscribers or channel.subscribers) or 0,
+  msg.time and msg.time and ("%i:%i"):format(msg.time, msg.tag) or "",
+  tonumber(num_messages)
+}
+
+return {ch, new_channel}
diff --git a/debian/modules/nchan/src/store/redis/scripts/publish_status.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/publish_status.lua
similarity index 81%
rename from debian/modules/nchan/src/store/redis/scripts/publish_status.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/publish_status.lua
index a8b5ef0c..cdb251d0 100644
--- a/debian/modules/nchan/src/store/redis/scripts/publish_status.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/publish_status.lua
@@ -1,16 +1,16 @@
---input:  keys: [], values: [channel_id, status_code]
+--input:  keys: [], values: [namespace, channel_id, status_code]
 --output: current_subscribers
 
 redis.call('echo', ' ####### PUBLISH STATUS ####### ')
 --local dbg = function(...) redis.call('echo', table.concat({...})); end
-local id=ARGV[1]
-local code=tonumber(ARGV[2])
+local ns, id=ARGV[1], ARGV[2]
+local code=tonumber(ARGV[3])
 if code==nil then
   return {err="non-numeric status code given, bailing!"}
 end
 
 local pubmsg = "status:"..code
-local ch = ('{channel:%s}'):format(id)
+local ch = ('%s{channel:%s}'):format(ns, id)
 local subs_key = ch..':subscribers'
 local chan_key = ch
 --local channel_pubsub = ch..':pubsub'
diff --git a/debian/modules/nchan/src/store/redis/scripts/rsck.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/rsck.lua
similarity index 86%
rename from debian/modules/nchan/src/store/redis/scripts/rsck.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/rsck.lua
index 76dbffe0..9d351bc1 100644
--- a/debian/modules/nchan/src/store/redis/scripts/rsck.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/rsck.lua
@@ -1,4 +1,8 @@
 --redis-store consistency check
+local ns = ARGV[1]
+if ns and #ns > 0 then
+  ns = ns..":"
+end
 
 local concat = function(...)
   local arg = {...}
@@ -64,9 +68,22 @@ local known_msgs_count=0
 local known_msgkeys = {}
 local known_channel_keys = {}
 
+
+local k = {
+  channel = function(chid)
+    return ("%s{channel:%s}"):format(chid)
+  end,
+  msg = function (chid, msgid)
+    return ("%s:msg:%s"):format(k.channel(chid), msgid)
+  end,
+  messages = function(chid)
+    return k.channel(chid) .. ":messages"
+  end
+}
+
 local check_msg = function(chid, msgid, prev_msgid, next_msgid, description)
   description = description and "msg (" .. description ..")" or "msg"
-  local msgkey = "{channel:"..chid.."}:msg:"..msgid
+  local msgkey = k.msg(chid, msgid)
   if not known_msgkeys[msgkey] then
     known_msgs_count = known_msgs_count + 1
   end
@@ -75,13 +92,13 @@ local check_msg = function(chid, msgid, prev_msgid, next_msgid, description)
   if t == "none" then
     --message is missing, but maybe it expired under normal circumstances. 
     --check if any earlier messages are present
-    local msgids = redis.call('LRANGE', "{channel:"..chid.."}:messages", 0, -1)
+    local msgids = redis.call('LRANGE', k.messages(chid), 0, -1)
     local founds = 0
     for i=#msgids, 1, -1 do
       if msgids[i] == msgid then 
         break
       end
-      local thismsgkey = "{channel:"..chid.."}:msg:".. msgids[i]
+      local thismsgkey = k.msg(chid, msgids[i])
       local ttt = redis.call('type', thismsgkey)['ok']
       redis.breakpoint()
       if ttt == "hash" then
@@ -116,8 +133,8 @@ end
 
 local check_channel = function(id)
   local key={
-    ch = "{channel:"..id.."}",
-    msgs = "{channel:"..id.."}:messages"
+    ch = k.channel(id),
+    msgs = k.messages(id)
   }
   
   local ok, chkey_type = type_is(key.ch, "hash", "channel hash")
@@ -162,10 +179,10 @@ end
 
 local channel_ids = {}
 
-for i, chkey in ipairs(redis.call("KEYS", "{channel:*}")) do
-  local msgs_chid_match = chkey:match("^{channel:(.*)}:messages")
+for i, chkey in ipairs(redis.call("KEYS", k.channel("*"))) do
+  local msgs_chid_match = chkey:match("^"..k.messages("*"))
   if msgs_chid_match then
-    type_is("{channel:" .. msgs_chid_match.."}", "hash", "channel messages' corresponding hash key")
+    type_is(k.channel(msgs_chid_match), "hash", "channel messages' corresponding hash key")
   elseif not chkey:match(":msg$") then
     table.insert(channel_ids, chkey);
     known_channel_keys[chkey] = true
@@ -174,11 +191,11 @@ end
 
 dbg("found", #channel_ids, "channels")
 for i, chkey in ipairs(channel_ids) do
-  local chid = chkey:match("^{channel:(.*)}")
+  local chid = chkey:match("^" .. k.channel(".*"))
   check_channel(chid)
 end
 
-for i, msgkey in ipairs(redis.call("KEYS", "{channel:*}:msg")) do
+for i, msgkey in ipairs(redis.call("KEYS", k.channel("*")..":msg")) do
   if not known_msgkeys[msgkey] then
     local ok, t = type_is(msgkey, "hash")
     if ok then
diff --git a/debian/modules/nchan/src/store/redis/scripts/subscriber_register.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/subscriber_register.lua
similarity index 62%
rename from debian/modules/nchan/src/store/redis/scripts/subscriber_register.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/subscriber_register.lua
index 479623f9..e2eafcae 100644
--- a/debian/modules/nchan/src/store/redis/scripts/subscriber_register.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/subscriber_register.lua
@@ -1,17 +1,19 @@
---input: keys: [], values: [channel_id, subscriber_id, active_ttl]
+--input: keys: [], values: [namespace, channel_id, subscriber_id, active_ttl, time, want_channel_settings]
 --  'subscriber_id' can be '-' for new id, or an existing id
 --  'active_ttl' is channel ttl with non-zero subscribers. -1 to persist, >0 ttl in sec
---output: subscriber_id, num_current_subscribers, next_keepalive_time
+--output: subscriber_id, num_current_subscribers, next_keepalive_time, channel_buffer_length
+--  'channel_buffer_length' is returned only if want_channel_settings is 1
 
-local id, sub_id, active_ttl, concurrency = ARGV[1], ARGV[2], tonumber(ARGV[3]) or 20, ARGV[4]
+local ns, id, sub_id, active_ttl, time = ARGV[1], ARGV[2], ARGV[3], tonumber(ARGV[4]) or 20, tonumber(ARGV[5])
+local want_channel_settings = tonumber(ARGV[6]) == 1
 
 --local dbg = function(...) redis.call('echo', table.concat({...})); end
 
 redis.call('echo', ' ######## SUBSCRIBER REGISTER SCRIPT ####### ')
-local ch=("{channel:%s}"):format(id)
+local ch=("%s{channel:%s}"):format(ns, id)
 local keys = {
   channel =     ch,
-  messages =    ch..':messages:',
+  messages =    ch..':messages',
   subscribers = ch..':subscribers'
 }
 
@@ -37,6 +39,9 @@ if sub_id == "-" then
 else
   sub_count=tonumber(redis.call('hget', keys.channel, 'subscribers'))
 end
+if time then
+  redis.call('hset', keys.channel, "last_seen_subscriber", time)
+end
 
 local next_keepalive 
 local actual_ttl = tonumber(redis.call('ttl', keys.channel))
@@ -47,4 +52,11 @@ else
   next_keepalive = random_safe_next_ttl(actual_ttl)
 end
 
-return {sub_id, sub_count, next_keepalive}
+
+local ret = {sub_id, sub_count, next_keepalive}
+if want_channel_settings then
+  local max_messages = tonumber(redis.call('hget', keys.channel, 'max_stored_messages'))
+  table.insert(ret, max_messages)
+end
+
+return ret
diff --git a/debian/modules/nchan/src/store/redis/scripts/subscriber_unregister.lua b/debian/modules/nchan/src/store/redis/redis-lua-scripts/subscriber_unregister.lua
similarity index 85%
rename from debian/modules/nchan/src/store/redis/scripts/subscriber_unregister.lua
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/subscriber_unregister.lua
index 9233c78a..0343cc51 100644
--- a/debian/modules/nchan/src/store/redis/scripts/subscriber_unregister.lua
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/subscriber_unregister.lua
@@ -1,14 +1,14 @@
---input: keys: [], values: [channel_id, subscriber_id, empty_ttl]
+--input: keys: [], values: [namespace, channel_id, subscriber_id, empty_ttl]
 -- 'subscriber_id' is an existing id
 -- 'empty_ttl' is channel ttl when without subscribers. 0 to delete immediately, -1 to persist, >0 ttl in sec
 --output: subscriber_id, num_current_subscribers
 
-local id, sub_id, empty_ttl = ARGV[1], ARGV[2], tonumber(ARGV[3]) or 20
+local ns, id, sub_id, empty_ttl = ARGV[1], ARGV[2], ARGV[3], tonumber(ARGV[4]) or 20
 
 --local dbg = function(...) redis.call('echo', table.concat({...})); end
 
 redis.call('echo', ' ######## SUBSCRIBER UNREGISTER SCRIPT ####### ')
-local ch=('{channel:%s}'):format(id)
+local ch=('%s{channel:%s}'):format(ns, id)
 local keys = {
   channel =     ch,
   messages =    ch..':messages',
diff --git a/debian/modules/nchan/src/store/redis/scripts/testscripts.rb b/debian/modules/nchan/src/store/redis/redis-lua-scripts/testscripts.rb
similarity index 94%
rename from debian/modules/nchan/src/store/redis/scripts/testscripts.rb
rename to debian/modules/nchan/src/store/redis/redis-lua-scripts/testscripts.rb
index 27f4f9d4..739eb42a 100755
--- a/debian/modules/nchan/src/store/redis/scripts/testscripts.rb
+++ b/debian/modules/nchan/src/store/redis/redis-lua-scripts/testscripts.rb
@@ -12,6 +12,7 @@
 REDIS_HOST="127.0.0.1"
 REDIS_PORT=8537
 REDIS_DB=1
+NAMESPACE="nchan:"
 
 class PubSubTest < Minitest::Test
   @@redis=nil
@@ -121,14 +122,14 @@ def publish(*arg)
     end
 
     msg.time= Time.now.utc.to_i unless msg.time
-    msg_tag, channel_info=redis.evalsha hashes[:publish], [], [msg.chid, msg.time, msg.data, msg.content_type, msg.eventsource_event, msg.ttl, msg.max_buf_size]
+    msg_tag, channel_info=redis.evalsha hashes[:publish], [], [NAMESPACE, msg.chid, msg.time, msg.data, msg.content_type, msg.eventsource_event, msg.ttl, msg.max_buf_size]
     msg.tag=msg_tag
     msg.channel_info=channel_info
     return msg
   end
 
   def delete(ch_id)
-    redis.evalsha hashes[:delete], [], [ch_id]
+    redis.evalsha hashes[:delete], [], [NAMESPACE, ch_id]
   end
 
   def getmsg(msg, opt={})
@@ -146,7 +147,7 @@ def getmsg(msg, opt={})
     traverse_order=((Hash === opt) && opt[:getfirst]) ? 'FIFO' : 'FILO'
     msg_tag=0 if msg_time && msg_tag.nil?
     #binding.pry
-    status, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, msg_data, msg_content_type, msg_eventsource_event, subscriber_count = redis.evalsha hashes[:get_message], [], [ch_id, msg_time || 0, msg_tag || 0, traverse_order, 15 ]
+    status, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, msg_data, msg_content_type, msg_eventsource_event, subscriber_count = redis.evalsha hashes[:get_message], [], [NAMESPACE, ch_id, msg_time || 0, msg_tag || 0, traverse_order, 15 ]
     if status == 404
       return nil
     elsif status == 418 #not ready
diff --git a/debian/modules/nchan/src/store/redis/redis_lua_commands.c b/debian/modules/nchan/src/store/redis/redis_lua_commands.c
new file mode 100644
index 00000000..ed12b069
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/redis_lua_commands.c
@@ -0,0 +1,1036 @@
+#include "redis_lua_commands.h"
+
+redis_lua_scripts_t redis_lua_scripts = {
+  {"add_fakesub", "fd2ee193a2518982e607f99623c8200849b21098",
+   "--input:  keys: [], values: [namespace, channel_id, number, time]\n"
+   "--output: current_fake_subscribers\n"
+   "  \n"
+   "redis.call('echo', ' ####### FAKESUBS ####### ')\n"
+   "local ns=ARGV[1]\n"
+   "local id=ARGV[2]\n"
+   "local num=tonumber(ARGV[3])\n"
+   "local time = tonumber(ARGV[4])\n"
+   "if num==nil then\n"
+   "  return {err=\"fakesub number not given\"}\n"
+   "end\n"
+   "\n"
+   "local chan_key = ('%s{channel:%s}'):format(ns, id)\n"
+   "\n"
+   "local res = redis.pcall('EXISTS', chan_key)\n"
+   "if type(res) == \"table\" and res[\"err\"] then\n"
+   "  return {err = (\"CLUSTER KEYSLOT ERROR. %i %s\"):format(num, id)}\n"
+   "end\n"
+   "\n"
+   "local exists = res == 1\n"
+   "\n"
+   "local cur = 0\n"
+   "\n"
+   "if exists or (not exists and num > 0) then\n"
+   "  cur = redis.call('HINCRBY', chan_key, 'fake_subscribers', num)\n"
+   "  if time then\n"
+   "    redis.call('HSET', chan_key, 'last_seen_fake_subscriber', time)\n"
+   "  end\n"
+   "  if not exists then\n"
+   "    redis.call('EXPIRE', chan_key, 5) --something small\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "return cur\n"},
+
+  {"channel_keepalive", "7e213d514486887425875dc9835564edfe14e677",
+   "--input:  keys: [], values: [namespace, channel_id, ttl]\n"
+   "-- ttl is for when there are no messages but at least 1 subscriber.\n"
+   "--output: seconds until next keepalive is expected, or -1 for \"let it disappear\"\n"
+   "redis.call('ECHO', ' ####### CHANNEL KEEPALIVE ####### ')\n"
+   "local ns=ARGV[1]\n"
+   "local id=ARGV[2]\n"
+   "local ttl=tonumber(ARGV[3])\n"
+   "if not ttl then\n"
+   "  return {err=\"Invalid channel keepalive TTL (2nd arg)\"}\n"
+   "end\n"
+   "\n"
+   "local random_safe_next_ttl = function(ttl)\n"
+   "  return math.floor(ttl/2 + ttl/2.1 * math.random())\n"
+   "end\n"
+   "local ch = ('%s{channel:%s}'):format(ns, id)\n"
+   "local key={\n"
+   "  channel=   ch, --hash\n"
+   "  messages=  ch..':messages', --list\n"
+   "}\n"
+   "  \n"
+   "local subs_count = tonumber(redis.call('HGET', key.channel, \"subscribers\")) or 0\n"
+   "local msgs_count = tonumber(redis.call('LLEN', key.messages)) or 0\n"
+   "local actual_ttl = tonumber(redis.call('TTL',  key.channel))\n"
+   "\n"
+   "if subs_count > 0 then\n"
+   "  if msgs_count > 0 and actual_ttl > ttl then\n"
+   "    return random_safe_next_ttl(actual_ttl)\n"
+   "  end\n"
+   "  --refresh ttl\n"
+   "  redis.call('expire', key.channel, ttl);\n"
+   "  redis.call('expire', key.messages, ttl);\n"
+   "  return random_safe_next_ttl(ttl)\n"
+   "else\n"
+   "  return -1\n"
+   "end\n"},
+
+  {"delete", "a6008241827ea3bdec215b4460e96ad498cad8cb",
+   "--input: keys: [],  values: [ namespace, channel_id ]\n"
+   "--output: channel_hash {ttl, time_last_seen, subscribers, messages} or nil\n"
+   "-- delete this channel and all its messages\n"
+   "local ns = ARGV[1]\n"
+   "local id = ARGV[2]\n"
+   "local ch = ('%s{channel:%s}'):format(ns, id)\n"
+   "local key_msg=    ch..':msg:%s' --not finished yet\n"
+   "local key_channel=ch\n"
+   "local messages=   ch..':messages'\n"
+   "local subscribers=ch..':subscribers'\n"
+   "local pubsub=     ch..':pubsub'\n"
+   "\n"
+   "redis.call('echo', ' ####### DELETE #######')\n"
+   "local num_messages = 0\n"
+   "--delete all the messages right now mister!\n"
+   "local msg\n"
+   "while true do\n"
+   "  msg = redis.call('LPOP', messages)\n"
+   "  if msg then\n"
+   "    num_messages = num_messages + 1\n"
+   "    redis.call('DEL', key_msg:format(msg))\n"
+   "  else\n"
+   "    break\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "local del_msgpack =cmsgpack.pack({\"alert\", \"delete channel\", id})\n"
+   "for k,channel_key in pairs(redis.call('SMEMBERS', subscribers)) do\n"
+   "  redis.call('PUBLISH', channel_key, del_msgpack)\n"
+   "end\n"
+   "\n"
+   "local tohash=function(arr)\n"
+   "  if type(arr)~=\"table\" then\n"
+   "    return nil\n"
+   "  end\n"
+   "  local h = {}\n"
+   "  local k=nil\n"
+   "  for i, v in ipairs(arr) do\n"
+   "    if k == nil then\n"
+   "      k=v\n"
+   "    else\n"
+   "      h[k]=v; k=nil\n"
+   "    end\n"
+   "  end\n"
+   "  return h\n"
+   "end\n"
+   "\n"
+   "local channel = nil\n"
+   "if redis.call('EXISTS', key_channel) ~= 0 then\n"
+   "  channel = tohash(redis.call('hgetall', key_channel))\n"
+   "  --leave some crumbs behind showing this channel was just deleted\n"
+   "  redis.call('setex', ch..\":deleted\", 5, 1)  \n"
+   "end\n"
+   "\n"
+   "redis.call('DEL', key_channel, messages, subscribers)\n"
+   "redis.call('PUBLISH', pubsub, del_msgpack)\n"
+   "\n"
+   "if channel then\n"
+   "  return {\n"
+   "    tonumber(channel.ttl) or 0,\n"
+   "    tonumber(channel.last_seen_fake_subscriber) or 0,\n"
+   "    tonumber(channel.fake_subscribers or channel.subscribers) or 0,\n"
+   "    channel.current_message or \"\",\n"
+   "    tonumber(num_messages)\n"
+   "  }\n"
+   "else\n"
+   "  return nil\n"
+   "end\n"},
+
+  {"find_channel", "d027f1bc80eb1afc33f909759dfb7428cf1f9063",
+   "--input: keys: [],  values: [ namespace, channel_id ]\n"
+   "--output: channel_hash {ttl, time_last_seen, subscribers, last_channel_id, messages} or nil\n"
+   "-- finds and return the info hash of a channel, or nil of channel not found\n"
+   "local ns = ARGV[1]\n"
+   "local id = ARGV[2]\n"
+   "local channel_key = ('%s{channel:%s}'):format(ns, id)\n"
+   "local messages_key = channel_key..':messages'\n"
+   "\n"
+   "redis.call('echo', ' #######  FIND_CHANNEL ######## ')\n"
+   "\n"
+   "--check old entries\n"
+   "local oldestmsg=function(list_key, old_fmt)\n"
+   "  local old, oldkey\n"
+   "  local n, del=0,0\n"
+   "  while true do\n"
+   "    n=n+1\n"
+   "    old=redis.call('lindex', list_key, -1)\n"
+   "    if old then\n"
+   "      oldkey=old_fmt:format(old)\n"
+   "      local ex=redis.call('exists', oldkey)\n"
+   "      if ex==1 then\n"
+   "        return oldkey\n"
+   "      else\n"
+   "        redis.call('rpop', list_key)\n"
+   "        del=del+1\n"
+   "      end\n"
+   "    else\n"
+   "      break\n"
+   "    end\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "local tohash=function(arr)\n"
+   "  if type(arr)~=\"table\" then\n"
+   "    return nil\n"
+   "  end\n"
+   "  local h = {}\n"
+   "  local k=nil\n"
+   "  for i, v in ipairs(arr) do\n"
+   "    if k == nil then\n"
+   "      k=v\n"
+   "    else\n"
+   "      --dbg(k..\"=\"..v)\n"
+   "      h[k]=v; k=nil\n"
+   "    end\n"
+   "  end\n"
+   "  return h\n"
+   "end\n"
+   "\n"
+   "if redis.call('EXISTS', channel_key) ~= 0 then\n"
+   "  local ch = tohash(redis.call('hgetall', channel_key))\n"
+   "    \n"
+   "  local msgs_count\n"
+   "  if redis.call(\"TYPE\", messages_key)['ok'] == 'list' then\n"
+   "    oldestmsg(messages_key, channel_key ..':msg:%s')\n"
+   "    msgs_count = tonumber(redis.call('llen', messages_key))\n"
+   "  else\n"
+   "    msgs_count = 0\n"
+   "  end\n"
+   "  \n"
+   "  return {\n"
+   "    tonumber(ch.ttl) or 0,\n"
+   "    tonumber(ch.last_seen_fake_subscriber) or 0,\n"
+   "    tonumber(ch.fake_subscribers or ch.subscribers) or 0,\n"
+   "    ch.current_message or \"\",\n"
+   "    msgs_count\n"
+   "  }\n"
+   "else\n"
+   "  return nil\n"
+   "end\n"},
+
+  {"get_message", "fb9c46d33b3798a11d4eca6e0f7a3f92beba8685",
+   "--input:  keys: [], values: [namespace, channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl]\n"
+   "--output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, compression_type, channel_subscriber_count\n"
+   "-- no_msgid_order: 'FILO' for oldest message, 'FIFO' for most recent\n"
+   "-- create_channel_ttl - make new channel if it's absent, with ttl set to this. 0 to disable.\n"
+   "-- result_code can be: 200 - ok, 404 - not found, 410 - gone, 418 - not yet available\n"
+   "local ns, id, time, tag, subscribe_if_current = ARGV[1], ARGV[2], tonumber(ARGV[3]), tonumber(ARGV[4])\n"
+   "local no_msgid_order=ARGV[5]\n"
+   "local create_channel_ttl=tonumber(ARGV[6]) or 0\n"
+   "local msg_id\n"
+   "if time and time ~= 0 and tag then\n"
+   "  msg_id=(\"%s:%s\"):format(time, tag)\n"
+   "end\n"
+   "\n"
+   "if redis.replicate_commands then\n"
+   "  redis.replicate_commands()\n"
+   "end\n"
+   "\n"
+   "-- This script has gotten big and ugly, but there are a few good reasons \n"
+   "-- to keep it big and ugly. It needs to do a lot of stuff atomically, and \n"
+   "-- redis doesn't do includes. It could be generated pre-insertion into redis, \n"
+   "-- but then error messages become less useful, complicating debugging. If you \n"
+   "-- have a solution to this, please help.\n"
+   "local ch=('%s{channel:%s}'):format(ns, id)\n"
+   "local msgkey_fmt=ch..':msg:%s'\n"
+   "local key={\n"
+   "  next_message= msgkey_fmt, --hash\n"
+   "  message=      msgkey_fmt, --hash\n"
+   "  channel=      ch, --hash\n"
+   "  messages=     ch..':messages', --list\n"
+   "--  pubsub=       ch..':subscribers:', --set\n"
+   "}\n"
+   "\n"
+   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
+   "\n"
+   "redis.call('echo', ' #######  GET_MESSAGE ######## ')\n"
+   "\n"
+   "local oldestmsg=function(list_key, old_fmt)\n"
+   "  local old, oldkey\n"
+   "  local n, del=0,0\n"
+   "  while true do\n"
+   "    n=n+1\n"
+   "    old=redis.call('lindex', list_key, -1)\n"
+   "    if old then\n"
+   "      oldkey=old_fmt:format(old)\n"
+   "      local ex=redis.call('exists', oldkey)\n"
+   "      if ex==1 then\n"
+   "        return oldkey\n"
+   "      else\n"
+   "        redis.call('rpop', list_key)\n"
+   "        del=del+1\n"
+   "      end \n"
+   "    else\n"
+   "      --dbg(list_key, \" is empty\")\n"
+   "      break\n"
+   "    end\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "local tohash=function(arr)\n"
+   "  if type(arr)~=\"table\" then\n"
+   "    return nil\n"
+   "  end\n"
+   "  local h = {}\n"
+   "  local k=nil\n"
+   "  for i, v in ipairs(arr) do\n"
+   "    if k == nil then\n"
+   "      k=v\n"
+   "    else\n"
+   "      --dbg(k..\"=\"..v)\n"
+   "      h[k]=v; k=nil\n"
+   "    end\n"
+   "  end\n"
+   "  return h\n"
+   "end\n"
+   "\n"
+   "if no_msgid_order ~= 'FIFO' then\n"
+   "  no_msgid_order = 'FILO'\n"
+   "end\n"
+   "\n"
+   "local channel = tohash(redis.call('HGETALL', key.channel))\n"
+   "local new_channel = false\n"
+   "if next(channel) == nil then\n"
+   "  if create_channel_ttl==0 then\n"
+   "    return {404, nil}\n"
+   "  end\n"
+   "  redis.call('HSET', key.channel, 'time', time)\n"
+   "  redis.call('EXPIRE', key.channel, create_channel_ttl)\n"
+   "  channel = {time=time}\n"
+   "  new_channel = true\n"
+   "end\n"
+   "\n"
+   "local subs_count = tonumber(channel.subscribers)\n"
+   "\n"
+   "if msg_id==nil then\n"
+   "  local found_msg_key\n"
+   "  if new_channel then\n"
+   "    --dbg(\"new channel\")\n"
+   "    return {418, \"\", \"\", \"\", \"\", subs_count}\n"
+   "  else\n"
+   "    --dbg(\"no msg id given, ord=\"..no_msgid_order)\n"
+   "    \n"
+   "    if no_msgid_order == 'FIFO' then --most recent message\n"
+   "      --dbg(\"get most recent\")\n"
+   "      found_msg_key=channel.current_message\n"
+   "    elseif no_msgid_order == 'FILO' then --oldest message\n"
+   "      --dbg(\"get oldest\")\n"
+   "      found_msg_key=oldestmsg(key.messages, msgkey_fmt)\n"
+   "    end\n"
+   "    \n"
+   "    if found_msg_key == nil then\n"
+   "      --we await a message\n"
+   "      return {418, \"\", \"\", \"\", \"\", subs_count}\n"
+   "    else\n"
+   "      local msg=tohash(redis.call('HGETALL', found_msg_key))\n"
+   "      if not next(msg) then --empty\n"
+   "        return {404, \"\", \"\", \"\", \"\", subs_count}\n"
+   "      else\n"
+   "        --dbg((\"found msg %s:%s  after %s:%s\"):format(tostring(msg.time), tostring(msg.tag), tostring(time), tostring(tag)))\n"
+   "        local ttl = redis.call('TTL', found_msg_key)\n"
+   "        return {200, ttl, tonumber(msg.time) or \"\", tonumber(msg.tag) or \"\", tonumber(msg.prev_time) or \"\", tonumber(msg.prev_tag) or \"\", msg.data or \"\", msg.content_type or \"\", msg.eventsource_event or \"\", tonumber(msg.compression or 0), subs_count}\n"
+   "      end\n"
+   "    end\n"
+   "  end\n"
+   "else\n"
+   "  if msg_id and channel.current_message == msg_id\n"
+   "   or not channel.current_message then\n"
+   "    return {418, \"\", \"\", \"\", \"\", subs_count}\n"
+   "  end\n"
+   "\n"
+   "  key.message=key.message:format(msg_id)\n"
+   "  local msg=tohash(redis.call('HGETALL', key.message))\n"
+   "\n"
+   "  if next(msg) == nil then -- no such message. it might've expired, or maybe it was never there\n"
+   "    --dbg(\"MESSAGE NOT FOUND\")\n"
+   "    return {404, nil}\n"
+   "  end\n"
+   "\n"
+   "  local next_msg, next_msgtime, next_msgtag\n"
+   "  if not msg.next then --this should have been taken care of by the channel.current_message check\n"
+   "    --dbg(\"NEXT MESSAGE KEY NOT PRESENT. ERROR, ERROR!\")\n"
+   "    return {404, nil}\n"
+   "  else\n"
+   "    --dbg(\"NEXT MESSAGE KEY PRESENT: \" .. msg.next)\n"
+   "    key.next_message=key.next_message:format(msg.next)\n"
+   "    if redis.call('EXISTS', key.next_message)~=0 then\n"
+   "      local ntime, ntag, prev_time, prev_tag, ndata, ncontenttype, neventsource_event, ncompression=unpack(redis.call('HMGET', key.next_message, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event', 'compression'))\n"
+   "      local ttl = redis.call('TTL', key.next_message)\n"
+   "      --dbg((\"found msg2 %i:%i  after %i:%i\"):format(ntime, ntag, time, tag))\n"
+   "      return {200, ttl, tonumber(ntime) or \"\", tonumber(ntag) or \"\", tonumber(prev_time) or \"\", tonumber(prev_tag) or \"\", ndata or \"\", ncontenttype or \"\", neventsource_event or \"\", ncompression or 0, subs_count}\n"
+   "    else\n"
+   "      --dbg(\"NEXT MESSAGE NOT FOUND\")\n"
+   "      return {404, nil}\n"
+   "    end\n"
+   "  end\n"
+   "end\n"},
+
+  {"get_message_from_key", "304efcd42590f99e0016686572530defd3de1383",
+   "--input:  keys: [message_key], values: []\n"
+   "--output: msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, compression, channel_subscriber_count\n"
+   "local key = KEYS[1]\n"
+   "\n"
+   "local ttl = redis.call('TTL', key)\n"
+   "local time, tag, prev_time, prev_tag, data, content_type, es_event, compression = unpack(redis.call('HMGET', key, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event', 'compression'))\n"
+   "\n"
+   "return {ttl, time, tag, prev_time or 0, prev_tag or 0, data or \"\", content_type or \"\", es_event or \"\", tonumber(compression or 0)}\n"},
+
+  {"publish", "be28281114137d8e85a25a913c50bed2e93d0c7d",
+   "--input:  keys: [], values: [namespace, channel_id, time, message, content_type, eventsource_event, compression_setting, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff, optimize_target]\n"
+   "--output: channel_hash {ttl, time_last_subscriber_seen, subscribers, last_message_id, messages}, channel_created_just_now?\n"
+   "\n"
+   "local ns, id=ARGV[1], ARGV[2]\n"
+   "\n"
+   "local msg = {}\n"
+   "\n"
+   "local store_at_most_n_messages = tonumber(ARGV[9])\n"
+   "if store_at_most_n_messages == nil or store_at_most_n_messages == \"\" then\n"
+   "  return {err=\"Argument 9, max_msg_buf_size, can't be empty\"}\n"
+   "end\n"
+   "if store_at_most_n_messages == 0 then\n"
+   "  msg.unbuffered = 1\n"
+   "end\n"
+   "\n"
+   "local msgpacked_pubsub_cutoff = tonumber(ARGV[10])\n"
+   "\n"
+   "local optimize_target = tonumber(ARGV[11]) == 2 and \"bandwidth\" or \"cpu\"\n"
+   "\n"
+   "local time\n"
+   "if optimize_target == \"cpu\" and redis.replicate_commands then\n"
+   "  -- we're on redis >= 3.2. We can use We can use 'script effects replication' to allow\n"
+   "  -- writing nondeterministic command values like TIME.\n"
+   "  -- That's exactly what we want to do, use Redis' TIME rather than the given time from Nginx\n"
+   "  -- Also, it's more efficient to replicate just the commands in this case rather than run the whole script\n"
+   "  redis.replicate_commands()\n"
+   "  time = tonumber(redis.call('TIME')[1])\n"
+   "else\n"
+   "  --fallback to the provided time\n"
+   "  time = tonumber(ARGV[3])\n"
+   "end\n"
+   "\n"
+   "msg.id=nil\n"
+   "msg.data= ARGV[4]\n"
+   "msg.content_type=ARGV[5]\n"
+   "msg.eventsource_event=ARGV[6]\n"
+   "msg.compression=tonumber(ARGV[7])\n"
+   "msg.ttl= tonumber(ARGV[8])\n"
+   "msg.time= time\n"
+   "msg.tag= 0\n"
+   "\n"
+   "if msg.ttl == 0 then\n"
+   "  msg.ttl = 126144000 --4 years\n"
+   "end\n"
+   "\n"
+   "--[[local dbg = function(...)\n"
+   "  local arg = {...}\n"
+   "  for i = 1, #arg do\n"
+   "    arg[i]=tostring(arg[i])\n"
+   "  end\n"
+   "  redis.call('echo', table.concat(arg, \", \"))\n"
+   "end]]\n"
+   "\n"
+   "if type(msg.content_type)=='string' and msg.content_type:find(':') then\n"
+   "  return {err='Message content-type cannot contain \":\" character.'}\n"
+   "end\n"
+   "\n"
+   "redis.call('echo', ' #######  PUBLISH   ######## ')\n"
+   "\n"
+   "-- sets all fields for a hash from a dictionary\n"
+   "local hmset = function (key, dict)\n"
+   "  if next(dict) == nil then return nil end\n"
+   "  local bulk = {}\n"
+   "  for k, v in pairs(dict) do\n"
+   "    table.insert(bulk, k)\n"
+   "    table.insert(bulk, v)\n"
+   "  end\n"
+   "  return redis.call('HMSET', key, unpack(bulk))\n"
+   "end\n"
+   "\n"
+   "local tohash=function(arr)\n"
+   "  if type(arr)~=\"table\" then\n"
+   "    return nil\n"
+   "  end\n"
+   "  local h = {}\n"
+   "  local k=nil\n"
+   "  for i, v in ipairs(arr) do\n"
+   "    if k == nil then\n"
+   "      k=v\n"
+   "    else\n"
+   "      h[k]=v; k=nil\n"
+   "    end\n"
+   "  end\n"
+   "  return h\n"
+   "end\n"
+   "\n"
+   "local ch = ('%s{channel:%s}'):format(ns, id)\n"
+   "local msg_fmt = ch..':msg:%s'\n"
+   "local key={\n"
+   "  last_message= msg_fmt, --not finished yet\n"
+   "  message=      msg_fmt, --not finished yet\n"
+   "  channel=      ch,\n"
+   "  messages=     ch..':messages',\n"
+   "  subscribers=  ch..':subscribers'\n"
+   "}\n"
+   "local channel_pubsub = ch..':pubsub'\n"
+   "\n"
+   "local new_channel\n"
+   "local channel\n"
+   "if redis.call('EXISTS', key.channel) ~= 0 then\n"
+   "  channel=tohash(redis.call('HGETALL', key.channel))\n"
+   "  channel.max_stored_messages = tonumber(channel.max_stored_messages)\n"
+   "end\n"
+   "\n"
+   "if channel~=nil then\n"
+   "  --dbg(\"channel present\")\n"
+   "  if channel.current_message ~= nil then\n"
+   "    --dbg(\"channel current_message present\")\n"
+   "    key.last_message=key.last_message:format(channel.current_message, id)\n"
+   "  else\n"
+   "    --dbg(\"channel current_message absent\")\n"
+   "    key.last_message=nil\n"
+   "  end\n"
+   "  new_channel=false\n"
+   "else\n"
+   "  --dbg(\"channel missing\")\n"
+   "  channel={}\n"
+   "  new_channel=true\n"
+   "  key.last_message=nil\n"
+   "end\n"
+   "\n"
+   "--set new message id\n"
+   "local lastmsg, lasttime, lasttag\n"
+   "if key.last_message then\n"
+   "  lastmsg = redis.call('HMGET', key.last_message, 'time', 'tag')\n"
+   "  lasttime, lasttag = tonumber(lastmsg[1]), tonumber(lastmsg[2])\n"
+   "  --dbg(\"New message id: last_time \", lasttime, \" last_tag \", lasttag, \" msg_time \", msg.time)\n"
+   "  if lasttime and tonumber(lasttime) > tonumber(msg.time) then\n"
+   "    redis.log(redis.LOG_WARNING, \"Nchan: message for \" .. id .. \" arrived a little late and may be delivered out of order. Redis must be very busy, or the Nginx servers do not have their times synchronized.\")\n"
+   "    msg.time = lasttime\n"
+   "    time = lasttime\n"
+   "  end\n"
+   "  if lasttime and lasttime==msg.time then\n"
+   "    msg.tag=lasttag+1\n"
+   "  end\n"
+   "  msg.prev_time = lasttime\n"
+   "  msg.prev_tag = lasttag\n"
+   "else\n"
+   "  msg.prev_time = 0\n"
+   "  msg.prev_tag = 0\n"
+   "end\n"
+   "msg.id=('%i:%i'):format(msg.time, msg.tag)\n"
+   "\n"
+   "key.message=key.message:format(msg.id)\n"
+   "if redis.call('EXISTS', key.message) ~= 0 then\n"
+   "  local hash_tostr=function(h)\n"
+   "    local tt = {}\n"
+   "    for k, v in pairs(h) do\n"
+   "      table.insert(tt, (\"%s: %s\"):format(k, v))\n"
+   "    end\n"
+   "    return \"{\" .. table.concat(tt,\", \") .. \"}\"\n"
+   "  end\n"
+   "  local existing_msg = tohash(redis.call('HGETALL', key.message))\n"
+   "  local errmsg = \"Message %s for channel %s id %s already exists. time: %s lasttime: %s lasttag: %s. dbg: channel: %s, messages_key: %s, msglist: %s, msg: %s, msg_expire: %s.\"\n"
+   "  errmsg = errmsg:format(key.message, id, msg.id or \"-\", time or \"-\", lasttime or \"-\", lasttag or \"-\", hash_tostr(channel), key.messages, \"[\"..table.concat(redis.call('LRANGE', key.messages, 0, -1), \", \")..\"]\", hash_tostr(existing_msg), redis.call('TTL', key.message))\n"
+   "  return {err=errmsg}\n"
+   "end\n"
+   "\n"
+   "msg.prev=channel.current_message\n"
+   "if key.last_message and redis.call('exists', key.last_message) == 1 then\n"
+   "  redis.call('HSET', key.last_message, 'next', msg.id)\n"
+   "end\n"
+   "\n"
+   "--update channel\n"
+   "redis.call('HSET', key.channel, 'current_message', msg.id)\n"
+   "if msg.prev then\n"
+   "  redis.call('HSET', key.channel, 'prev_message', msg.prev)\n"
+   "end\n"
+   "if time then\n"
+   "  redis.call('HSET', key.channel, 'time', time)\n"
+   "end\n"
+   "\n"
+   "local message_len_changed = false\n"
+   "if channel.max_stored_messages ~= store_at_most_n_messages then\n"
+   "  channel.max_stored_messages = store_at_most_n_messages\n"
+   "  message_len_changed = true\n"
+   "  redis.call('HSET', key.channel, 'max_stored_messages', store_at_most_n_messages)\n"
+   "  --dbg(\"channel.max_stored_messages was not set, but is now \", store_at_most_n_messages)\n"
+   "end\n"
+   "\n"
+   "--write message\n"
+   "hmset(key.message, msg)\n"
+   "\n"
+   "\n"
+   "--check old entries\n"
+   "local oldestmsg=function(list_key, old_fmt)\n"
+   "  local old, oldkey\n"
+   "  local n, del=0,0\n"
+   "  while true do\n"
+   "    n=n+1\n"
+   "    old=redis.call('lindex', list_key, -1)\n"
+   "    if old then\n"
+   "      oldkey=old_fmt:format(old)\n"
+   "      local ex=redis.call('exists', oldkey)\n"
+   "      if ex==1 then\n"
+   "        return oldkey\n"
+   "      else\n"
+   "        redis.call('rpop', list_key)\n"
+   "        del=del+1\n"
+   "      end\n"
+   "    else\n"
+   "      break\n"
+   "    end\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "local max_stored_msgs = channel.max_stored_messages or -1\n"
+   "\n"
+   "if max_stored_msgs < 0 then --no limit\n"
+   "  oldestmsg(key.messages, msg_fmt)\n"
+   "  redis.call('LPUSH', key.messages, msg.id)\n"
+   "elseif max_stored_msgs > 0 then\n"
+   "  local stored_messages = tonumber(redis.call('LLEN', key.messages))\n"
+   "  redis.call('LPUSH', key.messages, msg.id)\n"
+   "  -- Reduce the message length if necessary\n"
+   "  local dump_message_ids = redis.call('LRANGE', key.messages, max_stored_msgs, stored_messages);\n"
+   "  if dump_message_ids then\n"
+   "    for _, msgid in ipairs(dump_message_ids) do\n"
+   "      redis.call('DEL', msg_fmt:format(msgid))\n"
+   "    end\n"
+   "  end\n"
+   "  redis.call('LTRIM', key.messages, 0, max_stored_msgs - 1)\n"
+   "  oldestmsg(key.messages, msg_fmt)\n"
+   "end\n"
+   "\n"
+   "\n"
+   "--set expiration times for all the things\n"
+   "local channel_ttl = tonumber(redis.call('TTL',  key.channel))\n"
+   "redis.call('EXPIRE', key.message, msg.ttl)\n"
+   "if msg.ttl + 1 > channel_ttl then -- a little extra time for failover weirdness for 1-second TTL messages\n"
+   "  redis.call('EXPIRE', key.channel, msg.ttl + 1)\n"
+   "  redis.call('EXPIRE', key.messages, msg.ttl + 1)\n"
+   "  redis.call('EXPIRE', key.subscribers, msg.ttl + 1)\n"
+   "end\n"
+   "\n"
+   "--publish message\n"
+   "local unpacked\n"
+   "\n"
+   "if msg.unbuffered or #msg.data < msgpacked_pubsub_cutoff then\n"
+   "  unpacked= {\n"
+   "    \"msg\",\n"
+   "    msg.ttl or 0,\n"
+   "    msg.time,\n"
+   "    tonumber(msg.tag) or 0,\n"
+   "    (msg.unbuffered and 0 or msg.prev_time) or 0,\n"
+   "    (msg.unbuffered and 0 or msg.prev_tag) or 0,\n"
+   "    msg.data or \"\",\n"
+   "    msg.content_type or \"\",\n"
+   "    msg.eventsource_event or \"\",\n"
+   "    msg.compression or 0\n"
+   "  }\n"
+   "else\n"
+   "  unpacked= {\n"
+   "    \"msgkey\",\n"
+   "    msg.time,\n"
+   "    tonumber(msg.tag) or 0,\n"
+   "    key.message\n"
+   "  }\n"
+   "end\n"
+   "\n"
+   "if message_len_changed then\n"
+   "  unpacked[1] = \"max_msgs+\" .. unpacked[1]\n"
+   "  table.insert(unpacked, 2, tonumber(channel.max_stored_messages))\n"
+   "end\n"
+   "\n"
+   "local msgpacked\n"
+   "\n"
+   "--dbg((\"Stored message with id %i:%i => %s\"):format(msg.time, msg.tag, msg.data))\n"
+   "\n"
+   "--we used to publish conditionally on subscribers on the Redis pubsub channel\n"
+   "--but now that we're subscribing to slaves this is not possible\n"
+   "--so just PUBLISH always.\n"
+   "msgpacked = cmsgpack.pack(unpacked)\n"
+   "redis.call('PUBLISH', channel_pubsub, msgpacked)\n"
+   "\n"
+   "local num_messages = redis.call('llen', key.messages)\n"
+   "\n"
+   "--dbg(\"channel \", id, \" ttl: \",channel.ttl, \", subscribers: \", channel.subscribers, \"(fake: \", channel.fake_subscribers or \"nil\", \"), messages: \", num_messages)\n"
+   "local ch = {\n"
+   "  tonumber(channel.ttl or msg.ttl),\n"
+   "  tonumber(channel.last_seen_fake_subscriber) or 0,\n"
+   "  tonumber(channel.fake_subscribers or channel.subscribers) or 0,\n"
+   "  msg.time and msg.time and (\"%i:%i\"):format(msg.time, msg.tag) or \"\",\n"
+   "  tonumber(num_messages)\n"
+   "}\n"
+   "\n"
+   "return {ch, new_channel}\n"},
+
+  {"publish_status", "2f2ce1443b22c8c9cf069d5588bad4bab58d70aa",
+   "--input:  keys: [], values: [namespace, channel_id, status_code]\n"
+   "--output: current_subscribers\n"
+   "\n"
+   "redis.call('echo', ' ####### PUBLISH STATUS ####### ')\n"
+   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
+   "local ns, id=ARGV[1], ARGV[2]\n"
+   "local code=tonumber(ARGV[3])\n"
+   "if code==nil then\n"
+   "  return {err=\"non-numeric status code given, bailing!\"}\n"
+   "end\n"
+   "\n"
+   "local pubmsg = \"status:\"..code\n"
+   "local ch = ('%s{channel:%s}'):format(ns, id)\n"
+   "local subs_key = ch..':subscribers'\n"
+   "local chan_key = ch\n"
+   "--local channel_pubsub = ch..':pubsub'\n"
+   "\n"
+   "for k,channel_key in pairs(redis.call('SMEMBERS', subs_key)) do\n"
+   "  --not efficient, but useful for a few short-term subscriptions\n"
+   "  redis.call('PUBLISH', channel_key, pubmsg)\n"
+   "end\n"
+   "--clear short-term subscriber list\n"
+   "redis.call('DEL', subs_key)\n"
+   "--now publish to the efficient channel\n"
+   "--what?... redis.call('PUBLISH', channel_pubsub, pubmsg)\n"
+   "return redis.call('HGET', chan_key, 'subscribers') or 0\n"},
+
+  {"rsck", "2fca046fa783d6cc25e493c993c407e59998e6e8",
+   "--redis-store consistency check\n"
+   "local ns = ARGV[1]\n"
+   "if ns and #ns > 0 then\n"
+   "  ns = ns..\":\"\n"
+   "end\n"
+   "\n"
+   "local concat = function(...)\n"
+   "  local arg = {...}\n"
+   "  for i = 1, #arg do\n"
+   "    arg[i]=tostring(arg[i])\n"
+   "  end\n"
+   "  return table.concat(arg, \" \")\n"
+   "end\n"
+   "local dbg =function(...) redis.call('echo', concat(...)); end\n"
+   "local errors={}\n"
+   "local err = function(...)\n"
+   "  local msg = concat(...)\n"
+   "  dbg(msg)\n"
+   "  table.insert(errors, msg)\n"
+   "end\n"
+   "\n"
+   "local tp=function(t, max_n)\n"
+   "  local tt={}\n"
+   "  for i, v in pairs(t) do\n"
+   "    local val = tostring(v)\n"
+   "    if max_n and #val > max_n then\n"
+   "      val = val:sub(1, max_n) .. \"[...]\"\n"
+   "    end\n"
+   "    table.insert(tt, tostring(i) .. \": \" .. val)\n"
+   "  end\n"
+   "  return \"{\" .. table.concat(tt, \", \") .. \"}\"\n"
+   "end\n"
+   "\n"
+   "local tohash=function(arr)\n"
+   "  if type(arr)~=\"table\" then\n"
+   "    return nil\n"
+   "  end\n"
+   "  local h = {}\n"
+   "  local k=nil\n"
+   "  for i, v in ipairs(arr) do\n"
+   "    if k == nil then\n"
+   "      k=v\n"
+   "    else\n"
+   "      h[k]=v; k=nil\n"
+   "    end\n"
+   "  end\n"
+   "  return h\n"
+   "end\n"
+   "local type_is = function(key, _type, description)\n"
+   "  local t = redis.call(\"TYPE\", key)['ok']\n"
+   "  local type_ok = true\n"
+   "  if type(_type) == \"table\" then\n"
+   "    type_ok = false\n"
+   "    for i, v in pairs(_type) do\n"
+   "      if v == _type then\n"
+   "        type_ok = true\n"
+   "        break\n"
+   "      end\n"
+   "    end\n"
+   "  elseif t ~= _type then\n"
+   "    err((description or \"\"), key, \"should be type \" .. _type .. \", is\", t)\n"
+   "    type_ok = false\n"
+   "  end\n"
+   "  return type_ok, t\n"
+   "end\n"
+   "\n"
+   "local known_msgs_count=0\n"
+   "local known_msgkeys = {}\n"
+   "local known_channel_keys = {}\n"
+   "\n"
+   "\n"
+   "local k = {\n"
+   "  channel = function(chid)\n"
+   "    return (\"%s{channel:%s}\"):format(chid)\n"
+   "  end,\n"
+   "  msg = function (chid, msgid)\n"
+   "    return (\"%s:msg:%s\"):format(k.channel(chid), msgid)\n"
+   "  end,\n"
+   "  messages = function(chid)\n"
+   "    return k.channel(chid) .. \":messages\"\n"
+   "  end\n"
+   "}\n"
+   "\n"
+   "local check_msg = function(chid, msgid, prev_msgid, next_msgid, description)\n"
+   "  description = description and \"msg (\" .. description ..\")\" or \"msg\"\n"
+   "  local msgkey = k.msg(chid, msgid)\n"
+   "  if not known_msgkeys[msgkey] then\n"
+   "    known_msgs_count = known_msgs_count + 1\n"
+   "  end\n"
+   "  known_msgkeys[msgkey]=true\n"
+   "  local ok, t = type_is(msgkey, {\"hash\", \"none\"}, \"message hash\")\n"
+   "  if t == \"none\" then\n"
+   "    --message is missing, but maybe it expired under normal circumstances. \n"
+   "    --check if any earlier messages are present\n"
+   "    local msgids = redis.call('LRANGE', k.messages(chid), 0, -1)\n"
+   "    local founds = 0\n"
+   "    for i=#msgids, 1, -1 do\n"
+   "      if msgids[i] == msgid then \n"
+   "        break\n"
+   "      end\n"
+   "      local thismsgkey = k.msg(chid, msgids[i])\n"
+   "      local ttt = redis.call('type', thismsgkey)['ok']\n"
+   "      redis.breakpoint()\n"
+   "      if ttt == \"hash\" then\n"
+   "        founds = founds + 1\n"
+   "      end\n"
+   "    end\n"
+   "    \n"
+   "    if founds > 0 then\n"
+   "      err(\"message\", msgkey, \"missing, with\", founds, \"prev. msgs in msg list\")\n"
+   "    end\n"
+   "    \n"
+   "  end\n"
+   "  local msg = tohash(redis.call('HGETALL', msgkey))\n"
+   "  local ttl = tonumber(redis.call('TTL', msgkey))\n"
+   "  local n = tonumber(redis.call(\"HLEN\", msgkey))\n"
+   "  if n > 0 and (msg.data == nil or msg.id == nil or msg.time == nil or msg.tag == nil)then\n"
+   "    err(\"incomplete \" .. description ..\"(ttl \"..ttl..\")\", msgkey, tp(msg))\n"
+   "    return false\n"
+   "  end\n"
+   "  if t == \"hash\" and tonumber(ttl) < 0 then\n"
+   "    err(\"message\", msgkey, \"ttl =\", ttl)\n"
+   "  end\n"
+   "  if ttl ~= -2 then\n"
+   "    if prev_msgid ~= false and msg.prev ~= prev_msgid then\n"
+   "      err(description, chid, msgid, \"prev_message wrong. expected\", prev_msgid, \"got\", msg.prev)\n"
+   "    end\n"
+   "    if next_msgid ~= false and msg.next ~= next_msgid then\n"
+   "      err(description, chid, msgid, \"next_message wrong. expected\", next_msgid, \"got\", msg.next)\n"
+   "    end\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "local check_channel = function(id)\n"
+   "  local key={\n"
+   "    ch = k.channel(id),\n"
+   "    msgs = k.messages(id)\n"
+   "  }\n"
+   "  \n"
+   "  local ok, chkey_type = type_is(key.ch, \"hash\", \"channel hash\")\n"
+   "  if not ok then\n"
+   "    if chkey_type ~= \"none\" then\n"
+   "      err(\"unecpected channel key\", key.ch, \"type:\", chkey_type);\n"
+   "    end\n"
+   "    return false\n"
+   "  end\n"
+   "  local _, msgs_list_type = type_is(key.msgs, {\"list\", \"none\"}, \"channel messages list\")\n"
+   "  \n"
+   "  local ch = tohash(redis.call('HGETALL', key.ch))\n"
+   "  local len = tonumber(redis.call(\"HLEN\", key.ch))\n"
+   "  local ttl = tonumber(redis.call('TTL',  key.ch))\n"
+   "  if not ch.current_message or not ch.time then\n"
+   "    if msgs_list_type == \"list\" then\n"
+   "      err(\"incomplete channel (ttl \" .. ttl ..\")\", key.ch, tp(ch))\n"
+   "    end  \n"
+   "  elseif (ch.current_message or ch.prev_message) and msgs_list_type ~= \"list\" then\n"
+   "    err(\"channel\", key.ch, \"has a current_message but no message list\")\n"
+   "  end\n"
+   "  \n"
+   "  local msgids = redis.call('LRANGE', key.msgs, 0, -1)\n"
+   "  for i, msgid in ipairs(msgids) do\n"
+   "    check_msg(id, msgid, msgids[i+1], msgids[i-1], \"msglist\")\n"
+   "  end\n"
+   "  \n"
+   "  if ch.prev_message then\n"
+   "    if redis.call('LINDEX', key.msgs, 1) ~= ch.prev_message then\n"
+   "      err(\"channel\", key.ch, \"prev_message doesn't correspond to\", key.msgs, \"second list element\")\n"
+   "    end\n"
+   "    check_msg(id, ch.prev_message, false, ch.current_message, \"channel prev_message\")\n"
+   "  end\n"
+   "  if ch.current_message then\n"
+   "    if redis.call('LINDEX', key.msgs, 0) ~= ch.current_message then\n"
+   "      err(\"channel\", key.ch, \"current_message doesn't correspond to\", key.msgs, \"first list element\")\n"
+   "    end\n"
+   "    check_msg(id, ch.current_message, ch.prev_message, false, \"channel current_message\")\n"
+   "  end\n"
+   "  \n"
+   "end\n"
+   "\n"
+   "local channel_ids = {}\n"
+   "\n"
+   "for i, chkey in ipairs(redis.call(\"KEYS\", k.channel(\"*\"))) do\n"
+   "  local msgs_chid_match = chkey:match(\"^\"..k.messages(\"*\"))\n"
+   "  if msgs_chid_match then\n"
+   "    type_is(k.channel(msgs_chid_match), \"hash\", \"channel messages' corresponding hash key\")\n"
+   "  elseif not chkey:match(\":msg$\") then\n"
+   "    table.insert(channel_ids, chkey);\n"
+   "    known_channel_keys[chkey] = true\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "dbg(\"found\", #channel_ids, \"channels\")\n"
+   "for i, chkey in ipairs(channel_ids) do\n"
+   "  local chid = chkey:match(\"^\" .. k.channel(\".*\"))\n"
+   "  check_channel(chid)\n"
+   "end\n"
+   "\n"
+   "for i, msgkey in ipairs(redis.call(\"KEYS\", k.channel(\"*\")..\":msg\")) do\n"
+   "  if not known_msgkeys[msgkey] then\n"
+   "    local ok, t = type_is(msgkey, \"hash\")\n"
+   "    if ok then\n"
+   "      if not redis.call('HGET', msgkey, 'unbuffered') then\n"
+   "        err(\"orphan message\", msgkey, \"(ttl: \" .. redis.call('TTL', msgkey) .. \")\", tp(tohash(redis.call('HGETALL', msgkey)), 15))\n"
+   "      end\n"
+   "    else\n"
+   "      err(\"orphan message\", msgkey, \"wrong type\", t) \n"
+   "    end\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "if errors then\n"
+   "  table.insert(errors, 1, concat(#channel_ids, \"channels,\",known_msgs_count,\"messages found\", #errors, \"problems\"))\n"
+   "  return errors\n"
+   "else\n"
+   "  return concat(#channel_ids, \"channels,\", known_msgs_count, \"messages, all ok\")\n"
+   "end\n"},
+
+  {"subscriber_register", "0418d941e41ce9d8cb938860fd340d85c121d4cc",
+   "--input: keys: [], values: [namespace, channel_id, subscriber_id, active_ttl, time, want_channel_settings]\n"
+   "--  'subscriber_id' can be '-' for new id, or an existing id\n"
+   "--  'active_ttl' is channel ttl with non-zero subscribers. -1 to persist, >0 ttl in sec\n"
+   "--output: subscriber_id, num_current_subscribers, next_keepalive_time, channel_buffer_length\n"
+   "--  'channel_buffer_length' is returned only if want_channel_settings is 1\n"
+   "\n"
+   "local ns, id, sub_id, active_ttl, time = ARGV[1], ARGV[2], ARGV[3], tonumber(ARGV[4]) or 20, tonumber(ARGV[5])\n"
+   "local want_channel_settings = tonumber(ARGV[6]) == 1\n"
+   "\n"
+   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
+   "\n"
+   "redis.call('echo', ' ######## SUBSCRIBER REGISTER SCRIPT ####### ')\n"
+   "local ch=(\"%s{channel:%s}\"):format(ns, id)\n"
+   "local keys = {\n"
+   "  channel =     ch,\n"
+   "  messages =    ch..':messages',\n"
+   "  subscribers = ch..':subscribers'\n"
+   "}\n"
+   "\n"
+   "local setkeyttl=function(ttl)\n"
+   "  for i,v in pairs(keys) do\n"
+   "    if ttl > 0 then\n"
+   "      redis.call('expire', v, ttl)\n"
+   "    else\n"
+   "      redis.call('persist', v)\n"
+   "    end\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "local random_safe_next_ttl = function(ttl)\n"
+   "  return math.floor(ttl/2 + ttl/2.1 * math.random())\n"
+   "end\n"
+   "\n"
+   "local sub_count\n"
+   "\n"
+   "if sub_id == \"-\" then\n"
+   "  sub_id = tonumber(redis.call('HINCRBY', keys.channel, \"last_subscriber_id\", 1))\n"
+   "  sub_count=tonumber(redis.call('hincrby', keys.channel, 'subscribers', 1))\n"
+   "else\n"
+   "  sub_count=tonumber(redis.call('hget', keys.channel, 'subscribers'))\n"
+   "end\n"
+   "if time then\n"
+   "  redis.call('hset', keys.channel, \"last_seen_subscriber\", time)\n"
+   "end\n"
+   "\n"
+   "local next_keepalive \n"
+   "local actual_ttl = tonumber(redis.call('ttl', keys.channel))\n"
+   "if actual_ttl < active_ttl then\n"
+   "  setkeyttl(active_ttl)\n"
+   "  next_keepalive = random_safe_next_ttl(active_ttl)\n"
+   "else\n"
+   "  next_keepalive = random_safe_next_ttl(actual_ttl)\n"
+   "end\n"
+   "\n"
+   "\n"
+   "local ret = {sub_id, sub_count, next_keepalive}\n"
+   "if want_channel_settings then\n"
+   "  local max_messages = tonumber(redis.call('hget', keys.channel, 'max_stored_messages'))\n"
+   "  table.insert(ret, max_messages)\n"
+   "end\n"
+   "\n"
+   "return ret\n"},
+
+  {"subscriber_unregister", "a98e07b21485951a7d34cf80736e53db1b6e87a6",
+   "--input: keys: [], values: [namespace, channel_id, subscriber_id, empty_ttl]\n"
+   "-- 'subscriber_id' is an existing id\n"
+   "-- 'empty_ttl' is channel ttl when without subscribers. 0 to delete immediately, -1 to persist, >0 ttl in sec\n"
+   "--output: subscriber_id, num_current_subscribers\n"
+   "\n"
+   "local ns, id, sub_id, empty_ttl = ARGV[1], ARGV[2], ARGV[3], tonumber(ARGV[4]) or 20\n"
+   "\n"
+   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
+   "\n"
+   "redis.call('echo', ' ######## SUBSCRIBER UNREGISTER SCRIPT ####### ')\n"
+   "local ch=('%s{channel:%s}'):format(ns, id)\n"
+   "local keys = {\n"
+   "  channel =     ch,\n"
+   "  messages =    ch..':messages',\n"
+   "  subscribers = ch..':subscribers',\n"
+   "}\n"
+   "\n"
+   "local setkeyttl=function(ttl)\n"
+   "  for i,v in pairs(keys) do\n"
+   "    if ttl > 0 then\n"
+   "      redis.call('expire', v, ttl)\n"
+   "    elseif ttl < 0 then\n"
+   "      redis.call('persist', v)\n"
+   "    else\n"
+   "      redis.call('del', v)\n"
+   "    end\n"
+   "  end\n"
+   "end\n"
+   "\n"
+   "local sub_count = 0\n"
+   "\n"
+   "local res = redis.pcall('EXISTS', keys.channel)\n"
+   "if type(res) == \"table\" and res[\"err\"] then\n"
+   "  return {err = (\"CLUSTER KEYSLOT ERROR. %i %s\"):format(empty_ttl, id)}\n"
+   "end\n"
+   "\n"
+   "if res ~= 0 then\n"
+   "   sub_count = redis.call('hincrby', keys.channel, 'subscribers', -1)\n"
+   "\n"
+   "  if sub_count == 0 and tonumber(redis.call('LLEN', keys.messages)) == 0 then\n"
+   "    setkeyttl(empty_ttl)\n"
+   "  elseif sub_count < 0 then\n"
+   "    return {err=\"Subscriber count for channel \" .. id .. \" less than zero: \" .. sub_count}\n"
+   "  end\n"
+   "else\n"
+   "  --dbg(\"channel \", id, \" already gone\")\n"
+   "end\n"
+   "\n"
+   "return {sub_id, sub_count}\n"}
+};
+const int redis_lua_scripts_count=11;
diff --git a/debian/modules/nchan/src/store/redis/redis_lua_commands.h b/debian/modules/nchan/src/store/redis/redis_lua_commands.h
index 6f4477db..76fb7b95 100644
--- a/debian/modules/nchan/src/store/redis/redis_lua_commands.h
+++ b/debian/modules/nchan/src/store/redis/redis_lua_commands.h
@@ -8,1029 +8,62 @@ typedef struct {
 } redis_lua_script_t;
 
 typedef struct {
-  //input:  keys: [], values: [channel_id, number]
+  //input:  keys: [], values: [namespace, channel_id, number, time]
   //output: current_fake_subscribers
   redis_lua_script_t add_fakesub;
 
-  //input:  keys: [], values: [channel_id, ttl]
+  //input:  keys: [], values: [namespace, channel_id, ttl]
   // ttl is for when there are no messages but at least 1 subscriber.
   //output: seconds until next keepalive is expected, or -1 for "let it disappear"
   redis_lua_script_t channel_keepalive;
 
-  //input: keys: [],  values: [ channel_id ]
+  //input: keys: [],  values: [ namespace, channel_id ]
   //output: channel_hash {ttl, time_last_seen, subscribers, messages} or nil
   // delete this channel and all its messages
   redis_lua_script_t delete;
 
-  //input: keys: [],  values: [ channel_id ]
-  //output: channel_hash {ttl, time_last_seen, subscribers, messages} or nil
+  //input: keys: [],  values: [ namespace, channel_id ]
+  //output: channel_hash {ttl, time_last_seen, subscribers, last_channel_id, messages} or nil
   // finds and return the info hash of a channel, or nil of channel not found
   redis_lua_script_t find_channel;
 
-  //input:  keys: [], values: [channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl]
-  //output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, channel_subscriber_count
+  //input:  keys: [], values: [namespace, channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl]
+  //output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, compression_type, channel_subscriber_count
   // no_msgid_order: 'FILO' for oldest message, 'FIFO' for most recent
   // create_channel_ttl - make new channel if it's absent, with ttl set to this. 0 to disable.
   // result_code can be: 200 - ok, 404 - not found, 410 - gone, 418 - not yet available
   redis_lua_script_t get_message;
 
   //input:  keys: [message_key], values: []
-  //output: msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, channel_subscriber_count
+  //output: msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, compression, channel_subscriber_count
   redis_lua_script_t get_message_from_key;
 
-  //input:  keys: [], values: [channel_id, time, message, content_type, eventsource_event, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff]
-  //output: message_tag, channel_hash {ttl, time_last_seen, subscribers, messages}
+  //input:  keys: [], values: [namespace, channel_id, time, message, content_type, eventsource_event, compression_setting, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff, optimize_target]
+  //output: channel_hash {ttl, time_last_subscriber_seen, subscribers, last_message_id, messages}, channel_created_just_now?
   redis_lua_script_t publish;
 
-  //input:  keys: [], values: [channel_id, status_code]
+  //input:  keys: [], values: [namespace, channel_id, status_code]
   //output: current_subscribers
   redis_lua_script_t publish_status;
 
   //redis-store consistency check
   redis_lua_script_t rsck;
 
-  //input: keys: [], values: [channel_id, subscriber_id, active_ttl]
+  //input: keys: [], values: [namespace, channel_id, subscriber_id, active_ttl, time, want_channel_settings]
   //  'subscriber_id' can be '-' for new id, or an existing id
   //  'active_ttl' is channel ttl with non-zero subscribers. -1 to persist, >0 ttl in sec
-  //output: subscriber_id, num_current_subscribers, next_keepalive_time
+  //output: subscriber_id, num_current_subscribers, next_keepalive_time, channel_buffer_length
+  //  'channel_buffer_length' is returned only if want_channel_settings is 1
   redis_lua_script_t subscriber_register;
 
-  //input: keys: [], values: [channel_id, subscriber_id, empty_ttl]
+  //input: keys: [], values: [namespace, channel_id, subscriber_id, empty_ttl]
   // 'subscriber_id' is an existing id
   // 'empty_ttl' is channel ttl when without subscribers. 0 to delete immediately, -1 to persist, >0 ttl in sec
   //output: subscriber_id, num_current_subscribers
   redis_lua_script_t subscriber_unregister;
 
 } redis_lua_scripts_t;
-
-static redis_lua_scripts_t redis_lua_scripts = {
-  {"add_fakesub", "b6511d02062dd6f2a1e99d761fe57ef8c987f299",
-   "--input:  keys: [], values: [channel_id, number]\n"
-   "--output: current_fake_subscribers\n"
-   "  \n"
-   "redis.call('echo', ' ####### FAKESUBS ####### ')\n"
-   "local id=ARGV[1]\n"
-   "local num=tonumber(ARGV[2])\n"
-   "if num==nil then\n"
-   "  return {err=\"fakesub number not given\"}\n"
-   "end\n"
-   "\n"
-   "local chan_key = ('{channel:%s}'):format(id)\n"
-   "\n"
-   "local res = redis.pcall('EXISTS', chan_key)\n"
-   "if type(res) == \"table\" and res[\"err\"] then\n"
-   "  return {err = (\"CLUSTER KEYSLOT ERROR. %i %s\"):format(num, id)}\n"
-   "end\n"
-   "\n"
-   "local exists = res == 1\n"
-   "\n"
-   "local cur = 0\n"
-   "\n"
-   "if exists or (not exists and num > 0) then\n"
-   "  cur = redis.call('HINCRBY', chan_key, 'fake_subscribers', num)\n"
-   "  if not exists then\n"
-   "    redis.call('EXPIRE', chan_key, 5) --something small\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "return cur\n"},
-
-  {"channel_keepalive", "e291b7ccc0c11cbd85292ae8b6a443b37f2220f2",
-   "--input:  keys: [], values: [channel_id, ttl]\n"
-   "-- ttl is for when there are no messages but at least 1 subscriber.\n"
-   "--output: seconds until next keepalive is expected, or -1 for \"let it disappear\"\n"
-   "redis.call('ECHO', ' ####### CHANNEL KEEPALIVE ####### ')\n"
-   "local id=ARGV[1]\n"
-   "local ttl=tonumber(ARGV[2])\n"
-   "if not ttl then\n"
-   "  return {err=\"Invalid channel keepalive TTL (2nd arg)\"}\n"
-   "end\n"
-   "\n"
-   "local random_safe_next_ttl = function(ttl)\n"
-   "  return math.floor(ttl/2 + ttl/2.1 * math.random())\n"
-   "end\n"
-   "local ch = ('{channel:%s}'):format(id)\n"
-   "local key={\n"
-   "  channel=   ch, --hash\n"
-   "  messages=  ch..':messages', --list\n"
-   "}\n"
-   "  \n"
-   "local subs_count = tonumber(redis.call('HGET', key.channel, \"subscribers\")) or 0\n"
-   "local msgs_count = tonumber(redis.call('LLEN', key.messages)) or 0\n"
-   "local actual_ttl = tonumber(redis.call('TTL',  key.channel))\n"
-   "\n"
-   "if subs_count > 0 then\n"
-   "  if msgs_count > 0 and actual_ttl > ttl then\n"
-   "    return random_safe_next_ttl(actual_ttl)\n"
-   "  end\n"
-   "  --refresh ttl\n"
-   "  redis.call('expire', key.channel, ttl);\n"
-   "  redis.call('expire', key.messages, ttl);\n"
-   "  return random_safe_next_ttl(ttl)\n"
-   "else\n"
-   "  return -1\n"
-   "end\n"},
-
-  {"delete", "fa52ada69e16947a687f9592529063f3c2d429bd",
-   "--input: keys: [],  values: [ channel_id ]\n"
-   "--output: channel_hash {ttl, time_last_seen, subscribers, messages} or nil\n"
-   "-- delete this channel and all its messages\n"
-   "local id = ARGV[1]\n"
-   "local ch = ('{channel:%s}'):format(id)\n"
-   "local key_msg=    ch..':msg:%s' --not finished yet\n"
-   "local key_channel=ch\n"
-   "local messages=   ch..':messages'\n"
-   "local subscribers=ch..':subscribers'\n"
-   "local pubsub=     ch..':pubsub'\n"
-   "\n"
-   "redis.call('echo', ' ####### DELETE #######')\n"
-   "local num_messages = 0\n"
-   "--delete all the messages right now mister!\n"
-   "local msg\n"
-   "while true do\n"
-   "  msg = redis.call('LPOP', messages)\n"
-   "  if msg then\n"
-   "    num_messages = num_messages + 1\n"
-   "    redis.call('DEL', key_msg:format(msg))\n"
-   "  else\n"
-   "    break\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "local del_msgpack =cmsgpack.pack({\"alert\", \"delete channel\", id})\n"
-   "for k,channel_key in pairs(redis.call('SMEMBERS', subscribers)) do\n"
-   "  redis.call('PUBLISH', channel_key, del_msgpack)\n"
-   "end\n"
-   "\n"
-   "local nearly_departed = nil\n"
-   "if redis.call('EXISTS', key_channel) ~= 0 then\n"
-   "  nearly_departed = redis.call('hmget', key_channel, 'ttl', 'time_last_seen', 'subscribers', 'fake_subscribers', 'current_message')\n"
-   "  if(nearly_departed[4]) then\n"
-   "    --replace subscribers count with fake_subscribers\n"
-   "    nearly_departed[3]=nearly_departed[4]\n"
-   "    table.remove(nearly_departed, 4)\n"
-   "  end\n"
-   "  for i = 1, 4 do\n"
-   "    nearly_departed[i]=tonumber(nearly_departed[i]) or 0\n"
-   "  end\n"
-   "  if type(nearly_departed[5]) ~= \"string\" then\n"
-   "    nearly_departed[5]=\"\"\n"
-   "  end\n"
-   "  \n"
-   "  --leave some crumbs behind showing this channel was just deleted\n"
-   "  redis.call('setex', ch..\":deleted\", 5, 1)\n"
-   "  \n"
-   "  table.insert(nearly_departed, num_messages)\n"
-   "end\n"
-   "\n"
-   "redis.call('DEL', key_channel, messages, subscribers)\n"
-   "\n"
-   "if redis.call('PUBSUB','NUMSUB', pubsub)[2] > 0 then\n"
-   "  redis.call('PUBLISH', pubsub, del_msgpack)\n"
-   "end\n"
-   "\n"
-   "return nearly_departed\n"},
-
-  {"find_channel", "efe9c3f1dd606b1534ee6948d07c7710c604e233",
-   "--input: keys: [],  values: [ channel_id ]\n"
-   "--output: channel_hash {ttl, time_last_seen, subscribers, messages} or nil\n"
-   "-- finds and return the info hash of a channel, or nil of channel not found\n"
-   "local id = ARGV[1]\n"
-   "local channel_key = ('{channel:%s}'):format(id)\n"
-   "local messages_key = channel_key..':messages'\n"
-   "\n"
-   "redis.call('echo', ' #######  FIND_CHANNEL ######## ')\n"
-   "\n"
-   "--check old entries\n"
-   "local oldestmsg=function(list_key, old_fmt)\n"
-   "  local old, oldkey\n"
-   "  local n, del=0,0\n"
-   "  while true do\n"
-   "    n=n+1\n"
-   "    old=redis.call('lindex', list_key, -1)\n"
-   "    if old then\n"
-   "      oldkey=old_fmt:format(old)\n"
-   "      local ex=redis.call('exists', oldkey)\n"
-   "      if ex==1 then\n"
-   "        return oldkey\n"
-   "      else\n"
-   "        redis.call('rpop', list_key)\n"
-   "        del=del+1\n"
-   "      end\n"
-   "    else\n"
-   "      break\n"
-   "    end\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "if redis.call('EXISTS', channel_key) ~= 0 then\n"
-   "  local ch = redis.call('hmget', channel_key, 'ttl', 'time_last_seen', 'subscribers', 'fake_subscribers', 'current_message')\n"
-   "  if(ch[4]) then\n"
-   "    --replace subscribers count with fake_subscribers\n"
-   "    ch[3]=ch[4]\n"
-   "    table.remove(ch, 4)\n"
-   "  end\n"
-   "  for i = 1, 4 do\n"
-   "    ch[i]=tonumber(ch[i]) or 0\n"
-   "  end\n"
-   "  if type(ch[5]) ~= \"string\" then\n"
-   "    ch[5]=\"\"\n"
-   "  end\n"
-   "  \n"
-   "  if redis.call(\"TYPE\", messages_key)['ok'] == 'list' then\n"
-   "    oldestmsg(messages_key, channel_key ..':msg:%s')\n"
-   "    table.insert(ch, tonumber(redis.call('llen', messages_key)))\n"
-   "  else\n"
-   "    table.insert(ch, 0)\n"
-   "  end\n"
-   "  \n"
-   "  return ch\n"
-   "else\n"
-   "  return nil\n"
-   "end\n"},
-
-  {"get_message", "cc3d8f6503731b6580f3a5a5d0de97bfc18c19ca",
-   "--input:  keys: [], values: [channel_id, msg_time, msg_tag, no_msgid_order, create_channel_ttl]\n"
-   "--output: result_code, msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, channel_subscriber_count\n"
-   "-- no_msgid_order: 'FILO' for oldest message, 'FIFO' for most recent\n"
-   "-- create_channel_ttl - make new channel if it's absent, with ttl set to this. 0 to disable.\n"
-   "-- result_code can be: 200 - ok, 404 - not found, 410 - gone, 418 - not yet available\n"
-   "local id, time, tag, subscribe_if_current = ARGV[1], tonumber(ARGV[2]), tonumber(ARGV[3])\n"
-   "local no_msgid_order=ARGV[4]\n"
-   "local create_channel_ttl=tonumber(ARGV[5]) or 0\n"
-   "local msg_id\n"
-   "if time and time ~= 0 and tag then\n"
-   "  msg_id=(\"%s:%s\"):format(time, tag)\n"
-   "end\n"
-   "\n"
-   "if redis.replicate_commands then\n"
-   "  redis.replicate_commands()\n"
-   "end\n"
-   "\n"
-   "-- This script has gotten big and ugly, but there are a few good reasons \n"
-   "-- to keep it big and ugly. It needs to do a lot of stuff atomically, and \n"
-   "-- redis doesn't do includes. It could be generated pre-insertion into redis, \n"
-   "-- but then error messages become less useful, complicating debugging. If you \n"
-   "-- have a solution to this, please help.\n"
-   "local ch=('{channel:%s}'):format(id)\n"
-   "local msgkey_fmt=ch..':msg:%s'\n"
-   "local key={\n"
-   "  next_message= msgkey_fmt, --hash\n"
-   "  message=      msgkey_fmt, --hash\n"
-   "  channel=      ch, --hash\n"
-   "  messages=     ch..':messages', --list\n"
-   "--  pubsub=       ch..':subscribers:', --set\n"
-   "}\n"
-   "\n"
-   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
-   "\n"
-   "redis.call('echo', ' #######  GET_MESSAGE ######## ')\n"
-   "\n"
-   "local oldestmsg=function(list_key, old_fmt)\n"
-   "  local old, oldkey\n"
-   "  local n, del=0,0\n"
-   "  while true do\n"
-   "    n=n+1\n"
-   "    old=redis.call('lindex', list_key, -1)\n"
-   "    if old then\n"
-   "      oldkey=old_fmt:format(old)\n"
-   "      local ex=redis.call('exists', oldkey)\n"
-   "      if ex==1 then\n"
-   "        return oldkey\n"
-   "      else\n"
-   "        redis.call('rpop', list_key)\n"
-   "        del=del+1\n"
-   "      end \n"
-   "    else\n"
-   "      --dbg(list_key, \" is empty\")\n"
-   "      break\n"
-   "    end\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "local tohash=function(arr)\n"
-   "  if type(arr)~=\"table\" then\n"
-   "    return nil\n"
-   "  end\n"
-   "  local h = {}\n"
-   "  local k=nil\n"
-   "  for i, v in ipairs(arr) do\n"
-   "    if k == nil then\n"
-   "      k=v\n"
-   "    else\n"
-   "      --dbg(k..\"=\"..v)\n"
-   "      h[k]=v; k=nil\n"
-   "    end\n"
-   "  end\n"
-   "  return h\n"
-   "end\n"
-   "\n"
-   "if no_msgid_order ~= 'FIFO' then\n"
-   "  no_msgid_order = 'FILO'\n"
-   "end\n"
-   "\n"
-   "local channel = tohash(redis.call('HGETALL', key.channel))\n"
-   "local new_channel = false\n"
-   "if next(channel) == nil then\n"
-   "  if create_channel_ttl==0 then\n"
-   "    return {404, nil}\n"
-   "  end\n"
-   "  redis.call('HSET', key.channel, 'time', time)\n"
-   "  redis.call('EXPIRE', key.channel, create_channel_ttl)\n"
-   "  channel = {time=time}\n"
-   "  new_channel = true\n"
-   "end\n"
-   "\n"
-   "local subs_count = tonumber(channel.subscribers)\n"
-   "\n"
-   "local found_msg_id\n"
-   "if msg_id==nil then\n"
-   "  if new_channel then\n"
-   "    --dbg(\"new channel\")\n"
-   "    return {418, \"\", \"\", \"\", \"\", subs_count}\n"
-   "  else\n"
-   "    --dbg(\"no msg id given, ord=\"..no_msgid_order)\n"
-   "    \n"
-   "    if no_msgid_order == 'FIFO' then --most recent message\n"
-   "      --dbg(\"get most recent\")\n"
-   "      found_msg_id=channel.current_message\n"
-   "    elseif no_msgid_order == 'FILO' then --oldest message\n"
-   "      --dbg(\"get oldest\")\n"
-   "      \n"
-   "      found_msg_id=oldestmsg(key.messages, msgkey_fmt)\n"
-   "    end\n"
-   "    if found_msg_id == nil then\n"
-   "      --we await a message\n"
-   "      return {418, \"\", \"\", \"\", \"\", subs_count}\n"
-   "    else\n"
-   "      msg_id = found_msg_id\n"
-   "      local msg=tohash(redis.call('HGETALL', msg_id))\n"
-   "      if not next(msg) then --empty\n"
-   "        return {404, \"\", \"\", \"\", \"\", subs_count}\n"
-   "      else\n"
-   "        --dbg((\"found msg %s:%s  after %s:%s\"):format(tostring(msg.time), tostring(msg.tag), tostring(time), tostring(tag)))\n"
-   "        local ttl = redis.call('TTL', msg_id)\n"
-   "        return {200, ttl, tonumber(msg.time) or \"\", tonumber(msg.tag) or \"\", tonumber(msg.prev_time) or \"\", tonumber(msg.prev_tag) or \"\", msg.data or \"\", msg.content_type or \"\", msg.eventsource_event or \"\", subs_count}\n"
-   "      end\n"
-   "    end\n"
-   "  end\n"
-   "else\n"
-   "  if msg_id and channel.current_message == msg_id\n"
-   "   or not channel.current_message then\n"
-   "    return {418, \"\", \"\", \"\", \"\", subs_count}\n"
-   "  end\n"
-   "\n"
-   "  key.message=key.message:format(msg_id)\n"
-   "  local msg=tohash(redis.call('HGETALL', key.message))\n"
-   "\n"
-   "  if next(msg) == nil then -- no such message. it might've expired, or maybe it was never there\n"
-   "    --dbg(\"MESSAGE NOT FOUND\")\n"
-   "    return {404, nil}\n"
-   "  end\n"
-   "\n"
-   "  local next_msg, next_msgtime, next_msgtag\n"
-   "  if not msg.next then --this should have been taken care of by the channel.current_message check\n"
-   "    --dbg(\"NEXT MESSAGE KEY NOT PRESENT. ERROR, ERROR!\")\n"
-   "    return {404, nil}\n"
-   "  else\n"
-   "    --dbg(\"NEXT MESSAGE KEY PRESENT: \" .. msg.next)\n"
-   "    key.next_message=key.next_message:format(msg.next)\n"
-   "    if redis.call('EXISTS', key.next_message)~=0 then\n"
-   "      local ntime, ntag, prev_time, prev_tag, ndata, ncontenttype, neventsource_event=unpack(redis.call('HMGET', key.next_message, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event'))\n"
-   "      local ttl = redis.call('TTL', key.next_message)\n"
-   "      --dbg((\"found msg2 %i:%i  after %i:%i\"):format(ntime, ntag, time, tag))\n"
-   "      return {200, ttl, tonumber(ntime) or \"\", tonumber(ntag) or \"\", tonumber(prev_time) or \"\", tonumber(prev_tag) or \"\", ndata or \"\", ncontenttype or \"\", neventsource_event or \"\", subs_count}\n"
-   "    else\n"
-   "      --dbg(\"NEXT MESSAGE NOT FOUND\")\n"
-   "      return {404, nil}\n"
-   "    end\n"
-   "  end\n"
-   "end\n"},
-
-  {"get_message_from_key", "173ff5fb759e434296433d6ff2a554ec7a57cbdb",
-   "--input:  keys: [message_key], values: []\n"
-   "--output: msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, channel_subscriber_count\n"
-   "\n"
-   "local key = KEYS[1]\n"
-   "\n"
-   "local ttl = redis.call('TTL', key)\n"
-   "local time, tag, prev_time, prev_tag, data, content_type, es_event = unpack(redis.call('HMGET', key, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event'))\n"
-   "\n"
-   "return {ttl, time, tag, prev_time or 0, prev_tag or 0, data or \"\", content_type or \"\", es_event or \"\"}\n"},
-
-  {"publish", "a3ef246c361dbe55269bce8afc4974c6e555a482",
-   "--input:  keys: [], values: [channel_id, time, message, content_type, eventsource_event, msg_ttl, max_msg_buf_size, pubsub_msgpacked_size_cutoff]\n"
-   "--output: message_tag, channel_hash {ttl, time_last_seen, subscribers, messages}\n"
-   "\n"
-   "local id=ARGV[1]\n"
-   "local time\n"
-   "if redis.replicate_commands then\n"
-   "  -- we're on redis >= 3.2. We can use We can use 'script effects replication' to allow\n"
-   "  -- writing nondeterministic command values like TIME.\n"
-   "  -- That's exactly what we want to do, use Redis' TIME rather than the given time from Nginx\n"
-   "  -- Also, it's more efficient to replicate just the commands in this case rather than run the whole script\n"
-   "  redis.replicate_commands()\n"
-   "  time = tonumber(redis.call('TIME')[1])\n"
-   "else\n"
-   "  --fallback to the provided time\n"
-   "  time = tonumber(ARGV[2])\n"
-   "end\n"
-   "\n"
-   "local msg={\n"
-   "  id=nil,\n"
-   "  data= ARGV[3],\n"
-   "  content_type=ARGV[4],\n"
-   "  eventsource_event=ARGV[5],\n"
-   "  ttl= tonumber(ARGV[6]),\n"
-   "  time= time,\n"
-   "  tag= 0\n"
-   "}\n"
-   "if msg.ttl == 0 then\n"
-   "  msg.ttl = 126144000 --4 years\n"
-   "end\n"
-   "local store_at_most_n_messages = tonumber(ARGV[7])\n"
-   "if store_at_most_n_messages == nil or store_at_most_n_messages == \"\" then\n"
-   "  return {err=\"Argument 7, max_msg_buf_size, can't be empty\"}\n"
-   "end\n"
-   "if store_at_most_n_messages == 0 then\n"
-   "  msg.unbuffered = 1\n"
-   "end\n"
-   "\n"
-   "local msgpacked_pubsub_cutoff = tonumber(ARGV[8])\n"
-   "\n"
-   "--[[local dbg = function(...)\n"
-   "  local arg = {...}\n"
-   "  for i = 1, #arg do\n"
-   "    arg[i]=tostring(arg[i])\n"
-   "  end\n"
-   "  redis.call('echo', table.concat(arg))\n"
-   "end\n"
-   "]]\n"
-   "if type(msg.content_type)=='string' and msg.content_type:find(':') then\n"
-   "  return {err='Message content-type cannot contain \":\" character.'}\n"
-   "end\n"
-   "\n"
-   "redis.call('echo', ' #######  PUBLISH   ######## ')\n"
-   "\n"
-   "-- sets all fields for a hash from a dictionary\n"
-   "local hmset = function (key, dict)\n"
-   "  if next(dict) == nil then return nil end\n"
-   "  local bulk = {}\n"
-   "  for k, v in pairs(dict) do\n"
-   "    table.insert(bulk, k)\n"
-   "    table.insert(bulk, v)\n"
-   "  end\n"
-   "  return redis.call('HMSET', key, unpack(bulk))\n"
-   "end\n"
-   "\n"
-   "--[[\n"
-   "local hash_tostr=function(h)\n"
-   "  local tt = {}\n"
-   "  for k, v in pairs(h) do\n"
-   "    table.insert(tt, (\"%s: %s\"):format(k, v))\n"
-   "  end\n"
-   "  return \"{\" .. table.concat(tt,\", \") .. \"}\"\n"
-   "end\n"
-   "]]\n"
-   "\n"
-   "local tohash=function(arr)\n"
-   "  if type(arr)~=\"table\" then\n"
-   "    return nil\n"
-   "  end\n"
-   "  local h = {}\n"
-   "  local k=nil\n"
-   "  for i, v in ipairs(arr) do\n"
-   "    if k == nil then\n"
-   "      k=v\n"
-   "    else\n"
-   "      h[k]=v; k=nil\n"
-   "    end\n"
-   "  end\n"
-   "  return h\n"
-   "end\n"
-   "\n"
-   "local ch = ('{channel:%s}'):format(id)\n"
-   "local msg_fmt = ch..':msg:%s'\n"
-   "local key={\n"
-   "  last_message= msg_fmt, --not finished yet\n"
-   "  message=      msg_fmt, --not finished yet\n"
-   "  channel=      ch,\n"
-   "  messages=     ch..':messages',\n"
-   "  subscribers=  ch..':subscribers'\n"
-   "}\n"
-   "local channel_pubsub = ch..':pubsub'\n"
-   "\n"
-   "local new_channel\n"
-   "local channel\n"
-   "if redis.call('EXISTS', key.channel) ~= 0 then\n"
-   "  channel=tohash(redis.call('HGETALL', key.channel))\n"
-   "  channel.max_stored_messages = tonumber(channel.max_stored_messages)\n"
-   "end\n"
-   "\n"
-   "if channel~=nil then\n"
-   "  --dbg(\"channel present\")\n"
-   "  if channel.current_message ~= nil then\n"
-   "    --dbg(\"channel current_message present\")\n"
-   "    key.last_message=key.last_message:format(channel.current_message, id)\n"
-   "  else\n"
-   "    --dbg(\"channel current_message absent\")\n"
-   "    key.last_message=nil\n"
-   "  end\n"
-   "  new_channel=false\n"
-   "else\n"
-   "  --dbg(\"channel missing\")\n"
-   "  channel={}\n"
-   "  new_channel=true\n"
-   "  key.last_message=nil\n"
-   "end\n"
-   "\n"
-   "--set new message id\n"
-   "local lastmsg, lasttime, lasttag\n"
-   "if key.last_message then\n"
-   "  lastmsg = redis.call('HMGET', key.last_message, 'time', 'tag')\n"
-   "  lasttime, lasttag = tonumber(lastmsg[1]), tonumber(lastmsg[2])\n"
-   "  --dbg(\"New message id: last_time \", lasttime, \" last_tag \", lasttag, \" msg_time \", msg.time)\n"
-   "  if lasttime and tonumber(lasttime) > tonumber(msg.time) then\n"
-   "    redis.log(redis.LOG_WARNING, \"Nchan: message for \" .. id .. \" arrived a little late and may be delivered out of order. Redis must be very busy.\")\n"
-   "    msg.time = lasttime\n"
-   "    time = lasttime\n"
-   "  end\n"
-   "  if lasttime and lasttime==msg.time then\n"
-   "    msg.tag=lasttag+1\n"
-   "  end\n"
-   "  msg.prev_time = lasttime\n"
-   "  msg.prev_tag = lasttag\n"
-   "else\n"
-   "  msg.prev_time = 0\n"
-   "  msg.prev_tag = 0\n"
-   "end\n"
-   "msg.id=('%i:%i'):format(msg.time, msg.tag)\n"
-   "\n"
-   "key.message=key.message:format(msg.id)\n"
-   "if redis.call('EXISTS', key.message) ~= 0 then\n"
-   "  local errmsg = \"Message %s for channel %s id %s already exists. time: %s lasttime: %s lasttag: %s\"\n"
-   "  errmsg = errmsg:format(key.message, id, msg.id, time, lasttime, lasttag)\n"
-   "  --redis.log(redis.LOG_WARNING, errmsg)\n"
-   "  --redis.log(redis.LOG_WARNING, \"channel: \" .. key.channel .. hash_tostr(channel))\n"
-   "  --redis.log(redis.LOG_WARNING, (\"messages: %s {%s}\"):format(key.messages, table.concat(redis.call('LRANGE', key.messages, 0, -1), \", \")))\n"
-   "  return {err=errmsg}\n"
-   "end\n"
-   "\n"
-   "msg.prev=channel.current_message\n"
-   "if key.last_message and redis.call('exists', key.last_message) == 1 then\n"
-   "  redis.call('HSET', key.last_message, 'next', msg.id)\n"
-   "end\n"
-   "\n"
-   "--update channel\n"
-   "redis.call('HSET', key.channel, 'current_message', msg.id)\n"
-   "if msg.prev then\n"
-   "  redis.call('HSET', key.channel, 'prev_message', msg.prev)\n"
-   "end\n"
-   "if time then\n"
-   "  redis.call('HSET', key.channel, 'time', time)\n"
-   "end\n"
-   "\n"
-   "local message_len_changed = false\n"
-   "if channel.max_stored_messages ~= store_at_most_n_messages then\n"
-   "  channel.max_stored_messages = store_at_most_n_messages\n"
-   "  message_len_changed = true\n"
-   "  redis.call('HSET', key.channel, 'max_stored_messages', store_at_most_n_messages)\n"
-   "  --dbg(\"channel.max_stored_messages was not set, but is now \", store_at_most_n_messages)\n"
-   "end\n"
-   "\n"
-   "--write message\n"
-   "hmset(key.message, msg)\n"
-   "\n"
-   "\n"
-   "--check old entries\n"
-   "local oldestmsg=function(list_key, old_fmt)\n"
-   "  local old, oldkey\n"
-   "  local n, del=0,0\n"
-   "  while true do\n"
-   "    n=n+1\n"
-   "    old=redis.call('lindex', list_key, -1)\n"
-   "    if old then\n"
-   "      oldkey=old_fmt:format(old)\n"
-   "      local ex=redis.call('exists', oldkey)\n"
-   "      if ex==1 then\n"
-   "        return oldkey\n"
-   "      else\n"
-   "        redis.call('rpop', list_key)\n"
-   "        del=del+1\n"
-   "      end\n"
-   "    else\n"
-   "      break\n"
-   "    end\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "local max_stored_msgs = channel.max_stored_messages or -1\n"
-   "\n"
-   "if max_stored_msgs < 0 then --no limit\n"
-   "  oldestmsg(key.messages, msg_fmt)\n"
-   "  redis.call('LPUSH', key.messages, msg.id)\n"
-   "elseif max_stored_msgs > 0 then\n"
-   "  local stored_messages = tonumber(redis.call('LLEN', key.messages))\n"
-   "  redis.call('LPUSH', key.messages, msg.id)\n"
-   "  -- Reduce the message length if necessary\n"
-   "  local dump_message_ids = redis.call('LRANGE', key.messages, max_stored_msgs, stored_messages);\n"
-   "  if dump_message_ids then\n"
-   "    for _, msgid in ipairs(dump_message_ids) do\n"
-   "      redis.call('DEL', msg_fmt:format(msgid))\n"
-   "    end\n"
-   "  end\n"
-   "  redis.call('LTRIM', key.messages, 0, max_stored_msgs - 1)\n"
-   "  oldestmsg(key.messages, msg_fmt)\n"
-   "end\n"
-   "\n"
-   "\n"
-   "--set expiration times for all the things\n"
-   "local channel_ttl = tonumber(redis.call('TTL',  key.channel))\n"
-   "redis.call('EXPIRE', key.message, msg.ttl)\n"
-   "if msg.ttl > channel_ttl then\n"
-   "  redis.call('EXPIRE', key.channel, msg.ttl)\n"
-   "  redis.call('EXPIRE', key.messages, msg.ttl)\n"
-   "  redis.call('EXPIRE', key.subscribers, msg.ttl)\n"
-   "end\n"
-   "\n"
-   "--publish message\n"
-   "local unpacked\n"
-   "\n"
-   "if msg.unbuffered or #msg.data < msgpacked_pubsub_cutoff then\n"
-   "  unpacked= {\n"
-   "    \"msg\",\n"
-   "    msg.ttl or 0,\n"
-   "    msg.time,\n"
-   "    tonumber(msg.tag) or 0,\n"
-   "    (msg.unbuffered and 0 or msg.prev_time) or 0,\n"
-   "    (msg.unbuffered and 0 or msg.prev_tag) or 0,\n"
-   "    msg.data or \"\",\n"
-   "    msg.content_type or \"\",\n"
-   "    msg.eventsource_event or \"\"\n"
-   "  }\n"
-   "else\n"
-   "  unpacked= {\n"
-   "    \"msgkey\",\n"
-   "    msg.time,\n"
-   "    tonumber(msg.tag) or 0,\n"
-   "    key.message\n"
-   "  }\n"
-   "end\n"
-   "\n"
-   "if message_len_changed then\n"
-   "  unpacked[1] = \"max_msgs+\" .. unpacked[1]\n"
-   "  table.insert(unpacked, 2, tonumber(channel.max_stored_messages))\n"
-   "end\n"
-   "\n"
-   "local msgpacked\n"
-   "\n"
-   "--dbg((\"Stored message with id %i:%i => %s\"):format(msg.time, msg.tag, msg.data))\n"
-   "\n"
-   "--now publish to the efficient channel\n"
-   "local numsub = redis.call('PUBSUB','NUMSUB', channel_pubsub)[2]\n"
-   "if tonumber(numsub) > 0 then\n"
-   "  msgpacked = cmsgpack.pack(unpacked)\n"
-   "  redis.call('PUBLISH', channel_pubsub, msgpacked)\n"
-   "end\n"
-   "\n"
-   "local num_messages = redis.call('llen', key.messages)\n"
-   "\n"
-   "--dbg(\"channel \", id, \" ttl: \",channel.ttl, \", subscribers: \", channel.subscribers, \"(fake: \", channel.fake_subscribers or \"nil\", \"), messages: \", num_messages)\n"
-   "return { msg.tag, {tonumber(channel.ttl or msg.ttl), tonumber(channel.time or msg.time), tonumber(channel.fake_subscribers or channel.subscribers or 0), tonumber(num_messages)}, new_channel}\n"},
-
-  {"publish_status", "cb9ff03713d74f854e3a90f4f77030a0791d3028",
-   "--input:  keys: [], values: [channel_id, status_code]\n"
-   "--output: current_subscribers\n"
-   "\n"
-   "redis.call('echo', ' ####### PUBLISH STATUS ####### ')\n"
-   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
-   "local id=ARGV[1]\n"
-   "local code=tonumber(ARGV[2])\n"
-   "if code==nil then\n"
-   "  return {err=\"non-numeric status code given, bailing!\"}\n"
-   "end\n"
-   "\n"
-   "local pubmsg = \"status:\"..code\n"
-   "local ch = ('{channel:%s}'):format(id)\n"
-   "local subs_key = ch..':subscribers'\n"
-   "local chan_key = ch\n"
-   "--local channel_pubsub = ch..':pubsub'\n"
-   "\n"
-   "for k,channel_key in pairs(redis.call('SMEMBERS', subs_key)) do\n"
-   "  --not efficient, but useful for a few short-term subscriptions\n"
-   "  redis.call('PUBLISH', channel_key, pubmsg)\n"
-   "end\n"
-   "--clear short-term subscriber list\n"
-   "redis.call('DEL', subs_key)\n"
-   "--now publish to the efficient channel\n"
-   "--what?... redis.call('PUBLISH', channel_pubsub, pubmsg)\n"
-   "return redis.call('HGET', chan_key, 'subscribers') or 0\n"},
-
-  {"rsck", "71beb40b0e39f61f6e53dc81d6f8849fd3b23632",
-   "--redis-store consistency check\n"
-   "\n"
-   "local concat = function(...)\n"
-   "  local arg = {...}\n"
-   "  for i = 1, #arg do\n"
-   "    arg[i]=tostring(arg[i])\n"
-   "  end\n"
-   "  return table.concat(arg, \" \")\n"
-   "end\n"
-   "local dbg =function(...) redis.call('echo', concat(...)); end\n"
-   "local errors={}\n"
-   "local err = function(...)\n"
-   "  local msg = concat(...)\n"
-   "  dbg(msg)\n"
-   "  table.insert(errors, msg)\n"
-   "end\n"
-   "\n"
-   "local tp=function(t, max_n)\n"
-   "  local tt={}\n"
-   "  for i, v in pairs(t) do\n"
-   "    local val = tostring(v)\n"
-   "    if max_n and #val > max_n then\n"
-   "      val = val:sub(1, max_n) .. \"[...]\"\n"
-   "    end\n"
-   "    table.insert(tt, tostring(i) .. \": \" .. val)\n"
-   "  end\n"
-   "  return \"{\" .. table.concat(tt, \", \") .. \"}\"\n"
-   "end\n"
-   "\n"
-   "local tohash=function(arr)\n"
-   "  if type(arr)~=\"table\" then\n"
-   "    return nil\n"
-   "  end\n"
-   "  local h = {}\n"
-   "  local k=nil\n"
-   "  for i, v in ipairs(arr) do\n"
-   "    if k == nil then\n"
-   "      k=v\n"
-   "    else\n"
-   "      h[k]=v; k=nil\n"
-   "    end\n"
-   "  end\n"
-   "  return h\n"
-   "end\n"
-   "local type_is = function(key, _type, description)\n"
-   "  local t = redis.call(\"TYPE\", key)['ok']\n"
-   "  local type_ok = true\n"
-   "  if type(_type) == \"table\" then\n"
-   "    type_ok = false\n"
-   "    for i, v in pairs(_type) do\n"
-   "      if v == _type then\n"
-   "        type_ok = true\n"
-   "        break\n"
-   "      end\n"
-   "    end\n"
-   "  elseif t ~= _type then\n"
-   "    err((description or \"\"), key, \"should be type \" .. _type .. \", is\", t)\n"
-   "    type_ok = false\n"
-   "  end\n"
-   "  return type_ok, t\n"
-   "end\n"
-   "\n"
-   "local known_msgs_count=0\n"
-   "local known_msgkeys = {}\n"
-   "local known_channel_keys = {}\n"
-   "\n"
-   "local check_msg = function(chid, msgid, prev_msgid, next_msgid, description)\n"
-   "  description = description and \"msg (\" .. description ..\")\" or \"msg\"\n"
-   "  local msgkey = \"{channel:\"..chid..\"}:msg:\"..msgid\n"
-   "  if not known_msgkeys[msgkey] then\n"
-   "    known_msgs_count = known_msgs_count + 1\n"
-   "  end\n"
-   "  known_msgkeys[msgkey]=true\n"
-   "  local ok, t = type_is(msgkey, {\"hash\", \"none\"}, \"message hash\")\n"
-   "  if t == \"none\" then\n"
-   "    --message is missing, but maybe it expired under normal circumstances. \n"
-   "    --check if any earlier messages are present\n"
-   "    local msgids = redis.call('LRANGE', \"{channel:\"..chid..\"}:messages\", 0, -1)\n"
-   "    local founds = 0\n"
-   "    for i=#msgids, 1, -1 do\n"
-   "      if msgids[i] == msgid then \n"
-   "        break\n"
-   "      end\n"
-   "      local thismsgkey = \"{channel:\"..chid..\"}:msg:\".. msgids[i]\n"
-   "      local ttt = redis.call('type', thismsgkey)['ok']\n"
-   "      redis.breakpoint()\n"
-   "      if ttt == \"hash\" then\n"
-   "        founds = founds + 1\n"
-   "      end\n"
-   "    end\n"
-   "    \n"
-   "    if founds > 0 then\n"
-   "      err(\"message\", msgkey, \"missing, with\", founds, \"prev. msgs in msg list\")\n"
-   "    end\n"
-   "    \n"
-   "  end\n"
-   "  local msg = tohash(redis.call('HGETALL', msgkey))\n"
-   "  local ttl = tonumber(redis.call('TTL', msgkey))\n"
-   "  local n = tonumber(redis.call(\"HLEN\", msgkey))\n"
-   "  if n > 0 and (msg.data == nil or msg.id == nil or msg.time == nil or msg.tag == nil)then\n"
-   "    err(\"incomplete \" .. description ..\"(ttl \"..ttl..\")\", msgkey, tp(msg))\n"
-   "    return false\n"
-   "  end\n"
-   "  if t == \"hash\" and tonumber(ttl) < 0 then\n"
-   "    err(\"message\", msgkey, \"ttl =\", ttl)\n"
-   "  end\n"
-   "  if ttl ~= -2 then\n"
-   "    if prev_msgid ~= false and msg.prev ~= prev_msgid then\n"
-   "      err(description, chid, msgid, \"prev_message wrong. expected\", prev_msgid, \"got\", msg.prev)\n"
-   "    end\n"
-   "    if next_msgid ~= false and msg.next ~= next_msgid then\n"
-   "      err(description, chid, msgid, \"next_message wrong. expected\", next_msgid, \"got\", msg.next)\n"
-   "    end\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "local check_channel = function(id)\n"
-   "  local key={\n"
-   "    ch = \"{channel:\"..id..\"}\",\n"
-   "    msgs = \"{channel:\"..id..\"}:messages\"\n"
-   "  }\n"
-   "  \n"
-   "  local ok, chkey_type = type_is(key.ch, \"hash\", \"channel hash\")\n"
-   "  if not ok then\n"
-   "    if chkey_type ~= \"none\" then\n"
-   "      err(\"unecpected channel key\", key.ch, \"type:\", chkey_type);\n"
-   "    end\n"
-   "    return false\n"
-   "  end\n"
-   "  local _, msgs_list_type = type_is(key.msgs, {\"list\", \"none\"}, \"channel messages list\")\n"
-   "  \n"
-   "  local ch = tohash(redis.call('HGETALL', key.ch))\n"
-   "  local len = tonumber(redis.call(\"HLEN\", key.ch))\n"
-   "  local ttl = tonumber(redis.call('TTL',  key.ch))\n"
-   "  if not ch.current_message or not ch.time then\n"
-   "    if msgs_list_type == \"list\" then\n"
-   "      err(\"incomplete channel (ttl \" .. ttl ..\")\", key.ch, tp(ch))\n"
-   "    end  \n"
-   "  elseif (ch.current_message or ch.prev_message) and msgs_list_type ~= \"list\" then\n"
-   "    err(\"channel\", key.ch, \"has a current_message but no message list\")\n"
-   "  end\n"
-   "  \n"
-   "  local msgids = redis.call('LRANGE', key.msgs, 0, -1)\n"
-   "  for i, msgid in ipairs(msgids) do\n"
-   "    check_msg(id, msgid, msgids[i+1], msgids[i-1], \"msglist\")\n"
-   "  end\n"
-   "  \n"
-   "  if ch.prev_message then\n"
-   "    if redis.call('LINDEX', key.msgs, 1) ~= ch.prev_message then\n"
-   "      err(\"channel\", key.ch, \"prev_message doesn't correspond to\", key.msgs, \"second list element\")\n"
-   "    end\n"
-   "    check_msg(id, ch.prev_message, false, ch.current_message, \"channel prev_message\")\n"
-   "  end\n"
-   "  if ch.current_message then\n"
-   "    if redis.call('LINDEX', key.msgs, 0) ~= ch.current_message then\n"
-   "      err(\"channel\", key.ch, \"current_message doesn't correspond to\", key.msgs, \"first list element\")\n"
-   "    end\n"
-   "    check_msg(id, ch.current_message, ch.prev_message, false, \"channel current_message\")\n"
-   "  end\n"
-   "  \n"
-   "end\n"
-   "\n"
-   "local channel_ids = {}\n"
-   "\n"
-   "for i, chkey in ipairs(redis.call(\"KEYS\", \"{channel:*}\")) do\n"
-   "  local msgs_chid_match = chkey:match(\"^{channel:(.*)}:messages\")\n"
-   "  if msgs_chid_match then\n"
-   "    type_is(\"{channel:\" .. msgs_chid_match..\"}\", \"hash\", \"channel messages' corresponding hash key\")\n"
-   "  elseif not chkey:match(\":msg$\") then\n"
-   "    table.insert(channel_ids, chkey);\n"
-   "    known_channel_keys[chkey] = true\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "dbg(\"found\", #channel_ids, \"channels\")\n"
-   "for i, chkey in ipairs(channel_ids) do\n"
-   "  local chid = chkey:match(\"^{channel:(.*)}\")\n"
-   "  check_channel(chid)\n"
-   "end\n"
-   "\n"
-   "for i, msgkey in ipairs(redis.call(\"KEYS\", \"{channel:*}:msg\")) do\n"
-   "  if not known_msgkeys[msgkey] then\n"
-   "    local ok, t = type_is(msgkey, \"hash\")\n"
-   "    if ok then\n"
-   "      if not redis.call('HGET', msgkey, 'unbuffered') then\n"
-   "        err(\"orphan message\", msgkey, \"(ttl: \" .. redis.call('TTL', msgkey) .. \")\", tp(tohash(redis.call('HGETALL', msgkey)), 15))\n"
-   "      end\n"
-   "    else\n"
-   "      err(\"orphan message\", msgkey, \"wrong type\", t) \n"
-   "    end\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "if errors then\n"
-   "  table.insert(errors, 1, concat(#channel_ids, \"channels,\",known_msgs_count,\"messages found\", #errors, \"problems\"))\n"
-   "  return errors\n"
-   "else\n"
-   "  return concat(#channel_ids, \"channels,\", known_msgs_count, \"messages, all ok\")\n"
-   "end\n"},
-
-  {"subscriber_register", "4e04dbb8bcb66052b49c87e95c30f91a224e9144",
-   "--input: keys: [], values: [channel_id, subscriber_id, active_ttl]\n"
-   "--  'subscriber_id' can be '-' for new id, or an existing id\n"
-   "--  'active_ttl' is channel ttl with non-zero subscribers. -1 to persist, >0 ttl in sec\n"
-   "--output: subscriber_id, num_current_subscribers, next_keepalive_time\n"
-   "\n"
-   "local id, sub_id, active_ttl, concurrency = ARGV[1], ARGV[2], tonumber(ARGV[3]) or 20, ARGV[4]\n"
-   "\n"
-   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
-   "\n"
-   "redis.call('echo', ' ######## SUBSCRIBER REGISTER SCRIPT ####### ')\n"
-   "local ch=(\"{channel:%s}\"):format(id)\n"
-   "local keys = {\n"
-   "  channel =     ch,\n"
-   "  messages =    ch..':messages:',\n"
-   "  subscribers = ch..':subscribers'\n"
-   "}\n"
-   "\n"
-   "local setkeyttl=function(ttl)\n"
-   "  for i,v in pairs(keys) do\n"
-   "    if ttl > 0 then\n"
-   "      redis.call('expire', v, ttl)\n"
-   "    else\n"
-   "      redis.call('persist', v)\n"
-   "    end\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "local random_safe_next_ttl = function(ttl)\n"
-   "  return math.floor(ttl/2 + ttl/2.1 * math.random())\n"
-   "end\n"
-   "\n"
-   "local sub_count\n"
-   "\n"
-   "if sub_id == \"-\" then\n"
-   "  sub_id = tonumber(redis.call('HINCRBY', keys.channel, \"last_subscriber_id\", 1))\n"
-   "  sub_count=tonumber(redis.call('hincrby', keys.channel, 'subscribers', 1))\n"
-   "else\n"
-   "  sub_count=tonumber(redis.call('hget', keys.channel, 'subscribers'))\n"
-   "end\n"
-   "\n"
-   "local next_keepalive \n"
-   "local actual_ttl = tonumber(redis.call('ttl', keys.channel))\n"
-   "if actual_ttl < active_ttl then\n"
-   "  setkeyttl(active_ttl)\n"
-   "  next_keepalive = random_safe_next_ttl(active_ttl)\n"
-   "else\n"
-   "  next_keepalive = random_safe_next_ttl(actual_ttl)\n"
-   "end\n"
-   "\n"
-   "return {sub_id, sub_count, next_keepalive}\n"},
-
-  {"subscriber_unregister", "841cddb1a9ae8af8f25df7ee53fa8739abdd6f76",
-   "--input: keys: [], values: [channel_id, subscriber_id, empty_ttl]\n"
-   "-- 'subscriber_id' is an existing id\n"
-   "-- 'empty_ttl' is channel ttl when without subscribers. 0 to delete immediately, -1 to persist, >0 ttl in sec\n"
-   "--output: subscriber_id, num_current_subscribers\n"
-   "\n"
-   "local id, sub_id, empty_ttl = ARGV[1], ARGV[2], tonumber(ARGV[3]) or 20\n"
-   "\n"
-   "--local dbg = function(...) redis.call('echo', table.concat({...})); end\n"
-   "\n"
-   "redis.call('echo', ' ######## SUBSCRIBER UNREGISTER SCRIPT ####### ')\n"
-   "local ch=('{channel:%s}'):format(id)\n"
-   "local keys = {\n"
-   "  channel =     ch,\n"
-   "  messages =    ch..':messages',\n"
-   "  subscribers = ch..':subscribers',\n"
-   "}\n"
-   "\n"
-   "local setkeyttl=function(ttl)\n"
-   "  for i,v in pairs(keys) do\n"
-   "    if ttl > 0 then\n"
-   "      redis.call('expire', v, ttl)\n"
-   "    elseif ttl < 0 then\n"
-   "      redis.call('persist', v)\n"
-   "    else\n"
-   "      redis.call('del', v)\n"
-   "    end\n"
-   "  end\n"
-   "end\n"
-   "\n"
-   "local sub_count = 0\n"
-   "\n"
-   "local res = redis.pcall('EXISTS', keys.channel)\n"
-   "if type(res) == \"table\" and res[\"err\"] then\n"
-   "  return {err = (\"CLUSTER KEYSLOT ERROR. %i %s\"):format(empty_ttl, id)}\n"
-   "end\n"
-   "\n"
-   "if res ~= 0 then\n"
-   "   sub_count = redis.call('hincrby', keys.channel, 'subscribers', -1)\n"
-   "\n"
-   "  if sub_count == 0 and tonumber(redis.call('LLEN', keys.messages)) == 0 then\n"
-   "    setkeyttl(empty_ttl)\n"
-   "  elseif sub_count < 0 then\n"
-   "    return {err=\"Subscriber count for channel \" .. id .. \" less than zero: \" .. sub_count}\n"
-   "  end\n"
-   "else\n"
-   "  --dbg(\"channel \", id, \" already gone\")\n"
-   "end\n"
-   "\n"
-   "return {sub_id, sub_count}\n"}
-};
-
-const int redis_lua_scripts_count=11;
+redis_lua_scripts_t redis_lua_scripts;
+const int redis_lua_scripts_count;
 #define REDIS_LUA_SCRIPTS_EACH(script) \
 for((script)=(redis_lua_script_t *)&redis_lua_scripts; (script) < (redis_lua_script_t *)(&redis_lua_scripts + 1); (script)++) 
diff --git a/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c b/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c
index 4c4f3514..4f64faa1 100644
--- a/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c
+++ b/debian/modules/nchan/src/store/redis/redis_nginx_adapter.c
@@ -31,7 +31,7 @@ void redis_nginx_init(void) {
 }
 
 
-redisAsyncContext *redis_nginx_open_context(ngx_str_t *host, int port, int database, ngx_str_t *password, void *privdata, redisAsyncContext **context) {
+redisAsyncContext *redis_nginx_open_context(ngx_str_t *host, int port, void *privdata) {
   redisAsyncContext *ac = NULL;
   u_char             hostchr[1024] = {0};
   if(host->len >= 1023) {
@@ -39,28 +39,25 @@ redisAsyncContext *redis_nginx_open_context(ngx_str_t *host, int port, int datab
     return NULL;
   }
   ngx_memcpy(hostchr, host->data, host->len);
+  ac = redisAsyncConnect((const char *)hostchr, port);
+  if (ac == NULL) {
+    ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: could not allocate the redis context for %V:%d", host, port);
+    return NULL;
+  }
   
-  if ((context == NULL) || (*context == NULL) || (*context)->err) {
-    ac = redisAsyncConnect((const char *)hostchr, port);
-    if (ac == NULL) {
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: could not allocate the redis context for %V:%d", host, port);
-      return NULL;
-    }
-    
-    if (ac->err) {
-      ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: could not create the redis context for %V:%d - %s", host, port, ac->errstr);
-      redisAsyncFree(ac);
-      *context = NULL;
-      return NULL;
-    }
-    
-    if(redis_nginx_event_attach(ac) == REDIS_OK) {
-      ac->data = privdata;
-      *context = ac;
-    }
+  if (ac->err) {
+    ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: could not create the redis context for %V:%d - %s", host, port, ac->errstr);
+    redisAsyncFree(ac);
+    return NULL;
+  }
+  
+  if(redis_nginx_event_attach(ac) == REDIS_OK) {
+    ac->data = privdata;
   }
   else {
-    ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: redis context already open");
+    ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: could not attach nginx events %V:%d", host, port);
+    redisAsyncFree(ac);
+    return NULL;
   }
 
   return ac;
@@ -141,7 +138,8 @@ void redis_nginx_ping_callback(redisAsyncContext *ac, void *rep, void *privdata)
 
 void redis_nginx_read_event(ngx_event_t *ev) {
   redisAsyncContext *ac = ((ngx_connection_t *)ev->data)->data;
-  int                bytes_left;
+  int                fd = ac->c.fd; //because redisAsyncHandleRead might free the redisAsyncContext
+  int                bytes_left = 0;
   redisAsyncHandleRead(ac);
   
   // we need to do this because hiredis, in its infinite wisdom, will read at 
@@ -149,7 +147,7 @@ void redis_nginx_read_event(ngx_event_t *ev) {
   // whole amount in one gulp. Otherwise, we could just check if 16Kb have 
   //been read and try again. But no, apparently that's not an option.
   
-  ioctl(ac->c.fd, FIONREAD, &bytes_left);
+  ioctl(fd, FIONREAD, &bytes_left);
   if (bytes_left > 0 && !ac->err) {
     //ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "again!");
     redis_nginx_read_event(ev);
@@ -217,22 +215,16 @@ void redis_nginx_cleanup(void *privdata) {
   if (privdata) {
     ngx_connection_t *connection = (ngx_connection_t *) privdata;
     redisAsyncContext *ac = (redisAsyncContext *) connection->data;
-    if (ac->err) {
-      //nchan_store_redis_connection_close_handler(ac);
-      //ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "redis_nginx_adapter: connection to redis failed - %s", ac->errstr);
-      /**
-        * If the context had an error but the fd still valid is because another context got the same fd from OS.
-        * So we clean the reference to this fd on redisAsyncContext and on ngx_connection, avoiding close a socket in use.
-        */
-      if (redis_nginx_fd_is_valid(ac->c.fd)) {
-        ac->c.fd = -1;
-        connection->fd = NGX_INVALID_FILE;
-      }
-    }
+    // don't care why the connection is being cleaned up. if there's an error, close the fd. if an fd was being shared between
+    // workers or connections -- tough luck
     
     if ((connection->fd != NGX_INVALID_FILE)) {
-      redis_nginx_del_read(privdata);
-      redis_nginx_del_write(privdata);
+      if(connection->read->active) {
+        redis_nginx_del_read(privdata);
+      }
+      if(connection->write->active) {
+        redis_nginx_del_write(privdata);
+      }
       ngx_close_connection(connection);
     } else {
       ngx_free_connection(connection);
diff --git a/debian/modules/nchan/src/store/redis/redis_nginx_adapter.h b/debian/modules/nchan/src/store/redis/redis_nginx_adapter.h
index 716c397c..ea113298 100644
--- a/debian/modules/nchan/src/store/redis/redis_nginx_adapter.h
+++ b/debian/modules/nchan/src/store/redis/redis_nginx_adapter.h
@@ -2,11 +2,16 @@
 #ifndef __REDIS_NGINX_ADAPTER_H
 #define __REDIS_NGINX_ADAPTER_H
 
+#if NCHAN_HAVE_HIREDIS_WITH_SOCKADDR
 #include <hiredis/hiredis.h>
 #include <hiredis/async.h>
+#else
+#include <store/redis/hiredis/hiredis.h>
+#include <store/redis/hiredis/async.h>
+#endif
 
 void redis_nginx_init(void);
-redisAsyncContext *redis_nginx_open_context(ngx_str_t *host, int port, int database, ngx_str_t *password, void *privdata, redisAsyncContext **context);
+redisAsyncContext *redis_nginx_open_context(ngx_str_t *host, int port, void *privdata);
 redisContext *redis_nginx_open_sync_context(ngx_str_t *host, int port, int database, ngx_str_t *password, redisContext **context);
 void redis_nginx_force_close_context(redisAsyncContext **context);
 void redis_nginx_close_context(redisAsyncContext **context);
diff --git a/debian/modules/nchan/src/store/redis/redis_nodeset.c b/debian/modules/nchan/src/store/redis/redis_nodeset.c
new file mode 100644
index 00000000..4994eaea
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/redis_nodeset.c
@@ -0,0 +1,2179 @@
+#include "redis_nodeset.h"
+
+#include <assert.h>
+#include "store-private.h"
+#include <store/store_common.h>
+#include "store.h"
+#include "redis_nginx_adapter.h"
+#include "redis_nodeset_parser.h"
+#include "redis_lua_commands.h"
+
+//#define DEBUG_LEVEL NGX_LOG_WARN
+#define DEBUG_LEVEL NGX_LOG_DEBUG
+
+#define DBG(fmt, args...) ngx_log_error(DEBUG_LEVEL, ngx_cycle->log, 0, "REDIS NODESET: " fmt, ##args)
+#define ERR(fmt, args...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "REDIS NODESET: " fmt, ##args)
+
+static redis_nodeset_t  redis_nodeset[NCHAN_MAX_NODESETS];
+static int              redis_nodeset_count = 0;
+static char            *redis_worker_id = NULL;
+static redisCallbackFn *redis_subscribe_callback = NULL;
+
+typedef struct {
+  ngx_event_t      ev;
+  ngx_int_t      (*cb)(redis_nodeset_t *, void *);
+  void            *pd;
+  redis_nodeset_t *ns;
+} nodeset_onready_callback_t;
+
+
+static ngx_str_t       default_redis_url = ngx_string(NCHAN_REDIS_DEFAULT_URL);
+
+static void node_connector_callback(redisAsyncContext *ac, void *rep, void *privdata);
+static int nodeset_cluster_keyslot_space_complete(redis_nodeset_t *ns);
+
+static void *rbtree_cluster_keyslots_node_id(void *data) {
+  return &((redis_nodeset_slot_range_node_t *)data)->range;
+}
+static uint32_t rbtree_cluster_keyslots_bucketer(void *vid) {
+  return 1; //no buckets
+}
+static ngx_int_t rbtree_cluster_keyslots_compare(void *v1, void *v2) {
+  redis_slot_range_t   *r1 = v1;
+  redis_slot_range_t   *r2 = v2;
+  
+  if(r1->max < r2->min) //r1 is strictly left of r2
+    return -1;
+  else if(r1->min > r2->max) //r1 is strictly right of r2
+    return 1;
+  else //there's an overlap
+    return 0;
+}
+
+static int nodeset_cluster_node_index_keyslot_ranges(redis_node_t *node) {
+  unsigned                         i;
+  ngx_rbtree_node_t               *rbtree_node;
+  redis_nodeset_slot_range_node_t *keyslot_tree_node;
+  rbtree_seed_t                   *tree = &node->nodeset->cluster.keyslots;
+  if(node->cluster.slot_range.indexed) {
+    node_log_error(node, "cluster keyslot range already indexed");
+    return 0;
+  }
+  
+  for(i=0; i<node->cluster.slot_range.n; i++) {
+    if(nodeset_node_find_by_range(node->nodeset, &node->cluster.slot_range.range[i])) { //overlap!
+      return 0;
+    }
+  }
+  
+  for(i=0; i<node->cluster.slot_range.n; i++) {
+    rbtree_node = rbtree_create_node(tree, sizeof(*keyslot_tree_node));
+    keyslot_tree_node = rbtree_data_from_node(rbtree_node);
+    keyslot_tree_node->range = node->cluster.slot_range.range[i];
+    keyslot_tree_node->node = node;
+    if(rbtree_insert_node(tree, rbtree_node) != NGX_OK) {
+      node_log_error(node, "couldn't insert keyslot node range %d-%d", keyslot_tree_node->range.min, keyslot_tree_node->range.max);
+      rbtree_destroy_node(tree, rbtree_node);
+      return 0;
+    }
+    else {
+      node_log_info(node, "inserted keyslot node range %d-%d", keyslot_tree_node->range.min, keyslot_tree_node->range.max);
+    }
+  }
+  node->cluster.slot_range.indexed = 1;
+  return 1;
+}
+/*
+static ngx_int_t print_slot_range_node(rbtree_seed_t *tree, void *node_data, void *privdata) {
+  redis_nodeset_slot_range_node_t        *rangenode = node_data;
+  node_log_notice(rangenode->node, "slots [%d - %d]", rangenode->range.min, rangenode->range.max);
+  return NGX_OK;
+}
+*/
+static int nodeset_cluster_node_unindex_keyslot_ranges(redis_node_t *node) {
+  ngx_rbtree_node_t               *rbtree_node;
+  redis_slot_range_t              *range;
+  rbtree_seed_t                   *tree = &node->nodeset->cluster.keyslots;
+  unsigned                         i;
+  if(!node->cluster.slot_range.indexed) {
+    //node_log_notice(node, "already unindexed");
+    return 1;
+  }
+  //node_log_notice(node, "unindex keyslot ranges");
+  
+  //rbtree_walk_incr(tree, print_slot_range_node, NULL);
+  
+  for(i=0; i<node->cluster.slot_range.n; i++) {
+    range = &node->cluster.slot_range.range[i];
+    //node_log_notice(node, "unindexing range [%d - %d]", range->min, range->max);
+    if((rbtree_node = rbtree_find_node(tree, range)) != NULL) {
+      rbtree_remove_node(tree, rbtree_node);
+      rbtree_destroy_node(tree, rbtree_node);
+    }
+    else {
+      node_log_error(node, "unable to unindex keyslot range %d-%d: range not found in tree", range->min, range->max);
+      raise(SIGABRT);
+    }
+  }
+  node->cluster.slot_range.indexed = 0;
+  return 1;
+}
+
+#if REDIS_NODESET_DBG
+
+
+static ngx_int_t nodeset_debug_rangetree_collector(rbtree_seed_t *tree, void *node_data, void *privdata) {
+  redis_nodeset_slot_range_node_t     *rangenode = node_data;
+  redis_nodeset_dbg_range_tree_t      *dbg = privdata;
+  dbg->node[dbg->n].range = rangenode->range;
+  dbg->node[dbg->n].node = rangenode->node;
+  dbg->n++;
+  return NGX_OK;
+}
+
+static redis_node_dbg_list_t *nodeset_update_debuginfo(redis_nodeset_t *nodeset) {
+  rbtree_seed_t         *tree = &nodeset->cluster.keyslots;
+  redis_node_dbg_list_t *node_dbg = &nodeset->dbg.nodes;
+  redis_node_t  *cur;
+  ngx_memzero(&nodeset->dbg, sizeof(nodeset->dbg));
+  for(cur = nchan_list_first(&nodeset->nodes); cur != NULL; cur = nchan_list_next(cur)) {
+    node_dbg->node[node_dbg->n++]=cur;
+  }
+  nodeset->dbg.keyspace_complete = nodeset_cluster_keyslot_space_complete(nodeset);
+  rbtree_walk_incr(tree, nodeset_debug_rangetree_collector, &nodeset->dbg.ranges);
+  return NGX_OK;
+}
+#endif
+
+static const char *__rcp_cstr(redis_connect_params_t *rcp, char *buf) {
+  ngx_snprintf((u_char *)buf, 512, "%V:%d%Z", &rcp->hostname, rcp->port, &rcp->peername);
+  return buf;
+}
+
+static const char *__node_cstr(redis_node_t *node, char *buf) {
+  return __rcp_cstr(&node->connect_params, buf);
+}
+
+static const char *rcp_cstr(redis_connect_params_t *rcp) {
+  static char    buf[512];
+  return __rcp_cstr(rcp, buf);
+}
+static const char *node_cstr(redis_node_t *node) {
+  return rcp_cstr(&node->connect_params);
+}
+
+#define MAX_RUN_ID_LENGTH 64
+#define MAX_CLUSTER_ID_LENGTH 64
+#define MAX_VERSION_LENGTH 16
+typedef struct {
+  redis_node_t    node;
+  u_char          peername[INET6_ADDRSTRLEN + 2];
+  u_char          run_id[MAX_RUN_ID_LENGTH];
+  u_char          cluster_id[MAX_CLUSTER_ID_LENGTH];
+  u_char          version[MAX_VERSION_LENGTH];
+} node_blob_t;
+
+static void nodeset_check_status_event(ngx_event_t *ev);
+
+int nodeset_ready(redis_nodeset_t *nodeset) {
+  return nodeset && nodeset->status == REDIS_NODESET_READY;
+}
+
+ngx_int_t nodeset_initialize(char *worker_id, redisCallbackFn *subscribe_handler) {
+  redis_worker_id = worker_id;
+  redis_subscribe_callback = subscribe_handler;
+  return NGX_OK;
+}
+
+redis_nodeset_t *nodeset_create(nchan_loc_conf_t *lcf) {
+  nchan_redis_conf_t  *rcf = &lcf->redis;
+  redis_nodeset_t     *ns = &redis_nodeset[redis_nodeset_count]; //incremented once everything is ok
+  assert(rcf->enabled);
+  assert(!rcf->nodeset);
+  
+  ns->first_loc_conf = lcf;
+  
+  if(redis_nodeset_count >= NCHAN_MAX_NODESETS) {
+    nchan_log_error("Cannot create more than %d Redis nodesets", NCHAN_MAX_NODESETS);
+    return NULL;
+  }
+  
+  assert(!nodeset_find(rcf)); //must be unique
+  
+  nchan_list_init(&ns->urls, sizeof(ngx_str_t *), "redis urls");
+  nchan_list_init(&ns->nodes, sizeof(node_blob_t), "redis nodes");
+  nchan_list_init(&ns->onready_callbacks, sizeof(nodeset_onready_callback_t), "nodeset onReady callbacks");
+  
+  nchan_slist_init(&ns->channels.all, rdstore_channel_head_t, redis.slist.nodeset.prev, redis.slist.nodeset.next);
+  nchan_slist_init(&ns->channels.disconnected_cmd, rdstore_channel_head_t, redis.slist.node_cmd.prev, redis.slist.node_cmd.next);
+  nchan_slist_init(&ns->channels.disconnected_pubsub, rdstore_channel_head_t, redis.slist.node_pubsub.prev, redis.slist.node_pubsub.next);
+  
+  ns->reconnect_delay_sec = 5;
+  ns->current_status_times_checked = 0;
+  ns->current_status_start = 0;
+  ns->generation = 0;
+  ns->settings.namespace = &rcf->namespace;
+  ns->settings.storage_mode = rcf->storage_mode;
+  ns->settings.nostore_fastpublish = rcf->nostore_fastpublish;
+  
+  ns->settings.ping_interval = rcf->ping_interval;
+  
+  ns->status = REDIS_NODESET_DISCONNECTED;
+  ngx_memzero(&ns->status_check_ev, sizeof(ns->status_check_ev));
+  ns->status_msg = NULL;
+  nchan_init_timer(&ns->status_check_ev, nodeset_check_status_event, ns);
+  
+  //init cluster stuff
+  ns->cluster.enabled = 0;
+  rbtree_init(&ns->cluster.keyslots, "redis cluster node (by keyslot) data", rbtree_cluster_keyslots_node_id, rbtree_cluster_keyslots_bucketer, rbtree_cluster_keyslots_compare);
+  
+  //urls
+  if(rcf->upstream) {
+    nchan_srv_conf_t           *scf = NULL;
+    scf = ngx_http_conf_upstream_srv_conf(rcf->upstream, ngx_nchan_module);
+    
+    ngx_uint_t                   i;
+    ngx_array_t                 *servers = rcf->upstream->servers;
+    ngx_http_upstream_server_t  *usrv = servers->elts;
+    ngx_str_t                   *upstream_url, **urlref;
+    ns->upstream = rcf->upstream;
+    
+    ns->settings.connect_timeout = scf->redis.connect_timeout == NGX_CONF_UNSET_MSEC ? NCHAN_DEFAULT_REDIS_NODE_CONNECT_TIMEOUT_MSEC : scf->redis.connect_timeout;
+    ns->settings.node_weight.master = scf->redis.master_weight == NGX_CONF_UNSET ? 1 : scf->redis.master_weight;
+    ns->settings.node_weight.slave = scf->redis.slave_weight == NGX_CONF_UNSET ? 1 : scf->redis.slave_weight;
+    
+    ns->settings.optimize_target = scf->redis.optimize_target == NCHAN_REDIS_OPTIMIZE_UNSET ? NCHAN_REDIS_OPTIMIZE_CPU : scf->redis.optimize_target;
+    
+    for(i=0; i < servers->nelts; i++) {
+#if nginx_version >= 1007002
+      upstream_url = &usrv[i].name;
+#else
+      upstream_url = &usrv[i].addrs->name;
+#endif
+      urlref = nchan_list_append(&ns->urls);
+      *urlref = upstream_url;
+    }
+  }
+  else {
+    ns->upstream = NULL;
+    ns->settings.connect_timeout = NCHAN_DEFAULT_REDIS_NODE_CONNECT_TIMEOUT_MSEC;
+    ns->settings.node_weight.master = 1;
+    ns->settings.node_weight.slave = 1;
+    ngx_str_t **urlref = nchan_list_append(&ns->urls);
+    *urlref = rcf->url.len > 0 ? &rcf->url : &default_redis_url;
+  }
+  DBG("nodeset created");
+  redis_nodeset_count++;
+  rcf->nodeset = ns;
+  return ns;
+}
+
+redis_nodeset_t *nodeset_find(nchan_redis_conf_t *rcf) {
+  if(rcf->nodeset) {
+    return rcf->nodeset;
+  }
+  else {
+    int              i;
+    redis_nodeset_t *ns;
+    for(i=0; i<redis_nodeset_count; i++) {
+      ns = &redis_nodeset[i];
+      if(nchan_ngx_str_match(&rcf->namespace, ns->settings.namespace) && rcf->storage_mode == ns->settings.storage_mode) {
+        if(rcf->upstream) {
+          if(ns->upstream == rcf->upstream)
+            return ns;
+        }
+        else {
+          ngx_str_t *search_url = rcf->url.len > 0 ? &rcf->url : &default_redis_url;
+          ngx_str_t **first_url = nchan_list_first(&ns->urls);
+          
+          if(first_url && nchan_ngx_str_match(search_url, *first_url)) {
+            //cache it
+            rcf->nodeset = ns;
+            if(rcf->ping_interval > 0 && ns->settings.ping_interval > rcf->ping_interval) {
+              //use the smallest ping interval found in the settings
+              ns->settings.ping_interval = rcf->ping_interval;
+            }
+            return ns;
+          }
+        }
+      }
+    }
+    return NULL;
+  }
+}
+
+static int node_transfer_slaves(redis_node_t *src, redis_node_t *dst) {
+  int transferred = 0;
+  redis_node_t  **cur;
+  for(cur = nchan_list_first(&src->peers.slaves); cur != NULL; cur = nchan_list_next(cur)) {
+    node_set_master_node(*cur, dst);
+    node_add_slave_node(dst, *cur); //won't be added if it's already there
+    transferred++;
+  }
+  return transferred;
+}
+
+static int equal_redis_connect_params(void *d1, void *d2) {
+  redis_connect_params_t *cp1 = d1;
+  redis_connect_params_t *cp2 = d2;
+  if(cp1->port != cp2->port || cp1->db != cp2->db) {
+    return 0;  
+  }
+  if( nchan_ngx_str_nonzero_match(&cp1->hostname, &cp2->hostname)
+   || nchan_ngx_str_nonzero_match(&cp1->peername, &cp2->peername)
+   || nchan_ngx_str_nonzero_match(&cp1->peername, &cp2->hostname)
+   || nchan_ngx_str_nonzero_match(&cp1->hostname, &cp2->peername)) {
+    return 1;
+  }
+  else {
+    return 0;
+  }
+}
+
+static int equal_nonzero_strings(void *s1, void *s2) {
+  return ((ngx_str_t *)s1)->len > 0 && ((ngx_str_t *)s2)->len > 0 && 
+    nchan_ngx_str_match((ngx_str_t *)s1, (ngx_str_t *)s2);
+}
+
+typedef struct {
+  char          *name;
+  off_t          offset;
+  int          (*match)(void *, void *);
+} node_match_t;
+
+static struct {
+  node_match_t    run_id;
+  node_match_t    cluster_id;
+  node_match_t    connect_params;
+} _node_match = {
+  .run_id =          {"run_id",      offsetof(redis_node_t, run_id),          equal_nonzero_strings},
+  .cluster_id =      {"cluster_id",  offsetof(redis_node_t, cluster.id),      equal_nonzero_strings},
+  .connect_params =  {"url",         offsetof(redis_node_t, connect_params),  equal_redis_connect_params}
+};
+
+static int nodeset_node_deduplicate_by(redis_node_t *node, node_match_t *match) {
+  redis_node_t   *cur;
+  void *d1, *d2;
+  d1 = &((char *)node)[match->offset];
+  for(cur = nchan_list_first(&node->nodeset->nodes); cur != NULL; cur = nchan_list_next(cur)) {
+    d2 = &((char *)cur)[match->offset];
+    if(cur != node && match->match(d1, d2)) {
+      node_log_notice(node, "deduplicated by %s", match->name);
+      node_transfer_slaves(node, cur); //node->cur
+      nodeset_node_destroy(node);
+      return 1;
+    }
+  }
+  return 0;
+}
+
+int nodeset_node_deduplicate_by_connect_params(redis_node_t *node) {
+  return nodeset_node_deduplicate_by(node, &_node_match.connect_params);
+}
+int nodeset_node_deduplicate_by_run_id(redis_node_t *node) {
+  return nodeset_node_deduplicate_by(node, &_node_match.run_id);
+}
+int nodeset_node_deduplicate_by_cluster_id(redis_node_t *node) {
+  return nodeset_node_deduplicate_by(node, &_node_match.cluster_id);
+}
+
+static redis_node_t *nodeset_node_find_by(redis_nodeset_t *ns, node_match_t *match, void *data) {
+  redis_node_t *cur;
+  void *d2;
+  for(cur = nchan_list_first(&ns->nodes); cur != NULL; cur = nchan_list_next(cur)) {
+    d2 = &((char *)cur)[match->offset];
+    if(match->match(data, d2)) {
+      return cur;
+    }
+  }
+  return NULL;
+}
+redis_node_t *nodeset_node_find_by_connect_params(redis_nodeset_t *ns, redis_connect_params_t *rcp) {
+  return nodeset_node_find_by(ns, &_node_match.connect_params, rcp);
+}
+redis_node_t *nodeset_node_find_by_run_id(redis_nodeset_t *ns, ngx_str_t *run_id) {
+  return nodeset_node_find_by(ns, &_node_match.run_id, run_id);
+}
+redis_node_t *nodeset_node_find_by_cluster_id(redis_nodeset_t *ns, ngx_str_t *cluster_id) {
+  return nodeset_node_find_by(ns, &_node_match.cluster_id, cluster_id);
+}
+
+static int keyslot_ranges_overlap(redis_slot_range_t *r1, redis_slot_range_t *r2) {
+  return rbtree_cluster_keyslots_compare(r1, r2) == 0;
+}
+
+redis_node_t *nodeset_node_find_by_range(redis_nodeset_t *ns, redis_slot_range_t *range) {
+  ngx_rbtree_node_t                   *rbtree_node;
+  redis_nodeset_slot_range_node_t     *keyslot_tree_node;
+  
+  if((rbtree_node = rbtree_find_node(&ns->cluster.keyslots, range)) != NULL) {
+    keyslot_tree_node = rbtree_data_from_node(rbtree_node);
+    assert(keyslot_ranges_overlap(range, &keyslot_tree_node->range));
+    return keyslot_tree_node->node;
+  }
+  else {
+    return NULL;
+  }
+}
+
+redis_node_t *nodeset_node_find_by_slot(redis_nodeset_t *ns, uint16_t slot) {
+  redis_slot_range_t range;
+  range.min = slot;
+  range.max = slot;
+  return nodeset_node_find_by_range(ns, &range);
+}
+redis_node_t *nodeset_node_find_any_ready_master(redis_nodeset_t *ns) {
+  redis_node_t *cur;
+  for(cur = nchan_list_first(&ns->nodes); cur != NULL; cur = nchan_list_next(cur)) {
+    if(cur->state >= REDIS_NODE_READY && cur->role == REDIS_NODE_ROLE_MASTER) {
+      return cur;
+    }
+  }
+  return NULL;
+}
+
+redis_node_t *nodeset_node_find_by_channel_id(redis_nodeset_t *ns, ngx_str_t *channel_id) {
+  redis_node_t      *node;
+  static uint16_t    prefix_crc = 0;
+  uint16_t           slot;
+  
+  if(!ns->cluster.enabled) {
+    node = nodeset_node_find_any_ready_master(ns);
+  }
+  else {
+    if(prefix_crc == 0) {
+      prefix_crc = redis_crc16(0, "channel:", 8);
+    }
+    slot = redis_crc16(prefix_crc, (const char *)channel_id->data, channel_id->len) % 16384;
+    //DBG("channel id %V (key {channel:%V}) slot %i", str, str, slot);
+    
+    node = nodeset_node_find_by_slot(ns, slot);
+  }
+  
+#if REDIS_NODESET_DBG
+  if(node == NULL) {
+    nodeset_update_debuginfo(ns);
+    raise(SIGABRT);
+  }
+#endif
+  
+  return node;
+}
+
+redis_node_t *nodeset_node_find_by_key(redis_nodeset_t *ns, ngx_str_t *key) {
+  if(!ns->cluster.enabled) {
+    return nodeset_node_find_any_ready_master(ns);
+  }
+  
+  char        *start, *end;
+  ngx_str_t    hashable;
+  uint16_t     slot;
+  
+  if(((start = memchr(key->data, '{', key->len))) != NULL) {
+    start++;
+    end = memchr(start, '}', key->len - ((u_char *)start - key->data));
+    if(end && end - start > 1) {
+      hashable.data = (u_char *)start;
+      hashable.len = (end - start);
+    }
+    else {
+      hashable = *key;
+      // not quite right -- need to ignore zero-length {} and scan to the next {
+      // but it's good enough for the keys we're using
+    }
+  }
+  else {
+    hashable = *key;
+  }
+  slot = redis_crc16(0, (const char *)hashable.data, hashable.len) % 16384;
+  
+  return nodeset_node_find_by_slot(ns, slot);
+}
+
+static void ping_command_callback(redisAsyncContext *ac, void *rep, void *privdata) {
+  redisReply                 *reply = rep;
+  redis_node_t               *node = privdata;
+  if(!reply || reply->type == REDIS_REPLY_ERROR || !ac || ac->err) {
+    node_log_error(node, "node ping failed");
+    return;
+  }
+  node_log_debug(node, "node ping command reply ok");
+}
+
+static void node_ping_event(ngx_event_t *ev) {
+  redis_node_t       *node = ev->data;
+  redis_nodeset_t    *ns = node->nodeset;
+  if(!ev->timedout || ngx_exiting || ngx_quit)
+    return;
+  
+  node_log_debug(node, "node ping event");
+  
+  ev->timedout = 0;
+  if(node->state == REDIS_NODE_READY) {
+    assert(node->ctx.cmd);
+    
+    //we used to PUBLISH to the correct keyslot-mapped cluster node
+    //but Redis clusters don't shard the PUBSUB keyspace, so this discrimination isn't necessary
+    //just publish the damn thing if this is a master node, and just a PING for slaves
+    if(node->role == REDIS_NODE_ROLE_MASTER) {
+      redisAsyncCommand(node->ctx.cmd, ping_command_callback, node, "PUBLISH %s ping", redis_worker_id);
+    }
+    else {
+      redisAsyncCommand(node->ctx.cmd, ping_command_callback, node, "PING");
+    }
+    
+    if(ns->settings.ping_interval > 0) {
+      ngx_add_timer(ev, ns->settings.ping_interval * 1000);
+    }
+  }
+}
+
+redis_node_t *nodeset_node_create_with_space(redis_nodeset_t *ns, redis_connect_params_t *rcp, size_t extra_space, void **extraspace_ptr) {
+  assert(!nodeset_node_find_by_connect_params(ns, rcp));
+  node_blob_t      *node_blob;
+  if(extra_space == 0) {
+    assert(extraspace_ptr == NULL);
+    node_blob = nchan_list_append(&ns->nodes);
+  }
+  else {
+    assert(extraspace_ptr);
+    node_blob = nchan_list_append_sized(&ns->nodes, sizeof(*node_blob)+extra_space);
+    if(extra_space) {
+      *extraspace_ptr = (void *)(&node_blob[1]);
+    }
+  }
+  redis_node_t     *node = &node_blob->node;
+  
+  assert((void *)node_blob == (void *)node);
+  assert(node);
+  node->role = REDIS_NODE_ROLE_UNKNOWN,
+  node->state = REDIS_NODE_DISCONNECTED;
+  node->discovered = 0;
+  node->connect_timeout = NULL;
+  node->connect_params = *rcp;
+  node->connect_params.peername.data = node_blob->peername;
+  node->connect_params.peername.len = 0;
+  node->cluster.id.len = 0;
+  node->cluster.id.data = node_blob->cluster_id;
+  node->cluster.enabled = 0;
+  node->cluster.ok = 0;
+  node->cluster.slot_range.indexed = 0;
+  node->cluster.slot_range.n = 0;
+  node->cluster.slot_range.range = NULL;
+  node->pending_commands = 0;
+  node->run_id.len = 0;
+  node->run_id.data = node_blob->run_id;
+  node->nodeset = ns;
+  node->generation = 0;
+  
+  nchan_slist_init(&node->channels.cmd, rdstore_channel_head_t, redis.slist.node_cmd.prev, redis.slist.node_cmd.next);
+  nchan_slist_init(&node->channels.pubsub, rdstore_channel_head_t, redis.slist.node_pubsub.prev, redis.slist.node_pubsub.next);
+  
+  node->peers.master = NULL;
+  nchan_list_init(&node->peers.slaves, sizeof(redis_node_t *), "node slaves");
+  
+  ngx_memzero(&node->ping_timer, sizeof(node->ping_timer));
+  nchan_init_timer(&node->ping_timer, node_ping_event, node);
+  
+  node->ctx.cmd = NULL;
+  node->ctx.pubsub = NULL;
+  node->ctx.sync = NULL;
+  
+  assert(nodeset_node_find_by_connect_params(ns, rcp));
+  return node;
+}
+
+redis_node_t *nodeset_node_create(redis_nodeset_t *ns, redis_connect_params_t *rcp) {
+  return nodeset_node_create_with_space(ns, rcp, 0, NULL);
+}
+
+redis_node_t *nodeset_node_create_with_connect_params(redis_nodeset_t *ns, redis_connect_params_t *rcp) {
+  redis_node_t  *node;
+  u_char        *space;
+  size_t         sz = rcp->hostname.len + rcp->password.len;
+  node = nodeset_node_create_with_space(ns, rcp, sz, (void **)&space);
+  assert(node);
+  node->connect_params.hostname.data = space;
+  node->connect_params.hostname.len = 0;
+  nchan_strcpy(&node->connect_params.hostname, &rcp->hostname, 0);
+  node->connect_params.password.data = &space[rcp->hostname.len];
+  nchan_strcpy(&node->connect_params.password, &rcp->password, 0);
+  return node;
+}
+
+static void node_remove_peer(redis_node_t *node, redis_node_t *peer) {
+  redis_node_t  **cur;
+  if(node->peers.master == peer) {
+    node->peers.master = NULL;
+  }
+  
+  for(cur = nchan_list_first(&node->peers.slaves); cur != NULL; cur = nchan_list_next(cur)) {
+    if(*cur == peer) {
+      nchan_list_remove(&node->peers.slaves, cur);
+      return;
+    }
+  }
+}
+
+ngx_int_t nodeset_node_destroy(redis_node_t *node) {
+  redisAsyncContext *ac;
+  redisContext      *c;
+  node_set_role(node, REDIS_NODE_ROLE_UNKNOWN); //removes from all peer lists, and clears own slave list
+  if((ac = node->ctx.cmd) != NULL) {
+    node->ctx.cmd = NULL;
+    redisAsyncFree(ac);
+  }
+  if((ac = node->ctx.pubsub) != NULL) { 
+    node->ctx.pubsub = NULL;
+    redisAsyncFree(ac);
+  }
+  if((c = node->ctx.sync) != NULL) {
+    node->ctx.sync = NULL;
+    redisFree(c);
+  }
+  if(node->connect_timeout) {
+    nchan_abort_oneshot_timer(node->connect_timeout);
+    node->connect_timeout = NULL;
+  }
+  nchan_list_remove(&node->nodeset->nodes, node);
+  return NGX_OK;
+}
+
+static void node_discover_slave(redis_node_t *master, redis_connect_params_t *rcp) {
+  redis_node_t    *slave;
+  if((slave = nodeset_node_find_by_connect_params(master->nodeset, rcp))!= NULL) {
+    //we know about it already
+    if(slave->role != REDIS_NODE_ROLE_SLAVE && slave->state > REDIS_NODE_GET_INFO) {
+      node_log_notice(slave, "Node appears to have changed to slave -- need to update");
+      node_set_role(slave, REDIS_NODE_ROLE_UNKNOWN);
+      node_disconnect(slave, REDIS_NODE_FAILED);
+      node_connect(slave);
+    }
+    //assert(slave->peers.master == master);
+  }
+  else {
+    slave = nodeset_node_create_with_connect_params(master->nodeset, rcp);
+    slave->discovered = 1;
+    node_set_role(slave, REDIS_NODE_ROLE_SLAVE);
+    node_log_notice(master, "Discovering own slave %s", rcp_cstr(rcp));
+  }
+  node_set_master_node(slave, master); //this is idempotent
+  node_add_slave_node(master, slave);  //so is this
+  //try to connect
+  if(slave->state <= REDIS_NODE_DISCONNECTED) {
+    node_connect(slave);
+  }
+}
+
+static void node_discover_master(redis_node_t  *slave, redis_connect_params_t *rcp) {
+  redis_node_t *master;
+  if ((master = nodeset_node_find_by_connect_params(slave->nodeset, rcp)) != NULL) {
+      if(master->role != REDIS_NODE_ROLE_MASTER && master->state > REDIS_NODE_GET_INFO) {
+        node_log_notice(master, "Node appears to have changed to master -- need to update");
+        node_set_role(master, REDIS_NODE_ROLE_UNKNOWN);
+        node_disconnect(master, REDIS_NODE_FAILED);
+        node_connect(master);
+      }
+    //assert(node_find_slave_node(master, slave));
+    //node_log_notice(slave, "Discovering master %s... already known", rcp_cstr(rcp));
+  }
+  else {
+    master = nodeset_node_create_with_connect_params(slave->nodeset, rcp);
+    master->discovered = 1;
+    node_set_role(master, REDIS_NODE_ROLE_MASTER);
+    node_log_notice(slave, "Discovering own master %s", rcp_cstr(rcp));
+  }
+  node_set_master_node(slave, master);
+  node_add_slave_node(master, slave);
+  //try to connect
+  if(master->state <= REDIS_NODE_DISCONNECTED) {
+    node_connect(master);
+  }
+}
+
+static int node_skip_cluster_peer(redis_node_t *node, cluster_nodes_line_t *l) {
+  redis_connect_params_t   rcp;
+  char                    *description = "";
+  char                    *role = NULL;
+  ngx_uint_t               loglevel = NGX_LOG_NOTICE;
+  rcp.hostname = l->hostname;
+  rcp.port = l->port;
+  rcp.peername.len = 0;
+  rcp.db = node->connect_params.db;
+  rcp.password = node->connect_params.password;
+  
+  if(l->noaddr) {
+    role = "node";
+    description = "no-address";
+    return 1;
+  }
+  else if(l->handshake) {
+    role = "node";
+    description = "handshaking";
+    
+  }
+  else if(l->hostname.len == 0) {
+    role = "node";
+    description = "empty hostname";
+  }
+  else if(l->failed) {
+    description = "failed";
+  }
+  else if(!l->connected) {
+    description = "disconnected";
+  }
+  else if(l->self) {
+    description = "self";
+    loglevel = NGX_LOG_INFO;
+  }
+  else {
+    return 0;
+  }
+  if(!role) role = l->master ? "master" : "slave";
+  node_log(node, loglevel, "Skipping %s cluster %s %s", description, role, rcp_cstr(&rcp));
+  return 1;
+}
+
+static int node_discover_cluster_peer(redis_node_t *node, cluster_nodes_line_t *l) {
+  redis_connect_params_t   rcp;
+  redis_node_t            *peer;
+  assert(!l->self);
+  if(l->failed || !l->connected || l->noaddr || l->self) {
+    return 0;
+  }
+  rcp.hostname = l->hostname;
+  rcp.port = l->port;
+  rcp.peername.len = 0;
+  rcp.db = node->connect_params.db;
+  rcp.password = node->connect_params.password;
+  
+  if( ((peer = nodeset_node_find_by_connect_params(node->nodeset, &rcp)) != NULL)
+   || ((peer = nodeset_node_find_by_cluster_id(node->nodeset, &l->id)) != NULL)
+  ) {
+    //node_log_notice(node, "Discovering cluster node %s... already known", rcp_cstr(&rcp));
+    return 0; //we already know this one.
+  }
+  node_log_notice(node, "Discovering cluster %s %s", (l->master ? "master" : "slave"), rcp_cstr(&rcp));
+  peer = nodeset_node_create_with_connect_params(node->nodeset, &rcp);
+  peer->discovered = 1;
+  nchan_strcpy(&peer->cluster.id, &l->id, MAX_CLUSTER_ID_LENGTH);
+  node_set_role(peer, l->master ? REDIS_NODE_ROLE_MASTER : REDIS_NODE_ROLE_SLAVE);
+  //ignore all the other things for now
+  node_connect(peer);
+  return 1;
+}
+
+static ngx_int_t set_preallocated_peername(redisAsyncContext *ctx, ngx_str_t *dst);
+
+static void node_connector_fail(redis_node_t *node, const char *err) {
+  const char  *ctxerr = NULL;
+  if(node->ctx.cmd && node->ctx.cmd->err) {
+    ctxerr = node->ctx.cmd->errstr;
+  }
+  else if(node->ctx.pubsub && node->ctx.pubsub->err) {
+    ctxerr = node->ctx.pubsub->errstr;
+  }
+  else if(node->ctx.sync && node->ctx.sync->err) {
+    ctxerr = node->ctx.sync->errstr;
+  }
+  if(node->state == REDIS_NODE_CONNECTION_TIMED_OUT) {
+    node_log_error(node, "connection failed: %s", err);
+  }
+  else if(ctxerr) {
+    node_log_error(node, "connection failed: %s (%s)", err, ctxerr);
+  }
+  else {
+    node_log_error(node, "connection failed: %s", err);
+  }
+  node_disconnect(node, REDIS_NODE_FAILED);
+}
+
+int node_connect(redis_node_t *node) {
+  assert(node->state <= REDIS_NODE_DISCONNECTED);
+  node_connector_callback(NULL, NULL, node);
+  return 1;
+}
+
+int node_disconnect(redis_node_t *node, int disconnected_state) {
+  ngx_int_t prev_state = node->state;
+  node_log_debug(node, "disconnect");
+  redisAsyncContext *ac;
+  redisContext      *c;
+  if((ac = node->ctx.cmd) != NULL) {
+    node->ctx.cmd->onDisconnect = NULL;
+    node->ctx.cmd = NULL;
+    //redisAsyncSetDisconnectCallback(ac, NULL); //this only sets the callback if it's currently null...
+    redisAsyncFree(ac);
+    node_log_debug(node, "redisAsyncFree %p", ac);
+  }
+  if((ac = node->ctx.pubsub) != NULL) {
+    node->ctx.pubsub->onDisconnect = NULL;
+    node->ctx.pubsub = NULL;
+    //redisAsyncSetDisconnectCallback(ac, NULL);  //this only sets the callback if it's currently null...
+    redisAsyncFree(ac);
+    node_log_debug(node, "redisAsyncFree pubsub %p", ac);
+  }
+  if((c = node->ctx.sync) != NULL) {
+    node->ctx.sync = NULL;
+    redisFree(c);
+  }
+  if(node->connect_timeout) {
+    nchan_abort_oneshot_timer(node->connect_timeout);
+    node->connect_timeout = NULL;
+  }
+
+  node->state = disconnected_state;
+  if(prev_state >= REDIS_NODE_READY) {
+    nchan_update_stub_status(redis_connected_servers, -1);
+  }
+  if(node->cluster.enabled) {
+    nodeset_cluster_node_unindex_keyslot_ranges(node);
+  }
+  if(node->cluster.slot_range.range) {
+    ngx_free(node->cluster.slot_range.range);
+    node->cluster.slot_range.n=0;
+    node->cluster.slot_range.range = NULL;
+  }
+  if(node->ping_timer.timer_set) {
+    ngx_del_timer(&node->ping_timer);
+  }
+  
+  rdstore_channel_head_t *cur;
+  nchan_slist_t *cmd = &node->channels.cmd;
+  nchan_slist_t *pubsub = &node->channels.pubsub;
+  nchan_slist_t *disconnected_cmd = &node->nodeset->channels.disconnected_cmd;
+  nchan_slist_t *disconnected_pubsub = &node->nodeset->channels.disconnected_pubsub;
+  
+  for(cur = nchan_slist_first(cmd); cur != NULL; cur = nchan_slist_first(cmd)) {
+    nodeset_node_dissociate_chanhead(cur);
+    nchan_slist_append(disconnected_cmd, cur);
+    cur->redis.slist.in_disconnected_cmd_list = 1;
+    if(cur->status && cur->status == READY) {
+      cur->status = NOTREADY;
+    }
+  }
+  for(cur = nchan_slist_first(pubsub); cur != NULL; cur = nchan_slist_first(pubsub)) {
+    nodeset_node_dissociate_pubsub_chanhead(cur);
+    nchan_slist_append(disconnected_pubsub, cur);
+    cur->redis.slist.in_disconnected_pubsub_list = 1;
+    
+    cur->pubsub_status = REDIS_PUBSUB_UNSUBSCRIBED;
+    
+    if(cur->redis.nodeset->settings.storage_mode == REDIS_MODE_BACKUP && cur->status == READY) {
+      cur->status = NOTREADY;
+    }
+
+  }
+  return 1;
+}
+
+void node_set_role(redis_node_t *node, redis_node_role_t role) {
+  if(node->role == role) {
+    return;
+  }
+  node->role = role;
+  redis_node_t  **cur;
+  switch(node->role) {
+    case REDIS_NODE_ROLE_UNKNOWN:
+      if(node->peers.master) {
+        node_remove_peer(node->peers.master, node);
+        DBG("removed %p from peers of %p", node->peers.master, node);
+        node->peers.master = NULL;
+      }
+      for(cur = nchan_list_first(&node->peers.slaves); cur != NULL; cur = nchan_list_next(cur)) {
+        node_remove_peer(*cur, node);
+      }
+      nchan_list_empty(&node->peers.slaves);
+      break;
+    
+    case REDIS_NODE_ROLE_MASTER:
+      if(node->peers.master) {
+        node_remove_peer(node->peers.master, node);
+        node->peers.master = NULL;
+      }
+      break;
+    
+    case REDIS_NODE_ROLE_SLAVE:
+      //do nothing
+      break;
+      
+  }
+}
+
+int node_set_master_node(redis_node_t *node, redis_node_t *master) {
+  if(node->peers.master && node->peers.master != master) {
+    node_remove_slave_node(master, node);
+  }
+  node->peers.master = master;
+  return 1;
+}
+redis_node_t *node_find_slave_node(redis_node_t *node, redis_node_t *slave) {
+  redis_node_t **cur;
+  for(cur = nchan_list_first(&node->peers.slaves); cur != NULL; cur = nchan_list_next(cur)) {
+    if (*cur == slave) {
+      return slave;
+    }
+  }
+  return NULL;
+}
+int node_add_slave_node(redis_node_t *node, redis_node_t *slave) {
+  if(!node_find_slave_node(node, slave)) {
+    redis_node_t **slaveref;
+    slaveref = nchan_list_append(&node->peers.slaves);
+    *slaveref = slave;
+    return 1;
+  }
+  return 1;
+}
+int node_remove_slave_node(redis_node_t *node, redis_node_t *slave) {
+  if(!node_find_slave_node(node, slave)) {
+    nchan_list_remove(&node->peers.slaves, slave);
+  }
+  return 1;
+}
+
+static int node_parseinfo_set_preallocd_str(redis_node_t *node, ngx_str_t *target, const char *info, const char *linestart, size_t maxlen) {
+  ngx_str_t found;
+  if(nchan_get_rest_of_line_in_cstr(info, linestart, &found)) {
+    if(found.len > maxlen) {
+      node_log_error(node, "\"%s\" is too long", linestart);
+      return 0;
+    }
+    else {
+      target->len = found.len;
+      ngx_memcpy(target->data, found.data, found.len);
+      return 1;
+    }
+  }
+  return 0;
+}
+
+static int node_connector_reply_str_ok(redisReply *reply) {
+  return (reply != NULL && reply->type != REDIS_REPLY_ERROR && reply->type == REDIS_REPLY_STRING);
+}
+static int node_connector_reply_status_ok(redisReply *reply) {
+  return (
+    reply != NULL 
+    && reply->type != REDIS_REPLY_ERROR
+    && reply->type == REDIS_REPLY_STATUS
+    && reply->str
+    && strcmp(reply->str, "OK") == 0
+  );
+}
+
+static int node_parseinfo_set_run_id(redis_node_t *node, const char *info) {
+  return node_parseinfo_set_preallocd_str(node, &node->run_id, info, "run_id:", MAX_RUN_ID_LENGTH);
+}
+
+static int node_connector_loadscript_reply_ok(redis_node_t *node, redis_lua_script_t *script, redisReply *reply) {
+  if (reply == NULL) {
+    node_log_error(node, "missing reply after loading Redis Lua script %s", script->name);
+    return 0;
+  }
+  switch(reply->type) {
+    case REDIS_REPLY_ERROR:
+      node_log_error(node, "failed loading Redis Lua script %s: %s", script->name, reply->str);
+      return 0;
+    
+    case REDIS_REPLY_STRING:
+      if(ngx_strncmp(reply->str, script->hash, REDIS_LUA_HASH_LENGTH)!=0) {
+        node_log_error(node, "Lua script %s has unexpected hash %s (expected %s)", script->name, reply->str, script->hash);
+        return 0;
+      }
+      else {
+        return 1;
+      }
+      break;
+      
+    default:
+      node_log_error(node, "unexpected reply type while loading Redis Lua script %s", script->name);
+      return 0;
+  }
+}
+
+static void redis_nginx_unexpected_disconnect_event_handler(const redisAsyncContext *ac, int status) {
+  redis_node_t    *node = ac->data;
+  //char            *which_ctx;
+  //DBG("unexpected disconnect event handler ac %p", ac);
+  if(node) {
+    if(node->ctx.cmd == ac) {
+      //which_ctx = "cmd";
+      node->ctx.cmd = NULL;
+    }
+    else if(node->ctx.pubsub == ac) {
+      node->ctx.pubsub = NULL;
+      //which_ctx = "pubsub";
+    }
+    else {
+      node_log_error(node, "unknown redisAsyncContext disconnected");
+      //which_ctx = "unknown";
+    }
+    
+    if(node->state >= REDIS_NODE_READY && !ngx_exiting && !ngx_quit) {
+      if(ac->err) {
+        node_log_error(node, "connection lost: %s.", ac->errstr);
+      }
+      else {
+        node_log_error(node, "connection lost");
+      }
+    }
+    node_disconnect(node, REDIS_NODE_FAILED);
+    nodeset_examine(node->nodeset);
+  }
+}
+
+static void redis_nginx_connect_event_handler(const redisAsyncContext *ac, int status) {
+  node_connector_callback((redisAsyncContext *)ac, NULL, ac->data);
+}
+
+static redisAsyncContext *node_connect_context(redis_node_t *node, ngx_str_t *host, ngx_int_t port) {
+  redisAsyncContext *ctx = redis_nginx_open_context(host, port, node);
+  if(ctx) {
+    redisAsyncSetConnectCallback(ctx, redis_nginx_connect_event_handler);
+    redisAsyncSetDisconnectCallback(ctx, redis_nginx_unexpected_disconnect_event_handler);
+  }
+  return ctx;
+}
+
+static int node_discover_slaves_from_info_reply(redis_node_t *node, redisReply *reply) {
+  redis_connect_params_t   *rcp;
+  size_t                    i, n;
+  if(!(rcp = parse_info_slaves(node, reply->str, &n))) {
+    return 0;
+  }
+  for(i=0; i<n; i++) {
+    node_discover_slave(node, &rcp[i]);
+  }
+  return 1;
+}
+
+int nodeset_node_keyslot_changed(redis_node_t *node) {
+  if(node->state >= REDIS_NODE_READY) {
+    node_disconnect(node, REDIS_NODE_FAILED);
+  }
+  char errstr[512];
+  ngx_snprintf((u_char *)errstr, 512, "cluster keyspace needs to be updated as reported by node %V:%d%Z", &(node)->connect_params.hostname, node->connect_params.port);
+  nodeset_set_status(node->nodeset, REDIS_NODESET_CLUSTER_FAILING, errstr);
+  return 1;
+}
+
+int nodeset_node_reply_keyslot_ok(redis_node_t *node, redisReply *reply) {
+  if(reply && reply->type == REDIS_REPLY_ERROR) {
+    char    *script_nonlocal_key_error = "Lua script attempted to access a non local key in a cluster node";
+    char    *script_error_start = "ERR Error running script";
+    char    *command_move_error = "MOVED ";
+    char    *command_ask_error = "ASK ";
+    
+    if((nchan_cstr_startswith(reply->str, script_error_start) && nchan_strstrn(reply->str, script_nonlocal_key_error))
+     || nchan_cstr_startswith(reply->str, command_move_error)
+     || nchan_cstr_startswith(reply->str, command_ask_error)) {
+      if(!node->cluster.enabled) {
+        node_log_error(node, "got a cluster error on a non-cluster redis connection: %s", reply->str);
+        node_disconnect(node, REDIS_NODE_FAILED);
+      }
+      else {
+        nodeset_node_keyslot_changed(node);
+      }
+      return 0;
+    }
+    else
+      return 1;
+  }
+  return 1;
+}
+
+static void node_subscribe_callback(redisAsyncContext *ac, void *rep, void *privdata) {
+  redisReply                 *reply = rep;
+  redis_node_t               *node = privdata;
+  if(node->state == REDIS_NODE_SUBSCRIBING_WORKER) {
+    node_connector_callback(ac, rep, privdata);
+  }
+  else if(reply && reply->type == REDIS_REPLY_ARRAY && reply->elements == 3
+   && reply->element[0]->type == REDIS_REPLY_STRING 
+   && reply->element[1]->type == REDIS_REPLY_STRING
+   && reply->element[2]->type == REDIS_REPLY_STRING
+   && strcmp(reply->element[0]->str, "message") == 0
+   && strcmp(reply->element[1]->str, redis_worker_id) == 0
+   && strcmp(reply->element[2]->str, "ping") == 0
+  ) {
+    node_log_debug(node, "received PUBSUB ping message");
+  }
+  else {
+    redis_subscribe_callback(ac, rep, privdata);
+  }
+}
+
+void node_connector_connect_timeout(void *pd) {
+  redis_node_t  *node = pd;
+  node->connect_timeout = NULL;
+  if(node->state == REDIS_NODE_CMD_CONNECTING || node->state == REDIS_NODE_PUBSUB_CONNECTING) {
+    //onConnect won't be fired, so the connector must be called manually
+    node->state = REDIS_NODE_CONNECTION_TIMED_OUT;
+    node_connector_callback(NULL, NULL, node);
+  }
+  else {
+    node_disconnect(node, REDIS_NODE_CONNECTION_TIMED_OUT);
+  }
+}
+
+static void node_connector_callback(redisAsyncContext *ac, void *rep, void *privdata) {
+  redisReply                 *reply = rep;
+  redis_node_t               *node = privdata;
+  redis_nodeset_t            *nodeset = node->nodeset;
+  char                        errstr[1024];
+  redis_connect_params_t     *cp = &node->connect_params;
+  redis_lua_script_t         *next_script = (redis_lua_script_t *)&redis_lua_scripts;
+  node_log_debug(node, "node_connector_callback state %d", node->state);
+  
+  switch(node->state) {
+    case REDIS_NODE_CONNECTION_TIMED_OUT:
+      return node_connector_fail(node, "connection timed out");
+      break;
+    case REDIS_NODE_FAILED:
+    case REDIS_NODE_DISCONNECTED:
+      assert(!node->connect_timeout);
+      if((node->ctx.cmd = node_connect_context(node, &cp->hostname, cp->port)) == NULL) { //always connect the cmd ctx to the hostname
+        return node_connector_fail(node, "failed to open redis async context for cmd");
+      }
+      else if(cp->peername.len == 0) { //don't know peername yet
+        set_preallocated_peername(node->ctx.cmd, &cp->peername);
+      }
+      node->connect_timeout = nchan_add_oneshot_timer(node_connector_connect_timeout, node, nodeset->settings.connect_timeout);
+      node->state = REDIS_NODE_CMD_CONNECTING;
+      break; //wait until the onConnect callback brings us back
+      
+    case REDIS_NODE_CMD_CONNECTING:
+      if(ac->err || ac->c.err) {
+        node->ctx.cmd = NULL; //to avoid calling redisAsyncFree on the ctx during node_disconnect()
+        //(it will be called automatically when this function returns control back to hiredis
+        return node_connector_fail(node, ac->errstr);
+      }
+      if((node->ctx.pubsub = node_connect_context(node, &cp->peername, cp->port)) == NULL) {
+        return node_connector_fail(node, "failed to open redis async context for pubsub");
+      }
+      node->state++;
+      break; //wait until the onConnect callback brings us back
+    
+    case REDIS_NODE_PUBSUB_CONNECTING:
+      if(ac->err || ac->c.err) {
+        node->ctx.pubsub = NULL; //to avoid calling redisAsyncFree on the ctx during node_disconnect()
+        //(it will be called automatically when this function returns control back to hiredis
+        ngx_snprintf((u_char *)errstr, 1024, "(pubsub) %s%Z", ac->errstr);
+        return node_connector_fail(node, errstr);
+      }
+      //connection established. move on...   
+      node->state++;
+      /* fall through */
+    case REDIS_NODE_CONNECTED:
+      //now we need to authenticate maybe?
+      if(cp->password.len > 0) {
+        if(!node->ctx.cmd) {
+          return node_connector_fail(node, "cmd connection missing, can't send AUTH command");
+        }
+        redisAsyncCommand(node->ctx.cmd, node_connector_callback, node, "AUTH %b", STR(&cp->password));
+        node->state++;
+      }
+      else {
+        node->state = REDIS_NODE_SELECT_DB;
+        return node_connector_callback(NULL, NULL, node); //continue as if authenticated
+      }
+      break;
+    
+    case REDIS_NODE_CMD_AUTHENTICATING:
+      if(!node_connector_reply_status_ok(reply)) {
+        return node_connector_fail(node, "AUTH command failed");
+      }
+      if(!node->ctx.pubsub) {
+        return node_connector_fail(node, "pubsub connection missing, can't send AUTH command");
+      }
+      //now authenticate pubsub ctx
+      redisAsyncCommand(node->ctx.pubsub, node_connector_callback, node, "AUTH %b", STR(&cp->password));
+      node->state++;
+      break;
+    
+    case REDIS_NODE_PUBSUB_AUTHENTICATING:
+      if(!node_connector_reply_status_ok(reply)) {
+        return node_connector_fail(node, "AUTH command failed");
+      }
+      node->state++;
+      /* fall through */
+    case REDIS_NODE_SELECT_DB:
+      if(cp->db > 0) {
+        if(!node->ctx.cmd) {
+          return node_connector_fail(node, "cmd connection missing, SELECT command");
+        }
+        redisAsyncCommand(node->ctx.cmd, node_connector_callback, node, "SELECT %d", cp->db);
+        node->state++;
+      }
+      else {
+        node->state = REDIS_NODE_SCRIPTS_LOAD;
+        return node_connector_callback(NULL, NULL, node);
+      }
+      break;
+    
+    case REDIS_NODE_CMD_SELECTING_DB:
+      if(reply == NULL || reply->type == REDIS_REPLY_ERROR) {
+        return node_connector_fail(node, "Redis SELECT command failed,");
+      }
+      if(!node->ctx.cmd) {
+        return node_connector_fail(node, "pubsub connection missing, can't send SELECT command");
+      }
+      redisAsyncCommand(node->ctx.pubsub, node_connector_callback, node, "SELECT %d", cp->db);
+      node->state++;
+      break;
+    
+    case REDIS_NODE_PUBSUB_SELECTING_DB:
+      if(reply == NULL || reply->type == REDIS_REPLY_ERROR) {
+        return node_connector_fail(node, "Redis SELECT command failed,");
+      }
+      node->state++; // fallthru
+      /* fall through */
+    case REDIS_NODE_SCRIPTS_LOAD:
+      node->scripts_loaded = 0;
+      if(!node->ctx.cmd) {
+        return node_connector_fail(node, "cmd connection missing, can't send SCRIPT LOAD command");
+      }
+      redisAsyncCommand(node->ctx.cmd, node_connector_callback, node, "SCRIPT LOAD %s", next_script->script);
+      node->state++;
+      break;
+    
+    case REDIS_NODE_SCRIPTS_LOADING:
+      next_script = &next_script[node->scripts_loaded];
+      
+      if(!node_connector_loadscript_reply_ok(node, next_script, reply)) {
+        return node_connector_fail(node, "SCRIPT LOAD failed,");
+      }
+      else {
+        //node_log_debug(node, "loaded script %s", next_script->name);
+        node->scripts_loaded++;
+        next_script++;
+      }
+      if(node->scripts_loaded < redis_lua_scripts_count) {
+        //load next script
+        if(!node->ctx.cmd) {
+          return node_connector_fail(node, "cmd connection missing, can't send SCRIPT LOAD command");
+        }
+        redisAsyncCommand(node->ctx.cmd, node_connector_callback, node, "SCRIPT LOAD %s", next_script->script);
+        return;
+      }
+      node_log_debug(node, "all scripts loaded");
+      node->state++;
+      /* fall through */
+    case REDIS_NODE_GET_INFO:
+      //getinfo time
+      if(!node->ctx.cmd) {
+        return node_connector_fail(node, "cmd connection missing, can't send INFO ALL command");
+      }
+      redisAsyncCommand(node->ctx.cmd, node_connector_callback, node, "INFO ALL");
+      node->state++;
+      break;
+      
+    case REDIS_NODE_GETTING_INFO:
+      if(reply && reply->type == REDIS_REPLY_ERROR && nchan_cstr_startswith(reply->str, "NOAUTH")) {
+        return node_connector_fail(node, "authentication required");
+      }
+      else if(reply == NULL || reply->type == REDIS_REPLY_ERROR) {
+        return node_connector_fail(node, "INFO command failed");
+      }
+      else if(!node_parseinfo_set_run_id(node, reply->str)) {
+        return node_connector_fail(node, "failed to set node run_id");
+      }
+      else if(nodeset_node_deduplicate_by_run_id(node)) {
+        // this node already exists
+        // the deduplication has deleted it; we're done here.
+        // commence rejoicing.
+        return;
+      }
+      
+      if(nchan_cstr_match_line(reply->str, "loading:1")) {
+        return node_connector_fail(node, "is busy loading data...");
+      }
+      
+      if(nchan_cstr_match_line(reply->str, "role:master")) {
+        node_set_role(node, REDIS_NODE_ROLE_MASTER);
+        if(!node_discover_slaves_from_info_reply(node, reply)) {
+          return node_connector_fail(node, "failed parsing slaves from INFO");
+        }
+      }
+      else if(nchan_cstr_match_line(reply->str, "role:slave")) {
+        redis_connect_params_t   *rcp;
+        node_set_role(node, REDIS_NODE_ROLE_SLAVE);
+        if(!(rcp = parse_info_master(node, reply->str))) {
+          return node_connector_fail(node, "failed parsing master from INFO");
+        }
+        node_discover_master(node, rcp);
+      }
+      else {
+        return node_connector_fail(node, "can't tell if node is master or slave");
+      }
+      
+      //what's next?
+      if(nchan_cstr_match_line(reply->str, "cluster_enabled:1")) {
+        node->cluster.enabled = 1;
+      }
+      node->state++;
+      /* fall through */
+    case REDIS_NODE_PUBSUB_GET_INFO:
+      if(!node->ctx.pubsub) {
+        return node_connector_fail(node, "cmd connection missing, can't send INFO SERVER command");
+      }
+      redisAsyncCommand(node->ctx.pubsub, node_connector_callback, node, "INFO SERVER");
+      node->state++;
+      break;
+    case REDIS_NODE_PUBSUB_GETTING_INFO:
+      if(reply && reply->type == REDIS_REPLY_ERROR && nchan_cstr_startswith(reply->str, "NOAUTH")) {
+        return node_connector_fail(node, "authentication required");
+      }
+      else if(reply == NULL || reply->type == REDIS_REPLY_ERROR) {
+        return node_connector_fail(node, "INFO command failed");
+      }
+      else {
+        u_char    idbuf[MAX_RUN_ID_LENGTH];
+        ngx_str_t pubsub_run_id = {0, idbuf};
+        node_parseinfo_set_preallocd_str(node, &pubsub_run_id, reply->str, "run_id:", MAX_RUN_ID_LENGTH);
+        if(!nchan_ngx_str_match(&node->run_id, &pubsub_run_id)) {
+          return node_connector_fail(node, "IP address connects to more than one server. Is Redis behind a proxy?");
+        }
+        node->state++;
+      }
+      /* fall through */
+    case REDIS_NODE_SUBSCRIBE_WORKER:
+      if(!node->ctx.pubsub) {
+        return node_connector_fail(node, "pubsub connection missing, can't send worker SUBSCRIBE command");
+      }
+      redisAsyncCommand(node->ctx.pubsub, node_subscribe_callback, node, "SUBSCRIBE %s", redis_worker_id);
+      node->state++;
+      break;
+    
+    case REDIS_NODE_SUBSCRIBING_WORKER:  
+      if(!reply) {
+        return node_connector_fail(node, "disconnected while subscribing to worker PUBSUB channel");
+      }
+      if( reply->type != REDIS_REPLY_ARRAY || reply->elements != 3 
+       || reply->element[0]->type != REDIS_REPLY_STRING || reply->element[1]->type != REDIS_REPLY_STRING
+       || strcmp(reply->element[0]->str, "subscribe") != 0
+       || strcmp(reply->element[1]->str, redis_worker_id) != 0
+      ) {
+        return node_connector_fail(node, "failed to subscribe to worker PUBSUB channel");
+      }
+      nchan_update_stub_status(redis_connected_servers, 1);
+      
+      node->state++;
+      /* fall through */
+    case REDIS_NODE_GET_CLUSTERINFO:
+      if(!node->cluster.enabled) {
+        node->state = REDIS_NODE_READY;
+        return node_connector_callback(NULL, NULL, node);
+      }
+      else {
+        if(!node->ctx.cmd) {
+          return node_connector_fail(node, "cmd connection missing, can't send CLUSTER INFO command");
+        }
+        redisAsyncCommand(node->ctx.cmd, node_connector_callback, node, "CLUSTER INFO");
+        node->state++;
+      }
+      break;
+    
+    case REDIS_NODE_GETTING_CLUSTERINFO:
+      if(reply == NULL || reply->type == REDIS_REPLY_ERROR) {
+        return node_connector_fail(node, "CLUSTER INFO command failed,");
+      }
+      if(!nchan_cstr_match_line(reply->str, "cluster_state:ok")) {
+        node->cluster.ok=0;
+        return node_connector_fail(node, "cluster_state not ok");
+      }
+      node->cluster.ok=1;
+      node->state++;
+      /* fall through */
+    case REDIS_NODE_GET_CLUSTER_NODES:
+      if(!node->ctx.cmd) {
+        return node_connector_fail(node, "cmd connection missing, can't send CLUSTER NODES command");
+      }
+      redisAsyncCommand(node->ctx.cmd, node_connector_callback, node, "CLUSTER NODES");
+      node->state++;
+      break;
+    
+    case REDIS_NODE_GETTING_CLUSTER_NODES:
+      if(!node_connector_reply_str_ok(reply)) {
+        return node_connector_fail(node, "CLUSTER NODES command failed");
+      }
+      else {
+        size_t                  i, n;
+        cluster_nodes_line_t   *l;
+        if(!(l = parse_cluster_nodes(node, reply->str, &n))) {
+          return node_connector_fail(node, "parsing CLUSTER NODES command failed");
+        }
+        for(i=0; i<n; i++) {
+          if(l[i].self) {
+            nchan_strcpy(&node->cluster.id, &l[i].id, MAX_CLUSTER_ID_LENGTH);
+            if(l[i].slot_ranges_count == 0 && l[i].master) {
+              node_log_notice(node, "is a master cluster node with no keyslots");
+            }
+            else {
+              redis_node_t       *conflict_node;
+              node->cluster.slot_range.n = l[i].slot_ranges_count;
+              size_t                 j;
+              if(node->cluster.slot_range.range) {
+                ngx_free(node->cluster.slot_range.range);
+              }
+              node->cluster.slot_range.range = ngx_alloc(sizeof(redis_slot_range_t) * node->cluster.slot_range.n, ngx_cycle->log);
+              if(!node->cluster.slot_range.range) {
+                return node_connector_fail(node, "failed allocating cluster slots range");
+              }
+              if(!parse_cluster_node_slots(&l[i], node->cluster.slot_range.range)) {
+                return node_connector_fail(node, "failed parsing cluster slots range");
+              }
+              for(j = 0; j<node->cluster.slot_range.n; j++) {
+                if((conflict_node = nodeset_node_find_by_range(nodeset, &node->cluster.slot_range.range[j]))!=NULL) {
+                  u_char buf[1024];
+                  ngx_snprintf(buf, 1024, "keyslot range conflict with node %s. These nodes are probably from different clusters.%Z", node_cstr(conflict_node));
+                  return node_connector_fail(node, (char *)buf);
+                }
+              }
+              
+              if(!nodeset_cluster_node_index_keyslot_ranges(node)) {
+                return node_connector_fail(node, "indexing keyslot ranges failed");
+              }
+            }
+          }
+          else if(!node_skip_cluster_peer(node, &l[i])) {
+            node_discover_cluster_peer(node, &l[i]);
+          }
+        }
+      }
+      node->state = REDIS_NODE_READY;
+      //intentional fall-through is affirmatively consensual
+      //yes, i consent to being fallen through.
+      //                               Signed, 
+      //                                 REDIS_NODE_GETTING_CLUSTER_NODES
+      //NOTE: consent required each time a fallthrough is imposed
+      /* fall through */
+    case REDIS_NODE_READY:
+      if(node->connect_timeout) {
+        nchan_abort_oneshot_timer(node->connect_timeout);
+        node->connect_timeout = NULL;
+      }
+      if(!node->ping_timer.timer_set && nodeset->settings.ping_interval > 0) {
+        ngx_add_timer(&node->ping_timer, nodeset->settings.ping_interval * 1000);
+      }
+      node_log_notice(node, "%s", node->generation == 0 ? "connected" : "reconnected");
+      node->generation++;
+      nodeset_examine(nodeset);
+      break;
+      
+  }
+}
+
+static int nodeset_cluster_keyslot_space_complete(redis_nodeset_t *ns) {
+  ngx_rbtree_node_t                  *node;
+  redis_slot_range_t                  range = {0, 0};
+  redis_nodeset_slot_range_node_t    *rangenode;
+  
+  while(range.min <= 16383) {
+    if((node = rbtree_find_node(&ns->cluster.keyslots, &range)) == NULL) {
+      DBG("cluster slots range incomplete: can't find slot %i", range.min);
+      return 0;
+    }
+    rangenode = rbtree_data_from_node(node);
+    
+    if(rangenode->node->state < REDIS_NODE_READY) {
+      node_log_notice(rangenode->node, "cluster node for range %d - %d not connected", rangenode->range.min, rangenode->range.max);
+      return 0;
+    }
+    
+    range.min = rangenode->range.max + 1;
+    range.max = range.min;
+  }
+  DBG("cluster range complete");
+  //print_cluster_slots(cluster);
+  return 1;
+}
+
+static int nodeset_status_timer_interval(redis_nodeset_status_t status) {
+  switch(status) {
+    case REDIS_NODESET_FAILED:
+    case REDIS_NODESET_INVALID:
+    case REDIS_NODESET_DISCONNECTED:
+      return 2000;
+    case REDIS_NODESET_FAILING:
+    case REDIS_NODESET_CLUSTER_FAILING:
+      return 300;
+    case REDIS_NODESET_CONNECTING:
+      return 1000;
+    case REDIS_NODESET_READY:
+      return 10000;
+  }
+  return 500; //default?
+}
+
+void nodeset_onready_expire_event(ngx_event_t *ev) {
+  nodeset_onready_callback_t *rcb = ev->data;
+  rcb->cb(rcb->ns, rcb->pd);
+  nchan_list_remove(&rcb->ns->onready_callbacks, rcb);
+}
+
+ngx_int_t nodeset_callback_on_ready(redis_nodeset_t *ns, ngx_msec_t max_wait, ngx_int_t (*cb)(redis_nodeset_t *, void *), void *pd) {
+  nodeset_onready_callback_t *ncb;
+  
+  if(ns->status == REDIS_NODESET_READY) {
+    cb(ns, pd);
+    return NGX_OK;
+  }
+  
+  ncb = nchan_list_append(&ns->onready_callbacks);
+  if(ncb == NULL) {
+    ERR("failed to add to onready_callback list");
+    return NGX_ERROR;
+  }
+  
+  ncb->cb = cb;
+  ncb->pd = pd;
+  ncb->ns = ns;
+  ngx_memzero(&ncb->ev, sizeof(ncb->ev));
+  if(max_wait > 0) {
+    nchan_init_timer(&ncb->ev, nodeset_onready_expire_event, ncb);
+    ngx_add_timer(&ncb->ev, max_wait);
+  }
+  
+  return NGX_OK;
+}
+
+ngx_int_t nodeset_run_on_ready_callbacks(redis_nodeset_t *ns) {
+  nodeset_onready_callback_t *rcb;
+  for(rcb = nchan_list_first(&ns->onready_callbacks); rcb != NULL; rcb = nchan_list_next(rcb)) {
+    if(rcb->ev.timer_set) {
+      ngx_del_timer(&rcb->ev);
+    }
+    rcb->cb(ns, rcb->pd);
+  }
+  nchan_list_empty(&ns->onready_callbacks);
+  return NGX_OK;
+}
+
+ngx_int_t nodeset_abort_on_ready_callbacks(redis_nodeset_t *ns) {
+  nodeset_onready_callback_t *rcb;
+  for(rcb = nchan_list_first(&ns->onready_callbacks); rcb != NULL; rcb = nchan_list_next(rcb)) {
+    if(rcb->ev.timer_set) {
+      ngx_del_timer(&rcb->ev);
+    }
+    rcb->cb(ns, rcb->pd);
+  }
+  nchan_list_empty(&ns->onready_callbacks);
+  return NGX_OK;
+}
+
+static ngx_int_t update_chanhead_status_on_reconnect(rdstore_channel_head_t *ch) {
+  if(ch->redis.node.cmd && ch->redis.node.pubsub && ch->pubsub_status == REDIS_PUBSUB_SUBSCRIBED && ch->status == NOTREADY) {
+    ch->status = READY;
+  }
+  return NGX_OK;
+}
+
+ngx_int_t nodeset_reconnect_disconnected_channels(redis_nodeset_t *ns) {
+  rdstore_channel_head_t *cur;
+  nchan_slist_t *disconnected_cmd = &ns->channels.disconnected_cmd;
+  nchan_slist_t *disconnected_pubsub = &ns->channels.disconnected_pubsub;
+  assert(nodeset_ready(ns));
+
+  while((cur = nchan_slist_pop(disconnected_cmd)) != NULL) {
+    assert(cur->redis.node.cmd == NULL);
+    cur->redis.slist.in_disconnected_cmd_list = 0;
+    assert(nodeset_node_find_by_chanhead(cur)); // this reuses the linked-list fields
+    update_chanhead_status_on_reconnect(cur);
+  }
+  
+  while((cur = nchan_slist_pop(disconnected_pubsub)) != NULL) {
+    assert(cur->redis.node.pubsub == NULL);
+    cur->redis.slist.in_disconnected_pubsub_list = 0;
+    assert(nodeset_node_pubsub_find_by_chanhead(cur)); // this reuses the linked-list fields
+    redis_chanhead_catch_up_after_reconnect(cur);
+    ensure_chanhead_pubsub_subscribed_if_needed(cur);
+    update_chanhead_status_on_reconnect(cur);
+  }
+  
+  return NGX_OK;
+}
+
+const char *__nodeset_nickname_cstr(redis_nodeset_t *nodeset) {
+  static char str[1024];
+  const char *what = NULL;
+  ngx_str_t  *name = NULL;
+  what = nodeset->cluster.enabled ? "cluster" : "server";
+  if(nodeset->upstream) {
+    name = &nodeset->upstream->host;
+  }
+  else {
+    ngx_str_t **url = nchan_list_first(&nodeset->urls);
+    if(url && *url) {
+      name = *url;
+    }
+  }
+  if(what && name) {
+    ngx_snprintf((u_char *)str, 1024, "%s %V%Z", what, name);
+  }
+  else if(what) {
+    ngx_snprintf((u_char *)str, 1024, "%s%Z", what);
+  }
+  else if(name) {
+    ngx_snprintf((u_char *)str, 1024, "%V%Z", name);
+  }
+  else {
+    ngx_snprintf((u_char *)str, 1024, "node set%Z");
+  }
+  return str;
+}
+
+const char *__node_nickname_cstr(redis_node_t *node) {
+  static char buf[512];
+  if(node) {
+    __node_cstr(node, buf);
+    return buf;
+  }
+  else {
+    return "???";
+  }
+}
+
+ngx_int_t nodeset_set_status(redis_nodeset_t *nodeset, redis_nodeset_status_t status, const char *msg) {
+  nodeset->status_msg = msg;
+  if(nodeset->status != status) {
+    if(msg) {
+      ngx_uint_t  lvl;
+      if(status == REDIS_NODESET_INVALID) {
+        lvl = NGX_LOG_ERR;
+      }
+      else if(status == REDIS_NODESET_DISCONNECTED
+        ||    status == REDIS_NODESET_CLUSTER_FAILING
+        ||    status == REDIS_NODESET_FAILED
+      ) {
+        lvl = NGX_LOG_WARN;
+      }
+      else {
+        lvl = NGX_LOG_NOTICE;
+      }
+      nodeset_log(nodeset, lvl, "%s", msg);
+    }
+    nodeset->current_status_start = ngx_time();
+    nodeset->current_status_times_checked = 0;
+    nodeset->status = status;
+    
+    if(nodeset->status_check_ev.timer_set) {
+      ngx_del_timer(&nodeset->status_check_ev);
+    }
+    
+    switch(status) {
+      case REDIS_NODESET_FAILED:
+      case REDIS_NODESET_DISCONNECTED:
+      case REDIS_NODESET_INVALID:
+        nodeset_disconnect(nodeset);
+        break;
+      case REDIS_NODESET_CLUSTER_FAILING:
+        
+        //very intentional fallthrough
+      case REDIS_NODESET_FAILING:
+        nodeset_connect(nodeset);
+        break;
+      case REDIS_NODESET_CONNECTING:
+        //no special actions
+        break;
+      case REDIS_NODESET_READY:
+        nodeset_reconnect_disconnected_channels(nodeset);
+        nodeset_run_on_ready_callbacks(nodeset);
+        break;
+    }
+  }
+  
+  if(!nodeset->status_check_ev.timer_set) {
+    ngx_add_timer(&nodeset->status_check_ev, nodeset_status_timer_interval(status));
+  }
+  return NGX_OK;
+}
+
+static void node_find_slaves_callback(redisAsyncContext *ac, void *rep, void *pd) {
+  redis_node_t   *node = pd;
+  redisReply     *reply = rep;
+  if(!reply) {
+    node_log_debug(node, "INFO REPLICATION aborted reply");
+    return;
+  }
+  node_discover_slaves_from_info_reply(node, reply);
+}
+
+ngx_int_t nodeset_examine(redis_nodeset_t *nodeset) {
+  redis_node_t *cur, *next;
+  int cluster = 0, masters = 0, slaves = 0, total = 0, connecting = 0, ready = 0, disconnected = 0;
+  int discovered = 0, failed_masters=0, failed_slaves = 0, failed_unknowns = 0;
+  int ready_cluster = 0, ready_non_cluster = 0, connecting_masters = 0;
+  redis_nodeset_status_t current_status = nodeset->status;
+  //ERR("check nodeset %p", nodeset);
+  
+  for(cur = nchan_list_first(&nodeset->nodes); cur != NULL; cur = next) {
+    next = nchan_list_next(cur);
+    total++;
+    if(cur->cluster.enabled == 1) {
+      cluster++;
+    }
+    if(cur->discovered)
+      discovered++;
+    if(cur->role == REDIS_NODE_ROLE_MASTER) {
+      masters++;
+      if(cur->state > REDIS_NODE_DISCONNECTED && cur->state < REDIS_NODE_READY) {
+        connecting_masters++;
+      }
+    }
+    if(cur->role == REDIS_NODE_ROLE_SLAVE)
+      slaves++;
+    if(cur->state <= REDIS_NODE_DISCONNECTED)
+      disconnected++;
+    if(cur->state > REDIS_NODE_DISCONNECTED && cur->state < REDIS_NODE_READY)
+      connecting++;
+    if(cur->state == REDIS_NODE_READY) {
+      ready++;
+      if(cur->cluster.enabled == 1)
+        ready_cluster++;
+      else
+        ready_non_cluster++;
+    }
+    if(cur->state == REDIS_NODE_FAILED) {
+      if(cur->role == REDIS_NODE_ROLE_MASTER) {
+        failed_masters++;
+      }
+      else if(cur->role == REDIS_NODE_ROLE_SLAVE) {
+        failed_slaves++;
+        if(cur->peers.master && cur->peers.master->state >= REDIS_NODE_READY && cur->nodeset->status == REDIS_NODESET_READY) {
+          //rediscover slaves
+          redisAsyncCommand(cur->peers.master->ctx.cmd, node_find_slaves_callback, cur->peers.master, "INFO REPLICATION");
+        }
+        //remove failed slave
+        node_log_notice(cur, "removed failed slave node");
+        node_disconnect(cur, REDIS_NODE_FAILED);
+        nodeset_node_destroy(cur);
+        total--;
+      }
+      else {
+        failed_unknowns++;
+      }
+    }
+  }
+  
+  nodeset->cluster.enabled = cluster > 0;
+  
+  if(current_status == REDIS_NODESET_CONNECTING && connecting > 0) {
+    //still connecting, with a few nodws yet to try to connect
+    return NGX_OK;
+  }
+  if(ready == 0 && total == 0) {
+    nodeset_set_status(nodeset, REDIS_NODESET_INVALID, "no reachable servers");
+  }
+  else if(cluster == 0 && masters > 1) {
+    nodeset_set_status(nodeset, REDIS_NODESET_INVALID, "invalid config, more than one master in non-cluster");
+  }
+  else if(ready_cluster > 0 && ready_non_cluster > 0) {
+    nodeset_set_status(nodeset, REDIS_NODESET_INVALID, "invalid config, cluster and non-cluster servers present");
+  }
+  else if(connecting > 0) {
+    nodeset_set_status(nodeset, REDIS_NODESET_CONNECTING, NULL);
+  }
+  else if(failed_masters > 0) {
+    if(current_status == REDIS_NODESET_READY) {
+      nodeset_set_status(nodeset, REDIS_NODESET_FAILING, NULL);
+    }
+    else {
+      nodeset_set_status(nodeset, REDIS_NODESET_FAILED, NULL);
+    }
+  }
+  else if (masters == 0) {
+    //this prevents slave-of-slave-of-master lookups
+    nodeset_set_status(nodeset, REDIS_NODESET_INVALID, "no reachable masters");
+  }
+  else if(cluster > 0 && !nodeset_cluster_keyslot_space_complete(nodeset)) {
+      nodeset_set_status(nodeset, REDIS_NODESET_CONNECTING, "keyslot space incomplete");
+  }
+  else if(current_status == REDIS_NODESET_READY && (ready == 0 || ready < total)) {
+    nodeset_set_status(nodeset, REDIS_NODESET_FAILING, NULL);
+  }
+  else if(ready == 0) {
+    nodeset_set_status(nodeset, REDIS_NODESET_DISCONNECTED, "no connected servers");
+  }
+  else {
+    nodeset_set_status(nodeset, REDIS_NODESET_READY, "ready");
+  } 
+  
+  return NGX_OK;
+}
+
+static void nodeset_check_status_event(ngx_event_t *ev) {
+  redis_nodeset_t *ns = ev->data;
+  
+  if(!ev->timedout) {
+    return;
+  }
+  DBG("nodeset %p status check event", ns);
+  ev->timedout = 0;
+  
+  switch(ns->status) {
+    case REDIS_NODESET_FAILED:
+      //fall-through rather intentionally
+      if(ngx_time() - ns->current_status_start > REDIS_NODESET_RECONNECT_WAIT_TIME_SEC) {
+        nodeset_log_notice(ns, "reconnecting...");
+        nodeset_connect(ns);
+      }
+      break;
+    case REDIS_NODESET_INVALID:
+    case REDIS_NODESET_DISCONNECTED:
+      //connect whatever needs to be connected
+      nodeset_connect(ns);
+      break;
+    
+    case REDIS_NODESET_CONNECTING:
+      //wait it out
+      if(ngx_time() - ns->current_status_start > REDIS_NODESET_MAX_CONNECTING_TIME_SEC) {
+        nodeset_set_status(ns, REDIS_NODESET_DISCONNECTED, "Redis node set took too long to connect");
+      }
+      else {
+        nodeset_examine(ns); // full status check
+      }
+      break;
+    case REDIS_NODESET_CLUSTER_FAILING:
+    case REDIS_NODESET_FAILING:
+      if(ngx_time() - ns->current_status_start > REDIS_NODESET_MAX_FAILING_TIME_SEC) {
+        nodeset_set_status(ns, REDIS_NODESET_FAILED, "Redis node set has failed");
+      }
+      break;
+    
+    case REDIS_NODESET_READY:
+      nodeset_reconnect_disconnected_channels(ns); //in case there are any waiting around
+      nodeset_run_on_ready_callbacks(ns); //in case there are any that got left behind
+      break;
+  }
+  
+  //check again soon!
+  if(!ev->timer_set) {
+    ngx_add_timer(ev, nodeset_status_timer_interval(ns->status));
+  }
+}
+
+int nodeset_connect(redis_nodeset_t *ns) {
+  redis_node_t             *node;
+  ngx_str_t               **url;
+  redis_connect_params_t    rcp;
+  
+  for(url = nchan_list_first(&ns->urls); url != NULL; url = nchan_list_next(url)) {
+    parse_redis_url(*url, &rcp);
+    if((node = nodeset_node_find_by_connect_params(ns, &rcp)) == NULL) {
+      node = nodeset_node_create(ns, &rcp);
+      node_log_debug(node, "created");
+    }
+    assert(node);
+  }
+  for(node = nchan_list_first(&ns->nodes); node != NULL; node = nchan_list_next(node)) {
+    if(node->state <= REDIS_NODE_DISCONNECTED) {
+      node_log_debug(node, "start connecting");
+      node_connect(node);
+    }
+  }
+  nodeset_set_status(ns, REDIS_NODESET_CONNECTING, NULL);
+  return 1;
+}
+
+int nodeset_disconnect(redis_nodeset_t *ns) {
+  redis_node_t *node;
+  for(node = nchan_list_first(&ns->nodes); node != NULL; node = nchan_list_first(&ns->nodes)) {
+    node_log_debug(node, "destroy %p", node);
+    if(node->state > REDIS_NODE_DISCONNECTED) {
+      node_log_debug(node, "intiating disconnect");
+      node_disconnect(node, REDIS_NODE_DISCONNECTED);
+    }
+    nodeset_node_destroy(node);
+  }
+  
+  return 1;
+}
+
+
+ngx_int_t nodeset_connect_all(void) {
+  int                      i;
+  redis_nodeset_t         *ns;
+  DBG("connect all");
+  for(i=0; i<redis_nodeset_count; i++) {
+    ns = &redis_nodeset[i];
+    nodeset_connect(ns);
+  }
+  return NGX_OK;
+}
+
+ngx_int_t nodeset_destroy_all(void) {
+  int                      i;
+  redis_nodeset_t         *ns;
+  DBG("nodeset destroy all");
+  for(i=0; i<redis_nodeset_count; i++) {
+    ns = &redis_nodeset[i];
+    nodeset_disconnect(ns);
+    nchan_list_empty(&ns->urls);
+  }
+  redis_nodeset_count = 0;
+  return NGX_OK;
+}
+
+ngx_int_t nodeset_each(void (*cb)(redis_nodeset_t *, void *), void *privdata) {
+  int                      i;
+  redis_nodeset_t         *ns;
+  for(i=0; i<redis_nodeset_count; i++) {
+    ns = &redis_nodeset[i];
+    cb(ns, privdata);
+  }
+  return NGX_OK;
+}
+ngx_int_t nodeset_each_node(redis_nodeset_t *ns, void (*cb)(redis_node_t *, void *), void *privdata) {
+  redis_node_t             *node, *next;
+  for(node = nchan_list_first(&ns->nodes); node != NULL; node = next) {
+    next = nchan_list_next(node);
+    cb(node, privdata);
+  }
+  return NGX_OK;
+}
+
+static ngx_int_t set_preallocated_peername(redisAsyncContext *ctx, ngx_str_t *dst) {
+  char                  *ipstr = (char *)dst->data;
+  struct sockaddr_in    *s4;
+  struct sockaddr_in6   *s6;
+  // deal with both IPv4 and IPv6:
+  switch(ctx->c.sockaddr.sa_family) {
+    case AF_INET:
+      s4 = (struct sockaddr_in *)&ctx->c.sockaddr;
+      inet_ntop(AF_INET, &s4->sin_addr, ipstr, INET6_ADDRSTRLEN);
+      break;
+    case AF_INET6:
+      s6 = (struct sockaddr_in6 *)&ctx->c.sockaddr;
+      inet_ntop(AF_INET6, &s6->sin6_addr, ipstr, INET6_ADDRSTRLEN);
+      break;
+    case AF_UNSPEC:
+    default:
+      DBG("couldn't get sockaddr");
+      return NGX_ERROR;
+  }
+  dst->len = strlen(ipstr);
+  return NGX_OK;
+}
+
+
+//sneaky channel stuff
+ngx_int_t nodeset_associate_chanhead(redis_nodeset_t *ns, void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  if(ch->redis.nodeset && ch->redis.nodeset != ns) {
+    nodeset_dissociate_chanhead(ch);
+  }
+  ngx_memzero(&ch->redis.slist, sizeof(ch->redis.slist));
+  ch->redis.nodeset = ns;
+  nchan_slist_append(&ns->channels.all, ch);
+  return NGX_OK;
+}
+ngx_int_t nodeset_dissociate_chanhead(void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  redis_nodeset_t *ns = ch->redis.nodeset;
+  
+  if(ns) {
+    if(ch->redis.node.cmd) {
+      assert(!ch->redis.slist.in_disconnected_cmd_list);
+      nodeset_node_dissociate_chanhead(ch);
+    }
+    else if(ch->redis.slist.in_disconnected_cmd_list) {
+      ch->redis.slist.in_disconnected_cmd_list = 0;
+      nchan_slist_remove(&ns->channels.disconnected_cmd, ch);
+    }
+    
+    if(ch->redis.node.pubsub) {
+      assert(!ch->redis.slist.in_disconnected_pubsub_list);
+      nodeset_node_dissociate_pubsub_chanhead(ch);
+    }
+    else if(ch->redis.slist.in_disconnected_pubsub_list) {
+      ch->redis.slist.in_disconnected_pubsub_list = 0;
+      nchan_slist_remove(&ns->channels.disconnected_pubsub, ch);
+    }
+    
+    ch->redis.nodeset = NULL;
+    nchan_slist_remove(&ns->channels.all, ch);
+  }
+  return NGX_OK;
+}
+ngx_int_t nodeset_node_associate_chanhead(redis_node_t *node, void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  assert(ch->redis.node.cmd == NULL);
+  assert(node->nodeset == ch->redis.nodeset);
+  assert(ch->redis.slist.in_disconnected_cmd_list == 0);
+  if(ch->redis.node.cmd != node) { //dat idempotence tho
+    nchan_slist_append(&node->channels.cmd, ch);
+  }
+  ch->redis.node.cmd = node;
+  return NGX_OK;
+}
+ngx_int_t nodeset_node_associate_pubsub_chanhead(redis_node_t *node, void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  assert(ch->redis.node.pubsub == NULL);
+  assert(node->nodeset == ch->redis.nodeset);
+  assert(ch->redis.slist.in_disconnected_pubsub_list == 0);
+  if(ch->redis.node.pubsub != node) { //dat idempotence tho
+    nchan_slist_append(&node->channels.pubsub, ch);
+  }
+  ch->redis.node.pubsub = node;
+  return NGX_OK;
+}
+ngx_int_t nodeset_node_dissociate_chanhead(void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  if(ch->redis.node.cmd) {
+    nchan_slist_remove(&ch->redis.node.cmd->channels.cmd, ch);
+  }
+  ch->redis.node.cmd = NULL;
+  return NGX_OK;
+}
+ngx_int_t nodeset_node_dissociate_pubsub_chanhead(void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  if(ch->redis.node.pubsub) {
+    nchan_slist_remove(&ch->redis.node.pubsub->channels.pubsub, ch);
+  }
+  ch->redis.node.pubsub = NULL; 
+  return NGX_OK;
+}
+
+static redis_node_t *nodeset_node_random_master_or_slave(redis_node_t *master) {
+  redis_nodeset_t *ns = master->nodeset;
+  int master_total = ns->settings.node_weight.master;
+  int slave_total = master->peers.slaves.n * ns->settings.node_weight.slave;
+  int n;
+  
+  assert(master->role == REDIS_NODE_ROLE_MASTER);
+  
+  if(master_total + slave_total == 0) {
+    return master;
+  }
+  
+  n = ngx_random() % (slave_total + master_total);
+  if(n < master_total) {
+    return master;
+  }
+  else {
+    int           i = 0;
+    n = ngx_random() % master->peers.slaves.n; //random slave
+    redis_node_t **nodeptr;
+    for(nodeptr = nchan_list_first(&master->peers.slaves); nodeptr != NULL && i < n; nodeptr = nchan_list_next(nodeptr)) {
+      i++;
+    }
+    if(nodeptr == NULL || (*nodeptr)->state < REDIS_NODE_READY) {
+      //not ready? play it safe.
+      //node_log_error(*nodeptr, "got slave, but it's not ready. return master instead");
+      return master;
+    }
+    else {
+      //node_log_error(*nodeptr, "got slave");
+      return *nodeptr;
+    }
+  }
+}
+
+redis_node_t *nodeset_node_find_by_chanhead(void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  redis_node_t           *node;
+  if(ch->redis.node.cmd) {
+    return ch->redis.node.cmd;
+  }
+  node = nodeset_node_find_by_channel_id(ch->redis.nodeset, &ch->id);
+  nodeset_node_associate_chanhead(node, ch);
+  return node;
+}
+redis_node_t *nodeset_node_pubsub_find_by_chanhead(void *chan) {
+  rdstore_channel_head_t *ch = chan;
+  redis_node_t           *node;
+  if(ch->redis.node.pubsub) {
+    return ch->redis.node.pubsub;
+  }
+  node = nodeset_node_find_by_channel_id(ch->redis.nodeset, &ch->id);
+  node = nodeset_node_random_master_or_slave(node);
+  nodeset_node_associate_pubsub_chanhead(node, ch);
+  return ch->redis.node.pubsub;
+}
+
+/*
+ * Copyright 2001-2010 Georges Menie (www.menie.org)
+ * Copyright 2010 Salvatore Sanfilippo (adapted to Redis coding style)
+ * All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the University of California, Berkeley nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE REGENTS AND CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* CRC16 implementation according to CCITT standards.
+ *
+ * Note by @antirez: this is actually the XMODEM CRC 16 algorithm, using the
+ * following parameters:
+ *
+ * Name                       : "XMODEM", also known as "ZMODEM", "CRC-16/ACORN"
+ * Width                      : 16 bit
+ * Poly                       : 1021 (That is actually x^16 + x^12 + x^5 + 1)
+ * Initialization             : 0000
+ * Reflect Input byte         : False
+ * Reflect Output CRC         : False
+ * Xor constant to output CRC : 0000
+ * Output for "123456789"     : 31C3
+ */
+
+static const uint16_t crc16tab[256]= {
+    0x0000,0x1021,0x2042,0x3063,0x4084,0x50a5,0x60c6,0x70e7,
+    0x8108,0x9129,0xa14a,0xb16b,0xc18c,0xd1ad,0xe1ce,0xf1ef,
+    0x1231,0x0210,0x3273,0x2252,0x52b5,0x4294,0x72f7,0x62d6,
+    0x9339,0x8318,0xb37b,0xa35a,0xd3bd,0xc39c,0xf3ff,0xe3de,
+    0x2462,0x3443,0x0420,0x1401,0x64e6,0x74c7,0x44a4,0x5485,
+    0xa56a,0xb54b,0x8528,0x9509,0xe5ee,0xf5cf,0xc5ac,0xd58d,
+    0x3653,0x2672,0x1611,0x0630,0x76d7,0x66f6,0x5695,0x46b4,
+    0xb75b,0xa77a,0x9719,0x8738,0xf7df,0xe7fe,0xd79d,0xc7bc,
+    0x48c4,0x58e5,0x6886,0x78a7,0x0840,0x1861,0x2802,0x3823,
+    0xc9cc,0xd9ed,0xe98e,0xf9af,0x8948,0x9969,0xa90a,0xb92b,
+    0x5af5,0x4ad4,0x7ab7,0x6a96,0x1a71,0x0a50,0x3a33,0x2a12,
+    0xdbfd,0xcbdc,0xfbbf,0xeb9e,0x9b79,0x8b58,0xbb3b,0xab1a,
+    0x6ca6,0x7c87,0x4ce4,0x5cc5,0x2c22,0x3c03,0x0c60,0x1c41,
+    0xedae,0xfd8f,0xcdec,0xddcd,0xad2a,0xbd0b,0x8d68,0x9d49,
+    0x7e97,0x6eb6,0x5ed5,0x4ef4,0x3e13,0x2e32,0x1e51,0x0e70,
+    0xff9f,0xefbe,0xdfdd,0xcffc,0xbf1b,0xaf3a,0x9f59,0x8f78,
+    0x9188,0x81a9,0xb1ca,0xa1eb,0xd10c,0xc12d,0xf14e,0xe16f,
+    0x1080,0x00a1,0x30c2,0x20e3,0x5004,0x4025,0x7046,0x6067,
+    0x83b9,0x9398,0xa3fb,0xb3da,0xc33d,0xd31c,0xe37f,0xf35e,
+    0x02b1,0x1290,0x22f3,0x32d2,0x4235,0x5214,0x6277,0x7256,
+    0xb5ea,0xa5cb,0x95a8,0x8589,0xf56e,0xe54f,0xd52c,0xc50d,
+    0x34e2,0x24c3,0x14a0,0x0481,0x7466,0x6447,0x5424,0x4405,
+    0xa7db,0xb7fa,0x8799,0x97b8,0xe75f,0xf77e,0xc71d,0xd73c,
+    0x26d3,0x36f2,0x0691,0x16b0,0x6657,0x7676,0x4615,0x5634,
+    0xd94c,0xc96d,0xf90e,0xe92f,0x99c8,0x89e9,0xb98a,0xa9ab,
+    0x5844,0x4865,0x7806,0x6827,0x18c0,0x08e1,0x3882,0x28a3,
+    0xcb7d,0xdb5c,0xeb3f,0xfb1e,0x8bf9,0x9bd8,0xabbb,0xbb9a,
+    0x4a75,0x5a54,0x6a37,0x7a16,0x0af1,0x1ad0,0x2ab3,0x3a92,
+    0xfd2e,0xed0f,0xdd6c,0xcd4d,0xbdaa,0xad8b,0x9de8,0x8dc9,
+    0x7c26,0x6c07,0x5c64,0x4c45,0x3ca2,0x2c83,0x1ce0,0x0cc1,
+    0xef1f,0xff3e,0xcf5d,0xdf7c,0xaf9b,0xbfba,0x8fd9,0x9ff8,
+    0x6e17,0x7e36,0x4e55,0x5e74,0x2e93,0x3eb2,0x0ed1,0x1ef0
+};
+
+uint16_t redis_crc16(uint16_t crc, const char *buf, int len) {
+    int counter;
+    for (counter = 0; counter < len; counter++)
+            crc = (crc<<8) ^ crc16tab[((crc>>8) ^ *buf++)&0x00FF];
+    return crc;
+}
+
diff --git a/debian/modules/nchan/src/store/redis/redis_nodeset.h b/debian/modules/nchan/src/store/redis/redis_nodeset.h
new file mode 100644
index 00000000..59ee0cf5
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/redis_nodeset.h
@@ -0,0 +1,276 @@
+#ifndef NCHAN_REDIS_NODESET_H
+#define NCHAN_REDIS_NODESET_H
+
+#include <nchan_module.h>
+#if NCHAN_HAVE_HIREDIS_WITH_SOCKADDR
+#include <hiredis/hiredis.h>
+#include <hiredis/async.h>
+#else
+#include <store/redis/hiredis/hiredis.h>
+#include <store/redis/hiredis/async.h>
+#endif
+#include <util/nchan_reaper.h>
+#include <util/nchan_rbtree.h>
+#include <util/nchan_list.h>
+#include <util/nchan_slist.h>
+
+//#include "store-private.h"
+
+//#define REDIS_NODESET_DBG 1
+
+#define node_log(node, lvl, fmt, args...) \
+  ngx_log_error(lvl, ngx_cycle->log, 0, "nchan: Redis node %s " fmt, __node_nickname_cstr(node), ##args)
+#define node_log_error(node, fmt, args...)    node_log((node), NGX_LOG_ERR, fmt, ##args)
+#define node_log_warning(node, fmt, args...)  node_log((node), NGX_LOG_WARN, fmt, ##args)
+#define node_log_notice(node, fmt, args...)   node_log((node), NGX_LOG_NOTICE, fmt, ##args)
+#define node_log_info(node, fmt, args...)     node_log((node), NGX_LOG_INFO, fmt, ##args)
+#define node_log_debug(node, fmt, args...)    node_log((node), NGX_LOG_DEBUG, fmt, ##args)
+  
+#define nodeset_log(nodeset, lvl, fmt, args...) \
+  ngx_log_error(lvl, ngx_cycle->log, 0, "nchan: Redis %s: " fmt, __nodeset_nickname_cstr(nodeset), ##args)
+#define nodeset_log_error(nodeset, fmt, args...)    nodeset_log((nodeset), NGX_LOG_ERR, fmt, ##args)
+#define nodeset_log_warning(nodeset, fmt, args...)  nodeset_log((nodeset), NGX_LOG_WARN, fmt, ##args)
+#define nodeset_log_notice(nodeset, fmt, args...)   nodeset_log((nodeset), NGX_LOG_NOTICE, fmt, ##args)
+#define nodeset_log_info(nodeset, fmt, args...)     nodeset_log((nodeset), NGX_LOG_INFO, fmt, ##args)
+#define nodeset_log_debug(nodeset, fmt, args...)    nodeset_log((nodeset), NGX_LOG_DEBUG, fmt, ##args)
+
+#define NCHAN_MAX_NODESETS 128
+#define REDIS_NODESET_STATUS_CHECK_TIME_MSEC 4000
+#define REDIS_NODESET_MAX_CONNECTING_TIME_SEC 5
+#define REDIS_NODESET_RECONNECT_WAIT_TIME_SEC 5
+#define REDIS_NODESET_MAX_FAILING_TIME_SEC 2
+
+#define REDIS_NODE_DEDUPLICATED         -100
+#define REDIS_NODE_CONNECTION_TIMED_OUT   -2
+#define REDIS_NODE_FAILED                 -1
+#define REDIS_NODE_DISCONNECTED            0
+#define REDIS_NODE_CMD_CONNECTING          1
+#define REDIS_NODE_PUBSUB_CONNECTING       2
+#define REDIS_NODE_CONNECTED               3
+#define REDIS_NODE_CMD_AUTHENTICATING      4
+#define REDIS_NODE_PUBSUB_AUTHENTICATING   5
+#define REDIS_NODE_SELECT_DB               6
+#define REDIS_NODE_CMD_SELECTING_DB        7
+#define REDIS_NODE_PUBSUB_SELECTING_DB     8
+#define REDIS_NODE_SCRIPTS_LOAD            9
+#define REDIS_NODE_SCRIPTS_LOADING        10
+#define REDIS_NODE_GET_INFO               11
+#define REDIS_NODE_GETTING_INFO           12
+#define REDIS_NODE_PUBSUB_GET_INFO        13
+#define REDIS_NODE_PUBSUB_GETTING_INFO    14
+#define REDIS_NODE_SUBSCRIBE_WORKER       15
+#define REDIS_NODE_SUBSCRIBING_WORKER     16
+#define REDIS_NODE_GET_CLUSTERINFO        17
+#define REDIS_NODE_GETTING_CLUSTERINFO    18
+#define REDIS_NODE_GET_CLUSTER_NODES      19
+#define REDIS_NODE_GETTING_CLUSTER_NODES  20
+#define REDIS_NODE_READY                  100
+  
+typedef struct redis_nodeset_s redis_nodeset_t;
+typedef struct redis_node_s redis_node_t;
+
+typedef struct { //redis_nodeset_cluster_t
+  unsigned                    enabled:1;
+  rbtree_seed_t               keyslots; //cluster rbtree seed
+} redis_nodeset_cluster_t;
+
+typedef struct {
+  unsigned         min:16;
+  unsigned         max:16;
+} redis_slot_range_t;
+
+typedef enum {
+  REDIS_NODE_ROLE_UNKNOWN = 0, REDIS_NODE_ROLE_MASTER, REDIS_NODE_ROLE_SLAVE
+} redis_node_role_t;
+
+typedef enum {
+  REDIS_NODESET_FAILED = -4,
+  REDIS_NODESET_CLUSTER_FAILING = -3,
+  REDIS_NODESET_FAILING = -2,
+  REDIS_NODESET_INVALID = -1,
+  REDIS_NODESET_DISCONNECTED = 0,
+  REDIS_NODESET_CONNECTING,
+  REDIS_NODESET_READY
+} redis_nodeset_status_t;
+
+#if REDIS_NODESET_DBG
+typedef struct {
+  int  n;
+  redis_node_t *node[128];
+} redis_node_dbg_list_t;
+typedef struct {
+  redis_slot_range_t range;
+  redis_node_t       *node;
+} redis_node_range_dbg_t;
+typedef struct {
+  int  n;
+  redis_node_range_dbg_t node[128];
+} redis_nodeset_dbg_range_tree_t;
+#endif
+
+
+
+struct redis_nodeset_s {
+  //a set of redis nodes
+  //  maybe just 1 master
+  //  maybe a master and its slaves
+  //  maybe a cluster of masters and their slaves
+  //slaves of slaves not included
+  
+  redis_nodeset_status_t      status;
+  ngx_event_t                 status_check_ev;
+  const char                 *status_msg;
+  time_t                      current_status_start;
+  ngx_int_t                   current_status_times_checked;
+  ngx_int_t                   generation;
+  nchan_list_t                urls;
+  nchan_loc_conf_t           *first_loc_conf;
+  ngx_http_upstream_srv_conf_t *upstream;
+  nchan_list_t                nodes;
+  redis_nodeset_cluster_t     cluster;
+  struct {                    //settings
+    nchan_redis_storage_mode_t  storage_mode;
+    ngx_int_t                   nostore_fastpublish;
+    struct {                    //pubsub_subscribe_weight
+      ngx_int_t                   master;
+      ngx_int_t                   slave;
+    }                           node_weight;
+    time_t                      ping_interval;
+    ngx_str_t                  *namespace;
+    nchan_redis_optimize_t      optimize_target;
+    ngx_msec_t                  connect_timeout;
+  }                           settings;
+  
+  struct {
+    nchan_slist_t               all;
+    nchan_slist_t               disconnected_cmd;
+    nchan_slist_t               disconnected_pubsub;
+  }                           channels;
+  
+  nchan_reaper_t              chanhead_reaper;
+  time_t                      reconnect_delay_sec;
+  nchan_list_t                onready_callbacks;
+#if REDIS_NODESET_DBG
+  struct {
+    redis_node_dbg_list_t       nodes;
+    redis_nodeset_dbg_range_tree_t ranges;
+    int                         keyspace_complete;
+  }                           dbg;
+#endif
+  
+}; //redis_nodeset_t
+
+struct redis_node_s {
+  int8_t                    state;
+  unsigned                  discovered:1;
+  redis_node_role_t         role;
+  redis_connect_params_t    connect_params;
+  void                     *connect_timeout;
+  redis_nodeset_t          *nodeset;
+  ngx_str_t                 run_id;
+  ngx_str_t                 version;
+  int                       scripts_loaded;
+  int                       generation;
+  ngx_event_t               ping_timer;
+  struct {
+    unsigned                  enabled:1;
+    unsigned                  ok:1;
+    ngx_str_t                 id;
+    struct {
+      redis_slot_range_t         *range;
+      size_t                      n;
+      unsigned                    indexed:1;
+    }                         slot_range; 
+    char                     *cluster_nodes;
+  }                         cluster;
+  struct {
+    redis_node_t              *master;
+    nchan_list_t               slaves;
+  }                         peers;
+  struct {
+    redisAsyncContext         *cmd;
+    redisAsyncContext         *pubsub;
+    redisContext              *sync;
+  }                         ctx;
+  int                       pending_commands;
+  struct {
+  nchan_slist_t               cmd;
+  nchan_slist_t               pubsub;
+  }                         channels;
+}; //redis_node_t
+
+typedef struct {
+  redis_slot_range_t      range;
+  redis_node_t           *node;
+} redis_nodeset_slot_range_node_t;
+
+
+
+redis_nodeset_t *nodeset_create(nchan_loc_conf_t *lcf);
+ngx_int_t nodeset_initialize(char *worker_id, redisCallbackFn *subscribe_handler);
+redis_nodeset_t *nodeset_find(nchan_redis_conf_t *rcf);
+ngx_int_t nodeset_examine(redis_nodeset_t *nodeset);
+
+ngx_int_t nodeset_node_destroy(redis_node_t *node);
+
+
+int node_disconnect(redis_node_t *node, int disconnected_state);
+int node_connect(redis_node_t *node);
+void node_set_role(redis_node_t *node, redis_node_role_t role);
+int node_set_master_node(redis_node_t *node, redis_node_t *master);
+redis_node_t *node_find_slave_node(redis_node_t *node, redis_node_t *slave);
+int node_add_slave_node(redis_node_t *node, redis_node_t *slave);
+int node_remove_slave_node(redis_node_t *node, redis_node_t *slave);
+
+ngx_int_t nodeset_connect_all(void);
+int nodeset_connect(redis_nodeset_t *ns);
+int nodeset_node_keyslot_changed(redis_node_t *node);
+int nodeset_disconnect(redis_nodeset_t *ns);
+ngx_int_t nodeset_destroy_all(void);
+ngx_int_t nodeset_each(void (*)(redis_nodeset_t *, void *), void *privdata);
+ngx_int_t nodeset_each_node(redis_nodeset_t *, void (*)(redis_node_t *, void *), void *privdata);
+ngx_int_t nodeset_callback_on_ready(redis_nodeset_t *ns, ngx_msec_t max_wait, ngx_int_t (*cb)(redis_nodeset_t *, void *), void *pd);
+ngx_int_t nodeset_abort_on_ready_callbacks(redis_nodeset_t *ns);
+ngx_int_t nodeset_run_on_ready_callbacks(redis_nodeset_t *ns);
+
+ngx_int_t nodeset_set_status(redis_nodeset_t *nodeset, redis_nodeset_status_t status, const char *msg);
+
+int nodeset_node_deduplicate_by_connect_params(redis_node_t *node);
+int nodeset_node_deduplicate_by_run_id(redis_node_t *node);
+int nodeset_node_deduplicate_by_cluster_id(redis_node_t *node);
+
+redis_node_t *nodeset_node_find_by_connect_params(redis_nodeset_t *ns, redis_connect_params_t *rcp);
+redis_node_t *nodeset_node_find_by_run_id(redis_nodeset_t *ns, ngx_str_t *run_id);
+redis_node_t *nodeset_node_find_by_cluster_id(redis_nodeset_t *ns, ngx_str_t *cluster_id);
+redis_node_t *nodeset_node_find_by_range(redis_nodeset_t *ns, redis_slot_range_t *range);
+redis_node_t *nodeset_node_find_by_slot(redis_nodeset_t *ns, uint16_t slot);
+redis_node_t *nodeset_node_find_by_channel_id(redis_nodeset_t *ns, ngx_str_t *channel_id);
+redis_node_t *nodeset_node_find_by_key(redis_nodeset_t *ns, ngx_str_t *key);
+redis_node_t *nodeset_node_find_any_ready_master(redis_nodeset_t *ns);
+int nodeset_node_reply_keyslot_ok(redis_node_t *node, redisReply *r);
+int nodeset_ready(redis_nodeset_t *nodeset);
+
+//chanheads are (void *) here to avoid circular typedef dependency with store-private.h
+//it's terrible, and dirty -- but quick
+ngx_int_t nodeset_associate_chanhead(redis_nodeset_t *, void *chanhead);
+ngx_int_t nodeset_dissociate_chanhead(void *chanhead);
+
+ngx_int_t nodeset_node_associate_chanhead(redis_node_t *, void *chanhead);
+ngx_int_t nodeset_node_associate_pubsub_chanhead(redis_node_t *, void *chanhead);
+ngx_int_t nodeset_node_dissociate_chanhead(void *chanhead);
+ngx_int_t nodeset_node_dissociate_pubsub_chanhead(void *chanhead);
+
+redis_node_t *nodeset_node_find_by_chanhead(void *chanhead);
+redis_node_t *nodeset_node_pubsub_find_by_chanhead(void *chanhead);
+
+
+
+redis_node_t *nodeset_node_create(redis_nodeset_t *ns, redis_connect_params_t *rcp);
+
+uint16_t redis_crc16(uint16_t crc, const char *buf, int len);
+
+
+const char *__nodeset_nickname_cstr(redis_nodeset_t *nodeset);
+const char *__node_nickname_cstr(redis_node_t *node);
+  
+#endif /* NCHAN_REDIS_NODESET_H */
diff --git a/debian/modules/nchan/src/store/redis/redis_nodeset_parser.c b/debian/modules/nchan/src/store/redis/redis_nodeset_parser.c
new file mode 100644
index 00000000..5db30f0d
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/redis_nodeset_parser.c
@@ -0,0 +1,241 @@
+#include <nchan_module.h>
+#include <assert.h>
+
+#include "redis_nginx_adapter.h"
+
+#include <util/nchan_util.h>
+#include <util/nchan_msg.h>
+#include <store/store_common.h>
+#include "redis_nodeset_parser.h"
+#include "redis_nodeset.h"
+
+#define nchan_scan_str(str_src, cur, chr, str)\
+  (str)->data = (u_char *)memchr(cur, chr, (str_src)->len - (cur - (str_src)->data));\
+  if(!(str)->data)                            \
+    (str)->data = (str_src)->data + (str_src)->len;\
+  if((str)->data) {                           \
+    (str)->len = (str)->data - cur;           \
+    (str)->data = cur;                        \
+    cur+=(str)->len+1;                        \
+  }                                           \
+  else                                        \
+    goto fail
+
+
+static cluster_nodes_line_t   cluster_node_parsed_lines[MAX_CLUSTER_NODE_PARSED_LINES];
+static redis_connect_params_t parsed_connect_params[MAX_NODE_SLAVES_PARSED];
+
+static u_char *nodeset_parser_scan_cluster_nodes_slots_string(ngx_str_t *str, u_char *cur, redis_slot_range_t *r) {
+  ngx_str_t       slot_min_str, slot_max_str, slot;
+  ngx_int_t       slot_min,     slot_max;
+  u_char         *dash;
+  
+  if(cur == NULL) {
+    cur = str->data;
+  }
+  else if(cur >= str->data + str->len) {
+    return NULL;
+  }
+  if(str->len == 0) {
+    return NULL;
+  }
+  
+  nchan_scan_str(str, cur, ' ', &slot);
+  if(slot.data[0] == '[') {
+    //transitional special slot. ignore it.
+    return nodeset_parser_scan_cluster_nodes_slots_string(str, cur, r);
+  }
+  
+  dash = (u_char *)memchr(slot.data, '-', slot.len);
+  if(dash) {
+    slot_min_str.data = slot.data;
+    slot_min_str.len = dash - slot.data;
+    
+    slot_max_str.data = dash + 1;
+    slot_max_str.len = slot.len - (slot_max_str.data - slot.data);
+  }
+  else {
+    slot_min_str = slot;
+    slot_max_str = slot;
+  }
+  
+  slot_min = ngx_atoi(slot_min_str.data, slot_min_str.len);
+  slot_max = ngx_atoi(slot_max_str.data, slot_max_str.len);
+  
+  //DBG("slots: %i - %i", slot_min, slot_max);
+  
+  r->min = slot_min;
+  r->max = slot_max;
+  
+  return cur;
+  
+fail:
+  return NULL;
+}
+
+int parse_cluster_node_slots(cluster_nodes_line_t *l, redis_slot_range_t *ranges) {
+  //assumes the correct amount of ranges has already been allocated
+int                    i = 0;
+  redis_slot_range_t   range;
+  u_char              *cur = NULL;
+  while((cur = nodeset_parser_scan_cluster_nodes_slots_string(&l->slots, cur, &range)) != NULL) {
+    if(i > l->slot_ranges_count) {
+      return 0; //parsing more slot ranges than was expected
+    }
+    ranges[i]=range;
+    i++;
+  }
+  if(i !=l->slot_ranges_count) {
+    return 0; //parsed the wrong amount of slot ranges
+  }
+  return 1;
+}
+
+static char *nodeset_parser_scan_cluster_nodes_line(const char *line, cluster_nodes_line_t *l) {
+  u_char     *cur = (u_char *)line;
+  u_char     *max = cur;
+  u_char     *tmp;
+  ngx_str_t   rest_line;
+  
+  if(cur[0]=='\0')
+    return NULL;
+  
+  nchan_scan_split_by_chr(&max, strlen((char *)max), &rest_line, '\n');
+  l->line = rest_line;
+  
+  nchan_scan_until_chr_on_line(&rest_line, &l->id,           ' ');
+  nchan_scan_until_chr_on_line(&rest_line, &l->address,      ' ');
+  nchan_scan_until_chr_on_line(&rest_line, &l->flags,        ' ');
+  
+  nchan_scan_until_chr_on_line(&rest_line, &l->master_id,    ' ');
+  nchan_scan_until_chr_on_line(&rest_line, &l->ping_sent,    ' ');
+  nchan_scan_until_chr_on_line(&rest_line, &l->pong_recv,    ' ');
+  nchan_scan_until_chr_on_line(&rest_line, &l->config_epoch, ' ');
+  nchan_scan_until_chr_on_line(&rest_line, &l->link_state,   ' ');
+  
+  if(nchan_ngx_str_substr((&l->flags), "master")) {
+    l->slots = rest_line;
+    l->master = 1;
+    
+    //how many slot ranges?
+    int                  i = 0;
+    redis_slot_range_t   range;
+    cur = NULL;
+    while((cur = nodeset_parser_scan_cluster_nodes_slots_string(&l->slots, cur, &range)) != NULL) {
+      i++;
+    }
+    l->slot_ranges_count = i;
+  }
+  else {
+    l->slots.data = NULL;
+    l->slots.len = 0;
+    l->slot_ranges_count = 0;
+    l->master = 0;
+  }
+  l->failed = nchan_ngx_str_substr((&l->flags), "fail");
+  l->self = nchan_ngx_str_substr((&l->flags), "myself");
+  l->noaddr = nchan_ngx_str_substr((&l->flags), "noaddr");
+  l->handshake = nchan_ngx_str_substr((&l->flags), "handshake");
+  
+  l->connected = l->link_state.data[0]=='c' ? 1 : 0; //[c]onnected
+  
+  //redis >= 4.0 CLUSTER NODES format compatibility
+  if((tmp = memrchr(l->address.data, '@', l->address.len)) != NULL) {
+    l->address.len = tmp - l->address.data;
+  }
+  
+  if((tmp = memrchr(l->address.data, ':', l->address.len)) != NULL) {
+    //hostname and port from address
+    ngx_str_t   port;
+    l->hostname.data = l->address.data;
+    l->hostname.len = tmp - l->address.data;
+    port.len = l->address.len - l->hostname.len - 1;
+    port.data = &tmp[1];
+    l->port = ngx_atoi(port.data, port.len);
+  }
+  
+  cur = max;
+  if(&cur[-1] > (u_char *)line && cur[-1] == '\0')
+    cur--;
+  return (char *)cur;
+}
+
+redis_connect_params_t *parse_info_slaves(redis_node_t *node, const char *info, size_t *count) {
+  char                   slavebuf[20]="slave0:";
+  int                    i = 0, skipped = 0;
+  redis_connect_params_t rcp;
+  ngx_str_t              line;
+  while(nchan_get_rest_of_line_in_cstr(info, slavebuf, &line)) {
+    //ip=localhost,port=8537,state=online,offset=420,lag=1
+    ngx_str_t hostname, port;
+    nchan_scan_until_chr_on_line(&line, NULL,      '='); //ip=
+    nchan_scan_until_chr_on_line(&line, &hostname, ','); //ip=([^,]*),
+    nchan_scan_until_chr_on_line(&line, NULL,      '='); //port=
+    nchan_scan_until_chr_on_line(&line, &port,     ','); //port=([^,]*),
+    //don't care about the rest
+    rcp.hostname = hostname;
+    rcp.port = ngx_atoi(port.data, port.len);
+    rcp.password = node->connect_params.password;
+    rcp.peername.len = 0;
+    rcp.db = node->connect_params.db;
+    
+    if(i < MAX_NODE_SLAVES_PARSED) {
+      parsed_connect_params[i]=rcp;
+    }
+    else {
+      node_log_error(node, "too many slaves, skipping slave %d", i+1);
+    }
+    i++;
+    ngx_sprintf((u_char *)slavebuf, "slave%d:", i);
+    
+    
+  }
+  *count = i - skipped;
+  return parsed_connect_params;
+}
+
+redis_connect_params_t *parse_info_master(redis_node_t *node, const char *info) {
+  redis_connect_params_t    rcp;
+  ngx_str_t                 port;
+  if(!nchan_get_rest_of_line_in_cstr(info, "master_host:", &rcp.hostname)) {
+    node_log_error(node, "failed to find master_host while discovering master");
+    return 0;
+  }
+  
+  if(!nchan_get_rest_of_line_in_cstr(info, "master_port:", &port)) {
+    node_log_error(node, "failed to find master_port while discovering master");
+    return 0;
+  }
+  rcp.port = ngx_atoi(port.data, port.len);
+  if(rcp.port == NGX_ERROR) {
+    node_log_error(node, "failed to parse master_port while discovering master");
+    return 0;
+  }
+  rcp.db = node->connect_params.db;
+  rcp.password = node->connect_params.password;
+
+  rcp.peername.data = NULL;
+  rcp.peername.len = 0;
+  
+  parsed_connect_params[0]=rcp;
+  return &parsed_connect_params[0];
+}
+
+cluster_nodes_line_t *parse_cluster_nodes(redis_node_t *node, const char *clusternodes, size_t *count) {
+  
+  const char           *line = clusternodes;
+  size_t                n = 0, discarded = 0;
+  cluster_nodes_line_t  l;
+  while((line = nodeset_parser_scan_cluster_nodes_line(line, &l)) != NULL) {
+    if(n > MAX_CLUSTER_NODE_PARSED_LINES) {
+      node_log_error(node, "too many cluster nodes, discarding line %d", n + discarded);
+      discarded++;
+    }
+    else {
+      cluster_node_parsed_lines[n]=l;
+      n++;
+    }
+  }
+  *count = n;
+  return cluster_node_parsed_lines;
+}
diff --git a/debian/modules/nchan/src/store/redis/redis_nodeset_parser.h b/debian/modules/nchan/src/store/redis/redis_nodeset_parser.h
new file mode 100644
index 00000000..e9f35759
--- /dev/null
+++ b/debian/modules/nchan/src/store/redis/redis_nodeset_parser.h
@@ -0,0 +1,40 @@
+#ifndef REDIS_NODESET_PARSER_H
+#define REDIS_NODESET_PARSER_H
+
+#define MAX_CLUSTER_NODE_PARSED_LINES 512
+#define MAX_NODE_SLAVES_PARSED 512
+
+#include <nchan_module.h>
+#include "store-private.h"
+
+typedef struct {
+  ngx_str_t      line;
+  ngx_str_t      id;         //node id
+  ngx_str_t      address;    //address as known by redis
+  ngx_str_t      hostname;
+  ngx_int_t      port;
+  ngx_str_t      flags;
+  
+  ngx_str_t      master_id;  //if slave
+  ngx_str_t      ping_sent;
+  ngx_str_t      pong_recv;
+  ngx_str_t      config_epoch;
+  ngx_str_t      link_state; //connected or disconnected
+  
+  ngx_str_t      slots;
+  ngx_int_t      slot_ranges_count;
+  
+  unsigned       connected:1;
+  unsigned       master:1;
+  unsigned       noaddr:1;
+  unsigned       failed:1;
+  unsigned       handshake:1;
+  unsigned       self:1;
+} cluster_nodes_line_t;
+
+redis_connect_params_t *parse_info_slaves(redis_node_t *node, const char *info, size_t *count);
+redis_connect_params_t *parse_info_master(redis_node_t *node, const char *info);
+cluster_nodes_line_t *parse_cluster_nodes(redis_node_t *node, const char *clusternodes, size_t *count);
+int parse_cluster_node_slots(cluster_nodes_line_t *l, redis_slot_range_t *ranges);
+
+#endif /*REDIS_NODESET_PARSER_H */
diff --git a/debian/modules/nchan/src/store/redis/scripts/find_channel.lua b/debian/modules/nchan/src/store/redis/scripts/find_channel.lua
deleted file mode 100644
index 882336c4..00000000
--- a/debian/modules/nchan/src/store/redis/scripts/find_channel.lua
+++ /dev/null
@@ -1,56 +0,0 @@
---input: keys: [],  values: [ channel_id ]
---output: channel_hash {ttl, time_last_seen, subscribers, messages} or nil
--- finds and return the info hash of a channel, or nil of channel not found
-local id = ARGV[1]
-local channel_key = ('{channel:%s}'):format(id)
-local messages_key = channel_key..':messages'
-
-redis.call('echo', ' #######  FIND_CHANNEL ######## ')
-
---check old entries
-local oldestmsg=function(list_key, old_fmt)
-  local old, oldkey
-  local n, del=0,0
-  while true do
-    n=n+1
-    old=redis.call('lindex', list_key, -1)
-    if old then
-      oldkey=old_fmt:format(old)
-      local ex=redis.call('exists', oldkey)
-      if ex==1 then
-        return oldkey
-      else
-        redis.call('rpop', list_key)
-        del=del+1
-      end
-    else
-      break
-    end
-  end
-end
-
-if redis.call('EXISTS', channel_key) ~= 0 then
-  local ch = redis.call('hmget', channel_key, 'ttl', 'time_last_seen', 'subscribers', 'fake_subscribers', 'current_message')
-  if(ch[4]) then
-    --replace subscribers count with fake_subscribers
-    ch[3]=ch[4]
-    table.remove(ch, 4)
-  end
-  for i = 1, 4 do
-    ch[i]=tonumber(ch[i]) or 0
-  end
-  if type(ch[5]) ~= "string" then
-    ch[5]=""
-  end
-  
-  if redis.call("TYPE", messages_key)['ok'] == 'list' then
-    oldestmsg(messages_key, channel_key ..':msg:%s')
-    table.insert(ch, tonumber(redis.call('llen', messages_key)))
-  else
-    table.insert(ch, 0)
-  end
-  
-  return ch
-else
-  return nil
-end
diff --git a/debian/modules/nchan/src/store/redis/scripts/get_message_from_key.lua b/debian/modules/nchan/src/store/redis/scripts/get_message_from_key.lua
deleted file mode 100644
index 13055cac..00000000
--- a/debian/modules/nchan/src/store/redis/scripts/get_message_from_key.lua
+++ /dev/null
@@ -1,9 +0,0 @@
---input:  keys: [message_key], values: []
---output: msg_ttl, msg_time, msg_tag, prev_msg_time, prev_msg_tag, message, content_type, eventsource_event, channel_subscriber_count
-
-local key = KEYS[1]
-
-local ttl = redis.call('TTL', key)
-local time, tag, prev_time, prev_tag, data, content_type, es_event = unpack(redis.call('HMGET', key, 'time', 'tag', 'prev_time', 'prev_tag', 'data', 'content_type', 'eventsource_event'))
-
-return {ttl, time, tag, prev_time or 0, prev_tag or 0, data or "", content_type or "", es_event or ""}
diff --git a/debian/modules/nchan/src/store/redis/store-private.h b/debian/modules/nchan/src/store/redis/store-private.h
index 8487efab..fffed5f1 100644
--- a/debian/modules/nchan/src/store/redis/store-private.h
+++ b/debian/modules/nchan/src/store/redis/store-private.h
@@ -7,23 +7,32 @@
 
