Changes with nginx 1.5.10 04 Feb 2014v1.5.10

*) Feature: the ngx_http_spdy_module now uses SPDY 3.1 protocol.
Thanks to Automattic and MaxCDN for sponsoring this work.

*) Feature: the ngx_http_mp4_module now skips tracks too short for a
seek requested.

*) Bugfix: a segmentation fault might occur in a worker process if the
$ssl_session_id variable was used in logs; the bug had appeared in
1.5.9.

*) Bugfix: the $date_local and $date_gmt variables used wrong format
outside of the ngx_http_ssi_filter_module.

*) Bugfix: client connections might be immediately closed if deferred
accept was used; the bug had appeared in 1.3.15.

*) Bugfix: alerts "getsockopt(TCP_FASTOPEN) ... failed" appeared in logs
during binary upgrade on Linux; the bug had appeared in 1.5.8.
Thanks to Piotr Sikora.

20 files changed, 1062 insertions, 206 deletions

diff --git a/CHANGES b/CHANGES
index 5b1678eea..e53487e69 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,27 @@
 
+Changes with nginx 1.5.10                                        04 Feb 2014
+
+    *) Feature: the ngx_http_spdy_module now uses SPDY 3.1 protocol.
+       Thanks to Automattic and MaxCDN for sponsoring this work.
+
+    *) Feature: the ngx_http_mp4_module now skips tracks too short for a
+       seek requested.
+
+    *) Bugfix: a segmentation fault might occur in a worker process if the
+       $ssl_session_id variable was used in logs; the bug had appeared in
+       1.5.9.
+
+    *) Bugfix: the $date_local and $date_gmt variables used wrong format
+       outside of the ngx_http_ssi_filter_module.
+
+    *) Bugfix: client connections might be immediately closed if deferred
+       accept was used; the bug had appeared in 1.3.15.
+
+    *) Bugfix: alerts "getsockopt(TCP_FASTOPEN) ... failed" appeared in logs
+       during binary upgrade on Linux; the bug had appeared in 1.5.8.
+       Thanks to Piotr Sikora.
+
+
 Changes with nginx 1.5.9                                         22 Jan 2014
 
     *) Change: now nginx expects escaped URIs in "X-Accel-Redirect" headers.
diff --git a/CHANGES.ru b/CHANGES.ru
index 580bba300..006b364a5 100644
--- a/CHANGES.ru
+++ b/CHANGES.ru
@@ -1,4 +1,29 @@
 
+Изменения в nginx 1.5.10                                          04.02.2014
+
+    *) Добавление: модуль ngx_http_spdy_module теперь использует протокол
+       SPDY 3.1.
+       Спасибо Automattic и MaxCDN за спонсирование разработки.
+
+    *) Добавление: модуль ngx_http_mp4_module теперь пропускает дорожки,
+       имеющие меньшую длину, чем запрошенная перемотка.
+
+    *) Исправление: в рабочем процессе мог произойти segmentation fault,
+       если переменная $ssl_session_id использовалась при логгировании;
+       ошибка появилась в 1.5.9.
+
+    *) Исправление: переменные $date_local и $date_gmt использовали неверный
+       формат вне модуля ngx_http_ssi_filter_module.
+
+    *) Исправление: клиентские соединения могли сразу закрываться, если
+       использовался отложенный accept; ошибка появилась в 1.3.15.
+
+    *) Исправление: сообщения "getsockopt(TCP_FASTOPEN) ... failed"
+       записывались в лог в процессе обновления исполняемого файла на Linux;
+       ошибка появилась в 1.5.8.
+       Спасибо Piotr Sikora.
+
+
 Изменения в nginx 1.5.9                                           22.01.2014
 
     *) Изменение: теперь в заголовке X-Accel-Redirect nginx ожидает
diff --git a/auto/cc/clang b/auto/cc/clang
index 0cca3442e..baaf4baa2 100644
--- a/auto/cc/clang
+++ b/auto/cc/clang
@@ -89,7 +89,7 @@ CFLAGS="$CFLAGS -Wconditional-uninitialized"
 CFLAGS="$CFLAGS -Wno-unused-parameter"
 
 # stop on warning
-#CFLAGS="$CFLAGS -Werror"
+CFLAGS="$CFLAGS -Werror"
 
 # debug
 CFLAGS="$CFLAGS -g"
diff --git a/src/core/nginx.h b/src/core/nginx.h
index 76d43c6d4..71a71230c 100644
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -9,8 +9,8 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define nginx_version      1005009
-#define NGINX_VERSION      "1.5.9"
+#define nginx_version      1005010
+#define NGINX_VERSION      "1.5.10"
 #define NGINX_VER          "nginx/" NGINX_VERSION
 
 #define NGINX_VAR          "NGINX"
diff --git a/src/core/ngx_connection.c b/src/core/ngx_connection.c
index 08a547d42..15f4f3c90 100644
--- a/src/core/ngx_connection.c
+++ b/src/core/ngx_connection.c
@@ -97,7 +97,7 @@ ngx_set_inherited_sockets(ngx_cycle_t *cycle)
     ngx_uint_t                 i;
     ngx_listening_t           *ls;
     socklen_t                  olen;
-#if (NGX_HAVE_DEFERRED_ACCEPT)
+#if (NGX_HAVE_DEFERRED_ACCEPT || NGX_HAVE_TCP_FASTOPEN)
     ngx_err_t                  err;
 #endif
 #if (NGX_HAVE_DEFERRED_ACCEPT && defined SO_ACCEPTFILTER)
@@ -223,9 +223,13 @@ ngx_set_inherited_sockets(ngx_cycle_t *cycle)
                        (void *) &ls[i].fastopen, &olen)
             == -1)
         {
-            ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno,
-                          "getsockopt(TCP_FASTOPEN) %V failed, ignored",
-                          &ls[i].addr_text);
+            err = ngx_socket_errno;
+
+            if (err != NGX_EOPNOTSUPP && err != NGX_ENOPROTOOPT) {
+                ngx_log_error(NGX_LOG_NOTICE, cycle->log, err,
+                              "getsockopt(TCP_FASTOPEN) %V failed, ignored",
+                              &ls[i].addr_text);
+            }
 
             ls[i].fastopen = -1;
         }
@@ -701,7 +705,13 @@ ngx_configure_listening_sockets(ngx_cycle_t *cycle)
         if (ls[i].add_deferred || ls[i].delete_deferred) {
 
             if (ls[i].add_deferred) {
-                value = (int) (ls[i].post_accept_timeout / 1000);
+                /*
+                 * There is no way to find out how long a connection was
+                 * in queue (and a connection may bypass deferred queue at all
+                 * if syncookies were used), hence we use 1 second timeout
+                 * here.
+                 */
+                value = 1;
 
             } else {
                 value = 0;
diff --git a/src/core/ngx_string.c b/src/core/ngx_string.c
index fe6b1ee71..4e279176c 100644
--- a/src/core/ngx_string.c
+++ b/src/core/ngx_string.c
@@ -11,6 +11,8 @@
 
 static u_char *ngx_sprintf_num(u_char *buf, u_char *last, uint64_t ui64,
     u_char zero, ngx_uint_t hexadecimal, ngx_uint_t width);
+static void ngx_encode_base64_internal(ngx_str_t *dst, ngx_str_t *src,
+    const u_char *basis, ngx_uint_t padding);
 static ngx_int_t ngx_decode_base64_internal(ngx_str_t *dst, ngx_str_t *src,
     const u_char *basis);
 
@@ -1100,38 +1102,61 @@ ngx_hex_dump(u_char *dst, u_char *src, size_t len)
 void
 ngx_encode_base64(ngx_str_t *dst, ngx_str_t *src)
 {
-    u_char         *d, *s;
-    size_t          len;
     static u_char   basis64[] =
             "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
+    ngx_encode_base64_internal(dst, src, basis64, 1);
+}
+
+
+void
+ngx_encode_base64url(ngx_str_t *dst, ngx_str_t *src)
+{
+    static u_char   basis64[] =
+            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+    ngx_encode_base64_internal(dst, src, basis64, 0);
+}
+
+
+static void
+ngx_encode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis,
+    ngx_uint_t padding)
+{
+    u_char         *d, *s;
+    size_t          len;
+
     len = src->len;
     s = src->data;
     d = dst->data;
 
     while (len > 2) {
-        *d++ = basis64[(s[0] >> 2) & 0x3f];
-        *d++ = basis64[((s[0] & 3) << 4) | (s[1] >> 4)];
-        *d++ = basis64[((s[1] & 0x0f) << 2) | (s[2] >> 6)];
-        *d++ = basis64[s[2] & 0x3f];
+        *d++ = basis[(s[0] >> 2) & 0x3f];
+        *d++ = basis[((s[0] & 3) << 4) | (s[1] >> 4)];
+        *d++ = basis[((s[1] & 0x0f) << 2) | (s[2] >> 6)];
+        *d++ = basis[s[2] & 0x3f];
 
         s += 3;
         len -= 3;
     }
 
     if (len) {
-        *d++ = basis64[(s[0] >> 2) & 0x3f];
+        *d++ = basis[(s[0] >> 2) & 0x3f];
 
         if (len == 1) {
-            *d++ = basis64[(s[0] & 3) << 4];
-            *d++ = '=';
+            *d++ = basis[(s[0] & 3) << 4];
+            if (padding) {
+                *d++ = '=';
+            }
 
         } else {
-            *d++ = basis64[((s[0] & 3) << 4) | (s[1] >> 4)];
-            *d++ = basis64[(s[1] & 0x0f) << 2];
+            *d++ = basis[((s[0] & 3) << 4) | (s[1] >> 4)];
+            *d++ = basis[(s[1] & 0x0f) << 2];
         }
 
-        *d++ = '=';
+        if (padding) {
+            *d++ = '=';
+        }
     }
 
     dst->len = d - dst->data;
diff --git a/src/core/ngx_string.h b/src/core/ngx_string.h
index 99bdbda6f..712e7d0bf 100644
--- a/src/core/ngx_string.h
+++ b/src/core/ngx_string.h
@@ -183,6 +183,7 @@ u_char *ngx_hex_dump(u_char *dst, u_char *src, size_t len);
 #define ngx_base64_decoded_length(len)  (((len + 3) / 4) * 3)
 
 void ngx_encode_base64(ngx_str_t *dst, ngx_str_t *src);
+void ngx_encode_base64url(ngx_str_t *dst, ngx_str_t *src);
 ngx_int_t ngx_decode_base64(ngx_str_t *dst, ngx_str_t *src);
 ngx_int_t ngx_decode_base64url(ngx_str_t *dst, ngx_str_t *src);
 
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 9935fb098..cbe4136a1 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -2508,6 +2508,10 @@ ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
     SSL_SESSION  *sess;
 
     sess = SSL_get0_session(c->ssl->connection);
+    if (sess == NULL) {
+        s->len = 0;
+        return NGX_OK;
+    }
 
     buf = sess->session_id;
     len = sess->session_id_length;
diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
index d900fb8d1..c29ab1ce5 100644
--- a/src/http/modules/ngx_http_mp4_module.c
+++ b/src/http/modules/ngx_http_mp4_module.c
@@ -1208,7 +1208,7 @@ ngx_http_mp4_read_mvhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
     u_char                 *atom_header;
     size_t                  atom_size;
     uint32_t                timescale;
-    uint64_t                duration;
+    uint64_t                duration, start_time;
     ngx_buf_t              *atom;
     ngx_mp4_mvhd_atom_t    *mvhd_atom;
     ngx_mp4_mvhd64_atom_t  *mvhd64_atom;
@@ -1251,7 +1251,16 @@ ngx_http_mp4_read_mvhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
                    "mvhd timescale:%uD, duration:%uL, time:%.3fs",
                    timescale, duration, (double) duration / timescale);
 
-    duration -= (uint64_t) mp4->start * timescale / 1000;
+    start_time = (uint64_t) mp4->start * timescale / 1000;
+
+    if (duration < start_time) {
+        ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                      "\"%s\" mp4 start time exceeds file duration",
+                      mp4->file.name.data);
+        return NGX_ERROR;
+    }
+
+    duration -= start_time;
 
