coverity-181580: supposedly dead code
[platform/upstream/libwebsockets.git] / lib / server.c
index 82add22..108321d 100644 (file)
@@ -42,6 +42,7 @@ lws_context_init_server(struct lws_context_creation_info *info,
        struct lws *wsi;
        int m = 0;
 
+       (void)opt;
        /* set up our external listening socket we serve on */
 
        if (info->port == CONTEXT_PORT_NO_LISTEN || info->port == CONTEXT_PORT_NO_LISTEN_SERVER)
@@ -64,6 +65,7 @@ lws_context_init_server(struct lws_context_creation_info *info,
        }
 
 #if LWS_POSIX
+       (void)n;
 #if defined(__linux__)
        limit = vhost->context->count_threads;
 #endif
@@ -86,22 +88,36 @@ lws_context_init_server(struct lws_context_creation_info *info,
 #if defined(LWS_WITH_ESP8266)
        sockfd = esp8266_create_tcp_listen_socket(vhost);
        if (!lws_sockfd_valid(sockfd)) {
-
-#else
-       sockfd = mbed3_create_tcp_stream_socket();
-       if (!lws_sockfd_valid(sockfd)) {
 #endif
 #endif
                lwsl_err("ERROR opening socket\n");
                return 1;
        }
+#if LWS_POSIX && !defined(LWS_WITH_ESP32)
+
+#if (defined(WIN32) || defined(_WIN32)) && defined(SO_EXCLUSIVEADDRUSE)
+       /*
+        * only accept that we are the only listener on the port
+        * https://msdn.microsoft.com/zh-tw/library/windows/desktop/ms740621(v=vs.85).aspx
+        *
+        * for lws, to match Linux, we default to exclusive listen
+        */
+       if (!lws_check_opt(vhost->options, LWS_SERVER_OPTION_ALLOW_LISTEN_SHARE)) {
+               if (setsockopt(sockfd, SOL_SOCKET, SO_EXCLUSIVEADDRUSE,
+                              (const void *)&opt, sizeof(opt)) < 0) {
+                       lwsl_err("reuseaddr failed\n");
+                       compatible_close(sockfd);
+                       return 1;
+               }
+       } else
+#endif
 
-#if LWS_POSIX
        /*
         * allow us to restart even if old sockets in TIME_WAIT
         */
        if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR,
                       (const void *)&opt, sizeof(opt)) < 0) {
+               lwsl_err("reuseaddr failed\n");
                compatible_close(sockfd);
                return 1;
        }
@@ -119,13 +135,19 @@ lws_context_init_server(struct lws_context_creation_info *info,
        }
 #endif
 
-#if defined(__linux__) && defined(SO_REUSEPORT) && LWS_MAX_SMP > 1
-       if (vhost->context->count_threads > 1)
-               if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEPORT,
-                               (const void *)&opt, sizeof(opt)) < 0) {
-                       compatible_close(sockfd);
-                       return 1;
-               }
+#if defined(__linux__) && defined(SO_REUSEPORT)
+       n = lws_check_opt(vhost->options, LWS_SERVER_OPTION_ALLOW_LISTEN_SHARE);
+#if LWS_MAX_SMP > 1
+       n = 1;
+#endif
+
+       if (n)
+               if (vhost->context->count_threads > 1)
+                       if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEPORT,
+                                       (const void *)&opt, sizeof(opt)) < 0) {
+                               compatible_close(sockfd);
+                               return 1;
+                       }
 #endif
 #endif
        lws_plat_set_socket_options(vhost, sockfd);
@@ -145,7 +167,7 @@ lws_context_init_server(struct lws_context_creation_info *info,
                goto bail;
        }
        wsi->context = vhost->context;
-       wsi->sock = sockfd;
+       wsi->desc.sockfd = sockfd;
        wsi->mode = LWSCM_SERVER_LISTENER;
        wsi->protocol = vhost->protocols;
        wsi->tsi = m;
@@ -164,7 +186,7 @@ lws_context_init_server(struct lws_context_creation_info *info,
        vhost->lserv_wsi = wsi;
 
 #if LWS_POSIX
-       n = listen(wsi->sock, LWS_SOMAXCONN);
+       n = listen(wsi->desc.sockfd, LWS_SOMAXCONN);
        if (n < 0) {
                lwsl_err("listen failed with error %d\n", LWS_ERRNO);
                vhost->lserv_wsi = NULL;
@@ -175,9 +197,7 @@ lws_context_init_server(struct lws_context_creation_info *info,
        } /* for each thread able to independently listen */
 #else
 #if defined(LWS_WITH_ESP8266)
-       esp8266_tcp_stream_bind(wsi->sock, info->port, wsi);
-#else
-       mbed3_tcp_stream_bind(wsi->sock, info->port, wsi);
+       esp8266_tcp_stream_bind(wsi->desc.sockfd, info->port, wsi);
 #endif
 #endif
        if (!lws_check_opt(info->options, LWS_SERVER_OPTION_EXPLICIT_VHOSTS)) {
@@ -215,7 +235,7 @@ lws_select_vhost(struct lws_context *context, int port, const char *servername)
        if (p)
                colon = p - servername;
 
-       /* first try exact matches */
+       /* Priotity 1: first try exact matches */
 
        while (vhost) {
                if (port == vhost->listen_port &&
@@ -227,7 +247,7 @@ lws_select_vhost(struct lws_context *context, int port, const char *servername)
        }
 
        /*
-        * if no exact matches, try matching *.vhost-name
+        * Priority 2: if no exact matches, try matching *.vhost-name
         * unintentional matches are possible but resolve to x.com for *.x.com
         * which is reasonable.  If exact match exists we already chose it and
         * never reach here.  SSL will still fail it if the cert doesn't allow
@@ -248,17 +268,19 @@ lws_select_vhost(struct lws_context *context, int port, const char *servername)
                vhost = vhost->vhost_next;
        }
 
-       return NULL;
-}
+       /* Priority 3: match the first vhost on our port */
 
-LWS_VISIBLE LWS_EXTERN const struct lws_protocols *
-lws_vhost_name_to_protocol(struct lws_vhost *vh, const char *name)
-{
-       int n;
+       vhost = context->vhost_list;
+       while (vhost) {
+               if (port == vhost->listen_port) {
+                       lwsl_info("vhost match to %s based on port %d\n",
+                                       vhost->name, port);
+                       return vhost;
+               }
+               vhost = vhost->vhost_next;
+       }
 
-       for (n = 0; n < vh->count_protocols; n++)
-               if (!strcmp(name, vh->protocols[n].name))
-                       return &vh->protocols[n];
+       /* no match */
 
        return NULL;
 }
@@ -311,6 +333,9 @@ lws_get_mimetype(const char *file, const struct lws_http_mount *m)
        if (!strcmp(&file[n - 4], ".ttf"))
                return "application/x-font-ttf";
 
+       if (!strcmp(&file[n - 4], ".otf"))
+               return "application/font-woff";
+
        if (!strcmp(&file[n - 5], ".woff"))
                return "application/font-woff";
 
