From 08b5ad92992e8fb78858f455692ee583cae64a92 Mon Sep 17 00:00:00 2001
From: Andy Green <andy@warmcat.com>
Date: Thu, 29 Nov 2018 08:29:48 +0800
Subject: [PATCH] role: raw-proxy

---
 CMakeLists.txt                                |  18 +
 README.md                                     |  24 +
 READMEs/README.http-fallback.md               | 172 ++++++
 cmake/lws_config.h.in                         | 241 +++-----
 doc-assets/accept-flow-1.svg                  |  46 ++
 doc-assets/accept-flow-2.svg                  |  71 +++
 doc-assets/accept-flow-3.svg                  |  23 +
 include/libwebsockets/lws-adopt.h             |   1 +
 include/libwebsockets/lws-callbacks.h         |  36 ++
 include/libwebsockets/lws-context-vhost.h     |   1 -
 include/libwebsockets/lws-write.h             |   2 +-
 lib/core/adopt.c                              |   8 +-
 lib/core/connect.c                            |   3 +
 lib/core/context.c                            |  31 +-
 lib/core/service.c                            |   8 +-
 lib/roles/cgi/ops-cgi.c                       |   2 +
 lib/roles/dbus/dbus.c                         |   2 +
 lib/roles/h1/ops-h1.c                         |   9 +-
 lib/roles/h2/ops-h2.c                         |   4 +
 lib/roles/http/client/client-handshake.c      |  89 ++-
 lib/roles/http/client/client.c                |   3 +-
 lib/roles/http/server/lejp-conf.c             |   2 +
 lib/roles/http/server/parsers.c               |   8 +-
 lib/roles/http/server/server.c                |  35 +-
 lib/roles/listen/ops-listen.c                 |   2 +
 lib/roles/pipe/ops-pipe.c                     |   2 +
 lib/roles/private.h                           |  16 +
 lib/roles/raw-file/ops-raw-file.c             |   4 +
 lib/roles/raw-proxy/ops-raw-proxy.c           | 217 +++++++
 lib/roles/raw-proxy/private.h                 |  41 ++
 lib/roles/raw-skt/ops-raw-skt.c               |   4 +
 lib/roles/ws/ops-ws.c                         |   4 +
 lib/tls/tls-server.c                          |  10 +-
 libwebsockets.dox                             |   1 +
 minimal-examples/raw/README.md                |   3 +
 .../README.md                                 |   4 +-
 .../minimal-raw-fallback-http-server.c        |   2 +-
 .../minimal-raw-netcat/minimal-raw-netcat.c   |   8 +-
 .../minimal-raw-proxy-fallback/CMakeLists.txt |  84 +++
 .../raw/minimal-raw-proxy-fallback/README.md  |  49 ++
 .../localhost-100y.cert                       |  34 ++
 .../localhost-100y.key                        |  52 ++
 .../minimal-raw-proxy-fallback.c              | 134 ++++
 .../mount-origin/404.html                     |   9 +
 .../mount-origin/favicon.ico                  | Bin 0 -> 1406 bytes
 .../mount-origin/index.html                   |  15 +
 .../mount-origin/libwebsockets.org-logo.svg   | 120 ++++
 .../mount-origin/strict-csp.svg               |  53 ++
 .../raw/minimal-raw-proxy/CMakeLists.txt      |  84 +++
 .../raw/minimal-raw-proxy/README.md           |  41 ++
 .../raw/minimal-raw-proxy/minimal-raw-proxy.c |  91 +++
 .../raw/minimal-raw-vhost/minimal-raw-vhost.c |   2 +-
 plugins/raw-proxy/README.md                   |  66 ++
 plugins/raw-proxy/protocol_lws_raw_proxy.c    | 574 ++++++++++++++++++
 test-apps/test-server.c                       |   2 +-
 55 files changed, 2340 insertions(+), 227 deletions(-)
 create mode 100644 READMEs/README.http-fallback.md
 create mode 100644 doc-assets/accept-flow-1.svg
 create mode 100644 doc-assets/accept-flow-2.svg
 create mode 100644 doc-assets/accept-flow-3.svg
 create mode 100644 lib/roles/raw-proxy/ops-raw-proxy.c
 create mode 100644 lib/roles/raw-proxy/private.h
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/CMakeLists.txt
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/README.md
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.cert
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.key
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/minimal-raw-proxy-fallback.c
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/404.html
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/favicon.ico
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/index.html
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/libwebsockets.org-logo.svg
 create mode 100644 minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/strict-csp.svg
 create mode 100644 minimal-examples/raw/minimal-raw-proxy/CMakeLists.txt
 create mode 100644 minimal-examples/raw/minimal-raw-proxy/README.md
 create mode 100644 minimal-examples/raw/minimal-raw-proxy/minimal-raw-proxy.c
 create mode 100644 plugins/raw-proxy/README.md
 create mode 100644 plugins/raw-proxy/protocol_lws_raw_proxy.c

diff --git a/CMakeLists.txt b/CMakeLists.txt
index e9e1a447..e44fee84 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -25,6 +25,7 @@ option(LWS_FOR_GITOHASHI "Enable features recommended for use with gitohashi" OF
 option(LWS_ROLE_H1 "Compile with support for http/1 (needed for ws)" ON)
 option(LWS_ROLE_WS "Compile with support for websockets" ON)
 option(LWS_ROLE_DBUS "Compile with support for DBUS" OFF)
+option(LWS_ROLE_RAW_PROXY "Raw packet proxy" OFF)
 option(LWS_WITH_HTTP2 "Compile with server support for HTTP/2" ON)
 option(LWS_WITH_LWSWS "Libwebsockets Webserver" OFF)
 option(LWS_WITH_CGI "Include CGI (spawn process with network-connected stdin/out/err) APIs" OFF)
@@ -154,6 +155,7 @@ if(LWS_WITH_DISTRO_RECOMMENDED)
 	set(LWS_WITH_LWSAC 1)
 	set(LWS_WITH_LEJP_CONF 1)
 	set(LWS_WITH_PLUGINS 1)
+	set(LWS_ROLE_RAW_PROXY 1)
 endif()
 
 # do you care about this?  Then send me a patch where it disables it on travis
@@ -279,6 +281,12 @@ if (LWS_WITH_LWSWS)
  set(LWS_WITH_LEJP 1)
  set(LWS_WITH_LEJP_CONF 1)
  set(LWS_WITH_PEER_LIMITS 1)
+ set(LWS_ROLE_RAW_PROXY 1)
+endif()
+
+if (LWS_ROLE_RAW_PROXY)
+ set (LWS_WITHOUT_CLIENT 0)
+ set (LWS_WITHOUT_SERVER 0)
 endif()
 
 if (LWS_WITH_ACME)
@@ -896,6 +904,11 @@ if (LWS_ROLE_RAW)
 		lib/roles/raw-file/ops-raw-file.c)
 endif()
 
+if (LWS_ROLE_RAW_PROXY)
+	list(APPEND SOURCES
+		lib/roles/raw-proxy/ops-raw-proxy.c)
+endif()
+
 if (LWS_ROLE_CGI)
 	list(APPEND SOURCES
 		lib/roles/cgi/cgi-server.c
@@ -2016,6 +2029,11 @@ endif()
 		create_plugin(protocol_post_demo ""
 			      "plugins/protocol_post_demo.c" "" "")
 
+if (LWS_ROLE_RAW_PROXY)
+		create_plugin(protocol_lws_raw_proxy ""
+			      "plugins/raw-proxy/protocol_lws_raw_proxy.c" "" "")
+endif()
+
 if (LWS_WITH_FTS)
 		create_plugin(protocol_fulltext_demo ""
 			      "plugins/protocol_fulltext_demo.c" "" "")
diff --git a/README.md b/README.md
index 85a0846a..2ae78a8d 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,30 @@ various scenarios, CC0-licensed (public domain) for cut-and-paste, allow you to
 News
 ----
 
+## New features on master
+
+ - **http fallback support** - you can specify a role and protocol to apply if non-http or non-tls
+   packets arrive at an http(s) listen port.  For example, you can specify that the new `raw proxy`
+   role + protocol should be used, to proxy your sshd port over :443 or :80.  Without affecting
+   normal http(s) serving on those ports but allowing, eg, `ssh -p 443 invalid@libwebsockets.org`.
+   [http fallback docs](https://libwebsockets.org/git/libwebsockets/tree/READMEs/README.http-fallback.md)
+
+ - **raw tcp proxy role and protocol** - adding raw tcp proxying is now trivial using the built-in lws
+   implementation.  You can control the onward connection using a pvo in the format "ipv4:server.com:port"
+   [raw proxy minimal example](https://libwebsockets.org/git/libwebsockets/tree/minimal-examples/raw/minimal-raw-proxy),
+   [raw proxy docs](https://libwebsockets.org/git/libwebsockets/tree/plugins/raw-proxy),
+   Cmake config: `-DLWS_ROLE_RAW_PROXY=1 -DLWS_WITH_PLUGINS=1`
+
+ - **deaddrop HTML file upload protocol** - protocol and minimal example for file upload and sharing using
+   drag and drop and a file picker.  Integrated with basic auth, uploaded files marked with upload user,
+   and files owned by the authenticated user may be deleted via the UI.  Supports multiple simultaneous
+   uploads both by drag-and-drop and from the file picker.
+   [deaddrop minimal example](https://libwebsockets.org/git/libwebsockets/tree/minimal-examples/http-server/minimal-http-server-deaddrop)
+
+ - **basic auth for ws(s)** - You can apply basic auth credential requirement to ws connections same
+   as on mounts now.  Just add a pvo "basic-auth" with the value being the credentials file path when
+   enabling the ws protocol for the vhost.
+
 ## v3.1 released: new features in v3.1
 
  - **lws threadpool** - lightweight pool of pthreads integrated to lws wsi, with all
diff --git a/READMEs/README.http-fallback.md b/READMEs/README.http-fallback.md
new file mode 100644
index 00000000..120b00f0
--- /dev/null
+++ b/READMEs/README.http-fallback.md
@@ -0,0 +1,172 @@
+# Http fallback and raw proxying
+
+Lws has several interesting options and features that can be applied to get
+some special behaviours... this article discusses them and how they work.
+
+## Overview of normal vhost selection
+
+Lws supports multiple http or https vhosts sharing a listening socket on the
+same port.
+
+For unencrypted http, the Host: header is used to select which vhost the
+connection should bind to, by comparing what is given there against the
+names the server was configured with for the various vhosts.  If no match, it
+selects the first configured vhost.
+
+For TLS, it has an extension called SNI (Server Name Indication) which tells
+the server early in the TLS handshake the host name the connection is aimed at.
+That allows lws to select the vhost early, and use vhost-specific TLS certs
+so everything is happy.  Again, if there is no match the connection proceeds
+using the first configured vhost and its certs.
+
+## Http(s) fallback options
+
+What happens if you try to connect, eg, an ssh client to the http server port
+(this is not an idle question...)?  Obviously the http server part or the tls
+part of lws will fail the connection and close it.  (We will look at that flow
+in a moment in detail for both unencrypted and tls listeners.)
+
+However if the first configured vhost for the port was created with the
+vhost creation info struct `.options` flag `LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG`,
+then instead of the error, the connection transitions to whatever role was
+given in the vhost creation info struct `.listen_accept_role` and `.listen_accept_protocol`.
+
+With lejp-conf / lwsws, the options can be applied to the first vhost using:
+
+```
+   "listen-accept-role": "the-role-name",
+   "listen-accept-protocol": "the-protocol-name",
+   "fallback-listen-accept": "1"
+```
+
+See `./minimal-examples/raw/minimal-raw-fallback-http-server` for examples of
+all the options in use via commandline flags.
+
+So long as the first packet for the protocol doesn't look like GET, POST, or
+a valid tls packet if connection to an https vhost, this allows the one listen
+socket to handle both http(s) and a second protocol, as we will see, like ssh.
+
+Notice there is a restriction that no vhost selection processing is possible,
+neither for tls listeners nor plain http ones... the packet belonging to a
+different protocol will not send any Host: header nor tls SNI.
+
+Therefore although the flags and settings are applied to the first configured
+vhost, actually their effect is global for a given listen port.  If enabled,
+all vhosts on the same listen port will do the fallback action.
+
+### Plain http flow
+
+![plain http flow](/doc-assets/accept-flow-1.svg)
+
+Normally, if the first received packet does not contain a valid HTTP method,
+then the connection is dropped.  Which is what you want from an http server.
+
+However if enabled, the connection can transition to the defined secondary
+role / protocol.
+
+|Flag|lejp-conf / lwsws|Function|
+|---|---|---|
+|`LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG`|`"fallback-listen-accept": "1"`|Enable fallback processing|
+
+### TLS https flow
+
+![tls https flow](/doc-assets/accept-flow-2.svg)
+
+If the port is listening with tls, the point that a packet from a different
+protocol will fail is earlier, when the tls tunnel is being set up.
+
+|Flag|lejp-conf / lwsws|Function|
+|---|---|---|
+|`LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG`|`"fallback-listen-accept": "1"`|Enable fallback processing|
+|`LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS`|`"redirect-http": "1"`|Treat invalid tls packet as http, issue http redirect to https://|
+|`LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER`|`"allow-http-on-https": "1"`|Accept unencrypted http connections on this tls port (dangerous)|
+
+The latter two options are higher priority than, and defeat, the first one.
+
+### Non-http listener
+
+![non-http flow](/doc-assets/accept-flow-3.svg)
+
+It's also possible to skip the fallback processing and just force the first
+vhost on the port to use the specified role and protocol in the first place.
+
+|Flag|lejp-conf / lwsws|Function|
+|---|---|---|
+|LWS_SERVER_OPTION_ADOPT_APPLY_LISTEN_ACCEPT_CONFIG|`"apply-listen-accept": "1"`|Force vhost to use listen-accept-role / listen-accept-protocol|
+
+## Using http(s) fallback with raw-proxy
+
+If enabled for build with `cmake .. -DLWS_ROLE_RAW_PROXY=1 -DLWS_WITH_PLUGINS=1`
+then lws includes ready-to-use support for raw tcp proxying.
+
+This can be used standalone on the first vhost on a port, but most intriguingly
+it can be specified as the fallback for http(s)...
+
+See `./minimal-examples/raw/minimal-raw-proxy-fallback.c` for a working example.
+
+### fallback with raw-proxy in code
+
+On the first vhost for the port, specify the required "onward" pvo to configure
+the raw-proxy protocol...you can adjust the "ipv4:127.0.0.1:22" to whatever you
+want...
+
+```
+	static struct lws_protocol_vhost_options pvo1 = {
+	        NULL,
+	        NULL,
+	        "onward",		/* pvo name */
+	        "ipv4:127.0.0.1:22"	/* pvo value */
+	};
+
+	static const struct lws_protocol_vhost_options pvo = {
+	        NULL,           	/* "next" pvo linked-list */
+	        &pvo1,			/* "child" pvo linked-list */
+	        "raw-proxy",		/* protocol name we belong to on this vhost */
+	        ""              	/* ignored */
+	};
+```
+
+... and set up the fallback enable and bindings...
+
+```
+	info.options |= LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG;
+	info.listen_accept_role = "raw_proxy";
+	info.listen_accept_proxy = "raw_proxy";
+	info.pvo = &pvo;
+```
+
+### fallback with raw-proxy in JSON conf
+
+On the first vhost for the port, enable the raw-proxy protocol on the vhost and
+set the pvo config
+
+```
+                "ws-protocols": [{
+                        "raw-proxy": {
+                         "status": "ok",
+                         "onward": "ipv4:127.0.0.1:22"
+                        }
+                 }],
+```
+
+Enable the fallback behaviour on the vhost and the role / protocol binding
+
+```
+	"listen-accept-role": "raw-proxy",
+	"listen-accept-protocol": "raw-proxy",
+	"fallback-listen-accept": "1"
+```
+
+### Testing
+
+With this configured, the listen port will function normally for http or https
+depending on how it was set up.
+
+But if you try to connect to it with an ssh client, that will also work fine.
+
+The libwebsockets.org server is set up in this way, you can confirm it by
+visiting `https://libwebsockets.org` on port 443 as usual, but also trying
+`ssh -p 443 invalid@libwebsockets.org`... you will get permission denied from
+your ssh client.  With valid credentials in fact that works perfectly for
+ssh, scp, git-over-ssh etc all on port 443...
+
diff --git a/cmake/lws_config.h.in b/cmake/lws_config.h.in
index 045be0e6..41c06afc 100644
--- a/cmake/lws_config.h.in
+++ b/cmake/lws_config.h.in
@@ -7,186 +7,101 @@
 #endif
 
 #define LWS_INSTALL_DATADIR "${CMAKE_INSTALL_PREFIX}/share"
-
-#cmakedefine LWS_ROLE_H1
-#cmakedefine LWS_ROLE_WS
-#cmakedefine LWS_ROLE_RAW
-#cmakedefine LWS_ROLE_H2
-#cmakedefine LWS_ROLE_CGI
-#cmakedefine LWS_ROLE_DBUS
-
-#cmakedefine LWS_WITH_LWSAC
-#cmakedefine LWS_WITH_FTS
-
-/* Define to 1 to use wolfSSL/CyaSSL as a replacement for OpenSSL.
- * LWS_OPENSSL_SUPPORT needs to be set also for this to work. */
-#cmakedefine USE_WOLFSSL
-
-/* Also define to 1 (in addition to USE_WOLFSSL) when using the
-  (older) CyaSSL library */
-#cmakedefine USE_OLD_CYASSL
-#cmakedefine LWS_WITH_BORINGSSL
-
-#cmakedefine LWS_WITH_MBEDTLS
-#cmakedefine LWS_WITH_POLARSSL
-#cmakedefine LWS_WITH_ESP32
-
-#cmakedefine LWS_WITH_PLUGINS
-#cmakedefine LWS_WITH_NO_LOGS
-
-/* The Libwebsocket version */
-#cmakedefine LWS_LIBRARY_VERSION "${LWS_LIBRARY_VERSION}"
-
 #define LWS_LIBRARY_VERSION_MAJOR ${LWS_LIBRARY_VERSION_MAJOR}
 #define LWS_LIBRARY_VERSION_MINOR ${LWS_LIBRARY_VERSION_MINOR}
 #define LWS_LIBRARY_VERSION_PATCH ${LWS_LIBRARY_VERSION_PATCH}
 /* LWS_LIBRARY_VERSION_NUMBER looks like 1005001 for e.g. version 1.5.1 */
-#define LWS_LIBRARY_VERSION_NUMBER (LWS_LIBRARY_VERSION_MAJOR*1000000)+(LWS_LIBRARY_VERSION_MINOR*1000)+LWS_LIBRARY_VERSION_PATCH
+#define LWS_LIBRARY_VERSION_NUMBER (LWS_LIBRARY_VERSION_MAJOR * 1000000) + \
+					(LWS_LIBRARY_VERSION_MINOR * 1000) + \
+					LWS_LIBRARY_VERSION_PATCH
+#define LWS_MAX_SMP ${LWS_MAX_SMP}
 
-/* The current git commit hash that we're building from */
+#cmakedefine LWS_AVOID_SIGPIPE_IGN
 #cmakedefine LWS_BUILD_HASH "${LWS_BUILD_HASH}"
-
-/* Build with OpenSSL support ... alias of LWS_WITH_TLS for compatibility*/
-#cmakedefine LWS_OPENSSL_SUPPORT
-#cmakedefine LWS_WITH_TLS
-
-/* The client should load and trust CA root certs it finds in the OS */
-#cmakedefine LWS_SSL_CLIENT_USE_OS_CA_CERTS
-
-/* Sets the path where the client certs should be installed. */
-#cmakedefine LWS_OPENSSL_CLIENT_CERTS "${LWS_OPENSSL_CLIENT_CERTS}"
-
-/* Turn off websocket extensions */
-#cmakedefine LWS_WITHOUT_EXTENSIONS
-
-/* notice if client or server gone */
-#cmakedefine LWS_WITHOUT_SERVER
-#cmakedefine LWS_WITHOUT_CLIENT
-
-#cmakedefine LWS_WITH_POLL
-
-/* Enable libev io loop */
-#cmakedefine LWS_WITH_LIBEV
-
-/* Enable libuv io loop */
-#cmakedefine LWS_WITH_LIBUV
-
-/* Enable libevent io loop */
-#cmakedefine LWS_WITH_LIBEVENT
-
-/* Build with support for ipv6 */
-#cmakedefine LWS_WITH_IPV6
-
-/* Build with support for UNIX domain socket */
-#cmakedefine LWS_WITH_UNIX_SOCK
-
-/* Build with support for HTTP2 */
-#cmakedefine LWS_WITH_HTTP2
-
-/* Turn on latency measuring code */
-#cmakedefine LWS_LATENCY
-
-/* Don't build the daemonizeation api */
-#cmakedefine LWS_NO_DAEMONIZE
-
-/* Build without server support */
-#cmakedefine LWS_NO_SERVER
-
-/* Build without client support */
-#cmakedefine LWS_NO_CLIENT
-
-/* If we should compile with MinGW support */
-#cmakedefine LWS_MINGW_SUPPORT
-
-/* Use the BSD getifaddrs that comes with libwebsocket, for uclibc support */
 #cmakedefine LWS_BUILTIN_GETIFADDRS
-
-/* use SHA1() not internal libwebsockets_SHA1 */
-#cmakedefine LWS_SHA1_USE_OPENSSL_NAME
-
-/* SSL server using ECDH certificate */
-#cmakedefine LWS_SSL_SERVER_WITH_ECDH_CERT
-#cmakedefine LWS_HAVE_SSL_CTX_set1_param
-#cmakedefine LWS_HAVE_X509_VERIFY_PARAM_set1_host
+#cmakedefine LWS_FALLBACK_GETHOSTBYNAME
+#cmakedefine LWS_HAS_INTPTR_T
+#cmakedefine LWS_HAVE__ATOI64
+#cmakedefine LWS_HAVE_ATOLL
+#cmakedefine LWS_HAVE_LIBCAP
+#cmakedefine LWS_HAVE_MALLOC_H
+#cmakedefine LWS_HAVE_NEW_UV_VERSION_H
+#cmakedefine LWS_HAVE_OPENSSL_ECDH_H
+#cmakedefine LWS_HAVE_PIPE2
+#cmakedefine LWS_HAVE_PTHREAD_H
 #cmakedefine LWS_HAVE_RSA_SET0_KEY
-#cmakedefine LWS_HAVE_X509_get_key_usage
 #cmakedefine LWS_HAVE_SSL_CTX_get0_certificate
+#cmakedefine LWS_HAVE_SSL_CTX_set1_param
 #cmakedefine LWS_HAVE_SSL_CTX_set_ciphersuites
-
+#cmakedefine LWS_HAVE_SSL_EXTRA_CHAIN_CERTS
+#cmakedefine LWS_HAVE_SSL_get0_alpn_selected
+#cmakedefine LWS_HAVE_SSL_set_alpn_protos
+#cmakedefine LWS_HAVE_SSL_SET_INFO_CALLBACK
+#cmakedefine LWS_HAVE__STAT32I64
+#cmakedefine LWS_HAVE_STDINT_H
+#cmakedefine LWS_HAVE_SYS_CAPABILITY_H
+#cmakedefine LWS_HAVE_TLS_CLIENT_METHOD
+#cmakedefine LWS_HAVE_TLSV1_2_CLIENT_METHOD
 #cmakedefine LWS_HAVE_UV_VERSION_H
-#cmakedefine LWS_HAVE_NEW_UV_VERSION_H
-#cmakedefine LWS_HAVE_PTHREAD_H
-
-/* CGI apis */
+#cmakedefine LWS_HAVE_X509_get_key_usage
+#cmakedefine LWS_HAVE_X509_VERIFY_PARAM_set1_host
+#cmakedefine LWS_LATENCY
+#cmakedefine LWS_LIBRARY_VERSION "${LWS_LIBRARY_VERSION}"
+#cmakedefine LWS_MINGW_SUPPORT
+#cmakedefine LWS_NO_CLIENT
+#cmakedefine LWS_NO_DAEMONIZE
+#cmakedefine LWS_NO_SERVER
+#cmakedefine LWS_OPENSSL_CLIENT_CERTS "${LWS_OPENSSL_CLIENT_CERTS}"
+#cmakedefine LWS_OPENSSL_SUPPORT
+#cmakedefine LWS_PLAT_OPTEE
+#cmakedefine LWS_ROLE_CGI
+#cmakedefine LWS_ROLE_DBUS
+#cmakedefine LWS_ROLE_H1
+#cmakedefine LWS_ROLE_H2
+#cmakedefine LWS_ROLE_RAW
+#cmakedefine LWS_ROLE_RAW_PROXY
+#cmakedefine LWS_ROLE_WS
+#cmakedefine LWS_SHA1_USE_OPENSSL_NAME
+#cmakedefine LWS_SSL_CLIENT_USE_OS_CA_CERTS
+#cmakedefine LWS_SSL_SERVER_WITH_ECDH_CERT
+#cmakedefine LWS_WITH_ACCESS_LOG
+#cmakedefine LWS_WITH_ACME
+#cmakedefine LWS_WITH_BORINGSSL
 #cmakedefine LWS_WITH_CGI
-
-/* whether the Openssl is recent enough, and / or built with, ecdh */
-#cmakedefine LWS_HAVE_OPENSSL_ECDH_H
-
-/* HTTP Proxy support */
+#cmakedefine LWS_WITH_ESP32
+#cmakedefine LWS_WITH_FTS
+#cmakedefine LWS_WITH_HTTP2
+#cmakedefine LWS_WITH_HTTP_BROTLI
 #cmakedefine LWS_WITH_HTTP_PROXY
-
-/* HTTP Ranges support */
+#cmakedefine LWS_WITH_HTTP_STREAM_COMPRESSION
+#cmakedefine LWS_WITH_IPV6
+#cmakedefine LWS_WITH_JWS
+#cmakedefine LWS_WITH_LEJP
+#cmakedefine LWS_WITH_LIBEV
+#cmakedefine LWS_WITH_LIBEVENT
+#cmakedefine LWS_WITH_LIBUV
+#cmakedefine LWS_WITH_LWSAC
+#cmakedefine LWS_WITH_MBEDTLS
+#cmakedefine LWS_WITH_NO_LOGS
+#cmakedefine LWS_WITHOUT_CLIENT
+#cmakedefine LWS_WITHOUT_EXTENSIONS
+#cmakedefine LWS_WITHOUT_SERVER
+#cmakedefine LWS_WITH_PEER_LIMITS
+#cmakedefine LWS_WITH_PLUGINS
+#cmakedefine LWS_WITH_POLARSSL
+#cmakedefine LWS_WITH_POLL
 #cmakedefine LWS_WITH_RANGES
-
-/* Http access log support */
-#cmakedefine LWS_WITH_ACCESS_LOG
+#cmakedefine LWS_WITH_SELFTESTS
 #cmakedefine LWS_WITH_SERVER_STATUS
-
-#cmakedefine LWS_WITH_STATEFUL_URLDECODE
-#cmakedefine LWS_WITH_PEER_LIMITS
-
-/* Maximum supported service threads */
-#define LWS_MAX_SMP ${LWS_MAX_SMP}
-
-/* Lightweight JSON Parser */
-#cmakedefine LWS_WITH_LEJP
-
-/* SMTP */
 #cmakedefine LWS_WITH_SMTP
-
-/* OPTEE */
-#cmakedefine LWS_PLAT_OPTEE
-
-/* ZIP FOPS */
-#cmakedefine LWS_WITH_ZIP_FOPS
-#cmakedefine LWS_HAVE_STDINT_H
-
-#cmakedefine LWS_AVOID_SIGPIPE_IGN
-
-#cmakedefine LWS_FALLBACK_GETHOSTBYNAME
-
-#cmakedefine LWS_WITH_STATS
 #cmakedefine LWS_WITH_SOCKS5
-
-#cmakedefine LWS_HAVE_SYS_CAPABILITY_H
-#cmakedefine LWS_HAVE_LIBCAP
-
-#cmakedefine LWS_HAVE_ATOLL
-#cmakedefine LWS_HAVE__ATOI64
-#cmakedefine LWS_HAVE__STAT32I64
-
-#cmakedefine LWS_WITH_JWS
-#cmakedefine LWS_WITH_ACME
-#cmakedefine LWS_WITH_SELFTESTS
-
-#cmakedefine LWS_HAVE_MALLOC_H
-
-#cmakedefine LWS_HAVE_PIPE2
-
-/* OpenSSL various APIs */
-
-#cmakedefine LWS_HAVE_TLS_CLIENT_METHOD
-#cmakedefine LWS_HAVE_TLSV1_2_CLIENT_METHOD
-#cmakedefine LWS_HAVE_SSL_SET_INFO_CALLBACK
-#cmakedefine LWS_HAVE_SSL_EXTRA_CHAIN_CERTS
-#cmakedefine LWS_HAVE_SSL_get0_alpn_selected
-#cmakedefine LWS_HAVE_SSL_set_alpn_protos
-
-#cmakedefine LWS_HAS_INTPTR_T
-
-#cmakedefine LWS_WITH_HTTP_STREAM_COMPRESSION
-#cmakedefine LWS_WITH_HTTP_BROTLI
+#cmakedefine LWS_WITH_STATEFUL_URLDECODE
+#cmakedefine LWS_WITH_STATS
 #cmakedefine LWS_WITH_THREADPOOL
+#cmakedefine LWS_WITH_TLS
+#cmakedefine LWS_WITH_UNIX_SOCK
+#cmakedefine LWS_WITH_ZIP_FOPS
+#cmakedefine USE_OLD_CYASSL
+#cmakedefine USE_WOLFSSL
 
