Blame SOURCES/httpd-2.4.34-CVE-2018-11763.patch

69c05d
diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c
69c05d
index 805d677..a1b31d2 100644
69c05d
--- a/modules/http2/h2_session.c
69c05d
+++ b/modules/http2/h2_session.c
69c05d
@@ -235,6 +235,7 @@ static int on_data_chunk_recv_cb(nghttp2_session *ngh2, uint8_t flags,
69c05d
     stream = h2_session_stream_get(session, stream_id);
69c05d
     if (stream) {
69c05d
         status = h2_stream_recv_DATA(stream, flags, data, len);
69c05d
+        dispatch_event(session, H2_SESSION_EV_STREAM_CHANGE, 0, "stream data rcvd");
69c05d
     }
69c05d
     else {
69c05d
         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, session->c, APLOGNO(03064)
69c05d
@@ -317,9 +318,9 @@ static int on_header_cb(nghttp2_session *ngh2, const nghttp2_frame *frame,
69c05d
 }
69c05d
 
69c05d
 /**
69c05d
- * nghttp2 session has received a complete frame. Most, it uses
69c05d
- * for processing of internal state. HEADER and DATA frames however
69c05d
- * we need to handle ourself.
69c05d
+ * nghttp2 session has received a complete frame. Most are used by nghttp2
69c05d
+ * for processing of internal state. Some, like HEADER and DATA frames,
69c05d
+ * we need to act on.
69c05d
  */
69c05d
 static int on_frame_recv_cb(nghttp2_session *ng2s,
69c05d
                             const nghttp2_frame *frame,
69c05d
@@ -378,6 +379,9 @@ static int on_frame_recv_cb(nghttp2_session *ng2s,
69c05d
                           "h2_stream(%ld-%d): WINDOW_UPDATE incr=%d", 
69c05d
                           session->id, (int)frame->hd.stream_id,
69c05d
                           frame->window_update.window_size_increment);
69c05d
+            if (nghttp2_session_want_write(session->ngh2)) {
69c05d
+                dispatch_event(session, H2_SESSION_EV_FRAME_RCVD, 0, "window update");
69c05d
+            }
69c05d
             break;
69c05d
         case NGHTTP2_RST_STREAM:
69c05d
             ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, session->c, APLOGNO(03067)
69c05d
@@ -404,6 +408,12 @@ static int on_frame_recv_cb(nghttp2_session *ng2s,
69c05d
                                frame->goaway.error_code, NULL);
69c05d
             }
69c05d
             break;
69c05d
+        case NGHTTP2_SETTINGS:
69c05d
+            if (APLOGctrace2(session->c)) {
69c05d
+                ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, session->c,
69c05d
+                              H2_SSSN_MSG(session, "SETTINGS, len=%ld"), (long)frame->hd.length);
69c05d
+            }
69c05d
+            break;
69c05d
         default:
69c05d
             if (APLOGctrace2(session->c)) {
69c05d
                 char buffer[256];
69c05d
@@ -415,7 +425,40 @@ static int on_frame_recv_cb(nghttp2_session *ng2s,
69c05d
             }
69c05d
             break;
69c05d
     }
69c05d
-    return (APR_SUCCESS == rv)? 0 : NGHTTP2_ERR_PROTO;
69c05d
+    
69c05d
+    if (session->state == H2_SESSION_ST_IDLE) {
69c05d
+        /* We received a frame, but session is in state IDLE. That means the frame
69c05d
+         * did not really progress any of the (possibly) open streams. It was a meta
69c05d
+         * frame, e.g. SETTINGS/WINDOW_UPDATE/unknown/etc.
69c05d
+         * Remember: IDLE means we cannot send because either there are no streams open or
69c05d
+         * all open streams are blocked on exhausted WINDOWs for outgoing data.
69c05d
+         * The more frames we receive that do not change this, the less interested we
69c05d
+         * become in serving this connection. This is expressed in increasing "idle_delays".
69c05d
+         * Eventually, the connection will timeout and we'll close it. */
69c05d
+        session->idle_frames = H2MIN(session->idle_frames + 1, session->frames_received);
69c05d
+            ap_log_cerror( APLOG_MARK, APLOG_TRACE2, 0, session->c,
69c05d
+                          H2_SSSN_MSG(session, "session has %ld idle frames"), 
69c05d
+                          (long)session->idle_frames);
69c05d
+        if (session->idle_frames > 10) {
69c05d
+            apr_size_t busy_frames = H2MAX(session->frames_received - session->idle_frames, 1);
69c05d
+            int idle_ratio = (int)(session->idle_frames / busy_frames); 
69c05d
+            if (idle_ratio > 100) {
69c05d
+                session->idle_delay = apr_time_from_msec(H2MIN(1000, idle_ratio));
69c05d
+            }
69c05d
+            else if (idle_ratio > 10) {
69c05d
+                session->idle_delay = apr_time_from_msec(10);
69c05d
+            }
69c05d
+            else if (idle_ratio > 1) {
69c05d
+                session->idle_delay = apr_time_from_msec(1);
69c05d
+            }
69c05d
+            else {
69c05d
+                session->idle_delay = 0;
69c05d
+            }
69c05d
+        }
69c05d
+    }
69c05d
+    
69c05d
+    if (APR_SUCCESS != rv) return NGHTTP2_ERR_PROTO;
69c05d
+    return 0;
69c05d
 }
69c05d
 
