File: mod_qos.c

package info (click to toggle)
libapache2-mod-qos 11.74-1~bpo12%2B1
links: PTS, VCS
area: main
in suites: bookworm-backports
size: 2,692 kB
sloc: ansic: 21,519; sh: 974; makefile: 58
file content (14830 lines) | stat: -rw-r--r-- 547,203 bytes
/* -*-mode: c; indent-tabs-mode: nil; c-basic-offset: 2; -*-
 */

/**
 * mod_qos.c: Quality of service module for Apache Web Server.
 *
 * The Apache Web Servers requires threads and processes to serve
 * requests. Each TCP connection to the web server occupies one
 * thread or process. Sometimes, a server gets too busy to serve
 * every request due the lack of free processes or threads.
 *
 * This module implements control mechanisms that can provide
 * different priority to different requests.
 *
 * mod_qos requires OpenSSL, PCRE, threading and shared memory
 * support. It has been designed, developed and fully 
 * tested for Apache httpd MPM worker binaries and it is optimized
 * to be used in a reverse proxy.
 *
 * See http://mod-qos.sourceforge.net/ for further
 * details and to obtain the latest version of this module.
 *
 * Copyright (C) 2023 Pascal Buchbinder
 *
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 */

/************************************************************************
 * Version
 ***********************************************************************/
static const char revision[] = "$Id: mod_qos.c 2706 2023-05-16 19:52:59Z pbuchbinder $";
static const char g_revision[] = "11.74";

/************************************************************************
 * Includes
 ***********************************************************************/
/* std */
#include <ctype.h>
#include <time.h>

#ifndef WIN32
#    include <arpa/inet.h>
#    include <unistd.h>
#else
#    include <ws2tcpip.h>
#    include <windows.h>
#    include <direct.h>
#endif

#include <stdlib.h>

// for socket options
#ifdef __unix__
#include <sys/types.h>
#include <sys/socket.h>
#endif

/* apache */
#include <httpd.h>
#include <http_core.h>
#include <http_main.h>
#include <http_protocol.h>
#include <http_request.h>
#include <http_connection.h>
#define CORE_PRIVATE
#include <http_config.h>
#include <http_log.h>
#include <util_filter.h>
#include <ap_mpm.h>
#include <scoreboard.h>
#include <ap_config.h>
#include <ap_regex.h>
#include <mpm_common.h>
#include <util_md5.h>

/* apr / scrlib */
#include <apr_strings.h>
#include <apr_file_info.h>
#include <apr_base64.h>
#include <apr_hooks.h>
#include <apr_lib.h>
#ifdef AP_NEED_SET_MUTEX_PERMS
#include <unixd.h>
#endif

/* mod_qos requires OpenSSL */
#include <openssl/rand.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>

/* additional modules */
#include "mod_status.h"

/* Preprocessor Definitions
 * this (optional header file allowing other modules to register to our hoos: */
#ifdef QS_MOD_EXT_HOOKS
#include "mod_qos.h"
#endif

/************************************************************************
 * defines
 ***********************************************************************/
#define QOS_LOG_PFX(id)  "mod_qos("#id"): "
#define QOS_LOGD_PFX  "mod_qos(): "
#define QOS_LOG_MSGCT 200
#define QOS_HASH_LEN 16
#define QOS_MAX_AGE "3600"
#define QOS_COOKIE_NAME "MODQOS"
#define QOS_USER_TRACKING "mod_qos_user_id"
#define QOS_USER_TRACKING_NEW "QOS_USER_ID_NEW"
#define QOS_USER_TRACKING_RENEW "QOS_USER_ID_RENEW"
#define QOS_DISABLE_UTC_ENFORCEMENT "DISABLE_UTC_ENFORCEMENT"
#define QOS_MILESTONE "mod_qos_milestone"
#define QOS_MILESTONE_TIMEOUT 3600
#define QOS_MILESTONE_COOKIE "QSSCD"
#define QS_SIM_IP_LEN 100
#define QS_USR_SPE "mod_qos::user"
#define QS_REC_COOKIE "mod_qos::gc"
#define QS_R010_ALREADY_BLOCKED "R010B"
#define QS_R012_ALREADY_BLOCKED "R012B"
#define QS_R013_ALREADY_BLOCKED "R013B"
#define QS_PKT_RATE_TH    3
#define QS_BW_SAMPLING_RATE 10
// split linear QS_SrvMaxConnPerIP* entry (conn->conn_ip) search:
#ifndef QS_MEM_SEG
#define QS_MEM_SEG 4
#endif
// buffer if srv opens new connections faster than it closes existing ones
#define QS_DOUBLE_CONN_H 128
#define QS_DOUBLE_CONN   32

#define QS_CONN_ABORT "mod_qos_connection_aborted"

/* Preprocessor Definitions
 * QSLOG_CLID, QSLOG_EVENT, QSLOG_AVERAGE define parameters for QSLog: */
#ifndef QSLOG_CLID
#define QSLOG_CLID "mod_qos_user_id"
#endif
#ifndef QSLOG_EVENT
#define QSLOG_EVENT "Event"
#endif
#ifndef QSLOG_AVERAGE
#define QSLOG_AVERAGE "QS_AllConn"
#endif

/* Preprocessor Definitions
 * logs repeating messages only once: */
#ifndef QS_LOG_REPEAT
#define QS_LOG_REPEAT     20
#endif

#define QS_IP4IN6         "::ffff:"

#define QS_PARP_Q         "qos-parp-query"
#define QS_PARP_QUERY     "qos-query"
#define QS_PARP_PATH      "qos-path"
#define QS_PARP_LOC       "qos-loc"

#define QSLOGFORMAT       "ISBiDUkEQaC"

#define QS_SET_DSCP       "QS_Set_DSCP"

#define QS_RESDELYATIME   "QS_ResponseDelayTime"
#define QS_CONNID         "QS_ConnectionId"
#define QS_COUNTRY        "QS_Country"
#define QS_SERIALIZE      "QS_Serialize"
#define QS_SRVSERIALIZE   "QS_SrvSerialize"
#define QS_ErrorNotes     "QS_ErrorNotes"
#define QS_BLOCK          "QS_Block"
#define QS_BLOCK_SEEN     "QS_Block_seen"
#define QS_BLOCK_DEC      "QS_Block_Decrement"
#define QS_LIMIT_NAME_PFX "QS_Limit_VAR_NAME_IDX"
#define QS_LIMIT_DEFAULT  "QS_Limit"
#define QS_LIMIT_SEEN     "QS_Limit_seen"
#define QS_COUNTER_SUFFIX "_Counter"
#define QS_LIMIT_CLEAR    "_Clear"
#define QS_LIMIT_DEC      "_Decrement"
#define QS_LIMIT_REMAINING "_Remaining"
#define QS_EVENT          "QS_Event"
#define QS_COND           "QS_Cond"
#define QS_ISVIPREQ       "QS_IsVipRequest"
#define QS_VipRequest     "QS_VipRequest"
#define QS_KEEPALIVE      "QS_KeepAliveTimeout"
#define QS_MAXKEEPALIVEREQ "QS_MaxKeepAliveRequests"
#define QS_TIMEOUT        "QS_Timeout"
#define QS_CLOSE          "QS_SrvMinDataRate"
#define QS_MAXIP          "QS_SrvMaxConnPerIP"
#define QS_EMPTY_CON      "NullConnection"
#define QS_BROKEN_CON     "BrokenConnection"
#define QS_RuleId         "QS_RuleId"

// enable connection counter if one of the following feature is used
#define QS_COUNT_CONNECTIONS(sconf) (sconf->max_conn != -1) || \
                                    (sconf->min_rate_max != -1) || \
                                    (sconf->max_conn_close != -1) || \
                                    (sconf->max_conn_per_ip_connections != 1) || \
                                     sconf->geodb


// "3758096128","3758096383","AU"
#define QS_GEO_PATTERN "\"([0-9]+)\",\"([0-9]+)\",\"([A-Z0-9]{2}|-)\""

static const char *m_env_variables[] = {
  QS_ErrorNotes,
  QS_SERIALIZE,
  QS_SRVSERIALIZE,
  QS_BLOCK,
  QS_BLOCK_SEEN,
  QS_BLOCK_DEC,
  QS_LIMIT_DEFAULT,
  QS_LIMIT_SEEN,
  QS_EVENT,
  QS_COND,
  QS_ISVIPREQ,
  QS_VipRequest,
  QS_KEEPALIVE,
  QS_MAXKEEPALIVEREQ,
  QS_CLOSE,
  QS_EMPTY_CON,
  QS_BROKEN_CON,
  QS_RuleId,
  NULL
};

static const char *m_note_variables[] = {
  QS_PARP_PATH,
  QS_PARP_QUERY,
  NULL
};

#define QS_INCTX_ID inctx->id

/* Preprocessor Definitions
   This is the measure rate for QS_SrvRequestRate/QS_SrvMinDataRate which may
   be increased to 10 or 30 seconds in order to compensate bandwidth variations.
   You may also use the QS_SrvSampleRate directive to override this default.
   Set it greater than the Apache Timeout directive to prevent from closing
   unused speculative TCP pre-connections. */
#ifndef QS_REQ_RATE_TM
#define QS_REQ_RATE_TM    5
#endif

#define QS_MAX_DELAY 5000000

#define QOS_DEC_MODE_FLAGS_URL        0x00
#define QOS_DEC_MODE_FLAGS_HTML       0x01
#define QOS_DEC_MODE_FLAGS_UNI        0x02
#define QOS_DEC_MODE_FLAGS_ANSI       0x04

#define QOS_LOW_FLAG_PKGRATE          0x01
#define QOS_LOW_FLAG_BEHAVIOR_OK      0x02
#define QOS_LOW_FLAG_BEHAVIOR_BAD     0x04
#define QOS_LOW_FLAG_EVENTBLOCK       0x08
#define QOS_LOW_FLAG_EVENTLIMIT       0x10
#define QOS_LOW_FLAG_TIMEOUT          0x20
#define QOS_LOW_TIMEOUT               86400

#define QOS_CC_BEHAVIOR_THR 50000
#define QOS_CC_BEHAVIOR_THR_SINGLE 50
#ifdef QS_INTERNAL_TEST
#undef QOS_CC_BEHAVIOR_THR
#undef QOS_CC_BEHAVIOR_THR_SINGLE
#define QOS_CC_BEHAVIOR_THR 50
#define QOS_CC_BEHAVIOR_THR_SINGLE 20
#endif
#define QOS_CC_BEHAVIOR_TOLERANCE_STR "20"

/* Apache 2.2 testing needs patch in util_pcre.c line 134 as it does not know AP_REG_DOTALL
 * Add:
 *  if ((cflags & 0x40) != 0) options |= 0x04; */
#ifndef AP_REG_DOTALL
#define AP_REG_DOTALL                 0x40
#endif

#define QS_ERR_TIME_FORMAT "%a %b %d %H:%M:%S %Y"

#define QSMOD 4
#define QOS_DELIM ";"

// Apache 2.4 compat
#if (AP_SERVER_MINORVERSION_NUMBER == 4)
#define QS_APACHE_24 1
#if (AP_SERVER_PATCHLEVEL_NUMBER > 17)
#define QS_CONN_REMOTEIP(c)  c->master ? c->master->client_ip : c->client_ip
#define QS_CONN_REMOTEADDR(c) c->master ? c->master->client_addr : c->client_addr
#define QS_CONN_MASTER(c) (c->master ? c->master : c)
#else
#define QS_CONN_REMOTEIP(c)  c->client_ip
#define QS_CONN_REMOTEADDR(c) c->client_addr
#define QS_CONN_MASTER(c) (c)
#endif
#define QOS_MY_GENERATION(g) ap_mpm_query(AP_MPMQ_GENERATION, &g)
#define qos_unixd_set_global_mutex_perms ap_unixd_set_global_mutex_perms
#define QS_ISDEBUG(s) APLOG_IS_LEVEL(s, APLOG_DEBUG)
#else
#define QS_CONN_REMOTEIP(c) c->remote_ip
#define QS_CONN_REMOTEADDR(c) c->remote_addr
#define QS_CONN_MASTER(c) (c)
#define QOS_MY_GENERATION(g) g = ap_my_generation
#define qos_unixd_set_global_mutex_perms unixd_set_global_mutex_perms
#define QS_ISDEBUG(s) s->loglevel >= APLOG_DEBUG
#endif

#ifdef QS_MOD_EXT_HOOKS
APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(qos, QOS, apr_status_t, path_decode_hook,
                                    (request_rec *r, char **path, int *len),
                                    (r, path, len),
                                    OK, DECLINED)
APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(qos, QOS, apr_status_t, query_decode_hook,
                                    (request_rec *r, char **query, int *len),
                                    (r, query, len),
                                    OK, DECLINED)
#endif

/************************************************************************
 * structures
 ***********************************************************************/
typedef struct {
  const char *name;             /* variable name */
  ap_regex_t *preg;
  const char *url;              /* redirect url */
  int code;
} qos_redirectif_entry_t;

typedef struct {
  unsigned long start;
  unsigned long end;
  char country[3];
} qos_geo_entry_t;

typedef struct {
  qos_geo_entry_t *data; // fist element
  int size;              // number of elements
  const char *path;
} qos_geo_t;

typedef struct {
  const char *url;
  const char *path;
} qos_errelt_t;

static const qos_errelt_t m_error_pages[] = {
  { "/errorpages/server_error.html", "work/errorpages/server_error.html" },
  { "/errorpages/forbidden.html", "work/errorpages/forbidden.html" },
  { "/errorpages/500.html", "work/errorpages/500.html" },
  { "/errorpages/error.html", "work/errorpages/error.html" },
  { "/errorpages/error500.html", "work/errorpages/error500.html" },
  { "/errorpages/gateway_error.html", "work/errorpages/gateway_error.html" },
  { NULL, NULL }
};

typedef struct {
  int id;
  const char *name;
} qos_dscp_t;

static const qos_dscp_t m_dscp_desc[] = {
  { 0, "none" },
  { 8, "class selector 1" },
  { 10, "assured forwarding 11" },
  { 12, "assured forwarding 12" },
  { 14, "assured forwarding 13" },
  { 16, "class selector 2" },
  { 18, "assured forwarding 21" },
  { 20, "assured forwarding 22" },
  { 22, "assured forwarding 23" },
  { 24, "class selector 3" },
  { 26, "assured forwarding 31" },
  { 28, "assured forwarding 32" },
  { 30, "assured forwarding 33" },
  { 32, "class selector 4" },
  { 34, "assured forwarding 41" },
  { 36, "assured forwarding 42" },
  { 38, "assured forwarding 43" },
  { 40, "class selector 5" },
  { 44, "voice admit" },
  { 46, "expedited forwarding" },
  { 48, "class selector 6" },
  { 56, "class selector 7" },
  { -1, "unknown" }
};

typedef struct {
  unsigned short int limit;
  time_t limitTime;
} qos_s_entry_limit_t;

typedef struct {
  unsigned short int limit;
  time_t limitTime;
  const char *eventClearStr; // name of the var clearing the counter
  const char *eventDecStr; // name of the var decrementing the counter
  const char *condStr;
  ap_regex_t *preg;
} qos_s_entry_limit_conf_t;

typedef struct {
  apr_uint64_t ip6[2];
  time_t lowrate;
  unsigned int lowratestatus;
  /* behavior */
  unsigned int html;
  unsigned int cssjs;
  unsigned int img;
  unsigned int other;
  unsigned int notmodified;
  unsigned int events;
  /* serialization flag */
  unsigned int serialize;
  apr_time_t serializeQueue;
  /* prefer */
  short int vip;
  /* ev block */
  unsigned short int block;
  short int blockMsg;
  time_t time;
  time_t blockTime;
  qos_s_entry_limit_t *limit;
  /* ev/sec */
  time_t interval;
  long req;
  long req_per_sec;
  int req_per_sec_block_rate;
  int event_req;
} qos_s_entry_t;

typedef struct {
  time_t t;
  /* index */
  qos_s_entry_t **ipd;
  qos_s_entry_t **timed;
  /* shm */
  apr_shm_t *m;
  char *lock_file;
  apr_global_mutex_t *lock;
  /* size */
  int num;
  int max;
  int msize;
  /* limit table settings */
  apr_table_t *limitTable;
  /* av. behavior */
  unsigned long long html;
  unsigned long long cssjs;
  unsigned long long img;
  unsigned long long other;
  unsigned long long notmodified;
  /* data */
  int connections;
  /* remember for which clients this rec has created (shared mem) */
  int generation_locked;  // indicates the the counters have been cleared for this generation
  /* log counter */
  unsigned long long eventTotal[QOS_LOG_MSGCT]; // total number of events since initial start
  unsigned long long eventLast[QOS_LOG_MSGCT];  // number of events since last read
} qos_s_t;

typedef enum  {
  QS_IP_V6_DEFAULT = 0,
  QS_IP_V6,
  QS_IP_V4
} qs_ip_type_e;

typedef enum  {
  QS_CONN_STATE_NEW = 0,
  QS_CONN_STATE_HEAD,
  QS_CONN_STATE_BODY,
  QS_CONN_STATE_CHUNKED,
  QS_CONN_STATE_KEEP,
  QS_CONN_STATE_RESPONSE,
  QS_CONN_STATE_END,
  QS_CONN_STATE_DESTROY
} qs_conn_state_e;

typedef enum  {
  QS_HEADERFILTER_OFF_DEFAULT = 0,
  QS_HEADERFILTER_OFF,
  QS_HEADERFILTER_ON,
  QS_HEADERFILTER_SIZE_ONLY,
  QS_HEADERFILTER_SILENT
} qs_headerfilter_mode_e;

typedef enum  {
  QS_FLT_ACTION_DROP,
  QS_FLT_ACTION_DENY
} qs_flt_action_e;

typedef enum  {
  QS_EVENT_ACTION_DENY = 0
} qs_event_action_e;

typedef enum  {
  QS_DENY_REQUEST_LINE,
  QS_DENY_PATH,
  QS_DENY_QUERY,
  QS_DENY_EVENT,
  QS_PERMIT_URI
} qs_rfilter_type_e;

typedef enum  {
  QS_LOG = 0,
  QS_DENY,
  QS_OFF_DEFAULT,
  QS_OFF
} qs_rfilter_action_e;

enum qos_cmp {
  QS_CMP_EQ,
  QS_CMP_NE,
  QS_CMP_GT,
  QS_CMP_LT
};

typedef struct {
  enum qos_cmp cmp;
  const char *left;
  const char *right;
  const char *variable;
  const char *value;
} qos_cmp_entry_t;

typedef struct {
  char *variable1;
  char *variable2;
  ap_regex_t *preg;
  char *name;
  char *value;
} qos_setenvif_t;

typedef struct {
  ap_regex_t *preg;
  char *name;
  char *value;
} qos_setenvifquery_t;

typedef struct {
  ap_regex_t *pregx;
  char *name;
  char *value;
} qos_setenvifparpbody_t;

/**
 * generic request filter
 */
typedef struct {
  ap_regex_t *preg;
  char *text;
  char *id;
  qs_rfilter_type_e type;
  qs_rfilter_action_e action;
} qos_rfilter_t;

/**
 * list of in_filter ctx
 */
typedef struct {
  apr_table_t *table;
#if APR_HAS_THREADS
  apr_thread_mutex_t *lock;
  apr_thread_t *thread;
#endif
  int exit;
} qos_ifctx_list_t;

/**
 * ip entry
 */
typedef struct qs_ip_entry_st {
  apr_uint64_t ip6[2];
  int counter;
  int error;
} qs_ip_entry_t;

typedef struct {
  qs_ip_entry_t *conn_ip;
  int conn_ip_len;
  int connections;
  int max_client;
} qs_conn_t;

typedef struct {
  apr_time_t q1; // first request in queue
  apr_time_t q2; // second request in queue
  int locked;
} qs_serial_t;

/**
 * session cookie
 */
typedef struct {
  time_t time;
} qos_session_t;

/**
 * cfg/act entry for event limitation
 */
typedef struct {
  const char *env_var;// configured environment variable name
  const char *eventDecStr;
  int max;            // configured max. num
  int seconds;        // configured duration
  int limit;          // event counter
  time_t limitTime;  // timer
  qs_event_action_e action;
  const char *condStr;
  ap_regex_t *preg;
} qos_event_limit_entry_t;

/** 
 * access control table entry
 */
typedef struct qs_acentry_st {
  int id;
  /** pointer to lock of the actable */
  apr_global_mutex_t *lock;
  /** location rules */
  char *url;
  int url_len;
  char *event;
  ap_regex_t *regex;
  ap_regex_t *regex_var;
  ap_regex_t *condition;
  int counter;
  int limit;
  /* measurement */
  apr_time_t interval;
  long req;
  long req_per_sec;
  long req_per_sec_limit;
  int req_per_sec_block_rate;
  long bytes;                           // transferred bytes
  apr_time_t kbytes_interval_us;        // elapsed time
  apr_off_t kbytes_per_sec;             // actual kbytes/sec (measured)
  apr_off_t kbytes_per_sec_limit;       // configured limitation
  apr_off_t kbytes_per_sec_block_rate;  // current wait time
  struct qs_acentry_st *next;
} qs_acentry_t;

/**
 * access control table (act)
 */
typedef struct qs_actable_st {
  apr_size_t size;
  apr_shm_t *m;
  apr_pool_t *pool;
  /** process pool is used to create user space data */
  apr_pool_t *ppool;
  /** rule entry list */
  qs_acentry_t *entry; /* shm pointer */
  int has_events;
  /** event limit list */
  qos_event_limit_entry_t *event_entry;
  /** mutex */
  char *lock_file;
  apr_global_mutex_t *lock;
  /** ip/conn data */
  qs_conn_t *conn; /* shm pointer */
  unsigned int timeout;
  /* settings */
  int child_init;
  /* serialize */
  qs_serial_t *serialize; /* shm pointer */
  time_t *qsstatustimer; /* shm pointer */
} qs_actable_t;

/**
 * network table (total connections, vip connections, first update, last update)
 */
typedef struct qs_netstat_st {
  //  int counter;
  int vip;
  //  time_t first;
  //  time_t last;
} qs_netstat_t;

/**
 * user space
 */
typedef struct {
  int server_start;
  apr_table_t *act_table;
  /* client control */
  qos_s_t *qos_cc;
} qos_user_t;

/**
 * directory config
 */
typedef struct {
  char *path;
  apr_table_t *rfilter_table;
  int inheritoff;
  qs_headerfilter_mode_e headerfilter;
  qs_headerfilter_mode_e resheaderfilter;
  int bodyfilter_d;
  int bodyfilter_p;
  int dec_mode;
  apr_off_t maxpost;
  qs_rfilter_action_e urldecoding;
  const char *response_pattern;
  int response_pattern_len;
  const char *response_pattern_var;
  apr_array_header_t *redirectif;
  int decodings; 
  apr_table_t *disable_reqrate_events;
  apr_table_t *setenvstatus_t;
  apr_array_header_t *setenvif_t;
  apr_table_t *setenvifquery_t;
  apr_array_header_t* setenvcmp;
} qos_dir_config;

/**
 * server configuration
 */
typedef struct {
  apr_pool_t *pool;
  int is_virtual;
  server_rec *base_server;
  char *mfile;
  qs_actable_t *act;
  const char *error_page;
  apr_table_t *location_t;
  apr_table_t *setenv_t;
  apr_table_t *setreqheader_t;
  apr_table_t *setreqheaderlate_t;
  apr_table_t *unsetresheader_t;
  apr_table_t *unsetreqheader_t;
  apr_array_header_t *setenvif_t;
  apr_table_t *setenvifquery_t;
  apr_table_t *setenvifparp_t;
  apr_table_t *setenvifparpbody_t;
  apr_table_t *setenvstatus_t;
  apr_table_t *setenvresheader_t;
  apr_table_t *setenvresheadermatch_t;
  apr_table_t *setenvres_t;
  qs_headerfilter_mode_e headerfilter;
  qs_headerfilter_mode_e resheaderfilter;
  apr_array_header_t *redirectif;
  char *cookie_name;
  char *cookie_path;
  char *user_tracking_cookie;
  char *user_tracking_cookie_force;
  int user_tracking_cookie_session;
  int user_tracking_cookie_jsredirect;
  char *user_tracking_cookie_domain;
  int max_age;
  unsigned char key[EVP_MAX_KEY_LENGTH];
  const unsigned char *rawKey;
  int rawKeyLen;
  int keyset;
  char *header_name;
  int header_name_drop;
  ap_regex_t *header_name_regex;
  apr_table_t *disable_reqrate_events;
  char *ip_header_name;
  int ip_header_name_drop;
  ap_regex_t *ip_header_name_regex;
  int vip_user;
  int vip_ip_user;

  int has_conn_counter;
  int max_conn;
  int max_conn_close;
  int max_conn_close_percent;
  int max_conn_per_ip;
  int max_conn_per_ip_connections;
  int max_conn_per_ip_ignore_vip;

  int serialize;
  int serializeTMO;
  apr_table_t *exclude_ip;
  qos_ifctx_list_t *inctx_t;
  apr_table_t *hfilter_table; /* GLOBAL ONLY */
  apr_table_t *reshfilter_table; /* GLOBAL ONLY */
  /* event rule (enables rule validation) */
  int has_event_filter;
  int has_event_limit;
  apr_array_header_t *event_limit_a;
  /* min data rate */
  int req_rate;               /* GLOBAL ONLY */
  int req_rate_start;         /* GLOBAL ONLY */
  int min_rate;               /* GLOBAL ONLY */
  int min_rate_max;           /* GLOBAL ONLY */
  int min_rate_off;
  int req_ignore_vip_rate;    /* GLOBAL ONLY */
  int max_clients;
  int max_clients_conf;
#ifdef QS_INTERNAL_TEST
  apr_table_t *testip;
  int enable_testip;
#endif
  int disable_handler;
  int log_only;               /* GLOBAL ONLY */
  int log_env;
  /* client control */
  int has_qos_cc;             /* GLOBAL ONLY */
  int qos_cc_size;            /* GLOBAL ONLY */
  int qos_cc_prefer;          /* GLOBAL ONLY */
  apr_table_t *cc_exclude_ip; /* GLOBAL ONLY */
  int qos_cc_prefer_limit;
  int qos_cc_event;           /* GLOBAL ONLY */
  int qos_cc_event_req;       /* GLOBAL ONLY */
  int qos_cc_block;           /* GLOBAL ONLY */
  int qos_cc_blockTime;      /* GLOBAL ONLY */
  apr_table_t *qos_cc_limitTable;    /* GLOBAL ONLY */
  char *qos_cc_forwardedfor;  /* GLOBAL ONLY */
  int qos_cc_serialize;       /* GLOBAL ONLY */
  apr_off_t maxpost;
  int cc_tolerance;           /* GLOBAL ONLY */
  int cc_tolerance_max;       /* GLOBAL ONLY */
  int cc_tolerance_min;       /* GLOBAL ONLY */
  int qs_req_rate_tm;         /* GLOBAL ONLY */
  qos_geo_t *geodb;           /* GLOBAL ONLY */
  int geo_limit;              /* GLOBAL ONLY */
  apr_table_t *geo_priv;      /* GLOBAL ONLY */
  int geo_excludeUnknown;     /* GLOBAL ONLY */
  qs_ip_type_e ip_type;       /* GLOBAL ONLY */
  int qsstatus;               /* GLOBAL ONLY */
  int qsevents;               /* GLOBAL ONLY */
  apr_array_header_t *milestones;
  time_t milestoneTimeout;
  /* predefined client behavior */
  int static_on;
  unsigned long long static_html;
  unsigned long long static_cssjs;
  unsigned long long static_img;
  unsigned long long static_other;
  unsigned long long static_notmodified;
  apr_file_t *qslog_p;        /* GLOBAL ONLY */
  const char *qslog_str;      /* GLOBAL ONLY */
} qos_srv_config;

#if APR_HAS_THREADS
typedef struct {
  apr_thread_t *thread;
  int exit;
  int maxclients;
  time_t *qsstatustimer;    /* shm in act */
  apr_global_mutex_t *lock; /* lock of act */
  apr_pool_t *pool;
  qos_srv_config *sconf;
} qsstatus_t;
#endif

/**
 * in_filter ctx
 */
typedef struct {
  apr_socket_t *clientSocket;
  qs_conn_state_e status;
  apr_off_t cl_val;
  conn_rec *c;
  request_rec *r;
  /* upload bandwidth (received bytes and start time) */
  time_t time;
  apr_size_t nbytes;    // measuring the bytes/sec
  int hasBytes;
  int shutdown;
  int errors;
  int disabled;
  int lowrate;
  char *id;
  qos_srv_config *sconf;
} qos_ifctx_t;

/**
 * connection configuration
 */
typedef struct {
  apr_uint64_t ip6[2];
  conn_rec *mc; // master (real) connection
  char *evmsg;
  qos_srv_config *sconf;
  int is_vip;           /* is vip, either by request or by session or by ip */
  int set_vip_by_header; /* received vip header from application/or auth. user (propagate to IP store)*/
  int has_lowrate;
  qs_conn_t *conn;
} qs_conn_ctx;

typedef struct {
  qs_conn_ctx *cconf;
  conn_rec *c;
  qos_srv_config *sconf;
  int requests; // number of requests processed (received) by this connection  
  apr_socket_t *clientSocket;
} qs_conn_base_ctx;

/**
 * request configuration
 */
typedef struct {
  qs_acentry_t *entry;
  qs_acentry_t *entry_cond;
  apr_table_t *event_entries;
  char *evmsg;
  int is_vip;
  apr_off_t maxpostcount;
  int cc_event_req_set;
  apr_uint64_t cc_event_ip[2];
  int cc_serialize_set;
  apr_uint64_t cc_serialize_ip[2];
  int srv_serialize_set;
  char *body_window;
  apr_off_t response_delayed; // indicates, if the response has been delayed (T)
} qs_req_ctx;


/**
 * Delay filter context
 */
typedef struct {
  qs_acentry_t *entry;
  qs_req_ctx *rctx;
} qos_delay_ctx_t;

/**
 * rule set
 */
typedef struct {
  char *url;
  char *event;
  int limit;
  ap_regex_t *regex;
  ap_regex_t *regex_var;
  ap_regex_t *condition;
  long req_per_sec_limit;
  apr_off_t kbytes_per_sec_limit;
} qs_rule_ctx_t;

typedef struct {
  const char* name;
  const char* pattern;
  qs_flt_action_e action;
  int size;
} qos_her_t;

typedef struct {
  ap_regex_t *preg;
  char *name;
  char *value;
} qos_pregval_t;

typedef struct {
  int num;
  int thinktime;
  const char* pattern;
  ap_regex_t *preg;
  qs_rfilter_action_e action;
} qos_milestone_t;

typedef struct {
  char *text;
  ap_regex_t *preg;
  qs_flt_action_e action;
  int size;
} qos_fhlt_r_t;

typedef struct {
  apr_time_t request_time;
  unsigned int in_addr;
  unsigned int conn;
#if APR_HAS_THREADS
  apr_os_thread_t tid;
#endif
  unsigned int unique_id_counter;
} qos_unique_id_t;

/************************************************************************
 * Globals
 ***********************************************************************/

module AP_MODULE_DECLARE_DATA qos_module;
static int m_forced_close = 1;
static int m_retcode = HTTP_INTERNAL_SERVER_ERROR;
static int m_threaded_mpm = 1; // note: mod_qos is fully tested for Apache 2.2 worker MPM only
static int m_event_mpm = 0;
static double m_event_mpm_worker_factor = 2;
static unsigned int m_hostcode = 0;
static int m_generation = 0; // parent process (restart generation)
static int m_qos_cc_partition = QSMOD;
static qos_unique_id_t m_unique_id;
static const char qos_basis_64[] =
  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-";

#ifdef QS_INTERNAL_TEST
static int m_qs_sim_ip_len = QS_SIM_IP_LEN;
#endif

#ifdef QS_APACHE_24
APLOG_USE_MODULE(qos);
#endif

/* mod_parp, forward and optional function */
static apr_status_t qos_cleanup_conn(void *p);
static apr_status_t qos_base_cleanup_conn(void *p);

static qs_ip_type_e m_ip_type = QS_IP_V6_DEFAULT;

APR_DECLARE_OPTIONAL_FN(apr_table_t *, parp_hp_table, (request_rec *));
APR_DECLARE_OPTIONAL_FN(char *, parp_body_data, (request_rec *, apr_size_t *));
static APR_OPTIONAL_FN_TYPE(parp_hp_table) *qos_parp_hp_table_fn = NULL;
static APR_OPTIONAL_FN_TYPE(parp_body_data) *qos_parp_body_data_fn = NULL;
static int m_requires_parp = 0;
static int m_enable_audit = 0;
/* mod_ssl, forward and optional function */
APR_DECLARE_OPTIONAL_FN(int, ssl_is_https, (conn_rec *));
static APR_OPTIONAL_FN_TYPE(ssl_is_https) *qos_is_https = NULL;
APR_DECLARE_OPTIONAL_FN(char *, ssl_var_lookup, (apr_pool_t *, server_rec *, conn_rec *, request_rec *, char *));
static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *qos_ssl_var = NULL;

static void qs_inc_eventcounter(apr_pool_t *ppool, int event, int locked);
#define QS_INC_EVENT(sconf, event) if(sconf->qsevents) qs_inc_eventcounter(sconf->act->ppool, event, 0)
#define QS_INC_EVENT_LOCKED(sconf, event) if(sconf->qsevents) qs_inc_eventcounter(sconf->act->ppool, event, 1)
static int m_knownEvents[] = { 10, 11, 12, 13, 21, 23, 25, 30, 31, 34, 35, 36, 37, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 60, 61, 62, 65, 66, 67, 68, 69, 101, 147, 0 };

/* simple header rules allowing "the usual" header formats only (even drop requests using
   extensions which are used rarely) */
/* reserved (to be escaped): {}[]()^$.|*+?\ */
static const qos_her_t qs_header_rules[] = {
#define QS_URL_UNRESERVED  "a-zA-Z0-9._~% -"
#define QS_URL_GEN         ":/?#\\[\\]@"
#define QS_URL_SUB         "!$&'()*+,;="
#define QS_URL             "["QS_URL_GEN""QS_URL_SUB""QS_URL_UNRESERVED"]"
#define QS_2616TOKEN       "[\\x21\\x23-\\x27\\x2a-\\x2e0-9A-Z\\x5-\\x60a-z\\x7e]+"
#define QS_B64_SP          "[a-zA-Z0-9 +/$=:]"
#define QS_PIPE            "\\|"
#define QS_WEAK            "(W/)?"
#define QS_H_ACCEPT        "[a-zA-Z0-9_*+-]+/[a-zA-Z0-9_*+.-]+(;[ ]?[a-zA-Z0-9]+=[0-9]+)?[ ]?(;[ ]?[qv]=[a-z0-9.]+)?"
#define QS_H_ACCEPT_C      "[a-zA-Z0-9*-]+(;[ ]?q=[0-9.]+)?"
#define QS_H_ACCEPT_E      "[a-zA-Z0-9*-]+(;[ ]?q=[0-9.]+)?"
#define QS_H_ACCEPT_L      "[a-zA-Z*-]+[0-9]{0,3}(;[ ]?q=[0-9.]+)?"
#define QS_H_CACHE         "no-cache|no-store|max-age=[0-9]+|max-stale(=[0-9]+)?|min-fresh=[0-9]+|no-transform|only-if-chached"
#define QS_H_CONTENT       "[\"a-zA-Z0-9*/; =-]+"
#define QS_H_COOKIE        "["QS_URL_GEN""QS_URL_SUB"\""QS_URL_UNRESERVED"]"
#define QS_H_EXPECT        "[a-zA-Z0-9= ;.,-]"
#define QS_H_PRAGMA        "[a-zA-Z0-9= ;.,-]"
#define QS_H_FROM          "[a-zA-Z0-9=@;.,()-]"
#define QS_H_HOST          "[a-zA-Z0-9.-]+(:[0-9]+)?"
#define QS_H_IFMATCH       "[a-zA-Z0-9=@;.,*\"-]"
#define QS_H_DATE          "[a-zA-Z0-9 :,]"
#define QS_H_TE            "[a-zA-Z0-9*-]+(;[ ]?q=[0-9.]+)?"
  { "Accept", "^("QS_H_ACCEPT"){1}([ ]?,[ ]?("QS_H_ACCEPT"))*$", QS_FLT_ACTION_DROP, 300 },
  { "Accept-Charset", "^("QS_H_ACCEPT_C"){1}([ ]?,[ ]?("QS_H_ACCEPT_C"))*$", QS_FLT_ACTION_DROP, 300 },
  { "Accept-Encoding", "^("QS_H_ACCEPT_E"){1}([ ]?,[ ]?("QS_H_ACCEPT_E"))*$", QS_FLT_ACTION_DROP, 500 },
  { "Accept-Language", "^("QS_H_ACCEPT_L"){1}([ ]?,[ ]?("QS_H_ACCEPT_L"))*$", QS_FLT_ACTION_DROP, 200 },
  { "Access-Control-Request-Method", "^[a-zA-Z]+$", QS_FLT_ACTION_DROP, 10 },
  { "Access-Control-Request-Headers", "^([a-zA-Z0-9-]+){1}([ ]?,[ ]?([a-zA-Z0-9-]+))*$", QS_FLT_ACTION_DROP, 500 },
  { "Authorization", "^"QS_B64_SP"+$", QS_FLT_ACTION_DROP, 4000 },
  { "Cache-Control", "^("QS_H_CACHE"){1}([ ]?,[ ]?("QS_H_CACHE"))*$", QS_FLT_ACTION_DROP, 100 },
  { "Connection", "^([teTE]+,[ ]?)?([a-zA-Z0-9-]+){1}([ ]?,[ ]?([teTE]+))?$", QS_FLT_ACTION_DROP, 100 },
  { "Content-Encoding", "^[a-zA-Z0-9-]+(,[ ]*[a-zA-Z0-9-]+)*$", QS_FLT_ACTION_DENY, 100 },
  { "Content-Language", "^([0-9a-zA-Z]{0,8}(-[0-9a-zA-Z]{0,8})*)(,[ ]*([0-9a-zA-Z]{0,8}(-[0-9a-zA-Z]{0,8})*))*$", QS_FLT_ACTION_DROP, 100 },
  { "Content-Length", "^[0-9]+$", QS_FLT_ACTION_DENY, 10 },
  { "Content-Location", "^"QS_URL"+$", QS_FLT_ACTION_DENY, 200 },
  { "Content-md5", "^"QS_B64_SP"+$", QS_FLT_ACTION_DENY, 50 },
  { "Content-Range", "^(bytes[ ]+([0-9]+-[0-9]+)/([0-9]+|\\*))$", QS_FLT_ACTION_DENY, 50 },
  { "Content-Type", "^("QS_H_CONTENT"){1}([ ]?,[ ]?("QS_H_CONTENT"))*$", QS_FLT_ACTION_DENY, 200 },
  { "Cookie", "^"QS_H_COOKIE"+$", QS_FLT_ACTION_DROP, 3000 },
  { "Cookie2", "^"QS_H_COOKIE"+$", QS_FLT_ACTION_DROP, 3000 },
  { "DNT", "^[0-9]+$", QS_FLT_ACTION_DROP, 3 },
  { "Expect", "^"QS_H_EXPECT"+$", QS_FLT_ACTION_DROP, 200 },
  { "From", "^"QS_H_FROM"+$", QS_FLT_ACTION_DROP, 100 },
  { "Host", "^"QS_H_HOST"$", QS_FLT_ACTION_DROP, 100 },
  { "If-Invalid", "^[a-zA-Z0-9_.:;() /+!-]+$", QS_FLT_ACTION_DROP, 500 },
  { "If-Match", "^"QS_WEAK""QS_H_IFMATCH"+$", QS_FLT_ACTION_DROP, 100 },
  { "If-Modified-Since", "^"QS_H_DATE"+$", QS_FLT_ACTION_DROP, 100 },
  { "If-None-Match", "^"QS_WEAK""QS_H_IFMATCH"+$", QS_FLT_ACTION_DROP, 100 },
  { "If-Range", "^"QS_H_IFMATCH"+$", QS_FLT_ACTION_DROP, 100 },
  { "If-Unmodified-Since", "^"QS_H_DATE"+$", QS_FLT_ACTION_DROP, 100 },
  { "If-Valid", "^[a-zA-Z0-9_.:;() /+!-]+$", QS_FLT_ACTION_DROP, 500 },
  { "Keep-Alive", "^[0-9]+$", QS_FLT_ACTION_DROP, 20 },
  { "Max-Forwards", "^[0-9]+$", QS_FLT_ACTION_DROP, 20 },
  { "Origin", "^"QS_URL"+$", QS_FLT_ACTION_DROP, 2000 },
  { "Proxy-Authorization", "^"QS_B64_SP"+$", QS_FLT_ACTION_DROP, 400 },
  { "Pragma", "^"QS_H_PRAGMA"+$", QS_FLT_ACTION_DROP, 200 },
  { "Range", "^[a-zA-Z0-9=_.:;() /+!-]+$", QS_FLT_ACTION_DROP, 200 },
  { "Referer", "^"QS_URL"+$", QS_FLT_ACTION_DROP, 2000 },
  { "TE", "^("QS_H_TE"){1}([ ]?,[ ]?("QS_H_TE"))*$", QS_FLT_ACTION_DROP, 100 },
  { "Transfer-Encoding", "^(chunked|Chunked|compress|Compress|deflate|Deflate|gzip|Gzip|identity|Identity)([ ]?,[ ]?(chunked|Chunked|compress|Compress|deflate|Deflate|gzip|Gzip|identity|Identity))*$", QS_FLT_ACTION_DENY, 100 },
  { "Unless-Modified-Since", "^"QS_H_DATE"+$", QS_FLT_ACTION_DROP, 100 },
  { "User-Agent", "^[a-zA-Z0-9]+[a-zA-Z0-9_.:;()\\[\\]@ /+!=,-]+$", QS_FLT_ACTION_DROP, 300 },
  { "Upgrade-Insecure-Requests", "^1$", QS_FLT_ACTION_DROP, 1 },
  { "Via", "^[a-zA-Z0-9_.:;() /+!-]+$", QS_FLT_ACTION_DROP, 100 },
  { "X-Forwarded-For", "^[a-zA-Z0-9_.:-]+(, [a-zA-Z0-9_.:-]+)*$", QS_FLT_ACTION_DROP, 100 },
  { "X-Forwarded-Host", "^[a-zA-Z0-9_.:-]+$", QS_FLT_ACTION_DROP, 100 },
  { "X-Forwarded-Server", "^[a-zA-Z0-9_.:-]+$", QS_FLT_ACTION_DROP, 100 },
  { "X-lori-time-1", "^[0-9]+$", QS_FLT_ACTION_DROP, 20 },
  { "X-Do-Not-Track", "^[0-9]+$", QS_FLT_ACTION_DROP, 20 },
  { NULL, NULL, 0, 0 }
};

/* list of allowed standard response headers */
static const qos_her_t qs_res_header_rules[] = {
  { "Age", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Accept-Ranges", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Access-Control-Allow-Origin", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Access-Control-Allow-Methods", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Access-Control-Allow-Headers", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Access-Control-Max-Age", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Access-Control-Allow-Credentials", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Access-Control-Expose-Headers", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Allow", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Cache-Control", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-Disposition", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-Encoding", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-Language", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-Length", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-Location", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-MD5", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-Range", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Content-Security-Policy", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 8000 },
  { "Content-Type", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Connection", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Date", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "ETag", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Expect", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Expires", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Keep-Alive", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Last-Modified", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Location", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Proxy-Authenticate", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Public-Key-Pins", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Public-Key-Pins-Report-Only", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Retry-After", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Pragma", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Server", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Set-Cookie", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 }, 
  { "Set-Cookie2", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Strict-Transport-Security", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "Vary", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "WWW-Authenticate", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "X-Content-Security-Policy", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 8000 },
  { "X-Content-Type-Options", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "X-Frame-Options", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { "X-XSS-Protection", "^[\\x20-\\xFF]*$", QS_FLT_ACTION_DROP, 4000 },
  { NULL, NULL, 0, 0 }
};

/************************************************************************
 * private functions
 ***********************************************************************/

static int qos_regexec_len(apr_pool_t *pool, const ap_regex_t *preg,
                           const char *buff, apr_size_t len) {
#if (AP_SERVER_MINORVERSION_NUMBER < 4) && defined QS_INTERNAL_TEST
  // Apache 2.2 is no longer supported (test only)
  char *data = apr_palloc(pool, len + 1);
  memcpy(data, buff, len);
  data[len] = '\0';
  return ap_regexec(preg, data, 0, NULL, 0); // won't work for null chars!
#else
  return ap_regexec_len(preg, buff, len, 0, NULL, 0);
#endif
}

/**
 * Converts an ip long array back to a string representation
 *
 * @param pool
 * @param src Array of two unsigned long
 * @return String or null for an invalid address
 */
static char *qos_ip_long2str(apr_pool_t *pool, const void *src) {
  char *dst = apr_pcalloc(pool, INET6_ADDRSTRLEN);
  char *ret = (char *)inet_ntop(AF_INET6, src, dst, INET6_ADDRSTRLEN);
  if(ret) {
    if((strncmp(ret, QS_IP4IN6, 7) == 0) &&
       strchr(ret, '.')) {
      ret = &ret[7];
    }
  }
  return ret;
}

/**
 * Converts an ip string to long array (128 bit) representation
 *
 * @param src String representation, e.g. 139.12.33.1 or 1::8
 * @param dst Pointer to array of unsigned long (2) (contains "{ 0, 0 }" on error)
 * @return 1 on success, 0 on error
 */
static int qos_ip_str2long(const char *src, apr_uint64_t *dst) {
  char str[INET6_ADDRSTRLEN];
  const char *convert = src;
  apr_uint64_t *n = dst;
  n[0] = 0;
  n[1] = 0;
  if(convert == NULL) {
    return 0;
  }
  if((strchr(convert, ':') == NULL) && 
     (strlen(convert) <= 15)) {
    // looks like an IPv4 address
    sprintf(str, QS_IP4IN6"%s", src);
    convert = str;
  }
  return inet_pton(AF_INET6, convert, dst);
}

static int qos_encode64_binary(char *encoded, const char *string, int len) {
  int i;
  char *p;
  
  p = encoded;
  for (i = 0; i < len - 2; i += 3) {
    *p++ = qos_basis_64[(string[i] >> 2) & 0x3F];
    *p++ = qos_basis_64[((string[i] & 0x3) << 4) |
                        ((int) (string[i + 1] & 0xF0) >> 4)];
    *p++ = qos_basis_64[((string[i + 1] & 0xF) << 2) |
                        ((int) (string[i + 2] & 0xC0) >> 6)];
    *p++ = qos_basis_64[string[i + 2] & 0x3F];
  }
  if (i < len) {
    *p++ = qos_basis_64[(string[i] >> 2) & 0x3F];
    if (i == (len - 1)) {
      *p++ = qos_basis_64[((string[i] & 0x3) << 4)];
      *p++ = '=';
    }
    else {
      *p++ = qos_basis_64[((string[i] & 0x3) << 4) |
                          ((int) (string[i + 1] & 0xF0) >> 4)];
      *p++ = qos_basis_64[((string[i + 1] & 0xF) << 2)];
    }
    *p++ = '=';
  }
  
  *p++ = '\0';
  return (int)(p - encoded);
}

/**
 * loads the default header rules into the server configuration (see rules
 * above).
 * @param pool To allocate memory
 * @param outHdrFltTable Table to add rules to
 * @param hdrFltRuleDefArray built-in header rules
 * @return error message (NULL on success)
 */
static char *qos_load_headerfilter(apr_pool_t *pool, apr_table_t *outHdrFltTable,
                                   const qos_her_t *hdrFltRuleDefArray) {
  const qos_her_t* hdrFltRuleDefEntry;
  for(hdrFltRuleDefEntry = hdrFltRuleDefArray; hdrFltRuleDefEntry->name != NULL ; ++hdrFltRuleDefEntry) {
    qos_fhlt_r_t *hdrFltElement = apr_pcalloc(pool, sizeof(qos_fhlt_r_t));
    hdrFltElement->text = apr_pstrdup(pool, hdrFltRuleDefEntry->pattern);
    hdrFltElement->preg = ap_pregcomp(pool, hdrFltRuleDefEntry->pattern, AP_REG_DOTALL);
    hdrFltElement->action = hdrFltRuleDefEntry->action;
    hdrFltElement->size = hdrFltRuleDefEntry->size;
    if(hdrFltElement->preg == NULL) {
      return apr_psprintf(pool, "could not compile regular expression '%s' for %s header",
                          hdrFltElement->text, hdrFltRuleDefEntry->name);
    }
    apr_table_setn(outHdrFltTable, hdrFltRuleDefEntry->name, (char *)hdrFltElement);
  }
  return NULL;
}

/**
 * Returns string representation of filter type (for logging purposes)
 * @param pool To allocate string
 * @param type Rule type
 * @return Name of the directive used to configure the rule
 */
static char *qos_rfilter_type2text(apr_pool_t *pool, qs_rfilter_type_e type) {
  if(type == QS_DENY_REQUEST_LINE) return apr_pstrdup(pool, "QS_DenyRequestLine");
  if(type == QS_DENY_PATH) return apr_pstrdup(pool, "QS_DenyPath");
  if(type == QS_DENY_QUERY) return apr_pstrdup(pool, "QS_DenyQuery");
  if(type == QS_DENY_EVENT) return apr_pstrdup(pool, "QS_DenyEvent");
  if(type == QS_PERMIT_URI) return apr_pstrdup(pool, "QS_PermitUri");
  return apr_pstrdup(pool, "UNKNOWN");
}

/**
 * Sets unique apache instance id (hopefully) to the global m_hostcore variable
 * @param ptemp Pool to allocate memory from
 * @param s Base server record
 */
static void qos_hostcode(apr_pool_t *ptemp, server_rec *s) {
  char *key = apr_psprintf(ptemp, "%s%s%s%d%s"
#ifdef ap_http_scheme
/* Apache 2.2 */
                           "%s"
#endif
                           "%s",
                           s->defn_name ? s->defn_name : "",
                           s->server_admin ? s->server_admin : "",
                           s->server_hostname ? s->server_hostname : "",
                           s->addrs ? s->addrs->host_port : 0,
                           s->path ? s->path : "",
                           s->error_fname ? s->error_fname : ""
#ifdef ap_http_scheme
/* Apache 2.2 */
                           ,s->server_scheme ? s->server_scheme : ""
#endif
                           );
  int len = strlen(key);
  int i;
  char *p;
  for(p = key, i = len; i; i--, p++) {
    m_hostcode = m_hostcode * 33 + *p;
  }
}

/**
 * temp file name for the main/virtual serve
 * @param pool Pool to allocate the file name from
 * @param s Server record
 * @return absolute file name
 */
static char *qos_tmpnam(apr_pool_t *pool, server_rec *s) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(s->module_config, 
                                                                &qos_module);
  const char *path = NULL;
  char *ret;
  char *file;
  if(apr_temp_dir_get(&path, pool) != APR_SUCCESS) {
    path = apr_pstrdup(pool, "/var/tmp");
  }
  if(sconf && sconf->mfile) {
    path = sconf->mfile;
  }
  ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
               QOS_LOGD_PFX"temporary directory for semaphores/shared memory: %s"
               " (use QS_SemMemFile to override it).", path);
  if(s) {
    unsigned int scode = 0;
    char *key = apr_psprintf(pool, "%u%s.%s.%d",
                             m_hostcode,
                             s->is_virtual ? "v" : "b",
                             s->server_hostname == NULL ? "-" : s->server_hostname,
                             s->addrs == NULL ? 0 : s->addrs->host_port);
    int len = strlen(key);
    int i;
    char *p;
    for(p = key, i = len; i; i--, p++) {
      scode = scode * 33 + *p;
    }
    file = apr_psprintf(pool, "%u", scode);
  } else {
    file = apr_psprintf(pool, "%u", m_hostcode);
  }
  file[0] += 25; /* non numeric */
  apr_filepath_merge(&ret, path, file, APR_FILEPATH_NATIVE, pool);
  ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
               QOS_LOGD_PFX"temporary file: %s", ret);
  return ret;
}

/**
 * QS_LimitRequestBody settings. Environment variable (dynamic) has higher prio than
 * configuration (static) value.
 * @param r
 * @param sconf
 * @param dconf
 */
static apr_off_t qos_maxpost(request_rec *r, qos_srv_config *sconf, 
                             qos_dir_config *dconf) {
  if(r->subprocess_env) {
    const char *bytes = apr_table_get(r->subprocess_env, "QS_LimitRequestBody");
    if(bytes) {
      apr_off_t s;
#ifdef ap_http_scheme
      /* Apache 2.2 */
      char *errp = NULL;
      if(APR_SUCCESS == apr_strtoff(&s, bytes, &errp, 10)) {
        return s;
      }
#else
      if((s = apr_atoi64(bytes)) >= 0) {
        return s;
      }
#endif
    }
  }
  if(dconf->maxpost != -1) {
    return dconf->maxpost;
  }
  return sconf->maxpost;
}


/**
 * Similar to strstr but restricting the length of s1 (supports strings which
 * are not NULL terminated).
 *
 * @param s1 String to search in
 * @param s2 Pattern to ind
 * @param len Length of s1
 * @return pointer to the beginning of the substring s2 within s1, or NULL
 *         if the substring is not found
 */
static char *qos_strnstr(const char *s1, const char *s2, int len) {
  const char *e1 = &s1[len-1];
  char *p1, *p2;
  if (*s2 == '\0') {
    /* an empty s2 */
    return((char *)s1);
  }
  while(1) {
    for ( ; (*s1 != '\0') && (s1 <= e1) && (apr_tolower(*s1) != apr_tolower(*s2)); s1++);
    if (*s1 == '\0' || s1 > e1) {
      return(NULL);
    }
    /* found first character of s2, see if the rest matches */
    p1 = (char *)s1;
    p2 = (char *)s2;
    for (++p1, ++p2; (apr_tolower(*p1) == apr_tolower(*p2)) && (p1 <= e1); ++p1, ++p2) {
      if((p1 > e1) && (*p2 != '\0')) {
        // reached the end without match
        return NULL;
      }
      if (*p2 == '\0') {
        /* both strings ended together */
        return((char *)s1);
      }
    }
    if (*p2 == '\0') {
      /* second string ended, a match */
      break;
    }
    /* didn't find a match here, try starting at next character in s1 */
    s1++;
  }
  return((char *)s1);
}

/**
 * Determines, if the client IP shall be excluded from rule enforcement
 *
 * @param connection Connection to get the IP
 * @param exclude_ip Table containing the rules
 * @return 1 on match otherwise 0
 */
static int qos_is_excluded_ip(conn_rec *connection, apr_table_t *exclude_ip) {
  conn_rec *c = connection;
  if(apr_table_elts(exclude_ip)->nelts > 0) {
    int i;
    apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(exclude_ip)->elts;
    for(i = 0; i < apr_table_elts(exclude_ip)->nelts; i++) {
      if(entry[i].val[0] == 'r') {
        if(strncmp(entry[i].key, QS_CONN_REMOTEIP(c), strlen(entry[i].key)) == 0) {
          return 1;
        }
      } else {
        if(strcmp(entry[i].key, QS_CONN_REMOTEIP(c)) == 0) {
          return 1;
        }
      }
    }
  }
  return 0;
}

/**
 * Comperator (ip search) for the client ip store qos_cc_*() 
 * functions (used by bsearch/qsort)
 */
static int qos_cc_comp(const void *_pA, const void *_pB) {
  qos_s_entry_t *pA=*(( qos_s_entry_t **)_pA);
  qos_s_entry_t *pB=*(( qos_s_entry_t **)_pB);
  if(pA->ip6[0] > pB->ip6[0]) return 2;
  if(pA->ip6[0] < pB->ip6[0]) return -2;
  if(pA->ip6[1] > pB->ip6[1]) return 1;
  if(pA->ip6[1] < pB->ip6[1]) return -1;
  return 0;
}

static int qos_cc_compv4(const void *_pA, const void *_pB) {
  qos_s_entry_t *pA=*(( qos_s_entry_t **)_pA);
  qos_s_entry_t *pB=*(( qos_s_entry_t **)_pB);
  if(pA->ip6[1] > pB->ip6[1]) return 1;
  if(pA->ip6[1] < pB->ip6[1]) return -1;
  return 0;
}

/**
 * Comperator (time search) for the client ip store qos_cc_*() 
 * functions (used by bsearch/qsort)
 */
static int qos_cc_comp_time(const void *_pA, const void *_pB) {
  qos_s_entry_t *pA=*(( qos_s_entry_t **)_pA);
  qos_s_entry_t *pB=*(( qos_s_entry_t **)_pB);
  if(pA->time > pB->time) return 1;
  if(pA->time < pB->time) return -1;
  return 0;
}

/**
 * creates new per client store
 * @param pool Persistent process pool
 * @param srec Server rec for sem/mutex
 * @param size Number of entries
 * @param limitTable Table of "QS_Limit" events
 * @return pointer to the per client data array
 */
static qos_s_t *qos_cc_new(apr_pool_t *pool, server_rec *srec, int size,
                           apr_table_t *limitTable) {
  char *file = "-";
  apr_shm_t *clientMem;  // per client memory table
  apr_shm_t *limitMem; // "limit" memory table
  apr_status_t res;
  int limitTableSize = apr_table_elts(limitTable)->nelts;
  int limitMemSize = 0;
  int clientMemSize = APR_ALIGN_DEFAULT(sizeof(qos_s_t)) + 
    (APR_ALIGN_DEFAULT(sizeof(qos_s_entry_t)) * size) + 
    (2 * APR_ALIGN_DEFAULT(sizeof(qos_s_entry_t *)) * size);
  int i;
  qos_s_t *clientDataArray;
  qos_s_entry_t *clientDataEntry;
  qos_s_entry_limit_t *limitTableEntry = NULL;
  clientMemSize = clientMemSize + 1024;
  if(limitTableSize > 0) {
    limitMemSize = APR_ALIGN_DEFAULT(sizeof(qos_s_entry_limit_t)) * limitTableSize * size;
    limitMemSize = limitMemSize + 1024;
  }
  /* use anonymous shm by default */
  if(limitTableSize > 0) {
    apr_shm_create(&limitMem, limitMemSize, NULL, pool);
  }
  res = apr_shm_create(&clientMem, clientMemSize, NULL, pool);
  if(APR_STATUS_IS_ENOTIMPL(res)) {
    char *lfile = apr_psprintf(pool, "%s_cc_ml.mod_qos",
                               qos_tmpnam(pool, srec));
    file = apr_psprintf(pool, "%s_cc_m.mod_qos",
                        qos_tmpnam(pool, srec));
#ifdef ap_http_scheme
    /* Apache 2.2 */
    if(limitTableSize > 0) {
      apr_shm_remove(lfile, pool);
    }
    apr_shm_remove(file, pool);
#endif
    if(limitTableSize > 0) {
      apr_shm_create(&limitMem, limitMemSize, lfile, pool);
    }
    res = apr_shm_create(&clientMem, clientMemSize, file, pool);
  }
  ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, srec, 
               QOS_LOGD_PFX"create shared memory (client control)(%s): %d bytes",
               file, clientMemSize + limitMemSize);
  if(res != APR_SUCCESS) {
    char buf[MAX_STRING_LEN];
    apr_strerror(res, buf, sizeof(buf));
    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, srec,
                 QOS_LOG_PFX(002)"failed to create shared memory (client control)(%s): "
                 "%s (%d bytes)",
                 file, buf, clientMemSize);
    return NULL;
  }
  clientDataArray = apr_shm_baseaddr_get(clientMem);
  clientDataArray->m = clientMem;
  clientDataArray->generation_locked = -1;
  if(limitTableSize > 0) {
    apr_table_entry_t *te = (apr_table_entry_t *)apr_table_elts(limitTable)->elts;
    limitTableEntry = apr_shm_baseaddr_get(limitMem);
    clientDataArray->limitTable = apr_table_make(pool, limitTableSize+10);
    for(i = 0; i < limitTableSize; i++) {
      char *eventName = apr_pstrdup(pool, te[i].key);
      qos_s_entry_limit_conf_t *eventLimitConf = apr_pcalloc(pool, sizeof(qos_s_entry_limit_conf_t));
      qos_s_entry_limit_conf_t *src = (qos_s_entry_limit_conf_t*)te[i].val;
      eventLimitConf->limit = src->limit;
      eventLimitConf->limitTime = src->limitTime;
      eventLimitConf->eventClearStr = apr_pstrcat(pool, eventName, QS_LIMIT_CLEAR, NULL);
      eventLimitConf->eventDecStr = apr_pstrcat(pool, eventName, QS_LIMIT_DEC, NULL);
      eventLimitConf->condStr = NULL;
      eventLimitConf->preg = NULL;
      if(src->condStr) {
        eventLimitConf->condStr = apr_pstrdup(pool, src->condStr);
        eventLimitConf->preg = ap_pregcomp(pool, src->condStr, AP_REG_EXTENDED);
      }
      apr_table_addn(clientDataArray->limitTable, eventName, (char *)eventLimitConf);
    }
  } else {
    clientDataArray->limitTable = NULL;
  }
  clientDataArray->lock_file = apr_psprintf(pool, "%s_ccl.mod_qos", 
                              qos_tmpnam(pool, srec));
  ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, srec, 
               QOS_LOGD_PFX"create mutex (client control)(%s)",
               clientDataArray->lock_file);
  res = apr_global_mutex_create(&clientDataArray->lock, clientDataArray->lock_file, APR_LOCK_DEFAULT, pool);
  if(res != APR_SUCCESS) {
    char buf[MAX_STRING_LEN];
    apr_strerror(res, buf, sizeof(buf));
    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, srec,
                 QOS_LOG_PFX(004)"failed to create mutex (client control)(%s): %s", 
                 clientDataArray->lock_file, buf);
    apr_shm_destroy(clientDataArray->m);
    return NULL;
  }
#ifdef AP_NEED_SET_MUTEX_PERMS
  qos_unixd_set_global_mutex_perms(clientDataArray->lock);
#endif
  clientDataEntry = (qos_s_entry_t *)&clientDataArray[1];
  clientDataArray->ipd = (qos_s_entry_t **)&clientDataEntry[size];
  clientDataArray->timed = (qos_s_entry_t **)&clientDataArray->ipd[size];
  clientDataArray->num = 0;
  clientDataArray->max = size;
  clientDataArray->msize = clientMemSize;
  clientDataArray->connections = 0;
  clientDataArray->html = 0;
  clientDataArray->cssjs = 0;
  clientDataArray->img = 0;
  clientDataArray->other = 0;
  clientDataArray->notmodified = 0;
  for(i = 0; i < size; i++) {
    clientDataArray->ipd[i] = clientDataEntry;
    clientDataArray->timed[i] = clientDataEntry;
    if(limitTableSize > 0) {
      clientDataEntry->limit = limitTableEntry;
      limitTableEntry += limitTableSize;
    } else {
      clientDataEntry->limit = NULL;
    }
    clientDataEntry++;
  }
  clientDataArray->t = time(NULL);
  for(i = 0; i < QOS_LOG_MSGCT; i++) {
    clientDataArray->eventTotal[i] = 0;
    clientDataArray->eventLast[i] = 0;
  }
  return clientDataArray;
}

/**
 * Destroys the client data store
 */
static void qos_cc_free(qos_s_t *s) {
  /*
    We don't need to destroy locks or shared memory 
    manually as apr_global_mutex_create() and 
    apr_shm_create() register the cleanup methods 
    themself to the pool we used when allocating the
    locks/memory.
  if(s->lock) {
    apr_global_mutex_destroy(s->lock);
  }
  if(s->m) {
    apr_shm_destroy(s->m);
  }
  if(s->lm) {
    apr_shm_destroy(s->lm);
  }
  */
}

/** 
 * searches an entry
 * @param s Client store (locked)
 * @param pA IP to search
 * @param now Current time (update access to the entry)
 * @return client entry or NULL if not available
 */
static qos_s_entry_t **qos_cc_get0(qos_s_t *s, qos_s_entry_t *pA, time_t now) {
  qos_s_entry_t **pB;
  unsigned char *b = (void *)&pA->ip6[1];
  int mod = b[7] % m_qos_cc_partition;
  int max = (s->max / m_qos_cc_partition);
  int start = mod * max;
  if(m_ip_type == QS_IP_V4) {
    pB = bsearch((const void *)&pA, (const void *)&s->ipd[start], 
                 max, sizeof(qos_s_entry_t *), qos_cc_compv4);
  } else {
    pB = bsearch((const void *)&pA, (const void *)&s->ipd[start], 
                 max, sizeof(qos_s_entry_t *), qos_cc_comp);
  }
  if(pB) {
    if(now != 0) {
      s->t = now;
    }
    (*pB)->time = s->t;
  }
  return pB;
}

/**
 * inserts a new entry to the client data store
 * @param s Client store (locked)
 * @param pA IP to insert
 * @param now Current time (last access)
 * @return inserted entry
 */
static qos_s_entry_t **qos_cc_set(qos_s_t *s, qos_s_entry_t *pA, time_t now) {
  qos_s_entry_t **pB;
  unsigned char *b = (void *)&pA->ip6[1];
  int mod = b[7] % m_qos_cc_partition;
  int max = (s->max / m_qos_cc_partition);
  int start = mod * max;
  s->t = now;
  qsort(&s->timed[start], max, sizeof(qos_s_entry_t *), qos_cc_comp_time);
  if(s->num < s->max) {
    s->num++;
  }
  pB = &s->timed[start];
  (*pB)->ip6[0] = pA->ip6[0];
  (*pB)->ip6[1] = pA->ip6[1];
  (*pB)->time = now;
  if(m_ip_type == QS_IP_V4) {
    qsort(&s->ipd[start], max, sizeof(qos_s_entry_t *), qos_cc_compv4);
  } else {
    qsort(&s->ipd[start], max, sizeof(qos_s_entry_t *), qos_cc_comp);
  }

  (*pB)->vip = 0;
  (*pB)->lowrate = 0;
  (*pB)->lowratestatus = 0;
  (*pB)->block = 0;
  (*pB)->blockMsg = 0;
  (*pB)->blockTime = 0;
  if(s->limitTable) {
    int i;
    for(i = 0; i < apr_table_elts(s->limitTable)->nelts; i++) {
      (*pB)->limit[i].limit = 0;
      (*pB)->limit[i].limitTime = 0;
    }
  }
  (*pB)->interval = now;
  (*pB)->req = 0;
  (*pB)->req_per_sec = 0;
  (*pB)->req_per_sec_block_rate = 0;
  (*pB)->event_req = 0;
  (*pB)->serialize = 0;
  (*pB)->serializeQueue = 0;
  (*pB)->html = 1;
  (*pB)->cssjs = 1;
  (*pB)->img = 1;
  (*pB)->other = 1;
  (*pB)->notmodified = 1;
  (*pB)->events = 0;
  return pB;
}

/**
 * searches or inserts (if not available) an entry from/to the client data store
 * @param s Client store (locked)
 * @param pA IP to insert
 * @param now Current time (last access)
 * @return inserted entry
 */
static qos_s_entry_t **qos_cc_getOrSet(qos_s_t *s, qos_s_entry_t *pA, time_t now) {
  qos_s_entry_t **clientEntry = clientEntry = qos_cc_get0(s, pA, now);
  if(!clientEntry) {
    clientEntry = qos_cc_set(s, pA, now != 0 ? now : time(NULL));
  }
  return clientEntry;
}

static int qos_isnum(const char *x) {
  const char *p = x;
  if(x == NULL || x[0] == 0) {
    return 0;
  }
  while(p && p[0]) {
    if(!apr_isdigit(p[0])) {
      return 0;
    }
    p++;
  }
  return 1;
}

/* 000-255 */
int qos_dec32c(const char *x) {
  char buf[4];
  strncpy(buf, x, 3);
  buf[3] = '\0';
  return atoi(buf);
}

int qos_dec22c(const char *x) {
  char buf[4];
  strncpy(buf, x, 2);
  buf[2] = '\0';
  return atoi(buf);
}

/**
 * hex value for the char
 * @param x
 * @return hex value
 */
int qos_hex2c(const char *x) {
  int i, ch;
  ch = x[0];
  if (isdigit(ch)) {
    i = ch - '0';
  }else if (isupper(ch)) {
    i = ch - ('A' - 10);
  } else {
    i = ch - ('a' - 10);
  }
  i <<= 4;
  
  ch = x[1];
  if (isdigit(ch)) {
    i += ch - '0';
  } else if (isupper(ch)) {
    i += ch - ('A' - 10);
  } else {
    i += ch - ('a' - 10);
  }
  return i;
}

#define QOS_ISHEX(x) (((x >= '0') && (x <= '9')) || \
                      ((x >= 'a') && (x <= 'f')) || \
                      ((x >= 'A') && (x <= 'F')))


/**
 * url unescaping (%xx, \xHH, '+')
 * optional decoding:
 * - uni: MS IIS unicode %uXXXX
 * - ansi: ansi c esc (\n, \r, ...), not implemented
 * - char: charset conv, not implemented
 * - html: (amp/angelbr, &#xHH;, &#DDD;, &#DD;), not implemented ('&' is delimiter)
 */
static int qos_unescaping(char *x, int mode, int *error) {
  /* start with standard url decoding*/
  int i, j, ch;
  if(x == 0) {
    return 0;
  }
  if(x[0] == '\0') {
    return 0;
  }
  for(i = 0, j = 0; x[i] != '\0'; i++, j++) {
    ch = x[i];
    if(ch == '%') {
      if(QOS_ISHEX(x[i + 1]) && QOS_ISHEX(x[i + 2])) {
        /* url %xx */
        ch = qos_hex2c(&x[i + 1]);
        i += 2;
      } else if((mode & QOS_DEC_MODE_FLAGS_UNI) && 
                ((x[i + 1] == 'u') || (x[i + 1] == 'U')) &&
                QOS_ISHEX(x[i + 2]) &&
                QOS_ISHEX(x[i + 3]) &&
                QOS_ISHEX(x[i + 4]) &&
                QOS_ISHEX(x[i + 5])) {
        /* unicode %uXXXX */
        ch = qos_hex2c(&x[i + 4]);
        if((ch > 0x00) && (ch < 0x5f) &&
           ((x[i + 2] == 'f') || (x[i + 2] == 'F')) &&
           ((x[i + 3] == 'f') || (x[i + 3] == 'F'))) {
          ch += 0x20;
        }
        i += 5;
      } else {
        (*error)++;
      }
    } else if((ch == '\\') &&
              (mode & QOS_DEC_MODE_FLAGS_UNI) &&
              ((x[i + 1] == 'u') || (x[i + 1] == 'U'))) {
      if(QOS_ISHEX(x[i + 2]) &&
         QOS_ISHEX(x[i + 3]) &&
         QOS_ISHEX(x[i + 4]) &&
         QOS_ISHEX(x[i + 5])) {
        /* unicode \uXXXX */
        ch = qos_hex2c(&x[i + 4]);
        if((ch > 0x00) && (ch < 0x5f) &&
           ((x[i + 2] == 'f') || (x[i + 2] == 'F')) &&
           ((x[i + 3] == 'f') || (x[i + 3] == 'F'))) {
          ch += 0x20;
        }
        i += 5;
      } else {
        (*error)++;
      }
    } else if(ch == '\\' && (x[i + 1] == 'x')) {
      if(QOS_ISHEX(x[i + 2]) && QOS_ISHEX(x[i + 3])) {
        /* url \xHH */
        ch = qos_hex2c(&x[i + 2]);
        i += 3;
      } else {
        (*error)++;
      }
    } else if(ch == '+') {
      ch = ' ';
    }
    x[j] = ch;
  }
  x[j] = '\0';
  return j;
}