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                    "mvhd new duration:%uL, time:%.3fs",
@@ -1398,7 +1407,7 @@ ngx_http_mp4_read_tkhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
 {
     u_char                 *atom_header;
     size_t                  atom_size;
-    uint64_t                duration;
+    uint64_t                duration, start_time;
     ngx_buf_t              *atom;
     ngx_http_mp4_trak_t    *trak;
     ngx_mp4_tkhd_atom_t    *tkhd_atom;
@@ -1438,7 +1447,15 @@ ngx_http_mp4_read_tkhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
                    "tkhd duration:%uL, time:%.3fs",
                    duration, (double) duration / mp4->timescale);
 
-    duration -= (uint64_t) mp4->start * mp4->timescale / 1000;
+    start_time = (uint64_t) mp4->start * mp4->timescale / 1000;
+
+    if (duration < start_time) {
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
+                       "tkhd duration is less than start time");
+        return NGX_DECLINED;
+    }
+
+    duration -= start_time;
 
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                    "tkhd new duration:%uL, time:%.3fs",
@@ -1541,7 +1558,7 @@ ngx_http_mp4_read_mdhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
     u_char                 *atom_header;
     size_t                  atom_size;
     uint32_t                timescale;
-    uint64_t                duration;
+    uint64_t                duration, start_time;
     ngx_buf_t              *atom;
     ngx_http_mp4_trak_t    *trak;
     ngx_mp4_mdhd_atom_t    *mdhd_atom;
@@ -1583,7 +1600,15 @@ ngx_http_mp4_read_mdhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
                    "mdhd timescale:%uD, duration:%uL, time:%.3fs",
                    timescale, duration, (double) duration / timescale);
 
-    duration -= (uint64_t) mp4->start * timescale / 1000;
+    start_time = (uint64_t) mp4->start * timescale / 1000;
+
+    if (duration < start_time) {
+        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
+                       "mdhd duration is less than start time");
+        return NGX_DECLINED;
+    }
+
+    duration -= start_time;
 
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                    "mdhd new duration:%uL, time:%.3fs",
@@ -2153,11 +2178,8 @@ ngx_http_mp4_update_stss_atom(ngx_http_mp4_file_t *mp4,
         entry++;
     }
 
-    ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
-                  "start sample is out of mp4 stss atom in \"%s\"",
-                  mp4->file.name.data);
-
-    return NGX_ERROR;
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
+                   "start sample is out of mp4 stss atom");
 
 found:
 
@@ -2472,7 +2494,7 @@ ngx_http_mp4_update_stsc_atom(ngx_http_mp4_file_t *mp4,
         entry++;
     }
 
-    next_chunk = trak->chunks;
+    next_chunk = trak->chunks + 1;
 
     ngx_log_debug4(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                    "start_sample:%uD, chunk:%uD, chunks:%uD, samples:%uD",
diff --git a/src/http/modules/ngx_http_range_filter_module.c b/src/http/modules/ngx_http_range_filter_module.c
index 82c202d33..6143a8786 100644
--- a/src/http/modules/ngx_http_range_filter_module.c
+++ b/src/http/modules/ngx_http_range_filter_module.c
@@ -22,7 +22,7 @@
  * ... data ...
  *
  *
- * the mutlipart format:
+ * the multipart format:
  *
  * "HTTP/1.0 206 Partial Content" CRLF
  * ... header ...
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
index a53cd1472..aeb1376b7 100644
--- a/src/http/modules/ngx_http_ssi_filter_module.c
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
@@ -213,6 +213,7 @@ static ngx_http_output_body_filter_pt    ngx_http_next_body_filter;
 static u_char ngx_http_ssi_string[] = "<!--";
 
 static ngx_str_t ngx_http_ssi_none = ngx_string("(none)");
+static ngx_str_t ngx_http_ssi_timefmt = ngx_string("%A, %d-%b-%Y %H:%M:%S %Z");
 static ngx_str_t ngx_http_ssi_null_string = ngx_null_string;
 
 
@@ -359,7 +360,7 @@ ngx_http_ssi_header_filter(ngx_http_request_t *r)
     ctx->params.nalloc = NGX_HTTP_SSI_PARAMS_N;
     ctx->params.pool = r->pool;
 
-    ngx_str_set(&ctx->timefmt, "%A, %d-%b-%Y %H:%M:%S %Z");
+    ctx->timefmt = ngx_http_ssi_timefmt;
     ngx_str_set(&ctx->errmsg,
                 "[an error occurred while processing the directive]");
 
@@ -2720,6 +2721,7 @@ ngx_http_ssi_date_gmt_local_variable(ngx_http_request_t *r,
 {
     ngx_http_ssi_ctx_t  *ctx;
     ngx_time_t          *tp;
+    ngx_str_t           *timefmt;
     struct tm            tm;
     char                 buf[NGX_HTTP_SSI_DATE_LEN];
 
@@ -2731,9 +2733,10 @@ ngx_http_ssi_date_gmt_local_variable(ngx_http_request_t *r,
 
     ctx = ngx_http_get_module_ctx(r, ngx_http_ssi_filter_module);
 
-    if (ctx == NULL
-        || (ctx->timefmt.len == sizeof("%s") - 1
-            && ctx->timefmt.data[0] == '%' && ctx->timefmt.data[1] == 's'))
+    timefmt = ctx ? &ctx->timefmt : &ngx_http_ssi_timefmt;
+
+    if (timefmt->len == sizeof("%s") - 1
+        && timefmt->data[0] == '%' && timefmt->data[1] == 's')
     {
         v->data = ngx_pnalloc(r->pool, NGX_TIME_T_LEN);
         if (v->data == NULL) {
@@ -2752,7 +2755,7 @@ ngx_http_ssi_date_gmt_local_variable(ngx_http_request_t *r,
     }
 
     v->len = strftime(buf, NGX_HTTP_SSI_DATE_LEN,
-                      (char *) ctx->timefmt.data, &tm);
+                      (char *) timefmt->data, &tm);
     if (v->len == 0) {
         return NGX_ERROR;
     }
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index 1a2669065..df1e55ee9 100644
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -17,6 +17,14 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
 #define NGX_DEFAULT_CIPHERS     "HIGH:!aNULL:!MD5"
 #define NGX_DEFAULT_ECDH_CURVE  "prime256v1"
 
+#define NGX_HTTP_NPN_ADVERTISE  "\x08http/1.1"
+
+
+#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
+static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn,
+    const unsigned char **out, unsigned char *outlen,
+    const unsigned char *in, unsigned int inlen, void *arg);
+#endif
 
 #ifdef TLSEXT_TYPE_next_proto_neg
 static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn,
@@ -288,9 +296,65 @@ static ngx_http_variable_t  ngx_http_ssl_vars[] = {
 static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP");
 
 
-#ifdef TLSEXT_TYPE_next_proto_neg
+#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
 
-#define NGX_HTTP_NPN_ADVERTISE  "\x08http/1.1"
+static int
+ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, const unsigned char **out,
+    unsigned char *outlen, const unsigned char *in, unsigned int inlen,
+    void *arg)
+{
+    unsigned int            srvlen;
+    unsigned char          *srv;
+#if (NGX_DEBUG)
+    unsigned int            i;
+#endif
+#if (NGX_HTTP_SPDY)
+    ngx_http_connection_t  *hc;
+#endif
+#if (NGX_HTTP_SPDY || NGX_DEBUG)
+    ngx_connection_t       *c;
+
+    c = ngx_ssl_get_connection(ssl_conn);
+#endif
+
+#if (NGX_DEBUG)
+    for (i = 0; i < inlen; i += in[i] + 1) {
+         ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                        "SSL ALPN supported by client: %*s", in[i], &in[i + 1]);
+    }
+#endif
+
+#if (NGX_HTTP_SPDY)
+    hc = c->data;
+
+    if (hc->addr_conf->spdy) {
+        srv = (unsigned char *) NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE;
+        srvlen = sizeof(NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1;
+
+    } else
+#endif
+    {
+        srv = (unsigned char *) NGX_HTTP_NPN_ADVERTISE;
+        srvlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1;
+    }
+
+    if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen,
+                              in, inlen)
+        != OPENSSL_NPN_NEGOTIATED)
+    {
+        return SSL_TLSEXT_ERR_NOACK;
+    }
+
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                   "SSL ALPN selected: %*s", *outlen, *out);
+
+    return SSL_TLSEXT_ERR_OK;
+}
+
+#endif
+
+
+#ifdef TLSEXT_TYPE_next_proto_neg
 
 static int
 ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn,
@@ -561,6 +625,10 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
 
 #endif
 
+#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
+    SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL);
+#endif
+
 #ifdef TLSEXT_TYPE_next_proto_neg
     SSL_CTX_set_next_protos_advertised_cb(conf->ssl.ctx,
                                           ngx_http_ssl_npn_advertised, NULL);
diff --git a/src/http/ngx_http.c b/src/http/ngx_http.c
index f030baa71..c3ac7266c 100644
--- a/src/http/ngx_http.c
+++ b/src/http/ngx_http.c
@@ -1349,11 +1349,13 @@ ngx_http_add_address(ngx_conf_t *cf, ngx_http_core_srv_conf_t *cscf,
         }
     }
 
-#if (NGX_HTTP_SPDY && NGX_HTTP_SSL && !defined TLSEXT_TYPE_next_proto_neg)
+#if (NGX_HTTP_SPDY && NGX_HTTP_SSL                                            \
+     && !defined TLSEXT_TYPE_application_layer_protocol_negotiation           \
+     && !defined TLSEXT_TYPE_next_proto_neg)
     if (lsopt->spdy && lsopt->ssl) {
         ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
-                           "nginx was built without OpenSSL NPN support, "
-                           "SPDY is not enabled for %s", lsopt->addr);
+                           "nginx was built without OpenSSL ALPN or NPN "
+                           "support, SPDY is not enabled for %s", lsopt->addr);
     }
 #endif
 
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 1f6d246bc..0bb1b8cde 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -423,20 +423,6 @@ ngx_http_wait_request_handler(ngx_event_t *rev)
 
     if (n == NGX_AGAIN) {
 
-#if (NGX_HAVE_DEFERRED_ACCEPT && defined TCP_DEFER_ACCEPT)
-        if (c->listening->deferred_accept
-#if (NGX_HTTP_SSL)
-            && c->ssl == NULL
-#endif
-            )
-        {
-            ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT,
-                          "client timed out in deferred accept");
-            ngx_http_close_connection(c);
-            return;
-        }
-#endif
-
         if (!rev->timer_set) {
             ngx_add_timer(rev, c->listening->post_accept_timeout);
             ngx_reusable_connection(c, 1);
@@ -636,15 +622,6 @@ ngx_http_ssl_handshake(ngx_event_t *rev)
     if (n == -1) {
         if (err == NGX_EAGAIN) {
 
-#if (NGX_HAVE_DEFERRED_ACCEPT && defined TCP_DEFER_ACCEPT)
-            if (c->listening->deferred_accept) {
-                ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT,
-                              "client timed out in deferred accept");
-                ngx_http_close_connection(c);
-                return;
-            }
-#endif
-
             if (!rev->timer_set) {
                 ngx_add_timer(rev, c->listening->post_accept_timeout);
                 ngx_reusable_connection(c, 1);
@@ -728,13 +705,26 @@ ngx_http_ssl_handshake_handler(ngx_connection_t *c)
 
         c->ssl->no_wait_shutdown = 1;
 
-#if (NGX_HTTP_SPDY && defined TLSEXT_TYPE_next_proto_neg)
+#if (NGX_HTTP_SPDY                                                            \
+     && (defined TLSEXT_TYPE_application_layer_protocol_negotiation           \
+         || defined TLSEXT_TYPE_next_proto_neg))
         {
         unsigned int             len;
         const unsigned char     *data;
         static const ngx_str_t   spdy = ngx_string(NGX_SPDY_NPN_NEGOTIATED);
 
+#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
+        SSL_get0_alpn_selected(c->ssl->connection, &data, &len);
+
+#ifdef TLSEXT_TYPE_next_proto_neg
+        if (len == 0) {
+            SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len);
+        }
+#endif
+
+#else /* TLSEXT_TYPE_next_proto_neg */
         SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len);
+#endif
 
         if (len == spdy.len && ngx_strncmp(data, spdy.data, spdy.len) == 0) {
             ngx_http_spdy_init(c->read);
@@ -1954,6 +1944,10 @@ ngx_http_set_virtual_server(ngx_http_request_t *r, ngx_str_t *host)
     ngx_http_core_loc_conf_t  *clcf;
     ngx_http_core_srv_conf_t  *cscf;
 
+#if (NGX_SUPPRESS_WARN)
+    cscf = NULL;
+#endif
+
     hc = r->http_connection;
 