 ${LWS_SIZEOFPTR_CODE}
diff --git a/doc-assets/accept-flow-1.svg b/doc-assets/accept-flow-1.svg
new file mode 100644
index 00000000..1c70ca1d
--- /dev/null
+++ b/doc-assets/accept-flow-1.svg
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="171.61mm" height="209.9mm" version="1.1" viewBox="0 0 171.61372 209.89664" xmlns="http://www.w3.org/2000/svg">
+	<defs>
+		<filter id="a" x="-.068968" y="-.055005" width="1.1379" height="1.11" color-interpolation-filters="sRGB">
+			<feGaussianBlur stdDeviation="15.814675"/>
+		</filter>
+	</defs>
+	<g transform="translate(503.09 509.47)">
+		<rect transform="matrix(.27404 0 0 .27404 -943.39 -698.21)" x="1644.6" y="726.68" width="550.33" height="690.03" fill-opacity=".93307" filter="url(#a)"/>
+		<rect x="-496.75" y="-503.13" width="150.81" height="189.09" fill="#fff" fill-opacity=".99606"/>
+		<path d="m-478.17-461.61h23.075c3.3599 0.0747 5.5257 3.5038 5.4557 5.6978s-1.697 5.9145-5.3019 6.0545c-5.0352-0.0508-18.547 0.0709-23.582 0.0206-2.2582-0.0882-4.5671-3.0397-4.5533-6.2647 0.014-3.225 2.6009-5.4327 4.9065-5.5082z" fill="#fff" stroke="#000" stroke-width="1.2058"/>
+		<g>
+			<rect x="-413.06" y="-406.97" width="1.4355" height="26.25"/>
+			<rect transform="rotate(90)" x="-412.46" y="381.78" width="1.4355" height="72.606"/>
+			<rect x="-466.58" y="-449.89" width="1.4355" height="100.28"/>
+		</g>
+		<g fill="#000000" font-family="'Open Sans'" letter-spacing="0px" text-anchor="middle" word-spacing="0px">
+			<text x="-465.56778" y="-337.15268" dominant-baseline="auto" font-size="4.8637px" stroke-width=".30398" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-465.56778" y="-337.15268">http</tspan><tspan x="-465.56778" y="-331.07309">processing</tspan></text>
+			<text x="-467.32571" y="-454.26376" dominant-baseline="auto" font-size="4.8637px" stroke-width=".30398" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-467.32571" y="-454.26376" stroke-width=".30398">Connection</tspan></text>
+			<text x="-365.37674" y="-415.41953" dominant-baseline="auto" font-size="4.6404px" stroke-width=".10461" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-365.37674" y="-415.41953">Fallback</tspan><tspan x="-365.37674" y="-409.61908">role +</tspan><tspan x="-365.37674" y="-403.81863">protocol</tspan></text>
+		</g>
+		<path d="m-460.22-350.48h-11.894l6.2548 6.2549z" stroke="#000" stroke-width=".072506px"/>
+		<g>
+			<path d="m-465.22-424.63-21.47 12.396 22.038 12.723 20.338-11.742z" fill="#fff" stroke="#000" stroke-width="1.0961"/>
+			<text x="-464.97501" y="-413.11075" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.4092px" letter-spacing="0px" stroke-width=".21307" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-464.97501" y="-413.11075">Invalid Method</tspan><tspan x="-464.97501" y="-408.8493">in "http header"</tspan></text>
+			<path d="m-412.77-423.89-21.47 12.396 22.038 12.723 20.748-12.767z" fill="#fff" stroke="#000" stroke-width="1.0961"/>
+			<text x="-412.72952" y="-413.60532" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.4092px" letter-spacing="0px" stroke-width=".21307" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-412.72952" y="-413.60532">Fallback</tspan><tspan x="-412.72952" y="-409.34387">set and enabled</tspan><tspan x="-412.72952" y="-405.08243">on vhost?</tspan></text>
+		</g>
+		<path d="m-382.23-417.61v11.894l6.2549-6.2548z" stroke="#000" stroke-width=".072506px"/>
+		<path d="m-423.88-381.11h23.075c3.36 0.0746 5.5257 3.5038 5.4558 5.6978-0.07 2.194-1.697 5.9145-5.3019 6.0545-5.0352-0.0508-18.547 0.0709-23.582 0.0205-2.2583-0.0882-4.5671-3.0397-4.5533-6.2647 0.014-3.225 2.6009-5.4327 4.9065-5.5082z" fill="#fff" stroke="#000" stroke-width="1.2058"/>
+		<g fill="#000000" font-family="'Open Sans'" letter-spacing="0px" text-anchor="middle" word-spacing="0px">
+			<text x="-413.17911" y="-373.47064" dominant-baseline="auto" font-size="4.8637px" stroke-width=".30398" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-413.17911" y="-373.47064" stroke-width=".30398">Error</tspan></text>
+			<text x="-442.51761" y="-413.80447" dominant-baseline="auto" font-size="3.0936px" stroke-width=".072506" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-442.51761" y="-413.80447" stroke-width=".072506">Yes</tspan></text>
+			<text x="-389.51834" y="-413.87546" dominant-baseline="auto" font-size="3.0936px" stroke-width=".072506" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-389.51834" y="-413.87546" stroke-width=".072506">Yes</tspan></text>
+		</g>
+		<g>
+			<text x="-387.27786" y="-423.98447" dominant-baseline="auto" fill="#0000ff" font-family="'Open Sans'" font-size="2.3761px" letter-spacing="0px" stroke-width=".012375" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-387.27786" y="-423.98447">LWS_SERVER_OPTION_FALLBACK_TO_</tspan><tspan x="-387.27786" y="-421.01437">APPLY_LISTEN_ACCEPT_CONFIG</tspan></text>
+			<text x="-420.85062" y="-484.34042" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="13.921px" letter-spacing="0px" stroke-width=".072506" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-420.85062" y="-484.34042" stroke-width=".072506">plain http port</tspan></text>
+			<path d="m-435.14-458.75c1.9501-3.293 3.8701-6.6043 5.8395-9.8856 0.2398-0.54978 0.8983-0.73811 1.3075-0.10105 0.3564 0.71254 0.6543 1.2038 0.9661 1.8124 1.5622 2.7051 3.1244 5.4102 4.6866 8.1153 0.2615 0.57459 0.2121 1.1772-0.3114 1.4642-0.6619 0.10273-1.0636 0.0238-1.6073 0.0453-3.3541-0.0106-6.7088 0.0256-10.063 0.0135-0.5994 0.042-1.205-0.57336-0.9833-1.1331 0.055-0.11037 0.1104-0.22075 0.1656-0.3311z" fill="#f00"/>
+			<path d="m-433.59-459.48c1.4834-2.5049 2.9439-5.0238 4.442-7.5197 0.1824-0.41821 0.6833-0.56147 0.9946-0.0769 0.2711 0.54201 0.4977 0.91574 0.7349 1.3787 1.1884 2.0577 2.3768 4.1154 3.565 6.1731 0.199 0.43709 0.1614 0.89546-0.2369 1.1138-0.5035 0.0781-0.809 0.0181-1.2225 0.0344-2.5515-8e-3 -5.1034 0.0195-7.655 0.0103-0.456 0.0319-0.9167-0.43614-0.7481-0.86193 0.042-0.084 0.084-0.16791 0.126-0.25186z" fill="#fff"/>
+			<path d="m-429.31-461.54c-0.1016-1.1244-0.2033-2.2489-0.3049-3.3733 0-0.53087 0.5275-0.97852 1.05-0.80555 0.5428 0.0382 0.767 0.61271 0.6514 1.0873-0.192 1.0861-0.287 2.1887-0.5181 3.2682-0.1472 0.45794-0.879 0.39062-0.86-0.12605l-0.019-0.0506z"/>
+			<circle cx="-428.86" cy="-459.79" r=".69563"/>
+			<text x="-399.48111" y="-466.21732" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.0161px" letter-spacing="0px" stroke-width=".10282" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-399.48111" y="-466.21732">This flow happens</tspan><tspan x="-399.48111" y="-462.4472">before any Host: headers.</tspan><tspan x="-399.48111" y="-458.67709">Indeed there are no Host:</tspan><tspan x="-399.48111" y="-454.90701">headers if the connection</tspan><tspan x="-399.48111" y="-451.1369">is not actually http.</tspan><tspan x="-399.48111" y="-447.36679">Therefore it occurs on the</tspan><tspan x="-399.48111" y="-443.59668" font-weight="bold">first vhost that listens</tspan><tspan x="-399.48111" y="-439.82657" font-weight="bold">on the connection port.</tspan></text>
+		</g>
+	</g>
+</svg>
diff --git a/doc-assets/accept-flow-2.svg b/doc-assets/accept-flow-2.svg
new file mode 100644
index 00000000..1a47cf94
--- /dev/null
+++ b/doc-assets/accept-flow-2.svg
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="182.1mm" height="225.6mm" version="1.1" viewBox="0 0 182.09999 225.60331" xmlns="http://www.w3.org/2000/svg">
+	<defs>
+		<filter id="a" x="-.062619" y="-.049353" width="1.1252" height="1.0987" color-interpolation-filters="sRGB">
+			<feGaussianBlur stdDeviation="15.408275"/>
+		</filter>
+	</defs>
+	<g transform="translate(807.32 618)">
+		<rect transform="matrix(.27404 0 0 .27404 -1453.5 -811.64)" x="2395" y="743.62" width="590.55" height="749.3" fill-opacity=".99606" filter="url(#a)"/>
+		<rect x="-799.8" y="-610.76" width="161.83" height="205.34" fill="#fff" fill-opacity=".99606"/>
+		<g>
+			<rect transform="rotate(90)" x="-460.09" y="677.79" width="1.4355" height="24.758"/>
+			<rect transform="rotate(90)" x="-493.87" y="731.55" width="1.4355" height="21.272"/>
+			<text x="-739.81171" y="-495.0983" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.0936px" letter-spacing="0px" stroke-width=".072506" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-739.81171" y="-495.0983" stroke-width=".072506">Yes</tspan></text>
+		</g>
+		<path d="m-777.65-577.12h23.075c3.3599 0.0747 5.5257 3.5038 5.4557 5.6978-0.07 2.1941-1.697 5.9145-5.3018 6.0545-5.0352-0.0509-18.547 0.0709-23.582 0.0206-2.2582-0.0882-4.5671-3.0397-4.5533-6.2647 0.014-3.225 2.6009-5.4327 4.9065-5.5082z" fill="#fff" stroke="#000" stroke-width="1.2058"/>
+		<g>
+			<rect x="-712.54" y="-522.48" width="1.4355" height="26.25"/>
+			<rect transform="rotate(90)" x="-527.97" y="677.63" width="1.4355" height="76.231"/>
+			<rect x="-766.07" y="-565.39" width="1.4355" height="100.28"/>
+		</g>
+		<g fill="#000000" font-family="'Open Sans'" letter-spacing="0px" text-anchor="middle" word-spacing="0px">
+			<text x="-765.05292" y="-452.6568" dominant-baseline="auto" font-size="4.8637px" stroke-width=".30398" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-765.05292" y="-452.6568">http</tspan><tspan x="-765.05292" y="-446.57721">processing</tspan></text>
+			<text x="-766.81085" y="-569.76788" dominant-baseline="auto" font-size="4.8637px" stroke-width=".30398" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-766.81085" y="-569.76788" stroke-width=".30398">Connection</tspan></text>
+			<text x="-660.09058" y="-531.22888" dominant-baseline="auto" font-size="4.6404px" stroke-width=".072506" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-660.09058" y="-531.22888">Issue http</tspan><tspan x="-660.09058" y="-525.42847">redirect to</tspan><tspan x="-660.09058" y="-519.62799">https://</tspan></text>
+		</g>
+		<path d="m-759.71-465.99h-11.894l6.2548 6.2548z" stroke="#000" stroke-width=".072506px"/>
+		<g>
+			<path d="m-765.43-540.28-21.47 12.396 22.038 12.723 20.338-11.742z" fill="#fff" stroke="#000" stroke-width="1.0961"/>
+			<text x="-764.46002" y="-528.61481" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.4092px" letter-spacing="0px" stroke-width=".21307" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-764.46002" y="-528.61481">TLS header</tspan><tspan x="-764.46002" y="-524.35339">looks bad?</tspan></text>
+			<path d="m-712.26-539.4-21.47 12.396 22.038 12.723 20.748-12.767z" fill="#fff" stroke="#000" stroke-width="1.0961"/>
+			<text x="-712.21466" y="-529.10938" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.4092px" letter-spacing="0px" stroke-width=".21307" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-712.21466" y="-529.10938">Redirect http</tspan><tspan x="-712.21466" y="-524.84796">to https enabled?</tspan></text>
+		</g>
+		<path d="m-678.95-533.2v11.894l6.2549-6.2548z" stroke="#000" stroke-width=".072506px"/>
+		<g>
+			<text x="-739.98285" y="-528.75726" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.0936px" letter-spacing="0px" stroke-width=".072506" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-739.98285" y="-528.75726" stroke-width=".072506">Yes</tspan></text>
+			<text x="-688.21381" y="-529.19232" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.0936px" letter-spacing="0px" stroke-width=".072506" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-688.21381" y="-529.19232" stroke-width=".072506">Yes</tspan></text>
+			<rect x="-712.26" y="-488.52" width="1.4355" height="26.25"/>
+		</g>
+		<path d="m-711.97-505.44-21.47 12.396 22.038 12.723 20.748-12.767z" fill="#fff" stroke="#000" stroke-width="1.0961"/>
+		<g>
+			<text x="-711.93158" y="-495.14944" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.4092px" letter-spacing="0px" stroke-width=".21307" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-711.93158" y="-495.14944">Allow http</tspan><tspan x="-711.93158" y="-490.888">on https enabled?</tspan></text>
+			<rect transform="rotate(45.692)" x="-879.04" y="193.74" width="1.5071" height="18.707"/>
+			<rect x="-712.38" y="-454.93" width="1.4355" height="26.25"/>
+		</g>
+		<g stroke="#000">
+			<path d="m-712.09-471.85-21.47 12.396 22.038 12.723 20.748-12.767z" fill="#fff" stroke-width="1.0961"/>
+			<path d="m-678.88-465.36v11.894l6.2548-6.2548z" stroke-width=".072506px"/>
+			<path d="m-723.2-429.07h23.075c3.36 0.0746 5.5257 3.5038 5.4558 5.6978-0.07 2.194-1.697 5.9145-5.3019 6.0545-5.0352-0.0508-18.547 0.0709-23.582 0.0205-2.2582-0.0882-4.5671-3.0397-4.5533-6.2647 0.014-3.225 2.6009-5.4327 4.9065-5.5082z" fill="#fff" stroke-width="1.2058"/>
+		</g>
+		<g fill="#000000" font-family="'Open Sans'" letter-spacing="0px" text-anchor="middle" word-spacing="0px">
+			<text x="-712.4975" y="-421.4249" dominant-baseline="auto" font-size="4.8637px" stroke-width=".30398" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-712.4975" y="-421.4249" stroke-width=".30398">Error</tspan></text>
+			<text x="-688.83673" y="-461.82974" dominant-baseline="auto" font-size="3.0936px" stroke-width=".072506" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-688.83673" y="-461.82974" stroke-width=".072506">Yes</tspan></text>
+			<text x="-711.2818" y="-462.36154" dominant-baseline="auto" font-size="3.4092px" stroke-width=".21307" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-711.2818" y="-462.36154">Fallback</tspan><tspan x="-711.2818" y="-458.1001">set and enabled</tspan><tspan x="-711.2818" y="-453.83865">on vhost?</tspan></text>
+		</g>
+		<g fill="#0000ff" font-family="'Open Sans'" font-size="2.3761px" letter-spacing="0px" stroke-width=".012375" text-anchor="middle" word-spacing="0px">
+			<text x="-688.36298" y="-538.93268" dominant-baseline="auto" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-688.36298" y="-538.93268">LWS_SERVER_OPTION_REDIRECT_</tspan><tspan x="-688.36298" y="-535.96259">HTTP_TO_HTTPS</tspan></text>
+			<text x="-686.2973" y="-504.24808" dominant-baseline="auto" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-686.2973" y="-504.24808">LWS_SERVER_OPTION_ALLOW_</tspan><tspan x="-686.2973" y="-501.27798">HTTP_ON_HTTPS_LISTENER</tspan></text>
+			<text x="-683.63141" y="-471.23087" dominant-baseline="auto" text-align="center" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-683.63141" y="-471.23087">LWS_SERVER_OPTION_FALLBACK_TO_</tspan><tspan x="-683.63141" y="-468.26077">APPLY_LISTEN_ACCEPT_CONFIG</tspan></text>
+		</g>
+		<g>
+			<text x="-661.86536" y="-462.39395" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="4.6404px" letter-spacing="0px" stroke-width=".10461" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-661.86536" y="-462.39395">Fallback</tspan><tspan x="-661.86536" y="-456.59351">role +</tspan><tspan x="-661.86536" y="-450.79306">protocol</tspan></text>
+			<text x="-721.37823" y="-592.37463" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="13.921px" letter-spacing="0px" stroke-width=".072506" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-721.37823" y="-592.37463" stroke-width=".072506">TLS port</tspan></text>
+			<path d="m-732.59-572.25c1.9501-3.293 3.8701-6.6043 5.8395-9.8856 0.2398-0.54978 0.8982-0.73811 1.3074-0.10105 0.3564 0.71254 0.6543 1.2038 0.9662 1.8124 1.5622 2.7051 3.1244 5.4102 4.6866 8.1153 0.2615 0.57459 0.21211 1.1772-0.3115 1.4642-0.6618 0.10273-1.0635 0.0238-1.6072 0.0453-3.3542-0.0106-6.7089 0.0256-10.063 0.0135-0.5994 0.042-1.205-0.57336-0.9833-1.1331 0.055-0.11036 0.1104-0.22074 0.1656-0.33109z" fill="#f00"/>
+			<path d="m-731.04-572.98c1.4834-2.5049 2.9439-5.0238 4.442-7.5197 0.1824-0.4182 0.6833-0.56147 0.99461-0.0769 0.2711 0.54201 0.4977 0.91573 0.73489 1.3787 1.1883 2.0577 2.3767 4.1154 3.565 6.1731 0.1989 0.43707 0.16139 0.89545-0.2369 1.1138-0.50351 0.0781-0.80901 0.0181-1.2226 0.0344-2.5514-8e-3 -5.1034 0.0195-7.6549 0.0103-0.45599 0.0319-0.9167-0.43614-0.74809-0.86194 0.042-0.084 0.084-0.16791 0.126-0.25185z" fill="#fff"/>
+			<path d="m-726.75-575.05c-0.1016-1.1244-0.2033-2.2489-0.30501-3.3733 0-0.53089 0.5276-0.97852 1.0501-0.80555 0.5428 0.0382 0.767 0.6127 0.65131 1.0873-0.19201 1.0861-0.28691 2.1887-0.51801 3.2682-0.1473 0.45794-0.8791 0.39062-0.86-0.12607l-0.019-0.0506z"/>
+			<circle cx="-726.3" cy="-573.3" r=".69563"/>
+			<text x="-696.92792" y="-579.72461" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="3.0161px" letter-spacing="0px" stroke-width=".10282" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-696.92792" y="-579.72461">This flow happens</tspan><tspan x="-696.92792" y="-575.95453">before any vhost selection</tspan><tspan x="-696.92792" y="-572.18439">using SNI or Host: headers.</tspan><tspan x="-696.92792" y="-568.41431">Therefore it occurs on the</tspan><tspan x="-696.92792" y="-564.64417" font-weight="bold">first vhost that listens</tspan><tspan x="-696.92792" y="-560.87408"><tspan font-weight="bold" stroke-width=".10282">on the connection port</tspan>.</tspan></text>
+		</g>
+	</g>
+</svg>
diff --git a/doc-assets/accept-flow-3.svg b/doc-assets/accept-flow-3.svg
new file mode 100644
index 00000000..ea51c3c9
--- /dev/null
+++ b/doc-assets/accept-flow-3.svg
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="171.61mm" height="209.9mm" version="1.1" viewBox="0 0 171.61372 209.89664" xmlns="http://www.w3.org/2000/svg">
+	<defs>
+		<filter id="a" x="-.068968" y="-.055005" width="1.1379" height="1.11" color-interpolation-filters="sRGB">
+			<feGaussianBlur stdDeviation="15.814675"/>
+		</filter>
+	</defs>
+	<g transform="translate(884.06 595.62)">
+		<rect transform="matrix(.27404 0 0 .27404 -1727.7 -789.44)" x="3116.4" y="745.24" width="550.33" height="690.03" fill-opacity=".99606" filter="url(#a)"/>
+		<rect x="-876.94" y="-588.5" width="150.81" height="189.09" fill="#fff" fill-opacity=".99606"/>
+		<path d="m-811.77-547.46h23.075c3.36 0.0747 5.5258 3.5038 5.4558 5.6978s-1.697 5.9145-5.3019 6.0545c-5.0352-0.0508-18.547 0.0709-23.582 0.0206-2.2582-0.0882-4.5671-3.0397-4.5533-6.2647 0.014-3.225 2.6009-5.4327 4.9065-5.5082z" fill="#fff" stroke="#000" stroke-width="1.2058"/>
+		<g>
+			<rect x="-800.18" y="-535.73" width="1.4355" height="100.28"/>
+			<text x="-800.92352" y="-540.10565" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="4.8637px" letter-spacing="0px" stroke-width=".30398" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-800.92352" y="-540.10565" stroke-width=".30398">Connection</tspan></text>
+			<text x="-800.69403" y="-422.8768" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="4.7928px" letter-spacing="0px" stroke-width=".11233" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-800.69403" y="-422.8768">Specified</tspan><tspan x="-800.69403" y="-416.88583">role +</tspan><tspan x="-800.69403" y="-410.89487">protocol</tspan></text>
+		</g>
+		<g>
+			<path d="m-793.82-436.33h-11.894l6.2548 6.2549z" stroke="#000" stroke-width=".072506px"/>
+			<text x="-776.86151" y="-525.82227" dominant-baseline="auto" fill="#0000ff" font-family="'Open Sans'" font-size="2.3761px" letter-spacing="0px" stroke-width=".012375" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-776.86151" y="-525.82227">LWS_SERVER_OPTION_ADOPT_</tspan><tspan x="-776.86151" y="-522.85217">APPLY_LISTEN_ACCEPT_CONFIG</tspan></text>
+			<text x="-803.2453" y="-567.64862" dominant-baseline="auto" fill="#000000" font-family="'Open Sans'" font-size="13.921px" letter-spacing="0px" stroke-width=".072506" text-align="center" text-anchor="middle" word-spacing="0px" style="font-feature-settings:normal;font-variant-alternates:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-position:normal;line-height:1.25;shape-padding:0;text-decoration-color:#000000;text-decoration-line:none;text-decoration-style:solid;text-indent:0;text-orientation:mixed;text-transform:none;white-space:normal" xml:space="preserve"><tspan x="-803.2453" y="-567.64862" stroke-width=".072506">raw-only port</tspan></text>
+		</g>
+	</g>
+</svg>
diff --git a/include/libwebsockets/lws-adopt.h b/include/libwebsockets/lws-adopt.h
index 256e3f9f..4686098b 100644
--- a/include/libwebsockets/lws-adopt.h
+++ b/include/libwebsockets/lws-adopt.h
@@ -68,6 +68,7 @@ typedef enum {
 	LWS_ADOPT_SOCKET = 2,		/* flag: absent implies file descr */
 	LWS_ADOPT_ALLOW_SSL = 4,	/* flag: if set requires LWS_ADOPT_SOCKET */
 	LWS_ADOPT_FLAG_UDP = 16,	/* flag: socket is UDP */
+	LWS_ADOPT_FLAG_RAW_PROXY = 32,	/* flag: raw proxy */
 
 	LWS_ADOPT_RAW_SOCKET_UDP = LWS_ADOPT_SOCKET | LWS_ADOPT_FLAG_UDP,
 } lws_adoption_type;
diff --git a/include/libwebsockets/lws-callbacks.h b/include/libwebsockets/lws-callbacks.h
index 8b49218e..4dc20a8a 100644
--- a/include/libwebsockets/lws-callbacks.h
+++ b/include/libwebsockets/lws-callbacks.h
@@ -682,6 +682,42 @@ enum lws_callback_reasons {
 	 * options.
 	 */
 