/**
 * returns the request id from mod_unique_id (if available)
 */
static const char *qos_unique_id(request_rec *r, const char *eid) {
  const char *uid = apr_table_get(r->subprocess_env, "UNIQUE_ID");
  if(eid) {
    apr_table_set(r->notes, "error-notes", eid);
    apr_table_set(r->subprocess_env, QS_ErrorNotes, eid);
  }
  if(uid == NULL) {
    /* generate simple id if mod_unique_id has not been not loaded */
    qos_unique_id_t id;
    char *uidstr;
    int len;

    m_unique_id.unique_id_counter++;
    id.request_time = r->request_time;
    id.in_addr = m_unique_id.in_addr;
#if APR_HAS_THREADS
    id.tid = apr_os_thread_current();
#endif
    id.conn = r->connection->id;
    id.unique_id_counter = m_unique_id.unique_id_counter;
    uidstr = (char *)apr_pcalloc(r->pool, apr_base64_encode_len(sizeof(qos_unique_id_t)));
    len = qos_encode64_binary(uidstr, (const char *)&id, sizeof(qos_unique_id_t));
    uidstr[len-2] = (id.unique_id_counter%8)+50;
    uid = uidstr;
    apr_table_set(r->subprocess_env, "UNIQUE_ID", uid);
  }
  return uid;
}

static void qos_log_env(request_rec *r, const char *handler) {
  char *msg = "";
  int i;
  apr_table_entry_t *e = (apr_table_entry_t *) apr_table_elts(r->subprocess_env)->elts;
  for (i = 0; i < apr_table_elts(r->subprocess_env)->nelts; ++i) {
    msg = apr_psprintf(r->pool, "%s=%s;%s",  e[i].key, e[i].val, msg);
  }
  ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_NOTICE, 0, r,
                QOS_LOG_PFX(210)"ENV %s %s %s", handler, msg, qos_unique_id(r, NULL));
  return;
}

static char *qos_ipv6_hash(request_rec *r, const char *var) {
  char *md = ap_md5_binary(r->pool, (unsigned char *)var, strlen(var));
  char *hash = apr_pcalloc(r->pool, 64);
  char *d = hash;
  int c = 0;
  while(md[0]) {
    d[0] = md[0];
    d++;
    c++;
    md++;
    if(c == 4 && md[0]) {
      c=0;
      d[0] = ':';
      d++;
    }
  }
  d[0] = '\0';
  return hash;
}

static const char *qos_forwardedfor_fromHeader(request_rec *r, const char *header) {
  const char *forwardedfor = apr_table_get(r->headers_in, header);
  if(forwardedfor == NULL && r->prev) {
    // internal redirect?
    forwardedfor = apr_table_get(r->prev->headers_in, header);
  }
  if(forwardedfor == NULL && r->main) {
    // internal redirect?
    forwardedfor = apr_table_get(r->main->headers_in, header);
  }
  return forwardedfor;
}

static const char *qos_forwardedfor_fromSSL(request_rec *r) {
  if(qos_ssl_var) {
    const char *dn = qos_ssl_var(r->pool, r->server, r->connection, r, "SSL_CLIENT_S_DN");
    const char *issuer = qos_ssl_var(r->pool, r->server, r->connection, r, "SSL_CLIENT_I_DN");
    char *header = apr_pstrcat(r->pool, dn, issuer, NULL);
    if(header && header[0]) {
      return header;
    }
  }
  return NULL;
}

static const char *qos_pseudoip(request_rec *r, const char *header) {
  const char *forwardedfor = NULL;
  if(strcmp("SSL_CLIENT_S_DN", header) == 0) {
    forwardedfor = qos_forwardedfor_fromSSL(r);
  } else {
    forwardedfor = qos_forwardedfor_fromHeader(r, header);
  }
  if(forwardedfor && forwardedfor[0]) {
    return qos_ipv6_hash(r, forwardedfor);
  }
  return NULL;
}

static const char *qos_forwardedfor(request_rec *r, const char *header) {
  const char *forwardedfor = NULL;
  if(header[0] == '#') {
    forwardedfor = qos_pseudoip(r, &header[1]);
  } else {
    forwardedfor = qos_forwardedfor_fromHeader(r, header);
  }
  return forwardedfor;
}

/**
 * Returns the client IP, either from the connection
 * of from the forwarded-for header if configured
 *
 * @param r Request to get the IP from the header
 * @param sconf
 * @param cconf (if available) to get the real IP from
 * @param caller Which caller of the method
 * @param ip6 The client's IP address to be used (pointer to array of unsigned long (2))
 * @return The client's IP address as a string (for logging)
 */
static const char *qos_get_clientIP(request_rec *r, qos_srv_config *sconf,
                                    qs_conn_ctx *cconf, const char *caller,
                                    apr_uint64_t *ip6) {
  const char *forwardedForLogIP;
  if(sconf->qos_cc_forwardedfor) {
    const char *forwardedfor = qos_forwardedfor(r, sconf->qos_cc_forwardedfor);
    if(forwardedfor) {
      if(qos_ip_str2long(forwardedfor, ip6) == 0) {
        if(apr_table_get(r->notes, "QOS_LOG_PFX069") == NULL) {
          ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                        QOS_LOG_PFX(069)"no valid IP header found (@%s):"
                        " invalid header value '%s',"
                        " fallback to connection's IP %s, id=%s",
                        caller,
                        forwardedfor,
                        QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : 
                        QS_CONN_REMOTEIP(r->connection),
                        qos_unique_id(r, "069"));
          apr_table_set(r->notes, "QOS_LOG_PFX069", "log once");
          QS_INC_EVENT(sconf, 69);
        }
      } else {
        // done
        return forwardedfor;
      }
    } else {
      if(apr_table_get(r->notes, "QOS_LOG_PFX069") == NULL) {
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                      QOS_LOG_PFX(069)"no valid IP header found (@%s):"
                      " header '%s' not available,"
                      " fallback to connection's IP %s, id=%s",
                      caller,
                      sconf->qos_cc_forwardedfor,
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "069"));
        apr_table_set(r->notes, "QOS_LOG_PFX069", "log once");
        QS_INC_EVENT(sconf, 69);
      }
    }
  }
  // use the real IP
  if(cconf) {
    forwardedForLogIP = QS_CONN_REMOTEIP(cconf->mc);
    // works for real connections only (no HTTP/2)
    ip6[0] = cconf->ip6[0];
    ip6[1] = cconf->ip6[1];
  } else {
    // HTTP/2
    forwardedForLogIP = QS_CONN_REMOTEIP(r->connection);
    qos_ip_str2long(forwardedForLogIP, ip6);
  }
  return forwardedForLogIP;
}

/**
 * returns the version number of mod_qos
 * @param p Pool to alloc version string from
 * @return Version string
 */
static char *qos_revision(apr_pool_t *p) {
  return apr_pstrdup(p, g_revision);
}

/**
 * returns the request context
 */
static qs_req_ctx *qos_rctx_config_get(request_rec *r) {
  qs_req_ctx *rctx = ap_get_module_config(r->request_config, &qos_module);
  if(rctx == NULL) {
    rctx = apr_pcalloc(r->pool, sizeof(qs_req_ctx));
    rctx->entry = NULL;
    rctx->entry_cond = NULL;
    rctx->evmsg = NULL;
    rctx->is_vip = 0;
    rctx->event_entries = apr_table_make(r->pool, 1);
    rctx->maxpostcount = 0;
    rctx->cc_event_req_set = 0;
    rctx->cc_event_ip[0] = 0;
    rctx->cc_event_ip[1] = 0;
    rctx->cc_serialize_set = 0;
    rctx->cc_serialize_ip[0] = 0;
    rctx->cc_serialize_ip[1] = 0;
    rctx->srv_serialize_set = 0;
    rctx->body_window = NULL;
    rctx->response_delayed = 0;
    ap_set_module_config(r->request_config, &qos_module, rctx);
  }
  return rctx;
}

/**
 * Adds the defined mod_qos_ev id to the request context (creates
 * the req ctx if necessary).
 *
 * @param r
 * @param id ID to set, e.g. "L;" or "D;"
 */
static void qs_set_evmsg(request_rec *r, const char *id) {
  qs_req_ctx *rctx = qos_rctx_config_get(r);
  if(rctx->evmsg == NULL || (strstr(rctx->evmsg, id) == NULL)) {
    rctx->evmsg = apr_pstrcat(r->pool, id, rctx->evmsg, NULL);
  }
}

/**
 * Encrypts and base64 encodes the provided buffer
 * @param r
 * @param sconf Secret to use (sconf->key)
 * @param b Buffer to encrypt
 * @param l Length of the buffer
 * @return Encrypted string (or NULL on error)
 */
static char *qos_encrypt(request_rec *r, qos_srv_config *sconf, 
                         const unsigned char *b, int l) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  EVP_CIPHER_CTX cipher_ctx;
  EVP_CIPHER_CTX *cipher_ctx_p = &cipher_ctx;
  HMAC_CTX hmac;
  HMAC_CTX *hmac_p = &hmac;
#else
  EVP_CIPHER_CTX *cipher_ctx_p;
  HMAC_CTX *hmac_p;
#endif
  unsigned char hash[HMAC_MAX_MD_CBLOCK];
  unsigned int hashLen = HMAC_MAX_MD_CBLOCK;
  int buf_len = 0;
  int len = 0;
  unsigned char *buf = apr_pcalloc(r->pool, +
                                   EVP_MAX_IV_LENGTH +
                                   QOS_HASH_LEN +
                                   l +
                                   EVP_CIPHER_block_size(EVP_des_ede3_cbc()));
  
#if APR_HAS_RANDOM
  if(apr_generate_random_bytes(buf, EVP_MAX_IV_LENGTH) != APR_SUCCESS) {
    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
                  QOS_LOG_PFX(080)"Can't generate random data, id=%s",
                  qos_unique_id(r, NULL));
  }
#else
  if(!RAND_bytes(buf, EVP_MAX_IV_LENGTH)) {
    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
                  QOS_LOG_PFX(080)"Can't generate random data, id=%s",
                  qos_unique_id(r, NULL));
  }
#endif

  /* checksum */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  HMAC_CTX_init(hmac_p);
#else
  hmac_p = HMAC_CTX_new();
#endif
#ifndef OPENSSL_NO_MD5
  HMAC_Init_ex(hmac_p, sconf->rawKey, sconf->rawKeyLen, EVP_md5(), NULL);
#else
  HMAC_Init_ex(hmac_p, sconf->rawKey, sconf->rawKeyLen, EVP_sha256(), NULL);
#endif
  HMAC_Update(hmac_p, b, l);
  HMAC_Final(hmac_p, hash, &hashLen);
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  HMAC_CTX_cleanup(hmac_p);
#else
  HMAC_CTX_free(hmac_p);
#endif

  /* sym enc */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  EVP_CIPHER_CTX_init(cipher_ctx_p);
#else
  cipher_ctx_p = EVP_CIPHER_CTX_new();
#endif
  EVP_EncryptInit(cipher_ctx_p, EVP_des_ede3_cbc(), sconf->key, (unsigned char *)buf);

  // skip iv, enc(hash + data)
  buf_len = EVP_MAX_IV_LENGTH;
  if(!EVP_EncryptUpdate(cipher_ctx_p, &buf[buf_len], &len, hash, QOS_HASH_LEN)) {
    goto failed;
  }
  buf_len+=len;
  if(!EVP_EncryptUpdate(cipher_ctx_p, &buf[buf_len], &len, b, l)) {
    goto failed;
  }
  buf_len+=len;
  if(!EVP_EncryptFinal(cipher_ctx_p, &buf[buf_len], &len)) {
    goto failed;
  }
  buf_len+=len;

#if OPENSSL_VERSION_NUMBER < 0x10100000L
  EVP_CIPHER_CTX_cleanup(cipher_ctx_p);
#else
  EVP_CIPHER_CTX_free(cipher_ctx_p);
#endif
  
  /* b64 encode */
  {
    char *data = (char *)apr_pcalloc(r->pool, 1 + apr_base64_encode_len(buf_len));
    len = apr_base64_encode(data, (const char *)buf, buf_len);
    data[len] = '\0';
    return data;
  }

 failed:
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  EVP_CIPHER_CTX_cleanup(cipher_ctx_p);
#else
  EVP_CIPHER_CTX_free(cipher_ctx_p);
#endif
  if(QS_ISDEBUG(r->server)) {
    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                  QOS_LOGD_PFX"qos_encrypt() encryption operation failed, id=%s",
                  qos_unique_id(r, NULL));
  }
  return NULL;
}

/**
 * Decryptes the base64 encoded string (see qos_encrypt()).
 * @param r
 * @param sconf To access the secret
 * @param ret_buf Pointer to the decypted data (result), NULL if decyption fails
 * @param value Base64 encded string to decrypt
 * @return Length of the decypted data (0 if decyption failed)
 */
static int qos_decrypt(request_rec *r, qos_srv_config* sconf, 
                       unsigned char **ret_buf, const char *value) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  EVP_CIPHER_CTX cipher_ctx;
  EVP_CIPHER_CTX *cipher_ctx_p = &cipher_ctx;
#else
  EVP_CIPHER_CTX *cipher_ctx_p;
#endif

  /* decode */
  char *dec = (char *)apr_pcalloc(r->pool, 1 + apr_base64_decode_len(value));
  int dec_len = apr_base64_decode(dec, value);
  *ret_buf = NULL;
  
  if(dec_len < (EVP_MAX_IV_LENGTH + QOS_HASH_LEN)) {
    if(QS_ISDEBUG(r->server)) {
      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                    QOS_LOGD_PFX"qos_decrypt() base64 decoding failed, id=%s",
                    qos_unique_id(r, NULL));
    }
    return 0;
  } else {
    /* decrypt */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
    HMAC_CTX hmac;
    HMAC_CTX *hmac_p = &hmac;
#else
    HMAC_CTX *hmac_p;
#endif
    unsigned char hash[HMAC_MAX_MD_CBLOCK];
    unsigned int hashLen = HMAC_MAX_MD_CBLOCK;
    int len = 0;
    int buf_len = 0;
    unsigned char *buf;
    dec_len -= EVP_MAX_IV_LENGTH;
    buf = apr_pcalloc(r->pool, dec_len);

    /* sym dec */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
    EVP_CIPHER_CTX_init(cipher_ctx_p);
#else
    cipher_ctx_p = EVP_CIPHER_CTX_new();
#endif
    EVP_DecryptInit(cipher_ctx_p, EVP_des_ede3_cbc(), sconf->key, (unsigned char *)dec);
    if(!EVP_DecryptUpdate(cipher_ctx_p, (unsigned char *)&buf[buf_len], &len,
                          (const unsigned char *)&dec[EVP_MAX_IV_LENGTH], dec_len)) {
      goto failed;
    }
    buf_len+=len;
    if(!EVP_DecryptFinal(cipher_ctx_p, (unsigned char *)&buf[buf_len], &len)) {
      goto failed;
    }
    buf_len+=len;

#if OPENSSL_VERSION_NUMBER < 0x10100000L
    EVP_CIPHER_CTX_cleanup(cipher_ctx_p);
#else
    EVP_CIPHER_CTX_free(cipher_ctx_p);
#endif

    // hash + data
    if(buf_len < (QOS_HASH_LEN + 1)) {
      if(QS_ISDEBUG(r->server)) {
        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                      QOS_LOGD_PFX"qos_decrypt() misshing hash, id=%s",
                      qos_unique_id(r, NULL));
      }
      return 0;
    }

    /* checksum */
    buf_len -= QOS_HASH_LEN;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
    HMAC_CTX_init(hmac_p);
#else
    hmac_p = HMAC_CTX_new();
#endif
#ifndef OPENSSL_NO_MD5
    HMAC_Init_ex(hmac_p, sconf->rawKey, sconf->rawKeyLen, EVP_md5(), NULL);
#else
    HMAC_Init_ex(hmac_p, sconf->rawKey, sconf->rawKeyLen, EVP_sha256(), NULL);
#endif
    HMAC_Update(hmac_p, &buf[QOS_HASH_LEN], buf_len);
    HMAC_Final(hmac_p, hash, &hashLen);
#if OPENSSL_VERSION_NUMBER < 0x10100000L
    HMAC_CTX_cleanup(hmac_p);
#else
    HMAC_CTX_free(hmac_p);
#endif
    if(hashLen > QOS_HASH_LEN) {
      // we don't keep more than 16 bytes
      hashLen = QOS_HASH_LEN;
    }
    if(memcmp(hash, buf, hashLen) != 0) {
      if(QS_ISDEBUG(r->server)) {
        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                      QOS_LOGD_PFX"qos_decrypt() invalid hash, id=%s",
                      qos_unique_id(r, NULL));
      }
      return 0;
    }

    /* decrypted and valid */
    *ret_buf = &buf[QOS_HASH_LEN];
    return buf_len;
  }

 failed:
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  EVP_CIPHER_CTX_cleanup(cipher_ctx_p);
#else
  EVP_CIPHER_CTX_free(cipher_ctx_p);
#endif
  if(QS_ISDEBUG(r->server)) {
    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                  QOS_LOGD_PFX"qos_decrypt() decryption operation failed, id=%s",
                  qos_unique_id(r, NULL));
  }
  return 0;
}

/**
 * Adds the user tracking cookie to r->headers_out if QOS_USER_TRACKING_NEW env variable
 * has been set.
 * @param r
 * @param sconf
 * @param status (302 or other)
 */
static void qos_send_user_tracking_cookie(request_rec *r, qos_srv_config* sconf, 
                                          int status) {
  const char *new_user = apr_table_get(r->subprocess_env, QOS_USER_TRACKING_NEW);
  if(new_user) {
    char *setCookieVal;
    apr_size_t retcode;
    char timeString[MAX_STRING_LEN];
    apr_time_exp_t timeEx;
    int new_user_len = strlen(new_user);
    int len = 2 + new_user_len;
    unsigned char *value = apr_pcalloc(r->pool, len + 1);
    char *encryptedVal;
    char *domain = NULL;
    apr_time_exp_gmt(&timeEx, r->request_time);
    apr_strftime(timeString, &retcode, sizeof(timeString), "%m", &timeEx);
#ifdef QS_INTERNAL_TEST
    {
      const char *m = apr_table_get(r->headers_in, "X-TEST-USER-TRACK-MONTH");
      if(m) {
        strcpy(timeString, m);
      }
    }
#endif
    memcpy(value, timeString, 2);
    memcpy(&value[2], new_user, new_user_len);
    value[len] = '\0';
    encryptedVal = qos_encrypt(r, sconf, value, len + 1);
    if(sconf->user_tracking_cookie_domain != NULL) {
      domain = apr_pstrcat(r->pool, "; Domain=", sconf->user_tracking_cookie_domain, NULL);
    }
    /* set cookie valid for 300 days or for this session only */
    setCookieVal = apr_psprintf(r->pool, "%s=%s; Path=/%s%s",
                      sconf->user_tracking_cookie, encryptedVal,
                      sconf->user_tracking_cookie_session < 1 ? "; Max-Age=25920000" : "",
                      domain != NULL ? domain : "");
    if(status != HTTP_MOVED_TEMPORARILY) {
      apr_table_add(r->headers_out, "Set-Cookie", setCookieVal);
    } else {
      apr_table_add(r->err_headers_out, "Set-Cookie", setCookieVal);
    }
  }
  return;
}

/**
 * Verifies and sets the user tracking cookie
 * - QOS_USER_TRACKING if the cookie was available
 * - QOS_USER_TRACKING_NEW if a new cookie needs to be set
 * - QOS_USER_TRACKING_RENEW if the cookie shall be renewed
 *
 * syntax: b64(enc(<month><UNIQUE_ID>))
 *
 * shall be called after(!) mod_unique_id has created an id
 *
 * @param r
 * @param sconf
 * @param value Cookie received from the client, possibly null (see qos_get_remove_cookie())
 */
static void qos_get_create_user_tracking(request_rec *r, qos_srv_config* sconf,
                                         const char *value) {
  const char *uid = qos_unique_id(r, NULL);
  const char *verified = NULL;
  const char *newUID = NULL;
  if(value != NULL) {
    int buf_len = 0;
    unsigned char *buf;
    buf_len = qos_decrypt(r, sconf, &buf, value);
    if(buf_len > 0) {
      verified = (char *)buf;
    }
  }
  if(verified == NULL) {
    newUID = uid;
    apr_table_set(r->subprocess_env, QOS_USER_TRACKING_NEW, newUID);
    qs_set_evmsg(r, "u;"); 
  } else if(strlen(verified) > 2) {
    apr_size_t retcode;
    char timeString[MAX_STRING_LEN];
    apr_time_exp_t timeEx;
    apr_time_exp_gmt(&timeEx, r->request_time);
    apr_strftime(timeString, &retcode, sizeof(timeString), "%m", &timeEx);
    if(strncmp(timeString, verified, 2) != 0) {
      /* renew, if not from this month */
      apr_table_set(r->subprocess_env, QOS_USER_TRACKING_NEW, &verified[2]);
      apr_table_set(r->subprocess_env, QOS_USER_TRACKING_RENEW, "1");
    }
    newUID = &verified[2];
  } else {
    newUID = uid;
    apr_table_set(r->subprocess_env, QOS_USER_TRACKING_NEW, newUID);
  }
  apr_table_set(r->subprocess_env, QOS_USER_TRACKING, newUID);
  return;
}

/**
 * Adds new milestone cookie to the response headers if QOS_MILESTONE_COOKIE 
 * has been set.
 * See qos_verify_milestone() about the syntax.
 */
static void qos_update_milestone(request_rec *r, qos_srv_config* sconf) {
  const char *new_ms = apr_table_get(r->subprocess_env, QOS_MILESTONE_COOKIE);
  if(new_ms) {
    apr_time_t now = apr_time_sec(r->request_time);
    int new_ms_len = strlen(new_ms);
    int len = sizeof(apr_time_t) + new_ms_len;
    unsigned char *value = apr_pcalloc(r->pool, len + 1);
    char *encryptedVal;

    apr_table_unset(r->subprocess_env, QOS_MILESTONE_COOKIE);
    memcpy(value, &now, sizeof(apr_time_t));
    memcpy(&value[sizeof(apr_time_t)], new_ms, new_ms_len);
    value[len] = '\0';
    encryptedVal = qos_encrypt(r, sconf, value, len);
    apr_table_add(r->headers_out, "Set-Cookie",
                  apr_psprintf(r->pool, "%s=%s; Path=/;",
                               QOS_MILESTONE_COOKIE, encryptedVal));
  }
  return;
}

/**
 * Verifies the milestone. Evaluates rule and enforces it. Does also set the
 * QOS_MILESTONE_COOKIE variable if a new milestone has been reached.
 *
 * milestone cookie syntax: b64(enc(<time><milestone>))
 *
 * @param r
 * @param sconf
 * @param value Cookie received from the client (contains the already reached milestones)
 * @return APR_SUCCESS if request is allowed, otherwise HTTP_FORBIDDEN 
 */

static int qos_verify_milestone(request_rec *r, qos_srv_config* sconf, const char *value) {
  char *the_request;
  int the_request_len;
  int escerr = 0;
  qos_milestone_t *milestone = NULL;
  qos_milestone_t *entries;
  int i;
  int ms = -1; // milestone the user has reached
  int required = -1; // required for this request
  apr_time_t age = 0; // milestone's age

  if(value != NULL) {
    int buf_len = 0;
    unsigned char *buf;
    buf_len = qos_decrypt(r, sconf, &buf, value);
    if(buf_len >= (sizeof(apr_time_t) + 1)) {
      apr_time_t *t = (apr_time_t *)buf;
      apr_time_t now = apr_time_sec(r->request_time);
      age = now - *t;
      if(now <= (*t + sconf->milestoneTimeout)) {
        ms = atoi((char *)&buf[sizeof(apr_time_t)]);
      }
    }
  }
  the_request = apr_pstrdup(r->pool, r->the_request);
  the_request_len = qos_unescaping(the_request, QOS_DEC_MODE_FLAGS_URL, &escerr);
  entries = (qos_milestone_t *)sconf->milestones->elts;
  for(i = 0; i < sconf->milestones->nelts; ++i) {
    milestone = &entries[i];
    if(qos_regexec_len(r->pool, milestone->preg, the_request, the_request_len) == 0) {
      required = milestone->num;
      break;
    }
  }
  if(milestone && (required >= 0)) {
    int severity = milestone->action == QS_DENY ? APLOG_ERR : APLOG_WARNING;
    if(ms < (required - 1)) {
      /* not allowed */
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|severity, 0, r,
                    QOS_LOG_PFX(047)"access denied, reached milestone '%d' (%s),"
                    " user has already passed '%s',"
                    " action=%s, c=%s, id=%s",
                    required, milestone->pattern,
                    ms == -1 ? "none" : apr_psprintf(r->pool, "%d", ms),
                    !sconf->log_only && milestone->action == QS_DENY ? 
                    "deny" : "log only (pass milestone)",
                    QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                    qos_unique_id(r, "047"));
      QS_INC_EVENT(sconf, 47);
      if(milestone->action == QS_DENY) {
        return HTTP_FORBIDDEN;
      }
    }
    if(milestone->thinktime > 0) {
      if(age < milestone->thinktime) {
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|severity, 0, r,
                      QOS_LOG_PFX(147)"access denied, reached milestone '%d' (%s),"
                      " earlier than expected (right after %"APR_TIME_T_FMT" instead of %d seconds),"
                      " action=%s, c=%s, id=%s",
                      required, milestone->pattern,
                      age, milestone->thinktime,
                      !sconf->log_only && milestone->action == QS_DENY ? 
                      "deny" : "log only (pass milestone)",
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "147"));
        QS_INC_EVENT(sconf, 147);
        if(milestone->action == QS_DENY) {
          return HTTP_FORBIDDEN;
        }
      }
    }
    if(required > ms) {
      /* update milestone */
      apr_table_set(r->subprocess_env, QOS_MILESTONE_COOKIE, apr_psprintf(r->pool, "%d", required));
    }
  }
  return APR_SUCCESS;
}


/**
 * Extracts the cookie from the request.
 * @param r
 * @param cookieName Name of the cookie to remove from the request headers
 * @param Cookie if available of NULL if not
 */
static char *qos_get_remove_cookie(request_rec *r, const char *cookieName) {
  const char *cookieHdr = apr_table_get(r->headers_in, "cookie");
  if(cookieHdr) {
    char *cn = apr_pstrcat(r->pool, cookieName, "=", NULL);
    char *pt = ap_strcasestr(cookieHdr, cn);
    char *p = NULL;
    while(pt && !p) {
      // ensure we found the real cookie (and not an ending b64 str)
      if(pt == cookieHdr) {
        // @beginning of the header
        p = pt;
        pt = NULL;
      } else {
        char pre = pt[-1];
        if(pre == ' ' ||
           pre == ';') {
          // @beginning of a cookie
          p = pt;
          pt = NULL;
        } else {
          // found patter somewhere else
          pt++;
          pt = ap_strcasestr(pt, cn);
        }
      }
    }
    if(p) {
      char *sp = p;
      char *value = NULL;
      p[0] = '\0'; /* terminates the beginning of the cookie header */
      sp--; /* deletes spaces "in front" of the qos cookie */
      while((sp > cookieHdr) && (sp[0] == ' ')) {
        sp[0] = '\0';
        sp--;
      }
      p = &p[strlen(cn)];
      value = ap_getword(r->pool, (const char **)&p, ';');
      while(p && (p[0] == ' ')) p++;
      /* skip a path, if there is any */
      if(p && (strncasecmp(p, "$path=", strlen("$path=")) == 0)) {
        ap_getword(r->pool, (const char **)&p, ';');
      }
      /* restore cookie header appending the part left*/
      if(p && p[0]) {
        if(cookieHdr[0]) {
          if(p[0] == ' ') {
            cookieHdr = apr_pstrcat(r->pool, cookieHdr, p, NULL);
          } else {
            cookieHdr = apr_pstrcat(r->pool, cookieHdr, " ", p, NULL);
          }
        } else {
          cookieHdr = apr_pstrcat(r->pool, p, NULL);
        }
      }
      if(strlen(cookieHdr) == 0) {
        apr_table_unset(r->headers_in, "cookie");
      } else {
        if((strncasecmp(cookieHdr, "$Version=", strlen("$Version=")) == 0) &&
           (strlen(cookieHdr) <= strlen("$Version=X; "))) {
          /* nothing left */
          apr_table_unset(r->headers_in, "cookie");
        } else {
          apr_table_set(r->headers_in, "cookie", cookieHdr);
        }
      }
      return value;
    }
  }
  return NULL;
}

/**
 * verifies the session cookie 0=failed, 1=succeeded
 */
static int qos_verify_session(request_rec *r, qos_srv_config* sconf) {
  int buf_len = 0;
  unsigned char *buf;
  char *value = qos_get_remove_cookie(r, sconf->cookie_name);
  if(value == NULL) {
    return 0;
  }
  buf_len = qos_decrypt(r, sconf, &buf, value);
  if(buf_len != sizeof(qos_session_t)) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                  QOS_LOG_PFX(021)"session cookie verification failed, "
                  "decoding failed, id=%s", qos_unique_id(r, "021"));
    QS_INC_EVENT(sconf, 21);
    return 0;
  } else {
    qos_session_t *s = (qos_session_t *)buf;
    if(s->time < (apr_time_sec(r->request_time) - sconf->max_age)) {
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                    QOS_LOG_PFX(023)"session cookie verification failed, "
                    "expired, id=%s", qos_unique_id(r, "023"));
      QS_INC_EVENT(sconf, 23);
      return 0;
    }
  }
  /* success */
  apr_table_set(r->notes, QS_REC_COOKIE, "");
  return 1;
}

/**
 * set/update the session cookie
 */
static void qos_set_session(request_rec *r, qos_srv_config *sconf) {
  qos_session_t *s = (qos_session_t *)apr_pcalloc(r->pool, sizeof(qos_session_t));
  char *cookie;
  char *session;
  qs_set_evmsg(r, "V;"); // log VIP session creation
  /* payload */
  s->time = time(NULL);
  session = qos_encrypt(r, sconf, (const unsigned char *)s, sizeof(qos_session_t));
  if(session == NULL) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                  QOS_LOG_PFX(025)"failed to create session cookie, id=%s",
                  qos_unique_id(r, "025"));
    QS_INC_EVENT(sconf, 25);
    return;
  }
  cookie = apr_psprintf(r->pool, "%s=%s; Path=%s; Max-Age=%d",
                        sconf->cookie_name, session,
                        sconf->cookie_path, sconf->max_age);
  apr_table_add(r->headers_out,"Set-Cookie", cookie);
  return;
}

/**
 * destroy shared memory and mutexes
 */
static void qos_destroy_act(qs_actable_t *act) {
  ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, NULL,
               QOS_LOGD_PFX"cleanup shared memory: %"APR_SIZE_T_FMT" bytes",
               act->size);
  act->child_init = 0;
  if(act->lock_file && act->lock_file[0]) {
    /*
      We don't need to destroy locks manually as
      apr_global_mutex_create() registers the cleanup
      method itself to the pool we used when allocating the
      lock.
    if(act->lock) {
      apr_global_mutex_destroy(act->lock);
    }
    */
    act->lock_file[0] = '\0';
    act->lock_file = NULL;
  }
  /*
    We don't need to destroy shared memory 
    manually as apr_shm_create() registers the
    cleanup method to the pool we used when
    allocating the memory.
  if(act->m) {
    apr_shm_destroy(act->m);
  }
  */
  apr_pool_destroy(act->pool);
}

/**
 * returns the persistent configuration (restarts)
 */
static qos_user_t *qos_get_user_conf(apr_pool_t *ppool) {
  void *v;
  qos_user_t *u;
  apr_pool_userdata_get(&v, QS_USR_SPE, ppool);
  u = v;
  if(v) {
    return v;
  }
  u = (qos_user_t *)apr_pcalloc(ppool, sizeof(qos_user_t));
  u->server_start = 0;
  u->act_table = apr_table_make(ppool, 2);
  apr_pool_userdata_set(u, QS_USR_SPE, apr_pool_cleanup_null, ppool);
  u->qos_cc = NULL;
  return u;
}

/**
 * increments the event counters for the specified event
 * @param ppool Process pool to fetch user ctx from
 * @param event Event number
 * @param locked Set this to 1 if user ctx is already locked
 */
static void qs_inc_eventcounter(apr_pool_t *ppool, int event, int locked) {
  qos_user_t *u = qos_get_user_conf(ppool);
  if(u->qos_cc == NULL) {
    return;
  }
  if(!locked) {
    apr_global_mutex_lock(u->qos_cc->lock);        /* @CRT49 */
  }
  u->qos_cc->eventTotal[event]++;
  u->qos_cc->eventLast[event]++;
  if(!locked) {
    apr_global_mutex_unlock(u->qos_cc->lock);      /* @CRT49 */
  }
}

static int qs_calc_maxClients(server_rec *bs, qos_srv_config *bsconf) {
  int maxThreads = 0;
  int maxDaemons = 0;
  int maxClientsCalc = 0;
  int maxClients = 0;
  
  ap_mpm_query(AP_MPMQ_MAX_DAEMONS, &maxDaemons);
  ap_mpm_query(AP_MPMQ_MAX_THREADS, &maxThreads);
  maxClientsCalc = (maxThreads == 0 ? 1 : maxThreads) * (maxDaemons == 0 ? 1 : maxDaemons);
  if(m_event_mpm) {
    /* QS_MaxClients = (AsyncRequestWorkerFactor + 1) * MaxRequestWorkers */
    maxClientsCalc = (m_event_mpm_worker_factor + 1) * maxClientsCalc;
  }
  if(bsconf->max_clients_conf > 0) {
    maxClients = bsconf->max_clients_conf;
  } else {
    maxClients = maxClientsCalc;
  }
  if(maxClients != maxClientsCalc) {
    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, bs, 
                 QOS_LOG_PFX(007)"calculated MaxClients/MaxRequestWorkers (max connections): %d,"
                 " applied limit: %d (QS_MaxClients)",
                 maxClientsCalc, maxClients);
  } else {
    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, bs, 
                 QOS_LOGD_PFX"calculated MaxClients/MaxRequestWorkers (max connections): %d",
                 maxClients);
  }
  return maxClients;
}

#ifdef QS_APACHE_24
/**
 * tells if server is terminating immediately or not
 */
static int qos_is_graceful() {
  if(ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_EXITING) {
    return 0;
  }
  if(ap_state_query(AP_SQ_CONFIG_GEN) == 0) {
    return 0;
  }
  return 1;
}
#else
/**
 * tells if server is terminating immediately or not
 */
static int qos_is_graceful() {
  int mpm_gen = 0;
  QOS_MY_GENERATION(mpm_gen);
  if(mpm_gen != m_generation) return 1;
  return 0;
}
#endif

/* clear all counters of the per client data store at graceful restart
   used to prevent counter grow due blocked/crashed client processes*/
static void qos_clear_cc(qos_user_t *u) {
  if(u->qos_cc) {
    qos_s_entry_t **entry;
    int i;
    apr_global_mutex_lock(u->qos_cc->lock);          /* @CRT37 */
    u->qos_cc->connections = 0;
    if(m_generation > 0) {
      // this process generation must not update the connections counter anymore
      u->qos_cc->generation_locked = m_generation;
    }
    entry = u->qos_cc->ipd;
    for(i = 0; i < u->qos_cc->max; i++) {
      (*entry)->event_req = 0;
      (*entry)->serialize = 0;
      entry++;
    }
    apr_global_mutex_unlock(u->qos_cc->lock);        /* @CRT37 */
  }
}

/**
 * destroys the act
 * shared memory must not be destroyed before graceful restart has
 * been finished due running requests still need the shared memory
 * till they have finished.
 * keep the memory leak as little as possible ...
 */
static apr_status_t qos_cleanup_shm(void *p) {
  qs_actable_t *act = p;
  qos_user_t *u = qos_get_user_conf(act->ppool);
  char *this_generation;
  char *last_generation;
  int i;
  apr_table_entry_t *entry;
  
  this_generation = apr_psprintf(act->ppool, "%d", m_generation);
  last_generation = apr_psprintf(act->pool, "%d", m_generation-1);
  qos_clear_cc(u);
  
  /* delete acts from the last graceful restart */
  entry = (apr_table_entry_t *)apr_table_elts(u->act_table)->elts;
  for(i = 0; i < apr_table_elts(u->act_table)->nelts; i++) {
    if(strcmp(entry[i].key, last_generation) == 0) {
      qs_actable_t *a = (qs_actable_t *)entry[i].val;
#ifdef QS_INTERNAL_TEST
      ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
                   QOS_LOGD_PFX"clear ACT generation '%s' at '%d'", last_generation, m_generation);
#endif
      qos_destroy_act(a);
    }
  }
  apr_table_unset(u->act_table, last_generation);

  if(qos_is_graceful()) {
    /* don't delete this act now, but at next server restart ... */
    apr_table_addn(u->act_table, this_generation, (char *)act);
  } else {
    if(u->qos_cc) {
      qos_cc_free(u->qos_cc);
      u->qos_cc = NULL;
    }
#ifdef QS_INTERNAL_TEST
    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
                 QOS_LOGD_PFX"clear ACT generation 'current' at '%d'", m_generation);
#endif
    qos_destroy_act(act);
  }
  return APR_SUCCESS;
}

/**
 * init the shared memory of the act
 *  act->serialize     <- start
    act->qsstatustimer <- start + sizeof(serialize)     
 *  act->conn          <- start + sizeof(serialize) + sizeof(time_t)
 *  act->conn->conn_ip <- start + sizeof(serialize) + sizeof(time_t) + sizeof(conn) * QS_MEM_SEG
 *                      + [max_ip]
 *  act->entry         <- 
 *                      + [rule_entries]
 *  act->event_limit   <-
 *                      + [event_limit_entries]
 */
static apr_status_t qos_init_shm(server_rec *s, qos_srv_config *sconf, qs_actable_t *act,
                                 apr_table_t *locRuleCfgTable, int maxClients) {
  char *file = "-";
  apr_status_t res;
  int i;
  int ruleEntries = apr_table_elts(locRuleCfgTable)->nelts;
  apr_table_entry_t *locRuleEntry = (apr_table_entry_t *)apr_table_elts(locRuleCfgTable)->elts;
  int event_limit_entries = sconf->event_limit_a->nelts;
  qs_acentry_t *actEntry = NULL;
  int max_ip = maxClients;

  act->size = ((max_ip+QS_DOUBLE_CONN) * QS_MEM_SEG * APR_ALIGN_DEFAULT(sizeof(qs_ip_entry_t))) +
    (ruleEntries * APR_ALIGN_DEFAULT(sizeof(qs_acentry_t))) +
    (event_limit_entries * APR_ALIGN_DEFAULT(sizeof(qos_event_limit_entry_t))) +
    APR_ALIGN_DEFAULT(sizeof(qs_conn_t)) +
    APR_ALIGN_DEFAULT(sizeof(qs_serial_t)) +
    APR_ALIGN_DEFAULT(sizeof(time_t)) +
    2048;
  /* use anonymous shm by default */
  res = apr_shm_create(&act->m, act->size, NULL, act->pool);
  if(APR_STATUS_IS_ENOTIMPL(res)) {
    file = apr_psprintf(act->pool, "%s_m.mod_qos",
                        qos_tmpnam(act->pool, s));
#ifdef ap_http_scheme
    /* Apache 2.2 */
    apr_shm_remove(file, act->pool);
#endif
    res = apr_shm_create(&act->m, act->size, file, act->pool);
  }
  ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, 
               QOS_LOGD_PFX"%s(%s), create shared memory (ACT)(%s): %"APR_SIZE_T_FMT" bytes"
               " (r=%d,ip=%d)", 
               s->server_hostname == NULL ? "-" : s->server_hostname,
               s->is_virtual ? "v" : "b",
               file,
               act->size,
               ruleEntries, max_ip);
  if(res != APR_SUCCESS) {
    char buf[MAX_STRING_LEN];
    apr_strerror(res, buf, sizeof(buf));
    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, 
                 QOS_LOG_PFX(002)"failed to create shared memory (ACT)(%s): %s"
                 " (%"APR_SIZE_T_FMT" bytes)",
                 file, buf, act->size);
    return res;
  } else {
    qs_serial_t *sp = apr_shm_baseaddr_get(act->m); 
    time_t *qsstatustimer = (time_t *)&sp[1];
    qs_conn_t *connEntryP = (qs_conn_t *)&qsstatustimer[1];
    qs_ip_entry_t *conn_ip = (qs_ip_entry_t *)&connEntryP[1];
    apr_time_t now = apr_time_now();
    act->serialize = sp;
    act->serialize->q1 = 0;
    act->serialize->q2 = 0;
    act->serialize->locked = 0;
    act->qsstatustimer = qsstatustimer;
    *act->qsstatustimer = 0;
    act->conn = connEntryP;
    act->conn->conn_ip_len = (max_ip + QS_DOUBLE_CONN) * QS_MEM_SEG;
    act->conn->conn_ip = conn_ip;
    act->conn->max_client = max_ip;
    act->conn->connections = 0;
    for(i = 0; i < act->conn->conn_ip_len; i++) {
      conn_ip->ip6[0] = 0;
      conn_ip->ip6[1] = 0;
      conn_ip->counter = 0;
      conn_ip->error = 0;
      conn_ip++;
    }
    if(ruleEntries) {
      act->entry = (qs_acentry_t *)conn_ip;
      actEntry = act->entry;
    } else {
      act->entry = NULL;
    }
    /* init rule entries (link data, init mutex) */
    for(i = 0; i < ruleEntries; i++) {
      qs_rule_ctx_t *rule = (qs_rule_ctx_t *)locRuleEntry[i].val;
      actEntry->next = &actEntry[1];
      actEntry->id = i;
      actEntry->url = rule->url;
      actEntry->url_len = strlen(actEntry->url);
      actEntry->event = rule->event;
      if(actEntry->event) {
        act->has_events++;
      }
      actEntry->regex = rule->regex;
      actEntry->condition = rule->condition;
      actEntry->regex_var = rule->regex_var;
      actEntry->limit = rule->limit;
      if(actEntry->limit == 0 ) {
        if((actEntry->condition == NULL) && (actEntry->event == NULL)) {
          ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, s,
                       QOS_LOG_PFX(003)"request level rule %s has no "
                       "concurrent request limitations",
                       actEntry->url);
        }
      }
      actEntry->kbytes_interval_us = now;
      actEntry->interval = apr_time_sec(now);
      actEntry->bytes = 0;
      actEntry->req_per_sec_limit = rule->req_per_sec_limit;
      actEntry->kbytes_per_sec_limit = rule->kbytes_per_sec_limit;
      actEntry->kbytes_per_sec = 0;
      actEntry->counter = 0;
      actEntry->lock = act->lock;
      if(i < ruleEntries - 1) {
        actEntry = actEntry->next;
      } else {
        actEntry->next = NULL;
      }
    }
    if(event_limit_entries == 0) {
      act->event_entry = NULL;
    } else {
      // source (config) event limit array
      qos_event_limit_entry_t *eventEntrySrc = (qos_event_limit_entry_t *)sconf->event_limit_a->elts;
      // target (act) event limit array
      qos_event_limit_entry_t *eventEntryDst;
      if(actEntry) {
        // end of the last act rule entry
        act->event_entry = (qos_event_limit_entry_t *)&actEntry[1];
      } else {
        // end of the last connection entry
        act->event_entry = (qos_event_limit_entry_t *)conn_ip;
      }
      eventEntryDst = act->event_entry;
      // set config
      for(i = 0; i < event_limit_entries; i++) {
        eventEntryDst->env_var = eventEntrySrc->env_var;
        eventEntryDst->eventDecStr = eventEntrySrc->eventDecStr;
        eventEntryDst->max = eventEntrySrc->max;
        eventEntryDst->seconds = eventEntrySrc->seconds;
        eventEntryDst->limit = 0;
        eventEntryDst->limitTime = 0;
        eventEntryDst->action = eventEntrySrc->action;
        eventEntryDst->condStr = eventEntrySrc->condStr;
        eventEntryDst->preg = eventEntrySrc->preg;
        eventEntryDst++;
        eventEntrySrc++;
      }
    }
  }
  return APR_SUCCESS;
}

/**
 * Loads the geo database. See QS_GEO_PATTERN about the file format.
 * @param pool To allocate memory from
 * @param geodb Data structore to initialize
 * @param msg Error message if something went wrong while loading the db
 * @param errors Number of errors
 * @return APR_SUCCESS if data could be loaded resp. lines have been counted
 */
static apr_status_t qos_loadgeo(apr_pool_t *pool, qos_geo_t *geodb,
                                char **msg, int *errors) {
  ap_regmatch_t ma[AP_MAX_REG_MATCH];
  ap_regex_t *preg;
  qos_geo_entry_t *entry = NULL;
  qos_geo_entry_t *last = NULL;

  int lines = 0;
  char line[HUGE_STRING_LEN];
  FILE *file;

  preg = ap_pregcomp(pool, QS_GEO_PATTERN, AP_REG_EXTENDED);
  if(preg == NULL) {
    // internal error
    *msg = apr_pstrdup(pool, "failed to compile regular"
                       " expression "QS_GEO_PATTERN);
    (*errors)++;
    return APR_INCOMPLETE;
  }
  
  file = fopen(geodb->path, "r");
  if(!file) {
    *msg = apr_psprintf(pool, "could not open file %s (%s)",
                        geodb->path, strerror(errno));
    (*errors)++;
    return APR_INCOMPLETE;
  }

  // check syntax and determine required memory size
  while(fgets(line, sizeof(line), file) != NULL) {
    if(strlen(line) > 0) {
      if(ap_regexec(preg, line, 0, NULL, 0) == 0) {
        lines++;
      } else {
        *msg = apr_psprintf(pool, "invalid entry in database: '%s'", line);
        (*errors)++;
      }
    }
  }
  if(*errors != 0) {
    return APR_INCOMPLETE;
  }
  
  geodb->size = lines;
  geodb->data = apr_pcalloc(pool, APR_ALIGN_DEFAULT(sizeof(qos_geo_entry_t)) * geodb->size);

  // load the file into the memory
  entry = geodb->data;
  fseek(file, 0, SEEK_SET);
  lines = 0;
  while(fgets(line, sizeof(line), file) != NULL) {
    lines++;
    if(strlen(line) > 0) {
      if(ap_regexec(preg, line, AP_MAX_REG_MATCH, ma, 0) == 0) {
        line[ma[1].rm_eo] = '\0';
        line[ma[2].rm_eo] = '\0';
        line[ma[3].rm_eo] = '\0';
        entry->start = atoll(&line[ma[1].rm_so]);
        entry->end = atoll(&line[ma[2].rm_so]);
        strncpy(entry->country, &line[ma[3].rm_so], 2);
        if(last) {
          if(entry->start < last->start) {
            *msg = apr_psprintf(pool, "wrong order/lines not sorted (line %d)",
                                lines);
            (*errors)++;
          }
        }
        last = entry;
        entry++;
      }
    }
  }

  fclose(file);
  if(*errors == 0) {
    return APR_SUCCESS;
  } else {
    return APR_INCOMPLETE;
  }
}

/**
 * Verifies if the string is a number
 * @param num Number to test
 * @param 1 if numeric (0 if not)
 */
static int qos_is_num(const char *num) {
  int i = 0;
  while(num[i]) {
    if(!isdigit(num[i])) {
      return 0;
    }
    i++;
  }
  return 1;
}

/**
 * Helper for the status viewer (unsigned long to char).
 */
static void qos_collect_ip(request_rec *r, qos_srv_config *sconf,
                           apr_table_t *entries, int limit,
                           int html) {
  int i = sconf->act->conn->conn_ip_len;
  qs_ip_entry_t *conn_ip = sconf->act->conn->conn_ip;
  apr_global_mutex_lock(sconf->act->lock);   /* @CRT8 */
  while(i) {
    if(conn_ip->ip6[0] || conn_ip->ip6[1]) {
      char *red = "style=\"background-color: rgb(240,153,155);\"";
      if(html) {
        apr_table_addn(entries, apr_psprintf(r->pool, "%s</td><td %s colspan=\"3\">%d",
                                             qos_ip_long2str(r->pool, conn_ip->ip6),
                                             ((limit != -1) && conn_ip->counter >= limit) ? red : "",
                                             conn_ip->counter), "");
      } else {
        apr_table_addn(entries, qos_ip_long2str(r->pool, conn_ip->ip6), apr_psprintf(r->pool, "%d", conn_ip->counter));
      }
    }
    conn_ip++;
    i--;
  }
  apr_global_mutex_unlock(sconf->act->lock); /* @CRT8 */
}


/**
 * Count's the number of free ip entries (for the status viewer only)
 */
static int qos_count_free_ip(qos_srv_config *sconf) {
  int c = sconf->act->conn->max_client;
  int i = sconf->act->conn->conn_ip_len;
  qs_ip_entry_t *conn_ip = sconf->act->conn->conn_ip;
  apr_global_mutex_lock(sconf->act->lock);   /* @CRT7 */
  while(i) {
    if((conn_ip->ip6[0] != 0) ||
       (conn_ip->ip6[1] != 0)) {
      c--;
    }
    conn_ip++;
    i--;
  }
  apr_global_mutex_unlock(sconf->act->lock); /* @CRT7 */
  return c > 0 ? c : 0;
}

/**
 * Checks the subprocess_env table for
 * event variable and returns its numeric value.
 *
 * @param r
 * @param variable Name of the variable to lookup
 * @return Number within the variable or 0 if not set
 */
static int get_qs_event(request_rec *r, const char *variable) {
  const char *eventStr = apr_table_get(r->subprocess_env, variable);
  if(eventStr == NULL) {
    return 0;
  }
  if(qos_is_num(eventStr) && (strlen(eventStr) > 0)) {
    int num = atoi(eventStr);
    if(num <= 0) {
      num = 1;
    }
    return num;
  }
  return 1;
}

/**
 * adds an ip entry (insert or increment)
 *
 * @param sconf
 * @param cconf Configuration record containing the ip table(s)
 * @param e Pointer to the IP entry
 *          NOTE: we can't sort the list since the address of this pointer
 *                must not be change (we don't keep the lock)
 * @return The number of connections open by this IP
 */
static int qos_inc_ip(qos_srv_config *sconf, 
                      qs_conn_ctx *cconf, qs_ip_entry_t **e) {
  int num = -1;
  qs_ip_entry_t *free = NULL;
  int i = cconf->sconf->act->conn->conn_ip_len / QS_MEM_SEG; // size of the array
  int seqnum = (cconf->ip6[1] % QS_MEM_SEG) * i;             // array offset
  qs_ip_entry_t *conn_ip = cconf->sconf->act->conn->conn_ip;
  conn_ip = &conn_ip[seqnum];                                // address of the first entry

  apr_global_mutex_lock(cconf->sconf->act->lock);   /* @CRT1 */

  // search the whole list (until we find an exiting entry for this ip)
  while(i) {
    if((conn_ip->ip6[0] == 0) &&
       (conn_ip->ip6[1] == 0) &&
       (free == NULL)) {
      // first free entry
      free = conn_ip;
    }
    if((conn_ip->ip6[0] == cconf->ip6[0]) &&
       (conn_ip->ip6[1] == cconf->ip6[1])) {
      // found an existing entry
      conn_ip->counter++;
      num = conn_ip->counter;
      *e = conn_ip;
      break;
    }
    conn_ip++;
    i--;
  }
  if(num == -1) {
    // no entry found, use the first free entry
    if(free) {
      free->ip6[0] = cconf->ip6[0];
      free->ip6[1] = cconf->ip6[1];
      free->counter++;
      num = free->counter;
      *e = free;
    } else {
      ap_log_error(APLOG_MARK, APLOG_ALERT, 0, sconf->base_server, 
                   QOS_LOG_PFX(035)"QS_SrvMaxConn: no free IP slot available!"
                   " Check log for unclean child exit and consider"
                   " to do a graceful server restart if this condition persists."
                   " You might also increase the number of supported connections"
                   " using the 'QS_MaxClients' directive.");
      QS_INC_EVENT_LOCKED(sconf, 35);
    }
  }
  
  apr_global_mutex_unlock(cconf->sconf->act->lock); /* @CRT1 */
  return num;
}

/**
 * removes an ip entry (deletes/decrements)
 */
static void qos_dec_ip(qs_conn_ctx *cconf) {
  int i = cconf->sconf->act->conn->conn_ip_len / QS_MEM_SEG;
  int seqnum = (cconf->ip6[1] % QS_MEM_SEG) * i;
  qs_ip_entry_t *conn_ip = cconf->sconf->act->conn->conn_ip;
  conn_ip = &conn_ip[seqnum];
  apr_global_mutex_lock(cconf->sconf->act->lock);   /* @CRT2 */
  while(i) {
    if((conn_ip->ip6[0] == cconf->ip6[0]) &&
       (conn_ip->ip6[1] == cconf->ip6[1])) {
      // entry found, decrement and exit
      conn_ip->counter--;
      if(conn_ip->counter == 0) {
        // entry is no longer used by this ip
        conn_ip->ip6[0] = 0;
        conn_ip->ip6[1] = 0;
        conn_ip->error = 0;
      }
      break;
    }
    conn_ip++;
    i--;
  }
  apr_global_mutex_unlock(cconf->sconf->act->lock); /* @CRT2 */
}

static apr_status_t qos_cleanup_inctx(void *p) {
  qos_ifctx_t *inctx = p;
  qos_srv_config *sconf = inctx->sconf;
#if APR_HAS_THREADS
  if(sconf && sconf->inctx_t && !sconf->inctx_t->exit) {
    apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT25 */
    inctx->status = QS_CONN_STATE_DESTROY;
    apr_table_unset(sconf->inctx_t->table,
                    QS_INCTX_ID);
    apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT25 */
  }
#endif
  return APR_SUCCESS;
}

/**
 * creates a new connection ctx (remember to set the socket, connection and timeout)
 */
static qos_ifctx_t *qos_create_ifctx(conn_rec *connection, qos_srv_config *sconf) {
  conn_rec *c = connection;
  char buf[128];
  qos_ifctx_t *inctx = apr_pcalloc(c->pool, sizeof(qos_ifctx_t));
  inctx->clientSocket = NULL;
  inctx->status = QS_CONN_STATE_NEW;
  inctx->cl_val = 0;
  inctx->c = c;
  inctx->r = NULL;
  inctx->clientSocket = NULL;
  inctx->time = 0;
  inctx->nbytes = 0;
  inctx->hasBytes = 0;
  inctx->shutdown = 0;
  inctx->disabled = 0;
  inctx->lowrate = -1;
  sprintf(buf, "%p", inctx);
  inctx->id = apr_psprintf(c->pool, "%s%.16lx", buf, c->id);
  inctx->sconf = sconf;
  apr_pool_pre_cleanup_register(c->pool, inctx, qos_cleanup_inctx);
  return inctx;
}

/**
 * returns the context from the r->connection->input_filters
 */
static qos_ifctx_t *qos_get_ifctx(ap_filter_t *f) {
  qos_ifctx_t *inctx = NULL;
  while(f) {
    if(strcmp(f->frec->name, "qos-in-filter") == 0) {
      inctx = f->ctx;
      break;
    }
    f = f->next;
  }
  return inctx;
}

static qs_conn_base_ctx *qos_create_conn_base_ctx(conn_rec *connection, qos_srv_config *sconf) {
  conn_rec *c = connection;
  qs_conn_base_ctx *base = apr_pcalloc(c->pool, sizeof(qs_conn_base_ctx));
  base->cconf = NULL;
  base->requests = 0;
  base->c = c;
  base->sconf = sconf;
  base->clientSocket = NULL;
  ap_set_module_config(c->conn_config, &qos_module, base);
  apr_pool_pre_cleanup_register(c->pool, base, qos_base_cleanup_conn);
  return base;
}

static qs_conn_base_ctx *qos_get_conn_base_ctx(conn_rec *connection) {
  conn_rec *c = connection;
  qs_conn_base_ctx *base = (qs_conn_base_ctx*)ap_get_module_config(c->conn_config, &qos_module);
  return base;
}

/**
 * send server error, used for connection errors
 */
static int qos_return_error_andclose(conn_rec *connection, apr_socket_t *socket) {
  conn_rec *c = connection;
  char *line = apr_pstrcat(c->pool, AP_SERVER_PROTOCOL, " ",
                           ap_get_status_line(500), CRLF CRLF, NULL);
  apr_bucket *e = apr_bucket_pool_create(line, strlen(line), c->pool, c->bucket_alloc);
  apr_bucket_brigade *bb = apr_brigade_create(c->pool, c->bucket_alloc);

  c->keepalive = AP_CONN_CLOSE;
  c->aborted = 1;
  if(c->cs) {
    c->cs->state = CONN_STATE_LINGER;
  }
  apr_table_set(c->notes, QS_CONN_ABORT, QS_CONN_ABORT);
  if (m_forced_close == 0) {
    return DECLINED;
  }

  //apr_brigade_cleanup(bb);
  APR_BRIGADE_INSERT_HEAD(bb, e);
  e = apr_bucket_flush_create(c->bucket_alloc);
  APR_BRIGADE_INSERT_TAIL(bb, e);
  ap_pass_brigade(c->output_filters, bb);

//  if(socket) {
//    // speed up connection termination
//    qos_ifctx_t *inctx = qos_get_ifctx(c->input_filters);
//#ifdef QS_INTERNAL_TEST
//    struct timespec delay;
//    delay.tv_sec  = 0;
//    delay.tv_nsec = 1000000; // 1ms to allow testing
//    nanosleep(&delay, NULL);
//#endif
//    apr_socket_shutdown(socket, APR_SHUTDOWN_READ);
//    if(inctx) {
//      qos_cleanup_inctx(inctx);
//    }
//  }

  return HTTP_INTERNAL_SERVER_ERROR;
}

/**
 * returns custom error page
 */
static int qos_error_response(request_rec *r, const char *error_page) {
  if(r->subprocess_env) {
    const char *v = apr_table_get(r->subprocess_env, "QS_ErrorPage");
    if(v) {
      error_page = v;
    }
  }

  if(error_page) {
    /* do (almost) the same as ap_die() does */
    const char *error_notes;
    r->status = m_retcode;
    r->connection->keepalive = AP_CONN_CLOSE;
    r->no_local_copy = 1;
    apr_table_setn(r->subprocess_env, "REQUEST_METHOD", r->method);
    if ((error_notes = apr_table_get(r->notes, 
                                     "error-notes")) != NULL) {
      apr_table_setn(r->subprocess_env, "ERROR_NOTES", error_notes);
    }
    /* external or internal redirect */
    if(strncasecmp(error_page, "http", 4) == 0) {
      apr_table_set(r->headers_out, "Location", error_page);
      return HTTP_MOVED_TEMPORARILY;
    } else {
      r->method = apr_pstrdup(r->pool, "GET");
      r->method_number = M_GET;
      ap_internal_redirect(error_page, r);
      return DONE;
    }
  }
  return DECLINED;
}

/**
 * returns the matching regex with the lowest limitation
 */
static qs_acentry_t *qos_getrule_byregex(request_rec *r, qos_srv_config *sconf) {
  qs_acentry_t *ret = NULL;
  qs_actable_t *act = sconf->act;
  qs_acentry_t *actEntry = act->entry;
  int limit = -1;
  while(actEntry) {
    if((actEntry->event == NULL) && (actEntry->regex != NULL) && (actEntry->condition == NULL)) {
      if((limit == -1) || (actEntry->limit < limit)) {
        if(ap_regexec(actEntry->regex, r->unparsed_uri, 0, NULL, 0) == 0) {
          if(limit == -1) {
            ret = actEntry;
            limit = actEntry->limit;
          } else if(actEntry->limit < limit) {
            ret = actEntry;
            limit = actEntry->limit;
          }
        }
      }
    }
    actEntry = actEntry->next;
  }
  return ret;
}

/**
 * returns the matching conditional regex with the lowest limitation
 */
static qs_acentry_t *qos_getcondrule_byregex(request_rec *r, qos_srv_config *sconf) {
  qs_acentry_t *ret = NULL;
  qs_actable_t *act = sconf->act;
  qs_acentry_t *actEntry = act->entry;
  int limit = -1;
  while(actEntry) {
    if((actEntry->event == NULL) && (actEntry->regex != NULL) && (actEntry->condition != NULL)) {
      if((limit == -1) || (actEntry->limit < limit)) {
        if(ap_regexec(actEntry->regex, r->unparsed_uri, 0, NULL, 0) == 0) {
          if(limit == -1) {
            ret = actEntry;
            limit = actEntry->limit;
          } else if(actEntry->limit < limit) {
            ret = actEntry;
            limit = actEntry->limit;
          }
        }
      }
    }
    actEntry = actEntry->next;
  }
  return ret;
}

/**
 * returns the best matching location entry
 */
static qs_acentry_t *qos_getrule_bylocation(request_rec * r, qos_srv_config *sconf) {
  qs_acentry_t *ret = NULL;
  qs_actable_t *act = sconf->act;
  qs_acentry_t *actEntry = act->entry;
  int match_len = 0;
  while(actEntry) {
    if((actEntry->event == NULL) && (actEntry->regex == NULL)) {
      /* per location limitation */
      if(actEntry->url && (strncmp(actEntry->url, r->parsed_uri.path, actEntry->url_len) == 0)) {
        /* best match */
        if(actEntry->url_len > match_len) {
          match_len = actEntry->url_len;
          ret = actEntry;
        }
      }
    }
    actEntry = actEntry->next;
  }
  return ret;
}

/**
 * checks for VIP user (may pass restrictions)
 */
static int qos_is_vip(request_rec *r, qos_srv_config *sconf) {
  if(qos_verify_session(r, sconf)) {
    apr_table_set(r->subprocess_env, QS_VipRequest, "yes");
    apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
    return 1;
  }
  if(r->subprocess_env) {
    const char *v = apr_table_get(r->subprocess_env, QS_VipRequest);
    if(v && (strcasecmp(v, "yes") == 0)) {
      apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
      return 1;
    }
  }
  return 0;
}

/**
 * writes the parp table to a single query line
 */
static const char *qos_parp_query(request_rec *r, apr_table_t *tl, const char *add) {
  int add_len = 0;
  char *query = NULL;
  int len = 0;
  char *p;
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(tl)->elts;
  for(i = 0; i < apr_table_elts(tl)->nelts; i++) {
    len = len + 
      (entry[i].key == NULL ? 0 : strlen(entry[i].key)) +
      (entry[i].val == NULL ? 0 : strlen(entry[i].val)) +
      2;
  }
  if(add && add[0]) {
    add_len = strlen(add);
    len = len + add_len + 1;
  }
  query = apr_pcalloc(r->pool, len + 2);
  query[0] = '?';
  if(add_len) {
    memcpy(&query[1], add, add_len);
    p = &query[add_len];
  } else {
    p = &query[1];
  }
  p[0] = '\0';
  for(i = 0; i < apr_table_elts(tl)->nelts; i++) {
    int l = strlen(entry[i].key);
    if(p != &query[1]) {
      p[0] = '&';
      p++;
      p[0] = '\0';
    }
    memcpy(p, entry[i].key, l);
    p += l;
    p[0] = '=';
    p++;
    l = strlen(entry[i].val);
    memcpy(p, entry[i].val, l);
    p += l;
    p[0] = '\0';
  }
  apr_table_setn(r->notes, apr_pstrdup(r->pool, QS_PARP_QUERY), query);
  return &query[1];
}

/* filter events */
static int qos_per_dir_event_rules(request_rec *r, qos_srv_config *sconf,
                                   qos_dir_config *dconf) {
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(dconf->rfilter_table)->elts;
  int i;
  for(i = 0; i < apr_table_elts(dconf->rfilter_table)->nelts; i++) {
    if(entry[i].key[0] == '+') {
      int deny_rule = 0;
      int ex = -1;
      qos_rfilter_t *rfilter = (qos_rfilter_t *)entry[i].val;
      if(rfilter->type == QS_DENY_EVENT) {
        deny_rule = 1;
        if(rfilter->text[0] == '!') {
          if(apr_table_get(r->subprocess_env, &rfilter->text[1]) == NULL) {
            ex = 0;
          }
        } else {
          if(apr_table_get(r->subprocess_env, rfilter->text) != NULL) {
            ex = 0;
          }
        }
      }
      if(deny_rule && (ex == 0)) {
        int severity = rfilter->action == QS_DENY ? APLOG_ERR : APLOG_WARNING;
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|severity, 0, r,
                      QOS_LOG_PFX(040)"access denied, %s rule id: %s (%s),"
                      " action=%s, c=%s, id=%s",
                      qos_rfilter_type2text(r->pool, rfilter->type),
                      rfilter->id,
                      rfilter->text,
                      (!sconf->log_only) && (rfilter->action == QS_DENY) ? "deny" : "log only",
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "040"));
        QS_INC_EVENT(sconf, 40);
        if(rfilter->action == QS_DENY) {
          return HTTP_FORBIDDEN;
        }
      }
    }
  }
  return APR_SUCCESS;
}

/* json parser start ------------------------------------------------------- */
#define QOS_J_ERROR "HTTP_BAD_REQUEST QOS JSON PARSER: FORMAT ERROR"
#define QOS_j_RECURSION 80

static int j_val(apr_pool_t *pool, char **val, apr_table_t *tl, char *name, int rec);

static char *j_escape_url(apr_pool_t *pool, const char *c) {
  char buf[4];
  char special[] = " \t()<>@,;:\\/[]?={}\"'&%+";
  char *r = apr_pcalloc(pool, 3 * strlen(c));
  const char *p = c;
  int i = 0;
  while(p && p[0]) {
    char c = p[0];
    if(!apr_isprint(c) || strchr(special, c)) {
      sprintf(buf, "%02x", p[0]);
      r[i] = '%'; i++;
      r[i] = buf[0]; i++;
      r[i] = buf[1]; i++;
    } else {
      r[i] = c;
      i++;
    }
    p++;
  }
  return r;
}

static char *j_strchr(char *data, char d) {
  char *q = data;
  if(!q) {
    return NULL;
  }
  if(q[0] == d) {
    return q;
  }
  while(q[0]) {
    if((q[0] == d) && (q[-1] != '\\')) {
      return q;
    }
    q++;
  }
  return NULL;
}

static char *j_skip(char *in) {
  if(!in) return NULL;
  while(in[0] && ((in[0] == ' ') ||
		  (in[0] == '\t') ||
		  (in[0] == '\r') ||
		  (in[0] == '\n') ||
		  (in[0] == '\f'))) {
    in++;
  }
  return in;
}

static int j_string(apr_pool_t *pool, char **val, apr_table_t *tl, char *name, char **n) {
  char *d = *val;
  char *v = d;
  char *end = j_strchr(d, '"');
  if(!end) {
    apr_table_add(tl, QOS_J_ERROR, "error while parsing string (no ending double quote)");
    return HTTP_BAD_REQUEST;
  }
  end[0] = '\0';
  end++;
  *val = j_skip(end);
  /* TODO, improve string format validation */
  while(v[0]) {
    if(v[0] < ' ') {
      apr_table_add(tl, QOS_J_ERROR, "error while parsing string (invalid character)");
      return HTTP_BAD_REQUEST;
    }
    v++;
  }
  *n = d;
  return APR_SUCCESS;
}

static int j_num(apr_pool_t *pool, char **val, apr_table_t *tl, char *name, char **n) {
  char *s = *val;
  char *d = *val;
  while(d && ((d[0] >= '0' && d[0] <= '9') ||
	      d[0] == '.' ||
	      d[0] == 'e' ||
	      d[0] == 'E' ||
	      d[0] == '+' ||
	      d[0] == '-')) {
    d++;
  }
  *n = apr_pstrndup(pool, s, d-s);
  *val = d;
  return APR_SUCCESS;
}

static int j_obj(apr_pool_t *pool, char **val, apr_table_t *tl, char *name, int rec) {
  char *d = j_skip(*val);
  int rc;
  while(d && d[0]) {
    if(*d != '\"') {
      apr_table_add(tl, QOS_J_ERROR, "error while parsing object (missing string)");
      return HTTP_BAD_REQUEST;
    } else {
      /* list of string ":" value pairs (sepated by ',') */
      char *v = NULL;
      char *thisname;
      d++;
      rc = j_string(pool, &d, tl, name, &v);
      if(rc != APR_SUCCESS) {
	return rc;
      }
      thisname = apr_pstrcat(pool, name, "_" , v, NULL);
      d = j_skip(d);
      if(!d || d[0] != ':') {
	apr_table_add(tl, QOS_J_ERROR, "error while parsing object (missing value/wrong delimiter)");
	return HTTP_BAD_REQUEST;
      }
      d++;
      rc = j_val(pool, &d, tl, thisname, rec);
      if(rc != APR_SUCCESS) {
	return rc;
      }
      d = j_skip(d);
      if(!d) {
	apr_table_add(tl, QOS_J_ERROR, "error while parsing object (unexpected end)");
	return HTTP_BAD_REQUEST;
      }
      if(d[0] == '}') {
	d++;
	*val = d;
	return APR_SUCCESS;
      } else if(d[0] == ',') {
	d = j_strchr(d, '"');
      } else {
	apr_table_add(tl, QOS_J_ERROR, "error while parsing object (unexpected end/wrong delimiter)");
	return HTTP_BAD_REQUEST;
      }
    }
  }
  return APR_SUCCESS;
}

static int j_ar(apr_pool_t *pool, char **val, apr_table_t *tl, char *name, int rec) {
  char *d = j_skip(*val);
  int rc;
  int index = 0;
  while(d && d[0]) {
    rc = j_val(pool, &d, tl, apr_psprintf(pool, "%s%d", name, index), rec);
    if(rc != APR_SUCCESS) {
      return rc;
    }
    d = j_skip(d);
    if(!d) {
      apr_table_add(tl, QOS_J_ERROR, "error while parsing array (unexpected end)");
      return HTTP_BAD_REQUEST;
    }
    if(d[0] == ']') {
      d++;
      *val = d;
      return APR_SUCCESS;
    } else if(d[0] == ',') {
      d++;
      d = j_skip(d);
    } else {
      apr_table_add(tl, QOS_J_ERROR, "error while parsing array (unexpected end/wrong delimiter)");
      return HTTP_BAD_REQUEST;
    }
    index++;
  }
  return APR_SUCCESS;
}

static int j_val(apr_pool_t *pool, char **val, apr_table_t *tl, char *name, int rec) {
  char *d = j_skip(*val);
  int rc = APR_SUCCESS;
  rec++;
  if(rec > QOS_j_RECURSION) {
    apr_table_add(tl, QOS_J_ERROR, "error while parsing string (reached recursion limit)");
    return HTTP_BAD_REQUEST;
  }
  /* either object, array, string, number, "true", "false", or "null" */
  if(d[0] == '{') {
    d++;
    rc = j_obj(pool, &d, tl, apr_pstrcat(pool, name, "_o", NULL), rec);
  } else if(d[0] == '[') {
    d++;
    rc = j_ar(pool, &d, tl, apr_pstrcat(pool, name, "_a", NULL), rec);
  } else if(strncmp(d,"null",4) == 0) {
    d+=4;
    apr_table_add(tl, apr_pstrcat(pool, j_escape_url(pool, name), "_b", NULL), "null");
  } else if(strncmp(d,"true",4) == 0) {
    apr_table_add(tl, apr_pstrcat(pool, j_escape_url(pool, name), "_b", NULL), "true");
    d+=4;
  } else if(strncmp(d,"false",5) == 0) {
    apr_table_add(tl, apr_pstrcat(pool, j_escape_url(pool, name), "_b", NULL), "false");
    d+=5;
  } else if(*d == '-' || (*d >= '0' && *d <= '9')) {
    char *n = apr_pstrcat(pool, name, "_n", NULL);
    char *v = NULL;
    rc = j_num(pool, &d, tl, n, &v);
    if(rc == APR_SUCCESS) {
      apr_table_addn(tl, j_escape_url(pool, n), j_escape_url(pool, v));
    }
  } else if(*d == '\"') {
    char *n = apr_pstrcat(pool, name, "_v", NULL);
    char *v = NULL;
    d++;
    rc = j_string(pool, &d, tl, n, &v);
    if(rc == APR_SUCCESS) {
      apr_table_addn(tl, j_escape_url(pool, n), j_escape_url(pool, v));
    }
  } else {
    /* error */
    apr_table_add(tl, QOS_J_ERROR, "error while parsing value (invalid type)");
    return HTTP_BAD_REQUEST;
  }
  if(rc != APR_SUCCESS) {
    return rc;
  }
  *val = d;
  rec--;
  return APR_SUCCESS;
}
/* json parser end --------------------------------------------------------- */