 #if (NGX_HTTP_SSL && defined SSL_CTRL_SET_TLSEXT_HOSTNAME)
diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index 27c8aa196..20755f490 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -42,6 +42,8 @@
 
 #define ngx_spdy_frame_parse_sid(p)                                           \
     (ngx_spdy_frame_parse_uint32(p) & 0x7fffffff)
+#define ngx_spdy_frame_parse_delta(p)                                         \
+    (ngx_spdy_frame_parse_uint32(p) & 0x7fffffff)
 
 
 #define ngx_spdy_ctl_frame_check(h)                                           \
@@ -52,6 +54,7 @@
 #define ngx_spdy_ctl_frame_type(h)   ((h) & 0x000000ff)
 #define ngx_spdy_frame_flags(p)      ((p) >> 24)
 #define ngx_spdy_frame_length(p)     ((p) & 0x00ffffff)
+#define ngx_spdy_frame_id(p)         ((p) & 0x00ffffff)
 
 
 #define NGX_SPDY_SKIP_HEADERS_BUFFER_SIZE  4096
@@ -64,10 +67,21 @@
 #define NGX_SPDY_CANCEL                    5
 #define NGX_SPDY_INTERNAL_ERROR            6
 #define NGX_SPDY_FLOW_CONTROL_ERROR        7
+#define NGX_SPDY_STREAM_IN_USE             8
+#define NGX_SPDY_STREAM_ALREADY_CLOSED     9
+/* deprecated                              10 */
+#define NGX_SPDY_FRAME_TOO_LARGE           11
 
 #define NGX_SPDY_SETTINGS_MAX_STREAMS      4
+#define NGX_SPDY_SETTINGS_INIT_WINDOW      7
 
 #define NGX_SPDY_SETTINGS_FLAG_PERSIST     0x01
+#define NGX_SPDY_SETTINGS_FLAG_PERSISTED   0x02
+
+#define NGX_SPDY_MAX_WINDOW                NGX_MAX_INT32_VALUE
+#define NGX_SPDY_CONNECTION_WINDOW         65536
+#define NGX_SPDY_INIT_STREAM_WINDOW        65536
+#define NGX_SPDY_STREAM_WINDOW             NGX_SPDY_MAX_WINDOW
 
 typedef struct {
     ngx_uint_t    hash;
@@ -91,20 +105,20 @@ static u_char *ngx_http_spdy_state_headers_error(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
 static u_char *ngx_http_spdy_state_headers_skip(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
+static u_char *ngx_http_spdy_state_window_update(ngx_http_spdy_connection_t *sc,
+    u_char *pos, u_char *end);
 static u_char *ngx_http_spdy_state_data(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
+static u_char *ngx_http_spdy_state_read_data(ngx_http_spdy_connection_t *sc,
+    u_char *pos, u_char *end);
 static u_char *ngx_http_spdy_state_rst_stream(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
 static u_char *ngx_http_spdy_state_ping(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
 static u_char *ngx_http_spdy_state_skip(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
-#if 0
 static u_char *ngx_http_spdy_state_settings(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
-#endif
-static u_char *ngx_http_spdy_state_noop(ngx_http_spdy_connection_t *sc,
-    u_char *pos, u_char *end);
 static u_char *ngx_http_spdy_state_complete(ngx_http_spdy_connection_t *sc,
     u_char *pos, u_char *end);
 static u_char *ngx_http_spdy_state_save(ngx_http_spdy_connection_t *sc,
@@ -114,6 +128,8 @@ static u_char *ngx_http_spdy_state_protocol_error(
 static u_char *ngx_http_spdy_state_internal_error(
     ngx_http_spdy_connection_t *sc);
 
+static ngx_int_t ngx_http_spdy_send_window_update(
+    ngx_http_spdy_connection_t *sc, ngx_uint_t sid, ngx_uint_t delta);
 static ngx_int_t ngx_http_spdy_send_rst_stream(ngx_http_spdy_connection_t *sc,
     ngx_uint_t sid, ngx_uint_t status, ngx_uint_t priority);
 static ngx_int_t ngx_http_spdy_send_settings(ngx_http_spdy_connection_t *sc);
@@ -138,13 +154,17 @@ static ngx_int_t ngx_http_spdy_alloc_large_header_buffer(ngx_http_request_t *r);
 static ngx_int_t ngx_http_spdy_handle_request_header(ngx_http_request_t *r);
 static ngx_int_t ngx_http_spdy_parse_method(ngx_http_request_t *r);
 static ngx_int_t ngx_http_spdy_parse_scheme(ngx_http_request_t *r);
-static ngx_int_t ngx_http_spdy_parse_url(ngx_http_request_t *r);
+static ngx_int_t ngx_http_spdy_parse_host(ngx_http_request_t *r);
+static ngx_int_t ngx_http_spdy_parse_path(ngx_http_request_t *r);
 static ngx_int_t ngx_http_spdy_parse_version(ngx_http_request_t *r);
 
 static ngx_int_t ngx_http_spdy_construct_request_line(ngx_http_request_t *r);
 static void ngx_http_spdy_run_request(ngx_http_request_t *r);
 static ngx_int_t ngx_http_spdy_init_request_body(ngx_http_request_t *r);
 
+static ngx_int_t ngx_http_spdy_terminate_stream(ngx_http_spdy_connection_t *sc,
+    ngx_http_spdy_stream_t *stream, ngx_uint_t status);
+
 static void ngx_http_spdy_close_stream_handler(ngx_event_t *ev);
 
 static void ngx_http_spdy_handle_connection_handler(ngx_event_t *rev);
@@ -152,43 +172,202 @@ static void ngx_http_spdy_keepalive_handler(ngx_event_t *rev);
 static void ngx_http_spdy_finalize_connection(ngx_http_spdy_connection_t *sc,
     ngx_int_t rc);
 
+static ngx_int_t ngx_http_spdy_adjust_windows(ngx_http_spdy_connection_t *sc,
+    ssize_t delta);
+
 static void ngx_http_spdy_pool_cleanup(void *data);
 
 static void *ngx_http_spdy_zalloc(void *opaque, u_int items, u_int size);
 static void ngx_http_spdy_zfree(void *opaque, void *address);
 