 #include <nchan_module.h>
 #include "uthash.h"
-#include "hiredis/hiredis.h"
-#include "hiredis/async.h"
+#if NCHAN_HAVE_HIREDIS_WITH_SOCKADDR
+#include <hiredis/hiredis.h>
+#include <hiredis/async.h>
+#else
+#include <store/redis/hiredis/hiredis.h>
+#include <store/redis/hiredis/async.h>
+#endif
 #include <util/nchan_reaper.h>
 #include <util/nchan_rbtree.h>
 #include <util/nchan_list.h>
 #include <store/spool.h>
 
-typedef struct rdstore_data_s rdstore_data_t;
-typedef struct rdstore_channel_head_s rdstore_channel_head_t;
+#include "redis_nodeset.h"
+#define REDIS_LUA_HASH_LENGTH 40
+#define REDIS_NODESET_NOT_READY_MAX_RETRIES 2
 
+//OBSOLETE
 typedef struct {
-  rdstore_data_t          *node_rdt;
-  unsigned                 enabled:1;
-} rdstore_channel_head_cluster_data_t;
+  unsigned         min:16;
+  unsigned         max:16;
+} redis_cluster_slot_range_t;
+
 
+typedef struct rdstore_channel_head_s rdstore_channel_head_t;
 
-typedef enum {SUBBING, SUBBED, UNSUBBING, UNSUBBED} redis_pubsub_status_t;
+typedef enum {REDIS_PUBSUB_SUBSCRIBING, REDIS_PUBSUB_SUBSCRIBED, REDIS_PUBSUB_UNSUBSCRIBED} redis_pubsub_status_t;
 
 struct rdstore_channel_head_s {
   ngx_str_t                    id; //channel id
@@ -34,22 +43,49 @@ struct rdstore_channel_head_s {
   ngx_int_t                    fetching_message_count;
   ngx_uint_t                   internal_sub_count;
   ngx_event_t                  keepalive_timer;
+  ngx_uint_t                   keepalive_times_sent;
   nchan_msg_id_t               last_msgid;
   
   void                        *redis_subscriber_privdata;
-  rdstore_data_t              *rdt;
-  rdstore_channel_head_cluster_data_t cluster;
+  //rdstore_channel_head_cluster_data_t cluster;
   
   ngx_int_t                    reserved;
   
-  rdstore_channel_head_t      *gc_prev;
-  rdstore_channel_head_t      *gc_next;
+  struct {                   //redis
+    int                          generation;
+    redis_nodeset_t             *nodeset;
+    struct {                   //node
+      redis_node_t                *cmd;
+      redis_node_t                *pubsub;
+    }                            node;
+    
+    struct {                  //linked list links
+      struct {
+        rdstore_channel_head_t      *prev;
+        rdstore_channel_head_t      *next;
+      }                            nodeset;
+      struct {
+        rdstore_channel_head_t      *prev;
+        rdstore_channel_head_t      *next;
+      }                            node_cmd;
+      struct {
+        rdstore_channel_head_t      *prev;
+        rdstore_channel_head_t      *next;
+      }                            node_pubsub;
+      unsigned                     in_disconnected_cmd_list:1;
+      unsigned                     in_disconnected_pubsub_list:1;
+    }                            slist;
+    
+  }                            redis;
+  
+  struct {                   //gc
+    rdstore_channel_head_t      *prev;
+    rdstore_channel_head_t      *next;
+    time_t                       time;
+    unsigned                     in_reaper:1;
+  }                            gc;
   
-  rdstore_channel_head_t      *rd_next;
-  rdstore_channel_head_t      *rd_prev;
   
-  time_t                       gc_time;
-  nchan_reaper_t              *in_gc_reaper;
   
   redis_pubsub_status_t        pubsub_status;
   unsigned                     meta:1;
@@ -57,139 +93,17 @@ struct rdstore_channel_head_s {
   UT_hash_handle               hh;
 };
 
-typedef struct {
-  ngx_str_t     host;
-  ngx_int_t     port;
-  ngx_str_t     password;
-  ngx_int_t     db;
-} redis_connect_params_t;
-
-typedef struct callback_chain_s callback_chain_t;
-struct callback_chain_s {
-  callback_pt                  cb;
-  void                        *pd;
-  callback_chain_t            *next;
-};
-
-typedef enum {DISCONNECTED, CONNECTING, AUTHENTICATING, LOADING, LOADING_SCRIPTS, CONNECTED} redis_connection_status_t;
 
-typedef enum {CLUSTER_DISCONNECTED, CLUSTER_CONNECTING, CLUSTER_NOTREADY, CLUSTER_READY, CLUSTER_FAILED} redis_cluster_status_t;
-
-
-typedef enum {CLUSTER_RETRY_BY_CHANHEAD, CLUSTER_RETRY_BY_CHANNEL_ID, CLUSTER_RETRY_BY_KEY, CLUSTER_RETRY_BY_CSTR} redis_cluster_retry_hashslot_t;
-typedef struct redis_cluster_retry_s redis_cluster_retry_t;
-struct redis_cluster_retry_s {
-  redis_cluster_retry_hashslot_t     type;
-  union {
-    rdstore_channel_head_t          *chanhead;
-    ngx_str_t                        str;
-    u_char                          *cstr;
-  };
-  void                              (*retry)(rdstore_data_t*, void *);
-  void                               *data;
-}; //retry_redis_script_t
-
-typedef struct {
-  redis_cluster_status_t           status;
-  
-  rbtree_seed_t                    hashslots; //cluster rbtree seed
-  struct {
-    nchan_list_t                     master;
-    nchan_list_t                     slave;
-    nchan_list_t                     disconnected;
-  } nodes;
-  ngx_uint_t                       size; //number of master nodes
-  ngx_uint_t                       nodes_connected; //number of connected nodes
-  ngx_int_t                        node_connections_pending; //number of master nodes
-  uint32_t                         homebrew_id;
-  ngx_http_upstream_srv_conf_t    *uscf;
-  ngx_pool_t                      *pool;
-  
-  ngx_event_t                      still_notready_timer;
-  
-  nchan_reaper_t                   chanhead_reaper;
-  rdstore_channel_head_t          *orphan_channels_head;
-  
-  nchan_list_t                     retry_commands;
-} redis_cluster_t;
-
-typedef struct {
-  ngx_str_t         id;
-  ngx_str_t         address;
-  ngx_str_t         slots;
-  redis_cluster_t  *cluster;
-  
-  nchan_list_t     *in_node_list;
-  rdstore_data_t  **node_list_el_data;
-  
-  unsigned          master:1;
-  unsigned          failed:1;
-  unsigned          inactive:1;
-  unsigned          indexed:1;
-} redis_cluster_node_t;
-
-typedef struct {
-  unsigned         min:16;
-  unsigned         max:16;
-} redis_cluster_slot_range_t;
-
-typedef struct {
-  redis_cluster_slot_range_t   range;
-  rdstore_data_t              *rdata;
-} redis_cluster_keyslot_range_node_t;
-
-struct rdstore_data_s {
-  ngx_str_t                       *connect_url;
-  redis_connect_params_t           connect_params;
-  
-  redisAsyncContext               *ctx;
-  redisAsyncContext               *sub_ctx;
-  redisContext                    *sync_ctx;
-  
-  nchan_reaper_t                   chanhead_reaper;
-  
-  redis_connection_status_t        status;
-  int                              scripts_loaded_count;
-  int                              generation;
-  ngx_event_t                      reconnect_timer;
-  ngx_event_t                      ping_timer;
-  time_t                           ping_interval;
-  callback_chain_t                *on_connected;
-  nchan_loc_conf_t                *lcf;
-  
-  //cluster stuff
-  redis_cluster_node_t             node;
-  rdstore_channel_head_t          *channels_head;
-  rdstore_channel_head_t          *almost_deleted_channels_head;
-  
-  ngx_int_t                        pending_commands;
-  ngx_event_t                      stall_timer;
-  
-  unsigned                         shutting_down:1;
-}; // rdstore_data_t
-
-
-redis_connection_status_t redis_connection_status(nchan_loc_conf_t *cf);
 void redisCheckErrorCallback(redisAsyncContext *c, void *r, void *privdata);
 int redisReplyOk(redisAsyncContext *c, void *r);
-ngx_int_t redis_add_connection_data(nchan_redis_conf_t *rcf, nchan_loc_conf_t *lcf, ngx_str_t *override_url);
-rdstore_data_t *redis_create_rdata(ngx_str_t *url, redis_connect_params_t *rcp, nchan_redis_conf_t *rcf, nchan_loc_conf_t *lcf);
-ngx_int_t redis_ensure_connected(rdstore_data_t *rdata);
 ngx_int_t parse_redis_url(ngx_str_t *url, redis_connect_params_t *rcp);
 ngx_int_t rdstore_initialize_chanhead_reaper(nchan_reaper_t *reaper, char *name);
 
 ngx_int_t redis_chanhead_gc_add(rdstore_channel_head_t *head, ngx_int_t expire, const char *reason);
-ngx_int_t redis_chanhead_gc_add_to_reaper(nchan_reaper_t *, rdstore_channel_head_t *head, ngx_int_t expire, const char *reason);
 ngx_int_t redis_chanhead_gc_withdraw(rdstore_channel_head_t *head);
-ngx_int_t redis_chanhead_gc_withdraw_from_reaper(nchan_reaper_t *, rdstore_channel_head_t *head);
 ngx_int_t redis_chanhead_catch_up_after_reconnect(rdstore_channel_head_t *ch);
 
-
-void redis_associate_chanhead_with_rdata(rdstore_channel_head_t *head, rdstore_data_t *rdata);
-nchan_reaper_t *rdstore_get_chanhead_reaper(rdstore_channel_head_t *ch);
-ngx_int_t ensure_chanhead_pubsub_subscribed(rdstore_channel_head_t *ch);
+ngx_int_t ensure_chanhead_pubsub_subscribed_if_needed(rdstore_channel_head_t *ch);
 
 
-rdstore_data_t *find_rdata_by_connect_params(redis_connect_params_t *rcp);
-rdstore_data_t *find_rdata_by_url(ngx_str_t *url);
 #endif //NCHAN_REDIS_STORE_PRIVATE_H
diff --git a/debian/modules/nchan/src/store/redis/store.h b/debian/modules/nchan/src/store/redis/store.h
index 834cadbf..973bbcf1 100755
--- a/debian/modules/nchan/src/store/redis/store.h
+++ b/debian/modules/nchan/src/store/redis/store.h
@@ -9,8 +9,13 @@ extern nchan_store_t  nchan_store_redis;
 ngx_int_t nchan_store_redis_fakesub_add(ngx_str_t *channel_id, nchan_loc_conf_t *cf, ngx_int_t count, uint8_t shutting_down);
 void redis_store_prepare_to_exit_worker(); // hark! a hack!!
 
-ngx_int_t nchan_store_redis_add_server_conf(ngx_conf_t *cf, nchan_redis_conf_t *rcf, nchan_loc_conf_t *loc_conf);
-ngx_int_t nchan_store_redis_remove_server_conf(ngx_conf_t *cf, nchan_redis_conf_t *rcf);
+ngx_int_t nchan_store_redis_add_active_loc_conf(ngx_conf_t *cf, nchan_loc_conf_t *loc_conf);
+ngx_int_t nchan_store_redis_remove_active_loc_conf(ngx_conf_t *cf, nchan_loc_conf_t *loc_conf);
 
-ngx_int_t redis_store_callback_on_connected(nchan_loc_conf_t *cf, callback_pt cb, void *privdata);
+int nchan_store_redis_ready(nchan_loc_conf_t *cf);
+int nchan_store_redis_validate_url(ngx_str_t *url);
+
+
+
+ngx_int_t redis_store_callback_on_connected(nchan_loc_conf_t *cf, ngx_msec_t max_wait, callback_pt cb, void *privdata);
 #endif // NCHAN_REDIS_STORE_H
diff --git a/debian/modules/nchan/src/store/spool.c b/debian/modules/nchan/src/store/spool.c
index 984f064a..1e1592ad 100755
--- a/debian/modules/nchan/src/store/spool.c
+++ b/debian/modules/nchan/src/store/spool.c
@@ -8,7 +8,6 @@
 #define DBG(fmt, arg...) ngx_log_error(DEBUG_LEVEL, ngx_cycle->log, 0, "SPOOL:" fmt, ##arg)
 #define ERR(fmt, arg...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "SPOOL:" fmt, ##arg)
 
-#define NCHAN_MSG_NORESPONSE_RETRY_TIME 200
 #define NCHAN_SPOOL_FETCHMSG_MAX_TIMES 20
 
 //////// SPOOLs -- Subscriber Pools  /////////
@@ -25,17 +24,20 @@ static ngx_int_t spool_fetch_msg(subscriber_pool_t *spool);
 static nchan_msg_id_t     latest_msg_id = NCHAN_NEWEST_MSGID;
 static nchan_msg_id_t     oldest_msg_id = NCHAN_OLDEST_MSGID;
 
-
 static subscriber_pool_t *find_spool(channel_spooler_t *spl, nchan_msg_id_t *id) {
   rbtree_seed_t      *seed = &spl->spoolseed;
   ngx_rbtree_node_t  *node;
+  subscriber_pool_t  *spool = NULL;
   
-  if((node = rbtree_find_node(seed, id)) != NULL) {
-    return (subscriber_pool_t *)rbtree_data_from_node(node);
+  if(id->time == NCHAN_NEWEST_MSGID_TIME || spl->fetching_strategy == NCHAN_SPOOL_PASSTHROUGH) {
+    spool = &spl->current_msg_spool;
+    spool->msg_status = MSG_EXPECTED;
   }
-  else {
-    return NULL;
+  else if((node = rbtree_find_node(seed, id)) != NULL) {
+    spool = rbtree_data_from_node(node);
   }
+  
+  return spool;
 }
 /*
 typedef struct {
@@ -84,6 +86,17 @@ static int validate_spooler(channel_spooler_t *spl, char *str) {
 }
 */
 
+static void spool_reserve(subscriber_pool_t *spool) {
+  spool->reserved++;
+}
+static void spool_release(subscriber_pool_t *spool) {
+  spool->reserved--;
+  ngx_int_t immortal_spool = spool->id.time == NCHAN_NEWEST_MSGID_TIME;
+  if(!immortal_spool && spool->reserved == 0 && spool->sub_count == 0) {
+    destroy_spool(spool);
+  }
+}
+
 static int msg_ids_equal(nchan_msg_id_t *id1, nchan_msg_id_t *id2) {
   int           i, max;
   int16_t      *tags1, *tags2;
@@ -155,11 +168,11 @@ static ngx_inline void init_spool(channel_spooler_t *spl, subscriber_pool_t *spo
   spool->msg_status = MSG_INVALID;
   
   spool->first = NULL;
-  spool->pool = NULL;
   spool->sub_count = 0;
   spool->non_internal_sub_count = 0;
-  spool->generation = 0;
-  spool->responded_count = 0;
+  //spool->generation = 0;
+  //spool->responded_count = 0;
+  spool->reserved = 0;
   ngx_memzero(&spool->fetchmsg_ev, sizeof(spool->fetchmsg_ev));
   nchan_init_timer(&spool->fetchmsg_ev, fetchmsg_ev_handler, spool);
   spool->fetchmsg_current_count=0;
@@ -173,7 +186,8 @@ static subscriber_pool_t *get_spool(channel_spooler_t *spl, nchan_msg_id_t *id)
   ngx_rbtree_node_t  *node;
   subscriber_pool_t *spool;
   
-  if(id->time == NCHAN_NEWEST_MSGID_TIME) {
+  
+  if(id->time == NCHAN_NEWEST_MSGID_TIME || spl->fetching_strategy == NCHAN_SPOOL_PASSTHROUGH) {
     spool = &spl->current_msg_spool;
     spool->msg_status = MSG_EXPECTED;
     return &spl->current_msg_spool;
@@ -213,6 +227,15 @@ static ngx_int_t spool_nextmsg(subscriber_pool_t *spool, nchan_msg_id_t *new_las
   int16_t                 largetags[NCHAN_MULTITAG_MAX];
   nchan_msg_id_t          new_id = NCHAN_ZERO_MSGID;
   
+  if(spl->fetching_strategy == NCHAN_SPOOL_PASSTHROUGH) {
+    if(immortal_spool) {
+      return NGX_OK; //nothing to do, already on the newest spool
+    }
+    else {
+      new_last_id = &latest_msg_id;
+    }
+  }
+  
   nchan_copy_msg_id(&new_id, &spool->id, largetags);
   nchan_update_multi_msgid(&new_id, new_last_id, largetags);
   
@@ -228,11 +251,13 @@ static ngx_int_t spool_nextmsg(subscriber_pool_t *spool, nchan_msg_id_t *new_las
     newspool = !immortal_spool ? find_spool(spl, &new_id) : get_spool(spl, &new_id);
     
     if(newspool != NULL) {
+      //move subs to next, already existing spool
       assert(spool != newspool);
       spool_transfer_subscribers(spool, newspool, 0);
-      if(!immortal_spool) destroy_spool(spool);
+      if(!immortal_spool && spool->reserved == 0) destroy_spool(spool);
     }
     else {
+      //next spool doesn't exist. reuse this one as the next
       ngx_rbtree_node_t       *node;
       assert(!immortal_spool);
       node = rbtree_node_from_data(spool);
@@ -260,6 +285,7 @@ static ngx_int_t spool_nextmsg(subscriber_pool_t *spool, nchan_msg_id_t *new_las
       switch(newspool->msg_status) {
         case MSG_CHANNEL_NOTREADY:
           newspool->msg_status = MSG_INVALID;
+          /*fallthrough*/
         case MSG_INVALID:
           spool_fetch_msg(newspool);
           break;
@@ -275,36 +301,15 @@ static ngx_int_t spool_nextmsg(subscriber_pool_t *spool, nchan_msg_id_t *new_las
   return NGX_OK;
 }
 
-typedef struct {
-  nchan_msg_id_t     msg_id;
-  channel_spooler_t *spooler;
-} nomsg_retry_data_t;
-
-static void spool_fetch_msg_noresponse_retry_cancel(void *pd) {
-  nomsg_retry_data_t *d = pd;
-  nchan_free_msg_id(&d->msg_id);
-  ngx_free(d);
-}
-
-static void spool_fetch_msg_noresponse_retry_callback(void *pd) {
-  nomsg_retry_data_t *d = pd;
-  subscriber_pool_t *spool = get_spool(d->spooler, &d->msg_id);
-  if(spool && spool->msg_status == MSG_INVALID) {
-    spool_fetch_msg(spool);
-  }
-  else if(!spool) {
-    DBG("spool not found for spool_fetch_msg_noresponse_retry_callback");
-  }
-  
-  spool_fetch_msg_noresponse_retry_cancel(pd);
-}
-
-static ngx_int_t spool_fetch_msg_callback(nchan_msg_status_t findmsg_status, nchan_msg_t *msg, fetchmsg_data_t *data) {
+static ngx_int_t spool_fetch_msg_callback(ngx_int_t code, nchan_msg_t *msg, fetchmsg_data_t *data) {
+  nchan_msg_status_t    findmsg_status = code;
   nchan_msg_status_t    prev_status;
   subscriber_pool_t    *spool, *nuspool;
   channel_spooler_t    *spl = data->spooler;
   int                   free_msg_id = 1;
   
+  assert(spl->fetching_strategy != NCHAN_SPOOL_PASSTHROUGH);
+  
   if(spl && data == spl->fetchmsg_cb_data_list) {
     spl->fetchmsg_cb_data_list = data->next;
   }
@@ -349,8 +354,7 @@ static ngx_int_t spool_fetch_msg_callback(nchan_msg_status_t findmsg_status, nch
       // ♫ It's gonna be the future soon ♫
       if(spool->id.time == NCHAN_NTH_MSGID_TIME) {
         //wait for message in the NEWEST_ID spool
-        nchan_msg_id_t  newest_id = NCHAN_NEWEST_MSGID;
-        spool_nextmsg(spool, &newest_id); 
+        spool_nextmsg(spool, &latest_msg_id); 
       }
       else {
         spool->msg_status = findmsg_status;
@@ -360,28 +364,19 @@ static ngx_int_t spool_fetch_msg_callback(nchan_msg_status_t findmsg_status, nch
         spool->msg = NULL;
       }
       break;
-      
-    case MSG_NORESPONSE:
-      if(prev_status == MSG_PENDING) {
-        spool->msg_status = MSG_INVALID;
-        if(spool->sub_count > 0) {
-          nomsg_retry_data_t *retry_data = ngx_alloc(sizeof(*retry_data), ngx_cycle->log);
-          
-          retry_data->spooler = spl;
-          
-          free_msg_id = 0;
-          retry_data->msg_id = data->msgid;
-          
-          spooler_add_timer(spl, NCHAN_MSG_NORESPONSE_RETRY_TIME, spool_fetch_msg_noresponse_retry_callback, spool_fetch_msg_noresponse_retry_cancel, retry_data);
-        }
-      }
+    
+    case MSG_CHANNEL_NOTREADY:
+      //just wait it out
+      spool->msg = NULL;
+      spool->msg_status = findmsg_status;
       break;
       
     case MSG_NOTFOUND:
-      if(spl->fetching_strategy == FETCH_IGNORE_MSG_NOTFOUND) {
+      if(spl->fetching_strategy == NCHAN_SPOOL_FETCH_IGNORE_MSG_NOTFOUND) {
         spool->msg_status = prev_status;
         break;
       }
+      /*fallthrough*/
     case MSG_EXPIRED:
       //is this right?
       //TODO: maybe message-expired notification
@@ -390,7 +385,24 @@ static ngx_int_t spool_fetch_msg_callback(nchan_msg_status_t findmsg_status, nch
       nuspool = get_spool(spool->spooler, &oldest_msg_id);
       if(spool != nuspool) {
         spool_transfer_subscribers(spool, nuspool, 1);
-        destroy_spool(spool);
+        if(spool->reserved == 0) {
+          destroy_spool(spool);
+        }
+        spool_fetch_msg(nuspool);
+      }
+      else if(spool->id.tagcount == 1 && nchan_compare_msgids(&spool->id, &oldest_msg_id) == 0) {
+        // oldest msgid not found or expired. that means there are no messages in this channel, 
+        // so move these subscribers over to the current_msg_spool
+        nuspool = get_spool(spool->spooler, &latest_msg_id);
+        assert(spool != nuspool);
+        spool_transfer_subscribers(spool, nuspool, 1);
+        if(spool->reserved == 0) {
+          destroy_spool(spool);
+        }
+      }
+      else if(spool == &spool->spooler->current_msg_spool) {
+        //sit there and wait, i guess
+        spool->msg_status = MSG_EXPECTED;
       }
       else {
         ERR("Unexpected spool == nuspool during spool fetch_msg_callback. This is weird, please report this to the developers. findmsg_status: %i", findmsg_status);
@@ -402,8 +414,12 @@ static ngx_int_t spool_fetch_msg_callback(nchan_msg_status_t findmsg_status, nch
       ERR("spool %p set status to MSG_PENDING", spool);
       break;
       
-    default:
-      assert(0);
+    case MSG_ERROR:
+      spool_respond_general(spool, NULL, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, 0);
+      break;
+      
+    case MSG_INVALID:
+      assert(0); //should never happen
       break;
   }
   
@@ -436,11 +452,13 @@ static ngx_int_t spool_fetch_msg(subscriber_pool_t *spool) {
     spool->fetchmsg_prev_msec = (ngx_timeofday())->msec;
   }
   
-  if(*spl->channel_status != READY) {
-    DBG("%p wanted to fetch msg %V, but channel %V not ready", spool, msgid_to_str(&spool->id), spl->chid);
+  if(*spl->channel_status != READY || !*spl->channel_buffer_complete) {
+    //DBG("%p wanted to fetch msg %V, but channel %V not ready or buffer not complete", spool, msgid_to_str(&spool->id), spl->chid);
     spool->msg_status = MSG_CHANNEL_NOTREADY;
+    //these will be fetch when channel is ready or when buffer is complete
     return NGX_DECLINED;
   }
+  
   DBG("%p fetch msg %V for channel %V", spool, msgid_to_str(&spool->id), spl->chid);
   data = ngx_alloc(sizeof(*data), ngx_cycle->log); //correctness over efficiency (at first).
   //TODO: optimize this alloc away
@@ -464,12 +482,12 @@ static ngx_int_t spool_fetch_msg(subscriber_pool_t *spool) {
     spl->handlers->get_message_start(spl, spl->handlers_privdata);
   }
   switch(spl->fetching_strategy) {
-    case FETCH:
-    case FETCH_IGNORE_MSG_NOTFOUND:
+    case NCHAN_SPOOL_FETCH:
+    case NCHAN_SPOOL_FETCH_IGNORE_MSG_NOTFOUND:
       spool->spooler->store->get_message(spool->spooler->chid, &spool->id, spool->spooler->cf, (callback_pt )spool_fetch_msg_callback, data);
       break;
-    case NO_FETCH:
-      //do nothing
+    case NCHAN_SPOOL_PASSTHROUGH:
+      spool_fetch_msg_callback(MSG_EXPECTED, NULL, data);
       break;
   }
   return NGX_OK;
@@ -492,6 +510,8 @@ static void spool_sub_dequeue_callback(subscriber_t *sub, void *data) {
 
 static ngx_int_t spool_add_subscriber(subscriber_pool_t *self, subscriber_t *sub, uint8_t enqueue) {
   spooled_subscriber_t       *ssub;
+  ngx_int_t                   rc;
+  ngx_int_t                   internal_sub = sub->type == INTERNAL;
   
   ssub = ngx_calloc(sizeof(*ssub), ngx_cycle->log);
   //DBG("add sub %p to spool %p", sub, self);
@@ -508,15 +528,28 @@ static ngx_int_t spool_add_subscriber(subscriber_pool_t *self, subscriber_t *sub
   }
   self->first = ssub;
   self->sub_count++;
-  if(sub->type != INTERNAL) {
+  if(!internal_sub) {
     self->non_internal_sub_count++;
   }
   ssub->dequeue_callback_data.ssub = ssub;
   ssub->dequeue_callback_data.spool = self;
   
   if(enqueue) {
-    sub->fn->enqueue(sub);
-    if(sub->type != INTERNAL && self->spooler->publish_events) {
+    if((rc = sub->fn->enqueue(sub)) != NGX_OK) {
+      //enqueue failed. undo everything and get out!
+      self->sub_count --;
+      self->first = ssub->next;
+      if(self->first) {
+        assert(self->first->prev == ssub);
+        self->first->prev = NULL;
+      }
+      if(!internal_sub) {
+        self->non_internal_sub_count--;
+      }
+      ngx_free(ssub);
+      return rc;
+    }
+    else if(sub->type != INTERNAL && self->spooler->publish_events) {
       nchan_maybe_send_channel_event_message(sub->request, SUB_ENQUEUE);
     }
   }
@@ -566,7 +599,7 @@ static ngx_int_t spool_respond_general(subscriber_pool_t *self, nchan_msg_t *msg
   //int8_t                     i, max;
   
   ngx_memzero(numsubs, sizeof(numsubs));
-  self->generation++;
+  //self->generation++;
   
   DBG("spool %p (%V) (subs: %i) respond with msg %p or code %i", self, msgid_to_str(&self->id), self->sub_count, msg, code);
   if(msg) {
@@ -594,19 +627,19 @@ static ngx_int_t spool_respond_general(subscriber_pool_t *self, nchan_msg_t *msg
     nnext = nsub->next;
     
     if(msg) {
-      self->responded_count++;
+      //self->responded_count++;
       sub->fn->respond_message(sub, msg);
     }
     else if(!notice) {
-      self->responded_count++;
-      sub->fn->respond_status(sub, code, code_data);
+      //self->responded_count++;
+      sub->fn->respond_status(sub, code, code_data, NULL);
     }
     else {
       sub->fn->notify(sub, code, code_data);
     }
   }
   
-  if(!notice && code != NGX_HTTP_NO_CONTENT) self->responded_count++;
+  //if(!notice && code != NGX_HTTP_NO_CONTENT) self->responded_count++;
   //assert(validate_spooler(spl, "after respond_general"));
   return NGX_OK;
 }
@@ -649,6 +682,7 @@ static ngx_int_t spooler_add_subscriber(channel_spooler_t *self, subscriber_t *s
   nchan_msg_id_t          *msgid = &sub->last_msgid;
   subscriber_pool_t       *spool;
   subscriber_type_t        subtype;
+  ngx_int_t                rc;
   
   if(self->want_to_stop) {
     ERR("Not accepting new subscribers right now. want to stop.");
@@ -659,8 +693,9 @@ static ngx_int_t spooler_add_subscriber(channel_spooler_t *self, subscriber_t *s
   
   spool = get_spool(self, msgid);
   
-  assert(spool->id.time == msgid->time);
-  
+  if(self->fetching_strategy == NCHAN_SPOOL_PASSTHROUGH) {
+    assert(spool->id.time == NCHAN_NEWEST_MSGID_TIME);
+  }
   
   if(spool == NULL) {
     return NGX_ERROR;
@@ -668,9 +703,9 @@ static ngx_int_t spooler_add_subscriber(channel_spooler_t *self, subscriber_t *s
 
   subtype = sub->type;
   
-  if(spool_add_subscriber(spool, sub, 1) != NGX_OK) {
-    ERR("couldn't add subscriber to spool %p", spool);
-    return NGX_ERROR;
+  if((rc = spool_add_subscriber(spool, sub, 1)) != NGX_OK) {
+    DBG("couldn't add subscriber to spool %p", spool);
+    return rc;
   }
   self->handlers->add(self, sub, self->handlers_privdata);
   
@@ -692,13 +727,14 @@ static ngx_int_t spooler_add_subscriber(channel_spooler_t *self, subscriber_t *s
       
     case MSG_EXPECTED:
       //notify subscriber
-      sub->fn->respond_status(sub, NGX_HTTP_NO_CONTENT, NULL);
+      sub->fn->respond_status(sub, NGX_HTTP_NO_CONTENT, NULL, NULL);
       break;
       
     case MSG_EXPIRED:
     case MSG_NOTFOUND:
-    case MSG_NORESPONSE:
+    case MSG_ERROR:
       //shouldn't happen
+      
       assert(0);
   }
   
@@ -730,8 +766,9 @@ static ngx_int_t spool_transfer_subscribers(subscriber_pool_t *spool, subscriber
     if(update_subscriber_last_msgid) {
       sub->last_msgid=newspool->id;
     }
-    spool_add_subscriber(newspool, sub, 0);
-    count++;
+    if(spool_add_subscriber(newspool, sub, 0) == NGX_OK) {
+      count++;
+    }
   }
   
   return count;
@@ -902,49 +939,45 @@ static ngx_int_t spooler_respond_message(channel_spooler_t *self, nchan_msg_t *m
   subscriber_pool_t         *spool;
   ngx_int_t                  responded_subs = 0;
   
-  srdata.min = msg->prev_id;
-  srdata.max = msg->id;
-  srdata.multi = msg->id.tagcount;
-  srdata.overflow = NULL;
-  srdata.msg = msg;
-  srdata.n = 0;
-  
-  //spooler_print_contents(self);
   
-  //find all spools between msg->prev_id and msg->id
-  rbtree_conditional_walk(&self->spoolseed, (rbtree_walk_conditional_callback_pt )collect_spool_range_callback, &srdata);
-  /*
-  if(srdata.n == 0) {
-    DBG("no spools in range %V -- ", msgid_to_str(&msg->prev_id));
-    DBG(" -- %V", msgid_to_str(&msg->id));
-  }
-  */
-  while((spool = spoolcollector_unwind_nextspool(&srdata)) != NULL) {
-    responded_subs += spool->sub_count;
-    if(msg->id.tagcount > NCHAN_FIXED_MULTITAG_MAX) {
-      assert(spool->id.tag.allocd != msg->id.tag.allocd);
+  if(self->fetching_strategy != NCHAN_SPOOL_PASSTHROUGH) {
+    srdata.min = msg->prev_id;
+    srdata.max = msg->id;
+    srdata.multi = msg->id.tagcount;
+    srdata.overflow = NULL;
+    srdata.msg = msg;
+    srdata.n = 0;
+    
+    //spooler_print_contents(self);
+    
+    //find all spools between msg->prev_id and msg->id
+    rbtree_conditional_walk(&self->spoolseed, (rbtree_walk_conditional_callback_pt )collect_spool_range_callback, &srdata);
+    /*
+    if(srdata.n == 0) {
+      DBG("no spools in range %V -- ", msgid_to_str(&msg->prev_id));
+      DBG(" -- %V", msgid_to_str(&msg->id));
     }
-    spool_respond_general(spool, msg, 0, NULL, 0);
-    if(msg->id.tagcount > NCHAN_FIXED_MULTITAG_MAX) {
-      assert(spool->id.tag.allocd != msg->id.tag.allocd);
+    */
+    while((spool = spoolcollector_unwind_nextspool(&srdata)) != NULL) {
+      responded_subs += spool->sub_count;
+      if(msg->id.tagcount > NCHAN_FIXED_MULTITAG_MAX) {
+        assert(spool->id.tag.allocd != msg->id.tag.allocd);
+      }
+      spool_respond_general(spool, msg, 0, NULL, 0);
+      if(msg->id.tagcount > NCHAN_FIXED_MULTITAG_MAX) {
+        assert(spool->id.tag.allocd != msg->id.tag.allocd);
+      }
+      spool_nextmsg(spool, &msg->id);
     }
-    spool_nextmsg(spool, &msg->id);
   }
-  
   spool = get_spool(self, &latest_msg_id);
-  if(spool->sub_count > 0) {
-#if NCHAN_BENCHMARK
-    responded_subs += spool->sub_count;
-#endif
+  if(spool->sub_count > 0 && *self->channel_buffer_complete) {
     spool_respond_general(spool, msg, 0, NULL, 0);
     spool_nextmsg(spool, &msg->id);
   }
 
   nchan_copy_msg_id(&self->prev_msg_id, &msg->id, NULL);
   
-#if NCHAN_BENCHMARK
-  self->last_responded_subscriber_count = responded_subs;
-#endif
   return NGX_OK;
 }
 
@@ -1041,16 +1074,26 @@ static ngx_int_t spool_rbtree_compare(void *v1, void *v2) {
 }
 
 static int its_time_for_a_spooling_filter(void *data) {
-  return ((subscriber_pool_t *)data)->msg_status == MSG_CHANNEL_NOTREADY;
+  subscriber_pool_t *spool = data;
+  if(spool->msg_status == MSG_CHANNEL_NOTREADY || spool->msg_status == MSG_INVALID) {
+    spool_reserve(spool);
+    return 1;
+  }
+  else {
+    return 0;
+  }
 }
 
 static ngx_int_t its_time_for_a_spooling(rbtree_seed_t *seed, subscriber_pool_t *spool, void *data) {
-  ngx_int_t       rc;
+  ngx_int_t       rc = NGX_OK;
   //validate_spool(spool);
-  assert(spool->msg_status == MSG_CHANNEL_NOTREADY);
-  spool->msg_status = MSG_INVALID;
-  rc = spool_fetch_msg(spool);
-  assert(rc == NGX_OK || rc == NGX_DONE);
+  if(spool->msg_status == MSG_CHANNEL_NOTREADY || spool->msg_status == MSG_INVALID) {
+    //TODO: maybe don't fetch spool with zero subs?
+    spool->msg_status = MSG_INVALID;
+    rc = spool_fetch_msg(spool);
+    assert(rc == NGX_OK || rc == NGX_DONE || NGX_DECLINED);
+  }
+  spool_release(spool);
   return rc;
 }
 
@@ -1115,7 +1158,7 @@ static channel_spooler_fn_t  spooler_fn = {
   spooler_prepare_to_stop
 };
 
-channel_spooler_t *start_spooler(channel_spooler_t *spl, ngx_str_t *chid, chanhead_pubsub_status_t *channel_status, nchan_store_t *store, nchan_loc_conf_t *cf, spooler_fetching_strategy_t fetching_strategy, channel_spooler_handlers_t *handlers, void *handlers_privdata) {
+channel_spooler_t *start_spooler(channel_spooler_t *spl, ngx_str_t *chid, chanhead_pubsub_status_t *channel_status, uint8_t *channel_buffer_complete, nchan_store_t *store, nchan_loc_conf_t *cf, spooler_fetching_strategy_t fetching_strategy, channel_spooler_handlers_t *handlers, void *handlers_privdata) {
   if(!spl->running) {
     ngx_memzero(spl, sizeof(*spl));
     rbtree_init(&spl->spoolseed, "spooler msg_id tree", spool_rbtree_node_id, spool_rbtree_bucketer, spool_rbtree_compare);
@@ -1130,6 +1173,7 @@ channel_spooler_t *start_spooler(channel_spooler_t *spl, ngx_str_t *chid, chanhe
     spl->store = store;
     
     spl->channel_status = channel_status;
+    spl->channel_buffer_complete = channel_buffer_complete;
     
     spl->running = 1;
     //spl->want_to_stop = 0;
@@ -1157,6 +1201,7 @@ static ngx_int_t remove_spool(subscriber_pool_t *spool) {
   channel_spooler_t    *spl = spool->spooler;
   ngx_rbtree_node_t    *node = rbtree_node_from_data(spool);
   
+  assert(spool->reserved == 0);
   DBG("remove spool node %p", node);
   
   assert(spool->spooler->running);
@@ -1176,7 +1221,7 @@ static ngx_int_t remove_spool(subscriber_pool_t *spool) {
 
 static ngx_int_t destroy_spool(subscriber_pool_t *spool) {
   rbtree_seed_t         *seed = &spool->spooler->spoolseed;
-  spooled_subscriber_t  *ssub;
+  spooled_subscriber_t  *ssub, *ssub_next;
   subscriber_t          *sub;
   ngx_rbtree_node_t     *node = rbtree_node_from_data(spool);
   
@@ -1184,15 +1229,16 @@ static ngx_int_t destroy_spool(subscriber_pool_t *spool) {
   
   DBG("destroy spool node %p", node);
   
-  for(ssub = spool->first; ssub!=NULL; ssub=ssub->next) {
+  for(ssub = spool->first; ssub!=NULL; ssub = ssub_next) {
     sub = ssub->sub;
+    ssub_next = ssub->next;
     //DBG("dequeue sub %p in spool %p", sub, spool);
     sub->fn->dequeue(sub);
   }
   assert(spool->sub_count == 0);
   assert(spool->first == NULL);
   
-  ngx_memset(spool, 0x42, sizeof(*spool)); //debug
+  //ngx_memset(spool, 0x42, sizeof(*spool)); //debug
   
   rbtree_destroy_node(seed, node);
   return NGX_OK;
diff --git a/debian/modules/nchan/src/store/spool.h b/debian/modules/nchan/src/store/spool.h
index 097c957c..88e8d1ab 100644
--- a/debian/modules/nchan/src/store/spool.h
+++ b/debian/modules/nchan/src/store/spool.h
@@ -31,11 +31,11 @@ struct subscriber_pool_s {
   ngx_int_t                   fetchmsg_current_count;
   ngx_event_t                 fetchmsg_ev;
   
-  ngx_pool_t                 *pool;
   ngx_uint_t                  sub_count;
   ngx_uint_t                  non_internal_sub_count;
-  ngx_uint_t                  generation;
-  ngx_uint_t                  responded_count;
+  //ngx_uint_t                  generation;
+  //ngx_uint_t                  responded_count;
+  uint8_t                     reserved;
   struct channel_spooler_s   *spooler;
 }; // subscriber_pool_t
 
@@ -52,7 +52,7 @@ typedef struct {
   ngx_int_t            (*prepare_to_stop)(channel_spooler_t *self);
 } channel_spooler_fn_t;
 
-typedef enum {FETCH, FETCH_IGNORE_MSG_NOTFOUND, NO_FETCH} spooler_fetching_strategy_t;
+typedef enum {NCHAN_SPOOL_FETCH, NCHAN_SPOOL_FETCH_IGNORE_MSG_NOTFOUND, NCHAN_SPOOL_PASSTHROUGH} spooler_fetching_strategy_t;
 
 
 typedef struct fetchmsg_data_s fetchmsg_data_t;
@@ -80,6 +80,7 @@ struct channel_spooler_s {
   ngx_uint_t                  responded_count;
   ngx_str_t                  *chid;
   chanhead_pubsub_status_t   *channel_status;
+  uint8_t                    *channel_buffer_complete;
   nchan_store_t              *store;
   nchan_loc_conf_t           *cf;
   channel_spooler_fn_t       *fn;
@@ -87,9 +88,6 @@ struct channel_spooler_s {
   void                       *handlers_privdata;
   fetchmsg_data_t            *fetchmsg_cb_data_list;
   spooler_event_ll_t         *spooler_dependent_events;
-#if NCHAN_BENCHMARK
-  ngx_int_t                   last_responded_subscriber_count;
-#endif  
   spooler_fetching_strategy_t fetching_strategy;
   unsigned                    publish_events:1;
   unsigned                    running:1;
@@ -106,7 +104,7 @@ struct channel_spooler_handlers_s {
   void                        (*get_message_finish)(channel_spooler_t *, void *);
 };
 
-channel_spooler_t *start_spooler(channel_spooler_t *spl, ngx_str_t *chid, chanhead_pubsub_status_t *channel_status, nchan_store_t *store, nchan_loc_conf_t *cf, spooler_fetching_strategy_t fetching_strategy, channel_spooler_handlers_t *handlers, void *handlers_privdata);
+channel_spooler_t *start_spooler(channel_spooler_t *spl, ngx_str_t *chid, chanhead_pubsub_status_t *channel_status, uint8_t *channel_buffer_complete, nchan_store_t *store, nchan_loc_conf_t *cf, spooler_fetching_strategy_t fetching_strategy, channel_spooler_handlers_t *handlers, void *handlers_privdata);
 ngx_int_t stop_spooler(channel_spooler_t *spl, uint8_t dequeue_subscribers);
 
 ngx_int_t spooler_catch_up(channel_spooler_t *spl);
diff --git a/debian/modules/nchan/src/subscribers/benchmark.c b/debian/modules/nchan/src/subscribers/benchmark.c
new file mode 100644
index 00000000..9b97870c
--- /dev/null
+++ b/debian/modules/nchan/src/subscribers/benchmark.c
@@ -0,0 +1,72 @@
+#include <nchan_module.h>
+#include <subscribers/common.h>
+#include "internal.h"
+#include "benchmark.h"
+#include <assert.h>
+
+//#define DEBUG_LEVEL NGX_LOG_WARN
+#define DEBUG_LEVEL NGX_LOG_DEBUG
+
+#define DBG(fmt, arg...) ngx_log_error(DEBUG_LEVEL, ngx_cycle->log, 0, "SUB:BENCHMARK:" fmt, ##arg)
+#define ERR(fmt, arg...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "SUB:BENCHMARK:" fmt, ##arg)
+
+typedef struct {
+  subscriber_t        *sub;
+  nchan_benchmark_t   *bench;
+} sub_data_t;
+
+static ngx_int_t sub_enqueue(ngx_int_t status, void *ptr, sub_data_t *d) {
+  if(nchan_benchmark_active()) {
+    ngx_atomic_fetch_add(d->bench->shared.subscribers_enqueued, 1);
+  }
+  nchan_update_stub_status(subscribers, 1); //needs to be done manually for INTERNAL subs
+  return NGX_OK;
+}
+
+static ngx_int_t sub_dequeue(ngx_int_t status, void *ptr, sub_data_t* d) {
+  if(nchan_benchmark_active()) {
+    ngx_atomic_fetch_add(d->bench->shared.subscribers_dequeued, 1);
+  }
+  nchan_update_stub_status(subscribers, -1); //needs to be done manually for INTERNAL subs
+  return NGX_OK;
+}
+
+static ngx_int_t sub_respond_message(ngx_int_t status, void *ptr, sub_data_t* d) {
+  nchan_msg_t *msg = ptr;
+  uint64_t msec = nchan_benchmark_message_delivery_msec(msg);
+  if(nchan_benchmark_active()) {
+    hdr_record_value(d->bench->data.msg_delivery_latency, msec);
+    d->bench->data.msg_received++;
+  }
+  return NGX_OK;
+}
+
+static ngx_int_t sub_respond_status(ngx_int_t status, void *ptr, sub_data_t *d) {
+  return NGX_OK;
+}
+
+static ngx_int_t sub_respond_notice(ngx_int_t notice, void *ptr, sub_data_t *d) {
+  return NGX_OK;
+}
+
+static ngx_str_t  sub_name = ngx_string("benchmark");
+
+subscriber_t *benchmark_subscriber_create(nchan_benchmark_t *bench) {
+  static  nchan_msg_id_t      newest_msgid = NCHAN_NEWEST_MSGID;
+  sub_data_t                 *d;
+  subscriber_t               *sub;
+  nchan_loc_conf_t           *cf = bench->loc_conf;
+  struct timeval tv;
+  
+  sub = internal_subscriber_create_init(&sub_name, cf, sizeof(*d), (void **)&d, (callback_pt )sub_enqueue, (callback_pt )sub_dequeue, (callback_pt )sub_respond_message, (callback_pt )sub_respond_status, (callback_pt )sub_respond_notice, NULL);
+  
+  sub->last_msgid = newest_msgid;
+  sub->destroy_after_dequeue = 1;
+  d->sub = sub;
+  d->bench = bench;
+  ngx_gettimeofday(&tv);
+  
+  
+  DBG("%p benchmark subscriber created with privdata %p", sub, d);
+  return sub;
+}
diff --git a/debian/modules/nchan/src/subscribers/benchmark.h b/debian/modules/nchan/src/subscribers/benchmark.h
new file mode 100644
index 00000000..dcb52c9e
--- /dev/null
+++ b/debian/modules/nchan/src/subscribers/benchmark.h
@@ -0,0 +1,3 @@
+#include <util/nchan_benchmark.h>
+
+subscriber_t *benchmark_subscriber_create(nchan_benchmark_t *bench);
diff --git a/debian/modules/nchan/src/subscribers/common.c b/debian/modules/nchan/src/subscribers/common.c
index 7c5cc4ae..611d9421 100644
--- a/debian/modules/nchan/src/subscribers/common.c
+++ b/debian/modules/nchan/src/subscribers/common.c
@@ -4,6 +4,8 @@
 //#include <util/nchan_fake_request.h>
 #include <util/nchan_subrequest.h>
 
+#include <util/nchan_fake_request.h>
+
 #if FAKESHARD
 #include <store/memory/store.h>
 #endif
@@ -14,181 +16,83 @@
 #define ERR(fmt, arg...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "SUB:COMMON:" fmt, ##arg)
 
 typedef struct {
-  subscriber_t    *sub;
-  ngx_str_t       *ch_id;
-  ngx_int_t        rc;
-  ngx_int_t        http_response_code;
-} nchan_subrequest_data_t;
-
-
-typedef struct {
-  subscriber_t            *sub;
-  subrequest_callback_pt   cb;
-  void                    *cb_data;
-} nchan_subrequest_data_cb_t;
-
-typedef struct {
-  ngx_http_post_subrequest_t     psr;
-  nchan_subrequest_data_t        psr_data;
-} nchan_subrequest_stuff_t;
-
-static ngx_int_t subscriber_subrequest_handler(ngx_http_request_t *sr, void *pd, ngx_int_t rc) {
-  nchan_subrequest_data_cb_t    *psrd = (nchan_subrequest_data_cb_t *)pd;
-  
-  psrd->sub->fn->release(psrd->sub, 1);
-  
-  if(psrd->cb) {
-    psrd->cb(psrd->sub, sr, rc, psrd->cb_data);
-  }
-  return NGX_OK;
-}
-
-
-ngx_http_request_t *subscriber_cv_subrequest(subscriber_t *sub, ngx_http_complex_value_t *url_ccv, ngx_buf_t *body, subrequest_callback_pt cb, void *cb_data) {
-  ngx_str_t                     request_url;
-  ngx_http_complex_value(sub->request, url_ccv, &request_url);
-  return subscriber_subrequest(sub, &request_url, body, cb, cb_data);
-}
-
-
-ngx_http_request_t *subscriber_subrequest(subscriber_t *sub, ngx_str_t *url, ngx_buf_t *body, subrequest_callback_pt cb, void *cb_data) {
-  ngx_http_request_t            *r = sub->request;
-  ngx_http_post_subrequest_t    *psr = ngx_pcalloc(r->pool, sizeof(*psr));
-  nchan_subrequest_data_cb_t    *psrd = ngx_pcalloc(r->pool, sizeof(*psrd));
-  ngx_http_request_t            *sr;
-
-  sub->fn->reserve(sub);
-  
-  psr->handler = subscriber_subrequest_handler;
-  psr->data = psrd;
-  psrd->sub = sub;
-  psrd->cb_data = cb_data;
-  psrd->cb = cb;
-  
-  ngx_http_subrequest(r, url, NULL, &sr, psr, NGX_HTTP_SUBREQUEST_IN_MEMORY);
-  
-  if((sr->request_body = ngx_pcalloc(r->pool, sizeof(*sr->request_body))) == NULL) { //dummy request body 
-    return NULL;
-  }
-  
-  if(body && ngx_buf_size(body) > 0) {
-    static ngx_str_t                   POST_REQUEST_STRING = {4, (u_char *)"POST "};
-    size_t                             sz;
-    ngx_http_request_body_t           *sr_body = sr->request_body;
-    ngx_chain_t                       *fakebody_chain;
-    ngx_buf_t                         *fakebody_buf;
-    
-    fakebody_chain = ngx_palloc(r->pool, sizeof(*fakebody_chain));
-    fakebody_buf = ngx_palloc(r->pool, sizeof(*fakebody_buf));
-    sr_body->bufs = fakebody_chain;
-    fakebody_chain->next = NULL;
-    fakebody_chain->buf = fakebody_buf;
-    ngx_memzero(fakebody_buf, sizeof(*fakebody_buf));
-    fakebody_buf->last_buf = 1;
-    fakebody_buf->last_in_chain = 1;
-    fakebody_buf->flush = 1;
-    fakebody_buf->memory = 1;
-    
-    //just copy the buffer contents. it's inefficient but I don't care at the moment.
-    //this can and should be optimized later
-    sz = ngx_buf_size(body);
-    fakebody_buf->start = ngx_palloc(r->pool, sz); //huuh?
-    ngx_memcpy(fakebody_buf->start, body->start, sz);
-    fakebody_buf->end = fakebody_buf->start + sz;
-    fakebody_buf->pos = fakebody_buf->start;
-    fakebody_buf->last = fakebody_buf->end;
-    
-    nchan_adjust_subrequest(sr, NGX_HTTP_POST, &POST_REQUEST_STRING, sr_body, sz, NULL);
-  }
-  else {
-    sr->header_only = 1;
-  }
-  sr->args = sub->request->args;
-  
-  return sr;
-}
-
-static ngx_int_t generic_subscriber_subrequest_old(subscriber_t *sub, ngx_http_complex_value_t *url_ccv, ngx_int_t (*handler)(ngx_http_request_t *, void *, ngx_int_t), ngx_http_request_t **subrequest, ngx_str_t *chid) {
-  ngx_str_t                  request_url;
-  nchan_subrequest_stuff_t  *psr_stuff = ngx_palloc(sub->request->pool, sizeof(*psr_stuff));
-  assert(psr_stuff != NULL);
-  
-  //ngx_http_request_t            *fake_parent_req = fake_cloned_parent_request(sub->request);
-  
-  ngx_http_post_subrequest_t    *psr = &psr_stuff->psr;
-  nchan_subrequest_data_t       *psrd = &psr_stuff->psr_data;
-  ngx_http_request_t            *sr;
-  
-  ngx_http_complex_value(sub->request, url_ccv, &request_url);
-  
-  sub->fn->reserve(sub);
-  
-  psr->handler = handler;
-  psr->data = psrd;
-  
-  psrd->sub = sub;
-  if(chid) {
-    psrd->ch_id = chid;
-  }
-  
-  ngx_http_subrequest(sub->request, &request_url, NULL, &sr, psr, NGX_HTTP_SUBREQUEST_IN_MEMORY);
-  
-  sr->request_body = ngx_pcalloc(sub->request->pool, sizeof(ngx_http_request_body_t)); //dummy request body 
-  if (sr->request_body == NULL) {
-    return NGX_ERROR;
-  }
-  
-  sr->header_only = 1;
-  
-  sr->args = sub->request->args;
-  if(subrequest) {
-    *subrequest = sr;
-  }
-  
-  return NGX_OK;
-}
-
-static void subscriber_authorize_timer_callback_handler(ngx_event_t *ev) {
-  nchan_subrequest_data_t *d = ev->data;
-  
-  d->sub->fn->release(d->sub, 1);
-  
-  if(d->rc == NGX_OK) {
-    ngx_int_t code = d->http_response_code;
+  subscriber_t       *sub;
+  ngx_str_t          *ch_id;
+  nchan_fakereq_subrequest_data_t *subrequest;
+} nchan_subscribe_auth_request_data_t;
+
+static ngx_int_t subscriber_authorize_callback(ngx_int_t rc, ngx_http_request_t *sr, void *data) {
+  nchan_subscribe_auth_request_data_t *d = data;
+  subscriber_t                        *sub = d->sub;
+  
+  if(sub->status == DEAD) {
+    nchan_requestmachine_request_cleanup_manual(d->subrequest);
+    sub->fn->release(d->sub, 0);
+  }
+  else if (rc == NGX_HTTP_CLIENT_CLOSED_REQUEST) {
+    //this shouldn't happen, but if it does, no big deal
+    nchan_requestmachine_request_cleanup_manual(d->subrequest);
+    sub->fn->release(d->sub, 1);
+    sub->fn->respond_status(sub, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL); //couldn't reach upstream
+  }
+  else if(rc == NGX_OK) {
+    ngx_int_t        code = sr->headers_out.status;
+    sub->fn->release(sub, 1);
     if(code >= 200 && code <299) {
-      //authorized. proceed as planned
-      nchan_subscriber_subscribe(d->sub, d->ch_id);
+      nchan_requestmachine_request_cleanup_manual(d->subrequest);
+      nchan_subscriber_subscribe(sub, d->ch_id);
     }
-    else { //anything else means forbidden
-      d->sub->fn->respond_status(d->sub, NGX_HTTP_FORBIDDEN, NULL); //auto-closes subscriber
+    else {
+      //forbidden, but with some data to forward to the subscriber
+      ngx_http_request_t       *r = d->sub->request;
+      ngx_str_t                *content_type;
+      ngx_int_t                 content_length;
+      ngx_chain_t              *request_chain = NULL;
+      content_type = (sr->upstream->headers_in.content_type ? &sr->upstream->headers_in.content_type->value : NULL);
+      content_length = nchan_subrequest_content_length(sr);
+      if(content_length > 0) {
+#if nginx_version >= 1013010
+        request_chain = sr->out;
+#else
+        request_chain = sr->upstream->out_bufs;
+#endif
+      }
+      //copy headers
+      ngx_uint_t                       i;
+      ngx_list_part_t                 *part = &sr->headers_out.headers.part;
+      ngx_table_elt_t                 *header= part->elts;
+      for (i = 0; /* void */ ; i++) {
+        if (i >= part->nelts) {
+          if (part->next == NULL) {
+            break;
+          }
+          part = part->next;
+          header = part->elts;
+          i = 0;
+        }
+        if (!nchan_strmatch(&header[i].key, 4, "Content-Type", "Server", "Content-Length", "Connection")) {
+          //copy header to main request's response
+          nchan_add_response_header(r, &header[i].key, &header[i].value);
+        }
+      }
+      
+      if(content_type) {
+        r->headers_out.content_type = *content_type;
+      }
+      r->headers_out.content_length_n = content_length;
+      nchan_requestmachine_request_cleanup_on_request_finalize(d->subrequest, r);
+      sub->fn->respond_status(sub, code, NULL, request_chain); //auto-closes subscriber
     }
   }
-  else {
-    d->sub->fn->respond_status(d->sub, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL); //auto-closes subscriber
-  }
-
-}
-
-static ngx_int_t subscriber_authorize_callback(ngx_http_request_t *r, void *data, ngx_int_t rc) {
-  nchan_subrequest_data_t       *d = data;
-  ngx_event_t                   *timer;
-  
-  if (rc == NGX_HTTP_CLIENT_CLOSED_REQUEST) {
-    d->sub->fn->release(d->sub, 1);
-    //subscriber will be cleaned up and destroyed because this happens before the 
-    //subscriber's sudden_abort_handler is called
+  else if(rc >= 500 && rc < 600) {
+    nchan_requestmachine_request_cleanup_manual(d->subrequest);
+    sub->fn->release(d->sub, 1);
+    sub->fn->respond_status(sub, rc, NULL, NULL); //auto-closes subscriber
   }
   else {
-    d->rc = rc;
-    d->http_response_code = r->headers_out.status;
-    if((timer = ngx_pcalloc(r->pool, sizeof(*timer))) == NULL) {
-      return NGX_ERROR;
-    }
-    timer->handler = subscriber_authorize_timer_callback_handler;
-    timer->log = d->sub->request->connection->log;
-    timer->data = data;
-    
-    ngx_add_timer(timer, 0); //not sure if this needs to be done like this, but i'm just playing it safe here.
+    nchan_requestmachine_request_cleanup_manual(d->subrequest);
+    sub->fn->release(d->sub, 1);
+    d->sub->fn->respond_status(d->sub, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL); //auto-closes subscriber
   }
   
   return NGX_OK;
@@ -197,82 +101,96 @@ static ngx_int_t subscriber_authorize_callback(ngx_http_request_t *r, void *data
 ngx_int_t nchan_subscriber_authorize_subscribe_request(subscriber_t *sub, ngx_str_t *ch_id) {
   
   ngx_http_complex_value_t  *authorize_request_url_ccv = sub->cf->authorize_request_url;
+  //DBG("%p (req %p) nchan_subscriber_authorize_subscribe_request", sub, sub->request);
   
   if(!authorize_request_url_ccv) {
     return nchan_subscriber_subscribe(sub, ch_id);
   }
   else {
-    return generic_subscriber_subrequest_old(sub, authorize_request_url_ccv, subscriber_authorize_callback, NULL, ch_id);
+    nchan_requestmachine_request_params_t param;
+    param.url.cv = authorize_request_url_ccv;
+    param.url_complex = 1;
+    param.pool = ngx_create_pool(1024, ngx_cycle->log);
+    param.body = NULL;
+    param.response_headers_only = 0;
+    param.manual_cleanup = 1;
+    
+    nchan_subscribe_auth_request_data_t  *d = ngx_palloc(param.pool, sizeof(*d));
+    if(!d) {
+      ngx_destroy_pool(param.pool);
+      return NGX_ERROR;
+    }
+    param.cb = (callback_pt )subscriber_authorize_callback;
+    param.pd = d;
+    
+    d->sub = sub;
+    d->ch_id = ch_id;
+    d->subrequest = nchan_subscriber_subrequest(sub, &param);
+    if(d->subrequest != NULL) {
+      sub->fn->reserve(sub);
+      return NGX_OK;
+    }
+    else {
+      ngx_destroy_pool(param.pool);
+      return NGX_ERROR;
+    }
   }
 }
 
-static ngx_int_t subscriber_unsubscribe_request_callback(ngx_http_request_t *r, void *data, ngx_int_t rc) {
-  nchan_subrequest_data_t       *d = data;
-  nchan_request_ctx_t           *ctx = ngx_http_get_module_ctx(d->sub->request, ngx_nchan_module);
-  ngx_int_t                      finalize_code = ctx->unsubscribe_request_callback_finalize_code;
-  DBG("callback %p %p %i", r, data, rc);
-  if(d->sub->request->main->blocked) {
-    d->sub->request->main->blocked = 0;
-  }
-  if(finalize_code != NGX_DONE) {
-    nchan_http_finalize_request(d->sub->request, finalize_code);
-  }
-  
-  ctx->unsubscribe_request_callback_finalize_code = NGX_OK;
-  d->sub->fn->release(d->sub, 0);
-  return NGX_OK;
+static ngx_int_t nchan_subscriber_subrequest_fire_and_forget(subscriber_t *sub, ngx_http_complex_value_t *url_cv) {
+  //DBG("%p (req %p) nchan_subscriber_unsubscribe_request", sub, sub->request);
+    
+  nchan_requestmachine_request_params_t param;
+  param.url.cv = url_cv;
+  param.url_complex = 1;
+  param.cb = NULL;
+  param.pd = NULL;
+  param.pool = NULL;
+  param.body = NULL;
+  param.response_headers_only = 1;
+  param.manual_cleanup = 0;
+  
+  return nchan_subscriber_subrequest(sub, &param) == NULL ? NGX_ERROR : NGX_OK;
 }
 
-
-ngx_int_t nchan_subscriber_unsubscribe_request(subscriber_t *sub, ngx_int_t finalize_code) {
-  ngx_int_t                    ret;
-  //ngx_http_upstream_conf_t    *ucf;
+ngx_int_t nchan_subscriber_unsubscribe_request(subscriber_t *sub) {
+  nchan_request_ctx_t         *ctx;
+  //DBG("%p (req %p) nchan_subscriber_unsubscribe_request", sub, sub->request);
   
-  if(sub->type == LONGPOLL || sub->type == INTERVALPOLL) {
-    //don't do this for longpoll subscribers. It's still buggy and not efficient anyway
+  if(!sub->enable_sub_unsub_callbacks) {
     return NGX_OK;
   }
   
-  nchan_request_ctx_t         *ctx = ngx_http_get_module_ctx(sub->request, ngx_nchan_module);
-  ngx_http_request_t          *subrequest;
-  ctx->unsubscribe_request_callback_finalize_code = finalize_code;
-  ret = generic_subscriber_subrequest_old(sub, sub->cf->unsubscribe_request_url, subscriber_unsubscribe_request_callback, &subrequest, NULL);
-  ctx->sent_unsubscribe_request = 1;
-  
-  //ucf = ngx_http_get_module_loc_conf(subrequest, ngx_http_upstream_module);
-  //ucf->ignore_client_abort = 1;
+  ctx = ngx_http_get_module_ctx(sub->request, ngx_nchan_module);
+  if(ctx->sent_unsubscribe_request) {
+    return NGX_OK;
+  }
   
-  return ret;
-}
-
-
-static ngx_int_t subscriber_subscribe_callback(ngx_http_request_t *r, void *data, ngx_int_t rc) {
-  nchan_subrequest_data_t       *d = data;
-  d->sub->fn->release(d->sub, 0);
-  return NGX_OK;
+  ctx->sent_unsubscribe_request = 1;
+  return nchan_subscriber_subrequest_fire_and_forget(sub, sub->cf->unsubscribe_request_url);
 }
 
-
 ngx_int_t nchan_subscriber_subscribe_request(subscriber_t *sub) {
-  nchan_request_ctx_t  *ctx = ngx_http_get_module_ctx(sub->request, ngx_nchan_module);
-  if(!ctx->sent_unsubscribe_request) {
-    return generic_subscriber_subrequest_old(sub, sub->cf->subscribe_request_url, subscriber_subscribe_callback, NULL, NULL);
-  }
-  else {
+  if(!sub->enable_sub_unsub_callbacks) {
     return NGX_OK;
   }
+  return nchan_subscriber_subrequest_fire_and_forget(sub, sub->cf->subscribe_request_url);
 }
 
 
+
 ngx_int_t nchan_subscriber_subscribe(subscriber_t *sub, ngx_str_t *ch_id) {
   ngx_int_t             ret;
-  //nchan_request_ctx_t  *ctx = ngx_http_get_module_ctx(sub->request, ngx_nchan_module);
-  subscriber_type_t     sub_type = sub->type;
+  nchan_request_ctx_t  *ctx;
   nchan_loc_conf_t     *cf = sub->cf;
+  int                   enable_sub_unsub_callbacks = sub->enable_sub_unsub_callbacks;
   
+  //DBG("%p (req %p) nchan_subscriber_subscribe", sub, sub->request);
+  
+  ctx = sub->request ? ngx_http_get_module_ctx(sub->request, ngx_nchan_module) : NULL;
   ret = sub->cf->storage_engine->subscribe(ch_id, sub);
   //don't access sub directly, it might have already been freed
-  if(ret == NGX_OK && sub_type != LONGPOLL && sub_type != INTERVALPOLL && cf->subscribe_request_url) {
+  if(ret == NGX_OK && enable_sub_unsub_callbacks && cf->subscribe_request_url && ctx && ctx->sub == sub) {
     nchan_subscriber_subscribe_request(sub);
   }
   return ret;
@@ -370,7 +288,7 @@ void nchan_subscriber_timeout_ev_handler(ngx_event_t *ev) {
   memstore_fakeprocess_push(sub->owner);
 #endif
   sub->dequeue_after_response = 1;
-  sub->fn->respond_status(sub, NGX_HTTP_REQUEST_TIMEOUT, &NCHAN_HTTP_STATUS_408);
+  sub->fn->respond_status(sub, NGX_HTTP_REQUEST_TIMEOUT, &NCHAN_HTTP_STATUS_408, NULL);
 #if FAKESHARD
   memstore_fakeprocess_pop();
 #endif
@@ -382,10 +300,35 @@ void nchan_subscriber_init_timeout_timer(subscriber_t *sub, ngx_event_t *ev) {
   nchan_init_timer(ev, nchan_subscriber_timeout_ev_handler, sub);
 }
 
+nchan_fakereq_subrequest_data_t *nchan_subscriber_subrequest(subscriber_t *sub, nchan_requestmachine_request_params_t *params) {
+  if(sub->upstream_requestmachine == NULL) {
+    sub->upstream_requestmachine = ngx_calloc(sizeof(nchan_requestmachine_t), ngx_cycle->log);
+    if(sub->upstream_requestmachine == NULL) {
+      nchan_log_error("failed to allocate upstream_requestmachine for subscriber %p", sub);
+      return NULL;
+    }
+    else {
+      nchan_requestmachine_initialize(sub->upstream_requestmachine, sub->request);
+    }
+  }
+  
+  return nchan_requestmachine_request(sub->upstream_requestmachine, params);
+}
+
+ngx_int_t nchan_subscriber_subrequest_cleanup(subscriber_t *sub) {
+  if(sub->upstream_requestmachine != NULL) {
+    nchan_requestmachine_shutdown(sub->upstream_requestmachine);
+    ngx_free(sub->upstream_requestmachine);
+    sub->upstream_requestmachine = NULL;
+  }
+  return NGX_OK;
+}
+
 void nchan_subscriber_init(subscriber_t *sub, const subscriber_t *tmpl, ngx_http_request_t *r, nchan_msg_id_t *msgid) {
   nchan_request_ctx_t  *ctx = NULL;
   *sub = *tmpl;
   sub->request = r;
+  sub->upstream_requestmachine = NULL;
   if(r) {
     ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
     sub->cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
@@ -415,12 +358,12 @@ void nchan_subscriber_init(subscriber_t *sub, const subscriber_t *tmpl, ngx_http
   
 }
 
-void nchan_subscriber_common_setup(subscriber_t *sub, subscriber_type_t type, ngx_str_t *name, subscriber_fn_t *fn, ngx_int_t dequeue_after_response) {
+void nchan_subscriber_common_setup(subscriber_t *sub, subscriber_type_t type, ngx_str_t *name, subscriber_fn_t *fn, ngx_int_t enable_sub_unsub_callbacks, ngx_int_t dequeue_after_response) {
   nchan_request_ctx_t  *ctx = ngx_http_get_module_ctx(sub->request, ngx_nchan_module);
   sub->type = type;
   sub->name = name;
   sub->fn = fn;
-  
+  sub->enable_sub_unsub_callbacks = enable_sub_unsub_callbacks;
   sub->dequeue_after_response = dequeue_after_response;
   if(ctx) {
     ctx->subscriber_type = sub->name;
@@ -461,195 +404,3 @@ ngx_str_t nchan_subscriber_set_recyclable_msgid_str(nchan_request_ctx_t *ctx, nc
   
   return ret;
 }
-
-void ngx_init_set_membuf(ngx_buf_t *buf, u_char *start, u_char *end) {
-  ngx_memzero(buf, sizeof(*buf));
-  buf->start = start;
-  buf->pos = start;
-  buf->end = end;
-  buf->last = end;
-  buf->memory = 1;
-}
-
-void ngx_init_set_membuf_str(ngx_buf_t *buf, ngx_str_t *str) {
-  ngx_memzero(buf, sizeof(*buf));
-  buf->start = str->data;
-  buf->pos = str->data;
-  buf->end = str->data + str->len;
-  buf->last = buf->end;
-  buf->memory = 1;
-}
-
-#if nginx_version >= 1003015
-
-static void ngx_http_close_request_dup(ngx_http_request_t *r, ngx_int_t rc) {
-  ngx_connection_t  *c;
-
-  r = r->main;
-  c = r->connection;
-
-  ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
-                  "http request count:%d blk:%d", r->count, r->blocked);
-
-  if (r->count == 0) {
-    ngx_log_error(NGX_LOG_ALERT, c->log, 0, "http request count is zero");
-  }
-
-  r->count--;
-
-  if (r->count || r->blocked) {
-    return;
-  }
-
-#if (NGX_HTTP_V2)
-  if (r->stream) {
-    ngx_http_v2_close_stream(r->stream, rc);
-    return;
-  }
-#endif
-
-  ngx_http_free_request(r, rc);
-  ngx_http_close_connection(c);
-}
-
-void nchan_subscriber_unsubscribe_callback_http_test_reading(ngx_http_request_t *r) {
-  int                n;
-  char               buf[1];
-  ngx_err_t          err;
-  ngx_event_t       *rev;
-  ngx_connection_t  *c;
-  
-  nchan_request_ctx_t  *nchan_ctx;
-
-  c = r->connection;
-  rev = c->read;
-
-  ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http test reading");
-
-#if (NGX_HTTP_V2)
-
-  if (r->stream) {
-    if (c->error) {
-      err = 0;
-      goto closed;
-    }
-
-    return;
-  }
-
-#endif
-#if (NGX_HTTP_SPDY)
-
-    if (r->spdy_stream) {
-        if (c->error) {
-            err = 0;
-            goto closed;
-        }
-
-        return;
-    }
-
-#endif
-
-#if (NGX_HAVE_KQUEUE)
-
-  if (ngx_event_flags & NGX_USE_KQUEUE_EVENT) {
-
-    if (!rev->pending_eof) {
-        return;
-    }
-
-    rev->eof = 1;
-    c->error = 1;
-    err = rev->kq_errno;
-
-    goto closed;
-  }
-
-#endif
-
-#if (NGX_HAVE_EPOLLRDHUP)
-#if nginx_version >= 1011000
-  if ((ngx_event_flags & NGX_USE_EPOLL_EVENT) && ngx_use_epoll_rdhup) {
-    socklen_t  len;
-
-    if (!rev->pending_eof) {
-        return;
-    }
-#else
-  if ((ngx_event_flags & NGX_USE_EPOLL_EVENT) && rev->pending_eof) {
-    socklen_t  len;
-#endif
-
-    rev->eof = 1;
-    c->error = 1;
-
-    err = 0;
-    len = sizeof(ngx_err_t);
-
-    /*
-      * BSDs and Linux return 0 and set a pending error in err
-      * Solaris returns -1 and sets errno
-      */
-
-    if (getsockopt(c->fd, SOL_SOCKET, SO_ERROR, (void *) &err, &len)
-        == -1)
-    {
-        err = ngx_socket_errno;
-    }
-
-    goto closed;
-  }
-
-#endif
-
-  n = recv(c->fd, buf, 1, MSG_PEEK);
-
-  if (n == 0) {
-    rev->eof = 1;
-    c->error = 1;
-    err = 0;
-
-    goto closed;
-
-  } else if (n == -1) {
-    err = ngx_socket_errno;
-
-    if (err != NGX_EAGAIN) {
-      rev->eof = 1;
-      c->error = 1;
-
-      goto closed;
-    }
-  }
-
-  /* aio does not call this handler */
-
-  if ((ngx_event_flags & NGX_USE_LEVEL_EVENT) && rev->active) {
-
-    if (ngx_del_event(rev, NGX_READ_EVENT, 0) != NGX_OK) {
-      ngx_http_close_request_dup(r, 0);
-    }
-  }
-
-  return;
-
-closed:
-
-  if (err) {
-    rev->error = 1;
-  }
-
-  ngx_log_error(NGX_LOG_INFO, c->log, err,
-                "client prematurely closed connection");
-
-  //send the unsubscribe upstream request before finalize the main request.
-  //otherwise, main request pool will have been wiped by the time we need it.
-  nchan_ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
-  if(!nchan_ctx->sent_unsubscribe_request && nchan_ctx->sub) {
-    nchan_subscriber_unsubscribe_request(nchan_ctx->sub, NGX_HTTP_CLIENT_CLOSED_REQUEST);
-  }
-}
-
-#endif
-
diff --git a/debian/modules/nchan/src/subscribers/common.h b/debian/modules/nchan/src/subscribers/common.h
index bb4a02aa..7ce41847 100644
--- a/debian/modules/nchan/src/subscribers/common.h
+++ b/debian/modules/nchan/src/subscribers/common.h
@@ -2,7 +2,8 @@ ngx_int_t nchan_subscriber_subscribe(subscriber_t *sub, ngx_str_t *ch_id);
 
 ngx_int_t nchan_subscriber_authorize_subscribe_request(subscriber_t *sub, ngx_str_t *ch_id);
 ngx_int_t nchan_subscriber_subscribe_request(subscriber_t *sub);
-ngx_int_t nchan_subscriber_unsubscribe_request(subscriber_t *sub, ngx_int_t finalize_code);
+ngx_int_t nchan_subscriber_unsubscribe_request(subscriber_t *sub);
+ngx_int_t nchan_subscriber_subrequest_cleanup(subscriber_t *sub);
 
 ngx_int_t nchan_cleverly_output_headers_only_for_later_response(ngx_http_request_t *r);
 
@@ -12,18 +13,14 @@ ngx_int_t nchan_request_set_content_type_multipart_boundary_header(ngx_http_requ
 
 ngx_int_t nchan_subscriber_empty_notify(subscriber_t *, ngx_int_t code, void *data);
 
-typedef ngx_int_t (*subrequest_callback_pt)(subscriber_t *sub, ngx_http_request_t *r, ngx_int_t rc, void *);
-ngx_http_request_t *subscriber_cv_subrequest(subscriber_t *sub, ngx_http_complex_value_t *url_ccv, ngx_buf_t *body, subrequest_callback_pt cb, void *cb_data);
-ngx_http_request_t *subscriber_subrequest(subscriber_t *sub, ngx_str_t *url, ngx_buf_t *body, subrequest_callback_pt cb, void *cb_data);
+
+nchan_fakereq_subrequest_data_t *nchan_subscriber_subrequest(subscriber_t *sub, nchan_requestmachine_request_params_t *params);
+
 
 void nchan_subscriber_timeout_ev_handler(ngx_event_t *ev);
 void nchan_subscriber_init(subscriber_t *sub, const subscriber_t *tmpl, ngx_http_request_t *r, nchan_msg_id_t *msgid);
 void nchan_subscriber_init_timeout_timer(subscriber_t *sub, ngx_event_t *ev);
-void nchan_subscriber_common_setup(subscriber_t *sub, subscriber_type_t type, ngx_str_t *name, subscriber_fn_t *fn, ngx_int_t dequeue_after_response);
+void nchan_subscriber_common_setup(subscriber_t *sub, subscriber_type_t type, ngx_str_t *name, subscriber_fn_t *fn, ngx_int_t enable_sub_unsub_callbacks, ngx_int_t dequeue_after_response);
 ngx_int_t nchan_subscriber_init_msgid_reusepool(nchan_request_ctx_t *ctx, ngx_pool_t *request_pool);
 ngx_str_t nchan_subscriber_set_recyclable_msgid_str(nchan_request_ctx_t *ctx, nchan_msg_id_t *msgid);
-void nchan_subscriber_unsubscribe_callback_http_test_reading(ngx_http_request_t *r);
-void ngx_init_set_membuf(ngx_buf_t *buf, u_char *start, u_char *end);
-void ngx_init_set_membuf_str(ngx_buf_t *buf, ngx_str_t *str);
-#define ngx_init_set_membuf_char(buf, str) \
-  ngx_init_set_membuf(buf, (u_char *)str, ((u_char *)str) + sizeof(str)-1)
+
diff --git a/debian/modules/nchan/src/subscribers/eventsource.c b/debian/modules/nchan/src/subscribers/eventsource.c
index 6ff437af..2a6df968 100644
--- a/debian/modules/nchan/src/subscribers/eventsource.c
+++ b/debian/modules/nchan/src/subscribers/eventsource.c
@@ -49,7 +49,10 @@ static void es_ensure_headers_sent(full_subscriber_t *fsub) {
     
     bc->buf.last_buf = 0;
     bc->buf.flush = 1;
-
+    
+    r->chunked = 0;
+    r->header_only = 0;
+    
     nchan_output_filter(fsub->sub.request, &bc->chain);
     
     fsub->data.shook_hands = 1; 
@@ -103,7 +106,7 @@ static ngx_int_t es_respond_message(subscriber_t *sub,  nchan_msg_t *msg) {
   static ngx_str_t        terminal_newlines=ngx_string("\n\n");
   full_subscriber_t      *fsub = (full_subscriber_t  *)sub;
   u_char                 *cur = NULL, *last = NULL;
-  ngx_buf_t              *msg_buf = msg->buf;
+  ngx_buf_t              *msg_buf = &msg->buf;
   ngx_buf_t               databuf;
   nchan_buf_and_chain_t  *bc;
   ngx_chain_t            *first_link = NULL, *last_link = NULL;
@@ -233,8 +236,8 @@ static ngx_int_t es_respond_message(subscriber_t *sub,  nchan_msg_t *msg) {
   if(sub->cf->eventsource_event.len > 0) {
     prepend_es_response_line(fsub, &event_line, &first_link, &sub->cf->eventsource_event);
   }
-  else if(msg->eventsource_event.len > 0) {
-    prepend_es_response_line(fsub, &event_line, &first_link, &msg->eventsource_event);
+  else if(msg->eventsource_event) {
+    prepend_es_response_line(fsub, &event_line, &first_link, msg->eventsource_event);
   }
   
   return nchan_output_msg_filter(fsub->sub.request, msg, first_link);
@@ -242,7 +245,7 @@ static ngx_int_t es_respond_message(subscriber_t *sub,  nchan_msg_t *msg) {
 
 static void empty_handler(void) {}
 
-static ngx_int_t es_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line){
+static ngx_int_t es_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line,  ngx_chain_t *status_body){
   
   static ngx_str_t          empty_line = ngx_string("");
   full_subscriber_t        *fsub = (full_subscriber_t  *)sub;
@@ -255,7 +258,7 @@ static ngx_int_t es_respond_status(subscriber_t *sub, ngx_int_t status_code, con
   }
   
   if(fsub->data.shook_hands == 0 && status_code >= 400 && status_code <600) {
-    return subscriber_respond_unqueued_status(fsub, status_code, status_line);
+    return subscriber_respond_unqueued_status(fsub, status_code, status_line, status_body);
   }
   
   es_ensure_headers_sent(fsub);
@@ -273,6 +276,7 @@ static ngx_int_t es_respond_status(subscriber_t *sub, ngx_int_t status_code, con
   if((status_code >=400 && status_code <599) || status_code == NGX_HTTP_NOT_MODIFIED) {
     fsub->data.cln->handler = (ngx_http_cleanup_pt )empty_handler;
     fsub->sub.request->keepalive=0;
+    sub->request->headers_out.status = status_code;
     fsub->data.finalize_request=1;
     sub->fn->dequeue(sub);
   }
@@ -280,17 +284,90 @@ static ngx_int_t es_respond_status(subscriber_t *sub, ngx_int_t status_code, con
   return NGX_OK;
 }
 
+static void ping_ev_handler(ngx_event_t *ev) {
+  full_subscriber_t    *fsub = (full_subscriber_t *)ev->data;
+  nchan_loc_conf_t     *cf = fsub->sub.cf;
+  
+  if(!ev->timedout) {
+    return;
+  }
+
+  struct {
+    ngx_str_t   prefix;
+    ngx_str_t  *value;
+  } line[3] = {
+    {ngx_string(":"),         &cf->eventsource_ping.comment},
+    {ngx_string("event: "),   &cf->eventsource_ping.event},
+    {ngx_string("data: "),    &cf->eventsource_ping.data}
+  };
+  
+  int chaincount = 1;
+  int i;
+  for(i=0; i<3; i++) {
+    chaincount += line[i].value->len > 0 ? 3 : 0;
+  }
+
+  nchan_buf_and_chain_t  *bc = nchan_bufchain_pool_reserve(fsub_bcp(fsub), chaincount);
+  ngx_chain_t            *chain = NULL;
+    
+  for(i=0; i<3; i++) {
+    if(line[i].value->len > 0) {
+      chain = chain ? chain->next : &bc->chain;
+      ngx_init_set_membuf_str(chain->buf, &line[i].prefix);
+      
+      chain = chain->next;
+      ngx_init_set_membuf_str(chain->buf, line[i].value);
+      
+      chain = chain->next;
+      ngx_init_set_membuf_char(chain->buf, "\n");
+    }
+  }
+  chain = chain ? chain->next : &bc->chain;
+  if(chaincount > 1) {
+    ngx_init_set_membuf_char(chain->buf, "\n");
+  }
+  else {
+    //everything's empty.
+    //rather than sending a single newline (which is probably a valid event-stream protocol token)
+    //send an empty comment (definitely valid)
+    ngx_init_set_membuf_char(chain->buf, ":\n\n");
+  }
+  chain->buf->last_in_chain = 1;
+  chain->buf->flush = 1;
+  chain->next = NULL;
+  
+  nchan_output_filter(fsub->sub.request, &bc->chain);
+  
+  ev->timedout=0;
+  ngx_add_timer(&fsub->data.ping_ev, fsub->sub.cf->eventsource_ping.interval * 1000);
+}
+
 static ngx_int_t es_enqueue(subscriber_t *sub) {
   ngx_int_t           rc;
   full_subscriber_t  *fsub = (full_subscriber_t *)sub;
   DBG("%p output status to subscriber", sub);
   rc = longpoll_enqueue(sub);
+  if(rc == NGX_OK) {
+    if(sub->cf->eventsource_ping.interval > 0) {
+      nchan_init_timer(&fsub->data.ping_ev, ping_ev_handler, fsub);
+      ngx_add_timer(&fsub->data.ping_ev, sub->cf->eventsource_ping.interval * 1000);
+    }
+  }
+  
   fsub->data.finalize_request = 0;
   es_ensure_headers_sent(fsub);
   sub->enqueued = 1;
   return rc;
 }
 
+static ngx_int_t es_dequeue(subscriber_t *sub) {
+  full_subscriber_t  *fsub = (full_subscriber_t *)sub;
+  if(fsub->data.ping_ev.timer_set) {
+    ngx_del_timer(&fsub->data.ping_ev);
+  }
+  return longpoll_dequeue(sub);
+}
+
 static       subscriber_fn_t  eventsource_fn_data;
 static       subscriber_fn_t *eventsource_fn = NULL;
 
@@ -306,10 +383,13 @@ subscriber_t *eventsource_subscriber_create(ngx_http_request_t *r, nchan_msg_id_
     eventsource_fn = &eventsource_fn_data;
     *eventsource_fn = *sub->fn;
     eventsource_fn->enqueue = es_enqueue;
+    eventsource_fn->dequeue = es_dequeue;
     eventsource_fn->respond_message= es_respond_message;
     eventsource_fn->respond_status = es_respond_status;
   }
   
+  ngx_memzero(&fsub->data.ping_ev, sizeof(fsub->data.ping_ev));
+  
   fsub->data.shook_hands = 0;
   
   ctx->bcp = ngx_palloc(r->pool, sizeof(nchan_bufchain_pool_t));
@@ -318,7 +398,7 @@ subscriber_t *eventsource_subscriber_create(ngx_http_request_t *r, nchan_msg_id_
   //msgid bufs -- unique per response
   nchan_subscriber_init_msgid_reusepool(ctx, r->pool);
   
-  nchan_subscriber_common_setup(sub, EVENTSOURCE, &sub_name, eventsource_fn, 0);
+  nchan_subscriber_common_setup(sub, EVENTSOURCE, &sub_name, eventsource_fn, 1, 0);
   return sub;
 }
 
diff --git a/debian/modules/nchan/src/subscribers/getmsg_proxy.c b/debian/modules/nchan/src/subscribers/getmsg_proxy.c
new file mode 100644
index 00000000..fb77b555
--- /dev/null
+++ b/debian/modules/nchan/src/subscribers/getmsg_proxy.c
@@ -0,0 +1,106 @@
+#include <nchan_module.h>
+#include <subscribers/common.h>
+#include "internal.h"
+#include "getmsg_proxy.h"
+#include <assert.h>
+
+//#define DEBUG_LEVEL NGX_LOG_WARN
+#define DEBUG_LEVEL NGX_LOG_DEBUG
+
+#define DBG(fmt, arg...) ngx_log_error(DEBUG_LEVEL, ngx_cycle->log, 0, "SUB:PROXY:" fmt, ##arg)
+#define ERR(fmt, arg...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "SUB:PROXY:" fmt, ##arg)
+
+
+typedef struct sub_data_s sub_data_t;
+
+struct sub_data_s {
+  subscriber_t                 *sub;
+  ngx_str_t                    *chid;
+  ngx_event_t                   timeout_ev;
+  callback_pt                   cb;
+  void                         *pd;
+}; //sub_data_t
+
+static ngx_int_t sub_enqueue(ngx_int_t status, void *ptr, sub_data_t *d) {
+  DBG("%p enqueued ok", d->sub);
+  return NGX_OK;
+}
+
+static ngx_int_t sub_dequeue(ngx_int_t status, void *ptr, sub_data_t* d) {
+  internal_subscriber_t  *fsub = (internal_subscriber_t  *)d->sub;
+  DBG("%p dequeue:", d->sub);
+
+  //TODO: make sure proxy target is already taken care of
+  
+  if(fsub->sub.reserved > 0) {
+    DBG("%p  not ready to destroy (reserved for %i)", fsub, fsub->sub.reserved);
+    fsub->awaiting_destruction = 1;
+  }
+  else {
+    DBG("%p destroy", fsub);
+  }
+  
+  return NGX_OK;
+}
+
+static ngx_int_t sub_respond_message(ngx_int_t status, void *ptr, sub_data_t* d) {
+  DBG("%p forwarding msg", d->sub);
+  nchan_msg_t            *msg = (nchan_msg_t *) ptr;
+  d->cb(MSG_FOUND, msg, d->pd);
+  d->cb = NULL;
+  //TODO : dequeue
+  return NGX_OK;
+}
+
+static ngx_int_t sub_respond_status(ngx_int_t status, void *ptr, sub_data_t *d) {
+  assert(d->cb);
+  if(!ptr) {
+    switch(status) {
+      case NGX_HTTP_GONE: //delete
+        DBG("%p forwarding MSG_EXPIRED", d->sub);
+        d->cb(MSG_EXPIRED, NULL, d->pd);
+        d->cb = NULL;
+        break;
+      case NGX_HTTP_CONFLICT:
+      case NGX_HTTP_CLOSE: //delete
+      case NGX_HTTP_FORBIDDEN:
+      case NGX_HTTP_NOT_FOUND:
+      case NGX_HTTP_REQUEST_TIMEOUT:
+        DBG("%p forwarding MSG_NOTFOUND", d->sub);
+        d->cb(MSG_NOTFOUND, NULL, d->pd);
+        d->cb = NULL;
+        break;
+      case NGX_HTTP_NO_CONTENT:
+        //translate back to MSG request status code
+        DBG("%p forwarding MSG_EXPECTED", d->sub);
+        d->cb(MSG_EXPECTED, NULL, d->pd);
+        d->cb = NULL;
+        break;
+      case NGX_HTTP_NOT_MODIFIED: //does this even ever happen? I don't think so.
+        assert(0);
+        break;
+      default:
+        ERR("unknown status %i", status);
+    }
+  }
+  return NGX_OK;
+}
+
+static ngx_str_t sub_name = ngx_string("getmsg-proxy");
+
+subscriber_t *getmsg_proxy_subscriber_create(nchan_msg_id_t *msgid, callback_pt cb, void *pd) {
+  sub_data_t                 *d;
+  subscriber_t               *sub;
+  
+  sub = internal_subscriber_create_init(&sub_name, NULL /*no config*/, sizeof(*d), (void **)&d, (callback_pt )sub_enqueue, (callback_pt )sub_dequeue, (callback_pt )sub_respond_message, (callback_pt )sub_respond_status, NULL, NULL);
+  
+  
+  DBG("created new getmsg_proxy sub %p", sub);
+  nchan_copy_new_msg_id(&sub->last_msgid, msgid);
+  sub->destroy_after_dequeue = 1;
+  sub->dequeue_after_response = 1;
+  d->sub = sub;
+  d->cb = cb;
+  d->pd = pd;
+  return sub;
+}
diff --git a/debian/modules/nchan/src/subscribers/getmsg_proxy.h b/debian/modules/nchan/src/subscribers/getmsg_proxy.h
new file mode 100644
index 00000000..48a98348
--- /dev/null
+++ b/debian/modules/nchan/src/subscribers/getmsg_proxy.h
@@ -0,0 +1 @@
+subscriber_t *getmsg_proxy_subscriber_create(nchan_msg_id_t *msgid, callback_pt cb, void *pd);
diff --git a/debian/modules/nchan/src/subscribers/http-chunked.c b/debian/modules/nchan/src/subscribers/http-chunked.c
index d356f5de..faa056fd 100644
--- a/debian/modules/nchan/src/subscribers/http-chunked.c
+++ b/debian/modules/nchan/src/subscribers/http-chunked.c
@@ -37,6 +37,8 @@ static void chunked_ensure_headers_sent(full_subscriber_t *fsub) {
     nchan_cleverly_output_headers_only_for_later_response(r);
     
     fsub->data.shook_hands = 1; 
+    r->chunked = 0;
+    r->header_only = 0;
   }
 }
 
@@ -49,7 +51,7 @@ static ngx_int_t chunked_respond_message(subscriber_t *sub,  nchan_msg_t *msg) {
   ngx_file_t             *file_copy;
   nchan_buf_and_chain_t  *bc = nchan_bufchain_pool_reserve(ctx->bcp, 3);
   ngx_chain_t            *chain;
-  ngx_buf_t              *buf, *msg_buf = msg->buf;
+  ngx_buf_t              *buf, *msg_buf = &msg->buf;
   ngx_int_t               rc;
   
   if(fsub->data.timeout_ev.timer_set) {
@@ -110,7 +112,7 @@ static ngx_int_t chunked_respond_message(subscriber_t *sub,  nchan_msg_t *msg) {
   return rc;
 }
 
-static ngx_int_t chunked_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line){
+static ngx_int_t chunked_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line,  ngx_chain_t *status_body){
   nchan_buf_and_chain_t     bc;
   ngx_chain_t              *chain = NULL;
   full_subscriber_t        *fsub = (full_subscriber_t  *)sub;
@@ -137,7 +139,7 @@ static ngx_int_t chunked_respond_status(subscriber_t *sub, ngx_int_t status_code
   }
   
   if(fsub->data.shook_hands == 0 && status_code >= 400 && status_code < 600) {
-    return subscriber_respond_unqueued_status(fsub, status_code, status_line);
+    return subscriber_respond_unqueued_status(fsub, status_code, status_line, status_body);
   }
   
   chunked_ensure_headers_sent(fsub);
@@ -189,7 +191,7 @@ subscriber_t *http_chunked_subscriber_create(ngx_http_request_t *r, nchan_msg_id
   ctx->bcp = ngx_palloc(r->pool, sizeof(nchan_bufchain_pool_t));
   nchan_bufchain_pool_init(ctx->bcp, r->pool);
   
-  nchan_subscriber_common_setup(sub, HTTP_CHUNKED, &sub_name, chunked_fn, 0);
+  nchan_subscriber_common_setup(sub, HTTP_CHUNKED, &sub_name, chunked_fn, 1, 0);
   return sub;
 }
 
diff --git a/debian/modules/nchan/src/subscribers/http-multipart-mixed.c b/debian/modules/nchan/src/subscribers/http-multipart-mixed.c
index 97b9fecb..3e12411e 100644
--- a/debian/modules/nchan/src/subscribers/http-multipart-mixed.c
+++ b/debian/modules/nchan/src/subscribers/http-multipart-mixed.c
@@ -44,9 +44,12 @@ static void multipart_ensure_headers_sent(full_subscriber_t *fsub) {
     //set preamble in the request ctx. it would be nicer to store in in the subscriber data, 
     //but that would mean not reusing longpoll's fsub directly
     
+    r->header_only = 0;
+    r->chunked = 0;
+    
     if((bc = nchan_bufchain_pool_reserve(ctx->bcp, 1)) == NULL) {
       ERR("can't reserve bufchain for multipart headers");
-      nchan_respond_status(fsub->sub.request, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, 1);
+      nchan_respond_status(fsub->sub.request, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL, 1);
       return;
     }
     
@@ -72,7 +75,7 @@ static void *headerbuf_alloc(void *pd) {
 static ngx_int_t multipart_respond_message(subscriber_t *sub,  nchan_msg_t *msg) {
   
   full_subscriber_t      *fsub = (full_subscriber_t  *)sub;
-  ngx_buf_t              *buf, *msg_buf = msg->buf, *msgid_buf;
+  ngx_buf_t              *buf, *msg_buf = &msg->buf, *msgid_buf;
   ngx_int_t               rc;
   nchan_loc_conf_t       *cf = ngx_http_get_module_loc_conf(fsub->sub.request, ngx_nchan_module);
   nchan_request_ctx_t    *ctx = ngx_http_get_module_ctx(fsub->sub.request, ngx_nchan_module);
@@ -107,7 +110,7 @@ static ngx_int_t multipart_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
   }
   
   n=4;
-  if(msg->content_type.len == 0) {
+  if(!msg->content_type) {
     //don't need content_type buf'n'chain
     n--;
   }
@@ -116,7 +119,7 @@ static ngx_int_t multipart_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
     n --;
   }
   if((bc = nchan_bufchain_pool_reserve(ctx->bcp, n)) == NULL) {
-    ERR("cant allocate buf-and-chains for multipart/mixed client output");
+    ERR("can't allocate buf-and-chains for multipart/mixed client output");
     return NGX_ERROR;
   }
   
@@ -130,7 +133,7 @@ static ngx_int_t multipart_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
   chain->buf->pos = headerbuf->charbuf;
   
   //content_type maybe
-  if(msg->content_type.len > 0) {
+  if(msg->content_type) {
     chain = chain->next;
     buf = chain->buf;
     
@@ -141,7 +144,7 @@ static ngx_int_t multipart_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
     buf->memory = 1;
     buf->start = cur;
     buf->pos = cur;
-    buf->last = ngx_snprintf(cur, 255, "Content-Type: %V\r\n\r\n", &msg->content_type);
+    buf->last = ngx_snprintf(cur, 255, "Content-Type: %V\r\n\r\n", msg->content_type);
     buf->end = buf->last;
   }
   else {
@@ -150,10 +153,10 @@ static ngx_int_t multipart_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
     msgid_buf->end = cur;
   }
   
-  chain = chain->next;
-  buf = chain->buf;
   //msgbuf
   if(ngx_buf_size(msg_buf) > 0) {
+    chain = chain->next;
+    buf = chain->buf;
     ngx_memcpy(buf, msg_buf, sizeof(*msg_buf));
     if(msg_buf->file) {
       file_copy = nchan_bufchain_pool_reserve_file(ctx->bcp);
@@ -189,7 +192,7 @@ static ngx_int_t multipart_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
   return rc;
 }
 
-static ngx_int_t multipart_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line){
+static ngx_int_t multipart_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body){
   nchan_buf_and_chain_t    *bc;
   static u_char            *end_boundary=(u_char *)"--\r\n";
   full_subscriber_t        *fsub = (full_subscriber_t  *)sub;
@@ -201,13 +204,13 @@ static ngx_int_t multipart_respond_status(subscriber_t *sub, ngx_int_t status_co
   }
   
   if(fsub->data.shook_hands == 0 && status_code >= 400 && status_code <600) {
-    return subscriber_respond_unqueued_status(fsub, status_code, status_line);
+    return subscriber_respond_unqueued_status(fsub, status_code, status_line, status_body);
   }
   
   multipart_ensure_headers_sent(fsub);
   
   if((bc = nchan_bufchain_pool_reserve(fsub_bcp(fsub), 1)) == NULL) {
-    nchan_respond_status(sub->request, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, 1);
+    nchan_respond_status(sub->request, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL, 1);
     return NGX_ERROR;
   }
   
@@ -272,7 +275,7 @@ subscriber_t *http_multipart_subscriber_create(ngx_http_request_t *r, nchan_msg_
   ctx->bcp = ngx_palloc(r->pool, sizeof(nchan_bufchain_pool_t));
   nchan_bufchain_pool_init(ctx->bcp, r->pool);
   
-  nchan_subscriber_common_setup(sub, HTTP_MULTIPART, &sub_name, multipart_fn, 0);
+  nchan_subscriber_common_setup(sub, HTTP_MULTIPART, &sub_name, multipart_fn, 1, 0);
   return sub;
 }
 
diff --git a/debian/modules/nchan/src/subscribers/http-raw-stream.c b/debian/modules/nchan/src/subscribers/http-raw-stream.c
index 7f8007c2..7c4ee1b0 100644
--- a/debian/modules/nchan/src/subscribers/http-raw-stream.c
+++ b/debian/modules/nchan/src/subscribers/http-raw-stream.c
@@ -18,13 +18,15 @@ static void rawstream_ensure_headers_sent(full_subscriber_t *fsub) {
   if(!fsub->data.shook_hands) {
     nchan_cleverly_output_headers_only_for_later_response(r);
     fsub->data.shook_hands = 1; 
+    r->header_only = 0;
+    r->chunked = 0;
   }
 }
 
 static ngx_int_t rawstream_respond_message(subscriber_t *sub,  nchan_msg_t *msg) {
   
   full_subscriber_t      *fsub = (full_subscriber_t  *)sub;
-  ngx_buf_t              *buf, *msg_buf = msg->buf;
+  ngx_buf_t              *buf, *msg_buf = &msg->buf;
   ngx_int_t               rc;
   nchan_loc_conf_t       *cf = ngx_http_get_module_loc_conf(fsub->sub.request, ngx_nchan_module);
   nchan_request_ctx_t    *ctx = ngx_http_get_module_ctx(fsub->sub.request, ngx_nchan_module);
@@ -33,7 +35,7 @@ static ngx_int_t rawstream_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
   ngx_file_t             *file_copy;
   
   size_t                  separator_len = cf->subscriber_http_raw_stream_separator.len;
-  size_t                  msg_len = ngx_buf_size((msg->buf));
+  size_t                  msg_len = ngx_buf_size(msg_buf);
   
   
   if(fsub->data.timeout_ev.timer_set) {
@@ -47,7 +49,7 @@ static ngx_int_t rawstream_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
   }
   
   if((bc = nchan_bufchain_pool_reserve(ctx->bcp, (1 + (msg_len > 0 ? 1: 0)))) == NULL) {
-    ERR("cant allocate buf-and-chains for http-raw-stream client output");
+    ERR("can't allocate buf-and-chains for http-raw-stream client output");
     return NGX_ERROR;
   }
   
@@ -90,7 +92,7 @@ static ngx_int_t rawstream_respond_message(subscriber_t *sub,  nchan_msg_t *msg)
   return rc;
 }
 
-static ngx_int_t rawstream_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line){
+static ngx_int_t rawstream_respond_status(subscriber_t *sub, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body){
   full_subscriber_t        *fsub = (full_subscriber_t  *)sub;
   //nchan_request_ctx_t      *ctx = ngx_http_get_module_ctx(fsub->sub.request, ngx_nchan_module);
   
@@ -99,8 +101,8 @@ static ngx_int_t rawstream_respond_status(subscriber_t *sub, ngx_int_t status_co
     return NGX_OK;
   }
   
-  if(fsub->data.shook_hands == 0 && status_code >= 400 && status_code <600) {
-    return subscriber_respond_unqueued_status(fsub, status_code, status_line);
+  if(fsub->data.shook_hands == 0 && status_code >= 400 && status_code < 600) {
+    return subscriber_respond_unqueued_status(fsub, status_code, status_line, status_body);
   }
   
   subscriber_maybe_dequeue_after_status_response(fsub, status_code);
@@ -144,7 +146,7 @@ subscriber_t *http_raw_stream_subscriber_create(ngx_http_request_t *r, nchan_msg
   ctx->bcp = ngx_palloc(r->pool, sizeof(nchan_bufchain_pool_t));
   nchan_bufchain_pool_init(ctx->bcp, r->pool);
   
-  nchan_subscriber_common_setup(sub, HTTP_RAW_STREAM, &sub_name, rawstream_fn, 0);
+  nchan_subscriber_common_setup(sub, HTTP_RAW_STREAM, &sub_name, rawstream_fn, 1, 0);
   return sub;
 }
 
diff --git a/debian/modules/nchan/src/subscribers/internal.c b/debian/modules/nchan/src/subscribers/internal.c
index 2b1f5348..8f4a8a21 100644
--- a/debian/modules/nchan/src/subscribers/internal.c
+++ b/debian/modules/nchan/src/subscribers/internal.c
@@ -150,7 +150,7 @@ void *internal_subscriber_get_privdata(subscriber_t *sub) {
 }
 
 static void reset_timer(internal_subscriber_t *f) {
-  if(f->sub.cf->subscriber_timeout > 0) {
+  if(f->sub.cf && f->sub.cf->subscriber_timeout > 0) {
     if(f->timeout_ev.timer_set) {
       ngx_del_timer(&f->timeout_ev);
     }
@@ -161,7 +161,7 @@ static void reset_timer(internal_subscriber_t *f) {
 static ngx_int_t internal_enqueue(subscriber_t *self) {
   internal_subscriber_t   *fsub = (internal_subscriber_t *)self;
   DBG("%p (%V) enqueue", self, fsub->sub.name);
-  if(self->cf->subscriber_timeout > 0 && !fsub->timeout_ev.timer_set) {
+  if(self->cf && self->cf->subscriber_timeout > 0 && !fsub->timeout_ev.timer_set) {
     //add timeout timer
     reset_timer(fsub);
   }
@@ -172,12 +172,15 @@ static ngx_int_t internal_enqueue(subscriber_t *self) {
 
 static ngx_int_t internal_dequeue(subscriber_t *self) {
   internal_subscriber_t   *f = (internal_subscriber_t *)self;
-  assert(!f->already_dequeued);
+  if (f->already_dequeued) {
+    return NGX_OK; //it's ok to be dequeued more than once,
+    //because a subscriber may linger a bit before being deleted
+  }
   f->already_dequeued = 1;
   DBG("%p (%V) dequeue sub", self, f->sub.name);
   f->dequeue(NGX_OK, NULL, f->privdata);
   f->dequeue_handler(self, f->dequeue_handler_data);
-  if(self->cf->subscriber_timeout > 0 && f->timeout_ev.timer_set) {
+  if(self->cf && self->cf->subscriber_timeout > 0 && f->timeout_ev.timer_set) {
     ngx_del_timer(&f->timeout_ev);
   }
   self->enqueued = 0;
@@ -205,7 +208,7 @@ static ngx_int_t internal_respond_message(subscriber_t *self, nchan_msg_t *msg)
   return dequeue_maybe(self);
 }
 
-static ngx_int_t internal_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line) {
+static ngx_int_t internal_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body) {
   internal_subscriber_t   *f = (internal_subscriber_t *)self;
   DBG("%p status %i", self, status_code);
   if(status_code == NGX_HTTP_GONE) {
@@ -259,9 +262,13 @@ static const subscriber_t new_internal_sub = {
   NCHAN_ZERO_MSGID,
   NULL,
   NULL,
+  NULL,
   0, //reserved
+  0, //enable sub/unsub callbacks
   0, //stick around after response
   1, //destroy after dequeue
   0, //enqueued
-
+#if NCHAN_SUBSCRIBER_LEAK_DEBUG
+  NULL, NULL, NULL
+#endif
 };
diff --git a/debian/modules/nchan/src/subscribers/longpoll-private.h b/debian/modules/nchan/src/subscribers/longpoll-private.h
index f388c746..111bc4dc 100644
--- a/debian/modules/nchan/src/subscribers/longpoll-private.h
+++ b/debian/modules/nchan/src/subscribers/longpoll-private.h
@@ -9,6 +9,7 @@ typedef struct {
   subscriber_callback_pt  dequeue_handler;
   void                   *dequeue_handler_data;
   ngx_event_t             timeout_ev;
+  ngx_event_t             ping_ev;
   
   nchan_longpoll_multimsg_t *multimsg_first;
   nchan_longpoll_multimsg_t *multimsg_last;
@@ -28,7 +29,8 @@ typedef struct {
 } full_subscriber_t;
 
 ngx_int_t longpoll_enqueue(subscriber_t *self);
+ngx_int_t longpoll_dequeue(subscriber_t *self);
 
 void subscriber_maybe_dequeue_after_status_response(full_subscriber_t *fsub, ngx_int_t status_code);
 
-ngx_int_t subscriber_respond_unqueued_status(full_subscriber_t *fsub, ngx_int_t status_code, const ngx_str_t *status_line);
+ngx_int_t subscriber_respond_unqueued_status(full_subscriber_t *fsub, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t  *status_body);
diff --git a/debian/modules/nchan/src/subscribers/longpoll.c b/debian/modules/nchan/src/subscribers/longpoll.c
index 0c723a70..c14061fb 100644
--- a/debian/modules/nchan/src/subscribers/longpoll.c
+++ b/debian/modules/nchan/src/subscribers/longpoll.c
@@ -19,6 +19,9 @@ static const subscriber_t new_longpoll_sub;
 static void empty_handler() { }
 
 static void sudden_abort_handler(subscriber_t *sub) {
+  if(sub->request && sub->status != DEAD) {
+    sub->request->headers_out.status = NGX_HTTP_CLIENT_CLOSED_REQUEST;
+  }
 #if FAKESHARD
   full_subscriber_t  *fsub = (full_subscriber_t  *)sub;
   memstore_fakeprocess_push(fsub->sub.owner);
@@ -70,9 +73,6 @@ subscriber_t *longpoll_subscriber_create(ngx_http_request_t *r, nchan_msg_id_t *
   
 #if NCHAN_SUBSCRIBER_LEAK_DEBUG
   subscriber_debug_add(&fsub->sub);
-  //set debug label
-  fsub->sub.lbl = ngx_calloc(r->uri.len+1, ngx_cycle->log);
-  ngx_memcpy(fsub->sub.lbl, r->uri.data, r->uri.len);
 #endif
   
   //http request sudden close cleanup
@@ -100,9 +100,9 @@ ngx_int_t longpoll_subscriber_destroy(subscriber_t *sub) {
     DBG("%p destroy for req %p", sub, fsub->sub.request);
     nchan_free_msg_id(&fsub->sub.last_msgid);
     assert(sub->status == DEAD);
+    nchan_subscriber_subrequest_cleanup(sub);
 #if NCHAN_SUBSCRIBER_LEAK_DEBUG
     subscriber_debug_remove(sub);
-    ngx_free(sub->lbl);
     ngx_memset(fsub, 0xB9, sizeof(*fsub)); //debug
 #endif
     ngx_free(fsub);
@@ -110,11 +110,28 @@ ngx_int_t longpoll_subscriber_destroy(subscriber_t *sub) {
   return NGX_OK;
 }
 
+static void finalize_request_handler(ngx_http_request_t *r) {
+  nchan_request_ctx_t  *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  if(ctx->sub == NULL) {
+    ngx_http_test_reading(r);
+    return;
+  }
+  subscriber_t *sub = ctx->sub;
+  #if FAKESHARD
+    memstore_fakeprocess_push(sub->owner);
+  #endif
+    sub->dequeue_after_response = 1;
+    sub->fn->respond_status(sub, NGX_HTTP_BAD_REQUEST, &NCHAN_HTTP_STATUS_400, NULL);
+  #if FAKESHARD
+    memstore_fakeprocess_pop();
+  #endif
+}
+
 static void ensure_request_hold(full_subscriber_t *fsub) {
   if(fsub->data.holding == 0) {
     DBG("hodl request %p", fsub->sub.request);
     fsub->data.holding = 1;
-    fsub->sub.request->read_event_handler = ngx_http_test_reading;
+    fsub->sub.request->read_event_handler = finalize_request_handler;
     fsub->sub.request->write_event_handler = ngx_http_request_empty_handler;
     fsub->sub.request->main->count++; //this is the right way to hold and finalize the request... maybe
   }
@@ -155,17 +172,10 @@ ngx_int_t longpoll_enqueue(subscriber_t *self) {
     ngx_add_timer(&fsub->data.timeout_ev, self->cf->subscriber_timeout * 1000);
   }
 
-  
-#if nginx_version >= 1003015
-  if(self->cf->unsubscribe_request_url) {
-    self->request->read_event_handler = nchan_subscriber_unsubscribe_callback_http_test_reading;
-  }
-#endif
-  
   return NGX_OK;
 }
 
-static ngx_int_t longpoll_dequeue(subscriber_t *self) {
+ngx_int_t longpoll_dequeue(subscriber_t *self) {
   full_subscriber_t    *fsub = (full_subscriber_t  *)self;
   ngx_http_request_t   *r = fsub->sub.request;
   nchan_request_ctx_t  *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
@@ -176,22 +186,8 @@ static ngx_int_t longpoll_dequeue(subscriber_t *self) {
   DBG("%p dequeue", self);
   fsub->data.dequeue_handler(self, fsub->data.dequeue_handler_data);
   
-  if(self->enqueued 
-   && (self->type != LONGPOLL && self->type != INTERVALPOLL) //disabled for longpoll & intervalpoll for now
-   && self->cf->unsubscribe_request_url 
-   && ctx->unsubscribe_request_callback_finalize_code != NGX_HTTP_CLIENT_CLOSED_REQUEST) {
-    r->main->blocked = 1;
-    if(fsub->data.finalize_request) {
-      nchan_subscriber_unsubscribe_request(self, NGX_OK);
-      self->status = DEAD;
-    }
-    else {
-      nchan_subscriber_unsubscribe_request(self, NGX_DONE);
-    }
-    if(ctx->request_ran_content_handler) {
-      ngx_http_run_posted_requests(r->connection);
-    }
-    finalize_now = 0;
+  if(self->enqueued && self->enable_sub_unsub_callbacks && self->cf->unsubscribe_request_url) {
+    nchan_subscriber_unsubscribe_request(self);
   }
   
   self->enqueued = 0;
@@ -218,8 +214,13 @@ static ngx_int_t dequeue_maybe(subscriber_t *self) {
 }
 
 static ngx_int_t abort_response(subscriber_t *sub, char *errmsg) {
-  ERR("abort! %s", errmsg ? errmsg : "unknown error");
-  dequeue_maybe(sub);
+  if(sub->request) {
+    nchan_log_request_warning(sub->request, "%V subscriber: %s", sub->name, errmsg ? errmsg : "weird response error");
+  }
+  else {
+    nchan_log_warning("%V subscriber: %s", sub->name, errmsg ? errmsg : "weird response error");
+  }
+  sub->fn->dequeue(sub);
   return NGX_ERROR;
 }
 
@@ -232,30 +233,14 @@ static ngx_int_t longpoll_multipart_add(full_subscriber_t *fsub, nchan_msg_t *ms
     return NGX_ERROR;
   }
   
-  if(msg->shared) {
-    msg_reserve(msg, "longpoll multipart");
-  }
-  else if(msg->id.tagcount > 1) {
-    //msg from a multiplexed channel
-    assert(!msg->shared && !msg->temp_allocd);
-    nchan_msg_copy_t *cmsg;
-    if((cmsg = ngx_palloc(fsub->sub.request->pool, sizeof(*cmsg))) == NULL) {
-      *err = "can't allocate msgcopy for message from multiplexed channel";
+  if(msg->storage != NCHAN_MSG_SHARED) {
+    if((msg = nchan_msg_derive_palloc(msg, fsub->sub.request->pool)) == NULL) {
+      *err = "can't allocate derived msg in request pool";
       return NGX_ERROR;
-      
     }
-    //  multiplexed channel message should have been created as a nchan_msg_copy_t
-    *cmsg = *(nchan_msg_copy_t *)msg;
-    
-    cmsg->copy.temp_allocd = 1;
-    
-    assert(cmsg->original->shared);
-    msg_reserve(cmsg->original, "longpoll multipart for multiplexed channel");
-    msg = &cmsg->copy;
-  }
-  else {
-    assert(0); //this is not yet an expected scenario;
   }
+  msg_reserve(msg, "longpoll multipart");
+  assert(msg->refcount > 0);
   
   mmsg->msg = msg;
   mmsg->next = NULL;
@@ -309,22 +294,8 @@ static ngx_int_t longpoll_respond_message(subscriber_t *self, nchan_msg_t *msg)
 
 static void multipart_request_cleanup_handler(nchan_longpoll_multimsg_t *first) {
   nchan_longpoll_multimsg_t    *cur;
-  nchan_msg_copy_t             *cmsg;
   for(cur = first; cur != NULL; cur = cur->next) {
-    if(cur->msg->shared) {
-      msg_release(cur->msg, "longpoll multipart");
-    }
-    else if(cur->msg->id.tagcount > 1) {
-      assert(!cur->msg->shared && cur->msg->temp_allocd);
-      // multiplexed channel message should have been created as a nchan_msg_copy_t
-      cmsg = (nchan_msg_copy_t *)cur->msg;
-      
-      assert(cmsg->original->shared);
-      msg_release(cmsg->original, "longpoll multipart for multiplexed channel");
-    }
-    else {
-      assert(0);
-    }
+    msg_release(cur->msg, "longpoll multipart");
   }
 }
 
@@ -336,16 +307,18 @@ static ngx_int_t longpoll_multipart_respond(full_subscriber_t *fsub) {
   u_char                *char_boundary = NULL;
   u_char                *char_boundary_last;
   
-  ngx_buf_t              boundary[3]; //first, mid, and last boundary
-  ngx_buf_t              newline_buf;
-  ngx_chain_t           *chain, *first_chain = NULL, *last_chain = NULL;
-  ngx_buf_t             *buf;
+  struct {
+    ngx_buf_t            first;
+    ngx_buf_t            mid;
+    ngx_buf_t            last;
+  }                      boundary;
+  
   ngx_buf_t              double_newline_buf;
   ngx_str_t             *content_type;
-  size_t                 size = 0;
   nchan_loc_conf_t      *cf = fsub->sub.cf;
   int                    use_raw_stream_separator = cf->longpoll_multimsg_use_raw_stream_separator;
-  nchan_buf_and_chain_t *bc;
+  
+  ngx_init_set_membuf_char(&double_newline_buf, "\r\n\r\n");
   
   nchan_longpoll_multimsg_t *first, *cur;
   
@@ -375,101 +348,64 @@ static ngx_int_t longpoll_multipart_respond(full_subscriber_t *fsub) {
     char_boundary = ngx_palloc(r->pool, 50);
     char_boundary_last = ngx_snprintf(char_boundary, 50, ("\r\n--%V--\r\n"), nchan_request_multipart_boundary(r, ctx));
     
-    ngx_init_set_membuf_char(&double_newline_buf, "\r\n\r\n");
-    
     //set up the boundaries
-    ngx_init_set_membuf(&boundary[0], &char_boundary[2], &char_boundary_last[-4]);
-    ngx_init_set_membuf(&boundary[1], &char_boundary[0], &char_boundary_last[-4]);
-    ngx_init_set_membuf(&boundary[2], &char_boundary[0], char_boundary_last);
-    
-    ngx_init_set_membuf_char(&newline_buf, "\n");
+    ngx_init_set_membuf(&boundary.first, &char_boundary[2], &char_boundary_last[-4]);
+    ngx_init_set_membuf(&boundary.mid, &char_boundary[0], &char_boundary_last[-4]);
+    ngx_init_set_membuf(&boundary.last, &char_boundary[0], char_boundary_last);
   }
   
-  int n=0;
-  
   for(cur = first; cur != NULL; cur = cur->next) {
-    bc = nchan_bufchain_pool_reserve(ctx->bcp, 4);
-    chain = &bc->chain;
-    n++;
-    
-    if(last_chain) {
-      last_chain->next = chain;
-    }
-    if(!first_chain) {
-      first_chain = chain;
-    }
     if(!use_raw_stream_separator) {
       // each buffer needs to be unique for the purpose of dealing with nginx output guts
       // (something about max. 64 iovecs per write call and counting the number of bytes already sent)
-      *chain->buf = cur == first ? boundary[0] : boundary[1];
-      size += ngx_buf_size((chain->buf));
-      chain = chain->next;
       
-      content_type = &cur->msg->content_type;
-      buf = chain->buf;
-      if (content_type->data != NULL) {
-        u_char    *char_cur = ngx_pcalloc(r->pool, content_type->len + 25);
-        ngx_init_set_membuf(buf, char_cur, ngx_snprintf(char_cur, content_type->len + 25, "\r\nContent-Type: %V\r\n\r\n", content_type));
-      }
-      else {
-        *buf = double_newline_buf;
+      nchan_bufchain_append_buf(ctx->bcp, cur == first ? &boundary.first : &boundary.mid);
+      
+      content_type = cur->msg->content_type;
+      if (content_type) {
+        nchan_bufchain_append_cstr(ctx->bcp, "\r\nContent-Type: ");
+        nchan_bufchain_append_str(ctx->bcp, content_type);
       }
-      size += ngx_buf_size(buf);
-      chain = chain->next;
+      nchan_bufchain_append_cstr(ctx->bcp, "\r\n\r\n");
     }
+    
+    if(ngx_buf_size((&cur->msg->buf)) > 0) {
+      ngx_buf_t             msgbuf = cur->msg->buf;
       
-    if(ngx_buf_size(cur->msg->buf) > 0) {
-      buf = chain->buf;
-      *buf = *cur->msg->buf;
-      
-      if(buf->file) {
+      if(msgbuf.file) {
         ngx_file_t  *file_copy = nchan_bufchain_pool_reserve_file(ctx->bcp);
-        nchan_msg_buf_open_fd_if_needed(buf, file_copy, NULL);
+        nchan_msg_buf_open_fd_if_needed(&msgbuf, file_copy, NULL);
       }
-      buf->last_buf = 0;
-      size += ngx_buf_size(buf);
+      nchan_bufchain_append_buf(ctx->bcp, &msgbuf);
     }
     
     if(use_raw_stream_separator) {
-      chain = chain->next;
-      ngx_init_set_membuf_str(chain->buf, &cf->subscriber_http_raw_stream_separator);
-      size += ngx_buf_size((chain->buf));
+      nchan_bufchain_append_str(ctx->bcp, &cf->subscriber_http_raw_stream_separator);
     }
-    else {
-      if(cur->next == NULL) {
-        chain = chain->next;
-        chain->buf = &boundary[2];
-        size += ngx_buf_size((chain->buf));
-      }
+    else if(cur->next == NULL) { //lastmsg
+      nchan_bufchain_append_buf(ctx->bcp, &boundary.last);
     }
-    last_chain = chain;
   }
-    
-  buf = last_chain->buf;
-  buf->last_buf = 1;
-  buf->last_in_chain = 1;
-  buf->flush = 1;
-  last_chain->next = NULL;
-    
+  
   r->headers_out.status = NGX_HTTP_OK;
-  r->headers_out.content_length_n = size;
+  r->headers_out.content_length_n = nchan_bufchain_length(ctx->bcp);
   nchan_set_msgid_http_response_headers(r, ctx, &fsub->data.multimsg_last->msg->id);
   nchan_include_access_control_if_needed(r, ctx);
-  ngx_http_send_header(r);
-  nchan_output_filter(r, first_chain);
-  
+  if(ngx_http_send_header(r) != NGX_OK) {
+    return abort_response(&fsub->sub, "failed to send longpoll-multipart headers");
+  }
+  if(nchan_output_filter(r, nchan_bufchain_first_chain(ctx->bcp)) != NGX_OK) {
+    return abort_response(&fsub->sub, "failed to send longpoll-multipart body");
+  }
   
   return NGX_OK;
 }
 
-static ngx_int_t longpoll_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line) {
-  
+static ngx_int_t longpoll_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body) {
   full_subscriber_t     *fsub = (full_subscriber_t *)self;
   ngx_http_request_t    *r = fsub->sub.request;
   nchan_loc_conf_t      *cf = fsub->sub.cf;
   
-  //DBG("%p got status %i", self, status_code);
-  
   if(fsub->data.act_as_intervalpoll) {
     if(status_code == NGX_HTTP_NO_CONTENT || status_code == NGX_HTTP_NOT_MODIFIED || status_code == NGX_HTTP_NOT_FOUND ) {
       status_code = NGX_HTTP_NOT_MODIFIED;
@@ -478,8 +414,12 @@ static ngx_int_t longpoll_respond_status(subscriber_t *self, ngx_int_t status_co
   else if(status_code == NGX_HTTP_NO_CONTENT || (status_code == NGX_HTTP_NOT_MODIFIED && !status_line)) {
     if(cf->longpoll_multimsg) {
       if(fsub->data.multimsg_first != NULL) {
-        longpoll_multipart_respond(fsub);
-        dequeue_maybe(self);
+        if(longpoll_multipart_respond(fsub) == NGX_OK) {
+          dequeue_maybe(self);
+        }
+        else {
+          DBG("%p should have been dequeued through abort_response");
+        }
       }
       return NGX_OK;
     }
@@ -498,19 +438,26 @@ static ngx_int_t longpoll_respond_status(subscriber_t *self, ngx_int_t status_co
   //disable abort handler
   fsub->data.cln->handler = empty_handler;
   
-  nchan_respond_status(r, status_code, status_line, 0);
+  nchan_respond_status(r, status_code, status_line, status_body, 0);
 
   dequeue_maybe(self);
   return NGX_OK;
 }
 
-ngx_int_t subscriber_respond_unqueued_status(full_subscriber_t *fsub, ngx_int_t status_code, const ngx_str_t *status_line) {
+ngx_int_t subscriber_respond_unqueued_status(full_subscriber_t *fsub, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body) {
   ngx_http_request_t     *r = fsub->sub.request;
+  nchan_loc_conf_t       *cf = fsub->sub.cf;
+  nchan_request_ctx_t    *ctx;
+  
   fsub->data.cln->handler = (ngx_http_cleanup_pt )empty_handler;
   fsub->data.finalize_request = 0;
   fsub->sub.status = DEAD;
   fsub->sub.fn->dequeue(&fsub->sub);
-  return nchan_respond_status(r, status_code, status_line, 1);
+  if(cf->unsubscribe_request_url || cf->subscribe_request_url) {
+    ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+    ctx->sent_unsubscribe_request = 1; //lie about having sent the unsub request already to avoid sending it
+  }
+  return nchan_respond_status(r, status_code, status_line, status_body, 1);
 }
 
 void subscriber_maybe_dequeue_after_status_response(full_subscriber_t *fsub, ngx_int_t status_code) {
@@ -518,6 +465,7 @@ void subscriber_maybe_dequeue_after_status_response(full_subscriber_t *fsub, ngx
     fsub->data.cln->handler = (ngx_http_cleanup_pt )empty_handler;
     fsub->sub.request->keepalive=0;
     fsub->data.finalize_request=1;
+    fsub->sub.request->headers_out.status = status_code;
     fsub->sub.fn->dequeue(&fsub->sub);
   }
 }
@@ -561,8 +509,14 @@ static const subscriber_t new_longpoll_sub = {
   NCHAN_ZERO_MSGID,
   NULL,
   NULL,
+  NULL,
   0, //reservations
+  0, //enable sub/unsub callbacks
   1, //deque after response
   1, //destroy after dequeue
   0, //enqueued
+  
+#if NCHAN_SUBSCRIBER_LEAK_DEBUG
+  NULL, NULL, NULL
+#endif
 };
diff --git a/debian/modules/nchan/src/subscribers/memstore_ipc.c b/debian/modules/nchan/src/subscribers/memstore_ipc.c
index 87a4cddb..ec0fa93b 100644
--- a/debian/modules/nchan/src/subscribers/memstore_ipc.c
+++ b/debian/modules/nchan/src/subscribers/memstore_ipc.c
@@ -20,6 +20,7 @@ struct sub_data_s {
   subscriber_t                 *sub;
   ngx_str_t                    *chid;
   ngx_int_t                     originator;
+  ngx_int_t                     unhooked;
   ngx_int_t                     owner;
   void                         *foreign_chanhead;
   ngx_event_t                   timeout_ev;
@@ -41,7 +42,12 @@ static ngx_int_t sub_dequeue(ngx_int_t status, void *ptr, sub_data_t* d) {
   if(d->timeout_ev.timer_set) {
     ngx_del_timer(&d->timeout_ev);
   }
-  ret = memstore_ipc_send_unsubscribed(d->originator, d->chid, NULL);
+  if(!d->unhooked) {
+    ret = memstore_ipc_send_unsubscribed(d->originator, d->chid, NULL);
+  }
+  else {
+    ret = NGX_OK;
+  }
   
   if(fsub->sub.reserved > 0) {
     DBG("%p (%V) not ready to destroy (reserved for %i)", fsub, d->chid, fsub->sub.reserved);
@@ -62,9 +68,12 @@ static ngx_int_t sub_respond_message(ngx_int_t status, void *ptr, sub_data_t* d)
   //DBG("%p (%V) memstore subscriber (lastid %V) respond with message %V (lastid %V)", d->sub, d->chid, msgid_to_str(&d->sub->last_msg_id), msgid_to_str(&msg->id), msgid_to_str(&msg->prev_id));
   
   //update_subscriber_last_msg_id(d->sub, msg);
-  
-  rc = memstore_ipc_send_publish_message(d->originator, d->chid, msg, d->sub->cf, empty_callback, NULL);
-  
+  if(!d->unhooked) {
+    rc = memstore_ipc_send_publish_message(d->originator, d->chid, msg, d->sub->cf, empty_callback, NULL);
+  }
+  else {
+    rc = NGX_OK;
+  }
   //no multi-ids allowed here
   assert(msg->id.tagcount == 1);
     
@@ -101,8 +110,23 @@ static ngx_int_t sub_respond_status(ngx_int_t status, void *ptr, sub_data_t *d)
         ERR("unknown status %i", status);
     }
   }
-  return memstore_ipc_send_publish_status(d->originator, d->chid, status, status_line, empty_callback, NULL);
+  if(!d->unhooked) {
+    return memstore_ipc_send_publish_status(d->originator, d->chid, status, status_line, empty_callback, NULL);
+  }
+  else {
+    return NGX_OK;
+  }
+}
+
+static ngx_int_t sub_respond_notice(ngx_int_t notice, void *ptr, sub_data_t *d) {
+  if(!d->unhooked) {
+    return memstore_ipc_send_publish_notice(d->originator, d->chid, notice, NULL);
+  }
+  else {
+    return NGX_OK;
+  }
 }
+
 static void reset_timer(sub_data_t *data) {
   if(data->timeout_ev.timer_set) {
     ngx_del_timer(&data->timeout_ev);
@@ -110,18 +134,9 @@ static void reset_timer(sub_data_t *data) {
   ngx_add_timer(&data->timeout_ev, MEMSTORE_IPC_SUBSCRIBER_TIMEOUT * 1000);
 }
 
-
-static ngx_int_t keepalive_reply_handler(ngx_int_t renew, void *_, void* pd) {
-  sub_data_t *d = (sub_data_t *)pd;
-  DBG("%p (%V) keepalive reply - renew: %i.", d->sub, d->chid, renew);
-  if(d->sub->fn->release(d->sub, 0) == NGX_OK) {
-    if(renew) {
-      reset_timer(d);
-    }
-    else {
-      d->sub->fn->dequeue(d->sub);
-    }
-  }
+ngx_int_t memstore_ipc_subscriber_keepalive_renew(subscriber_t *sub) {
+  sub_data_t *d = internal_subscriber_get_privdata(sub);
+  reset_timer(d);
   return NGX_OK;
 }
 
@@ -137,8 +152,9 @@ static void timeout_ev_handler(ngx_event_t *ev) {
   memstore_fakeprocess_push(d->owner);
 #endif
   DBG("%p (%V), timeout event. Ping originator to see if still needed.", d->sub, d->chid);
-  d->sub->fn->reserve(d->sub);
-  memstore_ipc_send_memstore_subscriber_keepalive(d->originator, d->chid, d->sub, d->foreign_chanhead, keepalive_reply_handler, d);
+  if(!d->unhooked) {
+    memstore_ipc_send_memstore_subscriber_keepalive(d->originator, d->chid, d->sub, d->foreign_chanhead);
+  }
 #if FAKESHARD
   memstore_fakeprocess_pop();
 #endif
@@ -152,13 +168,14 @@ subscriber_t *memstore_ipc_subscriber_create(ngx_int_t originator_slot, ngx_str_
   subscriber_t               *sub;
   
   assert(originator_slot != memstore_slot());
-  sub = internal_subscriber_create_init(&sub_name, cf, sizeof(*d), (void **)&d, (callback_pt )sub_enqueue, (callback_pt )sub_dequeue, (callback_pt )sub_respond_message, (callback_pt )sub_respond_status, NULL, NULL);
+  sub = internal_subscriber_create_init(&sub_name, cf, sizeof(*d), (void **)&d, (callback_pt )sub_enqueue, (callback_pt )sub_dequeue, (callback_pt )sub_respond_message, (callback_pt )sub_respond_status, (callback_pt )sub_respond_notice, NULL);
   
   sub->last_msgid = newest_msgid;
   sub->destroy_after_dequeue = 1;
   d->sub = sub;
   d->chid = chid;
   d->originator = originator_slot;
+  d->unhooked = 0;
   assert(foreign_chanhead != NULL);
   d->foreign_chanhead = foreign_chanhead;
   //d->chanhead = local_chanhead;
@@ -171,3 +188,9 @@ subscriber_t *memstore_ipc_subscriber_create(ngx_int_t originator_slot, ngx_str_
   DBG("%p (%V) memstore-ipc subscriber created with privdata %p", d->sub, d->chid, d);
   return sub;
 }
+
+ngx_int_t memstore_ipc_subscriber_unhook(subscriber_t *sub) {
+  sub_data_t *d = internal_subscriber_get_privdata(sub);
+  d->unhooked = 1;
+  return NGX_OK;
+}
diff --git a/debian/modules/nchan/src/subscribers/memstore_ipc.h b/debian/modules/nchan/src/subscribers/memstore_ipc.h
index d388ed65..15d58e85 100644
--- a/debian/modules/nchan/src/subscribers/memstore_ipc.h
+++ b/debian/modules/nchan/src/subscribers/memstore_ipc.h
@@ -1,2 +1,5 @@
 #define MEMSTORE_IPC_SUBSCRIBER_TIMEOUT 5
 subscriber_t *memstore_ipc_subscriber_create(ngx_int_t originator_slot, ngx_str_t *chid, nchan_loc_conf_t *cf, void* foreign_chanhead);
+
+ngx_int_t memstore_ipc_subscriber_unhook(subscriber_t *sub);
+ngx_int_t memstore_ipc_subscriber_keepalive_renew(subscriber_t *sub);
diff --git a/debian/modules/nchan/src/subscribers/memstore_multi.c b/debian/modules/nchan/src/subscribers/memstore_multi.c
index ec723a81..873f4d72 100644
--- a/debian/modules/nchan/src/subscribers/memstore_multi.c
+++ b/debian/modules/nchan/src/subscribers/memstore_multi.c
@@ -37,16 +37,16 @@ static void change_sub_count(memstore_channel_head_t *ch, ngx_int_t n) {
   if(ch->shared) {
     ngx_atomic_fetch_add(&ch->shared->sub_count, n);
   }
-  if(ch->cf->redis.enabled) {
+  if(ch->cf->redis.enabled && ch->cf->redis.storage_mode >= REDIS_MODE_DISTRIBUTED) {
     memstore_fakesub_add(ch, n);
   }
 }
 
 static ngx_int_t sub_enqueue(ngx_int_t status, void *ptr, sub_data_t *d) {
   DBG("%p enqueued (%p %V %i) %V", d->multi->sub, d->multi_chanhead, &d->multi_chanhead->id, d->n, &d->multi->id);
-  assert(d->multi_chanhead->multi_waiting > 0);
-  d->multi_chanhead->multi_waiting --;
-  if(d->multi_chanhead->multi_waiting == 0) {
+  assert(d->multi_chanhead->multi_subscribers_pending > 0);
+  d->multi_chanhead->multi_subscribers_pending --;
+  if(d->multi_chanhead->multi_subscribers_pending == 0) {
     memstore_ready_chanhead_unless_stub(d->multi_chanhead);
   }
   
@@ -56,15 +56,14 @@ static ngx_int_t sub_enqueue(ngx_int_t status, void *ptr, sub_data_t *d) {
 static ngx_int_t sub_dequeue(ngx_int_t status, void *ptr, sub_data_t* d) {
   DBG("%p dequeued (%p %V %i) %V", d->multi->sub, d->multi_chanhead, &d->multi_chanhead->id, d->n, &d->multi->id);
   d->multi_chanhead->status = WAITING;
-  d->multi_chanhead->multi_waiting++;
+  d->multi_chanhead->multi_subscribers_pending++;
   d->multi->sub = NULL;
   
   return NGX_OK;
 }
 
 static ngx_int_t sub_respond_message(ngx_int_t status, nchan_msg_t *msg, sub_data_t* d) {
-  nchan_msg_copy_t  remsg;
-  //nchan_msg_id_t   *last_msgid;
+  nchan_msg_t       remsg;
   ngx_int_t         mcount;
   
   int16_t          tags[NCHAN_MULTITAG_MAX], prevtags[NCHAN_MULTITAG_MAX];
@@ -74,49 +73,42 @@ static ngx_int_t sub_respond_message(ngx_int_t status, nchan_msg_t *msg, sub_dat
   
   assert( msg->id.tagcount == 1 );
   assert( msg->prev_id.tagcount == 1 );
-  
-  remsg.original = msg;
-  
-  remsg.copy = *msg;
-  remsg.copy.shared = 0;
-  remsg.copy.temp_allocd = 0;
+  nchan_msg_derive_stack(msg, &remsg, tags);
   
   mcount = d->multi_chanhead->multi_count;
   
-  remsg.copy.prev_id.tagcount = mcount;
-  remsg.copy.prev_id.tagactive = d->n;
+  remsg.prev_id.tagcount = mcount;
+  remsg.prev_id.tagactive = d->n;
   
-  remsg.copy.id.tagcount = mcount;
-  remsg.copy.id.tagactive = d->n;
+  remsg.id.tagcount = mcount;
+  remsg.id.tagactive = d->n;
   
   if(mcount > NCHAN_FIXED_MULTITAG_MAX) {
-    remsg.copy.id.tag.allocd = tags;
+    remsg.id.tag.allocd = tags;
     tags[0]=msg->id.tag.fixed[0];
-    remsg.copy.prev_id.tag.allocd = prevtags;
+    remsg.prev_id.tag.allocd = prevtags;
     prevtags[0]=msg->prev_id.tag.fixed[0];
   }
   
-  
-  nchan_expand_msg_id_multi_tag(&remsg.copy.prev_id, 0, d->n, -1);
-  nchan_expand_msg_id_multi_tag(&remsg.copy.id, 0, d->n, -1);
+  nchan_expand_msg_id_multi_tag(&remsg.prev_id, 0, d->n, -1);
+  nchan_expand_msg_id_multi_tag(&remsg.id, 0, d->n, -1);
   
   memstore_ensure_chanhead_is_ready(d->multi_chanhead, 1);
   
-  DBG("%p respond with transformed message %p %V (%p %V %i) %V", d->multi->sub, &remsg.copy, msgid_to_str(&remsg.copy.id), d->multi_chanhead, &d->multi_chanhead->id, d->n, &d->multi->id);
+  DBG("%p respond with transformed message %p %V (%p %V %i) %V", d->multi->sub, &remsg, msgid_to_str(&remsg.id), d->multi_chanhead, &d->multi_chanhead->id, d->n, &d->multi->id);
   
-  nchan_memstore_publish_generic(d->multi_chanhead, &remsg.copy, 0, NULL);
+  nchan_memstore_publish_generic(d->multi_chanhead, &remsg, 0, NULL);
   
   return NGX_OK;
 }
 
 static ngx_int_t sub_respond_status(ngx_int_t status, void *ptr, sub_data_t *d) {
-  DBG("%p subscriber respond with status (%p %V %i) %V", d->multi->sub, d->multi_chanhead, &d->multi_chanhead->id, d->n, &d->multi->id);
+  DBG("%p subscriber respond with status %i (%p %V %i) %V", d->multi->sub, status, d->multi_chanhead, &d->multi_chanhead->id, d->n, &d->multi->id);
   switch(status) {
     case NGX_HTTP_GONE: //delete
     case NGX_HTTP_CLOSE: //delete
       nchan_memstore_publish_generic(d->multi_chanhead, NULL, NGX_HTTP_GONE, &NCHAN_HTTP_STATUS_410);
       //nchan_store_memory.delete_channel(d->chid, NULL, NULL);
-      //TODO: change status to NOTREADY and whatnot
       break;
     
     case NGX_HTTP_CONFLICT:
@@ -160,18 +152,19 @@ subscriber_t *memstore_multi_subscriber_create(memstore_channel_head_t *chanhead
   sub->destroy_after_dequeue = 1;
   sub->dequeue_after_response = 0;
 
+  //DBG("create multi sub for %V (n=%i) pending=%i", &chanhead->multi[n].id, n, chanhead->multi_subscribers_pending);
   d->multi = &chanhead->multi[n];
   d->multi->sub = sub;
   d->multi_chanhead = chanhead;
   d->n = n;
-  chanhead->multi_waiting++;  
+  d->target_chanhead = target_ch;
+  
+  assert(chanhead->multi_subscribers_pending > 0);
 
   target_ch->spooler.fn->add(&target_ch->spooler, sub);
   
   multi_subs = chanhead->shared->sub_count;
-  
-  d->target_chanhead = target_ch;
-  
+
   change_sub_count(target_ch, multi_subs);
   
   DBG("%p created with privdata %p", d->multi->sub, d);
diff --git a/debian/modules/nchan/src/subscribers/memstore_redis.c b/debian/modules/nchan/src/subscribers/memstore_redis.c
index fc9bf294..f1302e82 100644
--- a/debian/modules/nchan/src/subscribers/memstore_redis.c
+++ b/debian/modules/nchan/src/subscribers/memstore_redis.c
@@ -8,8 +8,9 @@
 
 #include <store/redis/store.h>
 #include <store/redis/store-private.h>
+#include <store/redis/redis_nodeset.h>
 
-#include <util/nchan_msgid.h>
+#include <util/nchan_msg.h>
 #include "internal.h"
 #include "memstore_redis.h"
 #include <assert.h>
@@ -21,12 +22,6 @@
 #define ERR(fmt, arg...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "SUB:MEM-REDIS:" fmt, ##arg)
 
 
-typedef struct msgexpected_callback_llist_s msgexpected_callback_llist_t;
-struct msgexpected_callback_llist_s {
-  void                         (*cb)(nchan_msg_status_t, void *);
-  msgexpected_callback_llist_t  *next;
-};
-
 typedef struct sub_data_s sub_data_t;
 
 struct sub_data_s {
@@ -35,7 +30,6 @@ struct sub_data_s {
   ngx_str_t                    *chid;
   ngx_event_t                   timeout_ev;
   nchan_msg_status_t            last_msg_status;
-  msgexpected_callback_llist_t *waiting_for_msg_expected;
   sub_data_t                  **onconnect_callback_pd;
 }; //sub_data_t
 
@@ -45,41 +39,39 @@ static ngx_int_t empty_callback(){
 }
 */
 
-static void respond_msgexpected_callbacks(sub_data_t *d, nchan_msg_status_t status) {
-  msgexpected_callback_llist_t    *cur, *next;
-  cur = d->waiting_for_msg_expected;
-  d->waiting_for_msg_expected = NULL;
-  for(; cur != NULL; cur = next) {
-    next = cur->next;
-    cur->cb(status, &cur[1]);
-    ngx_free(cur);
-  }
-}
-
 static ngx_int_t sub_enqueue(ngx_int_t status, void *ptr, sub_data_t *d) {
   DBG("%p memstore-redis subsriber enqueued ok", d->sub);
-  
-  d->chanhead->status = READY;
-  d->chanhead->spooler.fn->handle_channel_status_change(&d->chanhead->spooler);
+  if(d->chanhead) {
+    d->chanhead->status = READY;
+    d->chanhead->spooler.fn->handle_channel_status_change(&d->chanhead->spooler);
+  }
   
   return NGX_OK;
 }
 
 ngx_int_t memstore_redis_subscriber_destroy(subscriber_t *sub) {
   DBG("%p destroy", sub);
+  sub_data_t  *d = internal_subscriber_get_privdata(sub);
+  d->chanhead = NULL; //memstore chanhead should be presumed missing
   return internal_subscriber_destroy(sub);
 }
 
 static ngx_int_t sub_dequeue(ngx_int_t status, void *ptr, sub_data_t* d) {
   DBG("%p dequeue", d->sub);
-  respond_msgexpected_callbacks(d, MSG_NORESPONSE);
   return NGX_OK;
 }
 
 static ngx_int_t sub_respond_message(ngx_int_t status, void *ptr, sub_data_t* d) {
   nchan_msg_t       *msg = (nchan_msg_t *) ptr;
   nchan_loc_conf_t   cf;
-  nchan_msg_id_t    *lastid;    
+  nchan_msg_id_t    *lastid;
+  ngx_pool_t        *deflate_pool = NULL;
+  int                nostore_mode;
+  if(!d->chanhead) {
+    DBG("memstore chanhead gone");
+    return NGX_DECLINED;
+  }
+  nostore_mode = d->chanhead->cf->redis.storage_mode == REDIS_MODE_DISTRIBUTED_NOSTORE;
   DBG("%p memstore-redis subscriber respond with message", d->sub);
 
   cf.max_messages = d->chanhead->max_messages;
@@ -87,21 +79,39 @@ static ngx_int_t sub_respond_message(ngx_int_t status, void *ptr, sub_data_t* d)
   cf.message_timeout = msg->expires - ngx_time();
   cf.complex_max_messages = NULL;
   cf.complex_message_timeout = NULL;
+  cf.message_compression = msg->compressed ? msg->compressed->compression : NCHAN_MSG_NO_COMPRESSION;
   