/**
 * Process json data retrieved from parp (request body)
 * @param r
 * @param dconf
 * @param query Query to add data
 * @param msg Error message if paring fails
 * @return APR_SUCCESS if processed without errors.
 */
static int qos_json(request_rec *r, qos_dir_config *dconf, const char **query, const char **msg) {
  const char *contenttype = apr_table_get(r->headers_in, "Content-Type");
  if(contenttype && (strncasecmp(contenttype, "application/json", 16) == 0)) {
    apr_size_t len = 0;
    const char *data = NULL;
    /* check if parp has body data to process (requires "PARP_BodyData application/json")
       or if the json message is stored within the query */
    if(qos_parp_body_data_fn) {
      data = qos_parp_body_data_fn(r, &len);
    }
    if(data == NULL) {
      data = *query;
      if(data && (data[0] == '[' || data[0] == '{')) {
        int escerr = 0;
        char *copyq = apr_pstrdup(r->pool, data);
        *query = NULL;
        // the query needs to be unescaped before getting parsed
        len = qos_unescaping(copyq, dconf->dec_mode, &escerr);
#ifdef QS_MOD_EXT_HOOKS
        qos_run_path_decode_hook(r, &copyq, &len);
#endif
        data = copyq;
        if(strlen(data) != len) {
          *msg = apr_pstrdup(r->pool, "null character within data structure in query");
          return HTTP_BAD_REQUEST;
        }
      } else {
        // does not look like a json structure (strict)
        data = NULL;
      }
    }
    if(data && (len > 0)) {
      char *value = apr_pstrndup(r->pool, data, len);
      apr_table_t *tl = apr_table_make(r->pool, 200);
      int rc;
      if(strlen(value) != len) {
        *msg = apr_pstrdup(r->pool, "null character within data structure");
        return HTTP_BAD_REQUEST;
      }
      rc = j_val(r->pool, &value, tl, "J", 0);
      if(rc != APR_SUCCESS) {
        *msg = apr_table_get(tl, QOS_J_ERROR); 
        apr_table_unset(tl, QOS_J_ERROR);
        return rc;
      }
      if(value && value[0]) {
        value = j_skip(value);
        if(value && value[0]) {
          /* error, there is still some data */
          *msg = apr_pstrdup(r->pool, "more than one element");
        }
      }
      *query = qos_parp_query(r, tl, *query);
      if(*query) {
        apr_table_setn(r->notes, apr_pstrdup(r->pool, QS_PARP_Q), *query);
      }
    }
  }
  return APR_SUCCESS;
}

/**
 * processes the per location rules QS_Permit* and QS_Deny*
 */
static int qos_per_dir_rules(request_rec *r, qos_srv_config *sconf,
                             qos_dir_config *dconf) {
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(dconf->rfilter_table)->elts;
  int i;
  char *path = apr_pstrdup(r->pool, r->parsed_uri.path);
  char *query = NULL;
  char *fragment = NULL;
  char *request_line = apr_pstrdup(r->pool, r->the_request);
  char *uri = path;
  int request_line_len;
  int path_len;
  int query_len = 0;
  int fragment_len = 0;
  int uri_len;
  int permit_rule = 0;
  int permit_rule_match = 0;
  int permit_rule_action = QS_DENY;
  int escerr = 0;
  request_line_len = qos_unescaping(request_line, dconf->dec_mode, &escerr);
  path_len = qos_unescaping(path, dconf->dec_mode, &escerr);
#ifdef QS_MOD_EXT_HOOKS
  qos_run_path_decode_hook(r, &path, &path_len);
#endif
  uri_len = path_len;
  if(dconf->bodyfilter_p == 1 || dconf->bodyfilter_d == 1) {
    const char *q = apr_table_get(r->notes, QS_PARP_Q);
    if((q == NULL) && qos_parp_hp_table_fn) {
      const char *msg = NULL;
      apr_table_t *tl = qos_parp_hp_table_fn(r);
      if(tl) {
        if(apr_table_elts(tl)->nelts > 0) {
          q = qos_parp_query(r, tl, NULL);
          if(q) {
            apr_table_setn(r->notes, apr_pstrdup(r->pool, QS_PARP_Q), q);
          }
        }
      } else {
        /* no table provided by mod_parp (unsupported content type?),
           use query string if available */
        if(r->parsed_uri.query) {
          q = r->parsed_uri.query;
        }
      }
      if(qos_json(r, dconf, &q, &msg) != APR_SUCCESS) {
        /* parser error */
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                      QOS_LOG_PFX(048)"access denied, invalid JSON syntax (%s),"
                      " action=%s, c=%s, id=%s",
                      msg ? msg : "-",
                      sconf->log_only ? "log only" : "deny",
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "048"));
        QS_INC_EVENT(sconf, 48);
        return HTTP_FORBIDDEN;
      }
    }
    if(q) {
      /* prepare unescaped body query (parp) */
      char *q1 = apr_pstrdup(r->pool, q);
      int q1_len = 0;
      q1 = apr_pstrdup(r->pool, q);
      q1_len = qos_unescaping(q1, dconf->dec_mode, &escerr);
#ifdef QS_MOD_EXT_HOOKS
      qos_run_query_decode_hook(r, &q1, &q1_len);
#endif
      if(dconf->bodyfilter_d == 1) {
        /* use body for query deny filter */
        query = q1;
        query_len = q1_len;
      } else {
        /* don't use body for query deny filter */
        if(r->parsed_uri.query) {
          query = apr_pstrdup(r->pool, r->parsed_uri.query);
          query_len = qos_unescaping(query, dconf->dec_mode, &escerr);
#ifdef QS_MOD_EXT_HOOKS
          qos_run_query_decode_hook(r, &query, &query_len);
#endif
        }
      }
      if(dconf->bodyfilter_p != 1) {
        /* don' use body for permit filter */
        if(r->parsed_uri.query) {
          q1 = apr_pstrdup(r->pool, r->parsed_uri.query);
          q1_len = qos_unescaping(q1, dconf->dec_mode, &escerr);
#ifdef QS_MOD_EXT_HOOKS
          qos_run_query_decode_hook(r, &q1, &q1_len);
#endif
        } else {
          q1 = NULL;
          q1_len = 0;
        }
      }
      if(q1) {
        uri = apr_pcalloc(r->pool, path_len + 1 + q1_len + 1);
        memcpy(uri, path, path_len);
        uri[path_len] = '?';
        memcpy(&uri[path_len+1], q1, q1_len);
        uri[path_len+1+q1_len] = '\0';
        uri_len = path_len + 1 + q1_len;
      }
    }
  } else {
    if(r->parsed_uri.query) {
      query = apr_pstrdup(r->pool, r->parsed_uri.query);
      query_len = qos_unescaping(query, dconf->dec_mode, &escerr);
#ifdef QS_MOD_EXT_HOOKS
      qos_run_query_decode_hook(r, &query, &query_len);
#endif
      uri = apr_pcalloc(r->pool, path_len + 1 + query_len + 1);
      memcpy(uri, path, path_len);
      uri[path_len] = '?';
      memcpy(&uri[path_len+1], query, query_len);
      uri[path_len+1+query_len] = '\0';
      uri_len = path_len + 1 + query_len;
    }
  }
  if(r->parsed_uri.fragment) {
    fragment = apr_pstrdup(r->pool, r->parsed_uri.fragment);
    fragment_len = qos_unescaping(fragment, dconf->dec_mode, &escerr);
    uri = apr_pcalloc(r->pool, path_len + 1 + fragment_len + 1);
    memcpy(uri, path, path_len);
    uri[path_len] = '?';
    memcpy(&uri[path_len+1], fragment, fragment_len);
    uri[path_len+1+fragment_len] = '\0';
    uri_len = path_len + 1 + fragment_len;
  }
  if(escerr > 0 && (dconf->urldecoding < QS_OFF_DEFAULT)) {
    int severity = dconf->urldecoding == QS_DENY ? APLOG_ERR : APLOG_WARNING;
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|severity, 0, r,
                  QOS_LOG_PFX(046)"access denied, invalid url encoding, action=%s, c=%s, id=%s",
                  (!sconf->log_only) && (dconf->urldecoding == QS_DENY) ? "deny" : "log only",
                  QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                  qos_unique_id(r, "046"));
    QS_INC_EVENT(sconf, 46);
    if(dconf->urldecoding == QS_DENY) {
      return HTTP_FORBIDDEN;
    }
  }
  /* process deny- and allow- list rules in one loop */
  for(i = 0; i < apr_table_elts(dconf->rfilter_table)->nelts; i++) {
    if(entry[i].key[0] == '+') {
      int deny_rule = 0;
      int ex = -1;
      qos_rfilter_t *rfilter = (qos_rfilter_t *)entry[i].val;
      if(rfilter->type == QS_DENY_REQUEST_LINE) {
        deny_rule = 1;
        ex = qos_regexec_len(r->pool, rfilter->preg, request_line, request_line_len);
      } else if(rfilter->type == QS_DENY_PATH) {
        deny_rule = 1;
        ex = qos_regexec_len(r->pool, rfilter->preg, path, path_len);
      } else if(rfilter->type == QS_DENY_QUERY) {
        deny_rule = 1;
        ex = qos_regexec_len(r->pool, rfilter->preg, query, query_len);
      } else if(rfilter->type == QS_DENY_EVENT) {
        /* event rules are processed separately */
      } else {
        permit_rule = 1;
        ex = qos_regexec_len(r->pool, rfilter->preg, uri, uri_len);
        permit_rule_action = rfilter->action;
        if(ex == 0) {
          permit_rule_match = 1; 
        }
      }
      if(deny_rule && (ex == 0)) {
        int severity = rfilter->action == QS_DENY ? APLOG_ERR : APLOG_WARNING;
        apr_table_set(r->subprocess_env, QS_RuleId, rfilter->id);
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|severity, 0, r,
                      QOS_LOG_PFX(040)"access denied, %s rule id: %s (%s),"
                      " action=%s, c=%s, id=%s",
                      qos_rfilter_type2text(r->pool, rfilter->type),
                      rfilter->id,
                      rfilter->text,
                      (!sconf->log_only) && (rfilter->action == QS_DENY) ? "deny" : "log only",
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "040"));
        QS_INC_EVENT(sconf, 40);
        if(rfilter->action == QS_DENY) {
          return HTTP_FORBIDDEN;
        }
      }
    }
  }
  if(permit_rule && !permit_rule_match) {
    int severity = permit_rule_action == QS_DENY ? APLOG_ERR : APLOG_WARNING;
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|severity, 0, r,
                  QOS_LOG_PFX(041)"access denied, no permit rule match, action=%s, c=%s, id=%s",
                  (!sconf->log_only) && (permit_rule_action == QS_DENY) ? "deny" : "log only",
                  QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                  qos_unique_id(r, "041"));
    QS_INC_EVENT(sconf, 41);
    if(permit_rule_action == QS_DENY) {
      return HTTP_FORBIDDEN;
    }
  }
  return APR_SUCCESS;
}

/**
 * request/response header filter, drops headers which are not allowed
 */
static int qos_header_filter(request_rec *r, qos_srv_config *sconf,
                             apr_table_t *headers, const char *type,
                             apr_table_t *hfilter_table,
                             qs_headerfilter_mode_e mode) {
  apr_table_t *delete = apr_table_make(r->pool, 1);
  apr_table_t *reason = NULL;
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(headers)->elts;
  for(i = 0; i < apr_table_elts(headers)->nelts; i++) {
    qos_fhlt_r_t *he = (qos_fhlt_r_t *)apr_table_get(hfilter_table, entry[i].key);
    int denied = 0;
    if(he) {
      if(mode != QS_HEADERFILTER_SIZE_ONLY) {
        if(ap_regexec(he->preg, entry[i].val, 0, NULL, 0) != 0) {
          denied = 1;
        }
      }
      if(strlen(entry[i].val) > he->size) {
        denied += 2;
      }
      if(denied) {
        char *pattern = apr_psprintf(r->pool, "(pattern=%s, max. length=%d)",
                                     he->text, he->size);
        if(he->action == QS_FLT_ACTION_DENY) {
          ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                        QOS_LOG_PFX(043)"access denied%s, %s header: \'%s: %s\', %s, c=%s, id=%s",
                        sconf->log_only ? " (log only)" : "",
                        type,
                        entry[i].key, entry[i].val,
                        pattern,
                        QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                        qos_unique_id(r, "043"));
          QS_INC_EVENT(sconf, 43);
          return HTTP_FORBIDDEN;
        }
        if(reason == NULL) {
          reason = apr_table_make(r->pool, 1);
        }
        apr_table_add(delete, entry[i].key, entry[i].val);
        apr_table_add(reason, entry[i].key, pattern);
      }
    } else {
      if(reason == NULL) {
        reason = apr_table_make(r->pool, 1);
      }
      apr_table_add(delete, entry[i].key, entry[i].val);
      apr_table_add(reason, entry[i].key, "(no rule available)");
    }
  }
  entry = (apr_table_entry_t *)apr_table_elts(delete)->elts;
  for(i = 0; i < apr_table_elts(delete)->nelts; i++) {
    if(mode != QS_HEADERFILTER_SILENT) {
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                    QOS_LOG_PFX(042)"drop %s header%s: \'%s: %s\', %s, c=%s, id=%s",
                    type,
                    sconf->log_only ? " (log only)" : "",
                    entry[i].key, entry[i].val,
                    apr_table_get(reason, entry[i].key),
                    QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                    qos_unique_id(r, "042"));
      QS_INC_EVENT(sconf, 42);
    }
    if(!sconf->log_only) {
      apr_table_unset(headers, entry[i].key);
    }
  }
  return APR_SUCCESS;
}

/**
 * returns list of all query name=value pairs
 */
static apr_table_t *qos_get_query_table(request_rec *r) {
  apr_table_t *av = apr_table_make(r->pool, 2);
  if(r->parsed_uri.query) {
    const char *q = apr_pstrdup(r->pool, r->parsed_uri.query);
    while(q && q[0]) {
      const char *t = ap_getword(r->pool, &q, '&');
      const char *name = ap_getword(r->pool, &t, '=');
      const char *value = t;
      if(name && (strlen(name) > 0)) {
        if(value && (strlen(value) > 0)) {
          apr_table_add(av, name, value);
        } else if((strlen(name) > 0)) {
          apr_table_add(av, name, "");
        }
      }
    }
  }
  return av;
}

/** add "\n" */
#define QOS_ALERT_LINE_LEN 65
static char *qos_crline(request_rec *r, const char *line) {
  char *string = "";
  const char *pos = line;
  while(pos && pos[0]) {
    int len = strlen(pos);
    if(len > QOS_ALERT_LINE_LEN) {
      string = apr_pstrcat(r->pool, string,
                           apr_psprintf(r->pool, "%.*s", QOS_ALERT_LINE_LEN, pos), "\n", NULL);
      pos = &pos[QOS_ALERT_LINE_LEN];
    } else {
      string = apr_pstrcat(r->pool, string, pos, NULL);
      pos = NULL;
    }
  }
  return string;
}

/**
 * calculates the rec/sec block rate
 */
static void qos_cal_req_sec(qos_srv_config *sconf, request_rec *r, qs_acentry_t *e) {
  if(e->req_per_sec > e->req_per_sec_limit) {
    int factor = ((e->req_per_sec * 100) / e->req_per_sec_limit) - 100;
    e->req_per_sec_block_rate = e->req_per_sec_block_rate + factor;
    if(e->req_per_sec_block_rate > QS_MAX_DELAY/1000) {
      e->req_per_sec_block_rate = QS_MAX_DELAY/1000;
    }
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                  QOS_LOG_PFX(050)"request rate limit, rule: %s(%ld), req/sec=%ld,"
                  " delay=%dms%s",
                  e->url, e->req_per_sec_limit,
                  e->req_per_sec, e->req_per_sec_block_rate,
                  e->req_per_sec_block_rate == QS_MAX_DELAY/1000 ? " (max)" : "");
    QS_INC_EVENT(sconf, 50);
  } else if(e->req_per_sec_block_rate > 0) {
    if(e->req_per_sec_block_rate < 50) {
      e->req_per_sec_block_rate = 0;
    } else {
      int factor = e->req_per_sec_block_rate / 4;
      e->req_per_sec_block_rate = e->req_per_sec_block_rate - factor;
    }
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_INFO, 0, r,
                  QOS_LOG_PFX(051)"request rate limit, rule: %s(%ld), req/sec=%ld,"
                  " delay=%dms",
                  e->url, e->req_per_sec_limit,
                  e->req_per_sec, e->req_per_sec_block_rate);
    QS_INC_EVENT(sconf, 51);
  }
}

/**
 * QS_DenyEvent enforcement at header parser
 * @param r
 * @param sconf
 * @param dconf
 # returns DECLINED if no events has been detected
 */
static int qos_hp_event_deny_filter(request_rec *r, qos_srv_config *sconf, qos_dir_config *dconf) {
  apr_status_t rv = qos_per_dir_event_rules(r, sconf, dconf);
  if(rv != APR_SUCCESS) {
    int rc;
    const char *error_page = sconf->error_page;
    qs_set_evmsg(r, "D;"); 
    if(!sconf->log_only) {
      rc = qos_error_response(r, error_page);
      if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
        return rc;
      }
      return rv;
    }
  }
  return DECLINED;
}

/**
 * QS_Permit* / QS_Deny* enforcement at header parser
 * @param r
 * @param sconf
 * @param dconf
 * @return
 */
static int qos_hp_filter(request_rec *r, qos_srv_config *sconf, qos_dir_config *dconf) {
  apr_status_t rv = APR_SUCCESS;
  if(sconf->milestones) {
    char *value = qos_get_remove_cookie(r, QOS_MILESTONE_COOKIE);
    rv = qos_verify_milestone(r, sconf, value);
  }

  if((rv == APR_SUCCESS) && (apr_table_elts(dconf->rfilter_table)->nelts > 0)) {
    rv = qos_per_dir_rules(r, sconf, dconf);
  }

  if(rv != APR_SUCCESS) {
    int rc;
    const char *error_page = sconf->error_page;
    qs_set_evmsg(r, "D;"); 
    if(!sconf->log_only) {
      rc = qos_error_response(r, error_page);
      if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
        return rc;
      }
      return rv;
    }
  }
  return DECLINED;
}

/**
 * QS_SetEnvRes (outfilter)
 * Detects events at response time.
 */
static void qos_setenvres(request_rec *r, qos_srv_config *sconf) {
  ap_regmatch_t regm[AP_MAX_REG_MATCH];
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(sconf->setenvres_t)->elts;
  for(i = 0; i < apr_table_elts(sconf->setenvres_t)->nelts; i++) {
    const char *val = apr_table_get(r->subprocess_env, entry[i].key);
    if(val) {
      qos_pregval_t *pregval = (qos_pregval_t *)entry[i].val;
      if(ap_regexec(pregval->preg, val, AP_MAX_REG_MATCH, regm, 0) == 0) {
        if(pregval->value) {
          char *replaced = ap_pregsub(r->pool, pregval->value, val, AP_MAX_REG_MATCH, regm);
          apr_table_set(r->subprocess_env, pregval->name, replaced);
        } else {
          apr_table_set(r->subprocess_env, pregval->name, "1");
        }
      }
    }
  }
}

/**
 * QS_SetEnvResHeader(Match) (outfilter)
 * Matches response headers and sets an event on match.
 * @param r
 * @param sconf
 */
static void qos_setenvresheader(request_rec *r, qos_srv_config *sconf) {
  apr_table_t *headers = r->headers_out;
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(sconf->setenvresheader_t)->elts;
  apr_table_entry_t *entryMatch = (apr_table_entry_t *)apr_table_elts(sconf->setenvresheadermatch_t)->elts;
  while(headers) {
    for(i = 0; i < apr_table_elts(sconf->setenvresheadermatch_t)->nelts; i++) {
      const char *val = apr_table_get(headers, entryMatch[i].key);
      if(val) {
        ap_regex_t *preg = (ap_regex_t *)entryMatch[i].val;
        if(ap_regexec(preg, val, 0, NULL, 0) == 0) {
          apr_table_set(r->subprocess_env, entryMatch[i].key, val);
        }
      }
    }
    for(i = 0; i < apr_table_elts(sconf->setenvresheader_t)->nelts; i++) {
      const char *val = apr_table_get(headers, entry[i].key);
      if(val) {
        apr_table_set(r->subprocess_env, entry[i].key, val);
        if(strcasecmp(entry[i].val, "drop") == 0) {
          apr_table_unset(headers, entry[i].key);
        }
      }
    }
    if(headers == r->headers_out) {
      headers = r->err_headers_out;
    } else {
      headers = NULL;
    }
  }
}

/**
 * QS_SetEnvIfStatus
 * Match response status code
 *
 * @param r
 * @param sconf
 * @param dconf
 */
static void qos_setenvstatus(request_rec *r, qos_srv_config *sconf, qos_dir_config *dconf) {
  char *code = apr_psprintf(r->pool, "%d", r->status);
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(sconf->setenvstatus_t)->elts;
  for(i = 0; i < apr_table_elts(sconf->setenvstatus_t)->nelts; i++) {
    if(strcmp(entry[i].key, code) == 0) {
      char *var = apr_pstrdup(r->pool, entry[i].val);
      char *value = strchr(var, '=');
      if(value) {
        // a value has been defined
        value[0] = '\0';
        value++;
      } else {
        if(strcmp(var, QS_BLOCK) == 0) {
          // QS_Block optionally defines the weight for error codes
          value = apr_pstrdup(r->pool, "1");
        } else {
          // by default, the value becomes the status code
          value = code;
        }
      }
      apr_table_set(r->subprocess_env, var, value);
    }
  }
  if(dconf) {
    entry = (apr_table_entry_t *)apr_table_elts(dconf->setenvstatus_t)->elts;
    for(i = 0; i < apr_table_elts(dconf->setenvstatus_t)->nelts; i++) {
      if(strcmp(entry[i].key, code) == 0) {
        char *var = apr_pstrdup(r->pool, entry[i].val);
        char *value = strchr(var, '=');
        if(value) {
          value[0] = '\0';
          value++;
        } else {
          value = code;
        }
        apr_table_set(r->subprocess_env, var, value);
      }
    }
  }
}

/**
 * Returns the best matching server name (the configured ServerName,
 * supporting ServerAlias directive or the value provided by the
 * caller (usually the Host header)).
 *
 * @param r
 * @param server_hostname Host name the client expects (Host header) <host>[:<port>]
 * @param match Indicates if the provide name matches the ServerName/ServerAlias
 * @return hostname
 */
static char *qos_server_alias(request_rec *r, const char *server_hostname, int *match) {
  char *server = apr_pstrdup(r->pool, r->server->server_hostname); // default (hostname, no port)
  *match = 0;
  if(server_hostname) {
    const char *search = server_hostname;
    char *port = strchr(search, ':');
    if(port) {
      // without the port
      search = apr_pstrndup(r->pool, search, port - search);
    }
    if(strcasecmp(search, r->server->server_hostname) == 0) {
      /* match ServerName */
      // we already did: server = apr_pstrdup(r->pool, r->server->server_hostname);
      *match = 1;
    } else if(r->server->names) {
      int i;
      apr_array_header_t *names = r->server->names;
      char **name = (char **)names->elts;
      for(i = 0; i < names->nelts; ++i) {
        if(!name[i]) continue;
        if(strcasecmp(search, name[i]) == 0) {
          /* match ServerAlias */
          server = apr_pstrdup(r->pool, name[i]);
          *match = 1;
        }
      }
    } else if(r->server->wild_names) {
      int i;
      apr_array_header_t *names = r->server->wild_names;
      char **name = (char **)names->elts;
      for(i = 0; i < names->nelts; ++i) {
        if(!name[i]) continue;
        if(!ap_strcasecmp_match(search, name[i])) {
          /* match ServerAlias using wildcards */
          server = apr_pstrdup(r->pool, search);
          *match = 1;
        }
      }
    }
  }
  return server;
}

/** 
 * Returns the url to this server, e.g. https://server1 or http://server1:8080
 * used for redirects.
 *
 * @param r
 * @return schema/hostname
 */
static char *qos_this_host(request_rec *r) {
  const char *hostport = apr_table_get(r->headers_in, "Host");
  int port = 0;
  int ssl = 0;
  int default_port;
  const char *server_hostname = r->server->server_hostname;
  if(qos_is_https) {
    ssl = qos_is_https(r->connection);
  }
  if(hostport) {
    char *p;
    int match;
    hostport = apr_pstrdup(r->pool, hostport);
    if((p = strchr(hostport, ':')) != NULL) {
      p[0] = '\0';
      p++;
      port = atoi(p);
    }
    server_hostname = qos_server_alias(r, hostport, &match);
  }
  if(port == 0) {
    // pref. vhost
    port = r->server->addrs->host_port;
  }
  if(port == 0) {
    // main srv
    port = r->server->port;
  }
  default_port = ssl ? 443 : 80;
  if(port == default_port) {
    return apr_psprintf(r->pool, "%s%s",
                        ssl ? "https://" : "http://",
                        server_hostname);
  }
  return apr_psprintf(r->pool, "%s%s:%d",
                      ssl ? "https://" : "http://",
                      server_hostname,
                      port);
}

/**
 * Enables mod_parp if mod_qos requires access to the request body.
 * @param r
 */
static void qos_enable_parp(request_rec *r) {
  const char *ct = apr_table_get(r->headers_in, "Content-Type");
  if(ct) {
    if(ap_strcasestr(ct, "application/x-www-form-urlencoded") ||
       ap_strcasestr(ct, "multipart/form-data") ||
       ap_strcasestr(ct, "multipart/mixed") ||
       ap_strcasestr(ct, "application/json")) {
      apr_table_set(r->subprocess_env, "parp", "mod_qos");
    }
  }
}

/** 
 * Generic request validation / sanity check:
 * We ensure to have at least a valid, decoded request uri received.
 * (no further uri validation required in your code)
 * @param r
 * @param sconf
 * @return HTTP_BAD_REQUEST for requests which may not be processed by mod_qos, otherwise
 *         APR_SUCCESS
 */
static apr_status_t qos_request_check(request_rec *r, qos_srv_config *sconf) {
  if((r->unparsed_uri == NULL) || (r->parsed_uri.path == NULL)) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(045)"access denied, invalid request line:"
                  " can't parse uri, c=%s, id=%s",
                  QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                  qos_unique_id(r, "045"));
    QS_INC_EVENT(sconf, 45);
    return HTTP_BAD_REQUEST;
  }
  return APR_SUCCESS;
}

/**
 * QS_SetEnvIfParp (prr), enable parp
 */
static apr_status_t qos_parp_prr(request_rec *r, qos_srv_config *sconf) {
  if(apr_table_elts(sconf->setenvifparp_t)->nelts > 0) {
    qos_enable_parp(r);
  }
  return DECLINED;
}

/**
 * QS_SetEnvIfQuery/QS_SetEnvIfParp
 */
static void qos_setenvif_ex(request_rec *r, const char *query, apr_table_t *table_setenvif) {
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(table_setenvif)->elts;
  for(i = 0; i < apr_table_elts(table_setenvif)->nelts; i++) {
    qos_setenvifquery_t *setenvif = (qos_setenvifquery_t *)entry[i].val;
    char *name = setenvif->name;
    ap_regmatch_t regm[AP_MAX_REG_MATCH];
    if(ap_regexec(setenvif->preg, query, AP_MAX_REG_MATCH, regm, 0) == 0) {
      if(name[0] == '!') {
        apr_table_unset(r->subprocess_env, &name[1]);
      } else {
        char *replaced = "";
        if(setenvif->value) {
          replaced = ap_pregsub(r->pool, setenvif->value, query, AP_MAX_REG_MATCH, regm);
        }
        apr_table_set(r->subprocess_env, name, replaced);
      }
    }
  }
}

/**
 * Process body events (QS_SetEnvIfBody) and sets the r->subprocess_env variables
 * @param r
 * @param sconf
 */
static void qos_parp_hp_body(request_rec *r, qos_srv_config *sconf) {
  apr_size_t len;
  const char *data = qos_parp_body_data_fn(r, &len);
  if(data && (len > 0)) {
    int i;
    apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(sconf->setenvifparpbody_t)->elts;
#if (AP_SERVER_MINORVERSION_NUMBER < 4) && defined QS_INTERNAL_TEST
    // Apache 2.2 is no longer supported (test only)
    char *tmpData = apr_palloc(r->pool, len + 1);
    memcpy(tmpData, data, len);
    tmpData[len] = '\0';
    data = (const char *)tmpData;
#endif
    for(i = 0; i < apr_table_elts(sconf->setenvifparpbody_t)->nelts; i++) {
      qos_setenvifparpbody_t *setenvif = (qos_setenvifparpbody_t *)entry[i].val;
      ap_regmatch_t regm[AP_MAX_REG_MATCH];
#if (AP_SERVER_MINORVERSION_NUMBER < 4) && defined QS_INTERNAL_TEST
      if(ap_regexec(setenvif->pregx, data, AP_MAX_REG_MATCH, regm, 0) == 0) { // won't work for null chars!
#else
      if(ap_regexec_len(setenvif->pregx, data, len, AP_MAX_REG_MATCH, regm, 0) == 0) {
#endif
        char *name = setenvif->name;
        if(name[0] == '!') {
          apr_table_unset(r->subprocess_env, &name[1]);
        } else {
          char *value = apr_pstrdup(r->pool, setenvif->value);
          char *p = strstr(value, "$1");
          if(p) {
            char *c = apr_pstrndup(r->pool, &data[regm[0].rm_so], regm[0].rm_eo - regm[0].rm_so);
            if(ap_regexec(setenvif->pregx, c, AP_MAX_REG_MATCH, regm, 0) == 0) {
              value = ap_pregsub(r->pool, value, c, AP_MAX_REG_MATCH, regm);
            }
          }
          apr_table_set(r->subprocess_env, name, value != NULL ? value : "");
        }
      }
    }
  }
}

/**
 * Setting events based on request payload (query), QS_SetEnvIfParp (hp)
 * @param r
 * @param sconf
 */
static void qos_parp_hp(request_rec *r, qos_srv_config *sconf) {
  const char *query = apr_table_get(r->notes, QS_PARP_Q);
  if((query == NULL) && qos_parp_hp_table_fn) {
    apr_table_t *tl = qos_parp_hp_table_fn(r);
    if(tl) {
      if(apr_table_elts(tl)->nelts > 0) {
        query = qos_parp_query(r, tl, NULL);
        if(query) {
          apr_table_setn(r->notes, apr_pstrdup(r->pool, QS_PARP_Q), query);
        }
      }
    } else {
      /* no table provided by mod_parp (unsupported content type?),
         use query string if available */
      if(r->parsed_uri.query) {
        query = r->parsed_uri.query;
      }
    }
  }
  if(query) {
    qos_setenvif_ex(r, query, sconf->setenvifparp_t);
  }
}

/**
 * Replaces ${var} by the value in var
 * @param p Pool for memory allocation
 * @param vars Available variables to lookup
 * @param string String to replace variables
 * @return 1 on success or 0 if string still contains "${"
 */
static int qos_reslove_variable(apr_pool_t *p, apr_table_t *vars, char **string) {
  int i;
  int start;
  int line_end;
  char *var_name;
  char *new_line = *string;
  char *line = *string;
  const char *val;

 once_again:
  i = 0;
  while(line[i] != 0) {
    if((line[i] == '$') && (line[i+1] == '{')) {
      line_end = i;
      i=i+2;
      start = i;
      while((line[i] != 0) && (line[i] != '}')) {
        i++;
      }
      if(line[i] != '}') {
        /* no end found */
        break;
      } else {
        var_name = apr_pstrndup(p, &line[start], i - start);
        val = apr_table_get(vars, var_name);
        if(val) {
          line[line_end] = 0;
          i++;
          new_line = apr_pstrcat(p, line, val, &line[i], NULL);
          line = new_line;
          goto once_again;
        }      
      }
    }
    i++;
  }
  if(!new_line[0] || strstr(new_line, "${")) {
    return 0;
  }
  *string = new_line;
  return 1;
}

/**
 * QS_SetEnvIfQuery (hp)
 * @param r
 * @param sconf
 * @param dconf
 */
static void qos_setenvifquery(request_rec *r, qos_srv_config *sconf, qos_dir_config *dconf) {
  qos_setenvif_ex(r, r->parsed_uri.query, sconf->setenvifquery_t);
  qos_setenvif_ex(r, r->parsed_uri.query, dconf->setenvifquery_t);
}

/**
 * QS_SetEnv
 * @param r
 * @param sconf
 */
static void qos_setenv(request_rec *r, qos_srv_config *sconf) {
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(sconf->setenv_t)->elts;
  for(i = 0; i < apr_table_elts(sconf->setenv_t)->nelts; i++) {
    char *variable = entry[i].val;
    char *value = apr_pstrdup(r->pool, strchr(entry[i].key, '='));
    value++;
    if(qos_reslove_variable(r->pool, r->subprocess_env, &value)) {
      apr_table_set(r->subprocess_env, variable, value);
    }
  }
}

/**
 * QS_SetReqHeader
 * @param r
 * @param header_t
 */
static void qos_setreqheader(request_rec *r, apr_table_t *header_t) {
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(header_t)->elts;
  for(i = 0; i < apr_table_elts(header_t)->nelts; i++) {
    char *header = entry[i].val;
    char *variable = apr_pstrdup(r->pool, strchr(entry[i].key, '='));
    const char *val;
    variable++;
    val = apr_table_get(r->subprocess_env, variable);
    if(val) {
      if(header[0] == '!') {
        apr_table_unset(r->headers_in, &header[1]);
      } else {
        apr_table_set(r->headers_in, header, val);
      }
    }
  }
}

/**
 * QS_SetEnvIf (hp and logger)
 * @param r
 * @param setenvif_t
 */
static void qos_setenvif(request_rec *r, apr_array_header_t *setenvif_t) {
  int i;
  qos_setenvif_t *entries = (qos_setenvif_t *)setenvif_t->elts;
  for(i = 0; i < setenvif_t->nelts; i++) {
    qos_setenvif_t *setenvif = &entries[i];
    if(setenvif->preg == NULL) {
      // mode 1 (boolean AND operator)
      if((setenvif->variable1[0] == '!') && (setenvif->variable2[0] == '!')) {
        if(!apr_table_get(r->subprocess_env, &setenvif->variable1[1]) &&
           !apr_table_get(r->subprocess_env, &setenvif->variable2[1])) {
          if(setenvif->name[0] == '!') {
            apr_table_unset(r->subprocess_env, &setenvif->name[1]);
          } else {
            apr_table_set(r->subprocess_env, setenvif->name, setenvif->value);
          }
        }
      } else if(setenvif->variable1[0] == '!') {
        if(!apr_table_get(r->subprocess_env, &setenvif->variable1[1]) &&
           apr_table_get(r->subprocess_env, setenvif->variable2)) {
          if(setenvif->name[0] == '!') {
            apr_table_unset(r->subprocess_env, &setenvif->name[1]);
          } else {
            apr_table_set(r->subprocess_env, setenvif->name, setenvif->value);
          }
        }
      } else if(setenvif->variable2[0] == '!') {
        if(apr_table_get(r->subprocess_env, setenvif->variable1) &&
           !apr_table_get(r->subprocess_env, &setenvif->variable2[1])) {
          if(setenvif->name[0] == '!') {
            apr_table_unset(r->subprocess_env, &setenvif->name[1]);
          } else {
            apr_table_set(r->subprocess_env, setenvif->name, setenvif->value);
          }
        }
      } else {
        if(apr_table_get(r->subprocess_env, setenvif->variable1) &&
           apr_table_get(r->subprocess_env, setenvif->variable2)) {
          if(setenvif->name[0] == '!') {
            apr_table_unset(r->subprocess_env, &setenvif->name[1]);
          } else {
            apr_table_set(r->subprocess_env, setenvif->name, setenvif->value);
          }
        }
      }
    } else {
      // mode 2 (pattern match)
      const char *value = apr_table_get(r->subprocess_env, setenvif->variable1);
      if(value) {
        ap_regmatch_t regm[AP_MAX_REG_MATCH];
        if(ap_regexec(setenvif->preg, value, AP_MAX_REG_MATCH, regm, 0) == 0) {
          if(setenvif->name[0] == '!') {
            apr_table_unset(r->subprocess_env, &setenvif->name[1]);
          } else {
            char *replaced = ap_pregsub(r->pool, setenvif->value, value, AP_MAX_REG_MATCH, regm);
            apr_table_set(r->subprocess_env, setenvif->name, replaced);
          }
        }
      }
    }
  }
}

/**
 * QS_RequestHeaderFilter enforcement
 * @param r
 * @param sconf
 * @parm dconf
 * @return
 */
static int qos_hp_header_filter(request_rec *r, qos_srv_config *sconf, qos_dir_config *dconf) {
  qs_headerfilter_mode_e mode = sconf->headerfilter;
  if(dconf->headerfilter > QS_HEADERFILTER_OFF_DEFAULT) {
    // overrides server configuration
    mode = dconf->headerfilter;
  }
  if(mode > QS_HEADERFILTER_OFF) {
    apr_status_t rv = qos_header_filter(r, sconf, r->headers_in, "request",
                                        sconf->hfilter_table, mode);
    if(rv != APR_SUCCESS) {
      int rc;
      const char *error_page = sconf->error_page;
      qs_set_evmsg(r, "D;"); 
      if(!sconf->log_only) {
        rc = qos_error_response(r, error_page);
        if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
          return rc;
        }
        return rv;
      }
    }
  }
  return DECLINED;
}

/**
 * Dynamic keep alive.
 * Creates a copy of the server_rec and adjusts the keep-aliva settings 
 * for this request.
 *
 * @param r
 * @param sconf
 */
static void qos_keepalive(request_rec *r, qos_srv_config *sconf) {
  if(r->subprocess_env) {
    const char *vtmo = apr_table_get(r->subprocess_env, QS_KEEPALIVE);
    const char *vmax = apr_table_get(r->subprocess_env, QS_MAXKEEPALIVEREQ);
    int ka = -1; // keep alive timeout
    int km = -1; // max keep alive requests
    if(vtmo) {
      ka = atoi(vtmo);
      if(ka == 0 && vtmo[0] != '0') {
        ka = -1;
      }
    }
    if(vmax) {
      km = atoi(vmax);
      if(km == 0 && vmax[0] != '0') {
        km = -1;
      }
    }
    if(ka >= 0 || km >= 0) {
      qs_req_ctx *rctx = qos_rctx_config_get(r);
      if(m_event_mpm) {
        ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, 
                      QOS_LOG_PFX(037)"loaded MPM is 'event'"
                      " and the QS_KeepAliveTimeout/QS_MaxKeepAliveRequests"
                      " directives can't be used.");
        QS_INC_EVENT(sconf, 37);
        return;
      }
      if(QS_ISDEBUG(r->server)) {
        int kaorig = apr_time_sec(r->server->keep_alive_timeout);
        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                      QOS_LOGD_PFX"set keepalive timeout to %d seconds and max"
                      " keepalive requests to %d%s, id=%s",
                      ka >= 0 ? ka :  kaorig,
                      km >= 0 ? km : r->server->keep_alive_max,
                      sconf->log_only ? " (log only)" : "",
                      qos_unique_id(r, NULL));
      }
      /* copy the server record (I know......., but this works) */
      if(!rctx->evmsg || !strstr(rctx->evmsg, "T;")) {
        /* copy it only once (@hp or @out-filter) */
        if(!sconf->log_only) {
          server_rec *sr = apr_pcalloc(r->connection->pool, sizeof(server_rec));
          server_rec *sc = apr_pcalloc(r->connection->pool, sizeof(server_rec));
          memcpy(sr, r->server, sizeof(server_rec));
          memcpy(sc, r->connection->base_server, sizeof(server_rec));
          r->server = sr;
          r->connection->base_server = sc;
        }
        qs_set_evmsg(r, "T;"); 
      }
      if(!sconf->log_only) {
        if(ka >= 0) {
          apr_interval_time_t kat = apr_time_from_sec(ka);
          r->server->keep_alive_timeout = kat;
          r->connection->base_server->keep_alive_timeout = kat;
        }
        if(km >= 0) {
          r->server->keep_alive_max = km;
          r->connection->base_server->keep_alive_max = km;
        }
      }
    }
  }
}

/**
 * QS_EventPerSecLimit
 */
static void qos_lg_event_update(request_rec *r, apr_time_t *t) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                &qos_module);
  qs_actable_t *act = sconf->act;
  if(act->has_events && (apr_table_get(r->notes, QS_R012_ALREADY_BLOCKED) == NULL)) {
    apr_time_t now = apr_time_sec(r->request_time);
    qs_acentry_t *actEntry = act->entry;
    *t = now;
    if(actEntry) {
      apr_global_mutex_lock(act->lock);     /* @CRT13 */
      while(actEntry) {
        if(actEntry->event) {
          if(((actEntry->event[0] != '!') && apr_table_get(r->subprocess_env, actEntry->event)) ||
             ((actEntry->event[0] == '!') && !apr_table_get(r->subprocess_env, &actEntry->event[1]))) {
            if(actEntry->req < LONG_MAX) {
              actEntry->req++;
            }
            if(now > (actEntry->interval + QS_BW_SAMPLING_RATE)) {
              if(actEntry->req_per_sec_limit) {
                /* QS_EventPerSecLimit */
                actEntry->req_per_sec = actEntry->req / (now - actEntry->interval);
                actEntry->req = 0;
                actEntry->interval = now;
                qos_cal_req_sec(sconf, r, actEntry);
              }
            }
          }
        }
        actEntry = actEntry->next;
      }
      apr_global_mutex_unlock(act->lock);   /* @CRT13 */
    }
  }
}

/**
 * QS_EventLimitCount, propagte variable
 */
static void qos_pr_event_limit(request_rec *r, qos_srv_config *sconf) {
  qs_actable_t *act = sconf->act;
  if(act->event_entry && (sconf->event_limit_a->nelts > 0)) {
    int i;
    qos_event_limit_entry_t *entry = act->event_entry;
    apr_time_t now = apr_time_sec(r->request_time);
    apr_global_mutex_lock(act->lock);     /* @CRT46 */
    for(i = 0; i < sconf->event_limit_a->nelts; i++) {
      if(entry->action == QS_EVENT_ACTION_DENY) {
        // propagte to environment (previous value)
        if(entry->limitTime + entry->seconds >= now) {
          apr_table_set(r->subprocess_env,
                        apr_pstrcat(r->pool, entry->env_var, QS_COUNTER_SUFFIX, NULL),
                        apr_psprintf(r->pool, "%d", entry->limit));
        }
      }
      // next rule
      entry++;
    }
    apr_global_mutex_unlock(act->lock);   /* @CRT46 */
  }
}

/**
 * QS_EventLimitCount, detect and enforce
 */
static int qos_hp_event_limit(request_rec *r, qos_srv_config *sconf) {
  apr_status_t rv = DECLINED;
  qs_actable_t *act = sconf->act;
  if(act->event_entry) {
    apr_time_t now = apr_time_sec(r->request_time);
    int i;
    qos_event_limit_entry_t *entry = act->event_entry;
    apr_global_mutex_lock(act->lock);     /* @CRT41 */
    for(i = 0; i < sconf->event_limit_a->nelts; i++) {
      if(entry->action == QS_EVENT_ACTION_DENY) {
        if(apr_table_get(r->subprocess_env, entry->env_var) != NULL) {
          char *eventLimitId = apr_pstrcat(r->pool, QS_R013_ALREADY_BLOCKED, entry->env_var, NULL);
          apr_table_set(r->notes, eventLimitId, "");
          // reset required (expired)?
          if(entry->limitTime + entry->seconds < now) {
            entry->limit = 0;
            entry->limitTime = 0;
          }
          /* increment limit event */
          if(entry->limit < INT_MAX) {
            entry->limit++;
          }
          if(entry->limit == 1) {
            /* ... and start timer */
            entry->limitTime = now;
          }
          // check limit
          if(entry->limit > entry->max) {
            int block = 1;
            char *conditional = "";
            if(entry->condStr != NULL) {
              // conditional enforcement...
              const char *condition = apr_table_get(r->subprocess_env, QS_COND);
              conditional = apr_pstrdup(r->pool, "Cond");
              if(condition == NULL) {
                block = 0; // variable not set
              } else {
                if(ap_regexec(entry->preg, condition, 0, NULL, 0) != 0) {
                  block = 0; // pattern does not match
                }
              }
            }
            if(block) {
              rv = m_retcode;
              ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                            QOS_LOG_PFX(013)"access denied%s,"
                            " QS_%sEventLimitCount rule: %s,"
                            " max=%d, current=%d,"
                            " c=%s, id=%s",
                            sconf->log_only ? " (log only)" : "",
                            conditional,
                            entry->env_var, entry->max, entry->limit,
                            QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                            qos_unique_id(r, "013"));
              QS_INC_EVENT_LOCKED(sconf, 13);
            }
          }
        }
        // propagte to environment (current)
        apr_table_set(r->subprocess_env,
                      apr_pstrcat(r->pool, entry->env_var, QS_COUNTER_SUFFIX, NULL),
                      apr_psprintf(r->pool, "%d", entry->limit));
      }
      // next rule
      entry++;
    }
    apr_global_mutex_unlock(act->lock);   /* @CRT41 */
  }
  if(rv != DECLINED) {
    int rc;
    const char *error_page = sconf->error_page;
    qs_set_evmsg(r, "D;"); 
    if(!sconf->log_only) {
      rc = qos_error_response(r, error_page);
      if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
        rv = rc;
      }
    } else {
      return DECLINED;
    }
  }
  return rv;
}

/**
 * QS_EventRequestLimit
 */
static int qos_hp_event_filter(request_rec *r, qos_srv_config *sconf) {
  apr_status_t rv = DECLINED;
  qs_req_ctx *rctx = qos_rctx_config_get(r);
  qs_actable_t *act = sconf->act;
  if(act->has_events) {
    qs_acentry_t *actEntry = act->entry;
    if(actEntry) {
      apr_global_mutex_lock(act->lock);   /* @CRT31 */
      while(actEntry) {
        if(actEntry->event && (actEntry->limit != -1)) {
          const char *var = apr_table_get(r->subprocess_env, actEntry->event);
          if(var) {
            int match = 1;
            if(actEntry->regex_var) {
              if(ap_regexec(actEntry->regex_var, var, 0, NULL, 0) != 0) {
                match = 0;
              }
            }
            if(match) {
              apr_table_addn(rctx->event_entries, actEntry->url, (char *)actEntry);
              if(actEntry->counter < INT_MAX) {
                actEntry->counter++;
              }
              if(actEntry->counter > actEntry->limit) {
                rv = m_retcode;
                ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                              QOS_LOG_PFX(012)"access denied%s,"
                              " QS_EventRequestLimit rule: %s(%d),"
                              " concurrent requests=%d,"
                              " c=%s, id=%s",
                              sconf->log_only ? " (log only)" : "",
                              actEntry->url, actEntry->limit, actEntry->counter,
                              QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                              qos_unique_id(r, "012"));
                apr_table_set(r->notes, QS_R012_ALREADY_BLOCKED, "");
                QS_INC_EVENT_LOCKED(sconf, 12);
              }
              apr_table_add(r->subprocess_env,
                            apr_psprintf(r->pool, "QS_EventRequestLimit_%s_Counter", actEntry->event),
                            apr_psprintf(r->pool, "%d", actEntry->counter));
            }
          }
        }
        actEntry = actEntry->next;
      }
      apr_global_mutex_unlock(act->lock); /* @CRT31 */
    }
  }
  if(rv != DECLINED) {
    int rc;
    const char *error_page = sconf->error_page;
    qs_set_evmsg(r, "D;"); 
    if(!sconf->log_only) {
      rc = qos_error_response(r, error_page);
      if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
        rv = rc;
      }
    } else {
      return DECLINED;
    }
  }
  return rv;
}

static qs_conn_ctx *qos_get_cconf(conn_rec *connection) {
  conn_rec *c = QS_CONN_MASTER(connection);
  qs_conn_ctx *cconf = NULL;
  qs_conn_base_ctx *base = qos_get_conn_base_ctx(c);
  if(base) {
    cconf = base->cconf;
  }
  return cconf;
}

static qs_conn_ctx *qos_create_cconf(conn_rec *connection, qos_srv_config *sconf) {
  conn_rec *c = QS_CONN_MASTER(connection);
  qs_conn_base_ctx *base = qos_get_conn_base_ctx(c);
  qs_conn_ctx *cconf = apr_pcalloc(c->pool, sizeof(qs_conn_ctx));
  cconf->mc = c;
  cconf->ip6[0] = 0;
  cconf->ip6[1] = 0;
  cconf->evmsg = NULL;
  cconf->sconf = sconf;
  cconf->is_vip = 0;
  cconf->set_vip_by_header = 0;
  cconf->has_lowrate = 0;
  apr_pool_pre_cleanup_register(c->pool, cconf, qos_cleanup_conn);
  if(base == NULL) {
    base = qos_create_conn_base_ctx(c, sconf);
  }
  base->cconf = cconf;
  return cconf;  
}

/*
 * QS_SrvSerialize
 */
static void qos_hp_srv_serialize(request_rec *r, qos_srv_config *sconf, 
                                 qs_req_ctx * rctx) {
  int loops = 0;
  int locked = 0; // we got the lock for this request
  if(!rctx) {
    rctx = qos_rctx_config_get(r);
  }
  while(!locked) {
    apr_global_mutex_lock(sconf->act->lock);   /* @CRT44 */
    if(sconf->act->serialize->locked == 0) {
      // free!! check if we might get the lock for this request
      if(sconf->act->serialize->q1 == 0) {
        // yes: no other request waiting
        locked = 1;
      } else if(sconf->act->serialize->q1 == r->request_time) {
        // yes: waiting for this request (we are the next in the queue)
        locked = 1;
        sconf->act->serialize->q1 = sconf->act->serialize->q2;
        sconf->act->serialize->q2 = 0;
      } else if(sconf->act->serialize->q1 > r->request_time) {
        // yes: not yet in the queue but this request is waiting for a longer time
        //      keep the others in the queue
        locked = 1;
      } else if(sconf->act->serialize->q2 == 0 || sconf->act->serialize->q2 > r->request_time) {
        // no: it's not yet our time... but take the second place in the queue
        sconf->act->serialize->q2 = r->request_time;
      }
    } else {
      // put this request into one of the queues if possible
      if(sconf->act->serialize->q1 == 0) {
        // no other request waiting
        sconf->act->serialize->q1 = r->request_time;
      } else if(sconf->act->serialize->q1 == r->request_time) {
        // already next in the queue
      } else if(sconf->act->serialize->q1 > r->request_time) {
        // older request is waiting, take over
        sconf->act->serialize->q2 = sconf->act->serialize->q1;
        sconf->act->serialize->q1 = r->request_time;
      } else if(sconf->act->serialize->q2 == 0) {
        // no one in on the second place
        sconf->act->serialize->q2 = r->request_time;
      } else if(sconf->act->serialize->q2 == r->request_time) {
        // already next in the queue
      } else if(sconf->act->serialize->q2 > r->request_time) {
        // older request is waiting in the second position, take over
        sconf->act->serialize->q2 = r->request_time;
      }
    }
    if(locked) {
        sconf->act->serialize->locked = 1;
        rctx->srv_serialize_set = 1;
    }
    apr_global_mutex_unlock(sconf->act->lock);   /* @CRT44 */
    if(!locked) {
      /* sleep 50ms */
      qs_set_evmsg(r, "s;"); 
      if(sconf->log_only) {
        return;
      }
      apr_sleep(50000);
    }
    if(loops >= sconf->serializeTMO) {
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                    QOS_LOG_PFX(068)"QS_SrvSerialize exceeds limit of %d seconds, "
                    "id=%s",
                    sconf->serializeTMO / 20,
                    qos_unique_id(r, "037"));
      QS_INC_EVENT(sconf, 37);
      /* remove this request from the queue resp. clear the queue
         to avoid a deadlock */
      apr_global_mutex_lock(sconf->act->lock);     /* @CRT44.1 */
      sconf->act->serialize->q2 = 0;
      sconf->act->serialize->q1 = 0;
      apr_global_mutex_unlock(sconf->act->lock);   /* @CRT44.1 */
      break;
    }
    loops++;
  }
}

/*
 * QS_ClientSerialize
 */
static void qos_hp_cc_serialize(request_rec *r, qos_srv_config *sconf, qs_req_ctx * rctx) {
  qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
  qs_conn_ctx *cconf = qos_get_cconf(r->connection);
  if(!rctx) {
    rctx = qos_rctx_config_get(r);
  }
  if(u && cconf) {
    int loops = 0;
    int locked = 0;
    qos_s_entry_t searchE;
    const char *forwardedForLogIP = qos_get_clientIP(r, sconf, cconf,
                                                     "hp", rctx->cc_serialize_ip);
    searchE.ip6[0] = rctx->cc_serialize_ip[0];
    searchE.ip6[1] = rctx->cc_serialize_ip[1];

    /* wait until we get a lock */
    while(!locked) {
      qos_s_entry_t **clientEntry = NULL;
      apr_global_mutex_lock(u->qos_cc->lock);          /* @CRT36 */
      clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, apr_time_sec(r->request_time));
      if((*clientEntry)->serialize == 0) {
        // free! check if this request is the next in the queue */
        if(((*clientEntry)->serializeQueue == 0) || (r->request_time <= (*clientEntry)->serializeQueue)) {
          (*clientEntry)->serialize = 1;
          (*clientEntry)->serializeQueue = 0;
          rctx->cc_serialize_set = 1;
          locked = 1;
        }
      } else {
        // put the request into the queue
        if((*clientEntry)->serializeQueue == 0) {
          // the only waiting req
          (*clientEntry)->serializeQueue = r->request_time;
        } else {
          if((*clientEntry)->serializeQueue > r->request_time) {
            // this request is waiting for a longer time
            (*clientEntry)->serializeQueue = r->request_time;
          }
        }
      }
      apr_global_mutex_unlock(u->qos_cc->lock);        /* @CRT36 */   
      if(!locked) {
        /* sleep 100ms */
        qs_set_evmsg(r, "s;"); 
        if(sconf->log_only) {
          return;
        }
        apr_sleep(100000);
      }
      // max wait time: 5 minutes
      if(loops >= 3000) {
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                      QOS_LOG_PFX(068)"QS_ClientSerialize exceeds limit of 5 minutes, "
                      "c=%s, id=%s",
                      forwardedForLogIP == NULL ? "-" : forwardedForLogIP,
                      qos_unique_id(r, "068"));
        QS_INC_EVENT(sconf, 68);
        /* remove this request from the queue resp. clear the queue
           to avoid a deadlock */
        apr_global_mutex_lock(u->qos_cc->lock);          /* @CRT36.1 */
        clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, apr_time_sec(r->request_time));
        (*clientEntry)->serializeQueue = 0;
        apr_global_mutex_unlock(u->qos_cc->lock);        /* @CRT36.1 */      
        break;
      }
      loops++;
    }
  }
}

/*
 * QS_ClientEventRequestLimit
 */
static int qos_hp_cc_event_count(request_rec *r, qos_srv_config *sconf, 
                                 qs_req_ctx * rctx) {
  qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
  qs_conn_ctx *cconf = qos_get_cconf(r->connection);
  if(!rctx) {
    rctx = qos_rctx_config_get(r);
  }
  if(u && cconf &&
     r->subprocess_env && apr_table_get(r->subprocess_env, "QS_EventRequest")) {
    int vip = 0;
    int count = 0;
    qos_s_entry_t **clientEntry = NULL;
    qos_s_entry_t searchE;
    const char *forwardedForLogIP = qos_get_clientIP(r, sconf, cconf,
                                                     "hp", rctx->cc_event_ip);
    
    rctx->cc_event_req_set = 1;
    searchE.ip6[0] = rctx->cc_event_ip[0];
    searchE.ip6[1] = rctx->cc_event_ip[1];
    apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT33 */
    clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, apr_time_sec(r->request_time));
    if((*clientEntry)->event_req < INT_MAX) {
      (*clientEntry)->event_req++;
    }
    count = (*clientEntry)->event_req;
    if((*clientEntry)->vip || rctx->is_vip) {
      vip = 1;
    }
    apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT33 */
    if(vip) {
      apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
    }
    if(count > sconf->qos_cc_event_req) {
      if(vip) {
        qs_set_evmsg(r, "S;"); 
      } else {
        int rc;
        const char *error_page = sconf->error_page;
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                      QOS_LOG_PFX(065)"access denied%s,"
                      " QS_ClientEventRequestLimit rule:"
                      " max=%d, current=%d, c=%s, id=%s",
                      sconf->log_only ? " (log only)" : "",
                      sconf->qos_cc_event_req,
                      count,
                      forwardedForLogIP == NULL ? "-" : 
                      forwardedForLogIP,
                      qos_unique_id(r, "065"));
        QS_INC_EVENT(sconf, 65);
        qs_set_evmsg(r, "D;"); 
        if(!sconf->log_only) {
          rc = qos_error_response(r, error_page);
          if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
            return rc;
          }
          return m_retcode;
        }
      }
    }
  }
  return DECLINED;
}

/* QS_SetEnvIfCmp */
static void qos_setenvifcmp(request_rec *r, apr_array_header_t *cmps) {
  int i;
  qos_cmp_entry_t *entries = (qos_cmp_entry_t *)cmps->elts;
  for(i = 0; i < cmps->nelts; ++i) {
    qos_cmp_entry_t *b = &entries[i];
    const char *leftStr = apr_table_get(r->subprocess_env, b->left);
    const char *rightStr = apr_table_get(r->subprocess_env, b->right);
    if(leftStr != NULL && rightStr != NULL) {
      int set = 0;
      if(qos_isnum(leftStr) && qos_isnum(rightStr)) {
        int left = atoi(leftStr);
        int right = atoi(rightStr);
        switch (b->cmp) {
        case QS_CMP_EQ:
          if(left == right) {
            set = 1;
          }
          break;
        case QS_CMP_NE:
          if(left != right) {
            set = 1;
          }
          break;
        case QS_CMP_GT:
          if(left > right) {
            set = 1;
          }
          break;
        case QS_CMP_LT:
          if(left < right) {
            set = 1;
          }
          break;
        }
      } else {
        int c = strcasecmp(leftStr, rightStr);
        switch (b->cmp) {
        case QS_CMP_EQ:
          if(c == 0) {
            set = 1;
          }
          break;
        case QS_CMP_NE:
          if(c != 0) {
            set = 1;
          }
          break;
        case QS_CMP_GT:
          if(c < 0) {
            set = 1;
          }
          break;
        case QS_CMP_LT:
          if(c > 0) {
            set = 1;
          }
          break;
        }
      }
      if(set) {
        if(b->variable[0] == '!') {
          apr_table_unset(r->subprocess_env, &b->variable[1]);
        } else {
          apr_table_set(r->subprocess_env, b->variable, b->value);
        }
      }
    }
  }
  return;
}

/*
 * QS_EventPerSecLimit/QS_EventKBytesPerSecLimit
 * returns the max req_per_sec_block_rate/kbytes_per_sec_limit and the event
 *         with the lowest kbytes_per_sec_limit.
 */
static qs_acentry_t *qos_hp_event_count(request_rec *r, 
                                        int *req_per_sec_block, 
                                        apr_off_t *kbytes_per_sec_limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                &qos_module);
  qs_actable_t *act = sconf->act;
  qs_acentry_t *event_kbytes_limit = NULL;
  *req_per_sec_block = 0;
  *kbytes_per_sec_limit = 0;
  if(act->has_events) {
    qs_acentry_t *actEntry = act->entry;
    if(actEntry) {
      apr_global_mutex_lock(act->lock);   /* @CRT12 */
      while(actEntry) {
        if(actEntry->event && (actEntry->limit == -1)) {
          if(((actEntry->event[0] != '!') && apr_table_get(r->subprocess_env, actEntry->event)) ||
             ((actEntry->event[0] == '!') && !apr_table_get(r->subprocess_env, &actEntry->event[1]))) {
            if(actEntry->req_per_sec_limit) {
              /* QS_EventPerSecLimit */
              if(actEntry->req_per_sec_block_rate > *req_per_sec_block) {
                *req_per_sec_block = actEntry->req_per_sec_block_rate;
              }
            } else {
              /* QS_EventKBytesPerSecLimit */
              if(actEntry->kbytes_per_sec_limit) {
                if((*kbytes_per_sec_limit == 0) ||
                   (actEntry->kbytes_per_sec_limit < *kbytes_per_sec_limit)) {
                  *kbytes_per_sec_limit = actEntry->kbytes_per_sec_limit;
                  event_kbytes_limit = actEntry;
                }
              }
            }
          }
        }
        actEntry = actEntry->next;
      }
      apr_global_mutex_unlock(act->lock); /* @CRT12 */
    }
  }
  return event_kbytes_limit;
}

static apr_size_t qos_packet_rate(qos_ifctx_t *inctx, apr_bucket_brigade *bb) {
  apr_bucket *b;
  apr_size_t total = 0;
  for(b = APR_BRIGADE_FIRST(bb); b != APR_BRIGADE_SENTINEL(bb); b = APR_BUCKET_NEXT(b)) {
    if(b->length) {
      total = total + b->length;
    }
  }
  return total;
}

/**
 * start packet rate measure (if filter has not already been inserted)
 */
static void qos_pktrate_pc(conn_rec *connection, qos_srv_config *sconf) {
  conn_rec *c = connection;
  qos_ifctx_t *inctx = qos_get_ifctx(c->input_filters);
  if(inctx == NULL) {
    inctx = qos_create_ifctx(c, sconf);
    ap_add_input_filter("qos-in-filter", inctx, NULL, c);
  }
  inctx->lowrate = 0;
}

/**
 * timeout control at process connection handler
 */
static void qos_timeout_pc(conn_rec *connection, qos_srv_config *sconf) {
  conn_rec *c = connection;
  qos_ifctx_t *inctx = qos_get_ifctx(c->input_filters);
  if(inctx) {
    inctx->status = QS_CONN_STATE_HEAD;
    inctx->time = time(NULL);
    inctx->nbytes = 0;
#if APR_HAS_THREADS
    if(sconf->inctx_t && !sconf->inctx_t->exit && sconf->min_rate_off == 0) {
      apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT22 */
      apr_table_setn(sconf->inctx_t->table,
                     QS_INCTX_ID,
                     (char *)inctx);
      apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT22 */
    }
#endif
  }
}

/** 
 * determines client behavior based on accessed content types
 *
 * @return 0=normal, -1=unknown (not enough data), >=1 abnormal
 */
static int qos_content_type(request_rec *r, qos_srv_config *sconf,
                            qos_s_t *s, qos_s_entry_t *e, int limit) {
  int penalty = -1;
  const char *ct = apr_table_get(r->headers_out, "Content-Type");
  e->events++; // events counts requests and connections
  if(r->status == 304) {
    e->notmodified ++;
    s->notmodified ++;
  }
  if(ct) {
    if(ap_strcasestr(ct, "html")) {
      e->events++; // learn faster if user requests HTML content (main pages)
      e->html++;
      s->html++;
      goto end;
    } else if(ap_strcasestr(ct, "image")) {
      e->img++;
      s->img++;
      goto end;
    } else if(ap_strcasestr(ct, "css")) {
      e->cssjs++;
      s->cssjs++;
      goto end;
    } else if(ap_strcasestr(ct, "javascript")) {
      e->cssjs++;
      s->cssjs++;
      goto end;
    }
  }
  e->other++;
  s->other++;

 end:
  /* compare this client with other clients */
  if(e->events > QOS_CC_BEHAVIOR_THR_SINGLE) {
    penalty = 0;
    if(limit &&
       ((sconf->static_on == 1) ||
        (s->html > QOS_CC_BEHAVIOR_THR && s->html && s->img && s->cssjs && s->other && s->notmodified))) {
      int i;
      unsigned int server[5];
      unsigned int client[5];
      // note: all e->* variables are initialized by "1" to avoid FPE
      if(sconf->static_on == 1) {
        /* use predefined value */
        unsigned long e_all = e->html + e->img + e->cssjs + e->other + e->notmodified;
        server[0] = sconf->static_html;
        server[1] = sconf->static_cssjs;
        server[2] = sconf->static_img;
        server[3] = sconf->static_other;
        server[4] = sconf->static_notmodified;
        client[0] = 100 * e->html / e_all;
        client[1] = 100 * e->cssjs / e_all;
        client[2] = 100 * e->img / e_all;
        client[3] = 100 * e->other / e_all;
        client[4] = 100 * e->notmodified / e_all;
      } else {
        /* learn average */
        unsigned long long s_all = s->html + s->img + s->cssjs + s->other + s->notmodified;
        unsigned long e_all = e->html + e->img + e->cssjs + e->other + e->notmodified;
        server[0] = 100 * s->html / s_all;
        server[1] = 100 * s->cssjs / s_all;
        server[2] = 100 * s->img / s_all;
        server[3] = 100 * s->other / s_all;
        server[4] = 100 * s->notmodified / s_all;
        client[0] = 100 * e->html / e_all;
        client[1] = 100 * e->cssjs / e_all;
        client[2] = 100 * e->img / e_all;
        client[3] = 100 * e->other / e_all;
        client[4] = 100 * e->notmodified / e_all;
      }
      for(i = 0; i < 5; i++) {
        if(client[i] > (server[i] + sconf->cc_tolerance)) {
          penalty++;
        } else {
          if((server[i] > sconf->cc_tolerance) &&
             (client[i] < (server[i] - sconf->cc_tolerance))) {
            penalty++;
          }
        }
      }
    }
  }
  return penalty;
}

//static void qos_error_log(const char *file, int line, int level,
//                          apr_status_t status, const server_rec *s,
//                          const request_rec *r, apr_pool_t *pool,
//                          const char *errstr) {
//  return;
//}

/**
 * QS_EventLimitCount, detect/update only
 */
static void qos_logger_event_limit(request_rec *r, qos_srv_config *sconf) {
  qs_actable_t *act = sconf->act;
  if(act->event_entry && (sconf->event_limit_a->nelts > 0)) {
    apr_time_t now = apr_time_sec(r->request_time);
    int i;
    qos_event_limit_entry_t *actEntry = act->event_entry;
    apr_global_mutex_lock(act->lock);     /* @CRT42 */
    for(i = 0; i < sconf->event_limit_a->nelts; i++) {
      if(actEntry->action == QS_EVENT_ACTION_DENY) {
        int decEvent = get_qs_event(r, actEntry->eventDecStr);
        if(decEvent > 0) {
          if(decEvent >= actEntry->limit) {
            actEntry->limit = 0;
            actEntry->limitTime = 0;
          } else {
            actEntry->limit = actEntry->limit - decEvent;
          }
        }
        if(apr_table_get(r->subprocess_env, actEntry->env_var) != NULL) {
          // increment only once
          char *eventLimitId = apr_pstrcat(r->pool, QS_R013_ALREADY_BLOCKED, actEntry->env_var, NULL);
          if(apr_table_get(r->notes, eventLimitId) == NULL) {
            // reset required (expired)?
            if(actEntry->limitTime + actEntry->seconds < now) {
              actEntry->limit = 0;
              actEntry->limitTime = 0;
            }
            /* increment limit event */
            if(actEntry->limit < INT_MAX) {
              actEntry->limit++;
            }
            if(actEntry->limit == 1) {
              /* ... and start timer */
              actEntry->limitTime = now;
            }
          }
        }
      }
      // next rule
      actEntry++;
    }
    apr_global_mutex_unlock(act->lock);   /* @CRT42 */
  }
}