+	/* ---------------------------------------------------------------------
+	 * ----- Callbacks related to RAW PROXY -----
+	 */
+
+	LWS_CALLBACK_RAW_PROXY_CLI_RX				= 89,
+	/**< RAW mode client (outgoing) RX */
+
+	LWS_CALLBACK_RAW_PROXY_SRV_RX				= 90,
+	/**< RAW mode server (listening) RX */
+
+	LWS_CALLBACK_RAW_PROXY_CLI_CLOSE			= 91,
+	/**< RAW mode client (outgoing) is closing */
+
+	LWS_CALLBACK_RAW_PROXY_SRV_CLOSE			= 92,
+	/**< RAW mode server (listening) is closing */
+
+	LWS_CALLBACK_RAW_PROXY_CLI_WRITEABLE			= 93,
+	/**< RAW mode client (outgoing) may be written */
+
+	LWS_CALLBACK_RAW_PROXY_SRV_WRITEABLE			= 94,
+	/**< RAW mode server (listening) may be written */
+
+	LWS_CALLBACK_RAW_PROXY_CLI_ADOPT			= 95,
+	/**< RAW mode client (onward) accepted socket was adopted
+	 *   (equivalent to 'wsi created') */
+
+	LWS_CALLBACK_RAW_PROXY_SRV_ADOPT			= 96,
+	/**< RAW mode server (listening) accepted socket was adopted
+	 *   (equivalent to 'wsi created') */
+
+	LWS_CALLBACK_RAW_PROXY_CLI_BIND_PROTOCOL		= 97,
+	LWS_CALLBACK_RAW_PROXY_SRV_BIND_PROTOCOL		= 98,
+	LWS_CALLBACK_RAW_PROXY_CLI_DROP_PROTOCOL		= 99,
+	LWS_CALLBACK_RAW_PROXY_SRV_DROP_PROTOCOL		= 100,
+
+
 	/* ---------------------------------------------------------------------
 	 * ----- Callbacks related to RAW sockets -----
 	 */
diff --git a/include/libwebsockets/lws-context-vhost.h b/include/libwebsockets/lws-context-vhost.h
index 991eb969..4c095ea1 100644
--- a/include/libwebsockets/lws-context-vhost.h
+++ b/include/libwebsockets/lws-context-vhost.h
@@ -583,7 +583,6 @@ struct lws_context_creation_info {
 	 * "TLS_CHACHA20_POLY1305_SHA256") or you can leave it as NULL to get
 	 * "DEFAULT".
 	 */
-
 	const char *listen_accept_role;
 	/**< VHOST: NULL for default, or force accepted incoming connections to
 	 * bind to this role.  Uses the role names from their ops struct, eg,
diff --git a/include/libwebsockets/lws-write.h b/include/libwebsockets/lws-write.h
index 6e0be6b3..f6e464da 100644
--- a/include/libwebsockets/lws-write.h
+++ b/include/libwebsockets/lws-write.h
@@ -257,7 +257,7 @@ lws_write_ws_flags(int initial, int is_start, int is_end)
  * `return lws_raw_transaction_completed(wsi)` should better be used than
  * return -1.
  */
-LWS_VISIBLE int LWS_WARN_UNUSED_RESULT
+LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT
 lws_raw_transaction_completed(struct lws *wsi);
 
 ///@}
diff --git a/lib/core/adopt.c b/lib/core/adopt.c
index 49ac5af1..ac37063d 100644
--- a/lib/core/adopt.c
+++ b/lib/core/adopt.c
@@ -185,12 +185,8 @@ lws_adopt_descriptor_vhost(struct lws_vhost *vh, lws_adoption_type type,
 	 * itself by default protocols[0]
 	 */
 	n = LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED;
-	if (!(type & LWS_ADOPT_HTTP)) {
-		if (!(type & LWS_ADOPT_SOCKET))
-			n = LWS_CALLBACK_RAW_ADOPT_FILE;
-		else
-			n = LWS_CALLBACK_RAW_ADOPT;
-	}
+	if (new_wsi->role_ops->adoption_cb[lwsi_role_server(new_wsi)])
+		n = new_wsi->role_ops->adoption_cb[lwsi_role_server(new_wsi)];
 
 	lwsl_debug("new wsi wsistate 0x%x\n", new_wsi->wsistate);
 
diff --git a/lib/core/connect.c b/lib/core/connect.c
index 50111f8a..90137119 100644
--- a/lib/core/connect.c
+++ b/lib/core/connect.c
@@ -271,6 +271,9 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 					     i->uri_replace_to);
 #endif
 
+	if (i->method && !strcmp(i->method, "RAW"))
+		lws_http_client_connect_via_info2(wsi);
+
 	return wsi;
 
 bail1:
diff --git a/lib/core/context.c b/lib/core/context.c
index 05db439f..9749447a 100644
--- a/lib/core/context.c
+++ b/lib/core/context.c
@@ -37,6 +37,9 @@ const struct lws_role_ops *available_roles[] = {
 #endif
 #if defined(LWS_ROLE_DBUS)
 	&role_ops_dbus,
+#endif
+#if defined(LWS_ROLE_RAW_PROXY)
+	&role_ops_raw_proxy,
 #endif
 	NULL
 };
@@ -110,6 +113,8 @@ lws_role_call_alpn_negotiated(struct lws *wsi, const char *alpn)
 int
 lws_role_call_adoption_bind(struct lws *wsi, int type, const char *prot)
 {
+	int n;
+
 	/*
 	 * if the vhost is told to bind accepted sockets to a given role,
 	 * then look it up by name and try to bind to the specific role.
@@ -120,11 +125,31 @@ lws_role_call_adoption_bind(struct lws *wsi, int type, const char *prot)
 		const struct lws_role_ops *role =
 			lws_role_by_name(wsi->vhost->listen_accept_role);
 
-		if (role && role->adoption_bind(wsi, type, prot))
+		if (!prot)
+			prot = wsi->vhost->listen_accept_protocol;
+
+		if (!role)
+			lwsl_err("%s: can't find role '%s'\n", __func__,
+				  wsi->vhost->listen_accept_role);
+
+		if (role && role->adoption_bind) {
+			n = role->adoption_bind(wsi, type, prot);
+			if (n < 0)
+				return -1;
+			if (n) /* did the bind */
+				return 0;
+		}
+
+		if (type & _LWS_ADOPT_FINISH) {
+			lwsl_debug("%s: leaving bound to role %s\n", __func__,
+				   wsi->role_ops->name);
 			return 0;
+		}
+
 
-		lwsl_warn("%s: adoption bind to role %s failed", __func__,
-			  wsi->vhost->listen_accept_role);
+		lwsl_warn("%s: adoption bind to role '%s', "
+			  "protocol '%s', type 0x%x, failed\n", __func__,
+			  wsi->vhost->listen_accept_role, prot, type);
 	}
 
 	/*
diff --git a/lib/core/service.c b/lib/core/service.c
index ef251409..c8295de6 100644
--- a/lib/core/service.c
+++ b/lib/core/service.c
@@ -56,7 +56,7 @@ lws_handle_POLLOUT_event(struct lws *wsi, struct lws_pollfd *pollfd)
 	volatile struct lws *vwsi = (volatile struct lws *)wsi;
 	int n;
 
-	//lwsl_notice("%s: %p\n", __func__, wsi);
+	// lwsl_notice("%s: %p\n", __func__, wsi);
 
 	vwsi->leave_pollout_active = 0;
 	vwsi->handling_pollout = 1;
@@ -177,11 +177,9 @@ lws_handle_POLLOUT_event(struct lws *wsi, struct lws_pollfd *pollfd)
 		vwsi->leave_pollout_active = 0;
 	}
 
-	if (lwsi_role_client(wsi) &&
-	    !wsi->hdr_parsing_completed &&
+	if (lwsi_role_client(wsi) && !wsi->hdr_parsing_completed &&
 	     lwsi_state(wsi) != LRS_H2_WAITING_TO_SEND_HEADERS &&
-	     lwsi_state(wsi) != LRS_ISSUE_HTTP_BODY
-	     )
+	     lwsi_state(wsi) != LRS_ISSUE_HTTP_BODY)
 		goto bail_ok;
 
 
diff --git a/lib/roles/cgi/ops-cgi.c b/lib/roles/cgi/ops-cgi.c
index b85a0895..4880e219 100644
--- a/lib/roles/cgi/ops-cgi.c
+++ b/lib/roles/cgi/ops-cgi.c
@@ -114,6 +114,8 @@ struct lws_role_ops role_ops_cgi = {
 	/* destroy_role */		rops_destroy_role_cgi,
 	/* adoption_bind */		NULL,
 	/* client_bind */		NULL,
+	/* adoption_cb clnt, srv */	{ 0, 0 },
+	/* rx_cb clnt, srv */		{ 0, 0 },
 	/* writeable cb clnt, srv */	{ 0, 0 },
 	/* close cb clnt, srv */	{ 0, 0 },
 	/* protocol_bind_cb c,s */	{ 0, 0 },
diff --git a/lib/roles/dbus/dbus.c b/lib/roles/dbus/dbus.c
index d509cfd3..c3fdd3ba 100644
--- a/lib/roles/dbus/dbus.c
+++ b/lib/roles/dbus/dbus.c
@@ -519,6 +519,8 @@ struct lws_role_ops role_ops_dbus = {
 	/* destroy_role */		NULL,
 	/* adoption_bind */		NULL,
 	/* client_bind */		NULL,
+	/* adoption_cb clnt, srv */	{ 0, 0 },
+	/* rx_cb clnt, srv */		{ 0, 0 },
 	/* writeable cb clnt, srv */	{ 0, 0 },
 	/* close cb clnt, srv */	{ 0, 0 },
 	/* protocol_bind_cb c,s */	{ 0, 0 },
diff --git a/lib/roles/h1/ops-h1.c b/lib/roles/h1/ops-h1.c
index 2fa0fe16..a90e89a1 100644
--- a/lib/roles/h1/ops-h1.c
+++ b/lib/roles/h1/ops-h1.c
@@ -651,7 +651,8 @@ rops_handle_POLLIN_h1(struct lws_context_per_thread *pt, struct lws *wsi,
 	return LWS_HPI_RET_HANDLED;
 }
 
-int rops_handle_POLLOUT_h1(struct lws *wsi)
+static int
+rops_handle_POLLOUT_h1(struct lws *wsi)
 {
 	if (lwsi_state(wsi) == LRS_ISSUE_HTTP_BODY)
 		return LWS_HP_RET_USER_SERVICE;
@@ -791,6 +792,8 @@ rops_adoption_bind_h1(struct lws *wsi, int type, const char *vh_prot_name)
 	if (!(type & LWS_ADOPT_HTTP))
 		return 0; /* no match */
 
+	if (type & _LWS_ADOPT_FINISH && !lwsi_role_http(wsi))
+		return 0;
 
 	if (type & _LWS_ADOPT_FINISH) {
 		if (!lws_header_table_attach(wsi, 0))
@@ -1028,6 +1031,10 @@ struct lws_role_ops role_ops_h1 = {
 #else
 					NULL,
 #endif
+	/* adoption_cb clnt, srv */	{ LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED,
+					  LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED },
+	/* rx_cb clnt, srv */		{ LWS_CALLBACK_RECEIVE_CLIENT_HTTP,
+					  0 /* may be POST, etc */ },
 	/* writeable cb clnt, srv */	{ LWS_CALLBACK_CLIENT_HTTP_WRITEABLE,
 					  LWS_CALLBACK_HTTP_WRITEABLE },
 	/* close cb clnt, srv */	{ LWS_CALLBACK_CLOSED_CLIENT_HTTP,
diff --git a/lib/roles/h2/ops-h2.c b/lib/roles/h2/ops-h2.c
index 9f23f9e3..573eb83f 100644
--- a/lib/roles/h2/ops-h2.c
+++ b/lib/roles/h2/ops-h2.c
@@ -1197,6 +1197,10 @@ struct lws_role_ops role_ops_h2 = {
 	/* destroy_role */		rops_destroy_role_h2,
 	/* adoption_bind */		NULL,
 	/* client_bind */		NULL,
+	/* adoption_cb clnt, srv */	{ LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED,
+					  LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED },
+	/* rx cb clnt, srv */		{ LWS_CALLBACK_RECEIVE_CLIENT_HTTP,
+					  0 /* may be POST, etc */ },
 	/* writeable cb clnt, srv */	{ LWS_CALLBACK_CLIENT_HTTP_WRITEABLE,
 					  LWS_CALLBACK_HTTP_WRITEABLE },
 	/* close cb clnt, srv */	{ LWS_CALLBACK_CLOSED_CLIENT_HTTP,
diff --git a/lib/roles/http/client/client-handshake.c b/lib/roles/http/client/client-handshake.c
index 88cbb786..ee7bfd0e 100644
--- a/lib/roles/http/client/client-handshake.c
+++ b/lib/roles/http/client/client-handshake.c
@@ -44,7 +44,7 @@ lws_client_connect_2(struct lws *wsi)
 	const char *ads;
 	sockaddr46 sa46;
 	const struct sockaddr *psa;
-	int n, port = 0;
+	int n, m, port = 0, rawish = 0;
 	const char *cce = "", *iface;
 	const char *meth = NULL;
 #ifdef LWS_WITH_IPV6
@@ -57,10 +57,8 @@ lws_client_connect_2(struct lws *wsi)
 #endif
 #endif
 
-	lwsl_client("%s: %p\n", __func__, wsi);
-
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
-	if (!wsi->http.ah) {
+	if (!wsi->http.ah && !wsi->stash) {
 		cce = "ah was NULL at cc2";
 		lwsl_err("%s\n", cce);
 		goto oom4;
@@ -68,7 +66,14 @@ lws_client_connect_2(struct lws *wsi)
 
 	/* we can only piggyback GET or POST */
 
-	meth = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_METHOD);
+	if (wsi->stash)
+		meth = wsi->stash->method;
+	else
+		meth = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_METHOD);
+
+	if (meth && !strcmp(meth, "RAW"))
+		rawish = 1;
+
 	if (meth && strcmp(meth, "GET") && strcmp(meth, "POST"))
 		goto create_new_conn;
 
@@ -165,10 +170,15 @@ create_new_conn:
 	 * want to use it too
 	 */
 
-	if (!wsi->client_hostname_copy)
-		wsi->client_hostname_copy =
-			lws_strdup(lws_hdr_simple_ptr(wsi,
+	if (!wsi->client_hostname_copy) {
+		if (wsi->stash)
+			wsi->client_hostname_copy = lws_strdup(
+					wsi->stash->host);
+		else
+			wsi->client_hostname_copy =
+				lws_strdup(lws_hdr_simple_ptr(wsi,
 					_WSI_TOKEN_CLIENT_PEER_ADDRESS));
+	}
 
 	/*
 	 * If we made our own connection, and we're doing a method that can take
@@ -192,7 +202,10 @@ create_new_conn:
 	 * unix socket destination?
 	 */
 
-	ads = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_PEER_ADDRESS);
+	if (wsi->stash)
+		ads = wsi->stash->address;
+	else
+		ads = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_PEER_ADDRESS);
 #if defined(LWS_WITH_UNIX_SOCK)
 	if (*ads == '+') {
 		ads++;
@@ -226,8 +239,7 @@ create_new_conn:
 		plen = sprintf((char *)pt->serv_buf,
 			"CONNECT %s:%u HTTP/1.0\x0d\x0a"
 			"User-agent: libwebsockets\x0d\x0a",
-			lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_PEER_ADDRESS),
-			wsi->c_port);
+			ads, wsi->c_port);
 
 		if (wsi->vhost->proxy_basic_auth_token[0])
 			plen += sprintf((char *)pt->serv_buf + plen,
@@ -255,7 +267,7 @@ create_new_conn:
 
 		/* Priority 3: Connect directly */
 
-		ads = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_PEER_ADDRESS);
+		/* ads already set */
 		port = wsi->c_port;
 	}
 
@@ -264,7 +276,7 @@ create_new_conn:
 	 * to whatever we decided to connect to
 	 */
 
-       lwsl_info("%s: %p: address %s\n", __func__, wsi, ads);
+       lwsl_info("%s: %p: address %s:%u\n", __func__, wsi, ads, port);
 
        n = lws_getaddrinfo46(wsi, ads, &result);
 
@@ -448,7 +460,10 @@ ads_known:
 		lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_CONNECT_RESPONSE,
 				AWAITING_TIMEOUT);
 
-		iface = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_IFACE);
+		if (wsi->stash)
+			iface = wsi->stash->iface;
+		else
+			iface = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_IFACE);
 
 		if (iface) {
 			n = lws_socket_bind(wsi->vhost, wsi->desc.sockfd, 0,
@@ -532,7 +547,15 @@ ads_known:
 		 * (will overwrite existing pointer,
 		 * leaving old string/frag there but unreferenced)
 		 */
-		if (lws_hdr_simple_create(wsi, _WSI_TOKEN_CLIENT_PEER_ADDRESS,
+		if (wsi->stash) {
+			lws_free(wsi->stash->address);
+			wsi->stash->address =
+				lws_strdup(wsi->vhost->http.http_proxy_address);
+			if (!wsi->stash->address)
+				goto failed;
+		} else
+			if (lws_hdr_simple_create(wsi,
+					_WSI_TOKEN_CLIENT_PEER_ADDRESS,
 					  wsi->vhost->http.http_proxy_address))
 			goto failed;
 		wsi->c_port = wsi->vhost->http.http_proxy_port;
@@ -564,7 +587,7 @@ ads_known:
 			goto failed;
 		}
 
-		lws_set_timeout(wsi,
+		lws_out(wsi,
 				PENDING_TIMEOUT_AWAITING_SOCKS_GREETING_REPLY,
 				AWAITING_TIMEOUT);
 
@@ -603,7 +626,33 @@ send_hs:
 			    __func__, wsi);
 
 		/* we are making our own connection */
-		lwsi_set_state(wsi, LRS_H1C_ISSUE_HANDSHAKE);
+		if (!rawish)
+			lwsi_set_state(wsi, LRS_H1C_ISSUE_HANDSHAKE);
+		else {
+			/* for a method = "RAW" connection, this makes us
+			 * established */
+
+			/* clear his established timeout */
+			lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+
+			m = wsi->role_ops->adoption_cb[0];
+			if (m) {
+				n = user_callback_handle_rxflow(
+						wsi->protocol->callback, wsi,
+						m, wsi->user_space, NULL, 0);
+				if (n < 0) {
+					lwsl_info("LWS_CALLBACK_RAW_PROXY_CLI_ADOPT failed\n");
+					goto failed;
+				}
+			}
+
+			/* service.c pollout processing wants this */
+			wsi->hdr_parsing_completed = 1;
+
+			lwsi_set_state(wsi, LRS_ESTABLISHED);
+
+			return wsi;
+		}
 
 		/*
 		 * provoke service to issue the handshake directly.
@@ -925,11 +974,16 @@ lws_http_client_connect_via_info2(struct lws *wsi)
 {
 	struct client_info_stash *stash = wsi->stash;
 
+	lwsl_debug("%s: %p (stash %p)\n", __func__, wsi, stash);
+
 	if (!stash)
 		return wsi;
 
 	wsi->opaque_user_data = wsi->stash->opaque_user_data;
 
+	if (stash->method && !strcmp(stash->method, "RAW"))
+		goto no_ah;
+
 	/*
 	 * we're not necessarily in a position to action these right away,
 	 * stash them... we only need during connect phase so into a temp
@@ -975,6 +1029,7 @@ lws_http_client_connect_via_info2(struct lws *wsi)
 		lws_client_stash_destroy(wsi);
 #endif
 
+no_ah:
 	wsi->context->count_wsi_allocated++;
 
 	return lws_client_connect_2(wsi);
diff --git a/lib/roles/http/client/client.c b/lib/roles/http/client/client.c
index 1d6f13dc..f43b69f5 100644
--- a/lib/roles/http/client/client.c
+++ b/lib/roles/http/client/client.c
@@ -1055,7 +1055,8 @@ lws_generate_client_handshake(struct lws *wsi, char *pkt)
 					      wsi->user_space, NULL, 0))
 			return NULL;
 
-		lws_role_transition(wsi, 0, LRS_ESTABLISHED, &role_ops_raw_skt);
+		lws_role_transition(wsi, LWSIFR_CLIENT, LRS_ESTABLISHED,
+				    &role_ops_raw_skt);
 		lws_header_table_detach(wsi, 1);
 
 		return NULL;
diff --git a/lib/roles/http/server/lejp-conf.c b/lib/roles/http/server/lejp-conf.c
index b3e2cfa6..bdb4a2e2 100644
--- a/lib/roles/http/server/lejp-conf.c
+++ b/lib/roles/http/server/lejp-conf.c
@@ -817,6 +817,8 @@ lejp_vhosts_cb(struct lejp_ctx *ctx, char reason)
 			LWS_SERVER_OPTION_ADOPT_APPLY_LISTEN_ACCEPT_CONFIG);
 		return 0;
 	case LEJPVP_FLAG_FALLBACK_LISTEN_ACCEPT:
+		lwsl_notice("vh %s: LEJPVP_FLAG_FALLBACK_LISTEN_ACCEPT: %s\n",
+			    a->info->vhost_name, ctx->buf);
 		set_reset_flag(&a->info->options, ctx->buf,
 		      LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG);
 		return 0;
diff --git a/lib/roles/http/server/parsers.c b/lib/roles/http/server/parsers.c
index e7005229..4c7db995 100644
--- a/lib/roles/http/server/parsers.c
+++ b/lib/roles/http/server/parsers.c
@@ -106,7 +106,7 @@ __lws_header_table_reset(struct lws *wsi, int autoservice)
 
 	/* while we hold the ah, keep a timeout on the wsi */
 	__lws_set_timeout(wsi, PENDING_TIMEOUT_HOLDING_AH,
-			wsi->vhost->timeout_secs_ah_idle);
+			  wsi->vhost->timeout_secs_ah_idle);
 
 	time(&ah->assigned);
 
@@ -197,6 +197,12 @@ lws_header_table_attach(struct lws *wsi, int autoservice)
 		  (void *)wsi, (void *)wsi->http.ah, wsi->tsi,
 		  pt->http.ah_count_in_use);
 
+	if (!lwsi_role_http(wsi)) {
+		lwsl_err("%s: bad role %s\n", __func__, wsi->role_ops->name);
+		assert(0);
+		return -1;
+	}
+
 	lws_pt_lock(pt, __func__);
 
 	/* if we are already bound to one, just clear it down */
diff --git a/lib/roles/http/server/server.c b/lib/roles/http/server/server.c
index 1e7c80fc..063491bd 100644
--- a/lib/roles/http/server/server.c
+++ b/lib/roles/http/server/server.c
@@ -1654,6 +1654,7 @@ lws_http_to_fallback(struct lws *wsi, unsigned char *obuf, size_t olen)
 	const struct lws_role_ops *role = &role_ops_raw_skt;
 	const struct lws_protocols *p1, *protocol =
 			 &wsi->vhost->protocols[wsi->vhost->raw_protocol_index];
+	int n;
 
 	if (wsi->vhost->listen_accept_role &&
 	    lws_role_by_name(wsi->vhost->listen_accept_role))
@@ -1666,21 +1667,28 @@ lws_http_to_fallback(struct lws *wsi, unsigned char *obuf, size_t olen)
 			protocol = p1;
 	}
 
-	lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
 	lws_bind_protocol(wsi, protocol, __func__);
-	lwsl_info("falling back on vh %s to protocol %s\n", wsi->vhost->name,
-		  protocol->name);
-	if ((wsi->protocol->callback)(wsi, LWS_CALLBACK_RAW_ADOPT,
-				      wsi->user_space, NULL, 0))
-		return 1;
 
-	lws_role_transition(wsi, 0, LRS_ESTABLISHED, role);
-	lws_header_table_detach(wsi, 1);
+	lws_role_transition(wsi, LWSIFR_SERVER, LRS_ESTABLISHED, role);
 
+	lws_header_table_detach(wsi, 0);
 	lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
 
-	if (wsi->protocol->callback(wsi, LWS_CALLBACK_RAW_RX, wsi->user_space,
-				    obuf, olen))
+	n = LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED;
+	if (wsi->role_ops->adoption_cb[lwsi_role_server(wsi)])
+		n = wsi->role_ops->adoption_cb[lwsi_role_server(wsi)];
+
+	lwsl_notice("%s: vh %s, role %s, protocol %s, cb %d, ah %p\n",
+		    __func__, wsi->vhost->name, role->name, protocol->name, n,
+		    wsi->http.ah);
+
+	if ((wsi->protocol->callback)(wsi, n, wsi->user_space, NULL, 0))
+		return 1;
+
+	n = LWS_CALLBACK_RAW_RX;
+	if (wsi->role_ops->rx_cb[lwsi_role_server(wsi)])
+		n = wsi->role_ops->rx_cb[lwsi_role_server(wsi)];
+	if (wsi->protocol->callback(wsi, n, wsi->user_space, obuf, olen))
 		return 1;
 
 	return 0;
@@ -1734,8 +1742,12 @@ lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
 			 */
 raw_transition:
 
-			if (lws_http_to_fallback(wsi, obuf, olen))
+			if (lws_http_to_fallback(wsi, obuf, olen)) {
+				lwsl_info("%s: fallback -> close\n", __func__);
 				goto bail_nuke_ah;
+			}
+
+			(*buf) = obuf + olen;
 
 			return 0;
 		}
@@ -1970,7 +1982,6 @@ bail_nuke_ah:
 	return 1;
 }
 
-
 LWS_VISIBLE int LWS_WARN_UNUSED_RESULT
 lws_http_transaction_completed(struct lws *wsi)
 {
diff --git a/lib/roles/listen/ops-listen.c b/lib/roles/listen/ops-listen.c
index 77049e70..a1661cab 100644
--- a/lib/roles/listen/ops-listen.c
+++ b/lib/roles/listen/ops-listen.c
@@ -181,6 +181,8 @@ struct lws_role_ops role_ops_listen = {
 	/* destroy_role */		NULL,
 	/* adoption_bind */		NULL,
 	/* client_bind */		NULL,
+	/* adoption_cb clnt, srv */	{ 0, 0 },
+	/* rx_cb clnt, srv */		{ 0, 0 },
 	/* writeable cb clnt, srv */	{ 0, 0 },
 	/* close cb clnt, srv */	{ 0, 0 },
 	/* protocol_bind_cb c,s */	{ 0, 0 },
diff --git a/lib/roles/pipe/ops-pipe.c b/lib/roles/pipe/ops-pipe.c
index 659c9bd9..5563af15 100644
--- a/lib/roles/pipe/ops-pipe.c
+++ b/lib/roles/pipe/ops-pipe.c
@@ -89,6 +89,8 @@ struct lws_role_ops role_ops_pipe = {
 	/* destroy_role */		NULL,
 	/* adoption_bind */		NULL,
 	/* client_bind */		NULL,
+	/* adoption_cb clnt, srv */	{ 0, 0 },
+	/* rx_cb clnt, srv */		{ 0, 0 },
 	/* writeable cb clnt, srv */	{ 0, 0 },
 	/* close cb clnt, srv */	{ 0, 0 },
 	/* protocol_bind_cb c,s */	{ 0, 0 },
diff --git a/lib/roles/private.h b/lib/roles/private.h
index 5f93b86e..6eddf3af 100644
--- a/lib/roles/private.h
+++ b/lib/roles/private.h
@@ -231,6 +231,16 @@ struct lws_role_ops {
 	int (*client_bind)(struct lws *wsi,
 			   const struct lws_client_connect_info *i);
 
+	/*
+	 * the callback reasons for adoption for client, server
+	 * (just client applies if no concept of client or server)
+	 */
+	uint16_t adoption_cb[2];
+	/*
+	 * the callback reasons for adoption for client, server
+	 * (just client applies if no concept of client or server)
+	 */
+	uint16_t rx_cb[2];
 	/*
 	 * the callback reasons for WRITEABLE for client, server
 	 * (just client applies if no concept of client or server)
@@ -297,6 +307,12 @@ extern struct lws_role_ops role_ops_raw_skt, role_ops_raw_file, role_ops_listen,
  #define lwsi_role_dbus(wsi) (0)
 #endif
 