 
-static const u_char ngx_http_spdy_dict[] =
-    "options" "get" "head" "post" "put" "delete" "trace"
-    "accept" "accept-charset" "accept-encoding" "accept-language"
-    "authorization" "expect" "from" "host"
-    "if-modified-since" "if-match" "if-none-match" "if-range"
-    "if-unmodifiedsince" "max-forwards" "proxy-authorization"
-    "range" "referer" "te" "user-agent"
-    "100" "101" "200" "201" "202" "203" "204" "205" "206"
-    "300" "301" "302" "303" "304" "305" "306" "307"
-    "400" "401" "402" "403" "404" "405" "406" "407" "408" "409" "410"
-    "411" "412" "413" "414" "415" "416" "417"
-    "500" "501" "502" "503" "504" "505"
-    "accept-ranges" "age" "etag" "location" "proxy-authenticate" "public"
-    "retry-after" "server" "vary" "warning" "www-authenticate" "allow"
-    "content-base" "content-encoding" "cache-control" "connection" "date"
-    "trailer" "transfer-encoding" "upgrade" "via" "warning"
-    "content-language" "content-length" "content-location"
-    "content-md5" "content-range" "content-type" "etag" "expires"
-    "last-modified" "set-cookie"
-    "Monday" "Tuesday" "Wednesday" "Thursday" "Friday" "Saturday" "Sunday"
-    "Jan" "Feb" "Mar" "Apr" "May" "Jun" "Jul" "Aug" "Sep" "Oct" "Nov" "Dec"
-    "chunked" "text/html" "image/png" "image/jpg" "image/gif"
-    "application/xml" "application/xhtml" "text/plain" "public" "max-age"
-    "charset=iso-8859-1" "utf-8" "gzip" "deflate" "HTTP/1.1" "status"
-    "version" "url";
+static const u_char ngx_http_spdy_dict[] = {
+    0x00, 0x00, 0x00, 0x07, 0x6f, 0x70, 0x74, 0x69,   /* - - - - o p t i */
+    0x6f, 0x6e, 0x73, 0x00, 0x00, 0x00, 0x04, 0x68,   /* o n s - - - - h */
+    0x65, 0x61, 0x64, 0x00, 0x00, 0x00, 0x04, 0x70,   /* e a d - - - - p */
+    0x6f, 0x73, 0x74, 0x00, 0x00, 0x00, 0x03, 0x70,   /* o s t - - - - p */
+    0x75, 0x74, 0x00, 0x00, 0x00, 0x06, 0x64, 0x65,   /* u t - - - - d e */
+    0x6c, 0x65, 0x74, 0x65, 0x00, 0x00, 0x00, 0x05,   /* l e t e - - - - */
+    0x74, 0x72, 0x61, 0x63, 0x65, 0x00, 0x00, 0x00,   /* t r a c e - - - */
+    0x06, 0x61, 0x63, 0x63, 0x65, 0x70, 0x74, 0x00,   /* - a c c e p t - */
+    0x00, 0x00, 0x0e, 0x61, 0x63, 0x63, 0x65, 0x70,   /* - - - a c c e p */
+    0x74, 0x2d, 0x63, 0x68, 0x61, 0x72, 0x73, 0x65,   /* t - c h a r s e */
+    0x74, 0x00, 0x00, 0x00, 0x0f, 0x61, 0x63, 0x63,   /* t - - - - a c c */
+    0x65, 0x70, 0x74, 0x2d, 0x65, 0x6e, 0x63, 0x6f,   /* e p t - e n c o */
+    0x64, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x0f,   /* d i n g - - - - */
+    0x61, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x6c,   /* a c c e p t - l */
+    0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x00,   /* a n g u a g e - */
+    0x00, 0x00, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x70,   /* - - - a c c e p */
+    0x74, 0x2d, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x73,   /* t - r a n g e s */
+    0x00, 0x00, 0x00, 0x03, 0x61, 0x67, 0x65, 0x00,   /* - - - - a g e - */
+    0x00, 0x00, 0x05, 0x61, 0x6c, 0x6c, 0x6f, 0x77,   /* - - - a l l o w */
+    0x00, 0x00, 0x00, 0x0d, 0x61, 0x75, 0x74, 0x68,   /* - - - - a u t h */
+    0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,   /* o r i z a t i o */
+    0x6e, 0x00, 0x00, 0x00, 0x0d, 0x63, 0x61, 0x63,   /* n - - - - c a c */
+    0x68, 0x65, 0x2d, 0x63, 0x6f, 0x6e, 0x74, 0x72,   /* h e - c o n t r */
+    0x6f, 0x6c, 0x00, 0x00, 0x00, 0x0a, 0x63, 0x6f,   /* o l - - - - c o */
+    0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,   /* n n e c t i o n */
+    0x00, 0x00, 0x00, 0x0c, 0x63, 0x6f, 0x6e, 0x74,   /* - - - - c o n t */
+    0x65, 0x6e, 0x74, 0x2d, 0x62, 0x61, 0x73, 0x65,   /* e n t - b a s e */
+    0x00, 0x00, 0x00, 0x10, 0x63, 0x6f, 0x6e, 0x74,   /* - - - - c o n t */
+    0x65, 0x6e, 0x74, 0x2d, 0x65, 0x6e, 0x63, 0x6f,   /* e n t - e n c o */
+    0x64, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x10,   /* d i n g - - - - */
+    0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d,   /* c o n t e n t - */
+    0x6c, 0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65,   /* l a n g u a g e */
+    0x00, 0x00, 0x00, 0x0e, 0x63, 0x6f, 0x6e, 0x74,   /* - - - - c o n t */
+    0x65, 0x6e, 0x74, 0x2d, 0x6c, 0x65, 0x6e, 0x67,   /* e n t - l e n g */
+    0x74, 0x68, 0x00, 0x00, 0x00, 0x10, 0x63, 0x6f,   /* t h - - - - c o */
+    0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x6c, 0x6f,   /* n t e n t - l o */
+    0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00,   /* c a t i o n - - */
+    0x00, 0x0b, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e,   /* - - c o n t e n */
+    0x74, 0x2d, 0x6d, 0x64, 0x35, 0x00, 0x00, 0x00,   /* t - m d 5 - - - */
+    0x0d, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,   /* - c o n t e n t */
+    0x2d, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x00, 0x00,   /* - r a n g e - - */
+    0x00, 0x0c, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e,   /* - - c o n t e n */
+    0x74, 0x2d, 0x74, 0x79, 0x70, 0x65, 0x00, 0x00,   /* t - t y p e - - */
+    0x00, 0x04, 0x64, 0x61, 0x74, 0x65, 0x00, 0x00,   /* - - d a t e - - */
+    0x00, 0x04, 0x65, 0x74, 0x61, 0x67, 0x00, 0x00,   /* - - e t a g - - */
+    0x00, 0x06, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74,   /* - - e x p e c t */
+    0x00, 0x00, 0x00, 0x07, 0x65, 0x78, 0x70, 0x69,   /* - - - - e x p i */
+    0x72, 0x65, 0x73, 0x00, 0x00, 0x00, 0x04, 0x66,   /* r e s - - - - f */
+    0x72, 0x6f, 0x6d, 0x00, 0x00, 0x00, 0x04, 0x68,   /* r o m - - - - h */
+    0x6f, 0x73, 0x74, 0x00, 0x00, 0x00, 0x08, 0x69,   /* o s t - - - - i */
+    0x66, 0x2d, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x00,   /* f - m a t c h - */
+    0x00, 0x00, 0x11, 0x69, 0x66, 0x2d, 0x6d, 0x6f,   /* - - - i f - m o */
+    0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x2d, 0x73,   /* d i f i e d - s */
+    0x69, 0x6e, 0x63, 0x65, 0x00, 0x00, 0x00, 0x0d,   /* i n c e - - - - */
+    0x69, 0x66, 0x2d, 0x6e, 0x6f, 0x6e, 0x65, 0x2d,   /* i f - n o n e - */
+    0x6d, 0x61, 0x74, 0x63, 0x68, 0x00, 0x00, 0x00,   /* m a t c h - - - */
+    0x08, 0x69, 0x66, 0x2d, 0x72, 0x61, 0x6e, 0x67,   /* - i f - r a n g */
+    0x65, 0x00, 0x00, 0x00, 0x13, 0x69, 0x66, 0x2d,   /* e - - - - i f - */
+    0x75, 0x6e, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69,   /* u n m o d i f i */
+    0x65, 0x64, 0x2d, 0x73, 0x69, 0x6e, 0x63, 0x65,   /* e d - s i n c e */
+    0x00, 0x00, 0x00, 0x0d, 0x6c, 0x61, 0x73, 0x74,   /* - - - - l a s t */
+    0x2d, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65,   /* - m o d i f i e */
+    0x64, 0x00, 0x00, 0x00, 0x08, 0x6c, 0x6f, 0x63,   /* d - - - - l o c */
+    0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00,   /* a t i o n - - - */
+    0x0c, 0x6d, 0x61, 0x78, 0x2d, 0x66, 0x6f, 0x72,   /* - m a x - f o r */
+    0x77, 0x61, 0x72, 0x64, 0x73, 0x00, 0x00, 0x00,   /* w a r d s - - - */
+    0x06, 0x70, 0x72, 0x61, 0x67, 0x6d, 0x61, 0x00,   /* - p r a g m a - */
+    0x00, 0x00, 0x12, 0x70, 0x72, 0x6f, 0x78, 0x79,   /* - - - p r o x y */
+    0x2d, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,   /* - a u t h e n t */
+    0x69, 0x63, 0x61, 0x74, 0x65, 0x00, 0x00, 0x00,   /* i c a t e - - - */
+    0x13, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2d, 0x61,   /* - p r o x y - a */
+    0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,   /* u t h o r i z a */
+    0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x05,   /* t i o n - - - - */
+    0x72, 0x61, 0x6e, 0x67, 0x65, 0x00, 0x00, 0x00,   /* r a n g e - - - */
+    0x07, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x72,   /* - r e f e r e r */
+    0x00, 0x00, 0x00, 0x0b, 0x72, 0x65, 0x74, 0x72,   /* - - - - r e t r */
+    0x79, 0x2d, 0x61, 0x66, 0x74, 0x65, 0x72, 0x00,   /* y - a f t e r - */
+    0x00, 0x00, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65,   /* - - - s e r v e */
+    0x72, 0x00, 0x00, 0x00, 0x02, 0x74, 0x65, 0x00,   /* r - - - - t e - */
+    0x00, 0x00, 0x07, 0x74, 0x72, 0x61, 0x69, 0x6c,   /* - - - t r a i l */
+    0x65, 0x72, 0x00, 0x00, 0x00, 0x11, 0x74, 0x72,   /* e r - - - - t r */
+    0x61, 0x6e, 0x73, 0x66, 0x65, 0x72, 0x2d, 0x65,   /* a n s f e r - e */
+    0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, 0x67, 0x00,   /* n c o d i n g - */
+    0x00, 0x00, 0x07, 0x75, 0x70, 0x67, 0x72, 0x61,   /* - - - u p g r a */
+    0x64, 0x65, 0x00, 0x00, 0x00, 0x0a, 0x75, 0x73,   /* d e - - - - u s */
+    0x65, 0x72, 0x2d, 0x61, 0x67, 0x65, 0x6e, 0x74,   /* e r - a g e n t */
+    0x00, 0x00, 0x00, 0x04, 0x76, 0x61, 0x72, 0x79,   /* - - - - v a r y */
+    0x00, 0x00, 0x00, 0x03, 0x76, 0x69, 0x61, 0x00,   /* - - - - v i a - */
+    0x00, 0x00, 0x07, 0x77, 0x61, 0x72, 0x6e, 0x69,   /* - - - w a r n i */
+    0x6e, 0x67, 0x00, 0x00, 0x00, 0x10, 0x77, 0x77,   /* n g - - - - w w */
+    0x77, 0x2d, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e,   /* w - a u t h e n */
+    0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x00, 0x00,   /* t i c a t e - - */
+    0x00, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64,   /* - - m e t h o d */
+    0x00, 0x00, 0x00, 0x03, 0x67, 0x65, 0x74, 0x00,   /* - - - - g e t - */
+    0x00, 0x00, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,   /* - - - s t a t u */
+    0x73, 0x00, 0x00, 0x00, 0x06, 0x32, 0x30, 0x30,   /* s - - - - 2 0 0 */
+    0x20, 0x4f, 0x4b, 0x00, 0x00, 0x00, 0x07, 0x76,   /* - O K - - - - v */
+    0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x00, 0x00,   /* e r s i o n - - */
+    0x00, 0x08, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31,   /* - - H T T P - 1 */
+    0x2e, 0x31, 0x00, 0x00, 0x00, 0x03, 0x75, 0x72,   /* - 1 - - - - u r */
+    0x6c, 0x00, 0x00, 0x00, 0x06, 0x70, 0x75, 0x62,   /* l - - - - p u b */
+    0x6c, 0x69, 0x63, 0x00, 0x00, 0x00, 0x0a, 0x73,   /* l i c - - - - s */
+    0x65, 0x74, 0x2d, 0x63, 0x6f, 0x6f, 0x6b, 0x69,   /* e t - c o o k i */
+    0x65, 0x00, 0x00, 0x00, 0x0a, 0x6b, 0x65, 0x65,   /* e - - - - k e e */
+    0x70, 0x2d, 0x61, 0x6c, 0x69, 0x76, 0x65, 0x00,   /* p - a l i v e - */
+    0x00, 0x00, 0x06, 0x6f, 0x72, 0x69, 0x67, 0x69,   /* - - - o r i g i */
+    0x6e, 0x31, 0x30, 0x30, 0x31, 0x30, 0x31, 0x32,   /* n 1 0 0 1 0 1 2 */
+    0x30, 0x31, 0x32, 0x30, 0x32, 0x32, 0x30, 0x35,   /* 0 1 2 0 2 2 0 5 */
+    0x32, 0x30, 0x36, 0x33, 0x30, 0x30, 0x33, 0x30,   /* 2 0 6 3 0 0 3 0 */
+    0x32, 0x33, 0x30, 0x33, 0x33, 0x30, 0x34, 0x33,   /* 2 3 0 3 3 0 4 3 */
+    0x30, 0x35, 0x33, 0x30, 0x36, 0x33, 0x30, 0x37,   /* 0 5 3 0 6 3 0 7 */
+    0x34, 0x30, 0x32, 0x34, 0x30, 0x35, 0x34, 0x30,   /* 4 0 2 4 0 5 4 0 */
+    0x36, 0x34, 0x30, 0x37, 0x34, 0x30, 0x38, 0x34,   /* 6 4 0 7 4 0 8 4 */
+    0x30, 0x39, 0x34, 0x31, 0x30, 0x34, 0x31, 0x31,   /* 0 9 4 1 0 4 1 1 */
+    0x34, 0x31, 0x32, 0x34, 0x31, 0x33, 0x34, 0x31,   /* 4 1 2 4 1 3 4 1 */
+    0x34, 0x34, 0x31, 0x35, 0x34, 0x31, 0x36, 0x34,   /* 4 4 1 5 4 1 6 4 */
+    0x31, 0x37, 0x35, 0x30, 0x32, 0x35, 0x30, 0x34,   /* 1 7 5 0 2 5 0 4 */
+    0x35, 0x30, 0x35, 0x32, 0x30, 0x33, 0x20, 0x4e,   /* 5 0 5 2 0 3 - N */
+    0x6f, 0x6e, 0x2d, 0x41, 0x75, 0x74, 0x68, 0x6f,   /* o n - A u t h o */
+    0x72, 0x69, 0x74, 0x61, 0x74, 0x69, 0x76, 0x65,   /* r i t a t i v e */
+    0x20, 0x49, 0x6e, 0x66, 0x6f, 0x72, 0x6d, 0x61,   /* - I n f o r m a */
+    0x74, 0x69, 0x6f, 0x6e, 0x32, 0x30, 0x34, 0x20,   /* t i o n 2 0 4 - */
+    0x4e, 0x6f, 0x20, 0x43, 0x6f, 0x6e, 0x74, 0x65,   /* N o - C o n t e */
+    0x6e, 0x74, 0x33, 0x30, 0x31, 0x20, 0x4d, 0x6f,   /* n t 3 0 1 - M o */
+    0x76, 0x65, 0x64, 0x20, 0x50, 0x65, 0x72, 0x6d,   /* v e d - P e r m */
+    0x61, 0x6e, 0x65, 0x6e, 0x74, 0x6c, 0x79, 0x34,   /* a n e n t l y 4 */
+    0x30, 0x30, 0x20, 0x42, 0x61, 0x64, 0x20, 0x52,   /* 0 0 - B a d - R */
+    0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x34, 0x30,   /* e q u e s t 4 0 */
+    0x31, 0x20, 0x55, 0x6e, 0x61, 0x75, 0x74, 0x68,   /* 1 - U n a u t h */
+    0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x34, 0x30,   /* o r i z e d 4 0 */
+    0x33, 0x20, 0x46, 0x6f, 0x72, 0x62, 0x69, 0x64,   /* 3 - F o r b i d */
+    0x64, 0x65, 0x6e, 0x34, 0x30, 0x34, 0x20, 0x4e,   /* d e n 4 0 4 - N */
+    0x6f, 0x74, 0x20, 0x46, 0x6f, 0x75, 0x6e, 0x64,   /* o t - F o u n d */
+    0x35, 0x30, 0x30, 0x20, 0x49, 0x6e, 0x74, 0x65,   /* 5 0 0 - I n t e */
+    0x72, 0x6e, 0x61, 0x6c, 0x20, 0x53, 0x65, 0x72,   /* r n a l - S e r */
+    0x76, 0x65, 0x72, 0x20, 0x45, 0x72, 0x72, 0x6f,   /* v e r - E r r o */
+    0x72, 0x35, 0x30, 0x31, 0x20, 0x4e, 0x6f, 0x74,   /* r 5 0 1 - N o t */
+    0x20, 0x49, 0x6d, 0x70, 0x6c, 0x65, 0x6d, 0x65,   /* - I m p l e m e */
+    0x6e, 0x74, 0x65, 0x64, 0x35, 0x30, 0x33, 0x20,   /* n t e d 5 0 3 - */
+    0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x20,   /* S e r v i c e - */
+    0x55, 0x6e, 0x61, 0x76, 0x61, 0x69, 0x6c, 0x61,   /* U n a v a i l a */
+    0x62, 0x6c, 0x65, 0x4a, 0x61, 0x6e, 0x20, 0x46,   /* b l e J a n - F */
+    0x65, 0x62, 0x20, 0x4d, 0x61, 0x72, 0x20, 0x41,   /* e b - M a r - A */
+    0x70, 0x72, 0x20, 0x4d, 0x61, 0x79, 0x20, 0x4a,   /* p r - M a y - J */
+    0x75, 0x6e, 0x20, 0x4a, 0x75, 0x6c, 0x20, 0x41,   /* u n - J u l - A */
+    0x75, 0x67, 0x20, 0x53, 0x65, 0x70, 0x74, 0x20,   /* u g - S e p t - */
+    0x4f, 0x63, 0x74, 0x20, 0x4e, 0x6f, 0x76, 0x20,   /* O c t - N o v - */
+    0x44, 0x65, 0x63, 0x20, 0x30, 0x30, 0x3a, 0x30,   /* D e c - 0 0 - 0 */
+    0x30, 0x3a, 0x30, 0x30, 0x20, 0x4d, 0x6f, 0x6e,   /* 0 - 0 0 - M o n */
+    0x2c, 0x20, 0x54, 0x75, 0x65, 0x2c, 0x20, 0x57,   /* - - T u e - - W */
+    0x65, 0x64, 0x2c, 0x20, 0x54, 0x68, 0x75, 0x2c,   /* e d - - T h u - */
+    0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x53, 0x61,   /* - F r i - - S a */
+    0x74, 0x2c, 0x20, 0x53, 0x75, 0x6e, 0x2c, 0x20,   /* t - - S u n - - */
+    0x47, 0x4d, 0x54, 0x63, 0x68, 0x75, 0x6e, 0x6b,   /* G M T c h u n k */
+    0x65, 0x64, 0x2c, 0x74, 0x65, 0x78, 0x74, 0x2f,   /* e d - t e x t - */
+    0x68, 0x74, 0x6d, 0x6c, 0x2c, 0x69, 0x6d, 0x61,   /* h t m l - i m a */
+    0x67, 0x65, 0x2f, 0x70, 0x6e, 0x67, 0x2c, 0x69,   /* g e - p n g - i */
+    0x6d, 0x61, 0x67, 0x65, 0x2f, 0x6a, 0x70, 0x67,   /* m a g e - j p g */
+    0x2c, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x2f, 0x67,   /* - i m a g e - g */
+    0x69, 0x66, 0x2c, 0x61, 0x70, 0x70, 0x6c, 0x69,   /* i f - a p p l i */
+    0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x78,   /* c a t i o n - x */
+    0x6d, 0x6c, 0x2c, 0x61, 0x70, 0x70, 0x6c, 0x69,   /* m l - a p p l i */
+    0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x78,   /* c a t i o n - x */
+    0x68, 0x74, 0x6d, 0x6c, 0x2b, 0x78, 0x6d, 0x6c,   /* h t m l - x m l */
+    0x2c, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x70, 0x6c,   /* - t e x t - p l */
+    0x61, 0x69, 0x6e, 0x2c, 0x74, 0x65, 0x78, 0x74,   /* a i n - t e x t */
+    0x2f, 0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72,   /* - j a v a s c r */
+    0x69, 0x70, 0x74, 0x2c, 0x70, 0x75, 0x62, 0x6c,   /* i p t - p u b l */
+    0x69, 0x63, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74,   /* i c p r i v a t */
+    0x65, 0x6d, 0x61, 0x78, 0x2d, 0x61, 0x67, 0x65,   /* e m a x - a g e */
+    0x3d, 0x67, 0x7a, 0x69, 0x70, 0x2c, 0x64, 0x65,   /* - g z i p - d e */
+    0x66, 0x6c, 0x61, 0x74, 0x65, 0x2c, 0x73, 0x64,   /* f l a t e - s d */
+    0x63, 0x68, 0x63, 0x68, 0x61, 0x72, 0x73, 0x65,   /* c h c h a r s e */
+    0x74, 0x3d, 0x75, 0x74, 0x66, 0x2d, 0x38, 0x63,   /* t - u t f - 8 c */
+    0x68, 0x61, 0x72, 0x73, 0x65, 0x74, 0x3d, 0x69,   /* h a r s e t - i */
+    0x73, 0x6f, 0x2d, 0x38, 0x38, 0x35, 0x39, 0x2d,   /* s o - 8 8 5 9 - */
+    0x31, 0x2c, 0x75, 0x74, 0x66, 0x2d, 0x2c, 0x2a,   /* 1 - u t f - - - */
+    0x2c, 0x65, 0x6e, 0x71, 0x3d, 0x30, 0x2e          /* - e n q - 0 -   */
+};
 