-  lastid = &d->chanhead->latest_msgid;
+  if(cf.message_compression != NCHAN_MSG_NO_COMPRESSION) {
+    deflate_pool = ngx_create_pool(NGX_DEFAULT_POOL_SIZE / 2, ngx_cycle->log);
+    if(!deflate_pool) {
+      ERR("unable to create deflatepool");
+      return NGX_ERROR;
+    }
+    nchan_deflate_message_if_needed(msg, &cf, NULL, deflate_pool);
+  }
+  else {
+    msg->compressed = NULL;
+  }
   
-  respond_msgexpected_callbacks(d, MSG_NORESPONSE);
+  lastid = &d->chanhead->latest_msgid;
   
   assert(lastid->tagcount == 1 && msg->id.tagcount == 1);
-  if(lastid->time < msg->id.time || 
+  if(nostore_mode || lastid->time < msg->id.time || 
     (lastid->time == msg->id.time && lastid->tag.fixed[0] < msg->id.tag.fixed[0])) {
+    if(nostore_mode) {
+      //out of order messages are ok, we don't care. publish them like they just got here. we can't lose messages due to network lag
+      msg->expires = 0;
+      msg->id.time = 0;
+    }
     memstore_ensure_chanhead_is_ready(d->chanhead, 1);
     nchan_store_chanhead_publish_message_generic(d->chanhead, msg, 0, &cf, NULL, NULL);
   }
   else {
     //meh, this message has already been delivered probably hopefully
   }
-  
+  if(deflate_pool) {
+    ngx_destroy_pool(deflate_pool);
+  }
   return NGX_OK;
 }
 
@@ -112,8 +122,11 @@ static ngx_int_t sub_destroy_handler(ngx_int_t status, void *d, sub_data_t *pd)
   return NGX_OK;
 }
 
-static ngx_int_t reconnect_callback(ngx_int_t status, void *d, void *pd) {
+static ngx_int_t reconnect_callback(redis_nodeset_t *ns, void *pd) {
   sub_data_t *sd = *((sub_data_t **) pd);
+  if(!sd->chanhead || !nodeset_ready(ns)) {
+    return NGX_ERROR;
+  }
   if(sd) {
     DBG("%reconnect callback");
     assert(sd->chanhead->redis_sub == sd->sub);
@@ -125,18 +138,22 @@ static ngx_int_t reconnect_callback(ngx_int_t status, void *d, void *pd) {
     ngx_free(pd);
   }
   else {
-    DBG("%reconnect callback skipped");
+    DBG("%reconnect callback skipped"); //probably because the channel was deleted while we were waiting
   }
   return NGX_OK;
 }
 
 static ngx_int_t sub_respond_status(ngx_int_t status, void *ptr, sub_data_t *d) {
   nchan_loc_conf_t  fake_cf;
+  redis_nodeset_t   *nodeset;
+  if(!d->chanhead) {
+    return NGX_DECLINED;
+  }
+  
   DBG("%p memstore-redis subscriber respond with status %i", d->sub, status);
   switch(status) {
     case NGX_HTTP_GONE: //delete
     case NGX_HTTP_CLOSE: //delete
-      respond_msgexpected_callbacks(d, MSG_NORESPONSE);
       fake_cf = *d->sub->cf;
       fake_cf.redis.enabled = 0;
       d->sub->destroy_after_dequeue = 1;
@@ -144,17 +161,23 @@ static ngx_int_t sub_respond_status(ngx_int_t status, void *ptr, sub_data_t *d)
       //now the chanhead will be in the garbage collector
       d->chanhead->redis_sub = NULL;
       
-      if(redis_connection_status(d->sub->cf) != CONNECTED && d->onconnect_callback_pd == NULL) {
+      nodeset = nodeset_find(&d->sub->cf->redis);
+      if(!nodeset_ready(nodeset) && d->onconnect_callback_pd == NULL) {
         sub_data_t **dd = ngx_alloc(sizeof(*d), ngx_cycle->log);
         *dd = d;
         d->onconnect_callback_pd = dd;
-        redis_store_callback_on_connected(d->sub->cf, reconnect_callback, dd);
+        nodeset_callback_on_ready(nodeset, 0, reconnect_callback, dd);
       }
       break;
       
     case NGX_HTTP_NO_CONTENT:
+      if(d->last_msg_status != MSG_EXPECTED) {
+        //the message buffer has just been walked start to finish
+        nchan_memstore_publish_notice(d->chanhead, NCHAN_NOTICE_BUFFER_LOADED, NULL);
+      }
       d->last_msg_status = MSG_EXPECTED;
-      respond_msgexpected_callbacks(d, MSG_EXPECTED);
+      //TODO: stuff about REDIS_MODE_BACKUP
+      
       break;
       
     default:
@@ -166,38 +189,20 @@ static ngx_int_t sub_respond_status(ngx_int_t status, void *ptr, sub_data_t *d)
 }
 
 static ngx_int_t sub_notify_handler(ngx_int_t code, void *data, sub_data_t *d) {
-  if(code == NCHAN_NOTICE_REDIS_CHANNEL_MESSAGE_BUFFER_SIZE_CHANGE) {
-    intptr_t   max_messages = (intptr_t )data;
-    d->chanhead->max_messages = max_messages;
-    memstore_chanhead_messages_gc(d->chanhead);
-  }
-  return NGX_OK;
-}
-
-ngx_int_t nchan_memstore_redis_subscriber_notify_on_MSG_EXPECTED(subscriber_t *sub, nchan_msg_id_t *id, void (*cb)(nchan_msg_status_t, void*), size_t pd_sz, void *pd) {
-  sub_data_t      *d = internal_subscriber_get_privdata(sub);
-  int8_t           cmpval = nchan_compare_msgids(id, &sub->last_msgid);
-  if(cmpval < 0) {
-    cb(MSG_NORESPONSE, pd);
+  intptr_t  max_messages;
+  if(!d->chanhead) {
+    return NGX_DECLINED;
   }
-  else if(d->last_msg_status == MSG_EXPECTED) {
-    cb(MSG_EXPECTED, pd);
-  }
-  else {
-    msgexpected_callback_llist_t *cbl;
-    void  *pd_copy;
-    if((cbl = ngx_alloc(sizeof(*cbl) + pd_sz, ngx_cycle->log)) == NULL) {
-      ERR("Unable to allocate memory for notify_on_MSG_EXPECTED callback llist");
-      return NGX_ERROR;
-    }
-    pd_copy = &cbl[1];
-    ngx_memcpy(pd_copy, pd, pd_sz);
-    cbl->cb = cb;
-    cbl->next = d->waiting_for_msg_expected;
-    d->waiting_for_msg_expected = cbl;
+  switch(code) {
+    case NCHAN_NOTICE_REDIS_CHANNEL_MESSAGE_BUFFER_SIZE_CHANGE:
+      max_messages = (intptr_t )data;
+      d->chanhead->max_messages = max_messages;
+      memstore_chanhead_messages_gc(d->chanhead);
+      break;
   }
   return NGX_OK;
 }
+
 /*
 static void reset_timer(sub_data_t *data) {
   if(data->timeout_ev.timer_set) {
@@ -239,7 +244,6 @@ subscriber_t *memstore_redis_subscriber_create(memstore_channel_head_t *chanhead
   d->chanhead = chanhead;
   d->chid = &chanhead->id;
   d->last_msg_status = MSG_PENDING;
-  d->waiting_for_msg_expected = NULL;
   d->onconnect_callback_pd = NULL;
 
   
diff --git a/debian/modules/nchan/src/subscribers/memstore_redis.h b/debian/modules/nchan/src/subscribers/memstore_redis.h
index e1149d1d..5c8d0e40 100644
--- a/debian/modules/nchan/src/subscribers/memstore_redis.h
+++ b/debian/modules/nchan/src/subscribers/memstore_redis.h
@@ -1,4 +1,3 @@
 #define MEMSTORE_REDIS_SUBSCRIBER_TIMEOUT 10
 subscriber_t *memstore_redis_subscriber_create(memstore_channel_head_t *chanhead);
 ngx_int_t memstore_redis_subscriber_destroy(subscriber_t *sub);
-ngx_int_t nchan_memstore_redis_subscriber_notify_on_MSG_EXPECTED(subscriber_t *sub, nchan_msg_id_t *id, void (*cb)(nchan_msg_status_t, void*), size_t pd_sz, void *pd);
diff --git a/debian/modules/nchan/src/subscribers/websocket.c b/debian/modules/nchan/src/subscribers/websocket.c
index c5c39476..8265abb7 100644
--- a/debian/modules/nchan/src/subscribers/websocket.c
+++ b/debian/modules/nchan/src/subscribers/websocket.c
@@ -1,6 +1,8 @@
 #include <nchan_module.h>
 #include <subscribers/common.h>
 #include <util/nchan_subrequest.h>
+#include <util/nchan_fake_request.h>
+#include <util/nchan_util.h>
 #if nginx_version >= 1000003
 #include <ngx_crypt.h>
 #endif
@@ -8,6 +10,11 @@
 #include <nginx.h>
 
 
+#if (NGX_ZLIB)
+#include <zlib.h>
+#endif
+
+
 //#define DEBUG_LEVEL NGX_LOG_WARN
 #define DEBUG_LEVEL NGX_LOG_DEBUG
 
@@ -15,7 +22,11 @@
 #define ERR(fmt, arg...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "SUB:WEBSOCKET:" fmt, ##arg)
 #include <assert.h>
 
-#if __AVX2__
+#if 0 //debug WS optimized xor
+  #define WEBSOCKET_OPTIMIZED_UNMASK 1
+  #define WEBSOCKET_FAKEOPTIMIZED_UNMASK 1
+  #define __vector_size_bytes 32
+#elif __AVX2__
   #include <immintrin.h>                     // AVX2 intrinsics
   #define WEBSOCKET_OPTIMIZED_UNMASK 1
   
@@ -37,6 +48,7 @@
 #endif
 
 #define WEBSOCKET_LAST_FRAME                0x8
+#define WEBSOCKET_LAST_FRAME_RSV1           0xC
 
 #define WEBSOCKET_OPCODE_TEXT               0x1
 #define WEBSOCKET_OPCODE_BINARY             0x2
@@ -54,11 +66,15 @@
 
 #define WEBSOCKET_CLOSING_TIMEOUT           250 //ms
 
+#define DEFLATE_MAX_WINDOW_BITS             15
+#define DEFLATE_MIN_WINDOW_BITS             9 //it should be 8, but zlib doesn't support window size of 8 these days
+#define DEFLATE_DEFAULT_CLIENT_WINDOW_BITS  15
+
 /**
  * here's what a websocket frame looks like
  * 
-    0                   1                   2                   3
-  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+   0                   1                   2                   3
+   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-------+-+-------------+-------------------------------+
   |F|R|R|R| opcode|M| Payload len |    Extended payload length    |
   |I|S|S|S|  (4)  |A|     (7)     |             (16/64)           |
@@ -92,11 +108,19 @@
 
 static const u_char WEBSOCKET_PAYLOAD_LEN_16_BYTE = 126;
 static const u_char WEBSOCKET_PAYLOAD_LEN_64_BYTE = 127;
+
 static const u_char WEBSOCKET_TEXT_LAST_FRAME_BYTE =  WEBSOCKET_OPCODE_TEXT  | (WEBSOCKET_LAST_FRAME << 4);
+static const u_char WEBSOCKET_TEXT_DEFLATED_LAST_FRAME_BYTE = WEBSOCKET_OPCODE_TEXT | (WEBSOCKET_LAST_FRAME_RSV1 << 4);
+
+static const u_char WEBSOCKET_BINARY_LAST_FRAME_BYTE =  WEBSOCKET_OPCODE_BINARY  | (WEBSOCKET_LAST_FRAME << 4);
+static const u_char WEBSOCKET_BINARY_DEFLATED_LAST_FRAME_BYTE = WEBSOCKET_OPCODE_BINARY  | (WEBSOCKET_LAST_FRAME_RSV1 << 4);
+
 static const u_char WEBSOCKET_CLOSE_LAST_FRAME_BYTE = WEBSOCKET_OPCODE_CLOSE | (WEBSOCKET_LAST_FRAME << 4);
 static const u_char WEBSOCKET_PONG_LAST_FRAME_BYTE  = WEBSOCKET_OPCODE_PONG  | (WEBSOCKET_LAST_FRAME << 4);
 static const u_char WEBSOCKET_PING_LAST_FRAME_BYTE  = WEBSOCKET_OPCODE_PING  | (WEBSOCKET_LAST_FRAME << 4);
 
+static ngx_str_t   binary_mimetype = ngx_string("application/octet-stream");
+
 #define NCHAN_WS_TMP_POOL_SIZE (4*1024)
 
 
@@ -142,18 +166,19 @@ struct nchan_pub_upstream_request_data_s {
   full_subscriber_t                  *fsub;
   nchan_pub_upstream_request_data_t  *next;
   unsigned                            sent:1;
+  unsigned                            binary:1;
 };
 
 typedef struct {
-  ngx_event_t                         upstream_subrequest_ev;
-  ngx_str_t                           request_url;
-  ngx_int_t                           running_upstream_request_count;
-  nchan_pub_upstream_request_data_t  *upstream_request_data_head;
-  nchan_pub_upstream_request_data_t  *upstream_request_data_tail;
-  nchan_pub_upstream_request_data_t  *upstream_request_data_received_head;
-  ngx_pool_t                         *temp_request_pool;
-  ngx_pool_t                         *real_request_pool;
-} nchan_pub_upstream_stuff_t;
+#if (NGX_ZLIB)
+  z_stream               *zstream_in;
+#endif
+  int8_t                  server_max_window_bits;
+  int8_t                  client_max_window_bits;
+  unsigned                server_no_context_takeover:1;
+  unsigned                client_no_context_takeover:1;
+  unsigned                enabled:1;
+} permessage_deflate_t;
 
 struct full_subscriber_s {
   subscriber_t            sub;
@@ -165,17 +190,23 @@ struct full_subscriber_s {
   ngx_event_t             closing_ev;
   ws_frame_t              frame;
   
-  ngx_str_t              *publish_channel_id;
-  nchan_pub_upstream_stuff_t *publish_upstream;
-  
   ngx_event_t             ping_ev;
+  
+  permessage_deflate_t    deflate;
+  
+  struct {
+    ngx_str_t               *channel_id;
+    ngx_str_t               *upstream_request_url;
+    ngx_pool_t              *msg_pool;
+    void                   (*intercept)(subscriber_t *, nchan_msg_t *);
+  }                       publisher;
+  
   unsigned                awaiting_pong:1;
   unsigned                ws_meta_subprotocol:1;
   unsigned                holding:1; //make sure the request doesn't close right away
   unsigned                shook_hands:1;
-  unsigned                connected:1;
-  unsigned                closing:1;
-  unsigned                already_sent_unsub_request:1;
+  unsigned                sent_close_frame:1;
+  unsigned                received_close_frame:1;
   unsigned                finalize_request:1;
   unsigned                awaiting_destruction:1;
 };// full_subscriber_t
@@ -185,12 +216,13 @@ static void empty_handler() { }
 static ngx_int_t websocket_send_frame(full_subscriber_t *fsub, const u_char opcode, off_t len, ngx_chain_t *chain);
 static void set_buf_to_str(ngx_buf_t *buf, const ngx_str_t *str);
 static ngx_chain_t *websocket_frame_header_chain(full_subscriber_t *fsub, const u_char opcode, off_t len, ngx_chain_t *chain);
-static ngx_flag_t is_utf8(u_char *, size_t);
+static ngx_flag_t is_utf8(ngx_buf_t *);
 static ngx_chain_t *websocket_close_frame_chain(full_subscriber_t *fsub, uint16_t code, ngx_str_t *err);
 static ngx_int_t websocket_send_close_frame(full_subscriber_t *fsub, uint16_t code, ngx_str_t *err);
-static ngx_int_t websocket_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line);
+static ngx_int_t websocket_send_close_frame_cstr(full_subscriber_t *fsub, uint16_t code, const char *err);
+static ngx_int_t websocket_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body);
 
-static ngx_int_t websocket_publish(full_subscriber_t *fsub, ngx_buf_t *buf);
+static ngx_int_t websocket_publish(full_subscriber_t *fsub, ngx_buf_t *buf, int binary);
 
 static ngx_int_t websocket_reserve(subscriber_t *self);
 static ngx_int_t websocket_release(subscriber_t *self, uint8_t nodestroy);
@@ -198,13 +230,45 @@ static ngx_int_t websocket_release(subscriber_t *self, uint8_t nodestroy);
 static void websocket_delete_timers(full_subscriber_t *fsub);
 static ngx_chain_t *websocket_msg_frame_chain(full_subscriber_t *fsub, nchan_msg_t *msg);
 
-ngx_int_t websocket_finalize_upstream_handler(subscriber_t *sub, ngx_http_request_t *sr, ngx_int_t rc, void *pd) {
-  ngx_http_request_t *r = sub->request;
-  DBG("websocket_finalize_upstream_handler");
-  r->main->blocked = 0;
-  websocket_release(sub, 0);
-  
-  nchan_http_finalize_request(r, NGX_HTTP_OK);
+/*
+ngx_int_t ws_reserve_tmp_pool(full_subscriber_t *fsub) {
+  if(!fsub->tmp_pool) {
+    fsub->tmp_pool = ngx_create_pool(NCHAN_WS_TMP_POOL_SIZE, fsub->sub.request->connection->log);
+  }
+  if(!fsub->tmp_pool) {
+    ERR("unable to create temp pool for websocket sub %p", fsub);
+    return NGX_ERROR;
+  }
+  fsub->tmp_pool_use_count++;
+  return NGX_OK;
+}
+
+ngx_int_t ws_release_tmp_pool(full_subscriber_t *fsub) {
+  if(!fsub->tmp_pool) {
+    ERR("attempted to release tmp_pool when it's NULL");
+    return NGX_ERROR;
+  }
+  if(--fsub->tmp_pool_use_count == 0) {
+    ngx_destroy_pool(fsub->tmp_pool);
+    fsub->tmp_pool = NULL;
+  } else {
+  }
+
+  return NGX_OK;
+}
+*/
+
+ngx_pool_t *ws_get_msgpool(full_subscriber_t *fsub) {
+  if(!fsub->publisher.msg_pool) {
+    fsub->publisher.msg_pool = ngx_create_pool(NCHAN_WS_TMP_POOL_SIZE, fsub->sub.request->connection->log);
+  }
+  return fsub->publisher.msg_pool;
+}
+ngx_int_t ws_destroy_msgpool(full_subscriber_t *fsub) {
+  if(fsub->publisher.msg_pool) {
+    ngx_destroy_pool(fsub->publisher.msg_pool);
+    fsub->publisher.msg_pool = NULL;
+  }
   return NGX_OK;
 }
 
@@ -212,26 +276,20 @@ static ngx_int_t websocket_finalize_request(full_subscriber_t *fsub) {
   subscriber_t       *sub = &fsub->sub;
   ngx_http_request_t *r = sub->request;
   
-  fsub->cln->handler = (ngx_http_cleanup_pt )empty_handler;
+  if(fsub->cln) {
+    fsub->cln->handler = (ngx_http_cleanup_pt )empty_handler;
+  }
+  
   if(sub->cf->unsubscribe_request_url && sub->enqueued) {
-    if(!fsub->already_sent_unsub_request) {
-      r->main->blocked = 1;
-      fsub->already_sent_unsub_request = 1;
-      websocket_reserve(&fsub->sub);
-      if(sub->enqueued) {
-        sub->fn->dequeue(sub);
-      }
-      if(subscriber_cv_subrequest(sub, sub->cf->unsubscribe_request_url, NULL, websocket_finalize_upstream_handler, NULL)) {
-        ngx_http_run_posted_requests(r->connection);
-      }
-    }
+    nchan_subscriber_unsubscribe_request(sub);
   }
-  else {
-    if(sub->enqueued) {
-      sub->fn->dequeue(sub);
-    }
-    nchan_http_finalize_request(r, NGX_HTTP_OK);
+  nchan_subscriber_subrequest_cleanup(sub);
+  
+  sub->status = DEAD;
+  if(sub->enqueued) {
+    sub->fn->dequeue(sub);
   }
+  nchan_http_finalize_request(r, NGX_HTTP_OK);
   return NGX_OK;
 }
 
@@ -239,12 +297,18 @@ static void aborted_ws_close_request_rev_handler(ngx_http_request_t *r) {
   nchan_request_ctx_t        *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
   full_subscriber_t          *fsub = (full_subscriber_t *)ctx->sub;
   if(fsub) {
+    ctx->sub->status = DEAD;
+    fsub->sub.request->headers_out.status = NGX_HTTP_CLIENT_CLOSED_REQUEST;
     websocket_finalize_request(fsub);
   }
 }
 
 static void sudden_abort_handler(subscriber_t *sub) {
-  DBG("sudden abort handler for sub %p request %p", sub, sub->request);
+  //DBG("sudden abort handler for sub %p request %p", sub, sub->request);
+  if(!sub) {
+    //DBG("%p already freed apparently?...", sub);
+    return; //websocket subscriber already freed
+  }
 #if FAKESHARD
   full_subscriber_t  *fsub = (full_subscriber_t  *)sub;
   memstore_fakeprocess_push(fsub->sub.owner);
@@ -272,6 +336,7 @@ static void sudden_upstream_request_abort_handler(full_subscriber_t *fsub) {
 }
 */
 
+static void init_buf(ngx_buf_t *buf, int8_t last);
 static void init_msg_buf(ngx_buf_t *buf);
 
 #if WEBSOCKET_OPTIMIZED_UNMASK
@@ -283,10 +348,9 @@ static void websocket_unmask_frame(ws_frame_t *frame) {
   u_char    *mask_key = frame->mask_key;
   uint64_t   preamble_len = payload_len <= __vector_size_bytes ? payload_len : (uintptr_t )payload % __vector_size_bytes;
   uint64_t   fastlen;
-  __vector_type    w, w_mask;
   u_char     extended_mask[__vector_size_bytes];  
   
-  //preamble
+  //preamble -- for alignment or msglen < __vector_size_bytes
   for (i = 0; i < preamble_len && i < payload_len; i++) {
     payload[i] ^= mask_key[i % 4];
   }
@@ -295,22 +359,32 @@ static void websocket_unmask_frame(ws_frame_t *frame) {
     return;
   }
   
-  assert((uintptr_t )(&payload[i]) % __vector_size_bytes == 0);
-  
-  for(j=0; j<__vector_size_bytes; j+=4) {
-    ngx_memcpy(&extended_mask[j], mask_key, 4);
+  if((uintptr_t )(&payload[i]) % __vector_size_bytes != 0) { //didn't get alignment right for some reason
+    fastlen = 0;
   }
+  else {
+    fastlen = ((payload_len - i) / __vector_size_bytes) * __vector_size_bytes;
+  }
+    
+#if WEBSOCKET_FAKEOPTIMIZED_UNMASK
+  for (/*void*/; i < fastlen + preamble_len; i++) {
+    payload[i] ^= mask_key[i % 4];
+  }
+#else
+  __vector_type    w, w_mask;
   
-  w_mask = __vector_load_intrinsic((__vector_type *)extended_mask);
-  fastlen = payload_len - ((payload_len - i) % __vector_size_bytes);
-  
-  assert(fastlen % __vector_size_bytes == 0);
-  
-  for (/*void*/; i < fastlen; i += __vector_size_bytes) {           // note that i must be multiple of [__vector_size_bytes]
-    w = __vector_load_intrinsic((__vector_type *)&payload[i]);       // load [__vector_size_bytes] bytes
-    w = __vector_xor_intrinsic(w, w_mask);           // XOR with mask
-    __vector_store_intrinsic((__vector_type *)&payload[i], w);   // store [__vector_size_bytes] masked bytes
+  if (fastlen > 0) {
+    for(j=0; j<__vector_size_bytes; j+=4) {
+      ngx_memcpy(&extended_mask[j], mask_key, 4);
+    }
+    w_mask = __vector_load_intrinsic((__vector_type *)extended_mask);
+    for (/*void*/; i < fastlen + preamble_len; i += __vector_size_bytes) {
+      w = __vector_load_intrinsic((__vector_type *)&payload[i]);       // load [__vector_size_bytes] bytes
+      w = __vector_xor_intrinsic(w, w_mask);           // XOR with mask
+      __vector_store_intrinsic((__vector_type *)&payload[i], w);   // store [__vector_size_bytes] masked bytes
+    }
   }
+#endif
   
   //leftovers
   for (/*void*/; i < payload_len; i++) {
@@ -332,7 +406,7 @@ static void websocket_unmask_frame(ws_frame_t *frame) {
 #endif
 
 static ngx_int_t ws_output_filter(full_subscriber_t *fsub, ngx_chain_t *chain) {
-  if(fsub->publish_upstream && fsub->sub.request->pool == fsub->publish_upstream->temp_request_pool) {
+  /*if(fsub->publish_upstream && fsub->sub.request->pool == fsub->publish_upstream->temp_request_pool) {
     ngx_int_t rc;
     fsub->sub.request->pool = fsub->publish_upstream->real_request_pool;
     rc = nchan_output_filter(fsub->sub.request, chain);
@@ -341,26 +415,44 @@ static ngx_int_t ws_output_filter(full_subscriber_t *fsub, ngx_chain_t *chain) {
   }
   else {
     return nchan_output_filter(fsub->sub.request, chain);
-  }
+  }*/
+  //placate google's devious ngx_pagespeed by not using the header_only hack
+  ngx_http_request_t *r = fsub->sub.request;
+  r->header_only = 0;
+  r->chunked = 0;
+  return nchan_output_filter(r, chain);
 }
 
 static ngx_int_t ws_output_msg_filter(full_subscriber_t *fsub, nchan_msg_t *msg) {
-  if(fsub->publish_upstream && fsub->sub.request->pool == fsub->publish_upstream->temp_request_pool) {
+  /*if(fsub->publish_upstream && fsub->sub.request->pool != fsub->publish_upstream->real_request_pool) {
     ngx_int_t rc;
+    ngx_pool_t *fake_pool = fsub->sub.request->pool;
     fsub->sub.request->pool = fsub->publish_upstream->real_request_pool;
     rc = nchan_output_msg_filter(fsub->sub.request, msg, websocket_msg_frame_chain(fsub, msg));
-    fsub->sub.request->pool = fsub->publish_upstream->temp_request_pool;
+    fsub->sub.request->pool = fake_pool;
     return rc;
   }
   else {
     return nchan_output_msg_filter(fsub->sub.request, msg, websocket_msg_frame_chain(fsub, msg));
-  }
+  }*/
+  return nchan_output_msg_filter(fsub->sub.request, msg, websocket_msg_frame_chain(fsub, msg));
 }
 
-static ngx_int_t websocket_publish_callback(ngx_int_t status, nchan_channel_t *ch, full_subscriber_t *fsub) {
+typedef struct {
+  full_subscriber_t *fsub;
+  ngx_pool_t        *pool;
+  ngx_buf_t         *msgbuf;
+  nchan_fakereq_subrequest_data_t *subrequest;
+  unsigned           binary:1;
+  nchan_msg_t        msg;
+} ws_publish_data_t;
+
+
+static ngx_int_t websocket_publish_callback(ngx_int_t status, nchan_channel_t *ch, ws_publish_data_t *d) {
   time_t                 last_seen = 0;
   ngx_uint_t             subscribers = 0;
   ngx_uint_t             messages = 0;
+  full_subscriber_t     *fsub = d->fsub;
   nchan_msg_id_t        *msgid = NULL;
   ngx_http_request_t    *r = fsub->sub.request;
   ngx_str_t             *accept_header = NULL;
@@ -372,8 +464,15 @@ static ngx_int_t websocket_publish_callback(ngx_int_t status, nchan_channel_t *c
     messages  = ch->messages;
     msgid = &ch->last_published_msg_id;
   }
+  if(d->subrequest) {
+    nchan_requestmachine_request_cleanup_manual(d->subrequest);
+  }
+  else {
+    ngx_destroy_pool(d->pool);
+  }
+  d = NULL;
   
-  if(websocket_release(&fsub->sub, 0) == NGX_ABORT) {
+  if(websocket_release(&fsub->sub, 0) == NGX_ABORT || fsub->sub.status == DEAD) {
     //zombie publisher
     //nothing more to do, we're finished here
     return NGX_OK;
@@ -382,9 +481,10 @@ static ngx_int_t websocket_publish_callback(ngx_int_t status, nchan_channel_t *c
   switch(status) {
     case NCHAN_MESSAGE_QUEUED:
     case NCHAN_MESSAGE_RECEIVED:
+      nchan_maybe_send_channel_event_message(fsub->sub.request, CHAN_PUBLISH);
       if(fsub->sub.cf->sub.websocket) {
         //don't reply with status info, this websocket is used for subscribing too,
-        //so it should only be recieving messages
+        //so it should only be receiving messages
         return NGX_OK;
       }
       accept_header = nchan_get_accept_header_value(r);
@@ -395,54 +495,90 @@ static ngx_int_t websocket_publish_callback(ngx_int_t status, nchan_channel_t *c
       
       ws_output_filter(fsub, websocket_frame_header_chain(fsub, WEBSOCKET_TEXT_LAST_FRAME_BYTE, ngx_buf_size((&bc->buf)), &bc->chain));
       break;
+    case NGX_HTTP_INSUFFICIENT_STORAGE:
+      websocket_respond_status(&fsub->sub, NGX_HTTP_INSUFFICIENT_STORAGE, NULL, NULL);
+      break;
     case NGX_ERROR:
     case NGX_HTTP_INTERNAL_SERVER_ERROR:
-      websocket_respond_status(&fsub->sub, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL);
+      websocket_respond_status(&fsub->sub, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL);
       break;
   }
   return NGX_OK;
 }
 
-static void websocket_publish_continue(full_subscriber_t *fsub, ngx_buf_t *buf) {
-  nchan_msg_t              msg;
+static void websocket_publish_continue(ws_publish_data_t *d) {
+  nchan_msg_t             *msg = &d->msg;
   struct timeval           tv;
-  ngx_http_request_t      *r = fsub->sub.request;
-  ngx_memzero(&msg, sizeof(msg));
+  full_subscriber_t       *fsub = d->fsub;
+  ngx_http_request_t      *r = d->fsub->sub.request;
+  
+  ngx_memzero(msg, sizeof(*msg));
   
-  msg.buf=buf;
+  msg->buf=*d->msgbuf;
   if(r->headers_in.content_type) {
-    msg.content_type.data = r->headers_in.content_type->value.data;
-    msg.content_type.len = r->headers_in.content_type->value.len;
+    msg->content_type = &r->headers_in.content_type->value;
   }
   
   ngx_gettimeofday(&tv);
-  msg.id.time = tv.tv_sec;
-  msg.id.tag.fixed[0]=0;
-  msg.id.tagcount=1;
-  msg.id.tagactive=0;
+  msg->id.time = tv.tv_sec;
+  msg->id.tag.fixed[0]=0;
+  msg->id.tagcount=1;
+  msg->id.tagactive=0;
   
-  websocket_reserve(&fsub->sub);
-  fsub->sub.cf->storage_engine->publish(fsub->publish_channel_id, &msg, fsub->sub.cf, (callback_pt )websocket_publish_callback, fsub); 
-  nchan_update_stub_status(total_published_messages, 1);
+  if(d->binary) {
+    msg->content_type = &binary_mimetype;
+  }
+  //ERR("%p pool sz %d", fsub, r->pool->total_allocd);
+  msg->storage = NCHAN_MSG_POOL;
+  
+  if(nchan_need_to_deflate_message(fsub->sub.cf)) {
+    nchan_deflate_message_if_needed(msg, fsub->sub.cf, r, d->pool);
+  }
+  
+  if(fsub->publisher.intercept) {
+    fsub->publisher.intercept(&fsub->sub, msg);
+    ngx_destroy_pool(d->pool);
+  }
+  else {
+    websocket_reserve(&fsub->sub);
+    fsub->sub.cf->storage_engine->publish(fsub->publisher.channel_id, msg, fsub->sub.cf, (callback_pt )websocket_publish_callback, d); 
+    nchan_update_stub_status(total_published_messages, 1);
+  }
   
 }
 
-static ngx_int_t websocket_publisher_upstream_handler(subscriber_t *sub, ngx_http_request_t *sr, ngx_int_t rc, void *data) {
-  ngx_http_request_t                  *r = sr->parent;
-  nchan_pub_upstream_request_data_t   *d = (nchan_pub_upstream_request_data_t *)data;
-  full_subscriber_t                   *fsub = (full_subscriber_t *)sub;
-  nchan_pub_upstream_stuff_t          *sup = fsub->publish_upstream;
-#if nginx_version <= 1009004
-  r->main->subrequests++; //avoid tripping up subrequest loop detection
-#endif
-  if(r->connection->data == sr) {
-    r->connection->data = r;
+
+static ngx_int_t websocket_heartbeat(full_subscriber_t *fsub, ngx_buf_t *buf) {
+  ngx_str_t      str_in;
+  if(!fsub->sub.cf->websocket_heartbeat.enabled) {
+    return NGX_DECLINED;
   }
-  if(r->postponed) {
-    r->postponed = NULL;
+  
+  str_in.data = buf->pos;
+  str_in.len = buf->last - buf->pos;
+  if(nchan_ngx_str_match(fsub->sub.cf->websocket_heartbeat.in, &str_in)) {
+    nchan_buf_and_chain_t *bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, 1);
+    init_buf(&bc->buf, 1);
+    set_buf_to_str(&bc->buf, fsub->sub.cf->websocket_heartbeat.out);
+    websocket_send_frame(fsub, WEBSOCKET_TEXT_LAST_FRAME_BYTE, fsub->sub.cf->websocket_heartbeat.out->len, &bc->chain);
+    return NGX_OK;
   }
+  else {
+    return NGX_DECLINED;
+  }
+}
+
+ngx_int_t websocket_publish_upstream_handler(ngx_int_t rc, ngx_http_request_t *sr, void *pd) {
+  ws_publish_data_t       *d = pd;
+  full_subscriber_t       *fsub = d->fsub;
   
-  r->count--;
+  assert(d->subrequest);
+  
+  if(websocket_release(&fsub->sub, 0) == NGX_ABORT || rc == NGX_ABORT) {
+    //websocket client disappered, or subrequest got canceled some other way
+    nchan_requestmachine_request_cleanup_manual(d->subrequest);
+    return NGX_OK;
+  }
   
   if(rc == NGX_OK) {
     ngx_int_t                        code = sr->headers_out.status;
@@ -455,14 +591,16 @@ static ngx_int_t websocket_publisher_upstream_handler(subscriber_t *sub, ngx_htt
       case NGX_HTTP_ACCEPTED:
         if(sr->upstream) {
           ngx_buf_t    *buf;
-          ngx_buf_t     emptybuf;
           
           content_length = nchan_subrequest_content_length(sr);
+#if nginx_version >= 1013010
+          request_chain = sr->out;
+#else
           request_chain = sr->upstream->out_bufs;
-          
+#endif
           if(content_length > 0 && request_chain) {
             if (request_chain->next != NULL) {
-              buf = nchan_chain_to_single_buffer(sup->temp_request_pool, request_chain, content_length);
+              buf = nchan_chain_to_single_buffer(d->pool, request_chain, content_length);
             }
             else {
               buf = request_chain->buf;
@@ -475,14 +613,13 @@ static ngx_int_t websocket_publisher_upstream_handler(subscriber_t *sub, ngx_htt
             }
           }
           else {
-            ngx_memzero((&emptybuf), sizeof(emptybuf));
-            emptybuf.memory=1;
-            emptybuf.last_in_chain=1;
-            emptybuf.last_buf=1;
-            buf=&emptybuf;
+            buf = ngx_pcalloc(d->pool, sizeof(*buf));
+            buf->memory=1;
+            buf->last_in_chain=1;
+            buf->last_buf=1;
           }
-          
-          websocket_publish_continue(fsub, buf);
+          d->msgbuf = buf;
+          websocket_publish_continue(d);
         }
         else {
           request_chain = NULL;
@@ -492,150 +629,70 @@ static ngx_int_t websocket_publisher_upstream_handler(subscriber_t *sub, ngx_htt
         break;
       
       case NGX_HTTP_NOT_MODIFIED:
-        websocket_publish_continue(fsub, &d->body_buf);
-        
+        websocket_publish_continue(d);
+        //cleaned up later
         break;
         
       case NGX_HTTP_NO_CONTENT:
-        //cancel publication
+        //cancel publishing
+        nchan_requestmachine_request_cleanup_manual(d->subrequest);
         break;
       
       default:
-        websocket_respond_status(&fsub->sub, NGX_HTTP_FORBIDDEN, NULL);
+        nchan_requestmachine_request_cleanup_manual(d->subrequest);
+        websocket_respond_status(&fsub->sub, NGX_HTTP_FORBIDDEN, NULL, NULL);
         break;
     }
   }
   else {
-    websocket_respond_status(&fsub->sub, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL);
+    nchan_requestmachine_request_cleanup_manual(d->subrequest);
+    websocket_respond_status(&fsub->sub, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL);
   }
   
-  assert(sup->upstream_request_data_head == d);
-  sup->upstream_request_data_head = d->next;
-  if(sup->upstream_request_data_tail == d) {
-    sup->upstream_request_data_tail = NULL;
-  }  
-  
-  sup->upstream_request_data_received_head=d;
   
-  sup->running_upstream_request_count--;
-  if(!sup->upstream_subrequest_ev.timer_set) {
-    ngx_add_timer(&sup->upstream_subrequest_ev, 0);
-  }
   
   return NGX_OK;
 }
-
-static void send_next_publish_subrequest(full_subscriber_t *fsub) {
-  nchan_pub_upstream_stuff_t        *sup = fsub->publish_upstream;
-  nchan_pub_upstream_request_data_t *scur;
-  ngx_http_request_t                *sr;
-  
-  if(!sup || !sup->upstream_request_data_head) return;
-  
-  scur = sup->upstream_request_data_head;
-  
-  //typedef ngx_int_t (*subrequest_callback_pt)(subscriber_t *sub, ngx_http_request_t *r, ngx_int_t rc, void *);
-  
-  sr = subscriber_subrequest(&fsub->sub, &sup->request_url, &scur->body_buf, websocket_publisher_upstream_handler, scur);
-  scur->sr = sr;
-  scur->sent = 1;
-  ngx_http_run_posted_requests(fsub->sub.request->connection);
-}
-
-static void clean_after_upstream_response(full_subscriber_t *fsub, ngx_int_t force) {
-  nchan_pub_upstream_stuff_t   *sup = fsub->publish_upstream;
-  if(sup) 
-    DBG("running_upstream_request_count %i", sup->running_upstream_request_count);
-  if(sup && (sup->upstream_request_data_head == NULL || force)) {
-    if(!force) assert(sup->running_upstream_request_count == 0);
-    ngx_http_cleanup_t *cln = fsub->sub.request->cleanup;
-    while(cln && cln != fsub->cln) {
-      if (cln->handler) {
-        DBG("run handler");
-        cln->handler(cln->data);
-      }
-      cln = cln->next;
-    }
-    fsub->sub.request->cleanup = cln;
-    
-    //no need for tmp_pool anymore
-    if(sup->temp_request_pool) {
-      ngx_destroy_pool(sup->temp_request_pool);
-      fsub->sub.request->pool = sup->real_request_pool;
-      sup->temp_request_pool = NULL;
-    }
-  }
-}
-
-static void upstream_subrequest_ev_handler(ngx_event_t *ev) {
-  full_subscriber_t            *fsub = ev->data;
-  send_next_publish_subrequest(fsub);
-  clean_after_upstream_response(fsub, 0);
-  //assert(fsub->sub.request->write_event_handler == ws_request_empty_handler);
-}
-
-static ngx_int_t websocket_publish(full_subscriber_t *fsub, ngx_buf_t *buf) {
-  static ngx_str_t         nopublishing = ngx_string("Publishing not allowed.");
-  
-  if(!fsub->sub.cf->pub.websocket) {
-    return websocket_send_close_frame(fsub, CLOSE_POLICY_VIOLATION, &nopublishing);
-  }
-  
+static ngx_int_t websocket_publish(full_subscriber_t *fsub, ngx_buf_t *buf, int binary) {
 #if (NGX_DEBUG_POOL)
   ERR("ws request pool size: %V", ngx_http_debug_pool_str(fsub->sub.request->pool));
 #endif
   
-  if(fsub->publish_upstream == NULL) { // don't need to send request upstream
-    websocket_publish_continue(fsub, buf);
+  ngx_int_t          rc = NGX_OK;
+  ws_publish_data_t *d = ngx_palloc(ws_get_msgpool(fsub), sizeof(*d));
+  if(d == NULL) {
+    return NGX_ERROR;
+  }
+  d->fsub = fsub;
+  d->binary = binary;
+  //move the msg pool
+  d->pool = fsub->publisher.msg_pool;
+  d->msgbuf = buf;
+  fsub->publisher.msg_pool = NULL;
+  
+  if(fsub->publisher.intercept || fsub->publisher.upstream_request_url == NULL) { // don't need to send request upstream
+    d->subrequest = NULL;
+    websocket_publish_continue(d);
   }
   else {
-    nchan_pub_upstream_request_data_t *psrd;
-    ngx_http_request_t                *r = fsub->sub.request;
-    size_t                             sz;
-    ngx_pool_t                        *tmp_pool;
-    nchan_pub_upstream_stuff_t        *sup = fsub->publish_upstream;
-    if(!sup->temp_request_pool) {
-      //can't use the client request's pool, it will bloat with every new upstream request
-      sup->temp_request_pool = ngx_create_pool(NCHAN_WS_TMP_POOL_SIZE, r->connection->log);
-      sup->real_request_pool = r->pool;
-      r->pool = sup->temp_request_pool;
-      //will set back to real request's pool at the end of this function
-    }
-    tmp_pool = fsub->publish_upstream->temp_request_pool;
-    
-    psrd = ngx_pcalloc(tmp_pool, sizeof(*psrd));
-    
-    if(sup->upstream_request_data_tail) {
-     sup->upstream_request_data_tail->next = psrd;
-    }
-    sup->upstream_request_data_tail = psrd;
-    if(!sup->upstream_request_data_head) {
-     sup->upstream_request_data_head = psrd;
-    }
-    
-    psrd->next = NULL;
-    psrd->sent = 0;
-    psrd->fsub = fsub;
+    nchan_requestmachine_request_params_t param;
+    param.url.str = fsub->publisher.upstream_request_url;
+    param.url_complex = 0;
+    param.pool = d->pool;
+    param.body = buf;
+    param.response_headers_only = 0;
+    param.cb = (callback_pt )websocket_publish_upstream_handler;
+    param.pd = d;
+    param.manual_cleanup = 1;
     
-    //copy body out of the websocket framebuffer to the upstream temp pool buffer
-    sz = ngx_buf_size(buf);
-    psrd->body_buf = *buf;
-    psrd->body_buf.start = ngx_palloc(tmp_pool, sz);
-    ngx_memcpy(psrd->body_buf.start, buf->start, sz);
-    psrd->body_buf.end = psrd->body_buf.start + sz;
-    psrd->body_buf.pos = psrd->body_buf.start;
-    psrd->body_buf.last = psrd->body_buf.end;
+    websocket_reserve(&d->fsub->sub);
     
-    //ERR("request %p tmp pool %p", r, r->pool);
+    d->subrequest = nchan_subscriber_subrequest(&fsub->sub, &param);
     
-    
-    sup->running_upstream_request_count++;
-    if(!sup->upstream_subrequest_ev.timer_set) {
-      ngx_add_timer(&sup->upstream_subrequest_ev, 0);
-    }
+    rc = d->subrequest == NULL ? NGX_ERROR : NGX_OK;
   }
   
-  return NGX_OK;
+  return rc;
 }
 
 static void websocket_init_frame(ws_frame_t *frame) {
@@ -652,7 +709,6 @@ static void *framebuf_alloc(void *pd) {
 static void closing_ev_handler(ngx_event_t *ev) {
   full_subscriber_t *fsub = (full_subscriber_t *)ev->data;
   DBG("closing_ev timer handler for %p, delayed", fsub);
-  //fsub->connected = 0;
   //fsub->sub.status = DEAD;
   websocket_finalize_request(fsub);
 }
@@ -675,12 +731,15 @@ subscriber_t *websocket_subscriber_create(ngx_http_request_t *r, nchan_msg_id_t
   fsub->finalize_request = 0;
   fsub->holding = 0;
   fsub->shook_hands = 0;
-  fsub->connected = 0;
   fsub->awaiting_pong = 0;
-  fsub->closing = 0;
-  fsub->already_sent_unsub_request = 0;
+  fsub->sent_close_frame = 0;
+  fsub->received_close_frame = 0;
   ngx_memzero(&fsub->ping_ev, sizeof(fsub->ping_ev));
+  
   nchan_subscriber_init_timeout_timer(&fsub->sub, &fsub->timeout_ev);
+  
+  ngx_memzero(&fsub->deflate, sizeof(fsub->deflate));
+  
   fsub->dequeue_handler = empty_handler;
   fsub->dequeue_handler_data = NULL;
   fsub->awaiting_destruction = 0;
@@ -699,22 +758,24 @@ subscriber_t *websocket_subscriber_create(ngx_http_request_t *r, nchan_msg_id_t
   b->temporary = 0;
   */
   
+  ngx_memzero(&fsub->publisher, sizeof(fsub->publisher));
+  
+  
   if(fsub->sub.cf->pub.websocket) {
-    fsub->publish_channel_id = nchan_get_channel_id(r, PUB, 0);
+    fsub->publisher.channel_id = nchan_get_channel_id(r, PUB, 0);
   }
   
   if(fsub->sub.cf->publisher_upstream_request_url) {
-    if((fsub->publish_upstream = ngx_pcalloc(r->pool, sizeof(*fsub->publish_upstream))) == NULL) {
-      err="Unable to allocate websocket upstream stuff";
+    ngx_str_t *url = ngx_palloc(r->pool, sizeof(*url));
+    if(url == NULL) {
+      err="Unable to allocate websocket upstream url";
       goto fail;
     }
-    nchan_init_timer(&fsub->publish_upstream->upstream_subrequest_ev, upstream_subrequest_ev_handler, fsub);
-    ngx_http_complex_value(r, fsub->sub.cf->publisher_upstream_request_url, &fsub->publish_upstream->request_url);
-    
-    
+    ngx_http_complex_value(r, fsub->sub.cf->publisher_upstream_request_url, url);
+    fsub->publisher.upstream_request_url = url;
   }
   else {
-    fsub->publish_upstream = NULL;
+    fsub->publisher.upstream_request_url = NULL;
   }
   
   websocket_init_frame(&fsub->frame);
@@ -749,6 +810,9 @@ subscriber_t *websocket_subscriber_create(ngx_http_request_t *r, nchan_msg_id_t
   
 fail: 
   if(fsub) {
+    if(fsub->cln) {
+      fsub->cln->data = NULL;
+    }
     ngx_free(fsub);
   }
   ERR("%s", (u_char *)err);
@@ -765,54 +829,122 @@ ngx_int_t websocket_subscriber_destroy(subscriber_t *sub) {
   if(sub->reserved > 0) {
     DBG("%p not ready to destroy (reserved for %i) for req %p", sub, sub->reserved, fsub->sub.request);
     fsub->awaiting_destruction = 1;
+    sub->status = DEAD;
   }
   else {
     DBG("%p destroy for req %p", sub, fsub->sub.request);
 #if NCHAN_SUBSCRIBER_LEAK_DEBUG
     subscriber_debug_remove(&fsub->sub);
 #endif
-    clean_after_upstream_response(fsub, 0);
+
     websocket_delete_timers(fsub);
     nchan_free_msg_id(&sub->last_msgid);
-    //debug 
-    DBG("Begone, websocket %p", fsub);
-    ngx_memset(fsub, 0x13, sizeof(*fsub));
+    //ngx_memset(fsub, 0x13, sizeof(*fsub));
+    ws_destroy_msgpool(fsub);
+    if(fsub->deflate.zstream_in) {
+      inflateEnd(fsub->deflate.zstream_in);
+      ngx_free(fsub->deflate.zstream_in);
+      fsub->deflate.zstream_in = NULL;
+    }
+    
+    nchan_subscriber_subrequest_cleanup(sub);
     ngx_free(fsub);
   }
   return NGX_OK;
 }
 
-static void websocket_perform_handshake(full_subscriber_t *fsub) {
+static ngx_int_t extract_deflate_window_bits(full_subscriber_t *fsub, u_char *lcur, u_char *lend, const char* setting_name, int8_t *bits_out) {
+  ngx_int_t bits;
+  u_char    *ltmp;
+  if((ltmp = ngx_strnstr(lcur, (char *)setting_name, lend - lcur)) != NULL) {
+    ltmp += strlen(setting_name); //strlen
+    if(*ltmp == '=') ltmp++;
+    if(*ltmp == '"') ltmp++;
+    u_char    *nend = ltmp;
+    while(nend <= lend && *nend >='0' && *nend <='9') nend++;
+    if(nend - ltmp == 0) {
+      //no value, don't set
+      return NGX_OK;
+    }
+    bits = ngx_atoi(ltmp, nend - ltmp);
+    switch (bits) {
+      case NGX_ERROR: //bad value
+        return NGX_ERROR;
+      case DEFLATE_MIN_WINDOW_BITS ... DEFLATE_MAX_WINDOW_BITS:
+        *bits_out = bits;
+        return NGX_OK;
+      default:
+        return NGX_ERROR; //out of range
+    }
+  }
+  return NGX_OK;
+}
+
+static ngx_int_t respond_with_error(full_subscriber_t *fsub, const char* msg) {
+  fsub->sub.dequeue_after_response = 1;
+  fsub->sub.request->header_only = 0;
+  nchan_respond_sprintf(fsub->sub.request, NGX_HTTP_BAD_REQUEST, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, 1, "%s", msg);
+  return NGX_ERROR;
+}
+  
+static ngx_int_t websocket_perform_handshake(full_subscriber_t *fsub) {
   static ngx_str_t    magic = ngx_string("258EAFA5-E914-47DA-95CA-C5AB0DC85B11");
   ngx_str_t           ws_accept_key, sha1_str;
   u_char              buf_sha1[21];
   u_char              buf[255];
+  u_char              permessage_deflate_buf[128];
   ngx_str_t          *tmp, *ws_key, *subprotocols;
   ngx_int_t           ws_version;
   ngx_http_request_t *r = fsub->sub.request;
   
+  nchan_main_conf_t  *mcf = ngx_http_get_module_main_conf(r, ngx_nchan_module);
+  int server_window_bits = mcf->zlib_params.windowBits;
+  
+  ngx_str_t          *which_deflate_extension = NULL;
+  static ngx_str_t permessage_deflate = ngx_string("permessage-deflate");
+  static ngx_str_t perframe_deflate = ngx_string("deflate-frame");
+  static ngx_str_t webkit_perframe_deflate = ngx_string("x-webkit-deflate-frame");
+  
+  permessage_deflate_t pmd;
+#if (NGX_ZLIB)
+  pmd.zstream_in = NULL;
+#endif
+  pmd.server_max_window_bits = NGX_CONF_UNSET;
+  pmd.client_max_window_bits = NGX_CONF_UNSET;
+  pmd.server_no_context_takeover = 0;
+  pmd.client_no_context_takeover = 0;
+  pmd.enabled = 0;
+  
   ngx_sha1_t          sha1;
   
   ws_accept_key.data = buf;
   
   r->headers_out.content_length_n = 0;
-  r->header_only = 1;  
+  r->chunked = 0;
+  r->header_only = 1;
   
   if((tmp = nchan_get_header_value(r, NCHAN_HEADER_SEC_WEBSOCKET_VERSION)) == NULL) {
-    r->headers_out.status = NGX_HTTP_BAD_REQUEST;
     fsub->sub.dequeue_after_response=1;
+    r->header_only = 0;
+    nchan_respond_cstring(r, NGX_HTTP_BAD_REQUEST, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, "No Sec-Websocket-Version header present", 1);
+    return NGX_ERROR;
   }
   else {
     ws_version=ngx_atoi(tmp->data, tmp->len);
     if(ws_version != 13) {
-      r->headers_out.status = NGX_HTTP_BAD_REQUEST;
+      //only websocket version 13 (RFC 6455) is supported
       fsub->sub.dequeue_after_response=1;
+      r->header_only = 0;
+      nchan_respond_cstring(r, NGX_HTTP_BAD_REQUEST, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, "Unsupported websocket protocol version (only version 13 is supported)", 1);
+      return NGX_ERROR;
     }
   }
   
   if((ws_key = nchan_get_header_value(r, NCHAN_HEADER_SEC_WEBSOCKET_KEY)) == NULL) {
-    r->headers_out.status = NGX_HTTP_BAD_REQUEST;
     fsub->sub.dequeue_after_response=1;
+    r->header_only = 0;
+    nchan_respond_cstring(r, NGX_HTTP_BAD_REQUEST, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, "No Sec-Websocket-Key header present", 1);
+    return NGX_ERROR;
   }
   
   if((subprotocols = nchan_get_header_value(r, NCHAN_HEADERS_SEC_WEBSOCKET_PROTOCOL)) != NULL) {
@@ -829,36 +961,163 @@ static void websocket_perform_handshake(full_subscriber_t *fsub) {
     }
   }
   
-  if(r->headers_out.status != NGX_HTTP_BAD_REQUEST) {
-    //generate accept key
-    ngx_sha1_init(&sha1);
-    ngx_sha1_update(&sha1, ws_key->data, ws_key->len);
-    ngx_sha1_update(&sha1, magic.data, magic.len);
-    ngx_sha1_final(buf_sha1, &sha1);
-    sha1_str.len=20;
-    sha1_str.data=buf_sha1;
+  if((tmp = nchan_get_header_value(r, NCHAN_HEADER_SEC_WEBSOCKET_EXTENSIONS)) != NULL) {
+    
+    u_char      *cur = tmp->data, *end = tmp->data + tmp->len;
+    u_char      *lcur, *lend;
     
-    ws_accept_key.len=ngx_base64_encoded_length(sha1_str.len);
-    assert(ws_accept_key.len < 255);
-    ngx_encode_base64(&ws_accept_key, &sha1_str);
+    if(nchan_strscanstr(&cur, &permessage_deflate, end)) {
+      which_deflate_extension = &permessage_deflate;
+    }
+    else if(nchan_strscanstr(&cur, &webkit_perframe_deflate, end)) {
+      which_deflate_extension = &webkit_perframe_deflate;
+    }
+    else if(nchan_strscanstr(&cur, &perframe_deflate, end)) {
+      which_deflate_extension = &perframe_deflate;
+    }
+
+    if(which_deflate_extension) {
+      lcur = cur;
+      lend = memchr(lcur, ',', end - lcur); 
+      if(lend == NULL) lend = end;
+      
+      pmd.enabled = 1;
+      
+      pmd.client_no_context_takeover = ngx_strnstr(lcur, "client_no_context_takeover", lend - lcur) != NULL ? 1 : 0;
+      pmd.server_no_context_takeover = ngx_strnstr(lcur, "server_no_context_takeover", lend - lcur) != NULL ? 1 : 0;
+      
+      if(which_deflate_extension == &permessage_deflate) {
+        if(extract_deflate_window_bits(fsub, lcur, lend, "client_max_window_bits", &pmd.client_max_window_bits) != NGX_OK) {
+          return respond_with_error(fsub, "invalid client_max_window_bits permessage-deflate setting");
+        }
+        if(extract_deflate_window_bits(fsub, lcur, lend, "server_max_window_bits", &pmd.server_max_window_bits) != NGX_OK) {
+          return respond_with_error(fsub, "invalid server_max_window_bits permessage-deflate setting");
+        }
+      }
+      else if(which_deflate_extension == &webkit_perframe_deflate || which_deflate_extension == &perframe_deflate) {
+        if(extract_deflate_window_bits(fsub, lcur, lend, "max_window_bits", &pmd.server_max_window_bits) == NGX_OK) {
+          pmd.client_max_window_bits = pmd.server_max_window_bits;
+        }
+        else {
+          return respond_with_error(fsub, "invalid max_window_bits perframe-deflate setting");
+        }
+      }
+    }
+  }
+  
+  //generate permessage-deflate headers
+  if(pmd.enabled) {
+    u_char *ws_ext_end;
+    ngx_str_t ws_extensions;
+    ws_extensions.data = permessage_deflate_buf;
     
-    nchan_include_access_control_if_needed(r, fsub->ctx);
-    nchan_add_response_header(r, &NCHAN_HEADER_SEC_WEBSOCKET_ACCEPT, &ws_accept_key);
-    nchan_add_response_header(r, &NCHAN_HEADER_UPGRADE, &NCHAN_WEBSOCKET);
+    if(which_deflate_extension == &webkit_perframe_deflate || which_deflate_extension == &perframe_deflate) {
+      ws_ext_end = ngx_snprintf(permessage_deflate_buf, 128, "%V; ", which_deflate_extension);
+      if (pmd.server_max_window_bits != NGX_CONF_UNSET) {
+        if(pmd.server_max_window_bits < server_window_bits) {
+          return respond_with_error(fsub, "max_window_bits perframe-deflate is too small");
+        }
+        pmd.server_max_window_bits = server_window_bits; //always the configured window bits
+        ws_ext_end = ngx_snprintf(ws_ext_end, (permessage_deflate_buf + 128 - ws_ext_end),
+                                  "max_window_bits=%i; ",
+                                  pmd.server_max_window_bits);
+      }
+      else {
+        pmd.server_max_window_bits = pmd.client_max_window_bits = server_window_bits;
+      }
+    }
+    else {
+      ws_ext_end = ngx_snprintf(permessage_deflate_buf, 128, "%V; %s%s", 
+                                which_deflate_extension,
+                                pmd.server_no_context_takeover ? "server_no_context_takeover; " : "",
+                                pmd.client_no_context_takeover ? "client_no_context_takeover; " : "");
+      if (pmd.server_max_window_bits != NGX_CONF_UNSET) {
+        if(pmd.server_max_window_bits < server_window_bits) {
+          return respond_with_error(fsub, "server_max_window_bits perframe-deflate is too small");
+        }
+        pmd.server_max_window_bits = server_window_bits; //always the configured window bits
+        ws_ext_end = ngx_snprintf(ws_ext_end, (permessage_deflate_buf + 128 - ws_ext_end), "server_max_window_bits=%i; ", pmd.server_max_window_bits);
+      }
+      else {
+        pmd.server_max_window_bits = server_window_bits;
+      }
+      
+      if (pmd.client_max_window_bits != NGX_CONF_UNSET) {
+        ws_ext_end = ngx_snprintf(ws_ext_end, (permessage_deflate_buf + 128 - ws_ext_end), "client_max_window_bits=%i; ", pmd.client_max_window_bits);
+      }
+      else {
+        pmd.client_max_window_bits = DEFLATE_DEFAULT_CLIENT_WINDOW_BITS;
+      }
+    }
+    ws_extensions.len = ws_ext_end - permessage_deflate_buf - 2; //-2 for the trailing "; "
+    nchan_add_response_header(r, &NCHAN_HEADER_SEC_WEBSOCKET_EXTENSIONS, &ws_extensions);
+  }
+  fsub->deflate = pmd;
+
+  //generate accept key
+  ngx_sha1_init(&sha1);
+  ngx_sha1_update(&sha1, ws_key->data, ws_key->len);
+  ngx_sha1_update(&sha1, magic.data, magic.len);
+  ngx_sha1_final(buf_sha1, &sha1);
+  sha1_str.len=20;
+  sha1_str.data=buf_sha1;
+  
+  ws_accept_key.len=ngx_base64_encoded_length(sha1_str.len);
+  assert(ws_accept_key.len < 255);
+  ngx_encode_base64(&ws_accept_key, &sha1_str);
+  
+  nchan_include_access_control_if_needed(r, fsub->ctx);
+  nchan_add_response_header(r, &NCHAN_HEADER_SEC_WEBSOCKET_ACCEPT, &ws_accept_key);
+  nchan_add_response_header(r, &NCHAN_HEADER_UPGRADE, &NCHAN_WEBSOCKET);
 #if nginx_version < 1003013
-    nchan_add_response_header(r, &NCHAN_HEADER_CONNECTION, &NCHAN_UPGRADE);
+  nchan_add_response_header(r, &NCHAN_HEADER_CONNECTION, &NCHAN_UPGRADE);
 #endif
-    r->headers_out.status_line = NCHAN_HTTP_STATUS_101;
-    r->headers_out.status = NGX_HTTP_SWITCHING_PROTOCOLS;
-    
-    r->keepalive=0; //apparently, websocket must not use keepalive.
-  }
+  r->headers_out.status_line = NCHAN_HTTP_STATUS_101;
+  r->headers_out.status = NGX_HTTP_SWITCHING_PROTOCOLS;
+  
+  r->keepalive=0; //apparently, websocket must not use keepalive.
   
   ngx_http_send_header(r);
+  return NGX_OK;
 }
 
 static void websocket_reading(ngx_http_request_t *r);
 
+static ngx_buf_t *websocket_inflate_message(full_subscriber_t *fsub, ngx_buf_t *msgbuf, ngx_pool_t *pool) {
+#if (NGX_ZLIB)
+  z_stream      *strm;
+  int            rc;
+  ngx_buf_t     *outbuf;
+  
+  if(fsub->deflate.zstream_in == NULL) {
+    if((fsub->deflate.zstream_in = ngx_calloc(sizeof(*strm), ngx_cycle->log)) == NULL) {
+      nchan_log_error("couldn't allocate deflate stream.");
+      return NULL;
+    }
+    strm = fsub->deflate.zstream_in;
+    
+    strm->zalloc = Z_NULL;
+    strm->zfree = Z_NULL;
+    strm->opaque = Z_NULL;
+    
+    rc = inflateInit2(strm, -fsub->deflate.client_max_window_bits);
+    
+    if(rc != Z_OK) {
+      nchan_log_error("couldn't initialize inflate stream.");
+      ngx_free(strm);
+      fsub->deflate.zstream_in = NULL;
+      return NULL;
+    }
+  }
+  
+  strm = fsub->deflate.zstream_in;
+  
+  outbuf = nchan_inflate(strm, msgbuf, fsub->sub.request, pool);
+  return outbuf;
+#else
+  return NULL;
+#endif
+}
 
 static void ensure_request_hold(full_subscriber_t *fsub) {
   if(fsub->holding == 0) {
@@ -872,12 +1131,15 @@ static void ensure_request_hold(full_subscriber_t *fsub) {
 static ngx_int_t ensure_handshake(full_subscriber_t *fsub) {
   if(fsub->shook_hands == 0) {
     ensure_request_hold(fsub);
-    websocket_perform_handshake(fsub);
-    fsub->shook_hands = 1;
-    fsub->connected = 1;
-    return NGX_OK;
+    if(websocket_perform_handshake(fsub) == NGX_OK) {
+      fsub->shook_hands = 1;
+      return NGX_OK;
+    }
+    else {
+      return NGX_ERROR;
+    }
   }
-  return NGX_DECLINED;
+  return NGX_OK;
 }
 
 static ngx_int_t websocket_reserve(subscriber_t *self) {
@@ -889,9 +1151,9 @@ static ngx_int_t websocket_reserve(subscriber_t *self) {
 }
 static ngx_int_t websocket_release(subscriber_t *self, uint8_t nodestroy) {
   full_subscriber_t  *fsub = (full_subscriber_t  *)self;
+  //DBG("%p release for req %p, reservations: %i", self, fsub->sub.request, self->reserved);
   assert(self->reserved > 0);
   self->reserved--;
-  //DBG("%p release for req %p, reservations: %i", self, fsub->sub.request, self->reserved);
   if(nodestroy == 0 && fsub->awaiting_destruction == 1 && self->reserved == 0) {
     websocket_subscriber_destroy(self);
     return NGX_ABORT;
@@ -920,7 +1182,10 @@ static void ping_ev_handler(ngx_event_t *ev) {
 
 static ngx_int_t websocket_enqueue(subscriber_t *self) {
   full_subscriber_t  *fsub = (full_subscriber_t  *)self;
-  ensure_handshake(fsub);
+  ngx_int_t           rc;
+  if((rc = ensure_handshake(fsub)) != NGX_OK) {
+    return rc;
+  }
   self->enqueued = 1;
   
   if(self->cf->websocket_ping_interval > 0) {
@@ -950,11 +1215,6 @@ static void websocket_delete_timers(full_subscriber_t *fsub) {
   if(fsub->timeout_ev.timer_set) {
     ngx_del_timer(&fsub->timeout_ev);
   }
-  if(fsub->publish_upstream) {
-    if(fsub->publish_upstream->upstream_subrequest_ev.timer_set) {
-      ngx_del_timer(&fsub->publish_upstream->upstream_subrequest_ev);
-    }
-  }
 }
 
 static ngx_int_t websocket_dequeue(subscriber_t *self) {
@@ -964,9 +1224,8 @@ static ngx_int_t websocket_dequeue(subscriber_t *self) {
   
   self->enqueued = 0;
   
-  if(fsub->connected) {
-    ngx_str_t          close_msg = ngx_string("410 Gone");
-    websocket_send_close_frame(fsub, CLOSE_NORMAL, &close_msg);
+  if(!fsub->sent_close_frame && fsub->shook_hands) {
+    websocket_send_close_frame_cstr(fsub, CLOSE_NORMAL, "410 Gone");
   }
   
   websocket_delete_timers(fsub);
@@ -1008,17 +1267,6 @@ static ngx_int_t ws_recv(ngx_connection_t *c, ngx_event_t *rev, ngx_buf_t *buf,
   return NGX_OK;
 }
 
-static uint64_t ws_ntohll(uint64_t value) {
-  int num = 42;
-  if (*(char *)&num == 42) {
-    uint32_t high_part = ntohl((uint32_t)(value >> 32));
-    uint32_t low_part = ntohl((uint32_t)(value & 0xFFFFFFFFLL));
-    return (((uint64_t)low_part) << 32) | high_part;
-  } else {
-    return value;
-  }
-}
-
 static void set_buffer(ngx_buf_t *buf, u_char *start, u_char *last, ssize_t len) {
   ngx_memzero(buf, sizeof(*buf));
   buf->start = start;
@@ -1029,19 +1277,10 @@ static void set_buffer(ngx_buf_t *buf, u_char *start, u_char *last, ssize_t len)
   buf->memory = 1;
 }
 
-#define maybe_close_pool(pool) \
-  if (pool != NULL) {          \
-    ngx_destroy_pool(pool);    \
-    pool = NULL;               \
-  }
-
-static void websocket_reading_finalize(ngx_http_request_t *r, ngx_pool_t *temp_pool) {
+static void websocket_reading_finalize(ngx_http_request_t *r) {
   nchan_request_ctx_t        *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
   full_subscriber_t          *fsub = (full_subscriber_t *)ctx->sub;
   
-  maybe_close_pool(temp_pool);
-  
-  //fsub->connected = 0;
   //fsub->sub.status = DEAD;
   if(fsub) {
     websocket_delete_timers(fsub);
@@ -1054,38 +1293,46 @@ static void websocket_reading_finalize(ngx_http_request_t *r, ngx_pool_t *temp_p
  * thanks, guys!
 */
 static void websocket_reading(ngx_http_request_t *r) {
-  nchan_request_ctx_t        *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
-  full_subscriber_t          *fsub = (full_subscriber_t *)ctx->sub;
-  ws_frame_t                 *frame = &fsub->frame;
-  ngx_int_t                   rc = NGX_OK;
+  nchan_request_ctx_t        *ctx;
+  full_subscriber_t          *fsub;
+  ws_frame_t                 *frame;
+  ngx_int_t                   rc;
   ngx_event_t                *rev;
   ngx_connection_t           *c;
-  ngx_buf_t                   buf;
-  ngx_pool_t                 *temp_pool = NULL;
-  int                         free_temp_pool = 1;
-  ngx_buf_t                   msgbuf;
-  //ngx_str_t                   msg_in_str;
-  int                         close_code;
-  ngx_str_t                   close_reason;
+  ngx_buf_t                  *msgbuf, buf;
+  //ngx_str_t                 msg_in_str;
+retry:
+  ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  fsub = (full_subscriber_t *)ctx->sub;
+  frame = &fsub->frame;
+  rc = NGX_OK;
+
+  c = r->connection;
+  rev = c->read;
+  
+  if(!fsub) {
+    nchan_http_finalize_request(r, NGX_OK);
+    return;
+  }
   
   set_buffer(&buf, frame->header, frame->last, 8);
 
   //DBG("websocket_reading fsub: %p, frame: %p", fsub, frame);
   
-  c = r->connection;
-  rev = c->read;
+
 
   for (;;) {
     if (c->error || c->timedout || c->close || c->destroyed || rev->closed || rev->eof || rev->pending_eof) {
       //ERR("c->error %i c->timedout %i c->close %i c->destroyed %i rev->closed %i rev->eof %i", c->error, c->timedout, c->close, c->destroyed, rev->closed, rev->eof);
-      fsub->connected = 0;
-      return websocket_reading_finalize(r, temp_pool);
+      fsub->sub.request->headers_out.status = NGX_HTTP_CLIENT_CLOSED_REQUEST;
+      return websocket_reading_finalize(r);
     }
     
     switch (frame->step) {
       case WEBSOCKET_READ_START_STEP:
         //reading frame header
         if ((rc = ws_recv(c, rev, &buf, 2)) != NGX_OK) {
+          fsub->sub.request->headers_out.status = NGX_HTTP_CLIENT_CLOSED_REQUEST;
           goto exit;
         }
         
@@ -1117,7 +1364,7 @@ static void websocket_reading(ngx_http_request_t *r) {
               goto exit;
             }
             ngx_memcpy(&len, frame->header, 8);
-            frame->payload_len = ws_ntohll(len);
+            frame->payload_len = nchan_ntohll(len);
             break;
         }
         
@@ -1136,103 +1383,169 @@ static void websocket_reading(ngx_http_request_t *r) {
         break;
       
       case WEBSOCKET_READ_GET_PAYLOAD_STEP:
-        if ((frame->opcode != WEBSOCKET_OPCODE_TEXT) && (frame->opcode != WEBSOCKET_OPCODE_CLOSE) && (frame->opcode != WEBSOCKET_OPCODE_PING) && (frame->opcode != WEBSOCKET_OPCODE_PONG)) {
-          websocket_send_frame(fsub, WEBSOCKET_CLOSE_LAST_FRAME_BYTE, 0, NULL);
-          return websocket_reading_finalize(r, temp_pool);
-        }
         
-        if (frame->payload_len > 0) {
-          //create a temporary pool to allocate temporary elements
-          if (temp_pool == NULL) {
-            if ((temp_pool = ngx_create_pool(NCHAN_WS_TMP_POOL_SIZE, r->connection->log)) == NULL) {
-              ERR("unable to allocate memory for temporary pool");
-              return websocket_reading_finalize(r, temp_pool);
-            }
-            if ((frame->payload = ngx_pcalloc(temp_pool, frame->payload_len)) == NULL) {
-              ERR("unable to allocate memory for payload");
-              return websocket_reading_finalize(r, temp_pool);
-            }
-            frame->last = frame->payload;
-          }
-          
-          set_buffer(&buf, frame->payload, frame->last, frame->payload_len);
-          
-          if ((rc = ws_recv(c, rev, &buf, frame->payload_len)) != NGX_OK) {
-            ERR("ws_recv NOT OK when receiving payload");
-            goto exit;
-          }
-          
-          if (frame->mask) {
-            websocket_unmask_frame(frame);
-          }
-        }
-        frame->step = WEBSOCKET_READ_START_STEP;
-        frame->last = NULL;
         switch(frame->opcode) {
-          case WEBSOCKET_OPCODE_TEXT:
-            if (!is_utf8(frame->payload, frame->payload_len)) {
-              return websocket_reading_finalize(r, temp_pool);
+          case WEBSOCKET_OPCODE_PING:
+          case WEBSOCKET_OPCODE_PONG:
+          case WEBSOCKET_OPCODE_CLOSE:
+            { //block-scope these vars
+              u_char                  payloadbuf[1024];
+              int                     close_code;
+              ngx_str_t               payload_str;
+              nchan_buf_and_chain_t  *bc;
+              
+              if (frame->payload_len == 0) {
+                frame->payload = NULL;
+              }
+              else if(frame->payload_len < 1024) {
+                frame->payload = payloadbuf;
+                frame->last = frame->payload;
+                set_buffer(&buf, frame->payload, frame->last, frame->payload_len);
+                if ((rc = ws_recv(c, rev, &buf, frame->payload_len)) != NGX_OK) {
+                  ERR("ws_recv NOT OK when receiving payload");
+                  goto exit;
+                }
+                if (frame->mask) {
+                  websocket_unmask_frame(frame);
+                }
+              }
+              else {
+                //ERROR: frame too big
+                websocket_send_close_frame(fsub, CLOSE_MESSAGE_TOO_BIG, NULL);
+                return websocket_reading_finalize(r);
+              }
+              
+              switch(frame->opcode) {
+                case WEBSOCKET_OPCODE_PING:
+                  bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, 1);
+                  DBG("%p got pinged", fsub);
+                  init_buf(&bc->buf, 1);
+                  payload_str.data = frame->payload;
+                  payload_str.len = frame->payload_len;
+                  set_buf_to_str(&bc->buf, &payload_str);
+                  websocket_send_frame(fsub, WEBSOCKET_PONG_LAST_FRAME_BYTE, frame->payload_len, &bc->chain);
+                  break;
+                
+                case WEBSOCKET_OPCODE_PONG:
+                  DBG("%p Got ponged", fsub);
+                  if(fsub->awaiting_pong) {
+                    fsub->awaiting_pong = 0;
+                  }
+                  // unsolicited pongs are ok too as per 
+                  // https://tools.ietf.org/html/rfc6455#page-37
+                  break;
+                
+                case WEBSOCKET_OPCODE_CLOSE:
+                  fsub->received_close_frame = 1;
+                  if(frame->payload_len >= 2) {
+                    ngx_memcpy(&close_code, frame->payload, 2);
+                    close_code = ntohs(close_code);
+                    payload_str.data = frame->payload + 2;
+                    payload_str.len = frame->payload_len - 2;
+                  }
+                  else {
+                    close_code = 0;
+                    payload_str.data = (u_char *)"";
+                    payload_str.len = 0;
+                  }
+                  DBG("%p wants to close (code %i reason \"%V\")", fsub, close_code, &payload_str);
+                  if(!fsub->sent_close_frame) {
+                    websocket_send_close_frame(fsub, close_code, &payload_str);
+                  }
+                  return websocket_reading_finalize(r);
+                  break; //good practice?
+              }
             }
-            //intentional fall-through
+            break;
+          case WEBSOCKET_OPCODE_TEXT:
           case WEBSOCKET_OPCODE_BINARY:
-            init_msg_buf(&msgbuf);
             
-            msgbuf.start = frame->payload;
-            msgbuf.pos = msgbuf.start;
-            msgbuf.end = msgbuf.start + frame->payload_len;
-            msgbuf.last = msgbuf.end;
+            if(!fsub->sub.cf->pub.websocket) {
+              websocket_send_close_frame_cstr(fsub, CLOSE_POLICY_VIOLATION, "Publishing not allowed.");
+              return websocket_reading_finalize(r);
+            }
             
-            //msg_in_str.data = msgbuf.pos;
-            //msg_in_str.len = frame->payload_len;
+            //TODO: check max websocket message length
+            if(frame->payload == NULL) {
+              if(ws_get_msgpool(fsub) == NULL) {
+                ERR("failed to get msgpool");
+                websocket_send_close_frame(fsub, CLOSE_INTERNAL_SERVER_ERROR, NULL);
+                return websocket_reading_finalize(r);
+              }
+              if((frame->payload = ngx_palloc(ws_get_msgpool(fsub), frame->payload_len == 0 ? 1 : frame->payload_len)) == NULL) {
+                ERR("failed to reserve payload len in tmp pool");
+                websocket_send_close_frame(fsub, CLOSE_INTERNAL_SERVER_ERROR, NULL);
+                ws_destroy_msgpool(fsub);
+                fsub->publisher.msg_pool = NULL;
+                return websocket_reading_finalize(r);
+              }
+              frame->last = frame->payload;
+            }
             
-            //ERR("we got data %V", &msg_in_str);
+            set_buffer(&buf, frame->payload, frame->last, frame->payload_len);
             
-            websocket_publish(fsub, &msgbuf);
-            break;
-          
-          case WEBSOCKET_OPCODE_PING:
-            DBG("%p got pinged", fsub);
-            websocket_send_frame(fsub, WEBSOCKET_PONG_LAST_FRAME_BYTE, 0, NULL);
-            break;
+            if (frame->payload_len > 0 && (rc = ws_recv(c, rev, &buf, frame->payload_len)) != NGX_OK) {
+              DBG("ws_recv NOT OK when receiving payload, but that's ok");
+              goto exit;
+            }
             
-          case WEBSOCKET_OPCODE_PONG:
-            DBG("%p Got ponged", fsub);
-            if(fsub->awaiting_pong) {
-              fsub->awaiting_pong = 0;
+            if (frame->mask) {
+              websocket_unmask_frame(frame);
             }
-            // unsolicited pongs are ok too as per 
-            // https://tools.ietf.org/html/rfc6455#page-37
-            break;
             
-          case WEBSOCKET_OPCODE_CLOSE:
-            if(frame->payload_len >= 2) {
-              ngx_memcpy(&close_code, frame->payload, 2);
-              close_code = ntohs(close_code);
-              close_reason.data = frame->payload + 2;
-              close_reason.len = frame->payload_len - 2;
+            if((msgbuf = ngx_palloc(ws_get_msgpool(fsub), sizeof(*msgbuf))) == NULL) {
+              ERR("failed to reserve payload msgbuf in tmp pool");
+              websocket_send_close_frame(fsub, CLOSE_INTERNAL_SERVER_ERROR, NULL);
+              ws_destroy_msgpool(fsub);
+              fsub->publisher.msg_pool = NULL;
+              return websocket_reading_finalize(r);
+            }
+            
+            init_msg_buf(msgbuf);
+            
+            msgbuf->start = frame->payload;
+            msgbuf->pos = msgbuf->start;
+            msgbuf->end = msgbuf->start + frame->payload_len;
+            msgbuf->last = msgbuf->end;
+            
+            //inflate message if needed
+            if(fsub->deflate.enabled && frame->rsv1) {
+              if((msgbuf = websocket_inflate_message(fsub, msgbuf, ws_get_msgpool(fsub))) == NULL) {
+                websocket_send_close_frame_cstr(fsub, CLOSE_INVALID_PAYLOAD, "Invalid permessage-deflate data");
+                ws_destroy_msgpool(fsub);
+                return websocket_reading_finalize(r);
+              }
+            }
+            
+            if (frame->opcode == WEBSOCKET_OPCODE_TEXT && !is_utf8(msgbuf)) {
+              ws_destroy_msgpool(fsub);
+              websocket_send_close_frame_cstr(fsub, CLOSE_INVALID_PAYLOAD, "Invalid text frame (not UTF8).");
+              return websocket_reading_finalize(r);
+            }
+            
+            if(websocket_heartbeat(fsub, msgbuf) != NGX_OK) {
+              websocket_publish(fsub, msgbuf, frame->opcode == WEBSOCKET_OPCODE_BINARY);
             }
             else {
-              close_code = 0;
-              close_reason.data = (u_char *)"";
-              close_reason.len = 0;
+              ws_destroy_msgpool(fsub);
             }
-            DBG("%p wants to close (code %i reason \"%V\")", fsub, close_code, &close_reason);
-            websocket_send_close_frame(fsub, 0, NULL);
-            maybe_close_pool(temp_pool);
-            return websocket_reading_finalize(r, temp_pool);
-            break; //good practice?
-        }
-        if(free_temp_pool && temp_pool != NULL) {
-          ngx_destroy_pool(temp_pool);
-          temp_pool = NULL;
+            break;
+          default:
+            //invalid frame or something
+            websocket_send_frame(fsub, WEBSOCKET_CLOSE_LAST_FRAME_BYTE, 0, NULL); //TODO: more specific close frame plz
+            return websocket_reading_finalize(r);
+            break;
         }
         
-        return websocket_reading(r);
+        frame->step = WEBSOCKET_READ_START_STEP; //restart loop
+        frame->last = NULL;
+        frame->payload = NULL;
+        goto retry; //I know, Dijkstra, I know.
         break;
         
       default:
         nchan_log(NGX_LOG_ERR, c->log, 0, "unknown websocket step (%d)", frame->step);
-        return websocket_reading_finalize(r, temp_pool);
+        return websocket_reading_finalize(r);
     }
     
     set_buffer(&buf, frame->header, NULL, 8);
@@ -1240,13 +1553,12 @@ static void websocket_reading(ngx_http_request_t *r) {
 
 exit:
   
-  maybe_close_pool(temp_pool);
   if (rc == NGX_AGAIN) {
     frame->last = buf.last;
     if (!c->read->ready) {
       if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
         nchan_log(NGX_LOG_INFO, c->log, ngx_socket_errno, "websocket client: failed to restore read events");
-        return websocket_reading_finalize(r, temp_pool);
+        return websocket_reading_finalize(r);
       }
     }
   }
@@ -1255,14 +1567,33 @@ static void websocket_reading(ngx_http_request_t *r) {
     rev->eof = 1;
     c->error = 1;
     nchan_log(NGX_LOG_INFO, c->log, ngx_socket_errno, "websocket client prematurely closed connection");
-    return websocket_reading_finalize(r, temp_pool);
+    return websocket_reading_finalize(r);
   }
 }
 
 
-static ngx_flag_t is_utf8(u_char *p, size_t n) {
+static ngx_flag_t is_utf8(ngx_buf_t *buf) {
+  
+  u_char *p;
+  size_t n;
+  
   u_char  c, *last;
   size_t  len;
+  int     mmapped = 0;
+  
+  if(ngx_buf_in_memory(buf)) {
+    n = ngx_buf_size(buf);
+    p = buf->pos;
+  }
+  else {
+    ngx_fd_t fd = buf->file->fd == NGX_INVALID_FILE ? nchan_fdcache_get(&buf->file->name) : buf->file->fd;
+    n = buf->file_last - buf->file_pos;
+    p = mmap(NULL, n, PROT_READ, MAP_SHARED, fd, buf->file_pos);
+    if (p == MAP_FAILED) {
+      return 0;
+    }
+    mmapped = 1;
+  }
   
   last = p + n;
   
@@ -1274,37 +1605,36 @@ static ngx_flag_t is_utf8(u_char *p, size_t n) {
       continue;
     }
     
-    if (ngx_utf8_decode(&p, n) > 0x10ffff) {
+    if (ngx_utf8_decode(&p, last - p) > 0x10ffff) {
       /* invalid UTF-8 */
+      if(mmapped) {
+        munmap(p, n);
+      }
       return 0;
     }
   }
+  if(mmapped) {
+    munmap(p, n);
+  }
   return 1;
 }
 
-uint64_t ws_htonll(uint64_t value) {
-  int num = 42;
-  if (*(char *)&num == 42) {
-    uint32_t high_part = htonl((uint32_t)(value >> 32));
-    uint32_t low_part = htonl((uint32_t)(value & 0xFFFFFFFFLL));
-    return (((uint64_t)low_part) << 32) | high_part;
-  } else {
-    return value;
+static void init_buf(ngx_buf_t *buf, int8_t last){
+  ngx_memzero(buf, sizeof(*buf));
+  buf->memory = 1;
+  if(last) {
+    buf->last_buf = 1;
+    buf->last_in_chain = 1;
+    buf->flush = 1;
   }
 }
 
-
 static void init_header_buf(ngx_buf_t *buf) {
-  ngx_memzero(buf, sizeof(*buf));
-  buf->memory = 1;
+  init_buf(buf, 0);
 }
 
 static void init_msg_buf(ngx_buf_t *buf) {
-  ngx_memzero(buf, sizeof(*buf));
-  buf->last_buf = 1;
-  buf->last_in_chain = 1;
-  buf->flush = 1;
-  buf->memory = 1;
+  init_buf(buf, 1);
 }
 
 static ngx_int_t websocket_frame_header(full_subscriber_t *fsub, ngx_buf_t *buf, const u_char opcode, off_t len) {
@@ -1316,7 +1646,6 @@ static ngx_int_t websocket_frame_header(full_subscriber_t *fsub, ngx_buf_t *buf,
   buf->start = last;
   *last = opcode;
   last++;
-  
   if (len <= 125) {
     last = ngx_copy(last, &len, 1);
     buf->end++;
@@ -1328,7 +1657,7 @@ static ngx_int_t websocket_frame_header(full_subscriber_t *fsub, ngx_buf_t *buf,
   }
   else {
     last = ngx_copy(last, &WEBSOCKET_PAYLOAD_LEN_64_BYTE, sizeof(WEBSOCKET_PAYLOAD_LEN_64_BYTE));
-    len_net = ws_htonll(len);
+    len_net = nchan_htonll(len);
     last = ngx_copy(last, &len_net, 8);
   }
   buf->end=last;
@@ -1378,87 +1707,153 @@ static ngx_int_t websocket_send_frame(full_subscriber_t *fsub, const u_char opco
 static ngx_chain_t *websocket_msg_frame_chain(full_subscriber_t *fsub, nchan_msg_t *msg) {
   nchan_buf_and_chain_t *bc;
   ngx_file_t            *file_copy;
-  ngx_buf_t             *chained_msgbuf;
-  size_t                 sz = ngx_buf_size((msg->buf));
+  ngx_buf_t             *chained_msgbuf = NULL;
+  size_t                 sz;
+  u_char                 frame_opcode;
+  int                    compressed;
+  ngx_buf_t             *msgbuf;
+  compressed = fsub->deflate.enabled && msg->compressed && msg->compressed->compression == NCHAN_MSG_COMPRESSION_WEBSOCKET_PERMESSAGE_DEFLATE;
+
+  msgbuf = compressed ? &msg->compressed->buf : &msg->buf;
+  sz = ngx_buf_size(msgbuf);
+  
+  if(msg->content_type && nchan_ngx_str_match(msg->content_type, &binary_mimetype)) {
+    frame_opcode = compressed ? WEBSOCKET_BINARY_DEFLATED_LAST_FRAME_BYTE : WEBSOCKET_BINARY_LAST_FRAME_BYTE;
+  }
+  else {
+    frame_opcode = compressed ? WEBSOCKET_TEXT_DEFLATED_LAST_FRAME_BYTE : WEBSOCKET_TEXT_LAST_FRAME_BYTE;
+  }
+  
   if(fsub->ws_meta_subprotocol) {
-    static ngx_str_t          id_line = ngx_string("id: ");
-    static ngx_str_t          content_type_line = ngx_string("\ncontent-type: ");
-    static ngx_str_t          two_newlines = ngx_string("\n\n");
-    ngx_chain_t              *cur;
-    ngx_str_t                 msgid;
-    bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, 4 + (msg->content_type.len > 0 ? 2 : 0));
-    cur = &bc->chain;
-    
-    // id: 
-    ngx_init_set_membuf(cur->buf, id_line.data, id_line.data + id_line.len);
-    sz += id_line.len;
-    cur = cur->next;
-    
-    //msgid value
-    msgid = nchan_subscriber_set_recyclable_msgid_str(fsub->ctx, &fsub->sub.last_msgid);
-    ngx_init_set_membuf(cur->buf, msgid.data, msgid.data + msgid.len);
-    sz += msgid.len;
-    cur = cur->next;
-    
-    if(msg->content_type.len > 0) {
-      // content-type: 
-      ngx_init_set_membuf(cur->buf, content_type_line.data, content_type_line.data + content_type_line.len);
-      sz += content_type_line.len;
+    if(!compressed) {
+      static ngx_str_t          id_line = ngx_string("id: ");
+      static ngx_str_t          content_type_line = ngx_string("\ncontent-type: ");
+      static ngx_str_t          two_newlines = ngx_string("\n\n");
+      ngx_chain_t              *cur;
+      ngx_str_t                 msgid;
+      bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, 4 + (msg->content_type ? 2 : 0));
+      cur = &bc->chain;
+      
+      // id: 
+      ngx_init_set_membuf(cur->buf, id_line.data, id_line.data + id_line.len);
+      sz += id_line.len;
       cur = cur->next;
       
-      //content-type value
-      ngx_init_set_membuf(cur->buf, msg->content_type.data, msg->content_type.data + msg->content_type.len);
-      sz += msg->content_type.len;
+      //msgid value
+      msgid = nchan_subscriber_set_recyclable_msgid_str(fsub->ctx, &fsub->sub.last_msgid);
+      ngx_init_set_membuf(cur->buf, msgid.data, msgid.data + msgid.len);
+      sz += msgid.len;
       cur = cur->next;
-    }
+      
+      if(msg->content_type) {
+        // content-type: 
+        ngx_init_set_membuf(cur->buf, content_type_line.data, content_type_line.data + content_type_line.len);
+        sz += content_type_line.len;
+        cur = cur->next;
+        
+        //content-type value
+        ngx_init_set_membuf(cur->buf, msg->content_type->data, msg->content_type->data + msg->content_type->len);
+        sz += msg->content_type->len;
+        cur = cur->next;
+      }
+      
+      // \n\n
+      ngx_init_set_membuf(cur->buf, two_newlines.data, two_newlines.data + two_newlines.len);
+      sz += two_newlines.len;
     
-    // \n\n
-    ngx_init_set_membuf(cur->buf, two_newlines.data, two_newlines.data + two_newlines.len);
-    sz += two_newlines.len;
-    cur = cur->next;
     
-    //now the message
-    *cur->buf = *msg->buf;
-    chained_msgbuf = cur->buf;
-    assert(cur->next == NULL);
+      if(ngx_buf_size(msgbuf) > 0) {
+        cur = cur->next;
+        //now the message
+        *cur->buf = *msgbuf;
+        chained_msgbuf = cur->buf;
+        assert(cur->next == NULL);
+      }
+      else {
+        cur->next = NULL;
+        cur->buf->last_in_chain = 1;
+        cur->buf->last_buf = 1;
+      }
+    }
+    else {
+#if (NGX_ZLIB)
+      u_char        ws_meta_header[512];
+      static u_char ws_meta_header_deflated[512];
+      ngx_chain_t  *cur;
+      u_char       *end;
+      ngx_str_t     ws_meta_header_str_in;
+      ngx_str_t     ws_meta_header_str_out;
+      
+      ws_meta_header_str_out.data = ws_meta_header_deflated;
+      ws_meta_header_str_out.len = 512;
+      
+      ngx_str_t     msgid = nchan_subscriber_set_recyclable_msgid_str(fsub->ctx, &fsub->sub.last_msgid);
+      if(msg->content_type) {
+        end = ngx_snprintf(ws_meta_header, 512, "id: %V\ncontent-type: %V\n\n", &msgid, msg->content_type);
+      }
+      else {
+        end = ngx_snprintf(ws_meta_header, 512, "id: %V\n\n", &msgid);
+      }
+      
+      ws_meta_header_str_in.data = ws_meta_header;
+      ws_meta_header_str_in.len = end - ws_meta_header;
+      
+      bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, 2);
+      cur = &bc->chain;
+      
+      nchan_common_simple_deflate_raw_block(&ws_meta_header_str_in, &ws_meta_header_str_out);
+      
+      ngx_init_set_membuf(cur->buf, ws_meta_header_str_out.data, ws_meta_header_str_out.data + ws_meta_header_str_out.len);
+      sz += ws_meta_header_str_out.len;
+      cur = cur->next;
+      
+      //now the message
+      *cur->buf = *msgbuf;
+      chained_msgbuf = cur->buf;
+#endif
+    }
   }
   else {
     bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, 1);
     //message first
     chained_msgbuf = &bc->buf;
-    bc->buf = *msg->buf;
+    bc->buf = *msgbuf;
   }
   
-  if(msg->buf->file) {
+  if(chained_msgbuf && msgbuf->file) {
     file_copy = nchan_bufchain_pool_reserve_file(fsub->ctx->bcp);
     nchan_msg_buf_open_fd_if_needed(chained_msgbuf, file_copy, NULL);
   }
   
+  //DBG("opcode: %i, orig sz: %i compressed sz: %i", frame_opcode, ngx_buf_size((&msg->buf)), compressed ? ngx_buf_size(msgbuf) : 0);
   //now the header
-  return websocket_frame_header_chain(fsub, WEBSOCKET_TEXT_LAST_FRAME_BYTE, sz, &bc->chain);
+  return websocket_frame_header_chain(fsub, frame_opcode, sz, &bc->chain);
+}
+
+static ngx_int_t websocket_send_close_frame_cstr(full_subscriber_t *fsub, uint16_t code, const char *err) {
+  ngx_str_t errstr=ngx_string(err);
+  return websocket_send_close_frame(fsub, code, &errstr);
 }
 
 static ngx_int_t websocket_send_close_frame(full_subscriber_t *fsub, uint16_t code, ngx_str_t *err) {
-  ws_output_filter(fsub, websocket_close_frame_chain(fsub, code, err));
-  fsub->connected = 0;
-  if(fsub->closing == 1) {
+  if(fsub->sent_close_frame == 1) {
     DBG("%p already sent close frame");
     websocket_finalize_request(fsub);
   }
   else {
-    fsub->closing = 1;
-    ngx_add_timer(&fsub->closing_ev, WEBSOCKET_CLOSING_TIMEOUT);
+    ws_output_filter(fsub, websocket_close_frame_chain(fsub, code, err));
+    fsub->sent_close_frame = 1;
+    ngx_add_timer(&fsub->closing_ev, fsub->received_close_frame ? 0 : WEBSOCKET_CLOSING_TIMEOUT);
   }
   return NGX_OK;
 }
 
 static ngx_chain_t *websocket_close_frame_chain(full_subscriber_t *fsub, uint16_t code, ngx_str_t *err) {
   nchan_buf_and_chain_t *bc; 
-  ngx_chain_t   *hdr_chain;
-  ngx_buf_t     *hdr_buf;
-  ngx_buf_t     *msg_buf;
-  ngx_str_t      alt_err;
-  uint16_t       code_net;
+  ngx_chain_t    *hdr_chain;
+  ngx_buf_t      *code_buf, *msg_buf;
+  ngx_str_t       alt_err;
+  static uint16_t code_net;
   
   if(err) {
     alt_err.data=err->data;
@@ -1474,30 +1869,43 @@ static ngx_chain_t *websocket_close_frame_chain(full_subscriber_t *fsub, uint16_
     return websocket_frame_header_chain(fsub, WEBSOCKET_CLOSE_LAST_FRAME_BYTE, 0, NULL);
   }
   
-  if(code < 1000 || code > 1011) {
+  if(code < 1000 || code == 1005 || code == 1006 || code >= 5000) {
     ERR("invalid websocket close status code %i", code);
     code=CLOSE_NORMAL;
-  }
-  bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, 1);
-  msg_buf = &bc->buf;
-  init_msg_buf(msg_buf);
-  set_buf_to_str(msg_buf, err);
-  hdr_chain = websocket_frame_header_chain(fsub, WEBSOCKET_CLOSE_LAST_FRAME_BYTE, err->len + 2, &bc->chain);
-  hdr_buf = hdr_chain->buf;
-  //there's definitely enough space at the end for 2 more bytes
+  }  
+  bc = nchan_bufchain_pool_reserve(fsub->ctx->bcp, err->len > 0 ? 2 : 1);
+  
+  code_buf = &bc->buf;
+  
+  init_buf(code_buf, err->len == 0);
   code_net=htons(code);
-  hdr_buf->last = ngx_copy(hdr_buf->last, &code_net, 2);
-  hdr_buf->end = hdr_buf->last;
+  code_buf->start = code_buf->pos = (u_char *)&code_net;
+  code_buf->last = code_buf->end = ngx_copy(code_buf->pos, &code_net, 2);
   
+  if(err->len > 0) {
+    if(err->len > 123) {
+      ERR("websocket close frame reason string is too long (length %i)", err->len);
+      err->len = 123;
+    }
+    msg_buf = bc->chain.next->buf;
+    init_msg_buf(msg_buf);
+    set_buf_to_str(msg_buf, err);
+  }
 
+  
+  hdr_chain = websocket_frame_header_chain(fsub, WEBSOCKET_CLOSE_LAST_FRAME_BYTE, err->len + 2, &bc->chain);
   return hdr_chain;
 }
 
 
 static ngx_int_t websocket_respond_message(subscriber_t *self, nchan_msg_t *msg) {
-  ngx_int_t        rc;
-  full_subscriber_t         *fsub = (full_subscriber_t *)self;
-  ensure_handshake(fsub);
+  ngx_int_t            rc;
+  full_subscriber_t   *fsub = (full_subscriber_t *)self;
+  if((rc = ensure_handshake(fsub)) != NGX_OK) {
+    return rc;
+  }
+  ngx_http_request_t *r = self->request;
+  r->header_only = 0;
   
   if(fsub->timeout_ev.timer_set) {
     ngx_del_timer(&fsub->timeout_ev);
@@ -1513,10 +1921,11 @@ static ngx_int_t websocket_respond_message(subscriber_t *self, nchan_msg_t *msg)
   return rc;
 }
 
-static ngx_int_t websocket_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line) {
+static ngx_int_t websocket_respond_status(subscriber_t *self, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body) {
   static const ngx_str_t    STATUS_410=ngx_string("410 Channel Deleted");
   static const ngx_str_t    STATUS_403=ngx_string("403 Forbidden");
   static const ngx_str_t    STATUS_500=ngx_string("500 Internal Server Error");
+  static const ngx_str_t    STATUS_507=ngx_string("507 Insufficient Storage");
   static const ngx_str_t    empty=ngx_string("");
   u_char                    msgbuf[50];
   ngx_str_t                 custom_close_msg;
@@ -1531,28 +1940,38 @@ static ngx_int_t websocket_respond_status(subscriber_t *self, ngx_int_t status_c
   
   if(!fsub->shook_hands) {
     //still in HTTP land
-    return nchan_respond_status(fsub->sub.request, status_code, status_line, 0);
+    fsub->cln = NULL;
+    return nchan_respond_status(fsub->sub.request, status_code, status_line, status_body, 1);
   }
   
   switch(status_code) {
     case 410:
       close_code = CLOSE_GOING_AWAY;
+      fsub->sub.request->headers_out.status = NGX_HTTP_GONE;
       close_msg = (ngx_str_t *)(status_line ? status_line : &STATUS_410);
       break;
     case 403:
       close_code = CLOSE_POLICY_VIOLATION;
+      fsub->sub.request->headers_out.status = NGX_HTTP_FORBIDDEN;
       close_msg = (ngx_str_t *)(status_line ? status_line : &STATUS_403);
       break;
     case 500: 
       close_code = CLOSE_INTERNAL_SERVER_ERROR;
+      fsub->sub.request->headers_out.status = NGX_HTTP_INTERNAL_SERVER_ERROR;
       close_msg = (ngx_str_t *)(status_line ? status_line : &STATUS_500);
       break;
+    case 507: 
+      close_code = CLOSE_INTERNAL_SERVER_ERROR;
+      fsub->sub.request->headers_out.status = NGX_HTTP_INSUFFICIENT_STORAGE;
+      close_msg = (ngx_str_t *)(status_line ? status_line : &STATUS_507);
+      break;
     default:
       if((status_code >= 400 && status_code < 600) || status_code == NGX_HTTP_NOT_MODIFIED) {
         custom_close_msg.data=msgbuf;
+        fsub->sub.request->headers_out.status = status_code;
         custom_close_msg.len = ngx_sprintf(msgbuf,"%i %v", status_code, (status_line ? status_line : &empty)) - msgbuf;
         close_msg = &custom_close_msg;
-        close_code = CLOSE_NORMAL;
+        close_code = status_code >=500 && status_code <= 599 ? CLOSE_INTERNAL_SERVER_ERROR : CLOSE_NORMAL;
       }
       else {
         ERR("unhandled code %i, %v", status_code, (status_line ? status_line : &empty));
@@ -1585,6 +2004,12 @@ ngx_int_t nchan_detect_websocket_request(ngx_http_request_t *r) {
   return 1;
 }
 
+ngx_int_t websocket_intercept_published_message(subscriber_t *sub, void (*interceptor)(subscriber_t *, nchan_msg_t *)) {
+  full_subscriber_t  *fsub = (full_subscriber_t  *)sub;
+  fsub->publisher.intercept = interceptor;
+  return NGX_OK;
+}
+
 static const subscriber_fn_t websocket_fn = {
   &websocket_enqueue,
   &websocket_dequeue,
@@ -1607,12 +2032,13 @@ static const subscriber_t new_websocket_sub = {
   NCHAN_ZERO_MSGID,
   NULL,
   NULL,
+  NULL,
   0, //reserved
+  1, //enable sub/unsub callbacks
   0, //deque after response
   1, //destroy after dequeue
   0, //enqueued
 #if NCHAN_SUBSCRIBER_LEAK_DEBUG
-  NULL,
-  NULL
+  NULL, NULL, NULL
 #endif
 };
diff --git a/debian/modules/nchan/src/subscribers/websocket.h b/debian/modules/nchan/src/subscribers/websocket.h
index ff15b24f..034b0b50 100644
--- a/debian/modules/nchan/src/subscribers/websocket.h
+++ b/debian/modules/nchan/src/subscribers/websocket.h
@@ -1,4 +1,5 @@
 subscriber_t *websocket_subscriber_create(ngx_http_request_t *r, nchan_msg_id_t *msg_id);
 ngx_int_t websocket_subscriber_destroy(subscriber_t *sub);
+ngx_int_t websocket_intercept_published_message(subscriber_t *sub, void (*)(subscriber_t *, nchan_msg_t *));
 
-ngx_int_t nchan_detect_websocket_request(ngx_http_request_t *r);
\ No newline at end of file
+ngx_int_t nchan_detect_websocket_request(ngx_http_request_t *r);
diff --git a/debian/modules/nchan/src/uthash.h b/debian/modules/nchan/src/uthash.h
index 375f9e4a..91db592e 100644
--- a/debian/modules/nchan/src/uthash.h
+++ b/debian/modules/nchan/src/uthash.h
@@ -1,5 +1,5 @@
 /*
-Copyright (c) 2003-2014, Troy D. Hanson     http://troydhanson.github.com/uthash/
+Copyright (c) 2003-2017, Troy D. Hanson     http://troydhanson.github.com/uthash/
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
@@ -22,59 +22,78 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 
 #ifndef UTHASH_H
-#define UTHASH_H 
+#define UTHASH_H
 
-#include <string.h>   /* memcmp,strlen */
+#define UTHASH_VERSION 2.0.2
+
+#include <string.h>   /* memcmp, memset, strlen */
 #include <stddef.h>   /* ptrdiff_t */
-#include <stdlib.h>   /* exit() */
+#include <stdlib.h>   /* exit */
 
 /* These macros use decltype or the earlier __typeof GNU extension.
    As decltype is only available in newer compilers (VS2010 or gcc 4.3+
    when compiling c++ source) this code uses whatever method is needed
    or, for VS2008 where neither is available, uses casting workarounds. */
-#ifdef _MSC_VER         /* MS compiler */
+#if !defined(DECLTYPE) && !defined(NO_DECLTYPE)
+#if defined(_MSC_VER)   /* MS compiler */
 #if _MSC_VER >= 1600 && defined(__cplusplus)  /* VS2010 or newer in C++ mode */
 #define DECLTYPE(x) (decltype(x))
 #else                   /* VS2008 or older (or VS2010 in C mode) */
 #define NO_DECLTYPE
-#define DECLTYPE(x)
 #endif
+#elif defined(__BORLANDC__) || defined(__ICCARM__) || defined(__LCC__) || defined(__WATCOMC__)
+#define NO_DECLTYPE
 #else                   /* GNU, Sun and other compilers */
 #define DECLTYPE(x) (__typeof(x))
 #endif
+#endif
 
 #ifdef NO_DECLTYPE
+#define DECLTYPE(x)
 #define DECLTYPE_ASSIGN(dst,src)                                                 \
 do {                                                                             \
   char **_da_dst = (char**)(&(dst));                                             \
   *_da_dst = (char*)(src);                                                       \
-} while(0)
-#else 
+} while (0)
+#else
 #define DECLTYPE_ASSIGN(dst,src)                                                 \
 do {                                                                             \
   (dst) = DECLTYPE(dst)(src);                                                    \
-} while(0)
+} while (0)
 #endif
 
-/* a number of the hash function use uint32_t which isn't defined on win32 */
-#ifdef _MSC_VER
+/* a number of the hash function use uint32_t which isn't defined on Pre VS2010 */
+#if defined(_WIN32)
+#if defined(_MSC_VER) && _MSC_VER >= 1600
+#include <stdint.h>
+#elif defined(__WATCOMC__) || defined(__MINGW32__) || defined(__CYGWIN__)
+#include <stdint.h>
+#else
 typedef unsigned int uint32_t;
 typedef unsigned char uint8_t;
+#endif
+#elif defined(__GNUC__) && !defined(__VXWORKS__)
+#include <stdint.h>
 #else
-#include <inttypes.h>   /* uint32_t */
+typedef unsigned int uint32_t;
+typedef unsigned char uint8_t;
 #endif
 
-#define UTHASH_VERSION 1.9.9
-
-#ifndef uthash_fatal
-#define uthash_fatal(msg) exit(-1)        /* fatal error (out of memory,etc) */
-#endif
 #ifndef uthash_malloc
 #define uthash_malloc(sz) malloc(sz)      /* malloc fcn                      */
 #endif
 #ifndef uthash_free
 #define uthash_free(ptr,sz) free(ptr)     /* free fcn                        */
 #endif
+#ifndef uthash_bzero
+#define uthash_bzero(a,n) memset(a,'\0',n)
+#endif
+#ifndef uthash_memcmp
+#define uthash_memcmp(a,b,n) memcmp(a,b,n)
+#endif
+#ifndef uthash_strlen
+#define uthash_strlen(s) strlen(s)
+#endif
 
 #ifndef uthash_noexpand_fyi
 #define uthash_noexpand_fyi(tbl)          /* can be defined to log noexpand  */
@@ -83,122 +102,335 @@ typedef unsigned char uint8_t;
 #define uthash_expand_fyi(tbl)            /* can be defined to log expands   */
 #endif
 
+#ifndef HASH_NONFATAL_OOM
+#define HASH_NONFATAL_OOM 0
+#endif
+
+#if HASH_NONFATAL_OOM
+/* malloc failures can be recovered from */
+
+#ifndef uthash_nonfatal_oom
+#define uthash_nonfatal_oom(obj) do {} while (0)    /* non-fatal OOM error */
+#endif
+
+#define HASH_RECORD_OOM(oomed) do { (oomed) = 1; } while (0)
+#define IF_HASH_NONFATAL_OOM(x) x
+
+#else
+/* malloc failures result in lost memory, hash tables are unusable */
+
+#ifndef uthash_fatal
+#define uthash_fatal(msg) exit(-1)        /* fatal OOM error */
+#endif
+
+#define HASH_RECORD_OOM(oomed) uthash_fatal("out of memory")
+#define IF_HASH_NONFATAL_OOM(x)
+
+#endif
+
 /* initial number of buckets */
-#define HASH_INITIAL_NUM_BUCKETS 32      /* initial number of buckets        */
-#define HASH_INITIAL_NUM_BUCKETS_LOG2 5  /* lg2 of initial number of buckets */
-#define HASH_BKT_CAPACITY_THRESH 10      /* expand when bucket count reaches */
+#define HASH_INITIAL_NUM_BUCKETS 32U     /* initial number of buckets        */
+#define HASH_INITIAL_NUM_BUCKETS_LOG2 5U /* lg2 of initial number of buckets */
+#define HASH_BKT_CAPACITY_THRESH 10U     /* expand when bucket count reaches */
 
-/* calculate the element whose hash handle address is hhe */
+/* calculate the element whose hash handle address is hhp */
 #define ELMT_FROM_HH(tbl,hhp) ((void*)(((char*)(hhp)) - ((tbl)->hho)))
+/* calculate the hash handle from element address elp */
+#define HH_FROM_ELMT(tbl,elp) ((UT_hash_handle *)(((char*)(elp)) + ((tbl)->hho)))
 
-#define HASH_FIND(hh,head,keyptr,keylen,out)                                     \
+#define HASH_ROLLBACK_BKT(hh, head, itemptrhh)                                   \
+do {                                                                             \
+  struct UT_hash_handle *_hd_hh_item = (itemptrhh);                              \
+  unsigned _hd_bkt;                                                              \
+  HASH_TO_BKT(_hd_hh_item->hashv, (head)->hh.tbl->num_buckets, _hd_bkt);         \
+  (head)->hh.tbl->buckets[_hd_bkt].count++;                                      \
+  _hd_hh_item->hh_next = NULL;                                                   \
+  _hd_hh_item->hh_prev = NULL;                                                   \
+} while (0)
+
+#define HASH_VALUE(keyptr,keylen,hashv)                                          \
+do {                                                                             \
+  HASH_FCN(keyptr, keylen, hashv);                                               \
+} while (0)
+
+#define HASH_FIND_BYHASHVALUE(hh,head,keyptr,keylen,hashval,out)                 \
 do {                                                                             \
-  unsigned _hf_bkt,_hf_hashv;                                                    \
-  out=NULL;                                                                      \
+  (out) = NULL;                                                                  \
   if (head) {                                                                    \
-     HASH_FCN(keyptr,keylen, (head)->hh.tbl->num_buckets, _hf_hashv, _hf_bkt);   \
-     if (HASH_BLOOM_TEST((head)->hh.tbl, _hf_hashv)) {                           \
-       HASH_FIND_IN_BKT((head)->hh.tbl, hh, (head)->hh.tbl->buckets[ _hf_bkt ],  \
-                        keyptr,keylen,out);                                      \
-     }                                                                           \
+    unsigned _hf_bkt;                                                            \
+    HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _hf_bkt);                  \
+    if (HASH_BLOOM_TEST((head)->hh.tbl, hashval) != 0) {                         \
+      HASH_FIND_IN_BKT((head)->hh.tbl, hh, (head)->hh.tbl->buckets[ _hf_bkt ], keyptr, keylen, hashval, out); \
+    }                                                                            \
   }                                                                              \
 } while (0)
 
+#define HASH_FIND(hh,head,keyptr,keylen,out)                                     \
+do {                                                                             \
+  unsigned _hf_hashv;                                                            \
+  HASH_VALUE(keyptr, keylen, _hf_hashv);                                         \
+  HASH_FIND_BYHASHVALUE(hh, head, keyptr, keylen, _hf_hashv, out);               \
+} while (0)
+
 #ifdef HASH_BLOOM
-#define HASH_BLOOM_BITLEN (1ULL << HASH_BLOOM)
-#define HASH_BLOOM_BYTELEN (HASH_BLOOM_BITLEN/8) + ((HASH_BLOOM_BITLEN%8) ? 1:0)
-#define HASH_BLOOM_MAKE(tbl)                                                     \
+#define HASH_BLOOM_BITLEN (1UL << HASH_BLOOM)
+#define HASH_BLOOM_BYTELEN (HASH_BLOOM_BITLEN/8UL) + (((HASH_BLOOM_BITLEN%8UL)!=0UL) ? 1UL : 0UL)
+#define HASH_BLOOM_MAKE(tbl,oomed)                                               \
 do {                                                                             \
   (tbl)->bloom_nbits = HASH_BLOOM;                                               \
   (tbl)->bloom_bv = (uint8_t*)uthash_malloc(HASH_BLOOM_BYTELEN);                 \
-  if (!((tbl)->bloom_bv))  { uthash_fatal( "out of memory"); }                   \
-  memset((tbl)->bloom_bv, 0, HASH_BLOOM_BYTELEN);                                \
-  (tbl)->bloom_sig = HASH_BLOOM_SIGNATURE;                                       \
-} while (0) 
+  if (!(tbl)->bloom_bv) {                                                        \
+    HASH_RECORD_OOM(oomed);                                                      \
+  } else {                                                                       \
+    uthash_bzero((tbl)->bloom_bv, HASH_BLOOM_BYTELEN);                           \
+    (tbl)->bloom_sig = HASH_BLOOM_SIGNATURE;                                     \
+  }                                                                              \
+} while (0)
 
 #define HASH_BLOOM_FREE(tbl)                                                     \
 do {                                                                             \
   uthash_free((tbl)->bloom_bv, HASH_BLOOM_BYTELEN);                              \
-} while (0) 
+} while (0)
 
-#define HASH_BLOOM_BITSET(bv,idx) (bv[(idx)/8] |= (1U << ((idx)%8)))
-#define HASH_BLOOM_BITTEST(bv,idx) (bv[(idx)/8] & (1U << ((idx)%8)))
+#define HASH_BLOOM_BITSET(bv,idx) (bv[(idx)/8U] |= (1U << ((idx)%8U)))
+#define HASH_BLOOM_BITTEST(bv,idx) (bv[(idx)/8U] & (1U << ((idx)%8U)))
 
 #define HASH_BLOOM_ADD(tbl,hashv)                                                \
-  HASH_BLOOM_BITSET((tbl)->bloom_bv, (hashv & (uint32_t)((1ULL << (tbl)->bloom_nbits) - 1)))
+  HASH_BLOOM_BITSET((tbl)->bloom_bv, (hashv & (uint32_t)((1UL << (tbl)->bloom_nbits) - 1U)))
 
 #define HASH_BLOOM_TEST(tbl,hashv)                                               \
-  HASH_BLOOM_BITTEST((tbl)->bloom_bv, (hashv & (uint32_t)((1ULL << (tbl)->bloom_nbits) - 1)))
+  HASH_BLOOM_BITTEST((tbl)->bloom_bv, (hashv & (uint32_t)((1UL << (tbl)->bloom_nbits) - 1U)))
 
 #else
-#define HASH_BLOOM_MAKE(tbl) 
-#define HASH_BLOOM_FREE(tbl) 
-#define HASH_BLOOM_ADD(tbl,hashv) 
+#define HASH_BLOOM_MAKE(tbl,oomed)
+#define HASH_BLOOM_FREE(tbl)
+#define HASH_BLOOM_ADD(tbl,hashv)
 #define HASH_BLOOM_TEST(tbl,hashv) (1)
-#define HASH_BLOOM_BYTELEN 0
+#define HASH_BLOOM_BYTELEN 0U
 #endif
 
-#define HASH_MAKE_TABLE(hh,head)                                                 \
-do {                                                                             \
-  (head)->hh.tbl = (UT_hash_table*)uthash_malloc(                                \
-                  sizeof(UT_hash_table));                                        \
-  if (!((head)->hh.tbl))  { uthash_fatal( "out of memory"); }                    \
-  memset((head)->hh.tbl, 0, sizeof(UT_hash_table));                              \
-  (head)->hh.tbl->tail = &((head)->hh);                                          \
-  (head)->hh.tbl->num_buckets = HASH_INITIAL_NUM_BUCKETS;                        \
-  (head)->hh.tbl->log2_num_buckets = HASH_INITIAL_NUM_BUCKETS_LOG2;              \
-  (head)->hh.tbl->hho = (char*)(&(head)->hh) - (char*)(head);                    \
-  (head)->hh.tbl->buckets = (UT_hash_bucket*)uthash_malloc(                      \
-          HASH_INITIAL_NUM_BUCKETS*sizeof(struct UT_hash_bucket));               \
-  if (! (head)->hh.tbl->buckets) { uthash_fatal( "out of memory"); }             \
-  memset((head)->hh.tbl->buckets, 0,                                             \
-          HASH_INITIAL_NUM_BUCKETS*sizeof(struct UT_hash_bucket));               \
-  HASH_BLOOM_MAKE((head)->hh.tbl);                                               \
-  (head)->hh.tbl->signature = HASH_SIGNATURE;                                    \
-} while(0)
+#define HASH_MAKE_TABLE(hh,head,oomed)                                           \
+do {                                                                             \
+  (head)->hh.tbl = (UT_hash_table*)uthash_malloc(sizeof(UT_hash_table));         \
+  if (!(head)->hh.tbl) {                                                         \
+    HASH_RECORD_OOM(oomed);                                                      \
+  } else {                                                                       \
+    uthash_bzero((head)->hh.tbl, sizeof(UT_hash_table));                         \
+    (head)->hh.tbl->tail = &((head)->hh);                                        \
+    (head)->hh.tbl->num_buckets = HASH_INITIAL_NUM_BUCKETS;                      \
+    (head)->hh.tbl->log2_num_buckets = HASH_INITIAL_NUM_BUCKETS_LOG2;            \
+    (head)->hh.tbl->hho = (char*)(&(head)->hh) - (char*)(head);                  \
+    (head)->hh.tbl->buckets = (UT_hash_bucket*)uthash_malloc(                    \
+        HASH_INITIAL_NUM_BUCKETS * sizeof(struct UT_hash_bucket));               \
+    (head)->hh.tbl->signature = HASH_SIGNATURE;                                  \
+    if (!(head)->hh.tbl->buckets) {                                              \
+      HASH_RECORD_OOM(oomed);                                                    \
+      uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                        \
+    } else {                                                                     \
+      uthash_bzero((head)->hh.tbl->buckets,                                      \
+          HASH_INITIAL_NUM_BUCKETS * sizeof(struct UT_hash_bucket));             \
+      HASH_BLOOM_MAKE((head)->hh.tbl, oomed);                                    \
+      IF_HASH_NONFATAL_OOM(                                                      \
+        if (oomed) {                                                             \
+          uthash_free((head)->hh.tbl->buckets,                                   \
+              HASH_INITIAL_NUM_BUCKETS*sizeof(struct UT_hash_bucket));           \
+          uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                    \
+        }                                                                        \
+      )                                                                          \
+    }                                                                            \
+  }                                                                              \
+} while (0)
+
+#define HASH_REPLACE_BYHASHVALUE_INORDER(hh,head,fieldname,keylen_in,hashval,add,replaced,cmpfcn) \
+do {                                                                             \
+  (replaced) = NULL;                                                             \
+  HASH_FIND_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, replaced); \
+  if (replaced) {                                                                \
+    HASH_DELETE(hh, head, replaced);                                             \
+  }                                                                              \
+  HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, &((add)->fieldname), keylen_in, hashval, add, cmpfcn); \
+} while (0)
 
-#define HASH_ADD(hh,head,fieldname,keylen_in,add)                                \
-        HASH_ADD_KEYPTR(hh,head,&((add)->fieldname),keylen_in,add)
+#define HASH_REPLACE_BYHASHVALUE(hh,head,fieldname,keylen_in,hashval,add,replaced) \
+do {                                                                             \
+  (replaced) = NULL;                                                             \
+  HASH_FIND_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, replaced); \
+  if (replaced) {                                                                \
+    HASH_DELETE(hh, head, replaced);                                             \
+  }                                                                              \
+  HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, add); \
+} while (0)
 
 #define HASH_REPLACE(hh,head,fieldname,keylen_in,add,replaced)                   \
 do {                                                                             \
-  replaced=NULL;                                                                 \
-  HASH_FIND(hh,head,&((add)->fieldname),keylen_in,replaced);                     \
-  if (replaced!=NULL) {                                                          \
-     HASH_DELETE(hh,head,replaced);                                              \
-  };                                                                             \
-  HASH_ADD(hh,head,fieldname,keylen_in,add);                                     \
-} while(0)
- 
+  unsigned _hr_hashv;                                                            \
+  HASH_VALUE(&((add)->fieldname), keylen_in, _hr_hashv);                         \
+  HASH_REPLACE_BYHASHVALUE(hh, head, fieldname, keylen_in, _hr_hashv, add, replaced); \
+} while (0)
+
+#define HASH_REPLACE_INORDER(hh,head,fieldname,keylen_in,add,replaced,cmpfcn)    \
+do {                                                                             \
+  unsigned _hr_hashv;                                                            \
+  HASH_VALUE(&((add)->fieldname), keylen_in, _hr_hashv);                         \
+  HASH_REPLACE_BYHASHVALUE_INORDER(hh, head, fieldname, keylen_in, _hr_hashv, add, replaced, cmpfcn); \
+} while (0)
+
+#define HASH_APPEND_LIST(hh, head, add)                                          \
+do {                                                                             \
+  (add)->hh.next = NULL;                                                         \
+  (add)->hh.prev = ELMT_FROM_HH((head)->hh.tbl, (head)->hh.tbl->tail);           \
+  (head)->hh.tbl->tail->next = (add);                                            \
+  (head)->hh.tbl->tail = &((add)->hh);                                           \
+} while (0)
+
+#define HASH_AKBI_INNER_LOOP(hh,head,add,cmpfcn)                                 \
+do {                                                                             \
+  do {                                                                           \
+    if (cmpfcn(DECLTYPE(head)(_hs_iter), add) > 0) {                             \
+      break;                                                                     \
+    }                                                                            \
+  } while ((_hs_iter = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->next));           \
+} while (0)
+
+#ifdef NO_DECLTYPE
+#undef HASH_AKBI_INNER_LOOP
+#define HASH_AKBI_INNER_LOOP(hh,head,add,cmpfcn)                                 \
+do {                                                                             \
+  char *_hs_saved_head = (char*)(head);                                          \
+  do {                                                                           \
+    DECLTYPE_ASSIGN(head, _hs_iter);                                             \
+    if (cmpfcn(head, add) > 0) {                                                 \
+      DECLTYPE_ASSIGN(head, _hs_saved_head);                                     \
+      break;                                                                     \
+    }                                                                            \
+    DECLTYPE_ASSIGN(head, _hs_saved_head);                                       \
+  } while ((_hs_iter = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->next));           \
+} while (0)
+#endif
+
+#if HASH_NONFATAL_OOM
+
+#define HASH_ADD_TO_TABLE(hh,head,keyptr,keylen_in,hashval,add,oomed)            \
+do {                                                                             \
+  if (!(oomed)) {                                                                \
+    unsigned _ha_bkt;                                                            \
+    (head)->hh.tbl->num_items++;                                                 \
+    HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _ha_bkt);                  \
+    HASH_ADD_TO_BKT((head)->hh.tbl->buckets[_ha_bkt], hh, &(add)->hh, oomed);    \
+    if (oomed) {                                                                 \
+      HASH_ROLLBACK_BKT(hh, head, &(add)->hh);                                   \
+      HASH_DELETE_HH(hh, head, &(add)->hh);                                      \
+      (add)->hh.tbl = NULL;                                                      \
+      uthash_nonfatal_oom(add);                                                  \
+    } else {                                                                     \
+      HASH_BLOOM_ADD((head)->hh.tbl, hashval);                                   \
+      HASH_EMIT_KEY(hh, head, keyptr, keylen_in);                                \
+    }                                                                            \
+  } else {                                                                       \
+    (add)->hh.tbl = NULL;                                                        \
+    uthash_nonfatal_oom(add);                                                    \
+  }                                                                              \
+} while (0)
+
+#else
+
+#define HASH_ADD_TO_TABLE(hh,head,keyptr,keylen_in,hashval,add,oomed)            \
+do {                                                                             \
+  unsigned _ha_bkt;                                                              \
+  (head)->hh.tbl->num_items++;                                                   \
+  HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _ha_bkt);                    \
+  HASH_ADD_TO_BKT((head)->hh.tbl->buckets[_ha_bkt], hh, &(add)->hh, oomed);      \
+  HASH_BLOOM_ADD((head)->hh.tbl, hashval);                                       \
+  HASH_EMIT_KEY(hh, head, keyptr, keylen_in);                                    \
+} while (0)
+
+#endif
+
+
+#define HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh,head,keyptr,keylen_in,hashval,add,cmpfcn) \
+do {                                                                             \
+  IF_HASH_NONFATAL_OOM( int _ha_oomed = 0; )                                     \
+  (add)->hh.hashv = (hashval);                                                   \
+  (add)->hh.key = (char*) (keyptr);                                              \
+  (add)->hh.keylen = (unsigned) (keylen_in);                                     \
+  if (!(head)) {                                                                 \
+    (add)->hh.next = NULL;                                                       \
+    (add)->hh.prev = NULL;                                                       \
+    HASH_MAKE_TABLE(hh, add, _ha_oomed);                                         \
+    IF_HASH_NONFATAL_OOM( if (!_ha_oomed) { )                                    \
+      (head) = (add);                                                            \
+    IF_HASH_NONFATAL_OOM( } )                                                    \
+  } else {                                                                       \
+    void *_hs_iter = (head);                                                     \
+    (add)->hh.tbl = (head)->hh.tbl;                                              \
+    HASH_AKBI_INNER_LOOP(hh, head, add, cmpfcn);                                 \
+    if (_hs_iter) {                                                              \
+      (add)->hh.next = _hs_iter;                                                 \
+      if (((add)->hh.prev = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->prev)) {     \
+        HH_FROM_ELMT((head)->hh.tbl, (add)->hh.prev)->next = (add);              \
+      } else {                                                                   \
+        (head) = (add);                                                          \
+      }                                                                          \
+      HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->prev = (add);                      \
+    } else {                                                                     \
+      HASH_APPEND_LIST(hh, head, add);                                           \
+    }                                                                            \
+  }                                                                              \
+  HASH_ADD_TO_TABLE(hh, head, keyptr, keylen_in, hashval, add, _ha_oomed);       \
+  HASH_FSCK(hh, head, "HASH_ADD_KEYPTR_BYHASHVALUE_INORDER");                    \
+} while (0)
+
+#define HASH_ADD_KEYPTR_INORDER(hh,head,keyptr,keylen_in,add,cmpfcn)             \
+do {                                                                             \
+  unsigned _hs_hashv;                                                            \
+  HASH_VALUE(keyptr, keylen_in, _hs_hashv);                                      \
+  HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, keyptr, keylen_in, _hs_hashv, add, cmpfcn); \
+} while (0)
+
+#define HASH_ADD_BYHASHVALUE_INORDER(hh,head,fieldname,keylen_in,hashval,add,cmpfcn) \
+  HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, &((add)->fieldname), keylen_in, hashval, add, cmpfcn)
+
+#define HASH_ADD_INORDER(hh,head,fieldname,keylen_in,add,cmpfcn)                 \
+  HASH_ADD_KEYPTR_INORDER(hh, head, &((add)->fieldname), keylen_in, add, cmpfcn)
+
+#define HASH_ADD_KEYPTR_BYHASHVALUE(hh,head,keyptr,keylen_in,hashval,add)        \
+do {                                                                             \
+  IF_HASH_NONFATAL_OOM( int _ha_oomed = 0; )                                     \
+  (add)->hh.hashv = (hashval);                                                   \
+  (add)->hh.key = (char*) (keyptr);                                              \
+  (add)->hh.keylen = (unsigned) (keylen_in);                                     \
+  if (!(head)) {                                                                 \
+    (add)->hh.next = NULL;                                                       \
+    (add)->hh.prev = NULL;                                                       \
+    HASH_MAKE_TABLE(hh, add, _ha_oomed);                                         \
+    IF_HASH_NONFATAL_OOM( if (!_ha_oomed) { )                                    \
+      (head) = (add);                                                            \
+    IF_HASH_NONFATAL_OOM( } )                                                    \
+  } else {                                                                       \
+    (add)->hh.tbl = (head)->hh.tbl;                                              \
+    HASH_APPEND_LIST(hh, head, add);                                             \
+  }                                                                              \
+  HASH_ADD_TO_TABLE(hh, head, keyptr, keylen_in, hashval, add, _ha_oomed);       \
+  HASH_FSCK(hh, head, "HASH_ADD_KEYPTR_BYHASHVALUE");                            \
+} while (0)
+
 #define HASH_ADD_KEYPTR(hh,head,keyptr,keylen_in,add)                            \
 do {                                                                             \
- unsigned _ha_bkt;                                                               \
- (add)->hh.next = NULL;                                                          \
- (add)->hh.key = (char*)(keyptr);                                                \
- (add)->hh.keylen = (unsigned)(keylen_in);                                       \
- if (!(head)) {                                                                  \
-    head = (add);                                                                \
-    (head)->hh.prev = NULL;                                                      \
-    HASH_MAKE_TABLE(hh,head);                                                    \
- } else {                                                                        \
-    (head)->hh.tbl->tail->next = (add);                                          \
-    (add)->hh.prev = ELMT_FROM_HH((head)->hh.tbl, (head)->hh.tbl->tail);         \
-    (head)->hh.tbl->tail = &((add)->hh);                                         \
- }                                                                               \
- (head)->hh.tbl->num_items++;                                                    \
- (add)->hh.tbl = (head)->hh.tbl;                                                 \
- HASH_FCN(keyptr,keylen_in, (head)->hh.tbl->num_buckets,                         \
-         (add)->hh.hashv, _ha_bkt);                                              \
- HASH_ADD_TO_BKT((head)->hh.tbl->buckets[_ha_bkt],&(add)->hh);                   \
- HASH_BLOOM_ADD((head)->hh.tbl,(add)->hh.hashv);                                 \
- HASH_EMIT_KEY(hh,head,keyptr,keylen_in);                                        \
- HASH_FSCK(hh,head);                                                             \
-} while(0)
-
-#define HASH_TO_BKT( hashv, num_bkts, bkt )                                      \
-do {                                                                             \
-  bkt = ((hashv) & ((num_bkts) - 1));                                            \
-} while(0)
+  unsigned _ha_hashv;                                                            \
+  HASH_VALUE(keyptr, keylen_in, _ha_hashv);                                      \
+  HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, keyptr, keylen_in, _ha_hashv, add);      \
+} while (0)
+
+#define HASH_ADD_BYHASHVALUE(hh,head,fieldname,keylen_in,hashval,add)            \
+  HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, add)
+
+#define HASH_ADD(hh,head,fieldname,keylen_in,add)                                \
+  HASH_ADD_KEYPTR(hh, head, &((add)->fieldname), keylen_in, add)
+
+#define HASH_TO_BKT(hashv,num_bkts,bkt)                                          \
+do {                                                                             \
+  bkt = ((hashv) & ((num_bkts) - 1U));                                           \
+} while (0)
 
 /* delete "delptr" from the hash table.
  * "the usual" patch-up process for the app-order doubly-linked-list.
@@ -213,48 +445,44 @@ do {
  * scratch pointer rather than through the repointed (users) symbol.
  */
 #define HASH_DELETE(hh,head,delptr)                                              \
+    HASH_DELETE_HH(hh, head, &(delptr)->hh)
+
+#define HASH_DELETE_HH(hh,head,delptrhh)                                         \
 do {                                                                             \
+  struct UT_hash_handle *_hd_hh_del = (delptrhh);                                \
+  if ((_hd_hh_del->prev == NULL) && (_hd_hh_del->next == NULL)) {                \
+    HASH_BLOOM_FREE((head)->hh.tbl);                                             \
+    uthash_free((head)->hh.tbl->buckets,                                         \
+                (head)->hh.tbl->num_buckets * sizeof(struct UT_hash_bucket));    \
+    uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                          \
+    (head) = NULL;                                                               \
+  } else {                                                                       \
     unsigned _hd_bkt;                                                            \
-    struct UT_hash_handle *_hd_hh_del;                                           \
-    if ( ((delptr)->hh.prev == NULL) && ((delptr)->hh.next == NULL) )  {         \
-        uthash_free((head)->hh.tbl->buckets,                                     \
-                    (head)->hh.tbl->num_buckets*sizeof(struct UT_hash_bucket) ); \
-        HASH_BLOOM_FREE((head)->hh.tbl);                                         \
-        uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                      \
-        head = NULL;                                                             \
+    if (_hd_hh_del == (head)->hh.tbl->tail) {                                    \
+      (head)->hh.tbl->tail = HH_FROM_ELMT((head)->hh.tbl, _hd_hh_del->prev);     \
+    }                                                                            \
+    if (_hd_hh_del->prev != NULL) {                                              \
+      HH_FROM_ELMT((head)->hh.tbl, _hd_hh_del->prev)->next = _hd_hh_del->next;   \
     } else {                                                                     \
-        _hd_hh_del = &((delptr)->hh);                                            \
-        if ((delptr) == ELMT_FROM_HH((head)->hh.tbl,(head)->hh.tbl->tail)) {     \
-            (head)->hh.tbl->tail =                                               \
-                (UT_hash_handle*)((ptrdiff_t)((delptr)->hh.prev) +               \
-                (head)->hh.tbl->hho);                                            \
-        }                                                                        \
-        if ((delptr)->hh.prev) {                                                 \
-            ((UT_hash_handle*)((ptrdiff_t)((delptr)->hh.prev) +                  \
-                    (head)->hh.tbl->hho))->next = (delptr)->hh.next;             \
-        } else {                                                                 \
-            DECLTYPE_ASSIGN(head,(delptr)->hh.next);                             \
-        }                                                                        \
-        if (_hd_hh_del->next) {                                                  \
-            ((UT_hash_handle*)((ptrdiff_t)_hd_hh_del->next +                     \
-                    (head)->hh.tbl->hho))->prev =                                \
-                    _hd_hh_del->prev;                                            \
-        }                                                                        \
-        HASH_TO_BKT( _hd_hh_del->hashv, (head)->hh.tbl->num_buckets, _hd_bkt);   \
-        HASH_DEL_IN_BKT(hh,(head)->hh.tbl->buckets[_hd_bkt], _hd_hh_del);        \
-        (head)->hh.tbl->num_items--;                                             \
+      DECLTYPE_ASSIGN(head, _hd_hh_del->next);                                   \
     }                                                                            \
-    HASH_FSCK(hh,head);                                                          \
+    if (_hd_hh_del->next != NULL) {                                              \
+      HH_FROM_ELMT((head)->hh.tbl, _hd_hh_del->next)->prev = _hd_hh_del->prev;   \
+    }                                                                            \
+    HASH_TO_BKT(_hd_hh_del->hashv, (head)->hh.tbl->num_buckets, _hd_bkt);        \
+    HASH_DEL_IN_BKT((head)->hh.tbl->buckets[_hd_bkt], _hd_hh_del);               \
+    (head)->hh.tbl->num_items--;                                                 \
+  }                                                                              \
+  HASH_FSCK(hh, head, "HASH_DELETE_HH");                                         \
 } while (0)
 
-
 /* convenience forms of HASH_FIND/HASH_ADD/HASH_DEL */
 #define HASH_FIND_STR(head,findstr,out)                                          \
-    HASH_FIND(hh,head,findstr,strlen(findstr),out)
+    HASH_FIND(hh,head,findstr,(unsigned)uthash_strlen(findstr),out)
 #define HASH_ADD_STR(head,strfield,add)                                          \
-    HASH_ADD(hh,head,strfield[0],strlen(add->strfield),add)
+    HASH_ADD(hh,head,strfield[0],(unsigned)uthash_strlen(add->strfield),add)
 #define HASH_REPLACE_STR(head,strfield,add,replaced)                             \
-    HASH_REPLACE(hh,head,strfield[0],strlen(add->strfield),add,replaced)
+    HASH_REPLACE(hh,head,strfield[0],(unsigned)uthash_strlen(add->strfield),add,replaced)
 #define HASH_FIND_INT(head,findint,out)                                          \
     HASH_FIND(hh,head,findint,sizeof(int),out)
 #define HASH_ADD_INT(head,intfield,add)                                          \
@@ -275,120 +503,118 @@ do {
  */
 #ifdef HASH_DEBUG
 #define HASH_OOPS(...) do { fprintf(stderr,__VA_ARGS__); exit(-1); } while (0)
-#define HASH_FSCK(hh,head)                                                       \
+#define HASH_FSCK(hh,head,where)                                                 \
 do {                                                                             \
+  struct UT_hash_handle *_thh;                                                   \
+  if (head) {                                                                    \
     unsigned _bkt_i;                                                             \
-    unsigned _count, _bkt_count;                                                 \
+    unsigned _count = 0;                                                         \
     char *_prev;                                                                 \
-    struct UT_hash_handle *_thh;                                                 \
-    if (head) {                                                                  \
-        _count = 0;                                                              \
-        for( _bkt_i = 0; _bkt_i < (head)->hh.tbl->num_buckets; _bkt_i++) {       \
-            _bkt_count = 0;                                                      \
-            _thh = (head)->hh.tbl->buckets[_bkt_i].hh_head;                      \
-            _prev = NULL;                                                        \
-            while (_thh) {                                                       \
-               if (_prev != (char*)(_thh->hh_prev)) {                            \
-                   HASH_OOPS("invalid hh_prev %p, actual %p\n",                  \
-                    _thh->hh_prev, _prev );                                      \
-               }                                                                 \
-               _bkt_count++;                                                     \
-               _prev = (char*)(_thh);                                            \
-               _thh = _thh->hh_next;                                             \
-            }                                                                    \
-            _count += _bkt_count;                                                \
-            if ((head)->hh.tbl->buckets[_bkt_i].count !=  _bkt_count) {          \
-               HASH_OOPS("invalid bucket count %d, actual %d\n",                 \
-                (head)->hh.tbl->buckets[_bkt_i].count, _bkt_count);              \
-            }                                                                    \
-        }                                                                        \
-        if (_count != (head)->hh.tbl->num_items) {                               \
-            HASH_OOPS("invalid hh item count %d, actual %d\n",                   \
-                (head)->hh.tbl->num_items, _count );                             \
-        }                                                                        \
-        /* traverse hh in app order; check next/prev integrity, count */         \
-        _count = 0;                                                              \
-        _prev = NULL;                                                            \
-        _thh =  &(head)->hh;                                                     \
-        while (_thh) {                                                           \
-           _count++;                                                             \
-           if (_prev !=(char*)(_thh->prev)) {                                    \
-              HASH_OOPS("invalid prev %p, actual %p\n",                          \
-                    _thh->prev, _prev );                                         \
-           }                                                                     \
-           _prev = (char*)ELMT_FROM_HH((head)->hh.tbl, _thh);                    \
-           _thh = ( _thh->next ?  (UT_hash_handle*)((char*)(_thh->next) +        \
-                                  (head)->hh.tbl->hho) : NULL );                 \
-        }                                                                        \
-        if (_count != (head)->hh.tbl->num_items) {                               \
-            HASH_OOPS("invalid app item count %d, actual %d\n",                  \
-                (head)->hh.tbl->num_items, _count );                             \
+    for (_bkt_i = 0; _bkt_i < (head)->hh.tbl->num_buckets; ++_bkt_i) {           \
+      unsigned _bkt_count = 0;                                                   \
+      _thh = (head)->hh.tbl->buckets[_bkt_i].hh_head;                            \
+      _prev = NULL;                                                              \
+      while (_thh) {                                                             \
+        if (_prev != (char*)(_thh->hh_prev)) {                                   \
+          HASH_OOPS("%s: invalid hh_prev %p, actual %p\n",                       \
+              (where), (void*)_thh->hh_prev, (void*)_prev);                      \
         }                                                                        \
+        _bkt_count++;                                                            \
+        _prev = (char*)(_thh);                                                   \
+        _thh = _thh->hh_next;                                                    \
+      }                                                                          \
+      _count += _bkt_count;                                                      \
+      if ((head)->hh.tbl->buckets[_bkt_i].count !=  _bkt_count) {                \
+        HASH_OOPS("%s: invalid bucket count %u, actual %u\n",                    \
+            (where), (head)->hh.tbl->buckets[_bkt_i].count, _bkt_count);         \
+      }                                                                          \
+    }                                                                            \
+    if (_count != (head)->hh.tbl->num_items) {                                   \
+      HASH_OOPS("%s: invalid hh item count %u, actual %u\n",                     \
+          (where), (head)->hh.tbl->num_items, _count);                           \
+    }                                                                            \
+    _count = 0;                                                                  \
+    _prev = NULL;                                                                \
+    _thh =  &(head)->hh;                                                         \
+    while (_thh) {                                                               \
+      _count++;                                                                  \
+      if (_prev != (char*)_thh->prev) {                                          \
+        HASH_OOPS("%s: invalid prev %p, actual %p\n",                            \
+            (where), (void*)_thh->prev, (void*)_prev);                           \
+      }                                                                          \
+      _prev = (char*)ELMT_FROM_HH((head)->hh.tbl, _thh);                         \
+      _thh = (_thh->next ? HH_FROM_ELMT((head)->hh.tbl, _thh->next) : NULL);     \
+    }                                                                            \
+    if (_count != (head)->hh.tbl->num_items) {                                   \
+      HASH_OOPS("%s: invalid app item count %u, actual %u\n",                    \
+          (where), (head)->hh.tbl->num_items, _count);                           \
     }                                                                            \
+  }                                                                              \
 } while (0)
 #else
-#define HASH_FSCK(hh,head) 
+#define HASH_FSCK(hh,head,where)
 #endif
 
-/* When compiled with -DHASH_EMIT_KEYS, length-prefixed keys are emitted to 
+/* When compiled with -DHASH_EMIT_KEYS, length-prefixed keys are emitted to
  * the descriptor to which this macro is defined for tuning the hash function.
  * The app can #include <unistd.h> to get the prototype for write(2). */
 #ifdef HASH_EMIT_KEYS
 #define HASH_EMIT_KEY(hh,head,keyptr,fieldlen)                                   \
 do {                                                                             \
-    unsigned _klen = fieldlen;                                                   \
-    write(HASH_EMIT_KEYS, &_klen, sizeof(_klen));                                \
-    write(HASH_EMIT_KEYS, keyptr, fieldlen);                                     \
+  unsigned _klen = fieldlen;                                                     \
+  write(HASH_EMIT_KEYS, &_klen, sizeof(_klen));                                  \
+  write(HASH_EMIT_KEYS, keyptr, (unsigned long)fieldlen);                        \
 } while (0)
-#else 
-#define HASH_EMIT_KEY(hh,head,keyptr,fieldlen)                    
+#else
+#define HASH_EMIT_KEY(hh,head,keyptr,fieldlen)
 #endif
 
 /* default to Jenkin's hash unless overridden e.g. DHASH_FUNCTION=HASH_SAX */
-#ifdef HASH_FUNCTION 
+#ifdef HASH_FUNCTION
 #define HASH_FCN HASH_FUNCTION
 #else
 #define HASH_FCN HASH_JEN
 #endif
 
 /* The Bernstein hash function, used in Perl prior to v5.6. Note (x<<5+x)=x*33. */
-#define HASH_BER(key,keylen,num_bkts,hashv,bkt)                                  \
+#define HASH_BER(key,keylen,hashv)                                               \
 do {                                                                             \
-  unsigned _hb_keylen=keylen;                                                    \
-  char *_hb_key=(char*)(key);                                                    \
+  unsigned _hb_keylen = (unsigned)keylen;                                        \
+  const unsigned char *_hb_key = (const unsigned char*)(key);                    \
   (hashv) = 0;                                                                   \
-  while (_hb_keylen--)  { (hashv) = (((hashv) << 5) + (hashv)) + *_hb_key++; }   \
-  bkt = (hashv) & (num_bkts-1);                                                  \
+  while (_hb_keylen-- != 0U) {                                                   \
+    (hashv) = (((hashv) << 5) + (hashv)) + *_hb_key++;                           \
+  }                                                                              \
 } while (0)
 
 
-/* SAX/FNV/OAT/JEN hash functions are macro variants of those listed at 
+/* SAX/FNV/OAT/JEN hash functions are macro variants of those listed at
  * http://eternallyconfuzzled.com/tuts/algorithms/jsw_tut_hashing.aspx */
-#define HASH_SAX(key,keylen,num_bkts,hashv,bkt)                                  \
+#define HASH_SAX(key,keylen,hashv)                                               \
 do {                                                                             \
   unsigned _sx_i;                                                                \
-  char *_hs_key=(char*)(key);                                                    \
+  const unsigned char *_hs_key = (const unsigned char*)(key);                    \
   hashv = 0;                                                                     \
-  for(_sx_i=0; _sx_i < keylen; _sx_i++)                                          \
-      hashv ^= (hashv << 5) + (hashv >> 2) + _hs_key[_sx_i];                     \
-  bkt = hashv & (num_bkts-1);                                                    \
+  for (_sx_i=0; _sx_i < keylen; _sx_i++) {                                       \
+    hashv ^= (hashv << 5) + (hashv >> 2) + _hs_key[_sx_i];                       \
+  }                                                                              \
 } while (0)
 /* FNV-1a variation */
-#define HASH_FNV(key,keylen,num_bkts,hashv,bkt)                                  \
+#define HASH_FNV(key,keylen,hashv)                                               \
 do {                                                                             \
   unsigned _fn_i;                                                                \
-  char *_hf_key=(char*)(key);                                                    \
-  hashv = 2166136261UL;                                                          \
-  for(_fn_i=0; _fn_i < keylen; _fn_i++)                                          \
-      hashv = hashv ^ _hf_key[_fn_i];                                            \
-      hashv = hashv * 16777619;                                                  \
-  bkt = hashv & (num_bkts-1);                                                    \
-} while(0) 
- 
-#define HASH_OAT(key,keylen,num_bkts,hashv,bkt)                                  \
+  const unsigned char *_hf_key = (const unsigned char*)(key);                    \
+  (hashv) = 2166136261U;                                                         \
+  for (_fn_i=0; _fn_i < keylen; _fn_i++) {                                       \
+    hashv = hashv ^ _hf_key[_fn_i];                                              \
+    hashv = hashv * 16777619U;                                                   \
+  }                                                                              \
+} while (0)
+
+#define HASH_OAT(key,keylen,hashv)                                               \
 do {                                                                             \
   unsigned _ho_i;                                                                \
-  char *_ho_key=(char*)(key);                                                    \
+  const unsigned char *_ho_key=(const unsigned char*)(key);                      \
   hashv = 0;                                                                     \
   for(_ho_i=0; _ho_i < keylen; _ho_i++) {                                        \
       hashv += _ho_key[_ho_i];                                                   \
@@ -398,8 +624,7 @@ do {
   hashv += (hashv << 3);                                                         \
   hashv ^= (hashv >> 11);                                                        \
   hashv += (hashv << 15);                                                        \
-  bkt = hashv & (num_bkts-1);                                                    \
-} while(0)
+} while (0)
 
 #define HASH_JEN_MIX(a,b,c)                                                      \
 do {                                                                             \
@@ -414,14 +639,14 @@ do {
   c -= a; c -= b; c ^= ( b >> 15 );                                              \
 } while (0)
 
-#define HASH_JEN(key,keylen,num_bkts,hashv,bkt)                                  \
+#define HASH_JEN(key,keylen,hashv)                                               \
 do {                                                                             \
   unsigned _hj_i,_hj_j,_hj_k;                                                    \
-  unsigned char *_hj_key=(unsigned char*)(key);                                  \
-  hashv = 0xfeedbeef;                                                            \
-  _hj_i = _hj_j = 0x9e3779b9;                                                    \
-  _hj_k = (unsigned)(keylen);                                                      \
-  while (_hj_k >= 12) {                                                          \
+  unsigned const char *_hj_key=(unsigned const char*)(key);                      \
+  hashv = 0xfeedbeefu;                                                           \
+  _hj_i = _hj_j = 0x9e3779b9u;                                                   \
+  _hj_k = (unsigned)(keylen);                                                    \
+  while (_hj_k >= 12U) {                                                         \
     _hj_i +=    (_hj_key[0] + ( (unsigned)_hj_key[1] << 8 )                      \
         + ( (unsigned)_hj_key[2] << 16 )                                         \
         + ( (unsigned)_hj_key[3] << 24 ) );                                      \
@@ -435,25 +660,24 @@ do {
      HASH_JEN_MIX(_hj_i, _hj_j, hashv);                                          \
                                                                                  \
      _hj_key += 12;                                                              \
-     _hj_k -= 12;                                                                \
+     _hj_k -= 12U;                                                               \
   }                                                                              \
-  hashv += keylen;                                                               \
+  hashv += (unsigned)(keylen);                                                   \
   switch ( _hj_k ) {                                                             \
-     case 11: hashv += ( (unsigned)_hj_key[10] << 24 );                          \
-     case 10: hashv += ( (unsigned)_hj_key[9] << 16 );                           \
-     case 9:  hashv += ( (unsigned)_hj_key[8] << 8 );                            \
-     case 8:  _hj_j += ( (unsigned)_hj_key[7] << 24 );                           \
-     case 7:  _hj_j += ( (unsigned)_hj_key[6] << 16 );                           \
-     case 6:  _hj_j += ( (unsigned)_hj_key[5] << 8 );                            \
-     case 5:  _hj_j += _hj_key[4];                                               \
-     case 4:  _hj_i += ( (unsigned)_hj_key[3] << 24 );                           \
-     case 3:  _hj_i += ( (unsigned)_hj_key[2] << 16 );                           \
-     case 2:  _hj_i += ( (unsigned)_hj_key[1] << 8 );                            \
-     case 1:  _hj_i += _hj_key[0];                                               \
+    case 11: hashv += ( (unsigned)_hj_key[10] << 24 ); /* FALLTHROUGH */         \
+    case 10: hashv += ( (unsigned)_hj_key[9] << 16 );  /* FALLTHROUGH */         \
+    case 9:  hashv += ( (unsigned)_hj_key[8] << 8 );   /* FALLTHROUGH */         \
+    case 8:  _hj_j += ( (unsigned)_hj_key[7] << 24 );  /* FALLTHROUGH */         \
+    case 7:  _hj_j += ( (unsigned)_hj_key[6] << 16 );  /* FALLTHROUGH */         \
+    case 6:  _hj_j += ( (unsigned)_hj_key[5] << 8 );   /* FALLTHROUGH */         \
+    case 5:  _hj_j += _hj_key[4];                      /* FALLTHROUGH */         \
+    case 4:  _hj_i += ( (unsigned)_hj_key[3] << 24 );  /* FALLTHROUGH */         \
+    case 3:  _hj_i += ( (unsigned)_hj_key[2] << 16 );  /* FALLTHROUGH */         \
+    case 2:  _hj_i += ( (unsigned)_hj_key[1] << 8 );   /* FALLTHROUGH */         \
+    case 1:  _hj_i += _hj_key[0];                                                \
   }                                                                              \
   HASH_JEN_MIX(_hj_i, _hj_j, hashv);                                             \
-  bkt = hashv & (num_bkts-1);                                                    \
-} while(0)
+} while (0)
 
 /* The Paul Hsieh hash function */
 #undef get16bits
@@ -466,21 +690,21 @@ do {
 #define get16bits(d) ((((uint32_t)(((const uint8_t *)(d))[1])) << 8)             \
                        +(uint32_t)(((const uint8_t *)(d))[0]) )
 #endif
-#define HASH_SFH(key,keylen,num_bkts,hashv,bkt)                                  \
+#define HASH_SFH(key,keylen,hashv)                                               \
 do {                                                                             \
-  unsigned char *_sfh_key=(unsigned char*)(key);                                 \
-  uint32_t _sfh_tmp, _sfh_len = keylen;                                          \
+  unsigned const char *_sfh_key=(unsigned const char*)(key);                     \
+  uint32_t _sfh_tmp, _sfh_len = (uint32_t)keylen;                                \
                                                                                  \
-  int _sfh_rem = _sfh_len & 3;                                                   \
+  unsigned _sfh_rem = _sfh_len & 3U;                                             \
   _sfh_len >>= 2;                                                                \
-  hashv = 0xcafebabe;                                                            \
+  hashv = 0xcafebabeu;                                                           \
                                                                                  \
   /* Main loop */                                                                \
-  for (;_sfh_len > 0; _sfh_len--) {                                              \
+  for (;_sfh_len > 0U; _sfh_len--) {                                             \
     hashv    += get16bits (_sfh_key);                                            \
-    _sfh_tmp       = (uint32_t)(get16bits (_sfh_key+2)) << 11  ^ hashv;          \
+    _sfh_tmp  = ((uint32_t)(get16bits (_sfh_key+2)) << 11) ^ hashv;              \
     hashv     = (hashv << 16) ^ _sfh_tmp;                                        \
-    _sfh_key += 2*sizeof (uint16_t);                                             \
+    _sfh_key += 2U*sizeof (uint16_t);                                            \
     hashv    += hashv >> 11;                                                     \
   }                                                                              \
                                                                                  \
@@ -488,7 +712,7 @@ do {
   switch (_sfh_rem) {                                                            \
     case 3: hashv += get16bits (_sfh_key);                                       \
             hashv ^= hashv << 16;                                                \
-            hashv ^= (uint32_t)(_sfh_key[sizeof (uint16_t)] << 18);              \
+            hashv ^= (uint32_t)(_sfh_key[sizeof (uint16_t)]) << 18;              \
             hashv += hashv >> 11;                                                \
             break;                                                               \
     case 2: hashv += get16bits (_sfh_key);                                       \
@@ -500,20 +724,19 @@ do {
             hashv += hashv >> 1;                                                 \
   }                                                                              \
                                                                                  \
-    /* Force "avalanching" of final 127 bits */                                  \
-    hashv ^= hashv << 3;                                                         \
-    hashv += hashv >> 5;                                                         \
-    hashv ^= hashv << 4;                                                         \
-    hashv += hashv >> 17;                                                        \
-    hashv ^= hashv << 25;                                                        \
-    hashv += hashv >> 6;                                                         \
-    bkt = hashv & (num_bkts-1);                                                  \
-} while(0) 
+  /* Force "avalanching" of final 127 bits */                                    \
+  hashv ^= hashv << 3;                                                           \
+  hashv += hashv >> 5;                                                           \
+  hashv ^= hashv << 4;                                                           \
+  hashv += hashv >> 17;                                                          \
+  hashv ^= hashv << 25;                                                          \
+  hashv += hashv >> 6;                                                           \
+} while (0)
 
 #ifdef HASH_USING_NO_STRICT_ALIASING
 /* The MurmurHash exploits some CPU's (x86,x86_64) tolerance for unaligned reads.
  * For other types of CPU's (e.g. Sparc) an unaligned read causes a bus error.
- * MurmurHash uses the faster approach only on CPU's where we know it's safe. 
+ * MurmurHash uses the faster approach only on CPU's where we know it's safe.
  *
  * Note the preprocessor built-in defines can be emitted using:
  *
@@ -523,10 +746,10 @@ do {
 #if (defined(__i386__) || defined(__x86_64__)  || defined(_M_IX86))
 #define MUR_GETBLOCK(p,i) p[i]
 #else /* non intel */
-#define MUR_PLUS0_ALIGNED(p) (((unsigned long)p & 0x3) == 0)
-#define MUR_PLUS1_ALIGNED(p) (((unsigned long)p & 0x3) == 1)
-#define MUR_PLUS2_ALIGNED(p) (((unsigned long)p & 0x3) == 2)
-#define MUR_PLUS3_ALIGNED(p) (((unsigned long)p & 0x3) == 3)
+#define MUR_PLUS0_ALIGNED(p) (((unsigned long)p & 3UL) == 0UL)
+#define MUR_PLUS1_ALIGNED(p) (((unsigned long)p & 3UL) == 1UL)
+#define MUR_PLUS2_ALIGNED(p) (((unsigned long)p & 3UL) == 2UL)
+#define MUR_PLUS3_ALIGNED(p) (((unsigned long)p & 3UL) == 3UL)
 #define WP(p) ((uint32_t*)((unsigned long)(p) & ~3UL))
 #if (defined(__BIG_ENDIAN__) || defined(SPARC) || defined(__ppc__) || defined(__ppc64__))
 #define MUR_THREE_ONE(p) ((((*WP(p))&0x00ffffff) << 8) | (((*(WP(p)+1))&0xff000000) >> 24))
@@ -546,24 +769,24 @@ do {
 #define MUR_FMIX(_h) \
 do {                 \
   _h ^= _h >> 16;    \
-  _h *= 0x85ebca6b;  \
+  _h *= 0x85ebca6bu; \
   _h ^= _h >> 13;    \
-  _h *= 0xc2b2ae35l; \
+  _h *= 0xc2b2ae35u; \
   _h ^= _h >> 16;    \
-} while(0)
+} while (0)
 
-#define HASH_MUR(key,keylen,num_bkts,hashv,bkt)                        \
+#define HASH_MUR(key,keylen,hashv)                                     \
 do {                                                                   \
   const uint8_t *_mur_data = (const uint8_t*)(key);                    \
-  const int _mur_nblocks = (keylen) / 4;                               \
-  uint32_t _mur_h1 = 0xf88D5353;                                       \
-  uint32_t _mur_c1 = 0xcc9e2d51;                                       \
-  uint32_t _mur_c2 = 0x1b873593;                                       \
+  const int _mur_nblocks = (int)(keylen) / 4;                          \
+  uint32_t _mur_h1 = 0xf88D5353u;                                      \
+  uint32_t _mur_c1 = 0xcc9e2d51u;                                      \
+  uint32_t _mur_c2 = 0x1b873593u;                                      \
   uint32_t _mur_k1 = 0;                                                \
   const uint8_t *_mur_tail;                                            \
-  const uint32_t *_mur_blocks = (const uint32_t*)(_mur_data+_mur_nblocks*4); \
+  const uint32_t *_mur_blocks = (const uint32_t*)(_mur_data+(_mur_nblocks*4)); \
   int _mur_i;                                                          \
-  for(_mur_i = -_mur_nblocks; _mur_i; _mur_i++) {                      \
+  for (_mur_i = -_mur_nblocks; _mur_i != 0; _mur_i++) {                \
     _mur_k1 = MUR_GETBLOCK(_mur_blocks,_mur_i);                        \
     _mur_k1 *= _mur_c1;                                                \
     _mur_k1 = MUR_ROTL32(_mur_k1,15);                                  \
@@ -571,150 +794,168 @@ do {                                                                   \
                                                                        \
     _mur_h1 ^= _mur_k1;                                                \
     _mur_h1 = MUR_ROTL32(_mur_h1,13);                                  \
-    _mur_h1 = _mur_h1*5+0xe6546b64;                                    \
+    _mur_h1 = (_mur_h1*5U) + 0xe6546b64u;                              \
   }                                                                    \
-  _mur_tail = (const uint8_t*)(_mur_data + _mur_nblocks*4);            \
+  _mur_tail = (const uint8_t*)(_mur_data + (_mur_nblocks*4));          \
   _mur_k1=0;                                                           \
-  switch((keylen) & 3) {                                               \
-    case 3: _mur_k1 ^= _mur_tail[2] << 16;                             \
-    case 2: _mur_k1 ^= _mur_tail[1] << 8;                              \
-    case 1: _mur_k1 ^= _mur_tail[0];                                   \
+  switch ((keylen) & 3U) {                                             \
+    case 0: break;                                                     \
+    case 3: _mur_k1 ^= (uint32_t)_mur_tail[2] << 16; /* FALLTHROUGH */ \
+    case 2: _mur_k1 ^= (uint32_t)_mur_tail[1] << 8;  /* FALLTHROUGH */ \
+    case 1: _mur_k1 ^= (uint32_t)_mur_tail[0];                         \
     _mur_k1 *= _mur_c1;                                                \
     _mur_k1 = MUR_ROTL32(_mur_k1,15);                                  \
     _mur_k1 *= _mur_c2;                                                \
     _mur_h1 ^= _mur_k1;                                                \
   }                                                                    \
-  _mur_h1 ^= (keylen);                                                 \
+  _mur_h1 ^= (uint32_t)(keylen);                                       \
   MUR_FMIX(_mur_h1);                                                   \
   hashv = _mur_h1;                                                     \
-  bkt = hashv & (num_bkts-1);                                          \
-} while(0)
+} while (0)
 #endif  /* HASH_USING_NO_STRICT_ALIASING */
 
-/* key comparison function; return 0 if keys equal */
-#define HASH_KEYCMP(a,b,len) memcmp(a,b,len) 
-
 /* iterate over items in a known bucket to find desired item */
-#define HASH_FIND_IN_BKT(tbl,hh,head,keyptr,keylen_in,out)                       \
+#define HASH_FIND_IN_BKT(tbl,hh,head,keyptr,keylen_in,hashval,out)               \
 do {                                                                             \
- if (head.hh_head) DECLTYPE_ASSIGN(out,ELMT_FROM_HH(tbl,head.hh_head));          \
- else out=NULL;                                                                  \
- while (out) {                                                                   \
-    if ((out)->hh.keylen == keylen_in) {                                           \
-        if ((HASH_KEYCMP((out)->hh.key,keyptr,keylen_in)) == 0) break;             \
+  if ((head).hh_head != NULL) {                                                  \
+    DECLTYPE_ASSIGN(out, ELMT_FROM_HH(tbl, (head).hh_head));                     \
+  } else {                                                                       \
+    (out) = NULL;                                                                \
+  }                                                                              \
+  while ((out) != NULL) {                                                        \
+    if ((out)->hh.hashv == (hashval) && (out)->hh.keylen == (keylen_in)) {       \
+      if (uthash_memcmp((out)->hh.key, keyptr, keylen_in) == 0) {                \
+        break;                                                                   \
+      }                                                                          \
+    }                                                                            \
+    if ((out)->hh.hh_next != NULL) {                                             \
+      DECLTYPE_ASSIGN(out, ELMT_FROM_HH(tbl, (out)->hh.hh_next));                \
+    } else {                                                                     \
+      (out) = NULL;                                                              \
     }                                                                            \
-    if ((out)->hh.hh_next) DECLTYPE_ASSIGN(out,ELMT_FROM_HH(tbl,(out)->hh.hh_next)); \
-    else out = NULL;                                                             \
- }                                                                               \
-} while(0)
+  }                                                                              \
+} while (0)
 
 /* add an item to a bucket  */
-#define HASH_ADD_TO_BKT(head,addhh)                                              \
-do {                                                                             \
- head.count++;                                                                   \
- (addhh)->hh_next = head.hh_head;                                                \
- (addhh)->hh_prev = NULL;                                                        \
- if (head.hh_head) { (head).hh_head->hh_prev = (addhh); }                        \
- (head).hh_head=addhh;                                                           \
- if (head.count >= ((head.expand_mult+1) * HASH_BKT_CAPACITY_THRESH)             \
-     && (addhh)->tbl->noexpand != 1) {                                           \
-       HASH_EXPAND_BUCKETS((addhh)->tbl);                                        \
- }                                                                               \
-} while(0)
+#define HASH_ADD_TO_BKT(head,hh,addhh,oomed)                                     \
+do {                                                                             \
+  UT_hash_bucket *_ha_head = &(head);                                            \
+  _ha_head->count++;                                                             \
+  (addhh)->hh_next = _ha_head->hh_head;                                          \
+  (addhh)->hh_prev = NULL;                                                       \
+  if (_ha_head->hh_head != NULL) {                                               \
+    _ha_head->hh_head->hh_prev = (addhh);                                        \
+  }                                                                              \
+  _ha_head->hh_head = (addhh);                                                   \
+  if ((_ha_head->count >= ((_ha_head->expand_mult + 1U) * HASH_BKT_CAPACITY_THRESH)) \
+      && !(addhh)->tbl->noexpand) {                                              \
+    HASH_EXPAND_BUCKETS(addhh,(addhh)->tbl, oomed);                              \
+    IF_HASH_NONFATAL_OOM(                                                        \
+      if (oomed) {                                                               \
+        HASH_DEL_IN_BKT(head,addhh);                                             \
+      }                                                                          \
+    )                                                                            \
+  }                                                                              \
+} while (0)
 
 /* remove an item from a given bucket */
-#define HASH_DEL_IN_BKT(hh,head,hh_del)                                          \
-    (head).count--;                                                              \
-    if ((head).hh_head == hh_del) {                                              \
-      (head).hh_head = hh_del->hh_next;                                          \
-    }                                                                            \
-    if (hh_del->hh_prev) {                                                       \
-        hh_del->hh_prev->hh_next = hh_del->hh_next;                              \
-    }                                                                            \
-    if (hh_del->hh_next) {                                                       \
-        hh_del->hh_next->hh_prev = hh_del->hh_prev;                              \
-    }                                                                
+#define HASH_DEL_IN_BKT(head,delhh)                                              \
+do {                                                                             \
+  UT_hash_bucket *_hd_head = &(head);                                            \
+  _hd_head->count--;                                                             \
+  if (_hd_head->hh_head == (delhh)) {                                            \
+    _hd_head->hh_head = (delhh)->hh_next;                                        \
+  }                                                                              \
+  if ((delhh)->hh_prev) {                                                        \
+    (delhh)->hh_prev->hh_next = (delhh)->hh_next;                                \
+  }                                                                              \
+  if ((delhh)->hh_next) {                                                        \
+    (delhh)->hh_next->hh_prev = (delhh)->hh_prev;                                \
+  }                                                                              \
+} while (0)
 
 /* Bucket expansion has the effect of doubling the number of buckets
  * and redistributing the items into the new buckets. Ideally the
  * items will distribute more or less evenly into the new buckets
  * (the extent to which this is true is a measure of the quality of
- * the hash function as it applies to the key domain). 
- * 
+ * the hash function as it applies to the key domain).
+ *
  * With the items distributed into more buckets, the chain length
  * (item count) in each bucket is reduced. Thus by expanding buckets
- * the hash keeps a bound on the chain length. This bounded chain 
+ * the hash keeps a bound on the chain length. This bounded chain
  * length is the essence of how a hash provides constant time lookup.
- * 
+ *
  * The calculation of tbl->ideal_chain_maxlen below deserves some
  * explanation. First, keep in mind that we're calculating the ideal
  * maximum chain length based on the *new* (doubled) bucket count.
  * In fractions this is just n/b (n=number of items,b=new num buckets).
- * Since the ideal chain length is an integer, we want to calculate 
+ * Since the ideal chain length is an integer, we want to calculate
  * ceil(n/b). We don't depend on floating point arithmetic in this
  * hash, so to calculate ceil(n/b) with integers we could write
- * 
+ *
  *      ceil(n/b) = (n/b) + ((n%b)?1:0)
- * 
+ *
  * and in fact a previous version of this hash did just that.
  * But now we have improved things a bit by recognizing that b is
  * always a power of two. We keep its base 2 log handy (call it lb),
  * so now we can write this with a bit shift and logical AND:
- * 
+ *
  *      ceil(n/b) = (n>>lb) + ( (n & (b-1)) ? 1:0)
- * 
+ *
  */
-#define HASH_EXPAND_BUCKETS(tbl)                                                 \
-do {                                                                             \
-    unsigned _he_bkt;                                                            \
-    unsigned _he_bkt_i;                                                          \
-    struct UT_hash_handle *_he_thh, *_he_hh_nxt;                                 \
-    UT_hash_bucket *_he_new_buckets, *_he_newbkt;                                \
-    _he_new_buckets = (UT_hash_bucket*)uthash_malloc(                            \
-             2 * tbl->num_buckets * sizeof(struct UT_hash_bucket));              \
-    if (!_he_new_buckets) { uthash_fatal( "out of memory"); }                    \
-    memset(_he_new_buckets, 0,                                                   \
-            2 * tbl->num_buckets * sizeof(struct UT_hash_bucket));               \
-    tbl->ideal_chain_maxlen =                                                    \
-       (tbl->num_items >> (tbl->log2_num_buckets+1)) +                           \
-       ((tbl->num_items & ((tbl->num_buckets*2)-1)) ? 1 : 0);                    \
-    tbl->nonideal_items = 0;                                                     \
-    for(_he_bkt_i = 0; _he_bkt_i < tbl->num_buckets; _he_bkt_i++)                \
-    {                                                                            \
-        _he_thh = tbl->buckets[ _he_bkt_i ].hh_head;                             \
-        while (_he_thh) {                                                        \
-           _he_hh_nxt = _he_thh->hh_next;                                        \
-           HASH_TO_BKT( _he_thh->hashv, tbl->num_buckets*2, _he_bkt);            \
-           _he_newbkt = &(_he_new_buckets[ _he_bkt ]);                           \
-           if (++(_he_newbkt->count) > tbl->ideal_chain_maxlen) {                \
-             tbl->nonideal_items++;                                              \
-             _he_newbkt->expand_mult = _he_newbkt->count /                       \
-                                        tbl->ideal_chain_maxlen;                 \
-           }                                                                     \
-           _he_thh->hh_prev = NULL;                                              \
-           _he_thh->hh_next = _he_newbkt->hh_head;                               \
-           if (_he_newbkt->hh_head) _he_newbkt->hh_head->hh_prev =               \
-                _he_thh;                                                         \
-           _he_newbkt->hh_head = _he_thh;                                        \
-           _he_thh = _he_hh_nxt;                                                 \
+#define HASH_EXPAND_BUCKETS(hh,tbl,oomed)                                        \
+do {                                                                             \
+  unsigned _he_bkt;                                                              \
+  unsigned _he_bkt_i;                                                            \
+  struct UT_hash_handle *_he_thh, *_he_hh_nxt;                                   \
+  UT_hash_bucket *_he_new_buckets, *_he_newbkt;                                  \
+  _he_new_buckets = (UT_hash_bucket*)uthash_malloc(                              \
+           2UL * (tbl)->num_buckets * sizeof(struct UT_hash_bucket));            \
+  if (!_he_new_buckets) {                                                        \
+    HASH_RECORD_OOM(oomed);                                                      \
+  } else {                                                                       \
+    uthash_bzero(_he_new_buckets,                                                \
+        2UL * (tbl)->num_buckets * sizeof(struct UT_hash_bucket));               \
+    (tbl)->ideal_chain_maxlen =                                                  \
+       ((tbl)->num_items >> ((tbl)->log2_num_buckets+1U)) +                      \
+       ((((tbl)->num_items & (((tbl)->num_buckets*2U)-1U)) != 0U) ? 1U : 0U);    \
+    (tbl)->nonideal_items = 0;                                                   \
+    for (_he_bkt_i = 0; _he_bkt_i < (tbl)->num_buckets; _he_bkt_i++) {           \
+      _he_thh = (tbl)->buckets[ _he_bkt_i ].hh_head;                             \
+      while (_he_thh != NULL) {                                                  \
+        _he_hh_nxt = _he_thh->hh_next;                                           \
+        HASH_TO_BKT(_he_thh->hashv, (tbl)->num_buckets * 2U, _he_bkt);           \
+        _he_newbkt = &(_he_new_buckets[_he_bkt]);                                \
+        if (++(_he_newbkt->count) > (tbl)->ideal_chain_maxlen) {                 \
+          (tbl)->nonideal_items++;                                               \
+          _he_newbkt->expand_mult = _he_newbkt->count / (tbl)->ideal_chain_maxlen; \
+        }                                                                        \
+        _he_thh->hh_prev = NULL;                                                 \
+        _he_thh->hh_next = _he_newbkt->hh_head;                                  \
+        if (_he_newbkt->hh_head != NULL) {                                       \
+          _he_newbkt->hh_head->hh_prev = _he_thh;                                \
         }                                                                        \
+        _he_newbkt->hh_head = _he_thh;                                           \
+        _he_thh = _he_hh_nxt;                                                    \
+      }                                                                          \
     }                                                                            \
-    uthash_free( tbl->buckets, tbl->num_buckets*sizeof(struct UT_hash_bucket) ); \
-    tbl->num_buckets *= 2;                                                       \
-    tbl->log2_num_buckets++;                                                     \
-    tbl->buckets = _he_new_buckets;                                              \
-    tbl->ineff_expands = (tbl->nonideal_items > (tbl->num_items >> 1)) ?         \
-        (tbl->ineff_expands+1) : 0;                                              \
-    if (tbl->ineff_expands > 1) {                                                \
-        tbl->noexpand=1;                                                         \
-        uthash_noexpand_fyi(tbl);                                                \
+    uthash_free((tbl)->buckets, (tbl)->num_buckets * sizeof(struct UT_hash_bucket)); \
+    (tbl)->num_buckets *= 2U;                                                    \
+    (tbl)->log2_num_buckets++;                                                   \
+    (tbl)->buckets = _he_new_buckets;                                            \
+    (tbl)->ineff_expands = ((tbl)->nonideal_items > ((tbl)->num_items >> 1)) ?   \
+        ((tbl)->ineff_expands+1U) : 0U;                                          \
+    if ((tbl)->ineff_expands > 1U) {                                             \
+      (tbl)->noexpand = 1;                                                       \
+      uthash_noexpand_fyi(tbl);                                                  \
     }                                                                            \
     uthash_expand_fyi(tbl);                                                      \
-} while(0)
+  }                                                                              \
+} while (0)
 
 
 /* This is an adaptation of Simon Tatham's O(n log(n)) mergesort */
-/* Note that HASH_SORT assumes the hash handle name to be hh. 
+/* Note that HASH_SORT assumes the hash handle name to be hh.
  * HASH_SRT was added to allow the hash handle name to be passed in. */
 #define HASH_SORT(head,cmpfcn) HASH_SRT(hh,head,cmpfcn)
 #define HASH_SRT(hh,head,cmpfcn)                                                 \
@@ -722,161 +963,179 @@ do {
   unsigned _hs_i;                                                                \
   unsigned _hs_looping,_hs_nmerges,_hs_insize,_hs_psize,_hs_qsize;               \
   struct UT_hash_handle *_hs_p, *_hs_q, *_hs_e, *_hs_list, *_hs_tail;            \
-  if (head) {                                                                    \
-      _hs_insize = 1;                                                            \
-      _hs_looping = 1;                                                           \
-      _hs_list = &((head)->hh);                                                  \
-      while (_hs_looping) {                                                      \
-          _hs_p = _hs_list;                                                      \
-          _hs_list = NULL;                                                       \
-          _hs_tail = NULL;                                                       \
-          _hs_nmerges = 0;                                                       \
-          while (_hs_p) {                                                        \
-              _hs_nmerges++;                                                     \
-              _hs_q = _hs_p;                                                     \
-              _hs_psize = 0;                                                     \
-              for ( _hs_i = 0; _hs_i  < _hs_insize; _hs_i++ ) {                  \
-                  _hs_psize++;                                                   \
-                  _hs_q = (UT_hash_handle*)((_hs_q->next) ?                      \
-                          ((void*)((char*)(_hs_q->next) +                        \
-                          (head)->hh.tbl->hho)) : NULL);                         \
-                  if (! (_hs_q) ) break;                                         \
-              }                                                                  \
-              _hs_qsize = _hs_insize;                                            \
-              while ((_hs_psize > 0) || ((_hs_qsize > 0) && _hs_q )) {           \
-                  if (_hs_psize == 0) {                                          \
-                      _hs_e = _hs_q;                                             \
-                      _hs_q = (UT_hash_handle*)((_hs_q->next) ?                  \
-                              ((void*)((char*)(_hs_q->next) +                    \
-                              (head)->hh.tbl->hho)) : NULL);                     \
-                      _hs_qsize--;                                               \
-                  } else if ( (_hs_qsize == 0) || !(_hs_q) ) {                   \
-                      _hs_e = _hs_p;                                             \
-                      if (_hs_p){                                                \
-                        _hs_p = (UT_hash_handle*)((_hs_p->next) ?                \
-                                ((void*)((char*)(_hs_p->next) +                  \
-                                (head)->hh.tbl->hho)) : NULL);                   \
-                       }                                                         \
-                      _hs_psize--;                                               \
-                  } else if ((                                                   \
-                      cmpfcn(DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl,_hs_p)), \
-                             DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl,_hs_q))) \
-                             ) <= 0) {                                           \
-                      _hs_e = _hs_p;                                             \
-                      if (_hs_p){                                                \
-                        _hs_p = (UT_hash_handle*)((_hs_p->next) ?                \
-                               ((void*)((char*)(_hs_p->next) +                   \
-                               (head)->hh.tbl->hho)) : NULL);                    \
-                       }                                                         \
-                      _hs_psize--;                                               \
-                  } else {                                                       \
-                      _hs_e = _hs_q;                                             \
-                      _hs_q = (UT_hash_handle*)((_hs_q->next) ?                  \
-                              ((void*)((char*)(_hs_q->next) +                    \
-                              (head)->hh.tbl->hho)) : NULL);                     \
-                      _hs_qsize--;                                               \
-                  }                                                              \
-                  if ( _hs_tail ) {                                              \
-                      _hs_tail->next = ((_hs_e) ?                                \
-                            ELMT_FROM_HH((head)->hh.tbl,_hs_e) : NULL);          \
-                  } else {                                                       \
-                      _hs_list = _hs_e;                                          \
-                  }                                                              \
-                  if (_hs_e) {                                                   \
-                  _hs_e->prev = ((_hs_tail) ?                                    \
-                     ELMT_FROM_HH((head)->hh.tbl,_hs_tail) : NULL);              \
-                  }                                                              \
-                  _hs_tail = _hs_e;                                              \
-              }                                                                  \
-              _hs_p = _hs_q;                                                     \
+  if (head != NULL) {                                                            \
+    _hs_insize = 1;                                                              \
+    _hs_looping = 1;                                                             \
+    _hs_list = &((head)->hh);                                                    \
+    while (_hs_looping != 0U) {                                                  \
+      _hs_p = _hs_list;                                                          \
+      _hs_list = NULL;                                                           \
+      _hs_tail = NULL;                                                           \
+      _hs_nmerges = 0;                                                           \
+      while (_hs_p != NULL) {                                                    \
+        _hs_nmerges++;                                                           \
+        _hs_q = _hs_p;                                                           \
+        _hs_psize = 0;                                                           \
+        for (_hs_i = 0; _hs_i < _hs_insize; ++_hs_i) {                           \
+          _hs_psize++;                                                           \
+          _hs_q = ((_hs_q->next != NULL) ?                                       \
+            HH_FROM_ELMT((head)->hh.tbl, _hs_q->next) : NULL);                   \
+          if (_hs_q == NULL) {                                                   \
+            break;                                                               \
           }                                                                      \
-          if (_hs_tail){                                                         \
-            _hs_tail->next = NULL;                                               \
+        }                                                                        \
+        _hs_qsize = _hs_insize;                                                  \
+        while ((_hs_psize != 0U) || ((_hs_qsize != 0U) && (_hs_q != NULL))) {    \
+          if (_hs_psize == 0U) {                                                 \
+            _hs_e = _hs_q;                                                       \
+            _hs_q = ((_hs_q->next != NULL) ?                                     \
+              HH_FROM_ELMT((head)->hh.tbl, _hs_q->next) : NULL);                 \
+            _hs_qsize--;                                                         \
+          } else if ((_hs_qsize == 0U) || (_hs_q == NULL)) {                     \
+            _hs_e = _hs_p;                                                       \
+            if (_hs_p != NULL) {                                                 \
+              _hs_p = ((_hs_p->next != NULL) ?                                   \
+                HH_FROM_ELMT((head)->hh.tbl, _hs_p->next) : NULL);               \
+            }                                                                    \
+            _hs_psize--;                                                         \
+          } else if ((cmpfcn(                                                    \
+                DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl, _hs_p)),             \
+                DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl, _hs_q))              \
+                )) <= 0) {                                                       \
+            _hs_e = _hs_p;                                                       \
+            if (_hs_p != NULL) {                                                 \
+              _hs_p = ((_hs_p->next != NULL) ?                                   \
+                HH_FROM_ELMT((head)->hh.tbl, _hs_p->next) : NULL);               \
+            }                                                                    \
+            _hs_psize--;                                                         \
+          } else {                                                               \
+            _hs_e = _hs_q;                                                       \
+            _hs_q = ((_hs_q->next != NULL) ?                                     \
+              HH_FROM_ELMT((head)->hh.tbl, _hs_q->next) : NULL);                 \
+            _hs_qsize--;                                                         \
           }                                                                      \
-          if ( _hs_nmerges <= 1 ) {                                              \
-              _hs_looping=0;                                                     \
-              (head)->hh.tbl->tail = _hs_tail;                                   \
-              DECLTYPE_ASSIGN(head,ELMT_FROM_HH((head)->hh.tbl, _hs_list));      \
+          if ( _hs_tail != NULL ) {                                              \
+            _hs_tail->next = ((_hs_e != NULL) ?                                  \
+              ELMT_FROM_HH((head)->hh.tbl, _hs_e) : NULL);                       \
+          } else {                                                               \
+            _hs_list = _hs_e;                                                    \
           }                                                                      \
-          _hs_insize *= 2;                                                       \
+          if (_hs_e != NULL) {                                                   \
+            _hs_e->prev = ((_hs_tail != NULL) ?                                  \
+              ELMT_FROM_HH((head)->hh.tbl, _hs_tail) : NULL);                    \
+          }                                                                      \
+          _hs_tail = _hs_e;                                                      \
+        }                                                                        \
+        _hs_p = _hs_q;                                                           \
+      }                                                                          \
+      if (_hs_tail != NULL) {                                                    \
+        _hs_tail->next = NULL;                                                   \
       }                                                                          \
-      HASH_FSCK(hh,head);                                                        \
- }                                                                               \
+      if (_hs_nmerges <= 1U) {                                                   \
+        _hs_looping = 0;                                                         \
+        (head)->hh.tbl->tail = _hs_tail;                                         \
+        DECLTYPE_ASSIGN(head, ELMT_FROM_HH((head)->hh.tbl, _hs_list));           \
+      }                                                                          \
+      _hs_insize *= 2U;                                                          \
+    }                                                                            \
+    HASH_FSCK(hh, head, "HASH_SRT");                                             \
+  }                                                                              \
 } while (0)
 
-/* This function selects items from one hash into another hash. 
- * The end result is that the selected items have dual presence 
- * in both hashes. There is no copy of the items made; rather 
- * they are added into the new hash through a secondary hash 
+/* This function selects items from one hash into another hash.
+ * The end result is that the selected items have dual presence
+ * in both hashes. There is no copy of the items made; rather
+ * they are added into the new hash through a secondary hash
  * hash handle that must be present in the structure. */
 #define HASH_SELECT(hh_dst, dst, hh_src, src, cond)                              \
 do {                                                                             \
   unsigned _src_bkt, _dst_bkt;                                                   \
-  void *_last_elt=NULL, *_elt;                                                   \
+  void *_last_elt = NULL, *_elt;                                                 \
   UT_hash_handle *_src_hh, *_dst_hh, *_last_elt_hh=NULL;                         \
   ptrdiff_t _dst_hho = ((char*)(&(dst)->hh_dst) - (char*)(dst));                 \
-  if (src) {                                                                     \
-    for(_src_bkt=0; _src_bkt < (src)->hh_src.tbl->num_buckets; _src_bkt++) {     \
-      for(_src_hh = (src)->hh_src.tbl->buckets[_src_bkt].hh_head;                \
-          _src_hh;                                                               \
-          _src_hh = _src_hh->hh_next) {                                          \
-          _elt = ELMT_FROM_HH((src)->hh_src.tbl, _src_hh);                       \
-          if (cond(_elt)) {                                                      \
-            _dst_hh = (UT_hash_handle*)(((char*)_elt) + _dst_hho);               \
-            _dst_hh->key = _src_hh->key;                                         \
-            _dst_hh->keylen = _src_hh->keylen;                                   \
-            _dst_hh->hashv = _src_hh->hashv;                                     \
-            _dst_hh->prev = _last_elt;                                           \
-            _dst_hh->next = NULL;                                                \
-            if (_last_elt_hh) { _last_elt_hh->next = _elt; }                     \
-            if (!dst) {                                                          \
-              DECLTYPE_ASSIGN(dst,_elt);                                         \
-              HASH_MAKE_TABLE(hh_dst,dst);                                       \
-            } else {                                                             \
-              _dst_hh->tbl = (dst)->hh_dst.tbl;                                  \
-            }                                                                    \
-            HASH_TO_BKT(_dst_hh->hashv, _dst_hh->tbl->num_buckets, _dst_bkt);    \
-            HASH_ADD_TO_BKT(_dst_hh->tbl->buckets[_dst_bkt],_dst_hh);            \
-            (dst)->hh_dst.tbl->num_items++;                                      \
-            _last_elt = _elt;                                                    \
-            _last_elt_hh = _dst_hh;                                              \
+  if ((src) != NULL) {                                                           \
+    for (_src_bkt=0; _src_bkt < (src)->hh_src.tbl->num_buckets; _src_bkt++) {    \
+      for (_src_hh = (src)->hh_src.tbl->buckets[_src_bkt].hh_head;               \
+        _src_hh != NULL;                                                         \
+        _src_hh = _src_hh->hh_next) {                                            \
+        _elt = ELMT_FROM_HH((src)->hh_src.tbl, _src_hh);                         \
+        if (cond(_elt)) {                                                        \
+          IF_HASH_NONFATAL_OOM( int _hs_oomed = 0; )                             \
+          _dst_hh = (UT_hash_handle*)(((char*)_elt) + _dst_hho);                 \
+          _dst_hh->key = _src_hh->key;                                           \
+          _dst_hh->keylen = _src_hh->keylen;                                     \
+          _dst_hh->hashv = _src_hh->hashv;                                       \
+          _dst_hh->prev = _last_elt;                                             \
+          _dst_hh->next = NULL;                                                  \
+          if (_last_elt_hh != NULL) {                                            \
+            _last_elt_hh->next = _elt;                                           \
+          }                                                                      \
+          if ((dst) == NULL) {                                                   \
+            DECLTYPE_ASSIGN(dst, _elt);                                          \
+            HASH_MAKE_TABLE(hh_dst, dst, _hs_oomed);                             \
+            IF_HASH_NONFATAL_OOM(                                                \
+              if (_hs_oomed) {                                                   \
+                uthash_nonfatal_oom(_elt);                                       \
+                (dst) = NULL;                                                    \
+                continue;                                                        \
+              }                                                                  \
+            )                                                                    \
+          } else {                                                               \
+            _dst_hh->tbl = (dst)->hh_dst.tbl;                                    \
           }                                                                      \
+          HASH_TO_BKT(_dst_hh->hashv, _dst_hh->tbl->num_buckets, _dst_bkt);      \
+          HASH_ADD_TO_BKT(_dst_hh->tbl->buckets[_dst_bkt], hh_dst, _dst_hh, _hs_oomed); \
+          (dst)->hh_dst.tbl->num_items++;                                        \
+          IF_HASH_NONFATAL_OOM(                                                  \
+            if (_hs_oomed) {                                                     \
+              HASH_ROLLBACK_BKT(hh_dst, dst, _dst_hh);                           \
+              HASH_DELETE_HH(hh_dst, dst, _dst_hh);                              \
+              _dst_hh->tbl = NULL;                                               \
+              uthash_nonfatal_oom(_elt);                                         \
+              continue;                                                          \
+            }                                                                    \
+          )                                                                      \
+          HASH_BLOOM_ADD(_dst_hh->tbl, _dst_hh->hashv);                          \
+          _last_elt = _elt;                                                      \
+          _last_elt_hh = _dst_hh;                                                \
+        }                                                                        \
       }                                                                          \
     }                                                                            \
   }                                                                              \
-  HASH_FSCK(hh_dst,dst);                                                         \
+  HASH_FSCK(hh_dst, dst, "HASH_SELECT");                                         \
 } while (0)
 
 #define HASH_CLEAR(hh,head)                                                      \
 do {                                                                             \
-  if (head) {                                                                    \
+  if ((head) != NULL) {                                                          \
+    HASH_BLOOM_FREE((head)->hh.tbl);                                             \
     uthash_free((head)->hh.tbl->buckets,                                         \
                 (head)->hh.tbl->num_buckets*sizeof(struct UT_hash_bucket));      \
-    HASH_BLOOM_FREE((head)->hh.tbl);                                             \
     uthash_free((head)->hh.tbl, sizeof(UT_hash_table));                          \
-    (head)=NULL;                                                                 \
+    (head) = NULL;                                                               \
   }                                                                              \
-} while(0)
+} while (0)
 
 #define HASH_OVERHEAD(hh,head)                                                   \
- (size_t)((((head)->hh.tbl->num_items   * sizeof(UT_hash_handle))   +            \
-           ((head)->hh.tbl->num_buckets * sizeof(UT_hash_bucket))   +            \
-            (sizeof(UT_hash_table))                                 +            \
-            (HASH_BLOOM_BYTELEN)))
+ (((head) != NULL) ? (                                                           \
+ (size_t)(((head)->hh.tbl->num_items   * sizeof(UT_hash_handle))   +             \
+          ((head)->hh.tbl->num_buckets * sizeof(UT_hash_bucket))   +             \
+           sizeof(UT_hash_table)                                   +             \
+           (HASH_BLOOM_BYTELEN))) : 0U)
 
 #ifdef NO_DECLTYPE
 #define HASH_ITER(hh,head,el,tmp)                                                \
-for((el)=(head), (*(char**)(&(tmp)))=(char*)((head)?(head)->hh.next:NULL);       \
-  el; (el)=(tmp),(*(char**)(&(tmp)))=(char*)((tmp)?(tmp)->hh.next:NULL)) 
+for(((el)=(head)), ((*(char**)(&(tmp)))=(char*)((head!=NULL)?(head)->hh.next:NULL)); \
+  (el) != NULL; ((el)=(tmp)), ((*(char**)(&(tmp)))=(char*)((tmp!=NULL)?(tmp)->hh.next:NULL)))
 #else
 #define HASH_ITER(hh,head,el,tmp)                                                \
-for((el)=(head),(tmp)=DECLTYPE(el)((head)?(head)->hh.next:NULL);                 \
-  el; (el)=(tmp),(tmp)=DECLTYPE(el)((tmp)?(tmp)->hh.next:NULL))
+for(((el)=(head)), ((tmp)=DECLTYPE(el)((head!=NULL)?(head)->hh.next:NULL));      \
+  (el) != NULL; ((el)=(tmp)), ((tmp)=DECLTYPE(el)((tmp!=NULL)?(tmp)->hh.next:NULL)))
 #endif
 
 /* obtain a count of items in the hash */
-#define HASH_COUNT(head) HASH_CNT(hh,head) 
-#define HASH_CNT(hh,head) ((head)?((head)->hh.tbl->num_items):0)
+#define HASH_COUNT(head) HASH_CNT(hh,head)
+#define HASH_CNT(hh,head) ((head != NULL)?((head)->hh.tbl->num_items):0U)
 
 typedef struct UT_hash_bucket {
    struct UT_hash_handle *hh_head;
@@ -884,7 +1143,7 @@ typedef struct UT_hash_bucket {
 
    /* expand_mult is normally set to 0. In this situation, the max chain length
     * threshold is enforced at its default value, HASH_BKT_CAPACITY_THRESH. (If
-    * the bucket's chain exceeds this length, bucket expansion is triggered). 
+    * the bucket's chain exceeds this length, bucket expansion is triggered).
     * However, setting expand_mult to a non-zero value delays bucket expansion
     * (that would be triggered by additions to this particular bucket)
     * until its chain length reaches a *multiple* of HASH_BKT_CAPACITY_THRESH.
@@ -892,15 +1151,15 @@ typedef struct UT_hash_bucket {
     * multiplier is to reduce bucket expansions, since they are expensive, in
     * situations where we know that a particular bucket tends to be overused.
     * It is better to let its chain length grow to a longer yet-still-bounded
-    * value, than to do an O(n) bucket expansion too often. 
+    * value, than to do an O(n) bucket expansion too often.
     */
    unsigned expand_mult;
 
 } UT_hash_bucket;
 
 /* random signature used only to find hash tables in external analysis */
-#define HASH_SIGNATURE 0xa0111fe1
-#define HASH_BLOOM_SIGNATURE 0xb12220f2
+#define HASH_SIGNATURE 0xa0111fe1u
+#define HASH_BLOOM_SIGNATURE 0xb12220f2u
 
 typedef struct UT_hash_table {
    UT_hash_bucket *buckets;
@@ -918,7 +1177,7 @@ typedef struct UT_hash_table {
     * hash distribution; reaching them in a chain traversal takes >ideal steps */
    unsigned nonideal_items;
 