@@ -329,6 +354,22 @@ lws_get_mimetype(const char *file, const struct lws_http_mount *m)
 
        return NULL;
 }
+static lws_fop_flags_t
+lws_vfs_prepare_flags(struct lws *wsi)
+{
+       lws_fop_flags_t f = 0;
+
+       if (!lws_hdr_total_length(wsi, WSI_TOKEN_HTTP_ACCEPT_ENCODING))
+               return f;
+
+       if (strstr(lws_hdr_simple_ptr(wsi, WSI_TOKEN_HTTP_ACCEPT_ENCODING),
+                  "gzip")) {
+               lwsl_info("client indicates GZIP is acceptable\n");
+               f |= LWS_FOP_FLAG_COMPR_ACCEPTABLE_GZIP;
+       }
+
+       return f;
+}
 
 static int
 lws_http_serve(struct lws *wsi, char *uri, const char *origin,
@@ -338,13 +379,20 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
        struct lws_process_html_args args;
        const char *mimetype;
 #if !defined(_WIN32_WCE) && !defined(LWS_WITH_ESP8266)
+       const struct lws_plat_file_ops *fops;
+       const char *vpath;
+       lws_fop_flags_t fflags = LWS_O_RDONLY;
+#if defined(WIN32) && defined(LWS_HAVE__STAT32I64)
+       struct _stat32i64 st;
+#else
        struct stat st;
+#endif
        int spin = 0;
 #endif
        char path[256], sym[512];
        unsigned char *p = (unsigned char *)sym + 32 + LWS_PRE, *start = p;
        unsigned char *end = p + sizeof(sym) - 32 - LWS_PRE;
-#if !defined(WIN32) && LWS_POSIX
+#if !defined(WIN32) && LWS_POSIX && !defined(LWS_WITH_ESP32)
        size_t len;
 #endif
        int n;
@@ -352,16 +400,54 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
        lws_snprintf(path, sizeof(path) - 1, "%s/%s", origin, uri);
 
 #if !defined(_WIN32_WCE) && !defined(LWS_WITH_ESP8266)
+
+       fflags |= lws_vfs_prepare_flags(wsi);
+
        do {
                spin++;
+               fops = lws_vfs_select_fops(wsi->context->fops, path, &vpath);
+
+               if (wsi->u.http.fop_fd)
+                       lws_vfs_file_close(&wsi->u.http.fop_fd);
+
+               wsi->u.http.fop_fd = fops->LWS_FOP_OPEN(wsi->context->fops,
+                                                       path, vpath, &fflags);
+               if (!wsi->u.http.fop_fd) {
+                       lwsl_err("Unable to open '%s'\n", path);
 
+                       return -1;
+               }
+
+               /* if it can't be statted, don't try */
+               if (fflags & LWS_FOP_FLAG_VIRTUAL)
+                       break;
+#if defined(LWS_WITH_ESP32)
+               break;
+#endif
+#if !defined(WIN32)
+               if (fstat(wsi->u.http.fop_fd->fd, &st)) {
+                       lwsl_info("unable to stat %s\n", path);
+                       goto bail;
+               }
+#else
+#if defined(LWS_HAVE__STAT32I64)
+               if (_stat32i64(path, &st)) {
+                       lwsl_info("unable to stat %s\n", path);
+                       goto bail;
+               }
+#else
                if (stat(path, &st)) {
                        lwsl_info("unable to stat %s\n", path);
                        goto bail;
                }
+#endif
+#endif
+
+               wsi->u.http.fop_fd->mod_time = (uint32_t)st.st_mtime;
+               fflags |= LWS_FOP_FLAG_MOD_TIME_VALID;
 
                lwsl_debug(" %s mode %d\n", path, S_IFMT & st.st_mode);
-#if !defined(WIN32) && LWS_POSIX
+#if !defined(WIN32) && LWS_POSIX && !defined(LWS_WITH_ESP32)
                if ((S_IFMT & st.st_mode) == S_IFLNK) {
                        len = readlink(path, sym, sizeof(sym) - 1);
                        if (len) {
@@ -384,8 +470,9 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
        if (spin == 5)
                lwsl_err("symlink loop %s \n", path);
 
-       n = sprintf(sym, "%08lX%08lX", (unsigned long)st.st_size,
-                                  (unsigned long)st.st_mtime);
+       n = sprintf(sym, "%08llX%08lX",
+                   (unsigned long long)lws_vfs_get_length(wsi->u.http.fop_fd),
+                   (unsigned long)lws_vfs_get_mod_time(wsi->u.http.fop_fd));
 
        /* disable ranges if IF_RANGE token invalid */
 
@@ -399,13 +486,15 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
                 * he thinks he has some version of it already,
                 * check if the tag matches
                 */
-               if (!strcmp(sym, lws_hdr_simple_ptr(wsi, WSI_TOKEN_HTTP_IF_NONE_MATCH))) {
+               if (!strcmp(sym, lws_hdr_simple_ptr(wsi,
+                                       WSI_TOKEN_HTTP_IF_NONE_MATCH))) {
 
                        lwsl_debug("%s: ETAG match %s %s\n", __func__,
                                   uri, origin);
 
                        /* we don't need to send the payload */
-                       if (lws_add_http_header_status(wsi, 304, &p, end))
+                       if (lws_add_http_header_status(wsi,
+                                       HTTP_STATUS_NOT_MODIFIED, &p, end))
                                return -1;
 
                        if (lws_add_http_header_by_token(wsi,
@@ -424,6 +513,8 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
                                return -1;
                        }
 
+                       lws_vfs_file_close(&wsi->u.http.fop_fd);
+
                        return lws_http_transaction_completed(wsi);
                }
        }
@@ -452,10 +543,10 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
                if (n > (int)strlen(pvo->name) &&
                    !strcmp(&path[n - strlen(pvo->name)], pvo->name)) {
                        wsi->sending_chunked = 1;
-                       wsi->protocol_interpret_idx = (char)(long)pvo->value;
+                       wsi->protocol_interpret_idx = (char)(lws_intptr_t)pvo->value;
                        lwsl_info("want %s interpreted by %s\n", path,
-                                   wsi->vhost->protocols[(int)(long)(pvo->value)].name);
-                       wsi->protocol = &wsi->vhost->protocols[(int)(long)(pvo->value)];
+                                   wsi->vhost->protocols[(int)(lws_intptr_t)(pvo->value)].name);
+                       wsi->protocol = &wsi->vhost->protocols[(int)(lws_intptr_t)(pvo->value)];
                        if (lws_ensure_user_space(wsi))
                                return -1;
                        break;
@@ -596,6 +687,23 @@ lws_unauthorised_basic_auth(struct lws *wsi)
 
 #endif
 
+int lws_clean_url(char *p)
+{
+       while (*p) {
+               if (p[0] == '/' && p[1] == '/') {
+                       char *p1 = p;
+                       while (*p1) {
+                               *p1 = p1[1];
+                               p1++;
+                       }
+                       continue;
+               }
+               p++;
+       }
+
+       return 0;
+}
+
 int
 lws_http_action(struct lws *wsi)
 {
@@ -620,13 +728,14 @@ lws_http_action(struct lws *wsi)
                WSI_TOKEN_PUT_URI,
                WSI_TOKEN_PATCH_URI,
                WSI_TOKEN_DELETE_URI,
+               WSI_TOKEN_CONNECT,
 #ifdef LWS_USE_HTTP2
                WSI_TOKEN_HTTP_COLON_PATH,
 #endif
        };
 #if defined(_DEBUG) || defined(LWS_WITH_ACCESS_LOG)
        static const char * const method_names[] = {
-               "GET", "POST", "OPTIONS", "PUT", "PATCH", "DELETE",
+               "GET", "POST", "OPTIONS", "PUT", "PATCH", "DELETE", "CONNECT",
 #ifdef LWS_USE_HTTP2
                ":path",
 #endif
@@ -668,7 +777,7 @@ lws_http_action(struct lws *wsi)
 