+#if defined(LWS_ROLE_RAW_PROXY)
+ #include "roles/raw-proxy/private.h"
+#else
+ #define lwsi_role_raw_proxy(wsi) (0)
+#endif
+
 enum {
 	LWS_HP_RET_BAIL_OK,
 	LWS_HP_RET_BAIL_DIE,
diff --git a/lib/roles/raw-file/ops-raw-file.c b/lib/roles/raw-file/ops-raw-file.c
index 075a2ee8..b45422ca 100644
--- a/lib/roles/raw-file/ops-raw-file.c
+++ b/lib/roles/raw-file/ops-raw-file.c
@@ -98,6 +98,10 @@ struct lws_role_ops role_ops_raw_file = {
 					NULL,
 #endif
 	/* client_bind */		NULL,
+	/* adoption_cb clnt, srv */	{ LWS_CALLBACK_RAW_ADOPT_FILE,
+					  LWS_CALLBACK_RAW_ADOPT_FILE },
+	/* rx_cb clnt, srv */		{ LWS_CALLBACK_RAW_RX_FILE,
+					  LWS_CALLBACK_RAW_RX_FILE },
 	/* writeable cb clnt, srv */	{ LWS_CALLBACK_RAW_WRITEABLE_FILE, 0 },
 	/* close cb clnt, srv */	{ LWS_CALLBACK_RAW_CLOSE_FILE, 0 },
 	/* protocol_bind cb c, srv */	{ LWS_CALLBACK_RAW_FILE_BIND_PROTOCOL,
diff --git a/lib/roles/raw-proxy/ops-raw-proxy.c b/lib/roles/raw-proxy/ops-raw-proxy.c
new file mode 100644
index 00000000..0a75ef58
--- /dev/null
+++ b/lib/roles/raw-proxy/ops-raw-proxy.c
@@ -0,0 +1,217 @@
+/*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2010-2018 Andy Green <andy@warmcat.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation:
+ *  version 2.1 of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ *  MA  02110-1301  USA
+ */
+
+#include <core/private.h>
+
+static int
+rops_handle_POLLIN_raw_proxy(struct lws_context_per_thread *pt, struct lws *wsi,
+			     struct lws_pollfd *pollfd)
+{
+	struct lws_tokens ebuf;
+	int n, buffered;
+
+	/* pending truncated sends have uber priority */
+
+	if (lws_has_buffered_out(wsi)) {
+		if (!(pollfd->revents & LWS_POLLOUT))
+			return LWS_HPI_RET_HANDLED;
+
+		/* drain the output buflist */
+		if (lws_issue_raw(wsi, NULL, 0) < 0)
+			goto fail;
+		/*
+		 * we can't afford to allow input processing to send
+		 * something new, so spin around he event loop until
+		 * he doesn't have any partials
+		 */
+		return LWS_HPI_RET_HANDLED;
+	}
+
+	if ((pollfd->revents & pollfd->events & LWS_POLLIN) &&
+	    /* any tunnel has to have been established... */
+	    lwsi_state(wsi) != LRS_SSL_ACK_PENDING &&
+	    !(wsi->favoured_pollin &&
+	      (pollfd->revents & pollfd->events & LWS_POLLOUT))) {
+
+		buffered = lws_buflist_aware_read(pt, wsi, &ebuf);
+		switch (ebuf.len) {
+		case 0:
+			lwsl_info("%s: read 0 len\n", __func__);
+			wsi->seen_zero_length_recv = 1;
+			lws_change_pollfd(wsi, LWS_POLLIN, 0);
+
+			/*
+			 * we need to go to fail here, since it's the only
+			 * chance we get to understand that the socket has
+			 * closed
+			 */
+			// goto try_pollout;
+			goto fail;
+
+		case LWS_SSL_CAPABLE_ERROR:
+			goto fail;
+		case LWS_SSL_CAPABLE_MORE_SERVICE:
+			goto try_pollout;
+		}
+		n = user_callback_handle_rxflow(wsi->protocol->callback,
+						wsi, lwsi_role_client(wsi) ?
+						 LWS_CALLBACK_RAW_PROXY_CLI_RX :
+						 LWS_CALLBACK_RAW_PROXY_SRV_RX,
+						wsi->user_space, ebuf.token,
+						ebuf.len);
+		if (n < 0) {
+			lwsl_info("LWS_CALLBACK_RAW_PROXY_*_RX fail\n");
+			goto fail;
+		}
+
+		if (lws_buflist_aware_consume(wsi, &ebuf, ebuf.len, buffered))
+			return LWS_HPI_RET_PLEASE_CLOSE_ME;
+	} else
+		if (wsi->favoured_pollin &&
+		    (pollfd->revents & pollfd->events & LWS_POLLOUT))
+			/* we balanced the last favouring of pollin */
+			wsi->favoured_pollin = 0;
+
+try_pollout:
+
+	if (!(pollfd->revents & LWS_POLLOUT))
+		return LWS_HPI_RET_HANDLED;
+
+	if (lws_handle_POLLOUT_event(wsi, pollfd)) {
+		lwsl_debug("POLLOUT event closed it\n");
+		return LWS_HPI_RET_PLEASE_CLOSE_ME;
+	}
+
+#if !defined(LWS_NO_CLIENT)
+	if (lws_client_socket_service(wsi, pollfd, NULL))
+		return LWS_HPI_RET_WSI_ALREADY_DIED;
+#endif
+
+	return LWS_HPI_RET_HANDLED;
+
+fail:
+	lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS, "raw svc fail");
+
+	return LWS_HPI_RET_WSI_ALREADY_DIED;
+}
+
+static int
+rops_adoption_bind_raw_proxy(struct lws *wsi, int type,
+			     const char *vh_prot_name)
+{
+	/* no http but socket... must be raw skt */
+	if ((type & LWS_ADOPT_HTTP) || !(type & LWS_ADOPT_SOCKET) ||
+	    !(type & LWS_ADOPT_FLAG_RAW_PROXY) || (type & _LWS_ADOPT_FINISH))
+		return 0; /* no match */
+
+	if (type & LWS_ADOPT_FLAG_UDP)
+		/*
+		 * these can be >128 bytes, so just alloc for UDP
+		 */
+		wsi->udp = lws_malloc(sizeof(*wsi->udp), "udp struct");
+
+	lws_role_transition(wsi, LWSIFR_SERVER, (type & LWS_ADOPT_ALLOW_SSL) ?
+				    LRS_SSL_INIT : LRS_ESTABLISHED,
+			    &role_ops_raw_proxy);
+
+	if (vh_prot_name)
+		lws_bind_protocol(wsi, wsi->protocol, __func__);
+	else
+		/* this is the only time he will transition */
+		lws_bind_protocol(wsi,
+			&wsi->vhost->protocols[wsi->vhost->raw_protocol_index],
+			__func__);
+
+	return 1; /* bound */
+}
+
+static int
+rops_client_bind_raw_proxy(struct lws *wsi,
+			   const struct lws_client_connect_info *i)
+{
+	if (!i) {
+
+		/* finalize */
+
+		if (!wsi->user_space && wsi->stash->method)
+			if (lws_ensure_user_space(wsi))
+				return 1;
+
+		return 0;
+	}
+
+	/* we are a fallback if nothing else matched */
+
+	lws_role_transition(wsi, LWSIFR_CLIENT, LRS_UNCONNECTED,
+			    &role_ops_raw_proxy);
+
+	return 1;
+}
+
+static int
+rops_handle_POLLOUT_raw_proxy(struct lws *wsi)
+{
+	if (lwsi_state(wsi) == LRS_ESTABLISHED)
+		return LWS_HP_RET_USER_SERVICE;
+
+	if (lwsi_role_client(wsi))
+		return LWS_HP_RET_USER_SERVICE;
+
+	return LWS_HP_RET_BAIL_OK;
+}
+
+struct lws_role_ops role_ops_raw_proxy = {
+	/* role name */			"raw-proxy",
+	/* alpn id */			NULL,
+	/* check_upgrades */		NULL,
+	/* init_context */		NULL,
+	/* init_vhost */		NULL,
+	/* destroy_vhost */		NULL,
+	/* periodic_checks */		NULL,
+	/* service_flag_pending */	NULL,
+	/* handle_POLLIN */		rops_handle_POLLIN_raw_proxy,
+	/* handle_POLLOUT */		rops_handle_POLLOUT_raw_proxy,
+	/* perform_user_POLLOUT */	NULL,
+	/* callback_on_writable */	NULL,
+	/* tx_credit */			NULL,
+	/* write_role_protocol */	NULL,
+	/* encapsulation_parent */	NULL,
+	/* alpn_negotiated */		NULL,
+	/* close_via_role_protocol */	NULL,
+	/* close_role */		NULL,
+	/* close_kill_connection */	NULL,
+	/* destroy_role */		NULL,
+	/* adoption_bind */		rops_adoption_bind_raw_proxy,
+	/* client_bind */		rops_client_bind_raw_proxy,
+	/* adoption_cb clnt, srv */	{ LWS_CALLBACK_RAW_PROXY_CLI_ADOPT,
+					  LWS_CALLBACK_RAW_PROXY_SRV_ADOPT },
+	/* rx_cb clnt, srv */		{ LWS_CALLBACK_RAW_PROXY_CLI_RX,
+					  LWS_CALLBACK_RAW_PROXY_SRV_RX },
+	/* writeable cb clnt, srv */	{ LWS_CALLBACK_RAW_PROXY_CLI_WRITEABLE,
+					  LWS_CALLBACK_RAW_PROXY_SRV_WRITEABLE, },
+	/* close cb clnt, srv */	{ LWS_CALLBACK_RAW_PROXY_CLI_CLOSE,
+					  LWS_CALLBACK_RAW_PROXY_SRV_CLOSE },
+	/* protocol_bind cb c, srv */	{ LWS_CALLBACK_RAW_PROXY_CLI_BIND_PROTOCOL,
+					  LWS_CALLBACK_RAW_PROXY_SRV_BIND_PROTOCOL },
+	/* protocol_unbind cb c, srv */	{ LWS_CALLBACK_RAW_PROXY_CLI_DROP_PROTOCOL,
+					  LWS_CALLBACK_RAW_PROXY_SRV_DROP_PROTOCOL },
+	/* file_handle */		0,
+};
diff --git a/lib/roles/raw-proxy/private.h b/lib/roles/raw-proxy/private.h
new file mode 100644
index 00000000..6f169d98
--- /dev/null
+++ b/lib/roles/raw-proxy/private.h
@@ -0,0 +1,41 @@
+/*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2010 - 2018 Andy Green <andy@warmcat.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation:
+ *  version 2.1 of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ *  MA  02110-1301  USA
+ *
+ *  This is included from core/private.h if LWS_ROLE_RAW_PROXY
+ */
+
+extern struct lws_role_ops role_ops_raw_proxy;
+
+#define lwsi_role_raw_proxy(wsi) (wsi->role_ops == &role_ops_raw_proxy)
+
+#if 0
+struct lws_vhost_role_ws {
+	const struct lws_extension *extensions;
+};
+
+struct lws_pt_role_ws {
+	struct lws *rx_draining_ext_list;
+	struct lws *tx_draining_ext_list;
+};
+
+struct _lws_raw_proxy_related {
+	struct lws *wsi_onward;
+};
+#endif
diff --git a/lib/roles/raw-skt/ops-raw-skt.c b/lib/roles/raw-skt/ops-raw-skt.c
index 8b94de4b..cc6ed615 100644
--- a/lib/roles/raw-skt/ops-raw-skt.c
+++ b/lib/roles/raw-skt/ops-raw-skt.c
@@ -223,6 +223,10 @@ struct lws_role_ops role_ops_raw_skt = {
 #else
 					NULL,
 #endif
+	/* adoption_cb clnt, srv */	{ LWS_CALLBACK_RAW_ADOPT,
+					  LWS_CALLBACK_RAW_ADOPT },
+	/* rx_cb clnt, srv */		{ LWS_CALLBACK_RAW_RX,
+					  LWS_CALLBACK_RAW_RX },
 	/* writeable cb clnt, srv */	{ LWS_CALLBACK_RAW_WRITEABLE, 0 },
 	/* close cb clnt, srv */	{ LWS_CALLBACK_RAW_CLOSE, 0 },
 	/* protocol_bind cb c, srv */	{ LWS_CALLBACK_RAW_SKT_BIND_PROTOCOL,
diff --git a/lib/roles/ws/ops-ws.c b/lib/roles/ws/ops-ws.c
index 1cbc6ac6..307cfc91 100644
--- a/lib/roles/ws/ops-ws.c
+++ b/lib/roles/ws/ops-ws.c
@@ -2009,6 +2009,10 @@ struct lws_role_ops role_ops_ws = {
 	/* destroy_role */		rops_destroy_role_ws,
 	/* adoption_bind */		NULL,
 	/* client_bind */		NULL,
+	/* adoption_cb clnt, srv */	{ LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED,
+					  LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED },
+	/* rx_cb clnt, srv */		{ LWS_CALLBACK_CLIENT_RECEIVE,
+					  LWS_CALLBACK_RECEIVE },
 	/* writeable cb clnt, srv */	{ LWS_CALLBACK_CLIENT_WRITEABLE,
 					  LWS_CALLBACK_SERVER_WRITEABLE },
 	/* close cb clnt, srv */	{ LWS_CALLBACK_CLIENT_CLOSED,
diff --git a/lib/tls/tls-server.c b/lib/tls/tls-server.c
index 9525f0f7..a3591eee 100644
--- a/lib/tls/tls-server.c
+++ b/lib/tls/tls-server.c
@@ -297,7 +297,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd)
 				 */
 				wsi->tls.ssl = NULL;
 
-				if (lws_check_opt(context->options,
+				if (lws_check_opt(wsi->vhost->options,
 				    LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS)) {
 					lwsl_info("%s: redirecting from http "
 						  "to https\n", __func__);
@@ -305,7 +305,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd)
 					goto notls_accepted;
 				}
 
-				if (lws_check_opt(context->options,
+				if (lws_check_opt(wsi->vhost->options,
 				LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER)) {
 					lwsl_info("%s: allowing unencrypted "
 						  "http service on tls port\n",
@@ -313,7 +313,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd)
 					goto notls_accepted;
 				}
 
-				if (lws_check_opt(context->options,
+				if (lws_check_opt(wsi->vhost->options,
 		    LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG)) {
 					if (lws_http_to_fallback(wsi, NULL, 0))
 						goto fail;
@@ -323,7 +323,8 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd)
 				}
 
 				lwsl_notice("%s: client did not send a valid "
-					    "tls hello\n", __func__);
+					    "tls hello (default vhost %s)\n",
+					    __func__, wsi->vhost->name);
 				goto fail;
 			}
 			if (!n) {
@@ -424,6 +425,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd)
 
 notls_accepted:
 	lwsi_set_state(wsi, LRS_ESTABLISHED);
+
 	return 0;
 
 fail:
diff --git a/libwebsockets.dox b/libwebsockets.dox
index 6fa749fa..15bd4e84 100644
--- a/libwebsockets.dox
+++ b/libwebsockets.dox
@@ -145,6 +145,7 @@ INPUT                  = include/libwebsockets.h \
 			 ./READMEs/README.ci.md \
 			 ./READMEs/README.content-security-policy.md \
 			 ./READMEs/README.contributing.md \
+			 ./READMEs/README.http-fallback.md \
 			 ./READMEs/README.release-policy.md \
 			 ./READMEs/README.unix-domain-reverse-proxy.md \
 			 ./READMEs/README.vulnerability-reporting.md \
diff --git a/minimal-examples/raw/README.md b/minimal-examples/raw/README.md
index f6ce5ae0..ea3bd7a0 100644
--- a/minimal-examples/raw/README.md
+++ b/minimal-examples/raw/README.md
@@ -2,7 +2,10 @@
 ---|---
 minimal-raw-adopt-tcp|Shows how to have lws adopt an existing tcp socket something else had connected
 minimal-raw-adopt-udp|Shows how to create a udp socket and read and write on it
+minimal-raw-fallback-http|Shows how to run a normal http(s) server that falls back to a specified role + protocol
 minimal-raw-file|Shows how to adopt a file descriptor (device node, fifo, file, etc) into the lws event loop and handle events
 minimal-raw-netcat|Writes stdin to a remote server and prints results on stdout
+minimal-raw-proxy-fallback|Shows how to run a normal http(s) server that falls back to a proxied connection to a specified IP and port
+minimal-raw-proxy|Shows how to set up a vhost so it listens for connections and proxies them to a specified IP and port
 minimal-raw-vhost|Shows how to set up a vhost that listens and accepts RAW socket connections
 