 
 static ngx_http_spdy_request_header_t ngx_http_spdy_request_headers[] = {
     { 0, 6, "method", ngx_http_spdy_parse_method },
     { 0, 6, "scheme", ngx_http_spdy_parse_scheme },
-    { 0, 3, "url", ngx_http_spdy_parse_url },
+    { 0, 4, "host", ngx_http_spdy_parse_host },
+    { 0, 4, "path", ngx_http_spdy_parse_path },
     { 0, 7, "version", ngx_http_spdy_parse_version },
 };
 
@@ -235,6 +414,11 @@ ngx_http_spdy_init(ngx_event_t *rev)
     sc->connection = c;
     sc->http_connection = hc;
 
+    sc->send_window = NGX_SPDY_CONNECTION_WINDOW;
+    sc->recv_window = NGX_SPDY_CONNECTION_WINDOW;
+
+    sc->init_window = NGX_SPDY_INIT_STREAM_WINDOW;
+
     sc->handler = ngx_http_spdy_state_head;
 
     sc->zstream_in.zalloc = ngx_http_spdy_zalloc;
@@ -302,6 +486,17 @@ ngx_http_spdy_init(ngx_event_t *rev)
         return;
     }
 
+    if (ngx_http_spdy_send_window_update(sc, 0, NGX_SPDY_MAX_WINDOW
+                                                - sc->recv_window)
+        == NGX_ERROR)
+    {
+        ngx_http_close_connection(c);
+        return;
+    }
+
+    sc->recv_window = NGX_SPDY_MAX_WINDOW;
+
+    ngx_queue_init(&sc->waiting);
     ngx_queue_init(&sc->posted);
 
     c->data = sc;
@@ -653,10 +848,7 @@ ngx_http_spdy_state_head(ngx_http_spdy_connection_t *sc, u_char *pos,
             return ngx_http_spdy_state_rst_stream(sc, pos, end);
 
         case NGX_SPDY_SETTINGS:
-            return ngx_http_spdy_state_skip(sc, pos, end);
-
-        case NGX_SPDY_NOOP:
-            return ngx_http_spdy_state_noop(sc, pos, end);
+            return ngx_http_spdy_state_settings(sc, pos, end);
 
         case NGX_SPDY_PING:
             return ngx_http_spdy_state_ping(sc, pos, end);
@@ -667,6 +859,9 @@ ngx_http_spdy_state_head(ngx_http_spdy_connection_t *sc, u_char *pos,
         case NGX_SPDY_HEADERS:
             return ngx_http_spdy_state_protocol_error(sc);
 
+        case NGX_SPDY_WINDOW_UPDATE:
+            return ngx_http_spdy_state_window_update(sc, pos, end);
+
         default: /* TODO logging */
             return ngx_http_spdy_state_skip(sc, pos, end);
         }
@@ -707,7 +902,7 @@ ngx_http_spdy_state_syn_stream(ngx_http_spdy_connection_t *sc, u_char *pos,
     sc->length -= NGX_SPDY_SYN_STREAM_SIZE;
 
     sid = ngx_spdy_frame_parse_sid(pos);
-    prio = pos[8] >> 6;
+    prio = pos[8] >> 5;
 
     pos += NGX_SPDY_SYN_STREAM_SIZE;
 
@@ -835,7 +1030,7 @@ ngx_http_spdy_state_headers(ngx_http_spdy_connection_t *sc, u_char *pos,
                                             ngx_http_spdy_state_headers);
         }
 
-        sc->entries = ngx_spdy_frame_parse_uint16(buf->pos);
+        sc->entries = ngx_spdy_frame_parse_uint32(buf->pos);
 
         buf->pos += NGX_SPDY_NV_NUM_SIZE;
 
@@ -1053,9 +1248,220 @@ ngx_http_spdy_state_headers_skip(ngx_http_spdy_connection_t *sc, u_char *pos,
 
 
 static u_char *
+ngx_http_spdy_state_window_update(ngx_http_spdy_connection_t *sc, u_char *pos,
+    u_char *end)
+{
+    size_t                   delta;
+    ngx_uint_t               sid;
+    ngx_event_t             *wev;
+    ngx_queue_t             *q;
+    ngx_http_spdy_stream_t  *stream;
+
+    if (end - pos < NGX_SPDY_WINDOW_UPDATE_SIZE) {
+        return ngx_http_spdy_state_save(sc, pos, end,
+                                        ngx_http_spdy_state_window_update);
+    }
+
+    if (sc->length != NGX_SPDY_WINDOW_UPDATE_SIZE) {
+        ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                      "client sent WINDOW_UPDATE frame "
+                      "with incorrect length %uz", sc->length);
+
+        return ngx_http_spdy_state_protocol_error(sc);
+    }
+
+    sid = ngx_spdy_frame_parse_sid(pos);
+
+    pos += NGX_SPDY_SID_SIZE;
+
+    delta = ngx_spdy_frame_parse_delta(pos);
+
+    pos += NGX_SPDY_DELTA_SIZE;
+
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
+                   "spdy WINDOW_UPDATE sid:%ui delta:%ui", sid, delta);
+
+    if (sid) {
+        stream = ngx_http_spdy_get_stream_by_id(sc, sid);
+
+        if (stream == NULL) {
+            ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                          "client sent WINDOW_UPDATE frame "
+                          "for unknown stream %ui", sid);
+
+            if (ngx_http_spdy_send_rst_stream(sc, sid, NGX_SPDY_INVALID_STREAM,
+                                              NGX_SPDY_LOWEST_PRIORITY)
+                == NGX_ERROR)
+            {
+                return ngx_http_spdy_state_internal_error(sc);
+            }
+
+            return ngx_http_spdy_state_complete(sc, pos, end);
+        }
+
+        if (stream->send_window > (ssize_t) (NGX_SPDY_MAX_WINDOW - delta)) {
+
+            ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                          "client violated flow control for stream %ui: "
+                          "received WINDOW_UPDATE frame with delta %uz "
+                          "that is not allowed for window %z",
+                          sid, delta, stream->send_window);
+
+            if (ngx_http_spdy_terminate_stream(sc, stream,
+                                               NGX_SPDY_FLOW_CONTROL_ERROR)
+                == NGX_ERROR)
+            {
+                return ngx_http_spdy_state_internal_error(sc);
+            }
+
+            return ngx_http_spdy_state_complete(sc, pos, end);
+        }
+
+        stream->send_window += delta;
+
+        if (stream->exhausted) {
+            stream->exhausted = 0;
+
+            wev = stream->request->connection->write;
+
+            if (!wev->timer_set) {
+                wev->delayed = 0;
+                wev->handler(wev);
+            }
+        }
+
+    } else {
+        sc->send_window += delta;
+
+        if (sc->send_window > NGX_SPDY_MAX_WINDOW) {
+            ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                          "client violated connection flow control: "
+                          "received WINDOW_UPDATE frame with delta %uz "
+                          "that is not allowed for window %uz",
+                          delta, sc->send_window);
+
+            return ngx_http_spdy_state_protocol_error(sc);
+        }
+
+        while (!ngx_queue_empty(&sc->waiting)) {
+            q = ngx_queue_head(&sc->waiting);
+
+            ngx_queue_remove(q);
+
+            stream = ngx_queue_data(q, ngx_http_spdy_stream_t, queue);
+
+            stream->handled = 0;
+
+            wev = stream->request->connection->write;
+
+            if (!wev->timer_set) {
+                wev->delayed = 0;
+                wev->handler(wev);
+
+                if (sc->send_window == 0) {
+                    break;
+                }
+            }
+        }
+    }
+
+    return ngx_http_spdy_state_complete(sc, pos, end);
+}
+
+
+static u_char *
 ngx_http_spdy_state_data(ngx_http_spdy_connection_t *sc, u_char *pos,
     u_char *end)
 {
+    ngx_http_spdy_stream_t  *stream;
+
+    stream = sc->stream;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
+                   "spdy DATA frame");
+
+    if (sc->length > sc->recv_window) {
+        ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                      "client violated connection flow control: length of "
+                      "received DATA frame %uz, while available window %uz",
+                      stream->id, sc->length, sc->recv_window);
+
+        return ngx_http_spdy_state_protocol_error(sc);
+    }
+
+    sc->recv_window -= sc->length;
+
+    if (sc->recv_window < NGX_SPDY_MAX_WINDOW / 4) {
+
+        if (ngx_http_spdy_send_window_update(sc, 0,
+                                             NGX_SPDY_MAX_WINDOW
+                                             - sc->recv_window)
+            == NGX_ERROR)
+        {
+            return ngx_http_spdy_state_internal_error(sc);
+        }
+
+        sc->recv_window = NGX_SPDY_MAX_WINDOW;
+    }
+
+    if (stream == NULL) {
+        return ngx_http_spdy_state_skip(sc, pos, end);
+    }
+
+    if (sc->length > stream->recv_window) {
+        ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                      "client violated flow control for stream %ui: length of "
+                      "received DATA frame %uz, while available window %uz",
+                      stream->id, sc->length, stream->recv_window);
+
+        if (ngx_http_spdy_terminate_stream(sc, stream,
+                                           NGX_SPDY_FLOW_CONTROL_ERROR)
+            == NGX_ERROR)
+        {
+            return ngx_http_spdy_state_internal_error(sc);
+        }
+
+        return ngx_http_spdy_state_skip(sc, pos, end);
+    }
+
+    stream->recv_window -= sc->length;
+
+    if (stream->recv_window < NGX_SPDY_STREAM_WINDOW / 4) {
+
+        if (ngx_http_spdy_send_window_update(sc, stream->id,
+                                             NGX_SPDY_STREAM_WINDOW
+                                             - stream->recv_window)
+            == NGX_ERROR)
+        {
+            return ngx_http_spdy_state_internal_error(sc);
+        }
+
+        stream->recv_window = NGX_SPDY_STREAM_WINDOW;
+    }
+
+    if (stream->in_closed) {
+        ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                      "client sent DATA frame for half closed stream %ui",
+                      stream->id);
+
+        if (ngx_http_spdy_terminate_stream(sc, stream,
+                                           NGX_SPDY_STREAM_ALREADY_CLOSED)
+            == NGX_ERROR)
+        {
+            return ngx_http_spdy_state_internal_error(sc);
+        }
+
+        return ngx_http_spdy_state_skip(sc, pos, end);
+    }
+
+    return ngx_http_spdy_state_read_data(sc, pos, end);
+}
+
+
+static u_char *
+ngx_http_spdy_state_read_data(ngx_http_spdy_connection_t *sc, u_char *pos,
+    u_char *end)
+{
     size_t                     size;
     ssize_t                    n;
     ngx_buf_t                 *buf;
@@ -1069,18 +1475,10 @@ ngx_http_spdy_state_data(ngx_http_spdy_connection_t *sc, u_char *pos,
 