/**
 * client control rules at log transaction
 */
static void qos_logger_cc(request_rec *r, qos_srv_config *sconf, qs_req_ctx *rctx) {
  int lowrate = 0;
  int unusual_behavior = -1;
  int block_event = get_qs_event(r, QS_BLOCK);
  const char *block_seen = apr_table_get(r->subprocess_env, QS_BLOCK_SEEN);
  int block_dec = get_qs_event(r, QS_BLOCK_DEC);
  qs_conn_ctx *cconf = qos_get_cconf(r->connection);
  qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
  apr_time_t now = apr_time_sec(r->request_time);
  qos_s_entry_t **clientEntry = NULL;
  qos_s_entry_t **clientEntryFromHdr = NULL; // client ip entry from header
  qos_s_entry_t searchE;
  qos_s_entry_t searchEFromHdr;
 
  if(block_seen != NULL) {
    block_event = 0;
  }

  if(sconf->qos_cc_prefer_limit || (sconf->req_rate != -1)) {
    qos_ifctx_t *inctx = qos_get_ifctx(r->connection->input_filters);
    if(inctx) {
      if(inctx->lowrate > QS_PKT_RATE_TH) {
        lowrate = inctx->lowrate;
      }
      if(inctx->lowrate != -1) {
        inctx->lowrate = 0;
      }
      if(inctx->status > QS_CONN_STATE_NEW) {
        inctx->r = NULL;
        inctx->status = QS_CONN_STATE_KEEP;
      }
      if(inctx->shutdown) {
        lowrate++;
        inctx->shutdown = 0;
      }
    }
  }

  if(cconf) {
    // works for real connections only (no HTTP/2)
    searchE.ip6[0] = cconf->ip6[0];
    searchE.ip6[1] = cconf->ip6[1];
  } else {
    // HTTP/2
    apr_uint64_t ci6[2];
    qos_ip_str2long(QS_CONN_REMOTEIP(r->connection), ci6);
    searchE.ip6[0] = ci6[0];
    searchE.ip6[1] = ci6[1];
  }
  qos_get_clientIP(r, sconf, cconf, "logger", searchEFromHdr.ip6);

  apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT19 */
  clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, apr_time_sec(r->request_time));
  if(searchEFromHdr.ip6[0] == searchE.ip6[0] && searchEFromHdr.ip6[1] == searchE.ip6[1]) {
    clientEntryFromHdr = clientEntry; // same as connection
  } else {
    clientEntryFromHdr = qos_cc_getOrSet(u->qos_cc, &searchEFromHdr, apr_time_sec(r->request_time));
  }

  if(rctx->cc_event_req_set) {
    /* QS_ClientEventRequestLimit */
    qos_s_entry_t **eEvent = NULL;
    rctx->cc_event_req_set = 0;
    if(rctx->cc_event_ip[0] == searchE.ip6[0] &&
       rctx->cc_event_ip[1] == searchE.ip6[1]) {
      // connection ip
      eEvent = clientEntry;
    } else if(rctx->cc_event_ip[0] == searchEFromHdr.ip6[0] &&
              rctx->cc_event_ip[1] == searchEFromHdr.ip6[1]) {
      // from header
      eEvent = clientEntryFromHdr;
    } else {
      // looks like the header has changed or is no longer available
      qos_s_entry_t searchEvent;
      searchEvent.ip6[0] = rctx->cc_event_ip[0];
      searchEvent.ip6[1] = rctx->cc_event_ip[1];
      eEvent = qos_cc_get0(u->qos_cc, &searchEvent, apr_time_sec(r->request_time));
    }
    if(eEvent) {
      if((*eEvent)->event_req > 0) {
        (*eEvent)->event_req--;
      }
    }
  }

  if(rctx->cc_serialize_set) {
    /* QS_ClientSerialize */
    qos_s_entry_t **eSerialize = NULL;
    rctx->cc_serialize_set = 0;
    if(rctx->cc_serialize_ip[0] == searchE.ip6[0] &&
       rctx->cc_serialize_ip[1] == searchE.ip6[1]) {
      // connection ip
      eSerialize = clientEntry;
    } else if(rctx->cc_serialize_ip[0] == searchEFromHdr.ip6[0] &&
              rctx->cc_serialize_ip[1] == searchEFromHdr.ip6[1]) {
      // from header
      eSerialize = clientEntryFromHdr;
    } else {
      // looks like the header has changed or is no longer available
      qos_s_entry_t searchSerialize;
      searchSerialize.ip6[0] = rctx->cc_serialize_ip[0];
      searchSerialize.ip6[1] = rctx->cc_serialize_ip[1];
      eSerialize = qos_cc_get0(u->qos_cc, &searchSerialize, apr_time_sec(r->request_time));
    }
    if(eSerialize) {
      (*eSerialize)->serialize = 0;
    }
  }
  
  if(sconf->qos_cc_prefer) {
    // QS_ClientPrefer is not enabled
    unusual_behavior = qos_content_type(r, sconf, u->qos_cc, *clientEntry, sconf->qos_cc_prefer_limit);
    if(unusual_behavior == 0) {
      // normal behavior
      (*clientEntry)->lowratestatus |= QOS_LOW_FLAG_BEHAVIOR_OK;
      (*clientEntry)->lowratestatus &= ~QOS_LOW_FLAG_BEHAVIOR_BAD;
    } else {
      // unknown or bad behavior
      (*clientEntry)->lowratestatus &= ~QOS_LOW_FLAG_BEHAVIOR_OK;
    }
  }

  if(block_event || block_dec || lowrate || (unusual_behavior > 0)) {
    if(((*clientEntry)->blockTime + sconf->qos_cc_blockTime) < now) {
      /* reset expired events */
      if((*clientEntry)->blockMsg > QS_LOG_REPEAT) {
        // write remaining log lines
        ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r->connection->base_server,
                     QOS_LOG_PFX(060)"access denied (previously), "
                     "QS_ClientEventBlockCount rule: "
                     "max=%d, current=%hu, "
                     "message repeated %d times, "
                     "c=%s",
                     sconf->qos_cc_block,
                     (*clientEntry)->block,
                     (*clientEntry)->blockMsg % QS_LOG_REPEAT,
                     QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : 
                     QS_CONN_REMOTEIP(r->connection)/*no id here, this r is okay*/);
        QS_INC_EVENT_LOCKED(sconf, 60);
        (*clientEntry)->blockMsg = 0;
      }
      (*clientEntry)->block = 0;
      (*clientEntry)->blockTime = 0;
    }
    /* mark lowpkt client */
    if(lowrate || (unusual_behavior > 0)) {
      (*clientEntry)->lowrate = apr_time_sec(r->request_time);
      if(lowrate) {
        (*clientEntry)->lowratestatus |= QOS_LOW_FLAG_PKGRATE;
      }
      if(unusual_behavior > 1) {
        (*clientEntry)->lowratestatus |= QOS_LOW_FLAG_BEHAVIOR_BAD;
        (*clientEntry)->lowratestatus &= ~QOS_LOW_FLAG_BEHAVIOR_OK;
      }
      qs_set_evmsg(r, "r;"); 
    }
    if(block_dec > 0) {
      if(block_dec >= (*clientEntry)->block) {
        (*clientEntry)->block = 0;
        (*clientEntry)->blockTime = 0;
      } else {
        (*clientEntry)->block = (*clientEntry)->block - block_dec;
      }
    }
    if(block_event) {
      int newValue = (*clientEntry)->block + block_event;
      if((*clientEntry)->block == 0) {
        /* start timer */
        (*clientEntry)->blockTime = now;
      }
      /* ...and increment/increase block event counter */
      (*clientEntry)->block = newValue > USHRT_MAX ? USHRT_MAX : newValue;
    }
  } else if((*clientEntry)->lowrate) {
    /* reset low prio client after 24h (resp. QOS_LOW_TIMEOUT seconds) */
    if(((*clientEntry)->lowrate + QOS_LOW_TIMEOUT) < now) {
      (*clientEntry)->lowrate = 0;
      if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_BEHAVIOR_OK) {
        (*clientEntry)->lowratestatus = QOS_LOW_FLAG_BEHAVIOR_OK;
      } else {
        (*clientEntry)->lowratestatus = 0;
      }
    }
  }

  /* QS_Limit* */
  if(u->qos_cc->limitTable) {
    int limitTableIndex;
    apr_table_entry_t *limitTableEntry = (apr_table_entry_t *)apr_table_elts(u->qos_cc->limitTable)->elts;
    for(limitTableIndex = 0; 
        limitTableIndex < apr_table_elts(u->qos_cc->limitTable)->nelts;
        limitTableIndex++) {
      int eventSet = 0;
      const char *eventName = limitTableEntry[limitTableIndex].key;
      qos_s_entry_limit_conf_t *eventLimitConf = (qos_s_entry_limit_conf_t *)limitTableEntry[limitTableIndex].val;
      const char *clearEvent = apr_table_get(r->subprocess_env, eventLimitConf->eventClearStr);
      int decEvent = get_qs_event(r, eventLimitConf->eventDecStr);

      /*
       * reset expired events, clear event counter, decrement event counter
       */
      if(clearEvent ||
         (((*clientEntryFromHdr)->limit[limitTableIndex].limitTime + eventLimitConf->limitTime) < now)) {
        (*clientEntryFromHdr)->limit[limitTableIndex].limit = 0;
        (*clientEntryFromHdr)->limit[limitTableIndex].limitTime = 0;
      }
      if(decEvent > 0) {
        if(decEvent >= (*clientEntryFromHdr)->limit[limitTableIndex].limit) {
          (*clientEntryFromHdr)->limit[limitTableIndex].limit = 0;
          (*clientEntryFromHdr)->limit[limitTableIndex].limitTime = 0;
        } else {
          (*clientEntryFromHdr)->limit[limitTableIndex].limit = (*clientEntryFromHdr)->limit[limitTableIndex].limit - decEvent;
        }
      }

      /*
       * check for new events
       */
      eventSet = get_qs_event(r, eventName);
      if(eventSet) {
        char *seenEvent;
        if(strcasecmp(eventName, QS_LIMIT_DEFAULT) == 0) {
          // backward compat/event forwarding
          seenEvent = apr_pstrcat(r->pool, QS_LIMIT_SEEN, NULL);
        } else {
          seenEvent = apr_pstrcat(r->pool, QS_LIMIT_SEEN, eventName, NULL);
        }
        if(apr_table_get(r->subprocess_env, seenEvent) == NULL) {
          int newValue = (*clientEntryFromHdr)->limit[limitTableIndex].limit + eventSet;
          /* only once per request */
          apr_table_set(r->subprocess_env, seenEvent, "");
          if((*clientEntryFromHdr)->limit[limitTableIndex].limit == 0) {
            /* start timer... */
            (*clientEntryFromHdr)->limit[limitTableIndex].limitTime = now;
          }
          /* ... and increase limit event */
          (*clientEntryFromHdr)->limit[limitTableIndex].limit = newValue > USHRT_MAX ? USHRT_MAX : newValue;
        }
      }
    }
  }
  apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT19 */
  if(block_event) {
    /* only once per request */
    apr_table_set(r->subprocess_env, QS_BLOCK_SEEN, "");
    apr_table_set(r->connection->notes, QS_BLOCK_SEEN, "");
  }
}

/**
 * client control rules at header parser
 */
static int qos_hp_cc(request_rec *r, qos_srv_config *sconf, char **msg, char **uid) {
  int ret = DECLINED;
  if(sconf->has_qos_cc) {
    int req_per_sec_block_rate = 0;
    qos_s_entry_t **clientEntry = NULL;
    qos_s_entry_t **clientEntryFromHdr = NULL;
    qos_s_entry_t searchE;
    qos_s_entry_t searchEFromHdr;
    qs_conn_ctx *cconf = qos_get_cconf(r->connection);
    const char *forwardedForLogIP = QS_CONN_REMOTEIP(r->connection);
    qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
    int excludeFromBlock = qos_is_excluded_ip(r->connection, sconf->cc_exclude_ip);
    if(cconf) {
      searchE.ip6[0] = cconf->ip6[0];
      searchE.ip6[1] = cconf->ip6[1];
    } else {
      // HTTP/2
      apr_uint64_t ci6[2];
      qos_ip_str2long(QS_CONN_REMOTEIP(r->connection), ci6);
      searchE.ip6[0] = ci6[0];
      searchE.ip6[1] = ci6[1];
    }

    forwardedForLogIP = qos_get_clientIP(r, sconf, cconf, "hp",
                                         searchEFromHdr.ip6);

    apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT17 */
    clientEntry = qos_cc_get0(u->qos_cc, &searchE, apr_time_sec(r->request_time));
    if(!clientEntry) {
      clientEntry = qos_cc_set(u->qos_cc, &searchE, apr_time_sec(r->request_time));
    } else {
      /* update time */
      (*clientEntry)->time = apr_time_sec(r->request_time);
    }
    if(searchEFromHdr.ip6[0] == searchE.ip6[0] && searchEFromHdr.ip6[1] == searchE.ip6[1]) {
      clientEntryFromHdr = clientEntry; // same as connection
    } else {
      clientEntryFromHdr = qos_cc_get0(u->qos_cc, &searchEFromHdr, apr_time_sec(r->request_time));
      if(!clientEntryFromHdr) {
        clientEntryFromHdr = qos_cc_set(u->qos_cc, &searchEFromHdr, apr_time_sec(r->request_time));
      } else {
        /* update time */
        (*clientEntryFromHdr)->time = apr_time_sec(r->request_time);
      }
    }
    if(sconf->qos_cc_event) {
      apr_time_t now = apr_time_sec(r->request_time);
      const char *v = apr_table_get(r->subprocess_env, QS_EVENT);
      if(v) {
        if((*clientEntry)->req < LONG_MAX) {
          (*clientEntry)->req++;
        }
        if(now > (*clientEntry)->interval + QS_BW_SAMPLING_RATE) {
          /* calc req/sec */
          (*clientEntry)->req_per_sec = (*clientEntry)->req / (now - (*clientEntry)->interval);
          (*clientEntry)->req = 0;
          (*clientEntry)->interval = now;
          /* calc block rate */
          if((*clientEntry)->req_per_sec > sconf->qos_cc_event) {
            int factor = (((*clientEntry)->req_per_sec * 100) / sconf->qos_cc_event) - 100;
            (*clientEntry)->req_per_sec_block_rate = (*clientEntry)->req_per_sec_block_rate + factor;
            if((*clientEntry)->req_per_sec_block_rate > QS_MAX_DELAY/1000) {
              (*clientEntry)->req_per_sec_block_rate = QS_MAX_DELAY/1000;
            }
            /* QS_ClientEventPerSecLimit */
            ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, r,
                          QOS_LOG_PFX(061)"request rate limit,"
                          " rule: "QS_EVENT"(%d), req/sec=%ld,"
                          " delay=%dms%s",
                          sconf->qos_cc_event,
                          (*clientEntry)->req_per_sec, (*clientEntry)->req_per_sec_block_rate,
                          (*clientEntry)->req_per_sec_block_rate == QS_MAX_DELAY/1000 ? " (max)" : "");
            QS_INC_EVENT_LOCKED(sconf, 61);
          } else if((*clientEntry)->req_per_sec_block_rate > 0) {
            if((*clientEntry)->req_per_sec_block_rate < 50) {
              (*clientEntry)->req_per_sec_block_rate = 0;
            } else {
              int factor = (*clientEntry)->req_per_sec_block_rate / 4;
              (*clientEntry)->req_per_sec_block_rate = (*clientEntry)->req_per_sec_block_rate - factor;
            }
            ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_INFO, 0, r,
                          QOS_LOG_PFX(062)"request rate limit,"
                          " rule: "QS_EVENT"(%d), req/sec=%ld,"
                          " delay=%dms",
                          sconf->qos_cc_event,
                          (*clientEntry)->req_per_sec, (*clientEntry)->req_per_sec_block_rate);
            QS_INC_EVENT_LOCKED(sconf, 62);
          }
        }
        req_per_sec_block_rate = (*clientEntry)->req_per_sec_block_rate;
      }
    }
    if(sconf->qos_cc_block && !excludeFromBlock) {
      apr_time_t now = apr_time_sec(r->request_time);
      int block_event = get_qs_event(r, QS_BLOCK);
      if(((*clientEntry)->blockTime + sconf->qos_cc_blockTime) < now) {
        /* reset expired events */
        if((*clientEntry)->blockMsg > QS_LOG_REPEAT) {
          // write remaining log lines
          ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r->connection->base_server,
                       QOS_LOG_PFX(060)"access denied (previously), "
                       "QS_ClientEventBlockCount rule: "
                       "max=%d, current=%hu, "
                       "message repeated %d times, "
                       "c=%s",
                       sconf->qos_cc_block,
                       (*clientEntry)->block,
                       (*clientEntry)->blockMsg % QS_LOG_REPEAT,
                       QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : 
                       QS_CONN_REMOTEIP(r->connection)/*no id here, this r is okay*/);
          QS_INC_EVENT_LOCKED(sconf, 60);
          (*clientEntry)->blockMsg = 0;
        }
        (*clientEntry)->block = 0;
        (*clientEntry)->blockTime = 0;
      }
      if(block_event) {
        if((*clientEntry)->block == 0) {
          /* start timer */
          (*clientEntry)->blockTime = now;
        }
        /* ... and increment block event */
        (*clientEntry)->block += block_event;
        /* only once per request */
        apr_table_set(r->subprocess_env, QS_BLOCK_SEEN, "");
        apr_table_set(r->connection->notes, QS_BLOCK_SEEN, "");
      }
      if((*clientEntry)->block >= sconf->qos_cc_block) {
        *uid = apr_pstrdup(r->connection->pool, "060");
        *msg = apr_psprintf(r->connection->pool, 
                            QOS_LOG_PFX(060)"access denied%s, "
                            "QS_ClientEventBlockCount rule: "
                            "max=%d, current=%hu, age=%"APR_TIME_T_FMT", c=%s",
                            sconf->log_only ? " (log only)" : "",
                            sconf->qos_cc_block,
                            (*clientEntry)->block,
                            now - (*clientEntry)->blockTime,
                            QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : 
                            QS_CONN_REMOTEIP(r->connection));
        QS_INC_EVENT_LOCKED(sconf, 60);
        ret = m_retcode;
        (*clientEntry)->lowrate = apr_time_sec(r->request_time);
        (*clientEntry)->lowratestatus |= QOS_LOW_FLAG_EVENTBLOCK;
        qs_set_evmsg(r, "r;"); 
      }
    }
    if(u->qos_cc->limitTable) {
      apr_time_t now = apr_time_sec(r->request_time);
      int limitTableIndex;
      apr_table_entry_t *limitTableEntry = (apr_table_entry_t *)apr_table_elts(u->qos_cc->limitTable)->elts;
      for(limitTableIndex = 0; 
          limitTableIndex < apr_table_elts(u->qos_cc->limitTable)->nelts;
          limitTableIndex++) {
        time_t remaining = 0;
        int eventSet = 0;
        const char *eventName = limitTableEntry[limitTableIndex].key;
        qos_s_entry_limit_conf_t *eventLimitConf = (qos_s_entry_limit_conf_t *)limitTableEntry[limitTableIndex].val;
        const char *clearEvent = apr_table_get(r->subprocess_env, eventLimitConf->eventClearStr);

        /*
         * reset expired events or clear event counter
         */
        if(clearEvent ||
           (((*clientEntryFromHdr)->limit[limitTableIndex].limitTime + eventLimitConf->limitTime) < now)) {
          (*clientEntryFromHdr)->limit[limitTableIndex].limit = 0;
          (*clientEntryFromHdr)->limit[limitTableIndex].limitTime = 0;
        }

        /*
         * check for new events
         */
        eventSet = get_qs_event(r, eventName);
        if(eventSet) {
          char *seenEvent;
          if(strcasecmp(eventName, QS_LIMIT_DEFAULT) == 0) {
            // backward compat/event forwarding
            seenEvent = apr_pstrcat(r->pool, QS_LIMIT_SEEN, NULL);
          } else {
            seenEvent = apr_pstrcat(r->pool, QS_LIMIT_SEEN, eventName, NULL);
          }
          if(apr_table_get(r->subprocess_env, seenEvent) == NULL) {
            int newValue = (*clientEntryFromHdr)->limit[limitTableIndex].limit + eventSet;
            // first occurrence
            apr_table_set(r->subprocess_env, seenEvent, "");
            if((*clientEntryFromHdr)->limit[limitTableIndex].limit == 0) {
              /* .start timer */
              (*clientEntryFromHdr)->limit[limitTableIndex].limitTime = now;
            }
            /* increment limit event */
            (*clientEntryFromHdr)->limit[limitTableIndex].limit = newValue > USHRT_MAX ? USHRT_MAX : newValue;
          }
        }

        /*
         * propagate to env
         */
        apr_table_set(r->subprocess_env,
                      apr_pstrcat(r->pool, QS_LIMIT_NAME_PFX, eventName, NULL),
                      eventName);
        apr_table_set(r->subprocess_env,
                      apr_pstrcat(r->pool, eventName, QS_COUNTER_SUFFIX, NULL),
                      apr_psprintf(r->pool, "%d", (*clientEntryFromHdr)->limit[limitTableIndex].limit));
        
        remaining = ((*clientEntryFromHdr)->limit[limitTableIndex].limitTime + eventLimitConf->limitTime) - now;
        apr_table_set(r->subprocess_env,
                      apr_pstrcat(r->pool, eventName, QS_LIMIT_REMAINING, NULL),
                      apr_psprintf(r->pool, "%"APR_TIME_T_FMT, remaining > 0 ? remaining : 0));

        /*
         * enforce limit
         */
        if((*clientEntryFromHdr)->limit[limitTableIndex].limit >= eventLimitConf->limit) {
          int block = 1;
          char *conditional = "";
          if(eventLimitConf->condStr != NULL) {
            // conditional enforcement...
            const char *condition = apr_table_get(r->subprocess_env, QS_COND);
            conditional = apr_pstrdup(r->pool, "Cond");
            if(condition == NULL) {
              block = 0; // variable not set
            } else {
              if(ap_regexec(eventLimitConf->preg, condition, 0, NULL, 0) != 0) {
                block = 0; // pattern does not match
              }
            }
          }
          if(block) {
            if(ret == DECLINED || clientEntryFromHdr != clientEntry) {
              /* log only one error (either block or limit) */
              *uid = apr_pstrdup(r->connection->pool, "067");
              *msg = apr_psprintf(r->connection->pool, 
                                  QOS_LOG_PFX(067)"access denied%s, "
                                  "QS_%sClientEventLimitCount rule: "
                                  "event=%s, "
                                  "max=%hu, current=%hu, age=%"APR_TIME_T_FMT", c=%s",
                                  sconf->log_only ? " (log only)" : "",
                                  conditional,
                                  eventName,
                                  eventLimitConf->limit,
                                  (*clientEntryFromHdr)->limit[limitTableIndex].limit,
                                  now - (*clientEntryFromHdr)->limit[limitTableIndex].limitTime,
                                  forwardedForLogIP == NULL ? "-" : forwardedForLogIP);
              QS_INC_EVENT_LOCKED(sconf, 67);
              ret = m_retcode;
            }
          }
          if(clientEntryFromHdr == clientEntry) {
            (*clientEntry)->lowrate = apr_time_sec(r->request_time);
            (*clientEntry)->lowratestatus |= QOS_LOW_FLAG_EVENTLIMIT;
            qs_set_evmsg(r, "r;"); 
          }
        }
      }
    }
    
    /* reset low prio client after 24h */
    if(clientEntry && sconf->qos_cc_prefer) { 
      apr_time_t now = apr_time_sec(r->request_time); 
      if(((*clientEntry)->lowrate + QOS_LOW_TIMEOUT) < now) {
        (*clientEntry)->lowrate = 0;
        if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_BEHAVIOR_OK) {
          (*clientEntry)->lowratestatus = QOS_LOW_FLAG_BEHAVIOR_OK;
        } else {
          (*clientEntry)->lowratestatus = 0;
        }
      }
    }
    apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT17 */

    if(req_per_sec_block_rate) {
      qs_set_evmsg(r, "L;"); 
      if(!sconf->log_only) {
        apr_sleep(req_per_sec_block_rate*1000);
      }
    }
  }
  return ret;
}

#if APR_HAS_THREADS
static apr_status_t qos_cleanup_status_thread(void *selfv) {
  qsstatus_t *s = selfv;
  s->exit = 1;
  /* may long up to 100ms */
  if(m_threaded_mpm) {
    apr_status_t status;
    apr_thread_join(&status, s->thread);
    //apr_pool_destroy(s->pool);
  }
  return APR_SUCCESS;
}

// checks if connection counting is enabled (any host)
static int qos_count_connections(qos_srv_config *sconf) {
  server_rec *s = sconf->base_server;
  qos_srv_config *bsconf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
  if(QS_COUNT_CONNECTIONS(bsconf)) {
    return 1;
  }
  s = s->next;
  while(s) {
    qos_srv_config *sc = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
    if(QS_COUNT_CONNECTIONS(sc)) {
      return 1;
    }
    s = s->next;
  }
  return 0;
}

// total (server/all hosts) connections
static int qos_server_connections(qos_srv_config *sconf) {
  server_rec *s = sconf->base_server;
  qos_srv_config *bsconf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
  int connections = bsconf->act->conn->connections;
  s = s->next;
  while(s) {
    qos_srv_config *sc = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
    if(sc->act->conn != bsconf->act->conn) {
      // server has either his own counter or the base server's counter
      connections += sc->act->conn->connections;
    }
    s = s->next;
  }
  return connections;
  /*
  int i, j;
  worker_score *ws_record;
  process_score *ps_record;
  for(i = 0; i < sconf->server_limit; ++i) {
    ps_record = ap_get_scoreboard_process(i);
    for(j = 0; j < sconf->thread_limit; ++j) {
      ws_record = ap_get_scoreboard_worker(i, j);
      if(!ps_record->quiescing && ps_record->pid) {
        if(ws_record->status == SERVER_READY && ps_record->generation == qos_my_generation) {
          ready++;
        }
      }
    }
  }
  */ 
}

/**
 * Status logger thread
 *
 * @param thread
 * @param selfv Base server_rec
 */
static void *APR_THREAD_FUNC qos_status_thread(apr_thread_t *thread, void *selfv) {
  qsstatus_t *s = selfv;
  int server_limit, thread_limit;
  ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit);
  ap_mpm_query(AP_MPMQ_HARD_LIMIT_DAEMONS, &server_limit);
  while(!s->exit) {
    char clientContentTypes[8192];
    char allConn[64];
    int s_busy = 0;
    int s_open = 0;
    int s_ready = 0;
    int s_read = 0;
    int s_write = 0;
    int s_keep = 0;
    int s_start = 0;
    int s_log = 0;
    int s_dns = 0;
    int s_closing = 0;
    int s_usr1 = 0;
    int s_kill = 0;
    worker_score ws_record;
    int c, i, e;
    time_t now = time(NULL);
    int run = 0;
    e = 60 - (now % 60);
    e = e * 10;
    for(c = 0; c < e; c++) {
      apr_sleep(100000);
      if(s->exit) {
        run = 0;
        break;
      }
    }
    if(!s->exit) {
      apr_global_mutex_lock(s->lock);            /* @CRT47 */
      now = time(NULL);
      if(*s->qsstatustimer <= now) {
        // set next and fetch the data
        *s->qsstatustimer = (now/60*60 + 60);
        run = 1;
      } else {
        // another child already did the job
        run = 0;
      }
      apr_global_mutex_unlock(s->lock);          /* @CRT47 */
    }
    if(!s->exit && run) {
      for(i = 0; i < server_limit; ++i) {
        int j;
        for(j = 0; j < thread_limit; ++j) {
          int res;
          ap_copy_scoreboard_worker(&ws_record, i, j);
          res = ws_record.status;
          if(res == SERVER_DEAD) {
            s_open++;
          } else  if(res == SERVER_READY) {
            s_ready++;
          } else if(res == SERVER_BUSY_READ) {
            s_read++;
            s_busy++;
          } else if(res == SERVER_BUSY_WRITE) {
            s_write++;
            s_busy++;
          } else if(res == SERVER_BUSY_KEEPALIVE) {
            s_keep++;
            s_busy++;
          } else if(res == SERVER_STARTING) {
            s_start++;
          } else if(res == SERVER_BUSY_LOG) {
            s_log++;
            s_busy++;
          } else if(res == SERVER_BUSY_DNS) {
            s_dns++;
            s_busy++;
          } else if(res == SERVER_CLOSING) {
            s_closing++;
          } else if(res == SERVER_GRACEFUL) {
            s_usr1++;
          } else if(res == SERVER_IDLE_KILL) {
            s_kill++;
          }
        }
      }
      clientContentTypes[0] = '\0';
      if(s->sconf->qos_cc_prefer) {
        qos_user_t *u = qos_get_user_conf(s->sconf->act->ppool);
        if(u) {
          unsigned long long html;
          unsigned long long cssjs;
          unsigned long long img;
          unsigned long long other;
          unsigned long long notmodified;
          apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT48 */
          html = u->qos_cc->html;
          cssjs = u->qos_cc->cssjs;
          img = u->qos_cc->img;
          other = u->qos_cc->other;
          notmodified = u->qos_cc->notmodified;
          apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT48 */
          snprintf(clientContentTypes, 8191, ", \"clientContentTypes\": { "
                   "\"html\": %llu, \"css/js\": %llu,"
                   " \"images\": %llu, \"other\": %llu, \"304\": %llu }",
                   html, cssjs,
                   img, other, notmodified
                   );
        }
      }
      allConn[0] = '\0';
      if(qos_count_connections(s->sconf)) {
        apr_global_mutex_lock(s->lock);          /* @CRT52 */
        int all_connections = qos_server_connections(s->sconf);
        snprintf(allConn, 64, ", \"QS_AllConn\": %d",
                 all_connections
                 );
        apr_global_mutex_unlock(s->lock);        /* @CRT52 */
      }
      ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s->sconf->base_server,
                   QOS_LOG_PFX(200)"{ \"scoreboard\": { "
                   "\"open\": %d, \"waiting\": %d, \"read\": %d, "
                   "\"write\": %d, \"keepalive\": %d, "
                   "\"start\": %d, \"log\": %d, "
                   "\"dns\": %d, \"closing\": %d, "
                   "\"finishing\": %d, \"idle\": %d }, "
                   "\"maxclients\": { "
                   "\"max\": %d, \"busy\": %d"
                   "%s }"
                   "%s }",
                   s_open, s_ready, s_read,
                   s_write, s_keep,
                   s_start, s_log,
                   s_dns, s_closing,
                   s_usr1, s_kill,
                   s->maxclients, s_busy,
                   allConn,
                   clientContentTypes);
    }
  }
  if(m_threaded_mpm) {
    apr_thread_exit(thread, APR_SUCCESS);
  }
  return NULL;
}

/**
 * Starts the stats logger thread
 */
static void qos_init_status_thread(apr_pool_t *p, qos_srv_config *sconf, int maxclients) {
  qs_actable_t *act = sconf->act;
  apr_pool_t *pool;
  apr_threadattr_t *tattr;
  qsstatus_t *s;
  apr_pool_create(&pool, NULL);
  s = apr_pcalloc(pool, sizeof(qsstatus_t));
  s->exit = 0;
  s->pool = pool;
  s->maxclients = maxclients;
  s->qsstatustimer = act->qsstatustimer;
  s->lock = act->lock;
  s->sconf = sconf;
  if(apr_threadattr_create(&tattr, pool) == APR_SUCCESS) {
    if(apr_thread_create(&s->thread, tattr, qos_status_thread, s, pool) == APR_SUCCESS) {
      apr_pool_pre_cleanup_register(p, s, qos_cleanup_status_thread);
    }
  }
}
#endif

/**
 * client control rules at process connection handler
 */
static int qos_cc_pc_filter(conn_rec *connection, qs_conn_ctx *cconf, qos_user_t *u, char **msg) {
  conn_rec *c = connection;
  int ret = DECLINED;
  if(cconf && cconf->sconf->has_qos_cc) {
    qos_s_entry_t **clientEntry = NULL;
    qos_s_entry_t searchE;
    searchE.ip6[0] = cconf->ip6[0];
    searchE.ip6[1] = cconf->ip6[1];
    apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT14 */
    clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, 0);

    /* early vip detection */
    if((*clientEntry)->vip) {
      cconf->is_vip = 1;
      apr_table_set(c->notes, QS_ISVIPREQ, "yes");
    }

    /* max connections */
    if(cconf->sconf->has_qos_cc && cconf->sconf->qos_cc_prefer) {
      if(m_generation != u->qos_cc->generation_locked) {
        u->qos_cc->connections++;
      } else {
        ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, c->base_server,
                     QOS_LOG_PFX(166)"unexpected connection dispatching, skipping"
                     " connection counter update for QS_ClientPrefer rule, c=%s",
                     QS_CONN_REMOTEIP(cconf->mc) == NULL ? "-" : 
                     QS_CONN_REMOTEIP(cconf->mc));
      }
      if((*clientEntry)->lowrate) {
        if(c->notes) {
          char *flags = apr_psprintf(c->pool, "0x%02x", (*clientEntry)->lowratestatus);
          apr_table_set(c->notes, "QS_ClientLowPrio", flags);
        }
      }
      /* non vip (allow all vip addresses - no restrictions) */
      if(!(*clientEntry)->vip) {
        if(u->qos_cc->connections > cconf->sconf->qos_cc_prefer_limit) {
          int penalty = 4; // 2 to 12 points
          int reqSpare = 0;
          if((*clientEntry)->lowrate) {
            if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_PKGRATE) {
              penalty++;
            }
            if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_BEHAVIOR_BAD) {
              penalty+=2;
            }
            if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_EVENTBLOCK) {
              penalty+=2;
            }
            if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_EVENTLIMIT) {
              penalty+=2;
            }
            if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_TIMEOUT) {
              penalty++;
            }
          }
          if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_BEHAVIOR_OK) {
            // normal behavior
            penalty-=2;
          }
          // calculate the min. required free connections allowing us to serve request by this IP
          reqSpare = (cconf->sconf->max_clients - cconf->sconf->qos_cc_prefer_limit) * penalty / 12;
          if((cconf->sconf->max_clients - u->qos_cc->connections) < reqSpare) {
            /* not enough free connections */
            if(u->qos_cc->connections > cconf->sconf->qos_cc_prefer_limit) {
              *msg = apr_psprintf(cconf->mc->pool, 
                                  QOS_LOG_PFX(066)"access denied%s, "
                                  "QS_ClientPrefer rule (penalty=%d 0x%02x): "
                                  "max=%d, concurrent connections=%d, c=%s",
                                  cconf->sconf->log_only ? " (log only)" : "",
                                  penalty, (*clientEntry)->lowratestatus,
                                  cconf->sconf->qos_cc_prefer_limit, u->qos_cc->connections,
                                  QS_CONN_REMOTEIP(cconf->mc) == NULL ? "-" : 
                                  QS_CONN_REMOTEIP(cconf->mc));
              QS_INC_EVENT_LOCKED(cconf->sconf, 66);
              ret = m_retcode;
            }
          }
        }
      }
    }

    apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT14 */
  }
  return ret;
}

/**
 * calculates the current minimal up/download bandwidth
 */
static int qos_req_rate_calc(qos_srv_config *sconf, int *current) {
  int req_rate = sconf->req_rate;
  if(sconf->min_rate_max != -1) {
    int connections = qos_server_connections(sconf);
    if(connections > sconf->req_rate_start) {
      /* keep the minimal rate until reaching the min connections */
      req_rate = req_rate + (sconf->min_rate_max * connections / sconf->max_clients);
      if(connections > sconf->max_clients) {
        // limit the max rate to its max if we have more connections then expected
        if(connections > (sconf->max_clients + QS_DOUBLE_CONN_H)) {
          ap_log_error(APLOG_MARK, APLOG_CRIT, 0, sconf->base_server, 
                       QOS_LOG_PFX(036)"QS_SrvMinDataRate: unexpected connection status!"
                       " connections=%d,"
                       " cal. request rate=%d,"
                       " max. limit=%d."
                       " Check log for unclean child exit and consider"
                       " to do a graceful server restart if this condition persists."
                       " You might also increase the number of supported connections"
                       " using the 'QS_MaxClients' directive.",
                       connections, req_rate, sconf->min_rate_max);
        }
        QS_INC_EVENT(sconf, 36);
        req_rate = sconf->min_rate_max;
      }
    }
    *current = connections;
  }
  return req_rate;
}

qos_s_entry_limit_conf_t *qos_getQSLimitEvent(qos_user_t *u, const char *event,
                                              int *limitTableIndex) {
  int i = 0;
  apr_table_entry_t *limitTableEntry = (apr_table_entry_t *)apr_table_elts(u->qos_cc->limitTable)->elts;
  for(i = 0; i < apr_table_elts(u->qos_cc->limitTable)->nelts; i++) {
    const char *eventName = limitTableEntry[i].key;
    if(strcasecmp(eventName, event) == 0) {
      *limitTableIndex = i;
      return (qos_s_entry_limit_conf_t *)limitTableEntry[i].val;
    }
  }
  return NULL;
}

/************************************************************************
 * "public"
 ***********************************************************************/

/**
 * short status viewer
 */
static void qos_ext_status_short(request_rec *r, apr_table_t *qt) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                &qos_module);
  server_rec *s = sconf->base_server;
  qos_srv_config *bsconf = (qos_srv_config*)ap_get_module_config(s->module_config,
                                                                 &qos_module);
  const char *option = apr_table_get(qt, "option");
  const char *all_connections = apr_table_get(r->subprocess_env, "QS_AllConn");
  apr_time_t now = apr_time_sec(r->request_time);
  double av[1];

  qos_user_t *u = qos_get_user_conf(sconf->act->ppool);

#if (!defined(WIN32) && !defined(__MINGW32__) && !defined(_WIN64) && !defined(CYGWIN))
  getloadavg(av, 1);
  ap_rprintf(r, "b"QOS_DELIM"system.load: %.2f\n", av[0]);
#endif

  if(u->qos_cc && sconf->qos_cc_prefer) {
    unsigned long long html;
    unsigned long long cssjs;
    unsigned long long img;
    unsigned long long other;
    unsigned long long notmodified;
    char clientContentTypes[8192];
    apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT51 */
    html = u->qos_cc->html;
    cssjs = u->qos_cc->cssjs;
    img = u->qos_cc->img;
    other = u->qos_cc->other;
    notmodified = u->qos_cc->notmodified;
    apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT51 */
    snprintf(clientContentTypes, 8191,
             "b;clientContentTypes(html,css/js,images,other,304): "
             "%llu %llu %llu %llu %llu",
             html, cssjs, img, other, notmodified
             );
    ap_rprintf(r, "%s\n", clientContentTypes);
  }
  while(s) {
    char *sn = apr_psprintf(r->pool, "%s"QOS_DELIM"%s"QOS_DELIM"%d",
                            s->is_virtual ? "v" : "b",
                            s->server_hostname == NULL ? "-" :
                            ap_escape_html(r->pool, s->server_hostname),
                            s->addrs->host_port);
    sconf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
    if(all_connections && !s->is_virtual) {
      ap_rprintf(r, "%s"QOS_DELIM"QS_AllConn: %s\n", sn, all_connections);
    }
    if((s->is_virtual && (sconf != bsconf)) || !s->is_virtual) {
      qs_acentry_t *actEntry;
      if(!s->is_virtual && sconf->has_qos_cc && sconf->qos_cc_prefer_limit) {
        int hc = u->qos_cc->connections; /* not synchronized ... */
        ap_rprintf(r, "%s"QOS_DELIM"QS_ClientPrefer"QOS_DELIM"%d[]: %d\n", sn,
                   sconf->qos_cc_prefer_limit, hc);
      }
      /* request level */
      actEntry = sconf->act->entry;
      while(actEntry) {
        if((actEntry->limit > 0) && !actEntry->condition && !actEntry->event) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_LocRequestLimit%s"QOS_DELIM"%d[%s]: %d\n", sn,
                     actEntry->regex == NULL ? "" : "Match", 
                     actEntry->limit,
                     actEntry->url, 
                     actEntry->counter);
        }
        if((actEntry->req_per_sec_limit > 0) && !actEntry->event) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_LocRequestPerSecLimit%s"QOS_DELIM"%ld[%s]: %ld\n", sn,
                     actEntry->regex == NULL ? "" : "Match", 
                     actEntry->req_per_sec_limit,
                     actEntry->url,
                     actEntry->req_per_sec);
        }
        if((actEntry->kbytes_per_sec_limit > 0) && !actEntry->event) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_LocKBytesPerSecLimit%s"QOS_DELIM"%"APR_OFF_T_FMT"[%s]: %"APR_OFF_T_FMT"\n", sn,
                     actEntry->regex == NULL ? "" : "Match",
                     actEntry->kbytes_per_sec_limit,
                     actEntry->url, 
                     actEntry->kbytes_per_sec);
        }
        if(actEntry->condition && !actEntry->event) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_CondLocRequestLimitMatch"QOS_DELIM"%d[%s]: %d\n", sn,
                     actEntry->limit,
                     actEntry->url, 
                     actEntry->counter);
        }
        if(actEntry->event && (actEntry->limit != -1)) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_EventRequestLimit"QOS_DELIM"%d[%s]: %d\n", sn,
                     actEntry->limit,
                     actEntry->url, 
                     actEntry->counter);
        }
        if(actEntry->event && (actEntry->kbytes_per_sec_limit != 0)) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_EventKBytesPerSecLimit"QOS_DELIM"%"APR_OFF_T_FMT"[%s]: %"APR_OFF_T_FMT"\n", sn,
                     actEntry->kbytes_per_sec_limit,
                     actEntry->url, 
                     now > (apr_time_sec(actEntry->kbytes_interval_us) + (QS_BW_SAMPLING_RATE*10)) ? 0 : actEntry->kbytes_per_sec);
        }
        if(actEntry->event && (actEntry->req_per_sec_limit > 0)) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_EventPerSecLimit"QOS_DELIM"%ld[%s]: %ld\n", sn,
                     actEntry->req_per_sec_limit,
                     actEntry->url, 
                     now > (actEntry->interval + (QS_BW_SAMPLING_RATE*3)) ? 0 : actEntry->req_per_sec);
        }
        actEntry = actEntry->next;
      }
      /* event limit */
      if(sconf->event_limit_a->nelts > 0) {
        int ie = 0;
        qos_event_limit_entry_t *event_limit = sconf->act->event_entry;
        for(ie = 0; ie < sconf->event_limit_a->nelts; ie++) {
          int elimit = event_limit->limit;
          if(event_limit->limitTime + event_limit->seconds <= now) {
            elimit = 0;
          }
          if(event_limit->action == QS_EVENT_ACTION_DENY) {
            ap_rprintf(r, "%s"QOS_DELIM"QS_%sEventLimitCount"QOS_DELIM"%d/%d[%s]: %d\n",
                       sn,
                       event_limit->condStr == NULL ? "" : "Cond",
                       event_limit->max,
                       event_limit->seconds,
                       event_limit->env_var,
                       elimit);
          }
          event_limit++;
        }
      }
      if(!s->is_virtual || sconf->act->conn != bsconf->act->conn) {
        if(sconf->max_conn != -1) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_SrvMaxConn"QOS_DELIM"%d[]: %d\n", sn,
                     sconf->max_conn,
                     sconf->act->conn->connections);
        }
        if(sconf->max_conn_close != -1) {
          ap_rprintf(r, "%s"QOS_DELIM"QS_SrvMaxConnClose"QOS_DELIM"%d[]: %d\n", sn,
                     sconf->max_conn_close,
                     sconf->act->conn->connections);
        }
        if(option && strstr(option, "ip")) {
          if(sconf->act->conn->connections) {
            apr_table_t *entries = apr_table_make(r->pool, 100);
            int j;
            apr_table_entry_t *entry;
            qos_collect_ip(r, sconf, entries, sconf->max_conn_per_ip, 0);
            entry = (apr_table_entry_t *)apr_table_elts(entries)->elts;
            for(j = 0; j < apr_table_elts(entries)->nelts; j++) {
              ap_rprintf(r, "%s"QOS_DELIM"QS_SrvMaxConnPerIP"QOS_DELIM"%s: %s\n",
                         sn,
                         entry[j].key, entry[j].val);
            }
          }
        }
      }
    }
    s = s->next;
  }
  if(u->qos_cc && sconf->qsevents) {
    int i = 0;
    apr_table_t *eTable = apr_table_make(r->pool, QOS_LOG_MSGCT);
    apr_table_entry_t *entry;
    char buf1[1024];
    char buf2[1024];
    apr_global_mutex_lock(u->qos_cc->lock);        /* @CRT50 */
    while(m_knownEvents[i] > 0) {
      snprintf(buf1, 1023, "e;mod_qos(%03d);new: %llu",
               m_knownEvents[i], u->qos_cc->eventLast[m_knownEvents[i]]);
      snprintf(buf2, 1023, "e;mod_qos(%03d);total: %llu", 
               m_knownEvents[i], u->qos_cc->eventTotal[m_knownEvents[i]]);
      apr_table_add(eTable, buf1, buf2);
      u->qos_cc->eventLast[m_knownEvents[i]] = 0;
      i++;
    }
    apr_global_mutex_unlock(u->qos_cc->lock);      /* @CRT50 */
    entry = (apr_table_entry_t *)apr_table_elts(eTable)->elts;
    for(i = 0; i < apr_table_elts(eTable)->nelts; ++i) {
      ap_rprintf(r, "%s\n%s\n", entry[i].key, entry[i].val);
    }
  }
}

/**
 * Comperator for bsearch function
 */
static int qos_geo_comp(const void *_pA, const void *_pB) {
  unsigned long *pA = (unsigned long *)_pA;
  qos_geo_entry_t *pB = (qos_geo_entry_t *)_pB;
  unsigned long search = *pA;
  if((search >= pB->start) && (search <= pB->end)) return 0;
  if(search > pB->start) return 1;
  if(search < pB->start) return -1;
  return -1; // error
}

/**
 * Translates an IP address (from geo csv) to a numeric value.
 *
 * @param pool To dup the string while parsing.
 * @param ip
 * @return
 */
static unsigned long qos_geo_str2long(apr_pool_t *pool, const char *ip) {
  char *p;
  char *i = apr_pstrdup(pool, ip);
  unsigned long addr = 0;

  p = strchr(i, '.');
  if(!p) return 0;
  p[0] = '\0';
  if(!qos_is_num(i)) return 0;
  addr += (atol(i) * 16777216);
  i = p;
  i++;

  p = strchr(i, '.');
  if(!p) return 0;
  p[0] = '\0';
  if(!qos_is_num(i)) return 0;
  addr += (atol(i) * 65536);
  i = p;
  i++;

  p = strchr(i, '.');
  if(!p) return 0;
  p[0] = '\0';
  if(!qos_is_num(i)) return 0;
  addr += (atol(i) * 256);
  i = p;
  i++;

  if(!qos_is_num(i)) return 0;
  addr += (atol(i));

  return addr;
}

/**
 * Viewer settings about ip address information.
 */
static void qos_show_ip(request_rec *r, qos_srv_config *sconf, apr_table_t *qt) {
  int max_conn_per_ip = 0;
  server_rec *s = sconf->base_server;
  apr_time_t now = apr_time_sec(r->request_time);
  while(s) {
    // enable per client connection search if any server has enabled QS_SrvMaxConnPerIP
    qos_srv_config *conf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
    if(conf->max_conn_per_ip != -1) {
      max_conn_per_ip = 1;
      break;
    }
    s = s->next;
  }
  if(sconf->has_qos_cc || max_conn_per_ip) {
    const char *option = apr_table_get(qt, "option");
    const char *refresh = apr_table_get(qt, "refresh");
    const char *address = apr_table_get(qt, "address");
    if(address) {
      int escerr = 0;
      char *ta = apr_pstrdup(r->pool, address);
      qos_unescaping(ta, QOS_DEC_MODE_FLAGS_URL, &escerr);
      address = ta;
    }
    if(strcmp(r->handler, "qos-viewer") == 0) {
      ap_rputs("<table class=\"btable\"><tbody>\n", r);
      ap_rputs(" <tr class=\"row\"><td>\n", r);
    } else {
      ap_rputs("<table border=\"1\"><tbody>\n", r);
      ap_rputs(" <tr><td>\n", r);
    }
    if(strcmp(r->handler, "qos-viewer") == 0) {
      ap_rputs("  <table border=\"0\" cellpadding=\"2\" "
               "cellspacing=\"2\" style=\"width: 100%\"><tbody>\n",r);
    } else {
      ap_rputs("  <table border=\"1\" cellpadding=\"2\" "
               "cellspacing=\"2\" style=\"width: 100%\"><tbody>\n",r);
    }
    ap_rputs("    <tr class=\"rowe\">\n", r);
    ap_rputs("      <td colspan=\"9\">viewer settings</td>\n", r);
    ap_rputs("    </tr>\n", r);
    /* auto refresh */
    ap_rputs("    <tr class=\"rows\">\n"
             "      <td colspan=\"1\">auto refresh</td>\n", r);
    ap_rputs("      <td colspan=\"8\">\n", r);
    ap_rprintf(r, "        <form action=\"%s\" method=\"get\">\n",
               ap_escape_html(r->pool, r->parsed_uri.path));
    if(option && strstr(option, "ip")) {
      ap_rprintf(r, "          <input name=\"option\" value=\"ip\" type=\"hidden\">\n");
    }
    if(address) {
      ap_rprintf(r, "          <input name=\"address\" value=\"%s\" type=\"hidden\">\n",
                 ap_escape_html(r->pool, address));
    }
    if(refresh) {
      ap_rprintf(r, "          <input name=\"action\" value=\"disable\" type=\"submit\">\n");
    } else {
      ap_rprintf(r, "          <input name=\"action\" value=\"enable\" type=\"submit\">\n");
      ap_rprintf(r, "          <input name=\"refresh\" value=\"\" type=\"hidden\">\n");
    }
    ap_rputs("        </form>\n", r);
    ap_rputs("      </td>\n", r);
    ap_rputs("    </tr>\n", r);
    /* show ip addresses and their connections */
    ap_rputs("    <tr class=\"rows\">\n"
             "      <td colspan=\"1\">client ip connections</td>\n", r);
    ap_rputs("      <td colspan=\"8\">\n", r);
    ap_rprintf(r, "        <form action=\"%s\" method=\"get\">\n",
               ap_escape_html(r->pool, r->parsed_uri.path));
    if(!option || (option && !strstr(option, "ip")) ) {
      ap_rprintf(r, "          <input name=\"option\" value=\"ip\" type=\"hidden\">\n");
      ap_rprintf(r, "          <input name=\"action\" value=\"enable\" type=\"submit\">\n");
    } else {
      ap_rprintf(r, "          <input name=\"option\" value=\"no\" type=\"hidden\">\n");
      ap_rprintf(r, "          <input name=\"action\" value=\"disable\" type=\"submit\">\n");
    }
    if(address) {
      ap_rprintf(r, "          <input name=\"address\" value=\"%s\" type=\"hidden\">\n",
                 ap_escape_html(r->pool, address));
    }
    if(refresh) {
      ap_rprintf(r, "          <input name=\"refresh\" value=\"\" type=\"hidden\">\n");
    }
    ap_rputs("        </form>\n", r);
    ap_rputs("      </td>\n", r);
    ap_rputs("    </tr>\n", r);
  
    if(sconf->has_qos_cc) {
      ap_rputs("    <tr class=\"rows\">\n"
               "      <td colspan=\"1\">search a client ip entry</td>\n", r); 
      ap_rputs("      <td colspan=\"8\">\n", r);
      ap_rprintf(r, "        <form action=\"%s\" method=\"get\">\n",
                 ap_escape_html(r->pool, r->parsed_uri.path));
      if(option && strstr(option, "ip")) {
        ap_rprintf(r, "          <input name=\"option\" value=\"ip\" type=\"hidden\">\n");
      }
      if(refresh) {
        ap_rprintf(r, "          <input name=\"refresh\" value=\"\" type=\"hidden\">\n");
      }
      ap_rprintf(r, "          <input name=\"address\" value=\"%s\" type=\"text\">\n",
                 address ? ap_escape_html(r->pool, address) : "0.0.0.0");
      ap_rprintf(r, "          <input name=\"action\" value=\"search\" type=\"submit\">\n");
      ap_rputs("          </form>\n", r);
      ap_rputs("      </td>\n", r);
      ap_rputs("    </tr>\n", r);
      if(address) {
        apr_uint64_t ip[2];
        qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
        if(qos_ip_str2long(address, ip)) {
          unsigned long html;
          unsigned long cssjs;
          unsigned long img;
          unsigned long other;
          unsigned long notmodified;
          qos_s_entry_t **clientEntry = NULL;
          qos_s_entry_t searchE;
          int found = 0;
          apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT20 */
          html = u->qos_cc->html;
          cssjs = u->qos_cc->cssjs;
          img = u->qos_cc->img;
          other = u->qos_cc->other;
          notmodified = u->qos_cc->notmodified;
          searchE.ip6[0] = ip[0];
          searchE.ip6[1] = ip[1];
          clientEntry = qos_cc_get0(u->qos_cc, &searchE, 0);
          if(clientEntry) {
            found = 1;
            searchE.vip = (*clientEntry)->vip;
            searchE.lowrate = (*clientEntry)->lowrate;
            searchE.lowratestatus = (*clientEntry)->lowratestatus;
            searchE.time = (*clientEntry)->time;
            searchE.block = (*clientEntry)->block;
            searchE.blockTime = (*clientEntry)->blockTime;
            searchE.limit = (*clientEntry)->limit;
            searchE.req_per_sec = (*clientEntry)->req_per_sec;
            searchE.req_per_sec_block_rate = (*clientEntry)->req_per_sec_block_rate;
            searchE.other = (*clientEntry)->other - 1;
            searchE.html = (*clientEntry)->html - 1;
            searchE.cssjs = (*clientEntry)->cssjs - 1;
            searchE.img = (*clientEntry)->img - 1;
            searchE.notmodified = (*clientEntry)->notmodified - 1;
            searchE.event_req = (*clientEntry)->event_req;
          }
          apr_global_mutex_unlock(u->qos_cc->lock);            /* @CRT20 */
          ap_rputs("    <tr class=\"rowt\">\n", r);
          ap_rputs("      <td colspan=\"1\">IP</td>\n", r);
          ap_rputs("      <td colspan=\"2\">last request</td>\n", r);
          ap_rputs("      <td colspan=\"1\">"
                   "<div title=\"QS_VipHeaderName|QS_VipIPHeaderName\">vip</div></td>\n", r);
          ap_rputs("      <td colspan=\"1\">"
                   "<div title=\"QS_ClientEventBlockCount\">blocked</div></td>\n", r);
          ap_rputs("      <td colspan=\"1\">"
                   "<div title=\"QS_ClientEventLimitCount (QS_Limit)\">limited</div></td>\n", r);
          ap_rputs("      <td colspan=\"2\">"
                   "<div title=\"QS_ClientEventPerSecLimit\">events/sec</div></td>\n", r);
          ap_rputs("      <td colspan=\"1\">"
                   "<div title=\"QS_ClientPrefer&#013;0x01 bad pkg rate&#013;0x02 normal behavior&#013;0x04 bad behavior&#013;0x08 blocked&#013;0x10 limited&#013;0x20 timeout\">low prio</div></td>\n", r);
          ap_rputs("    </tr>\n", r);
          ap_rprintf(r, "    <tr class=\"rows\">"
                     "<td colspan=\"1\">%s</td>", ap_escape_html(r->pool, address));
          if(!found) {
            ap_rputs("<td colspan=\"8\"><i>not found</i></td>\n", r);
          } else {
            char buf[1024];
            struct tm *ptr = localtime(&searchE.time);
            strftime(buf, sizeof(buf), "%d.%m.%Y %H:%M:%S", ptr);
            ap_rprintf(r, "<td colspan=\"2\">%s</td>", buf);
            ap_rprintf(r, "<td colspan=\"1\">%s</td>", searchE.vip ? "yes" : "no");
            if(sconf->qos_cc_blockTime > (time(NULL) - searchE.blockTime)) {
              ap_rprintf(r, "<td colspan=\"1\">%d, %ld&nbsp;sec</td>",
                         searchE.block, time(NULL) - searchE.blockTime);
            } else {
              ap_rprintf(r, "<td colspan=\"1\">no</td>");
            }
            
            if(u->qos_cc->limitTable) {
              int limitTableIndex;
              qos_s_entry_limit_conf_t *eventLimitConf = qos_getQSLimitEvent(u, QS_LIMIT_DEFAULT, &limitTableIndex);
              if(eventLimitConf) {
                if(eventLimitConf->limitTime > (time(NULL) - searchE.limit[limitTableIndex].limitTime)) {
                  ap_rprintf(r, "<td colspan=\"1\">%hu, %ld&nbsp;sec</td>",
                             searchE.limit[limitTableIndex].limit, time(NULL) - searchE.limit[limitTableIndex].limitTime);
                } else {
                  ap_rprintf(r, "<td colspan=\"1\">no</td>");
                }
              } else {
                ap_rprintf(r, "<td colspan=\"1\">off</td>");
              }
            } else {
              ap_rprintf(r, "<td colspan=\"1\">off</td>");
            }
            ap_rprintf(r, "<td colspan=\"1\">%ld</td>", searchE.req_per_sec);
            ap_rprintf(r, "<td colspan=\"1\">%d&nbsp;ms</td>", searchE.req_per_sec_block_rate);
            ap_rprintf(r, "<td colspan=\"1\">%s (0x%02x)</td>\n",
                       (searchE.lowrate + QOS_LOW_TIMEOUT) > now ? "yes" : "no",
                       searchE.lowratestatus);
            ap_rputs("</tr>\n", r);
            ap_rprintf(r, "   <tr class=\"rows\">"
                       "<td colspan=\"6\">&nbsp;</td>"
                       "<td>"
                       "<div title=\"QS_ClientEventRequestLimit\">events:</div></td>"
                       "<td style=\"width:9%%\">%s</td>"
                       "<td colspan=\"1\"></td>"
                       "</tr>\n", (sconf->qos_cc_event_req == -1 ? "off" : apr_psprintf(r->pool, "%d", searchE.event_req)));
          }
          if(sconf->qos_cc_prefer) {
            ap_rprintf(r, "   <tr class=\"rowt\">"
                       "<td colspan=\"4\"></td>"
                       "<td style=\"width:9%%\">html</td>"
                       "<td style=\"width:9%%\">css/js</td>"
                       "<td style=\"width:9%%\">images</td>"
                       "<td style=\"width:9%%\">other</td>"
                       "<td style=\"width:9%%\">304</td>"
                       "</tr>\n");
            if(found) {
              ap_rprintf(r, "   <tr class=\"rows\">"
                         "<td colspan=\"4\"></td>"
                         "<td style=\"width:9%%\">%u</td>"
                         "<td style=\"width:9%%\">%u</td>"
                         "<td style=\"width:9%%\">%u</td>"
                         "<td style=\"width:9%%\">%u</td>"
                         "<td style=\"width:9%%\">%u</td>"
                         "</tr>\n", searchE.html,
                         searchE.cssjs,
                         searchE.img,
                         searchE.other,
                         searchE.notmodified);
            }
            ap_rprintf(r, "   <tr class=\"rows\">"
                       "<td colspan=\"3\"></td>"
                       "<td style=\"width:9%%\"><div title=\"QS_ClientContentTypes\">all clients</div></td>"
                       "<td style=\"width:9%%\">%lu</td>"
                       "<td style=\"width:9%%\">%lu</td>"
                       "<td style=\"width:9%%\">%lu</td>"
                       "<td style=\"width:9%%\">%lu</td>"
                       "<td style=\"width:9%%\">%lu</td>"
                       "</tr>\n", html, cssjs, img, other, notmodified);
            if(sconf->static_on == 1) {
              unsigned long shtml = sconf->static_html;
              unsigned long scssjs = sconf->static_cssjs;
              unsigned long simg = sconf->static_img;
              unsigned long sother = sconf->static_other;
              unsigned long snotmodified = sconf->static_notmodified;
              ap_rprintf(r, "   <tr class=\"rows\">"
                         "<td colspan=\"3\"></td>"
                         "<td style=\"width:9%%\"><div title=\"QS_ClientContentTypes\">configured (global)</div></td>"
                         "<td style=\"width:9%%\">%lu</td>"
                         "<td style=\"width:9%%\">%lu</td>"
                         "<td style=\"width:9%%\">%lu</td>"
                         "<td style=\"width:9%%\">%lu</td>"
                         "<td style=\"width:9%%\">%lu</td>"
                         "</tr>\n", shtml, scssjs,
                         simg, sother, snotmodified);
            }
          }
        }
      }
    }
    ap_rprintf(r, "   <tr class=\"row\">"
               "<td style=\"width:28%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "</tr>\n");
    ap_rputs(" </tbody></table>\n", r);
    ap_rputs(" </tr></td>\n", r);
    ap_rputs("</tbody></table>\n", r);
  }
}

/**
 * Daws the load/connection bars at the top of the status page
 *
 * @param r
 * @param bs
 */
static void qos_bars(request_rec *r, server_rec *bs) {
  server_rec *s = bs;
  qos_srv_config *bsconf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
  if(bsconf->act && bsconf->act->conn) {
    int connections = -1;
    double av[1];
    int load = 0;
#if (!defined(WIN32) && !defined(__MINGW32__) && !defined(_WIN64) && !defined(CYGWIN))
    getloadavg(av, 1);
    load = av[0];
    if(load > 0) {
      load = 100*load/(10+load);
    }
#endif

    ap_rputs("<table class=\"btable\"><tbody>\n", r);
    ap_rputs(" <tr class=\"row\"><td>\n", r);

    ap_rputs("<table border=\"0\" cellpadding=\"2\" "
             "cellspacing=\"2\" style=\"width: 100%\"><tbody>\n",r);
    ap_rputs("<tr class=\"rowe\">\n", r);
    ap_rputs("<td colspan=\"2\">overview</td>", r);
    ap_rputs("</tr>\n", r);

    if(bsconf->log_only) {
      ap_rputs("<tr class=\"rowt\">\n", r);
      ap_rputs("<td colspan=\"2\">running in 'log only' mode - rules are NOT enforced</td>", r);
      ap_rputs("</tr>\n", r);
    }
    if(qos_count_connections(bsconf)) {
      connections = qos_server_connections(bsconf);
    }
    if(connections != -1) {
#if (!defined(WIN32) && !defined(__MINGW32__) && !defined(_WIN64))
      ap_rprintf(r, "<tr class=\"rowt\">"
                 "<td colspan=\"1\">connections: %d</td>"
                 "<td colspan=\"1\">load: %.2f</td>"
                 "</tr>\n", connections, av[0]);
#else
      ap_rprintf(r, "<tr class=\"rowt\">"
                 "<td colspan=\"1\">connections: %d</td>"
                 "<td colspan=\"1\">load: n/a</td>"
                 "</tr>\n", connections);
#endif
    } else {
#if (!defined(WIN32) && !defined(__MINGW32__) && !defined(_WIN64))
      ap_rprintf(r, "<tr class=\"rowt\">"
                 "<td colspan=\"1\">connections: n/a</td>"
                 "<td colspan=\"1\">load: %.2f</td>"
                 "</tr>\n", av[0]);
#else
      ap_rprintf(r, "<tr class=\"rowt\">"
                 "<td colspan=\"1\">connections: n/a</td>"
                 "<td colspan=\"1\">load: n/a</td>"
                 "</tr>\n");
#endif
    }
    ap_rprintf(r, "<tr class=\"rows\">");
    ap_rprintf(r, "<td>");
    if(connections != -1) {
      int percentage = 100 * connections / bsconf->max_clients;
      if(percentage > 100) percentage = 100;
      ap_rprintf(r, "<div class=\"prog-border\">"
                 "<div class=\"%s\" style=\"width: %d%%;\"></div></div>",
                 percentage < 90 ? "prog-bar" : "prog-bar-limit",
                 percentage);
      ap_rprintf(r, "</td>");
    } else {
      ap_rprintf(r, "&nbsp;");
    }      
    ap_rprintf(r, "<td>");
    ap_rprintf(r, "<div class=\"prog-border\">"
               "<div class=\"prog-bar\" style=\"width: %d%%;\"></div></div>",
               load);
    ap_rprintf(r, "</td>");
    ap_rprintf(r, "</tr>\n");

    ap_rputs("</tbody></table>\n", r);

    ap_rputs(" </tr></td>\n", r);
    ap_rputs("</tbody></table>\n", r);
  }
}

/**
 * (Extendet-)Status viewer, used by internal and mod_status handler.
 */
static int qos_ext_status_hook(request_rec *r, int flags) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                &qos_module);
  server_rec *s = sconf->base_server;
  int i = 0;
  apr_time_t now = apr_time_sec(r->request_time);
  qos_srv_config *bsconf = (qos_srv_config*)ap_get_module_config(s->module_config,
                                                                 &qos_module);
  apr_table_t *qt = qos_get_query_table(r);
  const char *option = apr_table_get(qt, "option");
  if(sconf->disable_handler == 1) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(072)"handler has been disabled for this host, id=%s",
                  qos_unique_id(r, "072"));
    return OK;
  }
  if (flags & AP_STATUS_SHORT) {
    qos_ext_status_short(r, qt);
    return OK;
  }
  if(qt && (apr_table_get(qt, "auto") != NULL)) {
    qos_ext_status_short(r, qt);
    return OK;
  }
  if(strcmp(r->handler, "qos-viewer") != 0) {
    ap_rputs("<hr>\n", r);
    ap_rputs("<table style=\"width:400px\" cellspacing=0 cellpadding=0>\n", r);
    ap_rputs(" <tr><td bgcolor=\"#000000\">\n", r);
    ap_rputs(" <b><font color=\"#ffffff\" face=\"Arial,Helvetica\">", r);
    ap_rprintf(r, "mod_qos&nbsp;%s", ap_escape_html(r->pool, qos_revision(r->pool)));
    ap_rputs(" </font></b>\r", r);
    ap_rputs(" </td></tr>\n", r);
    ap_rputs("</table>\n", r);
    if(sconf->log_only) {
      ap_rputs("<p>running in 'log only' mode - rules are NOT enforced</p>\n", r);
    }      
  }
#ifdef QS_INTERNAL_TEST
  {
    apr_uint64_t remoteip[2];
    qs_conn_ctx *cconf = qos_get_cconf(r->connection);
    qos_ip_str2long(QS_CONN_REMOTEIP(r->connection), remoteip);
    if(cconf) {
      remoteip[0] = cconf->ip6[0];
      remoteip[1] = cconf->ip6[1];
    }
    ap_rputs("<p>TEST BINARY, NOT FOR PRODUCTIVE USE<br>\n", r);
    ap_rprintf(r, "client ip=%s</p>\n", qos_ip_long2str(r->pool, remoteip));
  }
#endif
  if(strcmp(r->handler, "qos-viewer") == 0) {
    qos_bars(r, s);
  }
  qos_show_ip(r, bsconf, qt);
  if(strcmp(r->handler, "qos-viewer") == 0) {
    ap_rputs("<table class=\"btable\"><tbody>\n", r);
    ap_rputs(" <tr class=\"row\"><td>\n", r);
  } else {
    ap_rputs("<table border=\"1\"><tbody>\n", r);
    ap_rputs(" <tr><td>\n", r);
  }
  while(s) {
    qs_acentry_t *actEntry;
    if(strcmp(r->handler, "qos-viewer") == 0) {
      ap_rputs("  <table border=\"0\" cellpadding=\"2\" "
               "cellspacing=\"2\" style=\"width: 100%\"><tbody>\n",r);
    } else {
      ap_rputs("  <table border=\"1\" cellpadding=\"2\" "
               "cellspacing=\"2\" style=\"width: 100%\"><tbody>\n",r);
    }
    ap_rputs("    <tr class=\"rowe\">\n", r);
    ap_rprintf(r, "      <td colspan=\"9\">%s:%d (%s)</td>\n",
               s->server_hostname == NULL ? "-" : ap_escape_html(r->pool, s->server_hostname),
               s->addrs->host_port,
               s->is_virtual ? "virtual" : "base");
    ap_rputs("    </tr>\n", r);
    sconf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);

    if((sconf == bsconf) && s->is_virtual) {
      ap_rputs("    <tr class=\"rows\">\n"
               "     <td colspan=\"9\"><i>uses base server settings and counters</i></td>\n    </tr>\n", r);
    } else {
      if(!s->is_virtual && sconf->has_qos_cc) {
        qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
        int num = 0;
        int max = 0;
        int hc = -1;
        apr_global_mutex_lock(u->qos_cc->lock);           /* @CRT16 */
        hc = u->qos_cc->connections;
        num = u->qos_cc->num;
        max = u->qos_cc->max;
        apr_global_mutex_unlock(u->qos_cc->lock);         /* @CRT16 */
        ap_rputs("<tr class=\"rowt\">"
                 "<td colspan=\"6\">client control</td>"
                 "<td >max</td>"
                 "<td >limit&nbsp;</td>"
                 "<td >current&nbsp;</td>", r);
        ap_rputs("</tr>\n", r);
        ap_rprintf(r, "<tr class=\"rows\">");
        ap_rprintf(r, "<td colspan=\"6\"><div title=\"QS_ClientEntries\">clients in memory</div></td>");
        ap_rprintf(r, "<td >%d</td>", max);
        ap_rprintf(r, "<td >-</td>");
        ap_rprintf(r, "<td >%d</td>", num);
        ap_rputs("</tr>\n", r);
        if(sconf->qos_cc_prefer) {
          ap_rprintf(r, "<tr class=\"rows\">");
          ap_rprintf(r, "<td colspan=\"6\"><div title=\"QS_ClientPrefer\">connections</div></td>");
          ap_rprintf(r, "<td >%d</td>", sconf->qos_cc_prefer);
          ap_rprintf(r, "<td >%d</td>", sconf->qos_cc_prefer_limit);
          ap_rprintf(r, "<td >%d</td>", hc);
          ap_rputs("</tr>\n", r);
        }
        /*
        if(sconf->qos_cc_block) {
          ap_rprintf(r, "<tr class=\"rows\">");
          ap_rprintf(r, "<td colspan=\"6\">block event</td>");
          ap_rprintf(r, "<td >%d</td>", sconf->qos_cc_block);
          ap_rprintf(r, "<td >&nbsp</td>");
          ap_rprintf(r, "<td >%d</td>", blocked);
          ap_rputs("</tr>\n", r);
        }
        */
      }
      /* request level */
      actEntry = sconf->act->entry;
      if(actEntry) {
        ap_rputs("    <tr class=\"rowt\">"
                 "<td colspan=\"1\">rule</td>"
                 "<td colspan=\"2\">"
                 "<div title=\"QS_LocRequestLimitMatch|QS_LocRequestLimit"
                 "|QS_CondLocRequestLimitMatch|QS_EventRequestLimit\">"
                 "concurrent requests</div></td>"
                 "<td colspan=\"3\">"
                 "<div title=\"QS_LocRequestPerSecLimitMatch|"
                 "QS_LocRequestPerSecLimit|QS_EventPerSecLimit\">"
                 "requests/second</div></td>"
                 "<td colspan=\"3\">"
                 "<div title=\"QS_LocKBytesPerSecLimitMatch|QS_LocKBytesPerSecLimit\">"
                 "kbytes/second</div></td>", r);
        ap_rputs("</tr>\n", r);
        ap_rputs("    <tr class=\"rowt\">"
                 "<td >&nbsp;</td>"
                 "<td >limit</td>"
                 "<td >current</td>"
                   "<td >wait rate</td>"
                 "<td >limit</td>"
                 "<td >current</td>"
                 "<td >wait rate</td>"
                 "<td >limit</td>"
                 "<td >current</td>", r);
          ap_rputs("</tr>\n", r);
      }
      while(actEntry) {
        char *red = "style=\"background-color: rgb(240,153,155);\"";
        ap_rputs("    <tr class=\"rows\">", r);
        ap_rprintf(r, "<!--%d--><td>%s%s</a></td>", i,
                   ap_escape_html(r->pool, qos_crline(r, actEntry->url)),
                   actEntry->condition == NULL ? "" : " <small>(conditional)</small>");
        if((actEntry->limit == 0) || (actEntry->limit == -1)) {
          ap_rprintf(r, "<td>-</td>");
          ap_rprintf(r, "<td>-</td>");
        } else {
          ap_rprintf(r, "<td>%d</td>", actEntry->limit);
          ap_rprintf(r, "<td %s>%d</td>",
                     ((actEntry->counter * 100) / actEntry->limit) > 90 ? red : "",
                     actEntry->counter);
        }
        if(actEntry->req_per_sec_limit == 0) {
          ap_rprintf(r, "<td>-</td>");
          ap_rprintf(r, "<td>-</td>");
          ap_rprintf(r, "<td>-</td>");
          } else {
          ap_rprintf(r, "<td %s>%d&nbsp;ms</td>",
                     actEntry->req_per_sec_block_rate ? red : "",
                     actEntry->req_per_sec_block_rate);
          ap_rprintf(r, "<td>%ld</td>", actEntry->req_per_sec_limit);
          ap_rprintf(r, "<td %s>%ld</td>",
                     ((actEntry->req_per_sec * 100) / actEntry->req_per_sec_limit) > 90 ? red : "",
                     now > (actEntry->interval + (QS_BW_SAMPLING_RATE*3)) ? 0 : actEntry->req_per_sec);
        }
        if(actEntry->kbytes_per_sec_limit == 0) {
            ap_rprintf(r, "<td>-</td>");
            ap_rprintf(r, "<td>-</td>");
            ap_rprintf(r, "<td>-</td>");
        } else {
          int hasActualData = now > (apr_time_sec(actEntry->kbytes_interval_us) + QS_BW_SAMPLING_RATE) ? 0 : 1;
          ap_rprintf(r, "<td %s>%"APR_OFF_T_FMT"&nbsp;ms</td>",
                     hasActualData && (actEntry->kbytes_per_sec_block_rate >= 1000) ? red : "",
                     actEntry->kbytes_per_sec_block_rate / 1000);
          ap_rprintf(r, "<td>%"APR_OFF_T_FMT"</td>", actEntry->kbytes_per_sec_limit);
          ap_rprintf(r, "<td %s>%"APR_OFF_T_FMT"</td>",
                     hasActualData && (((actEntry->kbytes_per_sec * 100) / actEntry->kbytes_per_sec_limit) > 90) ? red : "",
                     hasActualData ? actEntry->kbytes_per_sec : 0);
        }
        ap_rputs("</tr>\n", r);
        actEntry = actEntry->next;
      }
      /* event limit */
      if(sconf->event_limit_a->nelts > 0) {
        char *red = "style=\"background-color: rgb(240,153,155);\"";
        int ie = 0;
        qos_event_limit_entry_t *event_limit = sconf->act->event_entry;
        ap_rputs("    <tr class=\"rowt\">"
                 "<td colspan=\"5\"><div title=\"QS_EventLimitCount\">events</div></td>"
                 "<td colspan=\"1\">limit</td>"
                 "<td colspan=\"1\">seconds</td>"
                 "<td colspan=\"2\">current</td>", r);
        ap_rputs("</tr>\n", r);
        for(ie = 0; ie < sconf->event_limit_a->nelts; ie++) {
          int edelta = event_limit->limitTime + event_limit->seconds - now;
          int elimit = event_limit->limit;
          if(event_limit->limitTime + event_limit->seconds <= now) {
            elimit = 0;
            edelta = 0;
          }
          if(event_limit->action == QS_EVENT_ACTION_DENY) {
            ap_rprintf(r, "    <tr class=\"rows\">"
                       "<td colspan=\"5\">%s%s</td>"
                       "<td>%d</td><td>%ds</td><td %s>%d</td><td>%ds</td>"
                       "</tr>\n",
                       event_limit->env_var,
                       event_limit->condStr == NULL ? "" : " <small>(conditional)</small>",
                       event_limit->max,
                       event_limit->seconds,
                       elimit >= event_limit->max ? red : "",
                       elimit,
                       edelta);
          }
          event_limit++;
        }
      }
      /* connection level */
      if(sconf->has_conn_counter == 1 || !s->is_virtual) {
        char *red = "style=\"background-color: rgb(240,153,155);\"";
        int c = qos_count_free_ip(sconf);
        ap_rputs("    <tr class=\"rowt\">"
                 "<td colspan=\"9\">connections</td>", r);
        ap_rputs("</tr>\n", r);
        ap_rprintf(r, "    <tr class=\"rows\">"
                   "<!--%d--><td colspan=\"6\">"
                   "<div title=\"QS_SrvMaxConnPerIP\">free ip entries</div></td>"
                   "<td colspan=\"3\">%d</td></tr>\n", i, c);
        ap_rprintf(r, "    <tr class=\"rows\">"
                   "<!--%d--><td colspan=\"6\">"
                   "<div title=\"QS_SrvMaxConn|QS_SrvMaxConnClose\">current connections</div></td>"
                   "<td %s colspan=\"3\">%d</td></tr>\n", i,
                   ( ( (sconf->max_conn_close != -1) &&
                       (sconf->act->conn->connections >= sconf->max_conn_close) )  ||
                     ( (sconf->max_conn != -1) &&
                       (sconf->act->conn->connections >= sconf->max_conn) ) ) ? red : "",
                   sconf->act->conn->connections);

        if(!s->is_virtual) {
          ap_rprintf(r, "    <tr class=\"rows\">"
                     "<!--base--><td colspan=\"6\">"
                     "<div>total connections</div></td>"
                     "<td colspan=\"3\">%d</td></tr>\n",
                     qos_server_connections(sconf));
        }

        if(option && strstr(option, "ip")) {
          apr_table_t *entries = apr_table_make(r->pool, 100);
          int j;
          apr_table_entry_t *entry;
          ap_rputs("    <tr class=\"rowt\">"
                   "<td colspan=\"6\">"
                   "<div title=\"QS_SrvMaxConnPerIP\">client ip connections</div></td>"
                   "<td colspan=\"3\">current&nbsp;</td>", r);
          ap_rputs("</tr>\n", r);
          qos_collect_ip(r, sconf, entries, sconf->max_conn_per_ip, 1);
          entry = (apr_table_entry_t *)apr_table_elts(entries)->elts;
          for(j = 0; j < apr_table_elts(entries)->nelts; j++) {
            ap_rputs("     <tr class=\"rows\">", r);
            ap_rputs("<td colspan=\"6\">", r);
            ap_rprintf(r, "%s</td></tr>\n", entry[j].key);
          }
        }

        ap_rputs("    <tr class=\"rowt\">"
                 "<td colspan=\"9\">connection settings</td>", r);
        ap_rputs("</tr>\n", r);
        ap_rprintf(r, "    <tr class=\"rows\">"
                   "<td colspan=\"6\">"
                   "<div title=\"QS_SrvMaxConn\">max connections</div></td>");
        if(sconf->max_conn == -1) {
          ap_rprintf(r, "<td colspan=\"3\">-</td></tr>\n");
        } else {
          ap_rprintf(r, "<td colspan=\"3\">%d</td></tr>\n", sconf->max_conn);
        }
        ap_rprintf(r, "    <tr class=\"rows\">"
                   "<td colspan=\"6\">"
                   "<div title=\"QS_SrvMaxConnClose\">max connections with keep-alive</div></td>");
        if(sconf->max_conn_close == -1) {
          ap_rprintf(r, "<td colspan=\"3\">-</td></tr>\n");
        } else {
          ap_rprintf(r, "<td colspan=\"3\">%d</td></tr>\n", sconf->max_conn_close);
        }
        ap_rprintf(r, "    <tr class=\"rows\">"
                   "<td colspan=\"6\">"
                   "<div title=\"QS_SrvMaxConnPerIP\">max connections per client ip</div></td>");
        if(sconf->max_conn_per_ip == -1) {
          ap_rprintf(r, "<td colspan=\"3\">-</td></tr>\n");
        } else {
          ap_rprintf(r, "<td colspan=\"3\">%d</td></tr>\n", sconf->max_conn_per_ip);
        }
        ap_rprintf(r, "    <tr class=\"rows\">"
                   "<td colspan=\"6\">"
                   "<div title=\"QS_SrvMinDataRate|QS_SrvRequestRate\">"
                   "min. data rate (bytes/sec) (min/max/current)</div></td>");
        if(sconf->req_rate == -1) {
          ap_rprintf(r, "<td colspan=\"3\">-</td></tr>\n");
        } else {
          int connections;
          int rt = qos_req_rate_calc(sconf, &connections);
          ap_rprintf(r, "<td colspan=\"3\">%d/%d/%d</td></tr>\n",
                     sconf->req_rate,
                     sconf->min_rate_max == -1 ? sconf->req_rate : sconf->min_rate_max,
                     rt);
        }
      } else {
        ap_rputs("    <tr class=\"rowt\">"
                 "<td colspan=\"9\">connections</td>", r);
        ap_rputs("</tr>\n", r);
        ap_rputs("    <tr class=\"rows\">\n"
                 "     <td colspan=\"9\"><i>uses base server settings and counters</i></td>\n    </tr>\n", r);
      }
    }
    ap_rprintf(r, "    <tr class=\"row\">"
               "<td style=\"width:28%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "<td style=\"width:9%%\"></td>"
               "</tr>");
    i++;
    s = s->next;
    ap_rputs("</tbody></table>\n", r);
  }
  ap_rputs(" </td></tr>\n", r);
  ap_rputs("</tbody></table>\n", r);
  return OK;
}