-   /* ineffective expands occur when a bucket doubling was performed, but 
+   /* ineffective expands occur when a bucket doubling was performed, but
     * afterward, more than half the items in the hash had nonideal chain
     * positions. If this happens on two consecutive expansions we inhibit any
     * further expansion, as it's not helping; this happens when the hash
@@ -930,7 +1189,7 @@ typedef struct UT_hash_table {
 #ifdef HASH_BLOOM
    uint32_t bloom_sig; /* used only to test bloom exists in external analysis */
    uint8_t *bloom_bv;
-   char bloom_nbits;
+   uint8_t bloom_nbits;
 #endif
 
 } UT_hash_table;
@@ -947,4 +1206,3 @@ typedef struct UT_hash_handle {
 } UT_hash_handle;
 
 #endif /* UTHASH_H */
- 
diff --git a/debian/modules/nchan/src/util/hdr_histogram.c b/debian/modules/nchan/src/util/hdr_histogram.c
new file mode 100644
index 00000000..9b4a7700
--- /dev/null
+++ b/debian/modules/nchan/src/util/hdr_histogram.c
@@ -0,0 +1,1015 @@
+/**
+ * hdr_histogram.c
+ * Written by Michael Barker and released to the public domain,
+ * as explained at http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+#include <math.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <nchan_module.h>
+#include <util/shmem.h>
+#include <store/memory/store.h>
+
+#include "hdr_histogram.h"
+
+//  ######   #######  ##     ## ##    ## ########  ######
+// ##    ## ##     ## ##     ## ###   ##    ##    ##    ##
+// ##       ##     ## ##     ## ####  ##    ##    ##
+// ##       ##     ## ##     ## ## ## ##    ##     ######
+// ##       ##     ## ##     ## ##  ####    ##          ##
+// ##    ## ##     ## ##     ## ##   ###    ##    ##    ##
+//  ######   #######   #######  ##    ##    ##     ######
+
+static int32_t normalize_index(const struct hdr_histogram* h, int32_t index)
+{
+    if (h->normalizing_index_offset == 0)
+    {
+        return index;
+    }
+
+    int32_t normalized_index = index - h->normalizing_index_offset;
+    int32_t adjustment = 0;
+
+    if (normalized_index < 0)
+    {
+        adjustment = h->counts_len;
+    }
+    else if (normalized_index >= h->counts_len)
+    {
+        adjustment = -h->counts_len;
+    }
+
+    return normalized_index + adjustment;
+}
+
+static int64_t counts_get_direct(const struct hdr_histogram* h, int32_t index)
+{
+    return h->counts[index];
+}
+
+static int64_t counts_get_normalised(const struct hdr_histogram* h, int32_t index)
+{
+    return counts_get_direct(h, normalize_index(h, index));
+}
+
+static void counts_inc_normalised(
+    struct hdr_histogram* h, int32_t index, int64_t value)
+{
+    int32_t normalised_index = normalize_index(h, index);
+    h->counts[normalised_index] += value;
+    h->total_count += value;
+}
+
+static void update_min_max(struct hdr_histogram* h, int64_t value)
+{
+    h->min_value = (value < h->min_value && value != 0) ? value : h->min_value;
+    h->max_value = (value > h->max_value) ? value : h->max_value;
+}
+
+// ##     ## ######## #### ##       #### ######## ##    ##
+// ##     ##    ##     ##  ##        ##     ##     ##  ##
+// ##     ##    ##     ##  ##        ##     ##      ####
+// ##     ##    ##     ##  ##        ##     ##       ##
+// ##     ##    ##     ##  ##        ##     ##       ##
+// ##     ##    ##     ##  ##        ##     ##       ##
+//  #######     ##    #### ######## ####    ##       ##
+
+static int64_t power(int64_t base, int64_t exp)
+{
+    int64_t result = 1;
+    while(exp)
+    {
+        result *= base; exp--;
+    }
+    return result;
+}
+
+#if defined(_MSC_VER)
+#pragma intrinsic(_BitScanReverse64)
+#endif
+
+static int32_t get_bucket_index(const struct hdr_histogram* h, int64_t value)
+{
+#if defined(_MSC_VER)
+    uint32_t leading_zero = 0;
+    _BitScanReverse64(&leading_zero, value | h->sub_bucket_mask);
+    int32_t pow2ceiling = 64 - (63 - leading_zero); // smallest power of 2 containing value
+#else
+    int32_t pow2ceiling = 64 - __builtin_clzll(value | h->sub_bucket_mask); // smallest power of 2 containing value
+#endif
+    return pow2ceiling - h->unit_magnitude - (h->sub_bucket_half_count_magnitude + 1);
+}
+
+static int32_t get_sub_bucket_index(int64_t value, int32_t bucket_index, int32_t unit_magnitude)
+{
+    return (int32_t)(value >> (bucket_index + unit_magnitude));
+}
+
+static int32_t counts_index(const struct hdr_histogram* h, int32_t bucket_index, int32_t sub_bucket_index)
+{
+    // Calculate the index for the first entry in the bucket:
+    // (The following is the equivalent of ((bucket_index + 1) * subBucketHalfCount) ):
+    int32_t bucket_base_index = (bucket_index + 1) << h->sub_bucket_half_count_magnitude;
+    // Calculate the offset in the bucket:
+    int32_t offset_in_bucket = sub_bucket_index - h->sub_bucket_half_count;
+    // The following is the equivalent of ((sub_bucket_index  - subBucketHalfCount) + bucketBaseIndex;
+    return bucket_base_index + offset_in_bucket;
+}
+
+static int64_t value_from_index(int32_t bucket_index, int32_t sub_bucket_index, int32_t unit_magnitude)
+{
+    return ((int64_t) sub_bucket_index) << (bucket_index + unit_magnitude);
+}
+
+int32_t counts_index_for(const struct hdr_histogram* h, int64_t value)
+{
+    int32_t bucket_index     = get_bucket_index(h, value);
+    int32_t sub_bucket_index = get_sub_bucket_index(value, bucket_index, h->unit_magnitude);
+
+    return counts_index(h, bucket_index, sub_bucket_index);
+}
+
+int64_t hdr_value_at_index(const struct hdr_histogram *h, int32_t index)
+{
+    int32_t bucket_index = (index >> h->sub_bucket_half_count_magnitude) - 1;
+    int32_t sub_bucket_index = (index & (h->sub_bucket_half_count - 1)) + h->sub_bucket_half_count;
+
+    if (bucket_index < 0)
+    {
+        sub_bucket_index -= h->sub_bucket_half_count;
+        bucket_index = 0;
+    }
+
+    return value_from_index(bucket_index, sub_bucket_index, h->unit_magnitude);
+}
+
+int64_t hdr_size_of_equivalent_value_range(const struct hdr_histogram* h, int64_t value)
+{
+    int32_t bucket_index     = get_bucket_index(h, value);
+    int32_t sub_bucket_index = get_sub_bucket_index(value, bucket_index, h->unit_magnitude);
+    int32_t adjusted_bucket  = (sub_bucket_index >= h->sub_bucket_count) ? (bucket_index + 1) : bucket_index;
+    return INT64_C(1) << (h->unit_magnitude + adjusted_bucket);
+}
+
+static int64_t lowest_equivalent_value(const struct hdr_histogram* h, int64_t value)
+{
+    int32_t bucket_index     = get_bucket_index(h, value);
+    int32_t sub_bucket_index = get_sub_bucket_index(value, bucket_index, h->unit_magnitude);
+    return value_from_index(bucket_index, sub_bucket_index, h->unit_magnitude);
+}
+
+int64_t hdr_next_non_equivalent_value(const struct hdr_histogram *h, int64_t value)
+{
+    return lowest_equivalent_value(h, value) + hdr_size_of_equivalent_value_range(h, value);
+}
+
+static int64_t highest_equivalent_value(const struct hdr_histogram* h, int64_t value)
+{
+    return hdr_next_non_equivalent_value(h, value) - 1;
+}
+
+int64_t hdr_median_equivalent_value(const struct hdr_histogram *h, int64_t value)
+{
+    return lowest_equivalent_value(h, value) + (hdr_size_of_equivalent_value_range(h, value) >> 1);
+}
+
+static int64_t non_zero_min(const struct hdr_histogram* h)
+{
+    if (INT64_MAX == h->min_value)
+    {
+        return INT64_MAX;
+    }
+
+    return lowest_equivalent_value(h, h->min_value);
+}
+
+void hdr_reset_internal_counters(struct hdr_histogram* h)
+{
+    int min_non_zero_index = -1;
+    int max_index = -1;
+    int64_t observed_total_count = 0;
+    int i;
+
+    for (i = 0; i < h->counts_len; i++)
+    {
+        int64_t count_at_index;
+
+        if ((count_at_index = counts_get_direct(h, i)) > 0)
+        {
+            observed_total_count += count_at_index;
+            max_index = i;
+            if (min_non_zero_index == -1 && i != 0)
+            {
+                min_non_zero_index = i;
+            }
+        }
+    }
+
+    if (max_index == -1)
+    {
+        h->max_value = 0;
+    }
+    else
+    {
+        int64_t max_value = hdr_value_at_index(h, max_index);
+        h->max_value = highest_equivalent_value(h, max_value);
+    }
+
+    if (min_non_zero_index == -1)
+    {
+        h->min_value = INT64_MAX;
+    }
+    else
+    {
+        h->min_value = hdr_value_at_index(h, min_non_zero_index);
+    }
+
+    h->total_count = observed_total_count;
+}
+
+static int32_t buckets_needed_to_cover_value(int64_t value, int32_t sub_bucket_count, int32_t unit_magnitude)
+{
+    int64_t smallest_untrackable_value = ((int64_t) sub_bucket_count) << unit_magnitude;
+    int32_t buckets_needed = 1;
+    while (smallest_untrackable_value <= value)
+    {
+        if (smallest_untrackable_value > INT64_MAX / 2)
+        {
+            return buckets_needed + 1;
+        }
+        smallest_untrackable_value <<= 1;
+        buckets_needed++;
+    }
+
+    return buckets_needed;
+}
+
+// ##     ## ######## ##     ##  #######  ########  ##    ##
+// ###   ### ##       ###   ### ##     ## ##     ##  ##  ##
+// #### #### ##       #### #### ##     ## ##     ##   ####
+// ## ### ## ######   ## ### ## ##     ## ########     ##
+// ##     ## ##       ##     ## ##     ## ##   ##      ##
+// ##     ## ##       ##     ## ##     ## ##    ##     ##
+// ##     ## ######## ##     ##  #######  ##     ##    ##
+
+int hdr_calculate_bucket_config(
+        int64_t lowest_trackable_value,
+        int64_t highest_trackable_value,
+        int significant_figures,
+        struct hdr_histogram_bucket_config* cfg)
+{
+    if (lowest_trackable_value < 1 ||
+            significant_figures < 1 || 5 < significant_figures)
+    {
+        return EINVAL;
+    }
+    else if (lowest_trackable_value * 2 > highest_trackable_value)
+    {
+        return EINVAL;
+    }
+
+    cfg->lowest_trackable_value = lowest_trackable_value;
+    cfg->significant_figures = significant_figures;
+    cfg->highest_trackable_value = highest_trackable_value;
+
+    int64_t largest_value_with_single_unit_resolution = 2 * power(10, significant_figures);
+    int32_t sub_bucket_count_magnitude = (int32_t) ceil(log((double)largest_value_with_single_unit_resolution) / log(2));
+    cfg->sub_bucket_half_count_magnitude = ((sub_bucket_count_magnitude > 1) ? sub_bucket_count_magnitude : 1) - 1;
+
+    cfg->unit_magnitude = (int32_t) floor(log((double)lowest_trackable_value) / log(2));
+
+    cfg->sub_bucket_count      = (int32_t) pow(2, (cfg->sub_bucket_half_count_magnitude + 1));
+    cfg->sub_bucket_half_count = cfg->sub_bucket_count / 2;
+    cfg->sub_bucket_mask       = ((int64_t) cfg->sub_bucket_count - 1) << cfg->unit_magnitude;
+
+    if (cfg->unit_magnitude + cfg->sub_bucket_half_count_magnitude > 61)
+    {
+        return EINVAL;
+    }
+
+    cfg->bucket_count = buckets_needed_to_cover_value(highest_trackable_value, cfg->sub_bucket_count, (int32_t)cfg->unit_magnitude);
+    cfg->counts_len = (cfg->bucket_count + 1) * (cfg->sub_bucket_count / 2);
+
+    return 0;
+}
+
+void hdr_init_preallocated(struct hdr_histogram* h, struct hdr_histogram_bucket_config* cfg)
+{
+    h->lowest_trackable_value          = cfg->lowest_trackable_value;
+    h->highest_trackable_value         = cfg->highest_trackable_value;
+    h->unit_magnitude                  = (int32_t)cfg->unit_magnitude;
+    h->significant_figures             = (int32_t)cfg->significant_figures;
+    h->sub_bucket_half_count_magnitude = cfg->sub_bucket_half_count_magnitude;
+    h->sub_bucket_half_count           = cfg->sub_bucket_half_count;
+    h->sub_bucket_mask                 = cfg->sub_bucket_mask;
+    h->sub_bucket_count                = cfg->sub_bucket_count;
+    h->min_value                       = INT64_MAX;
+    h->max_value                       = 0;
+    h->normalizing_index_offset        = 0;
+    h->conversion_ratio                = 1.0;
+    h->bucket_count                    = cfg->bucket_count;
+    h->counts_len                      = cfg->counts_len;
+    h->total_count                     = 0;
+}
+
+int hdr_init_nchan_shm(
+        int64_t lowest_trackable_value,
+        int64_t highest_trackable_value,
+        int significant_figures,
+        struct hdr_histogram** result)
+{
+    struct hdr_histogram_bucket_config cfg;
+
+    int r = hdr_calculate_bucket_config(lowest_trackable_value, highest_trackable_value, significant_figures, &cfg);
+    if (r)
+    {
+        return r;
+    }
+
+    int64_t* counts = shm_calloc(nchan_store_memory_shmem, (size_t) cfg.counts_len * sizeof(int64_t), "hdrhistogram counts");
+    struct hdr_histogram* histogram = shm_calloc(nchan_store_memory_shmem, sizeof(struct hdr_histogram), "hdrhistogram");
+
+    if (!counts || !histogram)
+    {
+        return ENOMEM;
+    }
+
+    histogram->counts = counts;
+
+    hdr_init_preallocated(histogram, &cfg);
+    *result = histogram;
+
+    return 0;
+}
+
+void hdr_close_nchan_shm(struct hdr_histogram* h)
+{
+    shm_free(nchan_store_memory_shmem, h->counts);
+    shm_free(nchan_store_memory_shmem, h);
+}
+
+// reset a histogram to zero.
+void hdr_reset(struct hdr_histogram *h)
+{
+     h->total_count=0;
+     h->min_value = INT64_MAX;
+     h->max_value = 0;
+     memset(h->counts, 0, (sizeof(int64_t) * h->counts_len));
+}
+
+size_t hdr_get_memory_size(struct hdr_histogram *h)
+{
+    return sizeof(struct hdr_histogram) + h->counts_len * sizeof(int64_t);
+}
+
+// ##     ## ########  ########     ###    ######## ########  ######
+// ##     ## ##     ## ##     ##   ## ##      ##    ##       ##    ##
+// ##     ## ##     ## ##     ##  ##   ##     ##    ##       ##
+// ##     ## ########  ##     ## ##     ##    ##    ######    ######
+// ##     ## ##        ##     ## #########    ##    ##             ##
+// ##     ## ##        ##     ## ##     ##    ##    ##       ##    ##
+//  #######  ##        ########  ##     ##    ##    ########  ######
+
+
+bool hdr_record_value(struct hdr_histogram* h, int64_t value)
+{
+    return hdr_record_values(h, value, 1);
+}
+
+bool hdr_record_values(struct hdr_histogram* h, int64_t value, int64_t count)
+{
+    if (value < 0)
+    {
+        return false;
+    }
+
+    int32_t counts_index = counts_index_for(h, value);
+
+    if (counts_index < 0 || h->counts_len <= counts_index)
+    {
+        return false;
+    }
+
+    counts_inc_normalised(h, counts_index, count);
+    update_min_max(h, value);
+
+    return true;
+}
+
+bool hdr_record_corrected_value(struct hdr_histogram* h, int64_t value, int64_t expected_interval)
+{
+    return hdr_record_corrected_values(h, value, 1, expected_interval);
+}
+
+
+bool hdr_record_corrected_values(struct hdr_histogram* h, int64_t value, int64_t count, int64_t expected_interval)
+{
+    if (!hdr_record_values(h, value, count))
+    {
+        return false;
+    }
+
+    if (expected_interval <= 0 || value <= expected_interval)
+    {
+        return true;
+    }
+
+    int64_t missing_value = value - expected_interval;
+    for (; missing_value >= expected_interval; missing_value -= expected_interval)
+    {
+        if (!hdr_record_values(h, missing_value, count))
+        {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+int64_t hdr_add(struct hdr_histogram* h, const struct hdr_histogram* from)
+{
+    struct hdr_iter iter;
+    hdr_iter_recorded_init(&iter, from);
+    int64_t dropped = 0;
+
+    while (hdr_iter_next(&iter))
+    {
+        int64_t value = iter.value;
+        int64_t count = iter.count;
+
+        if (!hdr_record_values(h, value, count))
+        {
+            dropped += count;
+        }
+    }
+
+    return dropped;
+}
+
+int64_t hdr_add_while_correcting_for_coordinated_omission(
+        struct hdr_histogram* h, struct hdr_histogram* from, int64_t expected_interval)
+{
+    struct hdr_iter iter;
+    hdr_iter_recorded_init(&iter, from);
+    int64_t dropped = 0;
+
+    while (hdr_iter_next(&iter))
+    {
+        int64_t value = iter.value;
+        int64_t count = iter.count;
+
+        if (!hdr_record_corrected_values(h, value, count, expected_interval))
+        {
+            dropped += count;
+        }
+    }
+
+    return dropped;
+}
+
+
+
+// ##     ##    ###    ##       ##     ## ########  ######
+// ##     ##   ## ##   ##       ##     ## ##       ##    ##
+// ##     ##  ##   ##  ##       ##     ## ##       ##
+// ##     ## ##     ## ##       ##     ## ######    ######
+//  ##   ##  ######### ##       ##     ## ##             ##
+//   ## ##   ##     ## ##       ##     ## ##       ##    ##
+//    ###    ##     ## ########  #######  ########  ######
+
+
+int64_t hdr_max(const struct hdr_histogram* h)
+{
+    if (0 == h->max_value)
+    {
+        return 0;
+    }
+
+    return highest_equivalent_value(h, h->max_value);
+}
+
+int64_t hdr_min(const struct hdr_histogram* h)
+{
+    if (0 < hdr_count_at_index(h, 0))
+    {
+        return 0;
+    }
+
+    return non_zero_min(h);
+}
+
+int64_t hdr_value_at_percentile(const struct hdr_histogram* h, double percentile)
+{
+    struct hdr_iter iter;
+    hdr_iter_init(&iter, h);
+
+    double requested_percentile = percentile < 100.0 ? percentile : 100.0;
+    int64_t count_at_percentile =
+        (int64_t) (((requested_percentile / 100) * h->total_count) + 0.5);
+    count_at_percentile = count_at_percentile > 1 ? count_at_percentile : 1;
+    int64_t total = 0;
+
+    while (hdr_iter_next(&iter))
+    {
+        total += iter.count;
+
+        if (total >= count_at_percentile)
+        {
+            int64_t value_from_index = iter.value;
+            return highest_equivalent_value(h, value_from_index);
+        }
+    }
+
+    return 0;
+}
+
+double hdr_mean(const struct hdr_histogram* h)
+{
+    struct hdr_iter iter;
+    int64_t total = 0;
+
+    hdr_iter_init(&iter, h);
+
+    while (hdr_iter_next(&iter))
+    {
+        if (0 != iter.count)
+        {
+            total += iter.count * hdr_median_equivalent_value(h, iter.value);
+        }
+    }
+
+    return (total * 1.0) / h->total_count;
+}
+
+double hdr_stddev(const struct hdr_histogram* h)
+{
+    double mean = hdr_mean(h);
+    double geometric_dev_total = 0.0;
+
+    struct hdr_iter iter;
+    hdr_iter_init(&iter, h);
+
+    while (hdr_iter_next(&iter))
+    {
+        if (0 != iter.count)
+        {
+            double dev = (hdr_median_equivalent_value(h, iter.value) * 1.0) - mean;
+            geometric_dev_total += (dev * dev) * iter.count;
+        }
+    }
+
+    return sqrt(geometric_dev_total / h->total_count);
+}
+
+bool hdr_values_are_equivalent(const struct hdr_histogram* h, int64_t a, int64_t b)
+{
+    return lowest_equivalent_value(h, a) == lowest_equivalent_value(h, b);
+}
+
+int64_t hdr_lowest_equivalent_value(const struct hdr_histogram* h, int64_t value)
+{
+    return lowest_equivalent_value(h, value);
+}
+
+int64_t hdr_count_at_value(const struct hdr_histogram* h, int64_t value)
+{
+    return counts_get_normalised(h, counts_index_for(h, value));
+}
+
+int64_t hdr_count_at_index(const struct hdr_histogram* h, int32_t index)
+{
+    return counts_get_normalised(h, index);
+}
+
+
+// #### ######## ######## ########     ###    ########  #######  ########   ######
+//  ##     ##    ##       ##     ##   ## ##      ##    ##     ## ##     ## ##    ##
+//  ##     ##    ##       ##     ##  ##   ##     ##    ##     ## ##     ## ##
+//  ##     ##    ######   ########  ##     ##    ##    ##     ## ########   ######
+//  ##     ##    ##       ##   ##   #########    ##    ##     ## ##   ##         ##
+//  ##     ##    ##       ##    ##  ##     ##    ##    ##     ## ##    ##  ##    ##
+// ####    ##    ######## ##     ## ##     ##    ##     #######  ##     ##  ######
+
+
+static bool has_buckets(struct hdr_iter* iter)
+{
+    return iter->counts_index < iter->h->counts_len;
+}
+
+static bool has_next(struct hdr_iter* iter)
+{
+    return iter->cumulative_count < iter->total_count;
+}
+
+static bool move_next(struct hdr_iter* iter)
+{
+    iter->counts_index++;
+
+    if (!has_buckets(iter))
+    {
+        return false;
+    }
+
+    iter->count = counts_get_normalised(iter->h, iter->counts_index);
+    iter->cumulative_count += iter->count;
+
+    iter->value = hdr_value_at_index(iter->h, iter->counts_index);
+    iter->highest_equivalent_value = highest_equivalent_value(iter->h, iter->value);
+    iter->lowest_equivalent_value = lowest_equivalent_value(iter->h, iter->value);
+    iter->median_equivalent_value = hdr_median_equivalent_value(iter->h, iter->value);
+
+    return true;
+}
+
+static int64_t peek_next_value_from_index(struct hdr_iter* iter)
+{
+    return hdr_value_at_index(iter->h, iter->counts_index + 1);
+}
+
+static bool next_value_greater_than_reporting_level_upper_bound(
+    struct hdr_iter *iter, int64_t reporting_level_upper_bound)
+{
+    if (iter->counts_index >= iter->h->counts_len)
+    {
+        return false;
+    }
+
+    return peek_next_value_from_index(iter) > reporting_level_upper_bound;
+}
+
+static bool _basic_iter_next(struct hdr_iter *iter)
+{
+    if (!has_next(iter) || iter->counts_index >= iter->h->counts_len)
+    {
+        return false;
+    }
+
+    move_next(iter);
+
+    return true;
+}
+
+static void _update_iterated_values(struct hdr_iter* iter, int64_t new_value_iterated_to)
+{
+    iter->value_iterated_from = iter->value_iterated_to;
+    iter->value_iterated_to = new_value_iterated_to;
+}
+
+static bool _all_values_iter_next(struct hdr_iter* iter)
+{
+    bool result = move_next(iter);
+
+    if (result)
+    {
+        _update_iterated_values(iter, iter->value);
+    }
+
+    return result;
+}
+
+void hdr_iter_init(struct hdr_iter* iter, const struct hdr_histogram* h)
+{
+    iter->h = h;
+
+    iter->counts_index = -1;
+    iter->total_count = h->total_count;
+    iter->count = 0;
+    iter->cumulative_count = 0;
+    iter->value = 0;
+    iter->highest_equivalent_value = 0;
+    iter->value_iterated_from = 0;
+    iter->value_iterated_to = 0;
+
+    iter->_next_fp = _all_values_iter_next;
+}
+
+bool hdr_iter_next(struct hdr_iter* iter)
+{
+    return iter->_next_fp(iter);
+}
+
+// ########  ######## ########   ######  ######## ##    ## ######## #### ##       ########  ######
+// ##     ## ##       ##     ## ##    ## ##       ###   ##    ##     ##  ##       ##       ##    ##
+// ##     ## ##       ##     ## ##       ##       ####  ##    ##     ##  ##       ##       ##
+// ########  ######   ########  ##       ######   ## ## ##    ##     ##  ##       ######    ######
+// ##        ##       ##   ##   ##       ##       ##  ####    ##     ##  ##       ##             ##
+// ##        ##       ##    ##  ##    ## ##       ##   ###    ##     ##  ##       ##       ##    ##
+// ##        ######## ##     ##  ######  ######## ##    ##    ##    #### ######## ########  ######
+
+static bool _percentile_iter_next(struct hdr_iter* iter)
+{
+    struct hdr_iter_percentiles* percentiles = &iter->specifics.percentiles;
+
+    if (!has_next(iter))
+    {
+        if (percentiles->seen_last_value)
+        {
+            return false;
+        }
+
+        percentiles->seen_last_value = true;
+        percentiles->percentile = 100.0;
+
+        return true;
+    }
+
+    if (iter->counts_index == -1 && !_basic_iter_next(iter))
+    {
+        return false;
+    }
+
+    do
+    {
+        double current_percentile = (100.0 * (double) iter->cumulative_count) / iter->h->total_count;
+        if (iter->count != 0 &&
+                percentiles->percentile_to_iterate_to <= current_percentile)
+        {
+            _update_iterated_values(iter, highest_equivalent_value(iter->h, iter->value));
+
+            percentiles->percentile = percentiles->percentile_to_iterate_to;
+            int64_t temp = (int64_t)(log(100 / (100.0 - (percentiles->percentile_to_iterate_to))) / log(2)) + 1;
+            int64_t half_distance = (int64_t) pow(2, (double) temp);
+            int64_t percentile_reporting_ticks = percentiles->ticks_per_half_distance * half_distance;
+            percentiles->percentile_to_iterate_to += 100.0 / percentile_reporting_ticks;
+
+            return true;
+        }
+    }
+    while (_basic_iter_next(iter));
+
+    return true;
+}
+
+void hdr_iter_percentile_init(struct hdr_iter* iter, const struct hdr_histogram* h, int32_t ticks_per_half_distance)
+{
+    iter->h = h;
+
+    hdr_iter_init(iter, h);
+
+    iter->specifics.percentiles.seen_last_value          = false;
+    iter->specifics.percentiles.ticks_per_half_distance  = ticks_per_half_distance;
+    iter->specifics.percentiles.percentile_to_iterate_to = 0.0;
+    iter->specifics.percentiles.percentile               = 0.0;
+
+    iter->_next_fp = _percentile_iter_next;
+}
+
+static void format_line_string(char* str, size_t len, int significant_figures, format_type format)
+{
+#if defined(_MSC_VER)
+#define snprintf _snprintf
+#pragma warning(push)
+#pragma warning(disable: 4996)
+#endif
+    const char* format_str = "%s%d%s";
+
+    switch (format)
+    {
+        case CSV:
+            snprintf(str, len, format_str, "%.", significant_figures, "f,%f,%d,%.2f\n");
+            break;
+        case CLASSIC:
+            snprintf(str, len, format_str, "%12.", significant_figures, "f %12f %12d %12.2f\n");
+            break;
+        default:
+            snprintf(str, len, format_str, "%12.", significant_figures, "f %12f %12d %12.2f\n");
+    }
+#if defined(_MSC_VER)
+#undef snprintf
+#pragma warning(pop)
+#endif
+}
+
+
+// ########  ########  ######   #######  ########  ########  ######## ########
+// ##     ## ##       ##    ## ##     ## ##     ## ##     ## ##       ##     ##
+// ##     ## ##       ##       ##     ## ##     ## ##     ## ##       ##     ##
+// ########  ######   ##       ##     ## ########  ##     ## ######   ##     ##
+// ##   ##   ##       ##       ##     ## ##   ##   ##     ## ##       ##     ##
+// ##    ##  ##       ##    ## ##     ## ##    ##  ##     ## ##       ##     ##
+// ##     ## ########  ######   #######  ##     ## ########  ######## ########
+
+
+static bool _recorded_iter_next(struct hdr_iter* iter)
+{
+    while (_basic_iter_next(iter))
+    {
+        if (iter->count != 0)
+        {
+            _update_iterated_values(iter, iter->value);
+
+            iter->specifics.recorded.count_added_in_this_iteration_step = iter->count;
+            return true;
+        }
+    }
+
+    return false;
+}
+
+void hdr_iter_recorded_init(struct hdr_iter* iter, const struct hdr_histogram* h)
+{
+    hdr_iter_init(iter, h);
+
+    iter->specifics.recorded.count_added_in_this_iteration_step = 0;
+
+    iter->_next_fp = _recorded_iter_next;
+}
+
+// ##       #### ##    ## ########    ###    ########
+// ##        ##  ###   ## ##         ## ##   ##     ##
+// ##        ##  ####  ## ##        ##   ##  ##     ##
+// ##        ##  ## ## ## ######   ##     ## ########
+// ##        ##  ##  #### ##       ######### ##   ##
+// ##        ##  ##   ### ##       ##     ## ##    ##
+// ######## #### ##    ## ######## ##     ## ##     ##
+
+
+static bool _iter_linear_next(struct hdr_iter* iter)
+{
+    struct hdr_iter_linear* linear = &iter->specifics.linear;
+
+    linear->count_added_in_this_iteration_step = 0;
+
+    if (has_next(iter) ||
+        next_value_greater_than_reporting_level_upper_bound(
+            iter, linear->next_value_reporting_level_lowest_equivalent))
+    {
+        do
+        {
+            if (iter->value >= linear->next_value_reporting_level_lowest_equivalent)
+            {
+                _update_iterated_values(iter, linear->next_value_reporting_level);
+
+                linear->next_value_reporting_level += linear->value_units_per_bucket;
+                linear->next_value_reporting_level_lowest_equivalent =
+                    lowest_equivalent_value(iter->h, linear->next_value_reporting_level);
+
+                return true;
+            }
+
+            if (!move_next(iter))
+            {
+                return true;
+            }
+
+            linear->count_added_in_this_iteration_step += iter->count;
+        }
+        while (true);
+    }
+
+    return false;
+}
+
+
+void hdr_iter_linear_init(struct hdr_iter* iter, const struct hdr_histogram* h, int64_t value_units_per_bucket)
+{
+    hdr_iter_init(iter, h);
+
+    iter->specifics.linear.count_added_in_this_iteration_step = 0;
+    iter->specifics.linear.value_units_per_bucket = value_units_per_bucket;
+    iter->specifics.linear.next_value_reporting_level = value_units_per_bucket;
+    iter->specifics.linear.next_value_reporting_level_lowest_equivalent = lowest_equivalent_value(h, value_units_per_bucket);
+
+    iter->_next_fp = _iter_linear_next;
+}
+
+// ##        #######   ######      ###    ########  #### ######## ##     ## ##     ## ####  ######
+// ##       ##     ## ##    ##    ## ##   ##     ##  ##     ##    ##     ## ###   ###  ##  ##    ##
+// ##       ##     ## ##         ##   ##  ##     ##  ##     ##    ##     ## #### ####  ##  ##
+// ##       ##     ## ##   #### ##     ## ########   ##     ##    ######### ## ### ##  ##  ##
+// ##       ##     ## ##    ##  ######### ##   ##    ##     ##    ##     ## ##     ##  ##  ##
+// ##       ##     ## ##    ##  ##     ## ##    ##   ##     ##    ##     ## ##     ##  ##  ##    ##
+// ########  #######   ######   ##     ## ##     ## ####    ##    ##     ## ##     ## ####  ######
+
+static bool _log_iter_next(struct hdr_iter *iter)
+{
+    struct hdr_iter_log* logarithmic = &iter->specifics.log;
+
+    logarithmic->count_added_in_this_iteration_step = 0;
+
+    if (has_next(iter) ||
+        next_value_greater_than_reporting_level_upper_bound(
+            iter, logarithmic->next_value_reporting_level_lowest_equivalent))
+    {
+        do
+        {
+            if (iter->value >= logarithmic->next_value_reporting_level_lowest_equivalent)
+            {
+                _update_iterated_values(iter, logarithmic->next_value_reporting_level);
+
+                logarithmic->next_value_reporting_level *= (int64_t)logarithmic->log_base;
+                logarithmic->next_value_reporting_level_lowest_equivalent = lowest_equivalent_value(iter->h, logarithmic->next_value_reporting_level);
+
+                return true;
+            }
+
+            if (!move_next(iter))
+            {
+                return true;
+            }
+
+            logarithmic->count_added_in_this_iteration_step += iter->count;
+        }
+        while (true);
+    }
+
+    return false;
+}
+
+void hdr_iter_log_init(
+        struct hdr_iter* iter,
+        const struct hdr_histogram* h,
+        int64_t value_units_first_bucket,
+        double log_base)
+{
+    hdr_iter_init(iter, h);
+    iter->specifics.log.count_added_in_this_iteration_step = 0;
+    iter->specifics.log.log_base = log_base;
+    iter->specifics.log.next_value_reporting_level = value_units_first_bucket;
+    iter->specifics.log.next_value_reporting_level_lowest_equivalent = lowest_equivalent_value(h, value_units_first_bucket);
+
+    iter->_next_fp = _log_iter_next;
+}
+
+// Printing.
+
+static const char* format_head_string(format_type format)
+{
+    switch (format)
+    {
+        case CSV:
+            return "%s,%s,%s,%s\n";
+        case CLASSIC:
+            return "%12s %12s %12s %12s\n\n";
+        default:
+            return "%12s %12s %12s %12s\n\n";
+    }
+}
+
+static const char CLASSIC_FOOTER[] =
+    "#[Mean    = %12.3f, StdDeviation   = %12.3f]\n"
+    "#[Max     = %12.3f, Total count    = %12" PRIu64 "]\n"
+    "#[Buckets = %12d, SubBuckets     = %12d]\n";
+
+int hdr_percentiles_print(
+        struct hdr_histogram* h, FILE* stream, int32_t ticks_per_half_distance,
+        double value_scale, format_type format)
+{
+    char line_format[25];
+    format_line_string(line_format, 25, h->significant_figures, format);
+    const char* head_format = format_head_string(format);
+    int rc = 0;
+
+    struct hdr_iter iter;
+    hdr_iter_percentile_init(&iter, h, ticks_per_half_distance);
+
+    if (fprintf(
+            stream, head_format,
+            "Value", "Percentile", "TotalCount", "1/(1-Percentile)") < 0)
+    {
+        rc = EIO;
+        goto cleanup;
+    }
+
+    struct hdr_iter_percentiles * percentiles = &iter.specifics.percentiles;
+    while (hdr_iter_next(&iter))
+    {
+        double  value               = iter.highest_equivalent_value / value_scale;
+        double  percentile          = percentiles->percentile / 100.0;
+        int64_t total_count         = iter.cumulative_count;
+        double  inverted_percentile = (1.0 / (1.0 - percentile));
+
+        if (fprintf(
+                stream, line_format, value, percentile, total_count, inverted_percentile) < 0)
+        {
+            rc = EIO;
+            goto cleanup;
+        }
+    }
+
+    if (CLASSIC == format)
+    {
+        double mean   = hdr_mean(h)   / value_scale;
+        double stddev = hdr_stddev(h) / value_scale;
+        double max    = hdr_max(h)    / value_scale;
+
+        if (fprintf(
+                stream, CLASSIC_FOOTER,  mean, stddev, max,
+                h->total_count, h->bucket_count, h->sub_bucket_count) < 0)
+        {
+            rc = EIO;
+            goto cleanup;
+        }
+    }
+
+    cleanup:
+    return rc;
+}
diff --git a/debian/modules/nchan/src/util/hdr_histogram.h b/debian/modules/nchan/src/util/hdr_histogram.h
new file mode 100644
index 00000000..010a4b80
--- /dev/null
+++ b/debian/modules/nchan/src/util/hdr_histogram.h
@@ -0,0 +1,427 @@
+/**
+ * hdr_histogram.h
+ * Written by Michael Barker and released to the public domain,
+ * as explained at http://creativecommons.org/publicdomain/zero/1.0/
+ *
+ * The source for the hdr_histogram utilises a few C99 constructs, specifically
+ * the use of stdint/stdbool and inline variable declaration.
+ */
+
+#ifndef HDR_HISTOGRAM_H
+#define HDR_HISTOGRAM_H 1
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stdio.h>
+
+struct hdr_histogram
+{
+    int64_t lowest_trackable_value;
+    int64_t highest_trackable_value;
+    int32_t unit_magnitude;
+    int32_t significant_figures;
+    int32_t sub_bucket_half_count_magnitude;
+    int32_t sub_bucket_half_count;
+    int64_t sub_bucket_mask;
+    int32_t sub_bucket_count;
+    int32_t bucket_count;
+    int64_t min_value;
+    int64_t max_value;
+    int32_t normalizing_index_offset;
+    double conversion_ratio;
+    int32_t counts_len;
+    int64_t total_count;
+    int64_t* counts;
+};
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * Allocate the memory and initialise the hdr_histogram.
+ *
+ * Due to the size of the histogram being the result of some reasonably
+ * involved math on the input parameters this function it is tricky to stack allocate.
+ * The histogram is allocated in a single contigious block so can be delete via free,
+ * without any structure specific destructor.
+ *
+ * @param lowest_trackable_value The smallest possible value to be put into the
+ * histogram.
+ * @param highest_trackable_value The largest possible value to be put into the
+ * histogram.
+ * @param significant_figures The level of precision for this histogram, i.e. the number
+ * of figures in a decimal number that will be maintained.  E.g. a value of 3 will mean
+ * the results from the histogram will be accurate up to the first three digits.  Must
+ * be a value between 1 and 5 (inclusive).
+ * @param result Output parameter to capture allocated histogram.
+ * @return 0 on success, EINVAL if lowest_trackable_value is < 1 or the
+ * significant_figure value is outside of the allowed range, ENOMEM if malloc
+ * failed.
+ */
+int hdr_init_nchan_shm(
+    int64_t lowest_trackable_value,
+    int64_t highest_trackable_value,
+    int significant_figures,
+    struct hdr_histogram** result);
+
+/**
+ * Free the memory and close the hdr_histogram.
+ *
+ * @param h The histogram you want to close.
+ */
+void hdr_close_nchan_shm(struct hdr_histogram* h);
+
+
+/**
+ * Reset a histogram to zero - empty out a histogram and re-initialise it
+ *
+ * If you want to re-use an existing histogram, but reset everything back to zero, this
+ * is the routine to use.
+ *
+ * @param h The histogram you want to reset to empty.
+ *
+ */
+void hdr_reset(struct hdr_histogram* h);
+
+/**
+ * Get the memory size of the hdr_histogram.
+ *
+ * @param h "This" pointer
+ * @return The amount of memory used by the hdr_histogram in bytes
+ */
+size_t hdr_get_memory_size(struct hdr_histogram* h);
+
+/**
+ * Records a value in the histogram, will round this value of to a precision at or better
+ * than the significant_figure specified at construction time.
+ *
+ * @param h "This" pointer
+ * @param value Value to add to the histogram
+ * @return false if the value is larger than the highest_trackable_value and can't be recorded,
+ * true otherwise.
+ */
+bool hdr_record_value(struct hdr_histogram* h, int64_t value);
+
+/**
+ * Records count values in the histogram, will round this value of to a
+ * precision at or better than the significant_figure specified at construction
+ * time.
+ *
+ * @param h "This" pointer
+ * @param value Value to add to the histogram
+ * @param count Number of 'value's to add to the histogram
+ * @return false if any value is larger than the highest_trackable_value and can't be recorded,
+ * true otherwise.
+ */
+bool hdr_record_values(struct hdr_histogram* h, int64_t value, int64_t count);
+
+
+/**
+ * Record a value in the histogram and backfill based on an expected interval.
+ *
+ * Records a value in the histogram, will round this value of to a precision at or better
+ * than the significant_figure specified at contruction time.  This is specifically used
+ * for recording latency.  If the value is larger than the expected_interval then the
+ * latency recording system has experienced co-ordinated omission.  This method fills in the
+ * values that would have occured had the client providing the load not been blocked.
+
+ * @param h "This" pointer
+ * @param value Value to add to the histogram
+ * @param expected_interval The delay between recording values.
+ * @return false if the value is larger than the highest_trackable_value and can't be recorded,
+ * true otherwise.
+ */
+bool hdr_record_corrected_value(struct hdr_histogram* h, int64_t value, int64_t expexcted_interval);
+/**
+ * Record a value in the histogram 'count' times.  Applies the same correcting logic
+ * as 'hdr_record_corrected_value'.
+ *
+ * @param h "This" pointer
+ * @param value Value to add to the histogram
+ * @param count Number of 'value's to add to the histogram
+ * @param expected_interval The delay between recording values.
+ * @return false if the value is larger than the highest_trackable_value and can't be recorded,
+ * true otherwise.
+ */
+bool hdr_record_corrected_values(struct hdr_histogram* h, int64_t value, int64_t count, int64_t expected_interval);
+
+/**
+ * Adds all of the values from 'from' to 'this' histogram.  Will return the
+ * number of values that are dropped when copying.  Values will be dropped
+ * if they around outside of h.lowest_trackable_value and
+ * h.highest_trackable_value.
+ *
+ * @param h "This" pointer
+ * @param from Histogram to copy values from.
+ * @return The number of values dropped when copying.
+ */
+int64_t hdr_add(struct hdr_histogram* h, const struct hdr_histogram* from);
+
+/**
+ * Adds all of the values from 'from' to 'this' histogram.  Will return the
+ * number of values that are dropped when copying.  Values will be dropped
+ * if they around outside of h.lowest_trackable_value and
+ * h.highest_trackable_value.
+ *
+ * @param h "This" pointer
+ * @param from Histogram to copy values from.
+ * @return The number of values dropped when copying.
+ */
+int64_t hdr_add_while_correcting_for_coordinated_omission(
+    struct hdr_histogram* h, struct hdr_histogram* from, int64_t expected_interval);
+
+/**
+ * Get minimum value from the histogram.  Will return 2^63-1 if the histogram
+ * is empty.
+ *
+ * @param h "This" pointer
+ */
+int64_t hdr_min(const struct hdr_histogram* h);
+
+/**
+ * Get maximum value from the histogram.  Will return 0 if the histogram
+ * is empty.
+ *
+ * @param h "This" pointer
+ */
+int64_t hdr_max(const struct hdr_histogram* h);
+
+/**
+ * Get the value at a specific percentile.
+ *
+ * @param h "This" pointer.
+ * @param percentile The percentile to get the value for
+ */
+int64_t hdr_value_at_percentile(const struct hdr_histogram* h, double percentile);
+
+/**
+ * Gets the standard deviation for the values in the histogram.
+ *
+ * @param h "This" pointer
+ * @return The standard deviation
+ */
+double hdr_stddev(const struct hdr_histogram* h);
+
+/**
+ * Gets the mean for the values in the histogram.
+ *
+ * @param h "This" pointer
+ * @return The mean
+ */
+double hdr_mean(const struct hdr_histogram* h);
+
+/**
+ * Determine if two values are equivalent with the histogram's resolution.
+ * Where "equivalent" means that value samples recorded for any two
+ * equivalent values are counted in a common total count.
+ *
+ * @param h "This" pointer
+ * @param a first value to compare
+ * @param b second value to compare
+ * @return 'true' if values are equivalent with the histogram's resolution.
+ */
+bool hdr_values_are_equivalent(const struct hdr_histogram* h, int64_t a, int64_t b);
+
+/**
+ * Get the lowest value that is equivalent to the given value within the histogram's resolution.
+ * Where "equivalent" means that value samples recorded for any two
+ * equivalent values are counted in a common total count.
+ *
+ * @param h "This" pointer
+ * @param value The given value
+ * @return The lowest value that is equivalent to the given value within the histogram's resolution.
+ */
+int64_t hdr_lowest_equivalent_value(const struct hdr_histogram* h, int64_t value);
+
+/**
+ * Get the count of recorded values at a specific value
+ * (to within the histogram resolution at the value level).
+ *
+ * @param h "This" pointer
+ * @param value The value for which to provide the recorded count
+ * @return The total count of values recorded in the histogram within the value range that is
+ * {@literal >=} lowestEquivalentValue(<i>value</i>) and {@literal <=} highestEquivalentValue(<i>value</i>)
+ */
+int64_t hdr_count_at_value(const struct hdr_histogram* h, int64_t value);
+
+int64_t hdr_count_at_index(const struct hdr_histogram* h, int32_t index);
+
+int64_t hdr_value_at_index(const struct hdr_histogram* h, int32_t index);
+
+struct hdr_iter_percentiles
+{
+    bool seen_last_value;
+    int32_t ticks_per_half_distance;
+    double percentile_to_iterate_to;
+    double percentile;
+};
+
+struct hdr_iter_recorded
+{
+    int64_t count_added_in_this_iteration_step;
+};
+
+struct hdr_iter_linear
+{
+    int64_t value_units_per_bucket;
+    int64_t count_added_in_this_iteration_step;
+    int64_t next_value_reporting_level;
+    int64_t next_value_reporting_level_lowest_equivalent;
+};
+
+struct hdr_iter_log
+{
+    double log_base;
+    int64_t count_added_in_this_iteration_step;
+    int64_t next_value_reporting_level;
+    int64_t next_value_reporting_level_lowest_equivalent;
+};
+
+/**
+ * The basic iterator.  This is a generic structure
+ * that supports all of the types of iteration.  Use
+ * the appropriate initialiser to get the desired
+ * iteration.
+ *
+ * @
+ */
+struct hdr_iter
+{
+    const struct hdr_histogram* h;
+    /** raw index into the counts array */
+    int32_t counts_index;
+    /** snapshot of the length at the time the iterator is created */
+    int32_t total_count;
+    /** value directly from array for the current counts_index */
+    int64_t count;
+    /** sum of all of the counts up to and including the count at this index */
+    int64_t cumulative_count;
+    /** The current value based on counts_index */
+    int64_t value;
+    int64_t highest_equivalent_value;
+    int64_t lowest_equivalent_value;
+    int64_t median_equivalent_value;
+    int64_t value_iterated_from;
+    int64_t value_iterated_to;
+
+    union
+    {
+        struct hdr_iter_percentiles percentiles;
+        struct hdr_iter_recorded recorded;
+        struct hdr_iter_linear linear;
+        struct hdr_iter_log log;
+    } specifics;
+
+    bool (* _next_fp)(struct hdr_iter* iter);
+
+};
+
+/**
+ * Initalises the basic iterator.
+ *
+ * @param itr 'This' pointer
+ * @param h The histogram to iterate over
+ */
+void hdr_iter_init(struct hdr_iter* iter, const struct hdr_histogram* h);
+
+/**
+ * Initialise the iterator for use with percentiles.
+ */
+void hdr_iter_percentile_init(struct hdr_iter* iter, const struct hdr_histogram* h, int32_t ticks_per_half_distance);
+
+/**
+ * Initialise the iterator for use with recorded values.
+ */
+void hdr_iter_recorded_init(struct hdr_iter* iter, const struct hdr_histogram* h);
+
+/**
+ * Initialise the iterator for use with linear values.
+ */
+void hdr_iter_linear_init(
+    struct hdr_iter* iter,
+    const struct hdr_histogram* h,
+    int64_t value_units_per_bucket);
+
+/**
+ * Initialise the iterator for use with logarithmic values
+ */
+void hdr_iter_log_init(
+    struct hdr_iter* iter,
+    const struct hdr_histogram* h,
+    int64_t value_units_first_bucket,
+    double log_base);
+
+/**
+ * Iterate to the next value for the iterator.  If there are no more values
+ * available return faluse.
+ *
+ * @param itr 'This' pointer
+ * @return 'false' if there are no values remaining for this iterator.
+ */
+bool hdr_iter_next(struct hdr_iter* iter);
+
+typedef enum
+{
+    CLASSIC,
+    CSV
+} format_type;
+
+/**
+ * Print out a percentile based histogram to the supplied stream.  Note that
+ * this call will not flush the FILE, this is left up to the user.
+ *
+ * @param h 'This' pointer
+ * @param stream The FILE to write the output to
+ * @param ticks_per_half_distance The number of iteration steps per half-distance to 100%
+ * @param value_scale Scale the output values by this amount
+ * @param format_type Format to use, e.g. CSV.
+ * @return 0 on success, error code on failure.  EIO if an error occurs writing
+ * the output.
+ */
+int hdr_percentiles_print(
+    struct hdr_histogram* h, FILE* stream, int32_t ticks_per_half_distance,
+    double value_scale, format_type format);
+
+/**
+* Internal allocation methods, used by hdr_dbl_histogram.
+*/
+struct hdr_histogram_bucket_config
+{
+    int64_t lowest_trackable_value;
+    int64_t highest_trackable_value;
+    int64_t unit_magnitude;
+    int64_t significant_figures;
+    int32_t sub_bucket_half_count_magnitude;
+    int32_t sub_bucket_half_count;
+    int64_t sub_bucket_mask;
+    int32_t sub_bucket_count;
+    int32_t bucket_count;
+    int32_t counts_len;
+};
+
+int hdr_calculate_bucket_config(
+    int64_t lowest_trackable_value,
+    int64_t highest_trackable_value,
+    int significant_figures,
+    struct hdr_histogram_bucket_config* cfg);
+
+void hdr_init_preallocated(struct hdr_histogram* h, struct hdr_histogram_bucket_config* cfg);
+
+int64_t hdr_size_of_equivalent_value_range(const struct hdr_histogram* h, int64_t value);
+
+int64_t hdr_next_non_equivalent_value(const struct hdr_histogram* h, int64_t value);
+
+int64_t hdr_median_equivalent_value(const struct hdr_histogram* h, int64_t value);
+
+/**
+ * Used to reset counters after importing data manuallying into the histogram, used by the logging code
+ * and other custom serialisation tools.
+ */
+void hdr_reset_internal_counters(struct hdr_histogram* h);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/debian/modules/nchan/src/util/nchan_benchmark.c b/debian/modules/nchan/src/util/nchan_benchmark.c
new file mode 100644
index 00000000..767f8c76
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_benchmark.c
@@ -0,0 +1,804 @@
+#include "nchan_benchmark.h"
+#include <subscribers/benchmark.h>
+#include <subscribers/websocket.h>
+#include <util/shmem.h>
+#include <store/memory/store.h>
+#include <store/memory/ipc-handlers.h>
+#include <assert.h>
+#include <sys/time.h> /* for struct timeval */
+#include <inttypes.h>
+
+//#define DEBUG_LEVEL NGX_LOG_WARN
+#define DEBUG_LEVEL NGX_LOG_DEBUG
+
+#define DBG(fmt, args...) ngx_log_error(DEBUG_LEVEL, ngx_cycle->log, 0, "BENCHMARK: " fmt, ##args)
+#define ERR(fmt, args...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "BENCHMARK: " fmt, ##args)
+
+nchan_benchmark_t    bench;
+
+ngx_atomic_int_t    *worker_counter = NULL;
+ngx_int_t            bench_worker_number = 0;
+
+int nchan_benchmark_active(void) {
+  return bench.state && *bench.state > NCHAN_BENCHMARK_INACTIVE;
+}
+
+static ngx_int_t benchmark_client_respond(char *cstr) {
+  if(!bench.client) {
+    return NGX_ERROR;
+  }
+  nchan_msg_t    msg;
+  nchan_msg_id_t msgid = NCHAN_NEWEST_MSGID;
+  ngx_memzero(&msg, sizeof(msg));
+  msg.storage = NCHAN_MSG_STACK;
+  msg.id = msgid;
+  ngx_init_set_membuf(&msg.buf, (u_char *)cstr, (u_char *)&cstr[strlen(cstr)]);
+  msg.buf.last_buf = 1;
+  msg.buf.last_in_chain = 1;
+  bench.client->fn->respond_message(bench.client, &msg);
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_init_module(ngx_cycle_t *cycle) {
+  bench.state = shm_calloc(nchan_store_memory_shmem, sizeof(ngx_atomic_int_t), "benchmark state");
+  worker_counter = shm_calloc(nchan_store_memory_shmem, sizeof(ngx_atomic_int_t), "benchmark worker counter");
+  bench.config = shm_calloc(nchan_store_memory_shmem, sizeof(*bench.config), "benchmark config (shared)");
+  
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_init_worker(ngx_cycle_t *cycle) {
+  DBG("init worker");
+  bench_worker_number = ngx_atomic_fetch_add((ngx_atomic_uint_t *)worker_counter, 1);
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_exit_master(ngx_cycle_t *cycle) {
+  shm_free(nchan_store_memory_shmem, bench.state);
+  shm_free(nchan_store_memory_shmem, worker_counter);
+  shm_free(nchan_store_memory_shmem, bench.config);
+  bench.state = NULL;
+  bench.config = NULL;
+  worker_counter = NULL;
+  return NGX_OK;
+}
+
+static ngx_int_t benchmark_publish_callback(ngx_int_t status, void *data, void *pd) {
+  struct      timeval tv;
+  uint64_t    t1;
+  uintptr_t   t0 = (uintptr_t )pd;
+  if(nchan_benchmark_active()) {
+    ngx_gettimeofday(&tv);
+    t1 = (tv.tv_sec - bench.time.init) * (uint64_t)1000000 + tv.tv_usec;
+    switch(status) {
+      case NCHAN_MESSAGE_QUEUED:
+      case NCHAN_MESSAGE_RECEIVED:
+        bench.data.msg_send_confirmed++;
+        break;
+      default:
+        bench.data.msg_send_failed++;
+    }
+    hdr_record_value(bench.data.msg_publishing_latency, t1-t0);
+  }
+  return NGX_OK;
+}
+
+static void benchmark_publish_message(nchan_benchmark_channel_t *chan) {
+  struct      timeval tv;
+  uint64_t    now;
+  u_char     *last;
+  uint64_t    msgnum;
+  nchan_msg_t msg;
+  ngx_str_t   channel_id;
+  
+  nchan_benchmark_channel_id(chan->n, &channel_id);
+  
+  msgnum = ngx_atomic_fetch_add(&chan->msg_count, 1);
+  
+  ngx_gettimeofday(&tv);
+  now = (tv.tv_sec - bench.time.init) * (uint64_t)1000000 + tv.tv_usec;
+  
+  last = ngx_snprintf(bench.msgbuf, 64, "%D %D zzzzzzzz", now, msgnum);
+  
+  //DBG("publish to channel %V msg #%D (t: %D)", &channel_id, msgnum, now);
+  
+  ngx_memzero(&msg, sizeof(msg));
+  msg.buf.temporary = 1;
+  msg.buf.memory = 1;
+  msg.buf.last_buf = 1;
+  msg.buf.pos = msg.buf.start = bench.msgbuf;
+  msg.buf.last = msg.buf.end = &last[bench.config->msg_padding];
+  msg.id.time = 0;
+  msg.id.tag.fixed[0] = 0;
+  msg.id.tagactive = 0;
+  msg.id.tagcount = 1;
+  msg.storage = NCHAN_MSG_STACK;
+  
+  msg.content_type = (ngx_str_t *)&NCHAN_CONTENT_TYPE_TEXT_PLAIN;
+  
+  bench.loc_conf->storage_engine->publish(&channel_id, &msg, bench.loc_conf, (callback_pt )benchmark_publish_callback, (void *)(uintptr_t)now);
+  bench.data.msg_sent++;
+}
+
+static ngx_int_t benchmark_publish_message_interval_timer(void *pd) {  
+  nchan_benchmark_channel_t *chan = pd;
+  if(!nchan_benchmark_active()) {
+    DBG("benchmark not running. stop trying to publish");
+    bench.timer.publishers[chan->n] = NULL;
+    return NGX_ABORT; //we're done here
+  }
+  
+  benchmark_publish_message(chan);
+  
+  return bench.base_msg_period;
+}
+
+static void benchmark_timer_running_stop(void *pd);
+static void benchmark_timer_finishing_check(void *pd);
+
+ngx_int_t nchan_benchmark_initialize(void) {
+  int           c, i;
+  subscriber_t **sub;
+  ngx_str_t     channel_id;
+  ngx_int_t     subs_per_channel;
+      
+  assert(bench.subs.array == NULL);
+  assert(bench.subs.n == 0);
+  
+  if(bench.config->subscriber_distribution == NCHAN_BENCHMARK_SUBSCRIBER_DISTRIBUTION_RANDOM) {
+    ngx_int_t divided_subs = bench.config->subscribers_per_channel / nchan_worker_processes;
+    ngx_int_t leftover_subs = bench.config->subscribers_per_channel % nchan_worker_processes;
+    for(c=0; c<bench.config->channels; c++) {
+      bench.subs.n += divided_subs;
+      if (c%nchan_worker_processes == bench_worker_number) {
+        bench.subs.n += leftover_subs;
+      }
+    }
+    DBG("bench.subs.n = %d", bench.subs.n);
+    bench.subs.array = ngx_alloc(sizeof(subscriber_t *) * bench.subs.n, ngx_cycle->log);
+    sub = &bench.subs.array[0];
+    
+    for(c=0; c<bench.config->channels; c++) {
+      subs_per_channel = divided_subs + (((c % nchan_worker_processes) == bench_worker_number) ? leftover_subs : 0);
+      //DBG("worker number %d channel %d subs %d", bench_worker_number, c, subs_per_channel);
+      nchan_benchmark_channel_id(c, &channel_id);
+      for(i=0; i<subs_per_channel; i++) {
+        *sub = benchmark_subscriber_create(&bench);
+        if((*sub)->fn->subscribe(*sub, &channel_id) != NGX_OK) {
+          return NGX_ERROR;
+        }
+        sub++;
+      }
+    }
+  }
+  else {
+    subs_per_channel = bench.config->subscribers_per_channel;
+    for(c=0; c<bench.config->channels; c++) {
+      nchan_benchmark_channel_id(c, &channel_id);
+      if(memstore_channel_owner(&channel_id) == ngx_process_slot) {
+        bench.subs.n += subs_per_channel;
+      }
+    }
+    bench.subs.array = ngx_alloc(sizeof(subscriber_t *) * bench.subs.n, ngx_cycle->log);
+    sub = &bench.subs.array[0];
+    
+    for(c=0; c<bench.config->channels; c++) {
+      nchan_benchmark_channel_id(c, &channel_id);
+      if(memstore_channel_owner(&channel_id) == ngx_process_slot) {
+        for(i=0; i<subs_per_channel; i++) {
+          *sub = benchmark_subscriber_create(&bench);
+          if((*sub)->fn->subscribe(*sub, &channel_id) != NGX_OK) {
+            return NGX_ERROR;
+          }
+          sub++;
+        }
+      }
+    }
+  }
+  
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_run(void) {
+  uint64_t required_subs = bench.config->subscribers_per_channel * bench.config->channels;
+  assert(*bench.shared.subscribers_enqueued == required_subs);
+  int       i;
+  size_t msgbuf_maxlen = bench.config->msg_padding + 64;
+  unsigned pubstart;
+  int64_t total_offset = 0;
+  bench.msgbuf = ngx_alloc(msgbuf_maxlen, ngx_cycle->log);
+  ngx_memset(bench.msgbuf, 'z', msgbuf_maxlen);
+  
+  bench.base_msg_period = 1000.0/((double)bench.config->msgs_per_minute / 60.0);
+  assert(bench.timer.publishers == NULL);
+  bench.timer.publishers = ngx_alloc(sizeof(void *) * bench.config->channels, ngx_cycle->log);
+  if(bench.config->publisher_distribution == NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_RANDOM) {
+    bench.base_msg_period *= nchan_worker_processes;
+    for(i=0; i < bench.config->channels; i++) {
+      pubstart = (rand() / (RAND_MAX / bench.base_msg_period));
+      total_offset += pubstart;
+      bench.timer.publishers[i] = nchan_add_interval_timer(benchmark_publish_message_interval_timer, &bench.shared.channels[i], pubstart);
+    }
+  }
+  else if(bench.config->publisher_distribution == NCHAN_BENCHMARK_PUBLISHER_DISTRIBUTION_OPTIMAL) {
+    ngx_str_t channel_id;
+    for(i=0; i < bench.config->channels; i++) {
+      nchan_benchmark_channel_id(i, &channel_id);
+      if(memstore_channel_owner(&channel_id) == ngx_process_slot) {
+        pubstart = (rand() / (RAND_MAX / bench.base_msg_period));
+        total_offset += pubstart;
+        bench.timer.publishers[i] = nchan_add_interval_timer(benchmark_publish_message_interval_timer, &bench.shared.channels[i], pubstart);
+      }
+      else {
+        bench.timer.publishers[i] = NULL;
+      }
+    }
+  }
+  
+  return NGX_OK;
+}
+
+
+ngx_int_t nchan_benchmark_dequeue_subscribers(void) {
+  unsigned i;
+  for(i=0; i < bench.subs.n; i++) {
+    bench.subs.array[i]->fn->dequeue(bench.subs.array[i]);
+  }
+  ngx_free(bench.subs.array);
+  bench.subs.array = NULL;
+  bench.subs.n = 0;
+  return NGX_OK;
+}
+
+static void benchmark_timer_running_stop(void *pd) {
+  bench.timer.running = NULL;
+  bench.time.end = ngx_time();
+  memstore_ipc_broadcast_benchmark_stop();
+  nchan_benchmark_stop();
+  bench.timer.finishing = nchan_add_oneshot_timer(benchmark_timer_finishing_check, NULL, 3000);
+}
+static void benchmark_timer_finishing_check(void *pd) {
+  bench.timer.finishing = NULL;
+  nchan_benchmark_dequeue_subscribers();
+  bench.waiting_for_results = nchan_worker_processes - 1;
+  if(bench.waiting_for_results == 0) {
+    nchan_benchmark_finish_response();
+    nchan_benchmark_finish();
+  }
+  else {
+    memstore_ipc_broadcast_benchmark_finish();
+  }
+}
+
+ngx_int_t nchan_benchmark_receive_finished_data(nchan_benchmark_data_t *data) {
+  DBG("received benchmark data");
+  assert(bench.waiting_for_results > 0);
+  bench.waiting_for_results  --;
+  bench.data.msg_sent += data->msg_sent;
+  bench.data.msg_send_confirmed += data->msg_send_confirmed;
+  bench.data.msg_send_failed += data->msg_send_failed;
+  bench.data.msg_received += data->msg_received;
+  hdr_add(bench.data.msg_delivery_latency, data->msg_delivery_latency);
+  hdr_close_nchan_shm(data->msg_delivery_latency);
+  hdr_add(bench.data.msg_publishing_latency, data->msg_publishing_latency);
+  hdr_close_nchan_shm(data->msg_publishing_latency);
+  hdr_add(bench.data.subscriber_readiness_latency, data->subscriber_readiness_latency);
+  hdr_close_nchan_shm(data->subscriber_readiness_latency);
+  
+  if(bench.waiting_for_results  == 0) {
+    nchan_benchmark_finish_response();
+    nchan_benchmark_finish();
+  }
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_finish_response(void) {
+  u_char                *str;
+  ngx_http_request_t    *r = bench.client->request;
+  ngx_str_t             *accept_header = nchan_get_accept_header_value(r);
+  const char            *fmt;
+  char stats[2048];
+  fmt = 
+    "  \"start_time\":           %d,\n"
+    "  \"run_time_sec\":         %d,\n"
+    "  \"channels\":             %d,\n"
+    "  \"subscribers\":          %d,\n"
+    "  \"message_length\":       %d,\n"
+    "  \"messages\": {\n"
+    "    \"sent\":               %d,\n"
+    "    \"send_confirmed\":     %d,\n"
+    "    \"send_unconfirmed\":   %d,\n"
+    "    \"send_failed\":        %d,\n"
+    "    \"received\":           %d,\n"
+    "    \"unreceived\":         %d\n"
+    "  },\n"
+    "  \"message_publishing_latency\": {\n"
+    "    \"min\":               \"%.3fms\",\n"
+    "    \"avg\":               \"%.3fms\",\n"
+    "    \"99th_percentile\":   \"%.3fms\",\n"
+    "    \"max\":               \"%.3fms\",\n"
+    "    \"stddev\":            \"%.3fms\",\n"
+    "    \"samples\":            %D\n"
+    "  },\n"
+    "  \"message_delivery_latency\": {\n"
+    "    \"min\":               \"%.3fms\",\n"
+    "    \"avg\":               \"%.3fms\",\n"
+    "    \"99th_percentile\":   \"%.3fms\",\n"
+    "    \"max\":               \"%.3fms\",\n"
+    "    \"stddev\":            \"%.3fms\",\n"
+    "    \"samples\":            %D\n"
+    "  }%Z";
+    
+  ngx_snprintf((u_char *)stats, 2048, fmt, 
+    bench.time.start,
+    bench.time.end - bench.time.start,
+    bench.config->channels,
+    *bench.shared.subscribers_enqueued,
+    bench.config->msg_padding + 5,
+    bench.data.msg_sent,
+    bench.data.msg_send_confirmed,
+    bench.data.msg_sent - bench.data.msg_send_confirmed,
+    bench.data.msg_send_failed,
+    bench.data.msg_received,
+    bench.data.msg_sent * bench.config->subscribers_per_channel - bench.data.msg_received,
+    (double )hdr_min(bench.data.msg_publishing_latency)/1000.0,
+    (double )hdr_mean(bench.data.msg_publishing_latency)/1000.0,
+    (double )hdr_value_at_percentile(bench.data.msg_publishing_latency, 99.0)/1000.0,
+    (double )hdr_max(bench.data.msg_publishing_latency)/1000.0,
+    (double )hdr_stddev(bench.data.msg_publishing_latency)/1000.0,
+    bench.data.msg_publishing_latency->total_count,
+    
+    (double )hdr_min(bench.data.msg_delivery_latency)/1000.0,
+    (double )hdr_mean(bench.data.msg_delivery_latency)/1000.0,
+    (double )hdr_value_at_percentile(bench.data.msg_delivery_latency, 99.0)/1000.0,
+    (double )hdr_max(bench.data.msg_delivery_latency)/1000.0,
+    (double )hdr_stddev(bench.data.msg_delivery_latency)/1000.0,
+    bench.data.msg_delivery_latency->total_count
+  );
+  if(accept_header && ngx_strnstr(accept_header->data, "text/x-json-hdrhistogram", accept_header->len)) {
+    ngx_str_t *serialized_publishing_histogram, *serialized_delivery_histogram;
+    size_t sz;
+    fmt = 
+      "RESULTS\n"
+      "{\n"
+      "%s,\n"
+      "  \"message_publishing_histogram\":\n"
+      "    \"%V\",\n"
+      "  \"message_delivery_histogram\":\n"
+      "    \"%V\"\n"
+      "}\n"
+      "%Z";
+    sz = strlen(stats) + strlen(fmt);
+    serialized_publishing_histogram = nchan_hdrhistogram_serialize(bench.data.msg_publishing_latency, r->pool);
+    serialized_delivery_histogram = nchan_hdrhistogram_serialize(bench.data.msg_delivery_latency, r->pool);
+    
+    sz += serialized_publishing_histogram->len;
+    sz += serialized_delivery_histogram->len;
+    str = ngx_palloc(r->pool, sz);
+    if(str == NULL) {
+      benchmark_client_respond("ERROR: unable to create results response");
+      return NGX_ERROR;
+    }
+    
+    ngx_snprintf(str, sz, fmt, 
+      stats,
+      serialized_publishing_histogram,
+      serialized_delivery_histogram
+    );
+  }
+  else {
+        fmt = 
+      "RESULTS\n"
+      "{\n"
+      "%s\n"
+      "}\n"
+      "%Z";
+    str = ngx_palloc(r->pool, strlen(stats) + strlen(fmt));
+    ngx_sprintf(str, fmt, stats);
+  } 
+  
+  benchmark_client_respond((char *)str);
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_abort(void) {
+  int active = nchan_benchmark_active();
+  
+  nchan_benchmark_dequeue_subscribers();
+  nchan_benchmark_stop();
+  nchan_benchmark_cleanup();
+  
+  return active ? NGX_OK : NGX_DECLINED;
+}
+
+ngx_int_t nchan_benchmark_stop(void) {
+  int i;
+  DBG("stop benchmark");
+  if(bench.timer.publishers) {
+    for(i=0; i< bench.config->channels; i++) {
+      if(bench.timer.publishers[i]) {
+        nchan_abort_interval_timer(bench.timer.publishers[i]);
+      }
+    }
+    ngx_free(bench.timer.publishers);
+    bench.timer.publishers = NULL;
+  }
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_finish(void) {
+  //free all the things
+  shm_free(nchan_store_memory_shmem, (void *)bench.shared.subscribers_enqueued);
+  shm_free(nchan_store_memory_shmem, (void *)bench.shared.subscribers_dequeued);
+  shm_free(nchan_store_memory_shmem, bench.shared.channels);
+  hdr_close_nchan_shm(bench.data.msg_publishing_latency);
+  hdr_close_nchan_shm(bench.data.msg_delivery_latency);
+  hdr_close_nchan_shm(bench.data.subscriber_readiness_latency);
+  bench.client->fn->respond_status(bench.client, NGX_HTTP_GONE, NULL, NULL);
+  nchan_benchmark_cleanup();
+  DBG("benchmark finished");
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_cleanup(void) {
+  DBG("benchmark cleanup");
+  bench.client = NULL;
+  assert(bench.timer.publishers == NULL);
+  assert(bench.subs.array == NULL);
+  assert(bench.subs.n == 0);
+  bench.id = 0;
+  if(bench.msgbuf) {
+    ngx_free(bench.msgbuf);
+    bench.msgbuf = NULL;
+  }
+  
+  ngx_memzero(&bench.time, sizeof(bench.time));
+  *bench.state = NCHAN_BENCHMARK_INACTIVE;
+  bench.waiting_for_results = 0;
+  
+  if(bench.timer.ready) {
+    nchan_abort_interval_timer(bench.timer.ready);
+    bench.timer.ready = NULL;
+  }
+  if(bench.timer.running) {
+    nchan_abort_oneshot_timer(bench.timer.running);
+    bench.timer.running = NULL;
+  }
+  if(bench.timer.finishing) {
+    nchan_abort_oneshot_timer(bench.timer.finishing);
+    bench.timer.finishing = NULL;
+  }
+  
+  return NGX_OK;
+}
+
+ngx_int_t nchan_benchmark_channel_id(int n, ngx_str_t *chid) {
+  static u_char  id[255];
+  u_char        *last;
+  chid->data = id;
+  last = ngx_snprintf(id, 255, "/benchmark.%T-%D.%D", bench.time.init, bench.id, n);
+  chid->len = last - id;
+  return NGX_OK;
+}
+
+uint64_t nchan_benchmark_message_delivery_msec(nchan_msg_t *msg) {
+  struct timeval tv;
+  ngx_gettimeofday(&tv);
+  
+  uint64_t now = (tv.tv_sec - bench.time.init) * (uint64_t)1000000 + tv.tv_usec;
+  int then;
+  
+  if(ngx_buf_in_memory((&msg->buf))) {
+    then = atoi((char *)msg->buf.start);
+  }
+  else {
+    //not supported yet
+    then = now;
+    raise(SIGABRT);
+  }
+  
+  return now - then;
+}
+
+nchan_benchmark_t *nchan_benchmark_get_active(void) {
+  return &bench;
+}
+
+char throwaway_buf[128];
+static void serialize_int64_t(int write, char **cur, int64_t val) {
+  char  *buf;
+  buf = write ? *cur : throwaway_buf;
+  *cur += sprintf(buf, "%" PRId64 " ", val);
+}
+static void serialize_int32_t(int write, char **cur, int32_t val) {
+  char  *buf;
+  buf = write ? *cur : throwaway_buf;
+  *cur += sprintf(buf, "%" PRId32 " ", val);
+}
+static void serialize_double(int write, char **cur, double val) {
+  char  *buf;
+  buf = write ? *cur : throwaway_buf;
+  *cur += sprintf(buf, "%lf ", val);
+}
+static void serialize_numrun(int write, char **cur, int num, int runcount) {
+  char  *numrun="~!@#$%^&*";
+  char  *buf;
+  assert((size_t)num < strlen(numrun));
+  buf = write ? *cur : throwaway_buf;
+  if(runcount == 0) {
+    *cur += sprintf(buf, "%i ", num);
+  }
+  else {
+    *cur += sprintf(buf, "%c%i ", numrun[num], runcount);
+  }
+}
+
+size_t hdrhistogram_serialize(int write, char *start, const struct hdr_histogram* hdr) {
+  int    i;
+  char  *fakestart = NULL;
+  char **cur;
+  if(start == NULL) {
+    start = fakestart;
+  }
+  cur = &start;
+  char *first = start;
+  
+  serialize_int64_t(write, cur, hdr->lowest_trackable_value);
+  serialize_int64_t(write, cur, hdr->highest_trackable_value);
+  serialize_int32_t(write, cur, hdr->unit_magnitude);
+  serialize_int32_t(write, cur, hdr->significant_figures);
+  serialize_int32_t(write, cur, hdr->sub_bucket_half_count_magnitude);
+  serialize_int32_t(write, cur, hdr->sub_bucket_half_count);
+  serialize_int64_t(write, cur, hdr->sub_bucket_mask);
+  serialize_int32_t(write, cur, hdr->sub_bucket_count);
+  serialize_int32_t(write, cur, hdr->bucket_count);
+  serialize_int64_t(write, cur, hdr->min_value);
+  serialize_int64_t(write, cur, hdr->max_value);
+  serialize_int32_t(write, cur, hdr->normalizing_index_offset);
+  serialize_double (write, cur, hdr->conversion_ratio);
+  serialize_int32_t(write, cur, hdr->counts_len);
+  serialize_int64_t(write, cur, hdr->total_count);
+  
+  if(write) {
+    **cur='[';
+  }
+  (*cur)++;
+  
+  int runcount=0;
+  int64_t ncur=0, nprev=0;
+  for(i=1, nprev=hdr->counts[0]; i<hdr->counts_len; i++) {
+    ncur = hdr->counts[i];
+    nprev = hdr->counts[i-1];
+    if(ncur <= 8 && ncur == nprev) {
+      runcount++;
+    }
+    else {
+      if(runcount > 0) {
+        serialize_numrun(write, cur, nprev, runcount+1);
+        runcount = 0;
+      }
+      else {
+        serialize_int64_t(write, cur, nprev);
+      }
+    }
+  }
+  if(runcount > 0) {
+    serialize_numrun(write, cur, ncur, runcount+1);
+  }
+  else {
+    serialize_int64_t(write, cur, ncur);
+  }
+  
+  if(write) {
+    **cur=']';
+  }
+  (*cur)++;
+  
+  return *cur - first;
+}
+
+
+ngx_str_t *nchan_hdrhistogram_serialize(const struct hdr_histogram* hdr, ngx_pool_t *pool) {
+  char *start=NULL;
+  ngx_str_t *str = ngx_palloc(pool, sizeof(*str));
+  size_t sz = hdrhistogram_serialize(0, NULL, hdr);
+  start = ngx_palloc(pool, sz);
+  hdrhistogram_serialize(1, start, hdr);
+  str->data = (u_char *)start;
+  str->len = sz;
+  return str;
+}
+
+static ngx_int_t benchmark_timer_ready_check(void *pd) {
+  uint64_t required_subs = bench.config->subscribers_per_channel * bench.config->channels;
+  if(*bench.shared.subscribers_enqueued == required_subs) {
+    char     ready_reply[512];
+    assert(*bench.state == NCHAN_BENCHMARK_INITIALIZING);
+    *bench.state = NCHAN_BENCHMARK_READY;
+    ngx_snprintf((u_char *)ready_reply, 512, "READY\n"
+      "{\n"
+      "  \"init_time\":                        %T,\n"
+      "  \"time\":                             %T,\n"
+      "  \"messages_per_channel_per_minute\":  %d,\n"
+      "  \"message_padding_bytes\":            %d,\n"
+      "  \"channels\":                         %d,\n"
+      "  \"subscribers_per_channel\":          %d\n"
+      "}\n%Z",
+      bench.time.init,
+      bench.config->time,
+      bench.config->msgs_per_minute,
+      bench.config->msg_padding,
+      bench.config->channels,
+      bench.config->subscribers_per_channel);
+    
+    benchmark_client_respond(ready_reply);
+    bench.timer.ready = NULL;
+    return NGX_DONE;
+  }
+  else {
+    return NGX_AGAIN;
+  }
+}
+
+ngx_int_t nchan_benchmark_initialize_from_ipc(ngx_int_t initiating_worker_slot, nchan_loc_conf_t *cf, time_t init_time, uint32_t id, nchan_benchmark_shared_t *shared_data) {
+  DBG("init benchmark via IPC (time %d src %d)", init_time, initiating_worker_slot);
+  bench.loc_conf = cf;
+  bench.time.init = init_time;
+  bench.id = id;
+  bench.shared = *shared_data;
+  ngx_memzero(&bench.data, sizeof(bench.data));
+  hdr_init_nchan_shm(1, 10000000, 3, &bench.data.msg_delivery_latency);
+  hdr_init_nchan_shm(1, 10000000, 3, &bench.data.msg_publishing_latency);
+  hdr_init_nchan_shm(1, 10000000, 3, &bench.data.subscriber_readiness_latency);
+  
+  nchan_benchmark_initialize();
+  
+  return NGX_OK;
+}
+
+static ngx_int_t init_command_get_config_value(const char *config, ngx_str_t *cmd, ngx_int_t *val) {
+  ngx_str_t find;
+  u_char   *cur = cmd->data, *end = cmd->data + cmd->len, *vend;
+  find.data = (u_char *)config;
+  find.len = strlen(config);
+  if(nchan_strscanstr(&cur, &find, end)) {
+    if((vend = memchr(cur, ' ', end - cur)) == NULL) {
+      vend = end;
+    }
+    if((*val = ngx_atoi(cur, vend - cur)) == NGX_ERROR) {
+      return 0;
+    }
+    else {
+      return 1;
+    }
+  }
+  return 0;
+}
+
+void benchmark_controller(subscriber_t *sub, nchan_msg_t *msg) {
+  ngx_str_t            cmd = {msg->buf.last - msg->buf.pos, msg->buf.pos};
+  ngx_http_request_t  *r = sub->request;
+  nchan_loc_conf_t   *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
+  
+  if(nchan_str_startswith(&cmd, "init")) {
+    int       i;
+    ngx_int_t val;
+    
+    if(!ngx_atomic_cmp_set((ngx_atomic_uint_t *)bench.state, NCHAN_BENCHMARK_INACTIVE, NCHAN_BENCHMARK_INITIALIZING)) {
+      benchmark_client_respond("ERROR: a benchmark is already initialized");
+      return;
+    }
+    
+    DBG("init benchmark");
+    benchmark_client_respond("INITIALIZING");
+    
+    bench.loc_conf = cf;
+    *bench.config = cf->benchmark;
+    
+    if(init_command_get_config_value(" time=", &cmd, &val)) {
+      bench.config->time = val;
+    }
+    if(init_command_get_config_value(" messages_per_channel_per_minute=", &cmd, &val)) {
+      bench.config->msgs_per_minute = val;
+    }
+    if(init_command_get_config_value(" message_padding_bytes=", &cmd, &val)) {
+      bench.config->msg_padding = val;
+    }
+    if(init_command_get_config_value(" channels=", &cmd, &val)) {
+      bench.config->channels = val;
+    }
+    if(init_command_get_config_value(" subscribers_per_channel=", &cmd, &val)) {
+      bench.config->subscribers_per_channel = val;
+    }
+    
+    bench.time.init = ngx_time();
+    bench.id = rand();
+    bench.client = sub;
+    ngx_memzero(&bench.data, sizeof(bench.data));
+    
+    bench.shared.subscribers_enqueued = shm_calloc(nchan_store_memory_shmem, sizeof(ngx_atomic_t), "hdrhistogram subscribers_enqueued count");
+    bench.shared.subscribers_dequeued = shm_calloc(nchan_store_memory_shmem, sizeof(ngx_atomic_t), "hdrhistogram subscribers_dequeued count");
+    bench.shared.channels = shm_calloc(nchan_store_memory_shmem, sizeof(nchan_benchmark_channel_t) * bench.config->channels, "benchmark channel states");
+    hdr_init_nchan_shm(1, 10000000, 3, &bench.data.msg_delivery_latency);
+    hdr_init_nchan_shm(1, 10000000, 3, &bench.data.msg_publishing_latency);
+    hdr_init_nchan_shm(1, 10000000, 3, &bench.data.subscriber_readiness_latency);
+    
+    for(i=0; i<bench.config->channels; i++) {
+      bench.shared.channels[i].n=i;
+      bench.shared.channels[i].msg_count=0;
+    }
+    
+    bench.msgbuf = NULL;
+    
+    //broadcast workload to other workers
+    memstore_ipc_broadcast_benchmark_initialize(&bench);
+    
+    nchan_benchmark_initialize();
+    
+    bench.timer.ready = nchan_add_interval_timer(benchmark_timer_ready_check, NULL, 250);
+  }
+  else if(nchan_strmatch(&cmd, 2, "run", "start")) {
+    if(!ngx_atomic_cmp_set((ngx_atomic_uint_t *)bench.state, NCHAN_BENCHMARK_READY, NCHAN_BENCHMARK_RUNNING)) {
+      benchmark_client_respond(*bench.state < NCHAN_BENCHMARK_READY ? "ERROR: not ready" : "ERROR: already running");
+      return;
+    }
+    
+    bench.time.start = ngx_time();
+    benchmark_client_respond("RUNNING");
+    
+    memstore_ipc_broadcast_benchmark_run();
+    nchan_benchmark_run();
+    
+    bench.timer.running = nchan_add_oneshot_timer(benchmark_timer_running_stop, NULL, bench.config->time * 1000);
+  }
+  else if(nchan_strmatch(&cmd, 2, "finish", "end")) {
+    //benchmark_finish();
+  }
+  else if(nchan_strmatch(&cmd, 1, "abort"))  {
+    if(nchan_benchmark_abort() == NGX_OK) {
+      memstore_ipc_broadcast_benchmark_abort();
+      benchmark_client_respond("ABORTED");
+    }
+    else {
+      benchmark_client_respond("ERROR: no active benchmark to abort");
+    }
+  }
+  else {
+    benchmark_client_respond("ERROR: unknown command");
+  }
+}
+
+void benchmark_request_cleanup_handler(void *pd) {
+  if(nchan_benchmark_abort() == NGX_OK) {
+    memstore_ipc_broadcast_benchmark_abort();
+  }
+  bench.client = NULL;
+}
+
+ngx_int_t nchan_benchmark_ws_initialize(ngx_http_request_t *r) {
+  nchan_msg_id_t          newest_msgid = NCHAN_NEWEST_MSGID;
+  ngx_http_cleanup_t     *cln;
+  if(!nchan_detect_websocket_request(r)) {
+    return NGX_HTTP_BAD_REQUEST;
+  }
+  
+  if(nchan_benchmark_active()) {
+    return nchan_respond_cstring(r, NGX_HTTP_CONFLICT, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, "benchmark already running", 0);
+  }
+  if(bench.client) {
+    return nchan_respond_cstring(r, NGX_HTTP_CONFLICT, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, "benchmark client already running", 0);
+  }
+  if((cln = ngx_http_cleanup_add(r, 0)) == NULL) {
+    return NGX_HTTP_INTERNAL_SERVER_ERROR;
+  }
+  cln->data = NULL;
+  cln->handler = benchmark_request_cleanup_handler;
+  if((bench.client = websocket_subscriber_create(r, &newest_msgid)) == NULL) {
+    return NGX_HTTP_INTERNAL_SERVER_ERROR;
+  }
+  websocket_intercept_published_message(bench.client, &benchmark_controller);
+  bench.client->fn->enqueue(bench.client);
+  
+  
+  return NGX_DONE;
+}
diff --git a/debian/modules/nchan/src/util/nchan_benchmark.h b/debian/modules/nchan/src/util/nchan_benchmark.h
new file mode 100644
index 00000000..c9bab817
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_benchmark.h
@@ -0,0 +1,91 @@
+#ifndef NCHAN_BENCHMARK_H
+#define NCHAN_BENCHMARK_H
+
+#include <nchan_module.h>
+#include <util/hdr_histogram.h>
+
+typedef struct {
+  struct hdr_histogram* msg_publishing_latency;
+  struct hdr_histogram* msg_delivery_latency;
+  struct hdr_histogram* subscriber_readiness_latency;
+  uint64_t              msg_sent;
+  uint64_t              msg_send_confirmed;
+  uint64_t              msg_send_failed;
+  uint64_t              msg_received;
+} nchan_benchmark_data_t;
+
+typedef struct {
+  uint64_t              n;
+  ngx_atomic_t          msg_count;
+  u_char               *msgbuf;
+} nchan_benchmark_channel_t;
+
+typedef struct {
+  ngx_atomic_t              *subscribers_enqueued;
+  ngx_atomic_t              *subscribers_dequeued;
+  nchan_benchmark_channel_t *channels;
+} nchan_benchmark_shared_t;
+
+
+#define NCHAN_BENCHMARK_INACTIVE      0
+#define NCHAN_BENCHMARK_INITIALIZING  1
+#define NCHAN_BENCHMARK_READY         2
+#define NCHAN_BENCHMARK_RUNNING       3
+#define NCHAN_BENCHMARK_FINISHED      4
+
+typedef struct nchan_benchmark_s nchan_benchmark_t;
+struct nchan_benchmark_s {
+  subscriber_t       *client;
+  nchan_benchmark_conf_t   *config;
+  nchan_loc_conf_t   *loc_conf;
+  uint32_t            id;
+  struct {
+    time_t              init;
+    time_t              start;
+    time_t              end;
+  }                   time;
+  struct {
+    void             *ready;
+    void             *running;
+    void             *finishing;
+    void            **publishers;
+  }                   timer;
+  u_char             *msgbuf;
+  ngx_atomic_int_t   *state;
+  struct {
+    size_t              n;
+    subscriber_t      **array;
+  }                   subs;
+  unsigned            base_msg_period;
+  int                 waiting_for_results;
+  nchan_benchmark_shared_t shared;
+  nchan_benchmark_data_t data;
+  
+}; //nchan_benchmark_t
+
+int nchan_benchmark_active(void);
+  
+ngx_int_t nchan_benchmark_init_module(ngx_cycle_t *cycle);
+ngx_int_t nchan_benchmark_init_worker(ngx_cycle_t *cycle);
+ngx_int_t nchan_benchmark_exit_master(ngx_cycle_t *cycle);
+
+ngx_int_t nchan_benchmark_initialize(void);
+ngx_int_t nchan_benchmark_initialize_from_ipc(ngx_int_t initiating_worker_slot, nchan_loc_conf_t *cf, time_t time_start, uint32_t id, nchan_benchmark_shared_t *shared_data);
+ngx_int_t nchan_benchmark_run(void);
+
+ngx_int_t nchan_benchmark_stop(void);
+ngx_int_t nchan_benchmark_dequeue_subscribers(void);
+ngx_int_t nchan_benchmark_finish_response(void);
+ngx_str_t *nchan_hdrhistogram_serialize(const struct hdr_histogram* hdr, ngx_pool_t *pool);
+ngx_int_t nchan_benchmark_receive_finished_data(nchan_benchmark_data_t *data);
+ngx_int_t nchan_benchmark_finish(void);
+ngx_int_t nchan_benchmark_abort(void);
+ngx_int_t nchan_benchmark_cleanup(void);
+
+ngx_int_t nchan_benchmark_channel_id(int n, ngx_str_t *chid);
+uint64_t nchan_benchmark_message_delivery_msec(nchan_msg_t *msg);
+nchan_benchmark_t *nchan_benchmark_get_active(void);
+
+
+ngx_int_t nchan_benchmark_ws_initialize(ngx_http_request_t *r);
+#endif //NCHAN_BENCHMARK_H
diff --git a/debian/modules/nchan/src/util/nchan_bufchainpool.c b/debian/modules/nchan/src/util/nchan_bufchainpool.c
index 175c0444..2148c119 100644
--- a/debian/modules/nchan/src/util/nchan_bufchainpool.c
+++ b/debian/modules/nchan/src/util/nchan_bufchainpool.c
@@ -31,6 +31,8 @@ static void validate_stuff(nchan_bufchain_pool_t *bcp) {
 }
 */
 
+
+
 nchan_buf_and_chain_t *nchan_bufchain_pool_reserve(nchan_bufchain_pool_t *bcp, ngx_int_t count) {
   nchan_bufchain_link_t      *cur = NULL, *last = NULL, *first = NULL;
   nchan_bufchain_link_t      **rhead = &bcp->bc_recycle_head;
@@ -66,6 +68,82 @@ nchan_buf_and_chain_t *nchan_bufchain_pool_reserve(nchan_bufchain_pool_t *bcp, n
   return &first->bc;
 }
 
+static ngx_buf_t *nchan_bufchain_append(nchan_bufchain_pool_t *bcp) {
+  static ngx_buf_t            throwaway;
+  ngx_chain_t                *chain;
+  ngx_chain_t               **rhead = &bcp->bc.recycle_head;
+  
+  if(*rhead) {
+    chain = *rhead;
+    *rhead = chain->next;
+    bcp->bc.recycle_count --;
+  } 
+  else {
+    nchan_buf_and_chain_t *bufchain = ngx_palloc(bcp->pool, sizeof(*bufchain));
+    if(bufchain == NULL) {
+      nchan_log_error("unable to palloc bufchain");
+      return &throwaway;
+    }
+    chain = &bufchain->chain;
+    chain->buf = &bufchain->buf;
+  }
+  
+  chain->buf->last_buf = 1;
+  chain->buf->last_in_chain = 1;
+  chain->next = NULL;
+  
+  if(!bcp->bc.head) {
+    bcp->bc.head = chain;
+  }
+  
+  if(bcp->bc.tail) {
+    ngx_buf_t *tbuf = bcp->bc.tail->buf;
+    tbuf->last_buf = 0;
+    tbuf->last_in_chain = 0;
+    bcp->bc.tail->next = chain;
+  }
+  bcp->bc.tail = chain;
+  bcp->bc.count++;
+  return chain->buf;
+}
+
+ngx_int_t nchan_bufchain_append_buf(nchan_bufchain_pool_t *bcp, ngx_buf_t *inbuf) {
+  ngx_buf_t *buf = nchan_bufchain_append(bcp);
+  *buf = *inbuf;
+  buf->last_buf = 1;
+  buf->last_in_chain = 1;
+  bcp->bc.length += ngx_buf_size(inbuf);
+  return NGX_OK;
+}
+
+ngx_int_t nchan_bufchain_append_str(nchan_bufchain_pool_t *bcp, ngx_str_t *str) {
+  ngx_buf_t *buf = nchan_bufchain_append(bcp);
+  ngx_memzero(buf, sizeof(*buf));
+  buf->start = str->data;
+  buf->pos = buf->start;
+  buf->end = str->data + str->len;
+  buf->last = buf->end;
+  buf->memory = 1;
+  buf->last_buf = 1;
+  buf->last_in_chain = 1;
+  bcp->bc.length += str->len;
+  return NGX_OK;
+}
+ngx_int_t nchan_bufchain_append_cstr(nchan_bufchain_pool_t *bcp, char *cstr) {
+  ngx_str_t str;
+  str.data = (u_char *)cstr;
+  str.len = strlen(cstr);
+  return nchan_bufchain_append_str(bcp, &str);
+}
+
+size_t nchan_bufchain_length(nchan_bufchain_pool_t *bcp) {
+  return bcp->bc.length;
+}
+ngx_chain_t *nchan_bufchain_first_chain(nchan_bufchain_pool_t *bcp) {
+  return bcp->bc.head;
+}
+
+
 ngx_file_t *nchan_bufchain_pool_reserve_file(nchan_bufchain_pool_t *bcp) {
   nchan_file_link_t    *cur;
   //validate_stuff(bcp);
@@ -103,6 +181,13 @@ ngx_int_t nchan_bufchain_pool_init(nchan_bufchain_pool_t *bcp, ngx_pool_t *pool)
   bcp->bc_head = NULL;
   bcp->bc_recycle_head = NULL;
   
+  bcp->bc.head = NULL;
+  bcp->bc.tail = NULL;
+  bcp->bc.recycle_head = NULL;
+  bcp->bc.count = 0;
+  bcp->bc.recycle_count = 0;
+  bcp->bc.length = 0;
+  
   bcp->file_head = NULL;
   bcp->file_recycle_head = NULL;
   
@@ -115,6 +200,17 @@ void nchan_bufchain_pool_flush(nchan_bufchain_pool_t *bcp) {
   nchan_bufchain_link_t      *cur;
   nchan_file_link_t          *fcur, **fhead = &bcp->file_head, **rfhead = &bcp->file_recycle_head;
   //validate_stuff(bcp);
+  
+  if(bcp->bc.tail) {
+    bcp->bc.tail->next = bcp->bc.recycle_head; //link just-used and recycled-in-waiting chains
+  }
+  bcp->bc.recycle_head = bcp->bc.head;
+  bcp->bc.recycle_count += bcp->bc.count;
+  bcp->bc.count = 0;
+  bcp->bc.length = 0;
+  bcp->bc.tail = NULL;
+  bcp->bc.head = NULL;
+  
   while(bcp->bc_head != NULL) {
     cur = bcp->bc_head;
     bcp->bc_head = cur->next;
diff --git a/debian/modules/nchan/src/util/nchan_bufchainpool.h b/debian/modules/nchan/src/util/nchan_bufchainpool.h
index 67f7d1aa..fa122990 100644
--- a/debian/modules/nchan/src/util/nchan_bufchainpool.h
+++ b/debian/modules/nchan/src/util/nchan_bufchainpool.h
@@ -29,6 +29,16 @@ typedef struct {
   nchan_file_link_t         *file_head;
   nchan_file_link_t         *file_recycle_head;
   ngx_pool_t                *pool;
+  
+  struct {
+    size_t                     length;
+    ngx_int_t                  count;
+    ngx_chain_t               *head;
+    ngx_chain_t               *tail;
+    
+    ngx_int_t                  recycle_count;
+    ngx_chain_t               *recycle_head;
+  }                          bc;
 } nchan_bufchain_pool_t;
 
 ngx_int_t nchan_bufchain_pool_init(nchan_bufchain_pool_t *bcp, ngx_pool_t *pool);
@@ -36,4 +46,11 @@ nchan_buf_and_chain_t *nchan_bufchain_pool_reserve(nchan_bufchain_pool_t *bcp, n
 ngx_file_t *nchan_bufchain_pool_reserve_file(nchan_bufchain_pool_t *bcp);
 void nchan_bufchain_pool_refresh_files(nchan_bufchain_pool_t *bcp);
 void nchan_bufchain_pool_flush(nchan_bufchain_pool_t *bcp);
+
+ngx_chain_t *nchan_bufchain_first_chain(nchan_bufchain_pool_t *bcp);
+size_t nchan_bufchain_length(nchan_bufchain_pool_t *bcp);
+ngx_int_t nchan_bufchain_append_buf(nchan_bufchain_pool_t *bcp, ngx_buf_t *buf);
+ngx_int_t nchan_bufchain_append_str(nchan_bufchain_pool_t *bcp, ngx_str_t *str);
+ngx_int_t nchan_bufchain_append_cstr(nchan_bufchain_pool_t *bcp, char *cstr);
+
 #endif //NCHAN_BUFCHAINPOOL_H
diff --git a/debian/modules/nchan/src/util/nchan_channel_id.c b/debian/modules/nchan/src/util/nchan_channel_id.c
index 532d0be0..4a2decab 100644
--- a/debian/modules/nchan/src/util/nchan_channel_id.c
+++ b/debian/modules/nchan/src/util/nchan_channel_id.c
@@ -9,18 +9,27 @@ static ngx_int_t validate_id(ngx_http_request_t *r, ngx_str_t *id, nchan_loc_con
   return NGX_OK;
 }
 
+ngx_int_t nchan_channel_id_is_multi(ngx_str_t *id) {
+  u_char         *cur = id->data;
+  return (id->len >= 3 && cur[0] == 'm' && cur[1] == '/' && cur[2] == NCHAN_MULTI_SEP_CHR);
+}
+
+
+
 static ngx_int_t nchan_process_multi_channel_id(ngx_http_request_t *r, nchan_complex_value_arr_t *idcf, nchan_loc_conf_t *cf, ngx_str_t **ret_id) {
   ngx_int_t                   i, n = idcf->n, n_out = 0;
   ngx_str_t                   id[NCHAN_MULTITAG_MAX];
   ngx_str_t                  *id_out;
-  ngx_str_t                  *group = &cf->channel_group;
+  nchan_request_ctx_t        *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  ngx_str_t                  *group = nchan_get_group_name(r, cf, ctx);
+  if(group == NULL) {
+    return NGX_ERROR;
+  }
   size_t                      sz = 0, grouplen = group->len;
   u_char                     *cur;
   
   //static ngx_str_t            empty_string = ngx_string("");
   
-  nchan_request_ctx_t        *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
-  
   for(i=0; i < n && n_out < NCHAN_MULTITAG_MAX; i++) {
     ngx_http_complex_value(r, idcf->cv[i], &id[n_out]);
     if(validate_id(r, &id[n_out], cf) != NGX_OK) {
@@ -101,12 +110,13 @@ static ngx_int_t nchan_process_legacy_channel_id(ngx_http_request_t *r, nchan_lo
   static ngx_str_t            channel_id_var_name = ngx_string("push_channel_id");
   ngx_uint_t                  key = ngx_hash_key(channel_id_var_name.data, channel_id_var_name.len);
   ngx_http_variable_value_t  *vv = NULL;
-  ngx_str_t                  *group = &cf->channel_group;
+  nchan_request_ctx_t        *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  ngx_str_t                  *group = nchan_get_group_name(r, cf, ctx);
   ngx_str_t                   tmpid;
   ngx_str_t                  *id;
   size_t                      sz;
   u_char                     *cur;
-  nchan_request_ctx_t        *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  
   
   ctx->channel_id_count = 0;
   
@@ -148,12 +158,68 @@ static ngx_int_t nchan_process_legacy_channel_id(ngx_http_request_t *r, nchan_lo
   return NGX_OK;
 }
 
+ngx_str_t nchan_get_group_from_channel_id(ngx_str_t *id) {
+  ngx_str_t group;
+  u_char *cur, *end;
+  size_t  len;
+  if(nchan_channel_id_is_multi(id)) {
+    cur = &id->data[3];
+    len = id->len - 3;
+  }
+  else {
+    cur = id->data;
+    len = id->len;
+  }
+  end = memchr(cur, '/', len);
+  
+  assert(end); //if slash wasn't found, we have a malformed id string. 
+  //this is crashworthy to investigate how it happened.
+  
+  group.data = cur;
+  group.len = (end - cur);
+  
+  return group;
+}
+
+ngx_str_t *nchan_get_group_name(ngx_http_request_t *r, nchan_loc_conf_t *cf, nchan_request_ctx_t *ctx) {
+  if(!ctx->channel_group_name) {
+    if((ctx->channel_group_name = ngx_palloc(r->pool, sizeof(*ctx->channel_group_name))) == NULL) {
+      nchan_log_request_error(r, "couldn't allocate a tiny little channel group string.");
+      return NULL;
+    }
+    
+    if(cf->channel_group == NULL) {
+      ctx->channel_group_name->len = 0;
+      ctx->channel_group_name->data = NULL;
+    }
+    else {
+      ngx_http_complex_value(r, cf->channel_group, ctx->channel_group_name);
+    }
+  }
+  
+  return ctx->channel_group_name;
+}
+
 ngx_str_t *nchan_get_channel_id(ngx_http_request_t *r, pub_or_sub_t what, ngx_int_t fail_hard) {
   static const ngx_str_t          NO_CHANNEL_ID_MESSAGE = ngx_string("No channel id provided.");
   nchan_loc_conf_t               *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
   ngx_int_t                       rc;
   ngx_str_t                      *id = NULL;
-  nchan_complex_value_arr_t          *chid_conf;
+  nchan_complex_value_arr_t      *chid_conf;
+  nchan_request_ctx_t            *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  ngx_str_t                      *group = nchan_get_group_name(r, cf, ctx);
+  
+  //validate group
+  if(group->len == 1 && group->data[0]=='m') {
+    nchan_log_request_warning(r, "channel group \"m\" is reserved and cannot be used in a request.");
+    rc = NGX_DECLINED;
+    goto done;
+  }
+  else if(memchr(group->data, '/', group->len)) {
+    nchan_log_request_warning(r, "character \"/\" not allowed in channel group.");
+    rc = NGX_DECLINED;
+    goto done;
+  }
   
   chid_conf = what == PUB ? &cf->pub_chid : &cf->sub_chid;
   if(chid_conf->n == 0) {
@@ -193,11 +259,11 @@ ngx_str_t *nchan_get_channel_id(ngx_http_request_t *r, pub_or_sub_t what, ngx_in
     assert(rc != NGX_OK);
     switch(rc) {
       case NGX_ERROR:
-        nchan_respond_status(r, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, 0);
+        nchan_respond_status(r, NGX_HTTP_INTERNAL_SERVER_ERROR, NULL, NULL, 0);
         break;
       
       case NGX_DECLINED:
-        nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, 0);
+        nchan_respond_status(r, NGX_HTTP_FORBIDDEN, NULL, NULL, 0);
         break;
       
       case NGX_ABORT:
diff --git a/debian/modules/nchan/src/util/nchan_channel_id.h b/debian/modules/nchan/src/util/nchan_channel_id.h
index f8e40847..56958fd9 100644
--- a/debian/modules/nchan/src/util/nchan_channel_id.h
+++ b/debian/modules/nchan/src/util/nchan_channel_id.h
@@ -1 +1,4 @@
-ngx_str_t *nchan_get_channel_id(ngx_http_request_t *r, pub_or_sub_t what, ngx_int_t fail_hard);
\ No newline at end of file
+ngx_str_t *nchan_get_channel_id(ngx_http_request_t *r, pub_or_sub_t what, ngx_int_t fail_hard);
+ngx_int_t nchan_channel_id_is_multi(ngx_str_t *id);
+ngx_str_t *nchan_get_group_name(ngx_http_request_t *r, nchan_loc_conf_t *cf, nchan_request_ctx_t *ctx);
+ngx_str_t nchan_get_group_from_channel_id(ngx_str_t *id);
diff --git a/debian/modules/nchan/src/util/nchan_channel_info.c b/debian/modules/nchan/src/util/nchan_channel_info.c
deleted file mode 100644
index 5a4fbd1b..00000000
--- a/debian/modules/nchan/src/util/nchan_channel_info.c
+++ /dev/null
@@ -1,128 +0,0 @@
-#include <nchan_module.h>
-
-void nchan_match_channel_info_subtype(size_t off, u_char *cur, size_t rem, u_char **priority, const ngx_str_t **format, ngx_str_t *content_type) {
-  static nchan_content_subtype_t subtypes[] = {
-    { "json"  , 4, &NCHAN_CHANNEL_INFO_JSON },
-    { "yaml"  , 4, &NCHAN_CHANNEL_INFO_YAML },
-    { "xml"   , 3, &NCHAN_CHANNEL_INFO_XML  },
-    { "x-json", 6, &NCHAN_CHANNEL_INFO_JSON },
-    { "x-yaml", 6, &NCHAN_CHANNEL_INFO_YAML }
-  };
-  u_char                         *start = cur + off;
-  ngx_uint_t                      i;
-  
-  for(i=0; i<(sizeof(subtypes)/sizeof(nchan_content_subtype_t)); i++) {
-    if(ngx_strncmp(start, subtypes[i].subtype, rem<subtypes[i].len ? rem : subtypes[i].len)==0) {
-      if(*priority>start) {
-        *format = subtypes[i].format;
-        *priority = start;
-        content_type->data=cur;
-        content_type->len= off + subtypes[i].len;
-      }
-    }
-  }
-}
-
-ngx_buf_t                       channel_info_buf;
-u_char                          channel_info_buf_str[512]; //big enough
-ngx_str_t                       channel_info_content_type;
-
-ngx_buf_t *nchan_channel_info_buf(ngx_str_t *accept_header, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *last_msgid, ngx_str_t **generated_content_type) {
-  ngx_buf_t                      *b = &channel_info_buf;
-  ngx_uint_t                      len;
-  const ngx_str_t                *format = &NCHAN_CHANNEL_INFO_PLAIN;
-  time_t                          time_elapsed = ngx_time() - last_seen;
-  static nchan_msg_id_t           zero_msgid = NCHAN_ZERO_MSGID;
-  if(!last_msgid) {
-    last_msgid = &zero_msgid;
-  }
- 
-  ngx_memcpy(&channel_info_content_type, &NCHAN_CONTENT_TYPE_TEXT_PLAIN, sizeof(NCHAN_CONTENT_TYPE_TEXT_PLAIN));
-  
-  b->start = channel_info_buf_str;
-  b->pos = b->start;
-  b->last_buf = 1;
-  b->last_in_chain = 1;
-  b->flush = 1;
-  b->memory = 1;
-  
-  if(accept_header) {
-    //lame content-negotiation (without regard for qvalues)
-    u_char                    *accept = accept_header->data;
-    len = accept_header->len;
-    size_t                     rem;
-    u_char                    *cur = accept;
-    u_char                    *priority=&accept[len-1];
-    
-    for(rem=len; (cur = ngx_strnstr(cur, "text/", rem))!=NULL; cur += sizeof("text/")-1) {
-      rem=len - ((size_t)(cur-accept)+sizeof("text/")-1);
-      if(ngx_strncmp(cur+sizeof("text/")-1, "plain", rem<5 ? rem : 5)==0) {
-        if(priority) {
-          format = &NCHAN_CHANNEL_INFO_PLAIN;
-          priority = cur+sizeof("text/")-1;
-          //content-type is already set by default
-        }
-      }
-      nchan_match_channel_info_subtype(sizeof("text/")-1, cur, rem, &priority, &format, &channel_info_content_type);
-    }
-    cur = accept;
-    for(rem=len; (cur = ngx_strnstr(cur, "application/", rem))!=NULL; cur += sizeof("application/")-1) {
-      rem=len - ((size_t)(cur-accept)+sizeof("application/")-1);
-      nchan_match_channel_info_subtype(sizeof("application/")-1, cur, rem, &priority, &format, &channel_info_content_type);
-    }
-  }
-  
-  if(generated_content_type) {
-    *generated_content_type = &channel_info_content_type;
-  }
-  
-  len = format->len - 8 - 1 + 3*NGX_INT_T_LEN; //minus 8 sprintf
-  
-  if(len > 512) {
-    nchan_log_error("NCHAN: Channel info string too long: max: 512, is: %i", len);
-  }
-  
-  b->last = ngx_snprintf(b->start, 512, (char *)format->data, messages, last_seen==0 ? -1 : (ngx_int_t) time_elapsed, subscribers, msgid_to_str(last_msgid));
-  b->end = b->last;
-  
-  return b;
-}
-
-//print information about a channel
-ngx_int_t nchan_channel_info(ngx_http_request_t *r, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *msgid) {
-  ngx_buf_t                      *b;
-  ngx_str_t                      *content_type;
-  ngx_str_t                      *accept_header = nchan_get_accept_header_value(r);
-
-  b = nchan_channel_info_buf(accept_header, messages, subscribers, last_seen, msgid, &content_type);
-  
-  return nchan_respond_membuf(r, NGX_HTTP_OK, content_type, b, 0);
-}
-
-ngx_int_t nchan_response_channel_ptr_info(nchan_channel_t *channel, ngx_http_request_t *r, ngx_int_t status_code) {
-  static const ngx_str_t CREATED_LINE = ngx_string("201 Created");
-  static const ngx_str_t ACCEPTED_LINE = ngx_string("202 Accepted");
-  
-  time_t             last_seen = 0;
-  ngx_uint_t         subscribers = 0;
-  ngx_uint_t         messages = 0;
-  nchan_msg_id_t    *msgid = NULL;
-  if(channel!=NULL) {
-    subscribers = channel->subscribers;
-    last_seen = channel->last_seen;
-    messages  = channel->messages;
-    msgid = &channel->last_published_msg_id;
-    r->headers_out.status = status_code == (ngx_int_t) NULL ? NGX_HTTP_OK : status_code;
-    if (status_code == NGX_HTTP_CREATED) {
-      ngx_memcpy(&r->headers_out.status_line, &CREATED_LINE, sizeof(ngx_str_t));
-    }
-    else if (status_code == NGX_HTTP_ACCEPTED) {
-      ngx_memcpy(&r->headers_out.status_line, &ACCEPTED_LINE, sizeof(ngx_str_t));
-    }
-    return nchan_channel_info(r, messages, subscribers, last_seen, msgid);
-  }
-  else {
-    //404!
-    return nchan_respond_status(r, NGX_HTTP_NOT_FOUND, NULL, 0);
-  }
-}
diff --git a/debian/modules/nchan/src/util/nchan_channel_info.h b/debian/modules/nchan/src/util/nchan_channel_info.h
deleted file mode 100644
index 6028e4ad..00000000
--- a/debian/modules/nchan/src/util/nchan_channel_info.h
+++ /dev/null
@@ -1,7 +0,0 @@
-void nchan_match_channel_info_subtype(size_t off, u_char *cur, size_t rem, u_char **priority, const ngx_str_t **format, ngx_str_t *content_type);
-
-ngx_buf_t *nchan_channel_info_buf(ngx_str_t *accept_header, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *last_msgid, ngx_str_t **generated_content_type);
-
-ngx_int_t nchan_channel_info(ngx_http_request_t *r, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *msgid);
-
-ngx_int_t nchan_response_channel_ptr_info(nchan_channel_t *channel, ngx_http_request_t *r, ngx_int_t status_code);
\ No newline at end of file
diff --git a/debian/modules/nchan/src/util/nchan_debug.c b/debian/modules/nchan/src/util/nchan_debug.c
new file mode 100644
index 00000000..0092c514
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_debug.c
@@ -0,0 +1,81 @@
+#include "nchan_debug.h"
+#include <assert.h>
+
+#define STRINGIFY_ENUM(val) \
+  case val:                 \
+    return #val;
+
+char *nchan_msg_status_to_cstr(nchan_msg_status_t status) {
+  switch(status) {
+    STRINGIFY_ENUM(MSG_CHANNEL_NOTREADY)
+    STRINGIFY_ENUM(MSG_INVALID)
+    STRINGIFY_ENUM(MSG_PENDING)
+    STRINGIFY_ENUM(MSG_NOTFOUND)
+    STRINGIFY_ENUM(MSG_FOUND)
+    STRINGIFY_ENUM(MSG_EXPECTED)
+    STRINGIFY_ENUM(MSG_EXPIRED)
+    STRINGIFY_ENUM(MSG_ERROR)
+  }
+  return "???";
+}
+
+#if NCHAN_SUBSCRIBER_LEAK_DEBUG
+
+subscriber_t *subdebug_head = NULL;
+
+void subscriber_debug_add(subscriber_t *sub) {
+  if(subdebug_head == NULL) {
+    sub->dbg_next = NULL;
+    sub->dbg_prev = NULL;
+  }
+  else {
+    sub->dbg_next = subdebug_head;
+    sub->dbg_prev = NULL;
+    assert(subdebug_head->dbg_prev == NULL);
+    subdebug_head->dbg_prev = sub;
+  }
+  if(sub->request) {
+    sub->lbl = ngx_calloc(sub->request->uri.len+1, ngx_cycle->log);
+    ngx_memcpy(sub->lbl, sub->request->uri.data, sub->request->uri.len);
+  }
+  else {
+    sub->lbl = NULL;
+  }
+  
+  subdebug_head = sub;
+}
+void subscriber_debug_remove(subscriber_t *sub) {
+  subscriber_t *prev, *next;
+  prev = sub->dbg_prev;
+  next = sub->dbg_next;
+  if(subdebug_head == sub) {
+    assert(sub->dbg_prev == NULL);
+    if(next) {
+      next->dbg_prev = NULL;
+    }
+    subdebug_head = next;
+  }
+  else {
+    if(prev) {
+      prev->dbg_next = next;
+    }
+    if(next) {
+      next->dbg_prev = prev;
+    }
+  }
+  
+  sub->dbg_next = NULL;
+  sub->dbg_prev = NULL;
+  ngx_free(sub->lbl);
+  sub->lbl = NULL;
+}
+void subscriber_debug_assert_isempty(void) {
+  if(subdebug_head != NULL) {
+    subscriber_t *cur;
+    for(cur = subdebug_head; cur != NULL; cur = cur->dbg_next) {
+      nchan_log_error("  LEFTOVER: %V sub (req. %p (pool %p) cf %p rsv: %d) lbl %s", cur->name, cur->request, cur->request ? cur->request->pool : NULL, cur->cf, cur->reserved, cur->lbl ? cur->lbl : (u_char *)"nolbl");
+    }
+    raise(SIGABRT);
+  }
+}
+#endif
diff --git a/debian/modules/nchan/src/util/nchan_debug.h b/debian/modules/nchan/src/util/nchan_debug.h
new file mode 100644
index 00000000..640870a3
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_debug.h
@@ -0,0 +1,13 @@
+#ifndef NCHAN_DEBUG_H
+#define NCHAN_DEBUG_H
+#include <nchan_module.h>
+
+char *nchan_msg_status_to_cstr(nchan_msg_status_t status);
+
+#if NCHAN_SUBSCRIBER_LEAK_DEBUG
+void subscriber_debug_add(subscriber_t *);
+void subscriber_debug_remove(subscriber_t *);
+void subscriber_debug_assert_isempty(void);
+#endif
+
+#endif //NCHAN_DEBUG_H
diff --git a/debian/modules/nchan/src/util/nchan_fake_request.c b/debian/modules/nchan/src/util/nchan_fake_request.c
index 5a36501b..62151de4 100644
--- a/debian/modules/nchan/src/util/nchan_fake_request.c
+++ b/debian/modules/nchan/src/util/nchan_fake_request.c
@@ -1,14 +1,16 @@
-#include <nchan_module.h>
 #include "nchan_fake_request.h"
-
+#include <util/nchan_subrequest.h>
+#include <assert.h>
 //fake request and connection code adapted from lua-nginx-module by agentzh
 
 static void nchan_close_fake_request(ngx_http_request_t *r);
+static void nchan_close_fake_connection(ngx_connection_t *c);
 
-ngx_connection_t *nchan_create_fake_connection(ngx_pool_t *pool) {
+static ngx_connection_t *nchan_create_fake_connection(ngx_pool_t *pool) {
   ngx_log_t               *log;
   ngx_connection_t        *c;
   ngx_connection_t        *saved_c = NULL;
+  assert(pool);
 
   /* (we temporarily use a valid fd (0) to make ngx_get_connection happy) */
   if (ngx_cycle->files) {
@@ -28,29 +30,27 @@ ngx_connection_t *nchan_create_fake_connection(ngx_pool_t *pool) {
   c->fd = (ngx_socket_t) -1;
   c->number = ngx_atomic_fetch_add(ngx_connection_counter, 1);
 
-  if (pool) {
-    c->pool = pool;
-  } 
-  else {
-    c->pool = ngx_create_pool(128, c->log);
-    if (c->pool == NULL) {
-      goto failed;
-    }
-  }
+  c->pool = pool;
 
   log = ngx_pcalloc(c->pool, sizeof(ngx_log_t));
   if (log == NULL) {
       goto failed;
   }
 
+  c->write->active = 1;
+  
   c->log = log;
   c->log->connection = c->number;
   c->log->action = NULL;
   c->log->data = NULL;
+  c->log->data = ngx_pcalloc(c->pool, sizeof(ngx_http_log_ctx_t));
+  if(c->log->data == NULL) {
+    goto failed;
+  }
 
   c->log_error = NGX_ERROR_INFO;
 
-  c->error = 1;
+  c->error = 0;
 
   return c;
 
@@ -60,7 +60,7 @@ ngx_connection_t *nchan_create_fake_connection(ngx_pool_t *pool) {
   return NULL;
 }
 
-void nchan_close_fake_connection(ngx_connection_t *c) {
+static void nchan_close_fake_connection(ngx_connection_t *c) {
   ngx_pool_t          *pool;
   ngx_connection_t    *saved_c = NULL;
 
@@ -80,6 +80,7 @@ void nchan_close_fake_connection(ngx_connection_t *c) {
   }
 
   c->read->closed = 1;
+  c->write->active = 0;
   c->write->closed = 1;
 
   /* we temporarily use a valid fd (0) to make ngx_free_connection happy */
@@ -103,19 +104,25 @@ void nchan_close_fake_connection(ngx_connection_t *c) {
   }
 }
 
-ngx_http_request_t *nchan_create_fake_request(ngx_connection_t *c) {
-  ngx_http_request_t      *r;
-
-  r = ngx_pcalloc(c->pool, sizeof(ngx_http_request_t));
+static ngx_http_request_t *nchan_new_fake_request(ngx_connection_t *c) {
+  ngx_http_request_t *r = ngx_palloc(c->pool, sizeof(ngx_http_request_t));
+  assert(c->data == NULL);
   if (r == NULL) {
     return NULL;
   }
 
   c->requests++;
 
+  c->data = r;
+  return r;
+}
+/*
+static ngx_int_t nchan_initialize_fake_request(ngx_http_request_t *r, ngx_connection_t *c) {
+  ngx_memzero(r, sizeof(*r));
   r->pool = c->pool;
-
-#if 0
+  assert(c->data == r);
+  
+  #if 0
   hc = ngx_pcalloc(c->pool, sizeof(ngx_http_connection_t));
   if (hc == NULL) {
       goto failed;
@@ -139,9 +146,9 @@ ngx_http_request_t *nchan_create_fake_request(ngx_connection_t *c) {
   }
 #endif
 
-  r->ctx = ngx_pcalloc(r->pool, sizeof(void *) * ngx_http_max_module);
+  r->ctx = ngx_pcalloc(c->pool, sizeof(void *) * ngx_http_max_module);
   if (r->ctx == NULL) {
-      return NULL;
+      return NGX_ERROR;
   }
 
 #if 0
@@ -153,7 +160,7 @@ ngx_http_request_t *nchan_create_fake_request(ngx_connection_t *c) {
       goto failed;
   }
 #endif
-
+  
   r->connection = c;
 
   r->headers_in.content_length_n = 0;
@@ -174,8 +181,32 @@ ngx_http_request_t *nchan_create_fake_request(ngx_connection_t *c) {
 
   r->http_state = NGX_HTTP_PROCESS_REQUEST_STATE;
   r->discard_body = 1;
+  return NGX_OK;
+}
+*/
+void empty_handler(ngx_http_request_t *r) {
+  //do nothing
+}
 
-  return r;
+ngx_http_request_t *nchan_create_derivative_fake_request(ngx_connection_t *c, ngx_http_request_t *rsrc) {
+  ngx_http_request_t      *fr = nchan_new_fake_request(c);
+  if(fr == NULL) {
+    return NULL;
+  }
+  
+  *fr = *rsrc;
+  fr->read_event_handler = empty_handler;
+  fr->write_event_handler = empty_handler;
+  fr->connection = c;
+  fr->main = fr;
+  fr->pool = c->pool;
+  fr->parent = NULL;
+  fr->cleanup = NULL;
+  fr->http_state = NGX_HTTP_PROCESS_REQUEST_STATE;
+  fr->signature = NGX_HTTP_MODULE;
+  fr->count = 1;
+  
+  return fr;
 }
 
 void nchan_finalize_fake_request(ngx_http_request_t *r, ngx_int_t rc) {
@@ -275,3 +306,215 @@ void nchan_free_fake_request(ngx_http_request_t *r) {
 
   r->connection->destroyed = 1;
 }
+
+
+
+ngx_int_t nchan_requestmachine_initialize(nchan_requestmachine_t *rm, ngx_http_request_t *template_request) {
+  rm->template_request = template_request;
+  nchan_slist_init(&rm->request_queue, nchan_fakereq_subrequest_data_t, slist.prev, slist.next);
+  return NGX_OK;
+}
+
+static ngx_int_t nchan_requestmachine_run(nchan_requestmachine_t *rm) {
+  nchan_fakereq_subrequest_data_t *head = nchan_slist_first(&rm->request_queue);
+  if(head && !head->running) {
+    head->running = 1;
+    ngx_http_run_posted_requests(head->r->connection);
+  }
+  return NGX_OK;
+}
+
+static ngx_int_t nchan_requestmachine_subrequest_handler(ngx_http_request_t *sr, void *pd, ngx_int_t code) {
+  nchan_fakereq_subrequest_data_t *d = pd;
+  d->running = 0;
+  if(d->rm) {
+    assert(d->rm->request_queue.head == d);
+    if(d->cb) {
+      d->cb(code, sr, d->pd);
+    }
+    if(d->rm) {
+      nchan_slist_remove(&d->rm->request_queue, d);
+      nchan_requestmachine_run(d->rm);
+    }
+  }
+  else if(d->cb) {
+    d->cb(NGX_ABORT, sr, d->pd);
+  }
+  if(!d->manual_cleanup && !d->cleanup_timer.timer_set) {
+    ngx_add_timer(&d->cleanup_timer, 0);
+  }
+  return NGX_OK;
+}
+
+ngx_int_t nchan_requestmachine_request_cleanup_manual(nchan_fakereq_subrequest_data_t *d) {
+  if(!d->cleanup_timer.timer_set) {
+    ngx_add_timer(&d->cleanup_timer, 0);
+  }
+  return NGX_OK;
+}
+
+static void nchan_requestmachine_request_cleanup_on_request_finalize_cln_handler(void *d) {
+  nchan_requestmachine_request_cleanup_manual(d);
+}
+
+ngx_int_t nchan_requestmachine_request_cleanup_on_request_finalize(nchan_fakereq_subrequest_data_t *d, ngx_http_request_t *r) {
+  ngx_http_cleanup_t     *cln = ngx_http_cleanup_add(r, 0);
+  if(cln == NULL) {
+    return NGX_ERROR;
+  }
+  cln->data = d;
+  cln->handler = nchan_requestmachine_request_cleanup_on_request_finalize_cln_handler;
+  return NGX_OK;
+}
+
+static void fakerequest_cleanup_timer_handler(ngx_event_t *ev) {
+  nchan_fakereq_subrequest_data_t *d = ev->data;
+  d->r->main->count--;
+  assert(d->r->main->count == 1);
+  nchan_finalize_fake_request(d->r, NGX_OK);
+}
+
+nchan_fakereq_subrequest_data_t *nchan_requestmachine_request(nchan_requestmachine_t *rm, nchan_requestmachine_request_params_t *params) {
+  nchan_fakereq_subrequest_data_t *d;
+  ngx_pool_t *pool = params->pool;
+  int         created_pool = 0;
+  ngx_str_t url;
+  
+  if(!pool) {
+    if((pool = ngx_create_pool(1024, ngx_cycle->log)) == NULL) {
+      nchan_log_error("failed to create requestmachine pool");
+      return NULL;
+    }
+    created_pool = 1;
+  }
+  
+  if(params->url_complex) {
+    if(ngx_http_complex_value_custom_pool(rm->template_request, params->url.cv, &url, pool) != NGX_OK) {
+      if(created_pool) {
+        ngx_destroy_pool(pool);
+      }
+      nchan_log_error("failed to create subrequest url");
+      return NULL;
+    }
+    params->url.str = &url;
+  }
+  
+  ngx_connection_t            *fc = nchan_create_fake_connection(pool);
+  if(fc == NULL) {
+    if(created_pool) {
+      ngx_destroy_pool(pool);
+    }
+    return NULL;
+  }
+  ngx_http_request_t          *fr = nchan_create_derivative_fake_request(fc, rm->template_request);
+  ngx_http_request_t          *sr;
+  
+  d = ngx_palloc(pool, sizeof(*d));
+  ngx_http_post_subrequest_t  *psr = ngx_pcalloc(pool, sizeof(*psr));
+  if(fr == NULL || d == NULL || psr == NULL) {
+    if(created_pool) {
+      ngx_destroy_pool(pool);
+    }
+    return NULL;
+  }
+  
+  fr->main_conf = rm->template_request->main_conf;
+  fr->srv_conf = rm->template_request->srv_conf;
+  fr->loc_conf = rm->template_request->loc_conf;
+  
+  d->pd = params->pd;
+  d->cb = params->cb;
+  d->running = 0;
+  d->r = fr;
+  d->rm = rm;
+  d->manual_cleanup = params->manual_cleanup;
+  ngx_memzero(&d->cleanup_timer, sizeof(d->cleanup_timer));
+  nchan_init_timer(&d->cleanup_timer, fakerequest_cleanup_timer_handler, d);
+  
+  fr->main->count++; //make sure the fake request doesn't auto-finalize on subrequest completion
+  
+  psr->handler = nchan_requestmachine_subrequest_handler;
+  psr->data = d;
+  
+  ngx_http_subrequest(fr, params->url.str, NULL, &sr, psr, NGX_HTTP_SUBREQUEST_IN_MEMORY);
+  if(sr == NULL) {
+    if(created_pool) {
+      ngx_destroy_pool(pool);
+    }
+    return NULL;
+  }
+  d->sr = sr;
+  
+  if((sr->request_body = ngx_pcalloc(pool, sizeof(*sr->request_body))) == NULL) { //dummy request body 
+    if(created_pool) {
+      ngx_destroy_pool(pool);
+    }
+    return NULL;
+  }
+  
+  if(params->body && ngx_buf_size(params->body) > 0) {
+    static ngx_str_t                   POST_REQUEST_STRING = {4, (u_char *)"POST "};
+    size_t                             sz = ngx_buf_size(params->body);;
+    ngx_http_request_body_t           *sr_body = sr->request_body;
+    ngx_chain_t                       *fakebody_chain;
+    ngx_buf_t                         *fakebody_buf;
+    
+    fakebody_chain = ngx_palloc(pool, sizeof(*fakebody_chain));
+    fakebody_buf = ngx_pcalloc(pool, sizeof(*fakebody_buf));
+    sr_body->bufs = fakebody_chain;
+    fakebody_chain->next = NULL;
+    fakebody_chain->buf = fakebody_buf;
+    *fakebody_buf = *params->body;
+    fakebody_buf->last_buf = 1;
+    fakebody_buf->last_in_chain = 1;
+    fakebody_buf->flush = 1;
+    fakebody_buf->memory = 1;
+    
+    nchan_adjust_subrequest(sr, NGX_HTTP_POST, &POST_REQUEST_STRING, sr_body, sz);
+  }
+  else {
+    nchan_set_content_length_header(sr, 0);
+  }
+  
+  sr->header_only = params->response_headers_only;
+  
+  sr->args = fr->args;
+  
+  nchan_slist_append(&rm->request_queue, d);
+  
+  nchan_requestmachine_run(rm);
+  return d;
+}
+ngx_int_t nchan_requestmachine_shutdown(nchan_requestmachine_t *rm) {
+  return nchan_requestmachine_abort(rm);
+}
+
+ngx_int_t nchan_requestmachine_abort(nchan_requestmachine_t *rm) {
+  nchan_fakereq_subrequest_data_t *cur;
+  ngx_http_request_t              *r;
+  ngx_http_core_main_conf_t       *cmcf;
+  while((cur = nchan_slist_pop(&rm->request_queue)) != NULL) {
+    cur->rm = NULL; //no requestmachine ref means the machine stopped.
+    r = cur->r;
+    //clear stuff that might be used after the upstream request finishes
+    /*
+    if (ngx_list_init(&r->headers_out.headers, r->pool, 0, sizeof(ngx_table_elt_t)) != NGX_OK) {
+      nchan_log_error("couldn't create headers_out for requestmachine request");
+    }
+    if (ngx_list_init(&r->headers_in.headers, r->pool, 0,sizeof(ngx_table_elt_t)) != NGX_OK) {
+      nchan_log_error("couldn't create headers_in for requestmachine request");
+    }
+    */
+
+    r->ctx = ngx_pcalloc(r->pool, sizeof(void *) * ngx_http_max_module);
+    if (r->ctx == NULL) {
+      nchan_log_error("couldn't create ctx for requestmachine request");
+    }
+    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);
+    r->variables = ngx_pcalloc(r->pool, cmcf->variables.nelts * sizeof(ngx_http_variable_value_t));
+    if (r->variables == NULL) {
+      nchan_log_error("couldn't create vars for requestmachine request");
+    }
+  }
+  return NGX_OK;
+}
diff --git a/debian/modules/nchan/src/util/nchan_fake_request.h b/debian/modules/nchan/src/util/nchan_fake_request.h
index 2097aaad..eab1de9b 100644
--- a/debian/modules/nchan/src/util/nchan_fake_request.h
+++ b/debian/modules/nchan/src/util/nchan_fake_request.h
@@ -1,6 +1,58 @@
+#ifndef NCHAN_FAKE_REQUEST_H
+#define NCHAN_FAKE_REQUEST_H
 
-ngx_connection_t *nchan_create_fake_connection(ngx_pool_t *pool);
-void nchan_close_fake_connection(ngx_connection_t *c);
-ngx_http_request_t *nchan_create_fake_request(ngx_connection_t *c);
+#include <nchan_module.h>
+#include <util/nchan_slist.h>
+
+ngx_http_request_t *nchan_create_derivative_fake_request(ngx_connection_t *c, ngx_http_request_t *rsrc);
 void nchan_finalize_fake_request(ngx_http_request_t *r, ngx_int_t rc);
 void nchan_free_fake_request(ngx_http_request_t *r);
+
+typedef struct nchan_fakereq_subrequest_data_s nchan_fakereq_subrequest_data_t;
+typedef struct nchan_requestmachine_s nchan_requestmachine_t;
+
+struct nchan_fakereq_subrequest_data_s {
+  ngx_http_request_t *r;
+  ngx_http_request_t *sr;
+  void          *pd;
+  callback_pt    cb;
+  nchan_requestmachine_t *rm;
+  ngx_event_t    cleanup_timer;
+  unsigned       manual_cleanup:1;
+  unsigned       running:1;
+  unsigned       aborted:1;
+  struct {
+    nchan_fakereq_subrequest_data_t *prev;
+    nchan_fakereq_subrequest_data_t *next;
+  }              slist;
+};// nchan_fakereq_subrequest_data_t
+
+struct nchan_requestmachine_s {
+  ngx_http_request_t *template_request;
+  nchan_slist_t       request_queue;
+  unsigned            shutdown_when_finished;
+};// nchan_requestmachine_t;
+
+typedef struct {
+  union {
+    ngx_str_t                 *str;
+    ngx_http_complex_value_t  *cv;
+  }                          url;
+  ngx_pool_t                *pool;
+  ngx_buf_t                 *body;
+  
+  callback_pt                cb;
+  void                      *pd;
+  unsigned                   manual_cleanup:1;
+  unsigned                   response_headers_only:1;
+  unsigned                   url_complex:1;
+} nchan_requestmachine_request_params_t;
+
+ngx_int_t nchan_requestmachine_initialize(nchan_requestmachine_t *rm, ngx_http_request_t *template_request);
+nchan_fakereq_subrequest_data_t *nchan_requestmachine_request(nchan_requestmachine_t *rm, nchan_requestmachine_request_params_t *params);
+ngx_int_t nchan_requestmachine_request_cleanup_manual(nchan_fakereq_subrequest_data_t *d);
+ngx_int_t nchan_requestmachine_request_cleanup_on_request_finalize(nchan_fakereq_subrequest_data_t *d, ngx_http_request_t *r);
+ngx_int_t nchan_requestmachine_abort(nchan_requestmachine_t *rm);
+ngx_int_t nchan_requestmachine_shutdown(nchan_requestmachine_t *rm);
+
+#endif //NCHAN_FAKE_REQUEST_H
diff --git a/debian/modules/nchan/src/util/nchan_list.c b/debian/modules/nchan/src/util/nchan_list.c
index cfe9e7b0..8368b30d 100644
--- a/debian/modules/nchan/src/util/nchan_list.c
+++ b/debian/modules/nchan/src/util/nchan_list.c
@@ -34,6 +34,32 @@ void *nchan_list_append(nchan_list_t *list) {
  return nchan_list_append_sized(list, list->data_sz);
 }
 
+void *nchan_list_first(nchan_list_t *list) {
+  if(list->head) {
+    return nchan_list_data_from_el(list->head);
+  }
+  else {
+    return NULL;
+  }
+}
+void *nchan_list_last(nchan_list_t *list) {
+  if(list->tail) {
+    return nchan_list_data_from_el(list->tail);
+  }
+  else {
+    return NULL;
+  }
+}
+
+void *nchan_list_prev(void *data) {
+  nchan_list_el_t  *el = nchan_list_el_from_data(data)->prev;
+  return el == NULL ? NULL : nchan_list_data_from_el(el);
+}
+void *nchan_list_next(void *data) {
+  nchan_list_el_t  *el = nchan_list_el_from_data(data)->next;
+  return el == NULL ? NULL : nchan_list_data_from_el(el);
+}
+
 void *nchan_list_append_sized(nchan_list_t *list, size_t sz) {
   nchan_list_el_t  *el, *tail = list->tail;
   if(list->pool_sz > 0) {
diff --git a/debian/modules/nchan/src/util/nchan_list.h b/debian/modules/nchan/src/util/nchan_list.h
index d9728a60..4b590ab4 100644
--- a/debian/modules/nchan/src/util/nchan_list.h
+++ b/debian/modules/nchan/src/util/nchan_list.h
@@ -32,6 +32,11 @@ ngx_pool_t *nchan_list_get_pool(nchan_list_t *list);
 void *nchan_list_append(nchan_list_t *list);
 void *nchan_list_prepend(nchan_list_t *list);
 
+void *nchan_list_first(nchan_list_t *list);
+void *nchan_list_last(nchan_list_t *list);
+void *nchan_list_prev(void *data);
+void *nchan_list_next(void *data);
+
 void *nchan_list_prepend_sized(nchan_list_t *list, size_t sz);
 void *nchan_list_append_sized(nchan_list_t *list, size_t sz);
 
diff --git a/debian/modules/nchan/src/util/nchan_msgid.c b/debian/modules/nchan/src/util/nchan_msg.c
similarity index 65%
rename from debian/modules/nchan/src/util/nchan_msgid.c
rename to debian/modules/nchan/src/util/nchan_msg.c
index 8d501ca9..c1fe850d 100644
--- a/debian/modules/nchan/src/util/nchan_msgid.c
+++ b/debian/modules/nchan/src/util/nchan_msg.c
@@ -1,7 +1,175 @@
 #include <nchan_module.h>
 #include <assert.h>
+#include <store/memory/store.h>
+#include <util/shmem.h>
 
-#define ERR(fmt, args...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "NCHAN MSG_ID:" fmt, ##args)
+#define ERR(fmt, args...) ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "NCHAN MSG:" fmt, ##args)
+
+#define MSG_REFCOUNT_INVALID -9000
+
+#if NCHAN_MSG_RESERVE_DEBUG  
+static void nchan_msg_reserve_debug(nchan_msg_t *msg, char *lbl) {
+  msg_rsv_dbg_t     *rsv;
+  int shared = msg->storage == NCHAN_MSG_SHARED;
+  
+  if(shared) 
+    shmtx_lock(nchan_store_memory_shmem);  
+  
+  if(shared) 
+    rsv=shm_locked_calloc(nchan_store_memory_shmem, sizeof(*rsv) + ngx_strlen(lbl) + 1, "msgdebug");
+  else
+    rsv=ngx_calloc(sizeof(*rsv) + ngx_strlen(lbl) + 1, ngx_cycle->log);
+    
+  rsv->lbl = (char *)(&rsv[1]);
+  ngx_memcpy(rsv->lbl, lbl, ngx_strlen(lbl));
+  if(msg->rsv == NULL) {
+    msg->rsv = rsv;
+    rsv->prev = NULL;
+    rsv->next = NULL;
+  }
+  else {
+    msg->rsv->prev = rsv;
+    rsv->next = msg->rsv;
+    rsv->prev = NULL;
+    msg->rsv = rsv;
+  }
+  
+  if(shared)
+    shmtx_unlock(nchan_store_memory_shmem);
+}
+
+static void nchan_msg_release_debug(nchan_msg_t *msg, char *lbl) {
+  msg_rsv_dbg_t     *cur, *prev, *next;
+  size_t             sz = ngx_strlen(lbl);
+  ngx_int_t          rsv_found=0;
+  int shared = msg->storage == NCHAN_MSG_SHARED;
+  
+  if(shared)
+    shmtx_lock(nchan_store_memory_shmem);
+  
+  assert(msg->refcount > 0);
+  for(cur = msg->rsv; cur != NULL; cur = cur->next) {
+    if(ngx_memcmp(lbl, cur->lbl, sz) == 0) {
+      prev = cur->prev;
+      next = cur->next;
+      if(prev) {
+        prev->next = next;
+      }
+      if(next) {
+        next->prev = prev;
+      }
+      if(cur == msg->rsv) {
+        msg->rsv = next;
+      }
+      
+      if(shared)
+        shm_locked_free(nchan_store_memory_shmem, cur);
+      else
+        ngx_free(cur);
+      
+      rsv_found = 1;
+      break;
+    }
+  }
+  assert(rsv_found);
+  if(shared)
+    shmtx_unlock(nchan_store_memory_shmem);
+}
+#endif
+
+int msg_refcount_valid(nchan_msg_t *msg) {
+  return msg->refcount >= 0;
+}
+
+int msg_refcount_invalidate_if_zero(nchan_msg_t *msg) {
+  return ngx_atomic_cmp_set((ngx_atomic_uint_t *)&msg->refcount, 0, MSG_REFCOUNT_INVALID);
+}
+void msg_refcount_invalidate(nchan_msg_t *msg) {
+  msg->refcount = MSG_REFCOUNT_INVALID;
+}
+
+
+ngx_int_t msg_reserve(nchan_msg_t *msg, char *lbl) {
+  if(msg->parent) {
+    assert(msg->storage != NCHAN_MSG_SHARED);
+    msg->refcount++;
+#if NCHAN_MSG_RESERVE_DEBUG
+    nchan_msg_reserve_debug(msg, lbl);
+#endif
+    return msg_reserve(msg->parent, lbl);
+  }
+  assert(!msg->parent);
+  
+  ngx_atomic_fetch_add((ngx_atomic_uint_t *)&msg->refcount, 1);
+  assert(msg->refcount >= 0);
+  if(msg->refcount < 0) {
+    msg->refcount = MSG_REFCOUNT_INVALID;
+    return NGX_ERROR;
+  }
+#if NCHAN_MSG_RESERVE_DEBUG  
+  nchan_msg_reserve_debug(msg, lbl);
+#endif
+
+  //DBG("msg %p reserved (%i) %s", msg, msg->refcount, lbl);
+  return NGX_OK;
+}
+
+ngx_int_t msg_release(nchan_msg_t *msg, char *lbl) {
+  nchan_msg_t    *parent = msg->parent;
+  if(parent) {
+    assert(msg->storage != NCHAN_MSG_SHARED);
+#if NCHAN_MSG_RESERVE_DEBUG
+    nchan_msg_release_debug(msg, lbl);
+#endif
+    msg->refcount--;
+    assert(msg->refcount >= 0);
+    
+    if(msg->refcount == 0) {
+      switch(msg->storage) {
+        case NCHAN_MSG_POOL:
+          //free the id, the rest of the msg will be cleaned with the pool
+          nchan_free_msg_id(&msg->id);
+          break;
+          
+        case NCHAN_MSG_HEAP:
+          nchan_free_msg_id(&msg->id);
+          ngx_free(msg);
+          break;
+          
+        default:
+          break;
+          //do nothing for NCHAN_MSG_STACK. NCHAN_MSG_SHARED should never be seen here.
+      }
+    }
+    return msg_release(parent, lbl);
+  }
+  assert(!parent);
+  
+#if NCHAN_MSG_RESERVE_DEBUG
+  nchan_msg_release_debug(msg, lbl);
+#endif
+  assert(msg->refcount > 0);
+  ngx_atomic_fetch_add((ngx_atomic_uint_t *)&msg->refcount, -1);
+  //DBG("msg %p released (%i) %s", msg, msg->refcount, lbl);
+  return NGX_OK;
+}
+
+
+int nchan_msgid_tagcount_match(nchan_msg_id_t *id, int count) {
+  switch(id->time) {
+    case NCHAN_OLDEST_MSGID_TIME:
+    case NCHAN_NEWEST_MSGID_TIME:
+    case NCHAN_NTH_MSGID_TIME:
+      if(id->tagcount == 1 && id->tagactive == 0)
+        return 1;
+      break;
+    default:
+      if(id->tagcount == count && id->tagactive >= 0 && id->tagactive < count)
+        return 1;
+      break;
+  }
+  return 0;
+}
 
 void nchan_expand_msg_id_multi_tag(nchan_msg_id_t *id, uint8_t in_n, uint8_t out_n, int16_t fill) {
   int16_t v, n = id->tagcount;
@@ -237,8 +405,11 @@ static ngx_int_t nchan_parse_msg_tag(u_char *first, u_char *last, nchan_msg_id_t
   int8_t            sign = 1;
   int16_t           val = 0;
   static int16_t    tags[NCHAN_MULTITAG_MAX];
+  int brace_open_total = 0;
+  int brace_close_total = 0;
+  int tagactive = NGX_ERROR;
   
-  while(cur <= last && i < NCHAN_MULTITAG_MAX) {
+  while(first != NULL && last != NULL && cur <= last && i < NCHAN_MULTITAG_MAX) {
     if(cur == last) {
       tags[i]=(val == 0 && sign == -1) ? -1 : val * sign; //shorthand "-" for "-1";
       i++;
@@ -253,7 +424,15 @@ static ngx_int_t nchan_parse_msg_tag(u_char *first, u_char *last, nchan_msg_id_t
       val = 10 * val + (c - '0');
     }
     else if (c == '[') {
-      mid->tagactive = i;
+      if(++brace_open_total > 1) {
+        return NGX_ERROR;
+      }
+      tagactive = i;
+    }
+    else if (c == ']') {
+      if(++brace_close_total > 1 || brace_open_total - brace_close_total != 0) {
+        return NGX_ERROR;
+      }
     }
     else if (c == ',') {
       tags[i]=(val == 0 && sign == -1) ? -1 : val * sign; //shorthand "-" for "-1"
@@ -263,9 +442,30 @@ static ngx_int_t nchan_parse_msg_tag(u_char *first, u_char *last, nchan_msg_id_t
     }
     cur++;
   }
-  if(expected_tag_count > i) {
-    return NGX_ERROR;
+  
+  if (i == 0) {
+    mid->tagactive = -1; // No tags, so no active tag
+  }
+  if(tagactive == NGX_ERROR) {
+    if(i==1) {
+      //single message tag, so it's active by defaiult
+      mid->tagactive = 0;
+    }
+    else {
+      //got a multitag with no tag braced as [active]. That's invalid.
+      return NGX_ERROR;
+    }
   }
+  else {
+    mid->tagactive = tagactive;
+  }
+  
+  // We fill the rest of the tag needed with value '-1'
+  while (i < expected_tag_count) {
+    tags[i] = -1;
+    i++;
+  }
+  
   mid->tagcount = i;
   
   if(i <= NCHAN_FIXED_MULTITAG_MAX) {
@@ -296,7 +496,7 @@ ngx_int_t nchan_extract_from_multi_msgid(nchan_msg_id_t *src, uint16_t n, nchan_
     return NGX_OK; 
   }
   
-  if(n > count) {
+  if(n >= count) {
     ERR("can't extract msgid %i from multi-msg of count %i", n, count);
     return NGX_ERROR;
   }
@@ -342,6 +542,7 @@ static ngx_str_t *nchan_subscriber_get_etag(ngx_http_request_t * r) {
 }
 
 ngx_int_t nchan_parse_compound_msgid(nchan_msg_id_t *id, ngx_str_t *str, ngx_int_t expected_tag_count) {
+  //parse url-unescaped compound msgid
   u_char       *split, *last;
   ngx_int_t     time;
   uint8_t       len;
@@ -350,10 +551,6 @@ ngx_int_t nchan_parse_compound_msgid(nchan_msg_id_t *id, ngx_str_t *str, ngx_int
   if((split = ngx_strlchr(str->data, last, ':')) != NULL) {
     len = 1;
   }
-  else if( (str->len > 3 && (split = ngx_strnstr(str->data, "%3A", str->len)) != NULL)
-        || (str->len > 3 && (split = ngx_strnstr(str->data, "%3a", str->len)) != NULL)) {
-    len = 3;
-  }
   else {
     len = 0; //placate dumb GCC warning
   }
@@ -373,11 +570,27 @@ ngx_int_t nchan_parse_compound_msgid(nchan_msg_id_t *id, ngx_str_t *str, ngx_int
 
 
 
-nchan_msg_id_t *nchan_subscriber_get_msg_id(ngx_http_request_t *r) {
-  static nchan_msg_id_t           id = NCHAN_ZERO_MSGID;
+static ngx_int_t set_default_id(nchan_loc_conf_t *cf, nchan_msg_id_t *id) {
   static nchan_msg_id_t           nth_msg_id = NCHAN_NTH_MSGID;
   static nchan_msg_id_t           oldest_msg_id = NCHAN_OLDEST_MSGID;
   static nchan_msg_id_t           newest_msg_id = NCHAN_NEWEST_MSGID;
+  switch(cf->subscriber_first_message) {
+    case 1:
+      *id = oldest_msg_id;
+      break;
+    case 0: 
+      *id = newest_msg_id;
+      break;
+    default:
+      *id = nth_msg_id;
+      id->tag.fixed[0] = cf->subscriber_first_message;
+      break;
+  }
+  return NGX_OK;
+}
+
+nchan_msg_id_t *nchan_subscriber_get_msg_id(ngx_http_request_t *r) {
+  static nchan_msg_id_t           id = NCHAN_ZERO_MSGID;
   
   ngx_str_t                      *if_none_match;
   nchan_loc_conf_t               *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
@@ -390,15 +603,21 @@ nchan_msg_id_t *nchan_subscriber_get_msg_id(ngx_http_request_t *r) {
   if(!cf->msg_in_etag_only && r->headers_in.if_modified_since != NULL) {
     id.time=ngx_http_parse_time(r->headers_in.if_modified_since->value.data, r->headers_in.if_modified_since->value.len);
     
-    if(if_none_match==NULL) {
-      id.tagcount=1;
-      id.tagactive=0;
+    if(id.time <= 0) { //anything before 1-1-1970 is reserved and treated as no msgid provided
+      set_default_id(cf, &id);
+      return &id;
     }
-    else {
-      if(nchan_parse_msg_tag(if_none_match->data, if_none_match->data + if_none_match->len, &id, ctx->channel_id_count) == NGX_ERROR) {
-        return NULL;
-      }
+
+    u_char *first = NULL, *last = NULL;
+    if(if_none_match != NULL) {
+      first = if_none_match->data;
+      last = if_none_match->data + if_none_match->len;
+    }
+
+    if(nchan_parse_msg_tag(first, last, &id, ctx->channel_id_count) == NGX_ERROR) {
+      return NULL;
     }
+
     return &id;
   }
   else if((cf->msg_in_etag_only || r->headers_in.if_modified_since == NULL) && if_none_match) {
@@ -423,7 +642,7 @@ nchan_msg_id_t *nchan_subscriber_get_msg_id(ngx_http_request_t *r) {
     for(i=0; i < n; i++) {
       rc = ngx_http_complex_value_noalloc(r, alt_msgid_cv_arr->cv[i], &str, 128);
       if(str.len > 0 && rc == NGX_OK) {
-        rc2 = nchan_parse_compound_msgid(&id, &str, ctx->channel_id_count);
+        rc2 = nchan_parse_compound_msgid(&id, nchan_urldecode_str(r, &str), ctx->channel_id_count);
         if(rc2 == NGX_OK) {
           return &id;
         }
@@ -434,19 +653,7 @@ nchan_msg_id_t *nchan_subscriber_get_msg_id(ngx_http_request_t *r) {
     }
   }
   
-  //eh, we didn't find a valid alt_msgid value from variables. use the defaults
-  switch(cf->subscriber_first_message) {
-    case 1:
-      id = oldest_msg_id;
-      break;
-    case 0: 
-      id = newest_msg_id;
-      break;
-    default:
-      id = nth_msg_id;
-      id.tag.fixed[0] = cf->subscriber_first_message;
-      break;
-  }
+  set_default_id(cf, &id);
   return &id;
 }
 
@@ -513,3 +720,54 @@ int8_t nchan_compare_msgids(nchan_msg_id_t *id1, nchan_msg_id_t *id2) {
     }
   }
 }
+
+
+static nchan_msg_t *get_shared_msg(nchan_msg_t *msg) {
+  if(msg->storage == NCHAN_MSG_SHARED) {
+    assert(msg->parent == NULL);
+    return msg;
+  }
+  else {
+    assert(msg->parent);
+    assert(msg->parent->storage == NCHAN_MSG_SHARED);
+    return msg->parent;
+  }
+}
+
+static ngx_inline nchan_msg_t *msg_derive_init(nchan_msg_t *parent, nchan_msg_t *msg, nchan_msg_storage_t storage_type) {
+  nchan_msg_t    *shared = get_shared_msg(parent);
+  if(!msg) { return NULL; }
+  *msg = *shared;
+  msg->id.tagcount=1;
+  msg->parent = shared;
+  msg->storage = storage_type;
+#if NCHAN_MSG_RESERVE_DEBUG
+  msg->rsv = NULL;
+#endif
+  msg->refcount = 0;
+  return msg;
+}
+
+nchan_msg_t *nchan_msg_derive_alloc(nchan_msg_t *parent) {
+  nchan_msg_t *msg = msg_derive_init(parent, ngx_alloc(sizeof(nchan_msg_t), ngx_cycle->log), NCHAN_MSG_HEAP);
+  if(!msg || nchan_copy_new_msg_id(&msg->id, &parent->id) != NGX_OK) {
+    ngx_free(msg);
+    return NULL;
+  }
+  return msg;
+}
+nchan_msg_t *nchan_msg_derive_palloc(nchan_msg_t *parent, ngx_pool_t *pool) {
+  nchan_msg_t *msg = msg_derive_init(parent, ngx_palloc(pool, sizeof(nchan_msg_t)), NCHAN_MSG_POOL);
+  if(!msg || nchan_copy_new_msg_id(&msg->id, &parent->id) != NGX_OK) {
+    return NULL;
+  }
+  return msg;
+}
+nchan_msg_t *nchan_msg_derive_stack(nchan_msg_t *parent, nchan_msg_t *child, int16_t *largetags) {
+  nchan_msg_t *msg = msg_derive_init(parent, child, NCHAN_MSG_STACK);
+  if(!msg || nchan_copy_msg_id(&msg->id, &parent->id, largetags) != NGX_OK) {
+    return NULL;
+  }
+  return msg;
+}
+
diff --git a/debian/modules/nchan/src/util/nchan_msgid.h b/debian/modules/nchan/src/util/nchan_msg.h
similarity index 63%
rename from debian/modules/nchan/src/util/nchan_msgid.h
rename to debian/modules/nchan/src/util/nchan_msg.h
index ceeb129c..99d35d82 100644
--- a/debian/modules/nchan/src/util/nchan_msgid.h
+++ b/debian/modules/nchan/src/util/nchan_msg.h
@@ -1,3 +1,11 @@
+#ifndef NCHAN_MSG_H
+#define NCHAN_MSG_H
+ngx_int_t msg_reserve(nchan_msg_t *msg, char *lbl);
+ngx_int_t msg_release(nchan_msg_t *msg, char *lbl);
+int msg_refcount_valid(nchan_msg_t *msg);
+int msg_refcount_invalidate_if_zero(nchan_msg_t *msg);
+void msg_refcount_invalidate(nchan_msg_t *msg);
+
 void nchan_expand_msg_id_multi_tag(nchan_msg_id_t *id, uint8_t in_n, uint8_t out_n, int16_t fill);
 ngx_int_t nchan_copy_msg_id(nchan_msg_id_t *dst, nchan_msg_id_t *src, int16_t *largetags);
 ngx_int_t nchan_copy_new_msg_id(nchan_msg_id_t *dst, nchan_msg_id_t *src);
@@ -12,5 +20,16 @@ ngx_int_t nchan_extract_from_multi_msgid(nchan_msg_id_t *src, uint16_t n, nchan_
 int8_t nchan_compare_msgid_tags(nchan_msg_id_t *id1, nchan_msg_id_t *id2);
 int8_t nchan_compare_msgids(nchan_msg_id_t *id1, nchan_msg_id_t *id2);
 
+int nchan_msgid_tagcount_match(nchan_msg_id_t *id, int count);
+
 void nchan_expand_tiny_msgid(nchan_msg_tiny_id_t *tinyid, nchan_msg_id_t *id);
 void nchan_shrink_normal_msgid(nchan_msg_id_t *id, nchan_msg_tiny_id_t *tinyid);
+
+
+nchan_msg_t *nchan_msg_derive_alloc(nchan_msg_t *parent);
+nchan_msg_t *nchan_msg_derive_palloc(nchan_msg_t *parent, ngx_pool_t *pool);
+nchan_msg_t *nchan_msg_derive_stack(nchan_msg_t *parent, nchan_msg_t *child, int16_t *largetags);
+
+
+
+#endif //NCHAN_MSG_H
diff --git a/debian/modules/nchan/src/util/nchan_output.c b/debian/modules/nchan/src/util/nchan_output.c
index 31e2924d..1f620280 100644
--- a/debian/modules/nchan/src/util/nchan_output.c
+++ b/debian/modules/nchan/src/util/nchan_output.c
@@ -133,6 +133,14 @@ static void nchan_reserve_msg_cleanup(void *pd) {
 static void nchan_output_reserve_message_queue(ngx_http_request_t *r, nchan_msg_t *msg) {
   nchan_request_ctx_t  *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
   ngx_http_cleanup_t   *cln;
+  
+  if(msg->storage != NCHAN_MSG_SHARED) {
+    if((msg = nchan_msg_derive_alloc(msg)) == NULL) {
+      ERR("Coudln't alloc derived msg for output_reserve_message_queue");
+      return;
+    }
+  }
+  
   if(!ctx->reserved_msg_queue) {
     if((ctx->reserved_msg_queue = ngx_palloc(r->pool, sizeof(*ctx->reserved_msg_queue))) == NULL) {
       ERR("Coudln't palloc reserved_msg_queue");
@@ -157,7 +165,7 @@ static void nchan_output_reserve_message_queue(ngx_http_request_t *r, nchan_msg_
 
 //general request-output functions and the iraq and the asian countries and dated references and the, uh, such
 
-static void nchan_flush_pending_output(ngx_http_request_t *r) {
+void nchan_flush_pending_output(ngx_http_request_t *r) {
   int                        rc;
   ngx_event_t               *wev;
   ngx_connection_t          *c;
@@ -246,7 +254,7 @@ static ngx_int_t nchan_output_filter_generic(ngx_http_request_t *r, nchan_msg_t
   c = r->connection;
   wev = c->write;
 
-  if(ctx->bcp) {
+  if(ctx && ctx->bcp) {
     nchan_bufchain_pool_refresh_files(ctx->bcp);
   }
   
@@ -265,7 +273,9 @@ static ngx_int_t nchan_output_filter_generic(ngx_http_request_t *r, nchan_msg_t
       ngx_add_timer(wev, clcf->send_timeout);
     }
     if ((ngx_handle_write_event(wev, clcf->send_lowat)) != NGX_OK) {
-      flush_all_the_reserved_things(ctx);
+      if(ctx) {
+        flush_all_the_reserved_things(ctx);
+      }
       return NGX_ERROR;
     }
     return NGX_OK;
@@ -278,7 +288,9 @@ static ngx_int_t nchan_output_filter_generic(ngx_http_request_t *r, nchan_msg_t
   }
   
   if(r->out == NULL) {
-    flush_all_the_reserved_things(ctx);
+    if(ctx) {
+      flush_all_the_reserved_things(ctx);
+    }
   }
   
   return rc;
@@ -292,32 +304,51 @@ ngx_int_t nchan_output_msg_filter(ngx_http_request_t *r, nchan_msg_t *msg, ngx_c
 }
 
 void nchan_include_access_control_if_needed(ngx_http_request_t *r, nchan_request_ctx_t *ctx) {
+  ngx_str_t          *origin;
+  ngx_str_t          *allow_origin_val;
+  static ngx_str_t    true_string = ngx_string("true");
+  nchan_loc_conf_t   *cf;
   if(!ctx) {
     ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
   }
-  nchan_loc_conf_t       *cf;
   if(!ctx) {
     return;
   }
-  if(ctx->request_origin_header.data) {
+  
+  if((origin = nchan_get_header_value_origin(r, ctx)) != NULL) {
     cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
-    nchan_add_response_header(r, &NCHAN_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, &cf->allow_origin);
+    
+    if(cf->allow_credentials) {
+      nchan_add_response_header(r, &NCHAN_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS, &true_string);
+    }
+    allow_origin_val = nchan_get_allow_origin_value(r, cf, ctx);
+    if(allow_origin_val && allow_origin_val->len == 1 && allow_origin_val->data[0]=='*') {
+      nchan_add_response_header(r, &NCHAN_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, allow_origin_val);
+    }
+    else { //otherwise echo the origin
+      nchan_add_response_header(r, &NCHAN_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+    }
   }
 }
 
-ngx_int_t nchan_respond_status(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *status_line, ngx_int_t finalize) {
+ngx_int_t nchan_respond_status(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *status_body, ngx_int_t finalize) {
   ngx_int_t    rc = NGX_OK;
   r->headers_out.status=status_code;
   if(status_line!=NULL) {
     r->headers_out.status_line.len =status_line->len;
     r->headers_out.status_line.data=status_line->data;
   }
-  r->headers_out.content_length_n = 0;
-  r->header_only = 1;
+  if(status_body == NULL) {
+    r->headers_out.content_length_n = 0;
+    r->header_only = 1;
+  }
   
   nchan_include_access_control_if_needed(r, NULL);
   
   rc= ngx_http_send_header(r);
+  if(status_body) {
+    rc = ngx_http_output_filter(r, status_body);
+  }
   if(finalize) {
     nchan_http_finalize_request(r, rc);
   }
@@ -331,6 +362,26 @@ ngx_int_t nchan_respond_cstring(ngx_http_request_t *r, ngx_int_t status_code, co
   return nchan_respond_string(r, status_code, content_type, &str, finalize);
 }
 
+ngx_int_t nchan_respond_sprintf(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *content_type, const ngx_int_t finalize, char *fmt, ...) {
+  u_char *p;
+  ngx_str_t str;
+  va_list   args;
+    
+  str.len = 1024;
+  str.data = ngx_palloc(r->pool, 1024);
+  if(str.data == NULL) {
+    return nchan_respond_status(r, status_code, NULL, NULL, finalize);
+    return NGX_ERROR;
+  }
+
+  va_start(args, fmt);
+  p = ngx_vslprintf(str.data, str.data + str.len, fmt, args);
+  va_end(args);
+  
+  str.len = p - str.data;
+  return nchan_respond_string(r, status_code, content_type, &str, finalize);
+}
+
 ngx_int_t nchan_respond_membuf(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *content_type, ngx_buf_t *body, ngx_int_t finalize) {
   ngx_str_t str;
   str.len = ngx_buf_size(body);
@@ -355,7 +406,6 @@ size_t msgtag_to_strptr(nchan_msg_id_t *id, char *ch) {
   uint8_t   i;
   char     *cur;
   
-  assert(max < 255);
   static char* inactive="%i,";
   static char*  active="[%i],";
   if(max == 1) {
@@ -403,12 +453,13 @@ ngx_str_t *msgid_to_str(nchan_msg_id_t *id) {
 ngx_int_t nchan_set_msgid_http_response_headers(ngx_http_request_t *r, nchan_request_ctx_t *ctx, nchan_msg_id_t *msgid) {
   ngx_str_t                 *etag, *tmp_etag;
   nchan_loc_conf_t          *cf = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
-  int8_t                     output_etag = 1, cross_origin;
+  int8_t                     output_etag = 1;
+  ngx_str_t                 *origin_header;
   
   if(!ctx) {
     ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
   }
-  cross_origin = ctx && ctx->request_origin_header.data;
+  origin_header = ctx ? nchan_get_header_value_origin(r, ctx) : NULL; 
 
   if(!cf->msg_in_etag_only) {
     //last-modified
@@ -435,7 +486,7 @@ ngx_int_t nchan_set_msgid_http_response_headers(ngx_http_request_t *r, nchan_req
     if(output_etag) {
       nchan_add_response_header(r, &NCHAN_HEADER_ETAG, etag);
     }
-    if(cross_origin) {
+    if(origin_header) {
       nchan_add_response_header(r, &NCHAN_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS, &NCHAN_MSG_RESPONSE_ALLOWED_HEADERS);
     }
   }
@@ -443,7 +494,7 @@ ngx_int_t nchan_set_msgid_http_response_headers(ngx_http_request_t *r, nchan_req
     if(output_etag) {
       nchan_add_response_header(r, &cf->custom_msgtag_header, etag);
     }
-    if(cross_origin) {
+    if(origin_header) {
       u_char        *cur = ngx_palloc(r->pool, 255);
       if(cur == NULL) {
         return NGX_ERROR;
@@ -462,7 +513,7 @@ ngx_int_t nchan_set_msgid_http_response_headers(ngx_http_request_t *r, nchan_req
 }
 
 ngx_int_t nchan_respond_msg(ngx_http_request_t *r, nchan_msg_t *msg, nchan_msg_id_t *msgid, ngx_int_t finalize, char **err) {
-  ngx_buf_t                 *buffer = msg->buf;
+  ngx_buf_t                 *buffer = &msg->buf;
   nchan_buf_and_chain_t     *cb;
   ngx_int_t                  rc;
   ngx_chain_t               *rchain = NULL;
@@ -491,9 +542,8 @@ ngx_int_t nchan_respond_msg(ngx_http_request_t *r, nchan_msg_t *msg, nchan_msg_i
     r->header_only = 1;
   }
 
-  if (msg->content_type.data!=NULL) {
-    r->headers_out.content_type.len=msg->content_type.len;
-    r->headers_out.content_type.data = msg->content_type.data;
+  if (msg->content_type) {
+    r->headers_out.content_type = *msg->content_type;
   }
   
   if(msgid == NULL) {
@@ -518,6 +568,7 @@ ngx_int_t nchan_respond_msg(ngx_http_request_t *r, nchan_msg_t *msg, nchan_msg_i
   
   if(rchain) {
     rc= nchan_output_filter(r, rchain);
+    if(rc != NGX_OK && err) *err="failed to write data to connection socket, probably because the connection got closed";
   }
   
   if(finalize) {
@@ -594,17 +645,17 @@ ngx_table_elt_t * nchan_add_response_header(ngx_http_request_t *r, const ngx_str
   return h;
 }
 
-ngx_int_t nchan_OPTIONS_respond(ngx_http_request_t *r, const ngx_str_t *allow_origin, const ngx_str_t *allowed_headers, const ngx_str_t *allowed_methods) {
+ngx_int_t nchan_OPTIONS_respond(ngx_http_request_t *r, const ngx_str_t *allowed_headers, const ngx_str_t *allowed_methods) {
   nchan_request_ctx_t      *ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
   
   nchan_add_response_header(r, &NCHAN_HEADER_ALLOW, allowed_methods);
   
-  if(ctx && ctx->request_origin_header.data) {
+  if(ctx && nchan_get_header_value_origin(r, ctx)) {
     //Access-Control-Allow-Origin is included later
     nchan_add_response_header(r, &NCHAN_HEADER_ACCESS_CONTROL_ALLOW_HEADERS, allowed_headers);
     nchan_add_response_header(r, &NCHAN_HEADER_ACCESS_CONTROL_ALLOW_METHODS, allowed_methods);
   }
-  return nchan_respond_status(r, NGX_HTTP_OK, NULL, 0);
+  return nchan_respond_status(r, NGX_HTTP_OK, NULL, NULL, 0);
 }
 
 void nchan_http_finalize_request(ngx_http_request_t *r, ngx_int_t code) {
diff --git a/debian/modules/nchan/src/util/nchan_output.h b/debian/modules/nchan/src/util/nchan_output.h
index f145cfd5..d465de82 100644
--- a/debian/modules/nchan/src/util/nchan_output.h
+++ b/debian/modules/nchan/src/util/nchan_output.h
@@ -7,15 +7,17 @@ void nchan_output_shutdown(void);
 ngx_int_t nchan_output_filter(ngx_http_request_t *r, ngx_chain_t *in);
 ngx_int_t nchan_output_msg_filter(ngx_http_request_t *r, nchan_msg_t *msg, ngx_chain_t *in);
 
-ngx_int_t nchan_respond_status(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *status_line, ngx_int_t finalize);
+ngx_int_t nchan_respond_status(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *status_line, ngx_chain_t *body, ngx_int_t finalize);
 ngx_int_t nchan_respond_string(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *content_type, const ngx_str_t *body, ngx_int_t finalize);
+ngx_int_t nchan_respond_sprintf(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *content_type, const ngx_int_t finalize, char *fmt, ...);
 ngx_int_t nchan_respond_cstring(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *content_type, char *body, ngx_int_t finalize);
 ngx_int_t nchan_respond_membuf(ngx_http_request_t *r, ngx_int_t status_code, const ngx_str_t *content_type, ngx_buf_t *body, ngx_int_t finalize);
 ngx_table_elt_t * nchan_add_response_header(ngx_http_request_t *r, const ngx_str_t *header_name, const ngx_str_t *header_value);
 ngx_int_t nchan_set_msgid_http_response_headers(ngx_http_request_t *r, nchan_request_ctx_t *ctx, nchan_msg_id_t *msgid);
-ngx_int_t nchan_OPTIONS_respond(ngx_http_request_t *r, const ngx_str_t *allow_origin, const ngx_str_t *allowed_headers, const ngx_str_t *allowed_methods);
+ngx_int_t nchan_OPTIONS_respond(ngx_http_request_t *r, const ngx_str_t *allowed_headers, const ngx_str_t *allowed_methods);
 ngx_int_t nchan_respond_msg(ngx_http_request_t *r, nchan_msg_t *msg, nchan_msg_id_t *msgid, ngx_int_t finalize, char **err);
 void nchan_include_access_control_if_needed(ngx_http_request_t *r, nchan_request_ctx_t *ctx);
+void nchan_flush_pending_output(ngx_http_request_t *r);
 
 void nchan_http_finalize_request(ngx_http_request_t *r, ngx_int_t code);
 
diff --git a/debian/modules/nchan/src/util/nchan_output_info.c b/debian/modules/nchan/src/util/nchan_output_info.c
new file mode 100644
index 00000000..ebde84c5
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_output_info.c
@@ -0,0 +1,271 @@
+#include <nchan_module.h>
+
+typedef struct {
+  ngx_str_t            subtype;
+  nchan_content_type_t ct;
+} nchan_content_subtype_t;
+
+nchan_content_type_t nchan_output_info_type(ngx_str_t *accept) {
+  nchan_content_subtype_t subtypes[] = {
+    { ngx_string("plain"),    NCHAN_CONTENT_TYPE_PLAIN },
+    { ngx_string("json"),     NCHAN_CONTENT_TYPE_JSON },
+    { ngx_string("x-json"),   NCHAN_CONTENT_TYPE_JSON },
+    { ngx_string("yaml"),     NCHAN_CONTENT_TYPE_YAML },
+    { ngx_string("x-yaml"),   NCHAN_CONTENT_TYPE_YAML },
+    { ngx_string("xml"),      NCHAN_CONTENT_TYPE_XML }
+  };
+  
+  ngx_str_t  text_ = ngx_string("text/");
+  ngx_str_t  application_ = ngx_string("application/");
+  
+  if(!accept) {
+    return NCHAN_CONTENT_TYPE_PLAIN;
+  }
+  
+  unsigned i;
+  size_t len;
+  u_char *cur, *last, *curend;
+  
+  for(cur = accept->data, last = accept->data + accept->len; cur < last; cur = curend) {
+    if((curend = memchr(cur, ',', last - cur)) != NULL) {
+      curend++;
+    }
+    else {
+      curend = last;
+    }
+    
+    if(nchan_strscanstr(&cur, &text_, curend) || nchan_strscanstr(&cur, &application_, curend)) {
+      len = curend - cur;
+      for(i=0; i<(sizeof(subtypes)/sizeof(nchan_content_subtype_t)); i++) {
+        if(len >= subtypes[i].subtype.len && ngx_memcmp(cur, subtypes[i].subtype.data, subtypes[i].subtype.len) == 0) {
+          return subtypes[i].ct;
+        }
+      }
+    }
+    else {
+      continue;
+    }
+  }
+  
+  return NCHAN_CONTENT_TYPE_PLAIN;
+}
+
+#define NCHAN_CHANNEL_INFO_MAX_LEN 512
+ngx_buf_t *nchan_channel_info_buf(ngx_str_t *accept_header, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *last_msgid, ngx_str_t **generated_content_type) {
+  static ngx_buf_t                channel_info_buf;
+  static u_char                   channel_info_buf_str[NCHAN_CHANNEL_INFO_MAX_LEN]; //big enough
+  
+  ngx_buf_t                      *b = &channel_info_buf;
+  ngx_uint_t                      len;
+  const ngx_str_t                *format;
+  time_t                          time_elapsed = ngx_time() - last_seen;
+  static nchan_msg_id_t           zero_msgid = NCHAN_ZERO_MSGID;
+  nchan_content_type_t            ct;
+  
+  static struct {
+    ngx_str_t        content_type;
+    const ngx_str_t *format_string;
+  } content_type_map[] = {
+    [NCHAN_CONTENT_TYPE_PLAIN]    = { ngx_string("text/plain"), &NCHAN_CHANNEL_INFO_PLAIN }, 
+    [NCHAN_CONTENT_TYPE_JSON]     = { ngx_string("text/json"), &NCHAN_CHANNEL_INFO_JSON },
+    [NCHAN_CONTENT_TYPE_YAML]     = { ngx_string("text/yaml"), &NCHAN_CHANNEL_INFO_YAML },
+    [NCHAN_CONTENT_TYPE_XML]      = { ngx_string("text/xml"), &NCHAN_CHANNEL_INFO_XML }
+  };
+  
+  if(!last_msgid) {
+    last_msgid = &zero_msgid;
+  }
+ 
+  b->start = channel_info_buf_str;
+  b->pos = b->start;
+  b->last_buf = 1;
+  b->last_in_chain = 1;
+  b->flush = 1;
+  b->memory = 1;
+  
+  ct = nchan_output_info_type(accept_header);
+
+  if(generated_content_type) {
+    *generated_content_type = &content_type_map[ct].content_type;
+  }
+  
+  format = content_type_map[ct].format_string;
+  
+  len = format->len - 8 - 1 + 3*NGX_INT_T_LEN; //minus 8 sprintf
+  
+  if(len > NCHAN_CHANNEL_INFO_MAX_LEN) {
+    nchan_log_error("Channel info string too long: max: %i, is: %i", NCHAN_CHANNEL_INFO_MAX_LEN, len);
+  }
+  
+  b->last = ngx_snprintf(b->start, NCHAN_CHANNEL_INFO_MAX_LEN, (char *)format->data, messages, last_seen==0 ? -1 : (ngx_int_t) time_elapsed, subscribers, msgid_to_str(last_msgid));
+  b->end = b->last;
+  
+  return b;
+}
+
+
+#define NCHAN_GROUP_INFO_MAX_LEN 1024
+static ngx_buf_t *nchan_group_info_buf(ngx_str_t *accept_header, const nchan_group_t *group, ngx_str_t **generated_content_type) {
+  static ngx_buf_t                info_buf;
+  static u_char                   info_buf_str[NCHAN_GROUP_INFO_MAX_LEN]; //big enough
+  
+  ngx_buf_t                      *b = &info_buf;
+  ngx_uint_t                      len;
+  const ngx_str_t                *format;
+  nchan_content_type_t            ct;
+  
+  static struct {
+    ngx_str_t        content_type;
+    const ngx_str_t  format_string;
+  } content_type_map[] = {
+    [NCHAN_CONTENT_TYPE_PLAIN]    = { ngx_string("text/plain"), ngx_string(
+      "channels: %ui" CRLF
+      "subscribers: %ui" CRLF
+      "messages: %ui" CRLF
+      "shared memory used by messages: %ui bytes" CRLF
+      "disk space used by messages: %ui bytes" CRLF
+      "limits:" CRLF
+      "  max channels: %ui" CRLF
+      "  max subscribers: %ui" CRLF
+      "  max messages: %ui" CRLF
+      "  max messages shared memory: %ui" CRLF
+      "  max messages disk space: %ui" CRLF
+    )}, 
+    [NCHAN_CONTENT_TYPE_JSON]     = { ngx_string("text/json"), ngx_string(
+      "{" CRLF
+      "  \"channels\": %ui," CRLF
+      "  \"subscribers\": %ui," CRLF
+      "  \"messages\": %ui," CRLF
+      "  \"messages_memory\": %ui," CRLF
+      "  \"messages_disk\": %ui," CRLF
+      "  \"limits\": {" CRLF
+      "    \"channels\": %ui," CRLF
+      "    \"subscribers\": %ui," CRLF
+      "    \"messages\": %ui," CRLF
+      "    \"messages_memory\": %ui,"CRLF
+      "    \"messages_disk\": %ui" CRLF  
+      "  }" CRLF
+      "}"
+    )},
+    [NCHAN_CONTENT_TYPE_YAML]     = { ngx_string("text/yaml"), ngx_string(
+      "---" CRLF
+      "channels: %ui" CRLF
+      "subscribers: %ui" CRLF
+      "messages: %ui" CRLF
+      "messages_memory: %ui" CRLF
+      "messages_disk: %ui" CRLF
+      "limits:" CRLF
+      "  channels: %ui" CRLF
+      "  subscribers: %ui" CRLF
+      "  messages: %ui" CRLF
+      "  messages_memory: %ui" CRLF
+      "  messages_disk: %ui" CRLF
+      CRLF
+    )},
+    [NCHAN_CONTENT_TYPE_XML]      = { ngx_string("text/xml"), ngx_string(
+      "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>" CRLF
+      "<group>" CRLF
+      "  <channels>%ui</channels>" CRLF
+      "  <subscribers>%ui</subscribers>" CRLF
+      "  <messages>%ui</messages>" CRLF
+      "  <messages_memory>%ui</messages_memory>" CRLF
+      "  <messages_disk>%ui</messages_disk>" CRLF
+      "  <limits>" CRLF
+      "    <channels>%ui</channels>" CRLF
+      "    <subscribers>%ui</subscribers>" CRLF
+      "    <messages>%ui</messages>" CRLF
+      "    <messages_memory>%ui</messages_memory>" CRLF
+      "    <messages_disk>%ui</messages_disk>" CRLF
+      "  </limits>" CRLF
+      "</group>"
+    )}
+  };
+ 
+  b->start = info_buf_str;
+  b->pos = b->start;
+  b->last_buf = 1;
+  b->last_in_chain = 1;
+  b->flush = 1;
+  b->memory = 1;
+  
+  ct = nchan_output_info_type(accept_header);
+
+  if(generated_content_type) {
+    *generated_content_type = &content_type_map[ct].content_type;
+  }
+  
+  format = &content_type_map[ct].format_string;
+  
+  len = format->len + 5*NGX_INT_T_LEN; //minus 8 sprintf
+  
+  if(len > NCHAN_GROUP_INFO_MAX_LEN) {
+    nchan_log_error("Group info string too long: max: %i, is: %i", NCHAN_GROUP_INFO_MAX_LEN, len);
+  }
+  
+  b->last = ngx_snprintf(b->start, NCHAN_GROUP_INFO_MAX_LEN, (char *)format->data, 
+                         group->channels, 
+                         group->subscribers, 
+                         group->messages, 
+                         group->messages_shmem_bytes, 
+                         group->messages_file_bytes, 
+                         //now limits
+                         group->limit.channels, 
+                         group->limit.subscribers,
+                         group->limit.messages,
+                         group->limit.messages_shmem_bytes,
+                         group->limit.messages_file_bytes
+                        );
+  b->end = b->last;
+  
+  return b;
+}
+
+//print information about a group
+ngx_int_t nchan_group_info(ngx_http_request_t *r, const nchan_group_t *group) {
+  ngx_buf_t                      *b;
+  ngx_str_t                      *content_type;
+  ngx_str_t                      *accept_header = nchan_get_accept_header_value(r);
+
+  b = nchan_group_info_buf(accept_header, group, &content_type);
+  
+  return nchan_respond_membuf(r, NGX_HTTP_OK, content_type, b, 0);
+}
+
+//print information about a channel
+ngx_int_t nchan_channel_info(ngx_http_request_t *r, ngx_int_t status_code, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *msgid) {
+  ngx_buf_t                      *b;
+  ngx_str_t                      *content_type;
+  ngx_str_t                      *accept_header = nchan_get_accept_header_value(r);
+
+  b = nchan_channel_info_buf(accept_header, messages, subscribers, last_seen, msgid, &content_type);
+  
+  return nchan_respond_membuf(r, status_code, content_type, b, 0);
+}
+
+ngx_int_t nchan_response_channel_ptr_info(nchan_channel_t *channel, ngx_http_request_t *r, ngx_int_t status_code) {
+  static const ngx_str_t CREATED_LINE = ngx_string("201 Created");
+  static const ngx_str_t ACCEPTED_LINE = ngx_string("202 Accepted");
+  
+  time_t             last_seen = 0;
+  ngx_uint_t         subscribers = 0;
+  ngx_uint_t         messages = 0;
+  nchan_msg_id_t    *msgid = NULL;
+  if(channel!=NULL) {
+    subscribers = channel->subscribers;
+    last_seen = channel->last_seen;
+    messages  = channel->messages;
+    msgid = &channel->last_published_msg_id;
+    r->headers_out.status = status_code == NGX_OK ? NGX_HTTP_OK : status_code;
+    if (status_code == NGX_HTTP_CREATED) {
+      ngx_memcpy(&r->headers_out.status_line, &CREATED_LINE, sizeof(ngx_str_t));
+    }
+    else if (status_code == NGX_HTTP_ACCEPTED) {
+      ngx_memcpy(&r->headers_out.status_line, &ACCEPTED_LINE, sizeof(ngx_str_t));
+    }
+    return nchan_channel_info(r, r->headers_out.status, messages, subscribers, last_seen, msgid);
+  }
+  else {
+    //404!
+    return nchan_respond_status(r, NGX_HTTP_NOT_FOUND, NULL, NULL, 0);
+  }
+}
diff --git a/debian/modules/nchan/src/util/nchan_output_info.h b/debian/modules/nchan/src/util/nchan_output_info.h
new file mode 100644
index 00000000..36c5152d
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_output_info.h
@@ -0,0 +1,6 @@
+ngx_buf_t *nchan_channel_info_buf(ngx_str_t *accept_header, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *last_msgid, ngx_str_t **generated_content_type);
+
+ngx_int_t nchan_channel_info(ngx_http_request_t *r, ngx_int_t status_code, ngx_uint_t messages, ngx_uint_t subscribers, time_t last_seen, nchan_msg_id_t *msgid);
+ngx_int_t nchan_group_info(ngx_http_request_t *r, const nchan_group_t *group);
+
+ngx_int_t nchan_response_channel_ptr_info(nchan_channel_t *channel, ngx_http_request_t *r, ngx_int_t status_code);
diff --git a/debian/modules/nchan/src/util/nchan_rbtree.h b/debian/modules/nchan/src/util/nchan_rbtree.h
index 7a18dfc4..f67ad3bf 100644
--- a/debian/modules/nchan/src/util/nchan_rbtree.h
+++ b/debian/modules/nchan/src/util/nchan_rbtree.h
@@ -35,18 +35,18 @@ struct ngx_rbtree_debug_node_s {
 
 typedef enum {RBTREE_WALK_LEFT, RBTREE_WALK_RIGHT, RBTREE_WALK_LEFT_RIGHT, RBTREE_WALK_STOP} rbtree_walk_direction_t;
 
-typedef ngx_int_t (*rbtree_walk_callback_pt)(rbtree_seed_t *, void *, void *);
+typedef ngx_int_t (*rbtree_walk_callback_pt)(rbtree_seed_t *, void *node_data, void *privdata);
 typedef rbtree_walk_direction_t (*rbtree_walk_conditional_callback_pt)(rbtree_seed_t *, void *, void *);
 
 ngx_int_t rbtree_init(rbtree_seed_t *seed, char *name, void *(*id)(void *), uint32_t (*hash)(void *), ngx_int_t (*compare)(void *, void *));
 unsigned             rbtree_empty(rbtree_seed_t *, rbtree_walk_callback_pt, void *data);
 
-ngx_rbtree_node_t   *rbtree_create_node(rbtree_seed_t *, size_t);
+ngx_rbtree_node_t   *rbtree_create_node(rbtree_seed_t *, size_t data_size);
 ngx_int_t            rbtree_insert_node(rbtree_seed_t *, ngx_rbtree_node_t *);
 ngx_int_t            rbtree_remove_node(rbtree_seed_t *, ngx_rbtree_node_t *);
 ngx_int_t            rbtree_destroy_node(rbtree_seed_t *, ngx_rbtree_node_t *);
 
-ngx_rbtree_node_t   *rbtree_find_node(rbtree_seed_t *, void *);
+ngx_rbtree_node_t   *rbtree_find_node(rbtree_seed_t *, void *id);
 
 ngx_int_t            rbtree_walk(rbtree_seed_t *seed, rbtree_walk_callback_pt, void *data);
 ngx_int_t            rbtree_walk_incr(rbtree_seed_t *seed, rbtree_walk_callback_pt callback, void *data);
diff --git a/debian/modules/nchan/src/util/nchan_slist.c b/debian/modules/nchan/src/util/nchan_slist.c
new file mode 100644
index 00000000..8d67318a
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_slist.c
@@ -0,0 +1,164 @@
+#include "nchan_slist.h"
+#include <assert.h>
+
+ /*
+  * Boring non-allocating doubly-linked "static" list.
+  *uses preset offsets for the prev and next fields on pre-allocated data
+  */
+ 
+ngx_int_t __nchan_slist_init(nchan_slist_t *list, off_t offset_prev, off_t offset_next) {
+  list->offset.prev = offset_prev;
+  list->offset.next = offset_next;
+  return nchan_slist_reset(list);
+}
+
+ngx_int_t nchan_slist_reset(nchan_slist_t *list) {
+  list->head = NULL;
+  list->tail = NULL;
+  list->n = 0;
+  return NGX_OK;
+}
+
+void *nchan_slist_first(nchan_slist_t *list) {
+  return list->head;
+}
+void *nchan_slist_last(nchan_slist_t *list) {
+  return list->tail;
+}
+static void **nchan_slist_next_ptr(nchan_slist_t *list, void *el) {
+  return (void **)&(((char *)el)[list->offset.next]);
+}
+static void **nchan_slist_prev_ptr(nchan_slist_t *list, void *el) {
+  return (void **)&(((char *)el)[list->offset.prev]);
+}
+
+void *nchan_slist_next(nchan_slist_t *list, void *el) {
+  void **ptr = nchan_slist_next_ptr(list, el);
+  return *ptr;
+}
+void *nchan_slist_prev(nchan_slist_t *list, void *el) {
+  void **ptr = nchan_slist_prev_ptr(list, el);
+  return *ptr;
+}
+
+ngx_int_t nchan_slist_append(nchan_slist_t *list, void *el) {
+  void **el_prev_ptr = nchan_slist_prev_ptr(list, el);
+  void **el_next_ptr = nchan_slist_next_ptr(list, el);
+  if(list->head == NULL) {
+    list->head = el;
+  }
+  if(list->tail == NULL) {
+    *el_prev_ptr = NULL;
+  }
+  else {
+    void **tail_next = nchan_slist_next_ptr(list, list->tail);
+    *el_prev_ptr = list->tail;
+    *tail_next = el;
+  }
+  list->tail = el;
+  *el_next_ptr = NULL;
+  list->n++;
+  return NGX_OK;
+}
+ngx_int_t nchan_slist_prepend(nchan_slist_t *list, void *el) {
+  void **el_prev_ptr = nchan_slist_prev_ptr(list, el);
+  void **el_next_ptr = nchan_slist_next_ptr(list, el);
+  if(list->tail == NULL) {
+    list->tail = el;
+  }
+  if(list->head == NULL) {
+    *el_next_ptr = NULL;
+  }
+  else {
+    void **head_prev_ptr = nchan_slist_prev_ptr(list, list->head);
+    *el_next_ptr = list->head;
+    *head_prev_ptr = el;
+  }
+  list->head = el;
+  *el_prev_ptr = NULL;
+  list->n++;
+  return NGX_OK;
+}
+ngx_int_t nchan_slist_remove(nchan_slist_t *list, void *el) {
+  void **el_prev_ptr = nchan_slist_prev_ptr(list, el);
+  void **el_next_ptr = nchan_slist_next_ptr(list, el);
+  void *el_prev = *el_prev_ptr, *el_next = *el_next_ptr;
+  if(list->head == el) {
+    list->head = el_next;
+  }
+  if(list->tail == el) {
+    list->tail = el_prev;
+  }
+  if(el_prev) {
+    void **el_prev_next_ptr = nchan_slist_next_ptr(list, el_prev);
+    *el_prev_next_ptr = el_next;
+  }
+  if(el_next) {
+    void **el_next_prev_ptr = nchan_slist_prev_ptr(list, el_next);
+    *el_next_prev_ptr = el_prev;
+  }
+  list->n--;
+  *el_prev_ptr = NULL;
+  *el_next_ptr = NULL;
+  return NGX_OK;
+}
+
+ngx_int_t nchan_slist_transfer(nchan_slist_t *dst, nchan_slist_t *src) {
+  assert(dst->offset.prev == src->offset.prev); //same-ish slists
+  assert(dst->offset.next == src->offset.next); //same-ish slists
+  void **src_head_prev_ptr = nchan_slist_prev_ptr(src, src->head);
+  void **dst_tail_next_ptr = nchan_slist_next_ptr(dst, src->tail);
+  
+  if(src->n == 0) {
+    assert(src->head == NULL);
+    assert(src->tail == NULL);
+    return NGX_OK; //nothing to do
+  }
+  
+  *src_head_prev_ptr = dst->tail;
+  if(dst->tail) {
+    *dst_tail_next_ptr = src->head;
+  }
+  dst->tail = src->tail;
+  
+  if(dst->head == NULL) {
+    dst->head = src->head;
+  }
+  dst->tail = src->tail;
+  dst->n += src->n;
+  
+  src->n = 0;
+  src->head = NULL;
+  src->tail = NULL;
+  
+  return NGX_OK;
+}
+
+void *nchan_slist_shift(nchan_slist_t *list) {
+  void *head = list->head;
+  if(head) {
+    nchan_slist_remove(list, head);
+  }
+  return head;
+}
+
+void *nchan_slist_pop(nchan_slist_t *list) {
+  void *tail = list->tail;
+  if(tail) {
+    nchan_slist_remove(list, tail);
+  }
+  return tail;
+}
+
+int nchan_slist_is_empty(nchan_slist_t *list) {
+  if(list->n == 0) {
+    assert(list->head == NULL);
+    assert(list->tail == NULL);
+    return 1;
+  }
+  else {
+    assert(list->head != NULL);
+    assert(list->tail != NULL);
+    return 0;
+  }
+}
diff --git a/debian/modules/nchan/src/util/nchan_slist.h b/debian/modules/nchan/src/util/nchan_slist.h
new file mode 100644
index 00000000..df8dcb92
--- /dev/null
+++ b/debian/modules/nchan/src/util/nchan_slist.h
@@ -0,0 +1,41 @@
+#ifndef NCHAN_SLIST_H
+#define NCHAN_SLIST_H
+
+#define NCHAN_SLIST_DEBUG 0
+
+#include <nginx.h>
+#include <ngx_http.h>
+
+typedef struct {
+  off_t           prev;
+  off_t           next;
+} nchan_slist_offsets_t;
+
+typedef struct {
+  void                 *head;
+  void                 *tail;
+  ngx_uint_t            n;
+  nchan_slist_offsets_t offset;
+} nchan_slist_t;
+
+
+
+#define nchan_slist_init(slist, data_type, prev_field, next_field) \
+  __nchan_slist_init(slist, offsetof(data_type, prev_field), offsetof(data_type, next_field))
+ngx_int_t __nchan_slist_init(nchan_slist_t *list, off_t offset_prev, off_t offset_next);
+void *nchan_slist_first(nchan_slist_t *list);
+void *nchan_slist_last(nchan_slist_t *list);
+void *nchan_slist_next(nchan_slist_t *list, void *el);
+void *nchan_slist_prev(nchan_slist_t *list, void *el);
+ngx_int_t nchan_slist_append(nchan_slist_t *list, void *el);
+ngx_int_t nchan_slist_prepend(nchan_slist_t *list, void *el);
+ngx_int_t nchan_slist_remove(nchan_slist_t *list, void *el);
+
+ngx_int_t nchan_slist_reset(nchan_slist_t *list);
+ngx_int_t nchan_slist_transfer(nchan_slist_t *dst, nchan_slist_t *src);
+void *nchan_slist_pop(nchan_slist_t *list);
+void *nchan_slist_shift(nchan_slist_t *list);
+
+int nchan_slist_is_empty(nchan_slist_t *list);
+
+#endif /*NCHAN_SLIST_H*/
diff --git a/debian/modules/nchan/src/util/nchan_subrequest.c b/debian/modules/nchan/src/util/nchan_subrequest.c
index 02a7b0dd..a9f5141a 100644
--- a/debian/modules/nchan/src/util/nchan_subrequest.c
+++ b/debian/modules/nchan/src/util/nchan_subrequest.c
@@ -45,11 +45,12 @@ static ngx_inline ngx_uint_t nchan_hash_str(u_char *src, size_t n) {
 #define nchan_hash_literal(s)                                        \
   nchan_hash_str((u_char *) s, sizeof(s) - 1)
 
-static ngx_int_t nchan_set_content_length_header(ngx_http_request_t *r, off_t len, u_char *p) {
+ngx_int_t nchan_set_content_length_header(ngx_http_request_t *r, off_t len) {
   ngx_table_elt_t                 *h, *header;
   ngx_list_part_t                 *part;
   ngx_http_request_t              *pr;
   ngx_uint_t                       i;
+  u_char                          *p;
   static ngx_uint_t                nchan_content_length_hash = 0;
   if(nchan_content_length_hash == 0) {
     nchan_content_length_hash = nchan_hash_literal("content-length");
@@ -70,11 +71,9 @@ static ngx_int_t nchan_set_content_length_header(ngx_http_request_t *r, off_t le
   h->lowcase_key= (u_char *)"content-length";
 
   r->headers_in.content_length = h;
-  if(p == NULL) {
-    p = ngx_palloc(r->pool, NGX_OFF_T_LEN);
-    if (p == NULL) {
-      return NGX_ERROR;
-    }
+  p = ngx_palloc(r->pool, NGX_OFF_T_LEN);
+  if (p == NULL) {
+    return NGX_ERROR;
   }
 
   h->value.data = p;
@@ -120,7 +119,7 @@ static ngx_int_t nchan_set_content_length_header(ngx_http_request_t *r, off_t le
   return NGX_OK;
 }
 