     stream = sc->stream;
 
-    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
-                   "spdy DATA frame");
-
     if (stream == NULL) {
         return ngx_http_spdy_state_skip(sc, pos, end);
     }
 
-    if (stream->in_closed) {
-        /* TODO log */
-        return ngx_http_spdy_state_protocol_error(sc);
-    }
-
     if (stream->skip_data) {
 
         if (sc->flags & NGX_SPDY_FLAG_FIN) {
@@ -1171,7 +1569,7 @@ ngx_http_spdy_state_data(ngx_http_spdy_connection_t *sc, u_char *pos,
 
     if (!complete) {
         return ngx_http_spdy_state_save(sc, pos, end,
-                                        ngx_http_spdy_state_data);
+                                        ngx_http_spdy_state_read_data);
     }
 
     if (sc->flags & NGX_SPDY_FLAG_FIN) {
@@ -1357,12 +1755,12 @@ ngx_http_spdy_state_skip(ngx_http_spdy_connection_t *sc, u_char *pos,
 }
 
 
-#if 0
-
 static u_char *
 ngx_http_spdy_state_settings(ngx_http_spdy_connection_t *sc, u_char *pos,
     u_char *end)
 {
+    ngx_uint_t  fid, val;
+
     if (sc->entries == 0) {
 
         if (end - pos < NGX_SPDY_SETTINGS_NUM_SIZE) {
@@ -1392,24 +1790,46 @@ ngx_http_spdy_state_settings(ngx_http_spdy_connection_t *sc, u_char *pos,
         }
 
         sc->entries--;
-
-        pos += NGX_SPDY_SETTINGS_PAIR_SIZE;
         sc->length -= NGX_SPDY_SETTINGS_PAIR_SIZE;
-    }
 
-    return ngx_http_spdy_state_complete(sc, pos, end);
-}
+        fid = ngx_spdy_frame_parse_uint32(pos);
 
-#endif
+        pos += NGX_SPDY_SETTINGS_FID_SIZE;
 
+        val = ngx_spdy_frame_parse_uint32(pos);
 
-static u_char *
-ngx_http_spdy_state_noop(ngx_http_spdy_connection_t *sc, u_char *pos,
-    u_char *end)
-{
-    if (sc->length) {
-        /* TODO logging */
-        return ngx_http_spdy_state_protocol_error(sc);
+        pos += NGX_SPDY_SETTINGS_VAL_SIZE;
+
+        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
+                       "spdy SETTINGS entry fl:%ui id:%ui val:%ui",
+                       ngx_spdy_frame_flags(fid), ngx_spdy_frame_id(fid), val);
+
+        if (ngx_spdy_frame_flags(fid) == NGX_SPDY_SETTINGS_FLAG_PERSISTED) {
+            continue;
+        }
+
+        switch (ngx_spdy_frame_id(fid)) {
+
+        case NGX_SPDY_SETTINGS_INIT_WINDOW:
+
+            if (val > NGX_SPDY_MAX_WINDOW) {
+                ngx_log_error(NGX_LOG_INFO, sc->connection->log, 0,
+                              "client sent SETTINGS frame with "
+                              "incorrect INIT_WINDOW value: %ui", val);
+
+                return ngx_http_spdy_state_protocol_error(sc);
+            }
+
+            if (ngx_http_spdy_adjust_windows(sc, val - sc->init_window)
+                != NGX_OK)
+            {
+                return ngx_http_spdy_state_internal_error(sc);
+            }
+
+            sc->init_window = val;
+
+            continue;
+        }
     }
 
     return ngx_http_spdy_state_complete(sc, pos, end);
@@ -1473,6 +1893,41 @@ ngx_http_spdy_state_internal_error(ngx_http_spdy_connection_t *sc)
 
 
 static ngx_int_t
+ngx_http_spdy_send_window_update(ngx_http_spdy_connection_t *sc, ngx_uint_t sid,
+    ngx_uint_t delta)
+{
+    u_char                     *p;
+    ngx_buf_t                  *buf;
+    ngx_http_spdy_out_frame_t  *frame;
+
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
+                   "spdy write WINDOW_UPDATE sid:%ui delta:%ui", sid, delta);
+
+    frame = ngx_http_spdy_get_ctl_frame(sc, NGX_SPDY_WINDOW_UPDATE_SIZE,
+                                        NGX_SPDY_HIGHEST_PRIORITY);
+    if (frame == NULL) {
+        return NGX_ERROR;
+    }
+
+    buf = frame->first->buf;
+
+    p = buf->pos;
+
+    p = ngx_spdy_frame_write_head(p, NGX_SPDY_WINDOW_UPDATE);
+    p = ngx_spdy_frame_write_flags_and_len(p, 0, NGX_SPDY_WINDOW_UPDATE_SIZE);
+
+    p = ngx_spdy_frame_write_sid(p, sid);
+    p = ngx_spdy_frame_aligned_write_uint32(p, delta);
+
+    buf->last = p;
+
+    ngx_http_spdy_queue_frame(sc, frame);
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
 ngx_http_spdy_send_rst_stream(ngx_http_spdy_connection_t *sc, ngx_uint_t sid,
     ngx_uint_t status, ngx_uint_t priority)
 {
@@ -1570,7 +2025,7 @@ ngx_http_spdy_send_settings(ngx_http_spdy_connection_t *sc)
 
     buf = ngx_create_temp_buf(sc->pool, NGX_SPDY_FRAME_HEADER_SIZE
                                         + NGX_SPDY_SETTINGS_NUM_SIZE
-                                        + NGX_SPDY_SETTINGS_PAIR_SIZE);
+                                        + 2 * NGX_SPDY_SETTINGS_PAIR_SIZE);
     if (buf == NULL) {
         return NGX_ERROR;
     }
@@ -1585,7 +2040,8 @@ ngx_http_spdy_send_settings(ngx_http_spdy_connection_t *sc)
     frame->handler = ngx_http_spdy_settings_frame_handler;
     frame->stream = NULL;
 #if (NGX_DEBUG)
-    frame->length = NGX_SPDY_SETTINGS_NUM_SIZE + NGX_SPDY_SETTINGS_PAIR_SIZE;
+    frame->length = NGX_SPDY_SETTINGS_NUM_SIZE
+                    + 2 * NGX_SPDY_SETTINGS_PAIR_SIZE;
 #endif
     frame->priority = NGX_SPDY_HIGHEST_PRIORITY;
     frame->blocked = 0;
@@ -1594,18 +2050,20 @@ ngx_http_spdy_send_settings(ngx_http_spdy_connection_t *sc)
 
     p = ngx_spdy_frame_write_head(p, NGX_SPDY_SETTINGS);
     p = ngx_spdy_frame_write_flags_and_len(p, NGX_SPDY_FLAG_CLEAR_SETTINGS,
-                                              NGX_SPDY_SETTINGS_NUM_SIZE
-                                              + NGX_SPDY_SETTINGS_PAIR_SIZE);
+                                           NGX_SPDY_SETTINGS_NUM_SIZE
+                                           + 2 * NGX_SPDY_SETTINGS_PAIR_SIZE);
 
-    p = ngx_spdy_frame_aligned_write_uint32(p, 1);
-    p = ngx_spdy_frame_aligned_write_uint32(p,
-                                          NGX_SPDY_SETTINGS_MAX_STREAMS << 24);
+    p = ngx_spdy_frame_aligned_write_uint32(p, 2);
 
     sscf = ngx_http_get_module_srv_conf(sc->http_connection->conf_ctx,
                                         ngx_http_spdy_module);
 
+    p = ngx_spdy_frame_write_flags_and_id(p, 0, NGX_SPDY_SETTINGS_MAX_STREAMS);
     p = ngx_spdy_frame_aligned_write_uint32(p, sscf->concurrent_streams);
 
+    p = ngx_spdy_frame_write_flags_and_id(p, 0, NGX_SPDY_SETTINGS_INIT_WINDOW);
+    p = ngx_spdy_frame_aligned_write_uint32(p, NGX_SPDY_STREAM_WINDOW);
+
     buf->last = p;
 
     ngx_http_spdy_queue_frame(sc, frame);
@@ -1820,6 +2278,10 @@ ngx_http_spdy_create_stream(ngx_http_spdy_connection_t *sc, ngx_uint_t id,
     stream->id = id;
     stream->request = r;
     stream->connection = sc;
+
+    stream->send_window = sc->init_window;
+    stream->recv_window = NGX_SPDY_STREAM_WINDOW;
+
     stream->priority = priority;
 
     sscf = ngx_http_get_module_srv_conf(r, ngx_http_spdy_module);
@@ -1886,7 +2348,7 @@ ngx_http_spdy_parse_header(ngx_http_request_t *r)
             return NGX_AGAIN;
         }
 
-        len = ngx_spdy_frame_parse_uint16(p);
+        len = ngx_spdy_frame_parse_uint32(p);
 
         if (!len) {
             return NGX_HTTP_PARSE_INVALID_HEADER;
@@ -1915,6 +2377,11 @@ ngx_http_spdy_parse_header(ngx_http_request_t *r)
 
         r->header_name_start = p;
 
+        if (p[0] == ':') {
+            r->lowcase_index--;
+            p++;
+        }
+
         hash = 0;
 
         for ( /* void */ ; p != r->header_name_end; p++) {
@@ -1958,7 +2425,7 @@ ngx_http_spdy_parse_header(ngx_http_request_t *r)
             break;
         }
 
-        len = ngx_spdy_frame_parse_uint16(p);
+        len = ngx_spdy_frame_parse_uint32(p);
 