diff --git a/minimal-examples/raw/minimal-raw-fallback-http-server/README.md b/minimal-examples/raw/minimal-raw-fallback-http-server/README.md
index 35c84086..9a827c54 100644
--- a/minimal-examples/raw/minimal-raw-fallback-http-server/README.md
+++ b/minimal-examples/raw/minimal-raw-fallback-http-server/README.md
@@ -19,7 +19,7 @@ Commandline option|Meaning
 -d <loglevel>|Debug verbosity in decimal, eg, -d15
 -s|Configure the server for tls / https and `LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT`
 -h|(needs -s) Configure the vhost also for `LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER`, allowing http service on tls port (caution... it's insecure then)
--r|(needs -s) Configure the vhost also for `LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS`, so the server issues a redirect to https to clients that attempt to connect to a server configured for tls with http.
+-u|(needs -s) Configure the vhost also for `LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS`, so the server issues a redirect to https to clients that attempt to connect to a server configured for tls with http.
 
 ```
  $ ./lws-minimal-raw-fallback-http-server
@@ -37,5 +37,5 @@ content on an http(s) listening socket.
 |none|served|no tls|echos hello|LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG
 |-s|echos http GET|served|echos hello|LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG, LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT
 |-s -h|served|served|echos hello|LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG, LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT, LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER
-|-s -r|redirected to https|served|echos hello|LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG, LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT, LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS
+|-s -u|redirected to https|served|echos hello|LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG, LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT, LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS
 
diff --git a/minimal-examples/raw/minimal-raw-fallback-http-server/minimal-raw-fallback-http-server.c b/minimal-examples/raw/minimal-raw-fallback-http-server/minimal-raw-fallback-http-server.c
index cf37f0d4..6272f483 100644
--- a/minimal-examples/raw/minimal-raw-fallback-http-server/minimal-raw-fallback-http-server.c
+++ b/minimal-examples/raw/minimal-raw-fallback-http-server/minimal-raw-fallback-http-server.c
@@ -125,7 +125,7 @@ int main(int argc, const char **argv)
 		info.ssl_cert_filepath = "localhost-100y.cert";
 		info.ssl_private_key_filepath = "localhost-100y.key";
 
-		if (lws_cmdline_option(argc, argv, "-r"))
+		if (lws_cmdline_option(argc, argv, "-u"))
 			info.options |= LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS;
 
 		if (lws_cmdline_option(argc, argv, "-h"))
diff --git a/minimal-examples/raw/minimal-raw-netcat/minimal-raw-netcat.c b/minimal-examples/raw/minimal-raw-netcat/minimal-raw-netcat.c
index 2850d041..ab5b061b 100644
--- a/minimal-examples/raw/minimal-raw-netcat/minimal-raw-netcat.c
+++ b/minimal-examples/raw/minimal-raw-netcat/minimal-raw-netcat.c
@@ -141,13 +141,7 @@ int main(int argc, const char **argv)
 	struct addrinfo h, *r, *rp;
 	struct lws_vhost *vhost;
 	const char *p;
-	int n = 0, logs = LLL_USER | LLL_ERR | LLL_WARN | LLL_NOTICE
-			/* for LLL_ verbosity above NOTICE to be built into lws,
-			 * lws must have been configured and built with
-			 * -DCMAKE_BUILD_TYPE=DEBUG instead of =RELEASE */
-			/* | LLL_INFO */ /* | LLL_PARSER */ /* | LLL_HEADER */
-			/* | LLL_EXT */ /* | LLL_CLIENT */ /* | LLL_LATENCY */
-			/* | LLL_DEBUG */;
+	int n = 0, logs = LLL_USER | LLL_ERR | LLL_WARN | LLL_NOTICE;
 
 	signal(SIGINT, sigint_handler);
 
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/CMakeLists.txt b/minimal-examples/raw/minimal-raw-proxy-fallback/CMakeLists.txt
new file mode 100644
index 00000000..c0f72cee
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/CMakeLists.txt
@@ -0,0 +1,84 @@
+cmake_minimum_required(VERSION 2.8)
+include(CheckCSourceCompiles)
+
+set(SAMP lws-minimal-raw-proxy-fallback)
+set(SRCS minimal-raw-proxy-fallback.c)
+
+# NOTE... if you are building this standalone, you must point LWS_PLUGINS_DIR
+# to the lws plugins dir so it can pick up the plugin source.  Eg,
+# cmake . -DLWS_PLUGINS_DIR=~/libwebsockets/plugins
+
+# If we are being built as part of lws, confirm current build config supports
+# reqconfig, else skip building ourselves.
+#
+# If we are being built externally, confirm installed lws was configured to
+# support reqconfig, else error out with a helpful message about the problem.
+#
+MACRO(require_lws_config reqconfig _val result)
+
+	if (DEFINED ${reqconfig})
+	if (${reqconfig})
+		set (rq 1)
+	else()
+		set (rq 0)
+	endif()
+	else()
+		set(rq 0)
+	endif()
+
+	if (${_val} EQUAL ${rq})
+		set(SAME 1)
+	else()
+		set(SAME 0)
+	endif()
+
+	if (LWS_WITH_MINIMAL_EXAMPLES AND NOT ${SAME})
+		if (${_val})
+			message("${SAMP}: skipping as lws being built without ${reqconfig}")
+		else()
+			message("${SAMP}: skipping as lws built with ${reqconfig}")
+		endif()
+		set(${result} 0)
+	else()
+		if (LWS_WITH_MINIMAL_EXAMPLES)
+			set(MET ${SAME})
+		else()
+			CHECK_C_SOURCE_COMPILES("#include <libwebsockets.h>\nint main(void) {\n#if defined(${reqconfig})\n return 0;\n#else\n fail;\n#endif\n return 0;\n}\n" HAS_${reqconfig})
+			if (NOT DEFINED HAS_${reqconfig} OR NOT HAS_${reqconfig})
+				set(HAS_${reqconfig} 0)
+			else()
+				set(HAS_${reqconfig} 1)
+			endif()
+			if ((HAS_${reqconfig} AND ${_val}) OR (NOT HAS_${reqconfig} AND NOT ${_val}))
+				set(MET 1)
+			else()
+				set(MET 0)
+			endif()
+		endif()
+		if (NOT MET)
+			if (${_val})
+				message(FATAL_ERROR "This project requires lws must have been configured with ${reqconfig}")
+			else()
+				message(FATAL_ERROR "Lws configuration of ${reqconfig} is incompatible with this project")
+			endif()
+		endif()	
+	endif()
+ENDMACRO()
+
+set(requirements 1)
+require_lws_config(LWS_ROLE_RAW_PROXY 1 requirements)
+
+if (requirements)
+	add_executable(${SAMP} ${SRCS})
+	
+	if (LWS_PLUGINS_DIR)
+		include_directories(${LWS_PLUGINS_DIR})
+	endif()
+
+	if (websockets_shared)
+		target_link_libraries(${SAMP} websockets_shared)
+		add_dependencies(${SAMP} websockets_shared)
+	else()
+		target_link_libraries(${SAMP} websockets)
+	endif()
+endif()
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/README.md b/minimal-examples/raw/minimal-raw-proxy-fallback/README.md
new file mode 100644
index 00000000..f673f461
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/README.md
@@ -0,0 +1,49 @@
+# lws minimal ws server raw proxy fallback
+
+This demonstrates how a vhost doing normal http or http(s) duty can be also be
+bound to a specific role and protocol as a fallback if the incoming protocol is
+unexpected for tls or http.  The example makes the fallback role + protocol
+an lws plugin that performs raw packet proxying.
+
+By default the fallback in the example will proxy 127.0.0.1:22, which is usually
+your ssh server listen port, on 127.0.0.1:7681.  You should be able to ssh into
+port 7681 the same as you can port 22.  At the same time, you should be able to
+visit http://127.0.0.1:7681 in a browser (and if you give -s, to
+https://127.0.0.1:7681 while your ssh client can still connect to the same
+port.
+
+## build
+
+To build this standalone, you must tell cmake where the lws source tree
+./plugins directory can be found, since it relies on including the source
+of the raw-proxy plugin.
+
+```
+ $ cmake . -DLWS_PLUGINS_DIR=~/libwebsockets/plugins && make
+```
+
+## usage
+
+Commandline option|Meaning
+---|---
+-d <loglevel>|Debug verbosity in decimal, eg, -d15
+-r ipv4:address:port|Configure the remote IP and port that will be proxied, by default ipv4:127.0.0.1:22
+-s|Configure the server for tls / https and `LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT`
+-h|(needs -s) Configure the vhost also for `LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER`, allowing http service on tls port (caution... it's insecure then)
+-u|(needs -s) Configure the vhost also for `LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS`, so the server issues a redirect to https to clients that attempt to connect to a server configured for tls with http.
+```
+ $ ./lws-minimal-raw-proxy
+[2018/11/30 19:22:35:7290] USER: LWS minimal raw proxy-fallback
+[2018/11/30 19:22:35:7291] NOTICE: Creating Vhost 'default' port 7681, 1 protocols, IPv6 off
+[2018/11/30 19:22:35:7336] NOTICE: callback_raw_proxy: onward ipv4 127.0.0.1:22
+...
+```
+
+```
+ $ ssh -p7681 me@127.0.0.1
+Last login: Fri Nov 30 19:29:23 2018 from 127.0.0.1
+[me@learn ~]$
+```
+
+At the same time, visiting http(s)://127.0.0.1:7681 in a browser works fine.
+
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.cert b/minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.cert
new file mode 100644
index 00000000..6f372db4
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.cert
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF5jCCA86gAwIBAgIJANq50IuwPFKgMA0GCSqGSIb3DQEBCwUAMIGGMQswCQYD
+VQQGEwJHQjEQMA4GA1UECAwHRXJld2hvbjETMBEGA1UEBwwKQWxsIGFyb3VuZDEb
+MBkGA1UECgwSbGlid2Vic29ja2V0cy10ZXN0MRIwEAYDVQQDDAlsb2NhbGhvc3Qx
+HzAdBgkqhkiG9w0BCQEWEG5vbmVAaW52YWxpZC5vcmcwIBcNMTgwMzIwMDQxNjA3
+WhgPMjExODAyMjQwNDE2MDdaMIGGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRXJl
+d2hvbjETMBEGA1UEBwwKQWxsIGFyb3VuZDEbMBkGA1UECgwSbGlid2Vic29ja2V0
+cy10ZXN0MRIwEAYDVQQDDAlsb2NhbGhvc3QxHzAdBgkqhkiG9w0BCQEWEG5vbmVA
+aW52YWxpZC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCjYtuW
+aICCY0tJPubxpIgIL+WWmz/fmK8IQr11Wtee6/IUyUlo5I602mq1qcLhT/kmpoR8
+Di3DAmHKnSWdPWtn1BtXLErLlUiHgZDrZWInmEBjKM1DZf+CvNGZ+EzPgBv5nTek
+LWcfI5ZZtoGuIP1Dl/IkNDw8zFz4cpiMe/BFGemyxdHhLrKHSm8Eo+nT734tItnH
+KT/m6DSU0xlZ13d6ehLRm7/+Nx47M3XMTRH5qKP/7TTE2s0U6+M0tsGI2zpRi+m6
+jzhNyMBTJ1u58qAe3ZW5/+YAiuZYAB6n5bhUp4oFuB5wYbcBywVR8ujInpF8buWQ
+Ujy5N8pSNp7szdYsnLJpvAd0sibrNPjC0FQCNrpNjgJmIK3+mKk4kXX7ZTwefoAz
+TK4l2pHNuC53QVc/EF++GBLAxmvCDq9ZpMIYi7OmzkkAKKC9Ue6Ef217LFQCFIBK
+Izv9cgi9fwPMLhrKleoVRNsecBsCP569WgJXhUnwf2lon4fEZr3+vRuc9shfqnV0
+nPN1IMSnzXCast7I2fiuRXdIz96KjlGQpP4XfNVA+RGL7aMnWOFIaVrKWLzAtgzo
+GMTvP/AuehKXncBJhYtW0ltTioVx+5yTYSAZWl+IssmXjefxJqYi2/7QWmv1QC9p
+sNcjTMaBQLN03T1Qelbs7Y27sxdEnNUth4kI+wIDAQABo1MwUTAdBgNVHQ4EFgQU
+9mYU23tW2zsomkKTAXarjr2vjuswHwYDVR0jBBgwFoAU9mYU23tW2zsomkKTAXar
+jr2vjuswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEANjIBMrow
+YNCbhAJdP7dhlhT2RUFRdeRUJD0IxrH/hkvb6myHHnK8nOYezFPjUlmRKUgNEDuA
+xbnXZzPdCRNV9V2mShbXvCyiDY7WCQE2Bn44z26O0uWVk+7DNNLH9BnkwUtOnM9P
+wtmD9phWexm4q2GnTsiL6Ul6cy0QlTJWKVLEUQQ6yda582e23J1AXqtqFcpfoE34
+H3afEiGy882b+ZBiwkeV+oq6XVF8sFyr9zYrv9CvWTYlkpTQfLTZSsgPdEHYVcjv
+xQ2D+XyDR0aRLRlvxUa9dHGFHLICG34Juq5Ai6lM1EsoD8HSsJpMcmrH7MWw2cKk
+ujC3rMdFTtte83wF1uuF4FjUC72+SmcQN7A386BC/nk2TTsJawTDzqwOu/VdZv2g
+1WpTHlumlClZeP+G/jkSyDwqNnTu1aodDmUa4xZodfhP1HWPwUKFcq8oQr148QYA
+AOlbUOJQU7QwRWd1VbnwhDtQWXC92A2w1n/xkZSR1BM/NUSDhkBSUU1WjMbWg6Gg
+mnIZLRerQCu1Oozr87rOQqQakPkyt8BUSNK3K42j2qcfhAONdRl8Hq8Qs5pupy+s
+8sdCGDlwR3JNCMv6u48OK87F4mcIxhkSefFJUFII25pCGN5WtE4p5l+9cnO1GrIX
+e2Hl/7M0c/lbZ4FvXgARlex2rkgS0Ka06HE=
+-----END CERTIFICATE-----
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.key b/minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.key
new file mode 100644
index 00000000..148f8598
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/localhost-100y.key
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCjYtuWaICCY0tJ
+PubxpIgIL+WWmz/fmK8IQr11Wtee6/IUyUlo5I602mq1qcLhT/kmpoR8Di3DAmHK
+nSWdPWtn1BtXLErLlUiHgZDrZWInmEBjKM1DZf+CvNGZ+EzPgBv5nTekLWcfI5ZZ
+toGuIP1Dl/IkNDw8zFz4cpiMe/BFGemyxdHhLrKHSm8Eo+nT734tItnHKT/m6DSU
+0xlZ13d6ehLRm7/+Nx47M3XMTRH5qKP/7TTE2s0U6+M0tsGI2zpRi+m6jzhNyMBT
+J1u58qAe3ZW5/+YAiuZYAB6n5bhUp4oFuB5wYbcBywVR8ujInpF8buWQUjy5N8pS
+Np7szdYsnLJpvAd0sibrNPjC0FQCNrpNjgJmIK3+mKk4kXX7ZTwefoAzTK4l2pHN
+uC53QVc/EF++GBLAxmvCDq9ZpMIYi7OmzkkAKKC9Ue6Ef217LFQCFIBKIzv9cgi9
+fwPMLhrKleoVRNsecBsCP569WgJXhUnwf2lon4fEZr3+vRuc9shfqnV0nPN1IMSn
+zXCast7I2fiuRXdIz96KjlGQpP4XfNVA+RGL7aMnWOFIaVrKWLzAtgzoGMTvP/Au
+ehKXncBJhYtW0ltTioVx+5yTYSAZWl+IssmXjefxJqYi2/7QWmv1QC9psNcjTMaB
+QLN03T1Qelbs7Y27sxdEnNUth4kI+wIDAQABAoICAFWe8MQZb37k2gdAV3Y6aq8f
+qokKQqbCNLd3giGFwYkezHXoJfg6Di7oZxNcKyw35LFEghkgtQqErQqo35VPIoH+
+vXUpWOjnCmM4muFA9/cX6mYMc8TmJsg0ewLdBCOZVw+wPABlaqz+0UOiSMMftpk9
+fz9JwGd8ERyBsT+tk3Qi6D0vPZVsC1KqxxL/cwIFd3Hf2ZBtJXe0KBn1pktWht5A
+Kqx9mld2Ovl7NjgiC1Fx9r+fZw/iOabFFwQA4dr+R8mEMK/7bd4VXfQ1o/QGGbMT
+G+ulFrsiDyP+rBIAaGC0i7gDjLAIBQeDhP409ZhswIEc/GBtODU372a2CQK/u4Q/
+HBQvuBtKFNkGUooLgCCbFxzgNUGc83GB/6IwbEM7R5uXqsFiE71LpmroDyjKTlQ8
+YZkpIcLNVLw0usoGYHFm2rvCyEVlfsE3Ub8cFyTFk50SeOcF2QL2xzKmmbZEpXgl
+xBHR0hjgon0IKJDGfor4bHO7Nt+1Ece8u2oTEKvpz5aIn44OeC5mApRGy83/0bvs
+esnWjDE/bGpoT8qFuy+0urDEPNId44XcJm1IRIlG56ErxC3l0s11wrIpTmXXckqw
+zFR9s2z7f0zjeyxqZg4NTPI7wkM3M8BXlvp2GTBIeoxrWB4V3YArwu8QF80QBgVz
+mgHl24nTg00UH1OjZsABAoIBAQDOxftSDbSqGytcWqPYP3SZHAWDA0O4ACEM+eCw
+au9ASutl0IDlNDMJ8nC2ph25BMe5hHDWp2cGQJog7pZ/3qQogQho2gUniKDifN77
+40QdykllTzTVROqmP8+efreIvqlzHmuqaGfGs5oTkZaWj5su+B+bT+9rIwZcwfs5
+YRINhQRx17qa++xh5mfE25c+M9fiIBTiNSo4lTxWMBShnK8xrGaMEmN7W0qTMbFH
+PgQz5FcxRjCCqwHilwNBeLDTp/ZECEB7y34khVh531mBE2mNzSVIQcGZP1I/DvXj
+W7UUNdgFwii/GW+6M0uUDy23UVQpbFzcV8o1C2nZc4Fb4zwBAoIBAQDKSJkFwwuR
+naVJS6WxOKjX8MCu9/cKPnwBv2mmI2jgGxHTw5sr3ahmF5eTb8Zo19BowytN+tr6
+2ZFoIBA9Ubc9esEAU8l3fggdfM82cuR9sGcfQVoCh8tMg6BP8IBLOmbSUhN3PG2m
+39I802u0fFNVQCJKhx1m1MFFLOu7lVcDS9JN+oYVPb6MDfBLm5jOiPuYkFZ4gH79
+J7gXI0/YKhaJ7yXthYVkdrSF6Eooer4RZgma62Dd1VNzSq3JBo6rYjF7Lvd+RwDC
+R1thHrmf/IXplxpNVkoMVxtzbrrbgnC25QmvRYc0rlS/kvM4yQhMH3eA7IycDZMp
+Y+0xm7I7jTT7AoIBAGKzKIMDXdCxBWKhNYJ8z7hiItNl1IZZMW2TPUiY0rl6yaCh
+BVXjM9W0r07QPnHZsUiByqb743adkbTUjmxdJzjaVtxN7ZXwZvOVrY7I7fPWYnCE
+fXCr4+IVpZI/ZHZWpGX6CGSgT6EOjCZ5IUufIvEpqVSmtF8MqfXO9o9uIYLokrWQ
+x1dBl5UnuTLDqw8bChq7O5y6yfuWaOWvL7nxI8NvSsfj4y635gIa/0dFeBYZEfHI
+UlGdNVomwXwYEzgE/c19ruIowX7HU/NgxMWTMZhpazlxgesXybel+YNcfDQ4e3RM
+OMz3ZFiaMaJsGGNf4++d9TmMgk4Ns6oDs6Tb9AECggEBAJYzd+SOYo26iBu3nw3L
+65uEeh6xou8pXH0Tu4gQrPQTRZZ/nT3iNgOwqu1gRuxcq7TOjt41UdqIKO8vN7/A
+aJavCpaKoIMowy/aGCbvAvjNPpU3unU8jdl/t08EXs79S5IKPcgAx87sTTi7KDN5
+SYt4tr2uPEe53NTXuSatilG5QCyExIELOuzWAMKzg7CAiIlNS9foWeLyVkBgCQ6S
+me/L8ta+mUDy37K6vC34jh9vK9yrwF6X44ItRoOJafCaVfGI+175q/eWcqTX4q+I
+G4tKls4sL4mgOJLq+ra50aYMxbcuommctPMXU6CrrYyQpPTHMNVDQy2ttFdsq9iK
+TncCggEBAMmt/8yvPflS+xv3kg/ZBvR9JB1In2n3rUCYYD47ReKFqJ03Vmq5C9nY
+56s9w7OUO8perBXlJYmKZQhO4293lvxZD2Iq4NcZbVSCMoHAUzhzY3brdgtSIxa2
+gGveGAezZ38qKIU26dkz7deECY4vrsRkwhpTW0LGVCpjcQoaKvymAoCmAs8V2oMr
+Ziw1YQ9uOUoWwOqm1wZqmVcOXvPIS2gWAs3fQlWjH9hkcQTMsUaXQDOD0aqkSY3E
+NqOvbCV1/oUpRi3076khCoAXI1bKSn/AvR3KDP14B5toHI/F5OTSEiGhhHesgRrs
+fBrpEY1IATtPq1taBZZogRqI3rOkkPk=
+-----END PRIVATE KEY-----
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/minimal-raw-proxy-fallback.c b/minimal-examples/raw/minimal-raw-proxy-fallback/minimal-raw-proxy-fallback.c
new file mode 100644
index 00000000..abe58c8b
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/minimal-raw-proxy-fallback.c
@@ -0,0 +1,134 @@
+/*
+ * lws-minimal-raw-proxy-fallback
+ *
+ * Copyright (C) 2018 Andy Green <andy@warmcat.com>
+ *
+ * This file is made available under the Creative Commons CC0 1.0
+ * Universal Public Domain Dedication.
+ *
+ * This demonstrates a normal http / https server which if it receives something
+ * it can't make sense of at the start, falls back to becoming a raw tcp proxy
+ * to a specified address and port.
+ *
+ * Incoming connections cause an outgoing connection to be initiated, and if
+ * successfully established then traffic coming in one side is placed on a
+ * ringbuffer and sent out the opposite side as soon as possible.
+ *
+ * If it receives expected packets for an http(s) connection, it acts like a
+ * normal h1 / h2 webserver.
+ */
+
+#include <libwebsockets.h>
+#include <string.h>
+#include <signal.h>
+#include <sys/types.h>
+
+#define LWS_PLUGIN_STATIC
+#include "../plugins/raw-proxy/protocol_lws_raw_proxy.c"
+
+static struct lws_protocols protocols[] = {
+	LWS_PLUGIN_PROTOCOL_RAW_PROXY,
+	{ NULL, NULL, 0, 0 } /* terminator */
+};
+
+static const struct lws_http_mount mount = {
+	/* .mount_next */		NULL,		/* linked-list "next" */
+	/* .mountpoint */		"/",		/* mountpoint URL */
+	/* .origin */			"./mount-origin", /* serve from dir */
+	/* .def */			"index.html",	/* default filename */
+	/* .protocol */			NULL,
+	/* .cgienv */			NULL,
+	/* .extra_mimetypes */		NULL,
+	/* .interpret */		NULL,
+	/* .cgi_timeout */		0,
+	/* .cache_max_age */		0,
+	/* .auth_mask */		0,
+	/* .cache_reusable */		0,
+	/* .cache_revalidate */		0,
+	/* .cache_intermediaries */	0,
+	/* .origin_protocol */		LWSMPRO_FILE,	/* files in a dir */
+	/* .mountpoint_len */		1,		/* char count */
+	/* .basic_auth_login_file */	NULL,
+};
+
+static int interrupted;
+
+void sigint_handler(int sig)
+{
+	interrupted = 1;
+}
+
+static struct lws_protocol_vhost_options pvo1 = {
+        NULL,
+        NULL,
+        "onward",		/* pvo name */
+        "ipv4:127.0.0.1:22"	/* pvo value */
+};
+
+static const struct lws_protocol_vhost_options pvo = {
+        NULL,           	/* "next" pvo linked-list */
+        &pvo1,			/* "child" pvo linked-list */
+        "raw-proxy",		/* protocol name we belong to on this vhost */
+        ""              	/* ignored */
+};
+
+
+int main(int argc, const char **argv)
+{
+	int n = 0, logs = LLL_USER | LLL_ERR | LLL_WARN | LLL_NOTICE;
+	struct lws_context_creation_info info;
+	struct lws_context *context;
+	char outward[256];
+	const char *p;
+
+	signal(SIGINT, sigint_handler);
+
+	if ((p = lws_cmdline_option(argc, argv, "-d")))
+		logs = atoi(p);
+
+	lws_set_log_level(logs, NULL);
+	lwsl_user("LWS minimal raw proxy fallback | visit http://localhost:7681\n");
+
+	if ((p = lws_cmdline_option(argc, argv, "-r"))) {
+		lws_strncpy(outward, p, sizeof(outward));
+		pvo1.value = outward;
+	}
+
+	memset(&info, 0, sizeof info); /* otherwise uninitialized garbage */
+	info.port = 7681;
+	info.protocols = protocols;
+	info.pvo = &pvo;
+	info.mounts = &mount;
+	info.error_document_404 = "/404.html";
+	info.options =
+		LWS_SERVER_OPTION_HTTP_HEADERS_SECURITY_BEST_PRACTICES_ENFORCE |
+		LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG;
+	info.listen_accept_role = "raw-proxy";
+	info.listen_accept_protocol = "raw-proxy";
+
+	if (lws_cmdline_option(argc, argv, "-s")) {
+		info.options |= LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT |
+				LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT;
+		info.ssl_cert_filepath = "localhost-100y.cert";
+		info.ssl_private_key_filepath = "localhost-100y.key";
+
+		if (lws_cmdline_option(argc, argv, "-u"))
+			info.options |= LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS;
+
+		if (lws_cmdline_option(argc, argv, "-h"))
+			info.options |= LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER;
+	}
+
+	context = lws_create_context(&info);
+	if (!context) {
+		lwsl_err("lws init failed\n");
+		return 1;
+	}
+
+	while (n >= 0 && !interrupted)
+		n = lws_service(context, 1000);
+
+	lws_context_destroy(context);
+
+	return 0;
+}
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/404.html b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/404.html
new file mode 100644
index 00000000..3e5a14b9
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/404.html
@@ -0,0 +1,9 @@
+<meta charset="UTF-8"> 
+<html>
+	<body>
+		<img src="libwebsockets.org-logo.svg"><br>
+		<h1>404</h1>
+		Sorry, that file doesn't exist.
+	</body>
+</html>
+
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/favicon.ico b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/favicon.ico
new file mode 100644
index 0000000000000000000000000000000000000000..c0cc2e3dff34012ba3d4a7848a7ed17579788ec5
GIT binary patch
literal 1406
zcmZQzU}Ruq5D;JhgA7&%1~CQ(1`P%V29S^f14y0&EXTkIp}-`Ry|Mg1n7g4Wf+79t
z2ZrqYe+;>20vPVjzRB=<LjuF5*B2OyS3%T(6^;_4Aut*O!zKh6Nd`<zOpI)7Y@qT3
ztd|fUtO$wV;NW0nWo2b#XJ-eC65@juArUMrER39-oQ%xO%wSPMe6S*%#Q*;c3^07e
Soq+*{L1HjAh{nbTi2(qS_AI0T

literal 0
HcmV?d00001

diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/index.html b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/index.html
new file mode 100644
index 00000000..573e5154
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/index.html
@@ -0,0 +1,15 @@
+<html>
+ <head>
+  <meta charset=utf-8 http-equiv="Content-Language" content="en"/>
+ </head>
+	<body>
+		<img src="libwebsockets.org-logo.svg">
+		<img src="strict-csp.svg"><br>
+
+		Hello from the <b>minimal raw fallback http server example</b>.
+		<br>