69c05d
 static int h2_session_continue_data(h2_session *session) {
69c05d
@@ -1603,23 +1646,57 @@ static void update_child_status(h2_session *session, int status, const char *msg
69c05d
 
69c05d
 static void transit(h2_session *session, const char *action, h2_session_state nstate)
69c05d
 {
69c05d
+    apr_time_t timeout;
69c05d
+    int ostate, loglvl;
69c05d
+    const char *s;
69c05d
+    
69c05d
     if (session->state != nstate) {
69c05d
-        int loglvl = APLOG_DEBUG;
69c05d
-        if ((session->state == H2_SESSION_ST_BUSY && nstate == H2_SESSION_ST_WAIT)
69c05d
-            || (session->state == H2_SESSION_ST_WAIT && nstate == H2_SESSION_ST_BUSY)){
69c05d
+        ostate = session->state;
69c05d
+        session->state = nstate;
69c05d
+        
69c05d
+        loglvl = APLOG_DEBUG;
69c05d
+        if ((ostate == H2_SESSION_ST_BUSY && nstate == H2_SESSION_ST_WAIT)
69c05d
+            || (ostate == H2_SESSION_ST_WAIT && nstate == H2_SESSION_ST_BUSY)){
69c05d
             loglvl = APLOG_TRACE1;
69c05d
         }
69c05d
         ap_log_cerror(APLOG_MARK, loglvl, 0, session->c, 
69c05d
                       H2_SSSN_LOG(APLOGNO(03078), session, 
69c05d
                       "transit [%s] -- %s --> [%s]"), 
69c05d
-                      h2_session_state_str(session->state), action, 
69c05d
+                      h2_session_state_str(ostate), action, 
69c05d
                       h2_session_state_str(nstate));
69c05d
-        session->state = nstate;
69c05d
+        
69c05d
         switch (session->state) {
69c05d
             case H2_SESSION_ST_IDLE:
69c05d
-                update_child_status(session, (session->open_streams == 0? 
69c05d
-                                              SERVER_BUSY_KEEPALIVE
69c05d
-                                              : SERVER_BUSY_READ), "idle");
69c05d
+                if (!session->remote.emitted_count) {
69c05d
+                    /* on fresh connections, with async mpm, do not return
69c05d
+                     * to mpm for a second. This gives the first request a better
69c05d
+                     * chance to arrive (und connection leaving IDLE state).
69c05d
+                     * If we return to mpm right away, this connection has the
69c05d
+                     * same chance of being cleaned up by the mpm as connections
69c05d
+                     * that already served requests - not fair. */
69c05d
+                    session->idle_sync_until = apr_time_now() + apr_time_from_sec(1);
69c05d
+                    s = "timeout";
69c05d
+                    timeout = H2MAX(session->s->timeout, session->s->keep_alive_timeout);
69c05d
+                    update_child_status(session, SERVER_BUSY_READ, "idle");
69c05d
+                    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, session->c, 
69c05d
+                                  H2_SSSN_LOG("", session, "enter idle, timeout = %d sec"), 
69c05d
+                                  (int)apr_time_sec(H2MAX(session->s->timeout, session->s->keep_alive_timeout)));
69c05d
+                }
69c05d
+                else if (session->open_streams) {
69c05d
+                    s = "timeout";
69c05d
+                    timeout = session->s->keep_alive_timeout;
69c05d
+                    update_child_status(session, SERVER_BUSY_KEEPALIVE, "idle");
69c05d
+                }
69c05d
+                else {
69c05d
+                    /* normal keepalive setup */
69c05d
+                    s = "keepalive";
69c05d
+                    timeout = session->s->keep_alive_timeout;
69c05d
+                    update_child_status(session, SERVER_BUSY_KEEPALIVE, "idle");
69c05d
+                }
69c05d
+                session->idle_until = apr_time_now() + timeout; 
69c05d
+                ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, session->c, 
69c05d
+                              H2_SSSN_LOG("", session, "enter idle, %s = %d sec"), 
69c05d
+                              s, (int)apr_time_sec(timeout));
69c05d
                 break;
69c05d
             case H2_SESSION_ST_DONE:
69c05d
                 update_child_status(session, SERVER_CLOSING, "done");
69c05d
@@ -1726,8 +1803,6 @@ static void h2_session_ev_no_io(h2_session *session, int arg, const char *msg)
69c05d
                      * This means we only wait for WINDOW_UPDATE from the 
69c05d
                      * client and can block on READ. */
69c05d
                     transit(session, "no io (flow wait)", H2_SESSION_ST_IDLE);
69c05d
-                    session->idle_until = apr_time_now() + session->s->timeout;
69c05d
-                    session->keep_sync_until = session->idle_until;
69c05d
                     /* Make sure we have flushed all previously written output
69c05d
                      * so that the client will react. */
69c05d
                     if (h2_conn_io_flush(&session->io) != APR_SUCCESS) {
69c05d
@@ -1738,12 +1813,7 @@ static void h2_session_ev_no_io(h2_session *session, int arg, const char *msg)
69c05d
             }
69c05d
             else if (session->local.accepting) {
69c05d
                 /* When we have no streams, but accept new, switch to idle */
69c05d
-                apr_time_t now = apr_time_now();
69c05d
                 transit(session, "no io (keepalive)", H2_SESSION_ST_IDLE);
69c05d
-                session->idle_until = (session->remote.emitted_count? 
69c05d
-                                       session->s->keep_alive_timeout : 
69c05d
-                                       session->s->timeout) + now;
69c05d
-                session->keep_sync_until = now + apr_time_from_sec(1);
69c05d
             }
69c05d
             else {
69c05d
                 /* We are no longer accepting new streams and there are
69c05d
@@ -1758,12 +1828,25 @@ static void h2_session_ev_no_io(h2_session *session, int arg, const char *msg)
69c05d
     }
69c05d
 }
69c05d
 