        /* we insist on absolute paths */
 
-       if (uri_ptr[0] != '/') {
+       if (!uri_ptr || uri_ptr[0] != '/') {
                lws_return_http_status(wsi, HTTP_STATUS_FORBIDDEN, NULL);
 
                goto bail_nuke_ah;
@@ -686,7 +795,7 @@ lws_http_action(struct lws *wsi)
                lws_hdr_copy(wsi, content_length_str,
                             sizeof(content_length_str) - 1,
                             WSI_TOKEN_HTTP_CONTENT_LENGTH);
-               wsi->u.http.content_length = atoi(content_length_str);
+               wsi->u.http.content_length = atoll(content_length_str);
        }
 
        if (wsi->http2_substream) {
@@ -804,10 +913,7 @@ lws_http_action(struct lws *wsi)
                        if (!pa)
                                pa = "(unknown)";
 
-                       if (meth >= 0)
-                               me = method_names[meth];
-                       else
-                               me = "unknown";
+                       me = method_names[meth];
 
                        lws_snprintf(wsi->access_log.header_log, l,
                                 "%s - - [%s] \"%s %s %s\"",
@@ -888,9 +994,10 @@ lws_http_action(struct lws *wsi)
                                    hit->origin);
                else
                        n = lws_snprintf((char *)end, 256,
-                           "%s%s%s/", oprot[lws_is_ssl(wsi)],
+                           "%s%s%s/", oprot[!!lws_is_ssl(wsi)],
                            lws_hdr_simple_ptr(wsi, WSI_TOKEN_HOST),
                            uri_ptr);
+               lws_clean_url((char *)end);
 
                n = lws_http_redirect(wsi, HTTP_STATUS_MOVED_PERMANENTLY,
                                      end, n, &p, end);
@@ -946,6 +1053,84 @@ lws_http_action(struct lws *wsi)
        }
 #endif
 
+#if defined(LWS_WITH_HTTP_PROXY)
+       /*
+        * The mount is a reverse proxy?
+        */
+
+       if (hit->origin_protocol == LWSMPRO_HTTPS ||
+           hit->origin_protocol == LWSMPRO_HTTP)  {
+               struct lws_client_connect_info i;
+               char ads[96], rpath[256], *pcolon, *pslash, *p;
+               int n, na;
+
+               memset(&i, 0, sizeof(i));
+               i.context = lws_get_context(wsi);
+
+               pcolon = strchr(hit->origin, ':');
+               pslash = strchr(hit->origin, '/');
+               if (!pslash) {
+                       lwsl_err("Proxy mount origin '%s' must have /\n", hit->origin);
+                       return -1;
+               }
+               if (pcolon > pslash)
+                       pcolon = NULL;
+               
+               if (pcolon)
+                       n = pcolon - hit->origin;
+               else
+                       n = pslash - hit->origin;
+
+               if (n >= sizeof(ads) - 2)
+                       n = sizeof(ads) - 2;
+
+               memcpy(ads, hit->origin, n);
+               ads[n] = '\0';
+
+               i.address = ads;
+               i.port = 80;
+               if (hit->origin_protocol == LWSMPRO_HTTPS) { 
+                       i.port = 443;
+                       i.ssl_connection = 1;
+               }
+               if (pcolon)
+                       i.port = atoi(pcolon + 1);
+               
+               lws_snprintf(rpath, sizeof(rpath) - 1, "/%s/%s", pslash + 1, uri_ptr + hit->mountpoint_len);
+               lws_clean_url(rpath);
+               na = lws_hdr_total_length(wsi, WSI_TOKEN_HTTP_URI_ARGS);
+               if (na) {
+                       p = rpath + strlen(rpath);
+                       *p++ = '?';
+                       lws_hdr_copy(wsi, p, &rpath[sizeof(rpath) - 1] - p, WSI_TOKEN_HTTP_URI_ARGS);
+                       while (--na) {
+                               if (*p == '\0')
+                                       *p = '&';
+                               p++;
+                       }
+               }
+                               
+
+               i.path = rpath;
+               i.host = i.address;
+               i.origin = NULL;
+               i.method = "GET";
+               i.parent_wsi = wsi;
+               i.uri_replace_from = hit->origin;
+               i.uri_replace_to = hit->mountpoint;
+
+               lwsl_notice("proxying to %s port %d url %s, ssl %d, from %s, to %s\n",
+                               i.address, i.port, i.path, i.ssl_connection, i.uri_replace_from, i.uri_replace_to);
+       
+               if (!lws_client_connect_via_info(&i)) {
+                       lwsl_err("proxy connect fail\n");
+                       return 1;
+               }
+
+               return 0;
+       }
+#endif
+
        /*
         * A particular protocol callback is mounted here?
         *
@@ -1005,7 +1190,6 @@ lws_http_action(struct lws *wsi)
                        NULL, /* replace with cgi path */
                        NULL
                };
-               unsigned char *p, *end, buffer[1024];
 
                lwsl_debug("%s: cgi\n", __func__);
                cmd[0] = hit->origin;
@@ -1020,17 +1204,6 @@ lws_http_action(struct lws *wsi)
                        lwsl_err("%s: cgi failed\n", __func__);
                        return -1;
                }
-               p = buffer + LWS_PRE;
-               end = p + sizeof(buffer) - LWS_PRE;
-
-               if (lws_add_http_header_status(wsi, 200, &p, end))
-                       return 1;
-               if (lws_add_http_header_by_token(wsi, WSI_TOKEN_CONNECTION,
-                               (unsigned char *)"close", 5, &p, end))
-                       return 1;
-               n = lws_write(wsi, buffer + LWS_PRE,
-                             p - (buffer + LWS_PRE),
-                             LWS_WRITE_HTTP_HEADERS);
 
                goto deal_body;
        }
@@ -1095,7 +1268,7 @@ deal_body:
 
 bail_nuke_ah:
        /* we're closing, losing some rx is OK */
-       wsi->u.hdr.ah->rxpos = wsi->u.hdr.ah->rxlen;
+       lws_header_table_force_to_detachable_state(wsi);
        // lwsl_notice("%s: drop1\n", __func__);
        lws_header_table_detach(wsi, 1);
 
@@ -1108,43 +1281,69 @@ transaction_result_n:
 #endif
 }
 
-int
-lws_bind_protocol(struct lws *wsi, const struct lws_protocols *p)
+static int
+lws_server_init_wsi_for_ws(struct lws *wsi)
 {
-//     if (wsi->protocol == p)
-//             return 0;
+       int n;
 
-       if (wsi->protocol)
-               wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP_DROP_PROTOCOL,
-                                       wsi->user_space, NULL, 0);
-       if (!wsi->user_space_externally_allocated)
-               lws_free_set_NULL(wsi->user_space);
+       wsi->state = LWSS_ESTABLISHED;
+       lws_restart_ws_ping_pong_timer(wsi);
 
-       wsi->protocol = p;
-       if (!p)
-               return 0;
+       /*
+        * create the frame buffer for this connection according to the
+        * size mentioned in the protocol definition.  If 0 there, use
+        * a big default for compatibility
+        */
 
-       if (lws_ensure_user_space(wsi))
+       n = wsi->protocol->rx_buffer_size;
+       if (!n)
+               n = wsi->context->pt_serv_buf_size;
+       n += LWS_PRE;
+       wsi->u.ws.rx_ubuf = lws_malloc(n + 4 /* 0x0000ffff zlib */);
+       if (!wsi->u.ws.rx_ubuf) {
+               lwsl_err("Out of Mem allocating rx buffer %d\n", n);
                return 1;
+       }
+       wsi->u.ws.rx_ubuf_alloc = n;
+       lwsl_debug("Allocating RX buffer %d\n", n);
 