+		You can confirm the 404 page handler by going to this
+		nonexistant <a href="notextant.html">page</a>.
+	</body>
+</html>
+
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/libwebsockets.org-logo.svg b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/libwebsockets.org-logo.svg
new file mode 100644
index 00000000..7baea649
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/libwebsockets.org-logo.svg
@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="127.63mm" height="27.837mm" version="1.1" viewBox="0 0 127.63446 27.837189" xmlns="http://www.w3.org/2000/svg">
+	<defs>
+		<filter id="a" x="-.011681" y="-.053882" width="1.0234" height="1.1078" color-interpolation-filters="sRGB">
+			<feGaussianBlur stdDeviation="0.10687168"/>
+		</filter>
+	</defs>
+	<g transform="translate(452.86 42.871)">
+		<rect x="-452.86" y="-42.871" width="127.63" height="27.837" fill="none"/>
+		<g transform="matrix(4.0081 0 0 4.0081 -211.01 -224.26)" fill="#fff" filter="url(#a)" stroke="#fff">
+			<g style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="libwebsockets.org">
+				<path d="m-52.015 48.429q0 0.12497 0.03213 0.17852 0.0357 0.05356 0.0964 0.05356 0.07498 0 0.17495-0.03927l0.02499 0.20709q-0.04642 0.02856-0.13211 0.04642-0.08212 0.01785-0.14996 0.01785-0.13568 0-0.22137-0.08212-0.08212-0.08569-0.08212-0.29635v-2.1601h0.25707z"/>
+				<path d="m-51.417 47.068h0.25707v1.7852h-0.25707zm-0.04642-0.54271q0-0.08569 0.04642-0.13925 0.04999-0.05356 0.12854-0.05356 0.07855 0 0.12854 0.05356 0.05356 0.04999 0.05356 0.13925 0 0.08569-0.05356 0.13568-0.04999 0.04642-0.12854 0.04642-0.07855 0-0.12854-0.04999-0.04642-0.04999-0.04642-0.13211z"/>
+				<path d="m-50.686 46.354h0.25707v0.84976h0.01071q0.14639-0.17852 0.38918-0.17852 0.27492 0 0.4106 0.2178 0.13925 0.2178 0.13925 0.6891 0 0.48201-0.18566 0.71766-0.18209 0.23565-0.51771 0.23565-0.16424 0-0.29992-0.03571-0.13568-0.03927-0.20352-0.08926zm0.25707 2.2387q0.04999 0.02856 0.1214 0.04641 0.07498 0.01428 0.1571 0.01428 0.18566 0 0.29278-0.17495 0.11068-0.17852 0.11068-0.54628 0-0.15353-0.02142-0.27492-0.01785-0.12496-0.0607-0.21423-0.03927-0.08926-0.10711-0.13568-0.06427-0.04999-0.1571-0.04999-0.12854 0-0.21423 0.07855-0.08212 0.07498-0.1214 0.20708z"/>
+				<path d="m-48.092 47.068 0.24993 0.91403 0.04284 0.29635h0.01428l0.0357-0.29992 0.16781-0.91046h0.38561l-0.43916 1.8031h-0.33562l-0.26778-0.99615-0.02856-0.22851h-0.02142l-0.02499 0.23565-0.25707 0.98901h-0.34633l-0.45702-1.8031h0.46059l0.1928 0.89618 0.03213 0.31777h0.01428l0.04642-0.32134 0.2178-0.89261z"/>
+				<path d="m-45.889 48.721q-0.08926 0.07855-0.24279 0.12854-0.15353 0.04999-0.32134 0.04999-0.18566 0-0.32134-0.06427-0.13211-0.06427-0.2178-0.18566-0.08569-0.1214-0.12854-0.29278-0.03927-0.17495-0.03927-0.39632 0-0.48201 0.18923-0.71052 0.1928-0.23208 0.532-0.23208 0.11425 0 0.22137 0.0357 0.10711 0.03213 0.18923 0.11425 0.08569 0.07855 0.13568 0.21423 0.05356 0.13211 0.05356 0.33562 0 0.07855-0.01071 0.16781-0.0071 0.08926-0.02499 0.1928h-0.86762q0.0071 0.22137 0.09283 0.33919 0.08569 0.11782 0.27492 0.11782 0.11425 0 0.20709-0.0357 0.0964-0.0357 0.14639-0.07498zm-0.55699-1.3389q-0.13568 0-0.20352 0.11068-0.06784 0.10711-0.07855 0.30349h0.49272q0.01071-0.20352-0.04284-0.30706-0.05356-0.10711-0.16781-0.10711z"/>
+				<path d="m-45.569 46.354h0.42488v0.82834h0.01071q0.12854-0.1571 0.36776-0.1571 0.2535 0 0.39275 0.21066 0.14282 0.21066 0.14282 0.67838 0 0.507-0.19994 0.74622-0.19994 0.23565-0.54628 0.23565-0.18923 0-0.3499-0.0357-0.1571-0.03571-0.24279-0.07855zm0.42488 2.1137q0.07498 0.03927 0.19638 0.03927 0.13568 0 0.20708-0.12854 0.07141-0.13211 0.07141-0.43916 0-0.27135-0.05713-0.39632-0.05713-0.12854-0.17852-0.12854-0.17852 0-0.23922 0.18566z"/>
+				<path d="m-43.386 48.379q0-0.07498-0.04999-0.12496-0.04642-0.05356-0.1214-0.0964-0.07498-0.04642-0.16067-0.09283-0.08212-0.04641-0.1571-0.11425-0.07498-0.06784-0.12496-0.16424-0.04642-0.0964-0.04642-0.24279 0-0.24993 0.13568-0.38561 0.13568-0.13568 0.39989-0.13568 0.1571 0 0.29635 0.0357 0.13925 0.03213 0.22137 0.08212l-0.09997 0.32848q-0.06784-0.02856-0.16424-0.05356-0.0964-0.02856-0.18923-0.02856-0.17495 0-0.17495 0.14639 0 0.06784 0.04642 0.11425 0.04999 0.04284 0.12496 0.08569 0.07498 0.04284 0.1571 0.08926 0.08569 0.04642 0.16067 0.11782 0.07498 0.06784 0.1214 0.16781 0.04999 0.09997 0.04999 0.24636 0 0.24636-0.14996 0.39632-0.14996 0.14996-0.4463 0.14996-0.14639 0-0.2892-0.0357-0.13925-0.0357-0.22494-0.09283l0.11782-0.34276q0.07498 0.04285 0.17138 0.07498 0.09997 0.03213 0.20709 0.03213 0.08212 0 0.13568-0.0357 0.05356-0.03928 0.05356-0.1214z"/>
+				<path d="m-42.802 47.961q0-0.47487 0.18566-0.70695 0.18566-0.23208 0.51771-0.23208 0.35704 0 0.532 0.23565 0.17495 0.23565 0.17495 0.70338 0 0.47844-0.18566 0.71052-0.18566 0.22851-0.52128 0.22851-0.70338 0-0.70338-0.93902zm0.43916 0q0 0.26778 0.0607 0.41417t0.20352 0.14639q0.13568 0 0.19994-0.12497 0.06784-0.12854 0.06784-0.43559 0-0.27492-0.0607-0.41774-0.0607-0.14282-0.20708-0.14282-0.12497 0-0.19638 0.12854-0.06784 0.12497-0.06784 0.43202z"/>
+				<path d="m-40.094 48.757q-0.08926 0.07141-0.21423 0.10711-0.12496 0.0357-0.24993 0.0357-0.18209 0-0.30706-0.06427-0.1214-0.06784-0.19994-0.18923-0.07855-0.12496-0.11425-0.29635-0.03213-0.17495-0.03213-0.38918 0-0.46773 0.16781-0.70338 0.16781-0.23565 0.49272-0.23565 0.16067 0 0.26064 0.02856 0.10354 0.02856 0.18209 0.07141l-0.09997 0.35347q-0.06427-0.03213-0.12497-0.04642-0.05713-0.01785-0.13925-0.01785-0.14996 0-0.22494 0.13211-0.07498 0.12854-0.07498 0.41774 0 0.24279 0.07498 0.39632 0.07855 0.15353 0.24636 0.15353 0.08926 0 0.14996-0.02142 0.06427-0.02499 0.11782-0.0607z"/>
+				<path d="m-39.374 48.114h-0.09997v0.73908h-0.42488v-2.4993h0.42488v1.4746l0.08569-0.04999 0.29635-0.71052h0.46059l-0.32848 0.70695-0.15353 0.1214 0.16781 0.1214 0.36418 0.83548h-0.47844z"/>
+				<path d="m-37.256 48.721q-0.08926 0.07855-0.24279 0.12854-0.15353 0.04999-0.32134 0.04999-0.18566 0-0.32134-0.06427-0.13211-0.06427-0.2178-0.18566-0.08569-0.1214-0.12854-0.29278-0.03927-0.17495-0.03927-0.39632 0-0.48201 0.18923-0.71052 0.1928-0.23208 0.532-0.23208 0.11425 0 0.22137 0.0357 0.10711 0.03213 0.18923 0.11425 0.08569 0.07855 0.13568 0.21423 0.05356 0.13211 0.05356 0.33562 0 0.07855-0.01071 0.16781-0.0071 0.08926-0.02499 0.1928h-0.86763q0.0071 0.22137 0.09283 0.33919 0.08569 0.11782 0.27492 0.11782 0.11425 0 0.20708-0.0357 0.0964-0.0357 0.14639-0.07498zm-0.55699-1.3389q-0.13568 0-0.20352 0.11068-0.06784 0.10711-0.07855 0.30349h0.49272q0.01071-0.20352-0.04284-0.30706-0.05356-0.10711-0.16781-0.10711z"/>
+				<path d="m-37.075 47.068h0.19637v-0.33562l0.42488-0.13211v0.46773h0.34633v0.37847h-0.34633v0.77836q0 0.15353 0.02856 0.2178 0.03213 0.06427 0.11068 0.06427 0.05356 0 0.0964-0.01071t0.09283-0.03213l0.05356 0.33919q-0.07855 0.03928-0.18209 0.06427-0.10354 0.02856-0.2178 0.02856-0.20352 0-0.30706-0.11782-0.09997-0.11782-0.09997-0.39632v-0.93546h-0.19637z"/>
+				<path d="m-35.297 48.379q0-0.07498-0.04999-0.12496-0.04641-0.05356-0.1214-0.0964-0.07498-0.04642-0.16067-0.09283-0.08212-0.04641-0.1571-0.11425-0.07498-0.06784-0.12496-0.16424-0.04642-0.0964-0.04642-0.24279 0-0.24993 0.13568-0.38561 0.13568-0.13568 0.39989-0.13568 0.1571 0 0.29635 0.0357 0.13925 0.03213 0.22137 0.08212l-0.09997 0.32848q-0.06784-0.02856-0.16424-0.05356-0.0964-0.02856-0.18923-0.02856-0.17495 0-0.17495 0.14639 0 0.06784 0.04642 0.11425 0.04999 0.04284 0.12497 0.08569 0.07498 0.04284 0.1571 0.08926 0.08569 0.04642 0.16067 0.11782 0.07498 0.06784 0.1214 0.16781 0.04999 0.09997 0.04999 0.24636 0 0.24636-0.14996 0.39632-0.14996 0.14996-0.4463 0.14996-0.14639 0-0.2892-0.0357-0.13925-0.0357-0.22494-0.09283l0.11782-0.34276q0.07498 0.04285 0.17138 0.07498 0.09997 0.03213 0.20708 0.03213 0.08212 0 0.13568-0.0357 0.05356-0.03928 0.05356-0.1214z"/>
+				<path d="m-34.662 48.693q0-0.09997 0.04642-0.14996 0.04999-0.04999 0.13211-0.04999 0.08212 0 0.12854 0.04999 0.04999 0.04999 0.04999 0.14996 0 0.10354-0.04999 0.15353-0.04642 0.04999-0.12854 0.04999-0.08212 0-0.13211-0.04999-0.04642-0.04999-0.04642-0.15353z"/>
+				<path d="m-34.035 47.961q0-0.48201 0.16424-0.70695 0.16781-0.22851 0.47487-0.22851 0.32848 0 0.48201 0.23208 0.1571 0.23208 0.1571 0.70338 0 0.48558-0.16781 0.71052-0.16781 0.22494-0.4713 0.22494-0.32848 0-0.48558-0.23208-0.15353-0.23208-0.15353-0.70338zm0.26778 0q0 0.1571 0.01785 0.28564 0.02142 0.12854 0.06427 0.22137 0.04642 0.09283 0.11782 0.14639 0.07141 0.04999 0.17138 0.04999 0.18566 0 0.2785-0.16424 0.09283-0.16781 0.09283-0.53914 0-0.15353-0.02142-0.28206-0.01785-0.13211-0.06427-0.22494-0.04285-0.09283-0.11425-0.14282-0.07141-0.05356-0.17138-0.05356-0.18209 0-0.27849 0.16781-0.09283 0.16781-0.09283 0.53557z"/>
+				<path d="m-32.415 47.068h0.18209l0.04642 0.18923h0.01071q0.04999-0.10354 0.12854-0.16067 0.08212-0.0607 0.19637-0.0607 0.08212 0 0.18566 0.03213l-0.04999 0.26064q-0.09283-0.03213-0.16424-0.03213-0.11426 0-0.18566 0.06784-0.07141 0.06427-0.09283 0.17495v1.3139h-0.25707z"/>
+				<path d="m-30.314 48.936q0 0.34633-0.15353 0.51057-0.15353 0.16424-0.4463 0.16424-0.17852 0-0.29278-0.03213-0.11425-0.02856-0.18566-0.06784l0.07498-0.22137q0.07141 0.03213 0.1571 0.0607 0.08569 0.02856 0.21066 0.02856 0.2178 0 0.29635-0.1214 0.08212-0.1214 0.08212-0.40703v-0.13211h-0.01071q-0.05713 0.08212-0.14639 0.12854-0.08926 0.04641-0.22851 0.04641-0.28921 0-0.42488-0.22137-0.13568-0.22494-0.13568-0.70338 0-0.46059 0.17495-0.69624 0.17852-0.23565 0.52486-0.23565 0.16781 0 0.2892 0.03213t0.21423 0.07498zm-0.25707-1.6103q-0.10711-0.05713-0.27492-0.05713-0.18209 0-0.29278 0.16781-0.11068 0.16424-0.11068 0.52842 0 0.14996 0.01785 0.27849 0.01785 0.12497 0.0607 0.22137 0.04285 0.09283 0.10711 0.14639 0.06784 0.04999 0.16424 0.04999 0.13568 0 0.21423-0.07141t0.11425-0.21423z"/>
+			</g>
+			<g style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="lightweight, portable C library">
+				<path d="m-49.147 50.56q0 0.05637 0.01449 0.08052 0.0161 0.02416 0.04348 0.02416 0.03382 0 0.07891-0.01772l0.01127 0.09341q-0.02094 0.01288-0.05959 0.02094-0.03704 0.0081-0.06764 0.0081-0.0612 0-0.09985-0.03704-0.03704-0.03865-0.03704-0.13367v-0.97434h0.11595z"/>
+				<path d="m-48.878 49.946h0.11596v0.80524h-0.11596zm-0.02094-0.24479q0-0.03865 0.02094-0.06281 0.02255-0.02416 0.05798-0.02416t0.05798 0.02416q0.02416 0.02255 0.02416 0.06281 0 0.03865-0.02416 0.0612-0.02255 0.02094-0.05798 0.02094t-0.05798-0.02255q-0.02094-0.02255-0.02094-0.05959z"/>
+				<path d="m-48.041 50.789q0 0.15622-0.06925 0.2303-0.06925 0.07408-0.20131 0.07408-0.08052 0-0.13206-0.0145-0.05153-0.01288-0.08374-0.0306l0.03382-0.09985q0.03221 0.01449 0.07086 0.02738 0.03865 0.01288 0.09502 0.01288 0.09824 0 0.13367-0.05476 0.03704-0.05476 0.03704-0.18359v-0.05959h-0.0048q-0.02577 0.03704-0.06603 0.05798t-0.10307 0.02094q-0.13045 0-0.19165-0.09985-0.0612-0.10146-0.0612-0.31726 0-0.20775 0.07891-0.31404 0.08052-0.10629 0.23674-0.10629 0.07569 0 0.13045 0.01449 0.05476 0.01449 0.09663 0.03382zm-0.11595-0.72632q-0.04831-0.02577-0.12401-0.02577-0.08213 0-0.13206 0.07569-0.04992 0.07408-0.04992 0.23835 0 0.06764 0.0081 0.12562 0.0081 0.05637 0.02738 0.09985 0.01933 0.04187 0.04831 0.06603 0.0306 0.02255 0.07408 0.02255 0.0612 0 0.09663-0.03221t0.05154-0.09663z"/>
+				<path d="m-47.441 50.752v-0.48958q0-0.11273-0.02738-0.17071-0.02577-0.05959-0.10468-0.05959-0.05637 0-0.10307 0.04026-0.04509 0.04026-0.0612 0.10146v0.57816h-0.11595v-1.1273h0.11595v0.39779h0.0048q0.03221-0.04187 0.07891-0.06764 0.04832-0.02738 0.11918-0.02738 0.05315 0 0.0918 0.0145 0.04026 0.01449 0.06603 0.04992t0.03865 0.09502q0.01288 0.05798 0.01288 0.14494v0.52018z"/>
+				<path d="m-47.226 49.946h0.09824v-0.15944l0.11595-0.03704v0.19648h0.17393v0.10468h-0.17393v0.47992q0 0.07086 0.01611 0.10307 0.01772 0.0306 0.05637 0.0306 0.03221 0 0.05476-0.0064 0.02416-0.0081 0.05154-0.01933l0.02255 0.0918q-0.03543 0.01772-0.07891 0.02738-0.04187 0.01127-0.08858 0.01127-0.08052 0-0.11595-0.05154-0.03382-0.05315-0.03382-0.17071v-0.49603h-0.09824z"/>
+				<path d="m-46.272 49.946 0.14333 0.47026 0.02899 0.15461h0.0032l0.02416-0.15783 0.10951-0.46704h0.10951l-0.21418 0.82295h-0.06603l-0.16266-0.52824-0.02255-0.13528h-0.0032l-0.02255 0.13689-0.15783 0.52662h-0.06603l-0.22064-0.82295h0.12401l0.12401 0.46865 0.01933 0.15622h0.0032l0.02899-0.15944 0.13206-0.46543z"/>
+				<path d="m-45.286 50.697q-0.03865 0.03543-0.09824 0.05476t-0.12562 0.01933q-0.07569 0-0.13206-0.02899-0.05476-0.0306-0.0918-0.08535-0.03543-0.05637-0.05315-0.13367-0.01611-0.0773-0.01611-0.17393 0-0.20614 0.07569-0.31404t0.21419-0.1079q0.04509 0 0.08858 0.01127 0.04509 0.01127 0.08052 0.04509t0.05637 0.09502q0.02255 0.0612 0.02255 0.15944 0 0.02738-0.0032 0.05959-0.0016 0.0306-0.0048 0.06442h-0.40906q0 0.06925 0.01127 0.12562 0.01127 0.05637 0.03543 0.09663 0.02416 0.03865 0.0612 0.0612 0.03865 0.02094 0.09502 0.02094 0.04348 0 0.08535-0.0161 0.04348-0.01611 0.06603-0.03865zm-0.09019-0.43161q0.0032-0.12079-0.03382-0.17715-0.03704-0.05637-0.10146-0.05637-0.07408 0-0.11756 0.05637-0.04348 0.05637-0.05154 0.17715z"/>
+				<path d="m-45.084 49.946h0.11595v0.80524h-0.11595zm-0.02094-0.24479q0-0.03865 0.02094-0.06281 0.02255-0.02416 0.05798-0.02416t0.05798 0.02416q0.02416 0.02255 0.02416 0.06281 0 0.03865-0.02416 0.0612-0.02255 0.02094-0.05798 0.02094t-0.05798-0.02255q-0.02094-0.02255-0.02094-0.05959z"/>
+				<path d="m-44.247 50.789q0 0.15622-0.06925 0.2303-0.06925 0.07408-0.20131 0.07408-0.08052 0-0.13206-0.0145-0.05153-0.01288-0.08374-0.0306l0.03382-0.09985q0.03221 0.01449 0.07086 0.02738 0.03865 0.01288 0.09502 0.01288 0.09824 0 0.13367-0.05476 0.03704-0.05476 0.03704-0.18359v-0.05959h-0.0048q-0.02577 0.03704-0.06603 0.05798t-0.10307 0.02094q-0.13045 0-0.19165-0.09985-0.0612-0.10146-0.0612-0.31726 0-0.20775 0.07891-0.31404 0.08052-0.10629 0.23674-0.10629 0.07569 0 0.13045 0.01449 0.05476 0.01449 0.09663 0.03382zm-0.11595-0.72632q-0.04831-0.02577-0.12401-0.02577-0.08213 0-0.13206 0.07569-0.04993 0.07408-0.04993 0.23835 0 0.06764 0.0081 0.12562 0.0081 0.05637 0.02738 0.09985 0.01933 0.04187 0.04831 0.06603 0.0306 0.02255 0.07408 0.02255 0.0612 0 0.09663-0.03221t0.05154-0.09663z"/>
+				<path d="m-43.647 50.752v-0.48958q0-0.11273-0.02738-0.17071-0.02577-0.05959-0.10468-0.05959-0.05637 0-0.10307 0.04026-0.04509 0.04026-0.0612 0.10146v0.57816h-0.11595v-1.1273h0.11595v0.39779h0.0048q0.03221-0.04187 0.07891-0.06764 0.04831-0.02738 0.11918-0.02738 0.05315 0 0.0918 0.0145 0.04026 0.01449 0.06603 0.04992t0.03865 0.09502q0.01288 0.05798 0.01288 0.14494v0.52018z"/>
+				<path d="m-43.432 49.946h0.09824v-0.15944l0.11595-0.03704v0.19648h0.17393v0.10468h-0.17393v0.47992q0 0.07086 0.01611 0.10307 0.01771 0.0306 0.05637 0.0306 0.03221 0 0.05476-0.0064 0.02416-0.0081 0.05154-0.01933l0.02255 0.0918q-0.03543 0.01772-0.07891 0.02738-0.04187 0.01127-0.08858 0.01127-0.08052 0-0.11595-0.05154-0.03382-0.05315-0.03382-0.17071v-0.49603h-0.09824z"/>
+				<path d="m-42.945 50.682q0-0.04026 0.02255-0.06442 0.02416-0.02416 0.0612-0.02416 0.04187 0 0.06764 0.03382 0.02738 0.03382 0.02738 0.10629 0 0.05315-0.01449 0.09502-0.01288 0.04348-0.03543 0.07569-0.02094 0.03221-0.0467 0.05315-0.02577 0.02094-0.04993 0.0306l-0.04026-0.05476q0.02094-0.01127 0.03865-0.0306 0.01933-0.01772 0.0306-0.04026 0.01288-0.02255 0.01933-0.04831 0.0064-0.02416 0.0064-0.04831-0.03221 0.0097-0.05959-0.01288-0.02738-0.02255-0.02738-0.07086z"/>
+				<path d="m-42.373 49.946h0.08213l0.01771 0.08697h0.0064q0.05959-0.10629 0.18682-0.10629 0.12723 0 0.19004 0.09502 0.06442 0.09502 0.06442 0.31082 0 0.10146-0.02094 0.18359-0.02094 0.08052-0.05959 0.1385-0.03865 0.05637-0.09502 0.08696-0.05476 0.02899-0.1224 0.02899-0.0467 0-0.07408-0.0064-0.02738-0.0048-0.05959-0.02255v0.33176h-0.11595zm0.11595 0.67801q0.02255 0.01933 0.04992 0.0306 0.02899 0.01127 0.07569 0.01127 0.08535 0 0.13528-0.08697 0.04992-0.08696 0.04992-0.24801 0-0.06764-0.0097-0.1224-0.0081-0.05476-0.02738-0.09341-0.01933-0.04026-0.04992-0.0612-0.02899-0.02255-0.07247-0.02255-0.11756 0-0.15138 0.14333z"/>
+				<path d="m-41.707 50.349q0-0.21742 0.07408-0.31887 0.07569-0.10307 0.21419-0.10307 0.14816 0 0.21741 0.10468 0.07086 0.10468 0.07086 0.31726 0 0.21902-0.07569 0.32048t-0.21258 0.10146q-0.14816 0-0.21902-0.10468-0.06925-0.10468-0.06925-0.31726zm0.12079 0q0 0.07086 0.0081 0.12884 0.0097 0.05798 0.02899 0.09985 0.02094 0.04187 0.05315 0.06603 0.03221 0.02255 0.0773 0.02255 0.08375 0 0.12562-0.07408 0.04187-0.07569 0.04187-0.24318 0-0.06925-0.0097-0.12723-0.0081-0.05959-0.02899-0.10146-0.01933-0.04187-0.05154-0.06442-0.03221-0.02416-0.0773-0.02416-0.08213 0-0.12562 0.07569-0.04187 0.07569-0.04187 0.24157z"/>
+				<path d="m-40.977 49.946h0.08213l0.02094 0.08535h0.0048q0.02255-0.0467 0.05798-0.07247 0.03704-0.02738 0.08858-0.02738 0.03704 0 0.08375 0.01449l-0.02255 0.11756q-0.04187-0.01449-0.07408-0.01449-0.05154 0-0.08374 0.0306-0.03221 0.02899-0.04187 0.07891v0.59265h-0.11595z"/>
+				<path d="m-40.579 49.946h0.09824v-0.15944l0.11595-0.03704v0.19648h0.17393v0.10468h-0.17393v0.47992q0 0.07086 0.01611 0.10307 0.01772 0.0306 0.05637 0.0306 0.03221 0 0.05476-0.0064 0.02416-0.0081 0.05154-0.01933l0.02255 0.0918q-0.03543 0.01772-0.07891 0.02738-0.04187 0.01127-0.08858 0.01127-0.08052 0-0.11595-0.05154-0.03382-0.05315-0.03382-0.17071v-0.49603h-0.09824z"/>
+				<path d="m-40.063 49.995q0.0467-0.02899 0.11273-0.04509 0.06764-0.01611 0.14172-0.01611 0.06764 0 0.1079 0.02094 0.04187 0.01933 0.06442 0.05476 0.02416 0.03382 0.0306 0.07891 0.0081 0.04348 0.0081 0.0918 0 0.09663-0.0048 0.18842-0.0032 0.0918-0.0032 0.17393 0 0.0612 0.0032 0.11434 0.0048 0.05154 0.01611 0.09824h-0.08858l-0.02738-0.09502h-0.0064q-0.02416 0.04187-0.07086 0.07247t-0.12562 0.0306q-0.08697 0-0.14333-0.05959-0.05476-0.0612-0.05476-0.16749 0-0.06925 0.02255-0.11596 0.02416-0.0467 0.06603-0.07569 0.04348-0.02899 0.10146-0.04026 0.05959-0.01288 0.13206-0.01288 0.01611 0 0.03221 0 0.01611 0 0.03382 0.0016 0.0048-0.04993 0.0048-0.08858 0-0.0918-0.02738-0.12884-0.02738-0.03704-0.09985-0.03704-0.04509 0-0.09824 0.01449-0.05315 0.01288-0.08858 0.03382zm0.34947 0.38974q-0.0161-0.0016-0.03221-0.0016-0.01611-0.0016-0.03221-0.0016-0.03865 0-0.07569 0.0064t-0.06603 0.02255q-0.02899 0.0161-0.0467 0.04348-0.01611 0.02738-0.01611 0.06925 0 0.06442 0.0306 0.09985 0.03221 0.03543 0.08213 0.03543 0.06764 0 0.10468-0.03221 0.03704-0.03221 0.05153-0.07086z"/>
+				<path d="m-39.41 49.624h0.11595v0.38329h0.0048q0.06603-0.08052 0.17554-0.08052 0.12401 0 0.1852 0.09824 0.06281 0.09824 0.06281 0.31082 0 0.21741-0.08374 0.3237-0.08214 0.10629-0.23352 0.10629-0.07408 0-0.13528-0.0161-0.0612-0.01772-0.0918-0.04026zm0.11595 1.0098q0.02255 0.01288 0.05476 0.02094 0.03382 0.0064 0.07086 0.0064 0.08375 0 0.13206-0.07891 0.04993-0.08052 0.04993-0.2464 0-0.06925-0.0097-0.12401-0.0081-0.05637-0.02738-0.09663-0.01771-0.04026-0.04831-0.0612-0.02899-0.02255-0.07086-0.02255-0.05798 0-0.09663 0.03543-0.03704 0.03382-0.05476 0.09341z"/>
+				<path d="m-38.588 50.56q0 0.05637 0.01449 0.08052 0.0161 0.02416 0.04348 0.02416 0.03382 0 0.07891-0.01772l0.01127 0.09341q-0.02094 0.01288-0.05959 0.02094-0.03704 0.0081-0.06764 0.0081-0.0612 0-0.09985-0.03704-0.03704-0.03865-0.03704-0.13367v-0.97434h0.11595z"/>
+				<path d="m-37.856 50.697q-0.03865 0.03543-0.09824 0.05476t-0.12562 0.01933q-0.07569 0-0.13206-0.02899-0.05476-0.0306-0.0918-0.08535-0.03543-0.05637-0.05314-0.13367-0.01611-0.0773-0.01611-0.17393 0-0.20614 0.07569-0.31404t0.21419-0.1079q0.04509 0 0.08858 0.01127 0.04509 0.01127 0.08052 0.04509t0.05637 0.09502q0.02255 0.0612 0.02255 0.15944 0 0.02738-0.0032 0.05959-0.0016 0.0306-0.0048 0.06442h-0.40906q0 0.06925 0.01127 0.12562 0.01127 0.05637 0.03543 0.09663 0.02416 0.03865 0.0612 0.0612 0.03865 0.02094 0.09502 0.02094 0.04348 0 0.08536-0.0161 0.04348-0.01611 0.06603-0.03865zm-0.09019-0.43161q0.0032-0.12079-0.03382-0.17715-0.03704-0.05637-0.10146-0.05637-0.07408 0-0.11756 0.05637-0.04348 0.05637-0.05154 0.17715z"/>
+				<path d="m-36.734 50.708q-0.04026 0.03382-0.10146 0.04831t-0.12884 0.01449q-0.08535 0-0.15783-0.03221-0.07247-0.03221-0.12562-0.10146-0.05154-0.07086-0.08052-0.18198-0.02899-0.11112-0.02899-0.26734 0-0.16105 0.03221-0.27217 0.03382-0.11112 0.08858-0.18037t0.12562-0.09985q0.07247-0.0306 0.14816-0.0306 0.0773 0 0.12723 0.01127 0.05154 0.01127 0.08858 0.02738l-0.02899 0.10951q-0.03221-0.01772-0.07569-0.02738-0.04348-0.0097-0.09985-0.0097t-0.10629 0.02577q-0.04993 0.02416-0.08858 0.08052-0.03865 0.05476-0.0612 0.14494-0.02255 0.09019-0.02255 0.22064 0 0.23513 0.08052 0.3543 0.08052 0.11756 0.21419 0.11756 0.05476 0 0.09824-0.01449 0.04348-0.0161 0.07408-0.03704z"/>
+				<path d="m-36.176 50.56q0 0.05637 0.01449 0.08052 0.0161 0.02416 0.04348 0.02416 0.03382 0 0.07891-0.01772l0.01127 0.09341q-0.02094 0.01288-0.05959 0.02094-0.03704 0.0081-0.06764 0.0081-0.0612 0-0.09985-0.03704-0.03704-0.03865-0.03704-0.13367v-0.97434h0.11595z"/>