-ngx_int_t nchan_adjust_subrequest(ngx_http_request_t *sr, ngx_uint_t method, ngx_str_t *method_name, ngx_http_request_body_t *request_body, size_t content_length_n, u_char *content_len_str) {
+ngx_int_t nchan_adjust_subrequest(ngx_http_request_t *sr, ngx_uint_t method, ngx_str_t *method_name, ngx_http_request_body_t *request_body, size_t content_length_n) {
   //ngx_http_core_main_conf_t  *cmcf;
   ngx_http_request_t         *r;
   ngx_http_request_body_t    *body;
@@ -154,7 +153,7 @@ ngx_int_t nchan_adjust_subrequest(ngx_http_request_t *sr, ngx_uint_t method, ngx
   if ((body = request_body)!=NULL) {
     sr->request_body = body;
 
-    rc = nchan_set_content_length_header(sr, content_length_n, content_len_str);
+    rc = nchan_set_content_length_header(sr, content_length_n);
     
     if (rc != NGX_OK) {
       return NGX_ERROR;
@@ -253,9 +252,17 @@ size_t nchan_subrequest_content_length(ngx_http_request_t *sr) {
   size_t                            len = 0;
   ngx_http_upstream_headers_in_t   *headers_in = &sr->upstream->headers_in;
   ngx_chain_t                      *chain;
+  ngx_chain_t                      *body_chain;
+#if nginx_version >= 1013010
+  body_chain = sr->out;
+#else
+  body_chain = sr->upstream->out_bufs;
+#endif
+  
+  
   if(headers_in->chunked || headers_in->content_length_n == -1) {
     //count it
-    for(chain = sr->upstream->out_bufs; chain != NULL; chain = chain->next) {
+    for(chain = body_chain; chain != NULL; chain = chain->next) {
       len += ngx_buf_size((chain->buf));
     }
   }
@@ -265,3 +272,53 @@ size_t nchan_subrequest_content_length(ngx_http_request_t *sr) {
   
   return len;
 }
+
+
+ngx_http_request_t *nchan_create_subrequest(ngx_http_request_t *r, ngx_str_t *url, ngx_buf_t *body, ngx_http_post_subrequest_pt cb, void *pd) {
+  ngx_http_post_subrequest_t    *psr = ngx_pcalloc(r->pool, sizeof(*psr));
+  ngx_http_request_t            *sr;
+  
+  psr->handler = cb;
+  psr->data = pd;
+  
+  ngx_http_subrequest(r, url, NULL, &sr, psr, NGX_HTTP_SUBREQUEST_IN_MEMORY);
+  
+  if((sr->request_body = ngx_pcalloc(r->pool, sizeof(*sr->request_body))) == NULL) { //dummy request body 
+    return NULL;
+  }
+  
+  if(body && ngx_buf_size(body) > 0) {
+    static ngx_str_t                   POST_REQUEST_STRING = {4, (u_char *)"POST "};
+    size_t                             sz;
+    ngx_http_request_body_t           *sr_body = sr->request_body;
+    ngx_chain_t                       *fakebody_chain;
+    ngx_buf_t                         *fakebody_buf;
+    
+    fakebody_chain = ngx_palloc(r->pool, sizeof(*fakebody_chain));
+    fakebody_buf = ngx_pcalloc(r->pool, sizeof(*fakebody_buf));
+    sr_body->bufs = fakebody_chain;
+    fakebody_chain->next = NULL;
+    fakebody_chain->buf = fakebody_buf;
+    fakebody_buf->last_buf = 1;
+    fakebody_buf->last_in_chain = 1;
+    fakebody_buf->flush = 1;
+    fakebody_buf->memory = 1;
+    
+    //just copy the buffer contents. it's inefficient but I don't care at the moment.
+    //this can and should be optimized later
+    sz = ngx_buf_size(body);
+    fakebody_buf->start = ngx_palloc(r->pool, sz); //huuh?
+    ngx_memcpy(fakebody_buf->start, body->start, sz);
+    fakebody_buf->end = fakebody_buf->start + sz;
+    fakebody_buf->pos = fakebody_buf->start;
+    fakebody_buf->last = fakebody_buf->end;
+    
+    nchan_adjust_subrequest(sr, NGX_HTTP_POST, &POST_REQUEST_STRING, sr_body, sz);
+  }
+  else {
+    sr->header_only = 1;
+  }
+  sr->args = r->args;
+  
+  return sr;
+}
diff --git a/debian/modules/nchan/src/util/nchan_subrequest.h b/debian/modules/nchan/src/util/nchan_subrequest.h
index 356f4a43..b96b78df 100644
--- a/debian/modules/nchan/src/util/nchan_subrequest.h
+++ b/debian/modules/nchan/src/util/nchan_subrequest.h
@@ -1,3 +1,6 @@
-ngx_int_t nchan_adjust_subrequest(ngx_http_request_t *sr, ngx_uint_t method, ngx_str_t *method_name, ngx_http_request_body_t *request_body, size_t content_length_n, u_char *content_len_str);
+ngx_int_t nchan_set_content_length_header(ngx_http_request_t *r, off_t len);
+ngx_int_t nchan_adjust_subrequest(ngx_http_request_t *sr, ngx_uint_t method, ngx_str_t *method_name, ngx_http_request_body_t *request_body, size_t content_length_n);
 size_t nchan_subrequest_content_length(ngx_http_request_t *sr);
 ngx_int_t nchan_recover_x_accel_redirected_request_method(ngx_http_request_t *r);
+
+ngx_http_request_t *nchan_create_subrequest(ngx_http_request_t *r, ngx_str_t *url, ngx_buf_t *body, ngx_http_post_subrequest_pt cb, void *pd);
diff --git a/debian/modules/nchan/src/util/nchan_util.c b/debian/modules/nchan/src/util/nchan_util.c
index cfbe8d11..f675381e 100644
--- a/debian/modules/nchan/src/util/nchan_util.c
+++ b/debian/modules/nchan/src/util/nchan_util.c
@@ -1,35 +1,73 @@
 #include <nchan_module.h>
 #include <assert.h>
 
-char *nchan_msgstatus_to_str(nchan_msg_status_t status) {
-  switch(status) {
-    case MSG_CHANNEL_NOTREADY:
-      return "MSG_CHANNEL_NOTREADY";
-    case MSG_NORESPONSE:
-      return "MSG_NORESPONSE";
-    case MSG_INVALID:
-      return "MSG_INVALID";
-    case MSG_PENDING:
-      return "MSG_PENDING";
-    case MSG_NOTFOUND:
-      return "MSG_NOTFOUND";
-    case MSG_FOUND:
-      return "MSG_FOUND";
-    case MSG_EXPECTED:
-      return "MSG_EXPECTED";
-    case MSG_EXPIRED:
-      return "MSG_EXPIRED";
-  }
-  return "???";
+#if (NGX_ZLIB)
+#include <zlib.h>
+#endif
+
+#ifndef NCHAN_HAVE_MEMRCHR
+void *memrchr(const void *s, int c, size_t n) {
+  const char *start = s;
+  const char *end = &start[n]; //one too much on purpose
+  while(--end >= start) { //and this is why
+    if(c == *end) {
+      return (void *)end;
+    }
+  }
+  return NULL;
 }
+#endif
 
 int nchan_ngx_str_match(ngx_str_t *str1, ngx_str_t *str2) {
+  if(str1 == str2) {
+    return 1;
+  }
   if(str1->len != str2->len) {
     return 0;
   }
+  if(str1->len == 0) {
+    return 1;
+  }
   return memcmp(str1->data, str2->data, str1->len) == 0;
 }
 
+
+int nchan_ngx_str_nonzero_match(ngx_str_t *str1, ngx_str_t *str2) {
+  if(str1->len == 0) {
+    return 0;
+  }
+  else {
+    return nchan_ngx_str_match(str1, str2);
+  }
+}
+
+int nchan_strscanstr(u_char **cur, ngx_str_t *find, u_char *last) {
+  //inspired by ngx_strnstr
+  char   *s2 = (char *)find->data;
+  u_char *s1 = *cur;
+  size_t  len = last - s1;
+  u_char  c1, c2;
+  size_t  n;
+  c2 = *(u_char *) s2++;
+  n = find->len - 1;
+  do {
+    do {
+      if (len-- == 0) {
+        return 0;
+      }
+      c1 = *s1++;
+      if (c1 == 0) {
+        return 0;
+      }
+    } while (c1 != c2);
+    if (n > len) {
+      return 0;
+    }
+  } while (ngx_strncmp(s1, (u_char *) s2, n) != 0);
+  *cur = s1 + n;
+  return 1;
+}
+
 ngx_int_t ngx_http_complex_value_noalloc(ngx_http_request_t *r, ngx_http_complex_value_t *val, ngx_str_t *value, size_t maxlen) {
   size_t                        len;
   ngx_http_script_code_pt       code;
@@ -76,6 +114,53 @@ ngx_int_t ngx_http_complex_value_noalloc(ngx_http_request_t *r, ngx_http_complex
   return NGX_OK;
 }
 
+ngx_int_t ngx_http_complex_value_custom_pool(ngx_http_request_t *r, ngx_http_complex_value_t *val, ngx_str_t *value, ngx_pool_t *pool) {
+  size_t                        len;
+  ngx_http_script_code_pt       code;
+  ngx_http_script_len_code_pt   lcode;
+  ngx_http_script_engine_t      e;
+
+  if (val->lengths == NULL) {
+    *value = val->value;
+    return NGX_OK;
+  }
+
+  ngx_http_script_flush_complex_value(r, val);
+
+  ngx_memzero(&e, sizeof(ngx_http_script_engine_t));
+
+  e.ip = val->lengths;
+  e.request = r;
+  e.flushed = 1;
+
+  len = 0;
+
+  while (*(uintptr_t *) e.ip) {
+    lcode = *(ngx_http_script_len_code_pt *) e.ip;
+    len += lcode(&e);
+  }
+  
+  value->data = ngx_palloc(pool, len);
+  if(value->data == NULL) {
+    nchan_log_error("couldn't palloc for ngx_http_complex_value_custom_pool");
+    return NGX_ERROR;
+  }
+  value->len = len;
+
+  e.ip = val->values;
+  e.pos = value->data;
+  e.buf = *value;
+
+  while (*(uintptr_t *) e.ip) {
+    code = *(ngx_http_script_code_pt *) e.ip;
+    code((ngx_http_script_engine_t *) &e);
+  }
+
+  *value = e.buf;
+
+  return NGX_OK;
+}
+
 u_char *nchan_strsplit(u_char **s1, ngx_str_t *sub, u_char *last_char) {
   u_char   *delim = sub->data;
   size_t    delim_sz = sub->len;
@@ -121,6 +206,25 @@ ngx_str_t *nchan_get_header_value(ngx_http_request_t * r, ngx_str_t header_name)
   return NULL;
 }
 
+ngx_str_t *nchan_get_header_value_origin(ngx_http_request_t *r, nchan_request_ctx_t *ctx) {
+  ngx_str_t         *origin_header;
+  static ngx_str_t   empty_str = ngx_string("");
+  if(!ctx) {
+    ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  }
+  
+  if(!ctx->request_origin_header) {
+    if((origin_header = nchan_get_header_value(r, NCHAN_HEADER_ORIGIN)) != NULL) {
+      ctx->request_origin_header = origin_header;
+    }
+    else {
+      ctx->request_origin_header = &empty_str;
+    }
+  }
+  
+  return ctx->request_origin_header == &empty_str ? NULL : ctx->request_origin_header;
+}
+
 ngx_str_t *nchan_get_accept_header_value(ngx_http_request_t *r) {
 #if (NGX_HTTP_HEADERS)  
   if(r->headers_in.accept == NULL) {
@@ -175,31 +279,50 @@ int nchan_cstr_startswith(char *cstr, char *match) {
   }
   return 1;
 }
+int nchan_str_startswith(ngx_str_t *str, const char *match) {
+  size_t sz = strlen(match);
+  if(sz > str->len) {
+    return 0;
+  }
+  if(memcmp(str->data, match, sz) == 0) {
+    return 1;
+  }
+  return 0;
+}
 
-void nchan_scan_nearest_chr(u_char **cur, ngx_str_t *str, ngx_int_t n, ...) {
-  u_char    chr;
-  va_list   args;
+int nchan_str_after(ngx_str_t **str, const char *match) {
+  if(nchan_str_startswith(*str, match)) {
+    size_t sz = strlen(match);
+    (*str)->data+=sz;
+    (*str)->len-=sz;
+    return 1;
+  }
+  else {
+    return 0;
+  }
+}
+
+
+void nchan_scan_split_by_chr(u_char **cur, size_t max_len, ngx_str_t *str, u_char chr) {
   u_char   *shortest = NULL;
+  u_char   *start = *cur;
+  u_char   *tmp_cur;
   
-  u_char *tmp_cur;
-  
-  ngx_int_t i;
-  
-  for(tmp_cur = *cur; shortest == NULL && (tmp_cur == *cur || tmp_cur[-1] != '\0'); tmp_cur++) {
-    va_start(args, n);
-    for(i=0; shortest == NULL && i<n; i++) {
-      chr = (u_char )va_arg(args, int);
-      if(*tmp_cur == chr) {
-        shortest = tmp_cur;
-      }
+  for(tmp_cur = *cur; shortest == NULL && (tmp_cur == *cur || tmp_cur - start < (ssize_t )max_len); tmp_cur++) {
+    if(*tmp_cur == chr) {
+      shortest = tmp_cur;
     }
-    va_end(args);
   }
   if(shortest) {
     str->data = (u_char *)*cur;
     str->len = shortest - *cur;
     *cur = shortest + 1;
   }
+  else if(tmp_cur - start == (ssize_t )max_len) {
+    str->data = start;
+    str->len = max_len;
+    *cur = start + max_len;
+  }
   else {
     str->data = NULL;
     str->len = 0;
@@ -211,22 +334,26 @@ void nchan_scan_until_chr_on_line(ngx_str_t *line, ngx_str_t *str, u_char chr) {
   //ERR("rest_line: \"%V\"", line);
   cur = (u_char *)memchr(line->data, chr, line->len);
   if(!cur) {
-    *str = *line;
+    if(str) {
+      *str = *line;
+    }
     line->data += line->len;
     line->len = 0;
   }
   else {
-    str->data = line->data;
-    str->len = (cur - line->data);
-    line->len -= str->len + 1;
-    line->data += str->len + 1;
+    if(str) {
+      str->data = line->data;
+      str->len = (cur - line->data);
+    }
+    line->len -= (cur - line->data) + 1;
+    line->data += (cur - line->data) + 1;
   }
   //ERR("str: \"%V\"", str);
 }
 
 void nchan_strcpy(ngx_str_t *dst, ngx_str_t *src, size_t maxlen) {
   size_t len = src->len > maxlen && maxlen > 0 ? maxlen : src->len;
-  ngx_memcpy(dst->data, src->data, len);
+  memcpy(dst->data, src->data, len);
   dst->len = len;
 }
 
@@ -243,6 +370,50 @@ static ngx_buf_t *ensure_last_buf(ngx_pool_t *pool, ngx_buf_t *buf) {
   }
 }
 
+ngx_str_t *nchan_get_allow_origin_value(ngx_http_request_t *r, nchan_loc_conf_t *cf, nchan_request_ctx_t *ctx) {
+  if(!ctx) ctx = ngx_http_get_module_ctx(r, ngx_nchan_module);
+  if(!cf)  cf  = ngx_http_get_module_loc_conf(r, ngx_nchan_module);
+  if(!ctx->allow_origin && cf->allow_origin) {
+    ngx_str_t                 *allow_origin = ngx_palloc(r->pool, sizeof(*allow_origin));
+    ngx_http_complex_value(r, cf->allow_origin, allow_origin);
+    ctx->allow_origin = allow_origin;
+  }
+  
+  return ctx->allow_origin;
+}
+
+int nchan_match_origin_header(ngx_http_request_t *r, nchan_loc_conf_t *cf, nchan_request_ctx_t *ctx) {
+  ngx_str_t                 *origin_header;
+  ngx_str_t                 *allow_origin;
+  ngx_str_t                  curstr;
+  u_char                    *cur, *end;
+  
+  if(cf->allow_origin == NULL) { //default is to always match
+    return 1;
+  }
+  
+  if((origin_header = nchan_get_header_value_origin(r, ctx)) == NULL) {
+    return 1;
+  }
+
+  allow_origin = nchan_get_allow_origin_value(r, cf, ctx);
+  
+  cur = allow_origin->data;
+  end = cur + allow_origin->len;
+  
+  while(cur < end) {
+    nchan_scan_split_by_chr(&cur, end - cur, &curstr, ' ');
+    if(curstr.len == 1 && curstr.data[0] == '*') {
+      return 1;
+    }
+    if(nchan_ngx_str_match(&curstr, origin_header)) {
+      return 1;
+    }
+  }
+  
+  return 0;
+}
+
 // this function adapted from push stream module. thanks Wandenberg Peixoto <wandenberg@gmail.com> and Rogério Carvalho Schneider <stockrt@gmail.com>
 ngx_buf_t * nchan_chain_to_single_buffer(ngx_pool_t *pool, ngx_chain_t *chain, size_t content_length) {
   ngx_buf_t *buf = NULL;
@@ -316,21 +487,89 @@ void oneshot_timer_callback(ngx_event_t *ev) {
   ngx_free(timer);
  }
 
-ngx_int_t nchan_add_oneshot_timer(void (*cb)(void *), void *pd, ngx_msec_t delay) {
+void *nchan_add_oneshot_timer(void (*cb)(void *), void *pd, ngx_msec_t delay) {
   oneshot_timer_t *timer = ngx_alloc(sizeof(*timer), ngx_cycle->log);
   ngx_memzero(&timer->ev, sizeof(timer->ev));
   timer->cb = cb;
   nchan_init_timer(&timer->ev, oneshot_timer_callback, pd);
   ngx_add_timer(&timer->ev, delay);
-  return NGX_OK;
+  return timer;
+}
+
+void nchan_abort_oneshot_timer(void *t) {
+  oneshot_timer_t *timer = t;
+  if(timer->ev.timer_set) {
+    ngx_del_timer(&timer->ev);
+  }
+  ngx_free(timer);
+}
+
+typedef struct {
+  ngx_event_t    ev;
+  ngx_msec_t     wait;
+  ngx_int_t    (*cb)(void *pd);
+} interval_timer_t;
+
+void interval_timer_callback(ngx_event_t *ev) {
+  interval_timer_t  *timer = container_of(ev, interval_timer_t, ev);
+  ngx_int_t rc = timer->cb(ev->data);
+  if((rc == NGX_OK || rc == NGX_AGAIN) && ev->timedout) {
+    ev->timedout=0;
+    ngx_add_timer(&timer->ev, timer->wait);
+  }
+  else if(rc > NGX_OK && ev->timedout) {
+    timer->wait = rc;
+    ev->timedout=0;
+    ngx_add_timer(&timer->ev, timer->wait);
+  }
+  else { //rc < 0, != NGX_EAGAIN
+    //NGX_DONE, for example, or NGX_ABORT
+    ngx_free(timer);
+  }
+}
+
+void *nchan_add_interval_timer(ngx_int_t (*cb)(void *), void *pd, ngx_msec_t interval) {
+  interval_timer_t *timer = ngx_alloc(sizeof(*timer), ngx_cycle->log);
+  ngx_memzero(&timer->ev, sizeof(timer->ev));
+  timer->cb = cb;
+  timer->wait = interval;
+  nchan_init_timer(&timer->ev, interval_timer_callback, pd);
+  ngx_add_timer(&timer->ev, interval);
+  return timer;
+}
+void nchan_abort_interval_timer(void *t) {
+  interval_timer_t *timer = t;
+  if(timer->ev.timer_set) {
+    ngx_del_timer(&timer->ev);
+  }
+  ngx_free(timer);
+}
+
+
+ngx_str_t *nchan_urldecode_str(ngx_http_request_t *r, ngx_str_t *str) {
+  ngx_str_t   *out;
+  u_char      *dst, *src;
+  if(memchr(str->data, '%', str->len) == NULL) {
+    return str;
+  }
+  
+  out = ngx_palloc(r->pool, sizeof(*out) + str->len);
+  out->data = (u_char *)&out[1];
+  
+  dst = out->data;
+  src = str->data;
+  
+  ngx_unescape_uri(&dst, &src, str->len, 0);
+  out->len = dst - out->data;
+  
+  return out;
 }
 
 int nchan_ngx_str_char_substr(ngx_str_t *str, char *substr, size_t sz) {
   //naive non-null-terminated string matcher. don't use it in tight loops!
-  char *cur;
-  size_t len = str->len;
-  
-  for(cur = (char *)str->data, len = str->len; len >= sz; cur++, len--) {
+  char   *cur = (char *)str->data;
+  size_t  len;
+  for(len = str->len; len >= sz; cur++, len--) {
     if(strncmp(cur, substr, sz) == 0) {
       return 1;
     }
@@ -338,6 +577,586 @@ int nchan_ngx_str_char_substr(ngx_str_t *str, char *substr, size_t sz) {
   return 0;
 }
 
+int nchan_cstr_match_line(const char *cstr, const char *line) {
+  ngx_str_t rest;
+  if(nchan_get_rest_of_line_in_cstr(cstr, line, &rest)) {
+    return rest.len == 0 ? 1 : 0;
+  }
+  return 0;
+}
+
+int nchan_get_rest_of_line_in_cstr(const char *cstr, const char *line_start, ngx_str_t *rest) {
+  const char *cur = cstr;
+  const char *end = cur + strlen(cur);
+  
+  while(cur && cur < end) {
+    char *first = strstr(cstr, line_start);
+    if(!first) { //not found at all
+      if(rest) rest->len = 0;
+      return 0;
+    }
+    
+    if(first == cstr || first[-1]=='\n') { //start of line or start of string
+      const char *last = strchr(first, '\n');
+      if(!last) { // end of string
+        last = end;
+      }
+      else if(last > first && last[-1]=='\r') {
+        last--;
+      }
+      if(rest) {
+        rest->len = last - first - strlen(line_start);
+        rest->data = (u_char *)first + strlen(line_start);
+      }
+      return 1;
+    }
+    else {
+      //we found a match in the middle of the string
+      cur = strchr(cur, '\n'); //move on, redo
+    }
+  }
+  return 0;
+}
+
+//converts string to positive double float
+static double nchan_atof(u_char *line, ssize_t n) {
+  ssize_t cutoff, cutlim;
+  double  value = 0;
+  
+  u_char *decimal, *cur, *last = line + n;
+  
+  if (n == 0) {
+    return NGX_ERROR;
+  }
+
+  cutoff = NGX_MAX_SIZE_T_VALUE / 10;
+  cutlim = NGX_MAX_SIZE_T_VALUE % 10;
+  
+  decimal = memchr(line, '.', n);
+  
+  if(decimal == NULL) {
+    decimal = line + n;
+  }
+  
+  for (n = decimal - line; n-- > 0; line++) {
+    if (*line < '0' || *line > '9') {
+      return NGX_ERROR;
+    }
+
+    if (value >= cutoff && (value > cutoff || (*line - '0') > cutlim)) {
+      return NGX_ERROR;
+    }
+
+    value = value * 10 + (*line - '0');
+  }
+  
+  double decval = 0;
+  
+  
+  
+  for(cur = (decimal - last) > 10 ? decimal + 10 : last-1; cur > decimal && cur < last; cur--) {
+    if (*cur < '0' || *cur > '9') {
+      return NGX_ERROR;
+    }
+    decval = decval / 10 + (*cur - '0');
+  }
+  value = value + decval/10;
+  
+  return value;
+}
+
+ssize_t nchan_parse_size(ngx_str_t *line) {
+  u_char   unit;
+  size_t   len;
+  ssize_t  size, scale, max;
+  double   floaty;
+  
+  len = line->len;
+  unit = line->data[len - 1];
+
+  switch (unit) {
+  case 'K':
+  case 'k':
+      len--;
+      max = NGX_MAX_SIZE_T_VALUE / 1024;
+      scale = 1024;
+      break;
+
+  case 'M':
+  case 'm':
+      len--;
+      max = NGX_MAX_SIZE_T_VALUE / (1024 * 1024);
+      scale = 1024 * 1024;
+      break;
+  
+  case 'G':
+  case 'g':
+      len--;
+      max = NGX_MAX_SIZE_T_VALUE / (1024 * 1024 * 1024);
+      scale = 1024 * 1024 * 1024;
+      break;
+
+  default:
+      max = NGX_MAX_SIZE_T_VALUE;
+      scale = 1;
+  }
+
+  floaty = nchan_atof(line->data, len);
+  
+  if (floaty == NGX_ERROR || floaty > max) {
+      return NGX_ERROR;
+  }
+
+  size = floaty * scale;
+
+  return size;
+}
+
+char *nchan_conf_set_size_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+  char  *p = conf;
+
+  size_t           *sp;
+  ngx_str_t        *value;
+  ngx_conf_post_t  *post;
+
+
+  sp = (size_t *) (p + cmd->offset);
+  if (*sp != NGX_CONF_UNSET_SIZE) {
+      return "is duplicate";
+  }
+
+  value = cf->args->elts;
+
+  *sp = nchan_parse_size(&value[1]);
+  if (*sp == (size_t) NGX_ERROR) {
+    return "invalid value";
+  }
+
+  if (cmd->post) {
+    post = cmd->post;
+    return post->post_handler(cf, post, sp);
+  }
+
+  return NGX_CONF_OK;
+}
+
+void ngx_init_set_membuf(ngx_buf_t *buf, u_char *start, u_char *end) {
+  ngx_memzero(buf, sizeof(*buf));
+  buf->start = start;
+  buf->pos = start;
+  buf->end = end;
+  buf->last = end;
+  buf->memory = 1;
+}
+
+void ngx_init_set_membuf_str(ngx_buf_t *buf, ngx_str_t *str) {
+  ngx_memzero(buf, sizeof(*buf));
+  buf->start = str->data;
+  buf->pos = str->data;
+  buf->end = str->data + str->len;
+  buf->last = buf->end;
+  buf->memory = 1;
+}
+
+
+#if (NGX_ZLIB)
+static z_stream        *deflate_zstream = NULL;
+static z_stream        *deflate_dummy_zstream = NULL;
+
+static ngx_path_t      *message_temp_path = NULL;
+
+ngx_int_t nchan_common_deflate_init(nchan_main_conf_t  *mcf) {
+  int rc;
+  int windowBits;
+  message_temp_path = mcf->message_temp_path;
+  
+  if((deflate_zstream = ngx_calloc(sizeof(*deflate_zstream), ngx_cycle->log)) == NULL) {
+    nchan_log_error("couldn't allocate deflate stream.");
+    return NGX_ERROR;
+  }
+  
+  windowBits = -mcf->zlib_params.windowBits; //negative to disable headers and use a raw stream
+  
+  deflate_zstream->zalloc = Z_NULL;
+  deflate_zstream->zfree = Z_NULL;
+  deflate_zstream->opaque = Z_NULL;
+  
+  rc = deflateInit2(deflate_zstream, (int) mcf->zlib_params.level, Z_DEFLATED, windowBits, mcf->zlib_params.memLevel, mcf->zlib_params.strategy);
+  if(rc != Z_OK) {
+    nchan_log_error("couldn't initialize deflate stream.");
+    deflate_zstream = NULL;
+    return NGX_ERROR;
+  }
+  
+  if((deflate_dummy_zstream = ngx_calloc(sizeof(*deflate_dummy_zstream), ngx_cycle->log)) == NULL) {
+    nchan_log_error("couldn't allocate dummy deflate stream.");
+    return NGX_ERROR;
+  }
+  
+  deflate_dummy_zstream->zalloc = Z_NULL;
+  deflate_dummy_zstream->zfree = Z_NULL;
+  deflate_dummy_zstream->opaque = Z_NULL;
+  
+  rc = deflateInit2(deflate_dummy_zstream, 0, Z_DEFLATED, -9, 1, Z_DEFAULT_STRATEGY);
+  if(rc != Z_OK) {
+    nchan_log_error("couldn't initialize deflate stream.");
+    deflate_dummy_zstream = NULL;
+    return NGX_ERROR;
+  }
+  
+  return NGX_OK;
+}
+
+ngx_int_t nchan_common_deflate_shutdown(void) {
+  if(deflate_zstream) {
+    deflateEnd(deflate_zstream);
+    ngx_free(deflate_zstream);
+    deflate_zstream = NULL;
+  }
+  
+  if(deflate_dummy_zstream) {
+    deflateEnd(deflate_dummy_zstream);
+    ngx_free(deflate_dummy_zstream);
+    deflate_dummy_zstream = NULL;
+  }
+  return NGX_OK;
+}
+
+#define ZLIB_CHUNK 16384
+
+static ngx_temp_file_t *make_temp_file(ngx_http_request_t *r, ngx_pool_t *pool) {
+  ngx_temp_file_t           *tf;
+  ngx_path_t                *temp_path;
+  if(r) {
+    ngx_http_core_loc_conf_t  *clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
+    temp_path = clcf->client_body_temp_path;
+  }
+  else {
+    temp_path = message_temp_path;
+  }
+  tf = ngx_pcalloc(pool, sizeof(*tf));
+  if(!tf) {
+    if(r) {
+      nchan_log_request_error(r, "failed to allocate space for temp_file struct.");
+    } else {
+      nchan_log_error("failed to allocate space for temp_file struct.");
+    }
+    return NULL;
+  }
+  tf->file.fd = NGX_INVALID_FILE;
+  if(r) {
+    tf->file.log = r->connection->log;
+  }
+  else if(pool && pool->log) {
+    tf->file.log = pool->log;
+  }
+  else {
+    tf->file.log = ngx_cycle->log;
+  }
+  tf->path = temp_path;
+  tf->pool = pool;
+  tf->persistent = 1;
+  tf->clean = 0; //this will close the file on pool cleanup
+  tf->access = 0;
+  if(ngx_create_temp_file(&tf->file, tf->path, tf->pool, tf->persistent, tf->clean, tf->access) != NGX_OK) {
+    if(r) {
+      nchan_log_request_error(r, "failed to create temp file for deflated message");
+    } else {
+      nchan_log_error("failed to create temp file for deflated message");
+    }
+    return NULL;
+  }
+  return tf;
+}
+
+ngx_buf_t *nchan_common_deflate(ngx_buf_t *in, ngx_http_request_t *r, ngx_pool_t *pool) {
+  ngx_str_t           mm_instr;
+  int                 mmapped = 0;
+  ngx_temp_file_t    *tf = NULL;
+  
+  int                 rc;
+  ngx_buf_t          *out = NULL;
+  u_char              outbuf[ZLIB_CHUNK];
+  unsigned            have = 0;
+  off_t               written = 0;
+  
+  //input
+  
+  if(ngx_buf_in_memory(in)) {
+    deflate_zstream->avail_in = ngx_buf_size(in);
+    deflate_zstream->next_in = in->pos;
+  }
+  else {
+    ngx_fd_t fd = in->file->fd == NGX_INVALID_FILE ? nchan_fdcache_get(&in->file->name) : in->file->fd;
+    mm_instr.len = in->file_last - in->file_pos;
+    mm_instr.data = mmap(NULL, mm_instr.len, PROT_READ, MAP_SHARED, fd, in->file_pos);
+    if (mm_instr.data == MAP_FAILED) {
+      nchan_log_request_error(r, "failed to mmap input file for deflated message");
+      return NULL;
+    }
+    deflate_zstream->avail_in = mm_instr.len;
+    deflate_zstream->next_in = mm_instr.data;
+    mmapped = 1;
+  }
+
+  //output
+  
+  do {
+    deflate_zstream->avail_out = ZLIB_CHUNK;
+    deflate_zstream->next_out = outbuf;
+    
+    rc = deflate(deflate_zstream, Z_SYNC_FLUSH);
+    assert(rc != Z_STREAM_ERROR);
+    
+    have = ZLIB_CHUNK - deflate_zstream->avail_out;
+    
+    if(deflate_zstream->avail_out == 0 && tf == NULL) {
+      //if we filled up the buffer, let's start dumping to a file.
+      tf = make_temp_file(r, pool);
+      if(tf == NULL) { //couldn't make temp file for some reason
+        nchan_log_request_error(r, "failed to allocate output buf for deflated message");
+        deflateReset(deflate_zstream);
+        return NULL;
+      }
+    }
+    if(tf) {
+      ngx_write_file(&tf->file, outbuf, have, written);
+    }
+    
+    written += have;
+  } while(rc != Z_BUF_ERROR);
+  
+  if(mmapped) {
+    munmap(mm_instr.data, mm_instr.len);
+  }
+  
+  if((out = ngx_palloc(pool, sizeof(*out))) == NULL) {
+    nchan_log_request_error(r, "failed to allocate output buf for deflated message");
+    deflateReset(deflate_zstream);
+    return NULL;
+  }
+  
+  if(written > 4) { //there will be a 00 00 FF FF chunk at the end. remove it as the permessage-deflate spec demands
+    written -= 4;
+  }
+  
+  if(tf) { //using a tempfile
+    //thanks to tf->clean = 0, file will be closed on pool cleanup
+    ngx_memzero(out, sizeof(*out));
+    out->file_pos = 0;
+    out->file_last = written;
+    out->in_file = 1;
+    out->file = &tf->file;
+  }
+  else {
+    u_char  *outpooled = ngx_palloc(pool, written);
+    if(!outpooled) {
+      nchan_log_request_error(r, "failed to allocate output data for deflated message");
+      deflateReset(deflate_zstream);
+      return NULL;
+    }
+    ngx_memcpy(outpooled, outbuf, written);
+    ngx_init_set_membuf(out, outpooled, outpooled + written);
+  }
+  out->last_buf = 1;
+  
+  deflateReset(deflate_zstream);
+  return out;
+}
+
+ngx_buf_t *nchan_inflate(z_stream *stream, ngx_buf_t *in, ngx_http_request_t *r, ngx_pool_t *pool) {
+  ngx_str_t           mm_instr = {0, NULL};
+  int                 mmapped = 0;
+  ngx_temp_file_t    *tf = NULL;
+  
+  int                 rc;
+  ngx_buf_t          *out = NULL;
+  u_char              outbuf[ZLIB_CHUNK];
+  unsigned            have = 0;
+  off_t               written = 0;
+  int                 trailer_appended = 0;
+  
+  //input
+  if(ngx_buf_in_memory(in)) {
+    stream->avail_in = ngx_buf_size(in);
+    stream->next_in = in->pos;
+  }
+  else {
+    ngx_fd_t fd = in->file->fd == NGX_INVALID_FILE ? nchan_fdcache_get(&in->file->name) : in->file->fd;
+    mm_instr.len = in->file_last - in->file_pos;
+    mm_instr.data = mmap(NULL, mm_instr.len, PROT_READ, MAP_SHARED, fd, in->file_pos);
+    if (mm_instr.data == MAP_FAILED) {
+      nchan_log_request_error(r, "failed to mmap input file for deflated message");
+      return NULL;
+    }
+    stream->avail_in = mm_instr.len;
+    stream->next_in = mm_instr.data;
+    mmapped = 1;
+  }
+
+  //output
+  
+  do {
+    stream->avail_out = ZLIB_CHUNK;
+    stream->next_out = outbuf;
+    
+    if(stream->avail_in == 0 && !trailer_appended) {
+      stream->avail_in = 4;
+      stream->next_in = (u_char *)"\x00\x00\xFF\xFF";
+      trailer_appended = 1;
+    }
+    rc = inflate(stream, trailer_appended ? Z_SYNC_FLUSH : Z_NO_FLUSH);
+    assert(rc != Z_STREAM_ERROR);
+    switch (rc) {
+      case Z_DATA_ERROR:
+        nchan_log_request_error(r, "inflate error %d: %s", rc, stream->msg);
+        break;
+      case Z_NEED_DICT:
+      case Z_MEM_ERROR:
+        nchan_log_request_error(r, "inflate error %d", rc);
+        break;
+    }
+
+    have = ZLIB_CHUNK - stream->avail_out;
+    
+    if(stream->avail_out == 0 && tf == NULL) {
+      //if we filled up the buffer, let's start dumping to a file.
+      tf = make_temp_file(r, pool);
+    }
+    if(tf) {
+      ngx_write_file(&tf->file, outbuf, have, written);
+    }
+    written += have;
+  } while(rc == Z_OK);
+  
+  if(mmapped) {
+    munmap(mm_instr.data, mm_instr.len);
+  }
+  
+  if((out = ngx_palloc(pool, sizeof(*out))) == NULL) {
+    nchan_log_request_error(r, "failed to allocate output buf for deflated message");
+    deflateReset(deflate_zstream);
+    return NULL;
+  }
+  
+  if(tf) { //using a tempfile
+    //thanks to tf->clean = 0, file will be closed on pool cleanup
+    ngx_memzero(out, sizeof(*out));
+    out->file_pos = 0;
+    out->file_last = written;
+    out->in_file = 1;
+    out->file = &tf->file;
+  }
+  else {
+    u_char  *outpooled = ngx_palloc(pool, written);
+    if(!outpooled) {
+      nchan_log_request_error(r, "failed to allocate output data for deflated message");
+      deflateReset(deflate_zstream);
+      return NULL;
+    }
+    ngx_memcpy(outpooled, outbuf, written);
+    ngx_init_set_membuf(out, outpooled, outpooled + written);
+  }
+  out->last_buf = 1;
+  
+  deflateReset(deflate_zstream);
+  return out;
+}
+
+
+static ngx_int_t nchan_common_simple_deflate_internal(z_stream *strm, ngx_str_t *in, ngx_str_t *out) {
+  int rc;
+  strm->avail_in = in->len;
+  strm->next_in = in->data;
+
+  //output
+  strm->avail_out = out->len;
+  strm->next_out = out->data;
+
+  rc = deflate(strm, Z_SYNC_FLUSH);
+  if(rc != Z_STREAM_ERROR) {
+    out->len = strm->total_out;
+  }
+  
+  deflateReset(strm);
+  
+  return rc != Z_STREAM_ERROR ? NGX_OK : NGX_ERROR;
+}
+
+ngx_int_t nchan_common_simple_deflate(ngx_str_t *in, ngx_str_t *out) {
+  return nchan_common_simple_deflate_internal(deflate_zstream, in, out);
+}
+
+ngx_int_t nchan_common_simple_deflate_raw_block(ngx_str_t *in, ngx_str_t *out) {
+  return nchan_common_simple_deflate_internal(deflate_dummy_zstream, in, out);
+}
+  
+#endif
+
+ngx_flag_t nchan_need_to_deflate_message(nchan_loc_conf_t *cf) {
+#if (NGX_ZLIB)
+  if(cf->redis.enabled && cf->redis.storage_mode != REDIS_MODE_BACKUP) {
+    //redis mode ns non-backup storage mode gets the messages deflated later on
+    return 0;
+  }  
+  return cf->message_compression == NCHAN_MSG_COMPRESSION_WEBSOCKET_PERMESSAGE_DEFLATE;
+#else
+  return 0;
+#endif
+}
+
+ngx_int_t nchan_deflate_message_if_needed(nchan_msg_t *msg, nchan_loc_conf_t *cf, ngx_http_request_t *r, ngx_pool_t  *pool) {
+#if (NGX_ZLIB)
+  if(nchan_need_to_deflate_message(cf)) {
+    msg->compressed = ngx_pcalloc(pool, sizeof(*msg->compressed));
+    if(!msg->compressed) {
+      if(r) {
+        nchan_log_request_error(r, "no memory to compress message");
+      }
+      else {
+        nchan_log_error("no memory to compress message");
+      }
+    }
+    else {
+      ngx_buf_t  *compressed_buf = nchan_common_deflate(&msg->buf, r, pool);
+      if(!compressed_buf) {
+        if(r) {
+          nchan_log_request_error(r, "failed to compress message");
+        }
+        else {
+          nchan_log_error("failed to compress message");
+        }
+      }
+      else {
+        msg->compressed->compression = cf->message_compression;
+        msg->compressed->buf = *compressed_buf;
+      }
+    }
+  }
+  return NGX_OK;
+#else
+  return NGX_DECLINED;
+#endif
+}
+
+static uint64_t flip_uint64_if_little_endian(uint64_t value) {
+int num = 42;
+  if (*(char *)&num == 42) {
+    uint32_t high_part = htonl((uint32_t)(value >> 32));
+    uint32_t low_part = htonl((uint32_t)(value & 0xFFFFFFFFLL));
+    return (((uint64_t)low_part) << 32) | high_part;
+  } else {
+    return value;
+  }
+}
+
+uint64_t nchan_htonll(uint64_t value) {
+  return flip_uint64_if_little_endian(value); 
+}
+uint64_t nchan_ntohll(uint64_t value) {
+  return flip_uint64_if_little_endian(value);
+}
+
 #if (NGX_DEBUG_POOL)
 //Copyright (C) 2015 Alibaba Group Holding Limited
 static ngx_str_t            debug_pool_str;
diff --git a/debian/modules/nchan/src/util/nchan_util.h b/debian/modules/nchan/src/util/nchan_util.h
index f7ae941d..3dd2358a 100644
--- a/debian/modules/nchan/src/util/nchan_util.h
+++ b/debian/modules/nchan/src/util/nchan_util.h
@@ -1,23 +1,52 @@
+#include <string.h>
+#include <stddef.h>
+#ifndef NCHAN_HAVE_MEMRCHR
+void *memrchr(const void *s, int c, size_t n);
+#endif
 ngx_int_t ngx_http_complex_value_noalloc(ngx_http_request_t *r, ngx_http_complex_value_t *val, ngx_str_t *value, size_t maxlen);
+ngx_int_t ngx_http_complex_value_custom_pool(ngx_http_request_t *r, ngx_http_complex_value_t *val, ngx_str_t *value, ngx_pool_t *pool);
 u_char *nchan_strsplit(u_char **s1, ngx_str_t *sub, u_char *last_char);
 ngx_str_t *nchan_get_header_value(ngx_http_request_t * r, ngx_str_t header_name);
+ngx_str_t *nchan_get_header_value_origin(ngx_http_request_t *r, nchan_request_ctx_t *ctx);
+
+int nchan_match_origin_header(ngx_http_request_t *r, nchan_loc_conf_t *cf, nchan_request_ctx_t *ctx);
+ngx_str_t *nchan_get_allow_origin_value(ngx_http_request_t *r, nchan_loc_conf_t *cf, nchan_request_ctx_t *ctx);
+
 ngx_str_t *nchan_get_accept_header_value(ngx_http_request_t *r);
 ngx_buf_t *nchan_chain_to_single_buffer(ngx_pool_t *pool, ngx_chain_t *chain, size_t content_length);
 ngx_str_t *ngx_http_debug_pool_str(ngx_pool_t *pool);
 int nchan_strmatch(ngx_str_t *val, ngx_int_t n, ...);
 int nchan_cstrmatch(char *cstr, ngx_int_t n, ...);
 int nchan_cstr_startswith(char *cstr, char *match);
+int nchan_str_startswith(ngx_str_t *str, const char *match);
+int nchan_str_after(ngx_str_t **str, const char *match);
 
-void nchan_scan_nearest_chr(u_char **cur, ngx_str_t *str, ngx_int_t n, ...);
+void nchan_scan_split_by_chr(u_char **cur, size_t max_len, ngx_str_t *str, u_char chr);
 void nchan_scan_until_chr_on_line(ngx_str_t *line, ngx_str_t *str, u_char chr);
+int nchan_get_rest_of_line_in_cstr(const char *cstr, const char *line_start, ngx_str_t *rest);
 
 int nchan_ngx_str_match(ngx_str_t *str1, ngx_str_t *str2);
+int nchan_ngx_str_nonzero_match(ngx_str_t *str1, ngx_str_t *str2);
+int nchan_cstr_match_line(const char *cstr, const char *line);
 
 void nchan_strcpy(ngx_str_t *dst, ngx_str_t *src, size_t maxlen);
 ngx_int_t nchan_init_timer(ngx_event_t *ev, void (*cb)(ngx_event_t *), void *pd);
-ngx_int_t nchan_add_oneshot_timer(void (*cb)(void *), void *pd, ngx_msec_t delay);
-char *nchan_msgstatus_to_str(nchan_msg_status_t status);
+void *nchan_add_oneshot_timer(void (*cb)(void *), void *pd, ngx_msec_t delay);
+void nchan_abort_oneshot_timer(void *timer);
+
+void *nchan_add_interval_timer(ngx_int_t (*cb)(void *), void *pd, ngx_msec_t interval);
+void nchan_abort_interval_timer(void *t);
+int nchan_strscanstr(u_char **cur, ngx_str_t *find, u_char *last);
+
+char *nchan_conf_set_size_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
+ssize_t nchan_parse_size(ngx_str_t *line);
 
+void ngx_init_set_membuf(ngx_buf_t *buf, u_char *start, u_char *end);
+void ngx_init_set_membuf_str(ngx_buf_t *buf, ngx_str_t *str);
+#define ngx_init_set_membuf_char(buf, str) \
+  ngx_init_set_membuf(buf, (u_char *)str, ((u_char *)str) + sizeof(str)-1)
+
+ngx_str_t *nchan_urldecode_str(ngx_http_request_t *r, ngx_str_t *str);
 
 int nchan_ngx_str_char_substr(ngx_str_t *str, char *substr, size_t sz);
 #define nchan_ngx_str_substr(str, substr) \
@@ -31,3 +60,18 @@ int nchan_ngx_str_char_substr(ngx_str_t *str, char *substr, size_t sz);
         const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
         (type *)( (char *)__mptr - offsetof(type,member) );})
 #endif
+
+ngx_flag_t nchan_need_to_deflate_message(nchan_loc_conf_t *cf);
+ngx_int_t nchan_deflate_message_if_needed(nchan_msg_t *msg, nchan_loc_conf_t *cf, ngx_http_request_t *r, ngx_pool_t  *pool);
+#if (NGX_ZLIB)
+#include <zlib.h>
+ngx_int_t nchan_common_deflate_shutdown(void);
+ngx_int_t nchan_common_deflate_init(nchan_main_conf_t  *mcf);
+ngx_buf_t *nchan_common_deflate(ngx_buf_t *in, ngx_http_request_t *r, ngx_pool_t *pool);
+ngx_int_t nchan_common_simple_deflate_raw_block(ngx_str_t *in, ngx_str_t *out);
+ngx_int_t nchan_common_simple_deflate(ngx_str_t *in, ngx_str_t *out);
+ngx_buf_t *nchan_inflate(z_stream *stream, ngx_buf_t *in, ngx_http_request_t *r, ngx_pool_t *pool);
+
+uint64_t nchan_htonll(uint64_t value);
+uint64_t nchan_ntohll(uint64_t value);
+#endif
diff --git a/debian/modules/nchan/src/util/ngx_nchan_hacked_slab.c b/debian/modules/nchan/src/util/ngx_nchan_hacked_slab.c
index 98b6b8de..5670b73e 100644
--- a/debian/modules/nchan/src/util/ngx_nchan_hacked_slab.c
+++ b/debian/modules/nchan/src/util/ngx_nchan_hacked_slab.c
@@ -4,6 +4,8 @@
  * Copyright (C) Nginx, Inc.
  */
 
+#if nginx_version <= 1011006
+
 #include "ngx_nchan_hacked_slab.h"
 
 #define NGX_SLAB_PAGE_MASK   3
@@ -764,3 +766,5 @@ ngx_slab_error(ngx_slab_pool_t *pool, ngx_uint_t level, char *text)
 {
     ngx_log_error(level, ngx_cycle->log, 0, "%s%s", text, pool->log_ctx);
 }
+
+#endif
diff --git a/debian/modules/nchan/src/util/shmem.c b/debian/modules/nchan/src/util/shmem.c
index 9a68240e..817579dd 100644
--- a/debian/modules/nchan/src/util/shmem.c
+++ b/debian/modules/nchan/src/util/shmem.c
@@ -1,7 +1,11 @@
 #include <nchan_module.h>
 #include "shmem.h"
 #include "assert.h"
+
+#if nginx_version <= 1011006
+//old ugly slab-hack to track alloc'd pages
 #include <util/ngx_nchan_hacked_slab.h>
+#endif
 
 #define DEBUG_SHM_ALLOC 0
 
@@ -45,23 +49,42 @@ shmem_t *shm_create(ngx_str_t *name, ngx_conf_t *cf, size_t shm_size, ngx_int_t
   return shm;
 }
 
+#if nginx_version <= 1011006
 void shm_set_allocd_pages_tracker(shmem_t *shm, ngx_atomic_uint_t *ptr) {
   nchan_slab_set_reserved_pages_tracker(SHPOOL(shm), ptr);
 }
+#else
+size_t shm_used_pages(shmem_t *shm) {
+  ngx_slab_pool_t    *shpool = SHPOOL(shm);
+  ngx_slab_page_t    *slots = (ngx_slab_page_t *) ((u_char *) (shpool) + sizeof(ngx_slab_pool_t));
+  size_t              size = shpool->end - (u_char *) slots;
+  
+  ngx_uint_t          max = (ngx_uint_t) (size / (ngx_pagesize + sizeof(ngx_slab_page_t)));
+  return max - shpool->pfree;
+}
+#endif
 
 ngx_int_t shm_init(shmem_t *shm) {
   ngx_slab_pool_t    *shpool = SHPOOL(shm);
   #if (DEBUG_SHM_ALLOC == 1)
   ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "nchan_shpool start %p size %i", shpool->start, (u_char *)shpool->end - (u_char *)shpool->start);
   #endif
+#if nginx_version <= 1011006
   nchan_slab_init(shpool);
+#else
+  ngx_slab_init(shpool);
+#endif  
   
   return NGX_OK;
 }
 
 ngx_int_t shm_reinit(shmem_t *shm) {
   ngx_slab_pool_t    *shpool = SHPOOL(shm);
+#if nginx_version <= 1011006
   nchan_slab_init(shpool);
+#else
+  ngx_slab_init(shpool);
+#endif  
   
   return NGX_OK;
 }
@@ -81,10 +104,14 @@ ngx_int_t shm_destroy(shmem_t *shm) {
 }
 void *shm_alloc(shmem_t *shm, size_t size, const char *label) {
   void         *p;
-#if FAKESHARD  
+#if (FAKESHARD || FAKE_SHMEM)
   p = ngx_alloc(size, ngx_cycle->log);
 #else
+  #if nginx_version <= 1011006
   p = nchan_slab_alloc(SHPOOL(shm), size);  
+  #else
+  p = ngx_slab_alloc(SHPOOL(shm), size);
+  #endif
 #endif
   if(p == NULL) {
     ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "shpool alloc failed");
@@ -107,10 +134,14 @@ void *shm_calloc(shmem_t *shm, size_t size, const char *label) {
 }
 
 void shm_free(shmem_t *shm, void *p) {
-#if FAKESHARD
+#if (FAKESHARD || FAKE_SHMEM)
   ngx_free(p);
 #else
+  #if nginx_version <= 1011006
   nchan_slab_free(SHPOOL(shm), p);
+  #else
+  ngx_slab_free(SHPOOL(shm), p);
+  #endif
 #endif
 #if (DEBUG_SHM_ALLOC == 1)
   ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "shpool free addr %p", p);
@@ -123,10 +154,14 @@ void shm_free(shmem_t *shm, void *p) {
 
 void *shm_locked_alloc(shmem_t *shm, size_t size, const char *label) {
   void         *p;
-#if FAKESHARD  
+#if (FAKESHARD || FAKE_SHMEM)
   p = ngx_alloc(size, ngx_cycle->log);
 #else
-  p = nchan_slab_alloc_locked(SHPOOL(shm), size);  
+  #if nginx_version <= 1011006
+  p = nchan_slab_alloc_locked(SHPOOL(shm), size);
+  #else 
+  p = ngx_slab_alloc_locked(SHPOOL(shm), size);
+  #endif
 #endif
   if(p == NULL) {
     ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0, "shpool alloc failed");
@@ -149,10 +184,14 @@ void *shm_locked_calloc(shmem_t *shm, size_t size, const char *label) {
 }
 
 void shm_locked_free(shmem_t *shm, void *p) {
-#if FAKESHARD
+#if (FAKESHARD || FAKE_SHMEM)
   ngx_free(p);
 #else
+  #if nginx_version <= 1011006
   nchan_slab_free_locked(SHPOOL(shm), p);
+  #else
+  ngx_slab_free_locked(SHPOOL(shm), p);
+  #endif
 #endif
 #if (DEBUG_SHM_ALLOC == 1)
   ngx_log_error(NGX_LOG_WARN, ngx_cycle->log, 0, "shpool free addr %p", p);
diff --git a/debian/modules/nchan/src/util/shmem.h b/debian/modules/nchan/src/util/shmem.h
index 18514c43..52417dca 100644
--- a/debian/modules/nchan/src/util/shmem.h
+++ b/debian/modules/nchan/src/util/shmem.h
@@ -23,6 +23,11 @@ ngx_str_t        *shm_copy_immutable_string(shmem_t *shm, ngx_str_t *str);
 void              shm_free_immutable_string(shmem_t *shm, ngx_str_t *str);
 void              shm_verify_immutable_string(shmem_t *shm, ngx_str_t *str);
 
+#if nginx_version <= 1011006
 void shm_set_allocd_pages_tracker(shmem_t *shm, ngx_atomic_uint_t *ptr);
+#else
+ngx_uint_t shm_used_pages(shmem_t *shm);
+#endif
+
 
 #endif //NCHAN_SHMEM_H
diff --git a/debian/modules/patches/http-lua/CVE-2020-11724.patch b/debian/modules/patches/http-lua/CVE-2020-11724.patch
new file mode 100644
index 00000000..5e0eff79
--- /dev/null
+++ b/debian/modules/patches/http-lua/CVE-2020-11724.patch
@@ -0,0 +1,856 @@
+From 9ab38e8ee35fc08a57636b1b6190dca70b0076fa Mon Sep 17 00:00:00 2001
+From: Thibault Charbonnier <thibaultcha@me.com>
+Date: Mon, 23 Mar 2020 19:40:47 -0700
+Origin: https://github.com/openresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076fa
+Subject: [PATCH] bugfix: prevented request smuggling in the
+ ngx.location.capture API.
+
+Signed-off-by: Yichun Zhang (agentzh) <yichun@openresty.com>
+---
+ src/ngx_http_lua_subrequest.c | 196 +++++--------
+ t/020-subrequest.t            | 520 +++++++++++++++++++++++++++++++++-
+ 2 files changed, 585 insertions(+), 131 deletions(-)
+
+Index: http-lua/src/ngx_http_lua_subrequest.c
+===================================================================
+--- http-lua.orig/src/ngx_http_lua_subrequest.c	2020-07-14 09:50:35.830928117 +0200
++++ http-lua/src/ngx_http_lua_subrequest.c	2020-07-14 09:50:35.826928232 +0200
+@@ -56,8 +56,6 @@
+     ngx_string("Content-Length");
+ 
+ 
+-static ngx_int_t ngx_http_lua_set_content_length_header(ngx_http_request_t *r,
+-    off_t len);
+ static ngx_int_t ngx_http_lua_adjust_subrequest(ngx_http_request_t *sr,
+     ngx_uint_t method, int forward_body,
+     ngx_http_request_body_t *body, unsigned vars_action,
+@@ -78,7 +76,7 @@
+ static ngx_int_t ngx_http_post_request_to_head(ngx_http_request_t *r);
+ static ngx_int_t ngx_http_lua_copy_in_file_request_body(ngx_http_request_t *r);
+ static ngx_int_t ngx_http_lua_copy_request_headers(ngx_http_request_t *sr,
+-    ngx_http_request_t *r);
++    ngx_http_request_t *pr, int pr_not_chunked);
+ 
+ 
+ /* ngx.location.capture is just a thin wrapper around
+@@ -628,8 +626,8 @@
+     unsigned vars_action, ngx_array_t *extra_vars)
+ {
+     ngx_http_request_t          *r;
+-    ngx_int_t                    rc;
+     ngx_http_core_main_conf_t   *cmcf;
++    int                          pr_not_chunked = 0;
+     size_t                       size;
+ 
+     r = sr->parent;
+@@ -639,46 +637,32 @@
+     if (body) {
+         sr->request_body = body;
+ 
+-        rc = ngx_http_lua_set_content_length_header(sr,
+-                                                    body->buf
+-                                                    ? ngx_buf_size(body->buf)
+-                                                    : 0);
+-
+-        if (rc != NGX_OK) {
+-            return NGX_ERROR;
+-        }
+-
+     } else if (!always_forward_body
+                && method != NGX_HTTP_PUT
+                && method != NGX_HTTP_POST
+                && r->headers_in.content_length_n > 0)
+     {
+-        rc = ngx_http_lua_set_content_length_header(sr, 0);
+-        if (rc != NGX_OK) {
+-            return NGX_ERROR;
+-        }
+-
+-#if 1
+         sr->request_body = NULL;
+-#endif
+ 
+     } else {
+-        if (ngx_http_lua_copy_request_headers(sr, r) != NGX_OK) {
+-            return NGX_ERROR;
++        if (!r->headers_in.chunked) {
++            pr_not_chunked = 1;
+         }
+ 
+-        if (sr->request_body) {
++        if (sr->request_body && sr->request_body->temp_file) {
+ 
+             /* deep-copy the request body */
+ 
+-            if (sr->request_body->temp_file) {
+-                if (ngx_http_lua_copy_in_file_request_body(sr) != NGX_OK) {
+-                    return NGX_ERROR;
+-                }
++            if (ngx_http_lua_copy_in_file_request_body(sr) != NGX_OK) {
++                return NGX_ERROR;
+             }
+         }
+     }
+ 
++    if (ngx_http_lua_copy_request_headers(sr, r, pr_not_chunked) != NGX_OK) {
++        return NGX_ERROR;
++    }
++
+     sr->method = method;
+ 
+     switch (method) {
+@@ -1124,100 +1108,6 @@
+ }
+ 
+ 
+-static ngx_int_t
+-ngx_http_lua_set_content_length_header(ngx_http_request_t *r, off_t len)
+-{
+-    ngx_table_elt_t                 *h, *header;
+-    u_char                          *p;
+-    ngx_list_part_t                 *part;
+-    ngx_http_request_t              *pr;
+-    ngx_uint_t                       i;
+-
+-    r->headers_in.content_length_n = len;
+-
+-    if (ngx_list_init(&r->headers_in.headers, r->pool, 20,
+-                      sizeof(ngx_table_elt_t)) != NGX_OK)
+-    {
+-        return NGX_ERROR;
+-    }
+-
+-    h = ngx_list_push(&r->headers_in.headers);
+-    if (h == NULL) {
+-        return NGX_ERROR;
+-    }
+-
+-    h->key = ngx_http_lua_content_length_header_key;
+-    h->lowcase_key = ngx_pnalloc(r->pool, h->key.len);
+-    if (h->lowcase_key == NULL) {
+-        return NGX_ERROR;
+-    }
+-
+-    ngx_strlow(h->lowcase_key, h->key.data, h->key.len);
+-
+-    r->headers_in.content_length = h;
+-
+-    p = ngx_palloc(r->pool, NGX_OFF_T_LEN);
+-    if (p == NULL) {
+-        return NGX_ERROR;
+-    }
+-
+-    h->value.data = p;
+-
+-    h->value.len = ngx_sprintf(h->value.data, "%O", len) - h->value.data;
+-
+-    h->hash = ngx_http_lua_content_length_hash;
+-
+-#if 0
+-    dd("content length hash: %lu == %lu", (unsigned long) h->hash,
+-       ngx_hash_key_lc((u_char *) "Content-Length",
+-                       sizeof("Content-Length") - 1));
+-#endif
+-
+-    dd("r content length: %.*s",
+-       (int) r->headers_in.content_length->value.len,
+-       r->headers_in.content_length->value.data);
+-
+-    pr = r->parent;
+-
+-    if (pr == NULL) {
+-        return NGX_OK;
+-    }
+-
+-    /* forward the parent request's all other request headers */
+-
+-    part = &pr->headers_in.headers.part;
+-    header = part->elts;
+-
+-    for (i = 0; /* void */; i++) {
+-
+-        if (i >= part->nelts) {
+-            if (part->next == NULL) {
+-                break;
+-            }
+-
+-            part = part->next;
+-            header = part->elts;
+-            i = 0;
+-        }
+-
+-        if (header[i].key.len == sizeof("Content-Length") - 1
+-            && ngx_strncasecmp(header[i].key.data, (u_char *) "Content-Length",
+-                               sizeof("Content-Length") - 1) == 0)
+-        {
+-            continue;
+-        }
+-
+-        if (ngx_http_lua_set_input_header(r, header[i].key,
+-                                          header[i].value, 0) == NGX_ERROR)
+-        {
+-            return NGX_ERROR;
+-        }
+-    }
+-
+-    return NGX_OK;
+-}
+-
+-
+ static void
+ ngx_http_lua_handle_subreq_responses(ngx_http_request_t *r,
+     ngx_http_lua_ctx_t *ctx)
+@@ -1732,11 +1622,17 @@
+ 
+ 
+ static ngx_int_t
+-ngx_http_lua_copy_request_headers(ngx_http_request_t *sr, ngx_http_request_t *r)
++ngx_http_lua_copy_request_headers(ngx_http_request_t *sr,
++    ngx_http_request_t *pr, int pr_not_chunked)
+ {
+-    ngx_table_elt_t                 *header;
++    ngx_table_elt_t                 *clh, *header;
+     ngx_list_part_t                 *part;
+     ngx_uint_t                       i;
++    u_char                          *p;
++    off_t                            len;
++
++    dd("before: parent req headers count: %d",
++       (int) pr->headers_in.headers.part.nelts);
+ 
+     if (ngx_list_init(&sr->headers_in.headers, sr->pool, 20,
+                       sizeof(ngx_table_elt_t)) != NGX_OK)
+@@ -1744,10 +1640,46 @@
+         return NGX_ERROR;
+     }
+ 
+-    dd("before: parent req headers count: %d",
+-       (int) r->headers_in.headers.part.nelts);
++    if (sr->request_body && !pr_not_chunked) {
++
++        /* craft our own Content-Length */
++
++        len = sr->request_body->buf ? ngx_buf_size(sr->request_body->buf) : 0;
++
++        clh = ngx_list_push(&sr->headers_in.headers);
++        if (clh == NULL) {
++            return NGX_ERROR;
++        }
+ 
+-    part = &r->headers_in.headers.part;
++        clh->hash = ngx_http_lua_content_length_hash;
++        clh->key = ngx_http_lua_content_length_header_key;
++        clh->lowcase_key = ngx_pnalloc(sr->pool, clh->key.len);
++        if (clh->lowcase_key == NULL) {
++            return NGX_ERROR;
++        }
++
++        ngx_strlow(clh->lowcase_key, clh->key.data, clh->key.len);
++
++        p = ngx_palloc(sr->pool, NGX_OFF_T_LEN);
++        if (p == NULL) {
++            return NGX_ERROR;
++        }
++
++        clh->value.data = p;
++        clh->value.len = ngx_sprintf(clh->value.data, "%O", len)
++                         - clh->value.data;
++
++        sr->headers_in.content_length = clh;
++        sr->headers_in.content_length_n = len;
++
++        dd("sr crafted content-length: %.*s",
++           (int) sr->headers_in.content_length->value.len,
++           sr->headers_in.content_length->value.data);
++    }
++
++    /* copy the parent request's headers */
++
++    part = &pr->headers_in.headers.part;
+     header = part->elts;
+ 
+     for (i = 0; /* void */; i++) {
+@@ -1762,7 +1694,14 @@
+             i = 0;
+         }
+ 
+-        dd("setting request header %.*s: %.*s", (int) header[i].key.len,
++        if (!pr_not_chunked && header[i].key.len == sizeof("Content-Length") - 1
++            && ngx_strncasecmp(header[i].key.data, (u_char *) "Content-Length",
++                               sizeof("Content-Length") - 1) == 0)
++        {
++            continue;
++        }
++
++        dd("sr copied req header %.*s: %.*s", (int) header[i].key.len,
+            header[i].key.data, (int) header[i].value.len,
+            header[i].value.data);
+ 
+@@ -1774,9 +1713,10 @@
+     }
+ 
+     dd("after: parent req headers count: %d",
+-       (int) r->headers_in.headers.part.nelts);
++       (int) pr->headers_in.headers.part.nelts);
+ 
+     return NGX_OK;
+ }
+ 
++
+ /* vi:set ft=c ts=4 sw=4 et fdm=marker: */
+Index: http-lua/t/020-subrequest.t
+===================================================================
+--- http-lua.orig/t/020-subrequest.t	2020-07-14 09:50:35.830928117 +0200
++++ http-lua/t/020-subrequest.t	2020-07-14 09:50:35.826928232 +0200
+@@ -14,6 +14,7 @@
+ plan tests => repeat_each() * (blocks() * 3 + 23);
+ 
+ $ENV{TEST_NGINX_MEMCACHED_PORT} ||= 11211;
++$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
+ 
+ #no_diff();
+ no_long_string();
+@@ -210,7 +211,7 @@
+ 
+ 
+ 
+-=== TEST 8: PUT (nobody, proxy method)
++=== TEST 8: PUT (with body, proxy method)
+ --- config
+     location /other {
+         default_type 'foo/bar';
+@@ -242,7 +243,7 @@
+ 
+ 
+ 
+-=== TEST 9: PUT (nobody, no proxy method)
++=== TEST 9: PUT (with body, no proxy method)
+ --- config
+     location /other {
+         default_type 'foo/bar';
+@@ -271,7 +272,7 @@
+ 
+ 
+ 
+-=== TEST 10: PUT (nobody, no proxy method)
++=== TEST 10: PUT (no body, no proxy method)
+ --- config
+     location /other {
+         default_type 'foo/bar';
+@@ -2877,3 +2878,516 @@
+ --- no_error_log
+ [error]
+ --- error_code: 200
++
++
++
++=== TEST 77: avoid request smuggling 1/4 (default capture + smuggle in header)
++--- http_config
++    upstream backend {
++        server unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++        keepalive 32;
++    }
++
++    server {
++        listen unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++
++        location / {
++            content_by_lua_block {
++                ngx.say("method: ", ngx.var.request_method,
++                        ", uri: ", ngx.var.uri,
++                        ", X: ", ngx.var.http_x)
++            }
++        }
++    }
++--- config
++    location /proxy {
++        proxy_http_version 1.1;
++        proxy_set_header   Connection "";
++        proxy_pass         http://backend/foo;
++    }
++
++    location /capture {
++        server_tokens off;
++        more_clear_headers Date;
++
++        content_by_lua_block {
++            local res = ngx.location.capture("/proxy")
++            ngx.print(res.body)
++        }
++    }
++
++    location /t {
++        content_by_lua_block {
++            local req = [[
++GET /capture HTTP/1.1
++Host: test.com
++Content-Length: 37
++Transfer-Encoding: chunked
++
++0
++
++GET /capture HTTP/1.1
++Host: test.com
++X: GET /bar HTTP/1.0
++
++]]
++
++            local sock = ngx.socket.tcp()
++            sock:settimeout(1000)
++
++            local ok, err = sock:connect("127.0.0.1", $TEST_NGINX_SERVER_PORT)
++            if not ok then
++                ngx.say("failed to connect: ", err)
++                return
++            end
++
++            local bytes, err = sock:send(req)
++            if not bytes then
++                ngx.say("failed to send req: ", err)
++                return
++            end
++
++            ngx.say("req bytes: ", bytes)
++
++            local n_resp = 0
++
++            local reader = sock:receiveuntil("\r\n")
++            while true do
++                local line, err = reader()
++                if line then
++                    ngx.say(line)
++                    if line == "0" then
++                        n_resp = n_resp + 1
++                    end
++
++                    if n_resp >= 2 then
++                        break
++                    end
++
++                else
++                    ngx.say("err: ", err)
++                    break
++                end
++            end
++
++            sock:close()
++        }
++    }
++--- request
++GET /t
++--- response_body
++req bytes: 146
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++1f
++method: GET, uri: /foo, X: nil
++
++0
++
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++2d
++method: GET, uri: /foo, X: GET /bar HTTP/1.0
++
++0
++--- no_error_log
++[error]
++
++
++
++=== TEST 78: avoid request smuggling 2/4 (POST capture + smuggle in body)
++--- http_config
++    upstream backend {
++        server unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++        keepalive 32;
++    }
++
++    server {
++        listen unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++
++        location / {
++            content_by_lua_block {
++                ngx.say("method: ", ngx.var.request_method,
++                        ", uri: ", ngx.var.uri)
++            }
++        }
++    }
++--- config
++    location /proxy {
++        proxy_http_version 1.1;
++        proxy_set_header   Connection "";
++        proxy_pass         http://backend/foo;
++    }
++
++    location /capture {
++        server_tokens off;
++        more_clear_headers Date;
++
++        content_by_lua_block {
++            ngx.req.read_body()
++            local res = ngx.location.capture("/proxy", { method = ngx.HTTP_POST })
++            ngx.print(res.body)
++        }
++    }
++
++    location /t {
++        content_by_lua_block {
++            local req = [[
++GET /capture HTTP/1.1
++Host: test.com
++Content-Length: 57
++Transfer-Encoding: chunked
++
++0
++
++POST /capture HTTP/1.1
++Host: test.com
++Content-Length: 60
++
++POST /bar HTTP/1.1
++Host: test.com
++Content-Length: 5
++
++hello
++
++]]
++
++            local sock = ngx.socket.tcp()
++            sock:settimeout(1000)
++
++            local ok, err = sock:connect("127.0.0.1", $TEST_NGINX_SERVER_PORT)
++            if not ok then
++                ngx.say("failed to connect: ", err)
++                return
++            end
++
++            local bytes, err = sock:send(req)
++            if not bytes then
++                ngx.say("failed to send req: ", err)
++                return
++            end
++
++            ngx.say("req bytes: ", bytes)
++
++            local n_resp = 0
++
++            local reader = sock:receiveuntil("\r\n")
++            while true do
++                local line, err = reader()
++                if line then
++                    ngx.say(line)
++                    if line == "0" then
++                        n_resp = n_resp + 1
++                    end
++
++                    if n_resp >= 2 then
++                        break
++                    end
++
++                else
++                    ngx.say("err: ", err)
++                    break
++                end
++            end
++
++            sock:close()
++        }
++    }
++--- request
++GET /t
++--- response_body
++req bytes: 205
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++18
++method: POST, uri: /foo
++
++0
++
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++18
++method: POST, uri: /foo
++
++0
++--- no_error_log
++[error]
++
++
++
++=== TEST 79: avoid request smuggling 3/4 (POST capture w/ always_forward_body + smuggle in body)
++--- http_config
++    upstream backend {
++        server unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++        keepalive 32;
++    }
++
++    server {
++        listen unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++
++        location / {
++            content_by_lua_block {
++                ngx.say("method: ", ngx.var.request_method,
++                        ", uri: ", ngx.var.uri)
++            }
++        }
++    }
++--- config
++    location /proxy {
++        proxy_http_version 1.1;
++        proxy_set_header   Connection "";
++        proxy_pass         http://backend/foo;
++    }
++
++    location /capture {
++        server_tokens off;
++        more_clear_headers Date;
++
++        content_by_lua_block {
++            ngx.req.read_body()
++            local res = ngx.location.capture("/proxy", {
++                method = ngx.HTTP_POST,
++                always_forward_body = true
++            })
++            ngx.print(res.body)
++        }
++    }
++
++    location /t {
++        content_by_lua_block {
++            local req = [[
++GET /capture HTTP/1.1
++Host: test.com
++Content-Length: 57
++Transfer-Encoding: chunked
++
++0
++
++POST /capture HTTP/1.1
++Host: test.com
++Content-Length: 60
++
++POST /bar HTTP/1.1
++Host: test.com
++Content-Length: 5
++
++hello
++
++]]
++
++            local sock = ngx.socket.tcp()
++            sock:settimeout(1000)
++
++            local ok, err = sock:connect("127.0.0.1", $TEST_NGINX_SERVER_PORT)
++            if not ok then
++                ngx.say("failed to connect: ", err)
++                return
++            end
++
++            local bytes, err = sock:send(req)
++            if not bytes then
++                ngx.say("failed to send req: ", err)
++                return
++            end
++
++            ngx.say("req bytes: ", bytes)
++
++            local n_resp = 0
++
++            local reader = sock:receiveuntil("\r\n")
++            while true do
++                local line, err = reader()
++                if line then
++                    ngx.say(line)
++                    if line == "0" then
++                        n_resp = n_resp + 1
++                    end
++
++                    if n_resp >= 2 then
++                        break
++                    end
++
++                else
++                    ngx.say("err: ", err)
++                    break
++                end
++            end
++
++            sock:close()
++        }
++    }
++--- request
++GET /t
++--- response_body
++req bytes: 205
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++18
++method: POST, uri: /foo
++
++0
++
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++18
++method: POST, uri: /foo
++
++0
++--- no_error_log
++[error]
++
++
++
++=== TEST 80: avoid request smuggling 4/4 (POST capture w/ body + smuggle in body)
++--- http_config
++    upstream backend {
++        server unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++        keepalive 32;
++    }
++
++    server {
++        listen unix:$TEST_NGINX_HTML_DIR/nginx.sock;
++
++        location / {
++            content_by_lua_block {
++                ngx.say("method: ", ngx.var.request_method,
++                        ", uri: ", ngx.var.uri)
++            }
++        }
++    }
++--- config
++    location /proxy {
++        proxy_http_version 1.1;
++        proxy_set_header   Connection "";
++        proxy_pass         http://backend/foo;
++    }
++
++    location /capture {
++        server_tokens off;
++        more_clear_headers Date;
++
++        content_by_lua_block {
++            ngx.req.read_body()
++            local res = ngx.location.capture("/proxy", {
++                method = ngx.HTTP_POST,
++                always_forward_body = true,
++                body = ngx.req.get_body_data()
++            })
++            ngx.print(res.body)
++        }
++    }
++
++    location /t {
++        content_by_lua_block {
++            local req = [[
++GET /capture HTTP/1.1
++Host: test.com
++Content-Length: 57
++Transfer-Encoding: chunked
++
++0
++
++POST /capture HTTP/1.1
++Host: test.com
++Content-Length: 60
++
++POST /bar HTTP/1.1
++Host: test.com
++Content-Length: 5
++
++hello
++
++]]
++
++            local sock = ngx.socket.tcp()
++            sock:settimeout(1000)
++
++            local ok, err = sock:connect("127.0.0.1", $TEST_NGINX_SERVER_PORT)
++            if not ok then
++                ngx.say("failed to connect: ", err)
++                return
++            end
++
++            local bytes, err = sock:send(req)
++            if not bytes then
++                ngx.say("failed to send req: ", err)
++                return
++            end
++
++            ngx.say("req bytes: ", bytes)
++
++            local n_resp = 0
++
++            local reader = sock:receiveuntil("\r\n")
++            while true do
++                local line, err = reader()
++                if line then
++                    ngx.say(line)
++                    if line == "0" then
++                        n_resp = n_resp + 1
++                    end
++
++                    if n_resp >= 2 then
++                        break
++                    end
++
++                else
++                    ngx.say("err: ", err)
++                    break
++                end
++            end
++
++            sock:close()
++        }
++    }
++--- request
++GET /t
++--- response_body
++req bytes: 205
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++18
++method: POST, uri: /foo
++
++0
++
++HTTP/1.1 200 OK
++Server: nginx
++Content-Type: text/plain
++Transfer-Encoding: chunked
++Connection: keep-alive
++
++18
++method: POST, uri: /foo
++
++0
++--- no_error_log
++[error]
diff --git a/debian/modules/patches/http-lua/series b/debian/modules/patches/http-lua/series
index 6a8b245a..1c68a886 100644
--- a/debian/modules/patches/http-lua/series
+++ b/debian/modules/patches/http-lua/series
@@ -1 +1,2 @@
 discover-luajit-2.1.patch
+CVE-2020-11724.patch
diff --git a/debian/modules/watch/http-auth-pam b/debian/modules/watch/http-auth-pam
index 3fb5a27f..8c0a5c03 100644
--- a/debian/modules/watch/http-auth-pam
+++ b/debian/modules/watch/http-auth-pam
@@ -1,4 +1,4 @@
 version=4
 opts="dversionmangle=s/v//,filenamemangle=s%(?:.*?)?v?(\d[\d.]*)\.tar\.gz%libnginx-mod-http-auth-pam-$1.tar.gz%" \
-    https://github.com/stogh/ngx_http_auth_pam_module/tags \
+    https://github.com/sto/ngx_http_auth_pam_module/tags \
     (?:.*?/)?v?(\d[\d.]*)\.tar\.gz debian debian/ngxmod uupdate http-auth-pam
diff --git a/debian/modules/watch/http-geoip2 b/debian/modules/watch/http-geoip2
new file mode 100644
index 00000000..da23145a
--- /dev/null
+++ b/debian/modules/watch/http-geoip2
@@ -0,0 +1,4 @@
+version=4
+opts="dversionmangle=s/v//,filenamemangle=s%(?:.*?)?v?(\d[\d.]*)\.tar\.gz%libnginx-mod-http-geoip2-$1.tar.gz%" \
+    https://github.com/leev/ngx_http_geoip2_module/tags \
+    (?:.*?/)?v?(\d[\d.]*)\.tar\.gz debian debian/ngxmod uupdate http-geoip2
diff --git a/debian/nginx-common.maintscript b/debian/nginx-common.maintscript
new file mode 100644
index 00000000..e1e7f535
--- /dev/null
+++ b/debian/nginx-common.maintscript
@@ -0,0 +1,8 @@
+# Handle naxsi removal
+rm_conffile /etc/nginx/naxsi.rules         1.6.2-2~
+rm_conffile /etc/nginx/naxsi_core.rules    1.6.2-2~
+rm_conffile /etc/nginx/naxsi-ui.conf.1.4.1 1.6.2-2~
+rm_conffile /etc/nginx/naxsi-ui.conf       1.6.2-2~
+
+# Handle upstart removal
+rm_conffile /etc/init/nginx.conf           1.13.5-1~
diff --git a/debian/nginx-common.postinst b/debian/nginx-common.postinst
index f83032db..9e0610ec 100644
--- a/debian/nginx-common.postinst
+++ b/debian/nginx-common.postinst
@@ -3,20 +3,6 @@ set -e
 
 . /usr/share/debconf/confmodule
 
-# Handle naxsi removal
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi.rules         1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi_core.rules    1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi-ui.conf.1.4.1 1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi-ui.conf       1.6.2-2~ -- "$@"
-
-# Handle upstart removal
-dpkg-maintscript-helper rm_conffile \
-	          /etc/init/nginx.conf           1.13.5-1~ -- "$@"
-
 case "$1" in
   configure)
     logdir="/var/log/nginx"
diff --git a/debian/nginx-common.postrm b/debian/nginx-common.postrm
index d6f313ad..f5124c80 100644
--- a/debian/nginx-common.postrm
+++ b/debian/nginx-common.postrm
@@ -1,20 +1,6 @@
 #!/bin/sh
 set -e
 
-# Handle naxsi removal
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi.rules         1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi_core.rules    1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi-ui.conf.1.4.1 1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	          /etc/nginx/naxsi-ui.conf       1.6.2-2~ -- "$@"
-
-# Handle upstart removal
-dpkg-maintscript-helper rm_conffile \
-	          /etc/init/nginx.conf           1.13.5-1~ -- "$@"
-
 case "$1" in
   purge)
     rm -rf /var/lib/nginx /var/log/nginx /etc/nginx
diff --git a/debian/nginx-common.preinst b/debian/nginx-common.preinst
index 27f21da6..ead53f77 100644
--- a/debian/nginx-common.preinst
+++ b/debian/nginx-common.preinst
@@ -1,20 +1,6 @@
 #!/bin/sh
 set -e
 
-# Handle naxsi removal
-dpkg-maintscript-helper rm_conffile \
-	  /etc/nginx/naxsi.rules         1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	  /etc/nginx/naxsi_core.rules    1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	  /etc/nginx/naxsi-ui.conf.1.4.1 1.6.2-2~ -- "$@"
-dpkg-maintscript-helper rm_conffile \
-	  /etc/nginx/naxsi-ui.conf       1.6.2-2~ -- "$@"
-
-# Handle upstart removal
-dpkg-maintscript-helper rm_conffile \
-	  /etc/init/nginx.conf           1.13.5-1~ -- "$@"
-
 case "$1" in
   install)
     # If we are doing a fresh install, then these files are no longer needed.
diff --git a/debian/nginx-full.dirs b/debian/nginx-core.dirs
similarity index 100%
rename from debian/nginx-full.dirs
rename to debian/nginx-core.dirs
diff --git a/debian/nginx-core.install b/debian/nginx-core.install
new file mode 100644
index 00000000..a82f702d
--- /dev/null
+++ b/debian/nginx-core.install
@@ -0,0 +1 @@
+debian/build-core/objs/nginx usr/sbin
diff --git a/debian/nginx-core.manpages b/debian/nginx-core.manpages
new file mode 100644
index 00000000..3b6d0bde
--- /dev/null
+++ b/debian/nginx-core.manpages
@@ -0,0 +1 @@
+debian/build-core/objs/nginx.8
diff --git a/debian/nginx-full.postinst b/debian/nginx-core.postinst
similarity index 75%
rename from debian/nginx-full.postinst
rename to debian/nginx-core.postinst
index 2a1730f1..b43571ad 100644
--- a/debian/nginx-full.postinst
+++ b/debian/nginx-core.postinst
@@ -24,7 +24,12 @@ if [ -x /etc/init.d/nginx ]; then
     invoke-rc.d nginx upgrade || invoke-rc.d nginx restart
     exit $?
   else
-    invoke-rc.d nginx start || exit $?
+    if [ -z "$(ss -nlt 'sport = 80' | grep -v ^State)" ]; then
+      invoke-rc.d nginx start || exit $?
+    else
+      echo "Not attempting to start NGINX, port 80 is already in use."
+      exit 0
+    fi
   fi
 fi
 
diff --git a/debian/nginx-full.prerm b/debian/nginx-core.prerm
similarity index 100%
rename from debian/nginx-full.prerm
rename to debian/nginx-core.prerm
diff --git a/debian/nginx-full.triggers b/debian/nginx-core.triggers
similarity index 100%
rename from debian/nginx-full.triggers
rename to debian/nginx-core.triggers
diff --git a/debian/nginx-extras.postinst b/debian/nginx-extras.postinst
index 2a1730f1..b43571ad 100644
--- a/debian/nginx-extras.postinst
+++ b/debian/nginx-extras.postinst
@@ -24,7 +24,12 @@ if [ -x /etc/init.d/nginx ]; then
     invoke-rc.d nginx upgrade || invoke-rc.d nginx restart
     exit $?
   else
-    invoke-rc.d nginx start || exit $?
+    if [ -z "$(ss -nlt 'sport = 80' | grep -v ^State)" ]; then
+      invoke-rc.d nginx start || exit $?
+    else
+      echo "Not attempting to start NGINX, port 80 is already in use."
+      exit 0
+    fi
   fi
 fi
 
diff --git a/debian/nginx-full.install b/debian/nginx-full.install
deleted file mode 100644
index ccd26762..00000000
--- a/debian/nginx-full.install
+++ /dev/null
@@ -1 +0,0 @@
-debian/build-full/objs/nginx usr/sbin
diff --git a/debian/nginx-full.manpages b/debian/nginx-full.manpages
deleted file mode 100644
index 28267c2f..00000000
--- a/debian/nginx-full.manpages
+++ /dev/null
@@ -1 +0,0 @@
-debian/build-full/objs/nginx.8
diff --git a/debian/nginx-light.postinst b/debian/nginx-light.postinst
index 2a1730f1..b43571ad 100644
--- a/debian/nginx-light.postinst
+++ b/debian/nginx-light.postinst
@@ -24,7 +24,12 @@ if [ -x /etc/init.d/nginx ]; then
     invoke-rc.d nginx upgrade || invoke-rc.d nginx restart
     exit $?
   else
-    invoke-rc.d nginx start || exit $?
+    if [ -z "$(ss -nlt 'sport = 80' | grep -v ^State)" ]; then
+      invoke-rc.d nginx start || exit $?
+    else
+      echo "Not attempting to start NGINX, port 80 is already in use."
+      exit 0
+    fi
   fi
 fi
 
diff --git a/debian/ngx-conf/ngx-conf b/debian/ngx-conf/ngx-conf
index de24fcc3..658766af 100755
--- a/debian/ngx-conf/ngx-conf
+++ b/debian/ngx-conf/ngx-conf
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 ##
 # copyright (c) 2015 Michael Lustfield <michael@lustfield.net>
@@ -37,7 +37,7 @@ import subprocess
 
 
 # Read configuration values
-config_opts = ConfigParser.SafeConfigParser({
+config_opts = ConfigParser.ConfigParser({
     'base_dir': '/etc/nginx/',
     'conf_dir': 'conf.d/',
     'sites_en': 'sites-enabled/',
@@ -211,7 +211,7 @@ def remove_configs(configs, verbose, force):
         for f in files:
             if os.path.isfile(f):
                 if not force:
-                    answer = str(raw_input('Are you sure you want to delete {}? (y/N) '.format(f)))
+                    answer = str(input('Are you sure you want to delete {}? (y/N) '.format(f)))
                     if answer.lower() != 'y' and answer.lower() != 'yes':
                         break
                 try:
diff --git a/debian/ngxmod b/debian/ngxmod
index dba82e87..0ceb3990 100755
--- a/debian/ngxmod
+++ b/debian/ngxmod
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 """
 Handy Debian nginx module management helper
 """
@@ -13,12 +13,12 @@ import tempfile
 
 from subprocess import call
 
-import deb822
+import debian.deb822 as deb822
 
 DEBIAN_PATH = os.path.dirname(os.path.realpath(__file__))
 MODULES_PATH = os.path.join(DEBIAN_PATH, 'modules')
 CTRL_PATH = os.path.join(MODULES_PATH, 'control')
-CTRL = [p for p in deb822.Deb822.iter_paragraphs(file(CTRL_PATH))]
+CTRL = [p for p in deb822.Deb822.iter_paragraphs(open(CTRL_PATH))]
 
 
 def ctrl(name):
@@ -50,7 +50,7 @@ def prompt(query):
     :returns: The yes (True) or no (False) answer
     """
     sys.stdout.write('%s [y/N]: ' % query)
-    choice = raw_input().lower()
+    choice = input().lower()
 
     return choice == 'y'
 
@@ -80,7 +80,7 @@ def unpack(module, version, exclude):
     tar_gz = os.path.join(
         "..", "libnginx-mod-%s-%s.tar.gz" % (module, version))
     if not os.path.exists(tar_gz):
-        print "%s doesn't exist!" % tar_gz
+        print("%s doesn't exist!" % tar_gz)
         exit(1)
 
     module_path = os.path.join(MODULES_PATH, module)
@@ -91,12 +91,12 @@ def unpack(module, version, exclude):
         # stip top-level directory from tar
         topdir = members[0]
         if not topdir or not topdir.isdir():
-            print "No top directory found!"
+            print("No top directory found!")
             exit(1)
 
         topdir = members[0].path
         if any(topdir not in ti.path for ti in members):
-            print "Not all files are under the top directory '%s'" % topdir
+            print("Not all files are under the top directory '%s'" % topdir)
             exit(1)
 
         def remove_topdir_prefix(tarinfo):
@@ -110,12 +110,16 @@ def unpack(module, version, exclude):
     shutil.move(tmpdir, module_path)
 
     for e in exclude:
-        print "Removing %s..." % e
+        print("Removing %s..." % e)
         abspath = os.path.join(module_path, e)
         if os.path.isdir(abspath):
             shutil.rmtree(abspath)
         else:
-            os.remove(abspath)
+            try:
+                os.remove(abspath)
+            except FileNotFoundError as e:
+                # if it not exists, ignore it
+                pass
 
 
 def cmd_uupdate(args):
@@ -156,7 +160,7 @@ def cmd_uscan(args):
         watchfile = os.path.join(MODULES_PATH, 'watch', mi['Module'])
 
         if not os.path.isfile(watchfile):
-            print 'no watchfile available.'
+            print('no watchfile available.')
             continue
 
         # Check
@@ -166,7 +170,7 @@ def cmd_uscan(args):
             mi['Module']
         ]
         if call(uscan_check_cmd) != 0:
-            print 'up-to-date'
+            print('up-to-date')
             continue
 
         # Ask
@@ -179,7 +183,7 @@ def cmd_uscan(args):
             '--watchfile', watchfile, '--no-symlink'
         ]
         if call(uscan_upgrade_cmd, stdout=open(os.devnull, 'w')) != 0:
-            print "Uscan for %s failed!" % mi['Module']
+            print("Uscan for %s failed!" % mi['Module'])
             exit(1)
 
 
diff --git a/debian/patches/CVE-2019-20372.patch b/debian/patches/CVE-2019-20372.patch
new file mode 100644
index 00000000..741b0a9f
--- /dev/null
+++ b/debian/patches/CVE-2019-20372.patch
@@ -0,0 +1,26 @@
+From 8bffc01d084b4881e3eed2052c115b8f04268cb9 Mon Sep 17 00:00:00 2001
+From: Ruslan Ermilov <ru@nginx.com>
+Date: Mon, 23 Dec 2019 15:45:46 +0300
+Subject: [PATCH] Discard request body when redirecting to a URL via
+ error_page.
+
+Reported by Bert JW Regeer and Francisco Oca Gonzalez.
+---
+ src/http/ngx_http_special_response.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/http/ngx_http_special_response.c
++++ b/src/http/ngx_http_special_response.c
+@@ -629,6 +629,12 @@
+         r->keepalive = 0;
+     }
+ 
++    r->expect_tested = 1;
++
++    if (ngx_http_discard_request_body(r) != NGX_OK) {
++        r->keepalive = 0;
++    }
++
+     location = ngx_list_push(&r->headers_out.headers);
+ 
+     if (location == NULL) {
diff --git a/debian/patches/CVE-2019-9511.patch b/debian/patches/CVE-2019-9511.patch
new file mode 100644
index 00000000..3b48e0cd
--- /dev/null
+++ b/debian/patches/CVE-2019-9511.patch
@@ -0,0 +1,87 @@
+From 3f64486e0c15414dc6368139453dcaca338ddf3e Mon Sep 17 00:00:00 2001
+From: Ruslan Ermilov <ru@nginx.com>
+Date: Tue, 13 Aug 2019 15:43:36 +0300
+Subject: [PATCH 2/3] HTTP/2: limited number of DATA frames.
+
+Fixed excessive memory growth and CPU usage if stream windows are
+manipulated in a way that results in generating many small DATA frames.
+Fix is to limit the number of simultaneously allocated DATA frames.
+---
+ src/http/v2/ngx_http_v2.c               |  2 ++
+ src/http/v2/ngx_http_v2.h               |  2 ++
+ src/http/v2/ngx_http_v2_filter_module.c | 22 +++++++++++++++++-----
+ 3 files changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
+index be2ef82b..1b01f271 100644
+--- a/src/http/v2/ngx_http_v2.c
++++ b/src/http/v2/ngx_http_v2.c
+@@ -4339,6 +4339,8 @@ ngx_http_v2_close_stream(ngx_http_v2_stream_t *stream, ngx_int_t rc)
+      */
+     pool = stream->pool;
+ 
++    h2c->frames -= stream->frames;
++
+     ngx_http_free_request(stream->request, rc);
+ 
+     if (pool != h2c->state.pool) {
+diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
+index bec22160..715b7d30 100644
+--- a/src/http/v2/ngx_http_v2.h
++++ b/src/http/v2/ngx_http_v2.h
+@@ -192,6 +192,8 @@ struct ngx_http_v2_stream_s {
+ 
+     ngx_buf_t                       *preread;
+ 
++    ngx_uint_t                       frames;
++
+     ngx_http_v2_out_frame_t         *free_frames;
+     ngx_chain_t                     *free_frame_headers;
+     ngx_chain_t                     *free_bufs;
+diff --git a/src/http/v2/ngx_http_v2_filter_module.c b/src/http/v2/ngx_http_v2_filter_module.c
+index 029e8ece..c7ee5536 100644
+--- a/src/http/v2/ngx_http_v2_filter_module.c
++++ b/src/http/v2/ngx_http_v2_filter_module.c
+@@ -1661,22 +1661,34 @@ static ngx_http_v2_out_frame_t *
+ ngx_http_v2_filter_get_data_frame(ngx_http_v2_stream_t *stream,
+     size_t len, ngx_chain_t *first, ngx_chain_t *last)
+ {
+-    u_char                    flags;
+-    ngx_buf_t                *buf;
+-    ngx_chain_t              *cl;
+-    ngx_http_v2_out_frame_t  *frame;
++    u_char                     flags;
++    ngx_buf_t                 *buf;
++    ngx_chain_t               *cl;
++    ngx_http_v2_out_frame_t   *frame;
++    ngx_http_v2_connection_t  *h2c;
+ 
+     frame = stream->free_frames;
++    h2c = stream->connection;
+ 
+     if (frame) {
+         stream->free_frames = frame->next;
+ 
+-    } else {
++    } else if (h2c->frames < 10000) {
+         frame = ngx_palloc(stream->request->pool,
+                            sizeof(ngx_http_v2_out_frame_t));
+         if (frame == NULL) {
+             return NULL;
+         }
++
++        stream->frames++;
++        h2c->frames++;
++
++    } else {
++        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
++                      "http2 flood detected");
++
++        h2c->connection->error = 1;
++        return NULL;
+     }
+ 
+     flags = last->buf->last_buf ? NGX_HTTP_V2_END_STREAM_FLAG : 0;
+-- 
+2.20.1
+
diff --git a/debian/patches/CVE-2019-9513.patch b/debian/patches/CVE-2019-9513.patch
new file mode 100644
index 00000000..edc1c2b8
--- /dev/null
+++ b/debian/patches/CVE-2019-9513.patch
@@ -0,0 +1,62 @@
+From bbdc81631b6d322785d8e92788fd400e25a931e6 Mon Sep 17 00:00:00 2001
+From: Ruslan Ermilov <ru@nginx.com>
+Date: Tue, 13 Aug 2019 15:43:40 +0300
+Subject: [PATCH 3/3] HTTP/2: limited number of PRIORITY frames.
+
+Fixed excessive CPU usage caused by a peer that continuously shuffles
+priority of streams.  Fix is to limit the number of PRIORITY frames.
+---
+ src/http/v2/ngx_http_v2.c | 10 ++++++++++
+ src/http/v2/ngx_http_v2.h |  1 +
+ 2 files changed, 11 insertions(+)
+
+diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
+index 1b01f271..fd6ecb05 100644
+--- a/src/http/v2/ngx_http_v2.c
++++ b/src/http/v2/ngx_http_v2.c
+@@ -275,6 +275,7 @@ ngx_http_v2_init(ngx_event_t *rev)
+     h2scf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_v2_module);
+ 
+     h2c->concurrent_pushes = h2scf->concurrent_pushes;
++    h2c->priority_limit = h2scf->concurrent_streams;
+ 
+     h2c->pool = ngx_create_pool(h2scf->pool_size, h2c->connection->log);
+     if (h2c->pool == NULL) {
+@@ -1806,6 +1807,13 @@ ngx_http_v2_state_priority(ngx_http_v2_connection_t *h2c, u_char *pos,
+         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_SIZE_ERROR);
+     }
+ 
++    if (--h2c->priority_limit == 0) {
++        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
++                      "client sent too many PRIORITY frames");
++
++        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_ENHANCE_YOUR_CALM);
++    }
++
+     if (end - pos < NGX_HTTP_V2_PRIORITY_SIZE) {
+         return ngx_http_v2_state_save(h2c, pos, end,
+                                       ngx_http_v2_state_priority);
+@@ -3120,6 +3128,8 @@ ngx_http_v2_create_stream(ngx_http_v2_connection_t *h2c, ngx_uint_t push)
+         h2c->processing++;
+     }
+ 
++    h2c->priority_limit += h2scf->concurrent_streams;
++
+     return stream;
+ }
+ 
+diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
+index 715b7d30..69d55d1c 100644
+--- a/src/http/v2/ngx_http_v2.h
++++ b/src/http/v2/ngx_http_v2.h
+@@ -122,6 +122,7 @@ struct ngx_http_v2_connection_s {
+     ngx_uint_t                       processing;
+     ngx_uint_t                       frames;
+     ngx_uint_t                       idle;
++    ngx_uint_t                       priority_limit;
+ 
+     ngx_uint_t                       pushing;
+     ngx_uint_t                       concurrent_pushes;
+-- 
+2.20.1
+
diff --git a/debian/patches/CVE-2019-9516.patch b/debian/patches/CVE-2019-9516.patch
new file mode 100644
index 00000000..0d5ec774
--- /dev/null
+++ b/debian/patches/CVE-2019-9516.patch
@@ -0,0 +1,45 @@
+From 840d8a3e2f126384eb4ee3e5dd7ffe875a5634c5 Mon Sep 17 00:00:00 2001
+From: Sergey Kandaurov <pluknet@nginx.com>
+Date: Tue, 13 Aug 2019 15:43:32 +0300
+Subject: [PATCH 1/3] HTTP/2: reject zero length headers with PROTOCOL_ERROR.
+
+Fixed uncontrolled memory growth if peer sends a stream of
+headers with a 0-length header name and 0-length header value.
+Fix is to reject headers with zero name length.
+---
+ src/http/v2/ngx_http_v2.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
+index 12214e15..be2ef82b 100644
+--- a/src/http/v2/ngx_http_v2.c
++++ b/src/http/v2/ngx_http_v2.c
+@@ -1548,6 +1548,14 @@ ngx_http_v2_state_process_header(ngx_http_v2_connection_t *h2c, u_char *pos,
+         header->name.len = h2c->state.field_end - h2c->state.field_start;
+         header->name.data = h2c->state.field_start;
+ 
++        if (header->name.len == 0) {
++            ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
++                          "client sent zero header name length");
++
++            return ngx_http_v2_connection_error(h2c,
++                                                NGX_HTTP_V2_PROTOCOL_ERROR);
++        }
++
+         return ngx_http_v2_state_field_len(h2c, pos, end);
+     }
+ 
+@@ -3249,10 +3257,6 @@ ngx_http_v2_validate_header(ngx_http_request_t *r, ngx_http_v2_header_t *header)
+     ngx_uint_t                 i;
+     ngx_http_core_srv_conf_t  *cscf;
+ 
+-    if (header->name.len == 0) {
+-        return NGX_ERROR;
+-    }
+-
+     r->invalid_header = 0;
+ 
+     cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
+-- 
+2.20.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 5b6b799f..b221db70 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
 0002-Make-sure-signature-stays-the-same-in-all-nginx-buil.patch
 0003-define_gnu_source-on-other-glibc-based-platforms.patch
+CVE-2019-20372.patch
diff --git a/debian/rules b/debian/rules
index 981a57e3..f7778437 100755
--- a/debian/rules
+++ b/debian/rules
@@ -5,7 +5,7 @@ export DEB_BUILD_MAINT_OPTIONS=hardening=+all
 debian_cflags:=$(shell dpkg-buildflags --get CFLAGS) -fPIC $(shell dpkg-buildflags --get CPPFLAGS)
 debian_ldflags:=$(shell dpkg-buildflags --get LDFLAGS) -fPIC
 
-FLAVOURS := full light extras
+FLAVOURS := core light extras
 DYN_MODS := \
 	http-auth-pam \
 	http-cache-purge \
@@ -13,6 +13,7 @@ DYN_MODS := \
 	http-echo \
 	http-fancyindex \
 	http-geoip \
+	http-geoip2 \
 	http-headers-more-filter \
 	http-image-filter \
 	http-lua \
@@ -25,7 +26,9 @@ DYN_MODS := \
 	mail \
 	nchan \
 	rtmp \
-	stream
+	stream \
+	stream-geoip \
+	stream-geoip2
 
 MODULESDIR = $(CURDIR)/debian/modules
 BASEDIR = $(CURDIR)
@@ -60,6 +63,7 @@ common_configure_flags := \
 			--http-proxy-temp-path=/var/lib/nginx/proxy \
 			--http-scgi-temp-path=/var/lib/nginx/scgi \
 			--http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
+			--with-compat \
 			--with-debug \
 			--with-pcre-jit \
 			--with-http_ssl_module \
@@ -81,28 +85,14 @@ light_configure_flags := \
 			--without-http_memcached_module \
 			--without-http_referer_module \
 			--without-http_split_clients_module \
-			--without-http_userid_module \
-			--add-dynamic-module=$(MODULESDIR)/http-echo
+			--without-http_userid_module
 
-full_configure_flags := \
+core_configure_flags := \
 			$(common_configure_flags) \
 			--with-http_addition_module \
-			--with-http_geoip_module=dynamic \
 			--with-http_gunzip_module \
 			--with-http_gzip_static_module \
-			--with-http_image_filter_module=dynamic \
 			--with-http_sub_module \
-			--with-http_xslt_module=dynamic \
-			--with-stream=dynamic \
-			--with-stream_ssl_module \
-			--with-stream_ssl_preread_module \
-			--with-mail=dynamic \
-			--with-mail_ssl_module \
-			--add-dynamic-module=$(MODULESDIR)/http-auth-pam \
-			--add-dynamic-module=$(MODULESDIR)/http-dav-ext \
-			--add-dynamic-module=$(MODULESDIR)/http-echo \
-			--add-dynamic-module=$(MODULESDIR)/http-upstream-fair \
-			--add-dynamic-module=$(MODULESDIR)/http-subs-filter
 
 extras_configure_flags := \
 			$(common_configure_flags) \
@@ -121,6 +111,7 @@ extras_configure_flags := \
 			--with-mail=dynamic \
 			--with-mail_ssl_module \
 			--with-stream=dynamic \
+			--with-stream_geoip_module=dynamic \
 			--with-stream_ssl_module \
 			--with-stream_ssl_preread_module \
 			--add-dynamic-module=$(MODULESDIR)/http-headers-more-filter \
@@ -130,6 +121,7 @@ extras_configure_flags := \
 			--add-dynamic-module=$(MODULESDIR)/http-ndk \
 			--add-dynamic-module=$(MODULESDIR)/http-echo \
 			--add-dynamic-module=$(MODULESDIR)/http-fancyindex \
+			--add-dynamic-module=$(MODULESDIR)/http-geoip2 \
 			--add-dynamic-module=$(MODULESDIR)/nchan \
 			--add-dynamic-module=$(MODULESDIR)/http-lua \
 			--add-dynamic-module=$(MODULESDIR)/rtmp \
@@ -151,10 +143,10 @@ override_dh_install:
 	DH_AUTOSCRIPTDIR=$(CURDIR)/debian/autoscripts debian/dh_nginx
 
 override_dh_installinit:
-	dh_installinit --no-restart-on-upgrade --no-start --name=nginx
+	dh_installinit --no-stop-on-upgrade --no-start --name=nginx
 
-override_dh_systemd_enable:
-	dh_systemd_enable --name=nginx
+override_dh_installsystemd:
+	dh_installsystemd --name=nginx
 
 override_dh_installlogrotate:
 	dh_installlogrotate --package nginx-common --name=nginx
diff --git a/debian/tests/control b/debian/tests/control
index b4914825..52690ae2 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -10,6 +10,10 @@ Tests: lua
 Restrictions: allow-stderr isolation-container needs-root
 Depends: nginx-extras, curl
 
+Tests: core-simple
+Restrictions: allow-stderr isolation-container
+Depends: nginx-core, curl
+
 Tests: full-simple
 Restrictions: allow-stderr isolation-container
 Depends: nginx-full, curl
@@ -18,6 +22,32 @@ Tests: extras-simple
 Restrictions: allow-stderr isolation-container
 Depends: nginx-extras, curl
 
+Tests: core-module-deps
+Restrictions: allow-stderr isolation-container
+Depends: nginx-core,
+         curl,
+         libnginx-mod-http-auth-pam,
+         libnginx-mod-http-cache-purge,
+         libnginx-mod-http-dav-ext,
+         libnginx-mod-http-echo,
+         libnginx-mod-http-fancyindex,
+         libnginx-mod-http-geoip,
+         libnginx-mod-http-geoip2,
+         libnginx-mod-http-headers-more-filter,
+         libnginx-mod-http-image-filter,
+         libnginx-mod-http-lua,
+         libnginx-mod-http-perl,
+         libnginx-mod-http-subs-filter,
+         libnginx-mod-http-uploadprogress,
+         libnginx-mod-http-upstream-fair,
+         libnginx-mod-http-xslt-filter,
+         libnginx-mod-mail,
+         libnginx-mod-nchan,
+         libnginx-mod-rtmp,
+         libnginx-mod-stream-geoip,
+         libnginx-mod-stream-geoip2,
+         libnginx-mod-stream,
+
 Tests: full-module-deps
 Restrictions: allow-stderr isolation-container
 Depends: nginx-full,
@@ -28,6 +58,7 @@ Depends: nginx-full,
          libnginx-mod-http-echo,
          libnginx-mod-http-fancyindex,
          libnginx-mod-http-geoip,
+         libnginx-mod-http-geoip2,
          libnginx-mod-http-headers-more-filter,
          libnginx-mod-http-image-filter,
          libnginx-mod-http-lua,
@@ -39,7 +70,9 @@ Depends: nginx-full,
          libnginx-mod-mail,
          libnginx-mod-nchan,
          libnginx-mod-rtmp,
-         libnginx-mod-stream
+         libnginx-mod-stream-geoip,
+         libnginx-mod-stream-geoip2,
+         libnginx-mod-stream,
 
 Tests: light-module-deps
 Restrictions: allow-stderr isolation-container
@@ -51,6 +84,7 @@ Depends: nginx-light,
          libnginx-mod-http-echo,
          libnginx-mod-http-fancyindex,
          libnginx-mod-http-geoip,
+         libnginx-mod-http-geoip2,
          libnginx-mod-http-headers-more-filter,
          libnginx-mod-http-image-filter,
          libnginx-mod-http-lua,
@@ -62,7 +96,9 @@ Depends: nginx-light,
          libnginx-mod-mail,
          libnginx-mod-nchan,
          libnginx-mod-rtmp,
-         libnginx-mod-stream
+         libnginx-mod-stream-geoip,
+         libnginx-mod-stream-geoip2,
+         libnginx-mod-stream,
 
 Tests: extras-module-deps
 Restrictions: allow-stderr isolation-container
@@ -74,6 +110,7 @@ Depends: nginx-extras,
          libnginx-mod-http-echo,
          libnginx-mod-http-fancyindex,
          libnginx-mod-http-geoip,
+         libnginx-mod-http-geoip2,
          libnginx-mod-http-headers-more-filter,
          libnginx-mod-http-image-filter,
          libnginx-mod-http-lua,
@@ -85,4 +122,6 @@ Depends: nginx-extras,
          libnginx-mod-mail,
          libnginx-mod-nchan,
          libnginx-mod-rtmp,
-         libnginx-mod-stream
+         libnginx-mod-stream-geoip,
+         libnginx-mod-stream-geoip2,
+         libnginx-mod-stream,
diff --git a/debian/tests/core-module-deps b/debian/tests/core-module-deps
new file mode 100644
index 00000000..cefed50e
--- /dev/null
+++ b/debian/tests/core-module-deps
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+curl --silent --fail -o /dev/null -w "response_code: %{http_code}\n" http://127.0.0.1/
diff --git a/debian/tests/core-simple b/debian/tests/core-simple
new file mode 100644
index 00000000..cefed50e
--- /dev/null
+++ b/debian/tests/core-simple
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+curl --silent --fail -o /dev/null -w "response_code: %{http_code}\n" http://127.0.0.1/
diff --git a/debian/watch b/debian/watch
index 1aeff3ed..5ea7cc01 100644
--- a/debian/watch
+++ b/debian/watch
@@ -1,3 +1,3 @@
 version=3
 opts=pgpsigurlmangle=s/$/.asc/ \
-https://nginx.org/download/nginx-(1\.16\.\d+)\.tar\.gz
+https://nginx.org/download/nginx-(1\.18\.\d+)\.tar\.gz
diff --git a/man/nginx.8 b/man/nginx.8
index 1f4dc893..573d935e 100644
--- a/man/nginx.8
+++ b/man/nginx.8
@@ -1,5 +1,5 @@
 .\"
-.\" Copyright (C) 2010 Sergey A. Osokin
+.\" Copyright (C) 2010, 2019 Sergey A. Osokin
 .\" Copyright (C) Nginx, Inc.
 .\" All rights reserved.
 .\"
@@ -25,7 +25,7 @@
 .\" SUCH DAMAGE.
 .\"
 .\"
-.Dd June 16, 2015
+.Dd December 5, 2019
 .Dt NGINX 8
 .Os
 .Sh NAME
@@ -42,7 +42,8 @@
 .Nm
 (pronounced
 .Dq engine x )
-is an HTTP and reverse proxy server, as well as a mail proxy server.
+is an HTTP and reverse proxy server, a mail proxy server, and a generic
+TCP/UDP proxy server.
 It is known for its high performance, stability, rich feature set, simple
 configuration, and low resource consumption.
 .Pp
@@ -82,15 +83,15 @@ The following table shows the corresponding system signals:
 .It Cm reload
 .Dv SIGHUP
 .El
+.It Fl T
+Same as
+.Fl t ,
+but additionally dump configuration files to standard output.
 .It Fl t
 Do not run, just test the configuration file.
 .Nm
 checks the configuration file syntax and then tries to open files
 referenced in the configuration file.
-.It Fl T
-Same as
-.Fl t ,
-but additionally dump configuration files to standard output.
 .It Fl V
 Print the
 .Nm
diff --git a/src/core/nginx.c b/src/core/nginx.c
index 9fcb0eb2..48a20e9f 100644
--- a/src/core/nginx.c
+++ b/src/core/nginx.c
@@ -183,6 +183,7 @@ static ngx_uint_t   ngx_show_help;
 static ngx_uint_t   ngx_show_version;
 static ngx_uint_t   ngx_show_configure;
 static u_char      *ngx_prefix;
+static u_char      *ngx_error_log;
 static u_char      *ngx_conf_file;
 static u_char      *ngx_conf_params;
 static char        *ngx_signal;
@@ -230,7 +231,7 @@ main(int argc, char *const *argv)
     ngx_pid = ngx_getpid();
     ngx_parent = ngx_getppid();
 
-    log = ngx_log_init(ngx_prefix);
+    log = ngx_log_init(ngx_prefix, ngx_error_log);
     if (log == NULL) {
         return 1;
     }
@@ -393,9 +394,9 @@ ngx_show_version_info(void)
 
     if (ngx_show_help) {
         ngx_write_stderr(
-            "Usage: nginx [-?hvVtTq] [-s signal] [-c filename] "
-                         "[-p prefix] [-g directives]" NGX_LINEFEED
-                         NGX_LINEFEED
+            "Usage: nginx [-?hvVtTq] [-s signal] [-p prefix]" NGX_LINEFEED
+            "             [-e filename] [-c filename] [-g directives]"
+                          NGX_LINEFEED NGX_LINEFEED
             "Options:" NGX_LINEFEED
             "  -?,-h         : this help" NGX_LINEFEED
             "  -v            : show version and exit" NGX_LINEFEED
@@ -413,6 +414,12 @@ ngx_show_version_info(void)
                                NGX_LINEFEED
 #else
             "  -p prefix     : set prefix path (default: NONE)" NGX_LINEFEED
+#endif
+            "  -e filename   : set error log file (default: "
+#ifdef NGX_ERROR_LOG_STDERR
+                               "stderr)" NGX_LINEFEED
+#else
+                               NGX_ERROR_LOG_PATH ")" NGX_LINEFEED
 #endif
             "  -c filename   : set configuration file (default: " NGX_CONF_PATH
                                ")" NGX_LINEFEED
@@ -492,6 +499,7 @@ ngx_add_inherited_sockets(ngx_cycle_t *cycle)
             ngx_memzero(ls, sizeof(ngx_listening_t));
 
             ls->fd = (ngx_socket_t) s;
+            ls->inherited = 1;
         }
     }
 
@@ -799,6 +807,24 @@ ngx_get_options(int argc, char *const *argv)
                 ngx_log_stderr(0, "option \"-p\" requires directory name");
                 return NGX_ERROR;
 
+            case 'e':
+                if (*p) {
+                    ngx_error_log = p;
+
+                } else if (argv[++i]) {
+                    ngx_error_log = (u_char *) argv[i];
+
+                } else {
+                    ngx_log_stderr(0, "option \"-e\" requires file name");
+                    return NGX_ERROR;
+                }
+
+                if (ngx_strcmp(ngx_error_log, "stderr") == 0) {
+                    ngx_error_log = (u_char *) "";
+                }
+
+                goto next;
+
             case 'c':
                 if (*p) {
                     ngx_conf_file = p;
@@ -991,6 +1017,14 @@ ngx_process_options(ngx_cycle_t *cycle)
         }
     }
 
+    if (ngx_error_log) {
+        cycle->error_log.len = ngx_strlen(ngx_error_log);
+        cycle->error_log.data = ngx_error_log;
+
+    } else {
+        ngx_str_set(&cycle->error_log, NGX_ERROR_LOG_PATH);
+    }
+
     if (ngx_conf_params) {
         cycle->conf_param.len = ngx_strlen(ngx_conf_params);
         cycle->conf_param.data = ngx_conf_params;
diff --git a/src/core/nginx.h b/src/core/nginx.h
index c59a0e7e..d8c8289a 100644
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -9,8 +9,8 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define nginx_version      1016001
-#define NGINX_VERSION      "1.16.1"
+#define nginx_version      1021000
+#define NGINX_VERSION      "1.21.0"
 #define NGINX_VER          "nginx/" NGINX_VERSION
 
 #ifdef NGX_BUILD
diff --git a/src/core/ngx_buf.h b/src/core/ngx_buf.h
index 12781a78..4b665629 100644
--- a/src/core/ngx_buf.h
+++ b/src/core/ngx_buf.h
@@ -125,20 +125,20 @@ typedef struct {
 #define NGX_CHAIN_ERROR     (ngx_chain_t *) NGX_ERROR
 
 
-#define ngx_buf_in_memory(b)        (b->temporary || b->memory || b->mmap)
-#define ngx_buf_in_memory_only(b)   (ngx_buf_in_memory(b) && !b->in_file)
+#define ngx_buf_in_memory(b)       ((b)->temporary || (b)->memory || (b)->mmap)
+#define ngx_buf_in_memory_only(b)  (ngx_buf_in_memory(b) && !(b)->in_file)
 
 #define ngx_buf_special(b)                                                   \
-    ((b->flush || b->last_buf || b->sync)                                    \
-     && !ngx_buf_in_memory(b) && !b->in_file)
+    (((b)->flush || (b)->last_buf || (b)->sync)                              \
+     && !ngx_buf_in_memory(b) && !(b)->in_file)
 
 #define ngx_buf_sync_only(b)                                                 \
-    (b->sync                                                                 \
-     && !ngx_buf_in_memory(b) && !b->in_file && !b->flush && !b->last_buf)
+    ((b)->sync && !ngx_buf_in_memory(b)                                      \
+     && !(b)->in_file && !(b)->flush && !(b)->last_buf)
 
 #define ngx_buf_size(b)                                                      \
-    (ngx_buf_in_memory(b) ? (off_t) (b->last - b->pos):                      \
-                            (b->file_last - b->file_pos))
+    (ngx_buf_in_memory(b) ? (off_t) ((b)->last - (b)->pos):                  \
+                            ((b)->file_last - (b)->file_pos))
 
 ngx_buf_t *ngx_create_temp_buf(ngx_pool_t *pool, size_t size);
 ngx_chain_t *ngx_create_chain_of_bufs(ngx_pool_t *pool, ngx_bufs_t *bufs);
@@ -149,8 +149,8 @@ ngx_chain_t *ngx_create_chain_of_bufs(ngx_pool_t *pool, ngx_bufs_t *bufs);
 
 ngx_chain_t *ngx_alloc_chain_link(ngx_pool_t *pool);
 #define ngx_free_chain(pool, cl)                                             \
-    cl->next = pool->chain;                                                  \
-    pool->chain = cl
+    (cl)->next = (pool)->chain;                                              \
+    (pool)->chain = (cl)
 
 
 
diff --git a/src/core/ngx_conf_file.c b/src/core/ngx_conf_file.c
index 6d1629e9..fec7bb83 100644
--- a/src/core/ngx_conf_file.c
+++ b/src/core/ngx_conf_file.c
@@ -1137,7 +1137,7 @@ ngx_conf_set_keyval_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     a = (ngx_array_t **) (p + cmd->offset);
 
-    if (*a == NULL) {
+    if (*a == NGX_CONF_UNSET_PTR || *a == NULL) {
         *a = ngx_array_create(cf->pool, 4, sizeof(ngx_keyval_t));
         if (*a == NULL) {
             return NGX_CONF_ERROR;
diff --git a/src/core/ngx_conf_file.h b/src/core/ngx_conf_file.h
index 9cd58064..ed2d2ba9 100644
--- a/src/core/ngx_conf_file.h
+++ b/src/core/ngx_conf_file.h
@@ -49,7 +49,7 @@
 #define NGX_DIRECT_CONF      0x00010000
 
 #define NGX_MAIN_CONF        0x01000000
-#define NGX_ANY_CONF         0x1F000000
+#define NGX_ANY_CONF         0xFF000000
 
 
 
diff --git a/src/core/ngx_connection.c b/src/core/ngx_connection.c
index 33682532..8339e2bb 100644
--- a/src/core/ngx_connection.c
+++ b/src/core/ngx_connection.c
@@ -1070,7 +1070,8 @@ ngx_close_listening_sockets(ngx_cycle_t *cycle)
 
         if (ls[i].sockaddr->sa_family == AF_UNIX
             && ngx_process <= NGX_PROCESS_MASTER
-            && ngx_new_binary == 0)
+            && ngx_new_binary == 0
+            && (!ls[i].inherited || ngx_getppid() != ngx_parent))
         {
             u_char *name = ls[i].addr_text.data + sizeof("unix:") - 1;
 
@@ -1106,12 +1107,9 @@ ngx_get_connection(ngx_socket_t s, ngx_log_t *log)
         return NULL;
     }
 
-    c = ngx_cycle->free_connections;
+    ngx_drain_connections((ngx_cycle_t *) ngx_cycle);
 
-    if (c == NULL) {
-        ngx_drain_connections((ngx_cycle_t *) ngx_cycle);
-        c = ngx_cycle->free_connections;
-    }
+    c = ngx_cycle->free_connections;
 
     if (c == NULL) {
         ngx_log_error(NGX_LOG_ALERT, log, 0,
@@ -1297,6 +1295,22 @@ ngx_drain_connections(ngx_cycle_t *cycle)
     ngx_queue_t       *q;
     ngx_connection_t  *c;
 
+    if (cycle->free_connection_n > cycle->connection_n / 16
+        || cycle->reusable_connections_n == 0)
+    {
+        return;
+    }
+
+    if (cycle->connections_reuse_time != ngx_time()) {
+        cycle->connections_reuse_time = ngx_time();
+
+        ngx_log_error(NGX_LOG_WARN, cycle->log, 0,
+                      "%ui worker_connections are not enough, "
+                      "reusing connections",
+                      cycle->connection_n);
+    }
+
+    c = NULL;
     n = ngx_max(ngx_min(32, cycle->reusable_connections_n / 8), 1);
 
     for (i = 0; i < n; i++) {
@@ -1313,6 +1327,21 @@ ngx_drain_connections(ngx_cycle_t *cycle)
         c->close = 1;
         c->read->handler(c->read);
     }
+
+    if (cycle->free_connection_n == 0 && c && c->reusable) {
+
+        /*
+         * if no connections were freed, try to reuse the last
+         * connection again: this should free it as long as
+         * previous reuse moved it to lingering close
+         */
+
+        ngx_log_debug0(NGX_LOG_DEBUG_CORE, c->log, 0,
+                       "reusing connection again");
+
+        c->close = 1;
+        c->read->handler(c->read);
+    }
 }
 
 
diff --git a/src/core/ngx_connection.h b/src/core/ngx_connection.h
index 54059629..4716da49 100644
--- a/src/core/ngx_connection.h
+++ b/src/core/ngx_connection.h
@@ -45,8 +45,6 @@ struct ngx_listening_s {
     size_t              pool_size;
     /* should be here because of the AcceptEx() preread */
     size_t              post_accept_buffer_size;
-    /* should be here because of the deferred accept */
-    ngx_msec_t          post_accept_timeout;
 
     ngx_listening_t    *previous;
     ngx_connection_t   *connection;
@@ -147,8 +145,7 @@ struct ngx_connection_s {
     socklen_t           socklen;
     ngx_str_t           addr_text;
 
-    ngx_str_t           proxy_protocol_addr;
-    in_port_t           proxy_protocol_port;
+    ngx_proxy_protocol_t  *proxy_protocol;
 
 #if (NGX_SSL || NGX_COMPAT)
     ngx_ssl_connection_t  *ssl;
@@ -165,6 +162,7 @@ struct ngx_connection_s {
 
     ngx_atomic_uint_t   number;
 
+    ngx_msec_t          start_time;
     ngx_uint_t          requests;
 
     unsigned            buffered:8;
diff --git a/src/core/ngx_core.h b/src/core/ngx_core.h
index 93ca9174..7ecdca0c 100644
--- a/src/core/ngx_core.h
+++ b/src/core/ngx_core.h
@@ -26,6 +26,7 @@ typedef struct ngx_event_aio_s       ngx_event_aio_t;
 typedef struct ngx_connection_s      ngx_connection_t;
 typedef struct ngx_thread_task_s     ngx_thread_task_t;
 typedef struct ngx_ssl_s             ngx_ssl_t;
+typedef struct ngx_proxy_protocol_s  ngx_proxy_protocol_t;
 typedef struct ngx_ssl_connection_s  ngx_ssl_connection_t;
 typedef struct ngx_udp_connection_s  ngx_udp_connection_t;
 
diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c
index 95f4bdfa..6978c3e4 100644
--- a/src/core/ngx_cycle.c
+++ b/src/core/ngx_cycle.c
@@ -96,6 +96,15 @@ ngx_init_cycle(ngx_cycle_t *old_cycle)
         return NULL;
     }
 
+    cycle->error_log.len = old_cycle->error_log.len;
+    cycle->error_log.data = ngx_pnalloc(pool, old_cycle->error_log.len + 1);
+    if (cycle->error_log.data == NULL) {
+        ngx_destroy_pool(pool);
+        return NULL;
+    }
+    ngx_cpystrn(cycle->error_log.data, old_cycle->error_log.data,
+                old_cycle->error_log.len + 1);
+
     cycle->conf_file.len = old_cycle->conf_file.len;
     cycle->conf_file.data = ngx_pnalloc(pool, old_cycle->conf_file.len + 1);
     if (cycle->conf_file.data == NULL) {
@@ -520,6 +529,7 @@ ngx_init_cycle(ngx_cycle_t *old_cycle)
                     == NGX_OK)
                 {
                     nls[n].fd = ls[i].fd;
+                    nls[n].inherited = ls[i].inherited;
                     nls[n].previous = &ls[i];
                     ls[i].remain = 1;
 
@@ -1008,6 +1018,7 @@ ngx_int_t
 ngx_create_pidfile(ngx_str_t *name, ngx_log_t *log)
 {
     size_t      len;
+    ngx_int_t   rc;
     ngx_uint_t  create;
     ngx_file_t  file;
     u_char      pid[NGX_INT64_LEN + 2];
@@ -1032,11 +1043,13 @@ ngx_create_pidfile(ngx_str_t *name, ngx_log_t *log)
         return NGX_ERROR;
     }
 
+    rc = NGX_OK;
+
     if (!ngx_test_config) {
         len = ngx_snprintf(pid, NGX_INT64_LEN + 2, "%P%N", ngx_pid) - pid;
 
         if (ngx_write_file(&file, pid, len, 0) == NGX_ERROR) {
-            return NGX_ERROR;
+            rc = NGX_ERROR;
         }
     }
 
@@ -1045,7 +1058,7 @@ ngx_create_pidfile(ngx_str_t *name, ngx_log_t *log)
                       ngx_close_file_n " \"%s\" failed", file.name.data);
     }
 
-    return NGX_OK;
+    return rc;
 }
 
 
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
index 54fa2e6b..0c47f25f 100644
--- a/src/core/ngx_cycle.h
+++ b/src/core/ngx_cycle.h
@@ -55,6 +55,7 @@ struct ngx_cycle_s {
 
     ngx_queue_t               reusable_connections_queue;
     ngx_uint_t                reusable_connections_n;
+    time_t                    connections_reuse_time;
 
     ngx_array_t               listening;
     ngx_array_t               paths;
@@ -79,6 +80,7 @@ struct ngx_cycle_s {
     ngx_str_t                 conf_param;
     ngx_str_t                 conf_prefix;
     ngx_str_t                 prefix;
+    ngx_str_t                 error_log;
     ngx_str_t                 lock_file;
     ngx_str_t                 hostname;
 };
diff --git a/src/core/ngx_hash.c b/src/core/ngx_hash.c
index 1944c7a2..d9c157c1 100644
--- a/src/core/ngx_hash.c
+++ b/src/core/ngx_hash.c
@@ -265,6 +265,14 @@ ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
         return NGX_ERROR;
     }
 
+    if (hinit->bucket_size > 65536 - ngx_cacheline_size) {
+        ngx_log_error(NGX_LOG_EMERG, hinit->pool->log, 0,
+                      "could not build %s, too large "
+                      "%s_bucket_size: %i",
+                      hinit->name, hinit->name, hinit->bucket_size);
+        return NGX_ERROR;
+    }
+
     for (n = 0; n < nelts; n++) {
         if (hinit->bucket_size < NGX_HASH_ELT_SIZE(&names[n]) + sizeof(void *))
         {
@@ -300,17 +308,19 @@ ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
             }
 
             key = names[n].key_hash % size;
-            test[key] = (u_short) (test[key] + NGX_HASH_ELT_SIZE(&names[n]));
+            len = test[key] + NGX_HASH_ELT_SIZE(&names[n]);
 
 #if 0
             ngx_log_error(NGX_LOG_ALERT, hinit->pool->log, 0,
-                          "%ui: %ui %ui \"%V\"",
-                          size, key, test[key], &names[n].key);
+                          "%ui: %ui %uz \"%V\"",
+                          size, key, len, &names[n].key);
 #endif
 
-            if (test[key] > (u_short) bucket_size) {
+            if (len > bucket_size) {
                 goto next;
             }
+
+            test[key] = (u_short) len;
         }
 
         goto found;
@@ -341,7 +351,18 @@ ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
         }
 
         key = names[n].key_hash % size;
-        test[key] = (u_short) (test[key] + NGX_HASH_ELT_SIZE(&names[n]));
+        len = test[key] + NGX_HASH_ELT_SIZE(&names[n]);
+
+        if (len > 65536 - ngx_cacheline_size) {
+            ngx_log_error(NGX_LOG_EMERG, hinit->pool->log, 0,
+                          "could not build %s, you should "
+                          "increase %s_max_size: %i",
+                          hinit->name, hinit->name, hinit->max_size);
+            ngx_free(test);
+            return NGX_ERROR;
+        }
+
+        test[key] = (u_short) len;
     }
 
     len = 0;
diff --git a/src/core/ngx_log.c b/src/core/ngx_log.c
index 8e9408df..0c094265 100644
--- a/src/core/ngx_log.c
+++ b/src/core/ngx_log.c
@@ -315,7 +315,7 @@ ngx_log_errno(u_char *buf, u_char *last, ngx_err_t err)
 
 
 ngx_log_t *
-ngx_log_init(u_char *prefix)
+ngx_log_init(u_char *prefix, u_char *error_log)
 {
     u_char  *p, *name;
     size_t   nlen, plen;
@@ -323,13 +323,11 @@ ngx_log_init(u_char *prefix)
     ngx_log.file = &ngx_log_file;
     ngx_log.log_level = NGX_LOG_NOTICE;
 
-    name = (u_char *) NGX_ERROR_LOG_PATH;
-
-    /*
-     * we use ngx_strlen() here since BCC warns about
-     * condition is always false and unreachable code
-     */
+    if (error_log == NULL) {
+        error_log = (u_char *) NGX_ERROR_LOG_PATH;
+    }
 
+    name = error_log;
     nlen = ngx_strlen(name);
 
     if (nlen == 0) {
@@ -369,7 +367,7 @@ ngx_log_init(u_char *prefix)
                 *p++ = '/';
             }
 
-            ngx_cpystrn(p, (u_char *) NGX_ERROR_LOG_PATH, nlen + 1);
+            ngx_cpystrn(p, error_log, nlen + 1);
 
             p = name;
         }
@@ -403,8 +401,7 @@ ngx_log_init(u_char *prefix)
 ngx_int_t
 ngx_log_open_default(ngx_cycle_t *cycle)
 {
-    ngx_log_t         *log;
-    static ngx_str_t   error_log = ngx_string(NGX_ERROR_LOG_PATH);
+    ngx_log_t  *log;
 
     if (ngx_log_get_file_log(&cycle->new_log) != NULL) {
         return NGX_OK;
@@ -425,7 +422,7 @@ ngx_log_open_default(ngx_cycle_t *cycle)
 
     log->log_level = NGX_LOG_ERR;
 
-    log->file = ngx_conf_open_file(cycle, &error_log);
+    log->file = ngx_conf_open_file(cycle, &cycle->error_log);
     if (log->file == NULL) {
         return NGX_ERROR;
     }
diff --git a/src/core/ngx_log.h b/src/core/ngx_log.h
index afb73bf7..ab64a5ad 100644
--- a/src/core/ngx_log.h
+++ b/src/core/ngx_log.h
@@ -228,7 +228,7 @@ void ngx_cdecl ngx_log_debug_core(ngx_log_t *log, ngx_err_t err,
 
 /*********************************/
 
-ngx_log_t *ngx_log_init(u_char *prefix);
+ngx_log_t *ngx_log_init(u_char *prefix, u_char *error_log);
 void ngx_cdecl ngx_log_abort(ngx_err_t err, const char *fmt, ...);
 void ngx_cdecl ngx_log_stderr(ngx_err_t err, const char *fmt, ...);
 u_char *ngx_log_errno(u_char *buf, u_char *last, ngx_err_t err);
diff --git a/src/core/ngx_proxy_protocol.c b/src/core/ngx_proxy_protocol.c
index c3d7fd30..7a9e7f9d 100644
--- a/src/core/ngx_proxy_protocol.c
+++ b/src/core/ngx_proxy_protocol.c
@@ -40,6 +40,10 @@ typedef struct {
 } ngx_proxy_protocol_inet6_addrs_t;
 
 
+static u_char *ngx_proxy_protocol_read_addr(ngx_connection_t *c, u_char *p,
+    u_char *last, ngx_str_t *addr);
+static u_char *ngx_proxy_protocol_read_port(u_char *p, u_char *last,
+    in_port_t *port, u_char sep);
 static u_char *ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf,
     u_char *last);
 
@@ -47,9 +51,9 @@ static u_char *ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf,
 u_char *
 ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
 {
-    size_t     len;
-    u_char     ch, *p, *addr, *port;
-    ngx_int_t  n;
+    size_t                 len;
+    u_char                *p;
+    ngx_proxy_protocol_t  *pp;
 
     static const u_char signature[] = "\r\n\r\n\0\r\nQUIT\n";
 
@@ -83,11 +87,77 @@ ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
     }
 
     p += 5;
-    addr = p;
+
+    pp = ngx_pcalloc(c->pool, sizeof(ngx_proxy_protocol_t));
+    if (pp == NULL) {
+        return NULL;
+    }
+
+    p = ngx_proxy_protocol_read_addr(c, p, last, &pp->src_addr);
+    if (p == NULL) {
+        goto invalid;
+    }
+
+    p = ngx_proxy_protocol_read_addr(c, p, last, &pp->dst_addr);
+    if (p == NULL) {
+        goto invalid;
+    }
+
+    p = ngx_proxy_protocol_read_port(p, last, &pp->src_port, ' ');
+    if (p == NULL) {
+        goto invalid;
+    }
+
+    p = ngx_proxy_protocol_read_port(p, last, &pp->dst_port, CR);
+    if (p == NULL) {
+        goto invalid;
+    }
+
+    if (p == last) {
+        goto invalid;
+    }
+
+    if (*p++ != LF) {
+        goto invalid;
+    }
+
+    ngx_log_debug4(NGX_LOG_DEBUG_CORE, c->log, 0,
+                   "PROXY protocol src: %V %d, dst: %V %d",
+                   &pp->src_addr, pp->src_port, &pp->dst_addr, pp->dst_port);
+
+    c->proxy_protocol = pp;
+
+    return p;
+
+skip:
+
+    for ( /* void */ ; p < last - 1; p++) {
+        if (p[0] == CR && p[1] == LF) {
+            return p + 2;
+        }
+    }
+
+invalid:
+
+    ngx_log_error(NGX_LOG_ERR, c->log, 0,
+                  "broken header: \"%*s\"", (size_t) (last - buf), buf);
+
+    return NULL;
+}
+
+
+static u_char *
+ngx_proxy_protocol_read_addr(ngx_connection_t *c, u_char *p, u_char *last,
+    ngx_str_t *addr)
+{
+    size_t  len;
+    u_char  ch, *pos;
+
+    pos = p;
 
     for ( ;; ) {
         if (p == last) {
-            goto invalid;
+            return NULL;
         }
 
         ch = *p++;
@@ -101,70 +171,54 @@ ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
             && (ch < 'A' || ch > 'F')
             && (ch < '0' || ch > '9'))
         {
-            goto invalid;
+            return NULL;
         }
     }
 
-    len = p - addr - 1;
-    c->proxy_protocol_addr.data = ngx_pnalloc(c->pool, len);
+    len = p - pos - 1;
 
-    if (c->proxy_protocol_addr.data == NULL) {
+    addr->data = ngx_pnalloc(c->pool, len);
+    if (addr->data == NULL) {
         return NULL;
     }
 
-    ngx_memcpy(c->proxy_protocol_addr.data, addr, len);
-    c->proxy_protocol_addr.len = len;
+    ngx_memcpy(addr->data, pos, len);
+    addr->len = len;
 
-    for ( ;; ) {
-        if (p == last) {
-            goto invalid;
-        }
+    return p;
+}
 
-        if (*p++ == ' ') {
-            break;
-        }
-    }
 
-    port = p;
+static u_char *
+ngx_proxy_protocol_read_port(u_char *p, u_char *last, in_port_t *port,
+    u_char sep)
+{
+    size_t      len;
+    u_char     *pos;
+    ngx_int_t   n;
+
+    pos = p;
 
     for ( ;; ) {
         if (p == last) {
-            goto invalid;
+            return NULL;
         }
 
-        if (*p++ == ' ') {
+        if (*p++ == sep) {
             break;
         }
     }
 
-    len = p - port - 1;
-
-    n = ngx_atoi(port, len);
+    len = p - pos - 1;
 
+    n = ngx_atoi(pos, len);
     if (n < 0 || n > 65535) {
-        goto invalid;
-    }
-
-    c->proxy_protocol_port = (in_port_t) n;
-
-    ngx_log_debug2(NGX_LOG_DEBUG_CORE, c->log, 0,
-                   "PROXY protocol address: %V %d", &c->proxy_protocol_addr,
-                   c->proxy_protocol_port);
-
-skip:
-
-    for ( /* void */ ; p < last - 1; p++) {
-        if (p[0] == CR && p[1] == LF) {
-            return p + 2;
-        }
+        return NULL;
     }
 
-invalid:
+    *port = (in_port_t) n;
 
-    ngx_log_error(NGX_LOG_ERR, c->log, 0,
-                  "broken header: \"%*s\"", (size_t) (last - buf), buf);
-
-    return NULL;
+    return p;
 }
 
 
@@ -219,7 +273,8 @@ ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf, u_char *last)
     size_t                              len;
     socklen_t                           socklen;
     ngx_uint_t                          version, command, family, transport;
-    ngx_sockaddr_t                      sockaddr;
+    ngx_sockaddr_t                      src_sockaddr, dst_sockaddr;
+    ngx_proxy_protocol_t               *pp;
     ngx_proxy_protocol_header_t        *header;
     ngx_proxy_protocol_inet_addrs_t    *in;
 #if (NGX_HAVE_INET6)
@@ -266,6 +321,11 @@ ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf, u_char *last)
         return end;
     }
 
+    pp = ngx_pcalloc(c->pool, sizeof(ngx_proxy_protocol_t));
+    if (pp == NULL) {
+        return NULL;
+    }
+
     family = header->family_transport >> 4;
 
     switch (family) {
@@ -278,11 +338,16 @@ ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf, u_char *last)
 
         in = (ngx_proxy_protocol_inet_addrs_t *) buf;
 
-        sockaddr.sockaddr_in.sin_family = AF_INET;
-        sockaddr.sockaddr_in.sin_port = 0;
-        memcpy(&sockaddr.sockaddr_in.sin_addr, in->src_addr, 4);
+        src_sockaddr.sockaddr_in.sin_family = AF_INET;
+        src_sockaddr.sockaddr_in.sin_port = 0;
+        memcpy(&src_sockaddr.sockaddr_in.sin_addr, in->src_addr, 4);
 
-        c->proxy_protocol_port = ngx_proxy_protocol_parse_uint16(in->src_port);
+        dst_sockaddr.sockaddr_in.sin_family = AF_INET;
+        dst_sockaddr.sockaddr_in.sin_port = 0;
+        memcpy(&dst_sockaddr.sockaddr_in.sin_addr, in->dst_addr, 4);
+
+        pp->src_port = ngx_proxy_protocol_parse_uint16(in->src_port);
+        pp->dst_port = ngx_proxy_protocol_parse_uint16(in->dst_port);
 
         socklen = sizeof(struct sockaddr_in);
 
@@ -300,11 +365,16 @@ ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf, u_char *last)
 
         in6 = (ngx_proxy_protocol_inet6_addrs_t *) buf;
 
-        sockaddr.sockaddr_in6.sin6_family = AF_INET6;
-        sockaddr.sockaddr_in6.sin6_port = 0;
-        memcpy(&sockaddr.sockaddr_in6.sin6_addr, in6->src_addr, 16);
+        src_sockaddr.sockaddr_in6.sin6_family = AF_INET6;
+        src_sockaddr.sockaddr_in6.sin6_port = 0;
+        memcpy(&src_sockaddr.sockaddr_in6.sin6_addr, in6->src_addr, 16);
+
+        dst_sockaddr.sockaddr_in6.sin6_family = AF_INET6;
+        dst_sockaddr.sockaddr_in6.sin6_port = 0;
+        memcpy(&dst_sockaddr.sockaddr_in6.sin6_addr, in6->dst_addr, 16);
 
-        c->proxy_protocol_port = ngx_proxy_protocol_parse_uint16(in6->src_port);
+        pp->src_port = ngx_proxy_protocol_parse_uint16(in6->src_port);
+        pp->dst_port = ngx_proxy_protocol_parse_uint16(in6->dst_port);
 
         socklen = sizeof(struct sockaddr_in6);
 
@@ -321,23 +391,32 @@ ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf, u_char *last)
         return end;
     }
 
-    c->proxy_protocol_addr.data = ngx_pnalloc(c->pool, NGX_SOCKADDR_STRLEN);
-    if (c->proxy_protocol_addr.data == NULL) {
+    pp->src_addr.data = ngx_pnalloc(c->pool, NGX_SOCKADDR_STRLEN);
+    if (pp->src_addr.data == NULL) {
         return NULL;
     }
 
-    c->proxy_protocol_addr.len = ngx_sock_ntop(&sockaddr.sockaddr, socklen,
-                                               c->proxy_protocol_addr.data,
-                                               NGX_SOCKADDR_STRLEN, 0);
+    pp->src_addr.len = ngx_sock_ntop(&src_sockaddr.sockaddr, socklen,
+                                     pp->src_addr.data, NGX_SOCKADDR_STRLEN, 0);
 
-    ngx_log_debug2(NGX_LOG_DEBUG_CORE, c->log, 0,
-                   "PROXY protocol v2 address: %V %d", &c->proxy_protocol_addr,
-                   c->proxy_protocol_port);
+    pp->dst_addr.data = ngx_pnalloc(c->pool, NGX_SOCKADDR_STRLEN);
+    if (pp->dst_addr.data == NULL) {
+        return NULL;
+    }
+
+    pp->dst_addr.len = ngx_sock_ntop(&dst_sockaddr.sockaddr, socklen,
+                                     pp->dst_addr.data, NGX_SOCKADDR_STRLEN, 0);
+
+    ngx_log_debug4(NGX_LOG_DEBUG_CORE, c->log, 0,
+                   "PROXY protocol v2 src: %V %d, dst: %V %d",
+                   &pp->src_addr, pp->src_port, &pp->dst_addr, pp->dst_port);
 
     if (buf < end) {
         ngx_log_debug1(NGX_LOG_DEBUG_CORE, c->log, 0,
                        "PROXY protocol v2 %z bytes of tlv ignored", end - buf);
     }
 
+    c->proxy_protocol = pp;
+
     return end;
 }
diff --git a/src/core/ngx_proxy_protocol.h b/src/core/ngx_proxy_protocol.h
index fb848f68..b7162209 100644
--- a/src/core/ngx_proxy_protocol.h
+++ b/src/core/ngx_proxy_protocol.h
@@ -16,6 +16,14 @@
 #define NGX_PROXY_PROTOCOL_MAX_HEADER  107
 
 
+struct ngx_proxy_protocol_s {
+    ngx_str_t           src_addr;
+    ngx_str_t           dst_addr;
+    in_port_t           src_port;
+    in_port_t           dst_port;
+};
+
+
 u_char *ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf,
     u_char *last);
 u_char *ngx_proxy_protocol_write(ngx_connection_t *c, u_char *buf,
diff --git a/src/core/ngx_rbtree.c b/src/core/ngx_rbtree.c
index 969d549c..377b82fc 100644
--- a/src/core/ngx_rbtree.c
+++ b/src/core/ngx_rbtree.c
@@ -174,12 +174,7 @@ ngx_rbtree_delete(ngx_rbtree_t *tree, ngx_rbtree_node_t *node)
 
     } else {
         subst = ngx_rbtree_min(node->right, sentinel);
-
-        if (subst->left != sentinel) {
-            temp = subst->left;
-        } else {
-            temp = subst->right;
-        }
+        temp = subst->right;
     }
 
     if (subst == *root) {
diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c
index 593645d5..58d5f3ec 100644
--- a/src/core/ngx_resolver.c
+++ b/src/core/ngx_resolver.c
@@ -972,7 +972,8 @@ ngx_resolve_addr(ngx_resolver_ctx_t *ctx)
 
             name = ngx_resolver_dup(r, rn->name, rn->nlen);
             if (name == NULL) {
-                goto failed;
+                ngx_resolver_free(r, ctx);
+                return NGX_ERROR;
             }
 
             ctx->name.len = rn->nlen;
@@ -1562,13 +1563,28 @@ ngx_resolver_udp_read(ngx_event_t *rev)
     do {
         n = ngx_udp_recv(c, buf, NGX_RESOLVER_UDP_SIZE);
 
-        if (n < 0) {
-            return;
+        if (n == NGX_AGAIN) {
+            break;
+        }
+
+        if (n == NGX_ERROR) {
+            goto failed;
         }
 
         ngx_resolver_process_response(rec->resolver, buf, n, 0);
 
     } while (rev->ready);
+
+    if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+        goto failed;
+    }
+
+    return;
+
+failed:
+
+    ngx_close_connection(rec->udp);
+    rec->udp = NULL;
 }
 
 
@@ -1782,6 +1798,12 @@ ngx_resolver_process_response(ngx_resolver_t *r, u_char *buf, size_t n,
     i = sizeof(ngx_resolver_hdr_t);
 
     while (i < (ngx_uint_t) n) {
+
+        if (buf[i] & 0xc0) {
+            err = "unexpected compression pointer in DNS response";
+            goto done;
+        }
+
         if (buf[i] == '\0') {
             goto found;
         }
@@ -1917,7 +1939,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,
 
     if (rn == NULL) {
         ngx_log_error(r->log_level, r->log, 0,
-                      "unexpected response for %V", &name);
+                      "unexpected DNS response for %V", &name);
         ngx_resolver_free(r, name.data);
         goto failed;
     }
@@ -1929,7 +1951,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,
 
         if (rn->query6 == NULL || rn->naddrs6 != (u_short) -1) {
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected response for %V", &name);
+                          "unexpected DNS response for %V", &name);
             ngx_resolver_free(r, name.data);
             goto failed;
         }
@@ -1948,7 +1970,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,
 
         if (rn->query == NULL || rn->naddrs != (u_short) -1) {
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected response for %V", &name);
+                          "unexpected DNS response for %V", &name);
             ngx_resolver_free(r, name.data);
             goto failed;
         }
@@ -1963,7 +1985,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,
 
     if (ident != qident) {
         ngx_log_error(r->log_level, r->log, 0,
-                      "wrong ident %ui response for %V, expect %ui",
+                      "wrong ident %ui in DNS response for %V, expect %ui",
                       ident, &name, qident);
         ngx_resolver_free(r, name.data);
         goto failed;
@@ -2148,7 +2170,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,
 
         if (class != 1) {
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected RR class %ui", class);
+                          "unexpected RR class %ui in DNS response", class);
             goto failed;
         }
 
@@ -2217,7 +2239,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,
         default:
 
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected RR type %ui", type);
+                          "unexpected RR type %ui in DNS response", type);
         }
 
         i += len;
@@ -2566,7 +2588,7 @@ ngx_resolver_process_srv(ngx_resolver_t *r, u_char *buf, size_t n,
 
     if (rn == NULL || rn->query == NULL) {
         ngx_log_error(r->log_level, r->log, 0,
-                      "unexpected response for %V", &name);
+                      "unexpected DNS response for %V", &name);
         ngx_resolver_free(r, name.data);
         goto failed;
     }
@@ -2580,7 +2602,7 @@ ngx_resolver_process_srv(ngx_resolver_t *r, u_char *buf, size_t n,
 
     if (ident != qident) {
         ngx_log_error(r->log_level, r->log, 0,
-                      "wrong ident %ui response for %V, expect %ui",
+                      "wrong ident %ui in DNS response for %V, expect %ui",
                       ident, &name, qident);
         ngx_resolver_free(r, name.data);
         goto failed;
@@ -2690,7 +2712,7 @@ ngx_resolver_process_srv(ngx_resolver_t *r, u_char *buf, size_t n,
 
         if (class != 1) {
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected RR class %ui", class);
+                          "unexpected RR class %ui in DNS response", class);
             goto failed;
         }
 
@@ -2733,7 +2755,7 @@ ngx_resolver_process_srv(ngx_resolver_t *r, u_char *buf, size_t n,
         default:
 
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected RR type %ui", type);
+                          "unexpected RR type %ui in DNS response", type);
         }
 
         i += len;
@@ -3164,7 +3186,7 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n,
 
     if (rn == NULL || rn->query == NULL) {
         ngx_log_error(r->log_level, r->log, 0,
-                      "unexpected response for %V", &name);
+                      "unexpected DNS response for %V", &name);
         ngx_resolver_free(r, name.data);
         goto failed;
     }
@@ -3173,7 +3195,7 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n,
 
     if (ident != qident) {
         ngx_log_error(r->log_level, r->log, 0,
-                      "wrong ident %ui response for %V, expect %ui",
+                      "wrong ident %ui in DNS response for %V, expect %ui",
                       ident, &name, qident);
         ngx_resolver_free(r, name.data);
         goto failed;
@@ -3255,7 +3277,7 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n,
 
         if (class != 1) {
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected RR class %ui", class);
+                          "unexpected RR class %ui in DNS response", class);
             goto failed;
         }
 
@@ -3282,7 +3304,7 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n,
         default:
 
             ngx_log_error(r->log_level, r->log, 0,
-                          "unexpected RR type %ui", type);
+                          "unexpected RR type %ui in DNS response", type);
         }
 
         i += len;
@@ -3923,11 +3945,11 @@ ngx_resolver_copy(ngx_resolver_t *r, ngx_str_t *name, u_char *buf, u_char *src,
 {
     char        *err;
     u_char      *p, *dst;
-    ssize_t      len;
+    size_t       len;
     ngx_uint_t   i, n;
 
     p = src;
-    len = -1;
+    len = 0;
 
     /*
      * compression pointers allow to create endless loop, so we set limit;
@@ -3942,6 +3964,16 @@ ngx_resolver_copy(ngx_resolver_t *r, ngx_str_t *name, u_char *buf, u_char *src,
         }
 
         if (n & 0xc0) {
+            if ((n & 0xc0) != 0xc0) {
+                err = "invalid label type in DNS response";
+                goto invalid;
+            }
+
+            if (p >= last) {
+                err = "name is out of DNS response";
+                goto invalid;
+            }
+
             n = ((n & 0x3f) << 8) + *p;
             p = &buf[n];
 
@@ -3951,12 +3983,12 @@ ngx_resolver_copy(ngx_resolver_t *r, ngx_str_t *name, u_char *buf, u_char *src,
         }
 
         if (p >= last) {
-            err = "name is out of response";
+            err = "name is out of DNS response";
             goto invalid;
         }
     }
 
-    err = "compression pointers loop";
+    err = "compression pointers loop in DNS response";
 
 invalid:
 
@@ -3970,7 +4002,7 @@ ngx_resolver_copy(ngx_resolver_t *r, ngx_str_t *name, u_char *buf, u_char *src,
         return NGX_OK;
     }
 
-    if (len == -1) {
+    if (len == 0) {
         ngx_str_null(name);
         return NGX_OK;
     }
@@ -3982,30 +4014,23 @@ ngx_resolver_copy(ngx_resolver_t *r, ngx_str_t *name, u_char *buf, u_char *src,
 
     name->data = dst;
 
-    n = *src++;
-
     for ( ;; ) {
+        n = *src++;
+
+        if (n == 0) {
+            name->len = dst - name->data - 1;
+            return NGX_OK;
+        }
+
         if (n & 0xc0) {
             n = ((n & 0x3f) << 8) + *src;
             src = &buf[n];
 
-            n = *src++;
-
         } else {
             ngx_strlow(dst, src, n);
             dst += n;
             src += n;
-
-            n = *src++;
-
-            if (n != 0) {
-                *dst++ = '.';
-            }
-        }
-
-        if (n == 0) {
-            name->len = dst - name->data;
-            return NGX_OK;
+            *dst++ = '.';
         }
     }
 }
@@ -4443,6 +4468,8 @@ ngx_udp_connect(ngx_resolver_connection_t *rec)
 
     c->number = ngx_atomic_fetch_add(ngx_connection_counter, 1);
 
+    c->start_time = ngx_current_msec;
+
     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, &rec->log, 0,
                    "connect to %V, fd:%d #%uA", &rec->server, s, c->number);
 
@@ -4529,6 +4556,8 @@ ngx_tcp_connect(ngx_resolver_connection_t *rec)
 
     c->number = ngx_atomic_fetch_add(ngx_connection_counter, 1);
 
+    c->start_time = ngx_current_msec;
+
     if (ngx_add_conn) {
         if (ngx_add_conn(c) == NGX_ERROR) {
             goto failed;
diff --git a/src/core/ngx_string.c b/src/core/ngx_string.c
index 468e9600..5cc9b26f 100644
--- a/src/core/ngx_string.c
+++ b/src/core/ngx_string.c
@@ -11,6 +11,8 @@
 
 static u_char *ngx_sprintf_num(u_char *buf, u_char *last, uint64_t ui64,
     u_char zero, ngx_uint_t hexadecimal, ngx_uint_t width);
+static u_char *ngx_sprintf_str(u_char *buf, u_char *last, u_char *src,
+    size_t len, ngx_uint_t hexadecimal);
 static void ngx_encode_base64_internal(ngx_str_t *dst, ngx_str_t *src,
     const u_char *basis, ngx_uint_t padding);
 static ngx_int_t ngx_decode_base64_internal(ngx_str_t *dst, ngx_str_t *src,
@@ -101,10 +103,10 @@ ngx_pstrdup(ngx_pool_t *pool, ngx_str_t *src)
  *    %M                        ngx_msec_t
  *    %r                        rlim_t
  *    %p                        void *
- *    %V                        ngx_str_t *
- *    %v                        ngx_variable_value_t *
- *    %s                        null-terminated string
- *    %*s                       length and string
+ *    %[x|X]V                   ngx_str_t *
+ *    %[x|X]v                   ngx_variable_value_t *
+ *    %[x|X]s                   null-terminated string
+ *    %*[x|X]s                  length and string
  *    %Z                        '\0'
  *    %N                        '\n'
  *    %c                        char
@@ -165,7 +167,7 @@ ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
     u_char                *p, zero;
     int                    d;
     double                 f;
-    size_t                 len, slen;
+    size_t                 slen;
     int64_t                i64;
     uint64_t               ui64, frac;
     ngx_msec_t             ms;
@@ -250,8 +252,7 @@ ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
             case 'V':
                 v = va_arg(args, ngx_str_t *);
 
-                len = ngx_min(((size_t) (last - buf)), v->len);
-                buf = ngx_cpymem(buf, v->data, len);
+                buf = ngx_sprintf_str(buf, last, v->data, v->len, hex);
                 fmt++;
 
                 continue;
@@ -259,8 +260,7 @@ ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
             case 'v':
                 vv = va_arg(args, ngx_variable_value_t *);
 
-                len = ngx_min(((size_t) (last - buf)), vv->len);
-                buf = ngx_cpymem(buf, vv->data, len);
+                buf = ngx_sprintf_str(buf, last, vv->data, vv->len, hex);
                 fmt++;
 
                 continue;
@@ -268,16 +268,7 @@ ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
             case 's':
                 p = va_arg(args, u_char *);
 
-                if (slen == (size_t) -1) {
-                    while (*p && buf < last) {
-                        *buf++ = *p++;
-                    }
-
-                } else {
-                    len = ngx_min(((size_t) (last - buf)), slen);
-                    buf = ngx_cpymem(buf, p, len);
-                }
-
+                buf = ngx_sprintf_str(buf, last, p, slen, hex);
                 fmt++;
 
                 continue;
@@ -576,6 +567,64 @@ ngx_sprintf_num(u_char *buf, u_char *last, uint64_t ui64, u_char zero,
 }
 
 
+static u_char *
+ngx_sprintf_str(u_char *buf, u_char *last, u_char *src, size_t len,
+    ngx_uint_t hexadecimal)
+{
+    static u_char   hex[] = "0123456789abcdef";
+    static u_char   HEX[] = "0123456789ABCDEF";
+
+    if (hexadecimal == 0) {
+
+        if (len == (size_t) -1) {
+            while (*src && buf < last) {
+                *buf++ = *src++;
+            }
+
+        } else {
+            len = ngx_min((size_t) (last - buf), len);
+            buf = ngx_cpymem(buf, src, len);
+        }
+
+    } else if (hexadecimal == 1) {
+
+        if (len == (size_t) -1) {
+
+            while (*src && buf < last - 1) {
+                *buf++ = hex[*src >> 4];
+                *buf++ = hex[*src++ & 0xf];
+            }
+
+        } else {
+
+            while (len-- && buf < last - 1) {
+                *buf++ = hex[*src >> 4];
+                *buf++ = hex[*src++ & 0xf];
+            }
+        }
+
+    } else { /* hexadecimal == 2 */
+
+        if (len == (size_t) -1) {
+
+            while (*src && buf < last - 1) {
+                *buf++ = HEX[*src >> 4];
+                *buf++ = HEX[*src++ & 0xf];
+            }
+
+        } else {
+
+            while (len-- && buf < last - 1) {
+                *buf++ = HEX[*src >> 4];
+                *buf++ = HEX[*src++ & 0xf];
+            }
+        }
+    }
+
+    return buf;
+}
+
+
 /*
  * We use ngx_strcasecmp()/ngx_strncasecmp() for 7-bit ASCII strings only,
  * and implement our own ngx_strcasecmp()/ngx_strncasecmp()
@@ -1524,7 +1573,7 @@ ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
         0xffffffff  /* 1111 1111 1111 1111  1111 1111 1111 1111 */
     };
 
-                    /* " ", """, "%", "'", %00-%1F, %7F-%FF */
+                    /* " ", """, "'", %00-%1F, %7F-%FF */
 
     static uint32_t   refresh[] = {
         0xffffffff, /* 1111 1111 1111 1111  1111 1111 1111 1111 */
diff --git a/src/event/modules/ngx_devpoll_module.c b/src/event/modules/ngx_devpoll_module.c
index ee9f854b..590eb28e 100644
--- a/src/event/modules/ngx_devpoll_module.c
+++ b/src/event/modules/ngx_devpoll_module.c
@@ -495,6 +495,7 @@ ngx_devpoll_process_events(ngx_cycle_t *cycle, ngx_msec_t timer,
 
         if ((revents & POLLIN) && rev->active) {
             rev->ready = 1;
+            rev->available = -1;
 
             if (flags & NGX_POST_EVENTS) {
                 queue = rev->accept ? &ngx_posted_accept_events
diff --git a/src/event/modules/ngx_epoll_module.c b/src/event/modules/ngx_epoll_module.c
index 76aee08c..98e3ce7c 100644
--- a/src/event/modules/ngx_epoll_module.c
+++ b/src/event/modules/ngx_epoll_module.c
@@ -886,11 +886,10 @@ ngx_epoll_process_events(ngx_cycle_t *cycle, ngx_msec_t timer, ngx_uint_t flags)
             if (revents & EPOLLRDHUP) {
                 rev->pending_eof = 1;
             }
-
-            rev->available = 1;
 #endif
 
             rev->ready = 1;
+            rev->available = -1;
 
             if (flags & NGX_POST_EVENTS) {
                 queue = rev->accept ? &ngx_posted_accept_events
diff --git a/src/event/modules/ngx_eventport_module.c b/src/event/modules/ngx_eventport_module.c
index 11ad0934..d304e1c9 100644
--- a/src/event/modules/ngx_eventport_module.c
+++ b/src/event/modules/ngx_eventport_module.c
@@ -399,7 +399,7 @@ ngx_eventport_del_event(ngx_event_t *ev, ngx_int_t event, ngx_uint_t flags)
             return NGX_ERROR;
         }
 
-    } else {
+    } else if (ev->active) {
         ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                        "eventport del event: fd:%d", c->fd);
 
@@ -559,6 +559,7 @@ ngx_eventport_process_events(ngx_cycle_t *cycle, ngx_msec_t timer,
 
             if (revents & POLLIN) {
                 rev->ready = 1;
+                rev->available = -1;
 
                 if (flags & NGX_POST_EVENTS) {
                     queue = rev->accept ? &ngx_posted_accept_events
diff --git a/src/event/modules/ngx_poll_module.c b/src/event/modules/ngx_poll_module.c
index b46ab538..c16f0242 100644
--- a/src/event/modules/ngx_poll_module.c
+++ b/src/event/modules/ngx_poll_module.c
@@ -370,6 +370,7 @@ ngx_poll_process_events(ngx_cycle_t *cycle, ngx_msec_t timer, ngx_uint_t flags)
 
             ev = c->read;
             ev->ready = 1;
+            ev->available = -1;
 
             queue = ev->accept ? &ngx_posted_accept_events
                                : &ngx_posted_events;
diff --git a/src/event/modules/ngx_select_module.c b/src/event/modules/ngx_select_module.c
index 06446219..b9fceb3b 100644
--- a/src/event/modules/ngx_select_module.c
+++ b/src/event/modules/ngx_select_module.c
@@ -330,6 +330,7 @@ ngx_select_process_events(ngx_cycle_t *cycle, ngx_msec_t timer,
 
         if (found) {
             ev->ready = 1;
+            ev->available = -1;
 
             queue = ev->accept ? &ngx_posted_accept_events
                                : &ngx_posted_events;
diff --git a/src/event/modules/ngx_win32_poll_module.c b/src/event/modules/ngx_win32_poll_module.c
index 9fe867f7..2fbc1b37 100644
--- a/src/event/modules/ngx_win32_poll_module.c
+++ b/src/event/modules/ngx_win32_poll_module.c
@@ -380,6 +380,7 @@ ngx_poll_process_events(ngx_cycle_t *cycle, ngx_msec_t timer, ngx_uint_t flags)
 
             ev = c->read;
             ev->ready = 1;
+            ev->available = -1;
 
             queue = ev->accept ? &ngx_posted_accept_events
                                : &ngx_posted_events;
diff --git a/src/event/modules/ngx_win32_select_module.c b/src/event/modules/ngx_win32_select_module.c
index 8093a600..962514a3 100644
--- a/src/event/modules/ngx_win32_select_module.c
+++ b/src/event/modules/ngx_win32_select_module.c
@@ -330,6 +330,7 @@ ngx_select_process_events(ngx_cycle_t *cycle, ngx_msec_t timer,
 
         if (found) {
             ev->ready = 1;
+            ev->available = -1;
 
             queue = ev->accept ? &ngx_posted_accept_events
                                : &ngx_posted_events;
diff --git a/src/event/ngx_event.c b/src/event/ngx_event.c
index 69c55d7a..7777d043 100644
--- a/src/event/ngx_event.c
+++ b/src/event/ngx_event.c
@@ -237,6 +237,11 @@ ngx_process_events_and_timers(ngx_cycle_t *cycle)
         }
     }
 
+    if (!ngx_queue_empty(&ngx_posted_next_events)) {
+        ngx_event_move_posted_next(cycle);
+        timer = 0;
+    }
+
     delta = ngx_current_msec;
 
     (void) ngx_process_events(cycle, timer, flags);
@@ -252,9 +257,7 @@ ngx_process_events_and_timers(ngx_cycle_t *cycle)
         ngx_shmtx_unlock(&ngx_accept_mutex);
     }
 
-    if (delta) {
-        ngx_event_expire_timers();
-    }
+    ngx_event_expire_timers();
 
     ngx_event_process_posted(cycle, &ngx_posted_events);
 }
@@ -313,7 +316,7 @@ ngx_handle_read_event(ngx_event_t *rev, ngx_uint_t flags)
             return NGX_OK;
         }
 
-        if (rev->oneshot && !rev->ready) {
+        if (rev->oneshot && rev->ready) {
             if (ngx_del_event(rev, NGX_READ_EVENT, 0) == NGX_ERROR) {
                 return NGX_ERROR;
             }
@@ -639,6 +642,7 @@ ngx_event_process_init(ngx_cycle_t *cycle)
 #endif
 
     ngx_queue_init(&ngx_posted_accept_events);
+    ngx_queue_init(&ngx_posted_next_events);
     ngx_queue_init(&ngx_posted_events);
 
     if (ngx_event_timer_init(cycle->log) == NGX_ERROR) {
diff --git a/src/event/ngx_event.h b/src/event/ngx_event.h
index bb77c4ae..97f9673c 100644
--- a/src/event/ngx_event.h
+++ b/src/event/ngx_event.h
@@ -91,21 +91,14 @@ struct ngx_event_s {
      *   write:      available space in buffer when event is ready
      *               or lowat when event is set with NGX_LOWAT_EVENT flag
      *
-     * epoll with EPOLLRDHUP:
-     *   accept:     1 if accept many, 0 otherwise
-     *   read:       1 if there can be data to read, 0 otherwise
-     *
      * iocp: TODO
      *
      * otherwise:
      *   accept:     1 if accept many, 0 otherwise
+     *   read:       bytes to read when event is ready, -1 if not known
      */
 
-#if (NGX_HAVE_KQUEUE) || (NGX_HAVE_IOCP)
     int              available;
-#else
-    unsigned         available:1;
-#endif
 
     ngx_event_handler_pt  handler;
 
diff --git a/src/event/ngx_event_accept.c b/src/event/ngx_event_accept.c
index 43642409..b05666c7 100644
--- a/src/event/ngx_event_accept.c
+++ b/src/event/ngx_event_accept.c
@@ -256,6 +256,8 @@ ngx_event_accept(ngx_event_t *ev)
 
         c->number = ngx_atomic_fetch_add(ngx_connection_counter, 1);
 
+        c->start_time = ngx_current_msec;
+
 #if (NGX_STAT_STUB)
         (void) ngx_atomic_fetch_add(ngx_stat_handled, 1);
 #endif
diff --git a/src/event/ngx_event_connect.c b/src/event/ngx_event_connect.c
index 1ffa7984..adbbde63 100644
--- a/src/event/ngx_event_connect.c
+++ b/src/event/ngx_event_connect.c
@@ -193,6 +193,8 @@ ngx_event_connect_peer(ngx_peer_connection_t *pc)
 
     c->number = ngx_atomic_fetch_add(ngx_connection_counter, 1);
 
+    c->start_time = ngx_current_msec;
+
     if (ngx_add_conn) {
         if (ngx_add_conn(c) == NGX_ERROR) {
             goto failed;
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 7be4fb4c..d762d6b7 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -83,7 +83,7 @@ static time_t ngx_ssl_parse_time(
 #if OPENSSL_VERSION_NUMBER > 0x10100000L
     const
 #endif
-    ASN1_TIME *asn1time);
+    ASN1_TIME *asn1time, ngx_log_t *log);
 
 static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
 static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
@@ -130,6 +130,7 @@ int  ngx_ssl_connection_index;
 int  ngx_ssl_server_conf_index;
 int  ngx_ssl_session_cache_index;
 int  ngx_ssl_session_ticket_keys_index;
+int  ngx_ssl_ocsp_index;
 int  ngx_ssl_certificate_index;
 int  ngx_ssl_next_certificate_index;
 int  ngx_ssl_certificate_name_index;
@@ -164,7 +165,6 @@ ngx_ssl_init(ngx_log_t *log)
 
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
 #ifndef SSL_OP_NO_COMPRESSION
     {
     /*
@@ -181,7 +181,6 @@ ngx_ssl_init(ngx_log_t *log)
         (void) sk_SSL_COMP_pop(ssl_comp_methods);
     }
     }
-#endif
 #endif
 
     ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
@@ -215,6 +214,13 @@ ngx_ssl_init(ngx_log_t *log)
         return NGX_ERROR;
     }
 
+    ngx_ssl_ocsp_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
+    if (ngx_ssl_ocsp_index == -1) {
+        ngx_ssl_error(NGX_LOG_ALERT, log, 0,
+                      "SSL_CTX_get_ex_new_index() failed");
+        return NGX_ERROR;
+    }
+
     ngx_ssl_certificate_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
                                                          NULL);
     if (ngx_ssl_certificate_index == -1) {
@@ -904,13 +910,6 @@ ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
         return NGX_ERROR;
     }
 
-    /*
-     * before 0.9.7h and 0.9.8 SSL_load_client_CA_file()
-     * always leaved an error in the error queue
-     */
-
-    ERR_clear_error();
-
     SSL_CTX_set_client_CA_list(ssl->ctx, list);
 
     return NGX_OK;
@@ -921,6 +920,9 @@ ngx_int_t
 ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
     ngx_int_t depth)
 {
+    SSL_CTX_set_verify(ssl->ctx, SSL_CTX_get_verify_mode(ssl->ctx),
+                       ngx_ssl_verify_callback);
+
     SSL_CTX_set_verify_depth(ssl->ctx, depth);
 
     if (cert->len == 0) {
@@ -1012,26 +1014,52 @@ ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
 
     c = ngx_ssl_get_connection(ssl_conn);
 
+    if (!(c->log->log_level & NGX_LOG_DEBUG_EVENT)) {
+        return 1;
+    }
+
     cert = X509_STORE_CTX_get_current_cert(x509_store);
     err = X509_STORE_CTX_get_error(x509_store);
     depth = X509_STORE_CTX_get_error_depth(x509_store);
 
     sname = X509_get_subject_name(cert);
-    subject = sname ? X509_NAME_oneline(sname, NULL, 0) : "(none)";
+
+    if (sname) {
+        subject = X509_NAME_oneline(sname, NULL, 0);
+        if (subject == NULL) {
+            ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
+                          "X509_NAME_oneline() failed");
+        }
+
+    } else {
+        subject = NULL;
+    }
 
     iname = X509_get_issuer_name(cert);
-    issuer = iname ? X509_NAME_oneline(iname, NULL, 0) : "(none)";
+
+    if (iname) {
+        issuer = X509_NAME_oneline(iname, NULL, 0);
+        if (issuer == NULL) {
+            ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
+                          "X509_NAME_oneline() failed");
+        }
+
+    } else {
+        issuer = NULL;
+    }
 
     ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
                    "verify:%d, error:%d, depth:%d, "
                    "subject:\"%s\", issuer:\"%s\"",
-                   ok, err, depth, subject, issuer);
+                   ok, err, depth,
+                   subject ? subject : "(none)",
+                   issuer ? issuer : "(none)");
 
-    if (sname) {
+    if (subject) {
         OPENSSL_free(subject);
     }
 
-    if (iname) {
+    if (issuer) {
         OPENSSL_free(issuer);
     }
 #endif
@@ -1076,8 +1104,8 @@ ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret)
              * added to wbio, and set buffer size.
              */
 
-            rbio = SSL_get_rbio((ngx_ssl_conn_t *) ssl_conn);
-            wbio = SSL_get_wbio((ngx_ssl_conn_t *) ssl_conn);
+            rbio = SSL_get_rbio(ssl_conn);
+            wbio = SSL_get_wbio(ssl_conn);
 
             if (rbio != wbio) {
                 (void) BIO_set_write_buffer_size(wbio, NGX_SSL_BUFSIZE);
@@ -1360,7 +1388,6 @@ ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file)
 ngx_int_t
 ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *name)
 {
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
 #ifndef OPENSSL_NO_ECDH
 
     /*
@@ -1434,7 +1461,6 @@ ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *name)
 
     EC_KEY_free(ecdh);
 #endif
-#endif
 #endif
 
     return NGX_OK;
@@ -1470,6 +1496,78 @@ ngx_ssl_early_data(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable)
 }
 
 
+ngx_int_t
+ngx_ssl_conf_commands(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *commands)
+{
+    if (commands == NULL) {
+        return NGX_OK;
+    }
+
+#ifdef SSL_CONF_FLAG_FILE
+    {
+    int            type;
+    u_char        *key, *value;
+    ngx_uint_t     i;
+    ngx_keyval_t  *cmd;
+    SSL_CONF_CTX  *cctx;
+
+    cctx = SSL_CONF_CTX_new();
+    if (cctx == NULL) {
+        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+                      "SSL_CONF_CTX_new() failed");
+        return NGX_ERROR;
+    }
+
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_FILE);
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CLIENT);
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CERTIFICATE);
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SHOW_ERRORS);
+
+    SSL_CONF_CTX_set_ssl_ctx(cctx, ssl->ctx);
+
+    cmd = commands->elts;
+    for (i = 0; i < commands->nelts; i++) {
+
+        key = cmd[i].key.data;
+        type = SSL_CONF_cmd_value_type(cctx, (char *) key);
+
+        if (type == SSL_CONF_TYPE_FILE || type == SSL_CONF_TYPE_DIR) {
+            if (ngx_conf_full_name(cf->cycle, &cmd[i].value, 1) != NGX_OK) {
+                SSL_CONF_CTX_free(cctx);
+                return NGX_ERROR;
+            }
+        }
+
+        value = cmd[i].value.data;
+
+        if (SSL_CONF_cmd(cctx, (char *) key, (char *) value) <= 0) {
+            ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+                          "SSL_CONF_cmd(\"%s\", \"%s\") failed", key, value);
+            SSL_CONF_CTX_free(cctx);
+            return NGX_ERROR;
+        }
+    }
+
+    if (SSL_CONF_CTX_finish(cctx) != 1) {
+        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+                      "SSL_CONF_finish() failed");
+        SSL_CONF_CTX_free(cctx);
+        return NGX_ERROR;
+    }
+
+    SSL_CONF_CTX_free(cctx);
+
+    return NGX_OK;
+    }
+#else
+    ngx_log_error(NGX_LOG_EMERG, ssl->log, 0,
+                  "SSL_CONF_cmd() is not available on this platform");
+    return NGX_ERROR;
+#endif
+}
+
+
 ngx_int_t
 ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable)
 {
@@ -1605,6 +1703,7 @@ ngx_ssl_handshake(ngx_connection_t *c)
 {
     int        n, sslerr;
     ngx_err_t  err;
+    ngx_int_t  rc;
 
 #ifdef SSL_READ_EARLY_DATA_SUCCESS
     if (c->ssl->try_early_data) {
@@ -1612,6 +1711,10 @@ ngx_ssl_handshake(ngx_connection_t *c)
     }
 #endif
 
+    if (c->ssl->in_ocsp) {
+        return ngx_ssl_ocsp_validate(c);
+    }
+
     ngx_ssl_clear_error(c->log);
 
     n = SSL_do_handshake(c->ssl->connection);
@@ -1632,8 +1735,6 @@ ngx_ssl_handshake(ngx_connection_t *c)
         ngx_ssl_handshake_log(c);
 #endif
 
-        c->ssl->handshaked = 1;
-
         c->recv = ngx_ssl_recv;
         c->send = ngx_ssl_write;
         c->recv_chain = ngx_ssl_recv_chain;
@@ -1652,6 +1753,20 @@ ngx_ssl_handshake(ngx_connection_t *c)
 #endif
 #endif
 
+        rc = ngx_ssl_ocsp_validate(c);
+
+        if (rc == NGX_ERROR) {
+            return NGX_ERROR;
+        }
+
+        if (rc == NGX_AGAIN) {
+            c->read->handler = ngx_ssl_handshake_handler;
+            c->write->handler = ngx_ssl_handshake_handler;
+            return NGX_AGAIN;
+        }
+
+        c->ssl->handshaked = 1;
+
         return NGX_OK;
     }
 
@@ -1704,6 +1819,13 @@ ngx_ssl_handshake(ngx_connection_t *c)
         return NGX_ERROR;
     }
 
+    if (c->ssl->handshake_rejected) {
+        ngx_connection_error(c, err, "handshake rejected");
+        ERR_clear_error();
+
+        return NGX_ERROR;
+    }
+
     c->read->error = 1;
 
     ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
@@ -1721,6 +1843,7 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
     u_char     buf;
     size_t     readbytes;
     ngx_err_t  err;
+    ngx_int_t  rc;
 
     ngx_ssl_clear_error(c->log);
 
@@ -1755,7 +1878,6 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
         c->ssl->early_buf = buf;
         c->ssl->early_preread = 1;
 
-        c->ssl->handshaked = 1;
         c->ssl->in_early = 1;
 
         c->recv = ngx_ssl_recv;
@@ -1763,6 +1885,20 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
         c->recv_chain = ngx_ssl_recv_chain;
         c->send_chain = ngx_ssl_send_chain;
 
+        rc = ngx_ssl_ocsp_validate(c);
+
+        if (rc == NGX_ERROR) {
+            return NGX_ERROR;
+        }
+
+        if (rc == NGX_AGAIN) {
+            c->read->handler = ngx_ssl_handshake_handler;
+            c->write->handler = ngx_ssl_handshake_handler;
+            return NGX_AGAIN;
+        }
+
+        c->ssl->handshaked = 1;
+
         return NGX_OK;
     }
 
@@ -1838,6 +1974,10 @@ ngx_ssl_handshake_log(ngx_connection_t *c)
 #endif
     SSL_CIPHER  *cipher;
 
+    if (!(c->log->log_level & NGX_LOG_DEBUG_EVENT)) {
+        return;
+    }
+
     cipher = SSL_get_current_cipher(c->ssl->connection);
 
     if (cipher) {
@@ -1933,6 +2073,10 @@ ngx_ssl_recv_chain(ngx_connection_t *c, ngx_chain_t *cl, off_t limit)
             last += n;
             bytes += n;
 
+            if (!c->read->ready) {
+                return bytes;
+            }
+
             if (last == b->end) {
                 cl = cl->next;
 
@@ -2010,6 +2154,47 @@ ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size)
 
             if (size == 0) {
                 c->read->ready = 1;
+
+                if (c->read->available >= 0) {
+                    c->read->available -= bytes;
+
+                    /*
+                     * there can be data buffered at SSL layer,
+                     * so we post an event to continue reading on the next
+                     * iteration of the event loop
+                     */
+
+                    if (c->read->available < 0) {
+                        c->read->available = 0;
+                        c->read->ready = 0;
+
+                        if (c->read->posted) {
+                            ngx_delete_posted_event(c->read);
+                        }
+
+                        ngx_post_event(c->read, &ngx_posted_next_events);
+                    }
+
+                    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                                   "SSL_read: avail:%d", c->read->available);
+
+                } else {
+
+#if (NGX_HAVE_FIONREAD)
+
+                    if (ngx_socket_nread(c->fd, &c->read->available) == -1) {
+                        c->read->error = 1;
+                        ngx_connection_error(c, ngx_socket_errno,
+                                             ngx_socket_nread_n " failed");
+                        return NGX_ERROR;
+                    }
+
+                    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                                   "SSL_read: avail:%d", c->read->available);
+
+#endif
+                }
+
                 return bytes;
             }
 
@@ -2497,6 +2682,18 @@ ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size)
 
     sslerr = SSL_get_error(c->ssl->connection, n);
 
+    if (sslerr == SSL_ERROR_ZERO_RETURN) {
+
+        /*
+         * OpenSSL 1.1.1 fails to return SSL_ERROR_SYSCALL if an error
+         * happens during SSL_write() after close_notify alert from the
+         * peer, and returns SSL_ERROR_ZERO_RETURN instead,
+         * https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8051ab2
+         */
+
+        sslerr = SSL_ERROR_SYSCALL;
+    }
+
     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
 
     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
@@ -2698,8 +2895,11 @@ ngx_ssl_free_buffer(ngx_connection_t *c)
 ngx_int_t
 ngx_ssl_shutdown(ngx_connection_t *c)
 {
-    int        n, sslerr, mode;
-    ngx_err_t  err;
+    int         n, sslerr, mode;
+    ngx_err_t   err;
+    ngx_uint_t  tries;
+
+    ngx_ssl_ocsp_cleanup(c);
 
     if (SSL_in_init(c->ssl->connection)) {
         /*
@@ -2710,11 +2910,12 @@ ngx_ssl_shutdown(ngx_connection_t *c)
 
         SSL_free(c->ssl->connection);
         c->ssl = NULL;
+        c->recv = ngx_recv;
 
         return NGX_OK;
     }
 
-    if (c->timedout) {
+    if (c->timedout || c->error || c->buffered) {
         mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN;
         SSL_set_quiet_shutdown(c->ssl->connection, 1);
 
@@ -2738,55 +2939,81 @@ ngx_ssl_shutdown(ngx_connection_t *c)
 
     ngx_ssl_clear_error(c->log);
 
-    n = SSL_shutdown(c->ssl->connection);
+    tries = 2;
+
+    for ( ;; ) {
+
+        /*
+         * For bidirectional shutdown, SSL_shutdown() needs to be called
+         * twice: first call sends the "close notify" alert and returns 0,
+         * second call waits for the peer's "close notify" alert.
+         */
+
+        n = SSL_shutdown(c->ssl->connection);
+
+        ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
 
-    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
+        if (n == 1) {
+            SSL_free(c->ssl->connection);
+            c->ssl = NULL;
+            c->recv = ngx_recv;
 
-    sslerr = 0;
+            return NGX_OK;
+        }
 
-    /* before 0.9.8m SSL_shutdown() returned 0 instead of -1 on errors */
+        if (n == 0 && tries-- > 1) {
+            continue;
+        }
+
+        /* before 0.9.8m SSL_shutdown() returned 0 instead of -1 on errors */
 
-    if (n != 1 && ERR_peek_error()) {
         sslerr = SSL_get_error(c->ssl->connection, n);
 
         ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
                        "SSL_get_error: %d", sslerr);
-    }
 
-    if (n == 1 || sslerr == 0 || sslerr == SSL_ERROR_ZERO_RETURN) {
-        SSL_free(c->ssl->connection);
-        c->ssl = NULL;
+        if (sslerr == SSL_ERROR_WANT_READ || sslerr == SSL_ERROR_WANT_WRITE) {
+            c->read->handler = ngx_ssl_shutdown_handler;
+            c->write->handler = ngx_ssl_shutdown_handler;
 
-        return NGX_OK;
-    }
+            if (sslerr == SSL_ERROR_WANT_READ) {
+                c->read->ready = 0;
 
-    if (sslerr == SSL_ERROR_WANT_READ || sslerr == SSL_ERROR_WANT_WRITE) {
-        c->read->handler = ngx_ssl_shutdown_handler;
-        c->write->handler = ngx_ssl_shutdown_handler;
+            } else {
+                c->write->ready = 0;
+            }
 
-        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
-            return NGX_ERROR;
-        }
+            if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+                return NGX_ERROR;
+            }
 
-        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
-            return NGX_ERROR;
-        }
+            if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
+                return NGX_ERROR;
+            }
 
-        if (sslerr == SSL_ERROR_WANT_READ) {
-            ngx_add_timer(c->read, 30000);
+            ngx_add_timer(c->read, 3000);
+
+            return NGX_AGAIN;
         }
 
-        return NGX_AGAIN;
-    }
+        if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
+            SSL_free(c->ssl->connection);
+            c->ssl = NULL;
+            c->recv = ngx_recv;
 
-    err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
+            return NGX_OK;
+        }
 
-    ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
+        err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
 
-    SSL_free(c->ssl->connection);
-    c->ssl = NULL;
+        ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
 
-    return NGX_ERROR;
+        SSL_free(c->ssl->connection);
+        c->ssl = NULL;
+        c->recv = ngx_recv;
+
+        return NGX_ERROR;
+    }
 }
 
 
@@ -2825,6 +3052,9 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
     if (sslerr == SSL_ERROR_SYSCALL) {
 
         if (err == NGX_ECONNRESET
+#if (NGX_WIN32)
+            || err == NGX_ECONNABORTED
+#endif
             || err == NGX_EPIPE
             || err == NGX_ENOTCONN
             || err == NGX_ETIMEDOUT
@@ -3165,8 +3395,9 @@ ngx_ssl_session_id_context(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
         }
     }
 
-    if (SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index) == NULL) {
-
+    if (SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index) == NULL
+        && certificates != NULL)
+    {
         /*
          * If certificates are loaded dynamically, we use certificate
          * names as specified in the configuration (with variables).
@@ -3364,17 +3595,8 @@ ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
         }
     }
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
-
     session_id = (u_char *) SSL_SESSION_get_id(sess, &session_id_length);
 
-#else
-
-    session_id = sess->session_id;
-    session_id_length = sess->session_id_length;
-
-#endif
-
 #if (NGX_PTR_SIZE == 8)
 
     id = sess_id->sess_id;
@@ -3450,13 +3672,10 @@ ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
 #endif
     u_char *id, int len, int *copy)
 {
-#if OPENSSL_VERSION_NUMBER >= 0x0090707fL
-    const
-#endif
-    u_char                   *p;
     size_t                    slen;
     uint32_t                  hash;
     ngx_int_t                 rc;
+    const u_char             *p;
     ngx_shm_zone_t           *shm_zone;
     ngx_slab_pool_t          *shpool;
     ngx_rbtree_node_t        *node, *sentinel;
@@ -3578,17 +3797,8 @@ ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
 
     cache = shm_zone->data;
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
-
     id = (u_char *) SSL_SESSION_get_id(sess, &len);
 
-#else
-
-    id = sess->session_id;
-    len = sess->session_id_length;
-
-#endif
-
     hash = ngx_crc32_short(id, len);
 
     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
@@ -3881,9 +4091,6 @@ ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
     ngx_ssl_session_ticket_key_t  *key;
     const EVP_MD                  *digest;
     const EVP_CIPHER              *cipher;
-#if (NGX_DEBUG)
-    u_char                         buf[32];
-#endif
 
     c = ngx_ssl_get_connection(ssl_conn);
     ssl_ctx = c->ssl->session_ctx;
@@ -3905,8 +4112,8 @@ ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
         /* encrypt session ticket */
 
         ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
-                       "ssl session ticket encrypt, key: \"%*s\" (%s session)",
-                       ngx_hex_dump(buf, key[0].name, 16) - buf, buf,
+                       "ssl session ticket encrypt, key: \"%*xs\" (%s session)",
+                       (size_t) 16, key[0].name,
                        SSL_session_reused(ssl_conn) ? "reused" : "new");
 
         if (key[0].size == 48) {
@@ -3952,17 +4159,16 @@ ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
         }
 
         ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
-                       "ssl session ticket decrypt, key: \"%*s\" not found",
-                       ngx_hex_dump(buf, name, 16) - buf, buf);
+                       "ssl session ticket decrypt, key: \"%*xs\" not found",
+                       (size_t) 16, name);
 
         return 0;
 
     found:
 
         ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
-                       "ssl session ticket decrypt, key: \"%*s\"%s",
-                       ngx_hex_dump(buf, key[i].name, 16) - buf, buf,
-                       (i == 0) ? " (default)" : "");
+                       "ssl session ticket decrypt, key: \"%*xs\"%s",
+                       (size_t) 16, key[i].name, (i == 0) ? " (default)" : "");
 
         if (key[i].size == 48) {
             cipher = EVP_aes_128_cbc();
@@ -4387,17 +4593,8 @@ ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
         return NGX_OK;
     }
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
-
     buf = (u_char *) SSL_SESSION_get_id(sess, &len);
 
-#else
-
-    buf = sess->session_id;
-    len = sess->session_id_length;
-
-#endif
-
     s->len = 2 * len;
     s->data = ngx_pnalloc(pool, 2 * len);
     if (s->data == NULL) {
@@ -4628,11 +4825,13 @@ ngx_ssl_get_subject_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 
     bio = BIO_new(BIO_s_mem());
     if (bio == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
         X509_free(cert);
         return NGX_ERROR;
     }
 
     if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "X509_NAME_print_ex() failed");
         goto failed;
     }
 
@@ -4680,11 +4879,13 @@ ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 
     bio = BIO_new(BIO_s_mem());
     if (bio == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
         X509_free(cert);
         return NGX_ERROR;
     }
 
     if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "X509_NAME_print_ex() failed");
         goto failed;
     }
 
@@ -4733,6 +4934,11 @@ ngx_ssl_get_subject_dn_legacy(ngx_connection_t *c, ngx_pool_t *pool,
     }
 
     p = X509_NAME_oneline(name, NULL, 0);
+    if (p == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "X509_NAME_oneline() failed");
+        X509_free(cert);
+        return NGX_ERROR;
+    }
 
     for (len = 0; p[len]; len++) { /* void */ }
 
@@ -4776,6 +4982,11 @@ ngx_ssl_get_issuer_dn_legacy(ngx_connection_t *c, ngx_pool_t *pool,
     }
 
     p = X509_NAME_oneline(name, NULL, 0);
+    if (p == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "X509_NAME_oneline() failed");
+        X509_free(cert);
+        return NGX_ERROR;
+    }
 
     for (len = 0; p[len]; len++) { /* void */ }
 
@@ -4812,6 +5023,7 @@ ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 
     bio = BIO_new(BIO_s_mem());
     if (bio == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
         X509_free(cert);
         return NGX_ERROR;
     }
@@ -4850,6 +5062,7 @@ ngx_ssl_get_fingerprint(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
     }
 
     if (!X509_digest(cert, EVP_sha1(), buf, &len)) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "X509_digest() failed");
         X509_free(cert);
         return NGX_ERROR;
     }
@@ -4887,11 +5100,14 @@ ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
     rc = SSL_get_verify_result(c->ssl->connection);
 
     if (rc == X509_V_OK) {
-        ngx_str_set(s, "SUCCESS");
-        return NGX_OK;
-    }
+        if (ngx_ssl_ocsp_get_status(c, &str) == NGX_OK) {
+            ngx_str_set(s, "SUCCESS");
+            return NGX_OK;
+        }
 
-    str = X509_verify_cert_error_string(rc);
+    } else {
+        str = X509_verify_cert_error_string(rc);
+    }
 
     s->data = ngx_pnalloc(pool, sizeof("FAILED:") - 1 + ngx_strlen(str));
     if (s->data == NULL) {
@@ -4920,6 +5136,7 @@ ngx_ssl_get_client_v_start(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 
     bio = BIO_new(BIO_s_mem());
     if (bio == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
         X509_free(cert);
         return NGX_ERROR;
     }
@@ -4964,6 +5181,7 @@ ngx_ssl_get_client_v_end(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 
     bio = BIO_new(BIO_s_mem());
     if (bio == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
         X509_free(cert);
         return NGX_ERROR;
     }
@@ -5006,9 +5224,9 @@ ngx_ssl_get_client_v_remain(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
     }
 
 #if OPENSSL_VERSION_NUMBER > 0x10100000L
-    end = ngx_ssl_parse_time(X509_get0_notAfter(cert));
+    end = ngx_ssl_parse_time(X509_get0_notAfter(cert), c->log);
 #else
-    end = ngx_ssl_parse_time(X509_get_notAfter(cert));
+    end = ngx_ssl_parse_time(X509_get_notAfter(cert), c->log);
 #endif
 
     if (end == (time_t) NGX_ERROR) {
@@ -5043,7 +5261,7 @@ ngx_ssl_parse_time(
 #if OPENSSL_VERSION_NUMBER > 0x10100000L
     const
 #endif
-    ASN1_TIME *asn1time)
+    ASN1_TIME *asn1time, ngx_log_t *log)
 {
     BIO     *bio;
     char    *value;
@@ -5059,6 +5277,7 @@ ngx_ssl_parse_time(
 
     bio = BIO_new(BIO_s_mem());
     if (bio == NULL) {
+        ngx_ssl_error(NGX_LOG_ALERT, log, 0, "BIO_new() failed");
         return NGX_ERROR;
     }
 
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 61da0c5d..329760d0 100644
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -64,6 +64,9 @@
 #endif
 
 
+typedef struct ngx_ssl_ocsp_s  ngx_ssl_ocsp_t;
+
+
 struct ngx_ssl_s {
     SSL_CTX                    *ctx;
     ngx_log_t                  *log;
@@ -87,9 +90,12 @@ struct ngx_ssl_connection_s {
     ngx_event_handler_pt        saved_read_handler;
     ngx_event_handler_pt        saved_write_handler;
 