69c05d
-static void h2_session_ev_data_read(h2_session *session, int arg, const char *msg)
69c05d
+static void h2_session_ev_frame_rcvd(h2_session *session, int arg, const char *msg)
69c05d
+{
69c05d
+    switch (session->state) {
69c05d
+        case H2_SESSION_ST_IDLE:
69c05d
+        case H2_SESSION_ST_WAIT:
69c05d
+            transit(session, "frame received", H2_SESSION_ST_BUSY);
69c05d
+            break;
69c05d
+        default:
69c05d
+            /* nop */
69c05d
+            break;
69c05d
+    }
69c05d
+}
69c05d
+
69c05d
+static void h2_session_ev_stream_change(h2_session *session, int arg, const char *msg)
69c05d
 {
69c05d
     switch (session->state) {
69c05d
         case H2_SESSION_ST_IDLE:
69c05d
         case H2_SESSION_ST_WAIT:
69c05d
-            transit(session, "data read", H2_SESSION_ST_BUSY);
69c05d
+            transit(session, "stream change", H2_SESSION_ST_BUSY);
69c05d
             break;
69c05d
         default:
69c05d
             /* nop */
69c05d
@@ -1803,16 +1886,6 @@ static void h2_session_ev_pre_close(h2_session *session, int arg, const char *ms
69c05d
 static void ev_stream_open(h2_session *session, h2_stream *stream)
69c05d
 {
69c05d
     h2_iq_append(session->in_process, stream->id);
69c05d
-    switch (session->state) {
69c05d
-        case H2_SESSION_ST_IDLE:
69c05d
-            if (session->open_streams == 1) {
69c05d
-                /* enter timeout, since we have a stream again */
69c05d
-                session->idle_until = (session->s->timeout + apr_time_now());
69c05d
-            }
69c05d
-            break;
69c05d
-        default:
69c05d
-            break;
69c05d
-    }
69c05d
 }
69c05d
 