-       if (wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP_BIND_PROTOCOL,
-                                   wsi->user_space, NULL, 0))
-               return 1;
+#if LWS_POSIX && !defined(LWS_WITH_ESP32)
+       if (!wsi->parent_carries_io)
+               if (setsockopt(wsi->desc.sockfd, SOL_SOCKET, SO_SNDBUF,
+                      (const char *)&n, sizeof n)) {
+                       lwsl_warn("Failed to set SNDBUF to %d", n);
+                       return 1;
+               }
+#endif
+
+       /* notify user code that we're ready to roll */
+
+       if (wsi->protocol->callback)
+               if (wsi->protocol->callback(wsi, LWS_CALLBACK_ESTABLISHED,
+                                           wsi->user_space,
+#ifdef LWS_OPENSSL_SUPPORT
+                                           wsi->ssl,
+#else
+                                           NULL,
+#endif
+                                           0))
+                       return 1;
 
        return 0;
 }
 
-
 int
 lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
 {
+       int protocol_len, n = 0, hit, non_space_char_found = 0, m;
        struct lws_context *context = lws_get_context(wsi);
        struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
        struct _lws_header_related hdr;
        struct allocated_headers *ah;
-       int protocol_len, n = 0, hit, non_space_char_found = 0;
+       unsigned char *obuf = *buf;
        char protocol_list[128];
        char protocol_name[64];
+       size_t olen = len;
        char *p;
 
        if (len >= 10000000) {
@@ -1166,7 +1365,38 @@ lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
                        goto bail_nuke_ah;
                }
 
-               if (lws_parse(wsi, *(*buf)++)) {
+               m = lws_parse(wsi, *(*buf)++);
+               if (m) {
+                       if (m == 2) {
+                               /*
+                                * we are transitioning from http with
+                                * an AH, to raw.  Drop the ah and set
+                                * the mode.
+                                */
+raw_transition:
+                               lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+                               lws_bind_protocol(wsi, &wsi->vhost->protocols[
+                                                       wsi->vhost->
+                                                       raw_protocol_index]);
+                               lwsl_info("transition to raw vh %s prot %d\n",
+                                         wsi->vhost->name,
+                                         wsi->vhost->raw_protocol_index);
+                               if ((wsi->protocol->callback)(wsi,
+                                               LWS_CALLBACK_RAW_ADOPT,
+                                               wsi->user_space, NULL, 0))
+                                       goto bail_nuke_ah;
+
+                               lws_header_table_force_to_detachable_state(wsi);
+                               lws_union_transition(wsi, LWSCM_RAW);
+                               lws_header_table_detach(wsi, 1);
+
+                               if (m == 2 && (wsi->protocol->callback)(wsi,
+                                               LWS_CALLBACK_RAW_RX,
+                                               wsi->user_space, obuf, olen))
+                                       return 1;
+
+                               return 0;
+                       }
                        lwsl_info("lws_parse failed\n");
                        goto bail_nuke_ah;
                }
@@ -1222,6 +1452,12 @@ lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
                        wsi->conn_stat_done = 1;
                }
 
+               if (lws_hdr_total_length(wsi, WSI_TOKEN_CONNECT)) {
+                       lwsl_info("Changing to RAW mode\n");
+                       m = 0;
+                       goto raw_transition;
+               }
+
                wsi->mode = LWSCM_PRE_WS_SERVING_ACCEPT;
                lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
 
@@ -1254,7 +1490,7 @@ lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
 
                lws_union_transition(wsi, LWSCM_HTTP_SERVING_ACCEPTED);
                wsi->state = LWSS_HTTP;
-               wsi->u.http.fd = LWS_INVALID_FILE;
+               wsi->u.http.fop_fd = NULL;
 
                /* expose it at the same offset as u.hdr */
                wsi->u.http.ah = ah;
@@ -1391,7 +1627,7 @@ upgrade_ws:
                         */
                        lwsl_info("defaulting to prot handler %d\n",
                                wsi->vhost->default_protocol_index);
-                       n = 0;
+                       n = wsi->vhost->default_protocol_index;
                        wsi->protocol = &wsi->vhost->protocols[
                                      (int)wsi->vhost->default_protocol_index];
                }
@@ -1432,30 +1668,7 @@ upgrade_ws:
                        goto bail_nuke_ah;
                }
 
-               /*
-                * stitch protocol choice into the vh protocol linked list
-                * We always insert ourselves at the start of the list
-                *
-                * X <-> B
-                * X <-> pAn <-> pB
-                */
-               //lwsl_err("%s: pre insert vhost start wsi %p, that wsi prev == %p\n",
-               //              __func__,
-               //              wsi->vhost->same_vh_protocol_list[n],
-               //              wsi->same_vh_protocol_prev);
-               wsi->same_vh_protocol_prev = /* guy who points to us */
-                       &wsi->vhost->same_vh_protocol_list[n];
-               wsi->same_vh_protocol_next = /* old first guy is our next */
-                               wsi->vhost->same_vh_protocol_list[n];
-               /* we become the new first guy */
-               wsi->vhost->same_vh_protocol_list[n] = wsi;
-
-               if (wsi->same_vh_protocol_next)
-                       /* old first guy points back to us now */
-                       wsi->same_vh_protocol_next->same_vh_protocol_prev =
-                                       &wsi->same_vh_protocol_next;
-
-
+               lws_same_vh_protocol_insert(wsi, n);
 
                /* we are upgrading to ws, so http/1.1 and keepalive +
                 * pipelined header considerations about keeping the ah around
@@ -1487,52 +1700,13 @@ upgrade_ws:
                wsi->u.hdr = hdr;
                lws_pt_unlock(pt);
 
-               lws_restart_ws_ping_pong_timer(wsi);
-
-               /*
-                * create the frame buffer for this connection according to the
-                * size mentioned in the protocol definition.  If 0 there, use
-                * a big default for compatibility
-                */
-
-               n = wsi->protocol->rx_buffer_size;
-               if (!n)
-                       n = context->pt_serv_buf_size;
-               n += LWS_PRE;
-               wsi->u.ws.rx_ubuf = lws_malloc(n + 4 /* 0x0000ffff zlib */);
-               if (!wsi->u.ws.rx_ubuf) {
-                       lwsl_err("Out of Mem allocating rx buffer %d\n", n);
-                       return 1;
-               }
-               wsi->u.ws.rx_ubuf_alloc = n;
-               lwsl_debug("Allocating RX buffer %d\n", n);
-#if LWS_POSIX
-               if (setsockopt(wsi->sock, SOL_SOCKET, SO_SNDBUF,
-                              (const char *)&n, sizeof n)) {
-                       lwsl_warn("Failed to set SNDBUF to %d", n);
-                       return 1;
-               }
-#endif
-
+               lws_server_init_wsi_for_ws(wsi);
                lwsl_parser("accepted v%02d connection\n",
                            wsi->ietf_spec_revision);
 
-               /* notify user code that we're ready to roll */
-
-               if (wsi->protocol->callback)
-                       if (wsi->protocol->callback(wsi, LWS_CALLBACK_ESTABLISHED,
-                                                   wsi->user_space,
-#ifdef LWS_OPENSSL_SUPPORT
-                                                   wsi->ssl,
-#else
-                                                   NULL,
-#endif
-                                                   0))
-                               return 1;
-
                /* !!! drop ah unreservedly after ESTABLISHED */
                if (!wsi->more_rx_waiting) {
-                       wsi->u.hdr.ah->rxpos = wsi->u.hdr.ah->rxlen;
+                       lws_header_table_force_to_detachable_state(wsi);
 