/**
 * Disables request rate enforcements for all child processes (at start/fork) if
 * init has failed.
 *
 * @param bs Base server_rec to iterate through all client configurations
 * @param msg Error message to log (reason what has failed @init).
 */
static void qos_disable_req_rate(server_rec *bs, const char *msg) {
  server_rec *s = bs->next;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(bs->module_config, &qos_module);
  ap_log_error(APLOG_MARK, APLOG_CRIT, 0, bs,
               QOS_LOG_PFX(008)"could not create supervisor thread (%s),"
               " disable request rate enforcement", msg);
  sconf->req_rate = -1;
  while(s) {
    sconf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);
    sconf->req_rate = -1;
    s = s->next;
  }
}

/** 
 * stores the IP of the connection into the array and
 * increments the array pointer (for QS_Block for connection errors)
 */
static apr_uint64_t *qos_inc_block(conn_rec *connection, qos_srv_config *sconf,
                                   qs_conn_ctx *cconf, apr_uint64_t *ip) {
  conn_rec *c = connection;
 if(sconf->qos_cc_block &&
     apr_table_get(sconf->setenvstatus_t, QS_CLOSE) &&
     !apr_table_get(c->notes, QS_BLOCK_SEEN)) {
    apr_table_set(c->notes, QS_BLOCK_SEEN, "");
    *ip = cconf->ip6[0];
    ip++;
    *ip = cconf->ip6[1];
    ip++;
  }
  return ip;
}

#if APR_HAS_THREADS
/**
 * Supervisior thread monitoring the bandith of registered connections.
 *
 * Connections are closed by a apr_socket_close/shutdown which must be
 * detected by the thread processing the connection in order to 
 * de-register the connection and to terminate the pending request in
 * order to free resources (thread).
 *
 * @param thread
 * @param selfv Base server_rec
 */
static void *APR_THREAD_FUNC qos_req_rate_thread(apr_thread_t *thread, void *selfv) {
  server_rec *bs = selfv;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(bs->module_config, &qos_module);
  // list of ip addr. for whose we shall inc. block count
  apr_uint64_t *ips = calloc(sconf->max_clients * 2, APR_ALIGN_DEFAULT(sizeof(apr_uint64_t)));
  while(!sconf->inctx_t->exit) {
    apr_uint64_t *ip = ips;
    int current_con = 0;
    int req_rate = qos_req_rate_calc(sconf, &current_con);
    apr_time_t now = apr_time_sec(apr_time_now());
    apr_time_t interval = now - sconf->qs_req_rate_tm;
    int i;
    apr_table_entry_t *entry;
    // every second
    apr_sleep(APR_USEC_PER_SEC);
    if(sconf->inctx_t->exit) {
      break;
    }
    apr_thread_mutex_lock(sconf->inctx_t->lock);   /* @CRT21 */
    entry = (apr_table_entry_t *)apr_table_elts(sconf->inctx_t->table)->elts;
    for(i = 0; i < apr_table_elts(sconf->inctx_t->table)->nelts; i++) {
      qos_ifctx_t *inctx = (qos_ifctx_t *)entry[i].val;
      if(inctx->status == QS_CONN_STATE_KEEP) {
        /* enforce keep alive */
        apr_interval_time_t current_timeout = 0;
        apr_socket_timeout_get(inctx->clientSocket, &current_timeout);
        /* add 5sec tolerance to receive the request line 
           or let Apache close the connection */
        /* ignored by event MPM ! */
        if(!m_event_mpm && 
           (now > (apr_time_sec(current_timeout) + 5 + inctx->time))) {
          qs_conn_ctx *cconf = qos_get_cconf(inctx->c);
          int level = APLOG_ERR;
          if(cconf) {
            /* disabled by vip priv */
            if(cconf->is_vip && sconf->req_ignore_vip_rate != 1) {
              level = APLOG_DEBUG;
              cconf->has_lowrate = 1; /* mark connection low rate */
            }
            /* disabled for this request/connection */
            if(inctx->disabled) {
              level = APLOG_DEBUG;
              cconf->has_lowrate = 1; /* mark connection low rate */
            }
            /* enable only if min. num of connection reached */
            if(current_con < sconf->req_rate_start) {
              level = APLOG_DEBUG;
              cconf->has_lowrate = 1; /* mark connection low rate */
            }
            ip = qos_inc_block(inctx->c, sconf, cconf, ip);
            ap_log_error(APLOG_MARK, APLOG_NOERRNO|level, 0, inctx->c->base_server,
                         QOS_LOG_PFX(034)"%s,"
                         " QS_SrvMinDataRate rule (enforce keep-alive),"
                         " c=%s",
                         (level == APLOG_DEBUG) || sconf->log_only ? 
                         "log only (allowed)" 
                         : "access denied",
                         QS_CONN_REMOTEIP(inctx->c) == NULL ? "-" : QS_CONN_REMOTEIP(inctx->c));
            QS_INC_EVENT_LOCKED(sconf, 34);
            inctx->time = now;
            inctx->nbytes = 0;
            if((level == APLOG_ERR) &&
               !sconf->log_only) {
              apr_socket_shutdown(inctx->clientSocket, APR_SHUTDOWN_READ);
            }
            /* mark slow clients (QS_ClientPrefer) even they are VIP */
            inctx->shutdown = 1;
          } 
          //else {
          //  // HTTP/2
          //}
        }
      } else {
        if(interval > inctx->time) {
          int rate = inctx->nbytes / sconf->qs_req_rate_tm;
          if(rate < req_rate) {
            if(inctx->clientSocket) {
              qs_conn_ctx *cconf = qos_get_cconf(inctx->c);
              int level = APLOG_ERR;
              int notUsed = 0;
              if(cconf) {
                /* disabled by vip priv */
                if(cconf->is_vip && sconf->req_ignore_vip_rate != 1) {
                  level = APLOG_DEBUG;
                  cconf->has_lowrate = 1; /* mark connection low rate */
                }
                /* disabled for this request/connection */
                if(inctx->disabled) {
                  level = APLOG_DEBUG;
                  cconf->has_lowrate = 1; /* mark connection low rate */
                }
                /* enable only if min. num of connection reached */
                if(current_con < sconf->req_rate_start) {
                  level = APLOG_DEBUG;
                  cconf->has_lowrate = 1; /* mark connection low rate */
                }
                ip = qos_inc_block(inctx->c, sconf, cconf, ip);
                if((inctx->hasBytes == 0) &&
                   (inctx->c->keepalives == 0) &&
                   (inctx->status == QS_CONN_STATE_HEAD)) {
                  // not even received the request line
                  notUsed = 1;
                }
                ap_log_error(APLOG_MARK, APLOG_NOERRNO|level, 0, inctx->c->base_server,
                             QOS_LOG_PFX(034)"%s, QS_SrvMinDataRate rule (%s%s): min=%d,"
                             " this connection=%d,"
                             " c=%s",
                             (level == APLOG_DEBUG) || sconf->log_only ? 
                             "log only (allowed)" 
                             : "access denied",
                             inctx->status == QS_CONN_STATE_RESPONSE ? "out" : "in",
                             notUsed ? ":0" : "",
                             req_rate,
                             rate,
                             QS_CONN_REMOTEIP(inctx->c) == NULL ? "-" : QS_CONN_REMOTEIP(inctx->c));
                QS_INC_EVENT_LOCKED(sconf, 34);
                inctx->time = interval + sconf->qs_req_rate_tm;
                inctx->nbytes = 0;
                if((level == APLOG_ERR) && !sconf->log_only) {
                  if(inctx->status == QS_CONN_STATE_RESPONSE) {
                    apr_socket_shutdown(inctx->clientSocket, APR_SHUTDOWN_WRITE);
                    /* close out socket (the hard way) */
                    apr_socket_close(inctx->clientSocket);
                  } else {
                    apr_socket_shutdown(inctx->clientSocket, APR_SHUTDOWN_READ);
                  }
                }
                /* mark slow clients (QS_ClientPrefer) even they are VIP */
                inctx->shutdown = 1;
              }
            }
            //else {
            //  // HTTP/2
            //}
          } else {
            inctx->time = interval + sconf->qs_req_rate_tm;
            inctx->nbytes = 0;
          }
        }
      }
    }
    apr_thread_mutex_unlock(sconf->inctx_t->lock); /* @CRT21 */
    /* QS_Block for connection errors */
    while(ip != ips) {
      qos_user_t *u = qos_get_user_conf(sconf->act->ppool);    
      qos_s_entry_t **clientEntry = NULL;
      qos_s_entry_t searchE;
      apr_global_mutex_lock(u->qos_cc->lock);          /* @CRT38 */
      ip--;
      searchE.ip6[1] = *ip;
      ip--;
      searchE.ip6[0] = *ip;
      clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, 0);

      /* increment block event */
      if((*clientEntry)->block < USHRT_MAX) {
        (*clientEntry)->block++;
      }
      if((*clientEntry)->block == 1) {
        /* ... and start timer */
        (*clientEntry)->blockTime = apr_time_sec(apr_time_now());
      }
      apr_global_mutex_unlock(u->qos_cc->lock);        /* @CRT38 */
    }
  }
  // apr_thread_mutex_lock(sconf->inctx_t->lock);
  // apr_thread_mutex_unlock(sconf->inctx_t->lock);
  // called via apr_pool_cleanup_register():
  // apr_thread_mutex_destroy(sconf->inctx_t->lock);
  free(ips);
  if(m_threaded_mpm) {
    apr_thread_exit(thread, APR_SUCCESS);
  }
  return NULL;
}

/**
 * Terminates the connection supervisor thread.
 * (works for mpm_worker only)
 *
 * @param selfv The base server_rec
 * @return APR_SUCCESS
 */
static apr_status_t qos_cleanup_req_rate_thread(void *selfv) {
  server_rec *bs = selfv;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(bs->module_config, &qos_module);
  sconf->inctx_t->exit = 1;
  /* may long up to one second */
  if(m_threaded_mpm) {
    apr_status_t status;
    apr_thread_join(&status, sconf->inctx_t->thread);
  }
  return APR_SUCCESS;
}
#endif

/**
 * Writes the query/body to the env variables which may be used
 * for the qsfilter* audit log.
 *
 * @param r
 * @param dconf
 */
static void qos_audit(request_rec *r, qos_dir_config *dconf) {
  const char *q = NULL;
  const char *u = apr_table_get(r->notes, QS_PARP_PATH);
  if(dconf->bodyfilter_p == 1 || dconf->bodyfilter_d == 1) {
    q = apr_table_get(r->notes, QS_PARP_QUERY);
  }
  if(u == NULL) {
    if(r->parsed_uri.path) {
      u = apr_pstrdup(r->pool, r->parsed_uri.path);
    } else {
      u = apr_pstrdup(r->pool, "");
    }
    apr_table_setn(r->notes, apr_pstrdup(r->pool, QS_PARP_PATH), u);
  }
  if(q == NULL) {
    if(r->parsed_uri.query) {
      q = apr_pstrcat(r->pool, "?", r->parsed_uri.query, NULL);
    } else {
      q = apr_pstrdup(r->pool, "");
    }
    apr_table_setn(r->notes, apr_pstrdup(r->pool, QS_PARP_QUERY), q);
  }
  apr_table_setn(r->notes, apr_pstrdup(r->pool, QS_PARP_LOC), dconf->path);
  if(r->next) {
    apr_table_setn(r->next->notes, apr_pstrdup(r->pool, QS_PARP_PATH), u);
    apr_table_setn(r->next->notes, apr_pstrdup(r->pool, QS_PARP_QUERY), q);
    apr_table_setn(r->next->notes, apr_pstrdup(r->pool, QS_PARP_LOC), dconf->path);
  }
}

/**
 * Adds the configured (QS_Delay env var) delay to the request
 *
 * @param r
 * @param sconf Do set log-only mode
 */
static void qos_delay(request_rec *r, qos_srv_config *sconf) {
  const char *d = apr_table_get(r->subprocess_env, "QS_Delay");
  if(d) {
    apr_off_t s;
#ifdef ap_http_scheme
    /* Apache 2.2 */
    char *errp = NULL;
    if((APR_SUCCESS == apr_strtoff(&s, d, &errp, 10)) && s > 0)
#else
    if((s = apr_atoi64(d)) > 0)
#endif
      {
        qs_set_evmsg(r, "L;"); 
        if(!sconf->log_only) {
          apr_sleep(s*1000);
        } 
    }
  }
}

/** 
 * Enables mod_deflate
 * QS_DeflateReqBody (if parp has been enabled)
 *
 * @param r
 */
static void qos_deflate(request_rec *r) {
  if(apr_table_get(r->subprocess_env, "QS_DeflateReqBody") && 
     apr_table_get(r->subprocess_env, "parp")) {
    ap_add_input_filter("DEFLATE", NULL, r, r->connection);
  }
}

/**
 * Adjusts the content-length header
 *
 * @param r
 */
static void qos_deflate_contentlength(request_rec *r) {
  if(apr_table_get(r->subprocess_env, "QS_DeflateReqBody") && 
     apr_table_get(r->subprocess_env, "parp")) {
    const char *PARPContentLength = apr_table_get(r->subprocess_env, "PARPContentLength");
    const char *contentLength = apr_table_get(r->headers_in, "Content-Length");
    if(PARPContentLength && contentLength) {
      apr_table_set(r->headers_in, "Content-Length", PARPContentLength);
    }
  }
}

/**
 * Verifies Apache and MPM version and writes error message (notice)
 * for incompatibel version/type.
 *
 * Apache MPM worker binaries is the only configuration which
 * has been fully tested (as mentioned in the documentation, see index.html).
 *
 * - old (2.0.x, 2.2.x) MPM Apache prefork versions do not unload the
 *   DSO properly or child exit may cause a segfault (pool cleanup)
 * - regular expression are only fully supported with Apach 2.4
 * - Apache 2.4 should work (but is not fully tested)
 *   (see CHANGES.txt for more information)
 * - Apache 2.0 does not support all directives (e.g. QS_ClientPrefer) and
 *   we do no longer test against this version (the module does probably
 *   not even compile with version 2.0)
 *
 */
static void qos_version_check(server_rec *bs) {
  ap_version_t version;

  if(strcasecmp(ap_show_mpm(), "event") == 0) {
    ap_directive_t *pdir;
    m_event_mpm = 1; // disable features like keep-alive control
    for(pdir = ap_conftree; pdir != NULL; pdir = pdir->next) {
      if(strcasecmp(pdir->directive, "AsyncRequestWorkerFactor") == 0) {
        double val = 0;
        char *endptr;
        const char *arg = pdir->args;
        if(arg == NULL) {
          continue;
        }
        val = strtod(arg, &endptr);
        if(*endptr) {
          continue;
        }
        if(val < 0) {
          continue;
        }
        m_event_mpm_worker_factor = val;        
        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, bs, 
                     QOS_LOGD_PFX"found AsyncRequestWorkerFactor directive '%f'",
                     m_event_mpm_worker_factor);
      }
    }
  } else if(strcasecmp(ap_show_mpm(), "worker") != 0) {
    // mod_qos is fully tested for MPM worker (and "works" with event)
    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, bs, 
                 QOS_LOG_PFX(009)"loaded MPM is '%s'"
                 " but mod_qos should be used with MPM 'Worker' or 'Event' only.",
                 ap_show_mpm());
  }

  if(strcasecmp(ap_show_mpm(), "prefork") == 0) {
    m_threaded_mpm = 0; // disable child cleanup (if neither worker nor event MPM)
  }
  
  ap_get_server_revision(&version);
  if(version.major == 2 && version.minor == 4 && version.patch == 49) {
    // 2.4.49 compat: prevents Apache segfault on connection close
    m_forced_close = 0;
  }

  if(version.major != 2 || version.minor != 4) {
    // 2.4 should work fine / older or newer versions are not tested
    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, bs, 
                 QOS_LOG_PFX(009)"server version is %d.%d"
                 " but mod_qos should be used with Apache 2.4 only.",
                 version.major, version.minor);
  }
}

/**
 * enforces the QS_RedirectIf variable
 * @param r
 * @param sconf
 * @param rules Rules array
 * @return HTTP_MOVED_TEMPORARILY/HTTP_TEMPORARY_REDIRECT or DECLINED
 */
static int qos_redirectif(request_rec *r, qos_srv_config *sconf, 
                          apr_array_header_t *rules) {
  ap_regmatch_t regm[AP_MAX_REG_MATCH];
  int i;
  qos_redirectif_entry_t *entries = (qos_redirectif_entry_t *)rules->elts;
  for(i = 0; i < rules->nelts; ++i) {
    qos_redirectif_entry_t *entry = &entries[i];
    const char *val = apr_table_get(r->subprocess_env, entry->name);
    if(val) {
      if(ap_regexec(entry->preg, val, AP_MAX_REG_MATCH, regm, 0) == 0) {
        int severity = sconf->log_only ? APLOG_WARNING : APLOG_ERR;
        char *replaced = ap_pregsub(r->pool, entry->url, val, AP_MAX_REG_MATCH, regm);
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|severity, 0, r,
                      QOS_LOG_PFX(049)"redirect to %s,"
                      " var=%s,"
                      " action=%s, c=%s, id=%s",
                      replaced,
                      entry->name,
                      sconf->log_only ? "log only" : "redirect",
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" :
                      QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "049"));
        QS_INC_EVENT(sconf, 49);
        if(!sconf->log_only) {
          apr_table_set(r->headers_out, "Location", replaced);
          return entry->code;
        }
      }
    }
  }
  return DECLINED;
}

static void qos_init_unique_id(apr_pool_t *p, server_rec *bs) {
  char str[APRMAXHOSTLEN + 1];
  apr_sockaddr_t *sockaddr;
  str[APRMAXHOSTLEN] = '\0';
  unsigned int in_addr = 0;
  if(apr_gethostname(str, sizeof(str) - 1, p) == APR_SUCCESS) {
    if(apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p) == APR_SUCCESS) {
      in_addr = sockaddr->sa.sin.sin_addr.s_addr;
    }
  }
  pid_t pid = getpid();
  m_unique_id.in_addr = pid^in_addr;
  m_unique_id.unique_id_counter = time(NULL);
}

/**
 * propagates environment variables to sub-requests (for logging)
 */
static void qos_propagate_events(request_rec *r) {
  request_rec *mr = NULL;
  const char **var;
  if(r->prev) {
    mr = r->prev;
  } else if(r->main) {
    mr = r->main;
  } else if(r->next) {
    mr = r->next;
  }
  var = m_env_variables;
  while(*var) {
    int propagated = 0;
    if(mr) {
      const char *p = apr_table_get(mr->subprocess_env, *var);
      if(p) {
        propagated = 1;
        apr_table_set(r->subprocess_env, *var, p);
      }
      if(!propagated) {
        p = apr_table_get(r->subprocess_env, *var);
        if(p) {
          propagated = 1;
          apr_table_set(mr->subprocess_env, *var, p);
        }
      }
    }
    var++;
  }
  if(r->prev) {
    // internal redirect (e.g. error page)
    int i;
    int len = strlen(QS_LIMIT_NAME_PFX);
    request_rec *mp = r->prev;
    apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(mp->subprocess_env)->elts;
    for(i = 0; i < apr_table_elts(mp->subprocess_env)->nelts; ++i) {
      if(strncmp(entry[i].key, QS_LIMIT_NAME_PFX, len) == 0) {
        const char *eventName = entry[i].val;
        const char *name = apr_pstrcat(r->pool, eventName, QS_COUNTER_SUFFIX, NULL);
        const char *value = apr_table_get(mp->subprocess_env, name);
        if(value) {
          apr_table_set(r->subprocess_env, name, value);
        }
        name = eventName;
        value = apr_table_get(mp->subprocess_env, name);
        if(value) {
          apr_table_set(r->subprocess_env, name, value);
        }
        name = apr_pstrcat(r->pool, eventName, QS_LIMIT_REMAINING, NULL);
        value = apr_table_get(mp->subprocess_env, name);
        if(value) {
          apr_table_set(r->subprocess_env, name, value);
        }
        name = apr_pstrcat(r->pool, eventName, QS_LIMIT_SEEN, NULL);
        value = apr_table_get(mp->subprocess_env, name);
        if(value) {
          apr_table_set(r->subprocess_env, name, value);
        }
      }
    }
  }
}

/**
 * ensure that every request record has the error notes to log
 */
static void qos_propagate_notes(request_rec *r) {
  request_rec *mr = NULL;
  const char **var;
  if(r->prev) {
    mr = r->prev;
  } else if(r->main) {
    mr = r->main;
  } else if(r->next) {
    mr = r->next;
  }
  var = m_note_variables;
  while(*var) {
    int propagated = 0;
    if(mr) {
      const char *p = apr_table_get(mr->notes, *var);
      if(p) {
        propagated = 1;
        apr_table_setn(r->notes, *var, p);
      }
      if(!propagated) {
        p = apr_table_get(r->notes, *var);
        if(p) {
          propagated = 1;
          apr_table_setn(mr->notes, *var, p);
        }
      }
    }
    var++;
  }
}


/* QS_UnsetReqHeader */
static void qos_unset_reqheader(request_rec *r, qos_srv_config *sconf) {
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(sconf->unsetreqheader_t)->elts;
  for(i = 0; i < apr_table_elts(sconf->unsetreqheader_t)->nelts; i++) {
    apr_table_unset(r->headers_in, entry[i].key);
  }
  return;
}

/* QS_UnsetResHeader */
static void qos_unset_resheader(request_rec *r, qos_srv_config *sconf) {
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(sconf->unsetresheader_t)->elts;
  for(i = 0; i < apr_table_elts(sconf->unsetresheader_t)->nelts; i++) {
    apr_table_unset(r->headers_out, entry[i].key);
    apr_table_unset(r->err_headers_out, entry[i].key);
  }
  return;
}

/************************************************************************
 * handlers
 ***********************************************************************/

/**
 * Destructor to handle connections which do not have been established
 * successfully resp. have been closed unexpectedly.
 *
 * Increments block counter.
 *
 * @param p Connection base context
 * @return APR_SUCCESS
 */
static apr_status_t qos_base_cleanup_conn(void *p) {
  qs_conn_base_ctx *base = p;
  if(base->sconf->has_qos_cc || base->sconf->qos_cc_prefer) {
    int connRuleViolation = 0;
    const char *type = QS_EMPTY_CON;
    if(base->requests == 0 &&
       apr_table_get(base->sconf->setenvstatus_t, QS_EMPTY_CON) && 
       !apr_table_get(base->c->notes, QS_BLOCK_SEEN)) {
      connRuleViolation = 1;
      apr_table_set(base->c->notes, QS_BLOCK_SEEN, "");
    }
    if(apr_table_get(base->c->notes, QS_BROKEN_CON)) {
      connRuleViolation = 1;
      type = QS_BROKEN_CON;
    }
    if(apr_table_get(base->c->notes, QS_MAXIP)) {
      connRuleViolation = 1;
      type = QS_MAXIP;
    }
    if(connRuleViolation) {
      qos_user_t *u = qos_get_user_conf(base->sconf->act->ppool);
      qos_s_entry_t **clientEntry = NULL;
      qos_s_entry_t searchE;
      qos_ip_str2long(QS_CONN_REMOTEIP(base->c), searchE.ip6); // no ip simulation here
      apr_global_mutex_lock(u->qos_cc->lock);           /* @CRT40 */
      clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, 0);

      /* increment block event */
      if((*clientEntry)->block < USHRT_MAX) {
        (*clientEntry)->block++;
      }
      if((*clientEntry)->block == 1) {
        /* ... and start timer */
        (*clientEntry)->blockTime = apr_time_sec(apr_time_now());
      }
      apr_global_mutex_unlock(u->qos_cc->lock);         /* @CRT40 */
      if(QS_ISDEBUG(base->c->base_server)) {
        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, base->c->base_server, 
                     QOS_LOGD_PFX"QS_ClientEventBlockCount rule: "
                     "%s event detected "
                     "c=%s",
                     type,
                     QS_CONN_REMOTEIP(base->c) == NULL ? "-" : QS_CONN_REMOTEIP(base->c));
      }
    }
  }
  return APR_SUCCESS;
}

/**
 * Connection destructor.
 *
 * Updates per IP events and connection counter.
 *
 * @param p Connection context
 * @return APR_SUCCESS
 */
static apr_status_t qos_cleanup_conn(void *p) {
  qs_conn_ctx *cconf = p;
  if(cconf->sconf->has_qos_cc || cconf->sconf->qos_cc_prefer) {
    qos_user_t *u = qos_get_user_conf(cconf->sconf->act->ppool);
    qos_s_entry_t **clientEntry = NULL;
    qos_s_entry_t searchE;
    searchE.ip6[0] = cconf->ip6[0];
    searchE.ip6[1] = cconf->ip6[1];
    apr_global_mutex_lock(u->qos_cc->lock);           /* @CRT15 */
    // generation: check if it has been cleard for this process generation
    if((m_generation != u->qos_cc->generation_locked) && u->qos_cc->connections > 0) {
      u->qos_cc->connections--;
    }
    clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, 0);
    if((*clientEntry)->events < UINT_MAX) {
      (*clientEntry)->events++; // update event activity even there is no valid request (logger)
    }
    if(cconf->set_vip_by_header) {
      (*clientEntry)->vip = 1;
    }
    if(cconf->has_lowrate) {
      (*clientEntry)->lowrate = time(NULL);
      (*clientEntry)->lowratestatus |= QOS_LOW_FLAG_PKGRATE;
    }
    apr_global_mutex_unlock(u->qos_cc->lock);         /* @CRT15 */
  }
  /* QS_SrvMaxConn or Geo */
  if(qos_count_connections(cconf->sconf)) {
    apr_global_mutex_lock(cconf->sconf->act->lock);   /* @CRT3 */
    if(cconf->sconf->act->conn && cconf->sconf->act->conn->connections > 0) {
      cconf->sconf->act->conn->connections--;
    }
    apr_global_mutex_unlock(cconf->sconf->act->lock); /* @CRT3 */
  }
  if(cconf->sconf->max_conn_per_ip != -1) {
    qos_dec_ip(cconf);
  }
  return APR_SUCCESS;
}

/**
 * handler to close the connection in the case the abort
 * by the pre-connect hook was ignored (Apache 2.4.28 Event MPM)
 */
static int qos_process_connection(conn_rec *connection) {
#if (AP_SERVER_MINORVERSION_NUMBER == 4)
#if (AP_SERVER_PATCHLEVEL_NUMBER > 17)
  if(connection->master) {
    // skip slave connections / process "real" connections only
    return DECLINED;
  }
#endif
#endif
  if(connection->aborted == 1 && apr_table_get(connection->notes, QS_CONN_ABORT)) {
    if(connection->cs) {
      connection->cs->state = CONN_STATE_LINGER;
    }
    ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_WARNING, 0, connection->base_server,
                 QOS_LOG_PFX(167)"closing connection at process connection hook, c=%s",
                 QS_CONN_REMOTEIP(connection) == NULL ? "-" : 
                 QS_CONN_REMOTEIP(connection));

    return HTTP_INTERNAL_SERVER_ERROR;
  }
  return DECLINED;
}

/**
 * Connection constructor. Rules that are applied to established connections.
 *
 * @param c
 * @return
 */
static int qos_pre_process_connection(conn_rec *connection, void *skt) {
  conn_rec *c = connection;
  qs_conn_ctx *cconf;
  int vip = 0;
  apr_socket_t *socket = skt;
  
  if(c->sbh == NULL) {
    // proxy connections do NOT have any relation to the score board, don't handle them
    return DECLINED;
  }

#if (AP_SERVER_MINORVERSION_NUMBER == 4)
#if (AP_SERVER_PATCHLEVEL_NUMBER > 17)
  if(connection->master) {
    // skip slave connections / process "real" connections only
    return DECLINED;
  }
#endif
#endif

  cconf = qos_get_cconf(c);
  if(cconf == NULL) {
    int client_control = DECLINED;
    int connections = 0;
    int all_connections = 0;
    int current = 0;
    qs_ip_entry_t *conn_ip = NULL;
    char *msg = NULL;
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(c->base_server->module_config,
                                                                  &qos_module);
    qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
    cconf = qos_create_cconf(c, sconf);

    /* control timeout */
    if(sconf->req_rate != -1) {
      qos_timeout_pc(c, sconf);
    }

    /* packet rate */
    if(sconf->qos_cc_prefer_limit) {
      qos_pktrate_pc(c, sconf);
    }

    /* evaluates client ip */
    qos_ip_str2long(QS_CONN_REMOTEIP(c), cconf->ip6);
#ifdef QS_INTERNAL_TEST
    /* use one of the predefined ip addresses */
    if(cconf->sconf->enable_testip) {
      char *testid = apr_psprintf(c->pool, "%d", rand()%(m_qs_sim_ip_len-1));
      const char *testip = apr_table_get(cconf->sconf->testip, testid);
      qos_ip_str2long(testip, cconf->ip6);
    }
#endif

    /* ------------------------------------------------------------
     * update data
     */
    /* client control */
    client_control = qos_cc_pc_filter(c, cconf, u, &msg);
    /* QS_SrvMaxConn: vhost connections or Geo */
    if(qos_count_connections(sconf)) {
      apr_global_mutex_lock(cconf->sconf->act->lock);    /* @CRT4 */
      if(cconf->sconf->act->conn) {
        cconf->sconf->act->conn->connections++;
        all_connections = qos_server_connections(sconf);
        connections = cconf->sconf->act->conn->connections;
        apr_table_set(c->notes, "QS_SrvConn", apr_psprintf(c->pool, "%d", connections));
        apr_table_set(c->notes, "QS_AllConn", apr_psprintf(c->pool, "%d", all_connections));
      }
      apr_global_mutex_unlock(cconf->sconf->act->lock);  /* @CRT4 */
    }

    /* single source ip */
    if(sconf->max_conn_per_ip != -1) {
      current = qos_inc_ip(sconf, cconf, &conn_ip);
      apr_table_set(c->notes, "QS_IPConn", apr_psprintf(c->pool, "%d", current));
    }
    /* Check for vip (by ip) */
    vip = qos_is_excluded_ip(cconf->mc, sconf->exclude_ip);
    if(vip == 0) {
      // check if qos_cc_pc_filter() got vip status form the cc store
      vip = cconf->is_vip;
    }
    if(vip) {
      /* propagate vip to connection */
      cconf->is_vip = vip;
      if(!cconf->evmsg || !strstr(cconf->evmsg, "S;")) {
        cconf->evmsg = apr_pstrcat(c->pool, "S;", cconf->evmsg, NULL);
      }
    }

    /* ------------------------------------------------------------
     * enforce rules
     */
    /* client control */
    if((client_control != DECLINED) && !vip) {
      ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                   "%s",
                   msg == NULL ? "-" : msg);
      if(!sconf->log_only) {
        return qos_return_error_andclose(c, socket);
      }
    }
    /* Geo */
    if(sconf->geodb) {
      unsigned long ip = qos_geo_str2long(c->pool, QS_CONN_REMOTEIP(c));
      qos_geo_entry_t *pB = bsearch(&ip,
                              sconf->geodb->data,
                              sconf->geodb->size,
                              sizeof(qos_geo_entry_t),
                              qos_geo_comp);
      if(pB) {
        apr_table_set(c->notes, QS_COUNTRY, pB->country);
      }
      if(sconf->geo_limit != -1) {
        if(all_connections >= sconf->geo_limit) {
          if(sconf->geo_excludeUnknown == 1 && (pB == NULL || pB->country[0] == '\0')) {
            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, c->base_server, 
                         QOS_LOGD_PFX"skip QS_ClientGeoCountryPriv enforcement"
                         " for client address %s which could not be mapped to country code",
                         QS_CONN_REMOTEIP(c) ? QS_CONN_REMOTEIP(c) : "UNKNOWN");
          } else if(pB == NULL || apr_table_get(sconf->geo_priv, pB->country) == NULL) {
            ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                         QOS_LOG_PFX(101)"access denied%s,"
                         " QS_ClientGeoCountryPriv rule: max=%d,"
                         " concurrent connections=%d,"
                         " c=%s"
                         " country=%s",
                         sconf->log_only ? " (log only)" : "",
                         sconf->geo_limit,
                         all_connections,
                         QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c),
                         pB != NULL ? pB->country : "--");
            QS_INC_EVENT(sconf, 101);
            if(!sconf->log_only) {
              return qos_return_error_andclose(c, socket);
            }
          }
        }
      }
    }
    /* QS_SrvMaxConn: vhost connections */
    if((sconf->max_conn != -1) && !vip) {
      if(connections > sconf->max_conn) {
        ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                     QOS_LOG_PFX(030)"access denied%s, QS_SrvMaxConn rule: max=%d,"
                     " concurrent connections=%d,"
                     " c=%s",
                     sconf->log_only ? " (log only)" : "",
                     sconf->max_conn, connections,
                     QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c));
        QS_INC_EVENT(sconf, 30);
        if(!sconf->log_only) {
          return qos_return_error_andclose(c, socket);
        }
      }
    }
    /* single source ip */
    if((sconf->max_conn_per_ip != -1) && (!vip || sconf->max_conn_per_ip_ignore_vip == 1)) {
      if((current > sconf->max_conn_per_ip) &&
         (all_connections >= sconf->max_conn_per_ip_connections)) {
        conn_ip->error++;
        if(apr_table_get(sconf->setenvstatus_t, QS_MAXIP)) {
          apr_table_set(c->notes, QS_MAXIP, "1");
        }
        /* only print the first 20 messages for this client */
        QS_INC_EVENT(sconf, 31);
        if(conn_ip->error <= QS_LOG_REPEAT) {
          ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                       QOS_LOG_PFX(031)"access denied%s,"
                       " QS_SrvMaxConnPerIP rule: max=%d,"
                       " concurrent connections=%d,"
                       " c=%s",
                       sconf->log_only ? " (log only)" : "",
                       sconf->max_conn_per_ip, current,
                       QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c));
        } else {
          if((conn_ip->error % QS_LOG_REPEAT) == 0) {
            ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                         QOS_LOG_PFX(031)"access denied%s,"
                         " QS_SrvMaxConnPerIP rule: max=%d,"
                         " concurrent connections=%d,"
                         " message repeated %d times,"
                         " c=%s",
                         sconf->log_only ? " (log only)" : "",
                         sconf->max_conn_per_ip, current,
                         QS_LOG_REPEAT,
                         QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c));
          }
        }
        if(!sconf->log_only) {
          return qos_return_error_andclose(c, socket);
        }
      } else {
        if(conn_ip) {
          if(conn_ip->error > QS_LOG_REPEAT) {
            ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                         QOS_LOG_PFX(031)"access denied (previously),"
                         " QS_SrvMaxConnPerIP rule: max=%d,"
                         " concurrent connections=%d,"
                         " message repeated %d times,"
                         " c=%s",
                         sconf->max_conn_per_ip, current,
                         conn_ip->error % QS_LOG_REPEAT,
                         QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c));
          }
          conn_ip->error = 0;
        }
      }
    }
  }
  return DECLINED;
}

/**
 * Pre connection
 * - constructs the connection ctx (stores socket ref)
 * - enforces block counter (as early as possible)
 */
static int qos_pre_connection(conn_rec *connection, void *skt) {
  conn_rec *c = connection;
  int ret = DECLINED;
  qos_srv_config *sconf;
  qs_conn_base_ctx *base;
  int excludeFromBlock;

  if(c->sbh == NULL) {
    // proxy connections do NOT have any relation to the score board, don't handle them
    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, c->base_server, 
                 QOS_LOGD_PFX"skip processing of outgoing/virtual connection %s<->%s",
                 QS_CONN_REMOTEIP(c) ? QS_CONN_REMOTEIP(c) : "UNKNOWN",
                 c->local_ip ? c->local_ip : "UNKNOWN");
    return ret;
  }

#if (AP_SERVER_MINORVERSION_NUMBER == 4)
#if (AP_SERVER_PATCHLEVEL_NUMBER > 17)
  if(connection->master) {
    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, c->base_server, 
                 QOS_LOGD_PFX"skip slave connection %s",
                 QS_CONN_REMOTEIP(c) ? QS_CONN_REMOTEIP(c) : "UNKNOWN");
    return ret;
  }
#endif
#endif

  sconf = (qos_srv_config*)ap_get_module_config(c->base_server->module_config, &qos_module);
  excludeFromBlock = qos_is_excluded_ip(c, sconf->cc_exclude_ip);
  base = qos_get_conn_base_ctx(c);
  if(base == NULL) {
    base = qos_create_conn_base_ctx(c, sconf);
    base->clientSocket = skt;
  }

  if(sconf && (sconf->req_rate != -1)) {
    qos_ifctx_t *inctx = qos_create_ifctx(c, sconf);
    inctx->clientSocket = skt;
    ap_add_input_filter("qos-in-filter", inctx, NULL, c);
  }

  /* blocked by event (block only, no limit) - very aggressive */
  if(sconf->qos_cc_block && !excludeFromBlock) {
    qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
    qos_s_entry_t **clientEntry = NULL;
    qos_s_entry_t searchE;
    qos_ip_str2long(QS_CONN_REMOTEIP(c), searchE.ip6); // no ip simulation here
    apr_global_mutex_lock(u->qos_cc->lock);           /* @CRT39 */
    clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, 0);
    if((*clientEntry)->block >= sconf->qos_cc_block) {
      apr_time_t now = time(NULL);
      if(((*clientEntry)->blockTime + sconf->qos_cc_blockTime) > now) {
        (*clientEntry)->blockMsg++;;
        // stop logging every event if we have logged it many times
        QS_INC_EVENT_LOCKED(sconf, 60);
        if((*clientEntry)->blockMsg > QS_LOG_REPEAT) {
          if(((*clientEntry)->blockMsg % QS_LOG_REPEAT) == 0) {
            ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                         QOS_LOG_PFX(060)"access denied, "
                         "QS_ClientEventBlockCount rule: "
                         "max=%d, current=%hu, "
                         "message repeated %d times, "
                         "c=%s",
                         sconf->qos_cc_block,
                         (*clientEntry)->block,
                         QS_LOG_REPEAT,
                         QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c));
          }
        } else {
          ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                       QOS_LOG_PFX(060)"access denied, QS_ClientEventBlockCount rule: "
                       "max=%d, current=%hu, age=%"APR_TIME_T_FMT", c=%s",
                       sconf->qos_cc_block,
                       (*clientEntry)->block,
                       now - (*clientEntry)->blockTime,
                       QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c));
        }
        if(!sconf->log_only) {
          apr_table_set(c->notes, QS_BLOCK_SEEN, ""); // suppress NullConnection messages
          c->keepalive = AP_CONN_CLOSE;
          c->aborted = 1;
          if(c->cs) {
            c->cs->state = CONN_STATE_LINGER;
          }
          apr_table_set(c->notes, QS_CONN_ABORT, QS_CONN_ABORT);
          if (m_forced_close == 0) {
            ret = DECLINED;
          } else {
            ret = m_retcode;
          }
        }
      } else {
        /* release */
        if((*clientEntry)->blockMsg > QS_LOG_REPEAT) {
          // write remaining log lines
          ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, c->base_server,
                       QOS_LOG_PFX(060)"access denied (previously), QS_ClientEventBlockCount rule: "
                       "max=%d, current=%hu, "
                       "message repeated %d times, "
                       "c=%s",
                       sconf->qos_cc_block,
                       (*clientEntry)->block,
                       (*clientEntry)->blockMsg % QS_LOG_REPEAT,
                       QS_CONN_REMOTEIP(c) == NULL ? "-" : QS_CONN_REMOTEIP(c));          
          (*clientEntry)->blockMsg = 0;
        }
        (*clientEntry)->block = 0;
        (*clientEntry)->blockTime = 0;
      }
    }
    apr_global_mutex_unlock(u->qos_cc->lock);         /* @CRT39 */
  }

  return ret;
}

/**
 * Process user tracking cookie (QS_UserTrackingCookieName)
 *
 * @param r
 * @return DECLINED or 302
 */
static int qos_post_read_request_later(request_rec *r) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                &qos_module);
  char *value;
  const char *ignore;

  if(sconf->log_env == 1) {
    qos_log_env(r, ">PR_2");
  }

  if(!ap_is_initial_req(r) || !sconf->user_tracking_cookie) {
    return DECLINED;
  }

  value = qos_get_remove_cookie(r, sconf->user_tracking_cookie);
  qos_get_create_user_tracking(r, sconf, value);

  if(!sconf->user_tracking_cookie_force) {
    return DECLINED;
  }

  if(qos_request_check(r, sconf) != APR_SUCCESS) {
    return HTTP_BAD_REQUEST;
  }

  if(strcmp("/favicon.ico", r->parsed_uri.path) == 0) {
    return DECLINED;
  }

  ignore = apr_table_get(r->subprocess_env, QOS_DISABLE_UTC_ENFORCEMENT);
  if(ignore) {
    return DECLINED;
  }
  if(strcmp(sconf->user_tracking_cookie_force, r->parsed_uri.path) == 0) {
    /* access to check url */
    if(sconf->user_tracking_cookie_jsredirect == 1) {
      apr_table_set(r->subprocess_env, "QS_UT_NAME", sconf->user_tracking_cookie);
      apr_table_set(r->subprocess_env, "QS_UT_INITIAL_URI", "/");
      apr_table_set(r->subprocess_env, "QS_UT_QUERY", "qs=init");
      if(r->parsed_uri.query && strcmp(r->parsed_uri.query, "qs=init") == 0) {
        apr_table_add(r->headers_out, "Cache-Control", "no-cache, no-store");
        qos_send_user_tracking_cookie(r, sconf, HTTP_OK);
        return DECLINED;
      }
      if(r->parsed_uri.query && (strncmp(r->parsed_uri.query, "r=", 2) == 0)) {
        char *redirect_page;
        int buf_len = 0;
        unsigned char *buf;
        char *q = r->parsed_uri.query;
        buf_len = qos_decrypt(r, sconf, &buf, &q[2]);
        if(buf_len > 0) {
          redirect_page = apr_psprintf(r->pool, "%.*s",
                                       buf_len, buf);
          apr_table_set(r->subprocess_env, "QS_UT_INITIAL_URI", redirect_page);
        }
      }
    }
    if(apr_table_get(r->subprocess_env, QOS_USER_TRACKING_NEW) == NULL) {
      if(r->parsed_uri.query && (strncmp(r->parsed_uri.query, "r=", 2) == 0)) {
        /* client has send a cookie, redirect to original url */
        int buf_len = 0;
        unsigned char *buf;
        char *q = r->parsed_uri.query;
        buf_len = qos_decrypt(r, sconf, &buf, &q[2]);
        if(buf_len > 0) {
          char *redirect_page = apr_psprintf(r->pool, "%s%.*s",
                                             qos_this_host(r),
                                             buf_len, buf);
          apr_table_set(r->headers_out, "Location", redirect_page);
          return HTTP_MOVED_TEMPORARILY;
        }
      }
    } /* else, "grant access" to the error page */
    /* but prevent page caching (the browser shall always access the
       server when redireced to this url */
    apr_table_add(r->headers_out, "Cache-Control", "no-cache, no-store");
  } else if(apr_table_get(r->subprocess_env, QOS_USER_TRACKING_NEW) != NULL) {
    if((r->method_number == M_GET || sconf->user_tracking_cookie_jsredirect == 1) &&
       (apr_table_get(r->subprocess_env, QOS_USER_TRACKING_RENEW) == NULL)) {
      /* no valid cookie in request, redirect to check page */
      char *redirect_page = apr_pstrcat(r->pool, qos_this_host(r),
                                        sconf->user_tracking_cookie_force,
                                        "?r=",
                                        qos_encrypt(r, sconf,
                                                    (unsigned char *)r->unparsed_uri,
                                                    strlen(r->unparsed_uri)),
                                        NULL);
      apr_table_set(r->headers_out, "Location", redirect_page);
      if(sconf->user_tracking_cookie_jsredirect < 1) {
        qos_send_user_tracking_cookie(r, sconf, HTTP_MOVED_TEMPORARILY);
      }
      return HTTP_MOVED_TEMPORARILY;
    }
  }
  return DECLINED;
}

/**
 * All headers has been read. End/updates connection level filters and propagtes
 * per connection events to the request_rec.
 *
 * @param r
 * @return DECLINED
 */
static int qos_post_read_request(request_rec *r) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                &qos_module);
  qos_ifctx_t *inctx = NULL;

  /* propagate connection env vars to req, geo data and QS_SrvMaxConn */
  const char *country = apr_table_get(r->connection->notes, QS_COUNTRY);
  const char *connections = apr_table_get(r->connection->notes, "QS_SrvConn");
  const char *all_connections = apr_table_get(r->connection->notes, "QS_AllConn");
  const char *fromCurrentIp = apr_table_get(r->connection->notes, "QS_IPConn");
  const char *connectionid = apr_table_get(r->connection->notes, QS_CONNID);
  const char *lowPrioFlags = apr_table_get(r->connection->notes, "QS_ClientLowPrio");
  const char *isVipIP = apr_table_get(r->connection->notes, QS_ISVIPREQ);

  /* QS_UnsetReqHeader */
  qos_unset_reqheader(r, sconf);

  if(sconf->geodb) {
    if(sconf->qos_cc_forwardedfor) {
      // override country determined on a per connection basis
      const char *forwardedfor = qos_forwardedfor_fromHeader(r, sconf->qos_cc_forwardedfor);
      if(forwardedfor) {
        unsigned long ip = qos_geo_str2long(r->pool, forwardedfor);
        if(ip) {
          qos_geo_entry_t *pB = bsearch(&ip,
                                  sconf->geodb->data,
                                  sconf->geodb->size,
                                  sizeof(qos_geo_entry_t),
                                  qos_geo_comp);
          if(pB) {
            country = apr_pstrdup(r->pool, pB->country);
          }
        } else {
          if(apr_table_get(r->notes, "QOS_LOG_PFX069") == NULL) {
            ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                          QOS_LOG_PFX(069)"no valid IP header found (@prr):"
                          " invalid header value '%s', fallback to connection's IP %s, id=%s",
                          forwardedfor,
                          QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                          qos_unique_id(r, "069"));
            apr_table_set(r->notes, "QOS_LOG_PFX069", "log once");
            QS_INC_EVENT(sconf, 69);
          }
        }
      } else {
        if(apr_table_get(r->notes, "QOS_LOG_PFX069") == NULL) {
          ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                        QOS_LOG_PFX(069)"no valid IP header found (@prr):"
                        " header '%s' not available, fallback to connection's IP %s, id=%s",
                        sconf->qos_cc_forwardedfor,
                        QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                        qos_unique_id(r, "069"));
          apr_table_set(r->notes, "QOS_LOG_PFX069", "log once");
          QS_INC_EVENT(sconf, 69);
        }
      }
    }
  }
  if(country) {
    apr_table_set(r->subprocess_env, QS_COUNTRY, country);
  }
  if(connections) {
    apr_table_set(r->subprocess_env, "QS_SrvConn", connections);
  }
  if(fromCurrentIp) {
    apr_table_set(r->subprocess_env, "QS_IPConn", fromCurrentIp);
  }
  if(all_connections) {
    apr_table_set(r->subprocess_env, "QS_AllConn", all_connections);
  }
  if(connectionid == NULL) {
    connectionid = apr_psprintf(r->pool, "%"APR_TIME_T_FMT"%.2ld%.5"APR_PID_T_FMT,
                                r->request_time,
                                r->connection->id % 100,
                                getpid());
    apr_table_set(r->connection->notes, QS_CONNID, connectionid);
  }
  apr_table_set(r->subprocess_env, QS_CONNID, connectionid);

  if(!ap_is_initial_req(r)) {
    // sub-request
    qos_propagate_events(r);
  } else {
    qos_pr_event_limit(r, sconf);
  }

  /* QS_ClientPrefer: propagate connection env vars to req */
  if(lowPrioFlags) {
    apr_table_set(r->subprocess_env, "QS_ClientLowPrio", lowPrioFlags);
  }
  /* QS_IsVipRequest is set due VIP IP */
  if(isVipIP) {
    apr_table_set(r->subprocess_env, QS_ISVIPREQ, isVipIP);
  }

  if(sconf->log_env == 1) {
    qos_log_env(r, ">PR_1");
  }

  if(qos_request_check(r, sconf) != APR_SUCCESS) {
    return HTTP_BAD_REQUEST;
  }

  if(!ap_is_initial_req(r)) {
    // we are done for this request (e.g. error page)
    return DECLINED;
  }

  qos_parp_prr(r, sconf);
  if(sconf && (sconf->req_rate != -1)) {
    inctx = qos_get_ifctx(r->connection->input_filters);
    if(inctx) {
      const char *te = apr_table_get(r->headers_in, "Transfer-Encoding");
      inctx->r = r;
      if(r->read_chunked || (te && (strcasecmp(te, "chunked") == 0))) {
        ap_add_input_filter("qos-in-filter2", inctx, r, r->connection);
        inctx->status = QS_CONN_STATE_CHUNKED;
      } else {
        const char *cl = apr_table_get(r->headers_in, "Content-Length");
        if(cl == NULL) {
          inctx->status = QS_CONN_STATE_END;
#if APR_HAS_THREADS
          if(!sconf->inctx_t->exit) {
            apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT26 */
            apr_table_unset(sconf->inctx_t->table,
                            QS_INCTX_ID);
            apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT26 */
          }
#endif
        } else {
#ifdef ap_http_scheme
          /* Apache 2.2 */
          if(APR_SUCCESS == apr_strtoff(&inctx->cl_val, cl, NULL, 0))
#else
          if((inctx->cl_val = apr_atoi64(cl)) >= 0)
#endif
            {
            ap_add_input_filter("qos-in-filter2", inctx, r, r->connection);
            inctx->status = QS_CONN_STATE_BODY;
          } else {
            /* header filter should block this request */
          }
        }
      }
    }
  }
  return DECLINED;
}

/**
 * QS_LimitRequestBody, if content-length header is available.
 *
 * @param r
 * @param sconf Either server or dir config is used (or env var)
 * @param dconf Either server or dir config is used (or env var)
 * @return HTTP_REQUEST_ENTITY_TOO_LARGE if not allowed
 */
static apr_status_t qos_limitrequestbody_ctl(request_rec *r, qos_srv_config *sconf,
                                             qos_dir_config *dconf) {
  apr_off_t maxpost = qos_maxpost(r, sconf, dconf);
  if(maxpost != -1) {
    const char *l = apr_table_get(r->headers_in, "Content-Length");
    if(l != NULL) {
      apr_off_t s;
#ifdef ap_http_scheme
      /* Apache 2.2 */
      char *errp = NULL;
      if((APR_SUCCESS != apr_strtoff(&s, l, &errp, 10)) || (s < 0))
#else
      if(((s = apr_atoi64(l)) < 0) || (s < 0))
#endif
        {
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                      QOS_LOG_PFX(044)"access denied%s, QS_LimitRequestBody:"
                      " invalid content-length header, c=%s, id=%s",
                      sconf->log_only ? " (log only)" : "",
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "044"));
        QS_INC_EVENT(sconf, 44);
        return HTTP_REQUEST_ENTITY_TOO_LARGE;
      }
      if(s > maxpost) {
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                      QOS_LOG_PFX(044)"access denied%s, QS_LimitRequestBody:"
                      " max=%"APR_OFF_T_FMT" this=%"APR_OFF_T_FMT", c=%s, id=%s",
                      sconf->log_only ? " (log only)" : "",
                      maxpost, s,
                      QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                      qos_unique_id(r, "044"));
        QS_INC_EVENT(sconf, 44);
        return HTTP_REQUEST_ENTITY_TOO_LARGE;
      }
    } else {
      int read_chunked = 0;
      if(r->read_chunked) {
        read_chunked = 1;
      } else {
        // Apache 2.4
        const char *tenc = apr_table_get(r->headers_in, "Transfer-Encoding");
        if(tenc && strcasecmp(tenc, "chunked") == 0) {
          read_chunked = 1;
        }
      }
      if(ap_is_initial_req(r) && read_chunked) {
        ap_add_input_filter("qos-in-filter3", NULL, r, r->connection);
      }
    }
  }
  return APR_SUCCESS;
}

/**
 * Header parser (executed after mod_setenvif but before mod_parp).
 * Implements content-length based request body size limit and activates
 * content-length adijustmen for compressed request body.
 *
 * @param r
 * @return
 */
static int qos_header_parser1(request_rec * r) {
  if(ap_is_initial_req(r)) {
    apr_status_t rv;
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                  &qos_module);
    qos_dir_config *dconf = (qos_dir_config*)ap_get_module_config(r->per_dir_config,
                                                                  &qos_module);

    if(sconf->log_env == 1) {
      qos_log_env(r, ">HP_2");
    }

    qos_deflate(r);
   
    /** QS_LimitRequestBody */
    rv = qos_limitrequestbody_ctl(r, sconf, dconf);
    if(rv != APR_SUCCESS) {
      int rc;
      const char *error_page = sconf->error_page;
      qs_set_evmsg(r, "D;"); 
      if(!sconf->log_only) {
        rc = qos_error_response(r, error_page);
        if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
          return rc;
        }
        return rv;
      }
    }
  }
  return DECLINED;
}

/**
 * Header parser (executed before mod_setenvif or mod_parp).
 * Enables mod_parp if request body processing (filter) has been enabled
 * and implements the request header filter.
 *
 * @param r
 * @return
 */
static int qos_header_parser0(request_rec * r) {
  if(ap_is_initial_req(r)) {
    int rc = DECLINED;
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                  &qos_module);
    qos_dir_config *dconf = (qos_dir_config*)ap_get_module_config(r->per_dir_config,
                                                                  &qos_module);

    if(sconf->log_env == 1) {
      qos_log_env(r, ">HP_1");
    }

    /*
     * QS_DenyBody requires mod_parp
     */
    if(dconf && (dconf->bodyfilter_p == 1 || dconf->bodyfilter_d == 1)) {
      qos_enable_parp(r);
    }
    
    /*
     * QS_RequestHeaderFilter enforcement
     */
    rc = qos_hp_header_filter(r, sconf, dconf);
    if(rc != DECLINED) {
      return rc;
    }

  }
  return DECLINED;
}

/**
 * Header parser implements restrictions on a per location (url) basis.
 *
 * @param r
 * @return
 */
static int qos_header_parser(request_rec * r) {
  /* apply rules only to main request (avoid filtering of error documents) */
  if(ap_is_initial_req(r)) {
    char *msg = NULL;
    char *uid = NULL;
    int req_per_sec_block = 0;
    apr_off_t kbytes_per_sec_limit = 0;
    qs_acentry_t *event_kbytes_per_sec = NULL;
    int status;
    const char *tmostr = NULL;
    qs_acentry_t *actEntry = NULL;
    qs_acentry_t *actEntryCond = NULL;
    qs_acentry_t *actEntryMain = NULL; // either e or e_cond (used for locking)
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                  &qos_module);
    qos_dir_config *dconf = (qos_dir_config*)ap_get_module_config(r->per_dir_config,
                                                                  &qos_module);
    qs_req_ctx *rctx = NULL;
    const char *error_page = sconf->error_page;

    if(sconf->log_env == 1) {
      qos_log_env(r, ">HP_3");
    }

    qos_deflate_contentlength(r);

    /* QS_SetEnvIfResBody */
    if(dconf && dconf->response_pattern) {
      ap_add_output_filter("qos-out-filter-body", NULL, r, r->connection);
    }

    /* enable broken connection detection (connection abort by client) */
    if(apr_table_get(sconf->setenvstatus_t, QS_BROKEN_CON)) {
      ap_add_output_filter("qos-out-filter-brokencon", NULL, r, r->connection);
    }

    /* 
     * QS_Permit* / QS_Deny* enforcement (but not QS_DenyEvent)
     */
    status = qos_hp_filter(r, sconf, dconf);
    /* prepare audit log */
    if(m_enable_audit && dconf) {
      qos_audit(r, dconf);
    }
    if(status != DECLINED) {
      return status;
    }

    /* 
     * Dynamic keep alive
     */
    if(!sconf->log_only) {
      qos_keepalive(r, sconf);
    }

    /*
     * VIP control
     */
    if(sconf->header_name || sconf->vip_user) {
      rctx = qos_rctx_config_get(r);
      rctx->is_vip = qos_is_vip(r, sconf);
      if(rctx->is_vip) {
        qs_conn_ctx *cconf = qos_get_cconf(r->connection);
        if(cconf) {
          cconf->is_vip = 1;
        }
      }
    }

    /*
     * additional variables
     */
    if(apr_table_elts(sconf->setenvifparp_t)->nelts > 0) {
      qos_parp_hp(r, sconf);
    }
    if((apr_table_elts(sconf->setenvifparpbody_t)->nelts > 0) && qos_parp_body_data_fn) {
      qos_parp_hp_body(r, sconf);
    }
    if(r->parsed_uri.query) {
      qos_setenvifquery(r, sconf, dconf);
    }
    if(sconf->setenvif_t->nelts > 0) {
      qos_setenvif(r, sconf->setenvif_t);
    }
    if(dconf->setenvif_t->nelts > 0) {
      qos_setenvif(r, dconf->setenvif_t);
    }
    if(apr_table_elts(sconf->setenv_t)->nelts > 0) {
      qos_setenv(r, sconf);
    }
    if(apr_table_elts(sconf->setreqheader_t)->nelts > 0) {
      qos_setreqheader(r, sconf->setreqheader_t);
    }
    tmostr = apr_table_get(r->subprocess_env, QS_TIMEOUT);
    if(tmostr) {
      apr_interval_time_t timeout = apr_time_from_sec(atoi(tmostr));
      if(timeout > 0) {
        qs_conn_base_ctx *bctx = qos_get_conn_base_ctx(r->connection);
        if(bctx && bctx->clientSocket) {
          if(QS_ISDEBUG(r->server)) {
            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                          QOS_LOGD_PFX"set connection timeout to %s seconds, id=%s",
                          tmostr, qos_unique_id(r, NULL));
          }
          apr_socket_timeout_set(bctx->clientSocket, timeout);
        }
      }
    }

    /*
     * QS_DenyEvent
     */
    if(apr_table_elts(dconf->rfilter_table)->nelts > 0) {
      status = qos_hp_event_deny_filter(r, sconf, dconf);
      if(status != DECLINED) {
        return status;
      }
    }

    /*
     * QS_EventLimitCount
     */
    if(sconf->event_limit_a->nelts > 0) {
      status = qos_hp_event_limit(r, sconf);
      if(status != DECLINED) {
        return status;
      }
    }

    /*
     * QS_EventRequestLimit
     */
    if(sconf->has_event_filter) {
      status = qos_hp_event_filter(r, sconf);
      if(status != DECLINED) {
        return status;
      }
    }

    /*
     * QS_EventPerSecLimit/QS_EventKBytesPerSecLimit
     */
    if(sconf->has_event_limit) {
      event_kbytes_per_sec = qos_hp_event_count(r, &req_per_sec_block, &kbytes_per_sec_limit);
    }

    /*
     * QS_SetEnvIfCmp
     */
    qos_setenvifcmp(r, dconf->setenvcmp);

    /*
     * QS_ClientEventRequestLimit
     */
    if(sconf->qos_cc_event_req >= 0) {
      status = qos_hp_cc_event_count(r, sconf, rctx);
      if(status != DECLINED) {
        return status;
      }
    }

    /*
     * QS_ClientSerialize
     */
    if(sconf->qos_cc_serialize && apr_table_get(r->subprocess_env, QS_SERIALIZE)) {
      qos_hp_cc_serialize(r, sconf, rctx);
    }

    /*
     * QS_SrvSerialize
     */
    if((sconf->serialize == 1) && apr_table_get(r->subprocess_env, QS_SRVSERIALIZE)) {
      qos_hp_srv_serialize(r, sconf, rctx);
    }

    /*
     * client control
     */
    if(qos_hp_cc(r, sconf, &msg, &uid) != DECLINED) {
      int rc;
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                    "%s, id=%s", msg == NULL ? "-" : msg,
                    qos_unique_id(r, uid));
      qs_set_evmsg(r, "D;"); 
      if(!sconf->log_only) {
        rc = qos_error_response(r, error_page);
        if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
          return rc;
        }
        return m_retcode;
      }
    }

    /* 
     * Request level control
     * get rule with conditional enforcement
     */
    actEntryCond = qos_getcondrule_byregex(r, sconf);
    /* 1st prio has "Match" rule */
    actEntry = qos_getrule_byregex(r, sconf);
    /* 2th prio has "URL" rule */
    if(!actEntry) actEntry = qos_getrule_bylocation(r, sconf);
    if(actEntry) {
      actEntryMain = actEntry;
    } else if(actEntryCond) {
      actEntryMain = actEntryCond;
    }

    if(!rctx) {
      rctx = qos_rctx_config_get(r);
    }
    // optimistic locking (write only)
    if(actEntryMain) {
      rctx->entry_cond = actEntryCond;
      rctx->entry = actEntry;
      
      apr_global_mutex_lock(actEntryMain->lock);   /* @CRT5 */

      if(actEntryCond) {
        actEntryCond->counter++;
      }

      if(actEntry) {
        actEntry->counter++;
        if(actEntry->req_per_sec_block_rate > req_per_sec_block) {
          /* update req_per_sec_block if event restriction has returned worse block rate */
          req_per_sec_block = actEntry->req_per_sec_block_rate;
        }
      }

      apr_global_mutex_unlock(actEntryMain->lock); /* @CRT5 */

    }

    if(actEntry) {
      /*
       * QS_LocRequestLimitMatch/QS_LocRequestLimit/QS_LocRequestLimitDefault enforcement
       */
      if(actEntry->limit && (actEntry->counter > actEntry->limit)) {
        /* vip session has no limitation */
        if(rctx->is_vip) {
          qs_set_evmsg(r, "S;"); 
        } else {
          /* std user */
          int rc;
          ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                        QOS_LOG_PFX(010)"access denied%s, QS_LocRequestLimit* rule: %s(%d),"
                        " concurrent requests=%d,"
                        " c=%s, id=%s",
                        sconf->log_only ? " (log only)" : "",
                        actEntry->url, actEntry->limit, actEntry->counter,
                        QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                        qos_unique_id(r, "010"));
          QS_INC_EVENT(sconf, 10);
          qs_set_evmsg(r, "D;"); 
          // request has already been blocked, don't cont this request for req/sec violations!
          apr_table_set(r->notes, QS_R010_ALREADY_BLOCKED, "");
          if(!sconf->log_only) {
            rc = qos_error_response(r, error_page);
            if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
              return rc;
            }
            return m_retcode;
          }
        }
      }
      /*
       * QS_LocRequestPerSecLimit/QS_EventPerSecLimit enforcement
       */
      if(req_per_sec_block) {
        if(rctx->is_vip) {
          qs_set_evmsg(r, "S;"); 
        } else {
          qs_set_evmsg(r, "L;"); 
          if(!sconf->log_only) {
            apr_sleep(req_per_sec_block*1000);
          }
          /* don't wait more than once */
          req_per_sec_block = 0;
        }
      }
    
      /*
       * QS_LocKBytesPerSecLimit selection
       */
      if(actEntry->kbytes_per_sec_limit) {
        if(kbytes_per_sec_limit) {
          if(actEntry->kbytes_per_sec_limit < kbytes_per_sec_limit) {
            // this is lower than the event limitation
            kbytes_per_sec_limit = actEntry->kbytes_per_sec_limit;
            event_kbytes_per_sec = actEntry;
          }
        } else {
          kbytes_per_sec_limit = actEntry->kbytes_per_sec_limit;
          event_kbytes_per_sec = actEntry;
        }
      }
    }
    