+				<path d="m-35.906 49.946h0.11595v0.80524h-0.11595zm-0.02094-0.24479q0-0.03865 0.02094-0.06281 0.02255-0.02416 0.05798-0.02416t0.05798 0.02416q0.02416 0.02255 0.02416 0.06281 0 0.03865-0.02416 0.0612-0.02255 0.02094-0.05798 0.02094t-0.05798-0.02255q-0.02094-0.02255-0.02094-0.05959z"/>
+				<path d="m-35.576 49.624h0.11596v0.38329h0.0048q0.06603-0.08052 0.17554-0.08052 0.12401 0 0.1852 0.09824 0.06281 0.09824 0.06281 0.31082 0 0.21741-0.08375 0.3237-0.08213 0.10629-0.23352 0.10629-0.07408 0-0.13528-0.0161-0.0612-0.01772-0.0918-0.04026zm0.11596 1.0098q0.02255 0.01288 0.05476 0.02094 0.03382 0.0064 0.07086 0.0064 0.08374 0 0.13206-0.07891 0.04993-0.08052 0.04993-0.2464 0-0.06925-0.0097-0.12401-0.0081-0.05637-0.02738-0.09663-0.01771-0.04026-0.04831-0.0612-0.02899-0.02255-0.07086-0.02255-0.05798 0-0.09663 0.03543-0.03704 0.03382-0.05476 0.09341z"/>
+				<path d="m-34.878 49.946h0.08213l0.02094 0.08535h0.0048q0.02255-0.0467 0.05798-0.07247 0.03704-0.02738 0.08858-0.02738 0.03704 0 0.08375 0.01449l-0.02255 0.11756q-0.04187-0.01449-0.07408-0.01449-0.05154 0-0.08374 0.0306-0.03221 0.02899-0.04187 0.07891v0.59265h-0.11595z"/>
+				<path d="m-34.446 49.995q0.0467-0.02899 0.11273-0.04509 0.06764-0.01611 0.14172-0.01611 0.06764 0 0.1079 0.02094 0.04187 0.01933 0.06442 0.05476 0.02416 0.03382 0.0306 0.07891 0.0081 0.04348 0.0081 0.0918 0 0.09663-0.0048 0.18842-0.0032 0.0918-0.0032 0.17393 0 0.0612 0.0032 0.11434 0.0048 0.05154 0.01611 0.09824h-0.08858l-0.02738-0.09502h-0.0064q-0.02416 0.04187-0.07086 0.07247t-0.12562 0.0306q-0.08696 0-0.14333-0.05959-0.05476-0.0612-0.05476-0.16749 0-0.06925 0.02255-0.11596 0.02416-0.0467 0.06603-0.07569 0.04348-0.02899 0.10146-0.04026 0.05959-0.01288 0.13206-0.01288 0.0161 0 0.03221 0t0.03382 0.0016q0.0048-0.04993 0.0048-0.08858 0-0.0918-0.02738-0.12884-0.02738-0.03704-0.09985-0.03704-0.04509 0-0.09824 0.01449-0.05315 0.01288-0.08858 0.03382zm0.34947 0.38974q-0.01611-0.0016-0.03221-0.0016-0.01611-0.0016-0.03221-0.0016-0.03865 0-0.07569 0.0064t-0.06603 0.02255q-0.02899 0.0161-0.0467 0.04348-0.01611 0.02738-0.01611 0.06925 0 0.06442 0.0306 0.09985 0.03221 0.03543 0.08214 0.03543 0.06764 0 0.10468-0.03221t0.05154-0.07086z"/>
+				<path d="m-33.793 49.946h0.08214l0.02094 0.08535h0.0048q0.02255-0.0467 0.05798-0.07247 0.03704-0.02738 0.08858-0.02738 0.03704 0 0.08375 0.01449l-0.02255 0.11756q-0.04187-0.01449-0.07408-0.01449-0.05154 0-0.08374 0.0306-0.03221 0.02899-0.04187 0.07891v0.59265h-0.11595z"/>
+				<path d="m-33.153 50.467 0.03382 0.15622h0.0081l0.02416-0.15622 0.1224-0.52018h0.11756l-0.19165 0.7231q-0.02255 0.08696-0.04509 0.16266-0.02255 0.07569-0.04992 0.13045-0.02577 0.05637-0.05959 0.08697-0.03221 0.03221-0.0773 0.03221t-0.07891-0.01449l0.01933-0.10951q0.02255 0.0081 0.04509 0.0032 0.02255-0.0048 0.04187-0.02738 0.02094-0.02255 0.03704-0.06764 0.01772-0.04348 0.0306-0.11434l-0.2609-0.80524h0.13206z"/>
+			</g>
+		</g>
+		<g>
+			<g transform="matrix(4.0081 0 0 4.0081 -210.57 -224.31)" stroke-width=".4463" style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="libwebsockets.org">
+				<g stroke-width=".4463">
+					<path d="m-52.015 48.429q0 0.12497 0.03213 0.17852 0.0357 0.05356 0.0964 0.05356 0.07498 0 0.17495-0.03927l0.02499 0.20709q-0.04642 0.02856-0.13211 0.04642-0.08212 0.01785-0.14996 0.01785-0.13568 0-0.22137-0.08212-0.08212-0.08569-0.08212-0.29635v-2.1601h0.25707z"/>
+					<path d="m-51.417 47.068h0.25707v1.7852h-0.25707zm-0.04642-0.54271q0-0.08569 0.04642-0.13925 0.04999-0.05356 0.12854-0.05356 0.07855 0 0.12854 0.05356 0.05356 0.04999 0.05356 0.13925 0 0.08569-0.05356 0.13568-0.04999 0.04642-0.12854 0.04642-0.07855 0-0.12854-0.04999-0.04642-0.04999-0.04642-0.13211z"/>
+					<path d="m-50.686 46.354h0.25707v0.84976h0.01071q0.14639-0.17852 0.38918-0.17852 0.27492 0 0.4106 0.2178 0.13925 0.2178 0.13925 0.6891 0 0.48201-0.18566 0.71766-0.18209 0.23565-0.51771 0.23565-0.16424 0-0.29992-0.03571-0.13568-0.03927-0.20352-0.08926zm0.25707 2.2387q0.04999 0.02856 0.1214 0.04641 0.07498 0.01428 0.1571 0.01428 0.18566 0 0.29278-0.17495 0.11068-0.17852 0.11068-0.54628 0-0.15353-0.02142-0.27492-0.01785-0.12496-0.0607-0.21423-0.03927-0.08926-0.10711-0.13568-0.06427-0.04999-0.1571-0.04999-0.12854 0-0.21423 0.07855-0.08212 0.07498-0.1214 0.20708z"/>
+				</g>
+				<path d="m-48.092 47.068 0.24993 0.91403 0.04284 0.29635h0.01428l0.0357-0.29992 0.16781-0.91046h0.38561l-0.43916 1.8031h-0.33562l-0.26778-0.99615-0.02856-0.22851h-0.02142l-0.02499 0.23565-0.25707 0.98901h-0.34633l-0.45702-1.8031h0.46059l0.1928 0.89618 0.03213 0.31777h0.01428l0.04642-0.32134 0.2178-0.89261z"/>
+				<path d="m-45.889 48.721q-0.08926 0.07855-0.24279 0.12854-0.15353 0.04999-0.32134 0.04999-0.18566 0-0.32134-0.06427-0.13211-0.06427-0.2178-0.18566-0.08569-0.1214-0.12854-0.29278-0.03927-0.17495-0.03927-0.39632 0-0.48201 0.18923-0.71052 0.1928-0.23208 0.532-0.23208 0.11425 0 0.22137 0.0357 0.10711 0.03213 0.18923 0.11425 0.08569 0.07855 0.13568 0.21423 0.05356 0.13211 0.05356 0.33562 0 0.07855-0.01071 0.16781-0.0071 0.08926-0.02499 0.1928h-0.86762q0.0071 0.22137 0.09283 0.33919 0.08569 0.11782 0.27492 0.11782 0.11425 0 0.20709-0.0357 0.0964-0.0357 0.14639-0.07498zm-0.55699-1.3389q-0.13568 0-0.20352 0.11068-0.06784 0.10711-0.07855 0.30349h0.49272q0.01071-0.20352-0.04284-0.30706-0.05356-0.10711-0.16781-0.10711z"/>
+				<path d="m-45.569 46.354h0.42488v0.82834h0.01071q0.12854-0.1571 0.36776-0.1571 0.2535 0 0.39275 0.21066 0.14282 0.21066 0.14282 0.67838 0 0.507-0.19994 0.74622-0.19994 0.23565-0.54628 0.23565-0.18923 0-0.3499-0.0357-0.1571-0.03571-0.24279-0.07855zm0.42488 2.1137q0.07498 0.03927 0.19638 0.03927 0.13568 0 0.20708-0.12854 0.07141-0.13211 0.07141-0.43916 0-0.27135-0.05713-0.39632-0.05713-0.12854-0.17852-0.12854-0.17852 0-0.23922 0.18566z"/>
+				<path d="m-43.386 48.379q0-0.07498-0.04999-0.12496-0.04642-0.05356-0.1214-0.0964-0.07498-0.04642-0.16067-0.09283-0.08212-0.04641-0.1571-0.11425-0.07498-0.06784-0.12496-0.16424-0.04642-0.0964-0.04642-0.24279 0-0.24993 0.13568-0.38561 0.13568-0.13568 0.39989-0.13568 0.1571 0 0.29635 0.0357 0.13925 0.03213 0.22137 0.08212l-0.09997 0.32848q-0.06784-0.02856-0.16424-0.05356-0.0964-0.02856-0.18923-0.02856-0.17495 0-0.17495 0.14639 0 0.06784 0.04642 0.11425 0.04999 0.04284 0.12496 0.08569 0.07498 0.04284 0.1571 0.08926 0.08569 0.04642 0.16067 0.11782 0.07498 0.06784 0.1214 0.16781 0.04999 0.09997 0.04999 0.24636 0 0.24636-0.14996 0.39632-0.14996 0.14996-0.4463 0.14996-0.14639 0-0.2892-0.0357-0.13925-0.0357-0.22494-0.09283l0.11782-0.34276q0.07498 0.04285 0.17138 0.07498 0.09997 0.03213 0.20709 0.03213 0.08212 0 0.13568-0.0357 0.05356-0.03928 0.05356-0.1214z"/>
+				<path d="m-42.802 47.961q0-0.47487 0.18566-0.70695 0.18566-0.23208 0.51771-0.23208 0.35704 0 0.532 0.23565 0.17495 0.23565 0.17495 0.70338 0 0.47844-0.18566 0.71052-0.18566 0.22851-0.52128 0.22851-0.70338 0-0.70338-0.93902zm0.43916 0q0 0.26778 0.0607 0.41417t0.20352 0.14639q0.13568 0 0.19994-0.12497 0.06784-0.12854 0.06784-0.43559 0-0.27492-0.0607-0.41774-0.0607-0.14282-0.20708-0.14282-0.12497 0-0.19638 0.12854-0.06784 0.12497-0.06784 0.43202z"/>
+				<path d="m-40.094 48.757q-0.08926 0.07141-0.21423 0.10711-0.12496 0.0357-0.24993 0.0357-0.18209 0-0.30706-0.06427-0.1214-0.06784-0.19994-0.18923-0.07855-0.12496-0.11425-0.29635-0.03213-0.17495-0.03213-0.38918 0-0.46773 0.16781-0.70338 0.16781-0.23565 0.49272-0.23565 0.16067 0 0.26064 0.02856 0.10354 0.02856 0.18209 0.07141l-0.09997 0.35347q-0.06427-0.03213-0.12497-0.04642-0.05713-0.01785-0.13925-0.01785-0.14996 0-0.22494 0.13211-0.07498 0.12854-0.07498 0.41774 0 0.24279 0.07498 0.39632 0.07855 0.15353 0.24636 0.15353 0.08926 0 0.14996-0.02142 0.06427-0.02499 0.11782-0.0607z"/>
+				<path d="m-39.374 48.114h-0.09997v0.73908h-0.42488v-2.4993h0.42488v1.4746l0.08569-0.04999 0.29635-0.71052h0.46059l-0.32848 0.70695-0.15353 0.1214 0.16781 0.1214 0.36418 0.83548h-0.47844z"/>
+				<path d="m-37.256 48.721q-0.08926 0.07855-0.24279 0.12854-0.15353 0.04999-0.32134 0.04999-0.18566 0-0.32134-0.06427-0.13211-0.06427-0.2178-0.18566-0.08569-0.1214-0.12854-0.29278-0.03927-0.17495-0.03927-0.39632 0-0.48201 0.18923-0.71052 0.1928-0.23208 0.532-0.23208 0.11425 0 0.22137 0.0357 0.10711 0.03213 0.18923 0.11425 0.08569 0.07855 0.13568 0.21423 0.05356 0.13211 0.05356 0.33562 0 0.07855-0.01071 0.16781-0.0071 0.08926-0.02499 0.1928h-0.86763q0.0071 0.22137 0.09283 0.33919 0.08569 0.11782 0.27492 0.11782 0.11425 0 0.20708-0.0357 0.0964-0.0357 0.14639-0.07498zm-0.55699-1.3389q-0.13568 0-0.20352 0.11068-0.06784 0.10711-0.07855 0.30349h0.49272q0.01071-0.20352-0.04284-0.30706-0.05356-0.10711-0.16781-0.10711z"/>
+				<path d="m-37.075 47.068h0.19637v-0.33562l0.42488-0.13211v0.46773h0.34633v0.37847h-0.34633v0.77836q0 0.15353 0.02856 0.2178 0.03213 0.06427 0.11068 0.06427 0.05356 0 0.0964-0.01071t0.09283-0.03213l0.05356 0.33919q-0.07855 0.03928-0.18209 0.06427-0.10354 0.02856-0.2178 0.02856-0.20352 0-0.30706-0.11782-0.09997-0.11782-0.09997-0.39632v-0.93546h-0.19637z"/>
+				<path d="m-35.297 48.379q0-0.07498-0.04999-0.12496-0.04641-0.05356-0.1214-0.0964-0.07498-0.04642-0.16067-0.09283-0.08212-0.04641-0.1571-0.11425-0.07498-0.06784-0.12496-0.16424-0.04642-0.0964-0.04642-0.24279 0-0.24993 0.13568-0.38561 0.13568-0.13568 0.39989-0.13568 0.1571 0 0.29635 0.0357 0.13925 0.03213 0.22137 0.08212l-0.09997 0.32848q-0.06784-0.02856-0.16424-0.05356-0.0964-0.02856-0.18923-0.02856-0.17495 0-0.17495 0.14639 0 0.06784 0.04642 0.11425 0.04999 0.04284 0.12497 0.08569 0.07498 0.04284 0.1571 0.08926 0.08569 0.04642 0.16067 0.11782 0.07498 0.06784 0.1214 0.16781 0.04999 0.09997 0.04999 0.24636 0 0.24636-0.14996 0.39632-0.14996 0.14996-0.4463 0.14996-0.14639 0-0.2892-0.0357-0.13925-0.0357-0.22494-0.09283l0.11782-0.34276q0.07498 0.04285 0.17138 0.07498 0.09997 0.03213 0.20708 0.03213 0.08212 0 0.13568-0.0357 0.05356-0.03928 0.05356-0.1214z"/>
+				<g stroke-width=".4463">
+					<path d="m-34.662 48.693q0-0.09997 0.04642-0.14996 0.04999-0.04999 0.13211-0.04999 0.08212 0 0.12854 0.04999 0.04999 0.04999 0.04999 0.14996 0 0.10354-0.04999 0.15353-0.04642 0.04999-0.12854 0.04999-0.08212 0-0.13211-0.04999-0.04642-0.04999-0.04642-0.15353z"/>
+					<path d="m-34.035 47.961q0-0.48201 0.16424-0.70695 0.16781-0.22851 0.47487-0.22851 0.32848 0 0.48201 0.23208 0.1571 0.23208 0.1571 0.70338 0 0.48558-0.16781 0.71052-0.16781 0.22494-0.4713 0.22494-0.32848 0-0.48558-0.23208-0.15353-0.23208-0.15353-0.70338zm0.26778 0q0 0.1571 0.01785 0.28564 0.02142 0.12854 0.06427 0.22137 0.04642 0.09283 0.11782 0.14639 0.07141 0.04999 0.17138 0.04999 0.18566 0 0.2785-0.16424 0.09283-0.16781 0.09283-0.53914 0-0.15353-0.02142-0.28206-0.01785-0.13211-0.06427-0.22494-0.04285-0.09283-0.11425-0.14282-0.07141-0.05356-0.17138-0.05356-0.18209 0-0.27849 0.16781-0.09283 0.16781-0.09283 0.53557z"/>
+					<path d="m-32.415 47.068h0.18209l0.04642 0.18923h0.01071q0.04999-0.10354 0.12854-0.16067 0.08212-0.0607 0.19637-0.0607 0.08212 0 0.18566 0.03213l-0.04999 0.26064q-0.09283-0.03213-0.16424-0.03213-0.11426 0-0.18566 0.06784-0.07141 0.06427-0.09283 0.17495v1.3139h-0.25707z"/>
+					<path d="m-30.314 48.936q0 0.34633-0.15353 0.51057-0.15353 0.16424-0.4463 0.16424-0.17852 0-0.29278-0.03213-0.11425-0.02856-0.18566-0.06784l0.07498-0.22137q0.07141 0.03213 0.1571 0.0607 0.08569 0.02856 0.21066 0.02856 0.2178 0 0.29635-0.1214 0.08212-0.1214 0.08212-0.40703v-0.13211h-0.01071q-0.05713 0.08212-0.14639 0.12854-0.08926 0.04641-0.22851 0.04641-0.28921 0-0.42488-0.22137-0.13568-0.22494-0.13568-0.70338 0-0.46059 0.17495-0.69624 0.17852-0.23565 0.52486-0.23565 0.16781 0 0.2892 0.03213t0.21423 0.07498zm-0.25707-1.6103q-0.10711-0.05713-0.27492-0.05713-0.18209 0-0.29278 0.16781-0.11068 0.16424-0.11068 0.52842 0 0.14996 0.01785 0.27849 0.01785 0.12497 0.0607 0.22137 0.04285 0.09283 0.10711 0.14639 0.06784 0.04999 0.16424 0.04999 0.13568 0 0.21423-0.07141t0.11425-0.21423z"/>
+				</g>
+			</g>
+			<g transform="matrix(4.0081 0 0 4.0081 -210.57 -224.31)" stroke-width=".20131" style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="lightweight, portable C library">
+				<path d="m-49.147 50.56q0 0.05637 0.01449 0.08052 0.0161 0.02416 0.04348 0.02416 0.03382 0 0.07891-0.01772l0.01127 0.09341q-0.02094 0.01288-0.05959 0.02094-0.03704 0.0081-0.06764 0.0081-0.0612 0-0.09985-0.03704-0.03704-0.03865-0.03704-0.13367v-0.97434h0.11595z"/>
+				<path d="m-48.878 49.946h0.11596v0.80524h-0.11596zm-0.02094-0.24479q0-0.03865 0.02094-0.06281 0.02255-0.02416 0.05798-0.02416t0.05798 0.02416q0.02416 0.02255 0.02416 0.06281 0 0.03865-0.02416 0.0612-0.02255 0.02094-0.05798 0.02094t-0.05798-0.02255q-0.02094-0.02255-0.02094-0.05959z"/>
+				<path d="m-48.041 50.789q0 0.15622-0.06925 0.2303-0.06925 0.07408-0.20131 0.07408-0.08052 0-0.13206-0.0145-0.05153-0.01288-0.08374-0.0306l0.03382-0.09985q0.03221 0.01449 0.07086 0.02738 0.03865 0.01288 0.09502 0.01288 0.09824 0 0.13367-0.05476 0.03704-0.05476 0.03704-0.18359v-0.05959h-0.0048q-0.02577 0.03704-0.06603 0.05798t-0.10307 0.02094q-0.13045 0-0.19165-0.09985-0.0612-0.10146-0.0612-0.31726 0-0.20775 0.07891-0.31404 0.08052-0.10629 0.23674-0.10629 0.07569 0 0.13045 0.01449 0.05476 0.01449 0.09663 0.03382zm-0.11595-0.72632q-0.04831-0.02577-0.12401-0.02577-0.08213 0-0.13206 0.07569-0.04992 0.07408-0.04992 0.23835 0 0.06764 0.0081 0.12562 0.0081 0.05637 0.02738 0.09985 0.01933 0.04187 0.04831 0.06603 0.0306 0.02255 0.07408 0.02255 0.0612 0 0.09663-0.03221t0.05154-0.09663z"/>
+				<path d="m-47.441 50.752v-0.48958q0-0.11273-0.02738-0.17071-0.02577-0.05959-0.10468-0.05959-0.05637 0-0.10307 0.04026-0.04509 0.04026-0.0612 0.10146v0.57816h-0.11595v-1.1273h0.11595v0.39779h0.0048q0.03221-0.04187 0.07891-0.06764 0.04832-0.02738 0.11918-0.02738 0.05315 0 0.0918 0.0145 0.04026 0.01449 0.06603 0.04992t0.03865 0.09502q0.01288 0.05798 0.01288 0.14494v0.52018z"/>
+				<path d="m-47.226 49.946h0.09824v-0.15944l0.11595-0.03704v0.19648h0.17393v0.10468h-0.17393v0.47992q0 0.07086 0.01611 0.10307 0.01772 0.0306 0.05637 0.0306 0.03221 0 0.05476-0.0064 0.02416-0.0081 0.05154-0.01933l0.02255 0.0918q-0.03543 0.01772-0.07891 0.02738-0.04187 0.01127-0.08858 0.01127-0.08052 0-0.11595-0.05154-0.03382-0.05315-0.03382-0.17071v-0.49603h-0.09824z"/>
+				<path d="m-46.272 49.946 0.14333 0.47026 0.02899 0.15461h0.0032l0.02416-0.15783 0.10951-0.46704h0.10951l-0.21418 0.82295h-0.06603l-0.16266-0.52824-0.02255-0.13528h-0.0032l-0.02255 0.13689-0.15783 0.52662h-0.06603l-0.22064-0.82295h0.12401l0.12401 0.46865 0.01933 0.15622h0.0032l0.02899-0.15944 0.13206-0.46543z"/>
+				<path d="m-45.286 50.697q-0.03865 0.03543-0.09824 0.05476t-0.12562 0.01933q-0.07569 0-0.13206-0.02899-0.05476-0.0306-0.0918-0.08535-0.03543-0.05637-0.05315-0.13367-0.01611-0.0773-0.01611-0.17393 0-0.20614 0.07569-0.31404t0.21419-0.1079q0.04509 0 0.08858 0.01127 0.04509 0.01127 0.08052 0.04509t0.05637 0.09502q0.02255 0.0612 0.02255 0.15944 0 0.02738-0.0032 0.05959-0.0016 0.0306-0.0048 0.06442h-0.40906q0 0.06925 0.01127 0.12562 0.01127 0.05637 0.03543 0.09663 0.02416 0.03865 0.0612 0.0612 0.03865 0.02094 0.09502 0.02094 0.04348 0 0.08535-0.0161 0.04348-0.01611 0.06603-0.03865zm-0.09019-0.43161q0.0032-0.12079-0.03382-0.17715-0.03704-0.05637-0.10146-0.05637-0.07408 0-0.11756 0.05637-0.04348 0.05637-0.05154 0.17715z"/>
+				<path d="m-45.084 49.946h0.11595v0.80524h-0.11595zm-0.02094-0.24479q0-0.03865 0.02094-0.06281 0.02255-0.02416 0.05798-0.02416t0.05798 0.02416q0.02416 0.02255 0.02416 0.06281 0 0.03865-0.02416 0.0612-0.02255 0.02094-0.05798 0.02094t-0.05798-0.02255q-0.02094-0.02255-0.02094-0.05959z"/>
+				<path d="m-44.247 50.789q0 0.15622-0.06925 0.2303-0.06925 0.07408-0.20131 0.07408-0.08052 0-0.13206-0.0145-0.05153-0.01288-0.08374-0.0306l0.03382-0.09985q0.03221 0.01449 0.07086 0.02738 0.03865 0.01288 0.09502 0.01288 0.09824 0 0.13367-0.05476 0.03704-0.05476 0.03704-0.18359v-0.05959h-0.0048q-0.02577 0.03704-0.06603 0.05798t-0.10307 0.02094q-0.13045 0-0.19165-0.09985-0.0612-0.10146-0.0612-0.31726 0-0.20775 0.07891-0.31404 0.08052-0.10629 0.23674-0.10629 0.07569 0 0.13045 0.01449 0.05476 0.01449 0.09663 0.03382zm-0.11595-0.72632q-0.04831-0.02577-0.12401-0.02577-0.08213 0-0.13206 0.07569-0.04993 0.07408-0.04993 0.23835 0 0.06764 0.0081 0.12562 0.0081 0.05637 0.02738 0.09985 0.01933 0.04187 0.04831 0.06603 0.0306 0.02255 0.07408 0.02255 0.0612 0 0.09663-0.03221t0.05154-0.09663z"/>
+				<path d="m-43.647 50.752v-0.48958q0-0.11273-0.02738-0.17071-0.02577-0.05959-0.10468-0.05959-0.05637 0-0.10307 0.04026-0.04509 0.04026-0.0612 0.10146v0.57816h-0.11595v-1.1273h0.11595v0.39779h0.0048q0.03221-0.04187 0.07891-0.06764 0.04831-0.02738 0.11918-0.02738 0.05315 0 0.0918 0.0145 0.04026 0.01449 0.06603 0.04992t0.03865 0.09502q0.01288 0.05798 0.01288 0.14494v0.52018z"/>
+				<path d="m-43.432 49.946h0.09824v-0.15944l0.11595-0.03704v0.19648h0.17393v0.10468h-0.17393v0.47992q0 0.07086 0.01611 0.10307 0.01771 0.0306 0.05637 0.0306 0.03221 0 0.05476-0.0064 0.02416-0.0081 0.05154-0.01933l0.02255 0.0918q-0.03543 0.01772-0.07891 0.02738-0.04187 0.01127-0.08858 0.01127-0.08052 0-0.11595-0.05154-0.03382-0.05315-0.03382-0.17071v-0.49603h-0.09824z"/>
+				<path d="m-42.945 50.682q0-0.04026 0.02255-0.06442 0.02416-0.02416 0.0612-0.02416 0.04187 0 0.06764 0.03382 0.02738 0.03382 0.02738 0.10629 0 0.05315-0.01449 0.09502-0.01288 0.04348-0.03543 0.07569-0.02094 0.03221-0.0467 0.05315-0.02577 0.02094-0.04993 0.0306l-0.04026-0.05476q0.02094-0.01127 0.03865-0.0306 0.01933-0.01772 0.0306-0.04026 0.01288-0.02255 0.01933-0.04831 0.0064-0.02416 0.0064-0.04831-0.03221 0.0097-0.05959-0.01288-0.02738-0.02255-0.02738-0.07086z"/>
+				<path d="m-42.373 49.946h0.08213l0.01771 0.08697h0.0064q0.05959-0.10629 0.18682-0.10629 0.12723 0 0.19004 0.09502 0.06442 0.09502 0.06442 0.31082 0 0.10146-0.02094 0.18359-0.02094 0.08052-0.05959 0.1385-0.03865 0.05637-0.09502 0.08696-0.05476 0.02899-0.1224 0.02899-0.0467 0-0.07408-0.0064-0.02738-0.0048-0.05959-0.02255v0.33176h-0.11595zm0.11595 0.67801q0.02255 0.01933 0.04992 0.0306 0.02899 0.01127 0.07569 0.01127 0.08535 0 0.13528-0.08697 0.04992-0.08696 0.04992-0.24801 0-0.06764-0.0097-0.1224-0.0081-0.05476-0.02738-0.09341-0.01933-0.04026-0.04992-0.0612-0.02899-0.02255-0.07247-0.02255-0.11756 0-0.15138 0.14333z"/>
+				<path d="m-41.707 50.349q0-0.21742 0.07408-0.31887 0.07569-0.10307 0.21419-0.10307 0.14816 0 0.21741 0.10468 0.07086 0.10468 0.07086 0.31726 0 0.21902-0.07569 0.32048t-0.21258 0.10146q-0.14816 0-0.21902-0.10468-0.06925-0.10468-0.06925-0.31726zm0.12079 0q0 0.07086 0.0081 0.12884 0.0097 0.05798 0.02899 0.09985 0.02094 0.04187 0.05315 0.06603 0.03221 0.02255 0.0773 0.02255 0.08375 0 0.12562-0.07408 0.04187-0.07569 0.04187-0.24318 0-0.06925-0.0097-0.12723-0.0081-0.05959-0.02899-0.10146-0.01933-0.04187-0.05154-0.06442-0.03221-0.02416-0.0773-0.02416-0.08213 0-0.12562 0.07569-0.04187 0.07569-0.04187 0.24157z"/>
+				<path d="m-40.977 49.946h0.08213l0.02094 0.08535h0.0048q0.02255-0.0467 0.05798-0.07247 0.03704-0.02738 0.08858-0.02738 0.03704 0 0.08375 0.01449l-0.02255 0.11756q-0.04187-0.01449-0.07408-0.01449-0.05154 0-0.08374 0.0306-0.03221 0.02899-0.04187 0.07891v0.59265h-0.11595z"/>
+				<path d="m-40.579 49.946h0.09824v-0.15944l0.11595-0.03704v0.19648h0.17393v0.10468h-0.17393v0.47992q0 0.07086 0.01611 0.10307 0.01772 0.0306 0.05637 0.0306 0.03221 0 0.05476-0.0064 0.02416-0.0081 0.05154-0.01933l0.02255 0.0918q-0.03543 0.01772-0.07891 0.02738-0.04187 0.01127-0.08858 0.01127-0.08052 0-0.11595-0.05154-0.03382-0.05315-0.03382-0.17071v-0.49603h-0.09824z"/>
+				<path d="m-40.063 49.995q0.0467-0.02899 0.11273-0.04509 0.06764-0.01611 0.14172-0.01611 0.06764 0 0.1079 0.02094 0.04187 0.01933 0.06442 0.05476 0.02416 0.03382 0.0306 0.07891 0.0081 0.04348 0.0081 0.0918 0 0.09663-0.0048 0.18842-0.0032 0.0918-0.0032 0.17393 0 0.0612 0.0032 0.11434 0.0048 0.05154 0.01611 0.09824h-0.08858l-0.02738-0.09502h-0.0064q-0.02416 0.04187-0.07086 0.07247t-0.12562 0.0306q-0.08697 0-0.14333-0.05959-0.05476-0.0612-0.05476-0.16749 0-0.06925 0.02255-0.11596 0.02416-0.0467 0.06603-0.07569 0.04348-0.02899 0.10146-0.04026 0.05959-0.01288 0.13206-0.01288 0.01611 0 0.03221 0 0.01611 0 0.03382 0.0016 0.0048-0.04993 0.0048-0.08858 0-0.0918-0.02738-0.12884-0.02738-0.03704-0.09985-0.03704-0.04509 0-0.09824 0.01449-0.05315 0.01288-0.08858 0.03382zm0.34947 0.38974q-0.0161-0.0016-0.03221-0.0016-0.01611-0.0016-0.03221-0.0016-0.03865 0-0.07569 0.0064t-0.06603 0.02255q-0.02899 0.0161-0.0467 0.04348-0.01611 0.02738-0.01611 0.06925 0 0.06442 0.0306 0.09985 0.03221 0.03543 0.08213 0.03543 0.06764 0 0.10468-0.03221 0.03704-0.03221 0.05153-0.07086z"/>