                        //lwsl_notice("%p: dropping ah EST\n", wsi);
                        lws_header_table_detach(wsi, 1);
@@ -1546,7 +1720,7 @@ upgrade_ws:
 bail_nuke_ah:
        /* drop the header info */
        /* we're closing, losing some rx is OK */
-       wsi->u.hdr.ah->rxpos = wsi->u.hdr.ah->rxlen;
+       lws_header_table_force_to_detachable_state(wsi);
        //lwsl_notice("%s: drop2\n", __func__);
        lws_header_table_detach(wsi, 1);
 
@@ -1589,7 +1763,7 @@ lws_create_new_server_wsi(struct lws_vhost *vhost)
        }
 
        new_wsi->tsi = n;
-       lwsl_notice("Accepted wsi %p to context %p, tsi %d\n", new_wsi,
+       lwsl_debug("Accepted wsi %p to context %p, tsi %d\n", new_wsi,
                    vhost->context, new_wsi->tsi);
 
        new_wsi->vhost = vhost;
@@ -1616,7 +1790,9 @@ lws_create_new_server_wsi(struct lws_vhost *vhost)
        new_wsi->protocol = vhost->protocols;
        new_wsi->user_space = NULL;
        new_wsi->ietf_spec_revision = 0;
-       new_wsi->sock = LWS_SOCK_INVALID;
+       new_wsi->desc.sockfd = LWS_SOCK_INVALID;
+       new_wsi->position_in_fds_table = -1;
+
        vhost->context->count_wsi_allocated++;
 
        /*
@@ -1636,7 +1812,12 @@ lws_http_transaction_completed(struct lws *wsi)
 
        lws_access_log(wsi);
 
-       lwsl_info("%s: wsi %p\n", __func__, wsi);
+       if (!wsi->hdr_parsing_completed) {
+               lwsl_notice("%s: ignoring, ah parsing incomplete\n", __func__);
+               return 0;
+       }
+
+       lwsl_debug("%s: wsi %p\n", __func__, wsi);
        /* if we can't go back to accept new headers, drop the connection */
        if (wsi->u.http.connection_type != HTTP_CONNECTION_KEEP_ALIVE) {
                lwsl_info("%s: %p: close connection\n", __func__, wsi);
@@ -1677,8 +1858,23 @@ lws_http_transaction_completed(struct lws *wsi)
                                wsi->more_rx_waiting);
 
                if (!wsi->more_rx_waiting) {
-                       wsi->u.hdr.ah->rxpos = wsi->u.hdr.ah->rxlen;
+                       lws_header_table_force_to_detachable_state(wsi);
                        lws_header_table_detach(wsi, 1);
+#ifdef LWS_OPENSSL_SUPPORT
+                       /*
+                        * additionally... if we are hogging an SSL instance
+                        * with no pending pipelined headers (or ah now), and
+                        * SSL is scarce, drop this connection without waiting
+                        */
+
+                       if (wsi->vhost->use_ssl &&
+                           wsi->context->simultaneous_ssl_restriction &&
+                           wsi->context->simultaneous_ssl ==
+                                  wsi->context->simultaneous_ssl_restriction) {
+                               lwsl_info("%s: simultaneous_ssl_restriction and nothing pipelined\n", __func__);
+                               return 1;
+                       }
+#endif
                } else
                        lws_header_table_reset(wsi, 1);
        }
@@ -1691,74 +1887,183 @@ lws_http_transaction_completed(struct lws *wsi)
        return 0;
 }
 
+/* if not a socket, it's a raw, non-ssl file descriptor */
+
 LWS_VISIBLE struct lws *
-lws_adopt_socket_vhost(struct lws_vhost *vh, lws_sockfd_type accept_fd)
+lws_adopt_descriptor_vhost(struct lws_vhost *vh, lws_adoption_type type,
+                          lws_sock_file_fd_type fd, const char *vh_prot_name,
+                          struct lws *parent)
 {
        struct lws_context *context = vh->context;
        struct lws *new_wsi = lws_create_new_server_wsi(vh);
+       struct lws_context_per_thread *pt;
+       int n, ssl = 0;
 
        if (!new_wsi) {
-               compatible_close(accept_fd);
+               if (type & LWS_ADOPT_SOCKET && !(type & LWS_ADOPT_WS_PARENTIO))
+                       compatible_close(fd.sockfd);
                return NULL;
        }
+       pt = &context->pt[(int)new_wsi->tsi];
+       lws_stats_atomic_bump(context, pt, LWSSTATS_C_CONNECTIONS, 1);
 
-       //lwsl_notice("%s: new wsi %p, sockfd %d, cb %p\n", __func__, new_wsi, accept_fd, context->vhost_list->protocols[0].callback);
+       if (parent) {
+               new_wsi->parent = parent;
+               new_wsi->sibling_list = parent->child_list;
+               parent->child_list = new_wsi;
+
+               if (type & LWS_ADOPT_WS_PARENTIO)
+                       new_wsi->parent_carries_io = 1;
+       }
 
-       new_wsi->sock = accept_fd;
+       new_wsi->desc = fd;
 
-       /* the transport is accepted... give him time to negotiate */
-       lws_set_timeout(new_wsi, PENDING_TIMEOUT_ESTABLISH_WITH_SERVER,
-                       context->timeout_secs);
+       if (vh_prot_name) {
+               new_wsi->protocol = lws_vhost_name_to_protocol(new_wsi->vhost,
+                                                              vh_prot_name);
+               if (!new_wsi->protocol) {
+                       lwsl_err("Protocol %s not enabled on vhost %s\n",
+                                vh_prot_name, new_wsi->vhost->name);
+                       goto bail;
+               }
+               if (lws_ensure_user_space(new_wsi)) {
+                       lwsl_notice("OOM trying to get user_space\n");
+                       goto bail;
+               }
+               if (type & LWS_ADOPT_WS_PARENTIO) {
+                       new_wsi->desc.sockfd = LWS_SOCK_INVALID;
+                       lwsl_debug("binding to %s\n", new_wsi->protocol->name);
+                       lws_bind_protocol(new_wsi, new_wsi->protocol);
+                       lws_union_transition(new_wsi, LWSCM_WS_SERVING);
+                       lws_server_init_wsi_for_ws(new_wsi);
+
+                       return new_wsi;
+               }
+       } else
+               if (type & LWS_ADOPT_HTTP) /* he will transition later */
+                       new_wsi->protocol =
+                               &vh->protocols[vh->default_protocol_index];
+               else { /* this is the only time he will transition */
+                       lws_bind_protocol(new_wsi,
+                               &vh->protocols[vh->raw_protocol_index]);
+                       lws_union_transition(new_wsi, LWSCM_RAW);
+               }
+
+       if (type & LWS_ADOPT_SOCKET) { /* socket desc */
+               lwsl_debug("%s: new wsi %p, sockfd %d\n", __func__, new_wsi,
+                          (int)(lws_intptr_t)fd.sockfd);
+
+               if (type & LWS_ADOPT_HTTP)
+                       /* the transport is accepted...
+                        * give him time to negotiate */
+                       lws_set_timeout(new_wsi,
+                                       PENDING_TIMEOUT_ESTABLISH_WITH_SERVER,
+                                       context->timeout_secs);
 