69c05d
 static void ev_stream_closed(h2_session *session, h2_stream *stream)
69c05d
@@ -1825,11 +1898,6 @@ static void ev_stream_closed(h2_session *session, h2_stream *stream)
69c05d
     }
69c05d
     switch (session->state) {
69c05d
         case H2_SESSION_ST_IDLE:
69c05d
-            if (session->open_streams == 0) {
69c05d
-                /* enter keepalive timeout, since we no longer have streams */
69c05d
-                session->idle_until = (session->s->keep_alive_timeout
69c05d
-                                       + apr_time_now());
69c05d
-            }
69c05d
             break;
69c05d
         default:
69c05d
             break;
69c05d
@@ -1887,6 +1955,7 @@ static void on_stream_state_enter(void *ctx, h2_stream *stream)
69c05d
         default:
69c05d
             break;
69c05d
     }
69c05d
+    dispatch_event(session, H2_SESSION_EV_STREAM_CHANGE, 0, "stream state change");
69c05d
 }
69c05d
 
69c05d
 static void on_stream_event(void *ctx, h2_stream *stream, 
69c05d
@@ -1945,8 +2014,8 @@ static void dispatch_event(h2_session *session, h2_session_event_t ev,
69c05d
         case H2_SESSION_EV_NO_IO:
69c05d
             h2_session_ev_no_io(session, arg, msg);
69c05d
             break;
69c05d
-        case H2_SESSION_EV_DATA_READ:
69c05d
-            h2_session_ev_data_read(session, arg, msg);
69c05d
+        case H2_SESSION_EV_FRAME_RCVD:
69c05d
+            h2_session_ev_frame_rcvd(session, arg, msg);
69c05d
             break;
69c05d
         case H2_SESSION_EV_NGH2_DONE:
69c05d
             h2_session_ev_ngh2_done(session, arg, msg);
69c05d
@@ -1957,6 +2026,9 @@ static void dispatch_event(h2_session *session, h2_session_event_t ev,
69c05d
         case H2_SESSION_EV_PRE_CLOSE:
69c05d
             h2_session_ev_pre_close(session, arg, msg);
69c05d
             break;
69c05d
+        case H2_SESSION_EV_STREAM_CHANGE:
69c05d
+            h2_session_ev_stream_change(session, arg, msg);
69c05d
+            break;
69c05d
         default:
69c05d
             ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, session->c,
69c05d
                           H2_SSSN_MSG(session, "unknown event %d"), ev);
69c05d
@@ -1990,13 +2062,15 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
     apr_status_t status = APR_SUCCESS;
69c05d
     conn_rec *c = session->c;
69c05d
     int rv, mpm_state, trace = APLOGctrace3(c);
69c05d
-
69c05d
+    apr_time_t now;
69c05d
+    
69c05d
     if (trace) {
69c05d
         ap_log_cerror( APLOG_MARK, APLOG_TRACE3, status, c,
69c05d
                       H2_SSSN_MSG(session, "process start, async=%d"), async);
69c05d
     }
69c05d
                   
69c05d
     while (session->state != H2_SESSION_ST_DONE) {
69c05d
+        now = apr_time_now();
69c05d
         session->have_read = session->have_written = 0;
69c05d
 
69c05d
         if (session->local.accepting 
69c05d
@@ -2034,39 +2108,42 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
                 break;
69c05d
                 
69c05d
             case H2_SESSION_ST_IDLE:
69c05d
-                /* We trust our connection into the default timeout/keepalive
69c05d
-                 * handling of the core filters/mpm iff:
69c05d
-                 * - keep_sync_until is not set
69c05d
-                 * - we have an async mpm
69c05d
-                 * - we have no open streams to process
69c05d
-                 * - we are not sitting on a Upgrade: request
69c05d
-                 * - we already have seen at least one request
69c05d
-                 */
69c05d
-                if (!session->keep_sync_until && async && !session->open_streams
69c05d
-                    && !session->r && session->remote.emitted_count) {
69c05d
+                if (session->idle_until && (apr_time_now() + session->idle_delay) > session->idle_until) {
69c05d
+                    ap_log_cerror( APLOG_MARK, APLOG_TRACE1, status, c,
69c05d
+                                  H2_SSSN_MSG(session, "idle, timeout reached, closing"));
69c05d
+                    if (session->idle_delay) {
69c05d
+                        apr_table_setn(session->c->notes, "short-lingering-close", "1"); 
69c05d
+                    }
69c05d
+                    dispatch_event(session, H2_SESSION_EV_CONN_TIMEOUT, 0, "timeout");
69c05d
+                    goto out;
69c05d
+                }
69c05d
+                
69c05d
+                if (session->idle_delay) {
69c05d
+                    /* we are less interested in spending time on this connection */
69c05d
+                    ap_log_cerror( APLOG_MARK, APLOG_TRACE2, status, c,
69c05d
+                                  H2_SSSN_MSG(session, "session is idle (%ld ms), idle wait %ld sec left"), 
69c05d
+                                  (long)apr_time_as_msec(session->idle_delay),
69c05d
+                                  (long)apr_time_sec(session->idle_until - now));
69c05d
+                    apr_sleep(session->idle_delay);
69c05d
+                    session->idle_delay = 0;
69c05d
+                }
69c05d
+
69c05d
+                h2_conn_io_flush(&session->io);
69c05d
+                if (async && !session->r && (now > session->idle_sync_until)) {
69c05d
                     if (trace) {
69c05d
                         ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, c,
69c05d
                                       H2_SSSN_MSG(session, 
69c05d
                                       "nonblock read, %d streams open"), 
69c05d
                                       session->open_streams);
69c05d
                     }
69c05d
-                    h2_conn_io_flush(&session->io);
69c05d
                     status = h2_session_read(session, 0);
69c05d
                     