    /*
     * QS_EventKBytesPerSecLimit or QS_LocKBytesPerSecLimit enforcement
     */
    if(kbytes_per_sec_limit) {
      if(rctx->is_vip) {
        qs_set_evmsg(r, "S;"); 
      } else {
        qos_delay_ctx_t *dctx = apr_pcalloc(r->pool, sizeof(qos_delay_ctx_t));
        dctx->rctx = rctx;
        dctx->entry = event_kbytes_per_sec;
        if(!sconf->log_only) {
          ap_add_output_filter("qos-out-filter-delay", dctx, r, r->connection);
        }
      }
    }
    
    if(actEntryCond) {
      /*
       * QS_CondLocRequestLimitMatch
       */
      if(actEntryCond->limit && (actEntryCond->counter > actEntryCond->limit)) {
        /* check condition */
        const char *condition = apr_table_get(r->subprocess_env, QS_COND);
        if(condition) {
          if(ap_regexec(actEntryCond->condition, condition, 0, NULL, 0) == 0) {
            /* vip session has no limitation */
            if(rctx->is_vip) {
              qs_set_evmsg(r, "S;"); 
            } else {
              /* std user */
              int rc;
              ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                            QOS_LOG_PFX(011)"access denied, QS_CondLocRequestLimitMatch"
                            " rule: %s(%d),"
                            " concurrent requests=%d,"
                            " c=%s, id=%s",
                            actEntryCond->url, actEntryCond->limit, actEntryCond->counter,
                            QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                            qos_unique_id(r, "011"));
              QS_INC_EVENT(sconf, 11);
              qs_set_evmsg(r, "D;"); 
              if(!sconf->log_only) {
                rc = qos_error_response(r, error_page);
                if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
                  return rc;
                }
                return m_retcode;
              }
            }
          }
        }
      }
    }
  
    /*
     * QS_EventPerSecLimit
     */
    if(req_per_sec_block) {
      qs_set_evmsg(r, "L;"); 
      if(!sconf->log_only) {
        apr_sleep(req_per_sec_block*1000);
      }
    }

    /*
     * QS_Delay
     */
    qos_delay(r, sconf);

  }
  return DECLINED;
}

/**
 * QS_LimitRequestBody
 * Input filter limiting request body size for chunked encoded requests.
 *
 * @param f
 * @param bb
 * @param mode
 * @param block
 * @param nbytes
 * @return
 */
static apr_status_t qos_in_filter3(ap_filter_t *f, apr_bucket_brigade *bb,
                                  ap_input_mode_t mode, apr_read_type_e block,
                                  apr_off_t nbytes) {
  apr_status_t rv = ap_get_brigade(f->next, bb, mode, block, nbytes);
  request_rec *r = f->r;
  
  qos_srv_config *sconf = ap_get_module_config(r->server->module_config, &qos_module);
  qos_dir_config *dconf = ap_get_module_config(r->per_dir_config, &qos_module);
  apr_off_t maxpost = qos_maxpost(r, sconf, dconf);
  
  if(rv != APR_SUCCESS) {
    return rv;
  }
  
  if(maxpost != -1) {
    apr_size_t bytes = 0;
    apr_bucket *b;
    qs_req_ctx *rctx = qos_rctx_config_get(r);
    for(b = APR_BRIGADE_FIRST(bb); b != APR_BRIGADE_SENTINEL(bb); b = APR_BUCKET_NEXT(b)) {
      bytes = bytes + b->length;
    }
    rctx->maxpostcount += bytes;
    if(rctx->maxpostcount > maxpost) {
      int rc;
      const char *error_page = sconf->error_page;
      qs_req_ctx *rctx = qos_rctx_config_get(r);
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                    QOS_LOG_PFX(044)"access denied%s, QS_LimitRequestBody:"
                    " max=%"APR_OFF_T_FMT" this=%"APR_OFF_T_FMT", c=%s, id=%s",
                    sconf->log_only ? " (log only)" : "",
                    maxpost, rctx->maxpostcount,
                    QS_CONN_REMOTEIP(r->connection) == NULL ? "-" : QS_CONN_REMOTEIP(r->connection),
                    qos_unique_id(r, "044"));
      QS_INC_EVENT(sconf, 44);
      qs_set_evmsg(r, "D;"); 
      if(!sconf->log_only) {
        rc = qos_error_response(r, error_page);
        if((rc == DONE) || (rc == HTTP_MOVED_TEMPORARILY)) {
          return rc;
        }
        return HTTP_REQUEST_ENTITY_TOO_LARGE;
      }
    }
  }
  return APR_SUCCESS;
}

/**
 * Input filter removes connection from sconf->inctx_t->table
 * when reading EOS.
 *
 * @param f
 * @param bb
 * @param mode
 * @param block
 * @param nbytes
 * @return
 */
static apr_status_t qos_in_filter2(ap_filter_t *f, apr_bucket_brigade *bb,
                                  ap_input_mode_t mode, apr_read_type_e block,
                                  apr_off_t nbytes) {
  qos_ifctx_t *inctx = f->ctx;
  apr_status_t rv = ap_get_brigade(f->next, bb, mode, block, nbytes);
  if((rv == APR_SUCCESS) && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(bb))) {
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(inctx->c->base_server->module_config,
                                                                  &qos_module);
    ap_remove_input_filter(f);
#if APR_HAS_THREADS
    if(!sconf->inctx_t->exit) {
      apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT28 */
      apr_table_unset(sconf->inctx_t->table,
                      QS_INCTX_ID);
      apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT28 */
    }
#endif
  }
  return rv;
}

/**
 * Input filter, used to log timeout event, mark slow clients,
 * and to calculate packet rate.
 *
 * Adds/removes the connection from the sconf->inctx_t->table
 * dapending of the request state (read head/body, keepalive, ...).
 *
 * @param f
 * @param bb
 * @param mode
 * @param block
 * @param nbytes
 * @return
 */
static apr_status_t qos_in_filter(ap_filter_t *f, apr_bucket_brigade *bb,
                                  ap_input_mode_t mode, apr_read_type_e block,
                                  apr_off_t nbytes) {
  apr_status_t rv;
  qos_ifctx_t *inctx = f->ctx;
  apr_size_t bytes = 0;
  int crs = inctx->status;
  rv = ap_get_brigade(f->next, bb, mode, block, nbytes);
  if(rv == APR_SUCCESS) {
    if(inctx->lowrate != -1) {
      bytes = qos_packet_rate(inctx, bb);
    }
  }
  if(inctx->status == QS_CONN_STATE_KEEP) {
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(inctx->c->base_server->module_config,
                                                                  &qos_module);
    inctx->time = time(NULL);
    inctx->nbytes = 0;
    inctx->status = QS_CONN_STATE_HEAD;
#if APR_HAS_THREADS
    if(sconf->inctx_t && !sconf->inctx_t->exit && sconf->min_rate_off == 0) {
      apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT23 */
      apr_table_setn(sconf->inctx_t->table,
                     QS_INCTX_ID,
                     (char *)inctx);
      apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT23 */
    }
#endif
  }
  if(rv != APR_SUCCESS) {
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(inctx->c->base_server->module_config,
                                                                  &qos_module);
    inctx->status = QS_CONN_STATE_END;
    inctx->time = 0;
    inctx->nbytes = 0;
#if APR_HAS_THREADS
    if(sconf->inctx_t && !sconf->inctx_t->exit) {
      apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT24 */
      apr_table_unset(sconf->inctx_t->table,
                      QS_INCTX_ID);
      apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT24 */
    }
#endif
  }
  if(inctx->status > QS_CONN_STATE_NEW) {
    if(rv == APR_SUCCESS) {
      if(bytes == 0) {
        apr_bucket *b;
        for(b = APR_BRIGADE_FIRST(bb); b != APR_BRIGADE_SENTINEL(bb); b = APR_BUCKET_NEXT(b)) {
          bytes = bytes + b->length;
        }
      }
      inctx->nbytes = inctx->nbytes + bytes;
      inctx->hasBytes = inctx->nbytes;
      if(inctx->status == QS_CONN_STATE_BODY) {
        if(inctx->cl_val >= bytes) {
          inctx->cl_val = inctx->cl_val - bytes;
        }
        if(inctx->cl_val == 0) {
          qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(inctx->c->base_server->module_config,
                                                                        &qos_module);
#if APR_HAS_THREADS
          if(!sconf->inctx_t->exit) {
            apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT27 */
            apr_table_unset(sconf->inctx_t->table,
                            QS_INCTX_ID);
            apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT27 */
          }
#endif
        }
      }
    }
    if((rv == APR_TIMEUP) &&
       (crs != QS_CONN_STATE_END) && 
       (crs != QS_CONN_STATE_KEEP)) {
      qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(inctx->c->base_server->module_config,
                                                                    &qos_module);
      /* mark clients causing a timeout */
      if(sconf && sconf->has_qos_cc) {
        qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
        qos_s_entry_t **clientEntry = NULL;
        qos_s_entry_t searchE;
        request_rec *r = f->r;
        apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT18 */
        qos_ip_str2long(QS_CONN_REMOTEIP(inctx->c), searchE.ip6);
        clientEntry = qos_cc_getOrSet(u->qos_cc, &searchE, 0);
        (*clientEntry)->lowrate = time(NULL);
        (*clientEntry)->lowratestatus |= QOS_LOW_FLAG_TIMEOUT;
        if(r) {
          qs_set_evmsg(r, "r;"); 
        }
        apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT18 */
      }
      inctx->lowrate = QS_PKT_RATE_TH + 1;
    }
  }
  return rv;
}

/**
 * BrokenConnection
 */
static apr_status_t qos_out_filter_brokencon(ap_filter_t *f, apr_bucket_brigade *bb) {
  apr_status_t rc = ap_pass_brigade(f->next, bb);
  if(rc == APR_ECONNABORTED || rc == APR_EPIPE) {
    // client closed the connection (abort or broken pipe)
    request_rec *r = f->r;
    qs_set_evmsg(r, "A;");
    apr_table_set(r->connection->notes, QS_BROKEN_CON, "");
  }
  return rc;
}

/**
 * QS_SetEnvIfResBody
 *
 * Searches the response body for the pattern defined by the QS_SetEnvIfResBody
 * directive (supports only one search pattern (literal string)).
 *
 * @param f
 * @param bb
 * @return
 */
static apr_status_t qos_out_filter_body(ap_filter_t *f, apr_bucket_brigade *bb) {
  request_rec *r = f->r;
  qos_dir_config *dconf = ap_get_module_config(r->per_dir_config, &qos_module);
  qs_req_ctx *rctx;
  int len;
  apr_bucket *b;

  if((dconf == NULL) || (dconf->response_pattern == NULL)) {
    // not used
    ap_remove_output_filter(f);
    return ap_pass_brigade(f->next, bb);
  }

  rctx = qos_rctx_config_get(r);
  len = dconf->response_pattern_len;
  
  if((apr_table_get(r->subprocess_env, "QS_SetEnvIfResBodyIgnore") != NULL) && 
     rctx->body_window == NULL) {
    // skip this response (disabled and nothing processed yet)
    ap_remove_output_filter(f);
    return ap_pass_brigade(f->next, bb);
  }

  for(b = APR_BRIGADE_FIRST(bb); b != APR_BRIGADE_SENTINEL(bb); b = APR_BUCKET_NEXT(b)) {
    if(APR_BUCKET_IS_EOS(b)) {
      /* If we ever see an EOS, make sure to FLUSH. */
      apr_bucket *flush = apr_bucket_flush_create(f->c->bucket_alloc);
      APR_BUCKET_INSERT_BEFORE(b, flush);
    }
    if(!(APR_BUCKET_IS_METADATA(b))) {
      const char *buf;
      apr_size_t nbytes;
      if(apr_bucket_read(b, &buf, &nbytes, APR_BLOCK_READ) == APR_SUCCESS) {
        if(nbytes > 0) {
          int blen = nbytes > len ? len : nbytes - 1;
          /* 1. overlap: this buffer avoids that we miss a string if it is cut apart
             within two buckets 
             e.g., [Logi][n Page] instead of [Login Page] when searching for "Login Page" */
          if(rctx->body_window == NULL) {
            // first call, create a window buffer
            rctx->body_window = apr_pcalloc(r->pool, (len*2)+1);
            rctx->body_window[0] = '\0';
          } else {
            // subsequent call, searches within the window too
            int wlen = strlen(rctx->body_window);
            strncpy(&rctx->body_window[wlen], buf, blen);
            rctx->body_window[wlen+blen+1] = '\0';
            if(strstr(rctx->body_window, dconf->response_pattern)) {
              /* found pattern */
              if(dconf->response_pattern_var[0] == '!') {
                apr_table_unset(r->subprocess_env, &dconf->response_pattern_var[1]);
              } else {
                apr_table_set(r->subprocess_env, dconf->response_pattern_var, dconf->response_pattern);
              }
              ap_remove_output_filter(f);
            }
          }
          /* 2. new buffer (don't want to copy the data) */
          if(qos_strnstr(buf, dconf->response_pattern, nbytes)) {
            /* found pattern */
            if(dconf->response_pattern_var[0] == '!') {
              apr_table_unset(r->subprocess_env, &dconf->response_pattern_var[1]);
            } else {
              apr_table_set(r->subprocess_env, dconf->response_pattern_var, dconf->response_pattern);
            }
            ap_remove_output_filter(f);
          }
          /* 3. store the end (for next loop) */
          strncpy(rctx->body_window, &buf[nbytes - blen], blen);
          rctx->body_window[blen] = '\0';
        }
      }
    }
  }
  return ap_pass_brigade(f->next, bb);
}

/**
 * Helper used by qos_out_filter_delay() to calculate/update
 * the delay rate. Shall be called for every bucket we are 
 * sending to the client.
 * @param request_time Time this request has started
 * @param entry Rule entry to update / measure
 * @param length Bytes we are going to transfer
 * @return Wait time in microsseconds
 */
static apr_off_t qos_calc_kbytes_per_sec_wait_time(apr_time_t request_time,
                                                   qs_acentry_t *entry,
                                                   apr_off_t length) {
  apr_off_t kbps_wait_time;
  apr_global_mutex_lock(entry->lock);    /* @CRT43 */
  kbps_wait_time = entry->kbytes_per_sec_block_rate;
  if(((entry->bytes / 1024) > entry->kbytes_per_sec_limit) ||
     (request_time > (entry->kbytes_interval_us + APR_USEC_PER_SEC))) {
    /* transferred more than the limit/sec OR
       it's long time ago since we last updated the rate
       => check within which time we did */
    apr_time_t now = apr_time_now();
    apr_time_t duration = now - entry->kbytes_interval_us;
    apr_off_t kbs;
    if(duration == 0) {
      duration = 1;
    }
    kbs = entry->bytes * 1000 / duration;
    entry->kbytes_per_sec = (entry->kbytes_per_sec + kbs) / 2;
    if(duration > APR_USEC_PER_SEC) {
      // lower than the defined kbytes/sec rate
      if(kbps_wait_time > 0) {
        // reduce wait time
        apr_off_t newtime = kbps_wait_time * kbs / entry->kbytes_per_sec_limit;
        // PI like closed-loop control
        kbps_wait_time = (kbps_wait_time + newtime) / 2;
      }
    } else {
      // higher than the defined kbytes/sec rate
      if(kbps_wait_time == 0) {
        kbps_wait_time = 1000; // start with 1 ms
      } else {
        // increase wait time
        apr_off_t newtime = kbps_wait_time * kbs / entry->kbytes_per_sec_limit;
        // PI like closed-loop control
        kbps_wait_time = (kbps_wait_time + newtime) / 2;
      }
    }
    if(kbps_wait_time > QS_MAX_DELAY) {
      kbps_wait_time = QS_MAX_DELAY;
    }
    entry->kbytes_interval_us = now;
    entry->bytes = 0;
  }
  entry->bytes = entry->bytes + length;
  entry->kbytes_per_sec_block_rate = kbps_wait_time;
  apr_global_mutex_unlock(entry->lock); /* @CRT43 */
  return kbps_wait_time;
}

/**
 * Output filter adds response delay.
 *
 * @param f
 * @param bb
 * @return
 */
static apr_status_t qos_out_filter_delay(ap_filter_t *f, apr_bucket_brigade *bb) {
  qos_delay_ctx_t *dctx = f->ctx;
  qs_acentry_t *entry = dctx->entry;
  request_rec *r = f->r;
  if(entry) {
    apr_off_t length;
    if(apr_brigade_length(bb, 1, &length) == APR_SUCCESS) {
      if(length > 0) {
        if(length > APR_BUCKET_BUFF_SIZE) {
          // split (no proxy)
          while(!APR_BRIGADE_EMPTY(bb)) {
            apr_bucket *b, *first, *next;
            apr_bucket_brigade *tmp_bb;
            apr_status_t rv;
            apr_off_t kbps_wait_time;
            rv = apr_brigade_partition(bb, APR_BUCKET_BUFF_SIZE, &next);
            if(rv != APR_SUCCESS && rv != APR_INCOMPLETE) {
              return rv;
            }
            if(rv == APR_INCOMPLETE) { /* no split needed */
              break;
            }
            first = APR_BRIGADE_FIRST(bb);
            APR_BUCKET_REMOVE(first);
            kbps_wait_time = qos_calc_kbytes_per_sec_wait_time(r->request_time, 
                                                               entry, first->length);
            if(kbps_wait_time > 0) {
              dctx->rctx->response_delayed = (1 + dctx->rctx->response_delayed + kbps_wait_time) / 2;
              apr_sleep(kbps_wait_time);
            }
            tmp_bb = apr_brigade_create(f->r->pool, f->c->bucket_alloc);
            APR_BRIGADE_INSERT_TAIL(tmp_bb, first);
            b = apr_bucket_flush_create(f->c->bucket_alloc);
            APR_BRIGADE_INSERT_TAIL(tmp_bb, b);
            rv = ap_pass_brigade(f->next, tmp_bb);
            if(rv != APR_SUCCESS) {
              return rv;
            }
          }
        } else {
          // sleep once every 8k
          apr_off_t kbps_wait_time = qos_calc_kbytes_per_sec_wait_time(r->request_time,
                                                                       entry, length);
          if(length < APR_BUCKET_BUFF_SIZE) {
            // be fair with very small responses
            kbps_wait_time = kbps_wait_time * length / APR_BUCKET_BUFF_SIZE;
          }
          if(kbps_wait_time > 0) {
            dctx->rctx->response_delayed = (1 + dctx->rctx->response_delayed + kbps_wait_time) / 2;
            apr_sleep(kbps_wait_time);
          }
        }
      }
    }
  }
  return ap_pass_brigade(f->next, bb); 
}

/**
 * Out filter measuring the minimal download bandwidth.
 *
 * @param f
 * @param bb
 * @return
 */
static apr_status_t qos_out_filter_min(ap_filter_t *f, apr_bucket_brigade *bb) {
  request_rec *r = f->r;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config, &qos_module);
  qos_ifctx_t *inctx = qos_get_ifctx(r->connection->input_filters);
  if(APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(bb))) {
#if APR_HAS_THREADS
    if(!sconf->inctx_t->exit) {
      apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT30 */
      apr_table_unset(sconf->inctx_t->table,
                      QS_INCTX_ID);
      apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT30 */
    }
#endif
    inctx->status = QS_CONN_STATE_END;
    ap_remove_output_filter(f);
  } else {
    apr_size_t total = 0;
    apr_bucket *b;
    for(b = APR_BRIGADE_FIRST(bb); b != APR_BRIGADE_SENTINEL(bb); b = APR_BUCKET_NEXT(b)) {
      total = total + b->length;
    }
    inctx->nbytes = inctx->nbytes + total;
  }
  return ap_pass_brigade(f->next, bb); 
}

/**
 * Merges two  rule tables. Entries whose key/name begin with a "+" are added
 * while those with a "-" prefix are removed.
 *
 * @param p Pool to allocate new table from.
 * @param b_rfilter_table Base rule table (parent)
 * @param o_rfilter_table Over rule table (child)
 * @return Merged table
 */
apr_table_t *qos_table_merge_create(apr_pool_t *p, apr_table_t *b_rfilter_table,
                                    apr_table_t *o_rfilter_table) {
  int i;
  apr_table_t *rfilter_table = apr_table_make(p, apr_table_elts(b_rfilter_table)->nelts +
                                              apr_table_elts(o_rfilter_table)->nelts);
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(b_rfilter_table)->elts;
  // add additional (+) entries from the base/parent table
  for(i = 0; i < apr_table_elts(b_rfilter_table)->nelts; ++i) {
    if(entry[i].key[0] == '+') {
      apr_table_setn(rfilter_table, entry[i].key, entry[i].val);
    }
  }
  // add additional (+) entries from the over/child table
  entry = (apr_table_entry_t *)apr_table_elts(o_rfilter_table)->elts;
  for(i = 0; i < apr_table_elts(o_rfilter_table)->nelts; ++i) {
    if(entry[i].key[0] == '+') {
      apr_table_setn(rfilter_table, entry[i].key, entry[i].val);
    }
  }
  // remove the "-" entries
  for(i = 0; i < apr_table_elts(o_rfilter_table)->nelts; ++i) {
    if(entry[i].key[0] == '-') {
      char *id = apr_psprintf(p, "+%s", &entry[i].key[1]);
      apr_table_unset(rfilter_table, id);
    }
  }
  return rfilter_table;
}

/* QS_SrvMinDataRateOffEvent */
#if APR_HAS_THREADS
static void qos_disable_rate(request_rec *r, qos_srv_config *sconf,
                             qos_dir_config *dconf) {
  if(dconf && sconf && (sconf->req_rate != -1) && (sconf->min_rate != -1)) {
    apr_table_t *disable_reqrate_events = dconf->disable_reqrate_events;
    if(apr_table_elts(sconf->disable_reqrate_events)->nelts > 0) {
      disable_reqrate_events = qos_table_merge_create(r->pool, sconf->disable_reqrate_events,
                                                      dconf->disable_reqrate_events);
    }
    if(apr_table_elts(disable_reqrate_events)->nelts > 0) {
      qos_ifctx_t *inctx = qos_get_ifctx(r->connection->input_filters);
      if(inctx) {
        apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(disable_reqrate_events)->elts;
        int i;
        for(i = 0; i < apr_table_elts(disable_reqrate_events)->nelts; i++) {
          char *v = entry[i].key;
          if(apr_table_get(r->subprocess_env, &v[1])) {
            inctx->disabled = 1;
            break;
          }
        }
      }
    }
  }
}
#endif

static void qos_start_res_rate(request_rec *r, qos_srv_config *sconf) {
  if(sconf && (sconf->req_rate != -1) && (sconf->min_rate != -1)) {
    qos_ifctx_t *inctx = qos_get_ifctx(r->connection->input_filters);
    if(inctx) {
      inctx->status = QS_CONN_STATE_RESPONSE;
      inctx->time = time(NULL);
      inctx->nbytes = 0;
#if APR_HAS_THREADS
      if(sconf->inctx_t && !sconf->inctx_t->exit && sconf->min_rate_off == 0) {
        apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT29 */
        apr_table_setn(sconf->inctx_t->table,
                       QS_INCTX_ID,
                       (char *)inctx);
        apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT29 */
      }
      ap_add_output_filter("qos-out-filter-min", NULL, r, r->connection);
#endif
    }
  }
}

/* QS_SET_DSCP */
static void qos_set_dscp(request_rec *r) {
  const char *dscpStr = apr_table_get(r->subprocess_env, QS_SET_DSCP);
  if(dscpStr) {
#ifdef __unix__
    qs_conn_base_ctx *base = qos_get_conn_base_ctx(r->connection);
    int rc = -2;
    int hasSocket = 0;
    if(base!=NULL && base->clientSocket!=NULL) {
      apr_socket_t *sock = base->clientSocket;
      int fd;
      int dscp = atoi(dscpStr);
      hasSocket = 1;
      apr_os_sock_get(&fd, sock);
      if(dscp >= 0 && dscp < 64) {
        int tos = dscp << 2;
        if(QS_ISDEBUG(r->server)) {
          int n = 0;
          const char *d = "unknown";
          while(m_dscp_desc[n].id >= 0)  {
            if(m_dscp_desc[n].id == dscp) {
              d = m_dscp_desc[n].name;
            }
            n++;
          }
          ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
                        QOS_LOGD_PFX"%s=%s, tos=0x%02x, dscp=0x%02x (%s), id=%s",
                        QS_SET_DSCP, dscpStr, tos, dscp, d, qos_unique_id(r, NULL));
        }
        rc = setsockopt(fd,
                        IPPROTO_IP, IP_TOS, 
                        &tos, sizeof(tos));
      }
    }
    if(rc != 0) {
      ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, 
                    QOS_LOG_PFX(038)"DSCP, failed to set socket options, "
                    QS_SET_DSCP"=%s, socket=%s, rc=%d, id=%s",
                    dscpStr,
                    hasSocket ? "yes" : "no",
                    rc,
                    qos_unique_id(r, "038"));
    }
#else
    ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, 
                  QOS_LOG_PFX(038)QS_SET_DSCP" is not available for this platform");
#endif
  }
}

static void qos_end_res_rate(request_rec *r, qos_srv_config *sconf) {
  if((sconf->req_rate != -1) && (sconf->min_rate != -1)) {
    qos_ifctx_t *inctx = qos_get_ifctx(r->connection->input_filters);
    if(inctx) {
      inctx->time = time(NULL);
      inctx->nbytes = 0;
      if(r->connection->keepalive == AP_CONN_CLOSE) {
        if(!sconf->inctx_t->exit) {
#if APR_HAS_THREADS
          apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT30 */
#endif
          inctx->status = QS_CONN_STATE_END;
#if APR_HAS_THREADS
          apr_table_unset(sconf->inctx_t->table,
                         QS_INCTX_ID);
          apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT30 */
#endif
        }
      } else {
        if(!sconf->inctx_t->exit) {
#if APR_HAS_THREADS
          apr_thread_mutex_lock(sconf->inctx_t->lock);     /* @CRT30 */
#endif
          if(inctx->status != QS_CONN_STATE_DESTROY) {
            inctx->status = QS_CONN_STATE_KEEP;
#if APR_HAS_THREADS
            apr_table_setn(sconf->inctx_t->table,
                           QS_INCTX_ID, (char *)inctx);
#endif
          }
#if APR_HAS_THREADS
          apr_thread_mutex_unlock(sconf->inctx_t->lock);   /* @CRT30 */
#endif
        }
      }
    }
  }
}

/**
 * process response:
 * - start min data measure
 * - setenvif header
 * - detects vip header and create session
 * - header filter
 */
static apr_status_t qos_out_filter(ap_filter_t *f, apr_bucket_brigade *bb) {
  request_rec *r = f->r;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config, &qos_module);
  qos_dir_config *dconf = ap_get_module_config(r->per_dir_config, &qos_module);
  qs_headerfilter_mode_e mode;

  qos_start_res_rate(r, sconf);
  qos_setenvstatus(r, sconf, dconf);
  qos_setenvresheader(r, sconf);
  qos_setenvres(r, sconf);
  if(sconf->user_tracking_cookie) {
    if((sconf->user_tracking_cookie_jsredirect < 1) ||
       (apr_table_get(r->subprocess_env, QOS_USER_TRACKING_RENEW) != NULL)) {
      qos_send_user_tracking_cookie(r, sconf, r->status);
    }
  }
  if(sconf->milestones) {
    qos_update_milestone(r, sconf);
  }
  if(sconf->ip_header_name) {
    const char *ctrl_h = apr_table_get(r->headers_out, sconf->ip_header_name);
    if(ctrl_h) {
      int match = 1;
      if(sconf->ip_header_name_regex) {
        if(ap_regexec(sconf->ip_header_name_regex, ctrl_h, 0, NULL, 0) != 0) {
          match = 0;
        }
      }
      if(match) {
        qs_conn_ctx *cconf = qos_get_cconf(r->connection);
        if(cconf) {
          qs_set_evmsg(r, "v;"); 
          cconf->is_vip = 1;
          cconf->set_vip_by_header = 1;
          apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
        }
      }
      if(sconf->ip_header_name_drop) {
        apr_table_unset(r->headers_out, sconf->ip_header_name);
      }
    }
  }
  if(sconf->header_name) {
    /* got a vip header: create new session (if non exists) */
    const char *ctrl_h = apr_table_get(r->headers_out, sconf->header_name);
    if(ctrl_h && !apr_table_get(r->notes, QS_REC_COOKIE)) {
      int match = 1;
      if(sconf->header_name_regex) {
        if(ap_regexec(sconf->header_name_regex, ctrl_h, 0, NULL, 0) != 0) {
          match = 0;
        }
      }
      if(match) {
        qs_conn_ctx *cconf = qos_get_cconf(r->connection);
        qos_set_session(r, sconf);
        if(cconf) {
          qs_set_evmsg(r, "v;"); 
          cconf->is_vip = 1;
          cconf->set_vip_by_header = 1;
          apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
        }
        apr_table_set(r->notes, QS_REC_COOKIE, "");
      }
      if(sconf->header_name_drop) {
        apr_table_unset(r->headers_out, sconf->header_name);
      }
    }
  }
  if(sconf->vip_user && r->user) {
    if(!apr_table_get(r->notes, QS_REC_COOKIE)) {
      qs_conn_ctx *cconf = qos_get_cconf(r->connection);
      qos_set_session(r, sconf);
      if(cconf) {
        qs_set_evmsg(r, "v;"); 
        cconf->is_vip = 1;
        cconf->set_vip_by_header = 1;
        apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
      }
      apr_table_set(r->notes, QS_REC_COOKIE, "");
    }
  }
  if(sconf->vip_ip_user && r->user) {
    qs_conn_ctx *cconf = qos_get_cconf(r->connection);
    if(cconf) {
      qs_set_evmsg(r, "v;"); 
      cconf->is_vip = 1;
      cconf->set_vip_by_header = 1;
      apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
    }
  }
  qos_unset_resheader(r, sconf);
  /* don't handle response status since response header filter use "drop" action only */
  mode = sconf->resheaderfilter;
  if(dconf->resheaderfilter > QS_HEADERFILTER_OFF_DEFAULT) {
    // override server configuration
    mode = dconf->resheaderfilter;
  }
  if(mode > QS_HEADERFILTER_OFF) {
    qos_header_filter(r, sconf, r->headers_out, "response",
                      sconf->reshfilter_table, mode);
  }
  qos_set_dscp(r);
  qos_keepalive(r, sconf);
  if(sconf->max_conn_close != -1) {
    if(sconf->act->conn->connections > sconf->max_conn_close) {
      qs_set_evmsg(r, "K;"); 
      r->connection->keepalive = AP_CONN_CLOSE;
    }
  }
  /* disable request rate for certain connections */
#if APR_HAS_THREADS
  qos_disable_rate(r, sconf, dconf);
#endif
  ap_remove_output_filter(f);
  return ap_pass_brigade(f->next, bb);
}

static apr_status_t qos_out_err_filter(ap_filter_t *f, apr_bucket_brigade *bb) {
  request_rec *r = f->r;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config, &qos_module);

  if(sconf) {
    qos_dir_config *dconf = ap_get_module_config(r->per_dir_config, &qos_module);
    qos_setenvstatus(r, sconf, dconf);
    qos_setenvresheader(r, sconf);
    qos_setenvres(r, sconf);
    if(sconf->milestones) {
      qos_update_milestone(r, sconf);
    }
  }

  ap_remove_output_filter(f);
  return ap_pass_brigade(f->next, bb);
}

/**
 * QS_SrvSerialize
 */
static void qos_logger_serialize(qos_srv_config *sconf, qs_req_ctx *rctx) {
  if(rctx->srv_serialize_set) {
    apr_global_mutex_lock(sconf->act->lock);     /* @CRT45 */
    sconf->act->serialize->locked = 0;
    apr_global_mutex_unlock(sconf->act->lock);   /* @CRT45 */
  }
}

/**
 * QS_EventRequestLimit
 * reset event counter
 */
static void qos_event_reset(qos_srv_config *sconf, qs_req_ctx *rctx) {
  int i;
  apr_table_entry_t *entry;
  apr_global_mutex_lock(sconf->act->lock);   /* @CRT32 */
  entry = (apr_table_entry_t *)apr_table_elts(rctx->event_entries)->elts;
  for(i = 0; i < apr_table_elts(rctx->event_entries)->nelts; i++) {
    qs_acentry_t *e = (qs_acentry_t *)entry[i].val;
    if(e->counter > 0) {
      e->counter--;
    }
  }
  apr_global_mutex_unlock(sconf->act->lock); /* @CRT32 */
}

static int qos_fixup(request_rec * r) {
  int rc = 0;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                &qos_module);
  qos_dir_config *dconf = (qos_dir_config*)ap_get_module_config(r->per_dir_config,
                                                                &qos_module);
  /* QS_VipUser/QS_VipIpUser */
  if(sconf && (sconf->vip_user || sconf->vip_ip_user) && r->user) {
    /* check r->user early (final status is update is implemented in output-filter) */
    qs_conn_ctx *cconf = qos_get_cconf(r->connection);
    if(cconf) {
      qs_set_evmsg(r, "v;"); 
      cconf->is_vip = 1;
      cconf->set_vip_by_header = 1;
      apr_table_set(r->subprocess_env, QS_ISVIPREQ, "yes");
    }
  }

  if(sconf->log_env == 1) {
    qos_log_env(r, ">FX_1");
  }

#if APR_HAS_THREADS
  qos_disable_rate(r, sconf, dconf);
#endif

  if(apr_table_elts(sconf->setreqheaderlate_t)->nelts > 0) {
    qos_setreqheader(r, sconf->setreqheaderlate_t);
  }

  rc = qos_redirectif(r, sconf, sconf->redirectif);
  if(rc != DECLINED) {
    return rc;
  }
  rc = qos_redirectif(r, sconf, dconf->redirectif);
  if(rc != DECLINED) {
    return rc;
  }

  return DECLINED;
}

/**
 * "free resources" and update stats
 */
static int qos_logger(request_rec *r) {
  qs_req_ctx *rctx = qos_rctx_config_get(r);
  qs_acentry_t *actEntry = rctx->entry;
  qs_acentry_t *actEntryCond = rctx->entry_cond;
  qs_acentry_t *actEntryMain = actEntry;
  qs_conn_base_ctx *base = qos_get_conn_base_ctx(r->connection);
  qs_conn_ctx *cconf = qos_get_cconf(r->connection);
  apr_time_t now = 0;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config, &qos_module);
  qos_dir_config *dconf = ap_get_module_config(r->per_dir_config, &qos_module);
  if(actEntryMain == NULL) {
    actEntryMain = actEntryCond;
  }
  if(rctx->response_delayed) {
    qs_set_evmsg(r, "L;"); 
    apr_table_set(r->subprocess_env, QS_RESDELYATIME,
                  apr_psprintf(r->pool, "%"APR_OFF_T_FMT, rctx->response_delayed));
  }
  qos_propagate_notes(r);
  qos_propagate_events(r);
  if(sconf->log_env == 1) {
    qos_log_env(r, "<LG_1");
  }
  qos_end_res_rate(r, sconf);
  if(sconf->setenvif_t->nelts > 0) {
    qos_setenvif(r, sconf->setenvif_t);
  }
  if(dconf->setenvif_t->nelts > 0) {
    qos_setenvif(r, dconf->setenvif_t);
  }
  if(sconf->has_qos_cc) {
    qos_logger_cc(r, sconf, rctx);
  }
  qos_logger_event_limit(r, sconf);
  if(base) {
    base->requests++;
  }
  if(cconf) {
    if(cconf->evmsg) {
      rctx->evmsg = apr_pstrcat(r->pool, cconf->evmsg, rctx->evmsg, NULL);
    }
  }
  if(sconf->has_event_filter) {
    qos_event_reset(sconf, rctx);
  }
  if(sconf->serialize == 1) {
    qos_logger_serialize(sconf, rctx);
  }
  if(sconf->has_event_limit) {
    qos_lg_event_update(r, &now);
  }
  if(actEntryMain) {
    char *h;
    if(!now) {
      now = apr_time_sec(r->request_time);
    }
    apr_global_mutex_lock(actEntryMain->lock);   /* @CRT6 */
    h = apr_psprintf(r->pool, "%d", actEntryMain->counter);
    if(actEntryCond) {
      if(actEntryCond->counter > 0) {
        actEntryCond->counter--;
      }
    }
    if(actEntry) {
      if(actEntry->counter > 0) {
        actEntry->counter--;
      }
      if(apr_table_get(r->notes, QS_R010_ALREADY_BLOCKED) == NULL) {
        if(actEntry->req < LONG_MAX) { 
           actEntry->req++;
        }
        if(now > (actEntry->interval + QS_BW_SAMPLING_RATE)) {
          actEntry->req_per_sec = actEntry->req / (now - actEntry->interval);
          actEntry->req = 0;
          actEntry->interval = now;
          if(actEntry->req_per_sec_limit) {
            qos_cal_req_sec(sconf, r, actEntry);
          }
        }
      }
    }
    apr_global_mutex_unlock(actEntryMain->lock); /* @CRT6 */
    /* allow logging of the current location usage */
    apr_table_set(r->subprocess_env, "mod_qos_cr", h);
    if(r->next) {
      apr_table_set(r->next->subprocess_env, "mod_qos_cr", h);
    }
    /* decrement only once */
    ap_set_module_config(r->request_config, &qos_module, NULL);
  }
  if(cconf && (cconf->sconf->max_conn != -1)) {
    char *cc = apr_psprintf(r->pool, "%d", cconf->sconf->act->conn->connections);
    apr_table_set(r->subprocess_env, "mod_qos_con", cc);
    if(r->next) {
      apr_table_set(r->next->subprocess_env, "mod_qos_con", cc);
    }
  }
  if(rctx->evmsg) {
    apr_table_set(r->subprocess_env, "mod_qos_ev", rctx->evmsg);
    if(r->next) {
      apr_table_set(r->next->subprocess_env, "mod_qos_ev", rctx->evmsg);
    }
  }
#if APR_HAS_THREADS
  qos_disable_rate(r, sconf, dconf);
#endif

  if(sconf->qslog_p) {
    // ISBiDUkEQaC equiv %h %>s %B %{Content-Length}i %D %{mod_qos_user_id}e %k %{Event}e %{mod_qos_ev}e %{QS_AllConn}e '%v:%U'
    apr_size_t nbytes;
    const char *clID = apr_table_get(r->subprocess_env, QSLOG_CLID); // client identifier (individual users)
    const char *event = apr_table_get(r->subprocess_env, QSLOG_EVENT); // generic event variable
    const char *mod_qos_ev = apr_table_get(r->subprocess_env, "mod_qos_ev"); // qos events
    const char *averageConn = apr_table_get(r->subprocess_env, QSLOG_AVERAGE); // average counter, e.g. connections
    // TODO: measure the real traffic instead of using the (optional) content-length header
    const char *contentLength = apr_table_get(r->headers_in, "Content-Length");
    char *qslogstr = apr_psprintf(r->pool, "%s %s %s %s %s %s %d %s %s %s '%s:%s'\n",
                                  QS_CONN_REMOTEIP(r->connection),                          /* %h */
                                  (r->status <= 0) ? "-" : apr_itoa(r->pool, r->status),    /* %s */
                                  (!r->sent_bodyct || !r->bytes_sent) ? "0" : apr_off_t_toa(r->pool, r->bytes_sent), /* %B */
                                  contentLength == NULL ? "-" : contentLength,              /* %{content-length} */ 
                                  apr_psprintf(r->pool, "%" APR_TIME_T_FMT, (apr_time_now() - r->request_time)), /* %D */
                                  clID == NULL ? "-" : clID,                                /* %{mod_qos_user_id}e */
                                  r->connection->keepalives ? r->connection->keepalives - 1 : 0, /* %k */
                                  event == NULL ? "-" : event,                              /* %{Event}e */
                                  mod_qos_ev == NULL ? "-" : mod_qos_ev,                    /* %{mod_qos_ev}e */
                                  averageConn == NULL ? "- " : averageConn,                 /* %{QS_AllConn}e */
                                  ap_escape_logitem(r->pool, ap_get_server_name(r)),        /* %v */
                                  ap_escape_logitem(r->pool, r->uri)                        /* %U */
                                  );
    nbytes = strlen(qslogstr);
    apr_file_write(sconf->qslog_p, qslogstr, &nbytes);
  }

  return DECLINED;
}

static void qos_audit_check(ap_directive_t * node) {
  ap_directive_t *pdir;
  for(pdir = node; pdir != NULL; pdir = pdir->next) {
    if(pdir->args && 
       strstr(pdir->args, "%{"QS_PARP_PATH"}n") &&
       strstr(pdir->args, "%{"QS_PARP_QUERY"}n")) {
      m_enable_audit = 1;
    }
    if(pdir->first_child != NULL) {
      qos_audit_check(pdir->first_child);
    }
  }
}

static int qos_module_check(const char *m) {
  module *modp = NULL;
  for(modp = ap_top_module; modp; modp = modp->next) {
    if(strcmp(modp->name, m) == 0) {
      return APR_SUCCESS;
    }
  }
  return DECLINED;
}

/**
 * inits each child
 */
static void qos_child_init(apr_pool_t *p, server_rec *bs) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(bs->module_config, &qos_module);
  qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
  qos_ifctx_list_t *inctx_t = NULL;
#ifdef QS_INTERNAL_TEST
#ifdef PREFORK_MPM
  int seed = getpid() + time(NULL);
#if APR_HAS_THREADS
  seed += apr_os_thread_current();
#endif
  srand(seed);
#endif
#endif
  qos_init_unique_id(p, bs);
#if APR_HAS_THREADS
  if(sconf->req_rate != -1) {
    inctx_t = apr_pcalloc(p, sizeof(qos_ifctx_list_t));
    inctx_t->exit = 0;
    inctx_t->table = apr_table_make(p, 64);
    sconf->inctx_t = inctx_t;
    if(apr_thread_mutex_create(&sconf->inctx_t->lock, APR_THREAD_MUTEX_DEFAULT, p) != APR_SUCCESS) {
      qos_disable_req_rate(bs, "create mutex");
    } else {
      apr_threadattr_t *tattr;
      if(apr_threadattr_create(&tattr, p) != APR_SUCCESS) {
        qos_disable_req_rate(bs, "create thread attr");
      } else {
        if(apr_thread_create(&sconf->inctx_t->thread, tattr,
                             qos_req_rate_thread, bs, p) != APR_SUCCESS) {
          qos_disable_req_rate(bs, "create thread");
        } else {
          server_rec *sn = bs->next;
          apr_pool_pre_cleanup_register(p, bs, qos_cleanup_req_rate_thread);
          while(sn) {
            qos_srv_config *sc = (qos_srv_config*)ap_get_module_config(sn->module_config, &qos_module);
            sc->inctx_t = inctx_t;
            sn = sn->next;
          }
        }
      }
    }
  }
#endif
  if(sconf->has_qos_cc) {
    apr_global_mutex_child_init(&u->qos_cc->lock, u->qos_cc->lock_file, p);
  }
  if(!sconf->act->child_init) {
    sconf->act->child_init = 1;
    /* propagate mutex to child process (required by some platforms) */
    apr_global_mutex_child_init(&sconf->act->lock, sconf->act->lock_file, p);
  }
#if APR_HAS_THREADS
  if(sconf->qsstatus) {
    qos_init_status_thread(p, sconf, sconf->max_clients);
  }
#endif
}

/*
static const char *qos_search_docroot(apr_pool_t *pconf, server_rec *bs,
                                      ap_directive_t *node) {
  ap_directive_t *pdir;
  for(pdir = node; pdir != NULL; pdir = pdir->next) {
    if(strcasecmp(pdir->directive, "DocumentRoot") == 0) {
      return pdir->args;
    }
    if(pdir->first_child != NULL) {
      const char *docroot = qos_search_docroot(pconf, bs, pdir->first_child);
      if(docroot != NULL) {
        return docroot;
      }
    }
  }
  return NULL;
}
*/

static const char *detectErrorPage(apr_pool_t *ptemp, server_rec *bs, ap_directive_t *pdir) {
  const qos_errelt_t *e = m_error_pages;
  apr_finfo_t finfo;
  /*
  const char *docroot = qos_search_docroot(ptemp, bs, pdir);
  if(docroot) {
    docroot = ap_server_root_relative(ptemp, docroot);
  }
  */
  while(e->path != NULL) {
    char *path = ap_server_root_relative(ptemp, e->path);
    if(apr_stat(&finfo, path, APR_FINFO_TYPE, ptemp) == APR_SUCCESS) {
      return e->url;
    }
    /*
    if(docroot) {
      path = apr_pstrcat(ptemp, docroot, "/", e->path, NULL);
      if(apr_stat(&finfo, path, APR_FINFO_TYPE, ptemp) == APR_SUCCESS) {
        return e->url;
      }
    }
    */
    e++;
  }
  return NULL;
}

/**
 * inits the server configuration
 */
static int qos_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *bs) {
  qos_srv_config *bsconf = (qos_srv_config*)ap_get_module_config(bs->module_config, &qos_module);
  char *rev = qos_revision(ptemp);
  qos_user_t *u;
  int maxClients;
  int cc_net_prefer_limit = 0;
  apr_status_t rv;
  ap_directive_t *pdir = ap_conftree;
  const char *error_page = detectErrorPage(ptemp, bs, pdir);
  int auto_error_page = 0;

  /* verify if this Apache version is supported/mod_qos has been tested for
     and enable/disable features */
  qos_version_check(bs);

  maxClients = qs_calc_maxClients(bs, bsconf);
  QOS_MY_GENERATION(m_generation);
  bsconf->max_clients = maxClients;
  
  if(bsconf->ip_type == QS_IP_V4) {
    m_ip_type = QS_IP_V4;
  } else {
    m_ip_type = QS_IP_V6;
  }

  qos_hostcode(ptemp, bs);

  if(bsconf->log_only) {
    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, bs, 
                 QOS_LOG_PFX(009)"running in 'log only' mode - rules are NOT enforced!");
  }
  if(bsconf->geo_limit != -1 && !bsconf->geodb) {
    ap_log_error(APLOG_MARK, APLOG_CRIT, 0, bs, 
                 QOS_LOG_PFX(100)"QS_ClientGeoCountryDB has not been configured");
  }

  if(bsconf->max_conn_close_percent) {
    bsconf->max_conn_close = maxClients * bsconf->max_conn_close_percent / 100;
  }
  cc_net_prefer_limit = maxClients * bsconf->qos_cc_prefer / 100;
  if(bsconf->qos_cc_prefer) {
    bsconf->qos_cc_prefer = maxClients;
    bsconf->qos_cc_prefer_limit = cc_net_prefer_limit;
  } else {
    bsconf->qos_cc_prefer = 0;
    bsconf->qos_cc_prefer_limit = 0;
  }
  u = qos_get_user_conf(bs->process->pool);
  if(u == NULL) return !OK;
  u->server_start++;
  /* mutex init */
  if(bsconf->act->lock_file == NULL) {
    bsconf->act->lock_file = apr_psprintf(bsconf->act->pool, "%s.mod_qos",
                                         qos_tmpnam(bsconf->act->pool, bs));
    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, bs, 
                 QOS_LOGD_PFX"create mutex (ACT)(%s)",
                 bsconf->act->lock_file);
    rv = apr_global_mutex_create(&bsconf->act->lock, bsconf->act->lock_file,
                                 APR_LOCK_DEFAULT, bsconf->act->pool);
    if (rv != APR_SUCCESS) {
      char buf[MAX_STRING_LEN];
      apr_strerror(rv, buf, sizeof(buf));
      ap_log_error(APLOG_MARK, APLOG_EMERG, 0, bs, 
                   QOS_LOG_PFX(004)"failed to create mutex (ACT)(%s): %s",
                   bsconf->act->lock_file, buf);
      exit(1);
    }
#ifdef AP_NEED_SET_MUTEX_PERMS
    qos_unixd_set_global_mutex_perms(bsconf->act->lock);
#endif
  }
  bsconf->base_server = bs;
  bsconf->act->timeout = apr_time_sec(bs->timeout);
  if(bsconf->act->timeout == 0) bsconf->act->timeout = 300;
  if(qos_init_shm(bs, bsconf, bsconf->act, bsconf->location_t, maxClients) != APR_SUCCESS) {
    return !OK;
  }
  apr_pool_pre_cleanup_register(bsconf->pool, bsconf->act, qos_cleanup_shm);

  if((qos_module_check("mod_unique_id.c") != APR_SUCCESS) &&
     (qos_module_check("mod_navajo.cpp") != APR_SUCCESS)) {
    ap_log_error(APLOG_MARK, APLOG_WARNING, 0, bs, 
                 QOS_LOG_PFX(009)"mod_unique_id not available"
                 " (mod_qos generates simple request id if required)");
  }
  qos_audit_check(ap_conftree);
  qos_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
  qos_ssl_var = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
  if(qos_is_https == NULL || qos_ssl_var == NULL) {
    ap_log_error(APLOG_MARK, APLOG_INFO, 0, bs, 
                 QOS_LOG_PFX(009)"could not retrieve mod_ssl functions");
  }
  if(m_requires_parp) {
    if(qos_module_check("mod_parp.c") != APR_SUCCESS) {
      qos_parp_hp_table_fn = NULL;
      ap_log_error(APLOG_MARK, APLOG_CRIT, 0, bs, 
                   QOS_LOG_PFX(009)"mod_parp not available"
                   " (required by some directives)");
    } else {
      qos_parp_hp_table_fn = APR_RETRIEVE_OPTIONAL_FN(parp_hp_table);
      qos_parp_body_data_fn = APR_RETRIEVE_OPTIONAL_FN(parp_body_data);
    }
  }
  if(u->server_start == 2) {
    int i;
    apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(bsconf->hfilter_table)->elts;
    for(i = 0; i < apr_table_elts(bsconf->hfilter_table)->nelts; i++) {
      qos_fhlt_r_t *he = (qos_fhlt_r_t *)entry[i].val;
      ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, bs, 
                   QOS_LOGD_PFX"request header filter rule (%s) %s: %s max=%d",
                   he->action == QS_FLT_ACTION_DROP ? "drop" : "deny", entry[i].key,
                   he->text, he->size);
    }
    entry = (apr_table_entry_t *)apr_table_elts(bsconf->reshfilter_table)->elts;
    for(i = 0; i < apr_table_elts(bsconf->reshfilter_table)->nelts; i++) {
      qos_fhlt_r_t *he = (qos_fhlt_r_t *)entry[i].val;
      ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, bs, 
                   QOS_LOGD_PFX"response header filter rule (%s) %s: %s max=%d",
                   he->action == QS_FLT_ACTION_DROP ? "drop" : "deny", entry[i].key,
                   he->text, he->size);
    }
  }
  if(bsconf->has_qos_cc) {
    if(!u->qos_cc) {
      u->qos_cc = qos_cc_new(bs->process->pool, bs, bsconf->qos_cc_size, bsconf->qos_cc_limitTable);
      if(u->qos_cc == NULL) {
        return !OK;
      }
    } else {
      int configOk = 1;
      int limitTableSize = apr_table_elts(bsconf->qos_cc_limitTable)->nelts;
      if(u->qos_cc->limitTable) {
        int i;
        apr_table_entry_t *te = (apr_table_entry_t *)apr_table_elts(bsconf->qos_cc_limitTable)->elts;
        for(i = 0; i < limitTableSize; i++) {
          const char *name = te[i].key;
          qos_s_entry_limit_conf_t *newentry = (qos_s_entry_limit_conf_t *)te[i].val;
          qos_s_entry_limit_conf_t *entryConf = (qos_s_entry_limit_conf_t *)apr_table_get(u->qos_cc->limitTable, name);
          if(entryConf) {
            entryConf->limit = newentry->limit;
            entryConf->limitTime = newentry->limitTime;
            entryConf->condStr = NULL;
            entryConf->preg = NULL;
            if(newentry->condStr) {
              entryConf->condStr = apr_pstrdup(bs->process->pool, newentry->condStr);
              entryConf->preg = ap_pregcomp(bs->process->pool, newentry->condStr, AP_REG_EXTENDED);
            }
          } else {
            // new variable
            configOk = 0;
          }
          if(apr_table_elts(u->qos_cc->limitTable)->nelts != limitTableSize) {
            // removed variable
            configOk = 0;
          }
        }
      } else {
        if(limitTableSize > 0) {
          // enabled after graceful restart
          configOk = 0;
        }
      }
      if(!configOk) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, bs, 
                     QOS_LOG_PFX(001)"QS_ClientEventLimitCount directives"
                     " can't be added/removed by graceful restart. A server"
                     " restart is required to apply the new configuration!");
      }
    }
  }
  if(bsconf->error_page == NULL && error_page != NULL) {
    bsconf->error_page = error_page;
    auto_error_page = 1;
    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, bs, 
                 QOS_LOGD_PFX"QS_ErrorPage: use %s for server %s:%d (global)",
                 error_page,
                 bs->server_hostname == NULL ? "-" : bs->server_hostname,
                 bs->addrs->host_port);
  }

  if(bsconf->qslog_str) {
    char *qslogarg = apr_psprintf(pconf, "%s -f %s", bsconf->qslog_str, QSLOGFORMAT);
    piped_log *pl = ap_open_piped_log(pconf, qslogarg);
    if(pl == NULL) {
      ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, bs, 
                   QOS_LOG_PFX(009)"failed to initialize the qslog facility '%s'", qslogarg);
    }
    bsconf->qslog_p = ap_piped_log_write_fd(pl);
  }

  {
    server_rec *s = bs->next;
    while(s) {
      qos_srv_config *ssconf = (qos_srv_config*)ap_get_module_config(s->module_config, &qos_module);

      /* mutex init */
      if(ssconf->act->lock == NULL) {
        ssconf->act->lock_file = bsconf->act->lock_file;
        ssconf->act->lock = bsconf->act->lock;
      }
      ssconf->base_server = bs;
      ssconf->act->timeout = apr_time_sec(s->timeout);
      ssconf->qos_cc_prefer = bsconf->qos_cc_prefer;
      ssconf->qos_cc_prefer_limit = bsconf->qos_cc_prefer_limit;
      ssconf->max_clients = bsconf->max_clients;
      ssconf->max_clients_conf = bsconf->max_clients_conf;
      if(ssconf->max_conn_close_percent) {
        ssconf->max_conn_close = maxClients * ssconf->max_conn_close_percent / 100;
      }
      if(ssconf->act->timeout == 0) {
        ssconf->act->timeout = 300;
      }
      ssconf->qslog_p = bsconf->qslog_p;
      if(ssconf->is_virtual) {
        if(qos_init_shm(s, ssconf, ssconf->act, ssconf->location_t, maxClients) != APR_SUCCESS) {
          return !OK;
        }
        apr_pool_pre_cleanup_register(ssconf->pool, ssconf->act,
                                      qos_cleanup_shm);
        if(ssconf->has_conn_counter == 0 && bsconf->has_conn_counter == 1) {
          // shall use global counter because vhost has not QS_SrvMaxConn* directive
          ssconf->act->conn = bsconf->act->conn;
        }
      }
      if(ssconf->error_page == NULL && error_page != NULL) {
        ssconf->error_page = error_page;
        auto_error_page |= 2;
        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, bs, 
                     QOS_LOGD_PFX"QS_ErrorPage: use %s for server %s:%d",
                     error_page,
                     s->server_hostname == NULL ? "-" : s->server_hostname,
                     s->addrs->host_port);
      }
      s = s->next;
    }
  }
  if(auto_error_page) {
    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, bs, 
                 QOS_LOG_PFX(009)"found default error document '%s'. Use the QS_ErrorPage"
                 " directive to override this default page.",
                 error_page);
  }
  ap_add_version_component(pconf, apr_psprintf(pconf, "mod_qos/%s", rev));
               
#ifdef QS_INTERNAL_TEST
  fprintf(stdout, "\033[1mmod_qos TEST BINARY, NOT FOR PRODUCTIVE USE\033[0m\n");
  fflush(stdout);
#endif
#ifndef QS_NO_STATUS_HOOK
  APR_OPTIONAL_HOOK(ap, status_hook, qos_ext_status_hook, NULL, NULL, APR_HOOK_MIDDLE);
#endif

  return DECLINED;
}

/**
 * mod_qos
 */
static int qos_favicon(request_rec *r) {
  int i;
  unsigned const char ico[] = {
    0x00,0x00,0x01,0x00,0x01,0x00,0x10,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x68,0x05,
    0x00,0x00,0x16,0x00,0x00,0x00,0x28,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x20,0x00,
    0x00,0x00,0x01,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x0f,0x29,0x21,0x00,0x11,0x29,0x21,0x00,0x9c,0x9d,0x9c,0x00,0x8d,0x8e,
    0x8d,0x00,0x65,0x65,0x65,0x00,0x73,0xaf,0x9d,0x00,0xf1,0xf3,0xf2,0x00,0x04,0x0e,
    0x0b,0x00,0x05,0x0e,0x0b,0x00,0x1b,0x3b,0x31,0x00,0x26,0x60,0x4d,0x00,0x45,0x45,
    0x45,0x00,0x9c,0xc8,0xb9,0x00,0x38,0x89,0x6e,0x00,0x35,0x7d,0x67,0x00,0x7d,0x7d,
    0x7d,0x00,0x6f,0x27,0x80,0x00,0x3d,0x28,0x3d,0x00,0x0c,0x10,0x0f,0x00,0x04,0x05,
    0x05,0x00,0x5f,0x64,0x62,0x00,0x20,0x50,0x42,0x00,0x85,0xca,0xb6,0x00,0x61,0x22,
    0x98,0x00,0x76,0xb4,0xa2,0x00,0x69,0x6a,0x6a,0x00,0x02,0x03,0x03,0x00,0xaa,0xda,
    0xca,0x00,0x25,0x5c,0x4a,0x00,0xfc,0xfc,0xfc,0x00,0x87,0xae,0xa2,0x00,0xaa,0xcc,
    0xc0,0x00,0x01,0x01,0x01,0x00,0x6a,0xa0,0x91,0x00,0x31,0x75,0x5f,0x00,0x44,0xa5,
    0x85,0x00,0xe6,0xe5,0xec,0x00,0x31,0x7a,0x62,0x00,0x0b,0x1d,0x16,0x00,0xc2,0xcb,
    0xdc,0x00,0x2e,0x6c,0x58,0x00,0x22,0x53,0x44,0x00,0xa5,0xd4,0xc4,0x00,0x3e,0x42,
    0x41,0x00,0x68,0x85,0x7b,0x00,0x31,0x5a,0x51,0x00,0x55,0x4e,0xd5,0x00,0x8b,0x8b,
    0x8a,0x00,0x02,0x06,0x05,0x00,0x04,0x06,0x05,0x00,0x48,0x62,0x5b,0x00,0x0c,0x1d,
    0x17,0x00,0x01,0x04,0x03,0x00,0x03,0x04,0x03,0x00,0x2f,0x3d,0x38,0x00,0x65,0x81,
    0x77,0x00,0xef,0xf1,0xf5,0x00,0x57,0x25,0x51,0x00,0xc1,0xbd,0xc3,0x00,0x34,0x81,
    0x69,0x00,0x39,0x5d,0x52,0x00,0xff,0xff,0xff,0x00,0x2f,0x31,0x31,0x00,0x79,0x7d,
    0xd5,0x00,0x1b,0x46,0x39,0x00,0x4d,0x46,0xdd,0x00,0x13,0x13,0x13,0x00,0x5a,0x40,
    0x71,0x00,0xb4,0xb4,0xb4,0x00,0x71,0x74,0x73,0x00,0x4c,0x59,0x55,0x00,0x02,0x02,
    0x02,0x00,0xec,0xec,0xec,0x00,0x6f,0x72,0x71,0x00,0x67,0x67,0x67,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x3e,0x3e,
    0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,
    0x3e,0x3e,0x3e,0x4a,0x26,0x26,0x15,0x3e,0x3e,0x3e,0x3e,0x1e,0x28,0x39,0x3e,0x3f,
    0x3e,0x24,0x24,0x24,0x24,0x24,0x24,0x24,0x20,0x2f,0x11,0x18,0x25,0x3e,0x3e,0x3e,
    0x00,0x24,0x08,0x00,0x05,0x4b,0x21,0x42,0x3a,0x0f,0x40,0x3e,0x3e,0x3e,0x3e,0x17,
    0x2e,0x00,0x0c,0x45,0x00,0x00,0x44,0x12,0x24,0x09,0x3c,0x3e,0x3e,0x3e,0x3c,0x3c,
    0x00,0x3c,0x00,0x00,0x0d,0x2b,0x24,0x24,0x00,0x00,0x3c,0x46,0x3e,0x3e,0x3c,0x3c,
    0x30,0x43,0x24,0x31,0x1c,0x1c,0x0e,0x00,0x48,0x3b,0x3c,0x3c,0x3e,0x3e,0x3c,0x06,
    0x3e,0x00,0x23,0x1c,0x1c,0x1c,0x1c,0x00,0x36,0x3e,0x16,0x3c,0x3e,0x3e,0x3c,0x22,
    0x3e,0x00,0x33,0x1c,0x37,0x1f,0x1c,0x3d,0x14,0x3e,0x41,0x3c,0x3e,0x3e,0x3c,0x3c,
    0x49,0x00,0x00,0x32,0x1c,0x1c,0x2a,0x24,0x00,0x3e,0x3c,0x3c,0x3e,0x3e,0x47,0x3c,
    0x00,0x00,0x27,0x24,0x29,0x13,0x00,0x02,0x24,0x00,0x3c,0x0a,0x3e,0x3e,0x3e,0x3c,
    0x19,0x34,0x24,0x21,0x48,0x1b,0x00,0x00,0x01,0x0b,0x3c,0x3e,0x3e,0x3e,0x3e,0x3e,
    0x1d,0x3c,0x00,0x1a,0x3e,0x3e,0x10,0x00,0x3c,0x35,0x3e,0x3e,0x3e,0x3e,0x3e,0x2c,
    0x3e,0x3c,0x3c,0x3c,0x2d,0x38,0x3c,0x3c,0x3c,0x07,0x3f,0x3e,0x3e,0x3e,0x3e,0x3e,
    0x3e,0x3e,0x03,0x3c,0x3c,0x3c,0x3c,0x04,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,
    0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x3e,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
  ap_set_content_type(r, "image/x-icon");
  for(i=0; i < sizeof(ico); i++) {
    ap_rputc(ico[i], r);
  }
  return OK;
}

static int qos_console_dump(request_rec * r, const char *event) {
  qos_srv_config *sconf = sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config,
                                                                        &qos_module);
  if(sconf && sconf->has_qos_cc) {
    int i = 0;
    qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
    qos_s_entry_t **clientEntry = NULL;
    /* table requires heap (100'000 ~ 4MB) but we avoid io with drawn lock */
    apr_table_t *iptable = apr_table_make(r->pool, u->qos_cc->max);
    apr_table_entry_t *entry;
    apr_time_t now = apr_time_sec(r->request_time);
    ap_set_content_type(r, "text/plain");
    apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT35 */
    clientEntry = u->qos_cc->ipd;
    for(i = 0; i < u->qos_cc->max; i++) {
      if((clientEntry[i]->ip6[0] != 0) ||
         (clientEntry[i]->ip6[1] != 0)) {
        char *k;
        int limit = 0;
        time_t limitTime = 0;
        if(u->qos_cc->limitTable) {
          int limitTableIndex;
          qos_s_entry_limit_conf_t *eventLimitConf = qos_getQSLimitEvent(u, event, &limitTableIndex);
          if(eventLimitConf) {
            limit = clientEntry[i]->limit[limitTableIndex].limit;
            limitTime = (eventLimitConf->limitTime >= (time(NULL) - clientEntry[i]->limit[limitTableIndex].limitTime)) ? 
              (eventLimitConf->limitTime - (time(NULL) - clientEntry[i]->limit[limitTableIndex].limitTime)) : 0;
          }
        }
        k = apr_psprintf(r->pool,
                         "%010d %s vip=%s lowprio=%s block=%hu/%ld limit=%d/%ld %ld",
                         i,
                         qos_ip_long2str(r->pool, clientEntry[i]->ip6),
                         clientEntry[i]->vip ? "yes" : "no",
                         (clientEntry[i]->lowrate + QOS_LOW_TIMEOUT) > now ? "yes" : "no",
                         clientEntry[i]->block,
                         (sconf->qos_cc_blockTime >= (time(NULL) - clientEntry[i]->blockTime)) ? 
                         (sconf->qos_cc_blockTime - (time(NULL) - clientEntry[i]->blockTime)) : 0,
                         limit,
                         limitTime,
                         clientEntry[i]->time);
        apr_table_addn(iptable, k, NULL);
      }
    }
    apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT35 */
    entry = (apr_table_entry_t *)apr_table_elts(iptable)->elts;
    for(i = 0; i < apr_table_elts(iptable)->nelts; ++i) {
      ap_rprintf(r, "%s\n", entry[i].key);
    }
    return OK;
  }
  ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                QOS_LOG_PFX(070)"console, not acceptable, "
                "qos client control has not been activated, id=%s",
                qos_unique_id(r, "070"));
  return HTTP_NOT_ACCEPTABLE;
}

#ifdef QS_INTERNAL_TEST
static int qos_handler_headerfilter(request_rec * r) {
  int i;
  apr_table_entry_t *entry;
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config, &qos_module);
  if(strcmp(r->handler, "qos-headerfilter") != 0) {
    return DECLINED;
  }
  ap_set_content_type(r, "text/plain");
  
  ap_rprintf(r, "\nQS_RequestHeaderFilter rules:\n\n");
  entry = (apr_table_entry_t *)apr_table_elts(sconf->hfilter_table)->elts;
  for(i = 0; i < apr_table_elts(sconf->hfilter_table)->nelts; i++) {
    qos_fhlt_r_t *he = (qos_fhlt_r_t *)entry[i].val;
    ap_rprintf(r, " name=%s, action=%s, size=%d, pattern=%s\n",
               entry[i].key,
               he->action == QS_FLT_ACTION_DROP ? "drop" : "deny",
               he->size, he->text);
  }
  ap_rprintf(r, "\nQS_ResponseHeaderFilter rules:\n\n");
  entry = (apr_table_entry_t *)apr_table_elts(sconf->reshfilter_table)->elts;
  for(i = 0; i < apr_table_elts(sconf->reshfilter_table)->nelts; i++) {
    qos_fhlt_r_t *he = (qos_fhlt_r_t *)entry[i].val;
    ap_rprintf(r, " name=%s, action=%s, size=%d, pattern=%s\n",
               entry[i].key,
               he->action == QS_FLT_ACTION_DROP ? "drop" : "deny",
               he->size, he->text);
  }

  ap_rprintf(r, "\nmod_qos %s\n",  g_revision);

  return OK;
}
  
static int qos_handler_man1(request_rec * r) {
  module *modp = NULL;
  if(strcmp(r->handler, "qos-man1") != 0) {
    return DECLINED;
  }
  ap_set_content_type(r, "text/plain");
  for(modp = ap_top_module; modp; modp = modp->next) {
    if(strcmp(modp->name, "mod_qos.c") == 0) {
      const command_rec *cmd = modp->cmds;
      char time_string[64];
      time_t tm = time(NULL);
      struct tm *ptr = localtime(&tm);
      strftime(time_string, sizeof(time_string), "%B %Y", ptr);
      ap_rprintf(r, ".TH MOD_QOS 1 \"%s\" \"mod_qos Apache Module\" \"mod_qos\"\n", time_string);
      ap_rprintf(r, ".SH NAME\n");
      ap_rprintf(r, "mod_qos - quality of service module for the Apache Web server\n");
      ap_rprintf(r, ".SH DESCRIPTION\n");
      ap_rprintf(r, "mod_qos is a quality of service module for the Apache web server implementing control mechanisms that can provide different levels of priority to different HTTP requests.\n");
      ap_rprintf(r, ".SH OPTIONS\n");
      while(cmd) {
        if(cmd->name) {
          if(cmd->errmsg && cmd->errmsg[0] && 
             ((strstr(cmd->errmsg, "QS_") != NULL) || (strstr(cmd->errmsg, "QSLog") != NULL))) {
            ap_rprintf(r, ".TP\n");
            ap_rprintf(r, "%s\n", cmd->errmsg);
          }
          cmd++;
        } else {
          break;
        }
      }
      ap_rprintf(r, ".SH AUTHOR\n");
      ap_rprintf(r, "Pascal Buchbinder, http://mod-qos.sourceforge.net/\n");
    }
  }
  return OK;
}
#endif

static int qos_handler_console(request_rec * r) {
  apr_table_t *qt;
  const char *ip;
  const char *cmd;
  const char *event;
  apr_uint64_t addr[2];
  qos_srv_config *sconf;
  int status = HTTP_NOT_ACCEPTABLE;;
  if (strcmp(r->handler, "qos-console") != 0) {
    return DECLINED;
  }
  sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config, &qos_module);
  if(sconf->disable_handler == 1) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(072)"handler has been disabled for this host, id=%s",
                  qos_unique_id(r, "072"));
    return DECLINED;
  }
  apr_table_add(r->err_headers_out, "Cache-Control", "no-cache");
  qt = qos_get_query_table(r);
  ip = apr_table_get(qt, "address");
  cmd = apr_table_get(qt, "action");
  event = apr_table_get(qt, "event");
  if(event == NULL) {
    event = apr_pstrdup(r->pool, QS_LIMIT_DEFAULT);
  }
  if(!cmd || !ip) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(070)"console, not acceptable,"
                  " missing request query (action/address), id=%s",
                  qos_unique_id(r, "070"));
    return HTTP_NOT_ACCEPTABLE;
  }
  if(ip) {
    int escerr = 0;
    char *ta = apr_pstrdup(r->pool, ip);
    qos_unescaping(ta, QOS_DEC_MODE_FLAGS_URL, &escerr);
    ip = ta;
  }
  if(!sconf->has_qos_cc) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(070)"console, not acceptable,"
                  " client data store has not been enabled, id=%s",
                  qos_unique_id(r, "070"));
    return HTTP_NOT_ACCEPTABLE;
  }
  if((strcasecmp(cmd, "search") == 0) && (strcmp(ip, "*") == 0)) {
    return qos_console_dump(r, event);
  }
  if(qos_ip_str2long(ip, addr) == 0) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(070)"console, not acceptable,"
                  " invalid ip/wrong format, id=%s",
                  qos_unique_id(r, "070"));
    return HTTP_NOT_ACCEPTABLE;
  }
  if(sconf->has_qos_cc) {
    char *msg = "not available";
    qos_user_t *u = qos_get_user_conf(sconf->act->ppool);
    qos_s_entry_t **clientEntry = NULL;
    qos_s_entry_t searchE;
    int limitTableIndex = 0;
    qos_s_entry_limit_conf_t *eventLimitConf = NULL;
    int limit = 0;
    time_t limitTime = 0;
    apr_time_t now = apr_time_sec(r->request_time);
    apr_global_mutex_lock(u->qos_cc->lock);            /* @CRT34 */
    searchE.ip6[0] = addr[0];
    searchE.ip6[1] = addr[1];
    clientEntry = qos_cc_get0(u->qos_cc, &searchE, apr_time_sec(r->request_time));
    if(!clientEntry) {
      if(strcasecmp(cmd, "search") != 0) {
        clientEntry = qos_cc_set(u->qos_cc, &searchE, time(NULL));
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_INFO, 0, r,
                      QOS_LOG_PFX(071)"console, add new client ip entry '%s', is=%s",
                      ip, qos_unique_id(r, "071"));
      }
    }
    status = OK;
    if(u->qos_cc->limitTable) {
      eventLimitConf = qos_getQSLimitEvent(u, event, &limitTableIndex);
    }
    if(strcasecmp(cmd, "setvip") == 0) {
      (*clientEntry)->vip = 1;
    } else if(strcasecmp(cmd, "unsetvip") == 0) {
      (*clientEntry)->vip = 0;
    } else if(strcasecmp(cmd, "setlowprio") == 0) {
      (*clientEntry)->lowrate = time(NULL);
      (*clientEntry)->lowratestatus = 0xff;
      (*clientEntry)->lowratestatus &= ~QOS_LOW_FLAG_BEHAVIOR_OK;
    } else if(strcasecmp(cmd, "unsetlowprio") == 0) {
      (*clientEntry)->lowrate = 0;
      if((*clientEntry)->lowratestatus & QOS_LOW_FLAG_BEHAVIOR_OK) {
        (*clientEntry)->lowratestatus = QOS_LOW_FLAG_BEHAVIOR_OK;
      } else {
        (*clientEntry)->lowratestatus = 0;
      }
    } else if(strcasecmp(cmd, "unblock") == 0) {
      (*clientEntry)->blockTime = 0;
      (*clientEntry)->block = 0;
    } else if(strcasecmp(cmd, "block") == 0) {
      (*clientEntry)->blockTime = time(NULL);
      (*clientEntry)->block = sconf->qos_cc_block + 1000;
    } else if(strcasecmp(cmd, "unlimit") == 0) {
      if(eventLimitConf) {
        (*clientEntry)->limit[limitTableIndex].limitTime = 0;
        (*clientEntry)->limit[limitTableIndex].limit = 0;
      }
    } else if(strcasecmp(cmd, "limit") == 0) {
      if(eventLimitConf) {
        (*clientEntry)->limit[limitTableIndex].limitTime = time(NULL);
        (*clientEntry)->limit[limitTableIndex].limit = eventLimitConf->limit + 1000;
      }
    } else if(strcasecmp(cmd, "inclimit") == 0) {
      if(eventLimitConf) {
        if(((*clientEntry)->limit[limitTableIndex].limitTime + eventLimitConf->limitTime) < now) {
          // expired
          (*clientEntry)->limit[limitTableIndex].limit = 0;
          (*clientEntry)->limit[limitTableIndex].limitTime = 0;
        }
        // increment limit event
        if((*clientEntry)->limit[limitTableIndex].limit < USHRT_MAX) {
          (*clientEntry)->limit[limitTableIndex].limit++;
        }
        if((*clientEntry)->limit[limitTableIndex].limit == 1) {
          // first, start timer
          (*clientEntry)->limit[limitTableIndex].limitTime = now;
        }
      }
    } else if(strcasecmp(cmd, "search") == 0) {
      /* nothing to do here */
    } else {
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                    QOS_LOG_PFX(070)"console, not acceptable, unknown action '%s', id=%s",
                    cmd, qos_unique_id(r, "070"));
      status = HTTP_NOT_ACCEPTABLE;
    }
    if(clientEntry) {
      if(eventLimitConf) {
        limit = (*clientEntry)->limit[limitTableIndex].limit;
        limitTime = (eventLimitConf->limitTime >= (time(NULL) - (*clientEntry)->limit[limitTableIndex].limitTime)) ? 
          (eventLimitConf->limitTime - (time(NULL) - (*clientEntry)->limit[limitTableIndex].limitTime)) : 0;
      }
      msg = apr_psprintf(r->pool, "%s vip=%s lowprio=%s block=%hu/%ld limit=%d/%ld", ip,
                         (*clientEntry)->vip ? "yes" : "no",
                         ((*clientEntry)->lowrate + QOS_LOW_TIMEOUT) > now ? "yes" : "no",
                         (*clientEntry)->block,
                         (sconf->qos_cc_blockTime >= (time(NULL) - (*clientEntry)->blockTime)) ? 
                         (sconf->qos_cc_blockTime - (time(NULL) - (*clientEntry)->blockTime)) : 0,
                         limit,
                         limitTime);
    }
    apr_global_mutex_unlock(u->qos_cc->lock);          /* @CRT34 */
    if(status == OK) {
      ap_set_content_type(r, "text/plain");
      ap_rprintf(r, "%s\n", msg);
      ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_INFO, 0, r,
                    QOS_LOG_PFX(071)"console, action '%s' applied to client ip entry '%s', id=%s",
                    cmd, ip, qos_unique_id(r, "071"));
    }
  } else {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(070)"console, not acceptable,"
                  " qos client control has not been activated, id=%s",
                  qos_unique_id(r, "070"));
    status = HTTP_NOT_ACCEPTABLE;
  }
  return status;
}