 #if LWS_POSIX == 0
 #if defined(LWS_WITH_ESP8266)
-       esp8266_tcp_stream_accept(accept_fd, new_wsi);
-#else
-       mbed3_tcp_stream_accept(accept_fd, new_wsi);
+               esp8266_tcp_stream_accept(accept_fd, new_wsi);
 #endif
 #endif
+       } else /* file desc */
+               lwsl_debug("%s: new wsi %p, filefd %d\n", __func__, new_wsi,
+                          (int)(lws_intptr_t)fd.filefd);
+
        /*
         * A new connection was accepted. Give the user a chance to
         * set properties of the newly created wsi. There's no protocol
-        * selected yet so we issue this to protocols[0]
+        * selected yet so we issue this to the vhosts's default protocol,
+        * itself by default protocols[0]
         */
-       if ((context->vhost_list->protocols[0].callback)(new_wsi,
-            LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED, NULL, NULL, 0)) {
-               /* force us off the timeout list by hand */
-               lws_set_timeout(new_wsi, NO_PENDING_TIMEOUT, 0);
-               compatible_close(new_wsi->sock);
-               lws_free(new_wsi);
-               return NULL;
+       n = LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED;
+       if (!(type & LWS_ADOPT_HTTP)) {
+               if (!(type & LWS_ADOPT_SOCKET))
+                       n = LWS_CALLBACK_RAW_ADOPT_FILE;
+               else
+                       n = LWS_CALLBACK_RAW_ADOPT;
+       }
+
+       if (!LWS_SSL_ENABLED(new_wsi->vhost) || !(type & LWS_ADOPT_ALLOW_SSL) ||
+           !(type & LWS_ADOPT_SOCKET)) {
+               /* non-SSL */
+               if (!(type & LWS_ADOPT_HTTP)) {
+                       if (!(type & LWS_ADOPT_SOCKET))
+                               new_wsi->mode = LWSCM_RAW_FILEDESC;
+                       else
+                               new_wsi->mode = LWSCM_RAW;
+               }
+       } else {
+               /* SSL */
+               if (!(type & LWS_ADOPT_HTTP))
+                       new_wsi->mode = LWSCM_SSL_INIT_RAW;
+               else
+                       new_wsi->mode = LWSCM_SSL_INIT;
+
+               ssl = 1;
        }
 
-       lws_libev_accept(new_wsi, new_wsi->sock);
-       lws_libuv_accept(new_wsi, new_wsi->sock);
+       lws_libev_accept(new_wsi, new_wsi->desc);
+       lws_libuv_accept(new_wsi, new_wsi->desc);
+       lws_libevent_accept(new_wsi, new_wsi->desc);
 
-       if (!LWS_SSL_ENABLED(new_wsi->vhost)) {
+       if (!ssl) {
                if (insert_wsi_socket_into_fds(context, new_wsi)) {
                        lwsl_err("%s: fail inserting socket\n", __func__);
                        goto fail;
                }
-       } else {
-               new_wsi->mode = LWSCM_SSL_INIT;
-               if (lws_server_socket_service_ssl(new_wsi, accept_fd)) {
+       } else
+               if (lws_server_socket_service_ssl(new_wsi, fd.sockfd)) {
                        lwsl_err("%s: fail ssl negotiation\n", __func__);
                        goto fail;
                }
-       }
 
-       if (!lws_header_table_attach(new_wsi, 0))
-               lwsl_debug("Attached ah immediately\n");
+       /*
+        *  by deferring callback to this point, after insertion to fds,
+        * lws_callback_on_writable() can work from the callback
+        */
+       if ((new_wsi->protocol->callback)(
+                       new_wsi, n, new_wsi->user_space, NULL, 0))
+               goto fail;
+
+       if (type & LWS_ADOPT_HTTP) {
+               if (!lws_header_table_attach(new_wsi, 0)) {
+                       lwsl_debug("Attached ah immediately\n");
+               } else {
+                       lwsl_notice("%s: waiting for ah\n", __func__);
+               }
+       }
 
        return new_wsi;
 
 fail:
-       lws_close_free_wsi(new_wsi, LWS_CLOSE_STATUS_NOSTATUS);
+       if (type & LWS_ADOPT_SOCKET)
+               lws_close_free_wsi(new_wsi, LWS_CLOSE_STATUS_NOSTATUS);
+
+       return NULL;
+
+bail:
+       lwsl_notice("%s: exiting on bail\n", __func__);
+       if (parent)
+               parent->child_list = new_wsi->sibling_list;
+       if (new_wsi->user_space)
+               lws_free(new_wsi->user_space);
+       lws_free(new_wsi);
+       compatible_close(fd.sockfd);
 
        return NULL;
 }
 
 LWS_VISIBLE struct lws *
+lws_adopt_socket_vhost(struct lws_vhost *vh, lws_sockfd_type accept_fd)
+{
+       lws_sock_file_fd_type fd;
+
+       fd.sockfd = accept_fd;
+       return lws_adopt_descriptor_vhost(vh, LWS_ADOPT_SOCKET |
+                       LWS_ADOPT_HTTP | LWS_ADOPT_ALLOW_SSL, fd, NULL, NULL);
+}
+
+LWS_VISIBLE struct lws *
 lws_adopt_socket(struct lws_context *context, lws_sockfd_type accept_fd)
 {
        return lws_adopt_socket_vhost(context->vhost_list, accept_fd);
@@ -1861,8 +2166,10 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
        struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
        lws_sockfd_type accept_fd = LWS_SOCK_INVALID;
        struct allocated_headers *ah;
+       lws_sock_file_fd_type fd;
+       int opts = LWS_ADOPT_SOCKET | LWS_ADOPT_ALLOW_SSL;
 #if LWS_POSIX
-       struct sockaddr_in cli_addr;
+       struct sockaddr_storage cli_addr;
        socklen_t clilen;
 #endif
        int n, len;
@@ -1874,6 +2181,7 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
        case LWSCM_HTTP_SERVING:
        case LWSCM_HTTP_SERVING_ACCEPTED:
        case LWSCM_HTTP2_SERVING:
+       case LWSCM_RAW:
 
                /* handle http headers coming in */
 
@@ -1913,17 +2221,18 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
                        goto try_pollout;
                }
 #endif
+
                /* these states imply we MUST have an ah attached */
 
-               if (wsi->state == LWSS_HTTP ||
+               if (wsi->mode != LWSCM_RAW && (wsi->state == LWSS_HTTP ||
                    wsi->state == LWSS_HTTP_ISSUING_FILE ||
-                   wsi->state == LWSS_HTTP_HEADERS) {
+                   wsi->state == LWSS_HTTP_HEADERS)) {
                        if (!wsi->u.hdr.ah) {
                                
                                //lwsl_err("wsi %p: missing ah\n", wsi);
                                /* no autoservice beacuse we will do it next */
                                if (lws_header_table_attach(wsi, 0)) {
-                                       lwsl_err("wsi %p: failed to acquire ah\n", wsi);
+                                       lwsl_info("wsi %p: failed to acquire ah\n", wsi);
                                        goto try_pollout;
                                }
                        }
@@ -1952,6 +2261,13 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
                                        ah->rxlen = ah->rxpos = 0;
                                        goto try_pollout;
                                }
+
+                               /*
+                                *  make sure ah does not get detached if we
+                                * have live data in the rx
+                                */
+                               if (ah->rxlen)
+                                       wsi->more_rx_waiting = 1;
                        }
 
                        if (!(ah->rxpos != ah->rxlen && ah->rxlen)) {
@@ -1962,7 +2278,8 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
                        }
                        
                        /* just ignore incoming if waiting for close */
-                       if (wsi->state != LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE) {
+                       if (wsi->state != LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE &&
+                           wsi->state != LWSS_HTTP_ISSUING_FILE) {
                                n = lws_read(wsi, ah->rx + ah->rxpos,
                                             ah->rxlen - ah->rxpos);
                                if (n < 0) /* we closed wsi */
@@ -1973,7 +2290,7 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
 
                                        lwsl_debug("%s: wsi %p: ah read rxpos %d, rxlen %d\n", __func__, wsi, wsi->u.hdr.ah->rxpos, wsi->u.hdr.ah->rxlen);
 