69c05d
                     if (status == APR_SUCCESS) {
69c05d
                         session->have_read = 1;
69c05d
-                        dispatch_event(session, H2_SESSION_EV_DATA_READ, 0, NULL);
69c05d
                     }
69c05d
-                    else if (APR_STATUS_IS_EAGAIN(status) 
69c05d
-                        || APR_STATUS_IS_TIMEUP(status)) {
69c05d
-                        if (apr_time_now() > session->idle_until) {
69c05d
-                            dispatch_event(session, 
69c05d
-                                           H2_SESSION_EV_CONN_TIMEOUT, 0, NULL);
69c05d
-                        }
69c05d
-                        else {
69c05d
-                            status = APR_EAGAIN;
69c05d
-                            goto out;
69c05d
-                        }
69c05d
+                    else if (APR_STATUS_IS_EAGAIN(status) || APR_STATUS_IS_TIMEUP(status)) {
69c05d
+                        status = APR_EAGAIN;
69c05d
+                        goto out;
69c05d
                     }
69c05d
                     else {
69c05d
                         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, status, c,
69c05d
@@ -2078,7 +2155,6 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
                 }
69c05d
                 else {
69c05d
                     /* make certain, we send everything before we idle */
69c05d
-                    h2_conn_io_flush(&session->io);
69c05d
                     if (trace) {
69c05d
                         ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, c,
69c05d
                                       H2_SSSN_MSG(session, 
69c05d
@@ -2090,7 +2166,6 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
                      */
69c05d
                     status = h2_mplx_idle(session->mplx);
69c05d
                     if (status == APR_EAGAIN) {
69c05d
-                        dispatch_event(session, H2_SESSION_EV_DATA_READ, 0, NULL);
69c05d
                         break;
69c05d
                     }
69c05d
                     else if (status != APR_SUCCESS) {
69c05d
@@ -2101,33 +2176,11 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
                     status = h2_session_read(session, 1);
69c05d
                     if (status == APR_SUCCESS) {
69c05d
                         session->have_read = 1;
69c05d
-                        dispatch_event(session, H2_SESSION_EV_DATA_READ, 0, NULL);
69c05d
                     }
69c05d
                     else if (status == APR_EAGAIN) {
69c05d
                         /* nothing to read */
69c05d
                     }
69c05d
                     else if (APR_STATUS_IS_TIMEUP(status)) {
69c05d
-                        apr_time_t now = apr_time_now();
69c05d
-                        if (now > session->keep_sync_until) {
69c05d
-                            /* if we are on an async mpm, now is the time that
69c05d
-                             * we may dare to pass control to it. */
69c05d
-                            session->keep_sync_until = 0;
69c05d
-                        }
69c05d
-                        if (now > session->idle_until) {
69c05d
-                            if (trace) {
69c05d
-                                ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, c,
69c05d
-                                              H2_SSSN_MSG(session, 
69c05d
-                                              "keepalive timeout"));
69c05d
-                            }
69c05d
-                            dispatch_event(session, 
69c05d
-                                           H2_SESSION_EV_CONN_TIMEOUT, 0, "timeout");
69c05d
-                        }
69c05d
-                        else if (trace) {                        
69c05d
-                            ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, c,
69c05d
-                                          H2_SSSN_MSG(session, 
69c05d
-                                          "keepalive, %f sec left"),
69c05d
-                                          (session->idle_until - now) / 1000000.0f);
69c05d
-                        }
69c05d
                         /* continue reading handling */
69c05d
                     }
69c05d
                     else if (APR_STATUS_IS_ECONNABORTED(status)
69c05d
@@ -2145,6 +2198,18 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
                         dispatch_event(session, H2_SESSION_EV_CONN_ERROR, 0, "error");
69c05d
                     }
69c05d
                 }
69c05d
+                if (nghttp2_session_want_write(session->ngh2)) {
69c05d
+                    ap_update_child_status(session->c->sbh, SERVER_BUSY_WRITE, NULL);
69c05d
+                    status = h2_session_send(session);
69c05d
+                    if (status == APR_SUCCESS) {
69c05d
+                        status = h2_conn_io_flush(&session->io);
69c05d
+                    }
69c05d
+                    if (status != APR_SUCCESS) {
69c05d
+                        dispatch_event(session, H2_SESSION_EV_CONN_ERROR, 
69c05d
+                                       H2_ERR_INTERNAL_ERROR, "writing");
69c05d
+                        break;
69c05d
+                    }
69c05d
+                }
69c05d
                 break;
69c05d
                 