+    ngx_ssl_ocsp_t             *ocsp;
+
     u_char                      early_buf;
 
     unsigned                    handshaked:1;
+    unsigned                    handshake_rejected:1;
     unsigned                    renegotiation:1;
     unsigned                    buffer:1;
     unsigned                    no_wait_shutdown:1;
@@ -97,6 +103,7 @@ struct ngx_ssl_connection_s {
     unsigned                    handshake_buffer_set:1;
     unsigned                    try_early_data:1;
     unsigned                    in_early:1;
+    unsigned                    in_ocsp:1;
     unsigned                    early_preread:1;
     unsigned                    write_blocked:1;
 };
@@ -180,6 +187,14 @@ ngx_int_t ngx_ssl_stapling(ngx_conf_t *cf, ngx_ssl_t *ssl,
     ngx_str_t *file, ngx_str_t *responder, ngx_uint_t verify);
 ngx_int_t ngx_ssl_stapling_resolver(ngx_conf_t *cf, ngx_ssl_t *ssl,
     ngx_resolver_t *resolver, ngx_msec_t resolver_timeout);
+ngx_int_t ngx_ssl_ocsp(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *responder,
+    ngx_uint_t depth, ngx_shm_zone_t *shm_zone);
+ngx_int_t ngx_ssl_ocsp_resolver(ngx_conf_t *cf, ngx_ssl_t *ssl,
+    ngx_resolver_t *resolver, ngx_msec_t resolver_timeout);
+ngx_int_t ngx_ssl_ocsp_validate(ngx_connection_t *c);
+ngx_int_t ngx_ssl_ocsp_get_status(ngx_connection_t *c, const char **s);
+void ngx_ssl_ocsp_cleanup(ngx_connection_t *c);
+ngx_int_t ngx_ssl_ocsp_cache_init(ngx_shm_zone_t *shm_zone, void *data);
 RSA *ngx_ssl_rsa512_key_callback(ngx_ssl_conn_t *ssl_conn, int is_export,
     int key_length);
 ngx_array_t *ngx_ssl_read_password_file(ngx_conf_t *cf, ngx_str_t *file);
@@ -189,6 +204,9 @@ ngx_int_t ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file);
 ngx_int_t ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *name);
 ngx_int_t ngx_ssl_early_data(ngx_conf_t *cf, ngx_ssl_t *ssl,
     ngx_uint_t enable);
+ngx_int_t ngx_ssl_conf_commands(ngx_conf_t *cf, ngx_ssl_t *ssl,
+    ngx_array_t *commands);
+
 ngx_int_t ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl,
     ngx_uint_t enable);
 ngx_int_t ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
@@ -197,6 +215,7 @@ ngx_int_t ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
 ngx_int_t ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl,
     ngx_array_t *paths);
 ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data);
+
 ngx_int_t ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c,
     ngx_uint_t flags);
 
@@ -281,6 +300,7 @@ extern int  ngx_ssl_connection_index;
 extern int  ngx_ssl_server_conf_index;
 extern int  ngx_ssl_session_cache_index;
 extern int  ngx_ssl_session_ticket_keys_index;
+extern int  ngx_ssl_ocsp_index;
 extern int  ngx_ssl_certificate_index;
 extern int  ngx_ssl_next_certificate_index;
 extern int  ngx_ssl_certificate_name_index;
diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c
index c832aa0a..e3fa8c4e 100644
--- a/src/event/ngx_event_openssl_stapling.c
+++ b/src/event/ngx_event_openssl_stapling.c
@@ -22,6 +22,7 @@ typedef struct {
     ngx_msec_t                   resolver_timeout;
 
     ngx_addr_t                  *addrs;
+    ngx_uint_t                   naddrs;
     ngx_str_t                    host;
     ngx_str_t                    uri;
     in_port_t                    port;
@@ -30,6 +31,7 @@ typedef struct {
 
     X509                        *cert;
     X509                        *issuer;
+    STACK_OF(X509)              *chain;
 
     u_char                      *name;
 
@@ -41,15 +43,66 @@ typedef struct {
 } ngx_ssl_stapling_t;
 
 
+typedef struct {
+    ngx_addr_t                  *addrs;
+    ngx_uint_t                   naddrs;
+
+    ngx_str_t                    host;
+    ngx_str_t                    uri;
+    in_port_t                    port;
+    ngx_uint_t                   depth;
+
+    ngx_shm_zone_t              *shm_zone;
+
+    ngx_resolver_t              *resolver;
+    ngx_msec_t                   resolver_timeout;
+} ngx_ssl_ocsp_conf_t;
+
+
+typedef struct {
+    ngx_rbtree_t                 rbtree;
+    ngx_rbtree_node_t            sentinel;
+    ngx_queue_t                  expire_queue;
+} ngx_ssl_ocsp_cache_t;
+
+
+typedef struct {
+    ngx_str_node_t               node;
+    ngx_queue_t                  queue;
+    int                          status;
+    time_t                       valid;
+} ngx_ssl_ocsp_cache_node_t;
+
+
 typedef struct ngx_ssl_ocsp_ctx_s  ngx_ssl_ocsp_ctx_t;
 
+
+struct ngx_ssl_ocsp_s {
+    STACK_OF(X509)              *certs;
+    ngx_uint_t                   ncert;
+
+    int                          cert_status;
+    ngx_int_t                    status;
+
+    ngx_ssl_ocsp_conf_t         *conf;
+    ngx_ssl_ocsp_ctx_t          *ctx;
+};
+
+
 struct ngx_ssl_ocsp_ctx_s {
+    SSL_CTX                     *ssl_ctx;
+
     X509                        *cert;
     X509                        *issuer;
+    STACK_OF(X509)              *chain;
+
+    int                          status;
+    time_t                       valid;
 
     u_char                      *name;
 
     ngx_uint_t                   naddrs;
+    ngx_uint_t                   naddr;
 
     ngx_addr_t                  *addrs;
     ngx_str_t                    host;
@@ -64,17 +117,20 @@ struct ngx_ssl_ocsp_ctx_s {
     void                       (*handler)(ngx_ssl_ocsp_ctx_t *ctx);
     void                        *data;
 
+    ngx_str_t                    key;
     ngx_buf_t                   *request;
     ngx_buf_t                   *response;
     ngx_peer_connection_t        peer;
 
+    ngx_shm_zone_t              *shm_zone;
+
     ngx_int_t                  (*process)(ngx_ssl_ocsp_ctx_t *ctx);
 
     ngx_uint_t                   state;
 
     ngx_uint_t                   code;
     ngx_uint_t                   count;
-
+    ngx_uint_t                   flags;
     ngx_uint_t                   done;
 
     u_char                      *header_name_start;
@@ -105,8 +161,14 @@ static time_t ngx_ssl_stapling_time(ASN1_GENERALIZEDTIME *asn1time);
 
 static void ngx_ssl_stapling_cleanup(void *data);
 
-static ngx_ssl_ocsp_ctx_t *ngx_ssl_ocsp_start(void);
+static void ngx_ssl_ocsp_validate_next(ngx_connection_t *c);
+static void ngx_ssl_ocsp_handler(ngx_ssl_ocsp_ctx_t *ctx);
+static ngx_int_t ngx_ssl_ocsp_responder(ngx_connection_t *c,
+    ngx_ssl_ocsp_ctx_t *ctx);
+
+static ngx_ssl_ocsp_ctx_t *ngx_ssl_ocsp_start(ngx_log_t *log);
 static void ngx_ssl_ocsp_done(ngx_ssl_ocsp_ctx_t *ctx);
+static void ngx_ssl_ocsp_next(ngx_ssl_ocsp_ctx_t *ctx);
 static void ngx_ssl_ocsp_request(ngx_ssl_ocsp_ctx_t *ctx);
 static void ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve);
 static void ngx_ssl_ocsp_connect(ngx_ssl_ocsp_ctx_t *ctx);
@@ -120,6 +182,11 @@ static ngx_int_t ngx_ssl_ocsp_parse_status_line(ngx_ssl_ocsp_ctx_t *ctx);
 static ngx_int_t ngx_ssl_ocsp_process_headers(ngx_ssl_ocsp_ctx_t *ctx);
 static ngx_int_t ngx_ssl_ocsp_parse_header_line(ngx_ssl_ocsp_ctx_t *ctx);
 static ngx_int_t ngx_ssl_ocsp_process_body(ngx_ssl_ocsp_ctx_t *ctx);
+static ngx_int_t ngx_ssl_ocsp_verify(ngx_ssl_ocsp_ctx_t *ctx);
+
+static ngx_int_t ngx_ssl_ocsp_cache_lookup(ngx_ssl_ocsp_ctx_t *ctx);
+static ngx_int_t ngx_ssl_ocsp_cache_store(ngx_ssl_ocsp_ctx_t *ctx);
+static ngx_int_t ngx_ssl_ocsp_create_key(ngx_ssl_ocsp_ctx_t *ctx);
 
 static u_char *ngx_ssl_ocsp_log_error(ngx_log_t *log, u_char *buf, size_t len);
 
@@ -173,6 +240,18 @@ ngx_ssl_stapling_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, X509 *cert,
         return NGX_ERROR;
     }
 
+#ifdef SSL_CTRL_SELECT_CURRENT_CERT
+    /* OpenSSL 1.0.2+ */
+    SSL_CTX_select_current_cert(ssl->ctx, cert);
+#endif
+
+#ifdef SSL_CTRL_GET_EXTRA_CHAIN_CERTS
+    /* OpenSSL 1.0.1+ */
+    SSL_CTX_get_extra_chain_certs(ssl->ctx, &staple->chain);
+#else
+    staple->chain = ssl->ctx->extra_certs;
+#endif
+
     staple->ssl_ctx = ssl->ctx;
     staple->timeout = 60000;
     staple->verify = verify;
@@ -289,29 +368,16 @@ ngx_ssl_stapling_issuer(ngx_conf_t *cf, ngx_ssl_t *ssl,
     X509            *cert, *issuer;
     X509_STORE      *store;
     X509_STORE_CTX  *store_ctx;
-    STACK_OF(X509)  *chain;
 
     cert = staple->cert;
 
-#ifdef SSL_CTRL_SELECT_CURRENT_CERT
-    /* OpenSSL 1.0.2+ */
-    SSL_CTX_select_current_cert(ssl->ctx, cert);
-#endif
-
-#ifdef SSL_CTRL_GET_EXTRA_CHAIN_CERTS
-    /* OpenSSL 1.0.1+ */
-    SSL_CTX_get_extra_chain_certs(ssl->ctx, &chain);
-#else
-    chain = ssl->ctx->extra_certs;
-#endif
-
-    n = sk_X509_num(chain);
+    n = sk_X509_num(staple->chain);
 
     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ssl->log, 0,
                    "SSL get issuer: %d extra certs", n);
 
     for (i = 0; i < n; i++) {
-        issuer = sk_X509_value(chain, i);
+        issuer = sk_X509_value(staple->chain, i);
         if (X509_check_issued(issuer, cert) == X509_V_OK) {
 #if OPENSSL_VERSION_NUMBER >= 0x10100001L
             X509_up_ref(issuer);
@@ -462,6 +528,7 @@ ngx_ssl_stapling_responder(ngx_conf_t *cf, ngx_ssl_t *ssl,
     }
 
     staple->addrs = u.addrs;
+    staple->naddrs = u.naddrs;
     staple->host = u.host;
     staple->uri = u.uri;
     staple->port = u.port;
@@ -559,16 +626,20 @@ ngx_ssl_stapling_update(ngx_ssl_stapling_t *staple)
 
     staple->loading = 1;
 
-    ctx = ngx_ssl_ocsp_start();
+    ctx = ngx_ssl_ocsp_start(ngx_cycle->log);
     if (ctx == NULL) {
         return;
     }
 
+    ctx->ssl_ctx = staple->ssl_ctx;
     ctx->cert = staple->cert;
     ctx->issuer = staple->issuer;
+    ctx->chain = staple->chain;
     ctx->name = staple->name;
+    ctx->flags = (staple->verify ? OCSP_TRUSTOTHER : OCSP_NOVERIFY);
 
     ctx->addrs = staple->addrs;
+    ctx->naddrs = staple->naddrs;
     ctx->host = staple->host;
     ctx->uri = staple->uri;
     ctx->port = staple->port;
@@ -589,140 +660,27 @@ ngx_ssl_stapling_update(ngx_ssl_stapling_t *staple)
 static void
 ngx_ssl_stapling_ocsp_handler(ngx_ssl_ocsp_ctx_t *ctx)
 {
-#if OPENSSL_VERSION_NUMBER >= 0x0090707fL
-    const
-#endif
-    u_char                *p;
-    int                    n;
-    size_t                 len;
-    time_t                 now, valid;
-    ngx_str_t              response;
-    X509_STORE            *store;
-    STACK_OF(X509)        *chain;
-    OCSP_CERTID           *id;
-    OCSP_RESPONSE         *ocsp;
-    OCSP_BASICRESP        *basic;
-    ngx_ssl_stapling_t    *staple;
-    ASN1_GENERALIZEDTIME  *thisupdate, *nextupdate;
+    time_t               now;
+    ngx_str_t            response;
+    ngx_ssl_stapling_t  *staple;
 
     staple = ctx->data;
     now = ngx_time();
-    ocsp = NULL;
-    basic = NULL;
-    id = NULL;
-
-    if (ctx->code != 200) {
-        goto error;
-    }
-
-    /* check the response */
-
-    len = ctx->response->last - ctx->response->pos;
-    p = ctx->response->pos;
-
-    ocsp = d2i_OCSP_RESPONSE(NULL, &p, len);
-    if (ocsp == NULL) {
-        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
-                      "d2i_OCSP_RESPONSE() failed");
-        goto error;
-    }
-
-    n = OCSP_response_status(ocsp);
-
-    if (n != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
-        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
-                      "OCSP response not successful (%d: %s)",
-                      n, OCSP_response_status_str(n));
-        goto error;
-    }
-
-    basic = OCSP_response_get1_basic(ocsp);
-    if (basic == NULL) {
-        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
-                      "OCSP_response_get1_basic() failed");
-        goto error;
-    }
-
-    store = SSL_CTX_get_cert_store(staple->ssl_ctx);
-    if (store == NULL) {
-        ngx_ssl_error(NGX_LOG_CRIT, ctx->log, 0,
-                      "SSL_CTX_get_cert_store() failed");
-        goto error;
-    }
-
-#ifdef SSL_CTRL_SELECT_CURRENT_CERT
-    /* OpenSSL 1.0.2+ */
-    SSL_CTX_select_current_cert(staple->ssl_ctx, ctx->cert);
-#endif
-
-#ifdef SSL_CTRL_GET_EXTRA_CHAIN_CERTS
-    /* OpenSSL 1.0.1+ */
-    SSL_CTX_get_extra_chain_certs(staple->ssl_ctx, &chain);
-#else
-    chain = staple->ssl_ctx->extra_certs;
-#endif
-
-    if (OCSP_basic_verify(basic, chain, store,
-                          staple->verify ? OCSP_TRUSTOTHER : OCSP_NOVERIFY)
-        != 1)
-    {
-        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
-                      "OCSP_basic_verify() failed");
-        goto error;
-    }
-
-    id = OCSP_cert_to_id(NULL, ctx->cert, ctx->issuer);
-    if (id == NULL) {
-        ngx_ssl_error(NGX_LOG_CRIT, ctx->log, 0,
-                      "OCSP_cert_to_id() failed");
-        goto error;
-    }
 
-    if (OCSP_resp_find_status(basic, id, &n, NULL, NULL,
-                              &thisupdate, &nextupdate)
-        != 1)
-    {
-        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
-                      "certificate status not found in the OCSP response");
+    if (ngx_ssl_ocsp_verify(ctx) != NGX_OK) {
         goto error;
     }
 
-    if (n != V_OCSP_CERTSTATUS_GOOD) {
+    if (ctx->status != V_OCSP_CERTSTATUS_GOOD) {
         ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
                       "certificate status \"%s\" in the OCSP response",
-                      OCSP_cert_status_str(n));
-        goto error;
-    }
-
-    if (OCSP_check_validity(thisupdate, nextupdate, 300, -1) != 1) {
-        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
-                      "OCSP_check_validity() failed");
+                      OCSP_cert_status_str(ctx->status));
         goto error;
     }
 
-    if (nextupdate) {
-        valid = ngx_ssl_stapling_time(nextupdate);
-        if (valid == (time_t) NGX_ERROR) {
-            ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
-                          "invalid nextUpdate time in certificate status");
-            goto error;
-        }
-
-    } else {
-        valid = NGX_MAX_TIME_T_VALUE;
-    }
-
-    OCSP_CERTID_free(id);
-    OCSP_BASICRESP_free(basic);
-    OCSP_RESPONSE_free(ocsp);
-
-    id = NULL;
-    basic = NULL;
-    ocsp = NULL;
-
     /* copy the response to memory not in ctx->pool */
 
-    response.len = len;
+    response.len = ctx->response->last - ctx->response->pos;
     response.data = ngx_alloc(response.len, ctx->log);
 
     if (response.data == NULL) {
@@ -731,16 +689,12 @@ ngx_ssl_stapling_ocsp_handler(ngx_ssl_ocsp_ctx_t *ctx)
 
     ngx_memcpy(response.data, ctx->response->pos, response.len);
 
-    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp response, %s, %uz",
-                   OCSP_cert_status_str(n), response.len);
-
     if (staple->staple.data) {
         ngx_free(staple->staple.data);
     }
 
     staple->staple = response;
-    staple->valid = valid;
+    staple->valid = ctx->valid;
 
     /*
      * refresh before the response expires,
@@ -748,7 +702,7 @@ ngx_ssl_stapling_ocsp_handler(ngx_ssl_ocsp_ctx_t *ctx)
      */
 
     staple->loading = 0;
-    staple->refresh = ngx_max(ngx_min(valid - 300, now + 3600), now + 300);
+    staple->refresh = ngx_max(ngx_min(ctx->valid - 300, now + 3600), now + 300);
 
     ngx_ssl_ocsp_done(ctx);
     return;
@@ -758,18 +712,6 @@ ngx_ssl_stapling_ocsp_handler(ngx_ssl_ocsp_ctx_t *ctx)
     staple->loading = 0;
     staple->refresh = now + 300;
 
-    if (id) {
-        OCSP_CERTID_free(id);
-    }
-
-    if (basic) {
-        OCSP_BASICRESP_free(basic);
-    }
-
-    if (ocsp) {
-        OCSP_RESPONSE_free(ocsp);
-    }
-
     ngx_ssl_ocsp_done(ctx);
 }
 
@@ -823,366 +765,905 @@ ngx_ssl_stapling_cleanup(void *data)
 }
 
 
-static ngx_ssl_ocsp_ctx_t *
-ngx_ssl_ocsp_start(void)
+ngx_int_t
+ngx_ssl_ocsp(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *responder,
+    ngx_uint_t depth, ngx_shm_zone_t *shm_zone)
 {
-    ngx_log_t           *log;
-    ngx_pool_t          *pool;
-    ngx_ssl_ocsp_ctx_t  *ctx;
-
-    pool = ngx_create_pool(2048, ngx_cycle->log);
-    if (pool == NULL) {
-        return NULL;
-    }
+    ngx_url_t             u;
+    ngx_ssl_ocsp_conf_t  *ocf;
 
-    ctx = ngx_pcalloc(pool, sizeof(ngx_ssl_ocsp_ctx_t));
-    if (ctx == NULL) {
-        ngx_destroy_pool(pool);
-        return NULL;
+    ocf = ngx_pcalloc(cf->pool, sizeof(ngx_ssl_ocsp_conf_t));
+    if (ocf == NULL) {
+        return NGX_ERROR;
     }
 
-    log = ngx_palloc(pool, sizeof(ngx_log_t));
-    if (log == NULL) {
-        ngx_destroy_pool(pool);
-        return NULL;
-    }
+    ocf->depth = depth;
+    ocf->shm_zone = shm_zone;
 
-    ctx->pool = pool;
+    if (responder->len) {
+        ngx_memzero(&u, sizeof(ngx_url_t));
 
-    *log = *ctx->pool->log;
+        u.url = *responder;
+        u.default_port = 80;
+        u.uri_part = 1;
 
-    ctx->pool->log = log;
-    ctx->log = log;
+        if (u.url.len > 7
+            && ngx_strncasecmp(u.url.data, (u_char *) "http://", 7) == 0)
+        {
+            u.url.len -= 7;
+            u.url.data += 7;
 
-    log->handler = ngx_ssl_ocsp_log_error;
-    log->data = ctx;
-    log->action = "requesting certificate status";
+        } else {
+            ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+                          "invalid URL prefix in OCSP responder \"%V\" "
+                          "in \"ssl_ocsp_responder\"", &u.url);
+            return NGX_ERROR;
+        }
 
-    return ctx;
-}
+        if (ngx_parse_url(cf->pool, &u) != NGX_OK) {
+            if (u.err) {
+                ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+                              "%s in OCSP responder \"%V\" "
+                              "in \"ssl_ocsp_responder\"", u.err, &u.url);
+            }
 
+            return NGX_ERROR;
+        }
 
-static void
-ngx_ssl_ocsp_done(ngx_ssl_ocsp_ctx_t *ctx)
-{
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp done");
+        ocf->addrs = u.addrs;
+        ocf->naddrs = u.naddrs;
+        ocf->host = u.host;
+        ocf->uri = u.uri;
+        ocf->port = u.port;
+    }
 
-    if (ctx->peer.connection) {
-        ngx_close_connection(ctx->peer.connection);
+    if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_ocsp_index, ocf) == 0) {
+        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+                      "SSL_CTX_set_ex_data() failed");
+        return NGX_ERROR;
     }
 
-    ngx_destroy_pool(ctx->pool);
+    return NGX_OK;
 }
 
 
-static void
-ngx_ssl_ocsp_error(ngx_ssl_ocsp_ctx_t *ctx)
+ngx_int_t
+ngx_ssl_ocsp_resolver(ngx_conf_t *cf, ngx_ssl_t *ssl,
+    ngx_resolver_t *resolver, ngx_msec_t resolver_timeout)
 {
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp error");
+    ngx_ssl_ocsp_conf_t  *ocf;
 
-    ctx->code = 0;
-    ctx->handler(ctx);
+    ocf = SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_ocsp_index);
+    ocf->resolver = resolver;
+    ocf->resolver_timeout = resolver_timeout;
+
+    return NGX_OK;
 }
 
 
-static void
-ngx_ssl_ocsp_request(ngx_ssl_ocsp_ctx_t *ctx)
+ngx_int_t
+ngx_ssl_ocsp_validate(ngx_connection_t *c)
 {
-    ngx_resolver_ctx_t  *resolve, temp;
+    X509                 *cert;
+    SSL_CTX              *ssl_ctx;
+    ngx_int_t             rc;
+    X509_STORE           *store;
+    X509_STORE_CTX       *store_ctx;
+    STACK_OF(X509)       *chain;
+    ngx_ssl_ocsp_t       *ocsp;
+    ngx_ssl_ocsp_conf_t  *ocf;
+
+    if (c->ssl->in_ocsp) {
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            return NGX_ERROR;
+        }
 
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp request");
+        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
+            return NGX_ERROR;
+        }
 
-    if (ngx_ssl_ocsp_create_request(ctx) != NGX_OK) {
-        ngx_ssl_ocsp_error(ctx);
-        return;
+        return NGX_AGAIN;
     }
 
-    if (ctx->resolver) {
-        /* resolve OCSP responder hostname */
+    ssl_ctx = SSL_get_SSL_CTX(c->ssl->connection);
 
-        temp.name = ctx->host;
+    ocf = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_ocsp_index);
+    if (ocf == NULL) {
+        return NGX_OK;
+    }
 
-        resolve = ngx_resolve_start(ctx->resolver, &temp);
-        if (resolve == NULL) {
-            ngx_ssl_ocsp_error(ctx);
-            return;
-        }
+    if (SSL_get_verify_result(c->ssl->connection) != X509_V_OK) {
+        return NGX_OK;
+    }
 
-        if (resolve == NGX_NO_RESOLVER) {
-            ngx_log_error(NGX_LOG_WARN, ctx->log, 0,
-                          "no resolver defined to resolve %V", &ctx->host);
-            goto connect;
-        }
+    cert = SSL_get_peer_certificate(c->ssl->connection);
+    if (cert == NULL) {
+        return NGX_OK;
+    }
 
-        resolve->name = ctx->host;
-        resolve->handler = ngx_ssl_ocsp_resolve_handler;
-        resolve->data = ctx;
-        resolve->timeout = ctx->resolver_timeout;
+    ocsp = ngx_pcalloc(c->pool, sizeof(ngx_ssl_ocsp_t));
+    if (ocsp == NULL) {
+        X509_free(cert);
+        return NGX_ERROR;
+    }
 
-        if (ngx_resolve_name(resolve) != NGX_OK) {
-            ngx_ssl_ocsp_error(ctx);
-            return;
-        }
+    c->ssl->ocsp = ocsp;
 
-        return;
+    ocsp->status = NGX_AGAIN;
+    ocsp->cert_status = V_OCSP_CERTSTATUS_GOOD;
+    ocsp->conf = ocf;
+
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined LIBRESSL_VERSION_NUMBER)
+
+    ocsp->certs = SSL_get0_verified_chain(c->ssl->connection);
+
+    if (ocsp->certs) {
+        ocsp->certs = X509_chain_up_ref(ocsp->certs);
+        if (ocsp->certs == NULL) {
+            X509_free(cert);
+            return NGX_ERROR;
+        }
     }
 
-connect:
+#endif
 
-    ngx_ssl_ocsp_connect(ctx);
-}
+    if (ocsp->certs == NULL) {
+        store = SSL_CTX_get_cert_store(ssl_ctx);
+        if (store == NULL) {
+            ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
+                          "SSL_CTX_get_cert_store() failed");
+            X509_free(cert);
+            return NGX_ERROR;
+        }
 
+        store_ctx = X509_STORE_CTX_new();
+        if (store_ctx == NULL) {
+            ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
+                          "X509_STORE_CTX_new() failed");
+            X509_free(cert);
+            return NGX_ERROR;
+        }
 
-static void
-ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve)
-{
-    ngx_ssl_ocsp_ctx_t *ctx = resolve->data;
+        chain = SSL_get_peer_cert_chain(c->ssl->connection);
 
-    u_char           *p;
-    size_t            len;
-    socklen_t         socklen;
-    ngx_uint_t        i;
-    struct sockaddr  *sockaddr;
+        if (X509_STORE_CTX_init(store_ctx, store, cert, chain) == 0) {
+            ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
+                          "X509_STORE_CTX_init() failed");
+            X509_STORE_CTX_free(store_ctx);
+            X509_free(cert);
+            return NGX_ERROR;
+        }
 
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp resolve handler");
+        rc = X509_verify_cert(store_ctx);
+        if (rc <= 0) {
+            ngx_ssl_error(NGX_LOG_ERR, c->log, 0, "X509_verify_cert() failed");
+            X509_STORE_CTX_free(store_ctx);
+            X509_free(cert);
+            return NGX_ERROR;
+        }
 
-    if (resolve->state) {
-        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
-                      "%V could not be resolved (%i: %s)",
-                      &resolve->name, resolve->state,
-                      ngx_resolver_strerror(resolve->state));
-        goto failed;
-    }
+        ocsp->certs = X509_STORE_CTX_get1_chain(store_ctx);
+        if (ocsp->certs == NULL) {
+            ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
+                          "X509_STORE_CTX_get1_chain() failed");
+            X509_STORE_CTX_free(store_ctx);
+            X509_free(cert);
+            return NGX_ERROR;
+        }
 
-#if (NGX_DEBUG)
-    {
-    u_char     text[NGX_SOCKADDR_STRLEN];
-    ngx_str_t  addr;
+        X509_STORE_CTX_free(store_ctx);
+    }
 
-    addr.data = text;
+    X509_free(cert);
 
-    for (i = 0; i < resolve->naddrs; i++) {
-        addr.len = ngx_sock_ntop(resolve->addrs[i].sockaddr,
-                                 resolve->addrs[i].socklen,
-                                 text, NGX_SOCKADDR_STRLEN, 0);
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                   "ssl ocsp validate, certs:%d", sk_X509_num(ocsp->certs));
 
-        ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                       "name was resolved to %V", &addr);
+    ngx_ssl_ocsp_validate_next(c);
 
+    if (ocsp->status == NGX_AGAIN) {
+        c->ssl->in_ocsp = 1;
+        return NGX_AGAIN;
     }
-    }
-#endif
 
-    ctx->naddrs = resolve->naddrs;
-    ctx->addrs = ngx_pcalloc(ctx->pool, ctx->naddrs * sizeof(ngx_addr_t));
+    return NGX_OK;
+}
 
-    if (ctx->addrs == NULL) {
-        goto failed;
-    }
 
-    for (i = 0; i < resolve->naddrs; i++) {
+static void
+ngx_ssl_ocsp_validate_next(ngx_connection_t *c)
+{
+    ngx_int_t             rc;
+    ngx_uint_t            n;
+    ngx_ssl_ocsp_t       *ocsp;
+    ngx_ssl_ocsp_ctx_t   *ctx;
+    ngx_ssl_ocsp_conf_t  *ocf;
 
-        socklen = resolve->addrs[i].socklen;
+    ocsp = c->ssl->ocsp;
+    ocf = ocsp->conf;
 
-        sockaddr = ngx_palloc(ctx->pool, socklen);
-        if (sockaddr == NULL) {
-            goto failed;
-        }
+    n = sk_X509_num(ocsp->certs);
 
-        ngx_memcpy(sockaddr, resolve->addrs[i].sockaddr, socklen);
-        ngx_inet_set_port(sockaddr, ctx->port);
+    for ( ;; ) {
 
-        ctx->addrs[i].sockaddr = sockaddr;
-        ctx->addrs[i].socklen = socklen;
+        if (ocsp->ncert == n - 1 || (ocf->depth == 2 && ocsp->ncert == 1)) {
+            ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                           "ssl ocsp validated, certs:%ui", ocsp->ncert);
+            rc = NGX_OK;
+            goto done;
+        }
 
-        p = ngx_pnalloc(ctx->pool, NGX_SOCKADDR_STRLEN);
-        if (p == NULL) {
-            goto failed;
+        ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                       "ssl ocsp validate cert:%ui", ocsp->ncert);
+
+        ctx = ngx_ssl_ocsp_start(c->log);
+        if (ctx == NULL) {
+            rc = NGX_ERROR;
+            goto done;
         }
 
-        len = ngx_sock_ntop(sockaddr, socklen, p, NGX_SOCKADDR_STRLEN, 1);
+        ocsp->ctx = ctx;
 
-        ctx->addrs[i].name.len = len;
-        ctx->addrs[i].name.data = p;
-    }
+        ctx->ssl_ctx = SSL_get_SSL_CTX(c->ssl->connection);
+        ctx->cert = sk_X509_value(ocsp->certs, ocsp->ncert);
+        ctx->issuer = sk_X509_value(ocsp->certs, ocsp->ncert + 1);
+        ctx->chain = ocsp->certs;
 
-    ngx_resolve_name_done(resolve);
+        ctx->resolver = ocf->resolver;
+        ctx->resolver_timeout = ocf->resolver_timeout;
 
-    ngx_ssl_ocsp_connect(ctx);
-    return;
+        ctx->handler = ngx_ssl_ocsp_handler;
+        ctx->data = c;
 
-failed:
+        ctx->shm_zone = ocf->shm_zone;
 
-    ngx_resolve_name_done(resolve);
-    ngx_ssl_ocsp_error(ctx);
-}
+        ctx->addrs = ocf->addrs;
+        ctx->naddrs = ocf->naddrs;
+        ctx->host = ocf->host;
+        ctx->uri = ocf->uri;
+        ctx->port = ocf->port;
 
+        rc = ngx_ssl_ocsp_responder(c, ctx);
+        if (rc != NGX_OK) {
+            goto done;
+        }
 
-static void
-ngx_ssl_ocsp_connect(ngx_ssl_ocsp_ctx_t *ctx)
-{
-    ngx_int_t  rc;
+        if (ctx->uri.len == 0) {
+            ngx_str_set(&ctx->uri, "/");
+        }
 
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp connect");
+        ocsp->ncert++;
 
-    /* TODO: use all ip addresses */
+        rc = ngx_ssl_ocsp_cache_lookup(ctx);
 
-    ctx->peer.sockaddr = ctx->addrs[0].sockaddr;
-    ctx->peer.socklen = ctx->addrs[0].socklen;
-    ctx->peer.name = &ctx->addrs[0].name;
-    ctx->peer.get = ngx_event_get_peer;
-    ctx->peer.log = ctx->log;
-    ctx->peer.log_error = NGX_ERROR_ERR;
+        if (rc == NGX_ERROR) {
+            goto done;
+        }
 
-    rc = ngx_event_connect_peer(&ctx->peer);
+        if (rc == NGX_DECLINED) {
+            break;
+        }
 
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp connect peer done");
+        /* rc == NGX_OK */
 
-    if (rc == NGX_ERROR || rc == NGX_BUSY || rc == NGX_DECLINED) {
-        ngx_ssl_ocsp_error(ctx);
-        return;
-    }
+        if (ctx->status != V_OCSP_CERTSTATUS_GOOD) {
+            ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                           "ssl ocsp cached status \"%s\"",
+                           OCSP_cert_status_str(ctx->status));
+            ocsp->cert_status = ctx->status;
+            goto done;
+        }
 
-    ctx->peer.connection->data = ctx;
-    ctx->peer.connection->pool = ctx->pool;
+        ocsp->ctx = NULL;
+        ngx_ssl_ocsp_done(ctx);
+    }
 
-    ctx->peer.connection->read->handler = ngx_ssl_ocsp_read_handler;
-    ctx->peer.connection->write->handler = ngx_ssl_ocsp_write_handler;
+    ngx_ssl_ocsp_request(ctx);
+    return;
 
-    ctx->process = ngx_ssl_ocsp_process_status_line;
+done:
 
-    ngx_add_timer(ctx->peer.connection->read, ctx->timeout);
-    ngx_add_timer(ctx->peer.connection->write, ctx->timeout);
+    ocsp->status = rc;
 
-    if (rc == NGX_OK) {
-        ngx_ssl_ocsp_write_handler(ctx->peer.connection->write);
-        return;
+    if (c->ssl->in_ocsp) {
+        c->ssl->handshaked = 1;
+        c->ssl->handler(c);
     }
 }
 
 
 static void
-ngx_ssl_ocsp_write_handler(ngx_event_t *wev)
+ngx_ssl_ocsp_handler(ngx_ssl_ocsp_ctx_t *ctx)
 {
-    ssize_t              n, size;
-    ngx_connection_t    *c;
-    ngx_ssl_ocsp_ctx_t  *ctx;
-
-    c = wev->data;
-    ctx = c->data;
+    ngx_int_t          rc;
+    ngx_ssl_ocsp_t    *ocsp;
+    ngx_connection_t  *c;
 
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, wev->log, 0,
-                   "ssl ocsp write handler");
+    c = ctx->data;
+    ocsp = c->ssl->ocsp;
+    ocsp->ctx = NULL;
 
-    if (wev->timedout) {
-        ngx_log_error(NGX_LOG_ERR, wev->log, NGX_ETIMEDOUT,
-                      "OCSP responder timed out");
-        ngx_ssl_ocsp_error(ctx);
-        return;
+    rc = ngx_ssl_ocsp_verify(ctx);
+    if (rc != NGX_OK) {
+        goto done;
     }
 
-    size = ctx->request->last - ctx->request->pos;
-
-    n = ngx_send(c, ctx->request->pos, size);
+    rc = ngx_ssl_ocsp_cache_store(ctx);
+    if (rc != NGX_OK) {
+        goto done;
+    }
 
-    if (n == NGX_ERROR) {
-        ngx_ssl_ocsp_error(ctx);
-        return;
+    if (ctx->status != V_OCSP_CERTSTATUS_GOOD) {
+        ocsp->cert_status = ctx->status;
+        goto done;
     }
 
-    if (n > 0) {
-        ctx->request->pos += n;
+    ngx_ssl_ocsp_done(ctx);
 
-        if (n == size) {
-            wev->handler = ngx_ssl_ocsp_dummy_handler;
+    ngx_ssl_ocsp_validate_next(c);
 
-            if (wev->timer_set) {
-                ngx_del_timer(wev);
-            }
+    return;
 
-            if (ngx_handle_write_event(wev, 0) != NGX_OK) {
-                ngx_ssl_ocsp_error(ctx);
-            }
+done:
 
-            return;
-        }
-    }
+    ocsp->status = rc;
+    ngx_ssl_ocsp_done(ctx);
 
-    if (!wev->timer_set) {
-        ngx_add_timer(wev, ctx->timeout);
+    if (c->ssl->in_ocsp) {
+        c->ssl->handshaked = 1;
+        c->ssl->handler(c);
     }
 }
 
 
-static void
-ngx_ssl_ocsp_read_handler(ngx_event_t *rev)
+static ngx_int_t
+ngx_ssl_ocsp_responder(ngx_connection_t *c, ngx_ssl_ocsp_ctx_t *ctx)
 {
-    ssize_t              n, size;
-    ngx_int_t            rc;
-    ngx_connection_t    *c;
-    ngx_ssl_ocsp_ctx_t  *ctx;
+    char                      *s;
+    ngx_str_t                  responder;
+    ngx_url_t                  u;
+    STACK_OF(OPENSSL_STRING)  *aia;
 
-    c = rev->data;
-    ctx = c->data;
+    if (ctx->host.len) {
+        return NGX_OK;
+    }
 
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, rev->log, 0,
-                   "ssl ocsp read handler");
+    /* extract OCSP responder URL from certificate */
 
-    if (rev->timedout) {
-        ngx_log_error(NGX_LOG_ERR, rev->log, NGX_ETIMEDOUT,
-                      "OCSP responder timed out");
-        ngx_ssl_ocsp_error(ctx);
-        return;
+    aia = X509_get1_ocsp(ctx->cert);
+    if (aia == NULL) {
+        ngx_log_error(NGX_LOG_ERR, c->log, 0,
+                      "no OCSP responder URL in certificate");
+        return NGX_ERROR;
     }
 
-    if (ctx->response == NULL) {
-        ctx->response = ngx_create_temp_buf(ctx->pool, 16384);
-        if (ctx->response == NULL) {
-            ngx_ssl_ocsp_error(ctx);
-            return;
-        }
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+    s = sk_OPENSSL_STRING_value(aia, 0);
+#else
+    s = sk_value(aia, 0);
+#endif
+    if (s == NULL) {
+        ngx_log_error(NGX_LOG_ERR, c->log, 0,
+                      "no OCSP responder URL in certificate");
+        X509_email_free(aia);
+        return NGX_ERROR;
     }
 
-    for ( ;; ) {
+    responder.len = ngx_strlen(s);
+    responder.data = ngx_palloc(ctx->pool, responder.len);
+    if (responder.data == NULL) {
+        X509_email_free(aia);
+        return NGX_ERROR;
+    }
 
-        size = ctx->response->end - ctx->response->last;
+    ngx_memcpy(responder.data, s, responder.len);
+    X509_email_free(aia);
 
-        n = ngx_recv(c, ctx->response->last, size);
+    ngx_memzero(&u, sizeof(ngx_url_t));
 
-        if (n > 0) {
-            ctx->response->last += n;
+    u.url = responder;
+    u.default_port = 80;
+    u.uri_part = 1;
+    u.no_resolve = 1;
 
-            rc = ctx->process(ctx);
+    if (u.url.len > 7
+        && ngx_strncasecmp(u.url.data, (u_char *) "http://", 7) == 0)
+    {
+        u.url.len -= 7;
+        u.url.data += 7;
 
-            if (rc == NGX_ERROR) {
-                ngx_ssl_ocsp_error(ctx);
-                return;
-            }
+    } else {
+        ngx_log_error(NGX_LOG_ERR, c->log, 0,
+                      "invalid URL prefix in OCSP responder \"%V\" "
+                      "in certificate", &u.url);
+        return NGX_ERROR;
+    }
 
-            continue;
+    if (ngx_parse_url(ctx->pool, &u) != NGX_OK) {
+        if (u.err) {
+            ngx_log_error(NGX_LOG_ERR, c->log, 0,
+                          "%s in OCSP responder \"%V\" in certificate",
+                          u.err, &u.url);
         }
 
-        if (n == NGX_AGAIN) {
+        return NGX_ERROR;
+    }
 
-            if (ngx_handle_read_event(rev, 0) != NGX_OK) {
-                ngx_ssl_ocsp_error(ctx);
-            }
+    if (u.host.len == 0) {
+        ngx_log_error(NGX_LOG_ERR, c->log, 0,
+                      "empty host in OCSP responder in certificate");
+        return NGX_ERROR;
+    }
 
-            return;
-        }
+    ctx->addrs = u.addrs;
+    ctx->naddrs = u.naddrs;
+    ctx->host = u.host;
+    ctx->uri = u.uri;
+    ctx->port = u.port;
 
-        break;
-    }
+    return NGX_OK;
+}
 
-    ctx->done = 1;
 
-    rc = ctx->process(ctx);
+ngx_int_t
+ngx_ssl_ocsp_get_status(ngx_connection_t *c, const char **s)
+{
+    ngx_ssl_ocsp_t  *ocsp;
+
+    ocsp = c->ssl->ocsp;
+    if (ocsp == NULL) {
+        return NGX_OK;
+    }
+
+    if (ocsp->status == NGX_ERROR) {
+        *s = "certificate status request failed";
+        return NGX_DECLINED;
+    }
+
+    switch (ocsp->cert_status) {
+
+    case V_OCSP_CERTSTATUS_GOOD:
+        return NGX_OK;
+
+    case V_OCSP_CERTSTATUS_REVOKED:
+        *s = "certificate revoked";
+        break;
+
+    default: /* V_OCSP_CERTSTATUS_UNKNOWN */
+        *s = "certificate status unknown";
+    }
+
+    return NGX_DECLINED;
+}
+
+
+void
+ngx_ssl_ocsp_cleanup(ngx_connection_t *c)
+{
+    ngx_ssl_ocsp_t  *ocsp;
+
+    ocsp = c->ssl->ocsp;
+    if (ocsp == NULL) {
+        return;
+    }
+
+    if (ocsp->ctx) {
+        ngx_ssl_ocsp_done(ocsp->ctx);
+        ocsp->ctx = NULL;
+    }
+
+    if (ocsp->certs) {
+        sk_X509_pop_free(ocsp->certs, X509_free);
+        ocsp->certs = NULL;
+    }
+}
+
+
+static ngx_ssl_ocsp_ctx_t *
+ngx_ssl_ocsp_start(ngx_log_t *log)
+{
+    ngx_pool_t          *pool;
+    ngx_ssl_ocsp_ctx_t  *ctx;
+
+    pool = ngx_create_pool(2048, log);
+    if (pool == NULL) {
+        return NULL;
+    }
+
+    ctx = ngx_pcalloc(pool, sizeof(ngx_ssl_ocsp_ctx_t));
+    if (ctx == NULL) {
+        ngx_destroy_pool(pool);
+        return NULL;
+    }
+
+    log = ngx_palloc(pool, sizeof(ngx_log_t));
+    if (log == NULL) {
+        ngx_destroy_pool(pool);
+        return NULL;
+    }
+
+    ctx->pool = pool;
+
+    *log = *ctx->pool->log;
+
+    ctx->pool->log = log;
+    ctx->log = log;
+
+    log->handler = ngx_ssl_ocsp_log_error;
+    log->data = ctx;
+    log->action = "requesting certificate status";
+
+    return ctx;
+}
+
+
+static void
+ngx_ssl_ocsp_done(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp done");
+
+    if (ctx->peer.connection) {
+        ngx_close_connection(ctx->peer.connection);
+    }
+
+    ngx_destroy_pool(ctx->pool);
+}
+
+
+static void
+ngx_ssl_ocsp_error(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp error");
+
+    ctx->code = 0;
+    ctx->handler(ctx);
+}
+
+
+static void
+ngx_ssl_ocsp_next(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp next");
+
+    if (++ctx->naddr >= ctx->naddrs) {
+        ngx_ssl_ocsp_error(ctx);
+        return;
+    }
+
+    ctx->request->pos = ctx->request->start;
+
+    if (ctx->response) {
+        ctx->response->last = ctx->response->pos;
+    }
+
+    if (ctx->peer.connection) {
+        ngx_close_connection(ctx->peer.connection);
+        ctx->peer.connection = NULL;
+    }
+
+    ctx->state = 0;
+    ctx->count = 0;
+    ctx->done = 0;
+
+    ngx_ssl_ocsp_connect(ctx);
+}
+
+
+static void
+ngx_ssl_ocsp_request(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    ngx_resolver_ctx_t  *resolve, temp;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp request");
+
+    if (ngx_ssl_ocsp_create_request(ctx) != NGX_OK) {
+        ngx_ssl_ocsp_error(ctx);
+        return;
+    }
+
+    if (ctx->resolver) {
+        /* resolve OCSP responder hostname */
+
+        temp.name = ctx->host;
+
+        resolve = ngx_resolve_start(ctx->resolver, &temp);
+        if (resolve == NULL) {
+            ngx_ssl_ocsp_error(ctx);
+            return;
+        }
+
+        if (resolve == NGX_NO_RESOLVER) {
+            if (ctx->naddrs == 0) {
+                ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                              "no resolver defined to resolve %V", &ctx->host);
+
+                ngx_ssl_ocsp_error(ctx);
+                return;
+            }
+
+            ngx_log_error(NGX_LOG_WARN, ctx->log, 0,
+                          "no resolver defined to resolve %V", &ctx->host);
+            goto connect;
+        }
+
+        resolve->name = ctx->host;
+        resolve->handler = ngx_ssl_ocsp_resolve_handler;
+        resolve->data = ctx;
+        resolve->timeout = ctx->resolver_timeout;
+
+        if (ngx_resolve_name(resolve) != NGX_OK) {
+            ngx_ssl_ocsp_error(ctx);
+            return;
+        }
+
+        return;
+    }
+
+connect:
+
+    ngx_ssl_ocsp_connect(ctx);
+}
+
+
+static void
+ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve)
+{
+    ngx_ssl_ocsp_ctx_t *ctx = resolve->data;
+
+    u_char           *p;
+    size_t            len;
+    socklen_t         socklen;
+    ngx_uint_t        i;
+    struct sockaddr  *sockaddr;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp resolve handler");
+
+    if (resolve->state) {
+        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                      "%V could not be resolved (%i: %s)",
+                      &resolve->name, resolve->state,
+                      ngx_resolver_strerror(resolve->state));
+        goto failed;
+    }
+
+#if (NGX_DEBUG)
+    {
+    u_char     text[NGX_SOCKADDR_STRLEN];
+    ngx_str_t  addr;
+
+    addr.data = text;
+
+    for (i = 0; i < resolve->naddrs; i++) {
+        addr.len = ngx_sock_ntop(resolve->addrs[i].sockaddr,
+                                 resolve->addrs[i].socklen,
+                                 text, NGX_SOCKADDR_STRLEN, 0);
+
+        ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                       "name was resolved to %V", &addr);
+
+    }
+    }
+#endif
+
+    ctx->naddrs = resolve->naddrs;
+    ctx->addrs = ngx_pcalloc(ctx->pool, ctx->naddrs * sizeof(ngx_addr_t));
+
+    if (ctx->addrs == NULL) {
+        goto failed;
+    }
+
+    for (i = 0; i < resolve->naddrs; i++) {
+
+        socklen = resolve->addrs[i].socklen;
+
+        sockaddr = ngx_palloc(ctx->pool, socklen);
+        if (sockaddr == NULL) {
+            goto failed;
+        }
+
+        ngx_memcpy(sockaddr, resolve->addrs[i].sockaddr, socklen);
+        ngx_inet_set_port(sockaddr, ctx->port);
+
+        ctx->addrs[i].sockaddr = sockaddr;
+        ctx->addrs[i].socklen = socklen;
+
+        p = ngx_pnalloc(ctx->pool, NGX_SOCKADDR_STRLEN);
+        if (p == NULL) {
+            goto failed;
+        }
+
+        len = ngx_sock_ntop(sockaddr, socklen, p, NGX_SOCKADDR_STRLEN, 1);
+
+        ctx->addrs[i].name.len = len;
+        ctx->addrs[i].name.data = p;
+    }
+
+    ngx_resolve_name_done(resolve);
+
+    ngx_ssl_ocsp_connect(ctx);
+    return;
+
+failed:
+
+    ngx_resolve_name_done(resolve);
+    ngx_ssl_ocsp_error(ctx);
+}
+
+
+static void
+ngx_ssl_ocsp_connect(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    ngx_int_t    rc;
+    ngx_addr_t  *addr;
+
+    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp connect %ui/%ui", ctx->naddr, ctx->naddrs);
+
+    addr = &ctx->addrs[ctx->naddr];
+
+    ctx->peer.sockaddr = addr->sockaddr;
+    ctx->peer.socklen = addr->socklen;
+    ctx->peer.name = &addr->name;
+    ctx->peer.get = ngx_event_get_peer;
+    ctx->peer.log = ctx->log;
+    ctx->peer.log_error = NGX_ERROR_ERR;
+
+    rc = ngx_event_connect_peer(&ctx->peer);
+
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp connect peer done");
+
+    if (rc == NGX_ERROR) {
+        ngx_ssl_ocsp_error(ctx);
+        return;
+    }
+
+    if (rc == NGX_BUSY || rc == NGX_DECLINED) {
+        ngx_ssl_ocsp_next(ctx);
+        return;
+    }
+
+    ctx->peer.connection->data = ctx;
+    ctx->peer.connection->pool = ctx->pool;
+
+    ctx->peer.connection->read->handler = ngx_ssl_ocsp_read_handler;
+    ctx->peer.connection->write->handler = ngx_ssl_ocsp_write_handler;
+
+    ctx->process = ngx_ssl_ocsp_process_status_line;
+
+    if (ctx->timeout) {
+        ngx_add_timer(ctx->peer.connection->read, ctx->timeout);
+        ngx_add_timer(ctx->peer.connection->write, ctx->timeout);
+    }
+
+    if (rc == NGX_OK) {
+        ngx_ssl_ocsp_write_handler(ctx->peer.connection->write);
+        return;
+    }
+}
+
+
+static void
+ngx_ssl_ocsp_write_handler(ngx_event_t *wev)
+{
+    ssize_t              n, size;
+    ngx_connection_t    *c;
+    ngx_ssl_ocsp_ctx_t  *ctx;
+
+    c = wev->data;
+    ctx = c->data;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, wev->log, 0,
+                   "ssl ocsp write handler");
+
+    if (wev->timedout) {
+        ngx_log_error(NGX_LOG_ERR, wev->log, NGX_ETIMEDOUT,
+                      "OCSP responder timed out");
+        ngx_ssl_ocsp_next(ctx);
+        return;
+    }
+
+    size = ctx->request->last - ctx->request->pos;
+
+    n = ngx_send(c, ctx->request->pos, size);
+
+    if (n == NGX_ERROR) {
+        ngx_ssl_ocsp_next(ctx);
+        return;
+    }
+
+    if (n > 0) {
+        ctx->request->pos += n;
+
+        if (n == size) {
+            wev->handler = ngx_ssl_ocsp_dummy_handler;
+
+            if (wev->timer_set) {
+                ngx_del_timer(wev);
+            }
+
+            if (ngx_handle_write_event(wev, 0) != NGX_OK) {
+                ngx_ssl_ocsp_error(ctx);
+            }
+
+            return;
+        }
+    }
+
+    if (!wev->timer_set && ctx->timeout) {
+        ngx_add_timer(wev, ctx->timeout);
+    }
+}
+
+
+static void
+ngx_ssl_ocsp_read_handler(ngx_event_t *rev)
+{
+    ssize_t              n, size;
+    ngx_int_t            rc;
+    ngx_connection_t    *c;
+    ngx_ssl_ocsp_ctx_t  *ctx;
+
+    c = rev->data;
+    ctx = c->data;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, rev->log, 0,
+                   "ssl ocsp read handler");
+
+    if (rev->timedout) {
+        ngx_log_error(NGX_LOG_ERR, rev->log, NGX_ETIMEDOUT,
+                      "OCSP responder timed out");
+        ngx_ssl_ocsp_next(ctx);
+        return;
+    }
+
+    if (ctx->response == NULL) {
+        ctx->response = ngx_create_temp_buf(ctx->pool, 16384);
+        if (ctx->response == NULL) {
+            ngx_ssl_ocsp_error(ctx);
+            return;
+        }
+    }
+
+    for ( ;; ) {
+
+        size = ctx->response->end - ctx->response->last;
+
+        n = ngx_recv(c, ctx->response->last, size);
+
+        if (n > 0) {
+            ctx->response->last += n;
+
+            rc = ctx->process(ctx);
+
+            if (rc == NGX_ERROR) {
+                ngx_ssl_ocsp_next(ctx);
+                return;
+            }
+
+            continue;
+        }
+
+        if (n == NGX_AGAIN) {
+
+            if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+                ngx_ssl_ocsp_error(ctx);
+            }
+
+            return;
+        }
+
+        break;
+    }
+
+    ctx->done = 1;
+
+    rc = ctx->process(ctx);
 
     if (rc == NGX_DONE) {
         /* ctx->handler() was called */
@@ -1192,7 +1673,7 @@ ngx_ssl_ocsp_read_handler(ngx_event_t *rev)
     ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
                   "OCSP responder prematurely closed connection");
 
-    ngx_ssl_ocsp_error(ctx);
+    ngx_ssl_ocsp_next(ctx);
 }
 
 
@@ -1481,49 +1962,279 @@ ngx_ssl_ocsp_parse_status_line(ngx_ssl_ocsp_ctx_t *ctx)
 
             break;
 
-        /* HTTP status code */
-        case sw_status:
-            if (ch == ' ') {
+        /* HTTP status code */
+        case sw_status:
+            if (ch == ' ') {
+                break;
+            }
+
+            if (ch < '0' || ch > '9') {
+                return NGX_ERROR;
+            }
+
+            ctx->code = ctx->code * 10 + (ch - '0');
+
+            if (++ctx->count == 3) {
+                state = sw_space_after_status;
+                ctx->header_start = p - 2;
+            }
+
+            break;
+
+        /* space or end of line */
+        case sw_space_after_status:
+            switch (ch) {
+            case ' ':
+                state = sw_status_text;
+                break;
+            case '.':                    /* IIS may send 403.1, 403.2, etc */
+                state = sw_status_text;
+                break;
+            case CR:
+                state = sw_almost_done;
+                break;
+            case LF:
+                ctx->header_end = p;
+                goto done;
+            default:
+                return NGX_ERROR;
+            }
+            break;
+
+        /* any text until end of line */
+        case sw_status_text:
+            switch (ch) {
+            case CR:
+                state = sw_almost_done;
+                break;
+            case LF:
+                ctx->header_end = p;
+                goto done;
+            }
+            break;
+
+        /* end of status line */
+        case sw_almost_done:
+            switch (ch) {
+            case LF:
+                ctx->header_end = p - 1;
+                goto done;
+            default:
+                return NGX_ERROR;
+            }
+        }
+    }
+
+    b->pos = p;
+    ctx->state = state;
+
+    return NGX_AGAIN;
+
+done:
+
+    b->pos = p + 1;
+    ctx->state = sw_start;
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_ssl_ocsp_process_headers(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    size_t     len;
+    ngx_int_t  rc;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp process headers");
+
+    for ( ;; ) {
+        rc = ngx_ssl_ocsp_parse_header_line(ctx);
+
+        if (rc == NGX_OK) {
+
+            ngx_log_debug4(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                           "ssl ocsp header \"%*s: %*s\"",
+                           ctx->header_name_end - ctx->header_name_start,
+                           ctx->header_name_start,
+                           ctx->header_end - ctx->header_start,
+                           ctx->header_start);
+
+            len = ctx->header_name_end - ctx->header_name_start;
+
+            if (len == sizeof("Content-Type") - 1
+                && ngx_strncasecmp(ctx->header_name_start,
+                                   (u_char *) "Content-Type",
+                                   sizeof("Content-Type") - 1)
+                   == 0)
+            {
+                len = ctx->header_end - ctx->header_start;
+
+                if (len != sizeof("application/ocsp-response") - 1
+                    || ngx_strncasecmp(ctx->header_start,
+                                       (u_char *) "application/ocsp-response",
+                                       sizeof("application/ocsp-response") - 1)
+                       != 0)
+                {
+                    ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                                  "OCSP responder sent invalid "
+                                  "\"Content-Type\" header: \"%*s\"",
+                                  ctx->header_end - ctx->header_start,
+                                  ctx->header_start);
+                    return NGX_ERROR;
+                }
+
+                continue;
+            }
+
+            /* TODO: honor Content-Length */
+
+            continue;
+        }
+
+        if (rc == NGX_DONE) {
+            break;
+        }
+
+        if (rc == NGX_AGAIN) {
+            return NGX_AGAIN;
+        }
+
+        /* rc == NGX_ERROR */
+
+        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                      "OCSP responder sent invalid response");
+
+        return NGX_ERROR;
+    }
+
+    ctx->process = ngx_ssl_ocsp_process_body;
+    return ctx->process(ctx);
+}
+
+
+static ngx_int_t
+ngx_ssl_ocsp_parse_header_line(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    u_char  c, ch, *p;
+    enum {
+        sw_start = 0,
+        sw_name,
+        sw_space_before_value,
+        sw_value,
+        sw_space_after_value,
+        sw_almost_done,
+        sw_header_almost_done
+    } state;
+
+    state = ctx->state;
+
+    for (p = ctx->response->pos; p < ctx->response->last; p++) {
+        ch = *p;
+
+#if 0
+        ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                       "s:%d in:'%02Xd:%c'", state, ch, ch);
+#endif
+
+        switch (state) {
+
+        /* first char */
+        case sw_start:
+
+            switch (ch) {
+            case CR:
+                ctx->header_end = p;
+                state = sw_header_almost_done;
+                break;
+            case LF:
+                ctx->header_end = p;
+                goto header_done;
+            default:
+                state = sw_name;
+                ctx->header_name_start = p;
+
+                c = (u_char) (ch | 0x20);
+                if (c >= 'a' && c <= 'z') {
+                    break;
+                }
+
+                if (ch >= '0' && ch <= '9') {
+                    break;
+                }
+
+                return NGX_ERROR;
+            }
+            break;
+
+        /* header name */
+        case sw_name:
+            c = (u_char) (ch | 0x20);
+            if (c >= 'a' && c <= 'z') {
+                break;
+            }
+
+            if (ch == ':') {
+                ctx->header_name_end = p;
+                state = sw_space_before_value;
+                break;
+            }
+
+            if (ch == '-') {
                 break;
             }
 
-            if (ch < '0' || ch > '9') {
-                return NGX_ERROR;
+            if (ch >= '0' && ch <= '9') {
+                break;
             }
 
-            ctx->code = ctx->code * 10 + (ch - '0');
+            if (ch == CR) {
+                ctx->header_name_end = p;
+                ctx->header_start = p;
+                ctx->header_end = p;
+                state = sw_almost_done;
+                break;
+            }
 
-            if (++ctx->count == 3) {
-                state = sw_space_after_status;
-                ctx->header_start = p - 2;
+            if (ch == LF) {
+                ctx->header_name_end = p;
+                ctx->header_start = p;
+                ctx->header_end = p;
+                goto done;
             }
 
-            break;
+            return NGX_ERROR;
 
-        /* space or end of line */
-        case sw_space_after_status:
+        /* space* before header value */
+        case sw_space_before_value:
             switch (ch) {
             case ' ':
-                state = sw_status_text;
-                break;
-            case '.':                    /* IIS may send 403.1, 403.2, etc */
-                state = sw_status_text;
                 break;
             case CR:
+                ctx->header_start = p;
+                ctx->header_end = p;
                 state = sw_almost_done;
                 break;
             case LF:
+                ctx->header_start = p;
                 ctx->header_end = p;
                 goto done;
             default:
-                return NGX_ERROR;
+                ctx->header_start = p;
+                state = sw_value;
+                break;
             }
             break;
 
-        /* any text until end of line */
-        case sw_status_text:
+        /* header value */
+        case sw_value:
             switch (ch) {
+            case ' ':
+                ctx->header_end = p;
+                state = sw_space_after_value;
+                break;
             case CR:
+                ctx->header_end = p;
                 state = sw_almost_done;
                 break;
             case LF:
@@ -1532,305 +2243,429 @@ ngx_ssl_ocsp_parse_status_line(ngx_ssl_ocsp_ctx_t *ctx)
             }
             break;
 
-        /* end of status line */
+        /* space* before end of header line */
+        case sw_space_after_value:
+            switch (ch) {
+            case ' ':
+                break;
+            case CR:
+                state = sw_almost_done;
+                break;
+            case LF:
+                goto done;
+            default:
+                state = sw_value;
+                break;
+            }
+            break;
+
+        /* end of header line */
         case sw_almost_done:
             switch (ch) {
             case LF:
-                ctx->header_end = p - 1;
                 goto done;
             default:
                 return NGX_ERROR;
             }
+
+        /* end of header */
+        case sw_header_almost_done:
+            switch (ch) {
+            case LF:
+                goto header_done;
+            default:
+                return NGX_ERROR;
+            }
         }
     }
 
-    b->pos = p;
+    ctx->response->pos = p;
     ctx->state = state;
 
     return NGX_AGAIN;
 
 done:
 
-    b->pos = p + 1;
+    ctx->response->pos = p + 1;
     ctx->state = sw_start;
 
     return NGX_OK;
+
+header_done:
+
+    ctx->response->pos = p + 1;
+    ctx->state = sw_start;
+
+    return NGX_DONE;
 }
 
 
 static ngx_int_t
-ngx_ssl_ocsp_process_headers(ngx_ssl_ocsp_ctx_t *ctx)
+ngx_ssl_ocsp_process_body(ngx_ssl_ocsp_ctx_t *ctx)
 {
-    size_t     len;
-    ngx_int_t  rc;
-
     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp process headers");
+                   "ssl ocsp process body");
 
-    for ( ;; ) {
-        rc = ngx_ssl_ocsp_parse_header_line(ctx);
+    if (ctx->done) {
+        ctx->handler(ctx);
+        return NGX_DONE;
+    }
 
-        if (rc == NGX_OK) {
+    return NGX_AGAIN;
+}
 
-            ngx_log_debug4(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                           "ssl ocsp header \"%*s: %*s\"",
-                           ctx->header_name_end - ctx->header_name_start,
-                           ctx->header_name_start,
-                           ctx->header_end - ctx->header_start,
-                           ctx->header_start);
 
-            len = ctx->header_name_end - ctx->header_name_start;
+static ngx_int_t
+ngx_ssl_ocsp_verify(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    int                    n;
+    size_t                 len;
+    X509_STORE            *store;
+    const u_char          *p;
+    OCSP_CERTID           *id;
+    OCSP_RESPONSE         *ocsp;
+    OCSP_BASICRESP        *basic;
+    ASN1_GENERALIZEDTIME  *thisupdate, *nextupdate;
 
-            if (len == sizeof("Content-Type") - 1
-                && ngx_strncasecmp(ctx->header_name_start,
-                                   (u_char *) "Content-Type",
-                                   sizeof("Content-Type") - 1)
-                   == 0)
-            {
-                len = ctx->header_end - ctx->header_start;
+    ocsp = NULL;
+    basic = NULL;
+    id = NULL;
 
-                if (len != sizeof("application/ocsp-response") - 1
-                    || ngx_strncasecmp(ctx->header_start,
-                                       (u_char *) "application/ocsp-response",
-                                       sizeof("application/ocsp-response") - 1)
-                       != 0)
-                {
-                    ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
-                                  "OCSP responder sent invalid "
-                                  "\"Content-Type\" header: \"%*s\"",
-                                  ctx->header_end - ctx->header_start,
-                                  ctx->header_start);
-                    return NGX_ERROR;
-                }
+    if (ctx->code != 200) {
+        goto error;
+    }
 
-                continue;
-            }
+    /* check the response */
 
-            /* TODO: honor Content-Length */
+    len = ctx->response->last - ctx->response->pos;
+    p = ctx->response->pos;
 
-            continue;
+    ocsp = d2i_OCSP_RESPONSE(NULL, &p, len);
+    if (ocsp == NULL) {
+        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
+                      "d2i_OCSP_RESPONSE() failed");
+        goto error;
+    }
+
+    n = OCSP_response_status(ocsp);
+
+    if (n != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
+        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                      "OCSP response not successful (%d: %s)",
+                      n, OCSP_response_status_str(n));
+        goto error;
+    }
+
+    basic = OCSP_response_get1_basic(ocsp);
+    if (basic == NULL) {
+        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
+                      "OCSP_response_get1_basic() failed");
+        goto error;
+    }
+
+    store = SSL_CTX_get_cert_store(ctx->ssl_ctx);
+    if (store == NULL) {
+        ngx_ssl_error(NGX_LOG_CRIT, ctx->log, 0,
+                      "SSL_CTX_get_cert_store() failed");
+        goto error;
+    }
+
+    if (OCSP_basic_verify(basic, ctx->chain, store, ctx->flags) != 1) {
+        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
+                      "OCSP_basic_verify() failed");
+        goto error;
+    }
+
+    id = OCSP_cert_to_id(NULL, ctx->cert, ctx->issuer);
+    if (id == NULL) {
+        ngx_ssl_error(NGX_LOG_CRIT, ctx->log, 0,
+                      "OCSP_cert_to_id() failed");
+        goto error;
+    }
+
+    if (OCSP_resp_find_status(basic, id, &ctx->status, NULL, NULL,
+                              &thisupdate, &nextupdate)
+        != 1)
+    {
+        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                      "certificate status not found in the OCSP response");
+        goto error;
+    }
+
+    if (OCSP_check_validity(thisupdate, nextupdate, 300, -1) != 1) {
+        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
+                      "OCSP_check_validity() failed");
+        goto error;
+    }
+
+    if (nextupdate) {
+        ctx->valid = ngx_ssl_stapling_time(nextupdate);
+        if (ctx->valid == (time_t) NGX_ERROR) {
+            ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
+                          "invalid nextUpdate time in certificate status");
+            goto error;
         }
 
-        if (rc == NGX_DONE) {
-            break;
-        }
+    } else {
+        ctx->valid = NGX_MAX_TIME_T_VALUE;
+    }
+
+    OCSP_CERTID_free(id);
+    OCSP_BASICRESP_free(basic);
+    OCSP_RESPONSE_free(ocsp);
+
+    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp response, %s, %uz",
+                   OCSP_cert_status_str(ctx->status), len);
+
+    return NGX_OK;
+
+error:
+
+    if (id) {
+        OCSP_CERTID_free(id);
+    }
+
+    if (basic) {
+        OCSP_BASICRESP_free(basic);
+    }
+
+    if (ocsp) {
+        OCSP_RESPONSE_free(ocsp);
+    }
+
+    return NGX_ERROR;
+}
+
+
+ngx_int_t
+ngx_ssl_ocsp_cache_init(ngx_shm_zone_t *shm_zone, void *data)
+{
+    size_t                 len;
+    ngx_slab_pool_t       *shpool;
+    ngx_ssl_ocsp_cache_t  *cache;
+
+    if (data) {
+        shm_zone->data = data;
+        return NGX_OK;
+    }
+
+    shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
+
+    if (shm_zone->shm.exists) {
+        shm_zone->data = shpool->data;
+        return NGX_OK;
+    }
+
+    cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_ocsp_cache_t));
+    if (cache == NULL) {
+        return NGX_ERROR;
+    }
+
+    shpool->data = cache;
+    shm_zone->data = cache;
 
-        if (rc == NGX_AGAIN) {
-            return NGX_AGAIN;
-        }
+    ngx_rbtree_init(&cache->rbtree, &cache->sentinel,
+                    ngx_str_rbtree_insert_value);
 
-        /* rc == NGX_ERROR */
+    ngx_queue_init(&cache->expire_queue);
 
-        ngx_log_error(NGX_LOG_ERR, ctx->log, 0,
-                      "OCSP responder sent invalid response");
+    len = sizeof(" in OCSP cache \"\"") + shm_zone->shm.name.len;
 
+    shpool->log_ctx = ngx_slab_alloc(shpool, len);
+    if (shpool->log_ctx == NULL) {
         return NGX_ERROR;
     }
 
-    ctx->process = ngx_ssl_ocsp_process_body;
-    return ctx->process(ctx);
+    ngx_sprintf(shpool->log_ctx, " in OCSP cache \"%V\"%Z",
+                &shm_zone->shm.name);
+
+    shpool->log_nomem = 0;
+
+    return NGX_OK;
 }
 
 
 static ngx_int_t
-ngx_ssl_ocsp_parse_header_line(ngx_ssl_ocsp_ctx_t *ctx)
+ngx_ssl_ocsp_cache_lookup(ngx_ssl_ocsp_ctx_t *ctx)
 {
-    u_char  c, ch, *p;
-    enum {
-        sw_start = 0,
-        sw_name,
-        sw_space_before_value,
-        sw_value,
-        sw_space_after_value,
-        sw_almost_done,
-        sw_header_almost_done
-    } state;
+    uint32_t                    hash;
+    ngx_shm_zone_t             *shm_zone;
+    ngx_slab_pool_t            *shpool;
+    ngx_ssl_ocsp_cache_t       *cache;
+    ngx_ssl_ocsp_cache_node_t  *node;
 
-    state = ctx->state;
+    shm_zone = ctx->shm_zone;
 
-    for (p = ctx->response->pos; p < ctx->response->last; p++) {
-        ch = *p;
+    if (shm_zone == NULL) {
+        return NGX_DECLINED;
+    }
 
-#if 0
-        ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                       "s:%d in:'%02Xd:%c'", state, ch, ch);
-#endif
+    if (ngx_ssl_ocsp_create_key(ctx) != NGX_OK) {
+        return NGX_ERROR;
+    }
 
-        switch (state) {
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0, "ssl ocsp cache lookup");
 
-        /* first char */
-        case sw_start:
+    cache = shm_zone->data;
+    shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
+    hash = ngx_hash_key(ctx->key.data, ctx->key.len);
 
-            switch (ch) {
-            case CR:
-                ctx->header_end = p;
-                state = sw_header_almost_done;
-                break;
-            case LF:
-                ctx->header_end = p;
-                goto header_done;
-            default:
-                state = sw_name;
-                ctx->header_name_start = p;
+    ngx_shmtx_lock(&shpool->mutex);
 
-                c = (u_char) (ch | 0x20);
-                if (c >= 'a' && c <= 'z') {
-                    break;
-                }
+    node = (ngx_ssl_ocsp_cache_node_t *)
+               ngx_str_rbtree_lookup(&cache->rbtree, &ctx->key, hash);
 
-                if (ch >= '0' && ch <= '9') {
-                    break;
-                }
+    if (node) {
+        if (node->valid > ngx_time()) {
+            ctx->status = node->status;
+            ngx_shmtx_unlock(&shpool->mutex);
 
-                return NGX_ERROR;
-            }
-            break;
+            ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                           "ssl ocsp cache hit, %s",
+                           OCSP_cert_status_str(ctx->status));
 
-        /* header name */
-        case sw_name:
-            c = (u_char) (ch | 0x20);
-            if (c >= 'a' && c <= 'z') {
-                break;
-            }
+            return NGX_OK;
+        }
 
-            if (ch == ':') {
-                ctx->header_name_end = p;
-                state = sw_space_before_value;
-                break;
-            }
+        ngx_queue_remove(&node->queue);
+        ngx_rbtree_delete(&cache->rbtree, &node->node.node);
+        ngx_slab_free_locked(shpool, node);
 
-            if (ch == '-') {
-                break;
-            }
+        ngx_shmtx_unlock(&shpool->mutex);
 
-            if (ch >= '0' && ch <= '9') {
-                break;
-            }
+        ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                       "ssl ocsp cache expired");
 
-            if (ch == CR) {
-                ctx->header_name_end = p;
-                ctx->header_start = p;
-                ctx->header_end = p;
-                state = sw_almost_done;
-                break;
-            }
+        return NGX_DECLINED;
+    }
 
-            if (ch == LF) {
-                ctx->header_name_end = p;
-                ctx->header_start = p;
-                ctx->header_end = p;
-                goto done;
-            }
+    ngx_shmtx_unlock(&shpool->mutex);
 
-            return NGX_ERROR;
+    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0, "ssl ocsp cache miss");
 
-        /* space* before header value */
-        case sw_space_before_value:
-            switch (ch) {
-            case ' ':
-                break;
-            case CR:
-                ctx->header_start = p;
-                ctx->header_end = p;
-                state = sw_almost_done;
-                break;
-            case LF:
-                ctx->header_start = p;
-                ctx->header_end = p;
-                goto done;
-            default:
-                ctx->header_start = p;
-                state = sw_value;
-                break;
-            }
-            break;
+    return NGX_DECLINED;
+}
 
-        /* header value */
-        case sw_value:
-            switch (ch) {
-            case ' ':
-                ctx->header_end = p;
-                state = sw_space_after_value;
-                break;
-            case CR:
-                ctx->header_end = p;
-                state = sw_almost_done;
-                break;
-            case LF:
-                ctx->header_end = p;
-                goto done;
-            }
-            break;
 
-        /* space* before end of header line */
-        case sw_space_after_value:
-            switch (ch) {
-            case ' ':
-                break;
-            case CR:
-                state = sw_almost_done;
-                break;
-            case LF:
-                goto done;
-            default:
-                state = sw_value;
-                break;
-            }
-            break;
+static ngx_int_t
+ngx_ssl_ocsp_cache_store(ngx_ssl_ocsp_ctx_t *ctx)
+{
+    time_t                      now, valid;
+    uint32_t                    hash;
+    ngx_queue_t                *q;
+    ngx_shm_zone_t             *shm_zone;
+    ngx_slab_pool_t            *shpool;
+    ngx_ssl_ocsp_cache_t       *cache;
+    ngx_ssl_ocsp_cache_node_t  *node;
 
-        /* end of header line */
-        case sw_almost_done:
-            switch (ch) {
-            case LF:
-                goto done;
-            default:
-                return NGX_ERROR;
-            }
+    shm_zone = ctx->shm_zone;
 
-        /* end of header */
-        case sw_header_almost_done:
-            switch (ch) {
-            case LF:
-                goto header_done;
-            default:
-                return NGX_ERROR;
-            }
-        }
+    if (shm_zone == NULL) {
+        return NGX_OK;
     }
 
-    ctx->response->pos = p;
-    ctx->state = state;
+    valid = ctx->valid;
 
-    return NGX_AGAIN;
+    now = ngx_time();
 
-done:
+    if (valid < now) {
+        return NGX_OK;
+    }
 
-    ctx->response->pos = p + 1;
-    ctx->state = sw_start;
+    if (valid == NGX_MAX_TIME_T_VALUE) {
+        valid = now + 3600;
+    }
 
-    return NGX_OK;
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp cache store, valid:%T", valid - now);
 
-header_done:
+    cache = shm_zone->data;
+    shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
+    hash = ngx_hash_key(ctx->key.data, ctx->key.len);
 
-    ctx->response->pos = p + 1;
-    ctx->state = sw_start;
+    ngx_shmtx_lock(&shpool->mutex);
 
-    return NGX_DONE;
+    node = ngx_slab_calloc_locked(shpool,
+                             sizeof(ngx_ssl_ocsp_cache_node_t) + ctx->key.len);
+    if (node == NULL) {
+
+        if (!ngx_queue_empty(&cache->expire_queue)) {
+            q = ngx_queue_last(&cache->expire_queue);
+            node = ngx_queue_data(q, ngx_ssl_ocsp_cache_node_t, queue);
+
+            ngx_rbtree_delete(&cache->rbtree, &node->node.node);
+            ngx_queue_remove(q);
+            ngx_slab_free_locked(shpool, node);
+
+            node = ngx_slab_alloc_locked(shpool,
+                             sizeof(ngx_ssl_ocsp_cache_node_t) + ctx->key.len);
+        }
+
+        if (node == NULL) {
+            ngx_shmtx_unlock(&shpool->mutex);
+            ngx_log_error(NGX_LOG_ALERT, ctx->log, 0,
+                          "could not allocate new entry%s", shpool->log_ctx);
+            return NGX_ERROR;
+        }
+    }
+
+    node->node.str.len = ctx->key.len;
+    node->node.str.data = (u_char *) node + sizeof(ngx_ssl_ocsp_cache_node_t);
+    ngx_memcpy(node->node.str.data, ctx->key.data, ctx->key.len);
+    node->node.node.key = hash;
+    node->status = ctx->status;
+    node->valid = valid;
+
+    ngx_rbtree_insert(&cache->rbtree, &node->node.node);
+    ngx_queue_insert_head(&cache->expire_queue, &node->queue);
+
+    ngx_shmtx_unlock(&shpool->mutex);
+
+    return NGX_OK;
 }
 
 
 static ngx_int_t
-ngx_ssl_ocsp_process_body(ngx_ssl_ocsp_ctx_t *ctx)
+ngx_ssl_ocsp_create_key(ngx_ssl_ocsp_ctx_t *ctx)
 {
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
-                   "ssl ocsp process body");
+    u_char        *p;
+    X509_NAME     *name;
+    ASN1_INTEGER  *serial;
 
-    if (ctx->done) {
-        ctx->handler(ctx);
-        return NGX_DONE;
+    p = ngx_pnalloc(ctx->pool, 60);
+    if (p == NULL) {
+        return NGX_ERROR;
     }
 
-    return NGX_AGAIN;
+    ctx->key.data = p;
+    ctx->key.len = 60;
+
+    name = X509_get_subject_name(ctx->issuer);
+    if (X509_NAME_digest(name, EVP_sha1(), p, NULL) == 0) {
+        return NGX_ERROR;
+    }
+
+    p += 20;
+
+    if (X509_pubkey_digest(ctx->issuer, EVP_sha1(), p, NULL) == 0) {
+        return NGX_ERROR;
+    }
+
+    p += 20;
+
+    serial = X509_get_serialNumber(ctx->cert);
+    if (serial->length > 20) {
+        return NGX_ERROR;
+    }
+
+    p = ngx_cpymem(p, serial->data, serial->length);
+    ngx_memzero(p, 20 - serial->length);
+
+    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
+                   "ssl ocsp key %xV", &ctx->key);
+
+    return NGX_OK;
 }
 
 
@@ -1894,4 +2729,50 @@ ngx_ssl_stapling_resolver(ngx_conf_t *cf, ngx_ssl_t *ssl,
 }
 
 
+ngx_int_t
+ngx_ssl_ocsp(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *responder,
+    ngx_uint_t depth, ngx_shm_zone_t *shm_zone)
+{
+    ngx_log_error(NGX_LOG_EMERG, ssl->log, 0,
+                  "\"ssl_ocsp\" is not supported on this platform");
+
+    return NGX_ERROR;
+}
+
+
+ngx_int_t
+ngx_ssl_ocsp_resolver(ngx_conf_t *cf, ngx_ssl_t *ssl,
+    ngx_resolver_t *resolver, ngx_msec_t resolver_timeout)
+{
+    return NGX_OK;
+}
+
+
+ngx_int_t
+ngx_ssl_ocsp_validate(ngx_connection_t *c)
+{
+    return NGX_OK;
+}
+
+
+ngx_int_t
+ngx_ssl_ocsp_get_status(ngx_connection_t *c, const char **s)
+{
+    return NGX_OK;
+}
+
+
+void
+ngx_ssl_ocsp_cleanup(ngx_connection_t *c)
+{
+}
+
+
+ngx_int_t
+ngx_ssl_ocsp_cache_init(ngx_shm_zone_t *shm_zone, void *data)
+{
+    return NGX_OK;
+}
+
+
 #endif
diff --git a/src/event/ngx_event_pipe.c b/src/event/ngx_event_pipe.c
index da7c4ee7..54412e13 100644
--- a/src/event/ngx_event_pipe.c
+++ b/src/event/ngx_event_pipe.c
@@ -172,7 +172,11 @@ ngx_event_pipe_read_upstream(ngx_event_pipe_t *p)
              */
 
             if (p->upstream->read->available == 0
-                && p->upstream->read->pending_eof)
+                && p->upstream->read->pending_eof
+#if (NGX_SSL)
+                && !p->upstream->ssl
+#endif
+                )
             {
                 p->upstream->read->ready = 0;
                 p->upstream->read->eof = 1;
@@ -956,6 +960,22 @@ ngx_event_pipe_copy_input_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
         return NGX_OK;
     }
 
+    if (p->upstream_done) {
+        ngx_log_debug0(NGX_LOG_DEBUG_EVENT, p->log, 0,
+                       "input data after close");
+        return NGX_OK;
+    }
+
+    if (p->length == 0) {
+        p->upstream_done = 1;
+
+        ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+
+        return NGX_OK;
+    }
+
     cl = ngx_chain_get_free_buf(p->pool, &p->free);
     if (cl == NULL) {
         return NGX_ERROR;
@@ -983,6 +1003,18 @@ ngx_event_pipe_copy_input_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
         return NGX_OK;
     }
 
+    if (b->last - b->pos > p->length) {
+
+        ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+
+        b->last = b->pos + p->length;
+        p->upstream_done = 1;
+
+        return NGX_OK;
+    }
+
     p->length -= b->last - b->pos;
 
     return NGX_OK;
diff --git a/src/event/ngx_event_posted.c b/src/event/ngx_event_posted.c
index d851f3d1..fa575bd8 100644
--- a/src/event/ngx_event_posted.c
+++ b/src/event/ngx_event_posted.c
@@ -11,6 +11,7 @@
 
 
 ngx_queue_t  ngx_posted_accept_events;
+ngx_queue_t  ngx_posted_next_events;
 ngx_queue_t  ngx_posted_events;
 
 
@@ -33,3 +34,27 @@ ngx_event_process_posted(ngx_cycle_t *cycle, ngx_queue_t *posted)
         ev->handler(ev);
     }
 }
+
+
+void
+ngx_event_move_posted_next(ngx_cycle_t *cycle)
+{
+    ngx_queue_t  *q;
+    ngx_event_t  *ev;
+
+    for (q = ngx_queue_head(&ngx_posted_next_events);
+         q != ngx_queue_sentinel(&ngx_posted_next_events);
+         q = ngx_queue_next(q))
+    {
+        ev = ngx_queue_data(q, ngx_event_t, queue);
+
+        ngx_log_debug1(NGX_LOG_DEBUG_EVENT, cycle->log, 0,
+                      "posted next event %p", ev);
+
+        ev->ready = 1;
+        ev->available = -1;
+    }
+
+    ngx_queue_add(&ngx_posted_events, &ngx_posted_next_events);
+    ngx_queue_init(&ngx_posted_next_events);
+}
diff --git a/src/event/ngx_event_posted.h b/src/event/ngx_event_posted.h
index 145d30fe..b1a85c44 100644
--- a/src/event/ngx_event_posted.h
+++ b/src/event/ngx_event_posted.h
@@ -39,9 +39,11 @@
 
 
 void ngx_event_process_posted(ngx_cycle_t *cycle, ngx_queue_t *posted);
+void ngx_event_move_posted_next(ngx_cycle_t *cycle);
 
 
 extern ngx_queue_t  ngx_posted_accept_events;
+extern ngx_queue_t  ngx_posted_next_events;
 extern ngx_queue_t  ngx_posted_events;
 
 
diff --git a/src/event/ngx_event_udp.c b/src/event/ngx_event_udp.c
index 55728305..a524ae04 100644
--- a/src/event/ngx_event_udp.c
+++ b/src/event/ngx_event_udp.c
@@ -363,6 +363,8 @@ ngx_event_recvmsg(ngx_event_t *ev)
 
         c->number = ngx_atomic_fetch_add(ngx_connection_counter, 1);
 
+        c->start_time = ngx_current_msec;
+
 #if (NGX_STAT_STUB)
         (void) ngx_atomic_fetch_add(ngx_stat_handled, 1);
 #endif
diff --git a/src/http/modules/ngx_http_auth_basic_module.c b/src/http/modules/ngx_http_auth_basic_module.c
index a6f9ec46..06933198 100644
--- a/src/http/modules/ngx_http_auth_basic_module.c
+++ b/src/http/modules/ngx_http_auth_basic_module.c
@@ -16,7 +16,7 @@
 
 typedef struct {
     ngx_http_complex_value_t  *realm;
-    ngx_http_complex_value_t   user_file;
+    ngx_http_complex_value_t  *user_file;
 } ngx_http_auth_basic_loc_conf_t;
 
 
@@ -25,7 +25,6 @@ static ngx_int_t ngx_http_auth_basic_crypt_handler(ngx_http_request_t *r,
     ngx_str_t *passwd, ngx_str_t *realm);
 static ngx_int_t ngx_http_auth_basic_set_realm(ngx_http_request_t *r,
     ngx_str_t *realm);
-static void ngx_http_auth_basic_close(ngx_file_t *file);
 static void *ngx_http_auth_basic_create_loc_conf(ngx_conf_t *cf);
 static char *ngx_http_auth_basic_merge_loc_conf(ngx_conf_t *cf,
     void *parent, void *child);
@@ -108,7 +107,7 @@ ngx_http_auth_basic_handler(ngx_http_request_t *r)
 
     alcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_basic_module);
 
-    if (alcf->realm == NULL || alcf->user_file.value.data == NULL) {
+    if (alcf->realm == NULL || alcf->user_file == NULL) {
         return NGX_DECLINED;
     }
 
@@ -134,7 +133,7 @@ ngx_http_auth_basic_handler(ngx_http_request_t *r)
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
     }
 
-    if (ngx_http_complex_value(r, &alcf->user_file, &user_file) != NGX_OK) {
+    if (ngx_http_complex_value(r, alcf->user_file, &user_file) != NGX_OK) {
         return NGX_ERROR;
     }
 
@@ -177,8 +176,8 @@ ngx_http_auth_basic_handler(ngx_http_request_t *r)
                           offset);
 
         if (n == NGX_ERROR) {
-            ngx_http_auth_basic_close(&file);
-            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+            goto cleanup;
         }
 
         if (n == 0) {
@@ -219,12 +218,11 @@ ngx_http_auth_basic_handler(ngx_http_request_t *r)
                 if (buf[i] == LF || buf[i] == CR || buf[i] == ':') {
                     buf[i] = '\0';
 
-                    ngx_http_auth_basic_close(&file);
-
                     pwd.len = i - passwd;
                     pwd.data = &buf[passwd];
 
-                    return ngx_http_auth_basic_crypt_handler(r, &pwd, &realm);
+                    rc = ngx_http_auth_basic_crypt_handler(r, &pwd, &realm);
+                    goto cleanup;
                 }
 
                 break;
@@ -251,8 +249,6 @@ ngx_http_auth_basic_handler(ngx_http_request_t *r)
         offset += n;
     }
 
-    ngx_http_auth_basic_close(&file);
-
     if (state == sw_passwd) {
         pwd.len = i - passwd;
         pwd.data = ngx_pnalloc(r->pool, pwd.len + 1);
@@ -262,14 +258,26 @@ ngx_http_auth_basic_handler(ngx_http_request_t *r)
 
         ngx_cpystrn(pwd.data, &buf[passwd], pwd.len + 1);
 
-        return ngx_http_auth_basic_crypt_handler(r, &pwd, &realm);
+        rc = ngx_http_auth_basic_crypt_handler(r, &pwd, &realm);
+        goto cleanup;
     }
 
     ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                   "user \"%V\" was not found in \"%s\"",
                   &r->headers_in.user, user_file.data);
 
-    return ngx_http_auth_basic_set_realm(r, &realm);
+    rc = ngx_http_auth_basic_set_realm(r, &realm);
+
+cleanup:
+
+    if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
+        ngx_log_error(NGX_LOG_ALERT, r->connection->log, ngx_errno,
+                      ngx_close_file_n " \"%s\" failed", user_file.data);
+    }
+
+    ngx_explicit_memzero(buf, NGX_HTTP_AUTH_BUF_SIZE);
+
+    return rc;
 }
 
 
@@ -338,15 +346,6 @@ ngx_http_auth_basic_set_realm(ngx_http_request_t *r, ngx_str_t *realm)
     return NGX_HTTP_UNAUTHORIZED;
 }
 
-static void
-ngx_http_auth_basic_close(ngx_file_t *file)
-{
-    if (ngx_close_file(file->fd) == NGX_FILE_ERROR) {
-        ngx_log_error(NGX_LOG_ALERT, file->log, ngx_errno,
-                      ngx_close_file_n " \"%s\" failed", file->name.data);
-    }
-}
-
 
 static void *
 ngx_http_auth_basic_create_loc_conf(ngx_conf_t *cf)
@@ -358,6 +357,9 @@ ngx_http_auth_basic_create_loc_conf(ngx_conf_t *cf)
         return NULL;
     }
 
+    conf->realm = NGX_CONF_UNSET_PTR;
+    conf->user_file = NGX_CONF_UNSET_PTR;
+
     return conf;
 }
 
@@ -368,13 +370,8 @@ ngx_http_auth_basic_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_http_auth_basic_loc_conf_t  *prev = parent;
     ngx_http_auth_basic_loc_conf_t  *conf = child;
 
-    if (conf->realm == NULL) {
-        conf->realm = prev->realm;
-    }
-
-    if (conf->user_file.value.data == NULL) {
-        conf->user_file = prev->user_file;
-    }
+    ngx_conf_merge_ptr_value(conf->realm, prev->realm, NULL);
+    ngx_conf_merge_ptr_value(conf->user_file, prev->user_file, NULL);
 
     return NGX_CONF_OK;
 }
@@ -407,17 +404,22 @@ ngx_http_auth_basic_user_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     ngx_str_t                         *value;
     ngx_http_compile_complex_value_t   ccv;
 
-    if (alcf->user_file.value.data) {
+    if (alcf->user_file != NGX_CONF_UNSET_PTR) {
         return "is duplicate";
     }
 
+    alcf->user_file = ngx_palloc(cf->pool, sizeof(ngx_http_complex_value_t));
+    if (alcf->user_file == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
     value = cf->args->elts;
 
     ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
 
     ccv.cf = cf;
     ccv.value = &value[1];
-    ccv.complex_value = &alcf->user_file;
+    ccv.complex_value = alcf->user_file;
     ccv.zero = 1;
     ccv.conf_prefix = 1;
 
diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c
index 95c7b329..0cc9ae18 100644
--- a/src/http/modules/ngx_http_dav_module.c
+++ b/src/http/modules/ngx_http_dav_module.c
@@ -56,7 +56,7 @@ static ngx_int_t ngx_http_dav_copy_tree_file(ngx_tree_ctx_t *ctx,
 static ngx_int_t ngx_http_dav_depth(ngx_http_request_t *r, ngx_int_t dflt);
 static ngx_int_t ngx_http_dav_error(ngx_log_t *log, ngx_err_t err,
     ngx_int_t not_found, char *failed, u_char *path);
-static ngx_int_t ngx_http_dav_location(ngx_http_request_t *r, u_char *path);
+static ngx_int_t ngx_http_dav_location(ngx_http_request_t *r);
 static void *ngx_http_dav_create_loc_conf(ngx_conf_t *cf);
 static char *ngx_http_dav_merge_loc_conf(ngx_conf_t *cf,
     void *parent, void *child);
@@ -285,7 +285,7 @@ ngx_http_dav_put_handler(ngx_http_request_t *r)
     }
 
     if (status == NGX_HTTP_CREATED) {
-        if (ngx_http_dav_location(r, path.data) != NGX_OK) {
+        if (ngx_http_dav_location(r) != NGX_OK) {
             ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
             return;
         }
@@ -312,7 +312,7 @@ ngx_http_dav_delete_handler(ngx_http_request_t *r)
     ngx_file_info_t           fi;
     ngx_http_dav_loc_conf_t  *dlcf;
 
-    if (r->headers_in.content_length_n > 0) {
+    if (r->headers_in.content_length_n > 0 || r->headers_in.chunked) {
         ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                       "DELETE with body is unsupported");
         return NGX_HTTP_UNSUPPORTED_MEDIA_TYPE;
@@ -495,7 +495,7 @@ ngx_http_dav_mkcol_handler(ngx_http_request_t *r, ngx_http_dav_loc_conf_t *dlcf)
     size_t     root;
     ngx_str_t  path;
 
-    if (r->headers_in.content_length_n > 0) {
+    if (r->headers_in.content_length_n > 0 || r->headers_in.chunked) {
         ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                       "MKCOL with body is unsupported");
         return NGX_HTTP_UNSUPPORTED_MEDIA_TYPE;
@@ -513,7 +513,6 @@ ngx_http_dav_mkcol_handler(ngx_http_request_t *r, ngx_http_dav_loc_conf_t *dlcf)
     }
 
     *(p - 1) = '\0';
-    r->uri.len--;
 
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                    "http mkcol path: \"%s\"", path.data);
@@ -521,7 +520,7 @@ ngx_http_dav_mkcol_handler(ngx_http_request_t *r, ngx_http_dav_loc_conf_t *dlcf)
     if (ngx_create_dir(path.data, ngx_dir_access(dlcf->access))
         != NGX_FILE_ERROR)
     {
-        if (ngx_http_dav_location(r, path.data) != NGX_OK) {
+        if (ngx_http_dav_location(r) != NGX_OK) {
             return NGX_HTTP_INTERNAL_SERVER_ERROR;
         }
 
@@ -550,7 +549,9 @@ ngx_http_dav_copy_move_handler(ngx_http_request_t *r)
     ngx_http_dav_copy_ctx_t   copy;
     ngx_http_dav_loc_conf_t  *dlcf;
 
-    if (r->headers_in.content_length_n > 0) {
+    if (r->headers_in.content_length_n > 0 || r->headers_in.chunked) {
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                      "COPY and MOVE with body are unsupported");
         return NGX_HTTP_UNSUPPORTED_MEDIA_TYPE;
     }
 
@@ -1069,35 +1070,39 @@ ngx_http_dav_error(ngx_log_t *log, ngx_err_t err, ngx_int_t not_found,
 
 
 static ngx_int_t
-ngx_http_dav_location(ngx_http_request_t *r, u_char *path)
+ngx_http_dav_location(ngx_http_request_t *r)
 {
-    u_char                    *location;
-    ngx_http_core_loc_conf_t  *clcf;
+    u_char     *p;
+    size_t      len;
+    uintptr_t   escape;
 
     r->headers_out.location = ngx_list_push(&r->headers_out.headers);
     if (r->headers_out.location == NULL) {
         return NGX_ERROR;
     }
 
-    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
+    r->headers_out.location->hash = 1;
+    ngx_str_set(&r->headers_out.location->key, "Location");
+
+    escape = 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len, NGX_ESCAPE_URI);
 
-    if (!clcf->alias && clcf->root_lengths == NULL) {
-        location = path + clcf->root.len;
+    if (escape) {
+        len = r->uri.len + escape;
 
-    } else {
-        location = ngx_pnalloc(r->pool, r->uri.len);
-        if (location == NULL) {
+        p = ngx_pnalloc(r->pool, len);
+        if (p == NULL) {
             ngx_http_clear_location(r);
             return NGX_ERROR;
         }
 
-        ngx_memcpy(location, r->uri.data, r->uri.len);
-    }
+        r->headers_out.location->value.len = len;
+        r->headers_out.location->value.data = p;
 
-    r->headers_out.location->hash = 1;
-    ngx_str_set(&r->headers_out.location->key, "Location");
-    r->headers_out.location->value.len = r->uri.len;
-    r->headers_out.location->value.data = location;
+        ngx_escape_uri(p, r->uri.data, r->uri.len, NGX_ESCAPE_URI);
+
+    } else {
+        r->headers_out.location->value = r->uri;
+    }
 
     return NGX_OK;
 }
diff --git a/src/http/modules/ngx_http_fastcgi_module.c b/src/http/modules/ngx_http_fastcgi_module.c
index 2be06721..5191880e 100644
--- a/src/http/modules/ngx_http_fastcgi_module.c
+++ b/src/http/modules/ngx_http_fastcgi_module.c
@@ -81,12 +81,15 @@ typedef struct {
     size_t                         length;
     size_t                         padding;
 
+    off_t                          rest;
+
     ngx_chain_t                   *free;
     ngx_chain_t                   *busy;
 
     unsigned                       fastcgi_stdout:1;
     unsigned                       large_stderr:1;
     unsigned                       header_sent:1;
+    unsigned                       closed:1;
 
     ngx_array_t                   *split_parts;
 
@@ -2075,13 +2078,31 @@ ngx_http_fastcgi_process_header(ngx_http_request_t *r)
 static ngx_int_t
 ngx_http_fastcgi_input_filter_init(void *data)
 {
-    ngx_http_request_t           *r = data;
+    ngx_http_request_t  *r = data;
+
+    ngx_http_upstream_t          *u;
+    ngx_http_fastcgi_ctx_t       *f;
     ngx_http_fastcgi_loc_conf_t  *flcf;
 
+    u = r->upstream;
+
+    f = ngx_http_get_module_ctx(r, ngx_http_fastcgi_module);
     flcf = ngx_http_get_module_loc_conf(r, ngx_http_fastcgi_module);
 
-    r->upstream->pipe->length = flcf->keep_conn ?
-                                (off_t) sizeof(ngx_http_fastcgi_header_t) : -1;
+    u->pipe->length = flcf->keep_conn ?
+                      (off_t) sizeof(ngx_http_fastcgi_header_t) : -1;
+
+    if (u->headers_in.status_n == NGX_HTTP_NO_CONTENT
+        || u->headers_in.status_n == NGX_HTTP_NOT_MODIFIED)
+    {
+        f->rest = 0;
+
+    } else if (r->method == NGX_HTTP_HEAD) {
+        f->rest = -2;
+
+    } else {
+        f->rest = u->headers_in.content_length_n;
+    }
 
     return NGX_OK;
 }
@@ -2106,6 +2127,15 @@ ngx_http_fastcgi_input_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
     f = ngx_http_get_module_ctx(r, ngx_http_fastcgi_module);
     flcf = ngx_http_get_module_loc_conf(r, ngx_http_fastcgi_module);
 
+    if (p->upstream_done || f->closed) {
+        r->upstream->keepalive = 0;
+
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, p->log, 0,
+                       "http fastcgi data after close");
+
+        return NGX_OK;
+    }
+
     b = NULL;
     prev = &buf->shadow;
 
@@ -2128,13 +2158,25 @@ ngx_http_fastcgi_input_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
             if (f->type == NGX_HTTP_FASTCGI_STDOUT && f->length == 0) {
                 f->state = ngx_http_fastcgi_st_padding;
 
+                ngx_log_debug0(NGX_LOG_DEBUG_HTTP, p->log, 0,
+                               "http fastcgi closed stdout");
+
+                if (f->rest > 0) {
+                    ngx_log_error(NGX_LOG_ERR, p->log, 0,
+                                  "upstream prematurely closed "
+                                  "FastCGI stdout");
+
+                    p->upstream_error = 1;
+                    p->upstream_eof = 0;
+                    f->closed = 1;
+
+                    break;
+                }
+
                 if (!flcf->keep_conn) {
                     p->upstream_done = 1;
                 }
 
-                ngx_log_debug0(NGX_LOG_DEBUG_HTTP, p->log, 0,
-                               "http fastcgi closed stdout");
-
                 continue;
             }
 
@@ -2143,6 +2185,18 @@ ngx_http_fastcgi_input_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
                 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, p->log, 0,
                                "http fastcgi sent end request");
 
+                if (f->rest > 0) {
+                    ngx_log_error(NGX_LOG_ERR, p->log, 0,
+                                  "upstream prematurely closed "
+                                  "FastCGI request");
+
+                    p->upstream_error = 1;
+                    p->upstream_eof = 0;
+                    f->closed = 1;
+
+                    break;
+                }
+
                 if (!flcf->keep_conn) {
                     p->upstream_done = 1;
                     break;
@@ -2252,6 +2306,18 @@ ngx_http_fastcgi_input_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
             break;
         }
 
+        if (f->rest == -2) {
+            f->rest = r->upstream->headers_in.content_length_n;
+        }
+
+        if (f->rest == 0) {
+            ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                          "upstream sent more data than specified in "
+                          "\"Content-Length\" header");
+            p->upstream_done = 1;
+            break;
+        }
+
         cl = ngx_chain_get_free_buf(p->pool, &p->free);
         if (cl == NULL) {
             return NGX_ERROR;
@@ -2289,15 +2355,27 @@ ngx_http_fastcgi_input_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
             f->pos += f->length;
             b->last = f->pos;
 
-            continue;
+        } else {
+            f->length -= f->last - f->pos;
+            f->pos = f->last;
+            b->last = f->last;
         }
 
-        f->length -= f->last - f->pos;
+        if (f->rest > 0) {
 
-        b->last = f->last;
+            if (b->last - b->pos > f->rest) {
+                ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                              "upstream sent more data than specified in "
+                              "\"Content-Length\" header");
 
-        break;
+                b->last = b->pos + f->rest;
+                p->upstream_done = 1;
 
+                break;
+            }
+
+            f->rest -= b->last - b->pos;
+        }
     }
 
     if (flcf->keep_conn) {
@@ -2391,6 +2469,14 @@ ngx_http_fastcgi_non_buffered_filter(void *data, ssize_t bytes)
 
             if (f->type == NGX_HTTP_FASTCGI_END_REQUEST) {
 
+                if (f->rest > 0) {
+                    ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                                  "upstream prematurely closed "
+                                  "FastCGI request");
+                    u->error = 1;
+                    break;
+                }
+
                 if (f->pos + f->padding < f->last) {
                     u->length = 0;
                     break;
@@ -2486,6 +2572,14 @@ ngx_http_fastcgi_non_buffered_filter(void *data, ssize_t bytes)
             break;
         }
 
+        if (f->rest == 0) {
+            ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
+                          "upstream sent more data than specified in "
+                          "\"Content-Length\" header");
+            u->length = 0;
+            break;
+        }
+
         cl = ngx_chain_get_free_buf(r->pool, &u->free_bufs);
         if (cl == NULL) {
             return NGX_ERROR;
@@ -2510,13 +2604,27 @@ ngx_http_fastcgi_non_buffered_filter(void *data, ssize_t bytes)
             f->pos += f->length;
             b->last = f->pos;
 
-            continue;
+        } else {
+            f->length -= f->last - f->pos;
+            f->pos = f->last;
+            b->last = f->last;
         }
 
-        f->length -= f->last - f->pos;
-        b->last = f->last;
+        if (f->rest > 0) {
+
+            if (b->last - b->pos > f->rest) {
+                ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
+                              "upstream sent more data than specified in "
+                              "\"Content-Length\" header");
 
-        break;
+                b->last = b->pos + f->rest;
+                u->length = 0;
+
+                break;
+            }
+
+            f->rest -= b->last - b->pos;
+        }
     }
 
     return NGX_OK;
diff --git a/src/http/modules/ngx_http_flv_module.c b/src/http/modules/ngx_http_flv_module.c
index 7b72fae0..cc06d538 100644
--- a/src/http/modules/ngx_http_flv_module.c
+++ b/src/http/modules/ngx_http_flv_module.c
@@ -156,12 +156,6 @@ ngx_http_flv_handler(ngx_http_request_t *r)
     }
 
     if (!of.is_file) {
-
-        if (ngx_close_file(of.fd) == NGX_FILE_ERROR) {
-            ngx_log_error(NGX_LOG_ALERT, log, ngx_errno,
-                          ngx_close_file_n " \"%s\" failed", path.data);
-        }
-
         return NGX_DECLINED;
     }
 
diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c
index f59ecbda..2e20e5ff 100644
--- a/src/http/modules/ngx_http_grpc_module.c
+++ b/src/http/modules/ngx_http_grpc_module.c
@@ -27,6 +27,9 @@ typedef struct {
     ngx_str_t                  host;
     ngx_uint_t                 host_set;
 
+    ngx_array_t               *grpc_lengths;
+    ngx_array_t               *grpc_values;
+
 #if (NGX_HTTP_SSL)
     ngx_uint_t                 ssl;
     ngx_uint_t                 ssl_protocols;
@@ -34,9 +37,7 @@ typedef struct {
     ngx_uint_t                 ssl_verify_depth;
     ngx_str_t                  ssl_trusted_certificate;
     ngx_str_t                  ssl_crl;
-    ngx_str_t                  ssl_certificate;
-    ngx_str_t                  ssl_certificate_key;
-    ngx_array_t               *ssl_passwords;
+    ngx_array_t               *ssl_conf_commands;
 #endif
 } ngx_http_grpc_loc_conf_t;
 
@@ -81,6 +82,8 @@ typedef struct {
     ngx_uint_t                 pings;
     ngx_uint_t                 settings;
 
+    off_t                      length;
+
     ssize_t                    send_window;
     size_t                     recv_window;
 
@@ -117,8 +120,11 @@ typedef struct {
     unsigned                   end_stream:1;
     unsigned                   done:1;
     unsigned                   status:1;
+    unsigned                   rst:1;
 
     ngx_http_request_t        *request;
+
+    ngx_str_t                  host;
 } ngx_http_grpc_ctx_t;
 
 
@@ -135,6 +141,8 @@ typedef struct {
 } ngx_http_grpc_frame_t;
 
 
+static ngx_int_t ngx_http_grpc_eval(ngx_http_request_t *r,
+    ngx_http_grpc_ctx_t *ctx, ngx_http_grpc_loc_conf_t *glcf);
 static ngx_int_t ngx_http_grpc_create_request(ngx_http_request_t *r);
 static ngx_int_t ngx_http_grpc_reinit_request(ngx_http_request_t *r);
 static ngx_int_t ngx_http_grpc_body_output_filter(void *data, ngx_chain_t *in);
@@ -198,6 +206,8 @@ static char *ngx_http_grpc_pass(ngx_conf_t *cf, ngx_command_t *cmd,
 #if (NGX_HTTP_SSL)
 static char *ngx_http_grpc_ssl_password_file(ngx_conf_t *cf,
     ngx_command_t *cmd, void *conf);
+static char *ngx_http_grpc_ssl_conf_command_check(ngx_conf_t *cf, void *post,
+    void *data);
 static ngx_int_t ngx_http_grpc_set_ssl(ngx_conf_t *cf,
     ngx_http_grpc_loc_conf_t *glcf);
 #endif
@@ -232,6 +242,9 @@ static ngx_conf_bitmask_t  ngx_http_grpc_ssl_protocols[] = {
     { ngx_null_string, 0 }
 };
 
+static ngx_conf_post_t  ngx_http_grpc_ssl_conf_command_post =
+    { ngx_http_grpc_ssl_conf_command_check };
+
 #endif
 
 
@@ -409,16 +422,16 @@ static ngx_command_t  ngx_http_grpc_commands[] = {
 
     { ngx_string("grpc_ssl_certificate"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_http_set_complex_value_zero_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
-      offsetof(ngx_http_grpc_loc_conf_t, ssl_certificate),
+      offsetof(ngx_http_grpc_loc_conf_t, upstream.ssl_certificate),
       NULL },
 
     { ngx_string("grpc_ssl_certificate_key"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_http_set_complex_value_zero_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
-      offsetof(ngx_http_grpc_loc_conf_t, ssl_certificate_key),
+      offsetof(ngx_http_grpc_loc_conf_t, upstream.ssl_certificate_key),
       NULL },
 
     { ngx_string("grpc_ssl_password_file"),
@@ -428,6 +441,13 @@ static ngx_command_t  ngx_http_grpc_commands[] = {
       0,
       NULL },
 
+    { ngx_string("grpc_ssl_conf_command"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE2,
+      ngx_conf_set_keyval_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_grpc_loc_conf_t, ssl_conf_commands),
+      &ngx_http_grpc_ssl_conf_command_post },
+
 #endif
 
       ngx_null_command
@@ -524,23 +544,41 @@ ngx_http_grpc_handler(ngx_http_request_t *r)
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
     }
 
+    ctx = ngx_pcalloc(r->pool, sizeof(ngx_http_grpc_ctx_t));
+    if (ctx == NULL) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    ctx->request = r;
+
+    ngx_http_set_ctx(r, ctx, ngx_http_grpc_module);
+
     glcf = ngx_http_get_module_loc_conf(r, ngx_http_grpc_module);
 
     u = r->upstream;
 
+    if (glcf->grpc_lengths == NULL) {
+        ctx->host = glcf->host;
+
 #if (NGX_HTTP_SSL)
-    u->ssl = (glcf->upstream.ssl != NULL);
+        u->ssl = (glcf->upstream.ssl != NULL);
 
-    if (u->ssl) {
-        ngx_str_set(&u->schema, "grpcs://");
+        if (u->ssl) {
+            ngx_str_set(&u->schema, "grpcs://");
 
-    } else {
-        ngx_str_set(&u->schema, "grpc://");
-    }
+        } else {
+            ngx_str_set(&u->schema, "grpc://");
+        }
 #else
-    ngx_str_set(&u->schema, "grpc://");
+        ngx_str_set(&u->schema, "grpc://");
 #endif
 
+    } else {
+        if (ngx_http_grpc_eval(r, ctx, glcf) != NGX_OK) {
+            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        }
+    }
+
     u->output.tag = (ngx_buf_tag_t) &ngx_http_grpc_module;
 
     u->conf = &glcf->upstream;
@@ -551,15 +589,6 @@ ngx_http_grpc_handler(ngx_http_request_t *r)
     u->abort_request = ngx_http_grpc_abort_request;
     u->finalize_request = ngx_http_grpc_finalize_request;
 
-    ctx = ngx_pcalloc(r->pool, sizeof(ngx_http_grpc_ctx_t));
-    if (ctx == NULL) {
-        return NGX_HTTP_INTERNAL_SERVER_ERROR;
-    }
-
-    ctx->request = r;
-
-    ngx_http_set_ctx(r, ctx, ngx_http_grpc_module);
-
     u->input_filter_init = ngx_http_grpc_filter_init;
     u->input_filter = ngx_http_grpc_filter;
     u->input_filter_ctx = ctx;
@@ -576,6 +605,103 @@ ngx_http_grpc_handler(ngx_http_request_t *r)
 }
 
 
+static ngx_int_t
+ngx_http_grpc_eval(ngx_http_request_t *r, ngx_http_grpc_ctx_t *ctx,
+    ngx_http_grpc_loc_conf_t *glcf)
+{
+    size_t                add;
+    ngx_url_t             url;
+    ngx_http_upstream_t  *u;
+
+    ngx_memzero(&url, sizeof(ngx_url_t));
+
+    if (ngx_http_script_run(r, &url.url, glcf->grpc_lengths->elts, 0,
+                            glcf->grpc_values->elts)
+        == NULL)
+    {
+        return NGX_ERROR;
+    }
+
+    if (url.url.len > 7
+        && ngx_strncasecmp(url.url.data, (u_char *) "grpc://", 7) == 0)
+    {
+        add = 7;
+
+    } else if (url.url.len > 8
+               && ngx_strncasecmp(url.url.data, (u_char *) "grpcs://", 8) == 0)
+    {
+
+#if (NGX_HTTP_SSL)
+        add = 8;
+        r->upstream->ssl = 1;
+#else
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                      "grpcs protocol requires SSL support");
+        return NGX_ERROR;
+#endif
+
+    } else {
+        add = 0;
+    }
+
+    u = r->upstream;
+
+    if (add) {
+        u->schema.len = add;
+        u->schema.data = url.url.data;
+
+        url.url.data += add;
+        url.url.len -= add;
+
+    } else {
+        ngx_str_set(&u->schema, "grpc://");
+    }
+
+    url.no_resolve = 1;
+
+    if (ngx_parse_url(r->pool, &url) != NGX_OK) {
+        if (url.err) {
+            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                          "%s in upstream \"%V\"", url.err, &url.url);
+        }
+
+        return NGX_ERROR;
+    }
+
+    u->resolved = ngx_pcalloc(r->pool, sizeof(ngx_http_upstream_resolved_t));
+    if (u->resolved == NULL) {
+        return NGX_ERROR;
+    }
+
+    if (url.addrs) {
+        u->resolved->sockaddr = url.addrs[0].sockaddr;
+        u->resolved->socklen = url.addrs[0].socklen;
+        u->resolved->name = url.addrs[0].name;
+        u->resolved->naddrs = 1;
+    }
+
+    u->resolved->host = url.host;
+    u->resolved->port = url.port;
+    u->resolved->no_port = url.no_port;
+
+    if (url.family != AF_UNIX) {
+
+        if (url.no_port) {
+            ctx->host = url.host;
+
+        } else {
+            ctx->host.len = url.host.len + 1 + url.port_text.len;
+            ctx->host.data = url.host.data;
+        }
+
+    } else {
+        ngx_str_set(&ctx->host, "localhost");
+    }
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_http_grpc_create_request(ngx_http_request_t *r)
 {
@@ -587,6 +713,7 @@ ngx_http_grpc_create_request(ngx_http_request_t *r)
     ngx_chain_t                  *cl, *body;
     ngx_list_part_t              *part;
     ngx_table_elt_t              *header;
+    ngx_http_grpc_ctx_t          *ctx;
     ngx_http_upstream_t          *u;
     ngx_http_grpc_frame_t        *f;
     ngx_http_script_code_pt       code;
@@ -598,6 +725,8 @@ ngx_http_grpc_create_request(ngx_http_request_t *r)
 
     glcf = ngx_http_get_module_loc_conf(r, ngx_http_grpc_module);
 
+    ctx = ngx_http_get_module_ctx(r, ngx_http_grpc_module);
+
     len = sizeof(ngx_http_grpc_connection_start) - 1
           + sizeof(ngx_http_grpc_frame_t);             /* headers frame */
 
@@ -637,10 +766,10 @@ ngx_http_grpc_create_request(ngx_http_request_t *r)
     /* :authority header */
 
     if (!glcf->host_set) {
-        len += 1 + NGX_HTTP_V2_INT_OCTETS + glcf->host.len;
+        len += 1 + NGX_HTTP_V2_INT_OCTETS + ctx->host.len;
 
-        if (tmp_len < glcf->host.len) {
-            tmp_len = glcf->host.len;
+        if (tmp_len < ctx->host.len) {
+            tmp_len = ctx->host.len;
         }
     }
 
@@ -785,7 +914,7 @@ ngx_http_grpc_create_request(ngx_http_request_t *r)
     }
 
 #if (NGX_HTTP_SSL)
-    if (glcf->ssl) {
+    if (u->ssl) {
         *b->last++ = ngx_http_v2_indexed(NGX_HTTP_V2_SCHEME_HTTPS_INDEX);
 
         ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
@@ -846,11 +975,11 @@ ngx_http_grpc_create_request(ngx_http_request_t *r)
 
     if (!glcf->host_set) {
         *b->last++ = ngx_http_v2_inc_indexed(NGX_HTTP_V2_AUTHORITY_INDEX);
-        b->last = ngx_http_v2_write_value(b->last, glcf->host.data,
-                                          glcf->host.len, tmp);
+        b->last = ngx_http_v2_write_value(b->last, ctx->host.data,
+                                          ctx->host.len, tmp);
 
         ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
-                       "grpc header: \":authority: %V\"", &glcf->host);
+                       "grpc header: \":authority: %V\"", &ctx->host);
     }
 
     ngx_memzero(&e, sizeof(ngx_http_script_engine_t));
@@ -1009,20 +1138,11 @@ ngx_http_grpc_create_request(ngx_http_request_t *r)
 
     f->flags |= NGX_HTTP_V2_END_HEADERS_FLAG;
 
-#if (NGX_DEBUG)
-    if (r->connection->log->log_level & NGX_LOG_DEBUG_HTTP) {
-        u_char  buf[512];
-        size_t  n, m;
-
-        n = ngx_min(b->last - b->pos, 256);
-        m = ngx_hex_dump(buf, b->pos, n) - buf;
-
-        ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
-                       "grpc header: %*s%s, len: %uz",
-                       m, buf, b->last - b->pos > 256 ? "..." : "",
-                       b->last - b->pos);
-    }
-#endif
+    ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   "grpc header: %*xs%s, len: %uz",
+                   (size_t) ngx_min(b->last - b->pos, 256), b->pos,
+                   b->last - b->pos > 256 ? "..." : "",
+                   b->last - b->pos);
 
     if (r->request_body_no_buffering) {
 
@@ -1089,6 +1209,7 @@ ngx_http_grpc_reinit_request(ngx_http_request_t *r)
     ctx->end_stream = 0;
     ctx->done = 0;
     ctx->status = 0;
+    ctx->rst = 0;
     ctx->connection = NULL;
 
     return NGX_OK;
@@ -1471,20 +1592,11 @@ ngx_http_grpc_process_header(ngx_http_request_t *r)
     u = r->upstream;
     b = &u->buffer;
 
-#if (NGX_DEBUG)
-    if (r->connection->log->log_level & NGX_LOG_DEBUG_HTTP) {
-        u_char  buf[512];
-        size_t  n, m;
-
-        n = ngx_min(b->last - b->pos, 256);
-        m = ngx_hex_dump(buf, b->pos, n) - buf;
-
-        ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
-                       "grpc response: %*s%s, len: %uz",
-                       m, buf, b->last - b->pos > 256 ? "..." : "",
-                       b->last - b->pos);
-    }
-#endif
+    ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   "grpc response: %*xs%s, len: %uz",
+                   (size_t) ngx_min(b->last - b->pos, 256),
+                   b->pos, b->last - b->pos > 256 ? "..." : "",
+                   b->last - b->pos);
 
     ctx = ngx_http_grpc_get_ctx(r);
 
@@ -1835,10 +1947,29 @@ ngx_http_grpc_filter_init(void *data)
     r = ctx->request;
     u = r->upstream;
 
-    u->length = 1;
+    if (u->headers_in.status_n == NGX_HTTP_NO_CONTENT
+        || u->headers_in.status_n == NGX_HTTP_NOT_MODIFIED
+        || r->method == NGX_HTTP_HEAD)
+    {
+        ctx->length = 0;
+
+    } else {
+        ctx->length = u->headers_in.content_length_n;
+    }
 
     if (ctx->end_stream) {
+
+        if (ctx->length > 0) {
+            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                          "upstream prematurely closed stream");
+            return NGX_ERROR;
+        }
+
         u->length = 0;
+        ctx->done = 1;
+
+    } else {
+        u->length = 1;
     }
 
     return NGX_OK;
@@ -1881,6 +2012,12 @@ ngx_http_grpc_filter(void *data, ssize_t bytes)
 
                 if (ctx->done) {
 
+                    if (ctx->length > 0) {
+                        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                                      "upstream prematurely closed stream");
+                        return NGX_ERROR;
+                    }
+
                     /*
                      * We have finished parsing the response and the
                      * remaining control frames.  If there are unsent
@@ -1972,7 +2109,10 @@ ngx_http_grpc_filter(void *data, ssize_t bytes)
                 return NGX_ERROR;
             }
 
-            if (ctx->stream_id && ctx->done) {
+            if (ctx->stream_id && ctx->done
+                && ctx->type != NGX_HTTP_V2_RST_STREAM_FRAME
+                && ctx->type != NGX_HTTP_V2_WINDOW_UPDATE_FRAME)
+            {
                 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                               "upstream sent frame for closed stream %ui",
                               ctx->stream_id);
@@ -2015,11 +2155,21 @@ ngx_http_grpc_filter(void *data, ssize_t bytes)
                 return NGX_ERROR;
             }
 
-            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
-                          "upstream rejected request with error %ui",
-                          ctx->error);
+            if (ctx->error || !ctx->done) {
+                ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                              "upstream rejected request with error %ui",
+                              ctx->error);
+                return NGX_ERROR;
+            }
 
-            return NGX_ERROR;
+            if (ctx->rst) {
+                ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                              "upstream sent frame for closed stream %ui",
+                              ctx->stream_id);
+                return NGX_ERROR;
+            }
+
+            ctx->rst = 1;
         }
 
         if (ctx->type == NGX_HTTP_V2_GOAWAY_FRAME) {
@@ -2286,6 +2436,18 @@ ngx_http_grpc_filter(void *data, ssize_t bytes)
             b->pos = b->last;
             buf->last = b->pos;
 
+            if (ctx->length != -1) {
+
+                if (buf->last - buf->pos > ctx->length) {
+                    ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                                  "upstream sent response body larger "
+                                  "than indicated content length");
+                    return NGX_ERROR;
+                }
+
+                ctx->length -= buf->last - buf->pos;
+            }
+
             return NGX_AGAIN;
         }
 
@@ -2293,6 +2455,18 @@ ngx_http_grpc_filter(void *data, ssize_t bytes)
         buf->last = b->pos;
         ctx->rest = ctx->padding;
 
+        if (ctx->length != -1) {
+
+            if (buf->last - buf->pos > ctx->length) {
+                ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                              "upstream sent response body larger "
+                              "than indicated content length");
+                return NGX_ERROR;
+            }
+
+            ctx->length -= buf->last - buf->pos;
+        }
+
     done:
 
         if (ctx->padding) {
@@ -4154,9 +4328,7 @@ ngx_http_grpc_create_loc_conf(ngx_conf_t *cf)
      *     conf->upstream.ignore_headers = 0;
      *     conf->upstream.next_upstream = 0;
      *     conf->upstream.hide_headers_hash = { NULL, 0 };
-     *     conf->upstream.ssl_name = NULL;
      *
-     *     conf->headers_source = NULL;
      *     conf->headers.lengths = NULL;
      *     conf->headers.values = NULL;
      *     conf->headers.hash = { NULL, 0 };
@@ -4167,8 +4339,6 @@ ngx_http_grpc_create_loc_conf(ngx_conf_t *cf)
      *     conf->ssl_ciphers = { 0, NULL };
      *     conf->ssl_trusted_certificate = { 0, NULL };
      *     conf->ssl_crl = { 0, NULL };
-     *     conf->ssl_certificate = { 0, NULL };
-     *     conf->ssl_certificate_key = { 0, NULL };
      */
 
     conf->upstream.local = NGX_CONF_UNSET_PTR;
@@ -4188,10 +4358,14 @@ ngx_http_grpc_create_loc_conf(ngx_conf_t *cf)
 
 #if (NGX_HTTP_SSL)
     conf->upstream.ssl_session_reuse = NGX_CONF_UNSET;
+    conf->upstream.ssl_name = NGX_CONF_UNSET_PTR;
     conf->upstream.ssl_server_name = NGX_CONF_UNSET;
     conf->upstream.ssl_verify = NGX_CONF_UNSET;
     conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
-    conf->ssl_passwords = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_certificate = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_certificate_key = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_passwords = NGX_CONF_UNSET_PTR;
+    conf->ssl_conf_commands = NGX_CONF_UNSET_PTR;
 #endif
 
     /* the hardcoded values */
@@ -4209,6 +4383,8 @@ ngx_http_grpc_create_loc_conf(ngx_conf_t *cf)
     conf->upstream.pass_trailers = 1;
     conf->upstream.preserve_output = 1;
 
+    conf->headers_source = NGX_CONF_UNSET_PTR;
+
     ngx_str_set(&conf->upstream.module, "grpc");
 
     return conf;
@@ -4280,10 +4456,8 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers,
                              "DEFAULT");
 
-    if (conf->upstream.ssl_name == NULL) {
-        conf->upstream.ssl_name = prev->upstream.ssl_name;
-    }
-
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_name,
+                              prev->upstream.ssl_name, NULL);
     ngx_conf_merge_value(conf->upstream.ssl_server_name,
                               prev->upstream.ssl_server_name, 0);
     ngx_conf_merge_value(conf->upstream.ssl_verify,
@@ -4294,11 +4468,15 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
                               prev->ssl_trusted_certificate, "");
     ngx_conf_merge_str_value(conf->ssl_crl, prev->ssl_crl, "");
 
-    ngx_conf_merge_str_value(conf->ssl_certificate,
-                              prev->ssl_certificate, "");
-    ngx_conf_merge_str_value(conf->ssl_certificate_key,
-                              prev->ssl_certificate_key, "");
-    ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_certificate,
+                              prev->upstream.ssl_certificate, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_certificate_key,
+                              prev->upstream.ssl_certificate_key, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_passwords,
+                              prev->upstream.ssl_passwords, NULL);
+
+    ngx_conf_merge_ptr_value(conf->ssl_conf_commands,
+                              prev->ssl_conf_commands, NULL);
 
     if (conf->ssl && ngx_http_grpc_set_ssl(cf, conf) != NGX_OK) {
         return NGX_CONF_ERROR;
@@ -4319,21 +4497,30 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 
     clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module);
 
-    if (clcf->noname && conf->upstream.upstream == NULL) {
+    if (clcf->noname
+        && conf->upstream.upstream == NULL && conf->grpc_lengths == NULL)
+    {
         conf->upstream.upstream = prev->upstream.upstream;
         conf->host = prev->host;
+
+        conf->grpc_lengths = prev->grpc_lengths;
+        conf->grpc_values = prev->grpc_values;
+
 #if (NGX_HTTP_SSL)
         conf->upstream.ssl = prev->upstream.ssl;
 #endif
     }
 
-    if (clcf->lmt_excpt && clcf->handler == NULL && conf->upstream.upstream) {
+    if (clcf->lmt_excpt && clcf->handler == NULL
+        && (conf->upstream.upstream || conf->grpc_lengths))
+    {
         clcf->handler = ngx_http_grpc_handler;
     }
 
-    if (conf->headers_source == NULL) {
+    ngx_conf_merge_ptr_value(conf->headers_source, prev->headers_source, NULL);
+
+    if (conf->headers_source == prev->headers_source) {
         conf->headers = prev->headers;
-        conf->headers_source = prev->headers_source;
         conf->host_set = prev->host_set;
     }
 
@@ -4537,18 +4724,54 @@ ngx_http_grpc_pass(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 {
     ngx_http_grpc_loc_conf_t *glcf = conf;
 
-    size_t                     add;
-    ngx_str_t                 *value, *url;
-    ngx_url_t                  u;
-    ngx_http_core_loc_conf_t  *clcf;
+    size_t                      add;
+    ngx_str_t                  *value, *url;
+    ngx_url_t                   u;
+    ngx_uint_t                  n;
+    ngx_http_core_loc_conf_t   *clcf;
+    ngx_http_script_compile_t   sc;
 
-    if (glcf->upstream.upstream) {
+    if (glcf->upstream.upstream || glcf->grpc_lengths) {
         return "is duplicate";
     }
 
+    clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module);
+
+    clcf->handler = ngx_http_grpc_handler;
+
+    if (clcf->name.len && clcf->name.data[clcf->name.len - 1] == '/') {
+        clcf->auto_redirect = 1;
+    }
+
     value = cf->args->elts;
+
     url = &value[1];
 
+    n = ngx_http_script_variables_count(url);
+
+    if (n) {
+
+        ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));
+
+        sc.cf = cf;
+        sc.source = url;
+        sc.lengths = &glcf->grpc_lengths;
+        sc.values = &glcf->grpc_values;
+        sc.variables = n;
+        sc.complete_lengths = 1;
+        sc.complete_values = 1;
+
+        if (ngx_http_script_compile(&sc) != NGX_OK) {
+            return NGX_CONF_ERROR;
+        }
+
+#if (NGX_HTTP_SSL)
+        glcf->ssl = 1;
+#endif
+
+        return NGX_CONF_OK;
+    }
+
     if (ngx_strncasecmp(url->data, (u_char *) "grpc://", 7) == 0) {
         add = 7;
 
@@ -4593,14 +4816,6 @@ ngx_http_grpc_pass(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
         ngx_str_set(&glcf->host, "localhost");
     }
 
-    clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module);
-
-    clcf->handler = ngx_http_grpc_handler;
-
-    if (clcf->name.len && clcf->name.data[clcf->name.len - 1] == '/') {
-        clcf->auto_redirect = 1;
-    }
-
     return NGX_CONF_OK;
 }
 
@@ -4614,15 +4829,15 @@ ngx_http_grpc_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     ngx_str_t  *value;
 
-    if (glcf->ssl_passwords != NGX_CONF_UNSET_PTR) {
+    if (glcf->upstream.ssl_passwords != NGX_CONF_UNSET_PTR) {
         return "is duplicate";
     }
 
     value = cf->args->elts;
 
-    glcf->ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]);
+    glcf->upstream.ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]);
 
-    if (glcf->ssl_passwords == NULL) {
+    if (glcf->upstream.ssl_passwords == NULL) {
         return NGX_CONF_ERROR;
     }
 
@@ -4630,6 +4845,17 @@ ngx_http_grpc_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static char *
+ngx_http_grpc_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
+{
+#ifndef SSL_CONF_FLAG_FILE
+    return "is not supported on this platform";
+#else
+    return NGX_CONF_OK;
+#endif
+}
+
+
 static ngx_int_t
 ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf)
 {
@@ -4657,20 +4883,34 @@ ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf)
     cln->handler = ngx_ssl_cleanup_ctx;
     cln->data = glcf->upstream.ssl;
 
-    if (glcf->ssl_certificate.len) {
+    if (glcf->upstream.ssl_certificate) {
 
-        if (glcf->ssl_certificate_key.len == 0) {
+        if (glcf->upstream.ssl_certificate_key == NULL) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
                           "no \"grpc_ssl_certificate_key\" is defined "
-                          "for certificate \"%V\"", &glcf->ssl_certificate);
+                          "for certificate \"%V\"",
+                          &glcf->upstream.ssl_certificate->value);
             return NGX_ERROR;
         }
 
-        if (ngx_ssl_certificate(cf, glcf->upstream.ssl, &glcf->ssl_certificate,
-                                &glcf->ssl_certificate_key, glcf->ssl_passwords)
-            != NGX_OK)
+        if (glcf->upstream.ssl_certificate->lengths
+            || glcf->upstream.ssl_certificate_key->lengths)
         {
-            return NGX_ERROR;
+            glcf->upstream.ssl_passwords =
+                  ngx_ssl_preserve_passwords(cf, glcf->upstream.ssl_passwords);
+            if (glcf->upstream.ssl_passwords == NULL) {
+                return NGX_ERROR;
+            }
+
+        } else {
+            if (ngx_ssl_certificate(cf, glcf->upstream.ssl,
+                                    &glcf->upstream.ssl_certificate->value,
+                                    &glcf->upstream.ssl_certificate_key->value,
+                                    glcf->upstream.ssl_passwords)
+                != NGX_OK)
+            {
+                return NGX_ERROR;
+            }
         }
     }
 
@@ -4720,6 +4960,12 @@ ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf)
 
 #endif
 
+    if (ngx_ssl_conf_commands(cf, glcf->upstream.ssl, glcf->ssl_conf_commands)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
     return NGX_OK;
 }
 
diff --git a/src/http/modules/ngx_http_gzip_filter_module.c b/src/http/modules/ngx_http_gzip_filter_module.c
index e4c343c9..b8c5ccc5 100644
--- a/src/http/modules/ngx_http_gzip_filter_module.c
+++ b/src/http/modules/ngx_http_gzip_filter_module.c
@@ -55,44 +55,23 @@ typedef struct {
     unsigned             redo:1;
     unsigned             done:1;
     unsigned             nomem:1;
-    unsigned             gzheader:1;
     unsigned             buffering:1;
-    unsigned             intel:1;
+    unsigned             zlib_ng:1;
 
     size_t               zin;
     size_t               zout;
 
-    uint32_t             crc32;
     z_stream             zstream;
     ngx_http_request_t  *request;
 } ngx_http_gzip_ctx_t;
 
 
-#if (NGX_HAVE_LITTLE_ENDIAN && NGX_HAVE_NONALIGNED)
-
-struct gztrailer {
-    uint32_t  crc32;
-    uint32_t  zlen;
-};
-
-#else /* NGX_HAVE_BIG_ENDIAN || !NGX_HAVE_NONALIGNED */
-
-struct gztrailer {
-    u_char  crc32[4];
-    u_char  zlen[4];
-};
-
-#endif
-
-
 static void ngx_http_gzip_filter_memory(ngx_http_request_t *r,
     ngx_http_gzip_ctx_t *ctx);
 static ngx_int_t ngx_http_gzip_filter_buffer(ngx_http_gzip_ctx_t *ctx,
     ngx_chain_t *in);
 static ngx_int_t ngx_http_gzip_filter_deflate_start(ngx_http_request_t *r,
     ngx_http_gzip_ctx_t *ctx);
-static ngx_int_t ngx_http_gzip_filter_gzheader(ngx_http_request_t *r,
-    ngx_http_gzip_ctx_t *ctx);
 static ngx_int_t ngx_http_gzip_filter_add_data(ngx_http_request_t *r,
     ngx_http_gzip_ctx_t *ctx);
 static ngx_int_t ngx_http_gzip_filter_get_buf(ngx_http_request_t *r,
@@ -234,7 +213,7 @@ static ngx_str_t  ngx_http_gzip_ratio = ngx_string("gzip_ratio");
 static ngx_http_output_header_filter_pt  ngx_http_next_header_filter;
 static ngx_http_output_body_filter_pt    ngx_http_next_body_filter;
 
-static ngx_uint_t  ngx_http_gzip_assume_intel;
+static ngx_uint_t  ngx_http_gzip_assume_zlib_ng;
 
 
 static ngx_int_t
@@ -446,12 +425,6 @@ ngx_http_gzip_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
             return ctx->busy ? NGX_AGAIN : NGX_OK;
         }
 
-        if (!ctx->gzheader) {
-            if (ngx_http_gzip_filter_gzheader(r, ctx) != NGX_OK) {
-                goto failed;
-            }
-        }
-
         rc = ngx_http_next_body_filter(r, ctx->out);
 
         if (rc == NGX_ERROR) {
@@ -528,18 +501,21 @@ ngx_http_gzip_filter_memory(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
      * 8K is for zlib deflate_state, it takes
      *  *) 5816 bytes on i386 and sparc64 (32-bit mode)
      *  *) 5920 bytes on amd64 and sparc64
+     *
+     * A zlib variant from Intel (https://github.com/jtkukunas/zlib)
+     * uses additional 16-byte padding in one of window-sized buffers.
      */
 
-    if (!ngx_http_gzip_assume_intel) {
-        ctx->allocated = 8192 + (1 << (wbits + 2)) + (1 << (memlevel + 9));
+    if (!ngx_http_gzip_assume_zlib_ng) {
+        ctx->allocated = 8192 + 16 + (1 << (wbits + 2))
+                         + (1 << (memlevel + 9));
 
     } else {
         /*
-         * A zlib variant from Intel, https://github.com/jtkukunas/zlib.
-         * It can force window bits to 13 for fast compression level,
-         * on processors with SSE 4.2 it uses 64K hash instead of scaling
-         * it from the specified memory level, and also introduces
-         * 16-byte padding in one out of the two window-sized buffers.
+         * Another zlib variant, https://github.com/zlib-ng/zlib-ng.
+         * It forces window bits to 13 for fast compression level,
+         * uses 16-byte padding in one of window-sized buffers, and
+         * uses 128K hash.
          */
 
         if (conf->level == 1) {
@@ -547,9 +523,8 @@ ngx_http_gzip_filter_memory(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
         }
 
         ctx->allocated = 8192 + 16 + (1 << (wbits + 2))
-                         + (1 << (ngx_max(memlevel, 8) + 8))
-                         + (1 << (memlevel + 8));
-        ctx->intel = 1;
+                         + 131072 + (1 << (memlevel + 8));
+        ctx->zlib_ng = 1;
     }
 }
 
@@ -643,7 +618,7 @@ ngx_http_gzip_filter_deflate_start(ngx_http_request_t *r,
     ctx->zstream.opaque = ctx;
 
     rc = deflateInit2(&ctx->zstream, (int) conf->level, Z_DEFLATED,
-                      - ctx->wbits, ctx->memlevel, Z_DEFAULT_STRATEGY);
+                      ctx->wbits + 16, ctx->memlevel, Z_DEFAULT_STRATEGY);
 
     if (rc != Z_OK) {
         ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
@@ -652,45 +627,12 @@ ngx_http_gzip_filter_deflate_start(ngx_http_request_t *r,
     }
 
     ctx->last_out = &ctx->out;
-    ctx->crc32 = crc32(0L, Z_NULL, 0);
     ctx->flush = Z_NO_FLUSH;
 
     return NGX_OK;
 }
 
 
-static ngx_int_t
-ngx_http_gzip_filter_gzheader(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
-{
-    ngx_buf_t      *b;
-    ngx_chain_t    *cl;
-    static u_char  gzheader[10] =
-                               { 0x1f, 0x8b, Z_DEFLATED, 0, 0, 0, 0, 0, 0, 3 };
-
-    b = ngx_calloc_buf(r->pool);
-    if (b == NULL) {
-        return NGX_ERROR;
-    }
-
-    b->memory = 1;
-    b->pos = gzheader;
-    b->last = b->pos + 10;
-
-    cl = ngx_alloc_chain_link(r->pool);
-    if (cl == NULL) {
-        return NGX_ERROR;
-    }
-
-    cl->buf = b;
-    cl->next = ctx->out;
-    ctx->out = cl;
-
-    ctx->gzheader = 1;
-
-    return NGX_OK;
-}
-
-
 static ngx_int_t
 ngx_http_gzip_filter_add_data(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
 {
@@ -743,14 +685,9 @@ ngx_http_gzip_filter_add_data(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
 
     } else if (ctx->in_buf->flush) {
         ctx->flush = Z_SYNC_FLUSH;
-    }
-
-    if (ctx->zstream.avail_in) {
-
-        ctx->crc32 = crc32(ctx->crc32, ctx->zstream.next_in,
-                           ctx->zstream.avail_in);
 
-    } else if (ctx->flush == Z_NO_FLUSH) {
+    } else if (ctx->zstream.avail_in == 0) {
+        /* ctx->flush == Z_NO_FLUSH */
         return NGX_AGAIN;
     }
 
@@ -843,7 +780,7 @@ ngx_http_gzip_filter_deflate(ngx_http_request_t *r, ngx_http_gzip_ctx_t *ctx)
 
     ctx->out_buf->last = ctx->zstream.next_out;
 
-    if (ctx->zstream.avail_out == 0) {
+    if (ctx->zstream.avail_out == 0 && rc != Z_STREAM_END) {
 
         /* zlib wants to output some more gzipped data */
 
@@ -932,13 +869,12 @@ static ngx_int_t
 ngx_http_gzip_filter_deflate_end(ngx_http_request_t *r,
     ngx_http_gzip_ctx_t *ctx)
 {
-    int                rc;
-    ngx_buf_t         *b;
-    ngx_chain_t       *cl;
-    struct gztrailer  *trailer;
+    int           rc;
+    ngx_buf_t    *b;
+    ngx_chain_t  *cl;
 
     ctx->zin = ctx->zstream.total_in;
-    ctx->zout = 10 + ctx->zstream.total_out + 8;
+    ctx->zout = ctx->zstream.total_out;
 
     rc = deflateEnd(&ctx->zstream);
 
@@ -955,55 +891,18 @@ ngx_http_gzip_filter_deflate_end(ngx_http_request_t *r,
         return NGX_ERROR;
     }
 
-    cl->buf = ctx->out_buf;
-    cl->next = NULL;
-    *ctx->last_out = cl;
-    ctx->last_out = &cl->next;
+    b = ctx->out_buf;
 
-    if (ctx->zstream.avail_out >= 8) {
-        trailer = (struct gztrailer *) ctx->out_buf->last;
-        ctx->out_buf->last += 8;
-        ctx->out_buf->last_buf = 1;
-
-    } else {
-        b = ngx_create_temp_buf(r->pool, 8);
-        if (b == NULL) {
-            return NGX_ERROR;
-        }
-
-        b->last_buf = 1;
-
-        cl = ngx_alloc_chain_link(r->pool);
-        if (cl == NULL) {
-            return NGX_ERROR;
-        }
-
-        cl->buf = b;
-        cl->next = NULL;
-        *ctx->last_out = cl;
-        ctx->last_out = &cl->next;
-        trailer = (struct gztrailer *) b->pos;
-        b->last += 8;
+    if (ngx_buf_size(b) == 0) {
+        b->temporary = 0;
     }
 
-#if (NGX_HAVE_LITTLE_ENDIAN && NGX_HAVE_NONALIGNED)
-
-    trailer->crc32 = ctx->crc32;
-    trailer->zlen = ctx->zin;
+    b->last_buf = 1;
 
-#else
-
-    trailer->crc32[0] = (u_char) (ctx->crc32 & 0xff);
-    trailer->crc32[1] = (u_char) ((ctx->crc32 >> 8) & 0xff);
-    trailer->crc32[2] = (u_char) ((ctx->crc32 >> 16) & 0xff);
-    trailer->crc32[3] = (u_char) ((ctx->crc32 >> 24) & 0xff);
-
-    trailer->zlen[0] = (u_char) (ctx->zin & 0xff);
-    trailer->zlen[1] = (u_char) ((ctx->zin >> 8) & 0xff);
-    trailer->zlen[2] = (u_char) ((ctx->zin >> 16) & 0xff);
-    trailer->zlen[3] = (u_char) ((ctx->zin >> 24) & 0xff);
-
-#endif
+    cl->buf = b;
+    cl->next = NULL;
+    *ctx->last_out = cl;
+    ctx->last_out = &cl->next;
 
     ctx->zstream.avail_in = 0;
     ctx->zstream.avail_out = 0;
@@ -1048,13 +947,13 @@ ngx_http_gzip_filter_alloc(void *opaque, u_int items, u_int size)
         return p;
     }
 
-    if (ctx->intel) {
+    if (ctx->zlib_ng) {
         ngx_log_error(NGX_LOG_ALERT, ctx->request->connection->log, 0,
                       "gzip filter failed to use preallocated memory: "
                       "%ud of %ui", items * size, ctx->allocated);
 
     } else {
-        ngx_http_gzip_assume_intel = 1;
+        ngx_http_gzip_assume_zlib_ng = 1;
     }
 
     p = ngx_palloc(ctx->request->pool, items * size);
diff --git a/src/http/modules/ngx_http_index_module.c b/src/http/modules/ngx_http_index_module.c
index c144b31c..2ee1dd5a 100644
--- a/src/http/modules/ngx_http_index_module.c
+++ b/src/http/modules/ngx_http_index_module.c
@@ -163,7 +163,7 @@ ngx_http_index_handler(ngx_http_request_t *r)
 
             name = ngx_http_map_uri_to_path(r, &path, &root, reserve);
             if (name == NULL) {
-                return NGX_ERROR;
+                return NGX_HTTP_INTERNAL_SERVER_ERROR;
             }
 
             allocated = path.data + path.len - name;
diff --git a/src/http/modules/ngx_http_limit_conn_module.c b/src/http/modules/ngx_http_limit_conn_module.c
index 913d5993..4e3e7d52 100644
--- a/src/http/modules/ngx_http_limit_conn_module.c
+++ b/src/http/modules/ngx_http_limit_conn_module.c
@@ -10,36 +10,49 @@
 #include <ngx_http.h>
 
 
+#define NGX_HTTP_LIMIT_CONN_PASSED            1
+#define NGX_HTTP_LIMIT_CONN_REJECTED          2
+#define NGX_HTTP_LIMIT_CONN_REJECTED_DRY_RUN  3
+
+
 typedef struct {
-    u_char                     color;
-    u_char                     len;
-    u_short                    conn;
-    u_char                     data[1];
+    u_char                        color;
+    u_char                        len;
+    u_short                       conn;
+    u_char                        data[1];
 } ngx_http_limit_conn_node_t;
 
 
 typedef struct {
-    ngx_shm_zone_t            *shm_zone;
-    ngx_rbtree_node_t         *node;
+    ngx_shm_zone_t               *shm_zone;
+    ngx_rbtree_node_t            *node;
 } ngx_http_limit_conn_cleanup_t;
 
 
 typedef struct {
-    ngx_rbtree_t              *rbtree;
-    ngx_http_complex_value_t   key;
+    ngx_rbtree_t                  rbtree;
+    ngx_rbtree_node_t             sentinel;
+} ngx_http_limit_conn_shctx_t;
+
+
+typedef struct {
+    ngx_http_limit_conn_shctx_t  *sh;
+    ngx_slab_pool_t              *shpool;
+    ngx_http_complex_value_t      key;
 } ngx_http_limit_conn_ctx_t;
 
 
 typedef struct {
-    ngx_shm_zone_t            *shm_zone;
-    ngx_uint_t                 conn;
+    ngx_shm_zone_t               *shm_zone;
+    ngx_uint_t                    conn;
 } ngx_http_limit_conn_limit_t;
 
 
 typedef struct {
-    ngx_array_t                limits;
-    ngx_uint_t                 log_level;
-    ngx_uint_t                 status_code;
+    ngx_array_t                   limits;
+    ngx_uint_t                    log_level;
+    ngx_uint_t                    status_code;
+    ngx_flag_t                    dry_run;
 } ngx_http_limit_conn_conf_t;
 
 
@@ -48,6 +61,8 @@ static ngx_rbtree_node_t *ngx_http_limit_conn_lookup(ngx_rbtree_t *rbtree,
 static void ngx_http_limit_conn_cleanup(void *data);
 static ngx_inline void ngx_http_limit_conn_cleanup_all(ngx_pool_t *pool);
 
+static ngx_int_t ngx_http_limit_conn_status_variable(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data);
 static void *ngx_http_limit_conn_create_conf(ngx_conf_t *cf);
 static char *ngx_http_limit_conn_merge_conf(ngx_conf_t *cf, void *parent,
     void *child);
@@ -55,6 +70,7 @@ static char *ngx_http_limit_conn_zone(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 static char *ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+static ngx_int_t ngx_http_limit_conn_add_variables(ngx_conf_t *cf);
 static ngx_int_t ngx_http_limit_conn_init(ngx_conf_t *cf);
 
 
@@ -102,12 +118,19 @@ static ngx_command_t  ngx_http_limit_conn_commands[] = {
       offsetof(ngx_http_limit_conn_conf_t, status_code),
       &ngx_http_limit_conn_status_bounds },
 
+    { ngx_string("limit_conn_dry_run"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_limit_conn_conf_t, dry_run),
+      NULL },
+
       ngx_null_command
 };
 
 
 static ngx_http_module_t  ngx_http_limit_conn_module_ctx = {
-    NULL,                                  /* preconfiguration */
+    ngx_http_limit_conn_add_variables,     /* preconfiguration */
     ngx_http_limit_conn_init,              /* postconfiguration */
 
     NULL,                                  /* create main configuration */
@@ -137,6 +160,22 @@ ngx_module_t  ngx_http_limit_conn_module = {
 };
 
 
+static ngx_http_variable_t  ngx_http_limit_conn_vars[] = {
+
+    { ngx_string("limit_conn_status"), NULL,
+      ngx_http_limit_conn_status_variable, 0, NGX_HTTP_VAR_NOCACHEABLE, 0 },
+
+      ngx_http_null_variable
+};
+
+
+static ngx_str_t  ngx_http_limit_conn_status[] = {
+    ngx_string("PASSED"),
+    ngx_string("REJECTED"),
+    ngx_string("REJECTED_DRY_RUN")
+};
+
+
 static ngx_int_t
 ngx_http_limit_conn_handler(ngx_http_request_t *r)
 {
@@ -144,7 +183,6 @@ ngx_http_limit_conn_handler(ngx_http_request_t *r)
     uint32_t                        hash;
     ngx_str_t                       key;
     ngx_uint_t                      i;
-    ngx_slab_pool_t                *shpool;
     ngx_rbtree_node_t              *node;
     ngx_pool_cleanup_t             *cln;
     ngx_http_limit_conn_ctx_t      *ctx;
@@ -153,7 +191,7 @@ ngx_http_limit_conn_handler(ngx_http_request_t *r)
     ngx_http_limit_conn_limit_t    *limits;
     ngx_http_limit_conn_cleanup_t  *lccln;
 
-    if (r->main->limit_conn_set) {
+    if (r->main->limit_conn_status) {
         return NGX_DECLINED;
     }
 
@@ -179,15 +217,13 @@ ngx_http_limit_conn_handler(ngx_http_request_t *r)
             continue;
         }
 
-        r->main->limit_conn_set = 1;
+        r->main->limit_conn_status = NGX_HTTP_LIMIT_CONN_PASSED;
 
         hash = ngx_crc32_short(key.data, key.len);
 
-        shpool = (ngx_slab_pool_t *) limits[i].shm_zone->shm.addr;
-
-        ngx_shmtx_lock(&shpool->mutex);
+        ngx_shmtx_lock(&ctx->shpool->mutex);
 
-        node = ngx_http_limit_conn_lookup(ctx->rbtree, &key, hash);
+        node = ngx_http_limit_conn_lookup(&ctx->sh->rbtree, &key, hash);
 
         if (node == NULL) {
 
@@ -195,11 +231,20 @@ ngx_http_limit_conn_handler(ngx_http_request_t *r)
                 + offsetof(ngx_http_limit_conn_node_t, data)
                 + key.len;
 
-            node = ngx_slab_alloc_locked(shpool, n);
+            node = ngx_slab_alloc_locked(ctx->shpool, n);
 
             if (node == NULL) {
-                ngx_shmtx_unlock(&shpool->mutex);
+                ngx_shmtx_unlock(&ctx->shpool->mutex);
                 ngx_http_limit_conn_cleanup_all(r->pool);
+
+                if (lccf->dry_run) {
+                    r->main->limit_conn_status =
+                                          NGX_HTTP_LIMIT_CONN_REJECTED_DRY_RUN;
+                    return NGX_DECLINED;
+                }
+
+                r->main->limit_conn_status = NGX_HTTP_LIMIT_CONN_REJECTED;
+
                 return lccf->status_code;
             }
 
@@ -210,7 +255,7 @@ ngx_http_limit_conn_handler(ngx_http_request_t *r)
             lc->conn = 1;
             ngx_memcpy(lc->data, key.data, key.len);
 
-            ngx_rbtree_insert(ctx->rbtree, node);
+            ngx_rbtree_insert(&ctx->sh->rbtree, node);
 
         } else {
 
@@ -218,13 +263,23 @@ ngx_http_limit_conn_handler(ngx_http_request_t *r)
 
             if ((ngx_uint_t) lc->conn >= limits[i].conn) {
 
-                ngx_shmtx_unlock(&shpool->mutex);
+                ngx_shmtx_unlock(&ctx->shpool->mutex);
 
                 ngx_log_error(lccf->log_level, r->connection->log, 0,
-                              "limiting connections by zone \"%V\"",
+                              "limiting connections%s by zone \"%V\"",
+                              lccf->dry_run ? ", dry run," : "",
                               &limits[i].shm_zone->shm.name);
 
                 ngx_http_limit_conn_cleanup_all(r->pool);
+
+                if (lccf->dry_run) {
+                    r->main->limit_conn_status =
+                                          NGX_HTTP_LIMIT_CONN_REJECTED_DRY_RUN;
+                    return NGX_DECLINED;
+                }
+
+                r->main->limit_conn_status = NGX_HTTP_LIMIT_CONN_REJECTED;
+
                 return lccf->status_code;
             }
 
@@ -234,7 +289,7 @@ ngx_http_limit_conn_handler(ngx_http_request_t *r)
         ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                        "limit conn: %08Xi %d", node->key, lc->conn);
 
-        ngx_shmtx_unlock(&shpool->mutex);
+        ngx_shmtx_unlock(&ctx->shpool->mutex);
 
         cln = ngx_pool_cleanup_add(r->pool,
                                    sizeof(ngx_http_limit_conn_cleanup_t));
@@ -338,17 +393,15 @@ ngx_http_limit_conn_cleanup(void *data)
 {
     ngx_http_limit_conn_cleanup_t  *lccln = data;
 
-    ngx_slab_pool_t             *shpool;
     ngx_rbtree_node_t           *node;
     ngx_http_limit_conn_ctx_t   *ctx;
     ngx_http_limit_conn_node_t  *lc;
 
     ctx = lccln->shm_zone->data;
-    shpool = (ngx_slab_pool_t *) lccln->shm_zone->shm.addr;
     node = lccln->node;
     lc = (ngx_http_limit_conn_node_t *) &node->color;
 
-    ngx_shmtx_lock(&shpool->mutex);
+    ngx_shmtx_lock(&ctx->shpool->mutex);
 
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, lccln->shm_zone->shm.log, 0,
                    "limit conn cleanup: %08Xi %d", node->key, lc->conn);
@@ -356,11 +409,11 @@ ngx_http_limit_conn_cleanup(void *data)
     lc->conn--;
 
     if (lc->conn == 0) {
-        ngx_rbtree_delete(ctx->rbtree, node);
-        ngx_slab_free_locked(shpool, node);
+        ngx_rbtree_delete(&ctx->sh->rbtree, node);
+        ngx_slab_free_locked(ctx->shpool, node);
     }
 
-    ngx_shmtx_unlock(&shpool->mutex);
+    ngx_shmtx_unlock(&ctx->shpool->mutex);
 }
 
 
@@ -386,8 +439,6 @@ ngx_http_limit_conn_init_zone(ngx_shm_zone_t *shm_zone, void *data)
     ngx_http_limit_conn_ctx_t  *octx = data;
 
     size_t                      len;
-    ngx_slab_pool_t            *shpool;
-    ngx_rbtree_node_t          *sentinel;
     ngx_http_limit_conn_ctx_t  *ctx;
 
     ctx = shm_zone->data;
@@ -406,48 +457,63 @@ ngx_http_limit_conn_init_zone(ngx_shm_zone_t *shm_zone, void *data)
             return NGX_ERROR;
         }
 
-        ctx->rbtree = octx->rbtree;
+        ctx->sh = octx->sh;
+        ctx->shpool = octx->shpool;
 
         return NGX_OK;
     }
 
-    shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
+    ctx->shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
 
     if (shm_zone->shm.exists) {
-        ctx->rbtree = shpool->data;
+        ctx->sh = ctx->shpool->data;
 
         return NGX_OK;
     }
 
-    ctx->rbtree = ngx_slab_alloc(shpool, sizeof(ngx_rbtree_t));
-    if (ctx->rbtree == NULL) {
+    ctx->sh = ngx_slab_alloc(ctx->shpool, sizeof(ngx_http_limit_conn_shctx_t));
+    if (ctx->sh == NULL) {
         return NGX_ERROR;
     }
 
-    shpool->data = ctx->rbtree;
+    ctx->shpool->data = ctx->sh;
 
-    sentinel = ngx_slab_alloc(shpool, sizeof(ngx_rbtree_node_t));
-    if (sentinel == NULL) {
-        return NGX_ERROR;
-    }
-
-    ngx_rbtree_init(ctx->rbtree, sentinel,
+    ngx_rbtree_init(&ctx->sh->rbtree, &ctx->sh->sentinel,
                     ngx_http_limit_conn_rbtree_insert_value);
 
     len = sizeof(" in limit_conn_zone \"\"") + shm_zone->shm.name.len;
 
-    shpool->log_ctx = ngx_slab_alloc(shpool, len);
-    if (shpool->log_ctx == NULL) {
+    ctx->shpool->log_ctx = ngx_slab_alloc(ctx->shpool, len);
+    if (ctx->shpool->log_ctx == NULL) {
         return NGX_ERROR;
     }
 
-    ngx_sprintf(shpool->log_ctx, " in limit_conn_zone \"%V\"%Z",
+    ngx_sprintf(ctx->shpool->log_ctx, " in limit_conn_zone \"%V\"%Z",
                 &shm_zone->shm.name);
 
     return NGX_OK;
 }
 
 
+static ngx_int_t
+ngx_http_limit_conn_status_variable(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data)
+{
+    if (r->main->limit_conn_status == 0) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+    v->len = ngx_http_limit_conn_status[r->main->limit_conn_status - 1].len;
+    v->data = ngx_http_limit_conn_status[r->main->limit_conn_status - 1].data;
+
+    return NGX_OK;
+}
+
+
 static void *
 ngx_http_limit_conn_create_conf(ngx_conf_t *cf)
 {
@@ -466,6 +532,7 @@ ngx_http_limit_conn_create_conf(ngx_conf_t *cf)
 
     conf->log_level = NGX_CONF_UNSET_UINT;
     conf->status_code = NGX_CONF_UNSET_UINT;
+    conf->dry_run = NGX_CONF_UNSET;
 
     return conf;
 }
@@ -485,6 +552,8 @@ ngx_http_limit_conn_merge_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_uint_value(conf->status_code, prev->status_code,
                               NGX_HTTP_SERVICE_UNAVAILABLE);
 
+    ngx_conf_merge_value(conf->dry_run, prev->dry_run, 0);
+
     return NGX_CONF_OK;
 }
 
@@ -651,6 +720,25 @@ ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static ngx_int_t
+ngx_http_limit_conn_add_variables(ngx_conf_t *cf)
+{
+    ngx_http_variable_t  *var, *v;
+
+    for (v = ngx_http_limit_conn_vars; v->name.len; v++) {
+        var = ngx_http_add_variable(cf, &v->name, v->flags);
+        if (var == NULL) {
+            return NGX_ERROR;
+        }
+
+        var->get_handler = v->get_handler;
+        var->data = v->data;
+    }
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_http_limit_conn_init(ngx_conf_t *cf)
 {
diff --git a/src/http/modules/ngx_http_limit_req_module.c b/src/http/modules/ngx_http_limit_req_module.c
index e81d57ff..2b062a30 100644
--- a/src/http/modules/ngx_http_limit_req_module.c
+++ b/src/http/modules/ngx_http_limit_req_module.c
@@ -10,6 +10,13 @@
 #include <ngx_http.h>
 
 
+#define NGX_HTTP_LIMIT_REQ_PASSED            1
+#define NGX_HTTP_LIMIT_REQ_DELAYED           2
+#define NGX_HTTP_LIMIT_REQ_REJECTED          3
+#define NGX_HTTP_LIMIT_REQ_DELAYED_DRY_RUN   4
+#define NGX_HTTP_LIMIT_REQ_REJECTED_DRY_RUN  5
+
+
 typedef struct {
     u_char                       color;
     u_char                       dummy;
@@ -53,6 +60,7 @@ typedef struct {
     ngx_uint_t                   limit_log_level;
     ngx_uint_t                   delay_log_level;
     ngx_uint_t                   status_code;
+    ngx_flag_t                   dry_run;
 } ngx_http_limit_req_conf_t;
 
 
@@ -61,9 +69,13 @@ static ngx_int_t ngx_http_limit_req_lookup(ngx_http_limit_req_limit_t *limit,
     ngx_uint_t hash, ngx_str_t *key, ngx_uint_t *ep, ngx_uint_t account);
 static ngx_msec_t ngx_http_limit_req_account(ngx_http_limit_req_limit_t *limits,
     ngx_uint_t n, ngx_uint_t *ep, ngx_http_limit_req_limit_t **limit);
+static void ngx_http_limit_req_unlock(ngx_http_limit_req_limit_t *limits,
+    ngx_uint_t n);
 static void ngx_http_limit_req_expire(ngx_http_limit_req_ctx_t *ctx,
     ngx_uint_t n);
 
+static ngx_int_t ngx_http_limit_req_status_variable(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data);
 static void *ngx_http_limit_req_create_conf(ngx_conf_t *cf);
 static char *ngx_http_limit_req_merge_conf(ngx_conf_t *cf, void *parent,
     void *child);
@@ -71,6 +83,7 @@ static char *ngx_http_limit_req_zone(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 static char *ngx_http_limit_req(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+static ngx_int_t ngx_http_limit_req_add_variables(ngx_conf_t *cf);
 static ngx_int_t ngx_http_limit_req_init(ngx_conf_t *cf);
 
 
@@ -118,12 +131,19 @@ static ngx_command_t  ngx_http_limit_req_commands[] = {
       offsetof(ngx_http_limit_req_conf_t, status_code),
       &ngx_http_limit_req_status_bounds },
 
+    { ngx_string("limit_req_dry_run"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_limit_req_conf_t, dry_run),
+      NULL },
+
       ngx_null_command
 };
 
 
 static ngx_http_module_t  ngx_http_limit_req_module_ctx = {
-    NULL,                                  /* preconfiguration */
+    ngx_http_limit_req_add_variables,      /* preconfiguration */
     ngx_http_limit_req_init,               /* postconfiguration */
 
     NULL,                                  /* create main configuration */
@@ -153,6 +173,24 @@ ngx_module_t  ngx_http_limit_req_module = {
 };
 
 
+static ngx_http_variable_t  ngx_http_limit_req_vars[] = {
+
+    { ngx_string("limit_req_status"), NULL,
+      ngx_http_limit_req_status_variable, 0, NGX_HTTP_VAR_NOCACHEABLE, 0 },
+
+      ngx_http_null_variable
+};
+
+
+static ngx_str_t  ngx_http_limit_req_status[] = {
+    ngx_string("PASSED"),
+    ngx_string("DELAYED"),
+    ngx_string("REJECTED"),
+    ngx_string("DELAYED_DRY_RUN"),
+    ngx_string("REJECTED_DRY_RUN")
+};
+
+
 static ngx_int_t
 ngx_http_limit_req_handler(ngx_http_request_t *r)
 {
@@ -165,7 +203,7 @@ ngx_http_limit_req_handler(ngx_http_request_t *r)
     ngx_http_limit_req_conf_t   *lrcf;
     ngx_http_limit_req_limit_t  *limit, *limits;
 
-    if (r->main->limit_req_set) {
+    if (r->main->limit_req_status) {
         return NGX_DECLINED;
     }
 
@@ -187,6 +225,7 @@ ngx_http_limit_req_handler(ngx_http_request_t *r)
         ctx = limit->shm_zone->data;
 
         if (ngx_http_complex_value(r, &ctx->key, &key) != NGX_OK) {
+            ngx_http_limit_req_unlock(limits, n);
             return NGX_HTTP_INTERNAL_SERVER_ERROR;
         }
 
@@ -224,33 +263,25 @@ ngx_http_limit_req_handler(ngx_http_request_t *r)
         return NGX_DECLINED;
     }
 
-    r->main->limit_req_set = 1;
-
     if (rc == NGX_BUSY || rc == NGX_ERROR) {
 
         if (rc == NGX_BUSY) {
             ngx_log_error(lrcf->limit_log_level, r->connection->log, 0,
-                          "limiting requests, excess: %ui.%03ui by zone \"%V\"",
-                          excess / 1000, excess % 1000,
-                          &limit->shm_zone->shm.name);
+                        "limiting requests%s, excess: %ui.%03ui by zone \"%V\"",
+                        lrcf->dry_run ? ", dry run" : "",
+                        excess / 1000, excess % 1000,
+                        &limit->shm_zone->shm.name);
         }
 
-        while (n--) {
-            ctx = limits[n].shm_zone->data;
-
-            if (ctx->node == NULL) {
-                continue;
-            }
-
-            ngx_shmtx_lock(&ctx->shpool->mutex);
-
-            ctx->node->count--;
+        ngx_http_limit_req_unlock(limits, n);
 
-            ngx_shmtx_unlock(&ctx->shpool->mutex);
-
-            ctx->node = NULL;
+        if (lrcf->dry_run) {
+            r->main->limit_req_status = NGX_HTTP_LIMIT_REQ_REJECTED_DRY_RUN;
+            return NGX_DECLINED;
         }
 
+        r->main->limit_req_status = NGX_HTTP_LIMIT_REQ_REJECTED;
+
         return lrcf->status_code;
     }
 
@@ -263,15 +294,29 @@ ngx_http_limit_req_handler(ngx_http_request_t *r)
     delay = ngx_http_limit_req_account(limits, n, &excess, &limit);
 
     if (!delay) {
+        r->main->limit_req_status = NGX_HTTP_LIMIT_REQ_PASSED;
         return NGX_DECLINED;
     }
 
     ngx_log_error(lrcf->delay_log_level, r->connection->log, 0,
-                  "delaying request, excess: %ui.%03ui, by zone \"%V\"",
+                  "delaying request%s, excess: %ui.%03ui, by zone \"%V\"",
+                  lrcf->dry_run ? ", dry run" : "",
                   excess / 1000, excess % 1000, &limit->shm_zone->shm.name);
 
-    if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
-        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    if (lrcf->dry_run) {
+        r->main->limit_req_status = NGX_HTTP_LIMIT_REQ_DELAYED_DRY_RUN;
+        return NGX_DECLINED;
+    }
+
+    r->main->limit_req_status = NGX_HTTP_LIMIT_REQ_DELAYED;
+
+    if (r->connection->read->ready) {
+        ngx_post_event(r->connection->read, &ngx_posted_events);
+
+    } else {
+        if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
+            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        }
     }
 
     r->read_event_handler = ngx_http_test_reading;
@@ -561,6 +606,29 @@ ngx_http_limit_req_account(ngx_http_limit_req_limit_t *limits, ngx_uint_t n,
 }
 
 
+static void
+ngx_http_limit_req_unlock(ngx_http_limit_req_limit_t *limits, ngx_uint_t n)
+{
+    ngx_http_limit_req_ctx_t  *ctx;
+
+    while (n--) {
+        ctx = limits[n].shm_zone->data;
+
+        if (ctx->node == NULL) {
+            continue;
+        }
+
+        ngx_shmtx_lock(&ctx->shpool->mutex);
+
+        ctx->node->count--;
+
+        ngx_shmtx_unlock(&ctx->shpool->mutex);
+
+        ctx->node = NULL;
+    }
+}
+
+
 static void
 ngx_http_limit_req_expire(ngx_http_limit_req_ctx_t *ctx, ngx_uint_t n)
 {
@@ -693,6 +761,25 @@ ngx_http_limit_req_init_zone(ngx_shm_zone_t *shm_zone, void *data)
 }
 
 
+static ngx_int_t
+ngx_http_limit_req_status_variable(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data)
+{
+    if (r->main->limit_req_status == 0) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+    v->len = ngx_http_limit_req_status[r->main->limit_req_status - 1].len;
+    v->data = ngx_http_limit_req_status[r->main->limit_req_status - 1].data;
+
+    return NGX_OK;
+}
+
+
 static void *
 ngx_http_limit_req_create_conf(ngx_conf_t *cf)
 {
@@ -711,6 +798,7 @@ ngx_http_limit_req_create_conf(ngx_conf_t *cf)
 
     conf->limit_log_level = NGX_CONF_UNSET_UINT;
     conf->status_code = NGX_CONF_UNSET_UINT;
+    conf->dry_run = NGX_CONF_UNSET;
 
     return conf;
 }
@@ -735,6 +823,8 @@ ngx_http_limit_req_merge_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_uint_value(conf->status_code, prev->status_code,
                               NGX_HTTP_SERVICE_UNAVAILABLE);
 
+    ngx_conf_merge_value(conf->dry_run, prev->dry_run, 0);
+
     return NGX_CONF_OK;
 }
 
@@ -974,6 +1064,25 @@ ngx_http_limit_req(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static ngx_int_t
+ngx_http_limit_req_add_variables(ngx_conf_t *cf)
+{
+    ngx_http_variable_t  *var, *v;
+
+    for (v = ngx_http_limit_req_vars; v->name.len; v++) {
+        var = ngx_http_add_variable(cf, &v->name, v->flags);
+        if (var == NULL) {
+            return NGX_ERROR;
+        }
+
+        var->get_handler = v->get_handler;
+        var->data = v->data;
+    }
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_http_limit_req_init(ngx_conf_t *cf)
 {
diff --git a/src/http/modules/ngx_http_memcached_module.c b/src/http/modules/ngx_http_memcached_module.c
index 775bd7e8..c82df6e3 100644
--- a/src/http/modules/ngx_http_memcached_module.c
+++ b/src/http/modules/ngx_http_memcached_module.c
@@ -485,10 +485,11 @@ ngx_http_memcached_filter(void *data, ssize_t bytes)
 
     if (u->length == (ssize_t) ctx->rest) {
 
-        if (ngx_strncmp(b->last,
+        if (bytes > u->length
+            || ngx_strncmp(b->last,
                    ngx_http_memcached_end + NGX_HTTP_MEMCACHED_END - ctx->rest,
                    bytes)
-            != 0)
+               != 0)
         {
             ngx_log_error(NGX_LOG_ERR, ctx->request->connection->log, 0,
                           "memcached sent invalid trailer");
@@ -540,7 +541,9 @@ ngx_http_memcached_filter(void *data, ssize_t bytes)
 
     last += (size_t) (u->length - NGX_HTTP_MEMCACHED_END);
 
-    if (ngx_strncmp(last, ngx_http_memcached_end, b->last - last) != 0) {
+    if (bytes > u->length
+        || ngx_strncmp(last, ngx_http_memcached_end, b->last - last) != 0)
+    {
         ngx_log_error(NGX_LOG_ERR, ctx->request->connection->log, 0,
                       "memcached sent invalid trailer");
 
diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
index 618bf787..0e93fbd0 100644
--- a/src/http/modules/ngx_http_mp4_module.c
+++ b/src/http/modules/ngx_http_mp4_module.c
@@ -521,12 +521,6 @@ ngx_http_mp4_handler(ngx_http_request_t *r)
     }
 
     if (!of.is_file) {
-
-        if (ngx_close_file(of.fd) == NGX_FILE_ERROR) {
-            ngx_log_error(NGX_LOG_ALERT, log, ngx_errno,
-                          ngx_close_file_n " \"%s\" failed", path.data);
-        }
-
         return NGX_DECLINED;
     }
 
@@ -3116,6 +3110,13 @@ ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4,
                        "chunk samples sizes:%uL",
                        trak->start_chunk_samples_size);
 
+        if (trak->start_chunk_samples_size > (uint64_t) mp4->end) {
+            ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                          "too large mp4 start samples size in \"%s\"",
+                          mp4->file.name.data);
+            return NGX_ERROR;
+        }
+
         if (mp4->length) {
             if (trak->end_sample - trak->start_sample > entries) {
                 ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
@@ -3135,6 +3136,13 @@ ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4,
             ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                            "mp4 stsz end_chunk_samples_size:%uL",
                            trak->end_chunk_samples_size);
+
+            if (trak->end_chunk_samples_size > (uint64_t) mp4->end) {
+                ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                              "too large mp4 end samples size in \"%s\"",
+                              mp4->file.name.data);
+                return NGX_ERROR;
+            }
         }
 
         atom_size = sizeof(ngx_mp4_stsz_atom_t) + (data->last - data->pos);
@@ -3226,6 +3234,7 @@ ngx_http_mp4_update_stco_atom(ngx_http_mp4_file_t *mp4,
 {
     size_t                atom_size;
     uint32_t              entries;
+    uint64_t              chunk_offset, samples_size;
     ngx_buf_t            *atom, *data;
     ngx_mp4_stco_atom_t  *stco_atom;
 
@@ -3256,8 +3265,19 @@ ngx_http_mp4_update_stco_atom(ngx_http_mp4_file_t *mp4,
 
     data->pos += trak->start_chunk * sizeof(uint32_t);
 
-    trak->start_offset = ngx_mp4_get_32value(data->pos);
-    trak->start_offset += trak->start_chunk_samples_size;
+    chunk_offset = ngx_mp4_get_32value(data->pos);
+    samples_size = trak->start_chunk_samples_size;
+
+    if (chunk_offset > (uint64_t) mp4->end - samples_size
+        || chunk_offset + samples_size > NGX_MAX_UINT32_VALUE)
+    {
+        ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                      "too large chunk offset in \"%s\"",
+                      mp4->file.name.data);
+        return NGX_ERROR;
+    }
+
+    trak->start_offset = chunk_offset + samples_size;
     ngx_mp4_set_32value(data->pos, trak->start_offset);
 
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
@@ -3276,9 +3296,19 @@ ngx_http_mp4_update_stco_atom(ngx_http_mp4_file_t *mp4,
         data->last = data->pos + entries * sizeof(uint32_t);
 
         if (entries) {
-            trak->end_offset =
-                            ngx_mp4_get_32value(data->last - sizeof(uint32_t));
-            trak->end_offset += trak->end_chunk_samples_size;
+            chunk_offset = ngx_mp4_get_32value(data->last - sizeof(uint32_t));
+            samples_size = trak->end_chunk_samples_size;
+
+            if (chunk_offset > (uint64_t) mp4->end - samples_size
+                || chunk_offset + samples_size > NGX_MAX_UINT32_VALUE)
+            {
+                ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                              "too large chunk offset in \"%s\"",
+                              mp4->file.name.data);
+                return NGX_ERROR;
+            }
+
+            trak->end_offset = chunk_offset + samples_size;
 
             ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                            "end chunk offset:%O", trak->end_offset);
@@ -3409,7 +3439,7 @@ ngx_http_mp4_update_co64_atom(ngx_http_mp4_file_t *mp4,
     ngx_http_mp4_trak_t *trak)
 {
     size_t                atom_size;
-    uint64_t              entries;
+    uint64_t              entries, chunk_offset, samples_size;
     ngx_buf_t            *atom, *data;
     ngx_mp4_co64_atom_t  *co64_atom;
 
@@ -3440,8 +3470,17 @@ ngx_http_mp4_update_co64_atom(ngx_http_mp4_file_t *mp4,
 
     data->pos += trak->start_chunk * sizeof(uint64_t);
 
-    trak->start_offset = ngx_mp4_get_64value(data->pos);
-    trak->start_offset += trak->start_chunk_samples_size;
+    chunk_offset = ngx_mp4_get_64value(data->pos);
+    samples_size = trak->start_chunk_samples_size;
+
+    if (chunk_offset > (uint64_t) mp4->end - samples_size) {
+        ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                      "too large chunk offset in \"%s\"",
+                      mp4->file.name.data);
+        return NGX_ERROR;
+    }
+
+    trak->start_offset = chunk_offset + samples_size;
     ngx_mp4_set_64value(data->pos, trak->start_offset);
 
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
@@ -3460,9 +3499,17 @@ ngx_http_mp4_update_co64_atom(ngx_http_mp4_file_t *mp4,
         data->last = data->pos + entries * sizeof(uint64_t);
 
         if (entries) {
-            trak->end_offset =
-                            ngx_mp4_get_64value(data->last - sizeof(uint64_t));
-            trak->end_offset += trak->end_chunk_samples_size;
+            chunk_offset = ngx_mp4_get_64value(data->last - sizeof(uint64_t));
+            samples_size = trak->end_chunk_samples_size;
+
+            if (chunk_offset > (uint64_t) mp4->end - samples_size) {
+                ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                              "too large chunk offset in \"%s\"",
+                              mp4->file.name.data);
+                return NGX_ERROR;
+            }
+
+            trak->end_offset = chunk_offset + samples_size;
 
             ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                            "end chunk offset:%O", trak->end_offset);
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
index 3aafb999..64190f1a 100644
--- a/src/http/modules/ngx_http_proxy_module.c
+++ b/src/http/modules/ngx_http_proxy_module.c
@@ -10,6 +10,19 @@
 #include <ngx_http.h>
 
 
+#define  NGX_HTTP_PROXY_COOKIE_SECURE           0x0001
+#define  NGX_HTTP_PROXY_COOKIE_SECURE_ON        0x0002
+#define  NGX_HTTP_PROXY_COOKIE_SECURE_OFF       0x0004
+#define  NGX_HTTP_PROXY_COOKIE_HTTPONLY         0x0008
+#define  NGX_HTTP_PROXY_COOKIE_HTTPONLY_ON      0x0010
+#define  NGX_HTTP_PROXY_COOKIE_HTTPONLY_OFF     0x0020
+#define  NGX_HTTP_PROXY_COOKIE_SAMESITE         0x0040
+#define  NGX_HTTP_PROXY_COOKIE_SAMESITE_STRICT  0x0080
+#define  NGX_HTTP_PROXY_COOKIE_SAMESITE_LAX     0x0100
+#define  NGX_HTTP_PROXY_COOKIE_SAMESITE_NONE    0x0200
+#define  NGX_HTTP_PROXY_COOKIE_SAMESITE_OFF     0x0400
+
+
 typedef struct {
     ngx_array_t                    caches;  /* ngx_http_file_cache_t * */
 } ngx_http_proxy_main_conf_t;
@@ -18,7 +31,7 @@ typedef struct {
 typedef struct ngx_http_proxy_rewrite_s  ngx_http_proxy_rewrite_t;
 
 typedef ngx_int_t (*ngx_http_proxy_rewrite_pt)(ngx_http_request_t *r,
-    ngx_table_elt_t *h, size_t prefix, size_t len,
+    ngx_str_t *value, size_t prefix, size_t len,
     ngx_http_proxy_rewrite_t *pr);
 
 struct ngx_http_proxy_rewrite_s {
@@ -35,6 +48,19 @@ struct ngx_http_proxy_rewrite_s {
 };
 
 
+typedef struct {
+    union {
+        ngx_http_complex_value_t   complex;
+#if (NGX_PCRE)
+        ngx_http_regex_t          *regex;
+#endif
+    } cookie;
+
+    ngx_array_t                    flags_values;
+    ngx_uint_t                     regex;
+} ngx_http_proxy_cookie_flags_t;
+
+
 typedef struct {
     ngx_str_t                      key_start;
     ngx_str_t                      schema;
@@ -72,6 +98,7 @@ typedef struct {
     ngx_array_t                   *redirects;
     ngx_array_t                   *cookie_domains;
     ngx_array_t                   *cookie_paths;
+    ngx_array_t                   *cookie_flags;
 
     ngx_http_complex_value_t      *method;
     ngx_str_t                      location;
@@ -97,9 +124,7 @@ typedef struct {
     ngx_uint_t                     ssl_verify_depth;
     ngx_str_t                      ssl_trusted_certificate;
     ngx_str_t                      ssl_crl;
-    ngx_str_t                      ssl_certificate;
-    ngx_str_t                      ssl_certificate_key;
-    ngx_array_t                   *ssl_passwords;
+    ngx_array_t                   *ssl_conf_commands;
 #endif
 } ngx_http_proxy_loc_conf_t;
 
@@ -158,10 +183,16 @@ static ngx_int_t ngx_http_proxy_rewrite_redirect(ngx_http_request_t *r,
     ngx_table_elt_t *h, size_t prefix);
 static ngx_int_t ngx_http_proxy_rewrite_cookie(ngx_http_request_t *r,
     ngx_table_elt_t *h);
+static ngx_int_t ngx_http_proxy_parse_cookie(ngx_str_t *value,
+    ngx_array_t *attrs);
 static ngx_int_t ngx_http_proxy_rewrite_cookie_value(ngx_http_request_t *r,
-    ngx_table_elt_t *h, u_char *value, ngx_array_t *rewrites);
+    ngx_str_t *value, ngx_array_t *rewrites);
+static ngx_int_t ngx_http_proxy_rewrite_cookie_flags(ngx_http_request_t *r,
+    ngx_array_t *attrs, ngx_array_t *flags);
+static ngx_int_t ngx_http_proxy_edit_cookie_flags(ngx_http_request_t *r,
+    ngx_array_t *attrs, ngx_uint_t flags);
 static ngx_int_t ngx_http_proxy_rewrite(ngx_http_request_t *r,
-    ngx_table_elt_t *h, size_t prefix, size_t len, ngx_str_t *replacement);
+    ngx_str_t *value, size_t prefix, size_t len, ngx_str_t *replacement);
 
 static ngx_int_t ngx_http_proxy_add_variables(ngx_conf_t *cf);
 static void *ngx_http_proxy_create_main_conf(ngx_conf_t *cf);
@@ -180,6 +211,8 @@ static char *ngx_http_proxy_cookie_domain(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 static char *ngx_http_proxy_cookie_path(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+static char *ngx_http_proxy_cookie_flags(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
 static char *ngx_http_proxy_store(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 #if (NGX_HTTP_CACHE)
@@ -194,6 +227,10 @@ static char *ngx_http_proxy_ssl_password_file(ngx_conf_t *cf,
 #endif
 
 static char *ngx_http_proxy_lowat_check(ngx_conf_t *cf, void *post, void *data);
+#if (NGX_HTTP_SSL)
+static char *ngx_http_proxy_ssl_conf_command_check(ngx_conf_t *cf, void *post,
+    void *data);
+#endif
 
 static ngx_int_t ngx_http_proxy_rewrite_regex(ngx_conf_t *cf,
     ngx_http_proxy_rewrite_t *pr, ngx_str_t *regex, ngx_uint_t caseless);
@@ -239,6 +276,9 @@ static ngx_conf_bitmask_t  ngx_http_proxy_ssl_protocols[] = {
     { ngx_null_string, 0 }
 };
 
+static ngx_conf_post_t  ngx_http_proxy_ssl_conf_command_post =
+    { ngx_http_proxy_ssl_conf_command_check };
+
 #endif
 
 
@@ -282,6 +322,13 @@ static ngx_command_t  ngx_http_proxy_commands[] = {
       0,
       NULL },
 
+    { ngx_string("proxy_cookie_flags"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1234,
+      ngx_http_proxy_cookie_flags,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      0,
+      NULL },
+
     { ngx_string("proxy_store"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
       ngx_http_proxy_store,
@@ -703,16 +750,16 @@ static ngx_command_t  ngx_http_proxy_commands[] = {
 
     { ngx_string("proxy_ssl_certificate"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_http_set_complex_value_zero_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
-      offsetof(ngx_http_proxy_loc_conf_t, ssl_certificate),
+      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_certificate),
       NULL },
 
     { ngx_string("proxy_ssl_certificate_key"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_http_set_complex_value_zero_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
-      offsetof(ngx_http_proxy_loc_conf_t, ssl_certificate_key),
+      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_certificate_key),
       NULL },
 
     { ngx_string("proxy_ssl_password_file"),
@@ -722,6 +769,13 @@ static ngx_command_t  ngx_http_proxy_commands[] = {
       0,
       NULL },
 
+    { ngx_string("proxy_ssl_conf_command"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE2,
+      ngx_conf_set_keyval_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_proxy_loc_conf_t, ssl_conf_commands),
+      &ngx_http_proxy_ssl_conf_command_post },
+
 #endif
 
       ngx_null_command
@@ -845,6 +899,36 @@ static ngx_path_init_t  ngx_http_proxy_temp_path = {
 };
 
 
+static ngx_conf_bitmask_t  ngx_http_proxy_cookie_flags_masks[] = {
+
+    { ngx_string("secure"),
+      NGX_HTTP_PROXY_COOKIE_SECURE|NGX_HTTP_PROXY_COOKIE_SECURE_ON },
+
+    { ngx_string("nosecure"),
+      NGX_HTTP_PROXY_COOKIE_SECURE|NGX_HTTP_PROXY_COOKIE_SECURE_OFF },
+
+    { ngx_string("httponly"),
+      NGX_HTTP_PROXY_COOKIE_HTTPONLY|NGX_HTTP_PROXY_COOKIE_HTTPONLY_ON },
+
+    { ngx_string("nohttponly"),
+      NGX_HTTP_PROXY_COOKIE_HTTPONLY|NGX_HTTP_PROXY_COOKIE_HTTPONLY_OFF },
+
+    { ngx_string("samesite=strict"),
+      NGX_HTTP_PROXY_COOKIE_SAMESITE|NGX_HTTP_PROXY_COOKIE_SAMESITE_STRICT },
+
+    { ngx_string("samesite=lax"),
+      NGX_HTTP_PROXY_COOKIE_SAMESITE|NGX_HTTP_PROXY_COOKIE_SAMESITE_LAX },
+
+    { ngx_string("samesite=none"),
+      NGX_HTTP_PROXY_COOKIE_SAMESITE|NGX_HTTP_PROXY_COOKIE_SAMESITE_NONE },
+
+    { ngx_string("nosamesite"),
+      NGX_HTTP_PROXY_COOKIE_SAMESITE|NGX_HTTP_PROXY_COOKIE_SAMESITE_OFF },
+
+    { ngx_null_string, 0 }
+};
+
+
 static ngx_int_t
 ngx_http_proxy_handler(ngx_http_request_t *r)
 {
@@ -906,7 +990,7 @@ ngx_http_proxy_handler(ngx_http_request_t *r)
         u->rewrite_redirect = ngx_http_proxy_rewrite_redirect;
     }
 
-    if (plcf->cookie_domains || plcf->cookie_paths) {
+    if (plcf->cookie_domains || plcf->cookie_paths || plcf->cookie_flags) {
         u->rewrite_cookie = ngx_http_proxy_rewrite_cookie;
     }
 
@@ -2015,6 +2099,25 @@ ngx_http_proxy_copy_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
         return NGX_OK;
     }
 
+    if (p->upstream_done) {
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, p->log, 0,
+                       "http proxy data after close");
+        return NGX_OK;
+    }
+
+    if (p->length == 0) {
+
+        ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+
+        r = p->input_ctx;
+        r->upstream->keepalive = 0;
+        p->upstream_done = 1;
+
+        return NGX_OK;
+    }
+
     cl = ngx_chain_get_free_buf(p->pool, &p->free);
     if (cl == NULL) {
         return NGX_ERROR;
@@ -2042,20 +2145,23 @@ ngx_http_proxy_copy_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
         return NGX_OK;
     }
 
+    if (b->last - b->pos > p->length) {
+
+        ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+
+        b->last = b->pos + p->length;
+        p->upstream_done = 1;
+
+        return NGX_OK;
+    }
+
     p->length -= b->last - b->pos;
 
     if (p->length == 0) {
         r = p->input_ctx;
-        p->upstream_done = 1;
         r->upstream->keepalive = !r->upstream->headers_in.connection_close;
-
-    } else if (p->length < 0) {
-        r = p->input_ctx;
-        p->upstream_done = 1;
-
-        ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
-                      "upstream sent more data than specified in "
-                      "\"Content-Length\" header");
     }
 
     return NGX_OK;
@@ -2082,6 +2188,23 @@ ngx_http_proxy_chunked_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
         return NGX_ERROR;
     }
 
+    if (p->upstream_done) {
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, p->log, 0,
+                       "http proxy data after close");
+        return NGX_OK;
+    }
+
+    if (p->length == 0) {
+
+        ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                      "upstream sent data after final chunk");
+
+        r->upstream->keepalive = 0;
+        p->upstream_done = 1;
+
+        return NGX_OK;
+    }
+
     b = NULL;
     prev = &buf->shadow;
 
@@ -2144,9 +2267,15 @@ ngx_http_proxy_chunked_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
 
             /* a whole response has been parsed successfully */
 
-            p->upstream_done = 1;
+            p->length = 0;
             r->upstream->keepalive = !r->upstream->headers_in.connection_close;
 
+            if (buf->pos != buf->last) {
+                ngx_log_error(NGX_LOG_WARN, p->log, 0,
+                              "upstream sent data after final chunk");
+                r->upstream->keepalive = 0;
+            }
+
             break;
         }
 
@@ -2161,13 +2290,13 @@ ngx_http_proxy_chunked_filter(ngx_event_pipe_t *p, ngx_buf_t *buf)
 
         /* invalid response */
 
-        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+        ngx_log_error(NGX_LOG_ERR, p->log, 0,
                       "upstream sent invalid chunked response");
 
         return NGX_ERROR;
     }
 
-    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, p->log, 0,
                    "http proxy chunked state %ui, length %O",
                    ctx->chunked.state, p->length);
 
@@ -2202,6 +2331,13 @@ ngx_http_proxy_non_buffered_copy_filter(void *data, ssize_t bytes)
 
     u = r->upstream;
 
+    if (u->length == 0) {
+        ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+        return NGX_OK;
+    }
+
     for (cl = u->out_bufs, ll = &u->out_bufs; cl; cl = cl->next) {
         ll = &cl->next;
     }
@@ -2227,6 +2363,18 @@ ngx_http_proxy_non_buffered_copy_filter(void *data, ssize_t bytes)
         return NGX_OK;
     }
 
+    if (bytes > u->length) {
+
+        ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+
+        cl->buf->last = cl->buf->pos + u->length;
+        u->length = 0;
+
+        return NGX_OK;
+    }
+
     u->length -= bytes;
 
     if (u->length == 0) {
@@ -2313,6 +2461,12 @@ ngx_http_proxy_non_buffered_chunked_filter(void *data, ssize_t bytes)
             u->keepalive = !u->headers_in.connection_close;
             u->length = 0;
 
+            if (buf->pos != buf->last) {
+                ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
+                              "upstream sent data after final chunk");
+                u->keepalive = 0;
+            }
+
             break;
         }
 
@@ -2521,7 +2675,7 @@ ngx_http_proxy_rewrite_redirect(ngx_http_request_t *r, ngx_table_elt_t *h,
     len = h->value.len - prefix;
 
     for (i = 0; i < plcf->redirects->nelts; i++) {
-        rc = pr[i].handler(r, h, prefix, len, &pr[i]);
+        rc = pr[i].handler(r, &h->value, prefix, len, &pr[i]);
 
         if (rc != NGX_DECLINED) {
             return rc;
@@ -2535,27 +2689,43 @@ ngx_http_proxy_rewrite_redirect(ngx_http_request_t *r, ngx_table_elt_t *h,
 static ngx_int_t
 ngx_http_proxy_rewrite_cookie(ngx_http_request_t *r, ngx_table_elt_t *h)
 {
-    size_t                      prefix;
     u_char                     *p;
+    size_t                      len;
     ngx_int_t                   rc, rv;
+    ngx_str_t                  *key, *value;
+    ngx_uint_t                  i;
+    ngx_array_t                 attrs;
+    ngx_keyval_t               *attr;
     ngx_http_proxy_loc_conf_t  *plcf;
 
-    p = (u_char *) ngx_strchr(h->value.data, ';');
-    if (p == NULL) {
-        return NGX_DECLINED;
+    if (ngx_array_init(&attrs, r->pool, 2, sizeof(ngx_keyval_t)) != NGX_OK) {
+        return NGX_ERROR;
     }
 
-    prefix = p + 1 - h->value.data;
+    if (ngx_http_proxy_parse_cookie(&h->value, &attrs) != NGX_OK) {
+        return NGX_ERROR;
+    }
+
+    attr = attrs.elts;
+
+    if (attr[0].value.data == NULL) {
+        return NGX_DECLINED;
+    }
 
     rv = NGX_DECLINED;
 
     plcf = ngx_http_get_module_loc_conf(r, ngx_http_proxy_module);
 
-    if (plcf->cookie_domains) {
-        p = ngx_strcasestrn(h->value.data + prefix, "domain=", 7 - 1);
+    for (i = 1; i < attrs.nelts; i++) {
+
+        key = &attr[i].key;
+        value = &attr[i].value;
 
-        if (p) {
-            rc = ngx_http_proxy_rewrite_cookie_value(r, h, p + 7,
+        if (plcf->cookie_domains && key->len == 6
+            && ngx_strncasecmp(key->data, (u_char *) "domain", 6) == 0
+            && value->data)
+        {
+            rc = ngx_http_proxy_rewrite_cookie_value(r, value,
                                                      plcf->cookie_domains);
             if (rc == NGX_ERROR) {
                 return NGX_ERROR;
@@ -2565,13 +2735,12 @@ ngx_http_proxy_rewrite_cookie(ngx_http_request_t *r, ngx_table_elt_t *h)
                 rv = rc;
             }
         }
-    }
 
-    if (plcf->cookie_paths) {
-        p = ngx_strcasestrn(h->value.data + prefix, "path=", 5 - 1);
-
-        if (p) {
-            rc = ngx_http_proxy_rewrite_cookie_value(r, h, p + 5,
+        if (plcf->cookie_paths && key->len == 4
+            && ngx_strncasecmp(key->data, (u_char *) "path", 4) == 0
+            && value->data)
+        {
+            rc = ngx_http_proxy_rewrite_cookie_value(r, value,
                                                      plcf->cookie_paths);
             if (rc == NGX_ERROR) {
                 return NGX_ERROR;
@@ -2583,30 +2752,153 @@ ngx_http_proxy_rewrite_cookie(ngx_http_request_t *r, ngx_table_elt_t *h)
         }
     }
 