-                                       if (wsi->u.hdr.ah->rxpos == wsi->u.hdr.ah->rxlen &&
+                                       if (lws_header_table_is_in_detachable_state(wsi) &&
                                            (wsi->mode != LWSCM_HTTP_SERVING &&
                                             wsi->mode != LWSCM_HTTP_SERVING_ACCEPTED &&
                                             wsi->mode != LWSCM_HTTP2_SERVING))
@@ -1987,7 +2304,7 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
 
                len = lws_ssl_capable_read(wsi, pt->serv_buf,
                                           context->pt_serv_buf_size);
-               lwsl_notice("%s: wsi %p read %d\r\n", __func__, wsi, len);
+               lwsl_debug("%s: wsi %p read %d\r\n", __func__, wsi, len);
                switch (len) {
                case 0:
                        lwsl_info("%s: read 0 len\n", __func__);
@@ -2001,8 +2318,20 @@ lws_server_socket_service(struct lws_context *context, struct lws *wsi,
                        goto try_pollout;
                }
                
+               if (wsi->mode == LWSCM_RAW) {
+                       n = user_callback_handle_rxflow(wsi->protocol->callback,
+                                       wsi, LWS_CALLBACK_RAW_RX,
+                                       wsi->user_space, pt->serv_buf, len);
+                       if (n < 0) {
+                               lwsl_info("LWS_CALLBACK_RAW_RX_fail\n");
+                               goto fail;
+                       }
+                       goto try_pollout;
+               }
+
                /* just ignore incoming if waiting for close */
-               if (wsi->state != LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE) {
+               if (wsi->state != LWSS_FLUSHING_STORED_SEND_BEFORE_CLOSE &&
+                   wsi->state != LWSS_HTTP_ISSUING_FILE) {
                        /*
                         * this may want to send
                         * (via HTTP callback for example)
@@ -2033,10 +2362,43 @@ try_pollout:
                        goto fail;
                }
 
+               if (wsi->mode == LWSCM_RAW) {
+                       lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_C_WRITEABLE_CB, 1);
+#if defined(LWS_WITH_STATS)
+                       {
+                               uint64_t ul = time_in_microseconds() - wsi->active_writable_req_us;
+
+                               lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_MS_WRITABLE_DELAY, ul);
+                               lws_stats_atomic_max(wsi->context, pt, LWSSTATS_MS_WORST_WRITABLE_DELAY, ul);
+                               wsi->active_writable_req_us = 0;
+                       }
+#endif
+                       n = user_callback_handle_rxflow(wsi->protocol->callback,
+                                       wsi, LWS_CALLBACK_RAW_WRITEABLE,
+                                       wsi->user_space, NULL, 0);
+                       if (n < 0) {
+                               lwsl_info("writeable_fail\n");
+                               goto fail;
+                       }
+                       break;
+               }
+
                if (!wsi->hdr_parsing_completed)
                        break;
 
                if (wsi->state != LWSS_HTTP_ISSUING_FILE) {
+
+                       lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_C_WRITEABLE_CB, 1);
+#if defined(LWS_WITH_STATS)
+                       {
+                               uint64_t ul = time_in_microseconds() - wsi->active_writable_req_us;
+
+                               lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_MS_WRITABLE_DELAY, ul);
+                               lws_stats_atomic_max(wsi->context, pt, LWSSTATS_MS_WORST_WRITABLE_DELAY, ul);
+                               wsi->active_writable_req_us = 0;
+                       }
+#endif
+
                        n = user_callback_handle_rxflow(wsi->protocol->callback,
                                        wsi, LWS_CALLBACK_HTTP_WRITEABLE,
                                        wsi->user_space, NULL, 0);
@@ -2047,12 +2409,15 @@ try_pollout:
                        break;
                }
 
-               /* >0 == completion, <0 == error */
+               /* >0 == completion, <0 == error
+                *
+                * We'll get a LWS_CALLBACK_HTTP_FILE_COMPLETION callback when
+                * it's done.  That's the case even if we just completed the
+                * send, so wait for that.
+                */
                n = lws_serve_http_file_fragment(wsi);
-               if (n < 0 || (n > 0 && lws_http_transaction_completed(wsi))) {
-                       lwsl_info("completed\n");
+               if (n < 0)
                        goto fail;
-               }
 
                break;
 
@@ -2065,6 +2430,23 @@ try_pollout:
                        if (!(pollfd->revents & LWS_POLLIN) || !(pollfd->events & LWS_POLLIN))
                                break;
 
+#ifdef LWS_OPENSSL_SUPPORT
+                       /*
+                        * can we really accept it, with regards to SSL limit?
+                        * another vhost may also have had POLLIN on his listener this
+                        * round and used it up already
+                        */
+
+                       if (wsi->vhost->use_ssl &&
+                           context->simultaneous_ssl_restriction &&
+                           context->simultaneous_ssl ==
+                                         context->simultaneous_ssl_restriction)
+                               /* no... ignore it, he won't come again until we are
+                                * below the simultaneous_ssl_restriction limit and
+                                * POLLIN is enabled on him again
+                                */
+                               break;
+#endif
                        /* listen socket got an unencrypted connection... */
 
                        clilen = sizeof(cli_addr);
@@ -2076,7 +2458,7 @@ try_pollout:
                        if (accept_fd < 0) {
                                if (LWS_ERRNO == LWS_EAGAIN ||
                                    LWS_ERRNO == LWS_EWOULDBLOCK) {
-                                       lwsl_err("accept asks to try again\n");
+//                                     lwsl_err("accept asks to try again\n");
                                        break;
                                }
                                lwsl_err("ERROR on accept: %s\n", strerror(LWS_ERRNO));
@@ -2085,8 +2467,17 @@ try_pollout:
 
                        lws_plat_set_socket_options(wsi->vhost, accept_fd);
 
-                       lwsl_debug("accepted new conn  port %u on fd=%d\n",
-                                         ntohs(cli_addr.sin_port), accept_fd);
+#if defined(LWS_USE_IPV6)
+                       lwsl_debug("accepted new conn port %u on fd=%d\n",
+                                         ((cli_addr.ss_family == AF_INET6) ?
+                                         ntohs(((struct sockaddr_in6 *) &cli_addr)->sin6_port) :
+                                         ntohs(((struct sockaddr_in *) &cli_addr)->sin_port)),
+                                         accept_fd);
+#else
+                       lwsl_debug("accepted new conn port %u on fd=%d\n",
+                                         ntohs(((struct sockaddr_in *) &cli_addr)->sin_port),
+                                         accept_fd);
+#endif
 
 #else
                        /* not very beautiful... */
@@ -2099,13 +2490,18 @@ try_pollout:
                         */
                        if ((wsi->vhost->protocols[0].callback)(wsi,
                                        LWS_CALLBACK_FILTER_NETWORK_CONNECTION,
-                                       NULL, (void *)(long)accept_fd, 0)) {
+                                       NULL, (void *)(lws_intptr_t)accept_fd, 0)) {
                                lwsl_debug("Callback denied network connection\n");
                                compatible_close(accept_fd);
                                break;
                        }
 
-                       if (!lws_adopt_socket_vhost(wsi->vhost, accept_fd))
+                       if (!(wsi->vhost->options & LWS_SERVER_OPTION_ONLY_RAW))
+                               opts |= LWS_ADOPT_HTTP;
+
+                       fd.sockfd = accept_fd;
+                       if (!lws_adopt_descriptor_vhost(wsi->vhost, opts, fd,
+                                                       NULL, NULL))
                                /* already closed cleanly as necessary */
                                return 1;
 