/**
 * viewer which may be used as an alternative to mod_status
 */
static int qos_handler_view(request_rec * r) {
  qos_srv_config *sconf;
  apr_table_t *qt;
  if (strcmp(r->handler, "qos-viewer") != 0) {
    return DECLINED;
  }
  sconf = (qos_srv_config*)ap_get_module_config(r->server->module_config, &qos_module);
  if(sconf->disable_handler == 1) {
    ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
                  QOS_LOG_PFX(072)"handler has been disabled for this host, id=%s",
                  qos_unique_id(r, "072"));
    return DECLINED;
  }
  if(strstr(r->parsed_uri.path, "favicon.ico") != NULL) {
    apr_table_add(r->err_headers_out, "Cache-Control", "public, max-age=2592000");
    return qos_favicon(r);
  }
  apr_table_add(r->err_headers_out, "Cache-Control", "no-cache");
  qt = qos_get_query_table(r);
  if(qt && (apr_table_get(qt, "refresh") != NULL)) {
  apr_table_add(r->err_headers_out, "Refresh", "10");
  }
  if(qt && (apr_table_get(qt, "auto") != NULL)) {
    ap_set_content_type(r, "text/plain");
    qos_ext_status_short(r, qt);
    return OK;
  }
  ap_set_content_type(r, "text/html");
  if(!r->header_only) {
    int hasSlash = 1;
    if(strlen(r->parsed_uri.path) > 0) {
      if(r->parsed_uri.path[strlen(r->parsed_uri.path)-1] != '/') {
        hasSlash = 0;
      }
    }
    ap_rputs("<html><head><title>mod_qos</title>\n", r);
    ap_rprintf(r,"<link rel=\"shortcut icon\" href=\"%s%sfavicon.ico\"/>\n", 
               ap_escape_html(r->pool, r->parsed_uri.path),
               hasSlash ? "" : "/");
    ap_rputs("<meta http-equiv=\"content-type\" content=\"text/html; charset=ISO-8859-1\">\n", r);
    ap_rputs("<meta name=\"author\" content=\"Pascal Buchbinder\">\n", r);
    ap_rputs("<meta http-equiv=\"Pragma\" content=\"no-cache\">\n", r);
    ap_rputs("<style TYPE=\"text/css\">\n", r);
    ap_rputs("<!--", r);
    ap_rputs("  body {\n\
          background-color: rgb(248,250,246);\n\
          color: black;\n\
          font-family: arial, helvetica, verdana, sans-serif;\n\
   }\n\
  .btable{\n\
          background-color: white;\n\
          border: 1px solid; padding: 0px;\n\
          margin: 6px; width: 920px;\n\
          font-weight: normal;\n\
          border-collapse: collapse;\n\
  }\n\
  .rowts {\n\
          background-color: rgb(150,165,158);\n\
          vertical-align: top;\n\
          border: 1px solid;\n\
          border-color: black;\n\
          font-weight: normal;\n\
          padding: 0px;\n\
          margin: 0px;\n\
  }\n\
  .rowt {\n\
          background-color: rgb(210,220,215);\n\
          vertical-align: top;\n\
          border: 1px solid;\n\
          border-color: black;\n\
          font-weight: normal;\n\
          padding: 0px;\n\
          margin: 0px;\n\
  }\n\
  .rows {\n\
          background-color: rgb(228,235,230);\n\
          vertical-align: top;\n\
          border: 1px solid;\n\
          border-color: black;\n\
          font-weight: normal;\n\
          padding: 0px;\n\
          margin: 0px;\n\
  }\n\
  .row  {\n\
          background-color: white;\n\
          vertical-align: top;\n\
          border: 1px solid;\n\
          border-color: black;\n\
          font-weight: normal;\n\
          padding: 0px;\n\
          margin: 0px;\n\
  }\n\
  .rowe {\n\
          background-color: rgb(186,200,190);\n\
          vertical-align: top;\n\
          border: 1px solid;\n\
          border-color: black;\n\
          font-weight: normal;\n\
          padding: 0px;\n\
          margin: 0px;\n\
  }\n\
  .small {\n\
          font-size: 0.75em;\n\
          font-family: courier;\n\
  }\n\
  .prog-border {\n\
          height: 10px;\n\
          width: 150px;\n\
          background: #eee;\n\
          border: 1px solid #000;\n\
          padding: 2px;\n\
          font-family: arial, helvetica, verdana, sans-serif; font-size: 10px; color: #000;\n\
  }\n\
          .prog-bar {\n\
          height: 10px;\n\
          padding: 0;\n\
          background: #339900;\n\
          font-family: arial, helvetica, verdana, sans-serif; font-size: 10px; color: #000;\n\
  }\n\
          .prog-bar-limit {\n\
          height: 10px;\n\
          padding: 0;\n\
          background: #993300;\n\
          font-family: arial, helvetica, verdana, sans-serif; font-size: 10px; color: #000;\n\
  }\n\
  form      { display: inline; }\n", r);
    ap_rputs("-->\n", r);
    ap_rputs("</style>\n", r);
    ap_rputs("</head><body>\n", r);
    qos_ext_status_hook(r, 0);
    {
      apr_time_t nowtime = apr_time_now();
      ap_rvputs(r, "<div class=\"small\">",
                ap_ht_time(r->pool, nowtime, QS_ERR_TIME_FORMAT, 0), NULL);
      ap_rprintf(r, ", mod_qos %s\n", ap_escape_html(r->pool, qos_revision(r->pool)));
    }
    ap_rputs("</body></html>", r);
  }
  return OK;
}

static int qos_handler(request_rec * r) {
  int status = qos_handler_view(r);
  if(status != DECLINED) {
    return status;
  }
  status = qos_handler_console(r);
  if(status != DECLINED) {
    return status;
  }
#ifdef QS_INTERNAL_TEST
  status = qos_handler_man1(r);
  if(status != DECLINED) {
    return status;
  }
  status = qos_handler_headerfilter(r);
  if(status != DECLINED) {
    return status;
  }
#endif
  return DECLINED;
}

/**
 * insert response filter
 */
static void qos_insert_filter(request_rec *r) {
  ap_add_output_filter("qos-out-filter", NULL, r, r->connection);
}
static void qos_insert_err_filter(request_rec *r) {
  ap_add_output_filter("qos-out-err-filter", NULL, r, r->connection);
}

/************************************************************************
 * directiv handlers 
 ***********************************************************************/
static void qos_table_merge(apr_table_t *o, apr_table_t *b) {
  int i;
  apr_table_entry_t *entry = (apr_table_entry_t *)apr_table_elts(b)->elts;
  for(i = 0; i < apr_table_elts(b)->nelts; ++i) {
    if(apr_table_get(o, entry[i].key) == NULL) {
      // copy the pointer only!!!
      apr_table_setn(o, entry[i].key, entry[i].val);
    }
  }
}

static void *qos_dir_config_create(apr_pool_t *p, char *d) {
  qos_dir_config *dconf = apr_pcalloc(p, sizeof(qos_dir_config));
  dconf->path = d;
  dconf->rfilter_table = apr_table_make(p, 1);
  dconf->inheritoff = 0;
  dconf->headerfilter = QS_HEADERFILTER_OFF_DEFAULT;
  dconf->resheaderfilter = QS_HEADERFILTER_OFF_DEFAULT;
  dconf->bodyfilter_p = -1;
  dconf->bodyfilter_d = -1;
  dconf->dec_mode = QOS_DEC_MODE_FLAGS_URL;
  dconf->maxpost = -1;
  dconf->urldecoding = QS_OFF_DEFAULT;
  dconf->response_pattern = NULL;
  dconf->response_pattern_var = NULL;
  dconf->redirectif = apr_array_make(p, 20, sizeof(qos_redirectif_entry_t));
  dconf->disable_reqrate_events = apr_table_make(p, 1);
  dconf->setenvstatus_t = apr_table_make(p, 5);
  dconf->setenvif_t = apr_array_make(p, 20, sizeof(qos_setenvif_t));
  dconf->setenvifquery_t = apr_table_make(p, 1);
  dconf->setenvcmp = apr_array_make(p, 2, sizeof(qos_cmp_entry_t));
  return dconf;
}

/**
 * merges dir config, inheritoff disables merge of rfilter_table.
 */
static void *qos_dir_config_merge(apr_pool_t *p, void *basev, void *addv) {
  qos_dir_config *b = (qos_dir_config *)basev;
  qos_dir_config *o = (qos_dir_config *)addv;
  qos_dir_config *dconf = apr_pcalloc(p, sizeof(qos_dir_config));
  dconf->path = o->path;
  if(o->headerfilter != QS_HEADERFILTER_OFF_DEFAULT) {
    dconf->headerfilter = o->headerfilter;
  } else {
    dconf->headerfilter = b->headerfilter;
  }
  if(o->resheaderfilter != QS_HEADERFILTER_OFF_DEFAULT) {
    dconf->resheaderfilter = o->resheaderfilter;
  } else {
    dconf->resheaderfilter = b->resheaderfilter;
  }
  if(o->bodyfilter_p != -1) {
    dconf->bodyfilter_p = o->bodyfilter_p;
  } else {
    dconf->bodyfilter_p = b->bodyfilter_p;
  }
  if(o->bodyfilter_d != -1) {
    dconf->bodyfilter_d = o->bodyfilter_d;
  } else {
    dconf->bodyfilter_d = b->bodyfilter_d;
  }
  if((o->dec_mode != QOS_DEC_MODE_FLAGS_URL) ||
     (o->inheritoff)) {
    dconf->dec_mode = o->dec_mode;
  } else {
    dconf->dec_mode = b->dec_mode;
  }
  if(o->inheritoff) {
    dconf->rfilter_table = o->rfilter_table;
  } else {
    dconf->rfilter_table = qos_table_merge_create(p, b->rfilter_table, o->rfilter_table);
  }
  if(o->maxpost != -1) {
    dconf->maxpost = o->maxpost;
  } else {
    dconf->maxpost = b->maxpost;
  }
  if(o->urldecoding == QS_OFF_DEFAULT) {
    dconf->urldecoding = b->urldecoding;
  } else {
    dconf->urldecoding = o->urldecoding;
  }
  if(o->response_pattern) {
    dconf->response_pattern = o->response_pattern;
    dconf->response_pattern_len = o->response_pattern_len;
    dconf->response_pattern_var = o->response_pattern_var;
  } else {
    dconf->response_pattern = b->response_pattern;
    dconf->response_pattern_len = b->response_pattern_len;
    dconf->response_pattern_var = b->response_pattern_var;
  }
  dconf->disable_reqrate_events = qos_table_merge_create(p, b->disable_reqrate_events,
                                                         o->disable_reqrate_events);
  dconf->redirectif = apr_array_append(p, b->redirectif, o->redirectif);

  dconf->setenvstatus_t = apr_table_copy(p, b->setenvstatus_t);
  qos_table_merge(dconf->setenvstatus_t, o->setenvstatus_t);

  dconf->setenvif_t = apr_array_append(p, b->setenvif_t, o->setenvif_t);

  dconf->setenvifquery_t = apr_table_copy(p, b->setenvifquery_t);
  qos_table_merge(dconf->setenvifquery_t, o->setenvifquery_t);

  dconf->setenvcmp = apr_array_append(p, b->setenvcmp, o->setenvcmp);

  return dconf;
}

static void *qos_srv_config_create(apr_pool_t *p, server_rec *s) {
  qos_srv_config *sconf;
  apr_pool_t *act_pool;
  apr_pool_create(&act_pool, NULL);
  sconf =(qos_srv_config *)apr_pcalloc(p, sizeof(qos_srv_config));
  sconf->pool = p;
  sconf->location_t = apr_table_make(sconf->pool, 2);
  sconf->setenvif_t = apr_array_make(sconf->pool, 20, sizeof(qos_setenvif_t));
  sconf->setenv_t = apr_table_make(sconf->pool, 1);
  sconf->setreqheader_t = apr_table_make(sconf->pool, 5);
  sconf->setreqheaderlate_t = apr_table_make(sconf->pool, 5);
  sconf->unsetreqheader_t = apr_table_make(sconf->pool, 5);
  sconf->unsetresheader_t = apr_table_make(sconf->pool, 5);
  sconf->setenvifquery_t = apr_table_make(sconf->pool, 1);
  sconf->setenvifparp_t = apr_table_make(sconf->pool, 1);
  sconf->setenvifparpbody_t = apr_table_make(sconf->pool, 1);
  sconf->setenvstatus_t = apr_table_make(sconf->pool, 5);
  sconf->setenvresheader_t = apr_table_make(sconf->pool, 1);
  sconf->setenvresheadermatch_t = apr_table_make(sconf->pool, 1);
  sconf->setenvres_t = apr_table_make(sconf->pool, 1);
  sconf->headerfilter = QS_HEADERFILTER_OFF_DEFAULT;
  sconf->resheaderfilter = QS_HEADERFILTER_OFF_DEFAULT;
  sconf->redirectif = apr_array_make(p, 20, sizeof(qos_redirectif_entry_t));
  sconf->error_page = NULL;
  sconf->req_rate = -1;
  sconf->req_rate_start = 0;
  sconf->min_rate = -1;
  sconf->min_rate_max = -1;
  sconf->min_rate_off = 0;
  sconf->req_ignore_vip_rate = -1;
  sconf->max_clients = 1024;
  sconf->max_clients_conf = -1;
  sconf->has_event_filter = 0;
  sconf->has_event_limit = 0;
  sconf->event_limit_a = apr_array_make(p, 2, sizeof(qos_event_limit_entry_t));
  sconf->mfile = NULL;
  sconf->act = (qs_actable_t *)apr_pcalloc(act_pool, sizeof(qs_actable_t));
  sconf->act->pool = act_pool;
  sconf->act->ppool = s->process->pool;
  sconf->act->child_init = 0;
  sconf->act->timeout = apr_time_sec(s->timeout);
  sconf->act->has_events = 0;
  sconf->act->lock_file = NULL;
  sconf->act->lock = NULL;
  sconf->is_virtual = s->is_virtual;
  sconf->cookie_name = apr_pstrdup(sconf->pool, QOS_COOKIE_NAME);
  sconf->cookie_path = apr_pstrdup(sconf->pool, "/");
  sconf->user_tracking_cookie = NULL;
  sconf->user_tracking_cookie_force = NULL;
  sconf->user_tracking_cookie_session = -1;
  sconf->user_tracking_cookie_jsredirect = -1;
  sconf->user_tracking_cookie_domain = NULL;
  sconf->max_age = atoi(QOS_MAX_AGE);
  sconf->header_name = NULL;
  sconf->header_name_drop = 0;
  sconf->header_name_regex = NULL;
  sconf->ip_header_name = NULL;
  sconf->ip_header_name_drop = 0;
  sconf->ip_header_name_regex = NULL;
  sconf->vip_user = 0;
  sconf->vip_ip_user = 0;

  sconf->has_conn_counter = 0;
  sconf->max_conn = -1;
  sconf->max_conn_close = -1;
  sconf->max_conn_per_ip = -1;
  sconf->max_conn_per_ip_connections = -1;
  sconf->max_conn_per_ip_ignore_vip = -1;

  sconf->serialize = -1;
  sconf->exclude_ip = apr_table_make(sconf->pool, 2);
  sconf->hfilter_table = apr_table_make(p, 5);
  sconf->reshfilter_table = apr_table_make(p, 5);
  sconf->disable_reqrate_events = apr_table_make(p, 1);
  sconf->log_only = 0;
  sconf->log_env = -1;
  sconf->has_qos_cc = 0;
  sconf->cc_exclude_ip = apr_table_make(sconf->pool, 2);
  sconf->qos_cc_size = 50000;
  sconf->qos_cc_prefer = 0;
  sconf->qos_cc_prefer_limit = 0;
  sconf->qos_cc_event = 0;
  sconf->qos_cc_event_req = -1;
  sconf->qos_cc_block = 0;
  sconf->qos_cc_serialize = 0;
  sconf->serializeTMO = 6000; // 6000 * 50ms = 5 minutes
  sconf->cc_tolerance = atoi(QOS_CC_BEHAVIOR_TOLERANCE_STR);
  sconf->qs_req_rate_tm = QS_REQ_RATE_TM;
  sconf->geodb = NULL;
  sconf->geo_limit = -1;
  sconf->geo_priv = apr_table_make(p, 20);
  sconf->geo_excludeUnknown = -1;
  sconf->qslog_p = NULL;
  sconf->qsstatus = 0;
  sconf->qsevents = 0;
  sconf->qslog_str = NULL;
  sconf->ip_type = QS_IP_V6_DEFAULT;
  sconf->qos_cc_blockTime = 600;
  sconf->qos_cc_limitTable = apr_table_make(p, 5);
  sconf->qos_cc_forwardedfor = NULL;
  sconf->disable_handler = -1;
  sconf->maxpost = -1;
  sconf->milestones = NULL;
  sconf->milestoneTimeout = QOS_MILESTONE_TIMEOUT;
  sconf->static_on = -1;
  sconf->static_html = 0;
  sconf->static_cssjs = 0;
  sconf->static_img = 0;
  sconf->static_other = 0;
  sconf->static_notmodified = 0;
  if(!s->is_virtual) {
    char *msg = qos_load_headerfilter(p, sconf->hfilter_table, qs_header_rules);
    if(msg) {
      ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, 
                   QOS_LOG_PFX(006)"could not compile request header filter rules: %s", msg);
      exit(1);
    }
    msg = qos_load_headerfilter(p, sconf->reshfilter_table, qs_res_header_rules);
    if(msg) {
      ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, 
                   QOS_LOG_PFX(006)"could not compile response header filter rules: %s", msg);
      exit(1);
    }
  }

  {
    int len = EVP_MAX_KEY_LENGTH;
    unsigned char *rand = apr_pcalloc(p, len);
#if APR_HAS_RANDOM
    if(apr_generate_random_bytes(rand, len) != APR_SUCCESS) {
      ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
                   QOS_LOG_PFX(083)"Can't generate random data.");
    }
#else
    if(!RAND_bytes(rand, len)) {
      ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
                   QOS_LOG_PFX(083)"Can't generate random data.");
    }
#endif
    EVP_BytesToKey(EVP_des_ede3_cbc(), EVP_sha1(), NULL, rand, len, 1, sconf->key, NULL);
    sconf->rawKey = rand;
    sconf->rawKeyLen = len;
    sconf->keyset = 0;
  }
#ifdef QS_INTERNAL_TEST
  {
    int i;
    sconf->testip = apr_table_make(sconf->pool, m_qs_sim_ip_len);
    sconf->enable_testip = 1;
    for(i = 0; i < (m_qs_sim_ip_len*3/4); i++) {
      char *qsmi = apr_psprintf(p, "%d.%d.%d.%d", rand()%255, rand()%255, rand()%255, rand()%255);
      apr_table_add(sconf->testip, apr_psprintf(p, "%d", i), qsmi);
    }
    for(i = m_qs_sim_ip_len*3/4; i < m_qs_sim_ip_len; i++) {
      char *qsmi = apr_psprintf(p, "fe%d::%d:%d:%d", rand()%100, rand()%4000, rand()%4000, rand()%400);
      apr_table_add(sconf->testip, apr_psprintf(p, "%d", i), qsmi);
    }
  }
#endif
  return sconf;
}

/**
 * "merges" server configuration: virtual host overwrites global settings (if
 * any rule has been specified)
 * but: global settings such as header filter table and connection timeouts
 * are always used from the base server
 */
static void *qos_srv_config_merge(apr_pool_t *p, void *basev, void *addv) {
  qos_srv_config *b = (qos_srv_config *)basev;
  qos_srv_config *o = (qos_srv_config *)addv;
  /* GLOBAL ONLY directives: */
  o->hfilter_table = b->hfilter_table;
  o->reshfilter_table = b->reshfilter_table;
  o->log_only = b->log_only;
  if(o->log_env == -1) {
    o->log_env = b->log_env;
  }
  o->has_qos_cc = b->has_qos_cc;
  o->cc_exclude_ip = b->cc_exclude_ip;
  o->qos_cc_size = b->qos_cc_size;
  o->qos_cc_prefer = b->qos_cc_prefer;
  o->qos_cc_prefer_limit = b->qos_cc_prefer_limit;
  o->qos_cc_event = b->qos_cc_event;
  o->qos_cc_event_req = b->qos_cc_event_req;
  o->qos_cc_block = b->qos_cc_block;
  o->qos_cc_blockTime = b->qos_cc_blockTime;
  o->qos_cc_limitTable = b->qos_cc_limitTable;
  o->qos_cc_forwardedfor = b->qos_cc_forwardedfor;
  o->qos_cc_serialize = b->qos_cc_serialize;
  o->cc_tolerance = b->cc_tolerance;
  o->qs_req_rate_tm = b->qs_req_rate_tm;
  o->geodb = b->geodb;
  o->geo_limit = b->geo_limit;
  o->geo_priv = b->geo_priv;
  o->geo_excludeUnknown = b->geo_excludeUnknown;
  o->qslog_p = b->qslog_p;
  o->qsstatus = b->qsstatus;
  o->qsevents = b->qsevents;
  o->qslog_str = b->qslog_str;
  o->ip_type = b->ip_type;
  o->req_rate = b->req_rate;
  o->req_rate_start = b->req_rate_start;
  o->min_rate = b->min_rate;
  o->min_rate_max = b->min_rate_max;
  o->req_ignore_vip_rate = b->req_ignore_vip_rate;
  o->event_limit_a = apr_array_append(p, b->event_limit_a, o->event_limit_a);
  /* end GLOBAL ONLY directives */
  if(o->disable_handler == -1) {
    o->disable_handler = b->disable_handler;
  }
#ifdef QS_INTERNAL_TEST
  o->enable_testip = b->enable_testip;
#endif
  if(o->error_page == NULL) {
    o->error_page = b->error_page;
  }
  qos_table_merge(o->location_t, b->location_t);
  o->setenvif_t =  apr_array_append(p, b->setenvif_t, o->setenvif_t);
  qos_table_merge(o->setenv_t, b->setenv_t);
  qos_table_merge(o->setreqheader_t, b->setreqheader_t);
  qos_table_merge(o->setreqheaderlate_t, b->setreqheaderlate_t);
  qos_table_merge(o->unsetreqheader_t, b->unsetreqheader_t);
  qos_table_merge(o->unsetresheader_t, b->unsetresheader_t);
  qos_table_merge(o->setenvifquery_t, b->setenvifquery_t);
  qos_table_merge(o->setenvifparp_t, b->setenvifparp_t);
  qos_table_merge(o->setenvifparpbody_t, b->setenvifparpbody_t);
  qos_table_merge(o->setenvstatus_t, b->setenvstatus_t);
  qos_table_merge(o->setenvresheader_t, b->setenvresheader_t);
  qos_table_merge(o->setenvresheadermatch_t, b->setenvresheadermatch_t);
  qos_table_merge(o->setenvres_t, b->setenvres_t);
  qos_table_merge(o->exclude_ip, b->exclude_ip);
  o->disable_reqrate_events = qos_table_merge_create(p, b->disable_reqrate_events,
                                                     o->disable_reqrate_events);
  if(o->headerfilter == QS_HEADERFILTER_OFF_DEFAULT) {
    o->headerfilter = b->headerfilter;
  }
  if(o->resheaderfilter == QS_HEADERFILTER_OFF_DEFAULT) {
    o->resheaderfilter = b->resheaderfilter;
  }
  o->redirectif = apr_array_append(p, b->redirectif, o->redirectif);
  if(o->mfile == NULL) {
    o->mfile = b->mfile;
  }
  if(strcmp(o->cookie_name, QOS_COOKIE_NAME) == 0) {
    o->cookie_name = b->cookie_name;
  }
  if(strcmp(o->cookie_path, "/") == 0) {
    o->cookie_path = b->cookie_path;
  }
  if(o->max_age == atoi(QOS_MAX_AGE)) {
    o->max_age = b->max_age;
  }
  if(o->user_tracking_cookie == NULL) {
    o->user_tracking_cookie = b->user_tracking_cookie;
    o->user_tracking_cookie_force = b->user_tracking_cookie_force;
    o->user_tracking_cookie_session = b->user_tracking_cookie_session;
    o->user_tracking_cookie_jsredirect = b->user_tracking_cookie_jsredirect;
    o->user_tracking_cookie_domain = b->user_tracking_cookie_domain;
  }
  if(o->keyset == 0) {
    memcpy(o->key, b->key, sizeof(o->key));
    o->rawKey = b->rawKey;
    o->rawKeyLen = b->rawKeyLen;
  }
  if(o->header_name == NULL) {
    o->header_name = b->header_name;
    o->header_name_drop = b->header_name_drop;
    o->header_name_regex = b->header_name_regex;
  }
  if(o->ip_header_name == NULL) {
    o->ip_header_name = b->ip_header_name;
    o->ip_header_name_drop = b->ip_header_name_drop;
    o->ip_header_name_regex = b->ip_header_name_regex;
  }
  if(o->vip_user == 0) {
    o->vip_user = b->vip_user;
  }
  if(o->vip_ip_user == 0) {
    o->vip_ip_user = b->vip_ip_user;
  }
  if(o->max_conn == -1) {
    o->max_conn = b->max_conn;
  }
  if(o->max_conn_close == -1) {
    o->max_conn_close = b->max_conn_close;
    o->max_conn_close_percent = b->max_conn_close_percent;
  }
  if(o->max_conn_per_ip == -1) {
    o->max_conn_per_ip = b->max_conn_per_ip;
  }
  if(o->max_conn_per_ip_ignore_vip == -1) {
    o->max_conn_per_ip_ignore_vip = b->max_conn_per_ip_ignore_vip;
  }
  if(o->max_conn_per_ip_connections == -1) {
    o->max_conn_per_ip_connections = b->max_conn_per_ip_connections;
  }
  if(o->serialize == -1) {
    o->serialize = b->serialize;
    o->serializeTMO = b->serializeTMO;
  }
  if(o->has_event_filter == 0) {
    o->has_event_filter = b->has_event_filter;
  }
  if(o->has_event_limit == 0) {
    o->has_event_limit = b->has_event_limit;
  }
  if(o->maxpost == -1) {
    o->maxpost = b->maxpost;
  }
  if(o->milestones == NULL) {
    o->milestones = b->milestones;
    o->milestoneTimeout = b->milestoneTimeout;
  }
  if(o->static_on == -1) {
    /* use base settings if not configured per vhost */
    o->static_on = b->static_on;
    o->static_html = b->static_html;
    o->static_cssjs = b->static_cssjs;
    o->static_img = b->static_img;
    o->static_other = b->static_other;
    o->static_notmodified = b->static_notmodified;
  }
  return o;
}

const char *qos_logonly_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->log_only = flag;
  return NULL;
}

const char *qos_logenv_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->log_env = flag;
  return NULL;
}

/**
 * QS_MaxClients
 */
const char *qos_maxclients_cmd(cmd_parms *cmd, void *dcfg, const char *arg1) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->max_clients_conf = atoi(arg1);
  if(sconf->max_clients_conf <= 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0", 
                        cmd->directive->directive);
  }
  return NULL;
}
 
const char *qos_mfile_cmd(cmd_parms *cmd, void *dcfg, const char *path) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  apr_finfo_t finfo;
  apr_status_t rc;
  if(!path[0]) {
    return apr_psprintf(cmd->pool, "%s: invalid path",
                        cmd->directive->directive);
  }
  if((rc = apr_stat(&finfo, path, APR_FINFO_TYPE, cmd->pool)) != APR_SUCCESS) {
    char *p = apr_pstrdup(cmd->pool, path);
    /* file? */
    if(p[strlen(p)-1] == '/') {
      return apr_psprintf(cmd->pool, "%s: path does not exist",
                          cmd->directive->directive);
    } else {
      char *e = strrchr(p, '/');
      if(e) {
        e[0] = '\0';
      }
      if(((rc = apr_stat(&finfo, p, APR_FINFO_TYPE, cmd->pool)) != APR_SUCCESS) ||
         (finfo.filetype != APR_DIR)){
        return apr_psprintf(cmd->pool, "%s: path does not exist",
                            cmd->directive->directive);
      }
    }
  }
  sconf->mfile = apr_pstrdup(cmd->pool, path);
  return NULL;
}

/**
 * command to define the concurrent request limitation for a location
 */
const char *qos_loc_con_cmd(cmd_parms *cmd, void *dcfg, const char *loc, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule = (qs_rule_ctx_t *)apr_table_get(sconf->location_t, loc);
  if(rule == NULL) {
    rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
    rule->url = apr_pstrdup(cmd->pool, loc);
  }
  rule->limit = atoi(limit);
  if((rule->limit < 0) || ((rule->limit == 0) && limit && (strcmp(limit, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0", 
                        cmd->directive->directive);
  }
  rule->event = NULL;
  rule->regex = NULL;
  rule->condition = NULL;
  apr_table_setn(sconf->location_t, apr_pstrdup(cmd->pool, loc), (char *)rule);
  return NULL;
}

/**
 * QS_LocRequestPerSecLimit: command to define the req/sec limitation for a location
 */
const char *qos_loc_rs_cmd(cmd_parms *cmd, void *dcfg, const char *loc, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule = (qs_rule_ctx_t *)apr_table_get(sconf->location_t, loc);
  if(rule == NULL) {
    rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
    rule->url = apr_pstrdup(cmd->pool, loc);
  }
  rule->req_per_sec_limit = atol(limit);
  if(rule->req_per_sec_limit == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  rule->event = NULL;
  rule->regex = NULL;
  rule->condition = NULL;
  apr_table_setn(sconf->location_t, apr_pstrdup(cmd->pool, loc), (char *)rule);
  return NULL;
}

/**
 * QS_LocKBytesPerSecLimit: command to define the kbytes/sec limitation for a location
 */
const char *qos_loc_bs_cmd(cmd_parms *cmd, void *dcfg, const char *loc, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule = (qs_rule_ctx_t *)apr_table_get(sconf->location_t, loc);
  if(rule == NULL) {
    rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
    rule->url = apr_pstrdup(cmd->pool, loc);
  }
  rule->kbytes_per_sec_limit = atol(limit);
  if(rule->kbytes_per_sec_limit == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  rule->event = NULL;
  rule->regex = NULL;
  rule->condition = NULL;
  apr_table_setn(sconf->location_t, apr_pstrdup(cmd->pool, loc), (char *)rule);
  return NULL;
}

/**
 * QS_LocRequestLimitMatch: defines the maximum of concurrent requests matching the specified
 * request line pattern
 */
const char *qos_match_con_cmd(cmd_parms *cmd, void *dcfg, const char *match, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule = (qs_rule_ctx_t *)apr_table_get(sconf->location_t, match);
  if(rule == NULL) {
    rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
    rule->url = apr_pstrdup(cmd->pool, match);
  }
  rule->limit = atoi(limit);
  if((rule->limit < 0) || ((rule->limit == 0) && limit && (strcmp(limit, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0", 
                        cmd->directive->directive);
  }
  rule->regex = ap_pregcomp(cmd->pool, match, AP_REG_EXTENDED);
  if(rule->regex == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regular expression (%s)",
                       cmd->directive->directive, match);
  }
  rule->event = NULL;
  rule->condition = NULL;
  apr_table_setn(sconf->location_t, apr_pstrdup(cmd->pool, match), (char *)rule);
  return NULL;
}

/**
 * QS_CondLocRequestLimitMatch: defines the maximum of concurrent requests
 * matching the specified request line pattern
 */
const char *qos_cond_match_con_cmd(cmd_parms *cmd, void *dcfg, const char *match,
                                   const char *limit, const char *pattern) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
  rule->url = apr_pstrdup(cmd->pool, match);
  rule->limit = atoi(limit);
  if((rule->limit < 0) || ((rule->limit == 0) && limit && (strcmp(limit, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0", 
                        cmd->directive->directive);
  }
  rule->regex = ap_pregcomp(cmd->pool, match, AP_REG_EXTENDED);
  rule->condition = ap_pregcomp(cmd->pool, pattern, AP_REG_EXTENDED);
  if(rule->regex == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regular expression (%s)",
                       cmd->directive->directive, match);
  }
  if(rule->condition == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regular expression (%s)",
                       cmd->directive->directive, pattern);
  }
  rule->event = NULL;
  apr_table_setn(sconf->location_t, apr_pstrcat(cmd->pool, match, "##conditional##", NULL), (char *)rule);
  return NULL;
}

/**
 * QS_LocRequestPerSecLimitMatch: defines the maximum requests/sec for
 * the matching request line pattern
 */
const char *qos_match_rs_cmd(cmd_parms *cmd, void *dcfg, const char *match, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule = (qs_rule_ctx_t *)apr_table_get(sconf->location_t, match);
  if(rule == NULL) {
    rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
    rule->url = apr_pstrdup(cmd->pool, match);
  }
  rule->req_per_sec_limit = atol(limit);
  if(rule->req_per_sec_limit == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  rule->regex = ap_pregcomp(cmd->pool, match, AP_REG_EXTENDED);
  if(rule->regex == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regular expression (%s)",
                       cmd->directive->directive, match);
  }
  rule->event = NULL;
  rule->condition = NULL;
  apr_table_setn(sconf->location_t, apr_pstrdup(cmd->pool, match), (char *)rule);
  return NULL;
}

/**
 * QS_LocKBytesPerSecLimitMatch: defines the maximum kbytes/sec for
 * the matching request line pattern
 */
const char *qos_match_bs_cmd(cmd_parms *cmd, void *dcfg, const char *match, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule = (qs_rule_ctx_t *)apr_table_get(sconf->location_t, match);
  if(rule == NULL) {
    rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
    rule->url = apr_pstrdup(cmd->pool, match);
  }
  rule->kbytes_per_sec_limit = atol(limit);
  if(rule->kbytes_per_sec_limit == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  rule->regex = ap_pregcomp(cmd->pool, match, AP_REG_EXTENDED);
  if(rule->regex == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regular expression (%s)",
                       cmd->directive->directive, match);
  }
  rule->event = NULL;
  rule->condition = NULL;
  apr_table_setn(sconf->location_t, apr_pstrdup(cmd->pool, match), (char *)rule);
  return NULL;
}

/**
 * sets the default limitation of cuncurrent requests
 */
const char *qos_loc_con_def_cmd(cmd_parms *cmd, void *dcfg, const char *limit) {
  return qos_loc_con_cmd(cmd, dcfg, "/", limit);
}

/**
 * QS_EventRequestLimit: defines the number of concurrent events
 */
const char *qos_event_req_cmd(cmd_parms *cmd, void *dcfg, const char *event, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
  char *p = strchr(event, '=');
  rule->url = apr_pstrcat(cmd->pool, "var=(", event, ")", NULL);
  rule->limit = atoi(limit);
  rule->req_per_sec_limit = 0;
  rule->req_per_sec_limit = 0;
  if((rule->limit < 0) || ((rule->limit == 0) && limit && (strcmp(limit, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0", 
                        cmd->directive->directive);
  }
  sconf->has_event_filter = 1;
  if(p) {
    p++;
    rule->regex_var = ap_pregcomp(cmd->pool, p, AP_REG_EXTENDED);
    if(rule->regex_var == NULL) {
      return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                          cmd->directive->directive, p);
    }
    rule->event = apr_pstrndup(cmd->pool, event, p - event - 1);
  } else {
    rule->regex_var = NULL;
    rule->event = apr_pstrdup(cmd->pool, event);
  }
  rule->regex = NULL;
  rule->condition = NULL;
  apr_table_setn(sconf->location_t, rule->url, (char *)rule);
  return NULL;
}

/**
 * QS_EventPerSecLimit: defines the maximum requests/sec for the matching variable.
 */
const char *qos_event_rs_cmd(cmd_parms *cmd, void *dcfg, const char *event, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
  rule->url = apr_pstrcat(cmd->pool, "var=[", event, "]", NULL);
  rule->req_per_sec_limit = atol(limit);
  rule->kbytes_per_sec_limit = 0;
  if(rule->req_per_sec_limit == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  sconf->has_event_limit = 1;
  rule->event = apr_pstrdup(cmd->pool, event);
  rule->regex = NULL;
  rule->condition = NULL;
  rule->limit = -1;
  apr_table_setn(sconf->location_t, rule->url, (char *)rule);
  return NULL;
}

/**
 * QS_EventKBytesPerSecLimit: maximum download per event
 */
const char *qos_event_bps_cmd(cmd_parms *cmd, void *dcfg, const char *event, const char *limit) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qs_rule_ctx_t *rule =  (qs_rule_ctx_t *)apr_pcalloc(cmd->pool, sizeof(qs_rule_ctx_t));
  rule->url = apr_pstrcat(cmd->pool, "var={", event, "}", NULL);
  rule->kbytes_per_sec_limit = atol(limit);
  rule->req_per_sec_limit = 0;
  if(rule->kbytes_per_sec_limit == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  sconf->has_event_limit = 1;
  rule->event = apr_pstrdup(cmd->pool, event);
  rule->regex = NULL;
  rule->condition = NULL;
  rule->limit = -1;
  apr_table_setn(sconf->location_t, rule->url, (char *)rule);
  return NULL;
}

// QS_CondEventLimitCount
const char *qos_cond_event_limit_cmd(cmd_parms *cmd, void *dcfg, int argc, char *const argv[]) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_event_limit_entry_t *new = apr_array_push(sconf->event_limit_a);
  if(argc < 4) {
    return apr_psprintf(cmd->pool, "%s: takes 3 arguments",
                        cmd->directive->directive);
  }
  new->env_var = apr_pstrdup(cmd->pool, argv[0]);
  new->eventDecStr = apr_pstrcat(cmd->pool, argv[0], QS_LIMIT_DEC, NULL);
  new->max = atoi(argv[1]);
  new->seconds = atoi(argv[2]);
  new->action = QS_EVENT_ACTION_DENY;
  if(new->max == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  if(new->seconds == 0) {
    return apr_psprintf(cmd->pool, "%s: seconds must be numeric value >0", 
                        cmd->directive->directive);
  }
  new->condStr = apr_pstrdup(cmd->pool, argv[3]);
  new->preg = ap_pregcomp(cmd->pool, new->condStr, AP_REG_EXTENDED);
  if(new->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                        cmd->directive->directive, new->condStr);
  }
  return NULL;
}

// QS_EventLimitCount
const char *qos_event_limit_cmd(cmd_parms *cmd, void *dcfg, const char *event,
                                const char *number, const char *seconds) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_event_limit_entry_t *new = apr_array_push(sconf->event_limit_a);
  new->env_var = apr_pstrdup(cmd->pool, event);
  new->max = atoi(number);
  new->seconds = atoi(seconds);
  new->action = QS_EVENT_ACTION_DENY;
  new->condStr = NULL;
  if(new->max == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  if(new->seconds == 0) {
    return apr_psprintf(cmd->pool, "%s: seconds must be numeric value >0", 
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_event_setenvifstatus_cmd(cmd_parms *cmd, void *dcfg, const char *rc, const char *var) {
  apr_table_t *setenvstatus_t;
  if(cmd->path) {
    qos_dir_config *dconf = (qos_dir_config*)dcfg;
    setenvstatus_t = dconf->setenvstatus_t;
  } else {
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                  &qos_module);
    setenvstatus_t = sconf->setenvstatus_t;
  }

  if(strcasecmp(rc, QS_CLOSE) == 0) {
    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
    if(err != NULL) {
      return apr_psprintf(cmd->pool, "%s: "QS_CLOSE" may only be defined globally",
                          cmd->directive->directive);
    }
    if(strcasecmp(var, QS_BLOCK) != 0) {
      return apr_psprintf(cmd->pool, "%s: "QS_CLOSE" may only be defined for the event "QS_BLOCK,
                          cmd->directive->directive);
    }
  } else if(strcasecmp(rc, QS_MAXIP) == 0) {
    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
    if(err != NULL) {
      return apr_psprintf(cmd->pool, "%s: "QS_MAXIP" may only be defined globally",
                          cmd->directive->directive);
    }
    if(strcasecmp(var, QS_BLOCK) != 0) {
      return apr_psprintf(cmd->pool, "%s: "QS_MAXIP" may only be defined for the event "QS_BLOCK,
                          cmd->directive->directive);
    }
  } else if(strcasecmp(rc, QS_EMPTY_CON) == 0) {
    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
    if(err != NULL) {
      return apr_psprintf(cmd->pool, "%s: "QS_EMPTY_CON" may only be defined globally",
                          cmd->directive->directive);
    }
    if(strcasecmp(var, QS_BLOCK) != 0) {
      return apr_psprintf(cmd->pool, "%s: "QS_EMPTY_CON" may only be defined for the event "QS_BLOCK,
                          cmd->directive->directive);
    }
  } else if(strcasecmp(rc, QS_BROKEN_CON) == 0) {
    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
    if(err != NULL) {
      return apr_psprintf(cmd->pool, "%s: "QS_BROKEN_CON" may only be defined globally",
                          cmd->directive->directive);
    }
    if(strcasecmp(var, QS_BLOCK) != 0) {
      return apr_psprintf(cmd->pool, "%s: "QS_BROKEN_CON" may only be defined for the event "QS_BLOCK,
                          cmd->directive->directive);
    }
  } else {
    int code = atoi(rc);
    if(code <= 0) {
      return apr_psprintf(cmd->pool, "%s: invalid HTTP status code",
                          cmd->directive->directive);    
    }
  }
  apr_table_set(setenvstatus_t, rc, var);
  return NULL;
}

/** QS_SetEnvIfResBody */
const char *qos_event_setenvifresbody_cmd(cmd_parms *cmd, void *dcfg, const char *pattern,
                                        const char *var) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  if(dconf->response_pattern) {
    return apr_psprintf(cmd->pool, "%s: only one pattern must be configured for a location",
                        cmd->directive->directive);
  }
  dconf->response_pattern = apr_pstrdup(cmd->pool, pattern);
  dconf->response_pattern_len = strlen(dconf->response_pattern);
  dconf->response_pattern_var = apr_pstrdup(cmd->pool, var);
  if(var[0] == '!' && !var[1]) {
    return apr_psprintf(cmd->pool, "%s: variable name is too short",
                        cmd->directive->directive);
  }
  return NULL;
}

/* QS_SetEnv */
const char *qos_setenv_cmd(cmd_parms *cmd, void *dcfg, const char *variable,
                           const char *value) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  if(!variable[0] || !value[0]) {
    return apr_psprintf(cmd->pool, "%s: invalid parameter",
                        cmd->directive->directive);
  }
  if(strchr(variable, '=')) {
    return apr_psprintf(cmd->pool, "%s: variable must not contain a '='",
                        cmd->directive->directive);
  }
  apr_table_set(sconf->setenv_t, apr_pstrcat(cmd->pool, variable, "=", value, NULL), variable);
  return NULL;
}

/* QS_SetReqHeader */
const char *qos_setreqheader_cmd(cmd_parms *cmd, void *dcfg, const char *header,
                                 const char *variable, const char *late) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);

  if(!variable[0] || !header[0]) {
    return apr_psprintf(cmd->pool, "%s: invalid parameter",
                        cmd->directive->directive);
  }
  if(header[0] == '!' && !header[1]) {
    return apr_psprintf(cmd->pool, "%s: header name is too short",
                        cmd->directive->directive);
  }
  if(strchr(header, '=')) {
    return apr_psprintf(cmd->pool, "%s: header name must not contain a '='",
                        cmd->directive->directive);
  }
  if(late != NULL) {
    if(strcasecmp(late, "late") != 0) {
      return apr_psprintf(cmd->pool, "%s: third parameter can only be 'late'",
                          cmd->directive->directive);
    }
    apr_table_set(sconf->setreqheaderlate_t, 
                  apr_pstrcat(cmd->pool, header, "=", variable, NULL), header);
  } else {
    apr_table_set(sconf->setreqheader_t, 
                  apr_pstrcat(cmd->pool, header, "=", variable, NULL), header);
  }
  return NULL;
}

/* QS_UnsetReqHeader */
const char *qos_unsetreqheader_cmd(cmd_parms *cmd, void *dcfg, const char *header) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  apr_table_set(sconf->unsetreqheader_t, header, "");
  return NULL;
}

/* QS_UnsetResHeader */
const char *qos_unsetresheader_cmd(cmd_parms *cmd, void *dcfg, const char *header) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  apr_table_set(sconf->unsetresheader_t, header, "");
  return NULL;
}

const char *qos_event_setenvresheader_cmd(cmd_parms *cmd, void *dcfg, const char *hdr,
                                          const char *action) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  apr_table_set(sconf->setenvresheader_t, hdr, action == NULL ? "" : action);
  return NULL;
}

const char *qos_event_setenvresheadermatch_cmd(cmd_parms *cmd, void *dcfg, const char *hdr,
                                               const char *pcres) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  ap_regex_t *preg = ap_pregcomp(cmd->pool, pcres, AP_REG_DOTALL | AP_REG_ICASE);
  if(preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: could not compile regular expression '%s'",
                        cmd->directive->directive, pcres);
  }
  apr_table_setn(sconf->setenvresheadermatch_t, apr_pstrdup(cmd->pool, hdr), (char *)preg);
  return NULL;
}

const char *qos_redirectif_cmd(cmd_parms *cmd, void *dcfg, const char *var,
                               const char *pattern, const char *url) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  qos_redirectif_entry_t *new;
  if(cmd->path) {
    new = apr_array_push(dconf->redirectif);
  } else {
    new = apr_array_push(sconf->redirectif);
  }
  new->name = apr_pstrdup(cmd->pool, var);
  new->preg = ap_pregcomp(cmd->pool, pattern, (AP_REG_EXTENDED | AP_REG_ICASE));
  if(new->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: could not compile regular expression %s",
                        cmd->directive->directive, pattern);
  }
  if(strncasecmp(url, "307:", 4) == 0) {
    new->code = HTTP_TEMPORARY_REDIRECT;
    new->url = apr_pstrdup(cmd->pool, &url[4]);
  } else if(strncasecmp(url, "301:", 4) == 0) {
    new->code = HTTP_MOVED_PERMANENTLY;
    new->url = apr_pstrdup(cmd->pool, &url[4]);
  } else if(strncasecmp(url, "302:", 4) == 0) {
    new->code = HTTP_MOVED_TEMPORARILY;
    new->url = apr_pstrdup(cmd->pool, &url[4]);
  } else {
    new->code = HTTP_MOVED_TEMPORARILY;
    new->url = apr_pstrdup(cmd->pool, url);
  }
  return NULL;
}

const char *qos_setenvres_cmd(cmd_parms *cmd, void *dcfg, const char *var,
                              const char *pattern, const char *var2) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_pregval_t *pregval = apr_pcalloc(cmd->pool, sizeof(qos_pregval_t));
  pregval->name = apr_pstrdup(cmd->pool, var2);
  pregval->value = strchr(pregval->name, '=');
  if(pregval->value) {
    pregval->value[0] = '\0';
    pregval->value++;
  }
  pregval->preg = ap_pregcomp(cmd->pool, pattern, AP_REG_EXTENDED);
  if(pregval->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: could not compile regular expression '%s'",
                        cmd->directive->directive, pattern);
  }
  apr_table_addn(sconf->setenvres_t, apr_pstrdup(cmd->pool, var), (char *)pregval);
  return NULL;
}

/** QS_SetEnvIf */
const char *qos_event_setenvif_cmd(cmd_parms *cmd, void *dcfg, const char *v1, const char *v2,
                                   const char *a3) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_setenvif_t *setenvif;
  if(cmd->path) {
    qos_dir_config *dconf = (qos_dir_config*)dcfg;
    setenvif = apr_array_push(dconf->setenvif_t);
  } else {
    setenvif = apr_array_push(sconf->setenvif_t);
  }

  if(a3) {
    // mode 1 (boolean AND operator)
    setenvif->variable1 = apr_pstrdup(cmd->pool, v1);
    setenvif->variable2 = apr_pstrdup(cmd->pool, v2);
    setenvif->preg = NULL;
    setenvif->name = apr_pstrdup(cmd->pool, a3);
    setenvif->value = strchr(setenvif->name, '=');
    if(setenvif->value == NULL) {
      if(setenvif->name[0] == '!') {
        setenvif->value = apr_pstrdup(cmd->pool, "");
      } else {
        return apr_psprintf(cmd->pool, "%s: new variable must have the format <name>=<value>",
                            cmd->directive->directive);
      }
    } else {
      setenvif->value[0] = '\0';
      setenvif->value++;
    }
  } else {
    // mode 2 (pattern match)
    char *pattern;
    setenvif->variable1 = apr_pstrdup(cmd->pool, v1);
    pattern = strchr(setenvif->variable1, '=');
    if(pattern == NULL) {
        return apr_psprintf(cmd->pool, "%s: missing pattern for variable1",
                            cmd->directive->directive);
    }
    pattern[0] = '\0';
    pattern++;
    setenvif->variable2 = NULL;
    setenvif->preg = ap_pregcomp(cmd->pool, pattern, AP_REG_EXTENDED);
    if(setenvif->preg == NULL) {
      return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                          cmd->directive->directive, pattern);
    }
    setenvif->name = apr_pstrdup(cmd->pool, v2);
    setenvif->value = strchr(setenvif->name, '=');
    if(setenvif->value == NULL) {
      if(setenvif->name[0] == '!') {
        setenvif->value = apr_pstrdup(cmd->pool, "");
      } else {
        return apr_psprintf(cmd->pool, "%s: new variable must have the format <name>=<value>",
                            cmd->directive->directive);
      }
    } else {
      setenvif->value[0] = '\0';
      setenvif->value++;
    }
  }
  return NULL;
}

/** QS_SetEnvIfCmp */
const char *qos_cmp_cmd(cmd_parms *cmd, void *dcfg, int argc, char *const argv[]) {
  qos_cmp_entry_t *new;
  qos_dir_config *conf = dcfg;
  char *del;
  if(argc != 4) {
    return apr_psprintf(cmd->pool, "%s: requires 4 arguments",
                        cmd->directive->directive);
  }
  new = apr_array_push(conf->setenvcmp);
  new->left = apr_pstrdup(cmd->pool, argv[0]);
  if(strcasecmp(argv[1], "eq") == 0) {
    new->cmp = QS_CMP_EQ;
  } else if(strcasecmp(argv[1], "ne") == 0) {
    new->cmp = QS_CMP_NE;
  } else if(strcasecmp(argv[1], "lt") == 0) {
    new->cmp = QS_CMP_LT;
  } else if(strcasecmp(argv[1], "gt") == 0) {
    new->cmp = QS_CMP_GT;
  } else {
    return apr_psprintf(cmd->pool, "%s: invalid operator '%s",
                        cmd->directive->directive, argv[1]);
  }
  new->right = apr_pstrdup(cmd->pool, argv[2]);
  new->variable = apr_pstrdup(cmd->pool, argv[3]);
  del = strchr(new->variable, '=');
  if(del) {
    new->value = &del[1];
    del[0] = '\0';
  } else {
    new->value = apr_pstrdup(cmd->pool, "");
  }
  return NULL;
}

/** QS_SetEnvIfQuery */
const char *qos_event_setenvifquery_cmd(cmd_parms *cmd, void *dcfg, const char *rx, const char *v) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_setenvifquery_t *setenvif = apr_pcalloc(cmd->pool, sizeof(qos_setenvifquery_t));
  char *p;
  setenvif->preg = ap_pregcomp(cmd->pool, rx, AP_REG_EXTENDED);
  if(setenvif->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                        cmd->directive->directive, rx);
  }
  if(strlen(v) < 2) {
    return apr_psprintf(cmd->pool, "%s: variable name is too short (%s)",
                        cmd->directive->directive, v);
  }
  setenvif->name = apr_pstrdup(cmd->pool, v);
  p = strchr(setenvif->name, '=');
  if(p == NULL) {
    setenvif->value = apr_pstrdup(cmd->pool, "");
  } else {
    p[0] = '\0';
    p++;
    setenvif->value = p;
  }
  if(cmd->path) {
    qos_dir_config *dconf = (qos_dir_config*)dcfg;
    apr_table_setn(dconf->setenvifquery_t, apr_pstrdup(cmd->pool, rx), (char *)setenvif);
  } else {
    apr_table_setn(sconf->setenvifquery_t, apr_pstrdup(cmd->pool, rx), (char *)setenvif);
  }
  return NULL;
}

const char *qos_event_setenvifparpbody_cmd(cmd_parms *cmd, void *dcfg,
                                           const char *rx, const char *v) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_setenvifparpbody_t *setenvif = apr_pcalloc(cmd->pool, sizeof(qos_setenvifparpbody_t));
  char *p;
  setenvif->pregx = ap_pregcomp(cmd->pool, rx, AP_REG_DOTALL | AP_REG_EXTENDED | AP_REG_ICASE);
  if(setenvif->pregx == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                        cmd->directive->directive, rx);
  }
  setenvif->name = apr_pstrdup(cmd->pool, v);
  p = strchr(setenvif->name, '=');
  if(p == NULL) {
    setenvif->value = apr_pstrdup(cmd->pool, "");
  } else {
    p[0] = '\0';
    p++;
    setenvif->value = p;
  }
  m_requires_parp = 1;
  apr_table_setn(sconf->setenvifparpbody_t, apr_pstrdup(cmd->pool, rx), (char *)setenvif);
  return NULL;
}

const char *qos_event_setenvifparp_cmd(cmd_parms *cmd, void *dcfg, const char *rx, const char *v) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_setenvifquery_t *setenvif = apr_pcalloc(cmd->pool, sizeof(qos_setenvifquery_t));
  char *p;
  setenvif->preg = ap_pregcomp(cmd->pool, rx, AP_REG_EXTENDED);
  if(setenvif->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                        cmd->directive->directive, rx);
  }
  if(strlen(v) < 2) {
    return apr_psprintf(cmd->pool, "%s: variable name is too short (%s)",
                        cmd->directive->directive, v);
  }
  setenvif->name = apr_pstrdup(cmd->pool, v);
  p = strchr(setenvif->name, '=');
  if(p == NULL) {
    setenvif->value = apr_pstrdup(cmd->pool, "");
  } else {
    p[0] = '\0';
    p++;
    setenvif->value = p;
  }
  m_requires_parp = 1;
  apr_table_setn(sconf->setenvifparp_t, apr_pstrdup(cmd->pool, rx), (char *)setenvif);
  return NULL;
}

/**
 * defines custom error page
 */
const char *qos_error_page_cmd(cmd_parms *cmd, void *dcfg, const char *path) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->error_page = apr_pstrdup(cmd->pool, path);
  if((sconf->error_page[0] != '/') &&
     (strncmp(sconf->error_page, "http", 4) != 0)) {
    return apr_psprintf(cmd->pool, "%s: requires absolute path (%s)", 
                        cmd->directive->directive, sconf->error_page);
  }
  return NULL;
}

#if APR_HAS_THREADS
/**
 * QS_Status
 */
const char *qos_qsstatus_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                  &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->qsstatus = flag;
  return NULL;
}
#endif

/**
 * QS_EventCount
 */
const char *qos_qsevents_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                  &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->qsevents = flag;
  return NULL;
}

/**
 * pipe to global qslog tool (per Apache instance stat)
 */
const char *qos_qlog_cmd(cmd_parms *cmd, void *dcfg, const char *arg) {
  qos_srv_config *sconf = ap_get_module_config(cmd->server->module_config, &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->qslog_str = apr_pstrdup(cmd->pool, arg);
  return NULL;
}

/**
 * global error code setting
 */
const char *qos_error_code_cmd(cmd_parms *cmd, void *dcfg, const char *arg) {
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  int idx500 = ap_index_of_response(HTTP_INTERNAL_SERVER_ERROR);
  if (err != NULL) {
    return err;
  }
  m_retcode = atoi(arg);
  if((m_retcode < 400) || (m_retcode > 599)) {
    return apr_psprintf(cmd->pool, "%s: HTTP response code code must be a"
                        " numeric value between 400 and 599", 
                        cmd->directive->directive);
  }
  if(m_retcode != 500) {
    if(ap_index_of_response(m_retcode) == idx500) {
      return apr_psprintf(cmd->pool, "%s: unsupported HTTP response code", 
                          cmd->directive->directive);
    }
  }
  return NULL;
}

/**
 * global connection close behavior
 */
const char *qos_forced_close_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  m_forced_close = flag;
  return NULL;
}

/** QS_UserTrackingCookieName */

#ifdef AP_TAKE_ARGV
const char *qos_user_tracking_cookie_cmd(cmd_parms *cmd, void *dcfg,
                                         int argc, char *const argv[]) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                  &qos_module);
  int pos = 1;
  if(argc == 0) {
    return apr_psprintf(cmd->pool, "%s: takes 1 to 4 arguments",
                        cmd->directive->directive);
  }
  sconf->user_tracking_cookie = apr_pstrdup(cmd->pool, argv[0]);
  while(pos < argc) {
    const char *value = argv[pos];
    if(value[0] == '/') {
      sconf->user_tracking_cookie_force = apr_pstrdup(cmd->pool, value);
    } else if(strcasecmp(value, "session") == 0) {
      sconf->user_tracking_cookie_session = 1;
    } else if(strcasecmp(value, "jsredirect") == 0) {
      sconf->user_tracking_cookie_jsredirect = 1;
    } else {
      if(sconf->user_tracking_cookie_domain != NULL) {
        return apr_psprintf(cmd->pool, "%s: invalid attribute"
                            " (expects <name>, <path>, 'session', or <domain>",
                            cmd->directive->directive);
      }
      sconf->user_tracking_cookie_domain = apr_pstrdup(cmd->pool, value);      
    }
    pos++;
  }
  return NULL;
}
#else
const char *qos_user_tracking_cookie_cmd(cmd_parms *cmd, void *dcfg,
                                         const char *name,
                                         const char *option1,
                                         const char *option2) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *force = NULL;
  sconf->user_tracking_cookie = apr_pstrdup(cmd->pool, name);
  if(option1) {
    if((strcasecmp(option1, "session") == 0) || 
       (strcasecmp(option1, "'session'") == 0)) {
      sconf->user_tracking_cookie_session = 1;
    } else {
      force = option1;
    }
  }
  if(option2) {
    if((strcasecmp(option2, "session") == 0) || 
       (strcasecmp(option2, "'session'") == 0)) {
      sconf->user_tracking_cookie_session = 1;
    } else {
      if(force == NULL) {
         force = option2;
      }
    }
  }
  if(force) {
    if(force[0] != '/') {
      return apr_psprintf(cmd->pool, "%s: invalid path '%s'", 
                          cmd->directive->directive, force);
    }
    sconf->user_tracking_cookie_force = apr_pstrdup(cmd->pool, force);
  }
  return NULL;
}
#endif

/**
 * session definitions: cookie name and path, expiration/max-age
 */
const char *qos_cookie_name_cmd(cmd_parms *cmd, void *dcfg, const char *name) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->cookie_name = apr_pstrdup(cmd->pool, name);
  return NULL;
}

const char *qos_cookie_path_cmd(cmd_parms *cmd, void *dcfg, const char *path) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->cookie_path = apr_pstrdup(cmd->pool, path);
  return NULL;
}

const char *qos_timeout_cmd(cmd_parms *cmd, void *dcfg, const char *sec) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->max_age = atoi(sec);
  if(sconf->max_age == 0) {
    return apr_psprintf(cmd->pool, "%s: timeout must be numeric value >0", 
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_key_cmd(cmd_parms *cmd, void *dcfg, const char *seed) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->rawKey = (unsigned char *)apr_pstrdup(cmd->pool, seed);
  sconf->rawKeyLen = strlen(seed);
  EVP_BytesToKey(EVP_des_ede3_cbc(), EVP_sha1(), NULL,
                 sconf->rawKey, sconf->rawKeyLen, 1, sconf->key, NULL);
  sconf->keyset = 1;
  return NULL;
}

/**
 * name of the http header to mark a vip
 */
const char *qos_header_name_cmd(cmd_parms *cmd, void *dcfg, const char *n, const char *drop) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  char *name = apr_pstrdup(cmd->pool, n);
  char *p = strchr(name, '=');
  if(p) {
    p[0] = '\0';
    p++;
    sconf->header_name_regex = ap_pregcomp(cmd->pool, p, AP_REG_EXTENDED);
    if(sconf->header_name_regex == NULL) {
      return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                          cmd->directive->directive, p);
    }
  } else {
    sconf->header_name_regex = NULL;
  }
  if(drop && (strcasecmp(drop, "drop") == 0)) {
    sconf->header_name_drop = 1;
  } else {
    sconf->header_name_drop = 0;
  }
  sconf->header_name = name;
  return NULL;
}

const char *qos_ip_header_name_cmd(cmd_parms *cmd, void *dcfg, const char *n, const char *drop) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  char *name = apr_pstrdup(cmd->pool, n);
  char *p = strchr(name, '=');
  if(p) {
    p[0] = '\0';
    p++;
    sconf->ip_header_name_regex = ap_pregcomp(cmd->pool, p, AP_REG_EXTENDED);
    if(sconf->ip_header_name_regex == NULL) {
      return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                          cmd->directive->directive, p);
    }
  } else {
    sconf->ip_header_name_regex = NULL;
  }
  if(drop && (strcasecmp(drop, "drop") == 0)) {
    sconf->ip_header_name_drop = 1;
  } else {
    sconf->ip_header_name_drop = 0;
  }
  sconf->has_qos_cc = 1;
  sconf->ip_header_name = name;
  return NULL;
}

const char *qos_vip_u_cmd(cmd_parms *cmd, void *dcfg) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->vip_user = 1;
  return NULL;
}

const char *qos_vip_ip_u_cmd(cmd_parms *cmd, void *dcfg) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->vip_ip_user = 1;
  return NULL;
}

/**
 * max concurrent connections per server
 */
const char *qos_max_conn_cmd(cmd_parms *cmd, void *dcfg, const char *number) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->has_conn_counter = 1;
  sconf->max_conn = atoi(number);
  if(sconf->max_conn == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  return NULL;
}

/**
 * QS_SrvMaxConnClose, disable keep-alive
 */
const char *qos_max_conn_close_cmd(cmd_parms *cmd, void *dcfg, const char *number) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  char *n = apr_pstrdup(cmd->temp_pool, number);
  sconf->has_conn_counter = 1;
  if((strlen(n) > 1) &&
     (n[strlen(n)-1] == '%')) {
    n[strlen(n)-1] = '\0';
    sconf->max_conn_close = atoi(n);
    sconf->max_conn_close_percent = sconf->max_conn_close;
    if(sconf->max_conn_close > 99) {
      return apr_psprintf(cmd->pool, "%s: number must be a percentage <100", 
                          cmd->directive->directive);
    }
  } else {
    sconf->max_conn_close = atoi(n);
    sconf->max_conn_close_percent = 0;
  }
  if(sconf->max_conn_close == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be >0", 
                        cmd->directive->directive);
  }
  return NULL;
}

/**
 * max concurrent connections per client ip
 */
const char *qos_max_conn_ip_cmd(cmd_parms *cmd, void *dcfg, const char *number,
                                const char *connections) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->has_conn_counter = 1;
  sconf->max_conn_per_ip = atoi(number);
  if(sconf->max_conn_per_ip == 0) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                        cmd->directive->directive);
  }
  if(connections) {
    sconf->max_conn_per_ip_connections = atoi(connections);
    if((sconf->max_conn_per_ip_connections == 0) &&
       (strcmp(connections, "0") != 0)) {
      return apr_psprintf(cmd->pool, "%s: number must be numeric value >0", 
                          cmd->directive->directive);
    }
  }
  return NULL;
}

/* QS_SrvMaxConnPerIPIgnoreVIP */
const char *qos_max_conn_ip_vip_off_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->max_conn_per_ip_ignore_vip = flag;
  return NULL;
}

/**
 * QS_SrvSerialize
 */
const char *qos_serialize_cmd(cmd_parms *cmd, void *dcfg, const char * flag,
                              const char *seconds) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  if(strcasecmp(flag, "on") == 0) {
    sconf->serialize = 1;
  } else if(strcasecmp(flag, "off") == 0) {
    sconf->serialize = 0;
  } else {
    return apr_psprintf(cmd->pool, "%s: flag needs to be either 'on' or 'off'",
                        cmd->directive->directive);
  }
  if(seconds) {
    sconf->serializeTMO = atoi(seconds);
    if(sconf->serializeTMO <= 0) {
      return apr_psprintf(cmd->pool, "%s: timeout (seconds) must be a numeric value >0",
                          cmd->directive->directive);
    }
    // n * 50 milliseconds
    sconf->serializeTMO = sconf->serializeTMO * 20;
  }
  return NULL;
}

/**
 * ip address without any limitation
 */
const char *qos_max_conn_ex_cmd(cmd_parms *cmd, void *dcfg, const char *addr) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  if(addr[strlen(addr)-1] == '.') {
    /* address range */
    apr_table_add(sconf->exclude_ip, addr, "r");
  } else if(addr[strlen(addr)-1] == ':') {
    /* address range */
    apr_table_add(sconf->exclude_ip, addr, "r");
  } else {
    /* single ip */
    apr_table_add(sconf->exclude_ip, addr, "s");
  }
  return NULL;
}

const char *qos_req_rate_off_cmd(cmd_parms *cmd, void *dcfg) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->min_rate_off = 1;
  return NULL;
}

/** verify, that the platform supports "%p" in sprintf */
static int qos_sprintfcheck() {
  char buf[128];
  char buf2[128];
  sprintf(buf, "%p", buf);
  sprintf(buf2, "%p", buf2);
  if((strcmp(buf, buf2) == 0) || (strlen(buf) < 4)) {
    /* not okay */
    return 0;
  }
  return 1;
}

const char *qos_req_rate_cmd(cmd_parms *cmd, void *dcfg, const char *sec, const char *secmax) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  if(!qos_sprintfcheck()) {
    return apr_psprintf(cmd->pool, "%s: directive can't be used on this platform",
                        cmd->directive->directive);
  }
  if(sconf->req_rate != -1) {
    return apr_psprintf(cmd->pool, "%s: directive can't be used together with QS_SrvMinDataRate", 
                        cmd->directive->directive);
  }
  sconf->req_rate = atoi(sec);
  if(sconf->req_rate <= 0) {
    return apr_psprintf(cmd->pool, "%s: request rate must be a numeric value >0", 
                        cmd->directive->directive);
  }
  if(secmax) {
    sconf->min_rate_max = atoi(secmax);
    if(sconf->min_rate_max <= sconf->min_rate) {
      return apr_psprintf(cmd->pool, "%s: max. data rate must be a greater than min. value", 
                          cmd->directive->directive);
    }
  }
  return NULL;
}

/* QS_SrvMinDataRateOffEvent */
const char *qos_min_rate_off_cmd(cmd_parms *cmd, void *dcfg, const char *var) {
  apr_table_t *disable_reqrate_events;
  if(cmd->path) {
    qos_dir_config *dconf = (qos_dir_config*)dcfg;
    disable_reqrate_events = dconf->disable_reqrate_events;
  } else {
    qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                  &qos_module);
    disable_reqrate_events = sconf->disable_reqrate_events; 
  }
  if(((var[0] != '+') && (var[0] != '-')) || (strlen(var) < 2)) {
    return apr_psprintf(cmd->pool, "%s: invalid variable (requires +/- prefix)", 
                        cmd->directive->directive);
  }
  apr_table_set(disable_reqrate_events, var, "");
  return NULL;
}