         /* null-terminate header name */
         *p = '\0';
@@ -2093,13 +2560,15 @@ ngx_http_spdy_handle_request_header(ngx_http_request_t *r)
             return NGX_OK;
         }
 
-    } else {
+    }
+
+    if (r->header_name_start[0] == ':') {
         for (i = 0; i < NGX_SPDY_REQUEST_HEADERS; i++) {
             sh = &ngx_http_spdy_request_headers[i];
 
             if (sh->hash != r->header_hash
                 || sh->len != r->lowcase_index
-                || ngx_strncmp(sh->header, r->header_name_start,
+                || ngx_strncmp(sh->header, &r->header_name_start[1],
                                r->lowcase_index)
                    != 0)
             {
@@ -2108,6 +2577,8 @@ ngx_http_spdy_handle_request_header(ngx_http_request_t *r)
 
             return sh->handler(r);
         }
+
+        return NGX_HTTP_PARSE_INVALID_REQUEST;
     }
 
     h = ngx_list_push(&r->headers_in.headers);
@@ -2243,7 +2714,39 @@ ngx_http_spdy_parse_scheme(ngx_http_request_t *r)
 
 
 static ngx_int_t
-ngx_http_spdy_parse_url(ngx_http_request_t *r)
+ngx_http_spdy_parse_host(ngx_http_request_t *r)
+{
+    ngx_table_elt_t  *h;
+
+    if (r->headers_in.host) {
+        return NGX_HTTP_PARSE_INVALID_HEADER;
+    }
+
+    h = ngx_list_push(&r->headers_in.headers);
+    if (h == NULL) {
+        ngx_http_spdy_close_stream(r->spdy_stream,
+                                   NGX_HTTP_INTERNAL_SERVER_ERROR);
+        return NGX_ERROR;
+    }
+
+    r->headers_in.host = h;
+
+    h->hash = r->header_hash;
+
+    h->key.len = r->lowcase_index;
+    h->key.data = &r->header_name_start[1];
+
+    h->value.len = r->header_size;
+    h->value.data = r->header_start;
+
+    h->lowcase_key = h->key.data;
+
+    return NGX_OK;
+}
+
+
+static ngx_int_t
+ngx_http_spdy_parse_path(ngx_http_request_t *r)
 {
     if (r->unparsed_uri.len) {
         return NGX_HTTP_PARSE_INVALID_HEADER;
@@ -2560,6 +3063,32 @@ ngx_http_spdy_read_request_body(ngx_http_request_t *r,
 }
 
 
+static ngx_int_t
+ngx_http_spdy_terminate_stream(ngx_http_spdy_connection_t *sc,
+    ngx_http_spdy_stream_t *stream, ngx_uint_t status)
+{
+    ngx_event_t       *rev;
+    ngx_connection_t  *fc;
+
+    if (ngx_http_spdy_send_rst_stream(sc, stream->id, status,
+                                      NGX_SPDY_HIGHEST_PRIORITY)
+        == NGX_ERROR)
+    {
+        return NGX_ERROR;
+    }
+
+    stream->out_closed = 1;
+
+    fc = stream->request->connection;
+    fc->error = 1;
+
+    rev = fc->read;
+    rev->handler(rev);
+
+    return NGX_OK;
+}
+
+
 static void
 ngx_http_spdy_close_stream_handler(ngx_event_t *ev)
 {
@@ -2591,11 +3120,6 @@ ngx_http_spdy_close_stream(ngx_http_spdy_stream_t *stream, ngx_int_t rc)
                    "spdy close stream %ui, queued %ui, processing %ui",
                    stream->id, stream->queued, sc->processing);
 
-    if (stream->handled) {
-        stream->handled = 0;
-        ngx_queue_remove(&stream->queue);
-    }
-
     fc = stream->request->connection;
 
     if (stream->queued) {
@@ -2838,6 +3362,61 @@ ngx_http_spdy_finalize_connection(ngx_http_spdy_connection_t *sc,
 }
 
 
+static ngx_int_t
+ngx_http_spdy_adjust_windows(ngx_http_spdy_connection_t *sc, ssize_t delta)
+{
+    ngx_uint_t                 i, size;
+    ngx_event_t               *wev;
+    ngx_http_spdy_stream_t    *stream, *sn;
+    ngx_http_spdy_srv_conf_t  *sscf;
+
+    sscf = ngx_http_get_module_srv_conf(sc->http_connection->conf_ctx,
+                                        ngx_http_spdy_module);
+
+    size = ngx_http_spdy_streams_index_size(sscf);
+
+    for (i = 0; i < size; i++) {
+
+        for (stream = sc->streams_index[i]; stream; stream = sn) {
+            sn = stream->index;
+
+            if (delta > 0
+                && stream->send_window
+                      > (ssize_t) (NGX_SPDY_MAX_WINDOW - delta))
+            {
+                if (ngx_http_spdy_terminate_stream(sc, stream,
+                                                   NGX_SPDY_FLOW_CONTROL_ERROR)
+                    == NGX_ERROR)
+                {
+                    return NGX_ERROR;
+                }
+
+                continue;
+            }
+
+            stream->send_window += delta;
+
+            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
+                           "spdy:%ui adjust window:%z",
+                           stream->id, stream->send_window);
+
+            if (stream->send_window > 0 && stream->exhausted) {
+                stream->exhausted = 0;
+
+                wev = stream->request->connection->write;
+
+                if (!wev->timer_set) {
+                    wev->delayed = 0;
+                    wev->handler(wev);
+                }
+            }
+        }
+    }
+
+    return NGX_OK;
+}
+
+
 static void
 ngx_http_spdy_pool_cleanup(void *data)
 {
diff --git a/src/http/ngx_http_spdy.h b/src/http/ngx_http_spdy.h
index 8caa5b0c4..b98b4d85a 100644
--- a/src/http/ngx_http_spdy.h
+++ b/src/http/ngx_http_spdy.h
@@ -15,12 +15,10 @@
 #include <zlib.h>
 
 
-#define NGX_SPDY_VERSION              2
+#define NGX_SPDY_VERSION              3
 
-#ifdef TLSEXT_TYPE_next_proto_neg
-#define NGX_SPDY_NPN_ADVERTISE        "\x06spdy/2"
-#define NGX_SPDY_NPN_NEGOTIATED       "spdy/2"
-#endif
+#define NGX_SPDY_NPN_ADVERTISE        "\x08spdy/3.1"
+#define NGX_SPDY_NPN_NEGOTIATED       "spdy/3.1"
 
 #define NGX_SPDY_STATE_BUFFER_SIZE    16
 
@@ -30,32 +28,34 @@
 #define NGX_SPDY_SYN_REPLY            2
 #define NGX_SPDY_RST_STREAM           3
 #define NGX_SPDY_SETTINGS             4
-#define NGX_SPDY_NOOP                 5
 #define NGX_SPDY_PING                 6
 #define NGX_SPDY_GOAWAY               7
 #define NGX_SPDY_HEADERS              8
+#define NGX_SPDY_WINDOW_UPDATE        9
 
 #define NGX_SPDY_FRAME_HEADER_SIZE    8
 
 #define NGX_SPDY_SID_SIZE             4
+#define NGX_SPDY_DELTA_SIZE           4
 
 #define NGX_SPDY_SYN_STREAM_SIZE      10
-#define NGX_SPDY_SYN_REPLY_SIZE       6
+#define NGX_SPDY_SYN_REPLY_SIZE       4
 #define NGX_SPDY_RST_STREAM_SIZE      8
 #define NGX_SPDY_PING_SIZE            4
-#define NGX_SPDY_GOAWAY_SIZE          4
-#define NGX_SPDY_NV_NUM_SIZE          2
-#define NGX_SPDY_NV_NLEN_SIZE         2
-#define NGX_SPDY_NV_VLEN_SIZE         2
+#define NGX_SPDY_GOAWAY_SIZE          8
+#define NGX_SPDY_WINDOW_UPDATE_SIZE   8
+#define NGX_SPDY_NV_NUM_SIZE          4
+#define NGX_SPDY_NV_NLEN_SIZE         4
+#define NGX_SPDY_NV_VLEN_SIZE         4
 #define NGX_SPDY_SETTINGS_NUM_SIZE    4
-#define NGX_SPDY_SETTINGS_IDF_SIZE    4
+#define NGX_SPDY_SETTINGS_FID_SIZE    4
 #define NGX_SPDY_SETTINGS_VAL_SIZE    4
 
 #define NGX_SPDY_SETTINGS_PAIR_SIZE                                           \
-    (NGX_SPDY_SETTINGS_IDF_SIZE + NGX_SPDY_SETTINGS_VAL_SIZE)
+    (NGX_SPDY_SETTINGS_FID_SIZE + NGX_SPDY_SETTINGS_VAL_SIZE)
 
 #define NGX_SPDY_HIGHEST_PRIORITY     0
-#define NGX_SPDY_LOWEST_PRIORITY      3
+#define NGX_SPDY_LOWEST_PRIORITY      7
 
 #define NGX_SPDY_FLAG_FIN             0x01
 #define NGX_SPDY_FLAG_UNIDIRECTIONAL  0x02
@@ -81,6 +81,12 @@ struct ngx_http_spdy_connection_s {
 
     ngx_uint_t                       processing;
 
+    size_t                           send_window;
+    size_t                           recv_window;
+    size_t                           init_window;
+
+    ngx_queue_t                      waiting;
+
     u_char                           buffer[NGX_SPDY_STATE_BUFFER_SIZE];
     size_t                           buffer_used;
     ngx_http_spdy_handler_pt         handler;
@@ -121,15 +127,23 @@ struct ngx_http_spdy_stream_s {
     ngx_uint_t                       header_buffers;
     ngx_uint_t                       queued;
 
+    /*
+     * A change to SETTINGS_INITIAL_WINDOW_SIZE could cause the
+     * send_window to become negative, hence it's signed.
+     */
+    ssize_t                          send_window;
+    size_t                           recv_window;
+
     ngx_http_spdy_out_frame_t       *free_frames;
     ngx_chain_t                     *free_data_headers;
     ngx_chain_t                     *free_bufs;
 
     ngx_queue_t                      queue;
 
-    unsigned                         priority:2;
+    unsigned                         priority:3;
     unsigned                         handled:1;
     unsigned                         blocked:1;
+    unsigned                         exhausted:1;
     unsigned                         in_closed:1;
     unsigned                         out_closed:1;
     unsigned                         skip_data:2;
@@ -232,7 +246,10 @@ ngx_int_t ngx_http_spdy_send_output_queue(ngx_http_spdy_connection_t *sc);
 
 #define ngx_spdy_frame_write_flags_and_len(p, f, l)                           \
     ngx_spdy_frame_aligned_write_uint32(p, (f) << 24 | (l))
+#define ngx_spdy_frame_write_flags_and_id(p, f, i)                            \
+    ngx_spdy_frame_aligned_write_uint32(p, (f) << 24 | (i))
 
-#define ngx_spdy_frame_write_sid  ngx_spdy_frame_aligned_write_uint32
+#define ngx_spdy_frame_write_sid     ngx_spdy_frame_aligned_write_uint32
+#define ngx_spdy_frame_write_window  ngx_spdy_frame_aligned_write_uint32
 
 #endif /* _NGX_HTTP_SPDY_H_INCLUDED_ */
diff --git a/src/http/ngx_http_spdy_filter_module.c b/src/http/ngx_http_spdy_filter_module.c
index 0ec9028ce..8a3f0a3c8 100644
--- a/src/http/ngx_http_spdy_filter_module.c
+++ b/src/http/ngx_http_spdy_filter_module.c
@@ -17,9 +17,9 @@
 #define ngx_http_spdy_nv_nsize(h)  (NGX_SPDY_NV_NLEN_SIZE + sizeof(h) - 1)
 #define ngx_http_spdy_nv_vsize(h)  (NGX_SPDY_NV_VLEN_SIZE + sizeof(h) - 1)
 
-#define ngx_http_spdy_nv_write_num   ngx_spdy_frame_write_uint16
-#define ngx_http_spdy_nv_write_nlen  ngx_spdy_frame_write_uint16
-#define ngx_http_spdy_nv_write_vlen  ngx_spdy_frame_write_uint16
+#define ngx_http_spdy_nv_write_num   ngx_spdy_frame_write_uint32
+#define ngx_http_spdy_nv_write_nlen  ngx_spdy_frame_write_uint32
+#define ngx_http_spdy_nv_write_vlen  ngx_spdy_frame_write_uint32
 