-    return rv;
+    if (plcf->cookie_flags) {
+        rc = ngx_http_proxy_rewrite_cookie_flags(r, &attrs,
+                                                 plcf->cookie_flags);
+        if (rc == NGX_ERROR) {
+            return NGX_ERROR;
+        }
+
+        if (rc != NGX_DECLINED) {
+            rv = rc;
+        }
+
+        attr = attrs.elts;
+    }
+
+    if (rv != NGX_OK) {
+        return rv;
+    }
+
+    len = 0;
+
+    for (i = 0; i < attrs.nelts; i++) {
+
+        if (attr[i].key.data == NULL) {
+            continue;
+        }
+
+        if (i > 0) {
+            len += 2;
+        }
+
+        len += attr[i].key.len;
+
+        if (attr[i].value.data) {
+            len += 1 + attr[i].value.len;
+        }
+    }
+
+    p = ngx_pnalloc(r->pool, len + 1);
+    if (p == NULL) {
+        return NGX_ERROR;
+    }
+
+    h->value.data = p;
+    h->value.len = len;
+
+    for (i = 0; i < attrs.nelts; i++) {
+
+        if (attr[i].key.data == NULL) {
+            continue;
+        }
+
+        if (i > 0) {
+            *p++ = ';';
+            *p++ = ' ';
+        }
+
+        p = ngx_cpymem(p, attr[i].key.data, attr[i].key.len);
+
+        if (attr[i].value.data) {
+            *p++ = '=';
+            p = ngx_cpymem(p, attr[i].value.data, attr[i].value.len);
+        }
+    }
+
+    *p = '\0';
+
+    return NGX_OK;
 }
 
 
 static ngx_int_t
-ngx_http_proxy_rewrite_cookie_value(ngx_http_request_t *r, ngx_table_elt_t *h,
-    u_char *value, ngx_array_t *rewrites)
+ngx_http_proxy_parse_cookie(ngx_str_t *value, ngx_array_t *attrs)
 {
-    size_t                     len, prefix;
-    u_char                    *p;
-    ngx_int_t                  rc;
-    ngx_uint_t                 i;
-    ngx_http_proxy_rewrite_t  *pr;
+    u_char        *start, *end, *p, *last;
+    ngx_str_t      name, val;
+    ngx_keyval_t  *attr;
+
+    start = value->data;
+    end = value->data + value->len;
+
+    for ( ;; ) {
+
+        last = (u_char *) ngx_strchr(start, ';');
+
+        if (last == NULL) {
+            last = end;
+        }
 
-    prefix = value - h->value.data;
+        while (start < last && *start == ' ') { start++; }
 
-    p = (u_char *) ngx_strchr(value, ';');
+        for (p = start; p < last && *p != '='; p++) { /* void */ }
 
-    len = p ? (size_t) (p - value) : (h->value.len - prefix);
+        name.data = start;
+        name.len = p - start;
+
+        while (name.len && name.data[name.len - 1] == ' ') {
+            name.len--;
+        }
+
+        if (p < last) {
+
+            p++;
+
+            while (p < last && *p == ' ') { p++; }
+
+            val.data = p;
+            val.len = last - val.data;
+
+            while (val.len && val.data[val.len - 1] == ' ') {
+                val.len--;
+            }
+
+        } else {
+            ngx_str_null(&val);
+        }
+
+        attr = ngx_array_push(attrs);
+        if (attr == NULL) {
+            return NGX_ERROR;
+        }
+
+        attr->key = name;
+        attr->value = val;
+
+        if (last == end) {
+            break;
+        }
+
+        start = last + 1;
+    }
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_http_proxy_rewrite_cookie_value(ngx_http_request_t *r, ngx_str_t *value,
+    ngx_array_t *rewrites)
+{
+    ngx_int_t                  rc;
+    ngx_uint_t                 i;
+    ngx_http_proxy_rewrite_t  *pr;
 
     pr = rewrites->elts;
 
     for (i = 0; i < rewrites->nelts; i++) {
-        rc = pr[i].handler(r, h, prefix, len, &pr[i]);
+        rc = pr[i].handler(r, value, 0, value->len, &pr[i]);
 
         if (rc != NGX_DECLINED) {
             return rc;
@@ -2618,8 +2910,236 @@ ngx_http_proxy_rewrite_cookie_value(ngx_http_request_t *r, ngx_table_elt_t *h,
 
 
 static ngx_int_t
-ngx_http_proxy_rewrite_complex_handler(ngx_http_request_t *r,
-    ngx_table_elt_t *h, size_t prefix, size_t len, ngx_http_proxy_rewrite_t *pr)
+ngx_http_proxy_rewrite_cookie_flags(ngx_http_request_t *r, ngx_array_t *attrs,
+    ngx_array_t *flags)
+{
+    ngx_str_t                       pattern, value;
+#if (NGX_PCRE)
+    ngx_int_t                       rc;
+#endif
+    ngx_uint_t                      i, m, f, nelts;
+    ngx_keyval_t                   *attr;
+    ngx_conf_bitmask_t             *mask;
+    ngx_http_complex_value_t       *flags_values;
+    ngx_http_proxy_cookie_flags_t  *pcf;
+
+    attr = attrs->elts;
+    pcf = flags->elts;
+
+    for (i = 0; i < flags->nelts; i++) {
+
+#if (NGX_PCRE)
+        if (pcf[i].regex) {
+            rc = ngx_http_regex_exec(r, pcf[i].cookie.regex, &attr[0].key);
+
+            if (rc == NGX_ERROR) {
+                return NGX_ERROR;
+            }
+
+            if (rc == NGX_OK) {
+                break;
+            }
+
+            /* NGX_DECLINED */
+
+            continue;
+        }
+#endif
+
+        if (ngx_http_complex_value(r, &pcf[i].cookie.complex, &pattern)
+            != NGX_OK)
+        {
+            return NGX_ERROR;
+        }
+
+        if (pattern.len == attr[0].key.len
+            && ngx_strncasecmp(attr[0].key.data, pattern.data, pattern.len)
+               == 0)
+        {
+            break;
+        }
+    }
+
+    if (i == flags->nelts) {
+        return NGX_DECLINED;
+    }
+
+    nelts = pcf[i].flags_values.nelts;
+    flags_values = pcf[i].flags_values.elts;
+
+    mask = ngx_http_proxy_cookie_flags_masks;
+    f = 0;
+
+    for (i = 0; i < nelts; i++) {
+
+        if (ngx_http_complex_value(r, &flags_values[i], &value) != NGX_OK) {
+            return NGX_ERROR;
+        }
+
+        if (value.len == 0) {
+            continue;
+        }
+
+        for (m = 0; mask[m].name.len != 0; m++) {
+
+            if (mask[m].name.len != value.len
+                || ngx_strncasecmp(mask[m].name.data, value.data, value.len)
+                   != 0)
+            {
+                continue;
+            }
+
+            f |= mask[m].mask;
+
+            break;
+        }
+
+        if (mask[m].name.len == 0) {
+            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                           "invalid proxy_cookie_flags flag \"%V\"", &value);
+        }
+    }
+
+    if (f == 0) {
+        return NGX_DECLINED;
+    }
+
+    return ngx_http_proxy_edit_cookie_flags(r, attrs, f);
+}
+
+
+static ngx_int_t
+ngx_http_proxy_edit_cookie_flags(ngx_http_request_t *r, ngx_array_t *attrs,
+    ngx_uint_t flags)
+{
+    ngx_str_t     *key, *value;
+    ngx_uint_t     i;
+    ngx_keyval_t  *attr;
+
+    attr = attrs->elts;
+
+    for (i = 1; i < attrs->nelts; i++) {
+        key = &attr[i].key;
+
+        if (key->len == 6
+            && ngx_strncasecmp(key->data, (u_char *) "secure", 6) == 0)
+        {
+            if (flags & NGX_HTTP_PROXY_COOKIE_SECURE_ON) {
+                flags &= ~NGX_HTTP_PROXY_COOKIE_SECURE_ON;
+
+            } else if (flags & NGX_HTTP_PROXY_COOKIE_SECURE_OFF) {
+                key->data = NULL;
+            }
+
+            continue;
+        }
+
+        if (key->len == 8
+            && ngx_strncasecmp(key->data, (u_char *) "httponly", 8) == 0)
+        {
+            if (flags & NGX_HTTP_PROXY_COOKIE_HTTPONLY_ON) {
+                flags &= ~NGX_HTTP_PROXY_COOKIE_HTTPONLY_ON;
+
+            } else if (flags & NGX_HTTP_PROXY_COOKIE_HTTPONLY_OFF) {
+                key->data = NULL;
+            }
+
+            continue;
+        }
+
+        if (key->len == 8
+            && ngx_strncasecmp(key->data, (u_char *) "samesite", 8) == 0)
+        {
+            value = &attr[i].value;
+
+            if (flags & NGX_HTTP_PROXY_COOKIE_SAMESITE_STRICT) {
+                flags &= ~NGX_HTTP_PROXY_COOKIE_SAMESITE_STRICT;
+
+                if (value->len != 6
+                    || ngx_strncasecmp(value->data, (u_char *) "strict", 6)
+                       != 0)
+                {
+                    ngx_str_set(key, "SameSite");
+                    ngx_str_set(value, "Strict");
+                }
+
+            } else if (flags & NGX_HTTP_PROXY_COOKIE_SAMESITE_LAX) {
+                flags &= ~NGX_HTTP_PROXY_COOKIE_SAMESITE_LAX;
+
+                if (value->len != 3
+                    || ngx_strncasecmp(value->data, (u_char *) "lax", 3) != 0)
+                {
+                    ngx_str_set(key, "SameSite");
+                    ngx_str_set(value, "Lax");
+                }
+
+            } else if (flags & NGX_HTTP_PROXY_COOKIE_SAMESITE_NONE) {
+                flags &= ~NGX_HTTP_PROXY_COOKIE_SAMESITE_NONE;
+
+                if (value->len != 4
+                    || ngx_strncasecmp(value->data, (u_char *) "none", 4) != 0)
+                {
+                    ngx_str_set(key, "SameSite");
+                    ngx_str_set(value, "None");
+                }
+
+            } else if (flags & NGX_HTTP_PROXY_COOKIE_SAMESITE_OFF) {
+                key->data = NULL;
+            }
+
+            continue;
+        }
+    }
+
+    if (flags & NGX_HTTP_PROXY_COOKIE_SECURE_ON) {
+        attr = ngx_array_push(attrs);
+        if (attr == NULL) {
+            return NGX_ERROR;
+        }
+
+        ngx_str_set(&attr->key, "Secure");
+        ngx_str_null(&attr->value);
+    }
+
+    if (flags & NGX_HTTP_PROXY_COOKIE_HTTPONLY_ON) {
+        attr = ngx_array_push(attrs);
+        if (attr == NULL) {
+            return NGX_ERROR;
+        }
+
+        ngx_str_set(&attr->key, "HttpOnly");
+        ngx_str_null(&attr->value);
+    }
+
+    if (flags & (NGX_HTTP_PROXY_COOKIE_SAMESITE_STRICT
+                 |NGX_HTTP_PROXY_COOKIE_SAMESITE_LAX
+                 |NGX_HTTP_PROXY_COOKIE_SAMESITE_NONE))
+    {
+        attr = ngx_array_push(attrs);
+        if (attr == NULL) {
+            return NGX_ERROR;
+        }
+
+        ngx_str_set(&attr->key, "SameSite");
+
+        if (flags & NGX_HTTP_PROXY_COOKIE_SAMESITE_STRICT) {
+            ngx_str_set(&attr->value, "Strict");
+
+        } else if (flags & NGX_HTTP_PROXY_COOKIE_SAMESITE_LAX) {
+            ngx_str_set(&attr->value, "Lax");
+
+        } else {
+            ngx_str_set(&attr->value, "None");
+        }
+    }
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_http_proxy_rewrite_complex_handler(ngx_http_request_t *r, ngx_str_t *value,
+    size_t prefix, size_t len, ngx_http_proxy_rewrite_t *pr)
 {
     ngx_str_t  pattern, replacement;
 
@@ -2628,8 +3148,7 @@ ngx_http_proxy_rewrite_complex_handler(ngx_http_request_t *r,
     }
 
     if (pattern.len > len
-        || ngx_rstrncmp(h->value.data + prefix, pattern.data,
-                        pattern.len) != 0)
+        || ngx_rstrncmp(value->data + prefix, pattern.data, pattern.len) != 0)
     {
         return NGX_DECLINED;
     }
@@ -2638,20 +3157,20 @@ ngx_http_proxy_rewrite_complex_handler(ngx_http_request_t *r,
         return NGX_ERROR;
     }
 
-    return ngx_http_proxy_rewrite(r, h, prefix, pattern.len, &replacement);
+    return ngx_http_proxy_rewrite(r, value, prefix, pattern.len, &replacement);
 }
 
 
 #if (NGX_PCRE)
 
 static ngx_int_t
-ngx_http_proxy_rewrite_regex_handler(ngx_http_request_t *r, ngx_table_elt_t *h,
+ngx_http_proxy_rewrite_regex_handler(ngx_http_request_t *r, ngx_str_t *value,
     size_t prefix, size_t len, ngx_http_proxy_rewrite_t *pr)
 {
     ngx_str_t  pattern, replacement;
 
     pattern.len = len;
-    pattern.data = h->value.data + prefix;
+    pattern.data = value->data + prefix;
 
     if (ngx_http_regex_exec(r, pr->pattern.regex, &pattern) != NGX_OK) {
         return NGX_DECLINED;
@@ -2661,20 +3180,15 @@ ngx_http_proxy_rewrite_regex_handler(ngx_http_request_t *r, ngx_table_elt_t *h,
         return NGX_ERROR;
     }
 
-    if (prefix == 0 && h->value.len == len) {
-        h->value = replacement;
-        return NGX_OK;
-    }
-
-    return ngx_http_proxy_rewrite(r, h, prefix, len, &replacement);
+    return ngx_http_proxy_rewrite(r, value, prefix, len, &replacement);
 }
 
 #endif
 
 
 static ngx_int_t
-ngx_http_proxy_rewrite_domain_handler(ngx_http_request_t *r,
-    ngx_table_elt_t *h, size_t prefix, size_t len, ngx_http_proxy_rewrite_t *pr)
+ngx_http_proxy_rewrite_domain_handler(ngx_http_request_t *r, ngx_str_t *value,
+    size_t prefix, size_t len, ngx_http_proxy_rewrite_t *pr)
 {
     u_char     *p;
     ngx_str_t   pattern, replacement;
@@ -2683,9 +3197,9 @@ ngx_http_proxy_rewrite_domain_handler(ngx_http_request_t *r,
         return NGX_ERROR;
     }
 
-    p = h->value.data + prefix;
+    p = value->data + prefix;
 
-    if (p[0] == '.') {
+    if (len && p[0] == '.') {
         p++;
         prefix++;
         len--;
@@ -2699,18 +3213,23 @@ ngx_http_proxy_rewrite_domain_handler(ngx_http_request_t *r,
         return NGX_ERROR;
     }
 
-    return ngx_http_proxy_rewrite(r, h, prefix, len, &replacement);
+    return ngx_http_proxy_rewrite(r, value, prefix, len, &replacement);
 }
 
 
 static ngx_int_t
-ngx_http_proxy_rewrite(ngx_http_request_t *r, ngx_table_elt_t *h, size_t prefix,
+ngx_http_proxy_rewrite(ngx_http_request_t *r, ngx_str_t *value, size_t prefix,
     size_t len, ngx_str_t *replacement)
 {
     u_char  *p, *data;
     size_t   new_len;
 
-    new_len = replacement->len + h->value.len - len;
+    if (len == value->len) {
+        *value = *replacement;
+        return NGX_OK;
+    }
+
+    new_len = replacement->len + value->len - len;
 
     if (replacement->len > len) {
 
@@ -2719,23 +3238,22 @@ ngx_http_proxy_rewrite(ngx_http_request_t *r, ngx_table_elt_t *h, size_t prefix,
             return NGX_ERROR;
         }
 
-        p = ngx_copy(data, h->value.data, prefix);
+        p = ngx_copy(data, value->data, prefix);
         p = ngx_copy(p, replacement->data, replacement->len);
 
-        ngx_memcpy(p, h->value.data + prefix + len,
-                   h->value.len - len - prefix + 1);
+        ngx_memcpy(p, value->data + prefix + len,
+                   value->len - len - prefix + 1);
 
-        h->value.data = data;
+        value->data = data;
 
     } else {
-        p = ngx_copy(h->value.data + prefix, replacement->data,
-                     replacement->len);
+        p = ngx_copy(value->data + prefix, replacement->data, replacement->len);
 
-        ngx_memmove(p, h->value.data + prefix + len,
-                    h->value.len - len - prefix + 1);
+        ngx_memmove(p, value->data + prefix + len,
+                    value->len - len - prefix + 1);
     }
 
-    h->value.len = new_len;
+    value->len = new_len;
 
     return NGX_OK;
 }
@@ -2806,12 +3324,9 @@ ngx_http_proxy_create_loc_conf(ngx_conf_t *cf)
      *     conf->upstream.hide_headers_hash = { NULL, 0 };
      *     conf->upstream.store_lengths = NULL;
      *     conf->upstream.store_values = NULL;
-     *     conf->upstream.ssl_name = NULL;
      *
-     *     conf->method = NULL;
      *     conf->location = NULL;
      *     conf->url = { 0, NULL };
-     *     conf->headers_source = NULL;
      *     conf->headers.lengths = NULL;
      *     conf->headers.values = NULL;
      *     conf->headers.hash = { NULL, 0 };
@@ -2827,8 +3342,6 @@ ngx_http_proxy_create_loc_conf(ngx_conf_t *cf)
      *     conf->ssl_ciphers = { 0, NULL };
      *     conf->ssl_trusted_certificate = { 0, NULL };
      *     conf->ssl_crl = { 0, NULL };
-     *     conf->ssl_certificate = { 0, NULL };
-     *     conf->ssl_certificate_key = { 0, NULL };
      */
 
     conf->upstream.store = NGX_CONF_UNSET;
@@ -2880,20 +3393,30 @@ ngx_http_proxy_create_loc_conf(ngx_conf_t *cf)
 
 #if (NGX_HTTP_SSL)
     conf->upstream.ssl_session_reuse = NGX_CONF_UNSET;
+    conf->upstream.ssl_name = NGX_CONF_UNSET_PTR;
     conf->upstream.ssl_server_name = NGX_CONF_UNSET;
     conf->upstream.ssl_verify = NGX_CONF_UNSET;
+    conf->upstream.ssl_certificate = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_certificate_key = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_passwords = NGX_CONF_UNSET_PTR;
     conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
-    conf->ssl_passwords = NGX_CONF_UNSET_PTR;
+    conf->ssl_conf_commands = NGX_CONF_UNSET_PTR;
 #endif
 
     /* "proxy_cyclic_temp_file" is disabled */
     conf->upstream.cyclic_temp_file = 0;
 
-    conf->redirect = NGX_CONF_UNSET;
     conf->upstream.change_buffering = 1;
 
+    conf->headers_source = NGX_CONF_UNSET_PTR;
+
+    conf->method = NGX_CONF_UNSET_PTR;
+
+    conf->redirect = NGX_CONF_UNSET;
+
     conf->cookie_domains = NGX_CONF_UNSET_PTR;
     conf->cookie_paths = NGX_CONF_UNSET_PTR;
+    conf->cookie_flags = NGX_CONF_UNSET_PTR;
 
     conf->http_version = NGX_CONF_UNSET_UINT;
 
@@ -3184,10 +3707,6 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 
 #endif
 
-    if (conf->method == NULL) {
-        conf->method = prev->method;
-    }
-
     ngx_conf_merge_value(conf->upstream.pass_request_headers,
                               prev->upstream.pass_request_headers, 1);
     ngx_conf_merge_value(conf->upstream.pass_request_body,
@@ -3208,10 +3727,8 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers,
                              "DEFAULT");
 
-    if (conf->upstream.ssl_name == NULL) {
-        conf->upstream.ssl_name = prev->upstream.ssl_name;
-    }
-
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_name,
+                              prev->upstream.ssl_name, NULL);
     ngx_conf_merge_value(conf->upstream.ssl_server_name,
                               prev->upstream.ssl_server_name, 0);
     ngx_conf_merge_value(conf->upstream.ssl_verify,
@@ -3222,11 +3739,15 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
                               prev->ssl_trusted_certificate, "");
     ngx_conf_merge_str_value(conf->ssl_crl, prev->ssl_crl, "");
 
-    ngx_conf_merge_str_value(conf->ssl_certificate,
-                              prev->ssl_certificate, "");
-    ngx_conf_merge_str_value(conf->ssl_certificate_key,
-                              prev->ssl_certificate_key, "");
-    ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_certificate,
+                              prev->upstream.ssl_certificate, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_certificate_key,
+                              prev->upstream.ssl_certificate_key, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_passwords,
+                              prev->upstream.ssl_passwords, NULL);
+
+    ngx_conf_merge_ptr_value(conf->ssl_conf_commands,
+                              prev->ssl_conf_commands, NULL);
 
     if (conf->ssl && ngx_http_proxy_set_ssl(cf, conf) != NGX_OK) {
         return NGX_CONF_ERROR;
@@ -3234,6 +3755,8 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 
 #endif
 
+    ngx_conf_merge_ptr_value(conf->method, prev->method, NULL);
+
     ngx_conf_merge_value(conf->redirect, prev->redirect, 1);
 
     if (conf->redirect) {
@@ -3289,6 +3812,8 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_ptr_value(conf->cookie_paths, prev->cookie_paths, NULL);
 
+    ngx_conf_merge_ptr_value(conf->cookie_flags, prev->cookie_flags, NULL);
+
     ngx_conf_merge_uint_value(conf->http_version, prev->http_version,
                               NGX_HTTP_VERSION_10);
 
@@ -3359,12 +3884,13 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
         }
     }
 
-    if (conf->headers_source == NULL) {
+    ngx_conf_merge_ptr_value(conf->headers_source, prev->headers_source, NULL);
+
+    if (conf->headers_source == prev->headers_source) {
         conf->headers = prev->headers;
 #if (NGX_HTTP_CACHE)
         conf->headers_cache = prev->headers_cache;
 #endif
-        conf->headers_source = prev->headers_source;
     }
 
     rc = ngx_http_proxy_init_headers(cf, conf, &conf->headers,
@@ -3703,7 +4229,7 @@ ngx_http_proxy_redirect(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     ngx_http_compile_complex_value_t   ccv;
 
     if (plcf->redirect == 0) {
-        return NGX_CONF_OK;
+        return "is duplicate";
     }
 
     plcf->redirect = 1;
@@ -3712,16 +4238,12 @@ ngx_http_proxy_redirect(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     if (cf->args->nelts == 2) {
         if (ngx_strcmp(value[1].data, "off") == 0) {
-            plcf->redirect = 0;
-            plcf->redirects = NULL;
-            return NGX_CONF_OK;
-        }
 
-        if (ngx_strcmp(value[1].data, "false") == 0) {
-            ngx_conf_log_error(NGX_LOG_ERR, cf, 0,
-                           "invalid parameter \"false\", use \"off\" instead");
+            if (plcf->redirects) {
+                return "is duplicate";
+            }
+
             plcf->redirect = 0;
-            plcf->redirects = NULL;
             return NGX_CONF_OK;
         }
 
@@ -3745,7 +4267,9 @@ ngx_http_proxy_redirect(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
         return NGX_CONF_ERROR;
     }
 
-    if (ngx_strcmp(value[1].data, "default") == 0) {
+    if (cf->args->nelts == 2
+        && ngx_strcmp(value[1].data, "default") == 0)
+    {
         if (plcf->proxy_lengths) {
             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                "\"proxy_redirect default\" cannot be used "
@@ -3848,7 +4372,7 @@ ngx_http_proxy_cookie_domain(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     ngx_http_compile_complex_value_t   ccv;
 
     if (plcf->cookie_domains == NULL) {
-        return NGX_CONF_OK;
+        return "is duplicate";
     }
 
     value = cf->args->elts;
@@ -3856,6 +4380,11 @@ ngx_http_proxy_cookie_domain(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     if (cf->args->nelts == 2) {
 
         if (ngx_strcmp(value[1].data, "off") == 0) {
+
+            if (plcf->cookie_domains != NGX_CONF_UNSET_PTR) {
+                return "is duplicate";
+            }
+
             plcf->cookie_domains = NULL;
             return NGX_CONF_OK;
         }
@@ -3935,7 +4464,7 @@ ngx_http_proxy_cookie_path(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     ngx_http_compile_complex_value_t   ccv;
 
     if (plcf->cookie_paths == NULL) {
-        return NGX_CONF_OK;
+        return "is duplicate";
     }
 
     value = cf->args->elts;
@@ -3943,6 +4472,11 @@ ngx_http_proxy_cookie_path(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     if (cf->args->nelts == 2) {
 
         if (ngx_strcmp(value[1].data, "off") == 0) {
+
+            if (plcf->cookie_paths != NGX_CONF_UNSET_PTR) {
+                return "is duplicate";
+            }
+
             plcf->cookie_paths = NULL;
             return NGX_CONF_OK;
         }
@@ -4012,6 +4546,126 @@ ngx_http_proxy_cookie_path(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static char *
+ngx_http_proxy_cookie_flags(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+    ngx_http_proxy_loc_conf_t *plcf = conf;
+
+    ngx_str_t                         *value;
+    ngx_uint_t                         i;
+    ngx_http_complex_value_t          *cv;
+    ngx_http_proxy_cookie_flags_t     *pcf;
+    ngx_http_compile_complex_value_t   ccv;
+#if (NGX_PCRE)
+    ngx_regex_compile_t                rc;
+    u_char                             errstr[NGX_MAX_CONF_ERRSTR];
+#endif
+
+    if (plcf->cookie_flags == NULL) {
+        return "is duplicate";
+    }
+
+    value = cf->args->elts;
+
+    if (cf->args->nelts == 2) {
+
+        if (ngx_strcmp(value[1].data, "off") == 0) {
+
+            if (plcf->cookie_flags != NGX_CONF_UNSET_PTR) {
+                return "is duplicate";
+            }
+
+            plcf->cookie_flags = NULL;
+            return NGX_CONF_OK;
+        }
+
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "invalid parameter \"%V\"", &value[1]);
+        return NGX_CONF_ERROR;
+    }
+
+    if (plcf->cookie_flags == NGX_CONF_UNSET_PTR) {
+        plcf->cookie_flags = ngx_array_create(cf->pool, 1,
+                                        sizeof(ngx_http_proxy_cookie_flags_t));
+        if (plcf->cookie_flags == NULL) {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+    pcf = ngx_array_push(plcf->cookie_flags);
+    if (pcf == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    pcf->regex = 0;
+
+    if (value[1].data[0] == '~') {
+        value[1].len--;
+        value[1].data++;
+
+#if (NGX_PCRE)
+        ngx_memzero(&rc, sizeof(ngx_regex_compile_t));
+
+        rc.pattern = value[1];
+        rc.err.len = NGX_MAX_CONF_ERRSTR;
+        rc.err.data = errstr;
+        rc.options = NGX_REGEX_CASELESS;
+
+        pcf->cookie.regex = ngx_http_regex_compile(cf, &rc);
+        if (pcf->cookie.regex == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        pcf->regex = 1;
+#else
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "using regex \"%V\" requires PCRE library",
+                           &value[1]);
+        return NGX_CONF_ERROR;
+#endif
+
+    } else {
+
+        ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
+
+        ccv.cf = cf;
+        ccv.value = &value[1];
+        ccv.complex_value = &pcf->cookie.complex;
+
+        if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+    if (ngx_array_init(&pcf->flags_values, cf->pool, cf->args->nelts - 2,
+                       sizeof(ngx_http_complex_value_t))
+        != NGX_OK)
+    {
+        return NGX_CONF_ERROR;
+    }
+
+    for (i = 2; i < cf->args->nelts; i++) {
+
+        cv = ngx_array_push(&pcf->flags_values);
+        if (cv == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
+
+        ccv.cf = cf;
+        ccv.value = &value[i];
+        ccv.complex_value = cv;
+
+        if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+    return NGX_CONF_OK;
+}
+
+
 static ngx_int_t
 ngx_http_proxy_rewrite_regex(ngx_conf_t *cf, ngx_http_proxy_rewrite_t *pr,
     ngx_str_t *regex, ngx_uint_t caseless)
@@ -4201,15 +4855,15 @@ ngx_http_proxy_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     ngx_str_t  *value;
 
-    if (plcf->ssl_passwords != NGX_CONF_UNSET_PTR) {
+    if (plcf->upstream.ssl_passwords != NGX_CONF_UNSET_PTR) {
         return "is duplicate";
     }
 
     value = cf->args->elts;
 
-    plcf->ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]);
+    plcf->upstream.ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]);
 
-    if (plcf->ssl_passwords == NULL) {
+    if (plcf->upstream.ssl_passwords == NULL) {
         return NGX_CONF_ERROR;
     }
 
@@ -4250,6 +4904,17 @@ ngx_http_proxy_lowat_check(ngx_conf_t *cf, void *post, void *data)
 
 #if (NGX_HTTP_SSL)
 
+static char *
+ngx_http_proxy_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
+{
+#ifndef SSL_CONF_FLAG_FILE
+    return "is not supported on this platform";
+#else
+    return NGX_CONF_OK;
+#endif
+}
+
+
 static ngx_int_t
 ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)
 {
@@ -4277,20 +4942,34 @@ ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)
     cln->handler = ngx_ssl_cleanup_ctx;
     cln->data = plcf->upstream.ssl;
 
-    if (plcf->ssl_certificate.len) {
+    if (plcf->upstream.ssl_certificate) {
 
-        if (plcf->ssl_certificate_key.len == 0) {
+        if (plcf->upstream.ssl_certificate_key == NULL) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
                           "no \"proxy_ssl_certificate_key\" is defined "
-                          "for certificate \"%V\"", &plcf->ssl_certificate);
+                          "for certificate \"%V\"",
+                          &plcf->upstream.ssl_certificate->value);
             return NGX_ERROR;
         }
 
-        if (ngx_ssl_certificate(cf, plcf->upstream.ssl, &plcf->ssl_certificate,
-                                &plcf->ssl_certificate_key, plcf->ssl_passwords)
-            != NGX_OK)
+        if (plcf->upstream.ssl_certificate->lengths
+            || plcf->upstream.ssl_certificate_key->lengths)
         {
-            return NGX_ERROR;
+            plcf->upstream.ssl_passwords =
+                  ngx_ssl_preserve_passwords(cf, plcf->upstream.ssl_passwords);
+            if (plcf->upstream.ssl_passwords == NULL) {
+                return NGX_ERROR;
+            }
+
+        } else {
+            if (ngx_ssl_certificate(cf, plcf->upstream.ssl,
+                                    &plcf->upstream.ssl_certificate->value,
+                                    &plcf->upstream.ssl_certificate_key->value,
+                                    plcf->upstream.ssl_passwords)
+                != NGX_OK)
+            {
+                return NGX_ERROR;
+            }
         }
     }
 
@@ -4327,6 +5006,12 @@ ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)
         return NGX_ERROR;
     }
 
+    if (ngx_ssl_conf_commands(cf, plcf->upstream.ssl, plcf->ssl_conf_commands)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
     return NGX_OK;
 }
 
diff --git a/src/http/modules/ngx_http_range_filter_module.c b/src/http/modules/ngx_http_range_filter_module.c
index 819c5c94..ae08ebbc 100644
--- a/src/http/modules/ngx_http_range_filter_module.c
+++ b/src/http/modules/ngx_http_range_filter_module.c
@@ -700,8 +700,9 @@ ngx_http_range_singlepart_body(ngx_http_request_t *r,
     ngx_http_range_filter_ctx_t *ctx, ngx_chain_t *in)
 {
     off_t              start, last;
+    ngx_int_t          rc;
     ngx_buf_t         *buf;
-    ngx_chain_t       *out, *cl, **ll;
+    ngx_chain_t       *out, *cl, *tl, **ll;
     ngx_http_range_t  *range;
 
     out = NULL;
@@ -721,8 +722,22 @@ ngx_http_range_singlepart_body(ngx_http_request_t *r,
                        "http range body buf: %O-%O", start, last);
 
         if (ngx_buf_special(buf)) {
-            *ll = cl;
-            ll = &cl->next;
+
+            if (range->end <= start) {
+                continue;
+            }
+
+            tl = ngx_alloc_chain_link(r->pool);
+            if (tl == NULL) {
+                return NGX_ERROR;
+            }
+
+            tl->buf = buf;
+            tl->next = NULL;
+
+            *ll = tl;
+            ll = &tl->next;
+
             continue;
         }
 
@@ -764,21 +779,42 @@ ngx_http_range_singlepart_body(ngx_http_request_t *r,
 
             buf->last_buf = (r == r->main) ? 1 : 0;
             buf->last_in_chain = 1;
-            *ll = cl;
-            cl->next = NULL;
 
-            break;
+            tl = ngx_alloc_chain_link(r->pool);
+            if (tl == NULL) {
+                return NGX_ERROR;
+            }
+
+            tl->buf = buf;
+            tl->next = NULL;
+
+            *ll = tl;
+            ll = &tl->next;
+
+            continue;
+        }
+
+        tl = ngx_alloc_chain_link(r->pool);
+        if (tl == NULL) {
+            return NGX_ERROR;
         }
 
-        *ll = cl;
-        ll = &cl->next;
+        tl->buf = buf;
+        tl->next = NULL;
+
+        *ll = tl;
+        ll = &tl->next;
     }
 
-    if (out == NULL) {
-        return NGX_OK;
+    rc = ngx_http_next_body_filter(r, out);
+
+    while (out) {
+        cl = out;
+        out = out->next;
+        ngx_free_chain(r->pool, cl);
     }
 
-    return ngx_http_next_body_filter(r, out);
+    return rc;
 }
 
 
diff --git a/src/http/modules/ngx_http_realip_module.c b/src/http/modules/ngx_http_realip_module.c
index 7d3f2a91..9586ebe0 100644
--- a/src/http/modules/ngx_http_realip_module.c
+++ b/src/http/modules/ngx_http_realip_module.c
@@ -180,12 +180,11 @@ ngx_http_realip_handler(ngx_http_request_t *r)
 
     case NGX_HTTP_REALIP_PROXY:
 
-        value = &r->connection->proxy_protocol_addr;
-
-        if (value->len == 0) {
+        if (r->connection->proxy_protocol == NULL) {
             return NGX_DECLINED;
         }
 
+        value = &r->connection->proxy_protocol->src_addr;
         xfwd = NULL;
 
         break;
@@ -238,7 +237,7 @@ ngx_http_realip_handler(ngx_http_request_t *r)
         != NGX_DECLINED)
     {
         if (rlcf->type == NGX_HTTP_REALIP_PROXY) {
-            ngx_inet_set_port(addr.sockaddr, c->proxy_protocol_port);
+            ngx_inet_set_port(addr.sockaddr, c->proxy_protocol->src_port);
         }
 
         return ngx_http_realip_set_addr(r, &addr);
diff --git a/src/http/modules/ngx_http_rewrite_module.c b/src/http/modules/ngx_http_rewrite_module.c
index 3b49c455..0e6d4df6 100644
--- a/src/http/modules/ngx_http_rewrite_module.c
+++ b/src/http/modules/ngx_http_rewrite_module.c
@@ -318,6 +318,11 @@ ngx_http_rewrite(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     value = cf->args->elts;
 
+    if (value[2].len == 0) {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "empty replacement");
+        return NGX_CONF_ERROR;
+    }
+
     ngx_memzero(&rc, sizeof(ngx_regex_compile_t));
 
     rc.pattern = value[1];
diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c
index 7216f781..600999c8 100644
--- a/src/http/modules/ngx_http_scgi_module.c
+++ b/src/http/modules/ngx_http_scgi_module.c
@@ -49,6 +49,7 @@ static ngx_int_t ngx_http_scgi_create_request(ngx_http_request_t *r);
 static ngx_int_t ngx_http_scgi_reinit_request(ngx_http_request_t *r);
 static ngx_int_t ngx_http_scgi_process_status_line(ngx_http_request_t *r);
 static ngx_int_t ngx_http_scgi_process_header(ngx_http_request_t *r);
+static ngx_int_t ngx_http_scgi_input_filter_init(void *data);
 static void ngx_http_scgi_abort_request(ngx_http_request_t *r);
 static void ngx_http_scgi_finalize_request(ngx_http_request_t *r, ngx_int_t rc);
 
@@ -534,6 +535,10 @@ ngx_http_scgi_handler(ngx_http_request_t *r)
     u->pipe->input_filter = ngx_event_pipe_copy_input_filter;
     u->pipe->input_ctx = r;
 
+    u->input_filter_init = ngx_http_scgi_input_filter_init;
+    u->input_filter = ngx_http_upstream_non_buffered_filter;
+    u->input_filter_ctx = r;
+
     if (!scf->upstream.request_buffering
         && scf->upstream.pass_request_body
         && !r->headers_in.chunked)
@@ -1145,6 +1150,37 @@ ngx_http_scgi_process_header(ngx_http_request_t *r)
 }
 
 
+static ngx_int_t
+ngx_http_scgi_input_filter_init(void *data)
+{
+    ngx_http_request_t   *r = data;
+    ngx_http_upstream_t  *u;
+
+    u = r->upstream;
+
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   "http scgi filter init s:%ui l:%O",
+                   u->headers_in.status_n, u->headers_in.content_length_n);
+
+    if (u->headers_in.status_n == NGX_HTTP_NO_CONTENT
+        || u->headers_in.status_n == NGX_HTTP_NOT_MODIFIED)
+    {
+        u->pipe->length = 0;
+        u->length = 0;
+
+    } else if (r->method == NGX_HTTP_HEAD) {
+        u->pipe->length = -1;
+        u->length = -1;
+
+    } else {
+        u->pipe->length = u->headers_in.content_length_n;
+        u->length = u->headers_in.content_length_n;
+    }
+
+    return NGX_OK;
+}
+
+
 static void
 ngx_http_scgi_abort_request(ngx_http_request_t *r)
 {
diff --git a/src/http/modules/ngx_http_secure_link_module.c b/src/http/modules/ngx_http_secure_link_module.c
index 536e09a7..4d4ce6af 100644
--- a/src/http/modules/ngx_http_secure_link_module.c
+++ b/src/http/modules/ngx_http_secure_link_module.c
@@ -302,11 +302,12 @@ ngx_http_secure_link_create_conf(ngx_conf_t *cf)
     /*
      * set by ngx_pcalloc():
      *
-     *     conf->variable = NULL;
-     *     conf->md5 = NULL;
      *     conf->secret = { 0, NULL };
      */
 
+    conf->variable = NGX_CONF_UNSET_PTR;
+    conf->md5 = NGX_CONF_UNSET_PTR;
+
     return conf;
 }
 
@@ -318,6 +319,9 @@ ngx_http_secure_link_merge_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_http_secure_link_conf_t *conf = child;
 
     if (conf->secret.data) {
+        ngx_conf_init_ptr_value(conf->variable, NULL);
+        ngx_conf_init_ptr_value(conf->md5, NULL);
+
         if (conf->variable || conf->md5) {
             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                "\"secure_link_secret\" cannot be mixed with "
@@ -328,13 +332,8 @@ ngx_http_secure_link_merge_conf(ngx_conf_t *cf, void *parent, void *child)
         return NGX_CONF_OK;
     }
 
-    if (conf->variable == NULL) {
-        conf->variable = prev->variable;
-    }
-
-    if (conf->md5 == NULL) {
-        conf->md5 = prev->md5;
-    }
+    ngx_conf_merge_ptr_value(conf->variable, prev->variable, NULL);
+    ngx_conf_merge_ptr_value(conf->md5, prev->md5, NULL);
 
     if (conf->variable == NULL && conf->md5 == NULL) {
         conf->secret = prev->secret;
diff --git a/src/http/modules/ngx_http_slice_filter_module.c b/src/http/modules/ngx_http_slice_filter_module.c
index c1edbca2..186380a2 100644
--- a/src/http/modules/ngx_http_slice_filter_module.c
+++ b/src/http/modules/ngx_http_slice_filter_module.c
@@ -180,6 +180,11 @@ ngx_http_slice_header_filter(ngx_http_request_t *r)
     r->headers_out.content_range->hash = 0;
     r->headers_out.content_range = NULL;
 
+    if (r->headers_out.accept_ranges) {
+        r->headers_out.accept_ranges->hash = 0;
+        r->headers_out.accept_ranges = NULL;
+    }
+
     r->allow_ranges = 1;
     r->subrequest_ranges = 1;
     r->single_range = 1;
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
index d608df9d..6737965d 100644
--- a/src/http/modules/ngx_http_ssi_filter_module.c
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
@@ -1254,9 +1254,9 @@ ngx_http_ssi_parse(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx)
             case '-':
                 state = ssi_error_end0_state;
 
-                ctx->param->key.data[ctx->param->key.len++] = ch;
                 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
-                              "invalid \"%V\" parameter in \"%V\" SSI command",
+                              "unexpected \"-\" symbol after \"%V\" "
+                              "parameter in \"%V\" SSI command",
                               &ctx->param->key, &ctx->command);
                 break;
 
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index b3f8f479..a47d6963 100644
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -50,6 +50,11 @@ static char *ngx_http_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+static char *ngx_http_ssl_ocsp_cache(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+
+static char *ngx_http_ssl_conf_command_check(ngx_conf_t *cf, void *post,
+    void *data);
 
 static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf);
 
@@ -74,11 +79,23 @@ static ngx_conf_enum_t  ngx_http_ssl_verify[] = {
 };
 
 
+static ngx_conf_enum_t  ngx_http_ssl_ocsp[] = {
+    { ngx_string("off"), 0 },
+    { ngx_string("on"), 1 },
+    { ngx_string("leaf"), 2 },
+    { ngx_null_string, 0 }
+};
+
+
 static ngx_conf_deprecated_t  ngx_http_ssl_deprecated = {
     ngx_conf_deprecated, "ssl", "listen ... ssl"
 };
 
 
+static ngx_conf_post_t  ngx_http_ssl_conf_command_post =
+    { ngx_http_ssl_conf_command_check };
+
+
 static ngx_command_t  ngx_http_ssl_commands[] = {
 
     { ngx_string("ssl"),
@@ -214,6 +231,27 @@ static ngx_command_t  ngx_http_ssl_commands[] = {
       offsetof(ngx_http_ssl_srv_conf_t, crl),
       NULL },
 
+    { ngx_string("ssl_ocsp"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_enum_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_ssl_srv_conf_t, ocsp),
+      &ngx_http_ssl_ocsp },
+
+    { ngx_string("ssl_ocsp_responder"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_str_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_ssl_srv_conf_t, ocsp_responder),
+      NULL },
+
+    { ngx_string("ssl_ocsp_cache"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
+      ngx_http_ssl_ocsp_cache,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      0,
+      NULL },
+
     { ngx_string("ssl_stapling"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
       ngx_conf_set_flag_slot,
@@ -249,6 +287,20 @@ static ngx_command_t  ngx_http_ssl_commands[] = {
       offsetof(ngx_http_ssl_srv_conf_t, early_data),
       NULL },
 
+    { ngx_string("ssl_conf_command"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE2,
+      ngx_conf_set_keyval_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_ssl_srv_conf_t, conf_commands),
+      &ngx_http_ssl_conf_command_post },
+
+    { ngx_string("ssl_reject_handshake"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
+      NULL },
+
       ngx_null_command
 };
 
@@ -561,6 +613,7 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
      *     sscf->crl = { 0, NULL };
      *     sscf->ciphers = { 0, NULL };
      *     sscf->shm_zone = NULL;
+     *     sscf->ocsp_responder = { 0, NULL };
      *     sscf->stapling_file = { 0, NULL };
      *     sscf->stapling_responder = { 0, NULL };
      */
@@ -568,16 +621,20 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
     sscf->enable = NGX_CONF_UNSET;
     sscf->prefer_server_ciphers = NGX_CONF_UNSET;
     sscf->early_data = NGX_CONF_UNSET;
+    sscf->reject_handshake = NGX_CONF_UNSET;
     sscf->buffer_size = NGX_CONF_UNSET_SIZE;
     sscf->verify = NGX_CONF_UNSET_UINT;
     sscf->verify_depth = NGX_CONF_UNSET_UINT;
     sscf->certificates = NGX_CONF_UNSET_PTR;
     sscf->certificate_keys = NGX_CONF_UNSET_PTR;
     sscf->passwords = NGX_CONF_UNSET_PTR;
+    sscf->conf_commands = NGX_CONF_UNSET_PTR;
     sscf->builtin_session_cache = NGX_CONF_UNSET;
     sscf->session_timeout = NGX_CONF_UNSET;
     sscf->session_tickets = NGX_CONF_UNSET;
     sscf->session_ticket_keys = NGX_CONF_UNSET_PTR;
+    sscf->ocsp = NGX_CONF_UNSET_UINT;
+    sscf->ocsp_cache_zone = NGX_CONF_UNSET_PTR;
     sscf->stapling = NGX_CONF_UNSET;
     sscf->stapling_verify = NGX_CONF_UNSET;
 
@@ -611,6 +668,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
                          prev->prefer_server_ciphers, 0);
 
     ngx_conf_merge_value(conf->early_data, prev->early_data, 0);
+    ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
 
     ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
                          (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
@@ -641,6 +699,13 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);
 
+    ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
+
+    ngx_conf_merge_uint_value(conf->ocsp, prev->ocsp, 0);
+    ngx_conf_merge_str_value(conf->ocsp_responder, prev->ocsp_responder, "");
+    ngx_conf_merge_ptr_value(conf->ocsp_cache_zone,
+                         prev->ocsp_cache_zone, NULL);
+
     ngx_conf_merge_value(conf->stapling, prev->stapling, 0);
     ngx_conf_merge_value(conf->stapling_verify, prev->stapling_verify, 0);
     ngx_conf_merge_str_value(conf->stapling_file, prev->stapling_file, "");
@@ -651,38 +716,35 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
 
     if (conf->enable) {
 
-        if (conf->certificates == NULL) {
-            ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
-                          "no \"ssl_certificate\" is defined for "
-                          "the \"ssl\" directive in %s:%ui",
-                          conf->file, conf->line);
-            return NGX_CONF_ERROR;
-        }
+        if (conf->certificates) {
+            if (conf->certificate_keys == NULL) {
+                ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+                              "no \"ssl_certificate_key\" is defined for "
+                              "the \"ssl\" directive in %s:%ui",
+                              conf->file, conf->line);
+                return NGX_CONF_ERROR;
+            }
 
-        if (conf->certificate_keys == NULL) {
-            ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
-                          "no \"ssl_certificate_key\" is defined for "
-                          "the \"ssl\" directive in %s:%ui",
-                          conf->file, conf->line);
-            return NGX_CONF_ERROR;
-        }
+            if (conf->certificate_keys->nelts < conf->certificates->nelts) {
+                ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+                              "no \"ssl_certificate_key\" is defined "
+                              "for certificate \"%V\" and "
+                              "the \"ssl\" directive in %s:%ui",
+                              ((ngx_str_t *) conf->certificates->elts)
+                              + conf->certificates->nelts - 1,
+                              conf->file, conf->line);
+                return NGX_CONF_ERROR;
+            }
 
-        if (conf->certificate_keys->nelts < conf->certificates->nelts) {
+        } else if (!conf->reject_handshake) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
-                          "no \"ssl_certificate_key\" is defined "
-                          "for certificate \"%V\" and "
+                          "no \"ssl_certificate\" is defined for "
                           "the \"ssl\" directive in %s:%ui",
-                          ((ngx_str_t *) conf->certificates->elts)
-                          + conf->certificates->nelts - 1,
                           conf->file, conf->line);
             return NGX_CONF_ERROR;
         }
 
-    } else {
-
-        if (conf->certificates == NULL) {
-            return NGX_CONF_OK;
-        }
+    } else if (conf->certificates) {
 
         if (conf->certificate_keys == NULL
             || conf->certificate_keys->nelts < conf->certificates->nelts)
@@ -694,6 +756,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
                           + conf->certificates->nelts - 1);
             return NGX_CONF_ERROR;
         }
+
+    } else if (!conf->reject_handshake) {
+        return NGX_CONF_OK;
     }
 
     if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) {
@@ -752,7 +817,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
         return NGX_CONF_ERROR;
 #endif
 
-    } else {
+    } else if (conf->certificates) {
 
         /* configure certificates */
 
@@ -777,7 +842,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
 
         if (conf->client_certificate.len == 0 && conf->verify != 3) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
-                          "no ssl_client_certificate for ssl_client_verify");
+                          "no ssl_client_certificate for ssl_verify_client");
             return NGX_CONF_ERROR;
         }
 
@@ -802,6 +867,23 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
         return NGX_CONF_ERROR;
     }
 
+    if (conf->ocsp) {
+
+        if (conf->verify == 3) {
+            ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+                          "\"ssl_ocsp\" is incompatible with "
+                          "\"ssl_verify_client optional_no_ca\"");
+            return NGX_CONF_ERROR;
+        }
+
+        if (ngx_ssl_ocsp(cf, &conf->ssl, &conf->ocsp_responder, conf->ocsp,
+                         conf->ocsp_cache_zone)
+            != NGX_OK)
+        {
+            return NGX_CONF_ERROR;
+        }
+    }
+
     if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) {
         return NGX_CONF_ERROR;
     }
@@ -857,6 +939,10 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
         return NGX_CONF_ERROR;
     }
 
+    if (ngx_ssl_conf_commands(cf, &conf->ssl, conf->conf_commands) != NGX_OK) {
+        return NGX_CONF_ERROR;
+    }
+
     return NGX_CONF_OK;
 }
 
@@ -870,6 +956,10 @@ ngx_http_ssl_compile_certificates(ngx_conf_t *cf,
     ngx_http_complex_value_t          *cv;
     ngx_http_compile_complex_value_t   ccv;
 
+    if (conf->certificates == NULL) {
+        return NGX_OK;
+    }
+
     cert = conf->certificates->elts;
     key = conf->certificate_keys->elts;
     nelts = conf->certificates->nelts;
@@ -1100,6 +1190,96 @@ ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static char *
+ngx_http_ssl_ocsp_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+    ngx_http_ssl_srv_conf_t *sscf = conf;
+
+    size_t       len;
+    ngx_int_t    n;
+    ngx_str_t   *value, name, size;
+    ngx_uint_t   j;
+
+    if (sscf->ocsp_cache_zone != NGX_CONF_UNSET_PTR) {
+        return "is duplicate";
+    }
+
+    value = cf->args->elts;
+
+    if (ngx_strcmp(value[1].data, "off") == 0) {
+        sscf->ocsp_cache_zone = NULL;
+        return NGX_CONF_OK;
+    }
+
+    if (value[1].len <= sizeof("shared:") - 1
+        || ngx_strncmp(value[1].data, "shared:", sizeof("shared:") - 1) != 0)
+    {
+        goto invalid;
+    }
+
+    len = 0;
+
+    for (j = sizeof("shared:") - 1; j < value[1].len; j++) {
+        if (value[1].data[j] == ':') {
+            break;
+        }
+
+        len++;
+    }
+
+    if (len == 0) {
+        goto invalid;
+    }
+
+    name.len = len;
+    name.data = value[1].data + sizeof("shared:") - 1;
+
+    size.len = value[1].len - j - 1;
+    size.data = name.data + len + 1;
+
+    n = ngx_parse_size(&size);
+
+    if (n == NGX_ERROR) {
+        goto invalid;
+    }
+
+    if (n < (ngx_int_t) (8 * ngx_pagesize)) {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "OCSP cache \"%V\" is too small", &value[1]);
+
+        return NGX_CONF_ERROR;
+    }
+
+    sscf->ocsp_cache_zone = ngx_shared_memory_add(cf, &name, n,
+                                                  &ngx_http_ssl_module_ctx);
+    if (sscf->ocsp_cache_zone == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    sscf->ocsp_cache_zone->init = ngx_ssl_ocsp_cache_init;
+
+    return NGX_CONF_OK;
+
+invalid:
+
+    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                       "invalid OCSP cache \"%V\"", &value[1]);
+
+    return NGX_CONF_ERROR;
+}
+
+
+static char *
+ngx_http_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
+{
+#ifndef SSL_CONF_FLAG_FILE
+    return "is not supported on this platform";
+#else
+    return NGX_CONF_OK;
+#endif
+}
+
+
 static ngx_int_t
 ngx_http_ssl_init(ngx_conf_t *cf)
 {
@@ -1118,17 +1298,28 @@ ngx_http_ssl_init(ngx_conf_t *cf)
 
         sscf = cscfp[s]->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
 
-        if (sscf->ssl.ctx == NULL || !sscf->stapling) {
+        if (sscf->ssl.ctx == NULL) {
             continue;
         }
 
         clcf = cscfp[s]->ctx->loc_conf[ngx_http_core_module.ctx_index];
 
-        if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver,
+        if (sscf->stapling) {
+            if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver,
+                                          clcf->resolver_timeout)
+                != NGX_OK)
+            {
+                return NGX_ERROR;
+            }
+        }
+
+        if (sscf->ocsp) {
+            if (ngx_ssl_ocsp_resolver(cf, &sscf->ssl, clcf->resolver,
                                       clcf->resolver_timeout)
-            != NGX_OK)
-        {
-            return NGX_ERROR;
+                != NGX_OK)
+            {
+                return NGX_ERROR;
+            }
         }
     }
 
@@ -1149,7 +1340,33 @@ ngx_http_ssl_init(ngx_conf_t *cf)
             cscf = addr[a].default_server;
             sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
 
-            if (sscf->certificates == NULL) {
+            if (sscf->certificates) {
+                continue;
+            }
+
+            if (!sscf->reject_handshake) {
+                ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+                              "no \"ssl_certificate\" is defined for "
+                              "the \"listen ... ssl\" directive in %s:%ui",
+                              cscf->file_name, cscf->line);
+                return NGX_ERROR;
+            }
+
+            /*
+             * if no certificates are defined in the default server,
+             * check all non-default server blocks
+             */
+
+            cscfp = addr[a].servers.elts;
+            for (s = 0; s < addr[a].servers.nelts; s++) {
+
+                cscf = cscfp[s];
+                sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
+
+                if (sscf->certificates || sscf->reject_handshake) {
+                    continue;
+                }
+
                 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
                               "no \"ssl_certificate\" is defined for "
                               "the \"listen ... ssl\" directive in %s:%ui",
diff --git a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h
index 26fdccfe..7ab0f7ea 100644
--- a/src/http/modules/ngx_http_ssl_module.h
+++ b/src/http/modules/ngx_http_ssl_module.h
@@ -21,6 +21,7 @@ typedef struct {
 
     ngx_flag_t                      prefer_server_ciphers;
     ngx_flag_t                      early_data;
+    ngx_flag_t                      reject_handshake;
 
     ngx_uint_t                      protocols;
 
@@ -48,12 +49,17 @@ typedef struct {
     ngx_str_t                       ciphers;
 
     ngx_array_t                    *passwords;
+    ngx_array_t                    *conf_commands;
 
     ngx_shm_zone_t                 *shm_zone;
 
     ngx_flag_t                      session_tickets;
     ngx_array_t                    *session_ticket_keys;
 
+    ngx_uint_t                      ocsp;
+    ngx_str_t                       ocsp_responder;
+    ngx_shm_zone_t                 *ocsp_cache_zone;
+
     ngx_flag_t                      stapling;
     ngx_flag_t                      stapling_verify;
     ngx_str_t                       stapling_file;
diff --git a/src/http/modules/ngx_http_static_module.c b/src/http/modules/ngx_http_static_module.c
index 0e16c05a..cf29d5a6 100644
--- a/src/http/modules/ngx_http_static_module.c
+++ b/src/http/modules/ngx_http_static_module.c
@@ -50,6 +50,7 @@ ngx_http_static_handler(ngx_http_request_t *r)
 {
     u_char                    *last, *location;
     size_t                     root, len;
+    uintptr_t                  escape;
     ngx_str_t                  path;
     ngx_int_t                  rc;
     ngx_uint_t                 level;
@@ -155,14 +156,18 @@ ngx_http_static_handler(ngx_http_request_t *r)
             return NGX_HTTP_INTERNAL_SERVER_ERROR;
         }
 
-        len = r->uri.len + 1;
+        escape = 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len,
+                                    NGX_ESCAPE_URI);
 
-        if (!clcf->alias && clcf->root_lengths == NULL && r->args.len == 0) {
-            location = path.data + clcf->root.len;
+        if (!clcf->alias && r->args.len == 0 && escape == 0) {
+            len = r->uri.len + 1;
+            location = path.data + root;
 
             *last = '/';
 
         } else {
+            len = r->uri.len + escape + 1;
+
             if (r->args.len) {
                 len += r->args.len + 1;
             }
@@ -173,7 +178,13 @@ ngx_http_static_handler(ngx_http_request_t *r)
                 return NGX_HTTP_INTERNAL_SERVER_ERROR;
             }
 
-            last = ngx_copy(location, r->uri.data, r->uri.len);
+            if (escape) {
+                last = (u_char *) ngx_escape_uri(location, r->uri.data,
+                                                 r->uri.len, NGX_ESCAPE_URI);
+
+            } else {
+                last = ngx_copy(location, r->uri.data, r->uri.len);
+            }
 
             *last = '/';
 
diff --git a/src/http/modules/ngx_http_stub_status_module.c b/src/http/modules/ngx_http_stub_status_module.c
index 9bdf8812..db68b768 100644
--- a/src/http/modules/ngx_http_stub_status_module.c
+++ b/src/http/modules/ngx_http_stub_status_module.c
@@ -103,16 +103,6 @@ ngx_http_stub_status_handler(ngx_http_request_t *r)
     ngx_str_set(&r->headers_out.content_type, "text/plain");
     r->headers_out.content_type_lowcase = NULL;
 
-    if (r->method == NGX_HTTP_HEAD) {
-        r->headers_out.status = NGX_HTTP_OK;
-
-        rc = ngx_http_send_header(r);
-
-        if (rc == NGX_ERROR || rc > NGX_OK || r->header_only) {
-            return rc;
-        }
-    }
-
     size = sizeof("Active connections:  \n") + NGX_ATOMIC_T_LEN
            + sizeof("server accepts handled requests\n") - 1
            + 6 + 3 * NGX_ATOMIC_T_LEN
diff --git a/src/http/modules/ngx_http_upstream_hash_module.c b/src/http/modules/ngx_http_upstream_hash_module.c
index 6c247b56..e741eb23 100644
--- a/src/http/modules/ngx_http_upstream_hash_module.c
+++ b/src/http/modules/ngx_http_upstream_hash_module.c
@@ -178,7 +178,7 @@ ngx_http_upstream_get_hash_peer(ngx_peer_connection_t *pc, void *data)
 
     ngx_http_upstream_rr_peers_rlock(hp->rrp.peers);
 
-    if (hp->tries > 20 || hp->rrp.peers->single) {
+    if (hp->tries > 20 || hp->rrp.peers->single || hp->key.len == 0) {
         ngx_http_upstream_rr_peers_unlock(hp->rrp.peers);
         return hp->get_rr_peer(pc, &hp->rrp);
     }
@@ -509,7 +509,7 @@ ngx_http_upstream_get_chash_peer(ngx_peer_connection_t *pc, void *data)
 
     ngx_http_upstream_rr_peers_wlock(hp->rrp.peers);
 
-    if (hp->tries > 20 || hp->rrp.peers->single) {
+    if (hp->tries > 20 || hp->rrp.peers->single || hp->key.len == 0) {
         ngx_http_upstream_rr_peers_unlock(hp->rrp.peers);
         return hp->get_rr_peer(pc, &hp->rrp);
     }
diff --git a/src/http/modules/ngx_http_upstream_keepalive_module.c b/src/http/modules/ngx_http_upstream_keepalive_module.c
index bdc4ae5c..1a4dfd77 100644
--- a/src/http/modules/ngx_http_upstream_keepalive_module.c
+++ b/src/http/modules/ngx_http_upstream_keepalive_module.c
@@ -13,6 +13,7 @@
 typedef struct {
     ngx_uint_t                         max_cached;
     ngx_uint_t                         requests;
+    ngx_msec_t                         time;
     ngx_msec_t                         timeout;
 
     ngx_queue_t                        cache;
@@ -86,6 +87,13 @@ static ngx_command_t  ngx_http_upstream_keepalive_commands[] = {
       0,
       NULL },
 
+    { ngx_string("keepalive_time"),
+      NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_msec_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_upstream_keepalive_srv_conf_t, time),
+      NULL },
+
     { ngx_string("keepalive_timeout"),
       NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1,
       ngx_conf_set_msec_slot,
@@ -149,8 +157,9 @@ ngx_http_upstream_init_keepalive(ngx_conf_t *cf,
     kcf = ngx_http_conf_upstream_srv_conf(us,
                                           ngx_http_upstream_keepalive_module);
 
+    ngx_conf_init_msec_value(kcf->time, 3600000);
     ngx_conf_init_msec_value(kcf->timeout, 60000);
-    ngx_conf_init_uint_value(kcf->requests, 100);
+    ngx_conf_init_uint_value(kcf->requests, 1000);
 
     if (kcf->original_init_upstream(cf, us) != NGX_OK) {
         return NGX_ERROR;
@@ -275,6 +284,7 @@ ngx_http_upstream_get_keepalive_peer(ngx_peer_connection_t *pc, void *data)
 
     c->idle = 0;
     c->sent = 0;
+    c->data = NULL;
     c->log = pc->log;
     c->read->log = pc->log;
     c->write->log = pc->log;
@@ -325,6 +335,10 @@ ngx_http_upstream_free_keepalive_peer(ngx_peer_connection_t *pc, void *data,
         goto invalid;
     }
 
+    if (ngx_current_msec - c->start_time > kp->conf->time) {
+        goto invalid;
+    }
+
     if (!u->keepalive) {
         goto invalid;
     }
@@ -512,6 +526,7 @@ ngx_http_upstream_keepalive_create_conf(ngx_conf_t *cf)
      *     conf->max_cached = 0;
      */
 
+    conf->time = NGX_CONF_UNSET_MSEC;
     conf->timeout = NGX_CONF_UNSET_MSEC;
     conf->requests = NGX_CONF_UNSET_UINT;
 
diff --git a/src/http/modules/ngx_http_userid_filter_module.c b/src/http/modules/ngx_http_userid_filter_module.c
index 31cf402f..1e33c5c9 100644
--- a/src/http/modules/ngx_http_userid_filter_module.c
+++ b/src/http/modules/ngx_http_userid_filter_module.c
@@ -15,12 +15,21 @@
 #define NGX_HTTP_USERID_V1    2
 #define NGX_HTTP_USERID_ON    3
 
+#define NGX_HTTP_USERID_COOKIE_OFF              0x0002
+#define NGX_HTTP_USERID_COOKIE_SECURE           0x0004
+#define NGX_HTTP_USERID_COOKIE_HTTPONLY         0x0008
+#define NGX_HTTP_USERID_COOKIE_SAMESITE         0x0010
+#define NGX_HTTP_USERID_COOKIE_SAMESITE_STRICT  0x0020
+#define NGX_HTTP_USERID_COOKIE_SAMESITE_LAX     0x0040
+#define NGX_HTTP_USERID_COOKIE_SAMESITE_NONE    0x0080
+
 /* 31 Dec 2037 23:55:55 GMT */
 #define NGX_HTTP_USERID_MAX_EXPIRES  2145916555
 
 
 typedef struct {
     ngx_uint_t  enable;
+    ngx_uint_t  flags;
 
     ngx_int_t   service;
 
@@ -88,6 +97,20 @@ static ngx_conf_enum_t  ngx_http_userid_state[] = {
 };
 
 
+static ngx_conf_bitmask_t  ngx_http_userid_flags[] = {
+    { ngx_string("off"), NGX_HTTP_USERID_COOKIE_OFF },
+    { ngx_string("secure"), NGX_HTTP_USERID_COOKIE_SECURE },
+    { ngx_string("httponly"), NGX_HTTP_USERID_COOKIE_HTTPONLY },
+    { ngx_string("samesite=strict"),
+      NGX_HTTP_USERID_COOKIE_SAMESITE|NGX_HTTP_USERID_COOKIE_SAMESITE_STRICT },
+    { ngx_string("samesite=lax"),
+      NGX_HTTP_USERID_COOKIE_SAMESITE|NGX_HTTP_USERID_COOKIE_SAMESITE_LAX },
+    { ngx_string("samesite=none"),
+      NGX_HTTP_USERID_COOKIE_SAMESITE|NGX_HTTP_USERID_COOKIE_SAMESITE_NONE },
+    { ngx_null_string, 0 }
+};
+
+
 static ngx_conf_post_handler_pt  ngx_http_userid_domain_p =
     ngx_http_userid_domain;
 static ngx_conf_post_handler_pt  ngx_http_userid_path_p = ngx_http_userid_path;
@@ -138,6 +161,13 @@ static ngx_command_t  ngx_http_userid_commands[] = {
       0,
       NULL },
 
+    { ngx_string("userid_flags"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE123,
+      ngx_conf_set_bitmask_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_userid_conf_t, flags),
+      &ngx_http_userid_flags },
+
     { ngx_string("userid_p3p"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
       ngx_conf_set_str_slot,
@@ -383,6 +413,26 @@ ngx_http_userid_set_uid(ngx_http_request_t *r, ngx_http_userid_ctx_t *ctx,
         len += conf->domain.len;
     }
 
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SECURE) {
+        len += sizeof("; secure") - 1;
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_HTTPONLY) {
+        len += sizeof("; httponly") - 1;
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SAMESITE_STRICT) {
+        len += sizeof("; samesite=strict") - 1;
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SAMESITE_LAX) {
+        len += sizeof("; samesite=lax") - 1;
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SAMESITE_NONE) {
+        len += sizeof("; samesite=none") - 1;
+    }
+
     cookie = ngx_pnalloc(r->pool, len);
     if (cookie == NULL) {
         return NGX_ERROR;
@@ -422,6 +472,26 @@ ngx_http_userid_set_uid(ngx_http_request_t *r, ngx_http_userid_ctx_t *ctx,
 
     p = ngx_copy(p, conf->path.data, conf->path.len);
 
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SECURE) {
+        p = ngx_cpymem(p, "; secure", sizeof("; secure") - 1);
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_HTTPONLY) {
+        p = ngx_cpymem(p, "; httponly", sizeof("; httponly") - 1);
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SAMESITE_STRICT) {
+        p = ngx_cpymem(p, "; samesite=strict", sizeof("; samesite=strict") - 1);
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SAMESITE_LAX) {
+        p = ngx_cpymem(p, "; samesite=lax", sizeof("; samesite=lax") - 1);
+    }
+
+    if (conf->flags & NGX_HTTP_USERID_COOKIE_SAMESITE_NONE) {
+        p = ngx_cpymem(p, "; samesite=none", sizeof("; samesite=none") - 1);
+    }
+
     set_cookie = ngx_list_push(&r->headers_out.headers);
     if (set_cookie == NULL) {
         return NGX_ERROR;
@@ -658,6 +728,7 @@ ngx_http_userid_create_conf(ngx_conf_t *cf)
     /*
      * set by ngx_pcalloc():
      *
+     *     conf->flags = 0;
      *     conf->name = { 0, NULL };
      *     conf->domain = { 0, NULL };
      *     conf->path = { 0, NULL };
@@ -682,6 +753,9 @@ ngx_http_userid_merge_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_uint_value(conf->enable, prev->enable,
                               NGX_HTTP_USERID_OFF);
 
+    ngx_conf_merge_bitmask_value(conf->flags, prev->flags,
+                            (NGX_CONF_BITMASK_SET|NGX_HTTP_USERID_COOKIE_OFF));
+
     ngx_conf_merge_str_value(conf->name, prev->name, "uid");
     ngx_conf_merge_str_value(conf->domain, prev->domain, "");
     ngx_conf_merge_str_value(conf->path, prev->path, "; path=/");
diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c
index 56dc236e..655be98c 100644
--- a/src/http/modules/ngx_http_uwsgi_module.c
+++ b/src/http/modules/ngx_http_uwsgi_module.c
@@ -54,9 +54,7 @@ typedef struct {
     ngx_uint_t                 ssl_verify_depth;
     ngx_str_t                  ssl_trusted_certificate;
     ngx_str_t                  ssl_crl;
-    ngx_str_t                  ssl_certificate;
-    ngx_str_t                  ssl_certificate_key;
-    ngx_array_t               *ssl_passwords;
+    ngx_array_t               *ssl_conf_commands;
 #endif
 } ngx_http_uwsgi_loc_conf_t;
 
@@ -67,6 +65,7 @@ static ngx_int_t ngx_http_uwsgi_create_request(ngx_http_request_t *r);
 static ngx_int_t ngx_http_uwsgi_reinit_request(ngx_http_request_t *r);
 static ngx_int_t ngx_http_uwsgi_process_status_line(ngx_http_request_t *r);
 static ngx_int_t ngx_http_uwsgi_process_header(ngx_http_request_t *r);
+static ngx_int_t ngx_http_uwsgi_input_filter_init(void *data);
 static void ngx_http_uwsgi_abort_request(ngx_http_request_t *r);
 static void ngx_http_uwsgi_finalize_request(ngx_http_request_t *r,
     ngx_int_t rc);
@@ -95,6 +94,8 @@ static char *ngx_http_uwsgi_cache_key(ngx_conf_t *cf, ngx_command_t *cmd,
 #if (NGX_HTTP_SSL)
 static char *ngx_http_uwsgi_ssl_password_file(ngx_conf_t *cf,
     ngx_command_t *cmd, void *conf);
+static char *ngx_http_uwsgi_ssl_conf_command_check(ngx_conf_t *cf, void *post,
+    void *data);
 static ngx_int_t ngx_http_uwsgi_set_ssl(ngx_conf_t *cf,
     ngx_http_uwsgi_loc_conf_t *uwcf);
 #endif
@@ -133,6 +134,9 @@ static ngx_conf_bitmask_t  ngx_http_uwsgi_ssl_protocols[] = {
     { ngx_null_string, 0 }
 };
 
+static ngx_conf_post_t  ngx_http_uwsgi_ssl_conf_command_post =
+    { ngx_http_uwsgi_ssl_conf_command_check };
+
 #endif
 
 
@@ -541,16 +545,16 @@ static ngx_command_t ngx_http_uwsgi_commands[] = {
 
     { ngx_string("uwsgi_ssl_certificate"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_http_set_complex_value_zero_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
-      offsetof(ngx_http_uwsgi_loc_conf_t, ssl_certificate),
+      offsetof(ngx_http_uwsgi_loc_conf_t, upstream.ssl_certificate),
       NULL },
 
     { ngx_string("uwsgi_ssl_certificate_key"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_http_set_complex_value_zero_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
-      offsetof(ngx_http_uwsgi_loc_conf_t, ssl_certificate_key),
+      offsetof(ngx_http_uwsgi_loc_conf_t, upstream.ssl_certificate_key),
       NULL },
 
     { ngx_string("uwsgi_ssl_password_file"),
@@ -560,6 +564,13 @@ static ngx_command_t ngx_http_uwsgi_commands[] = {
       0,
       NULL },
 
+    { ngx_string("uwsgi_ssl_conf_command"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE2,
+      ngx_conf_set_keyval_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_uwsgi_loc_conf_t, ssl_conf_commands),
+      &ngx_http_uwsgi_ssl_conf_command_post },
+
 #endif
 
       ngx_null_command
@@ -703,6 +714,10 @@ ngx_http_uwsgi_handler(ngx_http_request_t *r)
     u->pipe->input_filter = ngx_event_pipe_copy_input_filter;
     u->pipe->input_ctx = r;
 
+    u->input_filter_init = ngx_http_uwsgi_input_filter_init;
+    u->input_filter = ngx_http_upstream_non_buffered_filter;
+    u->input_filter_ctx = r;
+
     if (!uwcf->upstream.request_buffering
         && uwcf->upstream.pass_request_body
         && !r->headers_in.chunked)
@@ -1141,6 +1156,7 @@ ngx_http_uwsgi_create_request(ngx_http_request_t *r)
         r->upstream->request_bufs = cl;
     }
 
+    b->flush = 1;
     cl->next = NULL;
 
     return NGX_OK;
@@ -1355,6 +1371,37 @@ ngx_http_uwsgi_process_header(ngx_http_request_t *r)
 }
 
 
+static ngx_int_t
+ngx_http_uwsgi_input_filter_init(void *data)
+{
+    ngx_http_request_t   *r = data;
+    ngx_http_upstream_t  *u;
+
+    u = r->upstream;
+
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   "http uwsgi filter init s:%ui l:%O",
+                   u->headers_in.status_n, u->headers_in.content_length_n);
+
+    if (u->headers_in.status_n == NGX_HTTP_NO_CONTENT
+        || u->headers_in.status_n == NGX_HTTP_NOT_MODIFIED)
+    {
+        u->pipe->length = 0;
+        u->length = 0;
+
+    } else if (r->method == NGX_HTTP_HEAD) {
+        u->pipe->length = -1;
+        u->length = -1;
+
+    } else {
+        u->pipe->length = u->headers_in.content_length_n;
+        u->length = u->headers_in.content_length_n;
+    }
+
+    return NGX_OK;
+}
+
+
 static void
 ngx_http_uwsgi_abort_request(ngx_http_request_t *r)
 {
@@ -1459,10 +1506,14 @@ ngx_http_uwsgi_create_loc_conf(ngx_conf_t *cf)
 
 #if (NGX_HTTP_SSL)
     conf->upstream.ssl_session_reuse = NGX_CONF_UNSET;
+    conf->upstream.ssl_name = NGX_CONF_UNSET_PTR;
     conf->upstream.ssl_server_name = NGX_CONF_UNSET;
     conf->upstream.ssl_verify = NGX_CONF_UNSET;
     conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
-    conf->ssl_passwords = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_certificate = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_certificate_key = NGX_CONF_UNSET_PTR;
+    conf->upstream.ssl_passwords = NGX_CONF_UNSET_PTR;
+    conf->ssl_conf_commands = NGX_CONF_UNSET_PTR;
 #endif
 
     /* "uwsgi_cyclic_temp_file" is disabled */
@@ -1773,10 +1824,8 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers,
                              "DEFAULT");
 
-    if (conf->upstream.ssl_name == NULL) {
-        conf->upstream.ssl_name = prev->upstream.ssl_name;
-    }
-
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_name,
+                              prev->upstream.ssl_name, NULL);
     ngx_conf_merge_value(conf->upstream.ssl_server_name,
                               prev->upstream.ssl_server_name, 0);
     ngx_conf_merge_value(conf->upstream.ssl_verify,
@@ -1787,11 +1836,15 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
                               prev->ssl_trusted_certificate, "");
     ngx_conf_merge_str_value(conf->ssl_crl, prev->ssl_crl, "");
 
-    ngx_conf_merge_str_value(conf->ssl_certificate,
-                              prev->ssl_certificate, "");
-    ngx_conf_merge_str_value(conf->ssl_certificate_key,
-                              prev->ssl_certificate_key, "");
-    ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_certificate,
+                              prev->upstream.ssl_certificate, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_certificate_key,
+                              prev->upstream.ssl_certificate_key, NULL);
+    ngx_conf_merge_ptr_value(conf->upstream.ssl_passwords,
+                              prev->upstream.ssl_passwords, NULL);
+
+    ngx_conf_merge_ptr_value(conf->ssl_conf_commands,
+                              prev->ssl_conf_commands, NULL);
 
     if (conf->ssl && ngx_http_uwsgi_set_ssl(cf, conf) != NGX_OK) {
         return NGX_CONF_ERROR;
@@ -2323,15 +2376,15 @@ ngx_http_uwsgi_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     ngx_str_t  *value;
 
-    if (uwcf->ssl_passwords != NGX_CONF_UNSET_PTR) {
+    if (uwcf->upstream.ssl_passwords != NGX_CONF_UNSET_PTR) {
         return "is duplicate";
     }
 
     value = cf->args->elts;
 
-    uwcf->ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]);
+    uwcf->upstream.ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]);
 
-    if (uwcf->ssl_passwords == NULL) {
+    if (uwcf->upstream.ssl_passwords == NULL) {
         return NGX_CONF_ERROR;
     }
 
@@ -2339,6 +2392,17 @@ ngx_http_uwsgi_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static char *
+ngx_http_uwsgi_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
+{
+#ifndef SSL_CONF_FLAG_FILE
+    return "is not supported on this platform";
+#else
+    return NGX_CONF_OK;
+#endif
+}
+
+
 static ngx_int_t
 ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf)
 {
@@ -2366,20 +2430,34 @@ ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf)
     cln->handler = ngx_ssl_cleanup_ctx;
     cln->data = uwcf->upstream.ssl;
 
-    if (uwcf->ssl_certificate.len) {
+    if (uwcf->upstream.ssl_certificate) {
 
-        if (uwcf->ssl_certificate_key.len == 0) {
+        if (uwcf->upstream.ssl_certificate_key == NULL) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
                           "no \"uwsgi_ssl_certificate_key\" is defined "
-                          "for certificate \"%V\"", &uwcf->ssl_certificate);
+                          "for certificate \"%V\"",
+                          &uwcf->upstream.ssl_certificate->value);
             return NGX_ERROR;
         }
 
-        if (ngx_ssl_certificate(cf, uwcf->upstream.ssl, &uwcf->ssl_certificate,
-                                &uwcf->ssl_certificate_key, uwcf->ssl_passwords)
-            != NGX_OK)
+        if (uwcf->upstream.ssl_certificate->lengths
+            || uwcf->upstream.ssl_certificate_key->lengths)
         {
-            return NGX_ERROR;
+            uwcf->upstream.ssl_passwords =
+                  ngx_ssl_preserve_passwords(cf, uwcf->upstream.ssl_passwords);
+            if (uwcf->upstream.ssl_passwords == NULL) {
+                return NGX_ERROR;
+            }
+
+        } else {
+            if (ngx_ssl_certificate(cf, uwcf->upstream.ssl,
+                                    &uwcf->upstream.ssl_certificate->value,
+                                    &uwcf->upstream.ssl_certificate_key->value,
+                                    uwcf->upstream.ssl_passwords)
+                != NGX_OK)
+            {
+                return NGX_ERROR;
+            }
         }
     }
 
@@ -2416,6 +2494,12 @@ ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf)
         return NGX_ERROR;
     }
 
+    if (ngx_ssl_conf_commands(cf, uwcf->upstream.ssl, uwcf->ssl_conf_commands)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
     return NGX_OK;
 }
 
diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c
index ea7ce2a5..8afd656a 100644
--- a/src/http/modules/ngx_http_xslt_filter_module.c
+++ b/src/http/modules/ngx_http_xslt_filter_module.c
@@ -233,6 +233,7 @@ ngx_http_xslt_header_filter(ngx_http_request_t *r)
     ngx_http_set_ctx(r, ctx, ngx_http_xslt_filter_module);
 
     r->main_filter_need_in_memory = 1;
+    r->allow_ranges = 0;
 
     return NGX_OK;
 }
@@ -628,7 +629,7 @@ static ngx_int_t
 ngx_http_xslt_params(ngx_http_request_t *r, ngx_http_xslt_filter_ctx_t *ctx,
     ngx_array_t *params, ngx_uint_t final)
 {
-    u_char                 *p, *last, *value, *dst, *src, **s;
+    u_char                 *p, *value, *dst, *src, **s;
     size_t                  len;
     ngx_uint_t              i;
     ngx_str_t               string;
@@ -698,8 +699,6 @@ ngx_http_xslt_params(ngx_http_request_t *r, ngx_http_xslt_filter_ctx_t *ctx,
             ngx_memcpy(p, string.data, string.len + 1);
         }
 
-        last = p + string.len;
-
         while (p && *p) {
 
             value = p;
@@ -729,7 +728,7 @@ ngx_http_xslt_params(ngx_http_request_t *r, ngx_http_xslt_filter_ctx_t *ctx,
                 *p++ = '\0';
 
             } else {
-                len = last - value;
+                len = ngx_strlen(value);
             }
 
             ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
diff --git a/src/http/modules/perl/nginx.xs b/src/http/modules/perl/nginx.xs
index ad126328..caf7c084 100644
--- a/src/http/modules/perl/nginx.xs
+++ b/src/http/modules/perl/nginx.xs
@@ -15,8 +15,10 @@
 #include "XSUB.h"
 
 
-#define ngx_http_perl_set_request(r)                                          \
-    r = INT2PTR(ngx_http_request_t *, SvIV((SV *) SvRV(ST(0))))
+#define ngx_http_perl_set_request(r, ctx)                                     \
+                                                                              \
+    ctx = INT2PTR(ngx_http_perl_ctx_t *, SvIV((SV *) SvRV(ST(0))));           \
+    r = ctx->request
 
 
 #define ngx_http_perl_set_targ(p, len)                                        \
@@ -64,14 +66,12 @@ ngx_http_perl_sv2str(pTHX_ ngx_http_request_t *r, ngx_str_t *s, SV *sv)
 
 
 static ngx_int_t
-ngx_http_perl_output(ngx_http_request_t *r, ngx_buf_t *b)
+ngx_http_perl_output(ngx_http_request_t *r, ngx_http_perl_ctx_t *ctx,
+    ngx_buf_t *b)
 {
-    ngx_chain_t           out;
+    ngx_chain_t   out;
 #if (NGX_HTTP_SSI)
-    ngx_chain_t          *cl;
-    ngx_http_perl_ctx_t  *ctx;
-
-    ctx = ngx_http_get_module_ctx(r, ngx_http_perl_module);
+    ngx_chain_t  *cl;
 
     if (ctx->ssi) {
         cl = ngx_alloc_chain_link(r->pool);
@@ -105,9 +105,14 @@ void
 status(r, code)
     CODE:
 
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+
+    ngx_http_perl_set_request(r, ctx);
 
-    ngx_http_perl_set_request(r);
+    if (ctx->variable) {
+        croak("status(): cannot be used in variable handler");
+    }
 
     r->headers_out.status = SvIV(ST(1));
 
@@ -121,10 +126,28 @@ void
 send_http_header(r, ...)
     CODE:
 
-    ngx_http_request_t  *r;
-    SV                  *sv;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    SV                   *sv;
+    ngx_int_t             rc;
+
+    ngx_http_perl_set_request(r, ctx);
+
+    if (ctx->error) {
+        croak("send_http_header(): called after error");
+    }
+
+    if (ctx->variable) {
+        croak("send_http_header(): cannot be used in variable handler");
+    }
+
+    if (ctx->header_sent) {
+        croak("send_http_header(): header already sent");
+    }
 
-    ngx_http_perl_set_request(r);
+    if (ctx->redirect_uri.len) {
+        croak("send_http_header(): cannot be used with internal_redirect()");
+    }
 
     if (r->headers_out.status == 0) {
         r->headers_out.status = NGX_HTTP_OK;
@@ -136,18 +159,30 @@ send_http_header(r, ...)
         if (ngx_http_perl_sv2str(aTHX_ r, &r->headers_out.content_type, sv)
             != NGX_OK)
         {
-            XSRETURN_EMPTY;
+            ctx->error = 1;
+            croak("ngx_http_perl_sv2str() failed");
         }
 
         r->headers_out.content_type_len = r->headers_out.content_type.len;
 
     } else {
         if (ngx_http_set_content_type(r) != NGX_OK) {
-            XSRETURN_EMPTY;
+            ctx->error = 1;
+            croak("ngx_http_set_content_type() failed");
         }
     }
 
-    (void) ngx_http_send_header(r);
+    ctx->header_sent = 1;
+
+    r->disable_not_modified = 1;
+
+    rc = ngx_http_send_header(r);
+
+    if (rc == NGX_ERROR || rc > NGX_OK) {
+        ctx->error = 1;
+        ctx->status = rc;
+        croak("ngx_http_send_header() failed");
+    }
 
 
 void
@@ -155,9 +190,10 @@ header_only(r)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
     sv_upgrade(TARG, SVt_IV);
     sv_setiv(TARG, r->header_only);
@@ -170,9 +206,10 @@ uri(r)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
     ngx_http_perl_set_targ(r->uri.data, r->uri.len);
 
     ST(0) = TARG;
@@ -183,9 +220,10 @@ args(r)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
     ngx_http_perl_set_targ(r->args.data, r->args.len);
 
     ST(0) = TARG;
@@ -196,9 +234,10 @@ request_method(r)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
     ngx_http_perl_set_targ(r->method_name.data, r->method_name.len);
 
     ST(0) = TARG;
@@ -209,9 +248,10 @@ remote_addr(r)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
     ngx_http_perl_set_targ(r->connection->addr_text.data,
                            r->connection->addr_text.len);
 
@@ -224,6 +264,7 @@ header_in(r, key)
 
     dXSTARG;
     ngx_http_request_t         *r;
+    ngx_http_perl_ctx_t        *ctx;
     SV                         *key;
     u_char                     *p, *lowcase_key, *value, sep;
     STRLEN                      len;
@@ -235,7 +276,7 @@ header_in(r, key)
     ngx_http_header_t          *hh;
     ngx_http_core_main_conf_t  *cmcf;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
     key = ST(1);
 
@@ -249,7 +290,8 @@ header_in(r, key)
 
     lowcase_key = ngx_pnalloc(r->pool, len);
     if (lowcase_key == NULL) {
-        XSRETURN_UNDEF;
+        ctx->error = 1;
+        croak("ngx_pnalloc() failed");
     }
 
     hash = ngx_hash_strlow(lowcase_key, p, len);
@@ -309,7 +351,8 @@ header_in(r, key)
 
         value = ngx_pnalloc(r->pool, size);
         if (value == NULL) {
-            XSRETURN_UNDEF;
+            ctx->error = 1;
+            croak("ngx_pnalloc() failed");
         }
 
         p = value;
@@ -371,14 +414,22 @@ has_request_body(r, next)
     dXSTARG;
     ngx_http_request_t   *r;
     ngx_http_perl_ctx_t  *ctx;
+    ngx_int_t             rc;
+
+    ngx_http_perl_set_request(r, ctx);
 
-    ngx_http_perl_set_request(r);
+    if (ctx->variable) {
+        croak("has_request_body(): cannot be used in variable handler");
+    }
+
+    if (ctx->next) {
+        croak("has_request_body(): another handler active");
+    }
 
     if (r->headers_in.content_length_n <= 0 && !r->headers_in.chunked) {
         XSRETURN_UNDEF;
     }
 
-    ctx = ngx_http_get_module_ctx(r, ngx_http_perl_module);
     ctx->next = SvRV(ST(1));
 
     r->request_body_in_single_buf = 1;
@@ -389,7 +440,14 @@ has_request_body(r, next)
         r->request_body_file_log_level = 0;
     }
 
-    ngx_http_read_client_request_body(r, ngx_http_perl_handle_request);
+    rc = ngx_http_read_client_request_body(r, ngx_http_perl_handle_request);
+
+    if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
+        ctx->error = 1;
+        ctx->status = rc;
+        ctx->next = NULL;
+        croak("ngx_http_read_client_request_body() failed");
+    }
 
     sv_upgrade(TARG, SVt_IV);
     sv_setiv(TARG, 1);
@@ -402,13 +460,14 @@ request_body(r)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
-    u_char              *p, *data;
-    size_t               len;
-    ngx_buf_t           *buf;
-    ngx_chain_t         *cl;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    u_char               *p, *data;
+    size_t                len;
+    ngx_buf_t            *buf;
+    ngx_chain_t          *cl;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
     if (r->request_body == NULL
         || r->request_body->temp_file
@@ -436,7 +495,8 @@ request_body(r)
 
     p = ngx_pnalloc(r->pool, len);
     if (p == NULL) {
-        XSRETURN_UNDEF;
+        ctx->error = 1;
+        croak("ngx_pnalloc() failed");
     }
 
     data = p;
@@ -463,9 +523,10 @@ request_body_file(r)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
     if (r->request_body == NULL || r->request_body->temp_file == NULL) {
         XSRETURN_UNDEF;
@@ -481,42 +542,66 @@ void
 discard_request_body(r)
     CODE:
 
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    ngx_int_t             rc;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
-    ngx_http_discard_request_body(r);
+    if (ctx->variable) {
+        croak("discard_request_body(): cannot be used in variable handler");
+    }
+
+    rc = ngx_http_discard_request_body(r);
+
+    if (rc != NGX_OK) {
+        ctx->error = 1;
+        ctx->status = rc;
+        croak("ngx_http_discard_request_body() failed");
+    }
 
 
 void
 header_out(r, key, value)
     CODE:
 
-    ngx_http_request_t  *r;
-    SV                  *key;
-    SV                  *value;
-    ngx_table_elt_t     *header;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    SV                   *key;
+    SV                   *value;
+    ngx_table_elt_t      *header;
+
+    ngx_http_perl_set_request(r, ctx);
+
+    if (ctx->error) {
+        croak("header_out(): called after error");
+    }
 
-    ngx_http_perl_set_request(r);
+    if (ctx->variable) {
+        croak("header_out(): cannot be used in variable handler");
+    }
 
     key = ST(1);
     value = ST(2);
 
     header = ngx_list_push(&r->headers_out.headers);
     if (header == NULL) {
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_list_push() failed");
     }
 
     header->hash = 1;
 
     if (ngx_http_perl_sv2str(aTHX_ r, &header->key, key) != NGX_OK) {
         header->hash = 0;
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_http_perl_sv2str() failed");
     }
 
     if (ngx_http_perl_sv2str(aTHX_ r, &header->value, value) != NGX_OK) {
         header->hash = 0;
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_http_perl_sv2str() failed");
     }
 
     if (header->key.len == sizeof("Content-Length") - 1
@@ -540,19 +625,19 @@ filename(r)
     CODE:
 
     dXSTARG;
-    size_t                root;
     ngx_http_request_t   *r;
     ngx_http_perl_ctx_t  *ctx;
+    size_t                root;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
-    ctx = ngx_http_get_module_ctx(r, ngx_http_perl_module);
     if (ctx->filename.data) {
         goto done;
     }
 
     if (ngx_http_map_uri_to_path(r, &ctx->filename, &root, 0) == NULL) {
-        XSRETURN_UNDEF;
+        ctx->error = 1;
+        croak("ngx_http_map_uri_to_path() failed");
     }
 
     ctx->filename.len--;
@@ -569,15 +654,29 @@ void
 print(r, ...)
     CODE:
 
-    ngx_http_request_t  *r;
-    SV                  *sv;
-    int                  i;
-    u_char              *p;
-    size_t               size;
-    STRLEN               len;
-    ngx_buf_t           *b;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    SV                   *sv;
+    int                   i;
+    u_char               *p;
+    size_t                size;
+    STRLEN                len;
+    ngx_int_t             rc;
+    ngx_buf_t            *b;
+
+    ngx_http_perl_set_request(r, ctx);
+
+    if (ctx->error) {
+        croak("print(): called after error");
+    }
+
+    if (ctx->variable) {
+        croak("print(): cannot be used in variable handler");
+    }
 
-    ngx_http_perl_set_request(r);
+    if (!ctx->header_sent) {
+        croak("print(): header not sent");
+    }
 
     if (items == 2) {
 
@@ -602,7 +701,8 @@ print(r, ...)
 
             b = ngx_calloc_buf(r->pool);
             if (b == NULL) {
-                XSRETURN_EMPTY;
+                ctx->error = 1;
+                croak("ngx_calloc_buf() failed");
             }
 
             b->memory = 1;
@@ -642,7 +742,8 @@ print(r, ...)
 
     b = ngx_create_temp_buf(r->pool, size);
     if (b == NULL) {
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_create_temp_buf() failed");
     }
 
     for (i = 1; i < items; i++) {
@@ -658,7 +759,12 @@ print(r, ...)
 
     out:
 
-    (void) ngx_http_perl_output(r, b);
+    rc = ngx_http_perl_output(r, ctx, b);
+
+    if (rc == NGX_ERROR) {
+        ctx->error = 1;
+        croak("ngx_http_perl_output() failed");
+    }
 
 
 void
@@ -666,15 +772,29 @@ sendfile(r, filename, offset = -1, bytes = 0)
     CODE:
 
     ngx_http_request_t        *r;
+    ngx_http_perl_ctx_t       *ctx;
     char                      *filename;
     off_t                      offset;
     size_t                     bytes;
+    ngx_int_t                  rc;
     ngx_str_t                  path;
     ngx_buf_t                 *b;
     ngx_open_file_info_t       of;
     ngx_http_core_loc_conf_t  *clcf;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
+
+    if (ctx->error) {
+        croak("sendfile(): called after error");
+    }
+
+    if (ctx->variable) {
+        croak("sendfile(): cannot be used in variable handler");
+    }
+
+    if (!ctx->header_sent) {
+        croak("sendfile(): header not sent");
+    }
 
     filename = SvPV_nolen(ST(1));
 
@@ -687,19 +807,22 @@ sendfile(r, filename, offset = -1, bytes = 0)
 
     b = ngx_calloc_buf(r->pool);
     if (b == NULL) {
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_calloc_buf() failed");
     }
 
     b->file = ngx_pcalloc(r->pool, sizeof(ngx_file_t));
     if (b->file == NULL) {
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_pcalloc() failed");
     }
 
     path.len = ngx_strlen(filename);
 
     path.data = ngx_pnalloc(r->pool, path.len + 1);
     if (path.data == NULL) {
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_pnalloc() failed");
     }
 
     (void) ngx_cpystrn(path.data, (u_char *) filename, path.len + 1);
@@ -716,19 +839,23 @@ sendfile(r, filename, offset = -1, bytes = 0)
     of.events = clcf->open_file_cache_events;
 
     if (ngx_http_set_disable_symlinks(r, clcf, &path, &of) != NGX_OK) {
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_http_set_disable_symlinks() failed");
     }
 
     if (ngx_open_cached_file(clcf->open_file_cache, &path, &of, r->pool)
         != NGX_OK)
     {
         if (of.err == 0) {
-            XSRETURN_EMPTY;
+            ctx->error = 1;
+            croak("ngx_open_cached_file() failed");
         }
 
         ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,
                       "%s \"%s\" failed", of.failed, filename);
-        XSRETURN_EMPTY;
+
+        ctx->error = 1;
+        croak("ngx_open_cached_file() failed");
     }
 
     if (offset == -1) {
@@ -748,28 +875,53 @@ sendfile(r, filename, offset = -1, bytes = 0)
     b->file->log = r->connection->log;
     b->file->directio = of.is_directio;
 
-    (void) ngx_http_perl_output(r, b);
+    rc = ngx_http_perl_output(r, ctx, b);
+
+    if (rc == NGX_ERROR) {
+        ctx->error = 1;
+        croak("ngx_http_perl_output() failed");
+    }
 
 
 void
 flush(r)
     CODE:
 
-    ngx_http_request_t  *r;
-    ngx_buf_t           *b;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    ngx_int_t             rc;
+    ngx_buf_t            *b;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
+
+    if (ctx->error) {
+        croak("flush(): called after error");
+    }
+
+    if (ctx->variable) {
+        croak("flush(): cannot be used in variable handler");
+    }
+
+    if (!ctx->header_sent) {
+        croak("flush(): header not sent");
+    }
 
     b = ngx_calloc_buf(r->pool);
     if (b == NULL) {
-        XSRETURN_EMPTY;
+        ctx->error = 1;
+        croak("ngx_calloc_buf() failed");
     }
 
     b->flush = 1;
 
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "$r->flush");
 
-    (void) ngx_http_perl_output(r, b);
+    rc = ngx_http_perl_output(r, ctx, b);
+
+    if (rc == NGX_ERROR) {
+        ctx->error = 1;
+        croak("ngx_http_perl_output() failed");
+    }
 
     XSRETURN_EMPTY;
 
@@ -779,29 +931,24 @@ internal_redirect(r, uri)
     CODE:
 
     ngx_http_request_t   *r;
-    SV                   *uri;
-    ngx_uint_t            i;
     ngx_http_perl_ctx_t  *ctx;
+    SV                   *uri;
 
-    ngx_http_perl_set_request(r);
-
-    uri = ST(1);
-
-    ctx = ngx_http_get_module_ctx(r, ngx_http_perl_module);
+    ngx_http_perl_set_request(r, ctx);
 
-    if (ngx_http_perl_sv2str(aTHX_ r, &ctx->redirect_uri, uri) != NGX_OK) {
-        XSRETURN_EMPTY;
+    if (ctx->variable) {
+        croak("internal_redirect(): cannot be used in variable handler");
     }
 
-    for (i = 0; i < ctx->redirect_uri.len; i++) {
-        if (ctx->redirect_uri.data[i] == '?') {
+    if (ctx->header_sent) {
+        croak("internal_redirect(): header already sent");
+    }
 
-            ctx->redirect_args.len = ctx->redirect_uri.len - (i + 1);
-            ctx->redirect_args.data = &ctx->redirect_uri.data[i + 1];
-            ctx->redirect_uri.len = i;
+    uri = ST(1);
 
-            XSRETURN_EMPTY;
-        }
+    if (ngx_http_perl_sv2str(aTHX_ r, &ctx->redirect_uri, uri) != NGX_OK) {
+        ctx->error = 1;
+        croak("ngx_http_perl_sv2str() failed");
     }
 
 
@@ -809,9 +956,14 @@ void
 allow_ranges(r)
     CODE:
 
-    ngx_http_request_t  *r;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+
+    ngx_http_perl_set_request(r, ctx);
 
-    ngx_http_perl_set_request(r);
+    if (ctx->variable) {
+        croak("allow_ranges(): cannot be used in variable handler");
+    }
 
     r->allow_ranges = 1;
 
@@ -821,13 +973,14 @@ unescape(r, text, type = 0)
     CODE:
 
     dXSTARG;
-    ngx_http_request_t  *r;
-    SV                  *text;
-    int                  type;
-    u_char              *p, *dst, *src;
-    STRLEN               len;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    SV                   *text;
+    int                   type;
+    u_char               *p, *dst, *src;
+    STRLEN                len;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
     text = ST(1);
 
@@ -835,7 +988,8 @@ unescape(r, text, type = 0)
 
     p = ngx_pnalloc(r->pool, len + 1);
     if (p == NULL) {
-        XSRETURN_UNDEF;
+        ctx->error = 1;
+        croak("ngx_pnalloc() failed");
     }
 
     dst = p;
@@ -856,16 +1010,16 @@ variable(r, name, value = NULL)
 
     dXSTARG;
     ngx_http_request_t         *r;
+    ngx_http_perl_ctx_t        *ctx;
     SV                         *name, *value;
     u_char                     *p, *lowcase;
     STRLEN                      len;
     ngx_str_t                   var, val;
     ngx_uint_t                  i, hash;
     ngx_http_perl_var_t        *v;
-    ngx_http_perl_ctx_t        *ctx;
     ngx_http_variable_value_t  *vv;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
     name = ST(1);
 
@@ -884,7 +1038,8 @@ variable(r, name, value = NULL)
         }
 
         if (ngx_http_perl_sv2str(aTHX_ r, &val, value) != NGX_OK) {
-            XSRETURN_UNDEF;
+            ctx->error = 1;
+            croak("ngx_http_perl_sv2str() failed");
         }
     }
 
@@ -892,7 +1047,8 @@ variable(r, name, value = NULL)
 
     lowcase = ngx_pnalloc(r->pool, len);
     if (lowcase == NULL) {
-        XSRETURN_UNDEF;
+        ctx->error = 1;
+        croak("ngx_pnalloc() failed");
     }
 
     hash = ngx_hash_strlow(lowcase, p, len);
@@ -912,13 +1068,12 @@ variable(r, name, value = NULL)
 
     vv = ngx_http_get_variable(r, &var, hash);
     if (vv == NULL) {
-        XSRETURN_UNDEF;
+        ctx->error = 1;
+        croak("ngx_http_get_variable() failed");
     }
 
     if (vv->not_found) {
 
-        ctx = ngx_http_get_module_ctx(r, ngx_http_perl_module);
-
         if (ctx->variables) {
 
             v = ctx->variables->elts;
@@ -947,13 +1102,15 @@ variable(r, name, value = NULL)
                 ctx->variables = ngx_array_create(r->pool, 1,
                                                   sizeof(ngx_http_perl_var_t));
                 if (ctx->variables == NULL) {
-                    XSRETURN_UNDEF;
+                    ctx->error = 1;
+                    croak("ngx_array_create() failed");
                 }
             }
 
             v = ngx_array_push(ctx->variables);
             if (v == NULL) {
-                XSRETURN_UNDEF;
+                ctx->error = 1;
+                croak("ngx_array_push() failed");
             }
 
             v->hash = hash;
@@ -989,18 +1146,24 @@ sleep(r, sleep, next)
     CODE:
 
     ngx_http_request_t   *r;
-    ngx_msec_t            sleep;
     ngx_http_perl_ctx_t  *ctx;
+    ngx_msec_t            sleep;
+
+    ngx_http_perl_set_request(r, ctx);
+
+    if (ctx->variable) {
+        croak("sleep(): cannot be used in variable handler");
+    }
 
-    ngx_http_perl_set_request(r);
+    if (ctx->next) {
+        croak("sleep(): another handler active");
+    }
 
     sleep = (ngx_msec_t) SvIV(ST(1));
 
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                    "perl sleep: %M", sleep);
 
-    ctx = ngx_http_get_module_ctx(r, ngx_http_perl_module);
-
     ctx->next = SvRV(ST(2));
 
     r->connection->write->delayed = 1;
@@ -1014,13 +1177,14 @@ void
 log_error(r, err, msg)
     CODE:
 
-    ngx_http_request_t  *r;
-    SV                  *err, *msg;
-    u_char              *p;
-    STRLEN               len;
-    ngx_err_t            e;
+    ngx_http_request_t   *r;
+    ngx_http_perl_ctx_t  *ctx;
+    SV                   *err, *msg;
+    u_char               *p;
+    STRLEN                len;
+    ngx_err_t             e;
 
-    ngx_http_perl_set_request(r);
+    ngx_http_perl_set_request(r, ctx);
 
     err = ST(1);
 
diff --git a/src/http/modules/perl/ngx_http_perl_module.c b/src/http/modules/perl/ngx_http_perl_module.c
index 6d3be912..f3fc6294 100644
--- a/src/http/modules/perl/ngx_http_perl_module.c
+++ b/src/http/modules/perl/ngx_http_perl_module.c
@@ -43,7 +43,8 @@ static PerlInterpreter *ngx_http_perl_create_interpreter(ngx_conf_t *cf,
 static ngx_int_t ngx_http_perl_run_requires(pTHX_ ngx_array_t *requires,
     ngx_log_t *log);
 static ngx_int_t ngx_http_perl_call_handler(pTHX_ ngx_http_request_t *r,
-    HV *nginx, SV *sub, SV **args, ngx_str_t *handler, ngx_str_t *rv);
+    ngx_http_perl_ctx_t *ctx, HV *nginx, SV *sub, SV **args,
+    ngx_str_t *handler, ngx_str_t *rv);
 static void ngx_http_perl_eval_anon_sub(pTHX_ ngx_str_t *handler, SV **sv);
 
 static ngx_int_t ngx_http_perl_preconfiguration(ngx_conf_t *cf);
@@ -183,6 +184,7 @@ ngx_http_perl_handle_request(ngx_http_request_t *r)
     SV                         *sub;
     ngx_int_t                   rc;
     ngx_str_t                   uri, args, *handler;
+    ngx_uint_t                  flags;
     ngx_http_perl_ctx_t        *ctx;
     ngx_http_perl_loc_conf_t   *plcf;
     ngx_http_perl_main_conf_t  *pmcf;
@@ -199,6 +201,8 @@ ngx_http_perl_handle_request(ngx_http_request_t *r)
         }
 
         ngx_http_set_ctx(r, ctx, ngx_http_perl_module);
+
+        ctx->request = r;
     }
 
     pmcf = ngx_http_get_module_main_conf(r, ngx_http_perl_module);
@@ -220,26 +224,20 @@ ngx_http_perl_handle_request(ngx_http_request_t *r)
         ctx->next = NULL;
     }
 
-    rc = ngx_http_perl_call_handler(aTHX_ r, pmcf->nginx, sub, NULL, handler,
-                                    NULL);
+    rc = ngx_http_perl_call_handler(aTHX_ r, ctx, pmcf->nginx, sub, NULL,
+                                    handler, NULL);
 
     }
 
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                    "perl handler done: %i", rc);
 
-    if (rc == NGX_DONE) {
-        ngx_http_finalize_request(r, rc);
-        return;
-    }
-
     if (rc > 600) {
         rc = NGX_OK;
     }
 
     if (ctx->redirect_uri.len) {
         uri = ctx->redirect_uri;
-        args = ctx->redirect_args;
 
     } else {
         uri.len = 0;
@@ -248,13 +246,32 @@ ngx_http_perl_handle_request(ngx_http_request_t *r)
     ctx->filename.data = NULL;
     ctx->redirect_uri.len = 0;
 
+    if (rc == NGX_ERROR) {
+        ngx_http_finalize_request(r, rc);
+        return;
+    }
+
     if (ctx->done || ctx->next) {
         ngx_http_finalize_request(r, NGX_DONE);
         return;
     }
 
     if (uri.len) {
-        ngx_http_internal_redirect(r, &uri, &args);
+        if (uri.data[0] == '@') {
+            ngx_http_named_location(r, &uri);
+
+        } else {
+            ngx_str_null(&args);
+            flags = NGX_HTTP_LOG_UNSAFE;
+
+            if (ngx_http_parse_unsafe_uri(r, &uri, &args, &flags) != NGX_OK) {
+                ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+                return;
+            }
+
+            ngx_http_internal_redirect(r, &uri, &args);
+        }
+
         ngx_http_finalize_request(r, NGX_DONE);
         return;
     }
@@ -299,6 +316,7 @@ ngx_http_perl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v,
 
     ngx_int_t                   rc;
     ngx_str_t                   value;
+    ngx_uint_t                  saved;
     ngx_http_perl_ctx_t        *ctx;
     ngx_http_perl_main_conf_t  *pmcf;
 
@@ -314,8 +332,13 @@ ngx_http_perl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v,
         }
 
         ngx_http_set_ctx(r, ctx, ngx_http_perl_module);
+
+        ctx->request = r;
     }
 
+    saved = ctx->variable;
+    ctx->variable = 1;
+
     pmcf = ngx_http_get_module_main_conf(r, ngx_http_perl_module);
 
     value.data = NULL;
@@ -326,7 +349,7 @@ ngx_http_perl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v,
     PERL_SET_CONTEXT(pmcf->perl);
     PERL_SET_INTERP(pmcf->perl);
 
-    rc = ngx_http_perl_call_handler(aTHX_ r, pmcf->nginx, pv->sub, NULL,
+    rc = ngx_http_perl_call_handler(aTHX_ r, ctx, pmcf->nginx, pv->sub, NULL,
                                     &pv->handler, &value);
 
     }
@@ -342,6 +365,7 @@ ngx_http_perl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v,
         v->not_found = 1;
     }
 
+    ctx->variable = saved;
     ctx->filename.data = NULL;
     ctx->redirect_uri.len = 0;
 
@@ -377,11 +401,14 @@ ngx_http_perl_ssi(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ssi_ctx,
         }
 
         ngx_http_set_ctx(r, ctx, ngx_http_perl_module);
+
+        ctx->request = r;
     }
 
     pmcf = ngx_http_get_module_main_conf(r, ngx_http_perl_module);
 
     ctx->ssi = ssi_ctx;
+    ctx->header_sent = 1;
 
     handler = params[NGX_HTTP_PERL_SSI_SUB];
     handler->data[handler->len] = '\0';
@@ -435,8 +462,8 @@ ngx_http_perl_ssi(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ssi_ctx,
         asv = NULL;
     }
 
-    rc = ngx_http_perl_call_handler(aTHX_ r, pmcf->nginx, sv, asv, handler,
-                                    NULL);
+    rc = ngx_http_perl_call_handler(aTHX_ r, ctx, pmcf->nginx, sv, asv,
+                                    handler, NULL);
 
     SvREFCNT_dec(sv);
 
@@ -672,8 +699,9 @@ ngx_http_perl_run_requires(pTHX_ ngx_array_t *requires, ngx_log_t *log)
 
 
 static ngx_int_t
-ngx_http_perl_call_handler(pTHX_ ngx_http_request_t *r, HV *nginx, SV *sub,
-    SV **args, ngx_str_t *handler, ngx_str_t *rv)
+ngx_http_perl_call_handler(pTHX_ ngx_http_request_t *r,
+    ngx_http_perl_ctx_t *ctx, HV *nginx, SV *sub, SV **args,
+    ngx_str_t *handler, ngx_str_t *rv)
 {
     SV                *sv;
     int                n, status;
@@ -687,12 +715,15 @@ ngx_http_perl_call_handler(pTHX_ ngx_http_request_t *r, HV *nginx, SV *sub,
 
     status = 0;
 
+    ctx->error = 0;
+    ctx->status = NGX_OK;
+
     ENTER;
     SAVETMPS;
 
     PUSHMARK(sp);
 
-    sv = sv_2mortal(sv_bless(newRV_noinc(newSViv(PTR2IV(r))), nginx));
+    sv = sv_2mortal(sv_bless(newRV_noinc(newSViv(PTR2IV(ctx))), nginx));
     XPUSHs(sv);
 
     if (args) {
@@ -736,6 +767,18 @@ ngx_http_perl_call_handler(pTHX_ ngx_http_request_t *r, HV *nginx, SV *sub,
     FREETMPS;
     LEAVE;
 
+    if (ctx->error) {
+
+        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                       "call_sv: error, %d", ctx->status);
+
+        if (ctx->status != NGX_OK) {
+            return ctx->status;
+        }
+
+        return NGX_ERROR;
+    }
+
     /* check $@ */
 
     if (SvTRUE(ERRSV)) {
@@ -750,6 +793,12 @@ ngx_http_perl_call_handler(pTHX_ ngx_http_request_t *r, HV *nginx, SV *sub,
             return NGX_ERROR;
         }
 
+        ctx->redirect_uri.len = 0;
+
+        if (ctx->header_sent) {
+            return NGX_ERROR;
+        }
+
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
     }
 
diff --git a/src/http/modules/perl/ngx_http_perl_module.h b/src/http/modules/perl/ngx_http_perl_module.h
index 5e60b031..8fa59a4c 100644
--- a/src/http/modules/perl/ngx_http_perl_module.h
+++ b/src/http/modules/perl/ngx_http_perl_module.h
@@ -21,13 +21,19 @@
 typedef ngx_http_request_t   *nginx;
 
 typedef struct {
+    ngx_http_request_t       *request;
+
     ngx_str_t                 filename;
     ngx_str_t                 redirect_uri;
-    ngx_str_t                 redirect_args;
 
     SV                       *next;
 
-    ngx_uint_t                done;       /* unsigned  done:1; */
+    ngx_int_t                 status;
+
+    unsigned                  done:1;
+    unsigned                  error:1;
+    unsigned                  variable:1;
+    unsigned                  header_sent:1;
 
     ngx_array_t              *variables;  /* array of ngx_http_perl_var_t */
 
diff --git a/src/http/ngx_http.c b/src/http/ngx_http.c
index 79ef9c64..3d5c4ac1 100644
--- a/src/http/ngx_http.c
+++ b/src/http/ngx_http.c
@@ -37,6 +37,8 @@ static ngx_int_t ngx_http_init_locations(ngx_conf_t *cf,
     ngx_http_core_srv_conf_t *cscf, ngx_http_core_loc_conf_t *pclcf);
 static ngx_int_t ngx_http_init_static_location_trees(ngx_conf_t *cf,
     ngx_http_core_loc_conf_t *pclcf);
+static ngx_int_t ngx_http_escape_location_name(ngx_conf_t *cf,
+    ngx_http_core_loc_conf_t *clcf);
 static ngx_int_t ngx_http_cmp_locations(const ngx_queue_t *one,
     const ngx_queue_t *two);
 static ngx_int_t ngx_http_join_exact_locations(ngx_conf_t *cf,
@@ -882,6 +884,41 @@ ngx_http_add_location(ngx_conf_t *cf, ngx_queue_t **locations,
 
     ngx_queue_insert_tail(*locations, &lq->queue);
 
+    if (ngx_http_escape_location_name(cf, clcf) != NGX_OK) {
+        return NGX_ERROR;
+    }
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_http_escape_location_name(ngx_conf_t *cf, ngx_http_core_loc_conf_t *clcf)
+{
+    u_char     *p;
+    size_t      len;
+    uintptr_t   escape;
+
+    escape = 2 * ngx_escape_uri(NULL, clcf->name.data, clcf->name.len,
+                                NGX_ESCAPE_URI);
+
+    if (escape) {
+        len = clcf->name.len + escape;
+
+        p = ngx_pnalloc(cf->pool, len);
+        if (p == NULL) {
+            return NGX_ERROR;
+        }
+
+        clcf->escaped_name.len = len;
+        clcf->escaped_name.data = p;
+
+        ngx_escape_uri(p, clcf->name.data, clcf->name.len, NGX_ESCAPE_URI);
+
+    } else {
+        clcf->escaped_name = clcf->name;
+    }
+
     return NGX_OK;
 }
 
@@ -1469,14 +1506,14 @@ ngx_http_server_names(ngx_conf_t *cf, ngx_http_core_main_conf_t *cmcf,
                                   NGX_HASH_WILDCARD_KEY);
 
             if (rc == NGX_ERROR) {
-                return NGX_ERROR;
+                goto failed;
             }
 
             if (rc == NGX_DECLINED) {
                 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
                               "invalid server name or wildcard \"%V\" on %V",
                               &name[n].name, &addr->opt.addr_text);
-                return NGX_ERROR;
+                goto failed;
             }
 
             if (rc == NGX_BUSY) {
@@ -1714,7 +1751,6 @@ ngx_http_add_listening(ngx_conf_t *cf, ngx_http_conf_addr_t *addr)
 
     cscf = addr->default_server;
     ls->pool_size = cscf->connection_pool_size;
-    ls->post_accept_timeout = cscf->client_header_timeout;
 
     clcf = cscf->ctx->loc_conf[ngx_http_core_module.ctx_index];
 
diff --git a/src/http/ngx_http_cache.h b/src/http/ngx_http_cache.h
index f9e96640..bb936c5f 100644
--- a/src/http/ngx_http_cache.h
+++ b/src/http/ngx_http_cache.h
@@ -80,6 +80,7 @@ struct ngx_http_cache_s {
     ngx_str_t                        vary;
     u_char                           variant[NGX_HTTP_CACHE_KEY_LEN];
 
+    size_t                           buffer_size;
     size_t                           header_start;
     size_t                           body_start;
     off_t                            length;
@@ -116,6 +117,7 @@ struct ngx_http_cache_s {
     unsigned                         purged:1;
     unsigned                         reading:1;
     unsigned                         secondary:1;
+    unsigned                         update_variant:1;
     unsigned                         background:1;
 
     unsigned                         stale_updating:1;
@@ -160,6 +162,7 @@ struct ngx_http_file_cache_s {
 
     ngx_path_t                      *path;
 
+    off_t                            min_free;
     off_t                            max_size;
     size_t                           bsize;
 
diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index cb49ef74..bad43ea5 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -21,6 +21,9 @@ typedef struct {
 #define NGX_HTTP_REQUEST_BODY_FILE_CLEAN  2
 
 
+static ngx_int_t ngx_http_core_auth_delay(ngx_http_request_t *r);
+static void ngx_http_core_auth_delay_handler(ngx_http_request_t *r);
+
 static ngx_int_t ngx_http_core_find_location(ngx_http_request_t *r);
 static ngx_int_t ngx_http_core_find_static_location(ngx_http_request_t *r,
     ngx_http_location_tree_node_t *node);
@@ -479,7 +482,7 @@ static ngx_command_t  ngx_http_core_commands[] = {
     { ngx_string("limit_rate"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF
                         |NGX_CONF_TAKE1,
-      ngx_conf_set_size_slot,
+      ngx_http_set_complex_value_size_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_core_loc_conf_t, limit_rate),
       NULL },
@@ -487,11 +490,18 @@ static ngx_command_t  ngx_http_core_commands[] = {
     { ngx_string("limit_rate_after"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF
                         |NGX_CONF_TAKE1,
-      ngx_conf_set_size_slot,
+      ngx_http_set_complex_value_size_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_core_loc_conf_t, limit_rate_after),
       NULL },
 
+    { ngx_string("keepalive_time"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_msec_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_core_loc_conf_t, keepalive_time),
+      NULL },
+
     { ngx_string("keepalive_timeout"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE12,
       ngx_http_core_keepalive,
@@ -520,6 +530,13 @@ static ngx_command_t  ngx_http_core_commands[] = {
       offsetof(ngx_http_core_loc_conf_t, satisfy),
       &ngx_http_core_satisfy },
 
+    { ngx_string("auth_delay"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_msec_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_core_loc_conf_t, auth_delay),
+      NULL },
+
     { ngx_string("internal"),
       NGX_HTTP_LOC_CONF|NGX_CONF_NOARGS,
       ngx_http_core_internal,
@@ -993,10 +1010,10 @@ ngx_http_core_find_config_phase(ngx_http_request_t *r,
         ngx_str_set(&r->headers_out.location->key, "Location");
 
         if (r->args.len == 0) {
-            r->headers_out.location->value = clcf->name;
+            r->headers_out.location->value = clcf->escaped_name;
 
         } else {
-            len = clcf->name.len + 1 + r->args.len;
+            len = clcf->escaped_name.len + 1 + r->args.len;
             p = ngx_pnalloc(r->pool, len);
 
             if (p == NULL) {
@@ -1008,7 +1025,7 @@ ngx_http_core_find_config_phase(ngx_http_request_t *r,
             r->headers_out.location->value.len = len;
             r->headers_out.location->value.data = p;
 
-            p = ngx_cpymem(p, clcf->name.data, clcf->name.len);
+            p = ngx_cpymem(p, clcf->escaped_name.data, clcf->escaped_name.len);
             *p++ = '?';
             ngx_memcpy(p, r->args.data, r->args.len);
         }
@@ -1124,6 +1141,10 @@ ngx_http_core_access_phase(ngx_http_request_t *r, ngx_http_phase_handler_t *ph)
 
     /* rc == NGX_ERROR || rc == NGX_HTTP_...  */
 
+    if (rc == NGX_HTTP_UNAUTHORIZED) {
+        return ngx_http_core_auth_delay(r);
+    }
+
     ngx_http_finalize_request(r, rc);
     return NGX_OK;
 }
@@ -1141,12 +1162,17 @@ ngx_http_core_post_access_phase(ngx_http_request_t *r,
     access_code = r->access_code;
 
     if (access_code) {
+        r->access_code = 0;
+
         if (access_code == NGX_HTTP_FORBIDDEN) {
             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                           "access forbidden by rule");
         }
 
-        r->access_code = 0;
+        if (access_code == NGX_HTTP_UNAUTHORIZED) {
+            return ngx_http_core_auth_delay(r);
+        }
+
         ngx_http_finalize_request(r, access_code);
         return NGX_OK;
     }
@@ -1156,6 +1182,70 @@ ngx_http_core_post_access_phase(ngx_http_request_t *r,
 }
 
 
+static ngx_int_t
+ngx_http_core_auth_delay(ngx_http_request_t *r)
+{
+    ngx_http_core_loc_conf_t  *clcf;
+
+    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
+
+    if (clcf->auth_delay == 0) {
+        ngx_http_finalize_request(r, NGX_HTTP_UNAUTHORIZED);
+        return NGX_OK;
+    }
+
+    ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                  "delaying unauthorized request");
+
+    if (r->connection->read->ready) {
+        ngx_post_event(r->connection->read, &ngx_posted_events);
+
+    } else {
+        if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
+            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        }
+    }
+
+    r->read_event_handler = ngx_http_test_reading;
+    r->write_event_handler = ngx_http_core_auth_delay_handler;
+
+    r->connection->write->delayed = 1;
+    ngx_add_timer(r->connection->write, clcf->auth_delay);
+
+    /*
+     * trigger an additional event loop iteration
+     * to ensure constant-time processing
+     */
+
+    ngx_post_event(r->connection->write, &ngx_posted_next_events);
+
+    return NGX_OK;
+}
+
+
+static void
+ngx_http_core_auth_delay_handler(ngx_http_request_t *r)
+{
+    ngx_event_t  *wev;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   "auth delay handler");
+
+    wev = r->connection->write;
+
+    if (wev->delayed) {
+
+        if (ngx_handle_write_event(wev, 0) != NGX_OK) {
+            ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+        }
+
+        return;
+    }
+
+    ngx_http_finalize_request(r, NGX_HTTP_UNAUTHORIZED);
+}
+
+
 ngx_int_t
 ngx_http_core_content_phase(ngx_http_request_t *r,
     ngx_http_phase_handler_t *ph)
@@ -1252,6 +1342,11 @@ ngx_http_update_location_config(ngx_http_request_t *r)
         } else if (r->connection->requests >= clcf->keepalive_requests) {
             r->keepalive = 0;
 
+        } else if (ngx_current_msec - r->connection->start_time
+                   > clcf->keepalive_time)
+        {
+            r->keepalive = 0;
+
         } else if (r->headers_in.msie6
                    && r->method == NGX_HTTP_POST
                    && (clcf->keepalive_disable
@@ -1281,10 +1376,6 @@ ngx_http_update_location_config(ngx_http_request_t *r)
         r->connection->tcp_nopush = NGX_TCP_NOPUSH_DISABLED;
     }
 
-    if (r->limit_rate == 0) {
-        r->limit_rate = clcf->limit_rate;
-    }
-
     if (clcf->handler) {
         r->content_handler = clcf->handler;
     }
@@ -1664,8 +1755,10 @@ ngx_http_send_response(ngx_http_request_t *r, ngx_uint_t status,
     ngx_buf_t    *b;
     ngx_chain_t   out;
 
-    if (ngx_http_discard_request_body(r) != NGX_OK) {
-        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    rc = ngx_http_discard_request_body(r);
+
+    if (rc != NGX_OK) {
+        return rc;
     }
 
     r->headers_out.status = status;
@@ -1706,7 +1799,7 @@ ngx_http_send_response(ngx_http_request_t *r, ngx_uint_t status,
         }
     }
 
-    if (r->method == NGX_HTTP_HEAD || (r != r->main && val.len == 0)) {
+    if (r != r->main && val.len == 0) {
         return ngx_http_send_header(r);
     }
 
@@ -1845,7 +1938,8 @@ ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,
         }
     }
 
-    last = ngx_cpystrn(last, r->uri.data + alias, r->uri.len - alias + 1);
+    last = ngx_copy(last, r->uri.data + alias, r->uri.len - alias);
+    *last = '\0';
 
     return last;
 }
@@ -2668,43 +2762,41 @@ ngx_http_get_forwarded_addr_internal(ngx_http_request_t *r, ngx_addr_t *addr,
     u_char *xff, size_t xfflen, ngx_array_t *proxies, int recursive)
 {
     u_char      *p;
-    ngx_int_t    rc;
     ngx_addr_t   paddr;
+    ngx_uint_t   found;
 
-    if (ngx_cidr_match(addr->sockaddr, proxies) != NGX_OK) {
-        return NGX_DECLINED;
-    }
+    found = 0;
 
-    for (p = xff + xfflen - 1; p > xff; p--, xfflen--) {
-        if (*p != ' ' && *p != ',') {
-            break;
-        }
-    }
+    do {
 
-    for ( /* void */ ; p > xff; p--) {
-        if (*p == ' ' || *p == ',') {
-            p++;
-            break;
+        if (ngx_cidr_match(addr->sockaddr, proxies) != NGX_OK) {
+            return found ? NGX_DONE : NGX_DECLINED;
         }
-    }
-
-    if (ngx_parse_addr_port(r->pool, &paddr, p, xfflen - (p - xff)) != NGX_OK) {
-        return NGX_DECLINED;
-    }
 
-    *addr = paddr;
+        for (p = xff + xfflen - 1; p > xff; p--, xfflen--) {
+            if (*p != ' ' && *p != ',') {
+                break;
+            }
+        }
 
-    if (recursive && p > xff) {
-        rc = ngx_http_get_forwarded_addr_internal(r, addr, xff, p - 1 - xff,
-                                                  proxies, 1);
+        for ( /* void */ ; p > xff; p--) {
+            if (*p == ' ' || *p == ',') {
+                p++;
+                break;
+            }
+        }
 
-        if (rc == NGX_DECLINED) {
-            return NGX_DONE;
+        if (ngx_parse_addr_port(r->pool, &paddr, p, xfflen - (p - xff))
+            != NGX_OK)
+        {
+            return found ? NGX_DONE : NGX_DECLINED;
         }
 
-        /* rc == NGX_OK || rc == NGX_DONE  */
-        return rc;
-    }
+        *addr = paddr;
+        found = 1;
+        xfflen = p - 1 - xff;
+
+    } while (recursive && p > xff);
 
     return NGX_OK;
 }
@@ -3375,6 +3467,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
     /*
      * set by ngx_pcalloc():
      *
+     *     clcf->escaped_name = { 0, NULL };
      *     clcf->root = { 0, NULL };
      *     clcf->limit_except = 0;
      *     clcf->post_action = { 0, NULL };
@@ -3395,6 +3488,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
     clcf->client_body_buffer_size = NGX_CONF_UNSET_SIZE;
     clcf->client_body_timeout = NGX_CONF_UNSET_MSEC;
     clcf->satisfy = NGX_CONF_UNSET_UINT;
+    clcf->auth_delay = NGX_CONF_UNSET_MSEC;
     clcf->if_modified_since = NGX_CONF_UNSET_UINT;
     clcf->max_ranges = NGX_CONF_UNSET_UINT;
     clcf->client_body_in_file_only = NGX_CONF_UNSET_UINT;
@@ -3417,8 +3511,9 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
     clcf->send_timeout = NGX_CONF_UNSET_MSEC;
     clcf->send_lowat = NGX_CONF_UNSET_SIZE;
     clcf->postpone_output = NGX_CONF_UNSET_SIZE;
-    clcf->limit_rate = NGX_CONF_UNSET_SIZE;
-    clcf->limit_rate_after = NGX_CONF_UNSET_SIZE;
+    clcf->limit_rate = NGX_CONF_UNSET_PTR;
+    clcf->limit_rate_after = NGX_CONF_UNSET_PTR;
+    clcf->keepalive_time = NGX_CONF_UNSET_MSEC;
     clcf->keepalive_timeout = NGX_CONF_UNSET_MSEC;
     clcf->keepalive_header = NGX_CONF_UNSET;
     clcf->keepalive_requests = NGX_CONF_UNSET_UINT;
@@ -3612,6 +3707,7 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
                                |NGX_HTTP_KEEPALIVE_DISABLE_MSIE6));
     ngx_conf_merge_uint_value(conf->satisfy, prev->satisfy,
                               NGX_HTTP_SATISFY_ALL);
+    ngx_conf_merge_msec_value(conf->auth_delay, prev->auth_delay, 0);
     ngx_conf_merge_uint_value(conf->if_modified_since, prev->if_modified_since,
                               NGX_HTTP_IMS_EXACT);
     ngx_conf_merge_uint_value(conf->max_ranges, prev->max_ranges,
@@ -3647,15 +3743,19 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_size_value(conf->send_lowat, prev->send_lowat, 0);
     ngx_conf_merge_size_value(conf->postpone_output, prev->postpone_output,
                               1460);
-    ngx_conf_merge_size_value(conf->limit_rate, prev->limit_rate, 0);
-    ngx_conf_merge_size_value(conf->limit_rate_after, prev->limit_rate_after,
-                              0);
+
+    ngx_conf_merge_ptr_value(conf->limit_rate, prev->limit_rate, NULL);
+    ngx_conf_merge_ptr_value(conf->limit_rate_after,
+                              prev->limit_rate_after, NULL);
+
+    ngx_conf_merge_msec_value(conf->keepalive_time,
+                              prev->keepalive_time, 3600000);
     ngx_conf_merge_msec_value(conf->keepalive_timeout,
                               prev->keepalive_timeout, 75000);
     ngx_conf_merge_sec_value(conf->keepalive_header,
                               prev->keepalive_header, 0);
     ngx_conf_merge_uint_value(conf->keepalive_requests,
-                              prev->keepalive_requests, 100);
+                              prev->keepalive_requests, 1000);
     ngx_conf_merge_uint_value(conf->lingering_close,
                               prev->lingering_close, NGX_HTTP_LINGERING_ON);
     ngx_conf_merge_msec_value(conf->lingering_time,
@@ -3995,14 +4095,6 @@ ngx_http_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 #endif
         }
 
-        if (ngx_strcmp(value[n].data, "spdy") == 0) {
-            ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
-                               "invalid parameter \"spdy\": "
-                               "ngx_http_spdy_module was superseded "
-                               "by ngx_http_v2_module");
-            continue;
-        }
-
         if (ngx_strncmp(value[n].data, "so_keepalive=", 13) == 0) {
 
             if (ngx_strcmp(&value[n].data[13], "on") == 0) {
@@ -4684,6 +4776,7 @@ ngx_http_core_error_page(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
                 case NGX_HTTP_TO_HTTPS:
                 case NGX_HTTPS_CERT_ERROR:
                 case NGX_HTTPS_NO_CERT:
+                case NGX_HTTP_REQUEST_HEADER_TOO_LARGE:
                     err->overwrite = NGX_HTTP_BAD_REQUEST;
             }
         }
diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h
index 85f6d66d..002d4193 100644
--- a/src/http/ngx_http_core_module.h
+++ b/src/http/ngx_http_core_module.h
@@ -299,6 +299,7 @@ typedef struct {
 
 struct ngx_http_core_loc_conf_s {
     ngx_str_t     name;          /* location name */
+    ngx_str_t     escaped_name;
 
 #if (NGX_PCRE)
     ngx_http_regex_t  *regex;
@@ -349,19 +350,22 @@ struct ngx_http_core_loc_conf_s {
     size_t        client_body_buffer_size; /* client_body_buffer_size */
     size_t        send_lowat;              /* send_lowat */
     size_t        postpone_output;         /* postpone_output */
-    size_t        limit_rate;              /* limit_rate */
-    size_t        limit_rate_after;        /* limit_rate_after */
     size_t        sendfile_max_chunk;      /* sendfile_max_chunk */
     size_t        read_ahead;              /* read_ahead */
     size_t        subrequest_output_buffer_size;
                                            /* subrequest_output_buffer_size */
 
+    ngx_http_complex_value_t  *limit_rate; /* limit_rate */
+    ngx_http_complex_value_t  *limit_rate_after; /* limit_rate_after */
+
     ngx_msec_t    client_body_timeout;     /* client_body_timeout */
     ngx_msec_t    send_timeout;            /* send_timeout */
+    ngx_msec_t    keepalive_time;          /* keepalive_time */
     ngx_msec_t    keepalive_timeout;       /* keepalive_timeout */
     ngx_msec_t    lingering_time;          /* lingering_time */
     ngx_msec_t    lingering_timeout;       /* lingering_timeout */
     ngx_msec_t    resolver_timeout;        /* resolver_timeout */
+    ngx_msec_t    auth_delay;              /* auth_delay */
 
     ngx_resolver_t  *resolver;             /* resolver */
 
diff --git a/src/http/ngx_http_file_cache.c b/src/http/ngx_http_file_cache.c
index ecdf11e2..c40093bc 100644
--- a/src/http/ngx_http_file_cache.c
+++ b/src/http/ngx_http_file_cache.c
@@ -294,6 +294,8 @@ ngx_http_file_cache_open(ngx_http_request_t *r)
         cln->data = c;
     }
 
+    c->buffer_size = c->body_start;
+
     rc = ngx_http_file_cache_exists(cache, c);
 
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
@@ -852,7 +854,7 @@ ngx_http_file_cache_exists(ngx_http_file_cache_t *cache, ngx_http_cache_t *c)
         if (fcn->exists || fcn->uses >= c->min_uses) {
 
             c->exists = fcn->exists;
-            if (fcn->body_start) {
+            if (fcn->body_start && !c->update_variant) {
                 c->body_start = fcn->body_start;
             }
 
@@ -1230,7 +1232,7 @@ ngx_http_file_cache_reopen(ngx_http_request_t *r, ngx_http_cache_t *c)
 
     c->secondary = 1;
     c->file.name.len = 0;
-    c->body_start = c->buf->end - c->buf->start;
+    c->body_start = c->buffer_size;
 
     ngx_memcpy(c->key, c->variant, NGX_HTTP_CACHE_KEY_LEN);
 
@@ -1337,6 +1339,7 @@ ngx_http_file_cache_update_variant(ngx_http_request_t *r, ngx_http_cache_t *c)
     ngx_shmtx_unlock(&cache->shpool->mutex);
 
     c->file.name.len = 0;
+    c->update_variant = 1;
 
     ngx_memcpy(c->key, c->main, NGX_HTTP_CACHE_KEY_LEN);
 
@@ -1959,7 +1962,7 @@ ngx_http_file_cache_manager(void *data)
 {
     ngx_http_file_cache_t  *cache = data;
 
-    off_t       size;
+    off_t       size, free;
     time_t      wait;
     ngx_msec_t  elapsed, next;
     ngx_uint_t  count, watermark;
@@ -1988,7 +1991,19 @@ ngx_http_file_cache_manager(void *data)
                        size, count, (ngx_int_t) watermark);
 
         if (size < cache->max_size && count < watermark) {
-            break;
+
+            if (!cache->min_free) {
+                break;
+            }
+
+            free = ngx_fs_available(cache->path->name.data);
+
+            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
+                           "http file cache free: %O", free);
+
+            if (free > cache->min_free) {
+                break;
+            }
         }
 
         wait = ngx_http_file_cache_forced_expire(cache);
@@ -2304,7 +2319,7 @@ ngx_http_file_cache_set_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 {
     char  *confp = conf;
 
-    off_t                   max_size;
+    off_t                   max_size, min_free;
     u_char                 *last, *p;
     time_t                  inactive;
     ssize_t                 size;
@@ -2341,6 +2356,7 @@ ngx_http_file_cache_set_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     name.len = 0;
     size = 0;
     max_size = NGX_MAX_OFF_T_VALUE;
+    min_free = 0;
 
     value = cf->args->elts;
 
@@ -2476,6 +2492,29 @@ ngx_http_file_cache_set_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
             continue;
         }
 
+        if (ngx_strncmp(value[i].data, "min_free=", 9) == 0) {
+
+#if (NGX_WIN32 || NGX_HAVE_STATFS || NGX_HAVE_STATVFS)
+
+            s.len = value[i].len - 9;
+            s.data = value[i].data + 9;
+
+            min_free = ngx_parse_offset(&s);
+            if (min_free < 0) {
+                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                   "invalid min_free value \"%V\"", &value[i]);
+                return NGX_CONF_ERROR;
+            }
+
+#else
+            ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
+                               "min_free is not supported "
+                               "on this platform, ignored");
+#endif
+
+            continue;
+        }
+
         if (ngx_strncmp(value[i].data, "loader_files=", 13) == 0) {
 
             loader_files = ngx_atoi(value[i].data + 13, value[i].len - 13);
@@ -2607,6 +2646,7 @@ ngx_http_file_cache_set_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     cache->inactive = inactive;
     cache->max_size = max_size;
+    cache->min_free = min_free;
 
     caches = (ngx_array_t *) (confp + cmd->offset);
 
diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index d9a1dbed..20ad89a7 100644
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -380,6 +380,12 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
                 r->uri_start = p;
                 state = sw_after_slash_in_uri;
                 break;
+            case '?':
+                r->uri_start = p;
+                r->args_start = p + 1;
+                r->empty_path_in_uri = 1;
+                state = sw_uri;
+                break;
             case ' ':
                 /*
                  * use single "/" from request line to preserve pointers,
@@ -446,6 +452,13 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
                 r->uri_start = p;
                 state = sw_after_slash_in_uri;
                 break;
+            case '?':
+                r->port_end = p;
+                r->uri_start = p;
+                r->args_start = p + 1;
+                r->empty_path_in_uri = 1;
+                state = sw_uri;
+                break;
             case ' ':
                 r->port_end = p;
                 /*
@@ -912,6 +925,8 @@ ngx_http_parse_header_line(ngx_http_request_t *r, ngx_buf_t *b,
                         i = 1;
 
                     } else {
+                        hash = 0;
+                        i = 0;
                         r->invalid_header = 1;
                     }
 
@@ -922,6 +937,8 @@ ngx_http_parse_header_line(ngx_http_request_t *r, ngx_buf_t *b,
                     return NGX_HTTP_PARSE_INVALID_HEADER;
                 }
 
+                hash = 0;
+                i = 0;
                 r->invalid_header = 1;
 
                 break;
@@ -1283,6 +1300,10 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
     r->uri_ext = NULL;
     r->args_start = NULL;
 
+    if (r->empty_path_in_uri) {
+        *u++ = '/';
+    }
+
     ch = *p++;
 
     while (p <= r->uri_end) {
@@ -1437,9 +1458,11 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
                 state = sw_quoted;
                 break;
             case '?':
+                u--;
                 r->args_start = p;
                 goto args;
             case '#':
+                u--;
                 goto done;
             case '+':
                 r->plus_in_uri = 1;
@@ -1467,8 +1490,9 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
             case '\\':
 #endif
             case '/':
-                state = sw_slash;
-                u -= 5;
+            case '?':
+            case '#':
+                u -= 4;
                 for ( ;; ) {
                     if (u < r->uri.data) {
                         return NGX_HTTP_PARSE_INVALID_REQUEST;
@@ -1479,16 +1503,19 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
                     }
                     u--;
                 }
+                if (ch == '?') {
+                    r->args_start = p;
+                    goto args;
+                }
+                if (ch == '#') {
+                    goto done;
+                }
+                state = sw_slash;
                 break;
             case '%':
                 quoted_state = state;
                 state = sw_quoted;
                 break;
-            case '?':
-                r->args_start = p;
-                goto args;
-            case '#':
-                goto done;
             case '+':
                 r->plus_in_uri = 1;
                 /* fall through */
@@ -1561,6 +1588,30 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
         }
     }
 
+    if (state == sw_quoted || state == sw_quoted_second) {
+        return NGX_HTTP_PARSE_INVALID_REQUEST;
+    }
+
+    if (state == sw_dot) {
+        u--;
+
+    } else if (state == sw_dot_dot) {
+        u -= 4;
+
+        for ( ;; ) {
+            if (u < r->uri.data) {
+                return NGX_HTTP_PARSE_INVALID_REQUEST;
+            }
+
+            if (*u == '/') {
+                u++;
+                break;
+            }
+
+            u--;
+        }
+    }
+
 done:
 
     r->uri.len = u - r->uri.data;
@@ -2268,6 +2319,9 @@ ngx_http_parse_chunked(ngx_http_request_t *r, ngx_buf_t *b,
                 break;
             case LF:
                 state = sw_chunk_start;
+                break;
+            default:
+                goto invalid;
             }
             break;
 
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 80c19656..81b27a38 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -49,7 +49,7 @@ static void ngx_http_request_finalizer(ngx_http_request_t *r);
 
 static void ngx_http_set_keepalive(ngx_http_request_t *r);
 static void ngx_http_keepalive_handler(ngx_event_t *ev);
-static void ngx_http_set_lingering_close(ngx_http_request_t *r);
+static void ngx_http_set_lingering_close(ngx_connection_t *c);
 static void ngx_http_lingering_close_handler(ngx_event_t *ev);
 static ngx_int_t ngx_http_post_action(ngx_http_request_t *r);
 static void ngx_http_close_request(ngx_http_request_t *r, ngx_int_t error);
@@ -131,7 +131,7 @@ ngx_http_header_t  ngx_http_headers_in[] = {
 
     { ngx_string("Transfer-Encoding"),
                  offsetof(ngx_http_headers_in_t, transfer_encoding),
-                 ngx_http_process_header_line },
+                 ngx_http_process_unique_header_line },
 
     { ngx_string("TE"),
                  offsetof(ngx_http_headers_in_t, te),
@@ -206,16 +206,17 @@ ngx_http_header_t  ngx_http_headers_in[] = {
 void
 ngx_http_init_connection(ngx_connection_t *c)
 {
-    ngx_uint_t              i;
-    ngx_event_t            *rev;
-    struct sockaddr_in     *sin;
-    ngx_http_port_t        *port;
-    ngx_http_in_addr_t     *addr;
-    ngx_http_log_ctx_t     *ctx;
-    ngx_http_connection_t  *hc;
+    ngx_uint_t                 i;
+    ngx_event_t               *rev;
+    struct sockaddr_in        *sin;
+    ngx_http_port_t           *port;
+    ngx_http_in_addr_t        *addr;
+    ngx_http_log_ctx_t        *ctx;
+    ngx_http_connection_t     *hc;
+    ngx_http_core_srv_conf_t  *cscf;
 #if (NGX_HAVE_INET6)
-    struct sockaddr_in6    *sin6;
-    ngx_http_in6_addr_t    *addr6;
+    struct sockaddr_in6       *sin6;
+    ngx_http_in6_addr_t       *addr6;
 #endif
 
     hc = ngx_pcalloc(c->pool, sizeof(ngx_http_connection_t));
@@ -361,7 +362,9 @@ ngx_http_init_connection(ngx_connection_t *c)
         return;
     }
 
-    ngx_add_timer(rev, c->listening->post_accept_timeout);
+    cscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_core_module);
+
+    ngx_add_timer(rev, cscf->client_header_timeout);
     ngx_reusable_connection(c, 1);
 
     if (ngx_handle_read_event(rev, 0) != NGX_OK) {
@@ -431,7 +434,7 @@ ngx_http_wait_request_handler(ngx_event_t *rev)
     if (n == NGX_AGAIN) {
 
         if (!rev->timer_set) {
-            ngx_add_timer(rev, c->listening->post_accept_timeout);
+            ngx_add_timer(rev, cscf->client_header_timeout);
             ngx_reusable_connection(c, 1);
         }
 
@@ -649,6 +652,7 @@ ngx_http_ssl_handshake(ngx_event_t *rev)
     ngx_http_connection_t     *hc;
     ngx_http_ssl_srv_conf_t   *sscf;
     ngx_http_core_loc_conf_t  *clcf;
+    ngx_http_core_srv_conf_t  *cscf;
 
     c = rev->data;
     hc = c->data;
@@ -680,7 +684,9 @@ ngx_http_ssl_handshake(ngx_event_t *rev)
             rev->ready = 0;
 
             if (!rev->timer_set) {
-                ngx_add_timer(rev, c->listening->post_accept_timeout);
+                cscf = ngx_http_get_module_srv_conf(hc->conf_ctx,
+                                                    ngx_http_core_module);
+                ngx_add_timer(rev, cscf->client_header_timeout);
                 ngx_reusable_connection(c, 1);
             }
 
@@ -748,16 +754,18 @@ ngx_http_ssl_handshake(ngx_event_t *rev)
                 return;
             }
 
+            ngx_reusable_connection(c, 0);
+
             rc = ngx_ssl_handshake(c);
 
             if (rc == NGX_AGAIN) {
 
                 if (!rev->timer_set) {
-                    ngx_add_timer(rev, c->listening->post_accept_timeout);
+                    cscf = ngx_http_get_module_srv_conf(hc->conf_ctx,
+                                                        ngx_http_core_module);
+                    ngx_add_timer(rev, cscf->client_header_timeout);
                 }
 
-                ngx_reusable_connection(c, 0);
-
                 c->ssl->handler = ngx_http_ssl_handshake_handler;
                 return;
             }
@@ -871,10 +879,14 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
         return SSL_TLSEXT_ERR_ALERT_FATAL;
     }
 
+    hc = c->data;
+
     servername = SSL_get_servername(ssl_conn, TLSEXT_NAMETYPE_host_name);
 
     if (servername == NULL) {
-        return SSL_TLSEXT_ERR_OK;
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                       "SSL server name: null");
+        goto done;
     }
 
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
@@ -883,7 +895,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
     host.len = ngx_strlen(servername);
 
     if (host.len == 0) {
-        return SSL_TLSEXT_ERR_OK;
+        goto done;
     }
 
     host.data = (u_char *) servername;
@@ -891,32 +903,27 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
     rc = ngx_http_validate_host(&host, c->pool, 1);
 
     if (rc == NGX_ERROR) {
-        *ad = SSL_AD_INTERNAL_ERROR;
-        return SSL_TLSEXT_ERR_ALERT_FATAL;
+        goto error;
     }
 
     if (rc == NGX_DECLINED) {
-        return SSL_TLSEXT_ERR_OK;
+        goto done;
     }
 
-    hc = c->data;
-
     rc = ngx_http_find_virtual_server(c, hc->addr_conf->virtual_names, &host,
                                       NULL, &cscf);
 
     if (rc == NGX_ERROR) {
-        *ad = SSL_AD_INTERNAL_ERROR;
-        return SSL_TLSEXT_ERR_ALERT_FATAL;
+        goto error;
     }
 
     if (rc == NGX_DECLINED) {
-        return SSL_TLSEXT_ERR_OK;
+        goto done;
     }
 
     hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t));
     if (hc->ssl_servername == NULL) {
-        *ad = SSL_AD_INTERNAL_ERROR;
-        return SSL_TLSEXT_ERR_ALERT_FATAL;
+        goto error;
     }
 
     *hc->ssl_servername = host;
@@ -932,7 +939,9 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
     c->ssl->buffer_size = sscf->buffer_size;
 
     if (sscf->ssl.ctx) {
-        SSL_set_SSL_CTX(ssl_conn, sscf->ssl.ctx);
+        if (SSL_set_SSL_CTX(ssl_conn, sscf->ssl.ctx) == NULL) {
+            goto error;
+        }
 
         /*
          * SSL_set_SSL_CTX() only changes certs as of 1.0.0d
@@ -957,7 +966,22 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
 #endif
     }
 
+done:
+
+    sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
+
+    if (sscf->reject_handshake) {
+        c->ssl->handshake_rejected = 1;
+        *ad = SSL_AD_UNRECOGNIZED_NAME;
+        return SSL_TLSEXT_ERR_ALERT_FATAL;
+    }
+
     return SSL_TLSEXT_ERR_OK;
+
+error:
+
+    *ad = SSL_AD_INTERNAL_ERROR;
+    return SSL_TLSEXT_ERR_ALERT_FATAL;
 }
 
 #endif
@@ -1019,12 +1043,14 @@ ngx_http_ssl_certificate(ngx_ssl_conn_t *ssl_conn, void *arg)
     }
 
     ngx_http_free_request(r, 0);
+    c->log->action = "SSL handshaking";
     c->destroyed = 0;
     return 1;
 
 failed:
 
     ngx_http_free_request(r, 0);
+    c->log->action = "SSL handshaking";
     c->destroyed = 0;
     return 0;
 }
@@ -1208,9 +1234,13 @@ ngx_http_process_request_uri(ngx_http_request_t *r)
         r->uri.len = r->uri_end - r->uri_start;
     }
 
-    if (r->complex_uri || r->quoted_uri) {
+    if (r->complex_uri || r->quoted_uri || r->empty_path_in_uri) {
 
-        r->uri.data = ngx_pnalloc(r->pool, r->uri.len + 1);
+        if (r->empty_path_in_uri) {
+            r->uri.len++;
+        }
+
+        r->uri.data = ngx_pnalloc(r->pool, r->uri.len);
         if (r->uri.data == NULL) {
             ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
             return NGX_ERROR;
@@ -1234,7 +1264,7 @@ ngx_http_process_request_uri(ngx_http_request_t *r)
     r->unparsed_uri.len = r->uri_end - r->uri_start;
     r->unparsed_uri.data = r->uri_start;
 
-    r->valid_unparsed_uri = r->space_in_uri ? 0 : 1;
+    r->valid_unparsed_uri = (r->space_in_uri || r->empty_path_in_uri) ? 0 : 1;
 
     if (r->uri_ext) {
         if (r->args_start) {
@@ -1647,6 +1677,12 @@ ngx_http_alloc_large_header_buffer(ngx_http_request_t *r,
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                    "http large header copy: %uz", r->header_in->pos - old);
 
+    if (r->header_in->pos - old > b->end - b->start) {
+        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
+                      "too large header to copy");
+        return NGX_ERROR;
+    }
+
     new = b->start;
 
     ngx_memcpy(new, old, r->header_in->pos - old);
@@ -1755,10 +1791,18 @@ ngx_http_process_host(ngx_http_request_t *r, ngx_table_elt_t *h,
     ngx_int_t  rc;
     ngx_str_t  host;
 
-    if (r->headers_in.host == NULL) {
-        r->headers_in.host = h;
+    if (r->headers_in.host) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent duplicate host header: \"%V: %V\", "
+                      "previous value: \"%V: %V\"",
+                      &h->key, &h->value, &r->headers_in.host->key,
+                      &r->headers_in.host->value);
+        ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
+        return NGX_ERROR;
     }
 
+    r->headers_in.host = h;
+
     host = h->value;
 
     rc = ngx_http_validate_host(&host, r->pool, 0);
@@ -1952,10 +1996,7 @@ ngx_http_process_request_header(ngx_http_request_t *r)
             r->headers_in.content_length_n = -1;
             r->headers_in.chunked = 1;
 
-        } else if (r->headers_in.transfer_encoding->value.len != 8
-            || ngx_strncasecmp(r->headers_in.transfer_encoding->value.data,
-                               (u_char *) "identity", 8) != 0)
-        {
+        } else {
             ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                           "client sent unknown \"Transfer-Encoding\": \"%V\"",
                           &r->headers_in.transfer_encoding->value);
@@ -1988,6 +2029,7 @@ ngx_http_process_request(ngx_http_request_t *r)
     if (r->http_connection->ssl) {
         long                      rc;
         X509                     *cert;
+        const char               *s;
         ngx_http_ssl_srv_conf_t  *sscf;
 
         if (c->ssl == NULL) {
@@ -2032,6 +2074,17 @@ ngx_http_process_request(ngx_http_request_t *r)
 
                 X509_free(cert);
             }
+
+            if (ngx_ssl_ocsp_get_status(c, &s) != NGX_OK) {
+                ngx_log_error(NGX_LOG_INFO, c->log, 0,
+                              "client SSL certificate verify error: %s", s);
+
+                ngx_ssl_remove_cached_session(c->ssl->session_ctx,
+                                       (SSL_get0_session(c->ssl->connection)));
+
+                ngx_http_finalize_request(r, NGX_HTTPS_CERT_ERROR);
+                return;
+            }
         }
     }
 
@@ -2483,26 +2536,6 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
     }
 
     if (r != r->main) {
-        clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
-
-        if (r->background) {
-            if (!r->logged) {
-                if (clcf->log_subrequest) {
-                    ngx_http_log_request(r);
-                }
-
-                r->logged = 1;
-
-            } else {
-                ngx_log_error(NGX_LOG_ALERT, c->log, 0,
-                              "subrequest: \"%V?%V\" logged again",
-                              &r->uri, &r->args);
-            }
-
-            r->done = 1;
-            ngx_http_finalize_connection(r);
-            return;
-        }
 
         if (r->buffered || r->postponed) {
 
@@ -2515,11 +2548,12 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
 
         pr = r->parent;
 
-        if (r == c->data) {
-
-            r->main->count--;
+        if (r == c->data || r->background) {
 
             if (!r->logged) {
+
+                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
+
                 if (clcf->log_subrequest) {
                     ngx_http_log_request(r);
                 }
@@ -2534,6 +2568,13 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
 
             r->done = 1;
 
+            if (r->background) {
+                ngx_http_finalize_connection(r);
+                return;
+            }
+
+            r->main->count--;
+
             if (pr->postponed && pr->postponed->request == r) {
                 pr->postponed = pr->postponed->next;
             }
@@ -2604,11 +2645,6 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
         ngx_del_timer(c->write);
     }
 
-    if (c->read->eof) {
-        ngx_http_close_request(r, 0);
-        return;
-    }
-
     ngx_http_finalize_connection(r);
 }
 
@@ -2707,6 +2743,11 @@ ngx_http_finalize_connection(ngx_http_request_t *r)
 
     r = r->main;
 
+    if (r->connection->read->eof) {
+        ngx_http_close_request(r, 0);
+        return;
+    }
+
     if (r->reading_body) {
         r->keepalive = 0;
         r->lingering_close = 1;
@@ -2727,7 +2768,7 @@ ngx_http_finalize_connection(ngx_http_request_t *r)
                 || r->header_in->pos < r->header_in->last
                 || r->connection->read->ready)))
     {
-        ngx_http_set_lingering_close(r);
+        ngx_http_set_lingering_close(r->connection);
         return;
     }
 
@@ -2981,6 +3022,12 @@ ngx_http_test_reading(ngx_http_request_t *r)
         rev->error = 1;
     }
 
+#if (NGX_HTTP_SSL)
+    if (c->ssl) {
+        c->ssl->no_send_shutdown = 1;
+    }
+#endif
+
     ngx_log_error(NGX_LOG_INFO, c->log, err,
                   "client prematurely closed connection");
 
@@ -3006,13 +3053,6 @@ ngx_http_set_keepalive(ngx_http_request_t *r)
 
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "set http keepalive handler");
 
-    if (r->discard_body) {
-        r->write_event_handler = ngx_http_request_empty_handler;
-        r->lingering_time = ngx_time() + (time_t) (clcf->lingering_time / 1000);
-        ngx_add_timer(rev, clcf->lingering_timeout);
-        return;
-    }
-
     c->log->action = "closing request";
 
     hc = r->http_connection;
@@ -3342,22 +3382,41 @@ ngx_http_keepalive_handler(ngx_event_t *rev)
 
 
 static void
-ngx_http_set_lingering_close(ngx_http_request_t *r)
+ngx_http_set_lingering_close(ngx_connection_t *c)
 {
     ngx_event_t               *rev, *wev;
-    ngx_connection_t          *c;
+    ngx_http_request_t        *r;
     ngx_http_core_loc_conf_t  *clcf;
 
-    c = r->connection;
+    r = c->data;
 
     clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
 
+    if (r->lingering_time == 0) {
+        r->lingering_time = ngx_time() + (time_t) (clcf->lingering_time / 1000);
+    }
+
+#if (NGX_HTTP_SSL)
+    if (c->ssl) {
+        ngx_int_t  rc;
+
+        rc = ngx_ssl_shutdown(c);
+
+        if (rc == NGX_ERROR) {
+            ngx_http_close_request(r, 0);
+            return;
+        }
+
+        if (rc == NGX_AGAIN) {
+            c->ssl->handler = ngx_http_set_lingering_close;
+            return;
+        }
+    }
+#endif
+
     rev = c->read;
     rev->handler = ngx_http_lingering_close_handler;
 
-    r->lingering_time = ngx_time() + (time_t) (clcf->lingering_time / 1000);
-    ngx_add_timer(rev, clcf->lingering_timeout);
-
     if (ngx_handle_read_event(rev, 0) != NGX_OK) {
         ngx_http_close_request(r, 0);
         return;
@@ -3380,6 +3439,11 @@ ngx_http_set_lingering_close(ngx_http_request_t *r)
         return;
     }
 
+    c->close = 0;
+    ngx_reusable_connection(c, 1);
+
+    ngx_add_timer(rev, clcf->lingering_timeout);
+
     if (rev->ready) {
         ngx_http_lingering_close_handler(rev);
     }
@@ -3402,7 +3466,7 @@ ngx_http_lingering_close_handler(ngx_event_t *rev)
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
                    "http lingering close handler");
 
-    if (rev->timedout) {
+    if (rev->timedout || c->close) {
         ngx_http_close_request(r, 0);
         return;
     }
diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h
index fce70efe..6dfb4a42 100644
--- a/src/http/ngx_http_request.h
+++ b/src/http/ngx_http_request.h
@@ -470,6 +470,9 @@ struct ngx_http_request_s {
     /* URI with " " */
     unsigned                          space_in_uri:1;
 
+    /* URI with empty path */
+    unsigned                          empty_path_in_uri:1;
+
     unsigned                          invalid_header:1;
 
     unsigned                          add_uri_to_alias:1;
@@ -510,10 +513,13 @@ struct ngx_http_request_s {
     /*
      * instead of using the request context data in
      * ngx_http_limit_conn_module and ngx_http_limit_req_module
-     * we use the single bits in the request structure
+     * we use the bit fields in the request structure
      */
-    unsigned                          limit_conn_set:1;
-    unsigned                          limit_req_set:1;
+    unsigned                          limit_conn_status:2;
+    unsigned                          limit_req_status:3;
+
+    unsigned                          limit_rate_set:1;
+    unsigned                          limit_rate_after_set:1;
 
 #if 0
     unsigned                          cacheable:1;
diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
index c4f092e5..0cae88f7 100644
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -12,6 +12,8 @@
 
 static void ngx_http_read_client_request_body_handler(ngx_http_request_t *r);
 static ngx_int_t ngx_http_do_read_client_request_body(ngx_http_request_t *r);
+static ngx_int_t ngx_http_copy_pipelined_header(ngx_http_request_t *r,
+    ngx_buf_t *buf);
 static ngx_int_t ngx_http_write_request_body(ngx_http_request_t *r);
 static ngx_int_t ngx_http_read_discarded_request_body(ngx_http_request_t *r);
 static ngx_int_t ngx_http_discard_request_body_filter(ngx_http_request_t *r,
@@ -135,8 +137,9 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
     } else {
         /* set rb->rest */
 
-        if (ngx_http_request_body_filter(r, NULL) != NGX_OK) {
-            rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+        rc = ngx_http_request_body_filter(r, NULL);
+
+        if (rc != NGX_OK) {
             goto done;
         }
     }
@@ -282,28 +285,12 @@ ngx_http_do_read_client_request_body(ngx_http_request_t *r)
         for ( ;; ) {
             if (rb->buf->last == rb->buf->end) {
 
-                if (rb->buf->pos != rb->buf->last) {
-
-                    /* pass buffer to request body filter chain */
-
-                    out.buf = rb->buf;
-                    out.next = NULL;
+                /* update chains */
 
-                    rc = ngx_http_request_body_filter(r, &out);
+                rc = ngx_http_request_body_filter(r, NULL);
 
-                    if (rc != NGX_OK) {
-                        return rc;
-                    }
-
-                } else {
-
-                    /* update chains */
-
-                    rc = ngx_http_request_body_filter(r, NULL);
-
-                    if (rc != NGX_OK) {
-                        return rc;
-                    }
+                if (rc != NGX_OK) {
+                    return rc;
                 }
 
                 if (rb->busy != NULL) {
@@ -319,6 +306,9 @@ ngx_http_do_read_client_request_body(ngx_http_request_t *r)
                         return NGX_AGAIN;
                     }
 
+                    ngx_log_error(NGX_LOG_ALERT, c->log, 0,
+                                  "busy buffers after request body flush");
+
                     return NGX_HTTP_INTERNAL_SERVER_ERROR;
                 }
 
@@ -355,17 +345,15 @@ ngx_http_do_read_client_request_body(ngx_http_request_t *r)
             rb->buf->last += n;
             r->request_length += n;
 
-            if (n == rest) {
-                /* pass buffer to request body filter chain */
+            /* pass buffer to request body filter chain */
 
-                out.buf = rb->buf;
-                out.next = NULL;
+            out.buf = rb->buf;
+            out.next = NULL;
 
-                rc = ngx_http_request_body_filter(r, &out);
+            rc = ngx_http_request_body_filter(r, &out);
 
-                if (rc != NGX_OK) {
-                    return rc;
-                }
+            if (rc != NGX_OK) {
+                return rc;
             }
 
             if (rb->rest == 0) {
@@ -386,21 +374,6 @@ ngx_http_do_read_client_request_body(ngx_http_request_t *r)
 
         if (!c->read->ready) {
 
-            if (r->request_body_no_buffering
-                && rb->buf->pos != rb->buf->last)
-            {
-                /* pass buffer to request body filter chain */
-
-                out.buf = rb->buf;
-                out.next = NULL;
-
-                rc = ngx_http_request_body_filter(r, &out);
-
-                if (rc != NGX_OK) {
-                    return rc;
-                }
-            }
-
             clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
             ngx_add_timer(c->read, clcf->client_body_timeout);
 
@@ -412,6 +385,10 @@ ngx_http_do_read_client_request_body(ngx_http_request_t *r)
         }
     }
 
+    if (ngx_http_copy_pipelined_header(r, rb->buf) != NGX_OK) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
+
     if (c->read->timer_set) {
         ngx_del_timer(c->read);
     }
@@ -425,6 +402,88 @@ ngx_http_do_read_client_request_body(ngx_http_request_t *r)
 }
 
 
+static ngx_int_t
+ngx_http_copy_pipelined_header(ngx_http_request_t *r, ngx_buf_t *buf)
+{
+    size_t                     n;
+    ngx_buf_t                 *b;
+    ngx_chain_t               *cl;
+    ngx_http_connection_t     *hc;
+    ngx_http_core_srv_conf_t  *cscf;
+
+    b = r->header_in;
+    n = buf->last - buf->pos;
+
+    if (buf == b || n == 0) {
+        return NGX_OK;
+    }
+
+    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   "http body pipelined header: %uz", n);
+
+    /*
+     * if there is a pipelined request in the client body buffer,
+     * copy it to the r->header_in buffer if there is enough room,
+     * or allocate a large client header buffer
+     */
+
+    if (n > (size_t) (b->end - b->last)) {
+
+        hc = r->http_connection;
+
+        if (hc->free) {
+            cl = hc->free;
+            hc->free = cl->next;
+
+            b = cl->buf;
+
+            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                           "http large header free: %p %uz",
+                           b->pos, b->end - b->last);
+
+        } else {
+            cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
+
+            b = ngx_create_temp_buf(r->connection->pool,
+                                    cscf->large_client_header_buffers.size);
+            if (b == NULL) {
+                return NGX_ERROR;
+            }
+
+            cl = ngx_alloc_chain_link(r->connection->pool);
+            if (cl == NULL) {
+                return NGX_ERROR;
+            }
+
+            cl->buf = b;
+
+            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                           "http large header alloc: %p %uz",
+                           b->pos, b->end - b->last);
+        }
+
+        cl->next = hc->busy;
+        hc->busy = cl;
+        hc->nbusy++;
+
+        r->header_in = b;
+
+        if (n > (size_t) (b->end - b->last)) {
+            ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
+                          "too large pipelined header after reading body");
+            return NGX_ERROR;
+        }
+    }
+
+    ngx_memcpy(b->last, buf->pos, n);
+
+    b->last += n;
+    r->request_length -= n;
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_http_write_request_body(ngx_http_request_t *r)
 {
@@ -619,6 +678,7 @@ ngx_http_discarded_request_body_handler(ngx_http_request_t *r)
     if (rc == NGX_OK) {
         r->discard_body = 0;
         r->lingering_close = 0;
+        r->lingering_time = 0;
         ngx_http_finalize_request(r, NGX_DONE);
         return;
     }
@@ -670,8 +730,7 @@ ngx_http_read_discarded_request_body(ngx_http_request_t *r)
 
     for ( ;; ) {
         if (r->headers_in.content_length_n == 0) {
-            r->read_event_handler = ngx_http_block_reading;
-            return NGX_OK;
+            break;
         }
 
         if (!r->connection->read->ready) {
@@ -705,15 +764,24 @@ ngx_http_read_discarded_request_body(ngx_http_request_t *r)
             return rc;
         }
     }
+
+    if (ngx_http_copy_pipelined_header(r, &b) != NGX_OK) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    r->read_event_handler = ngx_http_block_reading;
+
+    return NGX_OK;
 }
 
 
 static ngx_int_t
 ngx_http_discard_request_body_filter(ngx_http_request_t *r, ngx_buf_t *b)
 {
-    size_t                    size;
-    ngx_int_t                 rc;
-    ngx_http_request_body_t  *rb;
+    size_t                     size;
+    ngx_int_t                  rc;
+    ngx_http_request_body_t   *rb;
+    ngx_http_core_srv_conf_t  *cscf;
 
     if (r->headers_in.chunked) {
 
@@ -768,7 +836,10 @@ ngx_http_discard_request_body_filter(ngx_http_request_t *r, ngx_buf_t *b)
 
                 /* set amount of data we want to see next time */
 
-                r->headers_in.content_length_n = rb->chunked->length;
+                cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
+
+                r->headers_in.content_length_n = ngx_max(rb->chunked->length,
+                               (off_t) cscf->large_client_header_buffers.size);
                 break;
             }
 
@@ -936,6 +1007,7 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in)
     ngx_chain_t               *cl, *out, *tl, **ll;
     ngx_http_request_body_t   *rb;
     ngx_http_core_loc_conf_t  *clcf;
+    ngx_http_core_srv_conf_t  *cscf;
 
     rb = r->request_body;
 
@@ -949,8 +1021,10 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in)
             return NGX_HTTP_INTERNAL_SERVER_ERROR;
         }
 
+        cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
+
         r->headers_in.content_length_n = 0;
-        rb->rest = 3;
+        rb->rest = cscf->large_client_header_buffers.size;
     }
 
     out = NULL;
@@ -958,6 +1032,8 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in)
 
     for (cl = in; cl; cl = cl->next) {
 
+        b = NULL;
+
         for ( ;; ) {
 
             ngx_log_debug7(NGX_LOG_DEBUG_EVENT, r->connection->log, 0,
@@ -992,6 +1068,29 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in)
                     return NGX_HTTP_REQUEST_ENTITY_TOO_LARGE;
                 }
 
+                if (b
+                    && rb->chunked->size <= 128
+                    && cl->buf->last - cl->buf->pos >= rb->chunked->size)
+                {
+                    r->headers_in.content_length_n += rb->chunked->size;
+
+                    if (rb->chunked->size < 8) {
+
+                        while (rb->chunked->size) {
+                            *b->last++ = *cl->buf->pos++;
+                            rb->chunked->size--;
+                        }
+
+                    } else {
+                        ngx_memmove(b->last, cl->buf->pos, rb->chunked->size);
+                        b->last += rb->chunked->size;
+                        cl->buf->pos += rb->chunked->size;
+                        rb->chunked->size = 0;
+                    }
+
+                    continue;
+                }
+
                 tl = ngx_chain_get_free_buf(r->pool, &rb->free);
                 if (tl == NULL) {
                     return NGX_HTTP_INTERNAL_SERVER_ERROR;
@@ -1057,7 +1156,10 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in)
 
                 /* set rb->rest, amount of data we want to see next time */
 
-                rb->rest = rb->chunked->length;
+                cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
+
+                rb->rest = ngx_max(rb->chunked->length,
+                               (off_t) cscf->large_client_header_buffers.size);
 
                 break;
             }
diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
index 41538890..bebdbd92 100644
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -104,6 +104,37 @@ ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,
 }
 
 
+size_t
+ngx_http_complex_value_size(ngx_http_request_t *r,
+    ngx_http_complex_value_t *val, size_t default_value)
+{
+    size_t     size;
+    ngx_str_t  value;
+
+    if (val == NULL) {
+        return default_value;
+    }
+
+    if (val->lengths == NULL) {
+        return val->u.size;
+    }
+
+    if (ngx_http_complex_value(r, val, &value) != NGX_OK) {
+        return default_value;
+    }
+
+    size = ngx_parse_size(&value);
+
+    if (size == (size_t) NGX_ERROR) {
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                      "invalid size \"%V\"", &value);
+        return default_value;
+    }
+
+    return size;
+}
+
+
 ngx_int_t
 ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
 {
@@ -219,7 +250,44 @@ ngx_http_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     cv = (ngx_http_complex_value_t **) (p + cmd->offset);
 
-    if (*cv != NULL) {
+    if (*cv != NGX_CONF_UNSET_PTR && *cv != NULL) {
+        return "is duplicate";
+    }
+
+    *cv = ngx_palloc(cf->pool, sizeof(ngx_http_complex_value_t));
+    if (*cv == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    value = cf->args->elts;
+
+    ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
+
+    ccv.cf = cf;
+    ccv.value = &value[1];
+    ccv.complex_value = *cv;
+
+    if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
+        return NGX_CONF_ERROR;
+    }
+
+    return NGX_CONF_OK;
+}
+
+
+char *
+ngx_http_set_complex_value_zero_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf)
+{
+    char  *p = conf;
+
+    ngx_str_t                          *value;
+    ngx_http_complex_value_t          **cv;
+    ngx_http_compile_complex_value_t    ccv;
+
+    cv = (ngx_http_complex_value_t **) (p + cmd->offset);
+
+    if (*cv != NGX_CONF_UNSET_PTR) {
         return "is duplicate";
     }
 
@@ -235,6 +303,7 @@ ngx_http_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     ccv.cf = cf;
     ccv.value = &value[1];
     ccv.complex_value = *cv;
+    ccv.zero = 1;
 
     if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
         return NGX_CONF_ERROR;
@@ -244,6 +313,36 @@ ngx_http_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+char *
+ngx_http_set_complex_value_size_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf)
+{
+    char  *p = conf;
+
+    char                      *rv;
+    ngx_http_complex_value_t  *cv;
+
+    rv = ngx_http_set_complex_value_slot(cf, cmd, conf);
+
+    if (rv != NGX_CONF_OK) {
+        return rv;
+    }
+
+    cv = *(ngx_http_complex_value_t **) (p + cmd->offset);
+
+    if (cv->lengths) {
+        return NGX_CONF_OK;
+    }
+
+    cv->u.size = ngx_parse_size(&cv->value);
+    if (cv->u.size == (size_t) NGX_ERROR) {
+        return "invalid value";
+    }
+
+    return NGX_CONF_OK;
+}
+
+
 ngx_int_t
 ngx_http_test_predicates(ngx_http_request_t *r, ngx_array_t *predicates)
 {
@@ -1409,7 +1508,14 @@ ngx_http_script_return_code(ngx_http_script_engine_t *e)
 void
 ngx_http_script_break_code(ngx_http_script_engine_t *e)
 {
-    e->request->uri_changed = 0;
+    ngx_http_request_t  *r;
+
+    r = e->request;
+
+    if (r->uri_changed) {
+        r->valid_location = 0;
+        r->uri_changed = 0;
+    }
 
     e->ip = ngx_http_script_exit;
 }
diff --git a/src/http/ngx_http_script.h b/src/http/ngx_http_script.h
index 25bb6d73..43600383 100644
--- a/src/http/ngx_http_script.h
+++ b/src/http/ngx_http_script.h
@@ -68,6 +68,10 @@ typedef struct {
     ngx_uint_t                 *flushes;
     void                       *lengths;
     void                       *values;
+
+    union {
+        size_t                  size;
+    } u;
 } ngx_http_complex_value_t;
 
 
@@ -207,9 +211,15 @@ void ngx_http_script_flush_complex_value(ngx_http_request_t *r,
     ngx_http_complex_value_t *val);
 ngx_int_t ngx_http_complex_value(ngx_http_request_t *r,
     ngx_http_complex_value_t *val, ngx_str_t *value);
+size_t ngx_http_complex_value_size(ngx_http_request_t *r,
+    ngx_http_complex_value_t *val, size_t default_value);
 ngx_int_t ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv);
 char *ngx_http_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+char *ngx_http_set_complex_value_zero_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+char *ngx_http_set_complex_value_size_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
 
 
 ngx_int_t ngx_http_test_predicates(ngx_http_request_t *r,
diff --git a/src/http/ngx_http_special_response.c b/src/http/ngx_http_special_response.c
index 4ffb2cc8..72f56fd9 100644
--- a/src/http/ngx_http_special_response.c
+++ b/src/http/ngx_http_special_response.c
@@ -575,6 +575,10 @@ ngx_http_clean_header(ngx_http_request_t *r)
     r->headers_out.headers.part.next = NULL;
     r->headers_out.headers.last = &r->headers_out.headers.part;
 
+    r->headers_out.trailers.part.nelts = 0;
+    r->headers_out.trailers.part.next = NULL;
+    r->headers_out.trailers.last = &r->headers_out.trailers.part;
+
     r->headers_out.content_length_n = -1;
     r->headers_out.last_modified_time = -1;
 }
@@ -623,6 +627,12 @@ ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)
         return ngx_http_named_location(r, &uri);
     }
 
+    r->expect_tested = 1;
+
+    if (ngx_http_discard_request_body(r) != NGX_OK) {
+        r->keepalive = 0;
+    }
+
     location = ngx_list_push(&r->headers_out.headers);
 
     if (location == NULL) {
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index a7391d09..61fad5ca 100644
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -77,9 +77,6 @@ static void
 static void
     ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r,
     ngx_uint_t do_write);
-static ngx_int_t ngx_http_upstream_non_buffered_filter_init(void *data);
-static ngx_int_t ngx_http_upstream_non_buffered_filter(void *data,
-    ssize_t bytes);
 #if (NGX_THREADS)
 static ngx_int_t ngx_http_upstream_thread_handler(ngx_thread_task_t *task,
     ngx_file_t *file);
@@ -190,6 +187,8 @@ static void ngx_http_upstream_ssl_handshake(ngx_http_request_t *,
 static void ngx_http_upstream_ssl_save_session(ngx_connection_t *c);
 static ngx_int_t ngx_http_upstream_ssl_name(ngx_http_request_t *r,
     ngx_http_upstream_t *u, ngx_connection_t *c);
+static ngx_int_t ngx_http_upstream_ssl_certificate(ngx_http_request_t *r,
+    ngx_http_upstream_t *u, ngx_connection_t *c);
 #endif
 
 
@@ -597,10 +596,6 @@ ngx_http_upstream_init_request(ngx_http_request_t *r)
                 u->cache_status = NGX_HTTP_CACHE_MISS;
                 u->request_sent = 1;
             }
-
-            if (ngx_http_upstream_cache_background_update(r, u) != NGX_OK) {
-                rc = NGX_ERROR;
-            }
         }
 
         if (rc != NGX_DECLINED) {
@@ -614,6 +609,17 @@ ngx_http_upstream_init_request(ngx_http_request_t *r)
     u->store = u->conf->store;
 
     if (!u->store && !r->post_action && !u->conf->ignore_client_abort) {
+
+        if (r->connection->read->ready) {
+            ngx_post_event(r->connection->read, &ngx_posted_events);
+
+        } else {
+            if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
+                ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+                return;
+            }
+        }
+
         r->read_event_handler = ngx_http_upstream_rd_check_broken_connection;
         r->write_event_handler = ngx_http_upstream_wr_check_broken_connection;
     }
@@ -902,9 +908,14 @@ ngx_http_upstream_cache(ngx_http_request_t *r, ngx_http_upstream_t *u)
              || c->stale_updating) && !r->background
             && u->conf->cache_background_update)
         {
-            r->cache->background = 1;
-            u->cache_status = rc;
-            rc = NGX_OK;
+            if (ngx_http_upstream_cache_background_update(r, u) == NGX_OK) {
+                r->cache->background = 1;
+                u->cache_status = rc;
+                rc = NGX_OK;
+
+            } else {
+                rc = NGX_ERROR;
+            }
         }
 
         break;
@@ -1106,10 +1117,6 @@ ngx_http_upstream_cache_background_update(ngx_http_request_t *r,
 {
     ngx_http_request_t  *sr;
 
-    if (!r->cached || !r->cache->background) {
-        return NGX_OK;
-    }
-
     if (r == r->main) {
         r->preserve_body = 1;
     }
@@ -1687,6 +1694,16 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
         }
     }
 
+    if (u->conf->ssl_certificate && (u->conf->ssl_certificate->lengths
+                                     || u->conf->ssl_certificate_key->lengths))
+    {
+        if (ngx_http_upstream_ssl_certificate(r, u, c) != NGX_OK) {
+            ngx_http_upstream_finalize_request(r, u,
+                                               NGX_HTTP_INTERNAL_SERVER_ERROR);
+            return;
+        }
+    }
+
     if (u->conf->ssl_session_reuse) {
         c->ssl->save_session = ngx_http_upstream_ssl_save_session;
 
@@ -1907,6 +1924,45 @@ ngx_http_upstream_ssl_name(ngx_http_request_t *r, ngx_http_upstream_t *u,
     return NGX_OK;
 }
 
+
+static ngx_int_t
+ngx_http_upstream_ssl_certificate(ngx_http_request_t *r,
+    ngx_http_upstream_t *u, ngx_connection_t *c)
+{
+    ngx_str_t  cert, key;
+
+    if (ngx_http_complex_value(r, u->conf->ssl_certificate, &cert)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
+    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                   "http upstream ssl cert: \"%s\"", cert.data);
+
+    if (*cert.data == '\0') {
+        return NGX_OK;
+    }
+
+    if (ngx_http_complex_value(r, u->conf->ssl_certificate_key, &key)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
+    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                   "http upstream ssl key: \"%s\"", key.data);
+
+    if (ngx_ssl_connection_certificate(c, r->pool, &cert, &key,
+                                       u->conf->ssl_passwords)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
+    return NGX_OK;
+}
+
 #endif
 
 
@@ -1922,6 +1978,7 @@ ngx_http_upstream_reinit(ngx_http_request_t *r, ngx_http_upstream_t *u)
 
     u->keepalive = 0;
     u->upgrade = 0;
+    u->error = 0;
 
     ngx_memzero(&u->headers_in, sizeof(ngx_http_upstream_headers_in_t));
     u->headers_in.content_length_n = -1;
@@ -2478,7 +2535,7 @@ ngx_http_upstream_test_next(ngx_http_request_t *r, ngx_http_upstream_t *u)
 #if (NGX_HTTP_CACHE)
 
         if (u->cache_status == NGX_HTTP_CACHE_EXPIRED
-            && ((u->conf->cache_use_stale & un->mask) || r->cache->stale_error))
+            && (u->conf->cache_use_stale & un->mask))
         {
             ngx_int_t  rc;
 
@@ -2505,6 +2562,8 @@ ngx_http_upstream_test_next(ngx_http_request_t *r, ngx_http_upstream_t *u)
         }
 
 #endif
+
+        break;
     }
 
 #if (NGX_HTTP_CACHE)
@@ -2979,6 +3038,7 @@ ngx_http_upstream_send_response(ngx_http_request_t *r, ngx_http_upstream_t *u)
                              ngx_http_upstream_process_non_buffered_downstream;
 
         r->limit_rate = 0;
+        r->limit_rate_set = 1;
 
         if (u->input_filter_init(u->input_filter_ctx) == NGX_ERROR) {
             ngx_http_upstream_finalize_request(r, u, NGX_ERROR);
@@ -3013,9 +3073,7 @@ ngx_http_upstream_send_response(ngx_http_request_t *r, ngx_http_upstream_t *u)
                 return;
             }
 
-            if (u->peer.connection->read->ready || u->length == 0) {
-                ngx_http_upstream_process_non_buffered_upstream(r, u);
-            }
+            ngx_http_upstream_process_non_buffered_upstream(r, u);
         }
 
         return;
@@ -3336,6 +3394,7 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
     size_t                     size;
     ssize_t                    n;
     ngx_buf_t                 *b;
+    ngx_uint_t                 flags;
     ngx_connection_t          *c, *downstream, *upstream, *dst, *src;
     ngx_http_upstream_t       *u;
     ngx_http_core_loc_conf_t  *clcf;
@@ -3474,7 +3533,14 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
         ngx_del_timer(upstream->write);
     }
 
-    if (ngx_handle_read_event(upstream->read, 0) != NGX_OK) {
+    if (upstream->read->eof || upstream->read->error) {
+        flags = NGX_CLOSE_EVENT;
+
+    } else {
+        flags = 0;
+    }
+
+    if (ngx_handle_read_event(upstream->read, flags) != NGX_OK) {
         ngx_http_upstream_finalize_request(r, u, NGX_ERROR);
         return;
     }
@@ -3493,7 +3559,14 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
         return;
     }
 
-    if (ngx_handle_read_event(downstream->read, 0) != NGX_OK) {
+    if (downstream->read->eof || downstream->read->error) {
+        flags = NGX_CLOSE_EVENT;
+
+    } else {
+        flags = 0;
+    }
+
+    if (ngx_handle_read_event(downstream->read, flags) != NGX_OK) {
         ngx_http_upstream_finalize_request(r, u, NGX_ERROR);
         return;
     }
@@ -3565,6 +3638,7 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r,
     ssize_t                    n;
     ngx_buf_t                 *b;
     ngx_int_t                  rc;
+    ngx_uint_t                 flags;
     ngx_connection_t          *downstream, *upstream;
     ngx_http_upstream_t       *u;
     ngx_http_core_loc_conf_t  *clcf;
@@ -3611,7 +3685,7 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r,
                     return;
                 }
 
-                if (upstream->read->error) {
+                if (upstream->read->error || u->error) {
                     ngx_http_upstream_finalize_request(r, u,
                                                        NGX_HTTP_BAD_GATEWAY);
                     return;
@@ -3668,7 +3742,14 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r,
         ngx_del_timer(downstream->write);
     }
 
-    if (ngx_handle_read_event(upstream->read, 0) != NGX_OK) {
+    if (upstream->read->eof || upstream->read->error) {
+        flags = NGX_CLOSE_EVENT;
+
+    } else {
+        flags = 0;
+    }
+
+    if (ngx_handle_read_event(upstream->read, flags) != NGX_OK) {
         ngx_http_upstream_finalize_request(r, u, NGX_ERROR);
         return;
     }
@@ -3682,14 +3763,14 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r,
 }
 
 
-static ngx_int_t
+ngx_int_t
 ngx_http_upstream_non_buffered_filter_init(void *data)
 {
     return NGX_OK;
 }
 
 
-static ngx_int_t
+ngx_int_t
 ngx_http_upstream_non_buffered_filter(void *data, ssize_t bytes)
 {
     ngx_http_request_t  *r = data;
@@ -3700,6 +3781,13 @@ ngx_http_upstream_non_buffered_filter(void *data, ssize_t bytes)
 
     u = r->upstream;
 
+    if (u->length == 0) {
+        ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+        return NGX_OK;
+    }
+
     for (cl = u->out_bufs, ll = &u->out_bufs; cl; cl = cl->next) {
         ll = &cl->next;
     }
@@ -3725,6 +3813,18 @@ ngx_http_upstream_non_buffered_filter(void *data, ssize_t bytes)
         return NGX_OK;
     }
 
+    if (bytes > u->length) {
+
+        ngx_log_error(NGX_LOG_WARN, r->connection->log, 0,
+                      "upstream sent more data than specified in "
+                      "\"Content-Length\" header");
+
+        cl->buf->last = cl->buf->pos + u->length;
+        u->length = 0;
+
+        return NGX_OK;
+    }
+
     u->length -= bytes;
 
     return NGX_OK;
@@ -4806,6 +4906,7 @@ ngx_http_upstream_process_limit_rate(ngx_http_request_t *r, ngx_table_elt_t *h,
 
     if (n != NGX_ERROR) {
         r->limit_rate = (size_t) n;
+        r->limit_rate_set = 1;
     }
 
     return NGX_OK;
diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h
index 6079d723..3db7b064 100644
--- a/src/http/ngx_http_upstream.h
+++ b/src/http/ngx_http_upstream.h
@@ -234,6 +234,10 @@ typedef struct {
     ngx_http_complex_value_t        *ssl_name;
     ngx_flag_t                       ssl_server_name;
     ngx_flag_t                       ssl_verify;
+
+    ngx_http_complex_value_t        *ssl_certificate;
+    ngx_http_complex_value_t        *ssl_certificate_key;
+    ngx_array_t                     *ssl_passwords;
 #endif
 
     ngx_str_t                        module;
@@ -391,6 +395,7 @@ struct ngx_http_upstream_s {
     unsigned                         buffering:1;
     unsigned                         keepalive:1;
     unsigned                         upgrade:1;
+    unsigned                         error:1;
 
     unsigned                         request_sent:1;
     unsigned                         request_body_sent:1;
@@ -414,6 +419,8 @@ typedef struct {
 
 ngx_int_t ngx_http_upstream_create(ngx_http_request_t *r);
 void ngx_http_upstream_init(ngx_http_request_t *r);
+ngx_int_t ngx_http_upstream_non_buffered_filter_init(void *data);
+ngx_int_t ngx_http_upstream_non_buffered_filter(void *data, ssize_t bytes);
 ngx_http_upstream_srv_conf_t *ngx_http_upstream_add(ngx_conf_t *cf,
     ngx_url_t *u, ngx_uint_t flags);
 char *ngx_http_upstream_bind_set_slot(ngx_conf_t *cf, ngx_command_t *cmd,
diff --git a/src/http/ngx_http_upstream_round_robin.c b/src/http/ngx_http_upstream_round_robin.c
index f72de3ee..1f15fae5 100644
--- a/src/http/ngx_http_upstream_round_robin.c
+++ b/src/http/ngx_http_upstream_round_robin.c
@@ -10,8 +10,8 @@
 #include <ngx_http.h>
 
 
-#define ngx_http_upstream_tries(p) ((p)->number                               \
-                                    + ((p)->next ? (p)->next->number : 0))
+#define ngx_http_upstream_tries(p) ((p)->tries                                \
+                                    + ((p)->next ? (p)->next->tries : 0))
 
 
 static ngx_http_upstream_rr_peer_t *ngx_http_upstream_get_peer(
@@ -32,7 +32,7 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
     ngx_http_upstream_srv_conf_t *us)
 {
     ngx_url_t                      u;
-    ngx_uint_t                     i, j, n, w;
+    ngx_uint_t                     i, j, n, w, t;
     ngx_http_upstream_server_t    *server;
     ngx_http_upstream_rr_peer_t   *peer, **peerp;
     ngx_http_upstream_rr_peers_t  *peers, *backup;
@@ -44,6 +44,7 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
 
         n = 0;
         w = 0;
+        t = 0;
 
         for (i = 0; i < us->servers->nelts; i++) {
             if (server[i].backup) {
@@ -52,6 +53,10 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
 
             n += server[i].naddrs;
             w += server[i].naddrs * server[i].weight;
+
+            if (!server[i].down) {
+                t += server[i].naddrs;
+            }
         }
 
         if (n == 0) {
@@ -75,6 +80,7 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
         peers->number = n;
         peers->weighted = (w != n);
         peers->total_weight = w;
+        peers->tries = t;
         peers->name = &us->host;
 
         n = 0;
@@ -110,6 +116,7 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
 
         n = 0;
         w = 0;
+        t = 0;
 
         for (i = 0; i < us->servers->nelts; i++) {
             if (!server[i].backup) {
@@ -118,6 +125,10 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
 
             n += server[i].naddrs;
             w += server[i].naddrs * server[i].weight;
+
+            if (!server[i].down) {
+                t += server[i].naddrs;
+            }
         }
 
         if (n == 0) {
@@ -139,6 +150,7 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
         backup->number = n;
         backup->weighted = (w != n);
         backup->total_weight = w;
+        backup->tries = t;
         backup->name = &us->host;
 
         n = 0;
@@ -214,6 +226,7 @@ ngx_http_upstream_init_round_robin(ngx_conf_t *cf,
     peers->number = n;
     peers->weighted = 0;
     peers->total_weight = n;
+    peers->tries = n;
     peers->name = &us->host;
 
     peerp = &peers->peer;
@@ -332,6 +345,7 @@ ngx_http_upstream_create_round_robin_peer(ngx_http_request_t *r,
 
     peers->single = (ur->naddrs == 1);
     peers->number = ur->naddrs;
+    peers->tries = ur->naddrs;
     peers->name = &ur->host;
 
     if (ur->sockaddr) {
@@ -669,10 +683,7 @@ ngx_http_upstream_set_round_robin_peer_session(ngx_peer_connection_t *pc,
     ngx_http_upstream_rr_peer_t   *peer;
 #if (NGX_HTTP_UPSTREAM_ZONE)
     int                            len;
-#if OPENSSL_VERSION_NUMBER >= 0x0090707fL
-    const
-#endif
-    u_char                        *p;
+    const u_char                  *p;
     ngx_http_upstream_rr_peers_t  *peers;
     u_char                         buf[NGX_SSL_MAX_SESSION_SIZE];
 #endif
diff --git a/src/http/ngx_http_upstream_round_robin.h b/src/http/ngx_http_upstream_round_robin.h
index 45f258d2..922ceaa0 100644
--- a/src/http/ngx_http_upstream_round_robin.h
+++ b/src/http/ngx_http_upstream_round_robin.h
@@ -68,6 +68,7 @@ struct ngx_http_upstream_rr_peers_s {
 #endif
 
     ngx_uint_t                      total_weight;
+    ngx_uint_t                      tries;
 
     unsigned                        single:1;
     unsigned                        weighted:1;
diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index 31321b29..c25d80cc 100644
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -22,8 +22,6 @@ static void ngx_http_variable_request_set(ngx_http_request_t *r,
 #endif
 static ngx_int_t ngx_http_variable_request_get_size(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data);
-static void ngx_http_variable_request_set_size(ngx_http_request_t *r,
-    ngx_http_variable_value_t *v, uintptr_t data);
 static ngx_int_t ngx_http_variable_header(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data);
 
@@ -124,11 +122,15 @@ static ngx_int_t ngx_http_variable_sent_keep_alive(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data);
 static ngx_int_t ngx_http_variable_sent_transfer_encoding(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data);
+static void ngx_http_variable_set_limit_rate(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data);
 
 static ngx_int_t ngx_http_variable_connection(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data);
 static ngx_int_t ngx_http_variable_connection_requests(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data);
+static ngx_int_t ngx_http_variable_connection_time(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data);
 
 static ngx_int_t ngx_http_variable_nginx_version(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data);
@@ -199,10 +201,20 @@ static ngx_http_variable_t  ngx_http_core_variables[] = {
     { ngx_string("remote_port"), NULL, ngx_http_variable_remote_port, 0, 0, 0 },
 
     { ngx_string("proxy_protocol_addr"), NULL,
-      ngx_http_variable_proxy_protocol_addr, 0, 0, 0 },
+      ngx_http_variable_proxy_protocol_addr,
+      offsetof(ngx_proxy_protocol_t, src_addr), 0, 0 },
 
     { ngx_string("proxy_protocol_port"), NULL,
-      ngx_http_variable_proxy_protocol_port, 0, 0, 0 },
+      ngx_http_variable_proxy_protocol_port,
+      offsetof(ngx_proxy_protocol_t, src_port), 0, 0 },
+
+    { ngx_string("proxy_protocol_server_addr"), NULL,
+      ngx_http_variable_proxy_protocol_addr,
+      offsetof(ngx_proxy_protocol_t, dst_addr), 0, 0 },
+
+    { ngx_string("proxy_protocol_server_port"), NULL,
+      ngx_http_variable_proxy_protocol_port,
+      offsetof(ngx_proxy_protocol_t, dst_port), 0, 0 },
 
     { ngx_string("server_addr"), NULL, ngx_http_variable_server_addr, 0, 0, 0 },
 
@@ -321,7 +333,7 @@ static ngx_http_variable_t  ngx_http_core_variables[] = {
     { ngx_string("sent_http_link"), NULL, ngx_http_variable_headers,
       offsetof(ngx_http_request_t, headers_out.link), 0, 0 },
 
-    { ngx_string("limit_rate"), ngx_http_variable_request_set_size,
+    { ngx_string("limit_rate"), ngx_http_variable_set_limit_rate,
       ngx_http_variable_request_get_size,
       offsetof(ngx_http_request_t, limit_rate),
       NGX_HTTP_VAR_CHANGEABLE|NGX_HTTP_VAR_NOCACHEABLE, 0 },
@@ -332,6 +344,9 @@ static ngx_http_variable_t  ngx_http_core_variables[] = {
     { ngx_string("connection_requests"), NULL,
       ngx_http_variable_connection_requests, 0, 0, 0 },
 
+    { ngx_string("connection_time"), NULL, ngx_http_variable_connection_time,
+      0, NGX_HTTP_VAR_NOCACHEABLE, 0 },
+
     { ngx_string("nginx_version"), NULL, ngx_http_variable_nginx_version,
       0, 0, 0 },
 
@@ -788,32 +803,6 @@ ngx_http_variable_request_get_size(ngx_http_request_t *r,
 }
 
 
-static void
-ngx_http_variable_request_set_size(ngx_http_request_t *r,
-    ngx_http_variable_value_t *v, uintptr_t data)
-{
-    ssize_t    s, *sp;
-    ngx_str_t  val;
-
-    val.len = v->len;
-    val.data = v->data;
-
-    s = ngx_parse_size(&val);
-
-    if (s == NGX_ERROR) {
-        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
-                      "invalid size \"%V\"", &val);
-        return;
-    }
-
-    sp = (ssize_t *) ((char *) r + data);
-
-    *sp = s;
-
-    return;
-}
-
-
 static ngx_int_t
 ngx_http_variable_header(ngx_http_request_t *r, ngx_http_variable_value_t *v,
     uintptr_t data)
@@ -1091,7 +1080,7 @@ ngx_http_variable_argument(ngx_http_request_t *r, ngx_http_variable_value_t *v,
     len = name->len - (sizeof("arg_") - 1);
     arg = name->data + sizeof("arg_") - 1;
 