69c05d
             case H2_SESSION_ST_BUSY:
69c05d
@@ -2154,7 +2219,6 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
                     status = h2_session_read(session, 0);
69c05d
                     if (status == APR_SUCCESS) {
69c05d
                         session->have_read = 1;
69c05d
-                        dispatch_event(session, H2_SESSION_EV_DATA_READ, 0, NULL);
69c05d
                     }
69c05d
                     else if (status == APR_EAGAIN) {
69c05d
                         /* nothing to read */
69c05d
@@ -2218,7 +2282,7 @@ apr_status_t h2_session_process(h2_session *session, int async)
69c05d
                                              session->iowait);
69c05d
                 if (status == APR_SUCCESS) {
69c05d
                     session->wait_us = 0;
69c05d
-                    dispatch_event(session, H2_SESSION_EV_DATA_READ, 0, NULL);
69c05d
+                        dispatch_event(session, H2_SESSION_EV_STREAM_CHANGE, 0, NULL);
69c05d
                 }
69c05d
                 else if (APR_STATUS_IS_TIMEUP(status)) {
69c05d
                     /* go back to checking all inputs again */
69c05d
diff --git a/modules/http2/h2_session.h b/modules/http2/h2_session.h
69c05d
index 486938b..452c182 100644
69c05d
--- a/modules/http2/h2_session.h
69c05d
+++ b/modules/http2/h2_session.h
69c05d
@@ -66,10 +66,11 @@ typedef enum {
69c05d
     H2_SESSION_EV_PROTO_ERROR,      /* protocol error */
69c05d
     H2_SESSION_EV_CONN_TIMEOUT,     /* connection timeout */
69c05d
     H2_SESSION_EV_NO_IO,            /* nothing has been read or written */
69c05d
-    H2_SESSION_EV_DATA_READ,        /* connection data has been read */
69c05d
+    H2_SESSION_EV_FRAME_RCVD,       /* a frame has been received */
69c05d
     H2_SESSION_EV_NGH2_DONE,        /* nghttp2 wants neither read nor write anything */
69c05d
     H2_SESSION_EV_MPM_STOPPING,     /* the process is stopping */
69c05d
     H2_SESSION_EV_PRE_CLOSE,        /* connection will close after this */
69c05d
+    H2_SESSION_EV_STREAM_CHANGE,    /* a stream (state/input/output) changed */
69c05d
 } h2_session_event_t;
69c05d
 
69c05d
 typedef struct h2_session {
69c05d
@@ -118,8 +119,10 @@ typedef struct h2_session {
69c05d
     apr_size_t max_stream_mem;      /* max buffer memory for a single stream */
69c05d
     
69c05d
     apr_time_t idle_until;          /* Time we shut down due to sheer boredom */
69c05d
-    apr_time_t keep_sync_until;     /* Time we sync wait until passing to async mpm */
69c05d
-    
69c05d
+    apr_time_t idle_sync_until;     /* Time we sync wait until keepalive handling kicks in */
69c05d
+    apr_size_t idle_frames;         /* number of rcvd frames that kept session in idle state */
69c05d
+    apr_interval_time_t idle_delay; /* Time we delay processing rcvd frames in idle state */
69c05d
+
69c05d
     apr_bucket_brigade *bbtmp;      /* brigade for keeping temporary data */
69c05d
     struct apr_thread_cond_t *iowait; /* our cond when trywaiting for data */
69c05d