@@ -2142,20 +2538,34 @@ lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type,
        unsigned char *response = pt->serv_buf + LWS_PRE;
        unsigned char *p = response;
        unsigned char *end = p + context->pt_serv_buf_size - LWS_PRE;
-       unsigned long computed_total_content_length;
+       lws_filepos_t computed_total_content_length;
        int ret = 0, cclen = 8, n = HTTP_STATUS_OK;
+       lws_fop_flags_t fflags = LWS_O_RDONLY;
 #if defined(LWS_WITH_RANGES)
        int ranges;
 #endif
+       const struct lws_plat_file_ops *fops;
+       const char *vpath;
 
-       wsi->u.http.fd = lws_plat_file_open(wsi, file, &wsi->u.http.filelen,
-                                           O_RDONLY);
-
-       if (wsi->u.http.fd == LWS_INVALID_FILE) {
-               lwsl_err("Unable to open '%s'\n", file);
+       /*
+        * We either call the platform fops .open with first arg platform fops,
+        * or we call fops_zip .open with first arg platform fops, and fops_zip
+        * open will decide whether to switch to fops_zip or stay with fops_def.
+        *
+        * If wsi->u.http.fop_fd is already set, the caller already opened it
+        */
+       if (!wsi->u.http.fop_fd) {
+               fops = lws_vfs_select_fops(wsi->context->fops, file, &vpath);
+               fflags |= lws_vfs_prepare_flags(wsi);
+               wsi->u.http.fop_fd = fops->LWS_FOP_OPEN(wsi->context->fops,
+                                                       file, vpath, &fflags);
+               if (!wsi->u.http.fop_fd) {
+                       lwsl_err("Unable to open '%s'\n", file);
 
-               return -1;
+                       return -1;
+               }
        }
+       wsi->u.http.filelen = lws_vfs_get_length(wsi->u.http.fop_fd);
        computed_total_content_length = wsi->u.http.filelen;
 
 #if defined(LWS_WITH_RANGES)
@@ -2175,6 +2585,8 @@ lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type,
                if (lws_http_transaction_completed(wsi))
                        return -1; /* <0 means just hang up */
 
+               lws_vfs_file_close(&wsi->u.http.fop_fd);
+
                return 0; /* == 0 means we dealt with the transaction complete */
        }
        if (ranges)
@@ -2184,6 +2596,16 @@ lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type,
        if (lws_add_http_header_status(wsi, n, &p, end))
                return -1;
 
+       if ((wsi->u.http.fop_fd->flags & (LWS_FOP_FLAG_COMPR_ACCEPTABLE_GZIP |
+                      LWS_FOP_FLAG_COMPR_IS_GZIP)) ==
+           (LWS_FOP_FLAG_COMPR_ACCEPTABLE_GZIP | LWS_FOP_FLAG_COMPR_IS_GZIP)) {
+               if (lws_add_http_header_by_token(wsi,
+                       WSI_TOKEN_HTTP_CONTENT_ENCODING,
+                       (unsigned char *)"gzip", 4, &p, end))
+                       return -1;
+               lwsl_info("file is being provided in gzip\n");
+       }
+
 #if defined(LWS_WITH_RANGES)
        if (ranges < 2 && content_type && content_type[0])
                if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_CONTENT_TYPE,
@@ -2213,7 +2635,7 @@ lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type,
                 *  Precompute it for the main response header
                 */
 
-               computed_total_content_length = (unsigned long)rp->agg +
+               computed_total_content_length = (lws_filepos_t)rp->agg +
                                                6 /* final _lws\r\n */;
 
                lws_ranges_reset(rp);
@@ -2234,7 +2656,7 @@ lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type,
        }
 
        if (ranges == 1) {
-               computed_total_content_length = (unsigned long)rp->agg;
+               computed_total_content_length = (lws_filepos_t)rp->agg;
                n = lws_snprintf(cache_control, sizeof(cache_control), "bytes %llu-%llu/%llu",
                                rp->start, rp->end, rp->extent);
 
@@ -2329,6 +2751,7 @@ lws_interpret_incoming_packet(struct lws *wsi, unsigned char **buf, size_t len)
                }
 
                if (wsi->u.ws.rx_draining_ext) {
+                       // lwsl_notice("draining with 0\n");
                        m = lws_rx_sm(wsi, 0);
                        if (m < 0)
                                return -1;
@@ -2340,7 +2763,8 @@ lws_interpret_incoming_packet(struct lws *wsi, unsigned char **buf, size_t len)
                        wsi->rxflow_pos++;
 
                /* consume payload bytes efficiently */
-               if (wsi->lws_rx_parse_state ==
+               if (
+                   wsi->lws_rx_parse_state ==
                    LWS_RXPS_PAYLOAD_UNTIL_LENGTH_EXHAUSTED) {
                        m = lws_payload_until_length_exhausted(wsi, buf, &len);
                        if (wsi->rxflow_buffer)
@@ -2365,7 +2789,7 @@ lws_server_get_canonical_hostname(struct lws_context *context,
 {
        if (lws_check_opt(info->options, LWS_SERVER_OPTION_SKIP_SERVER_CANONICAL_NAME))
                return;
-#if LWS_POSIX
+#if LWS_POSIX && !defined(LWS_WITH_ESP32)
        /* find canonical hostname */
        gethostname((char *)context->canonical_hostname,
                    sizeof(context->canonical_hostname) - 1);
@@ -2757,6 +3181,8 @@ struct lws_spa {
        char *storage;
        char *end;
        int max_storage;
+
+       char finalized;
 };
 
 static int
@@ -2849,7 +3275,7 @@ lws_spa_create(struct lws *wsi, const char * const *param_names,
        if (!spa->param_length)
                goto bail5;
 
-       lwsl_notice("%s: Created SPA %p\n", __func__, spa);
+       lwsl_info("%s: Created SPA %p\n", __func__, spa);
 
        return spa;
 
@@ -2872,6 +3298,10 @@ lws_spa_process(struct lws_spa *ludspa, const char *in, int len)
                lwsl_err("%s: NULL spa\n", __func__);
                return -1;
        }
+       /* we reject any junk after the last part arrived and we finalized */
+       if (ludspa->finalized)
+               return 0;
+
        return lws_urldecode_s_process(ludspa->s, in, len);
 }
 
@@ -2901,6 +3331,8 @@ lws_spa_finalize(struct lws_spa *spa)
                spa->s = NULL;
        }
 
+       spa->finalized = 1;
+
        return 0;
 }
 
@@ -2914,7 +3346,12 @@ lws_spa_destroy(struct lws_spa *spa)
        if (spa->s)
                lws_urldecode_s_destroy(spa->s);
 
-       lwsl_debug("%s\n", __func__);
+       lwsl_debug("%s %p %p %p %p\n", __func__,
+                       spa->param_length,
+                       spa->params,
+                       spa->storage,
+                       spa
+                       );
 
        lws_free(spa->param_length);
        lws_free(spa->params);
@@ -2924,6 +3361,27 @@ lws_spa_destroy(struct lws_spa *spa)
        return n;
 }
 
+#if 0
+LWS_VISIBLE LWS_EXTERN int
+lws_spa_destroy(struct lws_spa *spa)
+{
+       int n = 0;
+
+       lwsl_info("%s: destroy spa %p\n", __func__, spa);
+
+       if (spa->s)
+               lws_urldecode_s_destroy(spa->s);
+
+       lwsl_debug("%s\n", __func__);
+
+       lws_free(spa->param_length);
+       lws_free(spa->params);
+       lws_free(spa->storage);
+       lws_free(spa);
+
+       return n;
+}
+#endif
 LWS_VISIBLE LWS_EXTERN int
 lws_chunked_html_process(struct lws_process_html_args *args,
                         struct lws_process_html_state *s)