-    if (ngx_http_arg(r, arg, len, &value) != NGX_OK) {
+    if (len == 0 || ngx_http_arg(r, arg, len, &value) != NGX_OK) {
         v->not_found = 1;
         return NGX_OK;
     }
@@ -1319,11 +1308,22 @@ static ngx_int_t
 ngx_http_variable_proxy_protocol_addr(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data)
 {
-    v->len = r->connection->proxy_protocol_addr.len;
+    ngx_str_t             *addr;
+    ngx_proxy_protocol_t  *pp;
+
+    pp = r->connection->proxy_protocol;
+    if (pp == NULL) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    addr = (ngx_str_t *) ((char *) pp + data);
+
+    v->len = addr->len;
     v->valid = 1;
     v->no_cacheable = 0;
     v->not_found = 0;
-    v->data = r->connection->proxy_protocol_addr.data;
+    v->data = addr->data;
 
     return NGX_OK;
 }
@@ -1333,7 +1333,14 @@ static ngx_int_t
 ngx_http_variable_proxy_protocol_port(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data)
 {
-    ngx_uint_t  port;
+    ngx_uint_t             port;
+    ngx_proxy_protocol_t  *pp;
+
+    pp = r->connection->proxy_protocol;
+    if (pp == NULL) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
 
     v->len = 0;
     v->valid = 1;
@@ -1345,7 +1352,7 @@ ngx_http_variable_proxy_protocol_port(ngx_http_request_t *r,
         return NGX_ERROR;
     }
 
-    port = r->connection->proxy_protocol_port;
+    port = *(in_port_t *) ((char *) pp + data);
 
     if (port > 0 && port < 65536) {
         v->len = ngx_sprintf(v->data, "%ui", port) - v->data;
@@ -1993,6 +2000,29 @@ ngx_http_variable_sent_transfer_encoding(ngx_http_request_t *r,
 }
 
 
+static void
+ngx_http_variable_set_limit_rate(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data)
+{
+    ssize_t    s;
+    ngx_str_t  val;
+
+    val.len = v->len;
+    val.data = v->data;
+
+    s = ngx_parse_size(&val);
+
+    if (s == NGX_ERROR) {
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                      "invalid $limit_rate \"%V\"", &val);
+        return;
+    }
+
+    r->limit_rate = s;
+    r->limit_rate_set = 1;
+}
+
+
 static ngx_int_t
 ngx_http_variable_request_completion(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data)
@@ -2227,6 +2257,31 @@ ngx_http_variable_connection_requests(ngx_http_request_t *r,
 }
 
 
+static ngx_int_t
+ngx_http_variable_connection_time(ngx_http_request_t *r,
+    ngx_http_variable_value_t *v, uintptr_t data)
+{
+    u_char          *p;
+    ngx_msec_int_t   ms;
+
+    p = ngx_pnalloc(r->pool, NGX_TIME_T_LEN + 4);
+    if (p == NULL) {
+        return NGX_ERROR;
+    }
+
+    ms = ngx_current_msec - r->connection->start_time;
+    ms = ngx_max(ms, 0);
+
+    v->len = ngx_sprintf(p, "%T.%03M", (time_t) ms / 1000, ms % 1000) - p;
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+    v->data = p;
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_http_variable_nginx_version(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data)
diff --git a/src/http/ngx_http_write_filter_module.c b/src/http/ngx_http_write_filter_module.c
index 3f18d76f..6a5d957b 100644
--- a/src/http/ngx_http_write_filter_module.c
+++ b/src/http/ngx_http_write_filter_module.c
@@ -250,9 +250,17 @@ ngx_http_write_filter(ngx_http_request_t *r, ngx_chain_t *in)
         return NGX_ERROR;
     }
 
+    if (!r->limit_rate_set) {
+        r->limit_rate = ngx_http_complex_value_size(r, clcf->limit_rate, 0);
+        r->limit_rate_set = 1;
+    }
+
     if (r->limit_rate) {
-        if (r->limit_rate_after == 0) {
-            r->limit_rate_after = clcf->limit_rate_after;
+
+        if (!r->limit_rate_after_set) {
+            r->limit_rate_after = ngx_http_complex_value_size(r,
+                                                    clcf->limit_rate_after, 0);
+            r->limit_rate_after_set = 1;
         }
 
         limit = (off_t) r->limit_rate * (ngx_time() - r->start_sec + 1)
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index e55f9bab..3611a2e5 100644
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -60,6 +60,8 @@ typedef struct {
 static void ngx_http_v2_read_handler(ngx_event_t *rev);
 static void ngx_http_v2_write_handler(ngx_event_t *wev);
 static void ngx_http_v2_handle_connection(ngx_http_v2_connection_t *h2c);
+static void ngx_http_v2_lingering_close(ngx_connection_t *c);
+static void ngx_http_v2_lingering_close_handler(ngx_event_t *rev);
 
 static u_char *ngx_http_v2_state_proxy_protocol(ngx_http_v2_connection_t *h2c,
     u_char *pos, u_char *end);
@@ -178,6 +180,7 @@ static void ngx_http_v2_read_client_request_body_handler(ngx_http_request_t *r);
 static ngx_int_t ngx_http_v2_terminate_stream(ngx_http_v2_connection_t *h2c,
     ngx_http_v2_stream_t *stream, ngx_uint_t status);
 static void ngx_http_v2_close_stream_handler(ngx_event_t *ev);
+static void ngx_http_v2_retry_close_stream_handler(ngx_event_t *ev);
 static void ngx_http_v2_handle_connection_handler(ngx_event_t *rev);
 static void ngx_http_v2_idle_handler(ngx_event_t *rev);
 static void ngx_http_v2_finalize_connection(ngx_http_v2_connection_t *h2c,
@@ -235,6 +238,7 @@ ngx_http_v2_init(ngx_event_t *rev)
     ngx_http_v2_srv_conf_t    *h2scf;
     ngx_http_v2_main_conf_t   *h2mcf;
     ngx_http_v2_connection_t  *h2c;
+    ngx_http_core_srv_conf_t  *cscf;
 
     c = rev->data;
     hc = c->data;
@@ -273,7 +277,7 @@ ngx_http_v2_init(ngx_event_t *rev)
     h2scf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_v2_module);
 
     h2c->concurrent_pushes = h2scf->concurrent_pushes;
-    h2c->priority_limit = h2scf->concurrent_streams;
+    h2c->priority_limit = ngx_max(h2scf->concurrent_streams, 100);
 
     h2c->pool = ngx_create_pool(h2scf->pool_size, h2c->connection->log);
     if (h2c->pool == NULL) {
@@ -322,7 +326,14 @@ ngx_http_v2_init(ngx_event_t *rev)
     rev->handler = ngx_http_v2_read_handler;
     c->write->handler = ngx_http_v2_write_handler;
 
+    if (!rev->timer_set) {
+        cscf = ngx_http_get_module_srv_conf(hc->conf_ctx,
+                                            ngx_http_core_module);
+        ngx_add_timer(rev, cscf->client_header_timeout);
+    }
+
     c->idle = 1;
+    ngx_reusable_connection(c, 0);
 
     ngx_http_v2_read_handler(rev);
 }
@@ -354,6 +365,16 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
     if (c->close) {
         c->close = 0;
 
+        if (c->error) {
+            ngx_http_v2_finalize_connection(h2c, 0);
+            return;
+        }
+
+        if (!h2c->processing && !h2c->pushing) {
+            ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_NO_ERROR);
+            return;
+        }
+
         if (!h2c->goaway) {
             h2c->goaway = 1;
 
@@ -419,6 +440,14 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
 
         } while (p != end);
 
+        h2c->total_bytes += n;
+
+        if (h2c->total_bytes / 8 > h2c->payload_bytes + 1048576) {
+            ngx_log_error(NGX_LOG_INFO, c->log, 0, "http2 flood detected");
+            ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_NO_ERROR);
+            return;
+        }
+
     } while (rev->ready);
 
     if (ngx_handle_read_event(rev, 0) != NGX_OK) {
@@ -433,14 +462,6 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
 
     h2c->blocked = 0;
 
-    if (h2c->processing || h2c->pushing) {
-        if (rev->timer_set) {
-            ngx_del_timer(rev);
-        }
-
-        return;
-    }
-
     ngx_http_v2_handle_connection(h2c);
 }
 
@@ -459,6 +480,7 @@ ngx_http_v2_write_handler(ngx_event_t *wev)
         ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
                        "http2 write event timed out");
         c->error = 1;
+        c->timedout = 1;
         ngx_http_v2_finalize_connection(h2c, 0);
         return;
     }
@@ -505,13 +527,12 @@ ngx_http_v2_send_output_queue(ngx_http_v2_connection_t *h2c)
     ngx_http_core_loc_conf_t  *clcf;
 
     c = h2c->connection;
+    wev = c->write;
 
     if (c->error) {
-        return NGX_ERROR;
+        goto error;
     }
 
-    wev = c->write;
-
     if (!wev->ready) {
         return NGX_AGAIN;
     }
@@ -613,9 +634,9 @@ ngx_http_v2_send_output_queue(ngx_http_v2_connection_t *h2c)
 static void
 ngx_http_v2_handle_connection(ngx_http_v2_connection_t *h2c)
 {
-    ngx_int_t                rc;
-    ngx_connection_t        *c;
-    ngx_http_v2_srv_conf_t  *h2scf;
+    ngx_int_t                  rc;
+    ngx_connection_t          *c;
+    ngx_http_core_loc_conf_t  *clcf;
 
     if (h2c->last_out || h2c->processing || h2c->pushing) {
         return;
@@ -648,14 +669,20 @@ ngx_http_v2_handle_connection(ngx_http_v2_connection_t *h2c)
     }
 
     if (h2c->goaway) {
-        ngx_http_close_connection(c);
+        ngx_http_v2_lingering_close(c);
         return;
     }
 
-    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
-                                         ngx_http_v2_module);
+    clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx,
+                                        ngx_http_core_module);
+
+    if (!c->read->timer_set) {
+        ngx_add_timer(c->read, clcf->keepalive_timeout);
+    }
+
+    ngx_reusable_connection(c, 1);
+
     if (h2c->state.incomplete) {
-        ngx_add_timer(c->read, h2scf->recv_timeout);
         return;
     }
 
@@ -673,7 +700,6 @@ ngx_http_v2_handle_connection(ngx_http_v2_connection_t *h2c)
 #endif
 
     c->destroyed = 1;
-    ngx_reusable_connection(c, 1);
 
     c->write->handler = ngx_http_empty_handler;
     c->read->handler = ngx_http_v2_idle_handler;
@@ -681,8 +707,142 @@ ngx_http_v2_handle_connection(ngx_http_v2_connection_t *h2c)
     if (c->write->timer_set) {
         ngx_del_timer(c->write);
     }
+}
+
 
-    ngx_add_timer(c->read, h2scf->idle_timeout);
+static void
+ngx_http_v2_lingering_close(ngx_connection_t *c)
+{
+    ngx_event_t               *rev, *wev;
+    ngx_http_v2_connection_t  *h2c;
+    ngx_http_core_loc_conf_t  *clcf;
+
+    h2c = c->data;
+
+    clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx,
+                                        ngx_http_core_module);
+
+    if (clcf->lingering_close == NGX_HTTP_LINGERING_OFF) {
+        ngx_http_close_connection(c);
+        return;
+    }
+
+    if (h2c->lingering_time == 0) {
+        h2c->lingering_time = ngx_time()
+                              + (time_t) (clcf->lingering_time / 1000);
+    }
+
+#if (NGX_HTTP_SSL)
+    if (c->ssl) {
+        ngx_int_t  rc;
+
+        rc = ngx_ssl_shutdown(c);
+
+        if (rc == NGX_ERROR) {
+            ngx_http_close_connection(c);
+            return;
+        }
+
+        if (rc == NGX_AGAIN) {
+            c->ssl->handler = ngx_http_v2_lingering_close;
+            return;
+        }
+    }
+#endif
+
+    rev = c->read;
+    rev->handler = ngx_http_v2_lingering_close_handler;
+
+    if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+        ngx_http_close_connection(c);
+        return;
+    }
+
+    wev = c->write;
+    wev->handler = ngx_http_empty_handler;
+
+    if (wev->active && (ngx_event_flags & NGX_USE_LEVEL_EVENT)) {
+        if (ngx_del_event(wev, NGX_WRITE_EVENT, 0) != NGX_OK) {
+            ngx_http_close_connection(c);
+            return;
+        }
+    }
+
+    if (ngx_shutdown_socket(c->fd, NGX_WRITE_SHUTDOWN) == -1) {
+        ngx_connection_error(c, ngx_socket_errno,
+                             ngx_shutdown_socket_n " failed");
+        ngx_http_close_connection(c);
+        return;
+    }
+
+    c->close = 0;
+    ngx_reusable_connection(c, 1);
+
+    ngx_add_timer(rev, clcf->lingering_timeout);
+
+    if (rev->ready) {
+        ngx_http_v2_lingering_close_handler(rev);
+    }
+}
+
+
+static void
+ngx_http_v2_lingering_close_handler(ngx_event_t *rev)
+{
+    ssize_t                    n;
+    ngx_msec_t                 timer;
+    ngx_connection_t          *c;
+    ngx_http_core_loc_conf_t  *clcf;
+    ngx_http_v2_connection_t  *h2c;
+    u_char                     buffer[NGX_HTTP_LINGERING_BUFFER_SIZE];
+
+    c = rev->data;
+    h2c = c->data;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                   "http2 lingering close handler");
+
+    if (rev->timedout || c->close) {
+        ngx_http_close_connection(c);
+        return;
+    }
+
+    timer = (ngx_msec_t) h2c->lingering_time - (ngx_msec_t) ngx_time();
+    if ((ngx_msec_int_t) timer <= 0) {
+        ngx_http_close_connection(c);
+        return;
+    }
+
+    do {
+        n = c->recv(c, buffer, NGX_HTTP_LINGERING_BUFFER_SIZE);
+
+        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, "lingering read: %z", n);
+
+        if (n == NGX_AGAIN) {
+            break;
+        }
+
+        if (n == NGX_ERROR || n == 0) {
+            ngx_http_close_connection(c);
+            return;
+        }
+
+    } while (rev->ready);
+
+    if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+        ngx_http_close_connection(c);
+        return;
+    }
+
+    clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx,
+                                        ngx_http_core_module);
+    timer *= 1000;
+
+    if (timer > clcf->lingering_timeout) {
+        timer = clcf->lingering_timeout;
+    }
+
+    ngx_add_timer(rev, timer);
 }
 
 
@@ -718,9 +878,8 @@ ngx_http_v2_state_preface(ngx_http_v2_connection_t *h2c, u_char *pos,
     }
 
     if (ngx_memcmp(pos, preface, sizeof(preface) - 1) != 0) {
-        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
-                       "invalid http2 connection preface \"%*s\"",
-                       sizeof(preface) - 1, pos);
+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+                      "invalid connection preface");
 
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
     }
@@ -741,9 +900,8 @@ ngx_http_v2_state_preface_end(ngx_http_v2_connection_t *h2c, u_char *pos,
     }
 
     if (ngx_memcmp(pos, preface, sizeof(preface) - 1) != 0) {
-        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
-                       "invalid http2 connection preface \"%*s\"",
-                       sizeof(preface) - 1, pos);
+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+                      "invalid connection preface");
 
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
     }
@@ -832,6 +990,13 @@ ngx_http_v2_state_data(ngx_http_v2_connection_t *h2c, u_char *pos, u_char *end)
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
                    "http2 DATA frame");
 
+    if (h2c->state.sid == 0) {
+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+                      "client sent DATA frame with incorrect identifier");
+
+        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
+    }
+
     if (size > h2c->recv_window) {
         ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
                       "client violated connection flow control: "
@@ -930,6 +1095,7 @@ ngx_http_v2_state_read_data(ngx_http_v2_connection_t *h2c, u_char *pos,
     size_t                   size;
     ngx_buf_t               *buf;
     ngx_int_t                rc;
+    ngx_connection_t        *fc;
     ngx_http_request_t      *r;
     ngx_http_v2_stream_t    *stream;
     ngx_http_v2_srv_conf_t  *h2scf;
@@ -947,6 +1113,23 @@ ngx_http_v2_state_read_data(ngx_http_v2_connection_t *h2c, u_char *pos,
         return ngx_http_v2_state_skip_padded(h2c, pos, end);
     }
 
+    r = stream->request;
+    fc = r->connection;
+
+    if (r->reading_body && !r->request_body_no_buffering) {
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
+                       "skipping http2 DATA frame");
+
+        return ngx_http_v2_state_skip_padded(h2c, pos, end);
+    }
+
+    if (r->headers_in.content_length_n < 0 && !r->headers_in.chunked) {
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
+                       "skipping http2 DATA frame");
+
+        return ngx_http_v2_state_skip_padded(h2c, pos, end);
+    }
+
     size = end - pos;
 
     if (size >= h2c->state.length) {
@@ -954,7 +1137,7 @@ ngx_http_v2_state_read_data(ngx_http_v2_connection_t *h2c, u_char *pos,
         stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG;
     }
 
-    r = stream->request;
+    h2c->payload_bytes += size;
 
     if (r->request_body) {
         rc = ngx_http_v2_process_request_body(r, pos, size, stream->in_closed);
@@ -964,6 +1147,8 @@ ngx_http_v2_state_read_data(ngx_http_v2_connection_t *h2c, u_char *pos,
             ngx_http_finalize_request(r, rc);
         }
 
+        ngx_http_run_posted_requests(fc);
+
     } else if (size) {
         buf = stream->preread;
 
@@ -1009,12 +1194,15 @@ static u_char *
 ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
     u_char *end)
 {
-    size_t                   size;
-    ngx_uint_t               padded, priority, depend, dependency, excl, weight;
-    ngx_uint_t               status;
-    ngx_http_v2_node_t      *node;
-    ngx_http_v2_stream_t    *stream;
-    ngx_http_v2_srv_conf_t  *h2scf;
+    size_t                     size;
+    ngx_uint_t                 padded, priority, depend, dependency, excl,
+                               weight;
+    ngx_uint_t                 status;
+    ngx_http_v2_node_t        *node;
+    ngx_http_v2_stream_t      *stream;
+    ngx_http_v2_srv_conf_t    *h2scf;
+    ngx_http_core_srv_conf_t  *cscf;
+    ngx_http_core_loc_conf_t  *clcf;
 
     padded = h2c->state.flags & NGX_HTTP_V2_PADDED_FLAG;
     priority = h2c->state.flags & NGX_HTTP_V2_PRIORITY_FLAG;
@@ -1100,6 +1288,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
     }
 
+    if (depend == h2c->state.sid) {
+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+                      "client sent HEADERS frame for stream %ui "
+                      "with incorrect dependency", h2c->state.sid);
+
+        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
+    }
+
     h2c->last_sid = h2c->state.sid;
 
     h2c->state.pool = ngx_create_pool(1024, h2c->connection->log);
@@ -1107,20 +1303,15 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
     }
 
-    if (depend == h2c->state.sid) {
-        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
-                      "client sent HEADERS frame for stream %ui "
-                      "with incorrect dependency", h2c->state.sid);
+    cscf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
+                                        ngx_http_core_module);
 
-        status = NGX_HTTP_V2_PROTOCOL_ERROR;
-        goto rst_stream;
-    }
+    h2c->state.header_limit = cscf->large_client_header_buffers.size
+                              * cscf->large_client_header_buffers.num;
 
     h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
                                          ngx_http_v2_module);
 
-    h2c->state.header_limit = h2scf->max_header_size;
-
     if (h2c->processing >= h2scf->concurrent_streams) {
         ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
                       "concurrent streams exceeded %ui", h2c->processing);
@@ -1174,7 +1365,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
         ngx_http_v2_set_dependency(h2c, node, depend, excl);
     }
 
-    if (h2c->connection->requests >= h2scf->max_requests) {
+    clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx,
+                                        ngx_http_core_module);
+
+    if (clcf->keepalive_timeout == 0
+        || h2c->connection->requests >= clcf->keepalive_requests
+        || ngx_current_msec - h2c->connection->start_time
+           > clcf->keepalive_time)
+    {
         h2c->goaway = 1;
 
         if (ngx_http_v2_send_goaway(h2c, NGX_HTTP_V2_NO_ERROR) == NGX_ERROR) {
@@ -1299,10 +1497,10 @@ static u_char *
 ngx_http_v2_state_field_len(ngx_http_v2_connection_t *h2c, u_char *pos,
     u_char *end)
 {
-    size_t                   alloc;
-    ngx_int_t                len;
-    ngx_uint_t               huff;
-    ngx_http_v2_srv_conf_t  *h2scf;
+    size_t                     alloc;
+    ngx_int_t                  len;
+    ngx_uint_t                 huff;
+    ngx_http_core_srv_conf_t  *cscf;
 
     if (!(h2c->state.flags & NGX_HTTP_V2_END_HEADERS_FLAG)
         && h2c->state.length < NGX_HTTP_V2_INT_OCTETS)
@@ -1349,12 +1547,12 @@ ngx_http_v2_state_field_len(ngx_http_v2_connection_t *h2c, u_char *pos,
                    "http2 %s string, len:%i",
                    huff ? "encoded" : "raw", len);
 
-    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
-                                         ngx_http_v2_module);
+    cscf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
+                                        ngx_http_core_module);
 
-    if ((size_t) len > h2scf->max_field_size) {
+    if ((size_t) len > cscf->large_client_header_buffers.size) {
         ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
-                      "client exceeded http2_max_field_size limit");
+                      "client sent too large header field");
 
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_ENHANCE_YOUR_CALM);
     }
@@ -1569,7 +1767,7 @@ ngx_http_v2_state_process_header(ngx_http_v2_connection_t *h2c, u_char *pos,
 
     if (len > h2c->state.header_limit) {
         ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
-                      "client exceeded http2_max_header_size limit");
+                      "client sent too large header");
 
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_ENHANCE_YOUR_CALM);
     }
@@ -1698,8 +1896,13 @@ ngx_http_v2_state_header_complete(ngx_http_v2_connection_t *h2c, u_char *pos,
     ngx_http_v2_stream_t  *stream;
 
     if (h2c->state.length) {
-        h2c->state.handler = ngx_http_v2_state_header_block;
-        return pos;
+        if (end - pos > 0) {
+            h2c->state.handler = ngx_http_v2_state_header_block;
+            return pos;
+        }
+
+        return ngx_http_v2_state_headers_save(h2c, pos, end,
+                                              ngx_http_v2_state_header_block);
     }
 
     if (!(h2c->state.flags & NGX_HTTP_V2_END_HEADERS_FLAG)) {
@@ -1842,28 +2045,7 @@ ngx_http_v2_state_priority(ngx_http_v2_connection_t *h2c, u_char *pos,
                       "client sent PRIORITY frame for stream %ui "
                       "with incorrect dependency", h2c->state.sid);
 
-        node = ngx_http_v2_get_node_by_id(h2c, h2c->state.sid, 0);
-
-        if (node && node->stream) {
-            if (ngx_http_v2_terminate_stream(h2c, node->stream,
-                                             NGX_HTTP_V2_PROTOCOL_ERROR)
-                == NGX_ERROR)
-            {
-                return ngx_http_v2_connection_error(h2c,
-                                                    NGX_HTTP_V2_INTERNAL_ERROR);
-            }
-
-        } else {
-            if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid,
-                                            NGX_HTTP_V2_PROTOCOL_ERROR)
-                == NGX_ERROR)
-            {
-                return ngx_http_v2_connection_error(h2c,
-                                                    NGX_HTTP_V2_INTERNAL_ERROR);
-            }
-        }
-
-        return ngx_http_v2_state_complete(h2c, pos, end);
+        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
     }
 
     node = ngx_http_v2_get_node_by_id(h2c, h2c->state.sid, 1);
@@ -1982,6 +2164,16 @@ static u_char *
 ngx_http_v2_state_settings(ngx_http_v2_connection_t *h2c, u_char *pos,
     u_char *end)
 {
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
+                   "http2 SETTINGS frame");
+
+    if (h2c->state.sid) {
+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+                      "client sent SETTINGS frame with incorrect identifier");
+
+        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
+    }
+
     if (h2c->state.flags == NGX_HTTP_V2_ACK_FLAG) {
 
         if (h2c->state.length != 0) {
@@ -2005,9 +2197,6 @@ ngx_http_v2_state_settings(ngx_http_v2_connection_t *h2c, u_char *pos,
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_SIZE_ERROR);
     }
 
-    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
-                   "http2 SETTINGS frame");
-
     return ngx_http_v2_state_settings_params(h2c, pos, end);
 }
 
@@ -2156,6 +2345,13 @@ ngx_http_v2_state_ping(ngx_http_v2_connection_t *h2c, u_char *pos, u_char *end)
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
                    "http2 PING frame");
 
+    if (h2c->state.sid) {
+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+                      "client sent PING frame with incorrect identifier");
+
+        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
+    }
+
     if (h2c->state.flags & NGX_HTTP_V2_ACK_FLAG) {
         return ngx_http_v2_state_skip(h2c, pos, end);
     }
@@ -2197,6 +2393,13 @@ ngx_http_v2_state_goaway(ngx_http_v2_connection_t *h2c, u_char *pos,
         return ngx_http_v2_state_save(h2c, pos, end, ngx_http_v2_state_goaway);
     }
 
+    if (h2c->state.sid) {
+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+                      "client sent GOAWAY frame with incorrect identifier");
+
+        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
+    }
+
 #if (NGX_DEBUG)
     h2c->state.length -= NGX_HTTP_V2_GOAWAY_SIZE;
 
@@ -2246,41 +2449,11 @@ ngx_http_v2_state_window_update(ngx_http_v2_connection_t *h2c, u_char *pos,
                    h2c->state.sid, window);
 
     if (window == 0) {
-        if (h2c->state.sid == 0) {
-            ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
-                          "client sent WINDOW_UPDATE frame "
-                          "with incorrect window increment 0");
-
-            return ngx_http_v2_connection_error(h2c,
-                                                NGX_HTTP_V2_PROTOCOL_ERROR);
-        }
-
         ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
-                      "client sent WINDOW_UPDATE frame for stream %ui "
-                      "with incorrect window increment 0", h2c->state.sid);
-
-        node = ngx_http_v2_get_node_by_id(h2c, h2c->state.sid, 0);
-
-        if (node && node->stream) {
-            if (ngx_http_v2_terminate_stream(h2c, node->stream,
-                                             NGX_HTTP_V2_PROTOCOL_ERROR)
-                == NGX_ERROR)
-            {
-                return ngx_http_v2_connection_error(h2c,
-                                                    NGX_HTTP_V2_INTERNAL_ERROR);
-            }
-
-        } else {
-            if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid,
-                                            NGX_HTTP_V2_PROTOCOL_ERROR)
-                == NGX_ERROR)
-            {
-                return ngx_http_v2_connection_error(h2c,
-                                                    NGX_HTTP_V2_INTERNAL_ERROR);
-            }
-        }
+                      "client sent WINDOW_UPDATE frame "
+                      "with incorrect window increment 0");
 
-        return ngx_http_v2_state_complete(h2c, pos, end);
+        return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR);
     }
 
     if (h2c->state.sid) {
@@ -2496,10 +2669,6 @@ ngx_http_v2_connection_error(ngx_http_v2_connection_t *h2c,
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
                    "http2 state connection error");
 
-    if (err == NGX_HTTP_V2_INTERNAL_ERROR) {
-        ngx_debug_point();
-    }
-
     ngx_http_v2_finalize_connection(h2c, err);
 
     return NULL;
@@ -2954,9 +3123,9 @@ ngx_http_v2_get_frame(ngx_http_v2_connection_t *h2c, size_t length,
                       "requested control frame is too large: %uz", length);
         return NULL;
     }
+#endif
 
     frame->length = length;
-#endif
 
     buf->last = ngx_http_v2_write_len_and_type(buf->pos, length, type);
 
@@ -2983,6 +3152,8 @@ ngx_http_v2_frame_handler(ngx_http_v2_connection_t *h2c,
     frame->next = h2c->free_frames;
     h2c->free_frames = frame;
 
+    h2c->total_bytes += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length;
+
     return NGX_OK;
 }
 
@@ -3130,6 +3301,10 @@ ngx_http_v2_create_stream(ngx_http_v2_connection_t *h2c, ngx_uint_t push)
 
     h2c->priority_limit += h2scf->concurrent_streams;
 
+    if (h2c->connection->read->timer_set) {
+        ngx_del_timer(h2c->connection->read);
+    }
+
     return stream;
 }
 
@@ -3768,7 +3943,8 @@ ngx_http_v2_construct_cookie_header(ngx_http_request_t *r)
 static void
 ngx_http_v2_run_request(ngx_http_request_t *r)
 {
-    ngx_connection_t  *fc;
+    ngx_connection_t          *fc;
+    ngx_http_v2_connection_t  *h2c;
 
     fc = r->connection;
 
@@ -3800,6 +3976,10 @@ ngx_http_v2_run_request(ngx_http_request_t *r)
         r->headers_in.chunked = 1;
     }
 
+    h2c = r->stream->connection;
+
+    h2c->payload_bytes += r->request_length;
+
     ngx_http_process_request(r);
 
 failed:
@@ -4312,8 +4492,9 @@ ngx_http_v2_close_stream(ngx_http_v2_stream_t *stream, ngx_int_t rc)
     fc = stream->request->connection;
 
     if (stream->queued) {
-        fc->write->handler = ngx_http_v2_close_stream_handler;
-        fc->read->handler = ngx_http_empty_handler;
+        fc->error = 1;
+        fc->write->handler = ngx_http_v2_retry_close_stream_handler;
+        fc->read->handler = ngx_http_v2_retry_close_stream_handler;
         return;
     }
 
@@ -4329,33 +4510,11 @@ ngx_http_v2_close_stream(ngx_http_v2_stream_t *stream, ngx_int_t rc)
             }
 
         } else if (!stream->in_closed) {
-#if 0
             if (ngx_http_v2_send_rst_stream(h2c, node->id, NGX_HTTP_V2_NO_ERROR)
                 != NGX_OK)
             {
                 h2c->connection->error = 1;
             }
-#else
-            /*
-             * At the time of writing at least the latest versions of Chrome
-             * do not properly handle RST_STREAM with NO_ERROR status.
-             *
-             * See: https://bugs.chromium.org/p/chromium/issues/detail?id=603182
-             *
-             * As a workaround, the stream window is maximized before closing
-             * the stream.  This allows a client to send up to 2 GB of data
-             * before getting blocked on flow control.
-             */
-
-            if (stream->recv_window < NGX_HTTP_V2_MAX_WINDOW
-                && ngx_http_v2_send_window_update(h2c, node->id,
-                                                  NGX_HTTP_V2_MAX_WINDOW
-                                                  - stream->recv_window)
-                   != NGX_OK)
-            {
-                h2c->connection->error = 1;
-            }
-#endif
         }
     }
 
@@ -4457,6 +4616,22 @@ ngx_http_v2_close_stream_handler(ngx_event_t *ev)
 }
 
 
+static void
+ngx_http_v2_retry_close_stream_handler(ngx_event_t *ev)
+{
+    ngx_connection_t    *fc;
+    ngx_http_request_t  *r;
+
+    fc = ev->data;
+    r = fc->data;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, fc->log, 0,
+                   "http2 retry close stream handler");
+
+    ngx_http_v2_close_stream(r->stream, 0);
+}
+
+
 static void
 ngx_http_v2_handle_connection_handler(ngx_event_t *rev)
 {
@@ -4496,6 +4671,7 @@ ngx_http_v2_idle_handler(ngx_event_t *rev)
     ngx_connection_t          *c;
     ngx_http_v2_srv_conf_t    *h2scf;
     ngx_http_v2_connection_t  *h2c;
+    ngx_http_core_loc_conf_t  *clcf;
 
     c = rev->data;
     h2c = c->data;
@@ -4527,10 +4703,10 @@ ngx_http_v2_idle_handler(ngx_event_t *rev)
 
 #endif
 
-    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
-                                         ngx_http_v2_module);
+    clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx,
+                                        ngx_http_core_module);
 
-    if (h2c->idle++ > 10 * h2scf->max_requests) {
+    if (h2c->idle++ > 10 * clcf->keepalive_requests) {
         ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
                       "http2 flood detected");
         ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_NO_ERROR);
@@ -4540,6 +4716,9 @@ ngx_http_v2_idle_handler(ngx_event_t *rev)
     c->destroyed = 0;
     ngx_reusable_connection(c, 0);
 
+    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
+                                         ngx_http_v2_module);
+
     h2c->pool = ngx_create_pool(h2scf->pool_size, h2c->connection->log);
     if (h2c->pool == NULL) {
         ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
@@ -4570,16 +4749,15 @@ ngx_http_v2_finalize_connection(ngx_http_v2_connection_t *h2c,
     h2c->blocked = 1;
 
     if (!c->error && !h2c->goaway) {
+        h2c->goaway = 1;
+
         if (ngx_http_v2_send_goaway(h2c, status) != NGX_ERROR) {
             (void) ngx_http_v2_send_output_queue(h2c);
         }
     }
 
-    c->error = 1;
-
     if (!h2c->processing && !h2c->pushing) {
-        ngx_http_close_connection(c);
-        return;
+        goto done;
     }
 
     c->read->handler = ngx_http_empty_handler;
@@ -4627,10 +4805,18 @@ ngx_http_v2_finalize_connection(ngx_http_v2_connection_t *h2c,
     h2c->blocked = 0;
 
     if (h2c->processing || h2c->pushing) {
+        c->error = 1;
+        return;
+    }
+
+done:
+
+    if (c->error) {
+        ngx_http_close_connection(c);
         return;
     }
 
-    ngx_http_close_connection(c);
+    ngx_http_v2_lingering_close(c);
 }
 
 
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
index 69d55d1c..34922971 100644
--- a/src/http/v2/ngx_http_v2.h
+++ b/src/http/v2/ngx_http_v2.h
@@ -119,6 +119,9 @@ struct ngx_http_v2_connection_s {
     ngx_connection_t                *connection;
     ngx_http_connection_t           *http_connection;
 
+    off_t                            total_bytes;
+    off_t                            payload_bytes;
+
     ngx_uint_t                       processing;
     ngx_uint_t                       frames;
     ngx_uint_t                       idle;
@@ -154,6 +157,8 @@ struct ngx_http_v2_connection_s {
     ngx_uint_t                       last_sid;
     ngx_uint_t                       last_push;
 
+    time_t                           lingering_time;
+
     unsigned                         closed_nodes:8;
     unsigned                         settings_ack:1;
     unsigned                         table_update:1;
diff --git a/src/http/v2/ngx_http_v2_filter_module.c b/src/http/v2/ngx_http_v2_filter_module.c
index 7735b5b2..a6e5e7d4 100644
--- a/src/http/v2/ngx_http_v2_filter_module.c
+++ b/src/http/v2/ngx_http_v2_filter_module.c
@@ -1444,6 +1444,12 @@ ngx_http_v2_send_chain(ngx_connection_t *fc, ngx_chain_t *in, off_t limit)
 
     if (in == NULL || stream->out_closed) {
 
+        if (size) {
+            ngx_log_error(NGX_LOG_ERR, fc->log, 0,
+                          "output on closed stream");
+            return NGX_CHAIN_ERROR;
+        }
+
         if (stream->queued) {
             fc->write->active = 1;
             fc->write->ready = 0;
@@ -1871,6 +1877,8 @@ ngx_http_v2_headers_frame_handler(ngx_http_v2_connection_t *h2c,
     stream->request->header_size += NGX_HTTP_V2_FRAME_HEADER_SIZE
                                     + frame->length;
 
+    h2c->payload_bytes += frame->length;
+
     ngx_http_v2_handle_frame(stream, frame);
 
     ngx_http_v2_handle_stream(h2c, stream);
@@ -1925,6 +1933,8 @@ ngx_http_v2_push_frame_handler(ngx_http_v2_connection_t *h2c,
     stream->request->header_size += NGX_HTTP_V2_FRAME_HEADER_SIZE
                                     + frame->length;
 
+    h2c->payload_bytes += frame->length;
+
     ngx_http_v2_handle_frame(stream, frame);
 
     ngx_http_v2_handle_stream(h2c, stream);
@@ -2018,6 +2028,8 @@ ngx_http_v2_data_frame_handler(ngx_http_v2_connection_t *h2c,
 
     stream->request->header_size += NGX_HTTP_V2_FRAME_HEADER_SIZE;
 
+    h2c->payload_bytes += frame->length;
+
     ngx_http_v2_handle_frame(stream, frame);
 
     ngx_http_v2_handle_stream(h2c, stream);
@@ -2030,12 +2042,17 @@ static ngx_inline void
 ngx_http_v2_handle_frame(ngx_http_v2_stream_t *stream,
     ngx_http_v2_out_frame_t *frame)
 {
-    ngx_http_request_t  *r;
+    ngx_http_request_t        *r;
+    ngx_http_v2_connection_t  *h2c;
 
     r = stream->request;
 
     r->connection->sent += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length;
 
+    h2c = stream->connection;
+
+    h2c->total_bytes += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length;
+
     if (frame->fin) {
         stream->out_closed = 1;
     }
diff --git a/src/http/v2/ngx_http_v2_module.c b/src/http/v2/ngx_http_v2_module.c
index c54dc103..00508861 100644
--- a/src/http/v2/ngx_http_v2_module.c
+++ b/src/http/v2/ngx_http_v2_module.c
@@ -36,10 +36,31 @@ static char *ngx_http_v2_preread_size(ngx_conf_t *cf, void *post, void *data);
 static char *ngx_http_v2_streams_index_mask(ngx_conf_t *cf, void *post,
     void *data);
 static char *ngx_http_v2_chunk_size(ngx_conf_t *cf, void *post, void *data);
-static char *ngx_http_v2_spdy_deprecated(ngx_conf_t *cf, ngx_command_t *cmd,
+static char *ngx_http_v2_obsolete(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 
 
+static ngx_conf_deprecated_t  ngx_http_v2_recv_timeout_deprecated = {
+    ngx_conf_deprecated, "http2_recv_timeout", "client_header_timeout"
+};
+
+static ngx_conf_deprecated_t  ngx_http_v2_idle_timeout_deprecated = {
+    ngx_conf_deprecated, "http2_idle_timeout", "keepalive_timeout"
+};
+
+static ngx_conf_deprecated_t  ngx_http_v2_max_requests_deprecated = {
+    ngx_conf_deprecated, "http2_max_requests", "keepalive_requests"
+};
+
+static ngx_conf_deprecated_t  ngx_http_v2_max_field_size_deprecated = {
+    ngx_conf_deprecated, "http2_max_field_size", "large_client_header_buffers"
+};
+
+static ngx_conf_deprecated_t  ngx_http_v2_max_header_size_deprecated = {
+    ngx_conf_deprecated, "http2_max_header_size", "large_client_header_buffers"
+};
+
+
 static ngx_conf_post_t  ngx_http_v2_recv_buffer_size_post =
     { ngx_http_v2_recv_buffer_size };
 static ngx_conf_post_t  ngx_http_v2_pool_size_post =
@@ -84,24 +105,24 @@ static ngx_command_t  ngx_http_v2_commands[] = {
 
     { ngx_string("http2_max_requests"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_num_slot,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      offsetof(ngx_http_v2_srv_conf_t, max_requests),
-      NULL },
+      ngx_http_v2_obsolete,
+      0,
+      0,
+      &ngx_http_v2_max_requests_deprecated },
 
     { ngx_string("http2_max_field_size"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_size_slot,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      offsetof(ngx_http_v2_srv_conf_t, max_field_size),
-      NULL },
+      ngx_http_v2_obsolete,
+      0,
+      0,
+      &ngx_http_v2_max_field_size_deprecated },
 
     { ngx_string("http2_max_header_size"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_size_slot,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      offsetof(ngx_http_v2_srv_conf_t, max_header_size),
-      NULL },
+      ngx_http_v2_obsolete,
+      0,
+      0,
+      &ngx_http_v2_max_header_size_deprecated },
 
     { ngx_string("http2_body_preread_size"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
@@ -119,17 +140,17 @@ static ngx_command_t  ngx_http_v2_commands[] = {
 
     { ngx_string("http2_recv_timeout"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_msec_slot,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      offsetof(ngx_http_v2_srv_conf_t, recv_timeout),
-      NULL },
+      ngx_http_v2_obsolete,
+      0,
+      0,
+      &ngx_http_v2_recv_timeout_deprecated },
 
     { ngx_string("http2_idle_timeout"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_msec_slot,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      offsetof(ngx_http_v2_srv_conf_t, idle_timeout),
-      NULL },
+      ngx_http_v2_obsolete,
+      0,
+      0,
+      &ngx_http_v2_idle_timeout_deprecated },
 
     { ngx_string("http2_chunk_size"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
@@ -152,62 +173,6 @@ static ngx_command_t  ngx_http_v2_commands[] = {
       0,
       NULL },
 
-    { ngx_string("spdy_recv_buffer_size"),
-      NGX_HTTP_MAIN_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_MAIN_CONF_OFFSET,
-      0,
-      NULL },
-
-    { ngx_string("spdy_pool_size"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      0,
-      NULL },
-
-    { ngx_string("spdy_max_concurrent_streams"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      0,
-      NULL },
-
-    { ngx_string("spdy_streams_index_size"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      0,
-      NULL },
-
-    { ngx_string("spdy_recv_timeout"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      0,
-      NULL },
-
-    { ngx_string("spdy_keepalive_timeout"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      0,
-      NULL },
-
-    { ngx_string("spdy_headers_comp"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_SRV_CONF_OFFSET,
-      0,
-      NULL },
-
-    { ngx_string("spdy_chunk_size"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-      ngx_http_v2_spdy_deprecated,
-      NGX_HTTP_LOC_CONF_OFFSET,
-      0,
-      NULL },
-
       ngx_null_command
 };
 
@@ -353,18 +318,11 @@ ngx_http_v2_create_srv_conf(ngx_conf_t *cf)
 
     h2scf->concurrent_streams = NGX_CONF_UNSET_UINT;
     h2scf->concurrent_pushes = NGX_CONF_UNSET_UINT;
-    h2scf->max_requests = NGX_CONF_UNSET_UINT;
-
-    h2scf->max_field_size = NGX_CONF_UNSET_SIZE;
-    h2scf->max_header_size = NGX_CONF_UNSET_SIZE;
 
     h2scf->preread_size = NGX_CONF_UNSET_SIZE;
 
     h2scf->streams_index_mask = NGX_CONF_UNSET_UINT;
 
-    h2scf->recv_timeout = NGX_CONF_UNSET_MSEC;
-    h2scf->idle_timeout = NGX_CONF_UNSET_MSEC;
-
     return h2scf;
 }
 
@@ -381,23 +339,12 @@ ngx_http_v2_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
                               prev->concurrent_streams, 128);
     ngx_conf_merge_uint_value(conf->concurrent_pushes,
                               prev->concurrent_pushes, 10);
-    ngx_conf_merge_uint_value(conf->max_requests, prev->max_requests, 1000);
-
-    ngx_conf_merge_size_value(conf->max_field_size, prev->max_field_size,
-                              4096);
-    ngx_conf_merge_size_value(conf->max_header_size, prev->max_header_size,
-                              16384);
 
     ngx_conf_merge_size_value(conf->preread_size, prev->preread_size, 65536);
 
     ngx_conf_merge_uint_value(conf->streams_index_mask,
                               prev->streams_index_mask, 32 - 1);
 
-    ngx_conf_merge_msec_value(conf->recv_timeout,
-                              prev->recv_timeout, 30000);
-    ngx_conf_merge_msec_value(conf->idle_timeout,
-                              prev->idle_timeout, 180000);
-
     return NGX_CONF_OK;
 }
 
@@ -600,11 +547,14 @@ ngx_http_v2_chunk_size(ngx_conf_t *cf, void *post, void *data)
 
 
 static char *
-ngx_http_v2_spdy_deprecated(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+ngx_http_v2_obsolete(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 {
+    ngx_conf_deprecated_t  *d = cmd->post;
+
     ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
-                       "invalid directive \"%V\": ngx_http_spdy_module "
-                       "was superseded by ngx_http_v2_module", &cmd->name);
+                       "the \"%s\" directive is obsolete, "
+                       "use the \"%s\" directive instead",
+                       d->old_name, d->new_name);
 
     return NGX_CONF_OK;
 }
diff --git a/src/http/v2/ngx_http_v2_module.h b/src/http/v2/ngx_http_v2_module.h
index cdd2921a..ca4a0bfc 100644
--- a/src/http/v2/ngx_http_v2_module.h
+++ b/src/http/v2/ngx_http_v2_module.h
@@ -24,13 +24,8 @@ typedef struct {
     size_t                          pool_size;
     ngx_uint_t                      concurrent_streams;
     ngx_uint_t                      concurrent_pushes;
-    ngx_uint_t                      max_requests;
-    size_t                          max_field_size;
-    size_t                          max_header_size;
     size_t                          preread_size;
     ngx_uint_t                      streams_index_mask;
-    ngx_msec_t                      recv_timeout;
-    ngx_msec_t                      idle_timeout;
 } ngx_http_v2_srv_conf_t;
 
 
diff --git a/src/mail/ngx_mail.c b/src/mail/ngx_mail.c
index f17c2ccc..890d8153 100644
--- a/src/mail/ngx_mail.c
+++ b/src/mail/ngx_mail.c
@@ -405,6 +405,7 @@ ngx_mail_add_addrs(ngx_conf_t *cf, ngx_mail_port_t *mport,
 #if (NGX_MAIL_SSL)
         addrs[i].conf.ssl = addr[i].opt.ssl;
 #endif
+        addrs[i].conf.proxy_protocol = addr[i].opt.proxy_protocol;
         addrs[i].conf.addr_text = addr[i].opt.addr_text;
     }
 
@@ -439,6 +440,7 @@ ngx_mail_add_addrs6(ngx_conf_t *cf, ngx_mail_port_t *mport,
 #if (NGX_MAIL_SSL)
         addrs6[i].conf.ssl = addr[i].opt.ssl;
 #endif
+        addrs6[i].conf.proxy_protocol = addr[i].opt.proxy_protocol;
         addrs6[i].conf.addr_text = addr[i].opt.addr_text;
     }
 
diff --git a/src/mail/ngx_mail.h b/src/mail/ngx_mail.h
index d904f25f..21178c3e 100644
--- a/src/mail/ngx_mail.h
+++ b/src/mail/ngx_mail.h
@@ -41,6 +41,7 @@ typedef struct {
     unsigned                ipv6only:1;
 #endif
     unsigned                so_keepalive:2;
+    unsigned                proxy_protocol:1;
 #if (NGX_HAVE_KEEPALIVE_TUNABLE)
     int                     tcp_keepidle;
     int                     tcp_keepintvl;
@@ -55,7 +56,8 @@ typedef struct {
 typedef struct {
     ngx_mail_conf_ctx_t    *ctx;
     ngx_str_t               addr_text;
-    ngx_uint_t              ssl;    /* unsigned   ssl:1; */
+    unsigned                ssl:1;
+    unsigned                proxy_protocol:1;
 } ngx_mail_addr_conf_t;
 
 typedef struct {
@@ -113,6 +115,8 @@ typedef struct {
     ngx_msec_t              timeout;
     ngx_msec_t              resolver_timeout;
 
+    ngx_uint_t              max_errors;
+
     ngx_str_t               server_name;
 
     u_char                 *file_name;
@@ -162,10 +166,12 @@ typedef enum {
     ngx_smtp_auth_external,
     ngx_smtp_helo,
     ngx_smtp_helo_xclient,
+    ngx_smtp_helo_auth,
     ngx_smtp_helo_from,
     ngx_smtp_xclient,
     ngx_smtp_xclient_from,
     ngx_smtp_xclient_helo,
+    ngx_smtp_xclient_auth,
     ngx_smtp_from,
     ngx_smtp_to
 } ngx_smtp_state_e;
@@ -174,6 +180,7 @@ typedef enum {
 typedef struct {
     ngx_peer_connection_t   upstream;
     ngx_buf_t              *buffer;
+    ngx_uint_t              proxy_protocol;  /* unsigned  proxy_protocol:1; */
 } ngx_mail_proxy_ctx_t;
 
 
@@ -195,6 +202,7 @@ typedef struct {
 
     ngx_uint_t              mail_state;
 
+    unsigned                ssl:1;
     unsigned                protocol:3;
     unsigned                blocked:1;
     unsigned                quit:1;
@@ -225,14 +233,15 @@ typedef struct {
     ngx_uint_t              command;
     ngx_array_t             args;
 
+    ngx_uint_t              errors;
     ngx_uint_t              login_attempt;
 
     /* used to parse POP3/IMAP/SMTP command */
 
     ngx_uint_t              state;
+    u_char                 *tag_start;
     u_char                 *cmd_start;
     u_char                 *arg_start;
-    u_char                 *arg_end;
     ngx_uint_t              literal_len;
 } ngx_mail_session_t;
 
@@ -403,6 +412,7 @@ char *ngx_mail_capabilities(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
 /* STUB */
 void ngx_mail_proxy_init(ngx_mail_session_t *s, ngx_addr_t *peer);
 void ngx_mail_auth_http_init(ngx_mail_session_t *s);
+ngx_int_t ngx_mail_realip_handler(ngx_mail_session_t *s);
 /**/
 
 
diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c
index 6b57358b..2a198f49 100644
--- a/src/mail/ngx_mail_auth_http_module.c
+++ b/src/mail/ngx_mail_auth_http_module.c
@@ -1135,10 +1135,10 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool,
     size_t                     len;
     ngx_buf_t                 *b;
     ngx_str_t                  login, passwd;
+    ngx_connection_t          *c;
 #if (NGX_MAIL_SSL)
     ngx_str_t                  verify, subject, issuer, serial, fingerprint,
                                raw_cert, cert;
-    ngx_connection_t          *c;
     ngx_mail_ssl_conf_t       *sslcf;
 #endif
     ngx_mail_core_srv_conf_t  *cscf;
@@ -1151,9 +1151,10 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool,
         return NULL;
     }
 
+    c = s->connection;
+
 #if (NGX_MAIL_SSL)
 
-    c = s->connection;
     sslcf = ngx_mail_get_module_srv_conf(s, ngx_mail_ssl_module);
 
     if (c->ssl && sslcf->verify) {
@@ -1224,22 +1225,49 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool,
           + sizeof("Client-IP: ") - 1 + s->connection->addr_text.len
                 + sizeof(CRLF) - 1
           + sizeof("Client-Host: ") - 1 + s->host.len + sizeof(CRLF) - 1
-          + sizeof("Auth-SMTP-Helo: ") - 1 + s->smtp_helo.len + sizeof(CRLF) - 1
-          + sizeof("Auth-SMTP-From: ") - 1 + s->smtp_from.len + sizeof(CRLF) - 1
-          + sizeof("Auth-SMTP-To: ") - 1 + s->smtp_to.len + sizeof(CRLF) - 1
-#if (NGX_MAIL_SSL)
-          + sizeof("Auth-SSL: on" CRLF) - 1
-          + sizeof("Auth-SSL-Verify: ") - 1 + verify.len + sizeof(CRLF) - 1
-          + sizeof("Auth-SSL-Subject: ") - 1 + subject.len + sizeof(CRLF) - 1
-          + sizeof("Auth-SSL-Issuer: ") - 1 + issuer.len + sizeof(CRLF) - 1
-          + sizeof("Auth-SSL-Serial: ") - 1 + serial.len + sizeof(CRLF) - 1
-          + sizeof("Auth-SSL-Fingerprint: ") - 1 + fingerprint.len
-              + sizeof(CRLF) - 1
-          + sizeof("Auth-SSL-Cert: ") - 1 + cert.len + sizeof(CRLF) - 1
-#endif
           + ahcf->header.len
           + sizeof(CRLF) - 1;
 
+    if (c->proxy_protocol) {
+        len += sizeof("Proxy-Protocol-Addr: ") - 1
+                     + c->proxy_protocol->src_addr.len + sizeof(CRLF) - 1
+               + sizeof("Proxy-Protocol-Port: ") - 1
+                     + sizeof("65535") - 1 + sizeof(CRLF) - 1
+               + sizeof("Proxy-Protocol-Server-Addr: ") - 1
+                     + c->proxy_protocol->dst_addr.len + sizeof(CRLF) - 1
+               + sizeof("Proxy-Protocol-Server-Port: ") - 1
+                     + sizeof("65535") - 1 + sizeof(CRLF) - 1;
+    }
+
+    if (s->auth_method == NGX_MAIL_AUTH_NONE) {
+        len += sizeof("Auth-SMTP-Helo: ") - 1 + s->smtp_helo.len
+                     + sizeof(CRLF) - 1
+               + sizeof("Auth-SMTP-From: ") - 1 + s->smtp_from.len
+                     + sizeof(CRLF) - 1
+               + sizeof("Auth-SMTP-To: ") - 1 + s->smtp_to.len
+                     + sizeof(CRLF) - 1;
+    }
+
+#if (NGX_MAIL_SSL)
+
+    if (c->ssl) {
+        len += sizeof("Auth-SSL: on" CRLF) - 1
+               + sizeof("Auth-SSL-Verify: ") - 1 + verify.len
+                     + sizeof(CRLF) - 1
+               + sizeof("Auth-SSL-Subject: ") - 1 + subject.len
+                     + sizeof(CRLF) - 1
+               + sizeof("Auth-SSL-Issuer: ") - 1 + issuer.len
+                     + sizeof(CRLF) - 1
+               + sizeof("Auth-SSL-Serial: ") - 1 + serial.len
+                     + sizeof(CRLF) - 1
+               + sizeof("Auth-SSL-Fingerprint: ") - 1 + fingerprint.len
+                     + sizeof(CRLF) - 1
+               + sizeof("Auth-SSL-Cert: ") - 1 + cert.len
+                     + sizeof(CRLF) - 1;
+    }
+
+#endif
+
     b = ngx_create_temp_buf(pool, len);
     if (b == NULL) {
         return NULL;
@@ -1298,6 +1326,26 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool,
         *b->last++ = CR; *b->last++ = LF;
     }
 
+    if (c->proxy_protocol) {
+        b->last = ngx_cpymem(b->last, "Proxy-Protocol-Addr: ",
+                             sizeof("Proxy-Protocol-Addr: ") - 1);
+        b->last = ngx_copy(b->last, c->proxy_protocol->src_addr.data,
+                           c->proxy_protocol->src_addr.len);
+        *b->last++ = CR; *b->last++ = LF;
+
+        b->last = ngx_sprintf(b->last, "Proxy-Protocol-Port: %d" CRLF,
+                              c->proxy_protocol->src_port);
+
+        b->last = ngx_cpymem(b->last, "Proxy-Protocol-Server-Addr: ",
+                             sizeof("Proxy-Protocol-Server-Addr: ") - 1);
+        b->last = ngx_copy(b->last, c->proxy_protocol->dst_addr.data,
+                           c->proxy_protocol->dst_addr.len);
+        *b->last++ = CR; *b->last++ = LF;
+
+        b->last = ngx_sprintf(b->last, "Proxy-Protocol-Server-Port: %d" CRLF,
+                              c->proxy_protocol->dst_port);
+    }
+
     if (s->auth_method == NGX_MAIL_AUTH_NONE) {
 
         /* HELO, MAIL FROM, and RCPT TO can't contain CRLF, no need to escape */
diff --git a/src/mail/ngx_mail_core_module.c b/src/mail/ngx_mail_core_module.c
index e16d7023..115671ca 100644
--- a/src/mail/ngx_mail_core_module.c
+++ b/src/mail/ngx_mail_core_module.c
@@ -85,6 +85,13 @@ static ngx_command_t  ngx_mail_core_commands[] = {
       offsetof(ngx_mail_core_srv_conf_t, resolver_timeout),
       NULL },
 
+    { ngx_string("max_errors"),
+      NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_num_slot,
+      NGX_MAIL_SRV_CONF_OFFSET,
+      offsetof(ngx_mail_core_srv_conf_t, max_errors),
+      NULL },
+
       ngx_null_command
 };
 
@@ -163,6 +170,8 @@ ngx_mail_core_create_srv_conf(ngx_conf_t *cf)
     cscf->timeout = NGX_CONF_UNSET_MSEC;
     cscf->resolver_timeout = NGX_CONF_UNSET_MSEC;
 
+    cscf->max_errors = NGX_CONF_UNSET_UINT;
+
     cscf->resolver = NGX_CONF_UNSET_PTR;
 
     cscf->file_name = cf->conf_file->file.name.data;
@@ -182,6 +191,7 @@ ngx_mail_core_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_msec_value(conf->resolver_timeout, prev->resolver_timeout,
                               30000);
 
+    ngx_conf_merge_uint_value(conf->max_errors, prev->max_errors, 5);
 
     ngx_conf_merge_str_value(conf->server_name, prev->server_name, "");
 
@@ -548,6 +558,11 @@ ngx_mail_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 #endif
         }
 
+        if (ngx_strcmp(value[i].data, "proxy_protocol") == 0) {
+            ls->proxy_protocol = 1;
+            continue;
+        }
+
         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                            "the invalid \"%V\" parameter", &value[i]);
         return NGX_CONF_ERROR;
diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
index 803a247d..246ba97c 100644
--- a/src/mail/ngx_mail_handler.c
+++ b/src/mail/ngx_mail_handler.c
@@ -11,6 +11,8 @@
 #include <ngx_mail.h>
 
 
+static void ngx_mail_proxy_protocol_handler(ngx_event_t *rev);
+static void ngx_mail_init_session_handler(ngx_event_t *rev);
 static void ngx_mail_init_session(ngx_connection_t *c);
 
 #if (NGX_MAIL_SSL)
@@ -26,6 +28,7 @@ ngx_mail_init_connection(ngx_connection_t *c)
 {
     size_t                     len;
     ngx_uint_t                 i;
+    ngx_event_t               *rev;
     ngx_mail_port_t           *port;
     struct sockaddr           *sa;
     struct sockaddr_in        *sin;
@@ -129,6 +132,10 @@ ngx_mail_init_connection(ngx_connection_t *c)
     s->main_conf = addr_conf->ctx->main_conf;
     s->srv_conf = addr_conf->ctx->srv_conf;
 
+#if (NGX_MAIL_SSL)
+    s->ssl = addr_conf->ssl;
+#endif
+
     s->addr_text = &addr_conf->addr_text;
 
     c->data = s;
@@ -159,13 +166,126 @@ ngx_mail_init_connection(ngx_connection_t *c)
 
     c->log_error = NGX_ERROR_INFO;
 
+    rev = c->read;
+    rev->handler = ngx_mail_init_session_handler;
+
+    if (addr_conf->proxy_protocol) {
+        c->log->action = "reading PROXY protocol";
+
+        rev->handler = ngx_mail_proxy_protocol_handler;
+
+        if (!rev->ready) {
+            ngx_add_timer(rev, cscf->timeout);
+
+            if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+                ngx_mail_close_connection(c);
+            }
+
+            return;
+        }
+    }
+
+    if (ngx_use_accept_mutex) {
+        ngx_post_event(rev, &ngx_posted_events);
+        return;
+    }
+
+    rev->handler(rev);
+}
+
+
+static void
+ngx_mail_proxy_protocol_handler(ngx_event_t *rev)
+{
+    u_char                    *p, buf[NGX_PROXY_PROTOCOL_MAX_HEADER];
+    size_t                     size;
+    ssize_t                    n;
+    ngx_err_t                  err;
+    ngx_connection_t          *c;
+    ngx_mail_session_t        *s;
+    ngx_mail_core_srv_conf_t  *cscf;
+
+    c = rev->data;
+    s = c->data;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0,
+                   "mail PROXY protocol handler");
+
+    if (rev->timedout) {
+        ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");
+        c->timedout = 1;
+        ngx_mail_close_connection(c);
+        return;
+    }
+
+    n = recv(c->fd, (char *) buf, sizeof(buf), MSG_PEEK);
+
+    err = ngx_socket_errno;
+
+    ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, "recv(): %z", n);
+
+    if (n == -1) {
+        if (err == NGX_EAGAIN) {
+            rev->ready = 0;
+
+            if (!rev->timer_set) {
+                cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
+                ngx_add_timer(rev, cscf->timeout);
+            }
+
+            if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+                ngx_mail_close_connection(c);
+            }
+
+            return;
+        }
+
+        ngx_connection_error(c, err, "recv() failed");
+
+        ngx_mail_close_connection(c);
+        return;
+    }
+
+    p = ngx_proxy_protocol_read(c, buf, buf + n);
+
+    if (p == NULL) {
+        ngx_mail_close_connection(c);
+        return;
+    }
+
+    size = p - buf;
+
+    if (c->recv(c, buf, size) != (ssize_t) size) {
+        ngx_mail_close_connection(c);
+        return;
+    }
+
+    if (ngx_mail_realip_handler(s) != NGX_OK) {
+        ngx_mail_close_connection(c);
+        return;
+    }
+
+    ngx_mail_init_session_handler(rev);
+}
+
+
+static void
+ngx_mail_init_session_handler(ngx_event_t *rev)
+{
+    ngx_connection_t  *c;
+
+    c = rev->data;
+
 #if (NGX_MAIL_SSL)
     {
+    ngx_mail_session_t   *s;
     ngx_mail_ssl_conf_t  *sslcf;
 
+    s = c->data;
+
     sslcf = ngx_mail_get_module_srv_conf(s, ngx_mail_ssl_module);
 
-    if (sslcf->enable || addr_conf->ssl) {
+    if (sslcf->enable || s->ssl) {
         c->log->action = "SSL handshaking";
 
         ngx_mail_ssl_init_connection(&sslcf->ssl, c);
@@ -215,9 +335,10 @@ ngx_mail_ssl_init_connection(ngx_ssl_t *ssl, ngx_connection_t *c)
 
         s = c->data;
 
-        cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
-
-        ngx_add_timer(c->read, cscf->timeout);
+        if (!c->read->timer_set) {
+            cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
+            ngx_add_timer(c->read, cscf->timeout);
+        }
 
         c->ssl->handler = ngx_mail_ssl_handshake_handler;
 
@@ -338,6 +459,8 @@ ngx_mail_init_session(ngx_connection_t *c)
 
     s = c->data;
 
+    c->log->action = "sending client greeting line";
+
     cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
 
     s->protocol = cscf->protocol->type;
@@ -710,25 +833,23 @@ ngx_mail_read_command(ngx_mail_session_t *s, ngx_connection_t *c)
     ngx_str_t                  l;
     ngx_mail_core_srv_conf_t  *cscf;
 
-    n = c->recv(c, s->buffer->last, s->buffer->end - s->buffer->last);
+    if (s->buffer->last < s->buffer->end) {
 
-    if (n == NGX_ERROR || n == 0) {
-        ngx_mail_close_connection(c);
-        return NGX_ERROR;
-    }
-
-    if (n > 0) {
-        s->buffer->last += n;
-    }
+        n = c->recv(c, s->buffer->last, s->buffer->end - s->buffer->last);
 
-    if (n == NGX_AGAIN) {
-        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
-            ngx_mail_session_internal_server_error(s);
+        if (n == NGX_ERROR || n == 0) {
+            ngx_mail_close_connection(c);
             return NGX_ERROR;
         }
 
-        if (s->buffer->pos == s->buffer->last) {
-            return NGX_AGAIN;
+        if (n > 0) {
+            s->buffer->last += n;
+        }
+
+        if (n == NGX_AGAIN) {
+            if (s->buffer->pos == s->buffer->last) {
+                return NGX_AGAIN;
+            }
         }
     }
 
@@ -753,7 +874,20 @@ ngx_mail_read_command(ngx_mail_session_t *s, ngx_connection_t *c)
         return NGX_MAIL_PARSE_INVALID_COMMAND;
     }
 
-    if (rc == NGX_IMAP_NEXT || rc == NGX_MAIL_PARSE_INVALID_COMMAND) {
+    if (rc == NGX_MAIL_PARSE_INVALID_COMMAND) {
+
+        s->errors++;
+
+        if (s->errors >= cscf->max_errors) {
+            ngx_log_error(NGX_LOG_INFO, c->log, 0,
+                          "client sent too many invalid commands");
+            s->quit = 1;
+        }
+
+        return rc;
+    }
+
+    if (rc == NGX_IMAP_NEXT) {
         return rc;
     }
 
diff --git a/src/mail/ngx_mail_imap_handler.c b/src/mail/ngx_mail_imap_handler.c
index 3bf09ec3..291e87a4 100644
--- a/src/mail/ngx_mail_imap_handler.c
+++ b/src/mail/ngx_mail_imap_handler.c
@@ -101,10 +101,9 @@ ngx_mail_imap_init_protocol(ngx_event_t *rev)
 void
 ngx_mail_imap_auth_state(ngx_event_t *rev)
 {
-    u_char              *p, *dst, *src, *end;
-    ngx_str_t           *arg;
+    u_char              *p;
     ngx_int_t            rc;
-    ngx_uint_t           tag, i;
+    ngx_uint_t           tag;
     ngx_connection_t    *c;
     ngx_mail_session_t  *s;
 
@@ -123,6 +122,12 @@ ngx_mail_imap_auth_state(ngx_event_t *rev)
     if (s->out.len) {
         ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, "imap send handler busy");
         s->blocked = 1;
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_close_connection(c);
+            return;
+        }
+
         return;
     }
 
@@ -130,7 +135,16 @@ ngx_mail_imap_auth_state(ngx_event_t *rev)
 
     rc = ngx_mail_read_command(s, c);
 
-    if (rc == NGX_AGAIN || rc == NGX_ERROR) {
+    if (rc == NGX_AGAIN) {
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_session_internal_server_error(s);
+            return;
+        }
+
+        return;
+    }
+
+    if (rc == NGX_ERROR) {
         return;
     }
 
@@ -143,27 +157,6 @@ ngx_mail_imap_auth_state(ngx_event_t *rev)
         ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, "imap auth command: %i",
                        s->command);
 
-        if (s->backslash) {
-
-            arg = s->args.elts;
-
-            for (i = 0; i < s->args.nelts; i++) {
-                dst = arg[i].data;
-                end = dst + arg[i].len;
-
-                for (src = dst; src < end; dst++) {
-                    *dst = *src;
-                    if (*src++ == '\\') {
-                        *dst = *src++;
-                    }
-                }
-
-                arg[i].len = dst - arg[i].data;
-            }
-
-            s->backslash = 0;
-        }
-
         switch (s->mail_state) {
 
         case ngx_imap_start:
@@ -233,6 +226,10 @@ ngx_mail_imap_auth_state(ngx_event_t *rev)
         ngx_str_set(&s->out, imap_next);
     }
 
+    if (s->buffer->pos < s->buffer->last) {
+        s->blocked = 1;
+    }
+
     switch (rc) {
 
     case NGX_DONE:
@@ -282,17 +279,23 @@ ngx_mail_imap_auth_state(ngx_event_t *rev)
 
         if (s->state) {
             /* preserve tag */
-            s->arg_start = s->buffer->start + s->tag.len;
-            s->buffer->pos = s->arg_start;
-            s->buffer->last = s->arg_start;
+            s->arg_start = s->buffer->pos;
 
         } else {
-            s->buffer->pos = s->buffer->start;
-            s->buffer->last = s->buffer->start;
+            if (s->buffer->pos == s->buffer->last) {
+                s->buffer->pos = s->buffer->start;
+                s->buffer->last = s->buffer->start;
+            }
+
             s->tag.len = 0;
         }
     }
 
+    if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+        ngx_mail_session_internal_server_error(s);
+        return;
+    }
+
     ngx_mail_send(c->write);
 }
 
@@ -461,6 +464,8 @@ ngx_mail_imap_starttls(ngx_mail_session_t *s, ngx_connection_t *c)
     if (c->ssl == NULL) {
         sslcf = ngx_mail_get_module_srv_conf(s, ngx_mail_ssl_module);
         if (sslcf->starttls) {
+            s->buffer->pos = s->buffer->start;
+            s->buffer->last = s->buffer->start;
             c->read->handler = ngx_mail_starttls_handler;
             return NGX_OK;
         }
diff --git a/src/mail/ngx_mail_parse.c b/src/mail/ngx_mail_parse.c
index 2c2cdffa..4db1f18d 100644
--- a/src/mail/ngx_mail_parse.c
+++ b/src/mail/ngx_mail_parse.c
@@ -21,6 +21,8 @@ ngx_mail_pop3_parse_command(ngx_mail_session_t *s)
     ngx_str_t  *arg;
     enum {
         sw_start = 0,
+        sw_command,
+        sw_invalid,
         sw_spaces_before_argument,
         sw_argument,
         sw_almost_done
@@ -35,8 +37,14 @@ ngx_mail_pop3_parse_command(ngx_mail_session_t *s)
 
         /* POP3 command */
         case sw_start:
+            s->cmd_start = p;
+            state = sw_command;
+
+            /* fall through */
+
+        case sw_command:
             if (ch == ' ' || ch == CR || ch == LF) {
-                c = s->buffer->start;
+                c = s->cmd_start;
 
                 if (p - c == 4) {
 
@@ -85,6 +93,9 @@ ngx_mail_pop3_parse_command(ngx_mail_session_t *s)
                     goto invalid;
                 }
 
+                s->cmd.data = s->cmd_start;
+                s->cmd.len = p - s->cmd_start;
+
                 switch (ch) {
                 case ' ':
                     state = sw_spaces_before_argument;
@@ -104,16 +115,17 @@ ngx_mail_pop3_parse_command(ngx_mail_session_t *s)
 
             break;
 
+        case sw_invalid:
+            goto invalid;
+
         case sw_spaces_before_argument:
             switch (ch) {
             case ' ':
                 break;
             case CR:
                 state = sw_almost_done;
-                s->arg_end = p;
                 break;
             case LF:
-                s->arg_end = p;
                 goto done;
             default:
                 if (s->args.nelts <= 2) {
@@ -188,37 +200,39 @@ ngx_mail_pop3_parse_command(ngx_mail_session_t *s)
 done:
 
     s->buffer->pos = p + 1;
-
-    if (s->arg_start) {
-        arg = ngx_array_push(&s->args);
-        if (arg == NULL) {
-            return NGX_ERROR;
-        }
-        arg->len = s->arg_end - s->arg_start;
-        arg->data = s->arg_start;
-        s->arg_start = NULL;
-    }
-
     s->state = (s->command != NGX_POP3_AUTH) ? sw_start : sw_argument;
 
     return NGX_OK;
 
 invalid:
 
-    s->state = sw_start;
-    s->arg_start = NULL;
+    s->state = sw_invalid;
 
-    return NGX_MAIL_PARSE_INVALID_COMMAND;
+    /* skip invalid command till LF */
+
+    for ( /* void */ ; p < s->buffer->last; p++) {
+        if (*p == LF) {
+            s->state = sw_start;
+            s->buffer->pos = p + 1;
+            return NGX_MAIL_PARSE_INVALID_COMMAND;
+        }
+    }
+
+    s->buffer->pos = p;
+
+    return NGX_AGAIN;
 }
 
 
 ngx_int_t
 ngx_mail_imap_parse_command(ngx_mail_session_t *s)
 {
-    u_char      ch, *p, *c;
+    u_char      ch, *p, *c, *dst, *src, *end;
     ngx_str_t  *arg;
     enum {
         sw_start = 0,
+        sw_tag,
+        sw_invalid,
         sw_spaces_before_command,
         sw_command,
         sw_spaces_before_argument,
@@ -241,31 +255,45 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s)
 
         /* IMAP tag */
         case sw_start:
+            s->tag_start = p;
+            state = sw_tag;
+
+            /* fall through */
+
+        case sw_tag:
             switch (ch) {
             case ' ':
-                s->tag.len = p - s->buffer->start + 1;
-                s->tag.data = s->buffer->start;
+                s->tag.len = p - s->tag_start + 1;
+                s->tag.data = s->tag_start;
                 state = sw_spaces_before_command;
                 break;
             case CR:
-                s->state = sw_start;
-                return NGX_MAIL_PARSE_INVALID_COMMAND;
             case LF:
-                s->state = sw_start;
-                return NGX_MAIL_PARSE_INVALID_COMMAND;
+                goto invalid;
+            default:
+                if ((ch < 'A' || ch > 'Z') && (ch < 'a' || ch > 'z')
+                    && (ch < '0' || ch > '9') && ch != '-' && ch != '.'
+                    && ch != '_')
+                {
+                    goto invalid;
+                }
+                if (p - s->tag_start > 31) {
+                    goto invalid;
+                }
+                break;
             }
             break;
 
+        case sw_invalid:
+            goto invalid;
+
         case sw_spaces_before_command:
             switch (ch) {
             case ' ':
                 break;
             case CR:
-                s->state = sw_start;
-                return NGX_MAIL_PARSE_INVALID_COMMAND;
             case LF:
-                s->state = sw_start;
-                return NGX_MAIL_PARSE_INVALID_COMMAND;
+                goto invalid;
             default:
                 s->cmd_start = p;
                 state = sw_command;
@@ -385,6 +413,9 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s)
                     goto invalid;
                 }
 
+                s->cmd.data = s->cmd_start;
+                s->cmd.len = p - s->cmd_start;
+
                 switch (ch) {
                 case ' ':
                     state = sw_spaces_before_argument;
@@ -410,10 +441,8 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s)
                 break;
             case CR:
                 state = sw_almost_done;
-                s->arg_end = p;
                 break;
             case LF:
-                s->arg_end = p;
                 goto done;
             case '"':
                 if (s->args.nelts <= 2) {
@@ -460,6 +489,22 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s)
                 }
                 arg->len = p - s->arg_start;
                 arg->data = s->arg_start;
+
+                if (s->backslash) {
+                    dst = s->arg_start;
+                    end = p;
+
+                    for (src = dst; src < end; dst++) {
+                        *dst = *src;
+                        if (*src++ == '\\') {
+                            *dst = *src++;
+                        }
+                    }
+
+                    arg->len = dst - s->arg_start;
+                    s->backslash = 0;
+                }
+
                 s->arg_start = NULL;
 
                 switch (ch) {
@@ -588,34 +633,46 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s)
 done:
 
     s->buffer->pos = p + 1;
-
-    if (s->arg_start) {
-        arg = ngx_array_push(&s->args);
-        if (arg == NULL) {
-            return NGX_ERROR;
-        }
-        arg->len = s->arg_end - s->arg_start;
-        arg->data = s->arg_start;
-
-        s->arg_start = NULL;
-        s->cmd_start = NULL;
-        s->quoted = 0;
-        s->no_sync_literal = 0;
-        s->literal_len = 0;
-    }
-
     s->state = (s->command != NGX_IMAP_AUTHENTICATE) ? sw_start : sw_argument;
 
     return NGX_OK;
 
 invalid:
 
-    s->state = sw_start;
+    s->state = sw_invalid;
     s->quoted = 0;
+    s->backslash = 0;
     s->no_sync_literal = 0;
     s->literal_len = 0;
 
-    return NGX_MAIL_PARSE_INVALID_COMMAND;
+    /* skip invalid command till LF */
+
+    for ( /* void */ ; p < s->buffer->last; p++) {
+        if (*p == LF) {
+            s->state = sw_start;
+            s->buffer->pos = p + 1;
+
+            /* detect non-synchronizing literals */
+
+            if ((size_t) (p - s->buffer->start) > sizeof("{1+}") - 1) {
+                p--;
+
+                if (*p == CR) {
+                    p--;
+                }
+
+                if (*p == '}' && *(p - 1) == '+') {
+                    s->quit = 1;
+                }
+            }
+
+            return NGX_MAIL_PARSE_INVALID_COMMAND;
+        }
+    }
+
+    s->buffer->pos = p;
+
+    return NGX_AGAIN;
 }
 
 
@@ -758,10 +815,8 @@ ngx_mail_smtp_parse_command(ngx_mail_session_t *s)
                 break;
             case CR:
                 state = sw_almost_done;
-                s->arg_end = p;
                 break;
             case LF:
-                s->arg_end = p;
                 goto done;
             default:
                 if (s->args.nelts <= 10) {
@@ -821,17 +876,6 @@ ngx_mail_smtp_parse_command(ngx_mail_session_t *s)
 done:
 
     s->buffer->pos = p + 1;
-
-    if (s->arg_start) {
-        arg = ngx_array_push(&s->args);
-        if (arg == NULL) {
-            return NGX_ERROR;
-        }
-        arg->len = s->arg_end - s->arg_start;
-        arg->data = s->arg_start;
-        s->arg_start = NULL;
-    }
-
     s->state = (s->command != NGX_SMTP_AUTH) ? sw_start : sw_argument;
 
     return NGX_OK;
@@ -839,21 +883,20 @@ ngx_mail_smtp_parse_command(ngx_mail_session_t *s)
 invalid:
 
     s->state = sw_invalid;
-    s->arg_start = NULL;
 
     /* skip invalid command till LF */
 
-    for (p = s->buffer->pos; p < s->buffer->last; p++) {
+    for ( /* void */ ; p < s->buffer->last; p++) {
         if (*p == LF) {
             s->state = sw_start;
-            p++;
-            break;
+            s->buffer->pos = p + 1;
+            return NGX_MAIL_PARSE_INVALID_COMMAND;
         }
     }
 
     s->buffer->pos = p;
 
-    return NGX_MAIL_PARSE_INVALID_COMMAND;
+    return NGX_AGAIN;
 }
 
 
diff --git a/src/mail/ngx_mail_pop3_handler.c b/src/mail/ngx_mail_pop3_handler.c
index 9310c275..226e7419 100644
--- a/src/mail/ngx_mail_pop3_handler.c
+++ b/src/mail/ngx_mail_pop3_handler.c
@@ -138,6 +138,12 @@ ngx_mail_pop3_auth_state(ngx_event_t *rev)
     if (s->out.len) {
         ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, "pop3 send handler busy");
         s->blocked = 1;
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_close_connection(c);
+            return;
+        }
+
         return;
     }
 
@@ -145,7 +151,16 @@ ngx_mail_pop3_auth_state(ngx_event_t *rev)
 
     rc = ngx_mail_read_command(s, c);
 
-    if (rc == NGX_AGAIN || rc == NGX_ERROR) {
+    if (rc == NGX_AGAIN) {
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_session_internal_server_error(s);
+            return;
+        }
+
+        return;
+    }
+
+    if (rc == NGX_ERROR) {
         return;
     }
 
@@ -247,6 +262,10 @@ ngx_mail_pop3_auth_state(ngx_event_t *rev)
         }
     }
 
+    if (s->buffer->pos < s->buffer->last) {
+        s->blocked = 1;
+    }
+
     switch (rc) {
 
     case NGX_DONE:
@@ -268,11 +287,19 @@ ngx_mail_pop3_auth_state(ngx_event_t *rev)
     case NGX_OK:
 
         s->args.nelts = 0;
-        s->buffer->pos = s->buffer->start;
-        s->buffer->last = s->buffer->start;
+
+        if (s->buffer->pos == s->buffer->last) {
+            s->buffer->pos = s->buffer->start;
+            s->buffer->last = s->buffer->start;
+        }
 
         if (s->state) {
-            s->arg_start = s->buffer->start;
+            s->arg_start = s->buffer->pos;
+        }
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_session_internal_server_error(s);
+            return;
         }
 
         ngx_mail_send(c->write);
@@ -380,6 +407,8 @@ ngx_mail_pop3_stls(ngx_mail_session_t *s, ngx_connection_t *c)
     if (c->ssl == NULL) {
         sslcf = ngx_mail_get_module_srv_conf(s, ngx_mail_ssl_module);
         if (sslcf->starttls) {
+            s->buffer->pos = s->buffer->start;
+            s->buffer->last = s->buffer->start;
             c->read->handler = ngx_mail_starttls_handler;
             return NGX_OK;
         }
diff --git a/src/mail/ngx_mail_proxy_module.c b/src/mail/ngx_mail_proxy_module.c
index 1c86e54c..a7ab0776 100644
--- a/src/mail/ngx_mail_proxy_module.c
+++ b/src/mail/ngx_mail_proxy_module.c
@@ -16,6 +16,8 @@ typedef struct {
     ngx_flag_t  enable;
     ngx_flag_t  pass_error_message;
     ngx_flag_t  xclient;
+    ngx_flag_t  smtp_auth;
+    ngx_flag_t  proxy_protocol;
     size_t      buffer_size;
     ngx_msec_t  timeout;
 } ngx_mail_proxy_conf_t;
@@ -25,7 +27,8 @@ static void ngx_mail_proxy_block_read(ngx_event_t *rev);
 static void ngx_mail_proxy_pop3_handler(ngx_event_t *rev);
 static void ngx_mail_proxy_imap_handler(ngx_event_t *rev);
 static void ngx_mail_proxy_smtp_handler(ngx_event_t *rev);
-static void ngx_mail_proxy_dummy_handler(ngx_event_t *ev);
+static void ngx_mail_proxy_write_handler(ngx_event_t *wev);
+static ngx_int_t ngx_mail_proxy_send_proxy_protocol(ngx_mail_session_t *s);
 static ngx_int_t ngx_mail_proxy_read_response(ngx_mail_session_t *s,
     ngx_uint_t state);
 static void ngx_mail_proxy_handler(ngx_event_t *ev);
@@ -74,6 +77,20 @@ static ngx_command_t  ngx_mail_proxy_commands[] = {
       offsetof(ngx_mail_proxy_conf_t, xclient),
       NULL },
 
+    { ngx_string("proxy_smtp_auth"),
+      NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_MAIL_SRV_CONF_OFFSET,
+      offsetof(ngx_mail_proxy_conf_t, smtp_auth),
+      NULL },
+
+    { ngx_string("proxy_protocol"),
+      NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_MAIL_SRV_CONF_OFFSET,
+      offsetof(ngx_mail_proxy_conf_t, proxy_protocol),
+      NULL },
+
       ngx_null_command
 };
 
@@ -148,7 +165,7 @@ ngx_mail_proxy_init(ngx_mail_session_t *s, ngx_addr_t *peer)
     p->upstream.connection->pool = s->connection->pool;
 
     s->connection->read->handler = ngx_mail_proxy_block_read;
-    p->upstream.connection->write->handler = ngx_mail_proxy_dummy_handler;
+    p->upstream.connection->write->handler = ngx_mail_proxy_write_handler;
 
     pcf = ngx_mail_get_module_srv_conf(s, ngx_mail_proxy_module);
 
@@ -159,6 +176,8 @@ ngx_mail_proxy_init(ngx_mail_session_t *s, ngx_addr_t *peer)
         return;
     }
 
+    s->proxy->proxy_protocol = pcf->proxy_protocol;
+
     s->out.len = 0;
 
     switch (s->protocol) {
@@ -178,6 +197,12 @@ ngx_mail_proxy_init(ngx_mail_session_t *s, ngx_addr_t *peer)
         s->mail_state = ngx_smtp_start;
         break;
     }
+
+    if (rc == NGX_AGAIN) {
+        return;
+    }
+
+    ngx_mail_proxy_write_handler(p->upstream.connection->write);
 }
 
 
@@ -222,9 +247,25 @@ ngx_mail_proxy_pop3_handler(ngx_event_t *rev)
         return;
     }
 
+    if (s->proxy->proxy_protocol) {
+        ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, "mail proxy pop3 busy");
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
+        return;
+    }
+
     rc = ngx_mail_proxy_read_response(s, 0);
 
     if (rc == NGX_AGAIN) {
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
         return;
     }
 
@@ -286,6 +327,10 @@ ngx_mail_proxy_pop3_handler(ngx_event_t *rev)
         c->log->action = NULL;
         ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in");
 
+        if (s->buffer->pos < s->buffer->last) {
+            ngx_post_event(c->write, &ngx_posted_events);
+        }
+
         ngx_mail_proxy_handler(s->connection->write);
 
         return;
@@ -306,6 +351,11 @@ ngx_mail_proxy_pop3_handler(ngx_event_t *rev)
         return;
     }
 
+    if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+        ngx_mail_proxy_internal_server_error(s);
+        return;
+    }
+
     s->proxy->buffer->pos = s->proxy->buffer->start;
     s->proxy->buffer->last = s->proxy->buffer->start;
 }
@@ -335,9 +385,25 @@ ngx_mail_proxy_imap_handler(ngx_event_t *rev)
         return;
     }
 
+    if (s->proxy->proxy_protocol) {
+        ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, "mail proxy imap busy");
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
+        return;
+    }
+
     rc = ngx_mail_proxy_read_response(s, s->mail_state);
 
     if (rc == NGX_AGAIN) {
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
         return;
     }
 
@@ -420,6 +486,10 @@ ngx_mail_proxy_imap_handler(ngx_event_t *rev)
         c->log->action = NULL;
         ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in");
 
+        if (s->buffer->pos < s->buffer->last) {
+            ngx_post_event(c->write, &ngx_posted_events);
+        }
+
         ngx_mail_proxy_handler(s->connection->write);
 
         return;
@@ -440,6 +510,11 @@ ngx_mail_proxy_imap_handler(ngx_event_t *rev)
         return;
     }
 
+    if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+        ngx_mail_proxy_internal_server_error(s);
+        return;
+    }
+
     s->proxy->buffer->pos = s->proxy->buffer->start;
     s->proxy->buffer->last = s->proxy->buffer->start;
 }
@@ -450,7 +525,7 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
 {
     u_char                    *p;
     ngx_int_t                  rc;
-    ngx_str_t                  line;
+    ngx_str_t                  line, auth, encoded;
     ngx_buf_t                 *b;
     ngx_connection_t          *c;
     ngx_mail_session_t        *s;
@@ -471,9 +546,25 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
         return;
     }
 
+    if (s->proxy->proxy_protocol) {
+        ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, "mail proxy smtp busy");
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
+        return;
+    }
+
     rc = ngx_mail_proxy_read_response(s, s->mail_state);
 
     if (rc == NGX_AGAIN) {
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
         return;
     }
 
@@ -513,6 +604,9 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
         } else if (s->auth_method == NGX_MAIL_AUTH_NONE) {
             s->mail_state = ngx_smtp_helo_from;
 
+        } else if (pcf->smtp_auth) {
+            s->mail_state = ngx_smtp_helo_auth;
+
         } else {
             s->mail_state = ngx_smtp_helo;
         }
@@ -552,7 +646,9 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
         p = ngx_copy(p, s->connection->addr_text.data,
                      s->connection->addr_text.len);
 
-        if (s->login.len) {
+        pcf = ngx_mail_get_module_srv_conf(s, ngx_mail_proxy_module);
+
+        if (s->login.len && !pcf->smtp_auth) {
             p = ngx_cpymem(p, " LOGIN=", sizeof(" LOGIN=") - 1);
             p = ngx_copy(p, s->login.data, s->login.len);
         }
@@ -570,6 +666,9 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
         } else if (s->auth_method == NGX_MAIL_AUTH_NONE) {
             s->mail_state = ngx_smtp_xclient_from;
 
+        } else if (pcf->smtp_auth) {
+            s->mail_state = ngx_smtp_xclient_auth;
+
         } else {
             s->mail_state = ngx_smtp_xclient;
         }
@@ -595,8 +694,62 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
                        &s->smtp_helo)
                    - line.data;
 
-        s->mail_state = (s->auth_method == NGX_MAIL_AUTH_NONE) ?
-                            ngx_smtp_helo_from : ngx_smtp_helo;
+        pcf = ngx_mail_get_module_srv_conf(s, ngx_mail_proxy_module);
+
+        if (s->auth_method == NGX_MAIL_AUTH_NONE) {
+            s->mail_state = ngx_smtp_helo_from;
+
+        } else if (pcf->smtp_auth) {
+            s->mail_state = ngx_smtp_helo_auth;
+
+        } else {
+            s->mail_state = ngx_smtp_helo;
+        }
+
+        break;
+
+    case ngx_smtp_helo_auth:
+    case ngx_smtp_xclient_auth:
+        ngx_log_debug0(NGX_LOG_DEBUG_MAIL, rev->log, 0,
+                       "mail proxy send auth");
+
+        s->connection->log->action = "sending AUTH to upstream";
+
+        if (s->passwd.data == NULL) {
+            ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
+                          "no password available");
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
+        auth.len = 1 + s->login.len + 1 + s->passwd.len;
+        auth.data = ngx_pnalloc(c->pool, auth.len);
+        if (auth.data == NULL) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
+        auth.len = ngx_sprintf(auth.data, "%Z%V%Z%V", &s->login, &s->passwd)
+                   - auth.data;
+
+        line.len = sizeof("AUTH PLAIN " CRLF) - 1
+                   + ngx_base64_encoded_length(auth.len);
+
+        line.data = ngx_pnalloc(c->pool, line.len);
+        if (line.data == NULL) {
+            ngx_mail_proxy_internal_server_error(s);
+            return;
+        }
+
+        encoded.data = ngx_cpymem(line.data, "AUTH PLAIN ",
+                                  sizeof("AUTH PLAIN ") - 1);
+
+        ngx_encode_base64(&encoded, &auth);
+
+        p = encoded.data + encoded.len;
+        *p++ = CR; *p = LF;
+
+        s->mail_state = ngx_smtp_auth_plain;
 
         break;
 
@@ -643,6 +796,7 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
 
     case ngx_smtp_helo:
     case ngx_smtp_xclient:
+    case ngx_smtp_auth_plain:
     case ngx_smtp_to:
 
         b = s->proxy->buffer;
@@ -667,13 +821,12 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
         c->log->action = NULL;
         ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in");
 
-        if (s->buffer->pos == s->buffer->last) {
-            ngx_mail_proxy_handler(s->connection->write);
-
-        } else {
-            ngx_mail_proxy_handler(c->write);
+        if (s->buffer->pos < s->buffer->last) {
+            ngx_post_event(c->write, &ngx_posted_events);
         }
 
+        ngx_mail_proxy_handler(s->connection->write);
+
         return;
 
     default:
@@ -692,28 +845,106 @@ ngx_mail_proxy_smtp_handler(ngx_event_t *rev)
         return;
     }
 
+    if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+        ngx_mail_proxy_internal_server_error(s);
+        return;
+    }
+
     s->proxy->buffer->pos = s->proxy->buffer->start;
     s->proxy->buffer->last = s->proxy->buffer->start;
 }
 
 
 static void
-ngx_mail_proxy_dummy_handler(ngx_event_t *wev)
+ngx_mail_proxy_write_handler(ngx_event_t *wev)
 {
     ngx_connection_t    *c;
     ngx_mail_session_t  *s;
 
-    ngx_log_debug0(NGX_LOG_DEBUG_MAIL, wev->log, 0, "mail proxy dummy handler");
+    ngx_log_debug0(NGX_LOG_DEBUG_MAIL, wev->log, 0, "mail proxy write handler");
+
+    c = wev->data;
+    s = c->data;
+
+    if (s->proxy->proxy_protocol) {
+        if (ngx_mail_proxy_send_proxy_protocol(s) != NGX_OK) {
+            return;
+        }
+
+        s->proxy->proxy_protocol = 0;
+    }
 
     if (ngx_handle_write_event(wev, 0) != NGX_OK) {
-        c = wev->data;
-        s = c->data;
+        ngx_mail_proxy_internal_server_error(s);
+    }
 
-        ngx_mail_proxy_close_session(s);
+    if (c->read->ready) {
+        ngx_post_event(c->read, &ngx_posted_events);
     }
 }
 
 
+static ngx_int_t
+ngx_mail_proxy_send_proxy_protocol(ngx_mail_session_t *s)
+{
+    u_char            *p;
+    ssize_t            n, size;
+    ngx_connection_t  *c;
+    u_char             buf[NGX_PROXY_PROTOCOL_MAX_HEADER];
+
+    s->connection->log->action = "sending PROXY protocol header to upstream";
+
+    ngx_log_debug0(NGX_LOG_DEBUG_MAIL, s->connection->log, 0,
+                   "mail proxy send PROXY protocol header");
+
+    p = ngx_proxy_protocol_write(s->connection, buf,
+                                 buf + NGX_PROXY_PROTOCOL_MAX_HEADER);
+    if (p == NULL) {
+        ngx_mail_proxy_internal_server_error(s);
+        return NGX_ERROR;
+    }
+
+    c = s->proxy->upstream.connection;
+
+    size = p - buf;
+
+    n = c->send(c, buf, size);
+
+    if (n == NGX_AGAIN) {
+        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
+            ngx_mail_proxy_internal_server_error(s);
+            return NGX_ERROR;
+        }
+
+        return NGX_AGAIN;
+    }
+
+    if (n == NGX_ERROR) {
+        ngx_mail_proxy_internal_server_error(s);
+        return NGX_ERROR;
+    }
+
+    if (n != size) {
+
+        /*
+         * PROXY protocol specification:
+         * The sender must always ensure that the header
+         * is sent at once, so that the transport layer
+         * maintains atomicity along the path to the receiver.
+         */
+
+        ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
+                      "could not send PROXY protocol header at once");
+
+        ngx_mail_proxy_internal_server_error(s);
+
+        return NGX_ERROR;
+    }
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_mail_proxy_read_response(ngx_mail_session_t *s, ngx_uint_t state)
 {
@@ -824,6 +1055,7 @@ ngx_mail_proxy_read_response(ngx_mail_session_t *s, ngx_uint_t state)
         case ngx_smtp_helo:
         case ngx_smtp_helo_xclient:
         case ngx_smtp_helo_from:
+        case ngx_smtp_helo_auth:
         case ngx_smtp_from:
             if (p[0] == '2' && p[1] == '5' && p[2] == '0') {
                 return NGX_OK;
@@ -833,11 +1065,18 @@ ngx_mail_proxy_read_response(ngx_mail_session_t *s, ngx_uint_t state)
         case ngx_smtp_xclient:
         case ngx_smtp_xclient_from:
         case ngx_smtp_xclient_helo:
+        case ngx_smtp_xclient_auth:
             if (p[0] == '2' && (p[1] == '2' || p[1] == '5') && p[2] == '0') {
                 return NGX_OK;
             }
             break;
 
+        case ngx_smtp_auth_plain:
+            if (p[0] == '2' && p[1] == '3' && p[2] == '5') {
+                return NGX_OK;
+            }
+            break;
+
         case ngx_smtp_to:
             return NGX_OK;
         }
@@ -1102,6 +1341,8 @@ ngx_mail_proxy_create_conf(ngx_conf_t *cf)
     pcf->enable = NGX_CONF_UNSET;
     pcf->pass_error_message = NGX_CONF_UNSET;
     pcf->xclient = NGX_CONF_UNSET;
+    pcf->smtp_auth = NGX_CONF_UNSET;
+    pcf->proxy_protocol = NGX_CONF_UNSET;
     pcf->buffer_size = NGX_CONF_UNSET_SIZE;
     pcf->timeout = NGX_CONF_UNSET_MSEC;
 
@@ -1118,6 +1359,8 @@ ngx_mail_proxy_merge_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_value(conf->enable, prev->enable, 0);
     ngx_conf_merge_value(conf->pass_error_message, prev->pass_error_message, 0);
     ngx_conf_merge_value(conf->xclient, prev->xclient, 1);
+    ngx_conf_merge_value(conf->smtp_auth, prev->smtp_auth, 0);
+    ngx_conf_merge_value(conf->proxy_protocol, prev->proxy_protocol, 0);
     ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
                               (size_t) ngx_pagesize);
     ngx_conf_merge_msec_value(conf->timeout, prev->timeout, 24 * 60 * 60000);
diff --git a/src/mail/ngx_mail_realip_module.c b/src/mail/ngx_mail_realip_module.c
new file mode 100644
index 00000000..c93d7d33
--- /dev/null
+++ b/src/mail/ngx_mail_realip_module.c
@@ -0,0 +1,269 @@
+
+/*
+ * Copyright (C) Igor Sysoev
+ * Copyright (C) Nginx, Inc.
+ */
+
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_mail.h>
+
+
+typedef struct {
+    ngx_array_t       *from;     /* array of ngx_cidr_t */
+} ngx_mail_realip_srv_conf_t;
+
+
+static ngx_int_t ngx_mail_realip_set_addr(ngx_mail_session_t *s,
+    ngx_addr_t *addr);
+static char *ngx_mail_realip_from(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+static void *ngx_mail_realip_create_srv_conf(ngx_conf_t *cf);
+static char *ngx_mail_realip_merge_srv_conf(ngx_conf_t *cf, void *parent,
+    void *child);
+
+
+static ngx_command_t  ngx_mail_realip_commands[] = {
+
+    { ngx_string("set_real_ip_from"),
+      NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+      ngx_mail_realip_from,
+      NGX_MAIL_SRV_CONF_OFFSET,
+      0,
+      NULL },
+
+      ngx_null_command
+};
+
+
+static ngx_mail_module_t  ngx_mail_realip_module_ctx = {
+    NULL,                                  /* protocol */
+
+    NULL,                                  /* create main configuration */
+    NULL,                                  /* init main configuration */
+
+    ngx_mail_realip_create_srv_conf,       /* create server configuration */
+    ngx_mail_realip_merge_srv_conf         /* merge server configuration */
+};
+
+
+ngx_module_t  ngx_mail_realip_module = {
+    NGX_MODULE_V1,
+    &ngx_mail_realip_module_ctx,           /* module context */
+    ngx_mail_realip_commands,              /* module directives */
+    NGX_MAIL_MODULE,                       /* module type */
+    NULL,                                  /* init master */
+    NULL,                                  /* init module */
+    NULL,                                  /* init process */
+    NULL,                                  /* init thread */
+    NULL,                                  /* exit thread */
+    NULL,                                  /* exit process */
+    NULL,                                  /* exit master */
+    NGX_MODULE_V1_PADDING
+};
+
+
+ngx_int_t
+ngx_mail_realip_handler(ngx_mail_session_t *s)
+{
+    ngx_addr_t                   addr;
+    ngx_connection_t            *c;
+    ngx_mail_realip_srv_conf_t  *rscf;
+
+    rscf = ngx_mail_get_module_srv_conf(s, ngx_mail_realip_module);
+
+    if (rscf->from == NULL) {
+        return NGX_OK;
+    }
+
+    c = s->connection;
+
+    if (c->proxy_protocol == NULL) {
+        return NGX_OK;
+    }
+
+    if (ngx_cidr_match(c->sockaddr, rscf->from) != NGX_OK) {
+        return NGX_OK;
+    }
+
+    if (ngx_parse_addr(c->pool, &addr, c->proxy_protocol->src_addr.data,
+                       c->proxy_protocol->src_addr.len)
+        != NGX_OK)
+    {
+        return NGX_OK;
+    }
+
+    ngx_inet_set_port(addr.sockaddr, c->proxy_protocol->src_port);
+
+    return ngx_mail_realip_set_addr(s, &addr);
+}
+
+
+static ngx_int_t
+ngx_mail_realip_set_addr(ngx_mail_session_t *s, ngx_addr_t *addr)
+{
+    size_t             len;
+    u_char            *p;
+    u_char             text[NGX_SOCKADDR_STRLEN];
+    ngx_connection_t  *c;
+
+    c = s->connection;
+
+    len = ngx_sock_ntop(addr->sockaddr, addr->socklen, text,
+                        NGX_SOCKADDR_STRLEN, 0);
+    if (len == 0) {
+        return NGX_ERROR;
+    }
+
+    p = ngx_pnalloc(c->pool, len);
+    if (p == NULL) {
+        return NGX_ERROR;
+    }
+
+    ngx_memcpy(p, text, len);
+
+    c->sockaddr = addr->sockaddr;
+    c->socklen = addr->socklen;
+    c->addr_text.len = len;
+    c->addr_text.data = p;
+
+    return NGX_OK;
+}
+
+
+static char *
+ngx_mail_realip_from(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+    ngx_mail_realip_srv_conf_t *rscf = conf;
+
+    ngx_int_t             rc;
+    ngx_str_t            *value;
+    ngx_url_t             u;
+    ngx_cidr_t            c, *cidr;
+    ngx_uint_t            i;
+    struct sockaddr_in   *sin;
+#if (NGX_HAVE_INET6)
+    struct sockaddr_in6  *sin6;
+#endif
+
+    value = cf->args->elts;
+
+    if (rscf->from == NULL) {
+        rscf->from = ngx_array_create(cf->pool, 2,
+                                      sizeof(ngx_cidr_t));
+        if (rscf->from == NULL) {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+#if (NGX_HAVE_UNIX_DOMAIN)
+
+    if (ngx_strcmp(value[1].data, "unix:") == 0) {
+        cidr = ngx_array_push(rscf->from);
+        if (cidr == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        cidr->family = AF_UNIX;
+        return NGX_CONF_OK;
+    }
+
+#endif
+
+    rc = ngx_ptocidr(&value[1], &c);
+
+    if (rc != NGX_ERROR) {
+        if (rc == NGX_DONE) {
+            ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
+                               "low address bits of %V are meaningless",
+                               &value[1]);
+        }
+
+        cidr = ngx_array_push(rscf->from);
+        if (cidr == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        *cidr = c;
+
+        return NGX_CONF_OK;
+    }
+
+    ngx_memzero(&u, sizeof(ngx_url_t));
+    u.host = value[1];
+
+    if (ngx_inet_resolve_host(cf->pool, &u) != NGX_OK) {
+        if (u.err) {
+            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                               "%s in set_real_ip_from \"%V\"",
+                               u.err, &u.host);
+        }
+
+        return NGX_CONF_ERROR;
+    }
+
+    cidr = ngx_array_push_n(rscf->from, u.naddrs);
+    if (cidr == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    ngx_memzero(cidr, u.naddrs * sizeof(ngx_cidr_t));
+
+    for (i = 0; i < u.naddrs; i++) {
+        cidr[i].family = u.addrs[i].sockaddr->sa_family;
+
+        switch (cidr[i].family) {
+
+#if (NGX_HAVE_INET6)
+        case AF_INET6:
+            sin6 = (struct sockaddr_in6 *) u.addrs[i].sockaddr;
+            cidr[i].u.in6.addr = sin6->sin6_addr;
+            ngx_memset(cidr[i].u.in6.mask.s6_addr, 0xff, 16);
+            break;
+#endif
+
+        default: /* AF_INET */
+            sin = (struct sockaddr_in *) u.addrs[i].sockaddr;
+            cidr[i].u.in.addr = sin->sin_addr.s_addr;
+            cidr[i].u.in.mask = 0xffffffff;
+            break;
+        }
+    }
+
+    return NGX_CONF_OK;
+}
+
+
+static void *
+ngx_mail_realip_create_srv_conf(ngx_conf_t *cf)
+{
+    ngx_mail_realip_srv_conf_t  *conf;
+
+    conf = ngx_pcalloc(cf->pool, sizeof(ngx_mail_realip_srv_conf_t));
+    if (conf == NULL) {
+        return NULL;
+    }
+
+    /*
+     * set by ngx_pcalloc():
+     *
+     *     conf->from = NULL;
+     */
+
+    return conf;
+}
+
+
+static char *
+ngx_mail_realip_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
+{
+    ngx_mail_realip_srv_conf_t *prev = parent;
+    ngx_mail_realip_srv_conf_t *conf = child;
+
+    if (conf->from == NULL) {
+        conf->from = prev->from;
+    }
+
+    return NGX_CONF_OK;
+}
diff --git a/src/mail/ngx_mail_smtp_handler.c b/src/mail/ngx_mail_smtp_handler.c
index 939fb1a5..e68ceedf 100644
--- a/src/mail/ngx_mail_smtp_handler.c
+++ b/src/mail/ngx_mail_smtp_handler.c
@@ -15,6 +15,7 @@
 static void ngx_mail_smtp_resolve_addr_handler(ngx_resolver_ctx_t *ctx);
 static void ngx_mail_smtp_resolve_name(ngx_event_t *rev);
 static void ngx_mail_smtp_resolve_name_handler(ngx_resolver_ctx_t *ctx);
+static void ngx_mail_smtp_block_reading(ngx_event_t *rev);
 static void ngx_mail_smtp_greeting(ngx_mail_session_t *s, ngx_connection_t *c);
 static void ngx_mail_smtp_invalid_pipelining(ngx_event_t *rev);
 static ngx_int_t ngx_mail_smtp_create_buffer(ngx_mail_session_t *s,
@@ -88,6 +89,9 @@ ngx_mail_smtp_init_session(ngx_mail_session_t *s, ngx_connection_t *c)
     ctx->data = s;
     ctx->timeout = cscf->resolver_timeout;
 
+    s->resolver_ctx = ctx;
+    c->read->handler = ngx_mail_smtp_block_reading;
+
     if (ngx_resolve_addr(ctx) != NGX_OK) {
         ngx_mail_close_connection(c);
     }
@@ -169,6 +173,9 @@ ngx_mail_smtp_resolve_name(ngx_event_t *rev)
     ctx->data = s;
     ctx->timeout = cscf->resolver_timeout;
 
+    s->resolver_ctx = ctx;
+    c->read->handler = ngx_mail_smtp_block_reading;
+
     if (ngx_resolve_name(ctx) != NGX_OK) {
         ngx_mail_close_connection(c);
     }
@@ -238,6 +245,38 @@ ngx_mail_smtp_resolve_name_handler(ngx_resolver_ctx_t *ctx)
 }
 
 
+static void
+ngx_mail_smtp_block_reading(ngx_event_t *rev)
+{
+    ngx_connection_t    *c;
+    ngx_mail_session_t  *s;
+    ngx_resolver_ctx_t  *ctx;
+
+    c = rev->data;
+    s = c->data;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, "smtp reading blocked");
+
+    if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+
+        if (s->resolver_ctx) {
+            ctx = s->resolver_ctx;
+
+            if (ctx->handler == ngx_mail_smtp_resolve_addr_handler) {
+                ngx_resolve_addr_done(ctx);
+
+            } else if (ctx->handler == ngx_mail_smtp_resolve_name_handler) {
+                ngx_resolve_name_done(ctx);
+            }
+
+            s->resolver_ctx = NULL;
+        }
+
+        ngx_mail_close_connection(c);
+    }
+}
+
+
 static void
 ngx_mail_smtp_greeting(ngx_mail_session_t *s, ngx_connection_t *c)
 {
@@ -258,6 +297,10 @@ ngx_mail_smtp_greeting(ngx_mail_session_t *s, ngx_connection_t *c)
         ngx_mail_close_connection(c);
     }
 
+    if (c->read->ready) {
+        ngx_post_event(c->read, &ngx_posted_events);
+    }
+
     if (sscf->greeting_delay) {
          c->read->handler = ngx_mail_smtp_invalid_pipelining;
          return;
@@ -406,6 +449,12 @@ ngx_mail_smtp_auth_state(ngx_event_t *rev)
     if (s->out.len) {
         ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, "smtp send handler busy");
         s->blocked = 1;
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_close_connection(c);
+            return;
+        }
+
         return;
     }
 
@@ -413,7 +462,16 @@ ngx_mail_smtp_auth_state(ngx_event_t *rev)
 
     rc = ngx_mail_read_command(s, c);
 
-    if (rc == NGX_AGAIN || rc == NGX_ERROR) {
+    if (rc == NGX_AGAIN) {
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_session_internal_server_error(s);
+            return;
+        }
+
+        return;
+    }
+
+    if (rc == NGX_ERROR) {
         return;
     }
 
@@ -525,6 +583,11 @@ ngx_mail_smtp_auth_state(ngx_event_t *rev)
             s->arg_start = s->buffer->pos;
         }
 
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            ngx_mail_session_internal_server_error(s);
+            return;
+        }
+
         ngx_mail_send(c->write);
     }
 }
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
index 5544f752..7eae83e2 100644
--- a/src/mail/ngx_mail_ssl_module.c
+++ b/src/mail/ngx_mail_ssl_module.c
@@ -26,6 +26,9 @@ static char *ngx_mail_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
 static char *ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 
+static char *ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post,
+    void *data);
+
 
 static ngx_conf_enum_t  ngx_mail_starttls_state[] = {
     { ngx_string("off"), NGX_MAIL_STARTTLS_OFF },
@@ -61,6 +64,10 @@ static ngx_conf_deprecated_t  ngx_mail_ssl_deprecated = {
 };
 
 
+static ngx_conf_post_t  ngx_mail_ssl_conf_command_post =
+    { ngx_mail_ssl_conf_command_check };
+
+
 static ngx_command_t  ngx_mail_ssl_commands[] = {
 
     { ngx_string("ssl"),
@@ -196,6 +203,13 @@ static ngx_command_t  ngx_mail_ssl_commands[] = {
       offsetof(ngx_mail_ssl_conf_t, crl),
       NULL },
 
+    { ngx_string("ssl_conf_command"),
+      NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE2,
+      ngx_conf_set_keyval_slot,
+      NGX_MAIL_SRV_CONF_OFFSET,
+      offsetof(ngx_mail_ssl_conf_t, conf_commands),
+      &ngx_mail_ssl_conf_command_post },
+
       ngx_null_command
 };
 
@@ -259,6 +273,7 @@ ngx_mail_ssl_create_conf(ngx_conf_t *cf)
     scf->certificates = NGX_CONF_UNSET_PTR;
     scf->certificate_keys = NGX_CONF_UNSET_PTR;
     scf->passwords = NGX_CONF_UNSET_PTR;
+    scf->conf_commands = NGX_CONF_UNSET_PTR;
     scf->prefer_server_ciphers = NGX_CONF_UNSET;
     scf->verify = NGX_CONF_UNSET_UINT;
     scf->verify_depth = NGX_CONF_UNSET_UINT;
@@ -316,6 +331,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);
 
+    ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
+
 
     conf->ssl.log = cf->log;
 
@@ -388,7 +405,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
 
         if (conf->client_certificate.len == 0 && conf->verify != 3) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
-                          "no ssl_client_certificate for ssl_client_verify");
+                          "no ssl_client_certificate for ssl_verify_client");
             return NGX_CONF_ERROR;
         }
 
@@ -461,6 +478,10 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
         return NGX_CONF_ERROR;
     }
 
+    if (ngx_ssl_conf_commands(cf, &conf->ssl, conf->conf_commands) != NGX_OK) {
+        return NGX_CONF_ERROR;
+    }
+
     return NGX_CONF_OK;
 }
 
@@ -654,3 +675,14 @@ ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     return NGX_CONF_ERROR;
 }
+
+
+static char *
+ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
+{
+#ifndef SSL_CONF_FLAG_FILE
+    return "is not supported on this platform";
+#else
+    return NGX_CONF_OK;
+#endif
+}
diff --git a/src/mail/ngx_mail_ssl_module.h b/src/mail/ngx_mail_ssl_module.h
index d6b0b8e0..a0a61131 100644
--- a/src/mail/ngx_mail_ssl_module.h
+++ b/src/mail/ngx_mail_ssl_module.h
@@ -48,6 +48,7 @@ typedef struct {
     ngx_str_t        ciphers;
 
     ngx_array_t     *passwords;
+    ngx_array_t     *conf_commands;
 
     ngx_shm_zone_t  *shm_zone;
 
diff --git a/src/misc/ngx_cpp_test_module.cpp b/src/misc/ngx_cpp_test_module.cpp
index 5d2f08d3..00264099 100644
--- a/src/misc/ngx_cpp_test_module.cpp
+++ b/src/misc/ngx_cpp_test_module.cpp
@@ -14,6 +14,8 @@ extern "C" {
   #include <ngx_mail_pop3_module.h>
   #include <ngx_mail_imap_module.h>
   #include <ngx_mail_smtp_module.h>
+
+  #include <ngx_stream.h>
 }
 
 // nginx header files should go before other, because they define 64-bit off_t
diff --git a/src/os/unix/ngx_errno.c b/src/os/unix/ngx_errno.c
index e787b237..ca23b2d3 100644
--- a/src/os/unix/ngx_errno.c
+++ b/src/os/unix/ngx_errno.c
@@ -9,6 +9,49 @@
 #include <ngx_core.h>
 
 
+static ngx_str_t   ngx_unknown_error = ngx_string("Unknown error");
+
+
+#if (NGX_HAVE_STRERRORDESC_NP)
+
+/*
+ * The strerrordesc_np() function, introduced in glibc 2.32, is
+ * async-signal-safe.  This makes it possible to use it directly,
+ * without copying error messages.
+ */
+
+
+u_char *
+ngx_strerror(ngx_err_t err, u_char *errstr, size_t size)
+{
+    size_t       len;
+    const char  *msg;
+
+    msg = strerrordesc_np(err);
+
+    if (msg == NULL) {
+        msg = (char *) ngx_unknown_error.data;
+        len = ngx_unknown_error.len;
+
+    } else {
+        len = ngx_strlen(msg);
+    }
+
+    size = ngx_min(size, len);
+
+    return ngx_cpymem(errstr, msg, size);
+}
+
+
+ngx_int_t
+ngx_strerror_init(void)
+{
+    return NGX_OK;
+}
+
+
+#else
+
 /*
  * The strerror() messages are copied because:
  *
@@ -26,7 +69,8 @@
 
 
 static ngx_str_t  *ngx_sys_errlist;
-static ngx_str_t   ngx_unknown_error = ngx_string("Unknown error");
+static ngx_err_t   ngx_first_error;
+static ngx_err_t   ngx_last_error;
 
 
 u_char *
@@ -34,8 +78,13 @@ ngx_strerror(ngx_err_t err, u_char *errstr, size_t size)
 {
     ngx_str_t  *msg;
 
-    msg = ((ngx_uint_t) err < NGX_SYS_NERR) ? &ngx_sys_errlist[err]:
-                                              &ngx_unknown_error;
+    if (err >= ngx_first_error && err < ngx_last_error) {
+        msg = &ngx_sys_errlist[err - ngx_first_error];
+
+    } else {
+        msg = &ngx_unknown_error;
+    }
+
     size = ngx_min(size, msg->len);
 
     return ngx_cpymem(errstr, msg->data, size);
@@ -50,20 +99,92 @@ ngx_strerror_init(void)
     size_t      len;
     ngx_err_t   err;
 
+#if (NGX_SYS_NERR)
+    ngx_first_error = 0;
+    ngx_last_error = NGX_SYS_NERR;
+
+#elif (EPERM > 1000 && EPERM < 0x7fffffff - 1000)
+
+    /*
+     * If number of errors is not known, and EPERM error code has large
+     * but reasonable value, guess possible error codes based on the error
+     * messages returned by strerror(), starting from EPERM.  Notably,
+     * this covers GNU/Hurd, where errors start at 0x40000001.
+     */
+
+    for (err = EPERM; err > EPERM - 1000; err--) {
+        ngx_set_errno(0);
+        msg = strerror(err);
+
+        if (errno == EINVAL
+            || msg == NULL
+            || strncmp(msg, "Unknown error", 13) == 0)
+        {
+            continue;
+        }
+
+        ngx_first_error = err;
+    }
+
+    for (err = EPERM; err < EPERM + 1000; err++) {
+        ngx_set_errno(0);
+        msg = strerror(err);
+
+        if (errno == EINVAL
+            || msg == NULL
+            || strncmp(msg, "Unknown error", 13) == 0)
+        {
+            continue;
+        }
+
+        ngx_last_error = err + 1;
+    }
+
+#else
+
+    /*
+     * If number of errors is not known, guess it based on the error
+     * messages returned by strerror().
+     */
+
+    ngx_first_error = 0;
+
+    for (err = 0; err < 1000; err++) {
+        ngx_set_errno(0);
+        msg = strerror(err);
+
+        if (errno == EINVAL
+            || msg == NULL
+            || strncmp(msg, "Unknown error", 13) == 0)
+        {
+            continue;
+        }
+
+        ngx_last_error = err + 1;
+    }
+
+#endif
+
     /*
      * ngx_strerror() is not ready to work at this stage, therefore,
      * malloc() is used and possible errors are logged using strerror().
      */
 
-    len = NGX_SYS_NERR * sizeof(ngx_str_t);
+    len = (ngx_last_error - ngx_first_error) * sizeof(ngx_str_t);
 
     ngx_sys_errlist = malloc(len);
     if (ngx_sys_errlist == NULL) {
         goto failed;
     }
 
-    for (err = 0; err < NGX_SYS_NERR; err++) {
+    for (err = ngx_first_error; err < ngx_last_error; err++) {
         msg = strerror(err);
+
+        if (msg == NULL) {
+            ngx_sys_errlist[err - ngx_first_error] = ngx_unknown_error;
+            continue;
+        }
+
         len = ngx_strlen(msg);
 
         p = malloc(len);
@@ -72,8 +193,8 @@ ngx_strerror_init(void)
         }
 
         ngx_memcpy(p, msg, len);
-        ngx_sys_errlist[err].len = len;
-        ngx_sys_errlist[err].data = p;
+        ngx_sys_errlist[err - ngx_first_error].len = len;
+        ngx_sys_errlist[err - ngx_first_error].data = p;
     }
 
     return NGX_OK;
@@ -85,3 +206,5 @@ ngx_strerror_init(void)
 
     return NGX_ERROR;
 }
+
+#endif
diff --git a/src/os/unix/ngx_files.c b/src/os/unix/ngx_files.c
index 482d3276..1c82a8ea 100644
--- a/src/os/unix/ngx_files.c
+++ b/src/os/unix/ngx_files.c
@@ -875,9 +875,28 @@ ngx_fs_bsize(u_char *name)
         return 512;
     }
 
+#if (NGX_LINUX)
+    if ((size_t) fs.f_bsize > ngx_pagesize) {
+        return 512;
+    }
+#endif
+
     return (size_t) fs.f_bsize;
 }
 
+
+off_t
+ngx_fs_available(u_char *name)
+{
+    struct statfs  fs;
+
+    if (statfs((char *) name, &fs) == -1) {
+        return NGX_MAX_OFF_T_VALUE;
+    }
+
+    return (off_t) fs.f_bavail * fs.f_bsize;
+}
+
 #elif (NGX_HAVE_STATVFS)
 
 size_t
@@ -893,9 +912,28 @@ ngx_fs_bsize(u_char *name)
         return 512;
     }
 
+#if (NGX_LINUX)
+    if ((size_t) fs.f_frsize > ngx_pagesize) {
+        return 512;
+    }
+#endif
+
     return (size_t) fs.f_frsize;
 }
 
+
+off_t
+ngx_fs_available(u_char *name)
+{
+    struct statvfs  fs;
+
+    if (statvfs((char *) name, &fs) == -1) {
+        return NGX_MAX_OFF_T_VALUE;
+    }
+
+    return (off_t) fs.f_bavail * fs.f_frsize;
+}
+
 #else
 
 size_t
@@ -904,4 +942,11 @@ ngx_fs_bsize(u_char *name)
     return 512;
 }
 
+
+off_t
+ngx_fs_available(u_char *name)
+{
+    return NGX_MAX_OFF_T_VALUE;
+}
+
 #endif
diff --git a/src/os/unix/ngx_files.h b/src/os/unix/ngx_files.h
index 383e38e6..d084713b 100644
--- a/src/os/unix/ngx_files.h
+++ b/src/os/unix/ngx_files.h
@@ -185,7 +185,10 @@ ngx_int_t ngx_set_file_time(u_char *name, ngx_fd_t fd, time_t s);
 #define ngx_is_exec(sb)          (((sb)->st_mode & S_IXUSR) == S_IXUSR)
 #define ngx_file_access(sb)      ((sb)->st_mode & 0777)
 #define ngx_file_size(sb)        (sb)->st_size
-#define ngx_file_fs_size(sb)     ngx_max((sb)->st_size, (sb)->st_blocks * 512)
+#define ngx_file_fs_size(sb)                                                 \
+    (((sb)->st_blocks * 512 > (sb)->st_size                                  \
+     && (sb)->st_blocks * 512 < (sb)->st_size + 8 * (sb)->st_blksize)        \
+     ? (sb)->st_blocks * 512 : (sb)->st_size)
 #define ngx_file_mtime(sb)       (sb)->st_mtime
 #define ngx_file_uniq(sb)        (sb)->st_ino
 
@@ -346,6 +349,7 @@ ngx_int_t ngx_directio_off(ngx_fd_t fd);
 #endif
 
 size_t ngx_fs_bsize(u_char *name);
+off_t ngx_fs_available(u_char *name);
 
 
 #if (NGX_HAVE_OPENAT)
diff --git a/src/os/unix/ngx_posix_config.h b/src/os/unix/ngx_posix_config.h
index 2a8c413e..03f7e0a5 100644
--- a/src/os/unix/ngx_posix_config.h
+++ b/src/os/unix/ngx_posix_config.h
@@ -21,10 +21,13 @@
 #endif
 
 
-#if (NGX_GNU_HURD)
+#if defined(__GLIBC__)
 #ifndef _GNU_SOURCE
 #define _GNU_SOURCE             /* accept4() */
 #endif
+#endif
+
+#if (NGX_GNU_HURD)
 #define _FILE_OFFSET_BITS       64
 #endif
 
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index 5817a2c2..07cd05e8 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -15,7 +15,7 @@ static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n,
     ngx_int_t type);
 static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle,
     ngx_uint_t respawn);
-static void ngx_pass_open_channel(ngx_cycle_t *cycle, ngx_channel_t *ch);
+static void ngx_pass_open_channel(ngx_cycle_t *cycle);
 static void ngx_signal_worker_processes(ngx_cycle_t *cycle, int signo);
 static ngx_uint_t ngx_reap_children(ngx_cycle_t *cycle);
 static void ngx_master_process_exit(ngx_cycle_t *cycle);
@@ -77,12 +77,11 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
     u_char            *p;
     size_t             size;
     ngx_int_t          i;
-    ngx_uint_t         n, sigio;
+    ngx_uint_t         sigio;
     sigset_t           set;
     struct itimerval   itv;
     ngx_uint_t         live;
     ngx_msec_t         delay;
-    ngx_listening_t   *ls;
     ngx_core_conf_t   *ccf;
 
     sigemptyset(&set);
@@ -204,16 +203,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
         if (ngx_quit) {
             ngx_signal_worker_processes(cycle,
                                         ngx_signal_value(NGX_SHUTDOWN_SIGNAL));
-
-            ls = cycle->listening.elts;
-            for (n = 0; n < cycle->listening.nelts; n++) {
-                if (ngx_close_socket(ls[n].fd) == -1) {
-                    ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_socket_errno,
-                                  ngx_close_socket_n " %V failed",
-                                  &ls[n].addr_text);
-                }
-            }
-            cycle->listening.nelts = 0;
+            ngx_close_listening_sockets(cycle);
 
             continue;
         }
@@ -345,25 +335,16 @@ ngx_single_process_cycle(ngx_cycle_t *cycle)
 static void
 ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n, ngx_int_t type)
 {
-    ngx_int_t      i;
-    ngx_channel_t  ch;
+    ngx_int_t  i;
 
     ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "start worker processes");
 
-    ngx_memzero(&ch, sizeof(ngx_channel_t));
-
-    ch.command = NGX_CMD_OPEN_CHANNEL;
-
     for (i = 0; i < n; i++) {
 
         ngx_spawn_process(cycle, ngx_worker_process_cycle,
                           (void *) (intptr_t) i, "worker process", type);
 
-        ch.pid = ngx_processes[ngx_process_slot].pid;
-        ch.slot = ngx_process_slot;
-        ch.fd = ngx_processes[ngx_process_slot].channel[0];
-
-        ngx_pass_open_channel(cycle, &ch);
+        ngx_pass_open_channel(cycle);
     }
 }
 
@@ -371,9 +352,8 @@ ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n, ngx_int_t type)
 static void
 ngx_start_cache_manager_processes(ngx_cycle_t *cycle, ngx_uint_t respawn)
 {
-    ngx_uint_t       i, manager, loader;
-    ngx_path_t     **path;
-    ngx_channel_t    ch;
+    ngx_uint_t    i, manager, loader;
+    ngx_path_t  **path;
 
     manager = 0;
     loader = 0;
@@ -398,14 +378,7 @@ ngx_start_cache_manager_processes(ngx_cycle_t *cycle, ngx_uint_t respawn)
                       &ngx_cache_manager_ctx, "cache manager process",
                       respawn ? NGX_PROCESS_JUST_RESPAWN : NGX_PROCESS_RESPAWN);
 
-    ngx_memzero(&ch, sizeof(ngx_channel_t));
-
-    ch.command = NGX_CMD_OPEN_CHANNEL;
-    ch.pid = ngx_processes[ngx_process_slot].pid;
-    ch.slot = ngx_process_slot;
-    ch.fd = ngx_processes[ngx_process_slot].channel[0];
-
-    ngx_pass_open_channel(cycle, &ch);
+    ngx_pass_open_channel(cycle);
 
     if (loader == 0) {
         return;
@@ -415,19 +388,22 @@ ngx_start_cache_manager_processes(ngx_cycle_t *cycle, ngx_uint_t respawn)
                       &ngx_cache_loader_ctx, "cache loader process",
                       respawn ? NGX_PROCESS_JUST_SPAWN : NGX_PROCESS_NORESPAWN);
 
-    ch.command = NGX_CMD_OPEN_CHANNEL;
-    ch.pid = ngx_processes[ngx_process_slot].pid;
-    ch.slot = ngx_process_slot;
-    ch.fd = ngx_processes[ngx_process_slot].channel[0];
-
-    ngx_pass_open_channel(cycle, &ch);
+    ngx_pass_open_channel(cycle);
 }
 
 
 static void
-ngx_pass_open_channel(ngx_cycle_t *cycle, ngx_channel_t *ch)
+ngx_pass_open_channel(ngx_cycle_t *cycle)
 {
-    ngx_int_t  i;
+    ngx_int_t      i;
+    ngx_channel_t  ch;
+
+    ngx_memzero(&ch, sizeof(ngx_channel_t));
+
+    ch.command = NGX_CMD_OPEN_CHANNEL;
+    ch.pid = ngx_processes[ngx_process_slot].pid;
+    ch.slot = ngx_process_slot;
+    ch.fd = ngx_processes[ngx_process_slot].channel[0];
 
     for (i = 0; i < ngx_last_process; i++) {
 
@@ -440,14 +416,14 @@ ngx_pass_open_channel(ngx_cycle_t *cycle, ngx_channel_t *ch)
 
         ngx_log_debug6(NGX_LOG_DEBUG_CORE, cycle->log, 0,
                       "pass channel s:%i pid:%P fd:%d to s:%i pid:%P fd:%d",
-                      ch->slot, ch->pid, ch->fd,
+                      ch.slot, ch.pid, ch.fd,
                       i, ngx_processes[i].pid,
                       ngx_processes[i].channel[0]);
 
         /* TODO: NGX_AGAIN */
 
         ngx_write_channel(ngx_processes[i].channel[0],
-                          ch, sizeof(ngx_channel_t), cycle->log);
+                          &ch, sizeof(ngx_channel_t), cycle->log);
     }
 }
 
@@ -631,12 +607,7 @@ ngx_reap_children(ngx_cycle_t *cycle)
                 }
 
 
-                ch.command = NGX_CMD_OPEN_CHANNEL;
-                ch.pid = ngx_processes[ngx_process_slot].pid;
-                ch.slot = ngx_process_slot;
-                ch.fd = ngx_processes[ngx_process_slot].channel[0];
-
-                ngx_pass_open_channel(cycle, &ch);
+                ngx_pass_open_channel(cycle);
 
                 live = 1;
 
diff --git a/src/os/unix/ngx_readv_chain.c b/src/os/unix/ngx_readv_chain.c
index 454cfdca..a3577ce1 100644
--- a/src/os/unix/ngx_readv_chain.c
+++ b/src/os/unix/ngx_readv_chain.c
@@ -60,7 +60,7 @@ ngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain, off_t limit)
                        "readv: eof:%d, avail:%d",
                        rev->pending_eof, rev->available);
 
-        if (!rev->available && !rev->pending_eof) {
+        if (rev->available == 0 && !rev->pending_eof) {
             return NGX_AGAIN;
         }
     }
@@ -165,6 +165,40 @@ ngx_readv_chain(ngx_connection_t *c, ngx_chain_t *chain, off_t limit)
 
 #endif
 
+#if (NGX_HAVE_FIONREAD)
+
+            if (rev->available >= 0) {
+                rev->available -= n;
+
+                /*
+                 * negative rev->available means some additional bytes
+                 * were received between kernel notification and readv(),
+                 * and therefore ev->ready can be safely reset even for
+                 * edge-triggered event methods
+                 */
+
+                if (rev->available < 0) {
+                    rev->available = 0;
+                    rev->ready = 0;
+                }
+
+                ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                               "readv: avail:%d", rev->available);
+
+            } else if (n == size) {
+
+                if (ngx_socket_nread(c->fd, &rev->available) == -1) {
+                    n = ngx_connection_error(c, ngx_socket_errno,
+                                             ngx_socket_nread_n " failed");
+                    break;
+                }
+
+                ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                               "readv: avail:%d", rev->available);
+            }
+
+#endif
+
 #if (NGX_HAVE_EPOLLRDHUP)
 
             if ((ngx_event_flags & NGX_USE_EPOLL_EVENT)
diff --git a/src/os/unix/ngx_recv.c b/src/os/unix/ngx_recv.c
index c85fd453..ddfae4db 100644
--- a/src/os/unix/ngx_recv.c
+++ b/src/os/unix/ngx_recv.c
@@ -57,7 +57,7 @@ ngx_unix_recv(ngx_connection_t *c, u_char *buf, size_t size)
                        "recv: eof:%d, avail:%d",
                        rev->pending_eof, rev->available);
 
-        if (!rev->available && !rev->pending_eof) {
+        if (rev->available == 0 && !rev->pending_eof) {
             rev->ready = 0;
             return NGX_AGAIN;
         }
@@ -116,6 +116,40 @@ ngx_unix_recv(ngx_connection_t *c, u_char *buf, size_t size)
 
 #endif
 
+#if (NGX_HAVE_FIONREAD)
+
+            if (rev->available >= 0) {
+                rev->available -= n;
+
+                /*
+                 * negative rev->available means some additional bytes
+                 * were received between kernel notification and recv(),
+                 * and therefore ev->ready can be safely reset even for
+                 * edge-triggered event methods
+                 */
+
+                if (rev->available < 0) {
+                    rev->available = 0;
+                    rev->ready = 0;
+                }
+
+                ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                               "recv: avail:%d", rev->available);
+
+            } else if ((size_t) n == size) {
+
+                if (ngx_socket_nread(c->fd, &rev->available) == -1) {
+                    n = ngx_connection_error(c, ngx_socket_errno,
+                                             ngx_socket_nread_n " failed");
+                    break;
+                }
+
+                ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                               "recv: avail:%d", rev->available);
+            }
+
+#endif
+
 #if (NGX_HAVE_EPOLLRDHUP)
 
             if ((ngx_event_flags & NGX_USE_EPOLL_EVENT)
diff --git a/src/os/unix/ngx_socket.h b/src/os/unix/ngx_socket.h
index fcc51533..ec66a6f8 100644
--- a/src/os/unix/ngx_socket.h
+++ b/src/os/unix/ngx_socket.h
@@ -38,6 +38,13 @@ int ngx_blocking(ngx_socket_t s);
 
 #endif
 
+#if (NGX_HAVE_FIONREAD)
+
+#define ngx_socket_nread(s, n)  ioctl(s, FIONREAD, n)
+#define ngx_socket_nread_n      "ioctl(FIONREAD)"
+
+#endif
+
 int ngx_tcp_nopush(ngx_socket_t s);
 int ngx_tcp_push(ngx_socket_t s);
 
diff --git a/src/os/unix/ngx_udp_sendmsg_chain.c b/src/os/unix/ngx_udp_sendmsg_chain.c
index 5399c791..3d1d6dde 100644
--- a/src/os/unix/ngx_udp_sendmsg_chain.c
+++ b/src/os/unix/ngx_udp_sendmsg_chain.c
@@ -189,6 +189,13 @@ ngx_udp_output_chain_to_iovec(ngx_iovec_t *vec, ngx_chain_t *in, ngx_log_t *log)
         return cl;
     }
 
+    /* zero-sized datagram; pretend to have at least 1 iov */
+    if (n == 0) {
+        iov = &vec->iovs[n++];
+        iov->iov_base = NULL;
+        iov->iov_len = 0;
+    }
+
     vec->count = n;
     vec->size = total;
 
diff --git a/src/stream/ngx_stream.c b/src/stream/ngx_stream.c
index 78356754..3304c843 100644
--- a/src/stream/ngx_stream.c
+++ b/src/stream/ngx_stream.c
@@ -510,6 +510,10 @@ ngx_stream_optimize_servers(ngx_conf_t *cf, ngx_array_t *ports)
             ls->ipv6only = addr[i].opt.ipv6only;
 #endif
 
+#if (NGX_HAVE_TCP_FASTOPEN)
+            ls->fastopen = addr[i].opt.fastopen;
+#endif
+
 #if (NGX_HAVE_REUSEPORT)
             ls->reuseport = addr[i].opt.reuseport;
 #endif
diff --git a/src/stream/ngx_stream.h b/src/stream/ngx_stream.h
index 57e73e04..46c36229 100644
--- a/src/stream/ngx_stream.h
+++ b/src/stream/ngx_stream.h
@@ -65,6 +65,9 @@ typedef struct {
     int                            backlog;
     int                            rcvbuf;
     int                            sndbuf;
+#if (NGX_HAVE_TCP_FASTOPEN)
+    int                            fastopen;
+#endif
     int                            type;
 } ngx_stream_listen_t;
 
@@ -226,6 +229,8 @@ struct ngx_stream_session_s {
     unsigned                       stat_processing:1;
 
     unsigned                       health_check:1;
+
+    unsigned                       limit_conn_status:2;
 };
 
 
diff --git a/src/stream/ngx_stream_core_module.c b/src/stream/ngx_stream_core_module.c
index 9b6afe97..d96d27ab 100644
--- a/src/stream/ngx_stream_core_module.c
+++ b/src/stream/ngx_stream_core_module.c
@@ -615,6 +615,10 @@ ngx_stream_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     ls->type = SOCK_STREAM;
     ls->ctx = cf->ctx;
 
+#if (NGX_HAVE_TCP_FASTOPEN)
+    ls->fastopen = -1;
+#endif
+
 #if (NGX_HAVE_INET6)
     ls->ipv6only = 1;
 #endif
@@ -635,6 +639,21 @@ ngx_stream_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
             continue;
         }
 
+#if (NGX_HAVE_TCP_FASTOPEN)
+        if (ngx_strncmp(value[i].data, "fastopen=", 9) == 0) {
+            ls->fastopen = ngx_atoi(value[i].data + 9, value[i].len - 9);
+            ls->bind = 1;
+
+            if (ls->fastopen == NGX_ERROR) {
+                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                   "invalid fastopen \"%V\"", &value[i]);
+                return NGX_CONF_ERROR;
+            }
+
+            continue;
+        }
+#endif
+
         if (ngx_strncmp(value[i].data, "backlog=", 8) == 0) {
             ls->backlog = ngx_atoi(value[i].data + 8, value[i].len - 8);
             ls->bind = 1;
@@ -859,6 +878,12 @@ ngx_stream_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
         if (ls->proxy_protocol) {
             return "\"proxy_protocol\" parameter is incompatible with \"udp\"";
         }
+
+#if (NGX_HAVE_TCP_FASTOPEN)
+        if (ls->fastopen != -1) {
+            return "\"fastopen\" parameter is incompatible with \"udp\"";
+        }
+#endif
     }
 
     als = cmcf->listen.elts;
diff --git a/src/stream/ngx_stream_limit_conn_module.c b/src/stream/ngx_stream_limit_conn_module.c
index b64a426c..bae034ad 100644
--- a/src/stream/ngx_stream_limit_conn_module.c
+++ b/src/stream/ngx_stream_limit_conn_module.c
@@ -10,35 +10,48 @@
 #include <ngx_stream.h>
 
 
+#define NGX_STREAM_LIMIT_CONN_PASSED            1
+#define NGX_STREAM_LIMIT_CONN_REJECTED          2
+#define NGX_STREAM_LIMIT_CONN_REJECTED_DRY_RUN  3
+
+
 typedef struct {
-    u_char                       color;
-    u_char                       len;
-    u_short                      conn;
-    u_char                       data[1];
+    u_char                          color;
+    u_char                          len;
+    u_short                         conn;
+    u_char                          data[1];
 } ngx_stream_limit_conn_node_t;
 
 
 typedef struct {
-    ngx_shm_zone_t              *shm_zone;
-    ngx_rbtree_node_t           *node;
+    ngx_shm_zone_t                 *shm_zone;
+    ngx_rbtree_node_t              *node;
 } ngx_stream_limit_conn_cleanup_t;
 
 
 typedef struct {
-    ngx_rbtree_t                *rbtree;
-    ngx_stream_complex_value_t   key;
+    ngx_rbtree_t                    rbtree;
+    ngx_rbtree_node_t               sentinel;
+} ngx_stream_limit_conn_shctx_t;
+
+
+typedef struct {
+    ngx_stream_limit_conn_shctx_t  *sh;
+    ngx_slab_pool_t                *shpool;
+    ngx_stream_complex_value_t      key;
 } ngx_stream_limit_conn_ctx_t;
 
 
 typedef struct {
-    ngx_shm_zone_t              *shm_zone;
-    ngx_uint_t                   conn;
+    ngx_shm_zone_t                 *shm_zone;
+    ngx_uint_t                      conn;
 } ngx_stream_limit_conn_limit_t;
 
 
 typedef struct {
-    ngx_array_t                  limits;
-    ngx_uint_t                   log_level;
+    ngx_array_t                     limits;
+    ngx_uint_t                      log_level;
+    ngx_flag_t                      dry_run;
 } ngx_stream_limit_conn_conf_t;
 
 
@@ -47,6 +60,8 @@ static ngx_rbtree_node_t *ngx_stream_limit_conn_lookup(ngx_rbtree_t *rbtree,
 static void ngx_stream_limit_conn_cleanup(void *data);
 static ngx_inline void ngx_stream_limit_conn_cleanup_all(ngx_pool_t *pool);
 
+static ngx_int_t ngx_stream_limit_conn_status_variable(ngx_stream_session_t *s,
+    ngx_stream_variable_value_t *v, uintptr_t data);
 static void *ngx_stream_limit_conn_create_conf(ngx_conf_t *cf);
 static char *ngx_stream_limit_conn_merge_conf(ngx_conf_t *cf, void *parent,
     void *child);
@@ -54,6 +69,7 @@ static char *ngx_stream_limit_conn_zone(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 static char *ngx_stream_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+static ngx_int_t ngx_stream_limit_conn_add_variables(ngx_conf_t *cf);
 static ngx_int_t ngx_stream_limit_conn_init(ngx_conf_t *cf);
 
 
@@ -89,12 +105,19 @@ static ngx_command_t  ngx_stream_limit_conn_commands[] = {
       offsetof(ngx_stream_limit_conn_conf_t, log_level),
       &ngx_stream_limit_conn_log_levels },
 
+    { ngx_string("limit_conn_dry_run"),
+      NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_STREAM_SRV_CONF_OFFSET,
+      offsetof(ngx_stream_limit_conn_conf_t, dry_run),
+      NULL },
+
       ngx_null_command
 };
 
 
 static ngx_stream_module_t  ngx_stream_limit_conn_module_ctx = {
-    NULL,                                  /* preconfiguration */
+    ngx_stream_limit_conn_add_variables,   /* preconfiguration */
     ngx_stream_limit_conn_init,            /* postconfiguration */
 
     NULL,                                  /* create main configuration */
@@ -121,6 +144,22 @@ ngx_module_t  ngx_stream_limit_conn_module = {
 };
 
 
+static ngx_stream_variable_t  ngx_stream_limit_conn_vars[] = {
+
+    { ngx_string("limit_conn_status"), NULL,
+      ngx_stream_limit_conn_status_variable, 0, NGX_STREAM_VAR_NOCACHEABLE, 0 },
+
+      ngx_stream_null_variable
+};
+
+
+static ngx_str_t  ngx_stream_limit_conn_status[] = {
+    ngx_string("PASSED"),
+    ngx_string("REJECTED"),
+    ngx_string("REJECTED_DRY_RUN")
+};
+
+
 static ngx_int_t
 ngx_stream_limit_conn_handler(ngx_stream_session_t *s)
 {
@@ -128,7 +167,6 @@ ngx_stream_limit_conn_handler(ngx_stream_session_t *s)
     uint32_t                          hash;
     ngx_str_t                         key;
     ngx_uint_t                        i;
-    ngx_slab_pool_t                  *shpool;
     ngx_rbtree_node_t                *node;
     ngx_pool_cleanup_t               *cln;
     ngx_stream_limit_conn_ctx_t      *ctx;
@@ -159,13 +197,13 @@ ngx_stream_limit_conn_handler(ngx_stream_session_t *s)
             continue;
         }
 
-        hash = ngx_crc32_short(key.data, key.len);
+        s->limit_conn_status = NGX_STREAM_LIMIT_CONN_PASSED;
 
-        shpool = (ngx_slab_pool_t *) limits[i].shm_zone->shm.addr;
+        hash = ngx_crc32_short(key.data, key.len);
 
-        ngx_shmtx_lock(&shpool->mutex);
+        ngx_shmtx_lock(&ctx->shpool->mutex);
 
-        node = ngx_stream_limit_conn_lookup(ctx->rbtree, &key, hash);
+        node = ngx_stream_limit_conn_lookup(&ctx->sh->rbtree, &key, hash);
 
         if (node == NULL) {
 
@@ -173,11 +211,20 @@ ngx_stream_limit_conn_handler(ngx_stream_session_t *s)
                 + offsetof(ngx_stream_limit_conn_node_t, data)
                 + key.len;
 
-            node = ngx_slab_alloc_locked(shpool, n);
+            node = ngx_slab_alloc_locked(ctx->shpool, n);
 
             if (node == NULL) {
-                ngx_shmtx_unlock(&shpool->mutex);
+                ngx_shmtx_unlock(&ctx->shpool->mutex);
                 ngx_stream_limit_conn_cleanup_all(s->connection->pool);
+
+                if (lccf->dry_run) {
+                    s->limit_conn_status =
+                                        NGX_STREAM_LIMIT_CONN_REJECTED_DRY_RUN;
+                    return NGX_DECLINED;
+                }
+
+                s->limit_conn_status = NGX_STREAM_LIMIT_CONN_REJECTED;
+
                 return NGX_STREAM_SERVICE_UNAVAILABLE;
             }
 
@@ -188,7 +235,7 @@ ngx_stream_limit_conn_handler(ngx_stream_session_t *s)
             lc->conn = 1;
             ngx_memcpy(lc->data, key.data, key.len);
 
-            ngx_rbtree_insert(ctx->rbtree, node);
+            ngx_rbtree_insert(&ctx->sh->rbtree, node);
 
         } else {
 
@@ -196,13 +243,23 @@ ngx_stream_limit_conn_handler(ngx_stream_session_t *s)
 
             if ((ngx_uint_t) lc->conn >= limits[i].conn) {
 
-                ngx_shmtx_unlock(&shpool->mutex);
+                ngx_shmtx_unlock(&ctx->shpool->mutex);
 
                 ngx_log_error(lccf->log_level, s->connection->log, 0,
-                              "limiting connections by zone \"%V\"",
+                              "limiting connections%s by zone \"%V\"",
+                              lccf->dry_run ? ", dry run," : "",
                               &limits[i].shm_zone->shm.name);
 
                 ngx_stream_limit_conn_cleanup_all(s->connection->pool);
+
+                if (lccf->dry_run) {
+                    s->limit_conn_status =
+                                        NGX_STREAM_LIMIT_CONN_REJECTED_DRY_RUN;
+                    return NGX_DECLINED;
+                }
+
+                s->limit_conn_status = NGX_STREAM_LIMIT_CONN_REJECTED;
+
                 return NGX_STREAM_SERVICE_UNAVAILABLE;
             }
 
@@ -212,7 +269,7 @@ ngx_stream_limit_conn_handler(ngx_stream_session_t *s)
         ngx_log_debug2(NGX_LOG_DEBUG_STREAM, s->connection->log, 0,
                        "limit conn: %08Xi %d", node->key, lc->conn);
 
-        ngx_shmtx_unlock(&shpool->mutex);
+        ngx_shmtx_unlock(&ctx->shpool->mutex);
 
         cln = ngx_pool_cleanup_add(s->connection->pool,
                                    sizeof(ngx_stream_limit_conn_cleanup_t));
@@ -317,17 +374,15 @@ ngx_stream_limit_conn_cleanup(void *data)
 {
     ngx_stream_limit_conn_cleanup_t  *lccln = data;
 
-    ngx_slab_pool_t               *shpool;
     ngx_rbtree_node_t             *node;
     ngx_stream_limit_conn_ctx_t   *ctx;
     ngx_stream_limit_conn_node_t  *lc;
 
     ctx = lccln->shm_zone->data;
-    shpool = (ngx_slab_pool_t *) lccln->shm_zone->shm.addr;
     node = lccln->node;
     lc = (ngx_stream_limit_conn_node_t *) &node->color;
 
-    ngx_shmtx_lock(&shpool->mutex);
+    ngx_shmtx_lock(&ctx->shpool->mutex);
 
     ngx_log_debug2(NGX_LOG_DEBUG_STREAM, lccln->shm_zone->shm.log, 0,
                    "limit conn cleanup: %08Xi %d", node->key, lc->conn);
@@ -335,11 +390,11 @@ ngx_stream_limit_conn_cleanup(void *data)
     lc->conn--;
 
     if (lc->conn == 0) {
-        ngx_rbtree_delete(ctx->rbtree, node);
-        ngx_slab_free_locked(shpool, node);
+        ngx_rbtree_delete(&ctx->sh->rbtree, node);
+        ngx_slab_free_locked(ctx->shpool, node);
     }
 
-    ngx_shmtx_unlock(&shpool->mutex);
+    ngx_shmtx_unlock(&ctx->shpool->mutex);
 }
 
 
@@ -365,8 +420,6 @@ ngx_stream_limit_conn_init_zone(ngx_shm_zone_t *shm_zone, void *data)
     ngx_stream_limit_conn_ctx_t  *octx = data;
 
     size_t                        len;
-    ngx_slab_pool_t              *shpool;
-    ngx_rbtree_node_t            *sentinel;
     ngx_stream_limit_conn_ctx_t  *ctx;
 
     ctx = shm_zone->data;
@@ -385,48 +438,64 @@ ngx_stream_limit_conn_init_zone(ngx_shm_zone_t *shm_zone, void *data)
             return NGX_ERROR;
         }
 
-        ctx->rbtree = octx->rbtree;
+        ctx->sh = octx->sh;
+        ctx->shpool = octx->shpool;
 
         return NGX_OK;
     }
 
-    shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
+    ctx->shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
 
     if (shm_zone->shm.exists) {
-        ctx->rbtree = shpool->data;
+        ctx->sh = ctx->shpool->data;
 
         return NGX_OK;
     }
 
-    ctx->rbtree = ngx_slab_alloc(shpool, sizeof(ngx_rbtree_t));
-    if (ctx->rbtree == NULL) {
+    ctx->sh = ngx_slab_alloc(ctx->shpool,
+                             sizeof(ngx_stream_limit_conn_shctx_t));
+    if (ctx->sh == NULL) {
         return NGX_ERROR;
     }
 
-    shpool->data = ctx->rbtree;
+    ctx->shpool->data = ctx->sh;
 
-    sentinel = ngx_slab_alloc(shpool, sizeof(ngx_rbtree_node_t));
-    if (sentinel == NULL) {
-        return NGX_ERROR;
-    }
-
-    ngx_rbtree_init(ctx->rbtree, sentinel,
+    ngx_rbtree_init(&ctx->sh->rbtree, &ctx->sh->sentinel,
                     ngx_stream_limit_conn_rbtree_insert_value);
 
     len = sizeof(" in limit_conn_zone \"\"") + shm_zone->shm.name.len;
 
-    shpool->log_ctx = ngx_slab_alloc(shpool, len);
-    if (shpool->log_ctx == NULL) {
+    ctx->shpool->log_ctx = ngx_slab_alloc(ctx->shpool, len);
+    if (ctx->shpool->log_ctx == NULL) {
         return NGX_ERROR;
     }
 
-    ngx_sprintf(shpool->log_ctx, " in limit_conn_zone \"%V\"%Z",
+    ngx_sprintf(ctx->shpool->log_ctx, " in limit_conn_zone \"%V\"%Z",
                 &shm_zone->shm.name);
 
     return NGX_OK;
 }
 
 
+static ngx_int_t
+ngx_stream_limit_conn_status_variable(ngx_stream_session_t *s,
+    ngx_stream_variable_value_t *v, uintptr_t data)
+{
+    if (s->limit_conn_status == 0) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+    v->len = ngx_stream_limit_conn_status[s->limit_conn_status - 1].len;
+    v->data = ngx_stream_limit_conn_status[s->limit_conn_status - 1].data;
+
+    return NGX_OK;
+}
+
+
 static void *
 ngx_stream_limit_conn_create_conf(ngx_conf_t *cf)
 {
@@ -444,6 +513,7 @@ ngx_stream_limit_conn_create_conf(ngx_conf_t *cf)
      */
 
     conf->log_level = NGX_CONF_UNSET_UINT;
+    conf->dry_run = NGX_CONF_UNSET;
 
     return conf;
 }
@@ -461,6 +531,8 @@ ngx_stream_limit_conn_merge_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_uint_value(conf->log_level, prev->log_level, NGX_LOG_ERR);
 
+    ngx_conf_merge_value(conf->dry_run, prev->dry_run, 0);
+
     return NGX_CONF_OK;
 }
 
@@ -627,6 +699,25 @@ ngx_stream_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static ngx_int_t
+ngx_stream_limit_conn_add_variables(ngx_conf_t *cf)
+{
+    ngx_stream_variable_t  *var, *v;
+
+    for (v = ngx_stream_limit_conn_vars; v->name.len; v++) {
+        var = ngx_stream_add_variable(cf, &v->name, v->flags);
+        if (var == NULL) {
+            return NGX_ERROR;
+        }
+
+        var->get_handler = v->get_handler;
+        var->data = v->data;
+    }
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_stream_limit_conn_init(ngx_conf_t *cf)
 {
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
index 127c8a4a..8c686ab2 100644
--- a/src/stream/ngx_stream_proxy_module.c
+++ b/src/stream/ngx_stream_proxy_module.c
@@ -24,8 +24,8 @@ typedef struct {
     ngx_msec_t                       timeout;
     ngx_msec_t                       next_upstream_timeout;
     size_t                           buffer_size;
-    size_t                           upload_rate;
-    size_t                           download_rate;
+    ngx_stream_complex_value_t      *upload_rate;
+    ngx_stream_complex_value_t      *download_rate;
     ngx_uint_t                       requests;
     ngx_uint_t                       responses;
     ngx_uint_t                       next_upstream_tries;
@@ -46,9 +46,10 @@ typedef struct {
     ngx_uint_t                       ssl_verify_depth;
     ngx_str_t                        ssl_trusted_certificate;
     ngx_str_t                        ssl_crl;
-    ngx_str_t                        ssl_certificate;
-    ngx_str_t                        ssl_certificate_key;
+    ngx_stream_complex_value_t      *ssl_certificate;
+    ngx_stream_complex_value_t      *ssl_certificate_key;
     ngx_array_t                     *ssl_passwords;
+    ngx_array_t                     *ssl_conf_commands;
 
     ngx_ssl_t                       *ssl;
 #endif
@@ -94,10 +95,13 @@ static char *ngx_stream_proxy_bind(ngx_conf_t *cf, ngx_command_t *cmd,
 static ngx_int_t ngx_stream_proxy_send_proxy_protocol(ngx_stream_session_t *s);
 static char *ngx_stream_proxy_ssl_password_file(ngx_conf_t *cf,
     ngx_command_t *cmd, void *conf);
+static char *ngx_stream_proxy_ssl_conf_command_check(ngx_conf_t *cf, void *post,
+    void *data);
 static void ngx_stream_proxy_ssl_init_connection(ngx_stream_session_t *s);
 static void ngx_stream_proxy_ssl_handshake(ngx_connection_t *pc);
 static void ngx_stream_proxy_ssl_save_session(ngx_connection_t *c);
 static ngx_int_t ngx_stream_proxy_ssl_name(ngx_stream_session_t *s);
+static ngx_int_t ngx_stream_proxy_ssl_certificate(ngx_stream_session_t *s);
 static ngx_int_t ngx_stream_proxy_set_ssl(ngx_conf_t *cf,
     ngx_stream_proxy_srv_conf_t *pscf);
 
@@ -112,6 +116,9 @@ static ngx_conf_bitmask_t  ngx_stream_proxy_ssl_protocols[] = {
     { ngx_null_string, 0 }
 };
 
+static ngx_conf_post_t  ngx_stream_proxy_ssl_conf_command_post =
+    { ngx_stream_proxy_ssl_conf_command_check };
+
 #endif
 
 
@@ -184,14 +191,14 @@ static ngx_command_t  ngx_stream_proxy_commands[] = {
 
     { ngx_string("proxy_upload_rate"),
       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_size_slot,
+      ngx_stream_set_complex_value_size_slot,
       NGX_STREAM_SRV_CONF_OFFSET,
       offsetof(ngx_stream_proxy_srv_conf_t, upload_rate),
       NULL },
 
     { ngx_string("proxy_download_rate"),
       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_size_slot,
+      ngx_stream_set_complex_value_size_slot,
       NGX_STREAM_SRV_CONF_OFFSET,
       offsetof(ngx_stream_proxy_srv_conf_t, download_rate),
       NULL },
@@ -312,14 +319,14 @@ static ngx_command_t  ngx_stream_proxy_commands[] = {
 
     { ngx_string("proxy_ssl_certificate"),
       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_stream_set_complex_value_zero_slot,
       NGX_STREAM_SRV_CONF_OFFSET,
       offsetof(ngx_stream_proxy_srv_conf_t, ssl_certificate),
       NULL },
 
     { ngx_string("proxy_ssl_certificate_key"),
       NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
-      ngx_conf_set_str_slot,
+      ngx_stream_set_complex_value_zero_slot,
       NGX_STREAM_SRV_CONF_OFFSET,
       offsetof(ngx_stream_proxy_srv_conf_t, ssl_certificate_key),
       NULL },
@@ -331,6 +338,13 @@ static ngx_command_t  ngx_stream_proxy_commands[] = {
       0,
       NULL },
 
+    { ngx_string("proxy_ssl_conf_command"),
+      NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE2,
+      ngx_conf_set_keyval_slot,
+      NGX_STREAM_SRV_CONF_OFFSET,
+      offsetof(ngx_stream_proxy_srv_conf_t, ssl_conf_commands),
+      &ngx_stream_proxy_ssl_conf_command_post },
+
 #endif
 
       ngx_null_command
@@ -839,7 +853,7 @@ ngx_stream_proxy_init_upstream(ngx_stream_session_t *s)
         u->upstream_buf.last = p;
     }
 
-    if (c->buffer && c->buffer->pos < c->buffer->last) {
+    if (c->buffer && c->buffer->pos <= c->buffer->last) {
         ngx_log_debug1(NGX_LOG_DEBUG_STREAM, c->log, 0,
                        "stream proxy add preread buffer: %uz",
                        c->buffer->last - c->buffer->pos);
@@ -853,6 +867,7 @@ ngx_stream_proxy_init_upstream(ngx_stream_session_t *s)
         *cl->buf = *c->buffer;
 
         cl->buf->tag = (ngx_buf_tag_t) &ngx_stream_proxy_module;
+        cl->buf->temporary = (cl->buf->pos == cl->buf->last) ? 0 : 1;
         cl->buf->flush = 1;
 
         cl->next = u->upstream_out;
@@ -895,6 +910,9 @@ ngx_stream_proxy_init_upstream(ngx_stream_session_t *s)
         u->proxy_protocol = 0;
     }
 
+    u->upload_rate = ngx_stream_complex_value_size(s, pscf->upload_rate, 0);
+    u->download_rate = ngx_stream_complex_value_size(s, pscf->download_rate, 0);
+
     u->connected = 1;
 
     pc->read->handler = ngx_stream_proxy_upstream_handler;
@@ -1004,6 +1022,17 @@ ngx_stream_proxy_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
 }
 
 
+static char *
+ngx_stream_proxy_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
+{
+#ifndef SSL_CONF_FLAG_FILE
+    return "is not supported on this platform";
+#else
+    return NGX_CONF_OK;
+#endif
+}
+
+
 static void
 ngx_stream_proxy_ssl_init_connection(ngx_stream_session_t *s)
 {
@@ -1032,6 +1061,15 @@ ngx_stream_proxy_ssl_init_connection(ngx_stream_session_t *s)
         }
     }
 
+    if (pscf->ssl_certificate && (pscf->ssl_certificate->lengths
+                                  || pscf->ssl_certificate_key->lengths))
+    {
+        if (ngx_stream_proxy_ssl_certificate(s) != NGX_OK) {
+            ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
+            return;
+        }
+    }
+
     if (pscf->ssl_session_reuse) {
         pc->ssl->save_session = ngx_stream_proxy_ssl_save_session;
 
@@ -1219,6 +1257,50 @@ ngx_stream_proxy_ssl_name(ngx_stream_session_t *s)
     return NGX_OK;
 }
 
+
+static ngx_int_t
+ngx_stream_proxy_ssl_certificate(ngx_stream_session_t *s)
+{
+    ngx_str_t                     cert, key;
+    ngx_connection_t             *c;
+    ngx_stream_proxy_srv_conf_t  *pscf;
+
+    c = s->upstream->peer.connection;
+
+    pscf = ngx_stream_get_module_srv_conf(s, ngx_stream_proxy_module);
+
+    if (ngx_stream_complex_value(s, pscf->ssl_certificate, &cert)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
+    ngx_log_debug1(NGX_LOG_DEBUG_STREAM, c->log, 0,
+                   "stream upstream ssl cert: \"%s\"", cert.data);
+
+    if (*cert.data == '\0') {
+        return NGX_OK;
+    }
+
+    if (ngx_stream_complex_value(s, pscf->ssl_certificate_key, &key)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
+    ngx_log_debug1(NGX_LOG_DEBUG_STREAM, c->log, 0,
+                   "stream upstream ssl key: \"%s\"", key.data);
+
+    if (ngx_ssl_connection_certificate(c, c->pool, &cert, &key,
+                                       pscf->ssl_passwords)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
+    return NGX_OK;
+}
+
 #endif
 
 
@@ -1532,7 +1614,7 @@ ngx_stream_proxy_process(ngx_stream_session_t *s, ngx_uint_t from_upstream,
         src = pc;
         dst = c;
         b = &u->upstream_buf;
-        limit_rate = pscf->download_rate;
+        limit_rate = u->download_rate;
         received = &u->received;
         packets = &u->responses;
         out = &u->downstream_out;
@@ -1544,7 +1626,7 @@ ngx_stream_proxy_process(ngx_stream_session_t *s, ngx_uint_t from_upstream,
         src = c;
         dst = pc;
         b = &u->downstream_buf;
-        limit_rate = pscf->upload_rate;
+        limit_rate = u->upload_rate;
         received = &s->received;
         packets = &u->requests;
         out = &u->upstream_out;
@@ -1949,11 +2031,8 @@ ngx_stream_proxy_create_srv_conf(ngx_conf_t *cf)
      *
      *     conf->ssl_protocols = 0;
      *     conf->ssl_ciphers = { 0, NULL };
-     *     conf->ssl_name = NULL;
      *     conf->ssl_trusted_certificate = { 0, NULL };
      *     conf->ssl_crl = { 0, NULL };
-     *     conf->ssl_certificate = { 0, NULL };
-     *     conf->ssl_certificate_key = { 0, NULL };
      *
      *     conf->ssl = NULL;
      *     conf->upstream = NULL;
@@ -1964,8 +2043,8 @@ ngx_stream_proxy_create_srv_conf(ngx_conf_t *cf)
     conf->timeout = NGX_CONF_UNSET_MSEC;
     conf->next_upstream_timeout = NGX_CONF_UNSET_MSEC;
     conf->buffer_size = NGX_CONF_UNSET_SIZE;
-    conf->upload_rate = NGX_CONF_UNSET_SIZE;
-    conf->download_rate = NGX_CONF_UNSET_SIZE;
+    conf->upload_rate = NGX_CONF_UNSET_PTR;
+    conf->download_rate = NGX_CONF_UNSET_PTR;
     conf->requests = NGX_CONF_UNSET_UINT;
     conf->responses = NGX_CONF_UNSET_UINT;
     conf->next_upstream_tries = NGX_CONF_UNSET_UINT;
@@ -1977,10 +2056,14 @@ ngx_stream_proxy_create_srv_conf(ngx_conf_t *cf)
 #if (NGX_STREAM_SSL)
     conf->ssl_enable = NGX_CONF_UNSET;
     conf->ssl_session_reuse = NGX_CONF_UNSET;
+    conf->ssl_name = NGX_CONF_UNSET_PTR;
     conf->ssl_server_name = NGX_CONF_UNSET;
     conf->ssl_verify = NGX_CONF_UNSET;
     conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
+    conf->ssl_certificate = NGX_CONF_UNSET_PTR;
+    conf->ssl_certificate_key = NGX_CONF_UNSET_PTR;
     conf->ssl_passwords = NGX_CONF_UNSET_PTR;
+    conf->ssl_conf_commands = NGX_CONF_UNSET_PTR;
 #endif
 
     return conf;
@@ -2005,11 +2088,9 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_size_value(conf->buffer_size,
                               prev->buffer_size, 16384);
 
-    ngx_conf_merge_size_value(conf->upload_rate,
-                              prev->upload_rate, 0);
+    ngx_conf_merge_ptr_value(conf->upload_rate, prev->upload_rate, NULL);
 
-    ngx_conf_merge_size_value(conf->download_rate,
-                              prev->download_rate, 0);
+    ngx_conf_merge_ptr_value(conf->download_rate, prev->download_rate, NULL);
 
     ngx_conf_merge_uint_value(conf->requests,
                               prev->requests, 0);
@@ -2042,9 +2123,7 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT");
 
-    if (conf->ssl_name == NULL) {
-        conf->ssl_name = prev->ssl_name;
-    }
+    ngx_conf_merge_ptr_value(conf->ssl_name, prev->ssl_name, NULL);
 
     ngx_conf_merge_value(conf->ssl_server_name, prev->ssl_server_name, 0);
 
@@ -2058,14 +2137,17 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_str_value(conf->ssl_crl, prev->ssl_crl, "");
 
-    ngx_conf_merge_str_value(conf->ssl_certificate,
-                              prev->ssl_certificate, "");
+    ngx_conf_merge_ptr_value(conf->ssl_certificate,
+                              prev->ssl_certificate, NULL);
 
-    ngx_conf_merge_str_value(conf->ssl_certificate_key,
-                              prev->ssl_certificate_key, "");
+    ngx_conf_merge_ptr_value(conf->ssl_certificate_key,
+                              prev->ssl_certificate_key, NULL);
 
     ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);
 
+    ngx_conf_merge_ptr_value(conf->ssl_conf_commands,
+                              prev->ssl_conf_commands, NULL);
+
     if (conf->ssl_enable && ngx_stream_proxy_set_ssl(cf, conf) != NGX_OK) {
         return NGX_CONF_ERROR;
     }
@@ -2103,20 +2185,34 @@ ngx_stream_proxy_set_ssl(ngx_conf_t *cf, ngx_stream_proxy_srv_conf_t *pscf)
     cln->handler = ngx_ssl_cleanup_ctx;
     cln->data = pscf->ssl;
 
-    if (pscf->ssl_certificate.len) {
+    if (pscf->ssl_certificate) {
 
-        if (pscf->ssl_certificate_key.len == 0) {
+        if (pscf->ssl_certificate_key == NULL) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
                           "no \"proxy_ssl_certificate_key\" is defined "
-                          "for certificate \"%V\"", &pscf->ssl_certificate);
+                          "for certificate \"%V\"",
+                          &pscf->ssl_certificate->value);
             return NGX_ERROR;
         }
 
-        if (ngx_ssl_certificate(cf, pscf->ssl, &pscf->ssl_certificate,
-                                &pscf->ssl_certificate_key, pscf->ssl_passwords)
-            != NGX_OK)
+        if (pscf->ssl_certificate->lengths
+            || pscf->ssl_certificate_key->lengths)
         {
-            return NGX_ERROR;
+            pscf->ssl_passwords =
+                           ngx_ssl_preserve_passwords(cf, pscf->ssl_passwords);
+            if (pscf->ssl_passwords == NULL) {
+                return NGX_ERROR;
+            }
+
+        } else {
+            if (ngx_ssl_certificate(cf, pscf->ssl,
+                                    &pscf->ssl_certificate->value,
+                                    &pscf->ssl_certificate_key->value,
+                                    pscf->ssl_passwords)
+                != NGX_OK)
+            {
+                return NGX_ERROR;
+            }
         }
     }
 
@@ -2150,6 +2246,12 @@ ngx_stream_proxy_set_ssl(ngx_conf_t *cf, ngx_stream_proxy_srv_conf_t *pscf)
         return NGX_ERROR;
     }
 
+    if (ngx_ssl_conf_commands(cf, pscf->ssl, pscf->ssl_conf_commands)
+        != NGX_OK)
+    {
+        return NGX_ERROR;
+    }
+
     return NGX_OK;
 }
 
diff --git a/src/stream/ngx_stream_realip_module.c b/src/stream/ngx_stream_realip_module.c
index 57b1ac21..603f5973 100644
--- a/src/stream/ngx_stream_realip_module.c
+++ b/src/stream/ngx_stream_realip_module.c
@@ -108,7 +108,7 @@ ngx_stream_realip_handler(ngx_stream_session_t *s)
 
     c = s->connection;
 
-    if (c->proxy_protocol_addr.len == 0) {
+    if (c->proxy_protocol == NULL) {
         return NGX_DECLINED;
     }
 
@@ -116,14 +116,14 @@ ngx_stream_realip_handler(ngx_stream_session_t *s)
         return NGX_DECLINED;
     }
 
-    if (ngx_parse_addr(c->pool, &addr, c->proxy_protocol_addr.data,
-                       c->proxy_protocol_addr.len)
+    if (ngx_parse_addr(c->pool, &addr, c->proxy_protocol->src_addr.data,
+                       c->proxy_protocol->src_addr.len)
         != NGX_OK)
     {
         return NGX_DECLINED;
     }
 
-    ngx_inet_set_port(addr.sockaddr, c->proxy_protocol_port);
+    ngx_inet_set_port(addr.sockaddr, c->proxy_protocol->src_port);
 
     return ngx_stream_realip_set_addr(s, &addr);
 }
diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c
index b00e7086..c447e152 100644
--- a/src/stream/ngx_stream_script.c
+++ b/src/stream/ngx_stream_script.c
@@ -105,6 +105,37 @@ ngx_stream_complex_value(ngx_stream_session_t *s,
 }
 
 
+size_t
+ngx_stream_complex_value_size(ngx_stream_session_t *s,
+    ngx_stream_complex_value_t *val, size_t default_value)
+{
+    size_t     size;
+    ngx_str_t  value;
+
+    if (val == NULL) {
+        return default_value;
+    }
+
+    if (val->lengths == NULL) {
+        return val->u.size;
+    }
+
+    if (ngx_stream_complex_value(s, val, &value) != NGX_OK) {
+        return default_value;
+    }
+
+    size = ngx_parse_size(&value);
+
+    if (size == (size_t) NGX_ERROR) {
+        ngx_log_error(NGX_LOG_ERR, s->connection->log, 0,
+                      "invalid size \"%V\"", &value);
+        return default_value;
+    }
+
+    return size;
+}
+
+
 ngx_int_t
 ngx_stream_compile_complex_value(ngx_stream_compile_complex_value_t *ccv)
 {
@@ -221,7 +252,7 @@ ngx_stream_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd,
 
     cv = (ngx_stream_complex_value_t **) (p + cmd->offset);
 
-    if (*cv != NULL) {
+    if (*cv != NGX_CONF_UNSET_PTR && *cv != NULL) {
         return "is duplicate";
     }
 
@@ -246,6 +277,74 @@ ngx_stream_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd,
 }
 
 
+char *
+ngx_stream_set_complex_value_zero_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf)
+{
+    char  *p = conf;
+
+    ngx_str_t                            *value;
+    ngx_stream_complex_value_t          **cv;
+    ngx_stream_compile_complex_value_t    ccv;
+
+    cv = (ngx_stream_complex_value_t **) (p + cmd->offset);
+
+    if (*cv != NGX_CONF_UNSET_PTR) {
+        return "is duplicate";
+    }
+
+    *cv = ngx_palloc(cf->pool, sizeof(ngx_stream_complex_value_t));
+    if (*cv == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    value = cf->args->elts;
+
+    ngx_memzero(&ccv, sizeof(ngx_stream_compile_complex_value_t));
+
+    ccv.cf = cf;
+    ccv.value = &value[1];
+    ccv.complex_value = *cv;
+    ccv.zero = 1;
+
+    if (ngx_stream_compile_complex_value(&ccv) != NGX_OK) {
+        return NGX_CONF_ERROR;
+    }
+
+    return NGX_CONF_OK;
+}
+
+
+char *
+ngx_stream_set_complex_value_size_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf)
+{
+    char  *p = conf;
+
+    char                        *rv;
+    ngx_stream_complex_value_t  *cv;
+
+    rv = ngx_stream_set_complex_value_slot(cf, cmd, conf);
+
+    if (rv != NGX_CONF_OK) {
+        return rv;
+    }
+
+    cv = *(ngx_stream_complex_value_t **) (p + cmd->offset);
+
+    if (cv->lengths) {
+        return NGX_CONF_OK;
+    }
+
+    cv->u.size = ngx_parse_size(&cv->value);
+    if (cv->u.size == (size_t) NGX_ERROR) {
+        return "invalid value";
+    }
+
+    return NGX_CONF_OK;
+}
+
+
 ngx_uint_t
 ngx_stream_script_variables_count(ngx_str_t *value)
 {
diff --git a/src/stream/ngx_stream_script.h b/src/stream/ngx_stream_script.h
index 25a450d2..d8f37404 100644
--- a/src/stream/ngx_stream_script.h
+++ b/src/stream/ngx_stream_script.h
@@ -56,6 +56,10 @@ typedef struct {
     ngx_uint_t                   *flushes;
     void                         *lengths;
     void                         *values;
+
+    union {
+        size_t                    size;
+    } u;
 } ngx_stream_complex_value_t;
 
 
@@ -102,10 +106,16 @@ void ngx_stream_script_flush_complex_value(ngx_stream_session_t *s,
     ngx_stream_complex_value_t *val);
 ngx_int_t ngx_stream_complex_value(ngx_stream_session_t *s,
     ngx_stream_complex_value_t *val, ngx_str_t *value);
+size_t ngx_stream_complex_value_size(ngx_stream_session_t *s,
+    ngx_stream_complex_value_t *val, size_t default_value);
 ngx_int_t ngx_stream_compile_complex_value(
     ngx_stream_compile_complex_value_t *ccv);
 char *ngx_stream_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+char *ngx_stream_set_complex_value_zero_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
+char *ngx_stream_set_complex_value_size_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+    void *conf);
 
 
 ngx_uint_t ngx_stream_script_variables_count(ngx_str_t *value);
diff --git a/src/stream/ngx_stream_set_module.c b/src/stream/ngx_stream_set_module.c
new file mode 100644
index 00000000..9b34a609
--- /dev/null
+++ b/src/stream/ngx_stream_set_module.c
@@ -0,0 +1,226 @@
+
+/*
+ * Copyright (C) Pavel Pautov
+ * Copyright (C) Nginx, Inc.
+ */
+
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_stream.h>
+
+
+typedef struct {
+    ngx_int_t                   index;
+    ngx_stream_set_variable_pt  set_handler;
+    uintptr_t                   data;
+    ngx_stream_complex_value_t  value;
+} ngx_stream_set_cmd_t;
+
+
+typedef struct {
+    ngx_array_t                 commands;
+} ngx_stream_set_srv_conf_t;
+
+
+static ngx_int_t ngx_stream_set_handler(ngx_stream_session_t *s);
+static ngx_int_t ngx_stream_set_var(ngx_stream_session_t *s,
+    ngx_stream_variable_value_t *v, uintptr_t data);
+static ngx_int_t ngx_stream_set_init(ngx_conf_t *cf);
+static void *ngx_stream_set_create_srv_conf(ngx_conf_t *cf);
+static char *ngx_stream_set(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
+
+
+static ngx_command_t  ngx_stream_set_commands[] = {
+
+    { ngx_string("set"),
+      NGX_STREAM_SRV_CONF|NGX_CONF_TAKE2,
+      ngx_stream_set,
+      NGX_STREAM_SRV_CONF_OFFSET,
+      0,
+      NULL },
+
+      ngx_null_command
+};
+
+
+static ngx_stream_module_t  ngx_stream_set_module_ctx = {
+    NULL,                                  /* preconfiguration */
+    ngx_stream_set_init,                   /* postconfiguration */
+
+    NULL,                                  /* create main configuration */
+    NULL,                                  /* init main configuration */
+
+    ngx_stream_set_create_srv_conf,        /* create server configuration */
+    NULL                                   /* merge server configuration */
+};
+
+
+ngx_module_t  ngx_stream_set_module = {
+    NGX_MODULE_V1,
+    &ngx_stream_set_module_ctx,            /* module context */
+    ngx_stream_set_commands,               /* module directives */
+    NGX_STREAM_MODULE,                     /* module type */
+    NULL,                                  /* init master */
+    NULL,                                  /* init module */
+    NULL,                                  /* init process */
+    NULL,                                  /* init thread */
+    NULL,                                  /* exit thread */
+    NULL,                                  /* exit process */
+    NULL,                                  /* exit master */
+    NGX_MODULE_V1_PADDING
+};
+
+
+static ngx_int_t
+ngx_stream_set_handler(ngx_stream_session_t *s)
+{
+    ngx_str_t                     str;
+    ngx_uint_t                    i;
+    ngx_stream_set_cmd_t         *cmds;
+    ngx_stream_set_srv_conf_t    *scf;
+    ngx_stream_variable_value_t   vv;
+
+    scf = ngx_stream_get_module_srv_conf(s, ngx_stream_set_module);
+    cmds = scf->commands.elts;
+    vv = ngx_stream_variable_null_value;
+
+    for (i = 0; i < scf->commands.nelts; i++) {
+        if (ngx_stream_complex_value(s, &cmds[i].value, &str) != NGX_OK) {
+            return NGX_ERROR;
+        }
+
+        if (cmds[i].set_handler != NULL) {
+            vv.len = str.len;
+            vv.data = str.data;
+            cmds[i].set_handler(s, &vv, cmds[i].data);
+
+        } else {
+            s->variables[cmds[i].index].len = str.len;
+            s->variables[cmds[i].index].valid = 1;
+            s->variables[cmds[i].index].no_cacheable = 0;
+            s->variables[cmds[i].index].not_found = 0;
+            s->variables[cmds[i].index].data = str.data;
+        }
+    }
+
+    return NGX_DECLINED;
+}
+
+
+static ngx_int_t
+ngx_stream_set_var(ngx_stream_session_t *s, ngx_stream_variable_value_t *v,
+    uintptr_t data)
+{
+    *v = ngx_stream_variable_null_value;
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_stream_set_init(ngx_conf_t *cf)
+{
+    ngx_stream_handler_pt        *h;
+    ngx_stream_core_main_conf_t  *cmcf;
+
+    cmcf = ngx_stream_conf_get_module_main_conf(cf, ngx_stream_core_module);
+
+    h = ngx_array_push(&cmcf->phases[NGX_STREAM_PREACCESS_PHASE].handlers);
+    if (h == NULL) {
+        return NGX_ERROR;
+    }
+
+    *h = ngx_stream_set_handler;
+
+    return NGX_OK;
+}
+
+
+static void *
+ngx_stream_set_create_srv_conf(ngx_conf_t *cf)
+{
+    ngx_stream_set_srv_conf_t  *conf;
+
+    conf = ngx_pcalloc(cf->pool, sizeof(ngx_stream_set_srv_conf_t));
+    if (conf == NULL) {
+        return NULL;
+    }
+
+    /*
+     * set by ngx_pcalloc():
+     *
+     *     conf->commands = { NULL };
+     */
+
+    return conf;
+}
+
+
+static char *
+ngx_stream_set(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+    ngx_stream_set_srv_conf_t  *scf = conf;
+
+    ngx_str_t                           *args;
+    ngx_int_t                            index;
+    ngx_stream_set_cmd_t                *set_cmd;
+    ngx_stream_variable_t               *v;
+    ngx_stream_compile_complex_value_t   ccv;
+
+    args = cf->args->elts;
+
+    if (args[1].data[0] != '$') {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                           "invalid variable name \"%V\"", &args[1]);
+        return NGX_CONF_ERROR;
+    }
+
+    args[1].len--;
+    args[1].data++;
+
+    v = ngx_stream_add_variable(cf, &args[1],
+                                NGX_STREAM_VAR_CHANGEABLE|NGX_STREAM_VAR_WEAK);
+    if (v == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    index = ngx_stream_get_variable_index(cf, &args[1]);
+    if (index == NGX_ERROR) {
+        return NGX_CONF_ERROR;
+    }
+
+    if (v->get_handler == NULL) {
+        v->get_handler = ngx_stream_set_var;
+    }
+
+    if (scf->commands.elts == NULL) {
+        if (ngx_array_init(&scf->commands, cf->pool, 1,
+                           sizeof(ngx_stream_set_cmd_t))
+            != NGX_OK)
+        {
+            return NGX_CONF_ERROR;
+        }
+    }
+
+    set_cmd = ngx_array_push(&scf->commands);
+    if (set_cmd == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    set_cmd->index = index;
+    set_cmd->set_handler = v->set_handler;
+    set_cmd->data = v->data;
+
+    ngx_memzero(&ccv, sizeof(ngx_stream_compile_complex_value_t));
+
+    ccv.cf = cf;
+    ccv.value = &args[2];
+    ccv.complex_value = &set_cmd->value;
+
+    if (ngx_stream_compile_complex_value(&ccv) != NGX_OK) {
+        return NGX_CONF_ERROR;
+    }
+
+    return NGX_CONF_OK;
+}
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
index ec9524e0..d8c0471e 100644
--- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c
@@ -45,6 +45,10 @@ static char *ngx_stream_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
 static char *ngx_stream_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
     void *conf);
+
+static char *ngx_stream_ssl_conf_command_check(ngx_conf_t *cf, void *post,
+    void *data);
+
 static ngx_int_t ngx_stream_ssl_init(ngx_conf_t *cf);
 
 
@@ -68,6 +72,10 @@ static ngx_conf_enum_t  ngx_stream_ssl_verify[] = {
 };
 
 
+static ngx_conf_post_t  ngx_stream_ssl_conf_command_post =
+    { ngx_stream_ssl_conf_command_check };
+
+
 static ngx_command_t  ngx_stream_ssl_commands[] = {
 
     { ngx_string("ssl_handshake_timeout"),
@@ -196,6 +204,13 @@ static ngx_command_t  ngx_stream_ssl_commands[] = {
       offsetof(ngx_stream_ssl_conf_t, crl),
       NULL },
 
+    { ngx_string("ssl_conf_command"),
+      NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE2,
+      ngx_conf_set_keyval_slot,
+      NGX_STREAM_SRV_CONF_OFFSET,
+      offsetof(ngx_stream_ssl_conf_t, conf_commands),
+      &ngx_stream_ssl_conf_command_post },
+
       ngx_null_command
 };
 
@@ -595,6 +610,7 @@ ngx_stream_ssl_create_conf(ngx_conf_t *cf)
     scf->certificates = NGX_CONF_UNSET_PTR;
     scf->certificate_keys = NGX_CONF_UNSET_PTR;
     scf->passwords = NGX_CONF_UNSET_PTR;
+    scf->conf_commands = NGX_CONF_UNSET_PTR;
     scf->prefer_server_ciphers = NGX_CONF_UNSET;
     scf->verify = NGX_CONF_UNSET_UINT;
     scf->verify_depth = NGX_CONF_UNSET_UINT;
@@ -650,6 +666,8 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
 
     ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);
 
+    ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
+
 
     conf->ssl.log = cf->log;
 
@@ -745,7 +763,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
 
         if (conf->client_certificate.len == 0 && conf->verify != 3) {
             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
-                          "no ssl_client_certificate for ssl_client_verify");
+                          "no ssl_client_certificate for ssl_verify_client");
             return NGX_CONF_ERROR;
         }
 
@@ -811,6 +829,10 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
         return NGX_CONF_ERROR;
     }
 
+    if (ngx_ssl_conf_commands(cf, &conf->ssl, conf->conf_commands) != NGX_OK) {
+        return NGX_CONF_ERROR;
+    }
+
     return NGX_CONF_OK;
 }
 
@@ -1034,6 +1056,17 @@ ngx_stream_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 }
 
 
+static char *
+ngx_stream_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
+{
+#ifndef SSL_CONF_FLAG_FILE
+    return "is not supported on this platform";
+#else
+    return NGX_CONF_OK;
+#endif
+}
+
+
 static ngx_int_t
 ngx_stream_ssl_init(ngx_conf_t *cf)
 {
diff --git a/src/stream/ngx_stream_ssl_module.h b/src/stream/ngx_stream_ssl_module.h
index 6cb4140a..c6e24bef 100644
--- a/src/stream/ngx_stream_ssl_module.h
+++ b/src/stream/ngx_stream_ssl_module.h
@@ -46,6 +46,7 @@ typedef struct {
     ngx_str_t        ciphers;
 
     ngx_array_t     *passwords;
+    ngx_array_t     *conf_commands;
 
     ngx_shm_zone_t  *shm_zone;
 
diff --git a/src/stream/ngx_stream_upstream.h b/src/stream/ngx_stream_upstream.h
index 0fe416b2..9857e0b7 100644
--- a/src/stream/ngx_stream_upstream.h
+++ b/src/stream/ngx_stream_upstream.h
@@ -132,6 +132,9 @@ typedef struct {
     ngx_uint_t                         responses;
     ngx_msec_t                         start_time;
 
+    size_t                             upload_rate;
+    size_t                             download_rate;
+
     ngx_str_t                          ssl_name;
 
     ngx_stream_upstream_srv_conf_t    *upstream;
diff --git a/src/stream/ngx_stream_upstream_hash_module.c b/src/stream/ngx_stream_upstream_hash_module.c
index 4fa9a2dc..b764fcbe 100644
--- a/src/stream/ngx_stream_upstream_hash_module.c
+++ b/src/stream/ngx_stream_upstream_hash_module.c
@@ -178,7 +178,7 @@ ngx_stream_upstream_get_hash_peer(ngx_peer_connection_t *pc, void *data)
 
     ngx_stream_upstream_rr_peers_rlock(hp->rrp.peers);
 
-    if (hp->tries > 20 || hp->rrp.peers->single) {
+    if (hp->tries > 20 || hp->rrp.peers->single || hp->key.len == 0) {
         ngx_stream_upstream_rr_peers_unlock(hp->rrp.peers);
         return hp->get_rr_peer(pc, &hp->rrp);
     }
@@ -511,7 +511,7 @@ ngx_stream_upstream_get_chash_peer(ngx_peer_connection_t *pc, void *data)
 
     ngx_stream_upstream_rr_peers_wlock(hp->rrp.peers);
 
-    if (hp->tries > 20 || hp->rrp.peers->single) {
+    if (hp->tries > 20 || hp->rrp.peers->single || hp->key.len == 0) {
         ngx_stream_upstream_rr_peers_unlock(hp->rrp.peers);
         return hp->get_rr_peer(pc, &hp->rrp);
     }
diff --git a/src/stream/ngx_stream_upstream_round_robin.c b/src/stream/ngx_stream_upstream_round_robin.c
index 36e2ec5c..ae3bf37a 100644
--- a/src/stream/ngx_stream_upstream_round_robin.c
+++ b/src/stream/ngx_stream_upstream_round_robin.c
@@ -10,8 +10,8 @@
 #include <ngx_stream.h>
 
 
-#define ngx_stream_upstream_tries(p) ((p)->number                             \
-                                      + ((p)->next ? (p)->next->number : 0))
+#define ngx_stream_upstream_tries(p) ((p)->tries                              \
+                                      + ((p)->next ? (p)->next->tries : 0))
 
 
 static ngx_stream_upstream_rr_peer_t *ngx_stream_upstream_get_peer(
@@ -38,7 +38,7 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
     ngx_stream_upstream_srv_conf_t *us)
 {
     ngx_url_t                        u;
-    ngx_uint_t                       i, j, n, w;
+    ngx_uint_t                       i, j, n, w, t;
     ngx_stream_upstream_server_t    *server;
     ngx_stream_upstream_rr_peer_t   *peer, **peerp;
     ngx_stream_upstream_rr_peers_t  *peers, *backup;
@@ -50,6 +50,7 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
 
         n = 0;
         w = 0;
+        t = 0;
 
         for (i = 0; i < us->servers->nelts; i++) {
             if (server[i].backup) {
@@ -58,6 +59,10 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
 
             n += server[i].naddrs;
             w += server[i].naddrs * server[i].weight;
+
+            if (!server[i].down) {
+                t += server[i].naddrs;
+            }
         }
 
         if (n == 0) {
@@ -81,6 +86,7 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
         peers->number = n;
         peers->weighted = (w != n);
         peers->total_weight = w;
+        peers->tries = t;
         peers->name = &us->host;
 
         n = 0;
@@ -116,6 +122,7 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
 
         n = 0;
         w = 0;
+        t = 0;
 
         for (i = 0; i < us->servers->nelts; i++) {
             if (!server[i].backup) {
@@ -124,6 +131,10 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
 
             n += server[i].naddrs;
             w += server[i].naddrs * server[i].weight;
+
+            if (!server[i].down) {
+                t += server[i].naddrs;
+            }
         }
 
         if (n == 0) {
@@ -145,6 +156,7 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
         backup->number = n;
         backup->weighted = (w != n);
         backup->total_weight = w;
+        backup->tries = t;
         backup->name = &us->host;
 
         n = 0;
@@ -220,6 +232,7 @@ ngx_stream_upstream_init_round_robin(ngx_conf_t *cf,
     peers->number = n;
     peers->weighted = 0;
     peers->total_weight = n;
+    peers->tries = n;
     peers->name = &us->host;
 
     peerp = &peers->peer;
@@ -342,6 +355,7 @@ ngx_stream_upstream_create_round_robin_peer(ngx_stream_session_t *s,
 
     peers->single = (ur->naddrs == 1);
     peers->number = ur->naddrs;
+    peers->tries = ur->naddrs;
     peers->name = &ur->host;
 
     if (ur->sockaddr) {
@@ -701,10 +715,7 @@ ngx_stream_upstream_set_round_robin_peer_session(ngx_peer_connection_t *pc,
     ngx_stream_upstream_rr_peer_t   *peer;
 #if (NGX_STREAM_UPSTREAM_ZONE)
     int                              len;
-#if OPENSSL_VERSION_NUMBER >= 0x0090707fL
-    const
-#endif
-    u_char                          *p;
+    const u_char                    *p;
     ngx_stream_upstream_rr_peers_t  *peers;
     u_char                           buf[NGX_SSL_MAX_SESSION_SIZE];
 #endif
diff --git a/src/stream/ngx_stream_upstream_round_robin.h b/src/stream/ngx_stream_upstream_round_robin.h
index 35d9fce6..bd96667b 100644
--- a/src/stream/ngx_stream_upstream_round_robin.h
+++ b/src/stream/ngx_stream_upstream_round_robin.h
@@ -66,6 +66,7 @@ struct ngx_stream_upstream_rr_peers_s {
 #endif
 
     ngx_uint_t                       total_weight;
+    ngx_uint_t                       tries;
 
     unsigned                         single:1;
     unsigned                         weighted:1;
diff --git a/src/stream/ngx_stream_variables.c b/src/stream/ngx_stream_variables.c
index d1526a96..8b596683 100644
--- a/src/stream/ngx_stream_variables.c
+++ b/src/stream/ngx_stream_variables.c
@@ -64,10 +64,20 @@ static ngx_stream_variable_t  ngx_stream_core_variables[] = {
       ngx_stream_variable_remote_port, 0, 0, 0 },
 
     { ngx_string("proxy_protocol_addr"), NULL,
-      ngx_stream_variable_proxy_protocol_addr, 0, 0, 0 },
+      ngx_stream_variable_proxy_protocol_addr,
+      offsetof(ngx_proxy_protocol_t, src_addr), 0, 0 },
 
     { ngx_string("proxy_protocol_port"), NULL,
-      ngx_stream_variable_proxy_protocol_port, 0, 0, 0 },
+      ngx_stream_variable_proxy_protocol_port,
+      offsetof(ngx_proxy_protocol_t, src_port), 0, 0 },
+
+    { ngx_string("proxy_protocol_server_addr"), NULL,
+      ngx_stream_variable_proxy_protocol_addr,
+      offsetof(ngx_proxy_protocol_t, dst_addr), 0, 0 },
+
+    { ngx_string("proxy_protocol_server_port"), NULL,
+      ngx_stream_variable_proxy_protocol_port,
+      offsetof(ngx_proxy_protocol_t, dst_port), 0, 0 },
 
     { ngx_string("server_addr"), NULL,
       ngx_stream_variable_server_addr, 0, 0, 0 },
@@ -557,11 +567,22 @@ static ngx_int_t
 ngx_stream_variable_proxy_protocol_addr(ngx_stream_session_t *s,
     ngx_stream_variable_value_t *v, uintptr_t data)
 {
-    v->len = s->connection->proxy_protocol_addr.len;
+    ngx_str_t             *addr;
+    ngx_proxy_protocol_t  *pp;
+
+    pp = s->connection->proxy_protocol;
+    if (pp == NULL) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    addr = (ngx_str_t *) ((char *) pp + data);
+
+    v->len = addr->len;
     v->valid = 1;
     v->no_cacheable = 0;
     v->not_found = 0;
-    v->data = s->connection->proxy_protocol_addr.data;
+    v->data = addr->data;
 
     return NGX_OK;
 }
@@ -571,7 +592,14 @@ static ngx_int_t
 ngx_stream_variable_proxy_protocol_port(ngx_stream_session_t *s,
     ngx_stream_variable_value_t *v, uintptr_t data)
 {
-    ngx_uint_t  port;
+    ngx_uint_t             port;
+    ngx_proxy_protocol_t  *pp;
+
+    pp = s->connection->proxy_protocol;
+    if (pp == NULL) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
 
     v->len = 0;
     v->valid = 1;
@@ -583,7 +611,7 @@ ngx_stream_variable_proxy_protocol_port(ngx_stream_session_t *s,
         return NGX_ERROR;
     }
 
-    port = s->connection->proxy_protocol_port;
+    port = *(in_port_t *) ((char *) pp + data);
 
     if (port > 0 && port < 65536) {
         v->len = ngx_sprintf(v->data, "%ui", port) - v->data;
diff --git a/src/stream/ngx_stream_write_filter_module.c b/src/stream/ngx_stream_write_filter_module.c
index 24326c60..156a61c3 100644
--- a/src/stream/ngx_stream_write_filter_module.c
+++ b/src/stream/ngx_stream_write_filter_module.c
@@ -234,7 +234,8 @@ ngx_stream_write_filter(ngx_stream_session_t *s, ngx_chain_t *in,
 
     if (size == 0
         && !(c->buffered & NGX_LOWLEVEL_BUFFERED)
-        && !(last && c->need_last_buf))
+        && !(last && c->need_last_buf)
+        && !(c->type == SOCK_DGRAM && flush))
     {
         if (last || flush || sync) {
             for (cl = *out; cl; /* void */) {