#ifdef AP_TAKE_ARGV
const char *qos_min_rate_cmd(cmd_parms *cmd, void *dcfg, int argc, char *const argv[])
#else
const char *qos_min_rate_cmd(cmd_parms *cmd, void *dcfg, const char *_sec, const char *_secmax)
#endif
{
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  const char *sec = NULL;
  const char *secmax = NULL;
  const char *connections = NULL;
#ifdef AP_TAKE_ARGV
  if(argc == 0) {
    return apr_psprintf(cmd->pool, "%s: takes 1 to 3 arguments",
                        cmd->directive->directive);
  }
  sec = argv[0];
  if(argc > 1) {
    secmax = argv[1];
  }
  if(argc > 2) {
    connections = argv[2];
  }
#else
  sec = _sec;
  secmax = _secmax;
#endif
  if (err != NULL) {
    return err;
  }
  if(!qos_sprintfcheck()) {
    return apr_psprintf(cmd->pool, "%s: directive can't be used on this platform",
                        cmd->directive->directive);
  }
  if(sconf->req_rate != -1) {
    return apr_psprintf(cmd->pool, "%s: directive can't be used together with QS_SrvRequestRate", 
                        cmd->directive->directive);
  }
  sconf->req_rate = atoi(sec);
  sconf->min_rate = sconf->req_rate;
  if(connections) {
    sconf->req_rate_start = atoi(connections);
    if(sconf->req_rate_start <= 0) {
      return apr_psprintf(cmd->pool, "%s: number of connections must be a numeric value >0", 
                          cmd->directive->directive);
    }
  }
  if(sconf->req_rate <= 0) {
    return apr_psprintf(cmd->pool, "%s: minimal data rate must be a numeric value >0", 
                        cmd->directive->directive);
  }
  if(secmax) {
    sconf->min_rate_max = atoi(secmax);
    if(sconf->min_rate_max <= sconf->min_rate) {
      return apr_psprintf(cmd->pool, "%s: max. data rate must be a greater than min. value", 
                          cmd->directive->directive);
    }
  }
  return NULL;
}

/* QS_SrvMinDataRateIgnoreVIP */
const char *qos_min_rate_vip_off_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->req_ignore_vip_rate = flag;
  return NULL;
}

/**
 * generic filter command
 */
const char *qos_deny_cmd(cmd_parms *cmd, void *dcfg,
                         const char *id, const char *action, const char *pcres,
                         qs_rfilter_type_e type, int options) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  qos_rfilter_t *flt = apr_pcalloc(cmd->pool, sizeof(qos_rfilter_t));
  flt->type = type;
  if(((id[0] != '+') && (id[0] != '-')) || (strlen(id) < 2)) {
    return apr_psprintf(cmd->pool, "%s: invalid rule id", 
                        cmd->directive->directive);
  }
  flt->id = apr_pstrdup(cmd->pool, &id[1]);
  if(strcasecmp(action, "log") == 0) {
    flt->action = QS_LOG;
  } else if(strcasecmp(action, "deny") == 0) {
    flt->action = QS_DENY;
  } else {
    return apr_psprintf(cmd->pool, "%s: invalid action", 
                        cmd->directive->directive);
  }
  if(flt->type != QS_DENY_EVENT) {
    flt->preg = ap_pregcomp(cmd->pool, pcres, AP_REG_DOTALL | options);
    if(flt->preg == NULL) {
      return apr_psprintf(cmd->pool, "%s: could not compile regular expression '%s'",
                          cmd->directive->directive,
                          pcres);
    }
  }
  flt->text = apr_pstrdup(cmd->pool, pcres);
  apr_table_setn(dconf->rfilter_table, apr_pstrdup(cmd->pool, id), (char *)flt);
  return NULL;
}
const char *qos_deny_rql_cmd(cmd_parms *cmd, void *dcfg,
                             const char *id, const char *action, const char *pcres) {
  return qos_deny_cmd(cmd, dcfg, id, action, pcres, QS_DENY_REQUEST_LINE, AP_REG_ICASE);
}
const char *qos_deny_path_cmd(cmd_parms *cmd, void *dcfg,
                              const char *id, const char *action, const char *pcres) {
  return qos_deny_cmd(cmd, dcfg, id, action, pcres, QS_DENY_PATH, AP_REG_ICASE);
}
const char *qos_deny_query_cmd(cmd_parms *cmd, void *dcfg,
                               const char *id, const char *action, const char *pcres) {
  return qos_deny_cmd(cmd, dcfg, id, action, pcres, QS_DENY_QUERY, AP_REG_ICASE);
}
const char *qos_deny_event_cmd(cmd_parms *cmd, void *dcfg,
                               const char *id, const char *action, const char *event) {
  return qos_deny_cmd(cmd, dcfg, id, action, event, QS_DENY_EVENT, 0);
}
const char *qos_permit_uri_cmd(cmd_parms *cmd, void *dcfg,
                               const char *id, const char *action, const char *pcres) {
  return qos_deny_cmd(cmd, dcfg, id, action, pcres, QS_PERMIT_URI, 0);
}
const char *qos_deny_urlenc_cmd(cmd_parms *cmd, void *dcfg, const char *mode) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  if(strcasecmp(mode, "log") == 0) {
    dconf->urldecoding = QS_LOG;
  } else if(strcasecmp(mode, "deny") == 0) {
    dconf->urldecoding = QS_DENY;
  } else if(strcasecmp(mode, "off") == 0) {
    dconf->urldecoding = QS_OFF;
  } else {
    return apr_psprintf(cmd->pool, "%s: invalid action", 
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_milestone_tmo_cmd(cmd_parms *cmd, void *dcfg, const char *sec) {
  qos_srv_config *sconf = ap_get_module_config(cmd->server->module_config, &qos_module);
  sconf->milestoneTimeout = atoi(sec);
  if(sconf->milestoneTimeout <= 0) {
    return apr_psprintf(cmd->pool, "%s: timeout must be numeric value >0",
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_milestone_cmd(cmd_parms *cmd, void *dcfg, const char *action,
                              const char *pattern, const char *thinktimestr) {
  qos_srv_config *sconf = ap_get_module_config(cmd->server->module_config, &qos_module);
  qos_milestone_t *ms;
  if(sconf->milestones == NULL) {
    sconf->milestones = apr_array_make(cmd->pool, 100, sizeof(qos_milestone_t));
  }
  ms = apr_array_push(sconf->milestones);
  ms->num = sconf->milestones->nelts - 1;
  if(thinktimestr != NULL) {
    ms->thinktime = atoi(thinktimestr);
    if(ms->thinktime <= 0) {
      return apr_psprintf(cmd->pool, "%s: invalid 'think time' (must be numeric value >0)",
                          cmd->directive->directive);
    }
  } else {
    ms->thinktime = 0;
  }
  ms->preg = ap_pregcomp(cmd->pool, pattern, AP_REG_DOTALL);
  if(ms->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: could not compile regular expression '%s'",
                        cmd->directive->directive, pattern);
  }
  ms->pattern = apr_pstrdup(cmd->pool, pattern);
  if(strcasecmp(action, "deny") == 0) {
    ms->action = QS_DENY;
  } else if(strcasecmp(action, "log") == 0) {
    ms->action = QS_LOG;
  } else {
    return apr_psprintf(cmd->pool, "%s: invalid action %s",
                        cmd->directive->directive, action);
  }
  return NULL;
}

const char *qos_maxpost_cmd(cmd_parms *cmd, void *dcfg, const char *bytes) {
  apr_off_t s;
  char *errp = NULL;
#ifdef ap_http_scheme
  /* Apache 2.2 */
  if(APR_SUCCESS != apr_strtoff(&s, bytes, &errp, 10))
#else
  if((s = apr_atoi64(bytes)) < 0)
#endif
    {
    return "QS_LimitRequestBody argument is not parsable";
  }
  if(s < 0) {
    return "QS_LimitRequestBody requires a non-negative integer";
  }
  if(cmd->path == NULL) {
    /* server */
    qos_srv_config *sconf = ap_get_module_config(cmd->server->module_config, &qos_module);
    sconf->maxpost = s;
  } else {
    /* location */
    qos_dir_config *dconf = (qos_dir_config*)dcfg;
    dconf->maxpost = s;
  }
  return NULL;
}

/* QS_Decoding */
const char *qos_dec_cmd(cmd_parms *cmd, void *dcfg, const char *arg) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
//  if(strcasecmp(arg, "html") == 0) {
//    dconf->dec_mode |= QOS_DEC_MODE_FLAGS_HTML;
//  } else 
  if(strcasecmp(arg, "uni") == 0) {
    dconf->dec_mode |= QOS_DEC_MODE_FLAGS_UNI;
//  } if(strcasecmp(arg, "ansi") == 0) {
//    dconf->dec_mode |= QOS_DEC_MODE_FLAGS_ANSI;
  } else {
    return apr_psprintf(cmd->pool, "%s: unknown decoding '%s'",
                        cmd->directive->directive, arg);
  }
  return NULL;
}

const char *qos_denyinheritoff_cmd(cmd_parms *cmd, void *dcfg) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  dconf->inheritoff = 1;
  return NULL;
}

const char *qos_denybody_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  dconf->bodyfilter_p = flag;
  dconf->bodyfilter_d = flag;
  if(flag) {
    m_requires_parp = 1;
  }
  return NULL;
}

const char *qos_denybody_d_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  dconf->bodyfilter_d = flag;
  if(flag) {
    m_requires_parp = 1;
  }
  return NULL;
}

const char *qos_denybody_p_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  dconf->bodyfilter_p = flag;
  if(flag) {
    m_requires_parp = 1;
  }
  return NULL;
}

/* QS_RequestHeaderFilter enables/disables header filter */
const char *qos_headerfilter_cmd(cmd_parms *cmd, void *dcfg, const char *flag) {
  qs_headerfilter_mode_e headerfilter;
  if(strcasecmp(flag, "on") == 0) {
    headerfilter = QS_HEADERFILTER_ON;
  } else if(strcasecmp(flag, "off") == 0) {
    headerfilter = QS_HEADERFILTER_OFF;
  } else if(strcasecmp(flag, "size") == 0) {
    headerfilter = QS_HEADERFILTER_SIZE_ONLY;
  } else {
    return apr_psprintf(cmd->pool, "%s: invalid argument",
                        cmd->directive->directive);
  }
  if(cmd->path) {
    qos_dir_config *dconf = (qos_dir_config*)dcfg;
    dconf->headerfilter = headerfilter;
  } else {
    qos_srv_config *sconf = ap_get_module_config(cmd->server->module_config, &qos_module);
    sconf->headerfilter = headerfilter;
  }
  return NULL;
}

/* QS_ResponseHeaderFilter */
const char *qos_resheaderfilter_cmd(cmd_parms *cmd, void *dcfg, const char *flag) {
  qos_dir_config *dconf = (qos_dir_config*)dcfg;
  if(strcasecmp(flag, "on") == 0) {
    dconf->resheaderfilter = QS_HEADERFILTER_ON;
  } else if(strcasecmp(flag, "off") == 0) {
    dconf->resheaderfilter = QS_HEADERFILTER_OFF;
  } else if(strcasecmp(flag, "silent") == 0) {
    dconf->resheaderfilter = QS_HEADERFILTER_SILENT;
  } else {
    return apr_psprintf(cmd->pool, "%s: invalid argument",
                        cmd->directive->directive);
  }
  return NULL;
}

/* QS_RequestHeaderFilterRule: set custom header rules (global only)
   name, action, pcre, size */
#ifdef AP_TAKE_ARGV
const char *qos_headerfilter_rule_cmd(cmd_parms *cmd, void *dcfg, int argc, char *const argv[])
#else
const char *qos_headerfilter_rule_cmd(cmd_parms *cmd, void *dcfg, 
                                      const char *header, const char *action,
                                      const char *rule)
#endif
  {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_fhlt_r_t *he;
#ifdef AP_TAKE_ARGV
  const char *header;
  const char *rule;
  const char *action;
#endif
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
#ifdef AP_TAKE_ARGV
  if(argc != 4) {
    return apr_psprintf(cmd->pool, "%s: takes 4 arguments",
                        cmd->directive->directive);
  }
#endif
  he = apr_pcalloc(cmd->pool, sizeof(qos_fhlt_r_t));
#ifdef AP_TAKE_ARGV
  header = argv[0];
  action = argv[1];
  rule = argv[2];
  he->size = atoi(argv[3]);
#else
  he->size = 9000;
#endif
  he->text = apr_pstrdup(cmd->pool, rule);
  he->preg = ap_pregcomp(cmd->pool, rule, AP_REG_DOTALL);
  if(strcasecmp(action, "deny") == 0) {
    he->action = QS_FLT_ACTION_DENY;
  } else if(strcasecmp(action, "drop") == 0) {
    he->action = QS_FLT_ACTION_DROP;
  } else {
    return apr_psprintf(cmd->pool, "%s: invalid action %s",
                        cmd->directive->directive, action);
  }
  if(he->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: could not compile regular expression '%s'",
                        cmd->directive->directive, rule);
  }
  if(he->size <= 0) {
    return apr_psprintf(cmd->pool, "%s: size must be numeric value >0",
                        cmd->directive->directive);
  }
  apr_table_setn(sconf->hfilter_table, apr_pstrdup(cmd->pool, header), (char *)he);
  return NULL;
}

const char *qos_resheaderfilter_rule_cmd(cmd_parms *cmd, void *dcfg, 
                                         const char *header,
                                         const char *rule, const char *size) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  qos_fhlt_r_t *he;
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  he = apr_pcalloc(cmd->pool, sizeof(qos_fhlt_r_t));
  he->size = atoi(size);
  he->text = apr_pstrdup(cmd->pool, rule);
  he->preg = ap_pregcomp(cmd->pool, rule, AP_REG_DOTALL);
  he->action = QS_FLT_ACTION_DROP;
  if(he->preg == NULL) {
    return apr_psprintf(cmd->pool, "%s: could not compile regular expression '%s'",
                        cmd->directive->directive, rule);
  }
  if(he->size <= 0) {
    return apr_psprintf(cmd->pool, "%s: size must be numeric value >0",
                        cmd->directive->directive);
  }
  apr_table_setn(sconf->reshfilter_table, apr_pstrdup(cmd->pool, header), (char *)he);
  return NULL;  
}

const char *qos_geodb_cmd(cmd_parms *cmd, void *dcfg, const char *arg1) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  char *msg = NULL;
  int errors = 0;
  qos_geo_t *geodb = apr_pcalloc(cmd->pool, sizeof(qos_geo_t));
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  
  sconf->geodb = geodb;
  sconf->geodb->data = NULL;
  sconf->geodb->path = ap_server_root_relative(cmd->pool, arg1);
  sconf->geodb->size = 0;

  if(qos_loadgeo(cmd->pool, sconf->geodb, &msg, &errors) != APR_SUCCESS) {
    return apr_psprintf(cmd->pool, "%s: failed to load the database: %s"
                        " (total %d errors)",
                        cmd->directive->directive,
                        msg ? msg : "-",
                        errors);
  }

  return NULL;
}

const char *qos_geopriv_cmd(cmd_parms *cmd, void *dcfg, const char *list, const char *con,
                            const char *excludeUnknown) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  char *next = apr_pstrdup(cmd->pool, list);
  int geo_limit;
  char *name;
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  name = apr_strtok(next, ",", &next);
  if(name == NULL) {
    return apr_psprintf(cmd->pool, "%s: empty list",
                        cmd->directive->directive);
  }
  while(name) {
    apr_table_set(sconf->geo_priv, name, "");
    name = apr_strtok(NULL, ",", &next);
  }
  geo_limit = atoi(con);
  if(geo_limit <= 0 && con[0] != '0' && con[1] != '\0') {
    return apr_psprintf(cmd->pool, "%s: invalid connection number",
                        cmd->directive->directive);
  }
  if(sconf->geo_limit != -1 && sconf->geo_limit != geo_limit) {
    return apr_psprintf(cmd->pool, "%s: already configured with a different limitation",
                        cmd->directive->directive);
  }
  if(excludeUnknown != NULL) {
    if(strcasecmp(excludeUnknown, excludeUnknown) != 0) {
      return apr_psprintf(cmd->pool, "%s: invalid argument %s",
                          cmd->directive->directive, excludeUnknown);
    }
    sconf->geo_excludeUnknown = 1;
  }
  sconf->geo_limit = geo_limit;
  return NULL;
}

const char *qos_enable_ipv6_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  if(flag) {
    sconf->ip_type = QS_IP_V6;
  } else {
    sconf->ip_type = QS_IP_V4;
  }
  return NULL;
}

const char *qos_client_ex_cmd(cmd_parms *cmd, void *dcfg, const char *addr) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  if(strlen(addr) == 0) {
    return apr_psprintf(cmd->pool, "%s: invalid address", 
                        cmd->directive->directive);
  }
  if(addr[strlen(addr)-1] == '.') {
    /* address range */
    apr_table_add(sconf->cc_exclude_ip, addr, "r");
  } else if(addr[strlen(addr)-1] == ':') {
    /* address range */
    apr_table_add(sconf->cc_exclude_ip, addr, "r");
  } else {
    /* single ip */
    apr_table_add(sconf->cc_exclude_ip, addr, "s");
  }
  return NULL;
}

const char *qos_client_cmd(cmd_parms *cmd, void *dcfg, const char *arg1) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->qos_cc_size = atoi(arg1);
#ifdef QS_INTERNAL_TEST
  sconf->qos_cc_size = sconf->qos_cc_size / 100 * 100 ;
#else
  sconf->qos_cc_size = sconf->qos_cc_size / 640 * 640 ;
#endif
  if(sconf->qos_cc_size < 50000) {
    m_qos_cc_partition = 2;
  }
  if(sconf->qos_cc_size >= 100000) {
    m_qos_cc_partition = 8;
  }
  if(sconf->qos_cc_size >= 500000) {
    m_qos_cc_partition = 16;
  }
  if(sconf->qos_cc_size >= 1000000) {
    m_qos_cc_partition = 32;
  }
  if(sconf->qos_cc_size >= 4000000) {
    m_qos_cc_partition = 64;
  }
  if(sconf->qos_cc_size <= 0 || sconf->qos_cc_size > 10000000) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value gearter than 640"
                        " and less than 10000000", 
                        cmd->directive->directive);
  }
  return NULL;
}

#ifdef AP_TAKE_ARGV
const char *qos_client_pref_cmd(cmd_parms *cmd, void *dcfg, int argc, char *const argv[])
#else
const char *qos_client_pref_cmd(cmd_parms *cmd, void *dcfg)
#endif
  {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->has_qos_cc = 1;
  sconf->qos_cc_prefer = 80;
#ifdef AP_TAKE_ARGV
  if(argc) {
    char *copy = apr_pstrdup(cmd->pool, argv[0]); 
    char *p = strchr(copy, '%');
    if(p) {
      p[0] = '\0';
    }
    sconf->qos_cc_prefer = atoi(copy);
  }
#endif
  if((sconf->qos_cc_prefer < 1) || (sconf->qos_cc_prefer > 99)) {
    return apr_psprintf(cmd->pool, "%s: percentage must be a numeric value"
                        " between 1 and 99",
                        cmd->directive->directive);
  }
#ifdef AP_TAKE_ARGV
  if(argc > 1) {
    return apr_psprintf(cmd->pool, "%s: command takes not more than one argument",
                        cmd->directive->directive);
  }
#endif
  return NULL;
}

const char *qos_client_block_cmd(cmd_parms *cmd, void *dcfg, const char *arg1,
                                 const char *arg2) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->has_qos_cc = 1;
  sconf->qos_cc_block = atoi(arg1);
  if((sconf->qos_cc_block < 0) || sconf->qos_cc_block >= (USHRT_MAX-1) || ((sconf->qos_cc_block == 0) && (strcmp(arg1, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0 and <%d.", 
                        cmd->directive->directive, USHRT_MAX-1);
  }
  if(arg2) {
    sconf->qos_cc_blockTime = atoi(arg2);
  }
  if(sconf->qos_cc_blockTime == 0) {
    return apr_psprintf(cmd->pool, "%s: time must be numeric value >0", 
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_client_limit_int_cmd(cmd_parms *cmd, void *dcfg, const char *arg_number,
                                     const char *arg_sec, const char *arg_varname,
                                     const char *arg_condition) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  char *limit_name = QS_LIMIT_DEFAULT;
  int limit;
  time_t limitTime = 600;
  qos_s_entry_limit_conf_t *entry = apr_pcalloc(cmd->pool, sizeof(qos_s_entry_limit_conf_t));
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->has_qos_cc = 1;
  limit = atoi(arg_number);
  if((limit < 0) || limit >= (USHRT_MAX-1) || ((limit == 0) && (strcmp(arg_number, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0 and <%d.", 
                        cmd->directive->directive, USHRT_MAX-1);
  }
  if(arg_sec) {
    limitTime = atoi(arg_sec);
  }
  if(limitTime == 0) {
    return apr_psprintf(cmd->pool, "%s: time must be numeric value >0", 
                        cmd->directive->directive);
  }
  if(arg_varname) {
    limit_name = apr_pstrdup(cmd->pool, arg_varname);
  }
  entry->limit = limit;
  entry->limitTime = limitTime;
  entry->condStr = NULL;
  entry->preg = NULL;
  if(arg_condition) {
    entry->condStr = apr_pstrdup(cmd->pool, arg_condition);
    entry->preg = ap_pregcomp(cmd->pool, entry->condStr, AP_REG_EXTENDED);
    if(entry->preg == NULL) {
      return apr_psprintf(cmd->pool, "%s: failed to compile regex (%s)",
                          cmd->directive->directive, entry->condStr);
    }
  }
  if(apr_table_get(sconf->qos_cc_limitTable, limit_name) != NULL) {
      return apr_psprintf(cmd->pool, "%s: variable %s has already been used by"
                          " another QS_[Cond]ClientEventLimitCount directive",
                          cmd->directive->directive, limit_name);    
  }
  apr_table_setn(sconf->qos_cc_limitTable, limit_name, (char *)entry);
  return NULL;
}

/* QS_ClientEventLimitCount <number> <seconds> <variable> */
const char *qos_client_limit_cmd(cmd_parms *cmd, void *dcfg, const char *arg_number,
                                 const char *arg_sec, const char *arg_varname) {
  return qos_client_limit_int_cmd(cmd, dcfg, arg_number, arg_sec, arg_varname, NULL);
}

#ifdef AP_TAKE_ARGV
/* QS_CondClientEventLimitCount <number> <seconds> <variable> <pattern> */
const char *qos_cond_client_limit_cmd(cmd_parms *cmd, void *dcfg, int argc, char *const argv[]) {
  if(argc != 4) {
    return apr_psprintf(cmd->pool, "%s: takes 4 arguments",
                        cmd->directive->directive);
  }
  return qos_client_limit_int_cmd(cmd, dcfg, argv[0], argv[1], argv[2], argv[3]);
}
#endif

const char *qos_client_forwardedfor_cmd(cmd_parms *cmd, void *dcfg, const char *header) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->qos_cc_forwardedfor = apr_pstrdup(cmd->pool, header);
  return NULL;
}

const char *qos_client_serial_cmd(cmd_parms *cmd, void *dcfg) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->has_qos_cc = 1;
  sconf->qos_cc_serialize = 1;
  return NULL;
}

const char *qos_req_rate_tm_cmd(cmd_parms *cmd, void *dcfg, const char *arg1) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->qs_req_rate_tm= atoi(arg1);
  if(sconf->qs_req_rate_tm < 2) {
    return apr_psprintf(cmd->pool, "%s: must be numeric value between >1",
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_client_tolerance_cmd(cmd_parms *cmd, void *dcfg, const char *arg1) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  char *value = apr_pstrdup(cmd->pool, arg1);
  char *p = strchr(value, '%');
  if(p) {
    p[0] = '\0';
  }
  if (err != NULL) {
    return err;
  }
  sconf->cc_tolerance = atoi(value);
  if(sconf->cc_tolerance < 5 || sconf->cc_tolerance > 80) {
    return apr_psprintf(cmd->pool, "%s: must be numeric value between 5 and 80",
                        cmd->directive->directive);
  }
  return NULL;
}

#ifdef AP_TAKE_ARGV
const char *qos_client_contenttype(cmd_parms *cmd, void *dcfg, int argc, char *const argv[]) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  if(argc != 5) {
    return apr_psprintf(cmd->pool, "%s: requires five arguments",
                        cmd->directive->directive);
  }
  sconf->static_on = 1;
  sconf->static_html = atol(argv[0]);
  sconf->static_cssjs = atol(argv[1]);
  sconf->static_img = atol(argv[2]);
  sconf->static_other = atol(argv[3]);
  sconf->static_notmodified = atol(argv[4]);
  if(sconf->static_html == 0 ||
     sconf->static_cssjs == 0 ||
     sconf->static_img == 0 ||
     sconf->static_other == 0 ||
     sconf->static_notmodified == 0) {
    return apr_psprintf(cmd->pool, "%s: requires numeric values greater than 0",
                        cmd->directive->directive);
  } else {
    unsigned long long s_all = sconf->static_html + sconf->static_img + sconf->static_cssjs + 
      sconf->static_other + sconf->static_notmodified;
    unsigned long long s_2html = 100 * sconf->static_html / s_all;
    unsigned long long s_2cssjs = 100 * sconf->static_cssjs / s_all;
    unsigned long long s_2img = 100 * sconf->static_img / s_all;
    unsigned long long s_2other = 100 * sconf->static_other / s_all;
    unsigned long long s_2notmodified = 100 * sconf->static_notmodified / s_all;
    sconf->static_html = s_2html;
    sconf->static_cssjs = s_2cssjs;
    sconf->static_img = s_2img;
    sconf->static_other = s_2other;
    sconf->static_notmodified = s_2notmodified;
  }
  return NULL;
}
#endif

const char *qos_client_event_cmd(cmd_parms *cmd, void *dcfg, const char *arg1) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->has_qos_cc = 1;
  sconf->qos_cc_event = atoi(arg1);
  if((sconf->qos_cc_event < 0) || ((sconf->qos_cc_event == 0) && (strcmp(arg1, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0", 
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_client_event_req_cmd(cmd_parms *cmd, void *dcfg, const char *arg1) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
  if (err != NULL) {
    return err;
  }
  sconf->has_qos_cc = 1;
  sconf->qos_cc_event_req = atoi(arg1);
  if((sconf->qos_cc_event_req < 0) || ((sconf->qos_cc_event_req == 0) && (strcmp(arg1, "0") != 0))) {
    return apr_psprintf(cmd->pool, "%s: number must be numeric value >=0", 
                        cmd->directive->directive);
  }
  return NULL;
}

const char *qos_disable_handler_cmd(cmd_parms *cmd, void *dcfg, int flag) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  sconf->disable_handler = flag;
  return NULL;
}

#ifdef QS_INTERNAL_TEST
const char *qos_disable_int_ip_cmd(cmd_parms *cmd, void *dcfg, const char *arg) {
  qos_srv_config *sconf = (qos_srv_config*)ap_get_module_config(cmd->server->module_config,
                                                                &qos_module);
  if(strcasecmp(arg, "off") == 0 ) {
    sconf->enable_testip = 0;
  } else if(strcasecmp(arg, "on") == 0 ) {
    sconf->enable_testip = 1;
  } else {
    sconf->enable_testip = 1;
    m_qs_sim_ip_len = atoi(arg);
    if(m_qs_sim_ip_len == 0) {
      return apr_psprintf(cmd->pool, "%s: must be on/off or the number of IPs", 
                          cmd->directive->directive);
    }
  }
  return NULL;
}
#endif

static const command_rec qos_config_cmds[] = {
  /* request limitation per location */
  AP_INIT_TAKE1("QS_LocRequestLimitDefault", qos_loc_con_def_cmd, NULL,
                RSRC_CONF,
                "QS_LocRequestLimitDefault <number>, defines the default for the"
                " QS_LocRequestLimit and QS_LocRequestLimitMatch directive."),

  AP_INIT_TAKE2("QS_LocRequestLimit", qos_loc_con_cmd, NULL,
                RSRC_CONF,
                "QS_LocRequestLimit <location> <number>, defines the maximum number of"
                " concurrent requests allowed to access the specified location. Default is defined by the"
                " QS_LocRequestLimitDefault directive."),

  AP_INIT_TAKE2("QS_LocRequestPerSecLimit", qos_loc_rs_cmd, NULL,
                RSRC_CONF,
                "QS_LocRequestPerSecLimit <location> <number>, defines the allowed"
                " number of requests per second to a location. Requests are limited"
                " by adding a delay to each requests. This directive should be used"
                " in conjunction with QS_LocRequestLimit only."),

  AP_INIT_TAKE2("QS_LocKBytesPerSecLimit", qos_loc_bs_cmd, NULL,
                RSRC_CONF,
                "QS_LocKBytesPerSecLimit <location> <kbytes>, defines the allowed"
                " download bandwidth to the defined kbytes per second. Responses are"
                "slowed by adding a delay to each response (non-linear, bigger files"
                " get longer delay than smaller ones). This directive should be used"
                " in conjunction with QS_LocRequestLimit only."),

  AP_INIT_TAKE2("QS_LocRequestLimitMatch", qos_match_con_cmd, NULL,
                RSRC_CONF,
                "QS_LocRequestLimitMatch <regex> <number>, defines the number of"
                " concurrent requests to the uri (path and query) pattern."
                " Default is defined by the QS_LocRequestLimitDefault directive."),

  AP_INIT_TAKE2("QS_LocRequestPerSecLimitMatch", qos_match_rs_cmd, NULL,
                RSRC_CONF,
                "QS_LocRequestPerSecLimitMatch <regex> <number>, defines the allowed"
                " number of requests per second to the uri (path and query) pattern."
                " Requests are limited by adding a delay to each requests."
                " This directive should be used in conjunction with"
                " QS_LocRequestLimitMatch only."),

  AP_INIT_TAKE2("QS_LocKBytesPerSecLimitMatch", qos_match_bs_cmd, NULL,
                RSRC_CONF,
                "QS_LocKBytesPerSecLimitMatch <regex> <kbytes>, defines the allowed"
                " download bandwidth to the location matching the defined URL (path"
                " and query) pattern. Responses are slowed down"
                " by adding a delay to each response (non-linear, bigger files"
                " get longer delay than smaller ones). This directive should be used"
                " in conjunction with QS_LocRequestLimitMatch only."),

  /* conditional per location */
  AP_INIT_TAKE3("QS_CondLocRequestLimitMatch", qos_cond_match_con_cmd, NULL,
                RSRC_CONF,
                "QS_CondLocRequestLimitMatch <regex> <number> <pattern>, defines the number of"
                " concurrent requests to the uri (path and query) regex."
                " Rule is only enforced if the "QS_COND" variable matches the specified"
                " pattern (regex)."),

  /* event based rules */
  AP_INIT_TAKE2("QS_EventRequestLimit", qos_event_req_cmd, NULL,
                RSRC_CONF,
                "QS_EventRequestLimit <variable>[=<regex>] <number>, defines the"
                " number of concurrent events. Directive works similar to"
                " QS_LocRequestLimit, but counts the requests having the same"
                " environment variable (and optionally matching its value, too)"
                " rather than those that have the same URL pattern."),

  AP_INIT_TAKE2("QS_EventPerSecLimit", qos_event_rs_cmd, NULL,
                RSRC_CONF,
                "QS_EventPerSecLimit [!]<variable> <number>, defines how"
                " often requests may have the defined environment variable"
                " (literal string) set. It measures the occurrences of the defined"
                " environment variable on a request per seconds level and tries to"
                " limit this occurrence to the defined number. It works similar to"
                " as QS_LocRequestPerSecLimit, but counts only the requests with the"
                " specified variable (or without it if the variable name is"
                " prefixed by a '!'). If a request matches multiple events, the"
                " rule with the lowest bandwidth is applied. Events are limited"
                " by adding a delay to each request causing an  event."),
  AP_INIT_TAKE2("QS_EventKBytesPerSecLimit", qos_event_bps_cmd, NULL,
                RSRC_CONF,
                "QS_EventKBytesPerSecLimit [!]<variable> <kbytes>, throttles the"
                " download bandwidth of all requests having the defined"
                " variable set to the defined kbytes per second. Responses are slowed"
                " by adding a delay to each response (non-linear, bigger files get"
                " longer delay than smaller ones). By default, no limitation is active."
                " This directive should be used in conjunction with QS_EventRequestLimit"
                " only (you must use the same variable name for both directives)."),
  AP_INIT_TAKE3("QS_EventLimitCount", qos_event_limit_cmd, NULL,
                RSRC_CONF,
                "QS_EventLimitCount <env-variable> <number> <seconds>,"
                " defines the maximum number of events allowed within the defined"
                " time. Requests are denied when reaching this limitation for the"
                " specified time (blocked at request level)."),
#ifdef AP_TAKE_ARGV
  AP_INIT_TAKE_ARGV("QS_CondEventLimitCount", qos_cond_event_limit_cmd, NULL,
                RSRC_CONF,
                "QS_CondEventLimitCount <env-variable> <number> <seconds> <pattern>,"
                " same as QS_EventLimitCount but blocks requests only if the "QS_COND
                " variable matches the specified pattern (regex)."),
#endif

  /* server / connection limitation */
  AP_INIT_TAKE1("QS_SrvMaxConn", qos_max_conn_cmd, NULL,
                RSRC_CONF,
                "QS_SrvMaxConn <number>, defines the maximum number of concurrent"
                " TCP connections for this server (virtual host)."),

  AP_INIT_TAKE1("QS_SrvMaxConnClose", qos_max_conn_close_cmd, NULL,
                RSRC_CONF,
                "QS_SrvMaxConnClose <number>[%], defines the maximum number of"
                " concurrent TCP connections until the server disables"
                " keep-alive for this server (closes the connection after"
                " each requests. You may specify the number of connections"
                " as a percentage of MaxClients if adding the suffix '%'"
                " to the specified value."),

  AP_INIT_TAKE12("QS_SrvMaxConnPerIP", qos_max_conn_ip_cmd, NULL,
                 RSRC_CONF,
                 "QS_SrvMaxConnPerIP <number> [<connections>], defines the maximum number"
                 " of connections per source IP address for this server (virtual host)."
                 " 'connections' defines the number of busy connections of the server"
                 " (all virtual hosts) to enable this limitation, default is 0."),

  AP_INIT_TAKE1("QS_SrvMaxConnExcludeIP", qos_max_conn_ex_cmd, NULL,
                RSRC_CONF,
                "QS_SrvMaxConnExcludeIP <addr>, excludes an IP address or"
                " address range from being limited."),

  AP_INIT_FLAG("QS_SrvMaxConnPerIPIgnoreVIP", qos_max_conn_ip_vip_off_cmd, NULL,
                RSRC_CONF,
               "QS_SrvMinDataRateIgnoreVIP tells the QS_SrvMaxConnPerIP"
               " directive to ignore (if set to \"on\") the VIP status"
               " of clients. Default is \"off\", which means that"
               " QS_SrvMaxConnPerIP is disabled for VIPs."),

  AP_INIT_TAKE12("QS_SrvSerialize", qos_serialize_cmd, NULL,
               RSRC_CONF,
               "QS_SrvSerialize 'on'|'off' [<seconds>], ensures that not more than one request"
               " having the "QS_SRVSERIALIZE" variable set is processed"
               " at the same time by serializing them (process one after"
               " each other)."),

#if APR_HAS_THREADS
  AP_INIT_NO_ARGS("QS_SrvDataRateOff", qos_req_rate_off_cmd, NULL,
                  RSRC_CONF,
                  "QS_SrvDataRateOff,"
                  " disables the QS_SrvRequestRate and QS_SrvMinDataRate enforcement for"
                  " a virtual host (only port/address based but not for name based"
                  " virtual hosts)."),

  AP_INIT_TAKE12("QS_SrvRequestRate", qos_req_rate_cmd, NULL,
                 RSRC_CONF,
                 "QS_SrvRequestRate <bytes per seconds> [<max bytes per second>],"
                 " defines the minimum upload"
                 " throughput a client must generate. See also QS_SrvMinDataRate."),

#ifdef AP_TAKE_ARGV
  AP_INIT_TAKE_ARGV("QS_SrvMinDataRate", qos_min_rate_cmd, NULL,
                    RSRC_CONF,
                    "QS_SrvMinDataRate <bytes per seconds> [<max bytes per second> [<connections>]],"
                    " defines the minimum upload/download"
                    " throughput a client must generate (the bytes send/received by the client"
                    " per seconds). This bandwidth is measured while transmitting the data"
                    " (request line, header fields, request body, or response data). The"
                    " client connection get closed if the client does not fulfill the"
                    " required data rate and the IP address of the causing client get marked"
                    " in order to be handled with low priority (see the QS_ClientPrefer"
                    " directive)."
                    " The \"max bytes per second\" activates dynamic"
                    " minimum throughput control: The required minimal throughput"
                    " is increased in parallel to the number of concurrent clients"
                    " sending/receiving data. The \"max bytes per second\""
                    " setting is reached when the number of sending/receiving"
                    " clients is equal to the MaxClients setting."
                    " The \"connections\" argument is used to specify the"
                    " number of busy TCP connections a server must have to"
                    " enable this feature (0 by default)."
                    " No limitation is set by default."),
#else
  AP_INIT_TAKE12("QS_SrvMinDataRate", qos_min_rate_cmd, NULL,
                    RSRC_CONF,
                    "QS_SrvMinDataRate <bytes per seconds> [<max bytes per second>],"
                    " defines the minimum upload/download throughput"
                    " a client must generate (the bytes send/received by the client"
                    " per seconds). This bandwidth is measured while transmitting the data"
                    " (request line, header fields, request body, or response data). The"
                    " client connection get closed if the client does not fulfill the"
                    " required data rate and the IP address of the causing client get marked"
                    " in order to be handled with low priority (see the QS_ClientPrefer"
                    " directive)."
                    " The \"max bytes per second\" activates dynamic"
                    " minimum throughput control: The required minimal throughput"
                    " is increased in parallel to the number of concurrent clients"
                    " sending/receiving data. The \"max bytes per second\""
                    " setting is reached when the number of sending/receiving"
                    " clients is equal to the MaxClients setting."
                    " No limitation is set by default."),
#endif // ARGV
  AP_INIT_TAKE1("QS_SrvMinDataRateOffEvent", qos_min_rate_off_cmd, NULL,
                RSRC_CONF|ACCESS_CONF,
                "QS_SrvMinDataRateOffEvent  '+'|'-'<env-variable>,"
                " disables the minimal data rate enfocement (QS_SrvMinDataRate)"
                " for a certain connection if the defined environment variable"
                " has been set. The '+' prefix is used to add a variable"
                " to the configuration while the '-' prefix is used"
                " to remove a variable."),

  AP_INIT_FLAG("QS_SrvMinDataRateIgnoreVIP", qos_min_rate_vip_off_cmd, NULL,
                RSRC_CONF,
               "QS_SrvMinDataRateIgnoreVIP tells the QS_SrvMinDataRate"
               " directive to ignore (if set to \"on\") the VIP status"
               " of clients. Default is \"off\", which means that"
               " QS_SrvMinDataRate is disabled for VIPs."),

#endif // has threads

  AP_INIT_TAKE1("QS_SrvSampleRate", qos_req_rate_tm_cmd, NULL,
                RSRC_CONF,
                "QS_SrvSampleRate <seconds>, defines the sampling rate used"
                " by the QS_SrvMinDataRate directive to measure the"
                " throughput of a connection."),

  /* generic request filter */
  AP_INIT_TAKE3("QS_DenyRequestLine", qos_deny_rql_cmd, NULL,
                ACCESS_CONF,
                "QS_DenyRequestLine '+'|'-'<id> 'log'|'deny' <regular expression>, generic"
                " request line (method, path, query and protocol) filter used"
                " to deny access for requests matching the defined regular expression."
                " '+' adds a new rule while '-' removes a rule for a location."
                " The action is either 'log' (access is granted but rule"
                " match is logged) or 'deny' (access is denied)."),

  AP_INIT_TAKE3("QS_DenyPath", qos_deny_path_cmd, NULL,
                ACCESS_CONF,
                "QS_DenyPath, same as QS_DenyRequestLine but applied to the"
                " path only."),

  AP_INIT_TAKE3("QS_DenyQuery", qos_deny_query_cmd, NULL,
                ACCESS_CONF,
                "QS_DenyQuery, same as QS_DenyRequestLine but applied to the"
                " query only."),

  AP_INIT_TAKE3("QS_DenyEvent", qos_deny_event_cmd, NULL,
                ACCESS_CONF,
                "QS_DenyEvent '+'|'-'<id> 'log'|'deny' [!]<variable>, matches"
                " requests having the defined process"
                " environment variable set (or NOT set if prefixed by a '!')."
                " The action taken for matching rules"
                " is either 'log' (access is granted but the rule match is"
                " logged) or 'deny' (access is denied)."),

  AP_INIT_TAKE3("QS_PermitUri", qos_permit_uri_cmd, NULL,
                ACCESS_CONF,
                "QS_PermitUri, '+'|'-'<id> 'log'|'deny' <regular expression>, generic"
                " request filter applied to the request uri (path and query)."
                " Only requests matching at least one QS_PermitUri pattern are"
                " allowed. If a QS_PermitUri pattern has been defined an the"
                " request does not match any rule, the request is denied albeit of"
                " any server resource availability (allow list). All rules"
                " must define the same action. Regular expression is case sensitive."),

  AP_INIT_FLAG("QS_DenyBody", qos_denybody_cmd, NULL,
               ACCESS_CONF,
               "QS_DenyBody 'on'|'off', enabled body data filter (obsolete)."),

  AP_INIT_FLAG("QS_DenyQueryBody", qos_denybody_d_cmd, NULL,
               ACCESS_CONF,
               "QS_DenyQueryBody 'on'|'off', enabled body data filter for QS_DenyQuery."),

  AP_INIT_FLAG("QS_PermitUriBody", qos_denybody_p_cmd, NULL,
               ACCESS_CONF,
               "QS_PermitUriBody 'on'|'off', enabled body data filter for QS_PermitUriBody."),

  AP_INIT_TAKE1("QS_InvalidUrlEncoding", qos_deny_urlenc_cmd, NULL,
                ACCESS_CONF,
                "QS_InvalidUrlEncoding 'log'|'deny'|'off',"
                " enforces correct URL decoding in conjunction with the"
                " QS_DenyRequestLine, QS_DenyPath, and QS_DenyQuery"
                " directives. Default is \"off\"."),

  AP_INIT_TAKE1("QS_LimitRequestBody", qos_maxpost_cmd, NULL,
                ACCESS_CONF|RSRC_CONF,
                "QS_LimitRequestBody <bytes>, limits the allowed size"
                " of an HTTP request message body."),

  AP_INIT_ITERATE("QS_Decoding", qos_dec_cmd, NULL,
                  ACCESS_CONF,
                  "QS_DenyDecoding 'uni', enabled additional string decoding"
                  " functions which are applied before"
                  " matching QS_Deny* and QS_Permit* directives."
                  " Default is URL decoding (%xx, \\xHH, '+')."),

  AP_INIT_NO_ARGS("QS_DenyInheritanceOff", qos_denyinheritoff_cmd, NULL,
                  ACCESS_CONF,
                  "QS_DenyInheritanceOff, disable inheritance of QS_Deny* and QS_Permit*"
                  " directives to a location."),

  AP_INIT_TAKE1("QS_RequestHeaderFilter", qos_headerfilter_cmd, NULL,
                RSRC_CONF|ACCESS_CONF,
                "QS_RequestHeaderFilter 'on'|'off'|'size', filters request headers by allowing"
                " only these headers which match the request header rules defined by"
                " mod_qos. Request headers which do not conform these definitions"
                " are either dropped or the whole request is denied. Custom"
                " request headers may be added by the QS_RequestHeaderFilterRule"
                " directive. Using the 'size' option, the header field max. size"
                " is verified only (similar to LimitRequestFieldsize but using"
                " individual values for each header type) while the pattern is ignored."),

  AP_INIT_TAKE1("QS_ResponseHeaderFilter", qos_resheaderfilter_cmd, NULL,
                ACCESS_CONF,
                "QS_ResponseHeaderFilter 'on'|'off', filters response headers by allowing"
                " only these headers which match the response header rules defined by"
                " mod_qos. Response headers which do not conform these definitions"
                " are dropped."),

#ifdef AP_TAKE_ARGV
  AP_INIT_TAKE_ARGV("QS_RequestHeaderFilterRule", qos_headerfilter_rule_cmd, NULL,
                    RSRC_CONF,
                    "QS_RequestHeaderFilterRule <header name> 'drop'|'deny' <regular expression>  <size>, used"
                    " to add custom request header filter rules which override the internal"
                    " filter rules of mod_qos."
                    " Directive is allowed in global server context only."),
#else
  AP_INIT_TAKE3("QS_RequestHeaderFilterRule", qos_headerfilter_rule_cmd, NULL,
                    RSRC_CONF,
                    "QS_RequestHeaderFilterRule <header name> 'drop'|'deny' <regular expression>, used"
                    " to add custom request header filter rules which override the internal"
                    " filter rules of mod_qos."
                    " Directive is allowed in global server context only."),
#endif

  AP_INIT_TAKE3("QS_ResponseHeaderFilterRule", qos_resheaderfilter_rule_cmd, NULL,
                RSRC_CONF,
                "QS_ResponseHeaderFilterRule <header name> <regular expression> <size>, used"
                " to add custom response header filter rules which override the internal"
                " filter rules of mod_qos."
                " Directive is allowed in global server context only."),

  /* milestones */
  AP_INIT_TAKE23("QS_MileStone", qos_milestone_cmd, NULL,
                RSRC_CONF,
                "QS_MileStone 'log'|'deny' <pattern> [<thinktime>], defines request line patterns"
                " a client must access in the defined order as they are defined in the"
                " configuration file."),

  AP_INIT_TAKE1("QS_MileStoneTimeout", qos_milestone_tmo_cmd, NULL,
                RSRC_CONF,
                "QS_MileStoneTimeout <seconds>, defines the time in seconds"
                " within a client must reach the next milestone."
                " Default are 3600 seconds."),

  /* session / vip */
  AP_INIT_TAKE1("QS_SessionCookieName", qos_cookie_name_cmd, NULL,
                RSRC_CONF,
                "QS_SessionCookieName <name>, defines a custom session cookie name,"
                " default is "QOS_COOKIE_NAME"."),

  AP_INIT_TAKE1("QS_SessionCookiePath", qos_cookie_path_cmd, NULL,
                RSRC_CONF,
                "QS_SessionCookiePath <path>, defines the cookie path, default is \"/\"."),

  AP_INIT_TAKE1("QS_SessionTimeout", qos_timeout_cmd, NULL,
                RSRC_CONF,
                "QS_SessionTimeout <seconds>, defines the session life time for a VIP."
                " It is only used for session based (cookie) VIP identification (not"
                " for IP based). Default is "QOS_MAX_AGE" seconds."),

  AP_INIT_TAKE1("QS_SessionKey", qos_key_cmd, NULL,
                RSRC_CONF,
                "QS_SessionKey <string>, secret key used for cookie encryption."
                " Used when using the same session cookie for multiple web servers"
                " (load balancing) or sessions should survive a server restart."
                " By default, a random key is used which changes every server restart."),

  AP_INIT_TAKE12("QS_VipHeaderName", qos_header_name_cmd, NULL,
                 RSRC_CONF,
                 "QS_VipHeaderName <name>[=<regex>] [drop], defines an HTTP"
                 " response header which marks a user as a VIP. mod_qos"
                 " creates a session for this user by setting a cookie,"
                 " e.g., after successful user authentication. Tests"
                 " optionally its value against the provided regular"
                 " expression. Specify the action 'drop' if you want mod_qos"
                 " to remove this control header from the HTTP response."),

  AP_INIT_TAKE12("QS_VipIPHeaderName", qos_ip_header_name_cmd, NULL,
                 RSRC_CONF,
                 "QS_VipIPHeaderName <name>[=<regex>] [drop], defines an HTTP"
                 " response header which marks a client source IP address as"
                 " a VIP. Tests optionally its value against the provided"
                 " regular expression."
                 " Specify the action 'drop' if you want mod_qos to remove"
                 " this control header from the HTTP response."),

  AP_INIT_NO_ARGS("QS_VipUser", qos_vip_u_cmd, NULL,
                  RSRC_CONF,
                  "QS_VipUser, creates a VIP session for users which have been"
                  " authenticated by the Apache server, e.g., by the standard"
                  " mod_auth* modules. It works similar to the"
                  " QS_VipHeaderName directive."),

  AP_INIT_NO_ARGS("QS_VipIpUser", qos_vip_ip_u_cmd, NULL,
                  RSRC_CONF,
                  "QS_VipIpUser, marks a source IP address as a VIP if the"
                  " user has been authenticated by the Apache server, e.g."
                  " by the standard mod_auth* modules. It works similar to"
                  " the QS_VipIPHeaderName directive."),

  /* user tracking */
#ifdef AP_TAKE_ARGV
  AP_INIT_TAKE_ARGV("QS_UserTrackingCookieName", qos_user_tracking_cookie_cmd, NULL,
                    RSRC_CONF,
                    "QS_UserTrackingCookieName <name> [<path>] [<domain>] ['session'] ['jsredirect'],"
                    " enables the user tracking cookie by defining a cookie"
                    " name. The \"path\" parameter is an option cookie"
                    " check page which is used to ensure the client accepts"
                    " cookies. The \"domain\" option defines the Domain attriibute"
                    " for the Set-Cookie header. The option \"session\" indicates"
                    " that the cookie shall be a session cookie expiring when the"
                    " user closes it's browser."
                    " User tracking requires mod_unique_id."
                    " This feature is disabled by default."
                    " Ignores QS_LogOnly."),
#else
  AP_INIT_TAKE123("QS_UserTrackingCookieName", qos_user_tracking_cookie_cmd, NULL,
                  RSRC_CONF,
                  "QS_UserTrackingCookieName <name> [<path>] ['session'],"
                  " enables the user tracking cookie by defining a cookie"
                  " name. The \"path\" parameter is an option cookie"
                  " check page which is used to ensure the client accepts"
                  " cookies. The option \"session\" indicates that the"
                  " cookie shall be a session cookie expiring when the"
                  " user closes it's browser."
                  " User tracking requires mod_unique_id."
                  " This feature is disabled by default."
                  " Ignores QS_LogOnly."),
#endif

  /* env vars */
  AP_INIT_TAKE23("QS_SetEnvIf", qos_event_setenvif_cmd, NULL,
                 RSRC_CONF|ACCESS_CONF,
                 "QS_SetEnvIf [!]<variable1>[=<regex>] [[!]<variable2>] [!]<variable=value>,"
                 " sets (or unsets) the 'variable=value' (literal string) if"
                 " variable1 (literal string) AND variable2 (literal string)"
                 " are set in the request environment variable list (not case"
                 " sensitive). This is used to combine multiple variables"
                 " to a new event type. Alternatively, a regular expression"
                 " can be specified for variable1's value and variable2 must be"
                 " omitted in order to simply set a new variable if"
                 " the regular expression matches."),

  AP_INIT_TAKE_ARGV("QS_SetEnvIfCmp", qos_cmp_cmd, NULL,
                    ACCESS_CONF,
                    "QS_SetEnvIfCmpP <env-variable1> eq|ne|gt|lt <env-variable2> [!]<env-variable>[=<value>],"
                    " sets the specified environment variable if the specified env-variables"
                    " are alphabetically or numerical equal (eq), not equal (ne),"
                    " greater (gt), less (lt)."),

  AP_INIT_TAKE2("QS_SetEnvIfQuery", qos_event_setenvifquery_cmd, NULL,
                RSRC_CONF|ACCESS_CONF,
                "QS_SetEnvIfQuery <regex> [!]<variable>[=value],"
                " directive works quite similar to the SetEnvIf directive"
                " of the Apache module mod_setenvif, but the specified regex"
                " is applied against the query string portion of the request"
                " line. The directive recognizes the occurrences of $1..$9"
                " within value and replaces them by the sub-expressions of"
                " the defined regex pattern."),

  AP_INIT_TAKE2("QS_SetEnvIfParp", qos_event_setenvifparp_cmd, NULL,
                RSRC_CONF,
                "QS_SetEnvIfParp <regex> [!]<variable>[=value],"
                " directive parsing the request payload using the Apache module"
                " mod_parp. It matches the request URL query and the HTTP"
                " request message body data as well ('application/x-www-form-urlencoded'," 
                " 'multipart/form-data', and 'multipart/mixed') and sets the defined"
                " process variable (quite similar to the QS_SetEnvIfQuery directive)."
                " The directive recognizes the occurrences of $1..$9 within value"
                " and replaces them by the sub-expressions of the defined regex"
                " pattern. This directive activates mod_parp for every request to"
                " the virtual host. You may deactivate mod_parp for selected requests"
                " using the SetEnvIf directive: unset the variable 'parp' to do so."
                " Important: request message body processing requires that the server"
                " loads the whole request into its memory (at least twice the length"
                " of the message). You should limit the allowed size of the HTTP"
                " request message body using the QS_LimitRequestBody directive"
                " when using QS_SetEnvIfParp!"),

  AP_INIT_TAKE2("QS_SetEnvIfBody", qos_event_setenvifparpbody_cmd, NULL,
                RSRC_CONF,
                "QS_SetEnvIfBody <regex> [!]<variable>[=value],"
                " parses the request body using the Apache module mod_parp."
                " Specify the content types to process using the mod_parp"
                " directive PARP_BodyData and ensure that mod_parp is enabled"
                " using the SetEnvIf directive of the Apache module mod_setenvif." 
                " You should limit the allowed size of HTTP requests message body"
                " using the QS_LimitRequestBody directive when using mod_parp."
                " The directive recognizes the occurrence of $1 within the variable"
                " value and replaces it by the sub-expressions of the defined regex"
                " pattern."),

  AP_INIT_TAKE2("QS_SetEnvStatus", qos_event_setenvifstatus_cmd, NULL,
                RSRC_CONF|ACCESS_CONF,
                "QS_SetEnvStatus (deprecated, use QS_SetEnvIfStatus)"),

  AP_INIT_TAKE2("QS_SetEnvIfStatus", qos_event_setenvifstatus_cmd, NULL,
                RSRC_CONF|ACCESS_CONF,
                "QS_SetEnvIfStatus <status code> <variable>, adds the defined"
                " request environment variable if the HTTP status code matches the"
                " defined value. The value '"QS_CLOSE"' may be used as a special"
                " status code to set a "QS_BLOCK" event in order to handle"
                " connection close events caused by "QS_CLOSE" rules while"
                " the status '"QS_EMPTY_CON"' may be used to mark connections"
                " which are closed before any HTTP request has ever been received."
                " The '"QS_MAXIP"' value may be used to count "QS_BLOCK" events for"
                " connections closed by the "QS_MAXIP" directive."
                " The '"QS_BROKEN_CON"' value may be used to mark clients not"
                " reading the full HTTP response."),

  AP_INIT_TAKE2("QS_SetEnvResBody", qos_event_setenvifresbody_cmd, NULL,
                ACCESS_CONF,
                "QS_SetEnvResBody (deprecated, use QS_SetEnvIfResBody)"),

  AP_INIT_TAKE2("QS_SetEnvIfResBody", qos_event_setenvifresbody_cmd, NULL,
                ACCESS_CONF,
                "QS_SetEnvIfResBody <string> [!]<variable>, adds the defined"
                " request environment variable (e.g. "QS_BLOCK") if the HTTP"
                " response body contains the defined literal string."
                " Supports only one pattern per location."),

  AP_INIT_TAKE2("QS_SetEnv", qos_setenv_cmd, NULL,
                RSRC_CONF,
                "QS_SetEnv <variable> <value>, sets the defined variable"
                " with the value where the value string may contain" 
                " other environment variables surrounded by \"${\" and \"}\"."
                " The variable is only set if all defined variables within"
                " the value can be resolved."),

  AP_INIT_TAKE23("QS_SetReqHeader", qos_setreqheader_cmd, NULL,
                RSRC_CONF,
                "QS_SetReqHeader [!]<header name> <variable> ['late'], sets the defined"
                " HTTP request header to the request if the specified"
                " environment variable is set."),

  AP_INIT_TAKE1("QS_UnsetReqHeader", qos_unsetreqheader_cmd, NULL,
                RSRC_CONF,
                "QS_UnsetReqHeader <header name>, Removes the specified header from the request."),
  
  AP_INIT_TAKE1("QS_UnsetResHeader", qos_unsetresheader_cmd, NULL,
                RSRC_CONF,
                "QS_UnsetResHeader <header name>, Removes the specified header from the response."),

  AP_INIT_TAKE12("QS_SetEnvResHeader", qos_event_setenvresheader_cmd, NULL,
                 RSRC_CONF,
                 "QS_SetEnvResHeader <header name> [drop], sets the defined"
                 " HTTP response header (name and value) to the request environment variables"
                 " Deletes the header if the action 'drop' has been specified."),

  AP_INIT_TAKE2("QS_SetEnvResHeaderMatch", qos_event_setenvresheadermatch_cmd, NULL,
                RSRC_CONF,
                "QS_SetEnvResHeaderMatch <header name> <regex>, sets the defined"
                " HTTP response header (name and value) to the request environment variables"
                " if the specified regular expression matches the header value."),

  AP_INIT_TAKE3("QS_SetEnvRes", qos_setenvres_cmd, NULL,
                RSRC_CONF,
                "QS_SetEnvRes <variable> <regex> <variable2>[=<value>], sets the environment"
                " variable2 if the regular expression matches against the value of"
                " the environment variable. Occurrences of $1..$9 within the value"
                " and replace them by parenthesized subexpressions of the regular expression."),

  AP_INIT_TAKE3("QS_RedirectIf", qos_redirectif_cmd, NULL,
                RSRC_CONF|ACCESS_CONF,
                "QS_RedirectIf <variable> <regex> [<code>:]<url>,"
                " redirects the client to the configured url"
                " if the regular expression matches"
                " the value of the the environment variable."),

  /* client control */
  AP_INIT_TAKE1("QS_ClientEntries", qos_client_cmd, NULL,
                RSRC_CONF,
                "QS_ClientEntries <number>, defines the number of individual"
                " clients managed by mod_qos. Default is 50000."
                " Directive is allowed in global server context only."),

#ifdef AP_TAKE_ARGV
  AP_INIT_TAKE_ARGV("QS_ClientPrefer", qos_client_pref_cmd, NULL,
                    RSRC_CONF,
                    "QS_ClientPrefer [<percent>], prefers known VIP clients"
                    " when server has less than 80% (or the configured value)"
                    " of free TCP connections. Preferred clients"
                    " are VIP clients (or those without any negative penalties),"
                    " see QS_VipHeaderName directive."
                    " Directive is allowed in global server context only."),
#else
  AP_INIT_NO_ARGS("QS_ClientPrefer", qos_client_pref_cmd, NULL,
                  RSRC_CONF,
                  "QS_ClientPrefer, prefers known VIP clients"
                  " when server has less than 80% of free TCP connections."
                  " Preferred clients are VIP clients only,"
                  " see QS_VipHeaderName directive."
                  " Directive is allowed in global server context only."),
#endif

  AP_INIT_TAKE1("QS_ClientTolerance", qos_client_tolerance_cmd, NULL,
                RSRC_CONF,
                "QS_ClientTolerance <percent>, defines the allowed tolerance (variation)"
                " from a \"normal\" client (average) in percent."
                " Default is "QOS_CC_BEHAVIOR_TOLERANCE_STR"%."
                " Directive is allowed in global server context only."),

#ifdef AP_TAKE_ARGV
  AP_INIT_TAKE_ARGV("QS_ClientContentTypes", qos_client_contenttype, NULL,
                    RSRC_CONF,
                    "QS_ClientContentTypes <html> <css/js> <images> <other> <304>,"
                    " defines the distribution of HTTP response content types a client normally"
                    " receives when accessing the server. mod_qos normally learns the average"
                    " behavior automatically by default but you may specify a static configuration"
                    " in order to avoid influences by a high number of abnormal clients."),
#endif

  AP_INIT_TAKE12("QS_ClientEventBlockCount", qos_client_block_cmd, NULL,
                 RSRC_CONF,
                 "QS_ClientEventBlockCount <number> [<seconds>], defines the maximum number"
                 " of "QS_BLOCK" allowed within the defined time (default are 10 minutes)."
                 " Directive is allowed in global server context only."),

  AP_INIT_TAKE1("QS_ClientEventBlockExcludeIP", qos_client_ex_cmd, NULL,
                 RSRC_CONF,
                 "QS_ClientEventBlockExcludeIP <addr>, excludes an IP address or"
                " address range from being limited by QS_ClientEventBlockCount."),

  AP_INIT_TAKE123("QS_ClientEventLimitCount", qos_client_limit_cmd, NULL,
                  RSRC_CONF,
                  "QS_ClientEventLimitCount <number> [<seconds> [<variable>]],"
                  " defines the maximum number"
                  " of the specified environment variable ("QS_LIMIT_DEFAULT" by default)"
                  " allowed within the defined time (default are 10 minutes)."
                  " Directive is allowed in global server context only."),

#ifdef AP_TAKE_ARGV
  AP_INIT_TAKE_ARGV("QS_CondClientEventLimitCount", qos_cond_client_limit_cmd, NULL,
                    RSRC_CONF,
                    "QS_CondClientEventLimitCount <number> <seconds> <variable> <pattern>,"
                    " defines the maximum number"
                    " of the specified environment variable"
                    " allowed within the defined time."
                    " Directive works similar as QS_ClientEventLimitCount but"
                    " requests are only blocked if the "QS_COND" variable matches"
                    " the defined pattern (regex)."
                    " Directive is allowed in global server context only."),
#endif

  AP_INIT_TAKE1("QS_ClientEventPerSecLimit", qos_client_event_cmd, NULL,
                RSRC_CONF,
                "QS_ClientEventPerSecLimit <number>, defines the number"
                " events pro seconds on a per client (source IP) basis."
                " Events are identified by requests having the"
                " "QS_EVENT" variable set."
                " Directive is allowed in global server context only."),

  AP_INIT_TAKE1("QS_ClientEventRequestLimit", qos_client_event_req_cmd, NULL,
                RSRC_CONF,
                "QS_ClientEventRequestLimit <number>, defines the allowed"
                " number of concurrent requests coming from the same client"
                " source IP address"
                " having the QS_EventRequest variable set."
                " Directive is allowed in global server context only."),

  AP_INIT_NO_ARGS("QS_ClientSerialize", qos_client_serial_cmd, NULL,
                  RSRC_CONF,
                  "QS_ClientSerialize, serializes requests having the "QS_SERIALIZE" variable"
                  " set if they are coming from the same IP address."),

  AP_INIT_TAKE1("QS_ClientIpFromHeader", qos_client_forwardedfor_cmd, NULL,
                RSRC_CONF,
                "QS_ClientIpFromHeader <header>, defines a HTTP request header to read"
                " the client's source IP address from (instead of taking the IP address"
                " of the client opening the TCP connection). This may be used for the"
                " QS_ClientEventLimitCount directive and QS_Country variable."),

  /* geo ip */
  AP_INIT_TAKE1("QS_ClientGeoCountryDB", qos_geodb_cmd, NULL,
                RSRC_CONF,
                "QS_ClientGeoCountryDB <path>, path to the geograpical database file."),

  AP_INIT_TAKE23("QS_ClientGeoCountryPriv", qos_geopriv_cmd, NULL,
                RSRC_CONF,
                "QS_ClientGeoCountryPriv <list> <connections> ['excludeUnknown'],"
                 " defines a comma separated list of country codes"
                 " for origin client IP address which are allowed to"
                 " access the server if the number of busy TCP connections reaches"
                 " the defined number of connections while others are denied access."
                 " Clients whose IP can't be mapped to a country code can be excluded"
                 " from the limitation by configuring the 'excludeUnknown' argument."),

  /* error documents */
  AP_INIT_TAKE1("QS_ErrorPage", qos_error_page_cmd, NULL,
                RSRC_CONF,
                "QS_ErrorPage <url>, defines a custom error page."),

  AP_INIT_TAKE1("QS_ErrorResponseCode", qos_error_code_cmd, NULL,
                RSRC_CONF,
                "QS_ErrorResponseCode <code>, defines the HTTP response code which"
                " is used when a request is denied, default is 500."),

  AP_INIT_FLAG("QS_ForcedClose", qos_forced_close_cmd, NULL,
               RSRC_CONF,
               "QS_ForcedClose 'on'|'off', defines if mod_qos connection handler shall"
               " exit with an error code (on) or not. Default is on (except for"
               " Apache 2.4.49)."),

  /* module settings / various stuff */
  AP_INIT_FLAG("QS_LogOnly", qos_logonly_cmd, NULL,
               RSRC_CONF,
               "QS_LogOnly 'on'|'off', enables the log only mode of the module"
               " where no limitations are enforced. Default is off."
               " Directive is allowed in global server context only."),

  AP_INIT_FLAG("QS_LogEnv", qos_logenv_cmd, NULL,
               RSRC_CONF,
               "QS_LogEnv 'on'|'off', enables logging of environment"
               " variables."),

  AP_INIT_FLAG("QS_SupportIPv6", qos_enable_ipv6_cmd, NULL,
               RSRC_CONF,
               "QS_SupportIPv6 'on'|'off', enables IPv6 address support."
               " Default is on."),

  AP_INIT_TAKE1("QS_SemMemFile", qos_mfile_cmd, NULL,
                RSRC_CONF,
                "QS_SemMemFile <path>, optional path to a directory or file"
                " which shall be used for file based semaphores/shared memory"
                " usage, e.g. /var/tmp."),

  AP_INIT_TAKE1("QS_MaxClients", qos_maxclients_cmd, NULL,
                RSRC_CONF,
                "QS_MaxClients <number>, optional override for mod_qos's"
                " MaxClients/MaxRequestWorkers calculation which defines"
                " the maximum number of TCP connections the server can handle."),

  AP_INIT_FLAG("QS_DisableHandler", qos_disable_handler_cmd, NULL,
               RSRC_CONF,
               "QS_DisableHandler 'on'|'off', disables the qos-viewer"
               " and qos-console for a virtual host"),

#if APR_HAS_THREADS
  AP_INIT_FLAG("QS_Status", qos_qsstatus_cmd, NULL,
               RSRC_CONF,
               "QS_Status 'on'|'off', writes a log message containing server"
               " statistics once every minute. Default is off."),
#endif

  AP_INIT_FLAG("QS_EventCount", qos_qsevents_cmd, NULL,
               RSRC_CONF,
               "QS_EventCount 'on'|'off', enables error event counting"
               " (counters are shown in the machine-readable version"
               " of the status viewer). Default is off."),

  AP_INIT_TAKE1("QSLog", qos_qlog_cmd, NULL,
                RSRC_CONF,
                "QSLog <arg>, used to configure a global (per Apache"
                " instance) 'qslog' logger."),

#ifdef QS_INTERNAL_TEST
  AP_INIT_TAKE1("QS_EnableInternalIPSimulation", qos_disable_int_ip_cmd, NULL,
                RSRC_CONF,
                ""),
#endif

  { NULL }
};


/************************************************************************
 * apache register 
 ***********************************************************************/
static void qos_register_hooks(apr_pool_t * p) {
  static const char *pre[] = { "mod_setenvif.c", "mod_setenvifplus.c", "mod_parp.c", NULL };
  static const char *preuid[] = { "mod_setenvif.c", "mod_setenvifplus.c", "mod_parp.c", "mod_unique_id.c", NULL };
  static const char *pressl[] = { "mod_ssl.c", NULL };
  static const char *preconf[] = { "mod_setenvif.c", "mod_setenvifplus.c", "mod_parp.c", "mod_ssl.c", NULL };
  static const char *post[] = { "mod_setenvif.c", "mod_setenvifplus.c", NULL };
  static const char *postlog[] = { "mod_logio.c", NULL };
  static const char *parp[] = { "mod_parp.c", NULL };
  static const char *prelast[] = { "mod_setenvif.c", "mod_setenvifplus.c", "mod_ssl.c", NULL };
  static const char *preFix[] = { "mod_ssl.c", "mod_setenvifplus.c", NULL };
  
  ap_hook_post_config(qos_post_config, preconf, NULL, APR_HOOK_MIDDLE);

  ap_hook_child_init(qos_child_init, NULL, NULL, APR_HOOK_MIDDLE);

  // before ssl_hook_pre_connection@APR_HOOK_MIDDLE but after logio_pre_conn@APR_HOOK_MIDDLE
  ap_hook_pre_connection(qos_pre_connection, postlog, pressl, APR_HOOK_MIDDLE);
  // after ssl_hook_pre_connection@APR_HOOK_MIDDLE (and a many others)
  ap_hook_pre_connection(qos_pre_process_connection, prelast, NULL, APR_HOOK_LAST);

  ap_hook_process_connection(qos_process_connection, NULL, NULL, APR_HOOK_MIDDLE);

  // be before sp_post_read_request@APR_HOOK_MIDDLE
  ap_hook_post_read_request(qos_post_read_request, NULL, post, APR_HOOK_MIDDLE);
  ap_hook_post_read_request(qos_post_read_request_later, preuid, NULL, APR_HOOK_MIDDLE);

  ap_hook_header_parser(qos_header_parser0, NULL, post, APR_HOOK_FIRST);
  ap_hook_header_parser(qos_header_parser1, post, parp, APR_HOOK_FIRST);
  ap_hook_header_parser(qos_header_parser, pre, NULL, APR_HOOK_MIDDLE);

  ap_hook_fixups(qos_fixup, preFix, NULL, APR_HOOK_MIDDLE);

  ap_hook_handler(qos_handler, NULL, NULL, APR_HOOK_MIDDLE);

  ap_hook_log_transaction(qos_logger, NULL, NULL, APR_HOOK_FIRST);
  //ap_hook_error_log(qos_error_log, NULL, NULL, APR_HOOK_LAST);

  ap_register_input_filter("qos-in-filter", qos_in_filter, NULL, AP_FTYPE_CONNECTION);
  ap_register_input_filter("qos-in-filter2", qos_in_filter2, NULL, AP_FTYPE_RESOURCE);
  ap_register_input_filter("qos-in-filter3", qos_in_filter3, NULL, AP_FTYPE_CONTENT_SET);
  /* AP_FTYPE_RESOURCE+1 ensures the filter is executed after mod_setenvifplus
   * AP_FTYPE_PROTOCOL+3 ensures the filter is executed after mod_deflate */
  ap_register_output_filter("qos-out-filter", qos_out_filter, NULL, AP_FTYPE_RESOURCE+1);
  ap_register_output_filter("qos-out-filter-min", qos_out_filter_min, NULL, AP_FTYPE_RESOURCE+1);
  ap_register_output_filter("qos-out-filter-delay", qos_out_filter_delay, NULL, AP_FTYPE_PROTOCOL+3);
  ap_register_output_filter("qos-out-filter-body", qos_out_filter_body, NULL, AP_FTYPE_RESOURCE+1);
  ap_register_output_filter("qos-out-filter-brokencon", qos_out_filter_brokencon, NULL, AP_FTYPE_PROTOCOL+3);
  ap_register_output_filter("qos-out-err-filter", qos_out_err_filter, NULL, AP_FTYPE_RESOURCE+1);

  ap_hook_insert_filter(qos_insert_filter, NULL, NULL, APR_HOOK_MIDDLE);
  ap_hook_insert_error_filter(qos_insert_err_filter, NULL, NULL, APR_HOOK_MIDDLE);

}

/************************************************************************
 * apache module definition 
 ***********************************************************************/
module AP_MODULE_DECLARE_DATA qos_module ={ 
  STANDARD20_MODULE_STUFF,
  qos_dir_config_create,                    /**< dir config creator */
  qos_dir_config_merge,                     /**< dir merger */
  qos_srv_config_create,                    /**< server config */
  qos_srv_config_merge,                     /**< server merger */
  qos_config_cmds,                          /**< command table */
  qos_register_hooks,                       /**< hook registration */
};