 #define ngx_http_spdy_nv_write_name(p, h)                                     \
     ngx_cpymem(ngx_http_spdy_nv_write_nlen(p, sizeof(h) - 1), h, sizeof(h) - 1)
@@ -33,6 +33,10 @@ static ngx_chain_t *ngx_http_spdy_send_chain(ngx_connection_t *fc,
 
 static ngx_inline ngx_int_t ngx_http_spdy_filter_send(
     ngx_connection_t *fc, ngx_http_spdy_stream_t *stream);
+static ngx_inline ngx_int_t ngx_http_spdy_flow_control(
+    ngx_http_spdy_connection_t *sc, ngx_http_spdy_stream_t *stream);
+static void ngx_http_spdy_waiting_queue(ngx_http_spdy_connection_t *sc,
+    ngx_http_spdy_stream_t *stream);
 
 static ngx_chain_t *ngx_http_spdy_filter_get_shadow(
     ngx_http_spdy_stream_t *stream, ngx_buf_t *buf, off_t offset, off_t size);
@@ -162,9 +166,9 @@ ngx_http_spdy_header_filter(ngx_http_request_t *r)
     }
 
     len = NGX_SPDY_NV_NUM_SIZE
-          + ngx_http_spdy_nv_nsize("version")
+          + ngx_http_spdy_nv_nsize(":version")
           + ngx_http_spdy_nv_vsize("HTTP/1.1")
-          + ngx_http_spdy_nv_nsize("status")
+          + ngx_http_spdy_nv_nsize(":status")
           + (r->headers_out.status_line.len
              ? NGX_SPDY_NV_VLEN_SIZE + r->headers_out.status_line.len
              : ngx_http_spdy_nv_vsize("418"));
@@ -305,10 +309,10 @@ ngx_http_spdy_header_filter(ngx_http_request_t *r)
 
     last = buf + NGX_SPDY_NV_NUM_SIZE;
 
-    last = ngx_http_spdy_nv_write_name(last, "version");
+    last = ngx_http_spdy_nv_write_name(last, ":version");
     last = ngx_http_spdy_nv_write_val(last, "HTTP/1.1");
 
-    last = ngx_http_spdy_nv_write_name(last, "status");
+    last = ngx_http_spdy_nv_write_name(last, ":status");
 
     if (r->headers_out.status_line.len) {
         last = ngx_http_spdy_nv_write_vlen(last,
@@ -457,17 +461,6 @@ ngx_http_spdy_header_filter(ngx_http_request_t *r)
             continue;
         }
 
-        if ((header[i].key.len == 6
-             && ngx_strncasecmp(header[i].key.data,
-                                (u_char *) "status", 6) == 0)
-            || (header[i].key.len == 7
-                && ngx_strncasecmp(header[i].key.data,
-                                   (u_char *) "version", 7) == 0))
-        {
-            header[i].hash = 0;
-            continue;
-        }
-
         last = ngx_http_spdy_nv_write_nlen(last, header[i].key.len);
 
         ngx_strlow(last, header[i].key.data, header[i].key.len);
@@ -620,13 +613,14 @@ ngx_http_spdy_header_filter(ngx_http_request_t *r)
 static ngx_chain_t *
 ngx_http_spdy_send_chain(ngx_connection_t *fc, ngx_chain_t *in, off_t limit)
 {
-    off_t                       size, offset;
-    size_t                      rest, frame_size;
-    ngx_chain_t                *cl, *out, **ln;
-    ngx_http_request_t         *r;
-    ngx_http_spdy_stream_t     *stream;
-    ngx_http_spdy_loc_conf_t   *slcf;
-    ngx_http_spdy_out_frame_t  *frame;
+    off_t                        size, offset;
+    size_t                       rest, frame_size;
+    ngx_chain_t                 *cl, *out, **ln;
+    ngx_http_request_t          *r;
+    ngx_http_spdy_stream_t      *stream;
+    ngx_http_spdy_loc_conf_t    *slcf;
+    ngx_http_spdy_out_frame_t   *frame;
+    ngx_http_spdy_connection_t  *sc;
 
     r = fc->data;
     stream = r->spdy_stream;
@@ -642,8 +636,23 @@ ngx_http_spdy_send_chain(ngx_connection_t *fc, ngx_chain_t *in, off_t limit)
         return NULL;
     }
 
+    sc = stream->connection;
+
     size = ngx_buf_size(in->buf);
 
+    if (size && ngx_http_spdy_flow_control(sc, stream) == NGX_DECLINED) {
+        fc->write->delayed = 1;
+        return in;
+    }
+
+    if (limit == 0 || limit > (off_t) sc->send_window) {
+        limit = sc->send_window;
+    }
+
+    if (limit > stream->send_window) {
+        limit = (stream->send_window > 0) ? stream->send_window : 0;
+    }
+
     if (in->buf->tag == (ngx_buf_tag_t) &ngx_http_spdy_filter_get_shadow) {
         cl = ngx_alloc_chain_link(r->pool);
         if (cl == NULL) {
@@ -670,9 +679,8 @@ ngx_http_spdy_send_chain(ngx_connection_t *fc, ngx_chain_t *in, off_t limit)
 
     slcf = ngx_http_get_module_loc_conf(r, ngx_http_spdy_module);
 
-    frame_size = (limit && limit <= (off_t) slcf->chunk_size)
-                 ? (size_t) limit
-                 : slcf->chunk_size;
+    frame_size = (limit <= (off_t) slcf->chunk_size) ? (size_t) limit
+                                                     : slcf->chunk_size;
 
     for ( ;; ) {
         ln = &out;
@@ -735,24 +743,25 @@ ngx_http_spdy_send_chain(ngx_connection_t *fc, ngx_chain_t *in, off_t limit)
             return NGX_CHAIN_ERROR;
         }
 
-        ngx_http_spdy_queue_frame(stream->connection, frame);
+        ngx_http_spdy_queue_frame(sc, frame);
 
+        sc->send_window -= frame_size;
+
+        stream->send_window -= frame_size;
         stream->queued++;
 
         if (in == NULL) {
             break;
         }
 
-        if (limit) {
-            limit -= frame_size;
+        limit -= frame_size;
 
-            if (limit == 0) {
-                break;
-            }
+        if (limit == 0) {
+            break;
+        }
 
-            if (limit < (off_t) slcf->chunk_size) {
-                frame_size = (size_t) limit;
-            }
+        if (limit < (off_t) slcf->chunk_size) {
+            frame_size = (size_t) limit;
         }
     }
 
@@ -770,6 +779,10 @@ ngx_http_spdy_send_chain(ngx_connection_t *fc, ngx_chain_t *in, off_t limit)
         return NGX_CHAIN_ERROR;
     }
 
+    if (in && ngx_http_spdy_flow_control(sc, stream) == NGX_DECLINED) {
+        fc->write->delayed = 1;
+    }
+
     return in;
 }
 
@@ -876,6 +889,8 @@ ngx_http_spdy_filter_get_data_frame(ngx_http_spdy_stream_t *stream,
 
         cl->next = first;
         first = cl;
+
+        last->buf->flush = 1;
     }
 
     frame->first = first;
@@ -915,6 +930,52 @@ ngx_http_spdy_filter_send(ngx_connection_t *fc, ngx_http_spdy_stream_t *stream)
 }
 
 
+static ngx_inline ngx_int_t
+ngx_http_spdy_flow_control(ngx_http_spdy_connection_t *sc,
+    ngx_http_spdy_stream_t *stream)
+{
+    if (stream->send_window <= 0) {
+        stream->exhausted = 1;
+        return NGX_DECLINED;
+    }
+
+    if (sc->send_window == 0) {
+        ngx_http_spdy_waiting_queue(sc, stream);
+        return NGX_DECLINED;
+    }
+
+    return NGX_OK;
+}
+
+
+static void
+ngx_http_spdy_waiting_queue(ngx_http_spdy_connection_t *sc,
+    ngx_http_spdy_stream_t *stream)
+{
+    ngx_queue_t             *q;
+    ngx_http_spdy_stream_t  *s;
+
+    if (stream->handled) {
+        return;
+    }
+
+    stream->handled = 1;
+
+    for (q = ngx_queue_last(&sc->waiting);
+         q != ngx_queue_sentinel(&sc->waiting);
+         q = ngx_queue_prev(q))
+    {
+        s = ngx_queue_data(q, ngx_http_spdy_stream_t, queue);
+
+        if (s->priority >= stream->priority) {
+            break;
+        }
+    }
+
+    ngx_queue_insert_after(q, &stream->queue);
+}
+
+
 static ngx_int_t
 ngx_http_spdy_syn_frame_handler(ngx_http_spdy_connection_t *sc,
     ngx_http_spdy_out_frame_t *frame)
@@ -1063,7 +1124,7 @@ ngx_http_spdy_handle_stream(ngx_http_spdy_connection_t *sc,
 {
     ngx_event_t  *wev;
 
-    if (stream->handled || stream->blocked) {
+    if (stream->handled || stream->blocked || stream->exhausted) {
         return;
     }
 
@@ -1083,13 +1144,22 @@ ngx_http_spdy_filter_cleanup(void *data)
 {
     ngx_http_spdy_stream_t *stream = data;
 
-    ngx_http_spdy_out_frame_t  *frame, **fn;
+    size_t                       delta;
+    ngx_http_spdy_out_frame_t   *frame, **fn;
+    ngx_http_spdy_connection_t  *sc;
+
+    if (stream->handled) {
+        stream->handled = 0;
+        ngx_queue_remove(&stream->queue);
+    }
 
     if (stream->queued == 0) {
         return;
     }
 
-    fn = &stream->connection->last_out;
+    delta = 0;
+    sc = stream->connection;
+    fn = &sc->last_out;
 
     for ( ;; ) {
         frame = *fn;
@@ -1099,14 +1169,26 @@ ngx_http_spdy_filter_cleanup(void *data)
         }
 
         if (frame->stream == stream && !frame->blocked) {
-            stream->queued--;
-
             *fn = frame->next;
+
+            delta += frame->length;
+
+            if (--stream->queued == 0) {
+                break;
+            }
+
             continue;
         }
 
         fn = &frame->next;
     }
+
+    if (sc->send_window == 0 && delta && !ngx_queue_empty(&sc->waiting)) {
+        ngx_queue_add(&sc->posted, &sc->waiting);
+        ngx_queue_init(&sc->waiting);
+    }
+
+    sc->send_window += delta;
 }
 
 
diff --git a/src/http/ngx_http_spdy_module.c b/src/http/ngx_http_spdy_module.c
index c706e3fe6..8307f15c8 100644
--- a/src/http/ngx_http_spdy_module.c
+++ b/src/http/ngx_http_spdy_module.c
@@ -180,11 +180,11 @@ ngx_http_spdy_variable(ngx_http_request_t *r,
     ngx_http_variable_value_t *v, uintptr_t data)
 {
     if (r->spdy_stream) {
-        v->len = 1;
+        v->len = sizeof("3.1") - 1;
         v->valid = 1;
         v->no_cacheable = 0;
         v->not_found = 0;
-        v->data = (u_char *) "2";
+        v->data = (u_char *) "3.1";
 
         return NGX_OK;
     }
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index 0524144f2..26b576441 100644
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -612,7 +612,7 @@ ngx_http_upstream_init_request(ngx_http_request_t *r)
             if (uscf->host.len == host->len
                 && ((uscf->port == 0 && u->resolved->no_port)
                      || uscf->port == u->resolved->port)
-                && ngx_memcmp(uscf->host.data, host->data, host->len) == 0)
+                && ngx_strncasecmp(uscf->host.data, host->data, host->len) == 0)
             {
                 goto found;
             }
diff --git a/src/os/unix/ngx_errno.h b/src/os/unix/ngx_errno.h
index 663e460d9..16cafda31 100644
--- a/src/os/unix/ngx_errno.h
+++ b/src/os/unix/ngx_errno.h
@@ -34,6 +34,7 @@ typedef int               ngx_err_t;
 #define NGX_ENOSPC        ENOSPC
 #define NGX_EPIPE         EPIPE
 #define NGX_EINPROGRESS   EINPROGRESS
+#define NGX_ENOPROTOOPT   ENOPROTOOPT
 #define NGX_EOPNOTSUPP    EOPNOTSUPP
 #define NGX_EADDRINUSE    EADDRINUSE
 #define NGX_ECONNABORTED  ECONNABORTED