+				<path d="m-39.41 49.624h0.11595v0.38329h0.0048q0.06603-0.08052 0.17554-0.08052 0.12401 0 0.1852 0.09824 0.06281 0.09824 0.06281 0.31082 0 0.21741-0.08374 0.3237-0.08214 0.10629-0.23352 0.10629-0.07408 0-0.13528-0.0161-0.0612-0.01772-0.0918-0.04026zm0.11595 1.0098q0.02255 0.01288 0.05476 0.02094 0.03382 0.0064 0.07086 0.0064 0.08375 0 0.13206-0.07891 0.04993-0.08052 0.04993-0.2464 0-0.06925-0.0097-0.12401-0.0081-0.05637-0.02738-0.09663-0.01771-0.04026-0.04831-0.0612-0.02899-0.02255-0.07086-0.02255-0.05798 0-0.09663 0.03543-0.03704 0.03382-0.05476 0.09341z"/>
+				<path d="m-38.588 50.56q0 0.05637 0.01449 0.08052 0.0161 0.02416 0.04348 0.02416 0.03382 0 0.07891-0.01772l0.01127 0.09341q-0.02094 0.01288-0.05959 0.02094-0.03704 0.0081-0.06764 0.0081-0.0612 0-0.09985-0.03704-0.03704-0.03865-0.03704-0.13367v-0.97434h0.11595z"/>
+				<path d="m-37.856 50.697q-0.03865 0.03543-0.09824 0.05476t-0.12562 0.01933q-0.07569 0-0.13206-0.02899-0.05476-0.0306-0.0918-0.08535-0.03543-0.05637-0.05314-0.13367-0.01611-0.0773-0.01611-0.17393 0-0.20614 0.07569-0.31404t0.21419-0.1079q0.04509 0 0.08858 0.01127 0.04509 0.01127 0.08052 0.04509t0.05637 0.09502q0.02255 0.0612 0.02255 0.15944 0 0.02738-0.0032 0.05959-0.0016 0.0306-0.0048 0.06442h-0.40906q0 0.06925 0.01127 0.12562 0.01127 0.05637 0.03543 0.09663 0.02416 0.03865 0.0612 0.0612 0.03865 0.02094 0.09502 0.02094 0.04348 0 0.08536-0.0161 0.04348-0.01611 0.06603-0.03865zm-0.09019-0.43161q0.0032-0.12079-0.03382-0.17715-0.03704-0.05637-0.10146-0.05637-0.07408 0-0.11756 0.05637-0.04348 0.05637-0.05154 0.17715z"/>
+				<path d="m-36.734 50.708q-0.04026 0.03382-0.10146 0.04831t-0.12884 0.01449q-0.08535 0-0.15783-0.03221-0.07247-0.03221-0.12562-0.10146-0.05154-0.07086-0.08052-0.18198-0.02899-0.11112-0.02899-0.26734 0-0.16105 0.03221-0.27217 0.03382-0.11112 0.08858-0.18037t0.12562-0.09985q0.07247-0.0306 0.14816-0.0306 0.0773 0 0.12723 0.01127 0.05154 0.01127 0.08858 0.02738l-0.02899 0.10951q-0.03221-0.01772-0.07569-0.02738-0.04348-0.0097-0.09985-0.0097t-0.10629 0.02577q-0.04993 0.02416-0.08858 0.08052-0.03865 0.05476-0.0612 0.14494-0.02255 0.09019-0.02255 0.22064 0 0.23513 0.08052 0.3543 0.08052 0.11756 0.21419 0.11756 0.05476 0 0.09824-0.01449 0.04348-0.0161 0.07408-0.03704z"/>
+				<path d="m-36.176 50.56q0 0.05637 0.01449 0.08052 0.0161 0.02416 0.04348 0.02416 0.03382 0 0.07891-0.01772l0.01127 0.09341q-0.02094 0.01288-0.05959 0.02094-0.03704 0.0081-0.06764 0.0081-0.0612 0-0.09985-0.03704-0.03704-0.03865-0.03704-0.13367v-0.97434h0.11595z"/>
+				<path d="m-35.906 49.946h0.11595v0.80524h-0.11595zm-0.02094-0.24479q0-0.03865 0.02094-0.06281 0.02255-0.02416 0.05798-0.02416t0.05798 0.02416q0.02416 0.02255 0.02416 0.06281 0 0.03865-0.02416 0.0612-0.02255 0.02094-0.05798 0.02094t-0.05798-0.02255q-0.02094-0.02255-0.02094-0.05959z"/>
+				<path d="m-35.576 49.624h0.11596v0.38329h0.0048q0.06603-0.08052 0.17554-0.08052 0.12401 0 0.1852 0.09824 0.06281 0.09824 0.06281 0.31082 0 0.21741-0.08375 0.3237-0.08213 0.10629-0.23352 0.10629-0.07408 0-0.13528-0.0161-0.0612-0.01772-0.0918-0.04026zm0.11596 1.0098q0.02255 0.01288 0.05476 0.02094 0.03382 0.0064 0.07086 0.0064 0.08374 0 0.13206-0.07891 0.04993-0.08052 0.04993-0.2464 0-0.06925-0.0097-0.12401-0.0081-0.05637-0.02738-0.09663-0.01771-0.04026-0.04831-0.0612-0.02899-0.02255-0.07086-0.02255-0.05798 0-0.09663 0.03543-0.03704 0.03382-0.05476 0.09341z"/>
+				<path d="m-34.878 49.946h0.08213l0.02094 0.08535h0.0048q0.02255-0.0467 0.05798-0.07247 0.03704-0.02738 0.08858-0.02738 0.03704 0 0.08375 0.01449l-0.02255 0.11756q-0.04187-0.01449-0.07408-0.01449-0.05154 0-0.08374 0.0306-0.03221 0.02899-0.04187 0.07891v0.59265h-0.11595z"/>
+				<path d="m-34.446 49.995q0.0467-0.02899 0.11273-0.04509 0.06764-0.01611 0.14172-0.01611 0.06764 0 0.1079 0.02094 0.04187 0.01933 0.06442 0.05476 0.02416 0.03382 0.0306 0.07891 0.0081 0.04348 0.0081 0.0918 0 0.09663-0.0048 0.18842-0.0032 0.0918-0.0032 0.17393 0 0.0612 0.0032 0.11434 0.0048 0.05154 0.01611 0.09824h-0.08858l-0.02738-0.09502h-0.0064q-0.02416 0.04187-0.07086 0.07247t-0.12562 0.0306q-0.08696 0-0.14333-0.05959-0.05476-0.0612-0.05476-0.16749 0-0.06925 0.02255-0.11596 0.02416-0.0467 0.06603-0.07569 0.04348-0.02899 0.10146-0.04026 0.05959-0.01288 0.13206-0.01288 0.0161 0 0.03221 0t0.03382 0.0016q0.0048-0.04993 0.0048-0.08858 0-0.0918-0.02738-0.12884-0.02738-0.03704-0.09985-0.03704-0.04509 0-0.09824 0.01449-0.05315 0.01288-0.08858 0.03382zm0.34947 0.38974q-0.01611-0.0016-0.03221-0.0016-0.01611-0.0016-0.03221-0.0016-0.03865 0-0.07569 0.0064t-0.06603 0.02255q-0.02899 0.0161-0.0467 0.04348-0.01611 0.02738-0.01611 0.06925 0 0.06442 0.0306 0.09985 0.03221 0.03543 0.08214 0.03543 0.06764 0 0.10468-0.03221t0.05154-0.07086z"/>
+				<path d="m-33.793 49.946h0.08214l0.02094 0.08535h0.0048q0.02255-0.0467 0.05798-0.07247 0.03704-0.02738 0.08858-0.02738 0.03704 0 0.08375 0.01449l-0.02255 0.11756q-0.04187-0.01449-0.07408-0.01449-0.05154 0-0.08374 0.0306-0.03221 0.02899-0.04187 0.07891v0.59265h-0.11595z"/>
+				<path d="m-33.153 50.467 0.03382 0.15622h0.0081l0.02416-0.15622 0.1224-0.52018h0.11756l-0.19165 0.7231q-0.02255 0.08696-0.04509 0.16266-0.02255 0.07569-0.04992 0.13045-0.02577 0.05637-0.05959 0.08697-0.03221 0.03221-0.0773 0.03221t-0.07891-0.01449l0.01933-0.10951q0.02255 0.0081 0.04509 0.0032 0.02255-0.0048 0.04187-0.02738 0.02094-0.02255 0.03704-0.06764 0.01772-0.04348 0.0306-0.11434l-0.2609-0.80524h0.13206z"/>
+			</g>
+			<path d="m-435.92-23.597c0.28617-0.34918 0.57227-0.69834 0.85837-1.0475 0.42677 0.47526 0.85355 0.95052 1.2803 1.4258 0.76622 0.0048 1.5325 0.01002 2.2987 0.01443-0.82927-0.91657-1.6586-1.8331-2.4878-2.7497 0.40254-0.45586 0.80503-0.91173 1.2076-1.3676 0.78562 0.91658 1.5713 1.8332 2.3569 2.7497-4e-3 -0.87778-8e-3 -1.7556-0.0161-2.6333-0.40253-0.45101-0.80501-0.90202-1.2075-1.353 0.28858-0.42545 0.99829-0.86377 0.3475-1.2606-1.4591-1.6118-2.9183-3.2236-4.3774-4.8354-3.0679-0.01042-6.1393 0.04092-9.205-0.0084-0.72986-0.06429-1.6392-0.29547-1.8065-1.1337-0.35271-1.09 0.84574-2.3762 1.9465-1.8649 0.76081 0.14726 0.44105 1.6835-0.23166 1.1743 0.69856-1.0262-1.2808-0.90972-0.72049 0.09824 0.38397 0.88195 1.783 1.0275 2.3349 0.22513 0.57404-0.92504-0.20641-1.9788-1.0842-2.3446-0.87836-0.41949-1.9686-0.31147-2.7028 0.34337-1.0973 0.83626-1.6281 2.4707-0.91191 3.7193 0.4168 0.93386 1.3405 1.5318 2.3429 1.6481 1.343 0.16782 2.7026 0.06445 4.0539 0.09323h5.3734c1.0184 1.13 2.0368 2.2599 3.0553 3.3899-0.91656 1.0136-1.8331 2.0271-2.7497 3.0407-0.66422-0.85695-1.6664-1.5082-2.0708-2.5299-0.32706-1.1972 1.4194-2.1305 2.2518-1.2247 0.79933 0.44227-0.0473 1.8554-0.62433 1.0813 0.46733-0.15836 0.67752-0.90508-0.0577-0.86727-0.86169 0.32798-0.49311 1.6295 0.25772 1.8808 0.71628 0.34674 1.6137-0.30285 1.5227-1.0869 0.0733-1.1334-0.75524-2.3676-1.9525-2.4204-1.2813-0.24958-2.727 0.4999-3.0402 1.8142-0.43151 1.1314 0.27896 2.2662 1.0551 3.0447 0.91076 0.98537 1.8001 1.9916 2.7018 2.985z" fill="#f00"/>
+			<path d="m-428.86-22.458c8e-3 -2.1947 0.012-4.3894 0.0201-6.5841-1.356-1.553-2.7839-3.046-4.0921-4.6391-0.4374-0.54095-0.77164-1.181-0.74606-1.8954-0.036-1.3281 0.79082-2.6298 2.0264-3.1348 0.95151-0.42136 2.0903-0.46194 3.022 0.03768 1.2998 0.66198 1.9155 2.4493 1.2087 3.7417-0.54185 0.79964-1.9325 0.78325-2.3809-0.10621-0.43247-0.56653-0.40691-1.7268 0.41575-1.8879 0.66914-0.01363 0.83223 0.96617 0.0962 1.0053-0.16353 0.63656 1.1345 0.49025 1.0924-0.18221 0.16593-0.92802-0.8623-1.6839-1.7291-1.5091-0.97624 0.09675-1.834 1.1261-1.4963 2.1064 0.35552 0.96342 1.2138 1.6073 1.8524 2.3761 1.0266 1.1181 2.05 2.2391 3.0765 3.3574-8e-3 2.445-0.012 4.89-0.0201 7.335-0.78189-0.0068-1.5639-0.01403-2.3458-0.02044z"/>
+			<path d="m-429.09-21.883-6.584 0.02044c-1.5531-1.356-3.0461-2.7839-4.6392-4.092-0.54093-0.43739-1.181-0.77164-1.8954-0.74605-1.3281-0.03447-2.6298 0.79084-3.1348 2.0263-0.42133 0.95153-0.46193 2.0903 0.036 3.0221 0.66201 1.2998 2.4493 1.9155 3.7417 1.2087 0.79964-0.54184 0.78325-1.9325-0.10621-2.381-0.56654-0.43248-1.7268-0.40688-1.8879 0.41576-0.012 0.66918 0.96618 0.83223 1.0053 0.09607 0.63656-0.16373 0.49027 1.1345-0.18236 1.0924-0.92803 0.16585-1.6839-0.86229-1.5092-1.7291 0.0966-0.97624 1.1261-1.834 2.1064-1.4963 0.96341 0.35556 1.6073 1.2139 2.376 1.8524 1.1181 1.0266 2.2391 2.05 3.3574 3.0765l9.8442-0.02044c-1.143-0.9713-1.4343-1.4219-2.5296-2.3458z"/>
+		</g>
+	</g>
+</svg>
diff --git a/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/strict-csp.svg b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/strict-csp.svg
new file mode 100644
index 00000000..cd128f1d
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy-fallback/mount-origin/strict-csp.svg
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="24.78mm" height="24.78mm" version="1.1" viewBox="0 0 24.780247 24.780247" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <defs>
+  <linearGradient id="linearGradient955" x1="66.618" x2="82.588" y1="81.176" y2="64.828" gradientTransform="matrix(.82538 0 0 .82538 -392 -92.399)" gradientUnits="userSpaceOnUse">
+   <stop stop-color="#0aa70b" offset="0"/>
+   <stop stop-color="#3bff39" offset="1"/>
+  </linearGradient>
+  <filter id="filter945" x="-.0516" y="-.0516" width="1.1032" height="1.1032" color-interpolation-filters="sRGB">
+   <feGaussianBlur stdDeviation="0.58510713"/>
+  </filter>
+ </defs>
+ <g transform="translate(342.15 43.638)">
+  <circle transform="matrix(.82538 0 0 .82538 -392 -92.399)" cx="75.406" cy="74.089" r="13.607" filter="url(#filter945)" stroke="#000" stroke-linecap="round" stroke-width="1.565"/>
+  <circle cx="-330.23" cy="-31.716" r="11.231" fill="url(#linearGradient955)" stroke="#000" stroke-linecap="round" stroke-width="1.2917"/>
+  <g transform="matrix(.70929 0 0 .70929 -99.465 -12.686)" stroke-width=".51676px" style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="Strict">
+   <path d="m-330.78-33.775q0 0.73996-0.53676 1.154-0.53676 0.41407-1.4569 0.41407-0.99684 0-1.5336-0.25688v-0.62878q0.34506 0.14569 0.75147 0.23004 0.4064 0.08435 0.80514 0.08435 0.65177 0 0.9815-0.24538 0.32972-0.24921 0.32972-0.69012 0-0.29138-0.11885-0.47542-0.11502-0.18787-0.39107-0.34506-0.27221-0.15719-0.83198-0.35656-0.78213-0.27988-1.1195-0.66328-0.33356-0.3834-0.33356-1.0007 0-0.64794 0.48692-1.0313 0.48691-0.3834 1.2882-0.3834 0.83581 0 1.5374 0.30672l-0.2032 0.56743q-0.69395-0.29138-1.3496-0.29138-0.51759 0-0.80897 0.22237t-0.29138 0.61727q0 0.29138 0.10735 0.47925 0.10735 0.18403 0.36039 0.34123 0.25688 0.15336 0.78214 0.34122 0.88182 0.31439 1.2115 0.67478 0.33356 0.3604 0.33356 0.93549z"/>
+   <path d="m-328.37-32.732q0.16869 0 0.32589-0.023 0.15719-0.02684 0.24921-0.05368v0.48692q-0.10352 0.04984-0.30672 0.08051-0.19937 0.03451-0.3604 0.03451-1.2192 0-1.2192-1.2844v-2.4998h-0.60194v-0.30672l0.60194-0.26455 0.26838-0.89716h0.36807v0.97384h1.2192v0.49458h-1.2192v2.4729q0 0.37957 0.18019 0.58277 0.1802 0.2032 0.49459 0.2032z"/>
+   <path d="m-325.04-36.562q0.27989 0 0.50226 0.04601l-0.0882 0.59044q-0.26072-0.05751-0.46008-0.05751-0.50993 0-0.87415 0.41407-0.3604 0.41407-0.3604 1.0313v2.2544h-0.63644v-4.2021h0.52525l0.0729 0.7783h0.0307q0.23388-0.41024 0.5636-0.63261 0.32972-0.22237 0.72462-0.22237z"/>
+   <path d="m-323.11-32.284h-0.63644v-4.2021h0.63644zm-0.69012-5.3408q0-0.21854 0.10735-0.31822 0.10735-0.10352 0.26838-0.10352 0.15336 0 0.26455 0.10352 0.11118 0.10352 0.11118 0.31822 0 0.2147-0.11118 0.32206-0.11119 0.10352-0.26455 0.10352-0.16103 0-0.26838-0.10352-0.10735-0.10735-0.10735-0.32206z"/>
+   <path d="m-320.07-32.207q-0.91249 0-1.4147-0.55976-0.49842-0.5636-0.49842-1.5911 0-1.0543 0.50609-1.6294 0.50992-0.5751 1.4492-0.5751 0.30288 0 0.60577 0.06518 0.30288 0.06518 0.47541 0.15336l-0.19553 0.54059q-0.21087-0.08435-0.46008-0.13802-0.24921-0.05751-0.44091-0.05751-1.2806 0-1.2806 1.6333 0 0.77447 0.31055 1.1885 0.31439 0.41407 0.92783 0.41407 0.52526 0 1.0774-0.22621v0.5636q-0.42174 0.21854-1.062 0.21854z"/>
+   <path d="m-316.65-32.732q0.16869 0 0.32589-0.023 0.15719-0.02684 0.24921-0.05368v0.48692q-0.10352 0.04984-0.30672 0.08051-0.19937 0.03451-0.3604 0.03451-1.2192 0-1.2192-1.2844v-2.4998h-0.60194v-0.30672l0.60194-0.26455 0.26838-0.89716h0.36806v0.97384h1.2192v0.49458h-1.2192v2.4729q0 0.37957 0.1802 0.58277 0.1802 0.2032 0.49459 0.2032z"/>
+  </g>
+  <g fill="#fff">
+   <g transform="matrix(.70929 0 0 .70929 -99.465 -12.686)" stroke-width=".3317px" style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="Content">
+    <path d="m-332.67-30.173q-0.5931 0-0.93764 0.39622-0.34208 0.39376-0.34208 1.0804 0 0.70631 0.32977 1.0927 0.33224 0.38392 0.94503 0.38392 0.37653 0 0.85889-0.13536v0.36669q-0.37407 0.14028-0.92288 0.14028-0.7949 0-1.228-0.48236-0.43067-0.48236-0.43067-1.3708 0-0.55619 0.20672-0.97456 0.20919-0.41837 0.60049-0.64478 0.39376-0.22641 0.92533-0.22641 0.56603 0 0.98933 0.20672l-0.1772 0.35931q-0.40852-0.19196-0.81705-0.19196z"/>
+    <path d="m-328.77-28.248q0 0.65955-0.33224 1.0312-0.33223 0.36915-0.91795 0.36915-0.36177 0-0.64233-0.16981-0.28055-0.16981-0.43313-0.48728-0.15259-0.31747-0.15259-0.74322 0-0.65955 0.32978-1.0262 0.32977-0.36915 0.91549-0.36915 0.56603 0 0.89827 0.37653 0.3347 0.37653 0.3347 1.0189zm-2.0549 0q0 0.51681 0.20672 0.78752 0.20673 0.27071 0.60787 0.27071t0.60787-0.26825q0.20918-0.27071 0.20918-0.78998 0-0.51435-0.20918-0.78014-0.20673-0.26825-0.61279-0.26825-0.40115 0-0.60541 0.26333-0.20426 0.26333-0.20426 0.78506z"/>
+    <path d="m-326.21-26.897v-1.7449q0-0.32978-0.15012-0.4922-0.15012-0.16243-0.47005-0.16243-0.42329 0-0.62017 0.22887-0.19688 0.22887-0.19688 0.75553v1.4151h-0.40853v-2.6973h0.33223l0.0664 0.36915h0.0197q0.12551-0.19934 0.35192-0.30762 0.22642-0.11075 0.50451-0.11075 0.48728 0 0.73338 0.23626 0.2461 0.2338 0.2461 0.75061v1.7596z"/>
+    <path d="m-324.09-27.185q0.10828 0 0.20918-0.01477 0.1009-0.01723 0.15997-0.03445v0.31255q-0.0665 0.03199-0.19688 0.05168-0.12797 0.02215-0.23134 0.02215-0.7826 0-0.7826-0.82444v-1.6046h-0.38637v-0.19688l0.38637-0.16981 0.17227-0.57588h0.23626v0.6251h0.7826v0.31747h-0.7826v1.5873q0 0.24364 0.11567 0.37407 0.11566 0.13043 0.31747 0.13043z"/>
+    <path d="m-322.04-26.848q-0.59802 0-0.94502-0.36423-0.34454-0.36423-0.34454-1.0115 0-0.65217 0.31993-1.0361 0.32239-0.38392 0.86381-0.38392 0.50697 0 0.80229 0.3347 0.29532 0.33224 0.29532 0.87858v0.25841h-1.8581q0.0123 0.47497 0.23872 0.72107 0.22887 0.2461 0.64232 0.2461 0.4356 0 0.86135-0.18212v0.36423q-0.21657 0.09352-0.41099 0.13289-0.19195 0.04184-0.46513 0.04184zm-0.11074-2.4536q-0.32485 0-0.51927 0.21165-0.19196 0.21165-0.22642 0.58572h1.4102q0-0.38638-0.17227-0.59064-0.17227-0.20672-0.4922-0.20672z"/>
+    <path d="m-318.51-26.897v-1.7449q0-0.32978-0.15012-0.4922-0.15013-0.16243-0.47006-0.16243-0.42329 0-0.62017 0.22887-0.19688 0.22887-0.19688 0.75553v1.4151h-0.40853v-2.6973h0.33224l0.0664 0.36915h0.0197q0.12552-0.19934 0.35193-0.30762 0.22641-0.11075 0.5045-0.11075 0.48728 0 0.73338 0.23626 0.2461 0.2338 0.2461 0.75061v1.7596z"/>
+    <path d="m-316.4-27.185q0.10829 0 0.20919-0.01477 0.1009-0.01723 0.15996-0.03445v0.31255q-0.0664 0.03199-0.19688 0.05168-0.12797 0.02215-0.23133 0.02215-0.7826 0-0.7826-0.82444v-1.6046h-0.38638v-0.19688l0.38638-0.16981 0.17227-0.57588h0.23625v0.6251h0.7826v0.31747h-0.7826v1.5873q0 0.24364 0.11567 0.37407 0.11567 0.13043 0.31747 0.13043z"/>
+   </g>
+   <g transform="matrix(.70929 0 0 .70929 -99.465 -12.686)" stroke-width=".32428px" style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="Security">
+    <path d="m-332.03-22.859q0 0.46434-0.33683 0.72417-0.33682 0.25984-0.91423 0.25984-0.62553 0-0.96236-0.1612v-0.39456q0.21653 0.09142 0.47155 0.14435 0.25503 0.05293 0.50524 0.05293 0.409 0 0.61591-0.15398 0.20691-0.15638 0.20691-0.43306 0-0.18285-0.0746-0.29833-0.0722-0.11789-0.2454-0.21653-0.17082-0.09864-0.52208-0.22375-0.4908-0.17563-0.70252-0.41622-0.20931-0.24059-0.20931-0.62794 0-0.4066 0.30555-0.64718t0.80838-0.24059q0.52448 0 0.96476 0.19247l-0.12751 0.35607q-0.43547-0.18285-0.84687-0.18285-0.3248 0-0.50765 0.13954-0.18284 0.13954-0.18284 0.38735 0 0.18285 0.0674 0.30074 0.0674 0.11548 0.22615 0.21412 0.1612 0.09624 0.4908 0.21412 0.55336 0.19728 0.76027 0.42344 0.20931 0.22615 0.20931 0.58704z"/>
+    <path d="m-330.26-21.875q-0.58463 0-0.92386-0.35607-0.33683-0.35607-0.33683-0.98882 0-0.63756 0.31277-1.0129 0.31517-0.37532 0.84446-0.37532 0.49562 0 0.78432 0.3272 0.28871 0.3248 0.28871 0.8589v0.25262h-1.8164q0.012 0.46434 0.23338 0.70492 0.22374 0.24059 0.62793 0.24059 0.42584 0 0.84206-0.17804v0.35607q-0.21171 0.09142-0.40178 0.12992-0.18766 0.0409-0.45471 0.0409zm-0.10827-2.3987q-0.31757 0-0.50764 0.20691-0.18766 0.20691-0.22134 0.5726h1.3786q0-0.37772-0.16841-0.57741-0.16841-0.2021-0.48118-0.2021z"/>
+    <path d="m-327.56-21.875q-0.5726 0-0.88777-0.35126-0.31277-0.35366-0.31277-0.99844 0-0.66162 0.31758-1.0225 0.31998-0.36088 0.90942-0.36088 0.19007 0 0.38013 0.0409 0.19007 0.0409 0.29833 0.09624l-0.1227 0.33923q-0.13232-0.05293-0.2887-0.08661-0.15639-0.03609-0.27668-0.03609-0.80357 0-0.80357 1.0249 0 0.48599 0.19488 0.74582 0.19728 0.25984 0.58223 0.25984 0.3296 0 0.67605-0.14195v0.35366q-0.26465 0.13714-0.66643 0.13714z"/>
+    <path d="m-325.89-24.56v1.7106q0 0.32239 0.14676 0.48118 0.14675 0.15879 0.45952 0.15879 0.41381 0 0.60388-0.22615 0.19247-0.22615 0.19247-0.73861v-1.3858h0.39938v2.6369h-0.32961l-0.0577-0.35367h-0.0217q-0.1227 0.19488-0.34163 0.29833-0.21653 0.10345-0.49561 0.10345-0.48118 0-0.72177-0.22856-0.23818-0.22856-0.23818-0.73139v-1.725z"/>
+    <path d="m-322.04-24.608q0.17563 0 0.31517 0.02887l-0.0553 0.37051q-0.1636-0.03609-0.2887-0.03609-0.31999 0-0.54855 0.25984-0.22615 0.25984-0.22615 0.64718v1.4147h-0.39938v-2.6369h0.32961l0.0457 0.4884h0.0192q0.14676-0.25743 0.35366-0.39697 0.20691-0.13954 0.45472-0.13954z"/>
+    <path d="m-320.83-21.923h-0.39938v-2.6369h0.39938zm-0.43306-3.3514q0-0.13714 0.0674-0.19969 0.0674-0.06496 0.16841-0.06496 0.0962 0 0.16601 0.06496 0.0698 0.06496 0.0698 0.19969 0 0.13473-0.0698 0.2021-0.0698 0.06496-0.16601 0.06496-0.10105 0-0.16841-0.06496-0.0674-0.06736-0.0674-0.2021z"/>
+    <path d="m-319.13-22.205q0.10586 0 0.2045-0.01443 0.0986-0.01684 0.15638-0.03368v0.30555q-0.065 0.03128-0.19247 0.05052-0.1251 0.02165-0.22615 0.02165-0.76507 0-0.76507-0.80597v-1.5686h-0.37773v-0.19247l0.37773-0.16601 0.16841-0.56298h0.23096v0.6111h0.76508v0.31036h-0.76508v1.5518q0 0.23818 0.11308 0.3657t0.31036 0.12751z"/>
+    <path d="m-318.66-24.56h0.42825l0.57742 1.5037q0.19006 0.51486 0.23577 0.74342h0.0192q0.0313-0.1227 0.12992-0.41862 0.10105-0.29833 0.6544-1.8285h0.42825l-1.1332 3.0025q-0.16841 0.44509-0.39456 0.63034-0.22375 0.18766-0.55095 0.18766-0.18285 0-0.36088-0.0409v-0.31998q0.13232 0.02887 0.29592 0.02887 0.41141 0 0.58704-0.46193l0.14676-0.37532z"/>
+   </g>
+   <g transform="matrix(.70929 0 0 .70929 -99.465 -12.686)" stroke-width=".32334px" style="font-feature-settings:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-variant-numeric:normal" aria-label="Policy">
+    <path d="m-329.37-19.254q0 0.53256-0.36464 0.82043-0.36224 0.28547-1.0387 0.28547h-0.41261v1.3794h-0.40782v-3.5072h0.90919q1.3146 0 1.3146 1.0219zm-1.816 0.75566h0.36703q0.54215 0 0.78445-0.17512 0.24229-0.17512 0.24229-0.56135 0-0.34784-0.2279-0.51817t-0.71008-0.17032h-0.45579z"/>
+    <path d="m-326.43-18.086q0 0.64291-0.32386 1.0051-0.32385 0.35984-0.89479 0.35984-0.35264 0-0.62612-0.16552t-0.42221-0.47498q-0.14873-0.30946-0.14873-0.72447 0-0.64291 0.32145-1.0003 0.32146-0.35984 0.8924-0.35984 0.55175 0 0.8756 0.36703 0.32626 0.36704 0.32626 0.99315zm-2.0031 0q0 0.50377 0.20151 0.76765t0.59253 0.26388q0.39103 0 0.59254-0.26148 0.2039-0.26388 0.2039-0.77005 0-0.50137-0.2039-0.76046-0.20151-0.26148-0.59733-0.26148-0.39103 0-0.59014 0.25668-0.19911 0.25668-0.19911 0.76525z"/>
+    <path d="m-325.33-16.769h-0.39822v-3.7327h0.39822z"/>
+    <path d="m-324.09-16.769h-0.39822v-2.6292h0.39822zm-0.43181-3.3417q0-0.13674 0.0672-0.19911 0.0672-0.06477 0.16793-0.06477 0.0959 0 0.16552 0.06477 0.0696 0.06477 0.0696 0.19911t-0.0696 0.20151q-0.0696 0.06477-0.16552 0.06477-0.10076 0-0.16793-0.06477-0.0672-0.06717-0.0672-0.20151z"/>
+    <path d="m-322.19-16.721q-0.57094 0-0.8852-0.35024-0.31186-0.35264-0.31186-0.99555 0-0.6597 0.31666-1.0195 0.31906-0.35984 0.90679-0.35984 0.18951 0 0.37903 0.04078 0.18951 0.04078 0.29746 0.09596l-0.12234 0.33825q-0.13194-0.05278-0.28787-0.08636-0.15593-0.03598-0.27588-0.03598-0.80123 0-0.80123 1.0219 0 0.48458 0.19431 0.74366 0.19671 0.25908 0.58054 0.25908 0.32865 0 0.67409-0.14154v0.35264q-0.26388 0.13674-0.6645 0.13674z"/>
+    <path d="m-321.31-19.398h0.427l0.57574 1.4993q0.18952 0.51337 0.2351 0.74127h0.0192q0.0312-0.12234 0.12954-0.41741 0.10076-0.29747 0.65251-1.8232h0.427l-1.1299 2.9938q-0.16792 0.4438-0.39342 0.62852-0.2231 0.18712-0.54935 0.18712-0.18232 0-0.35984-0.04078v-0.31906q0.13194 0.02879 0.29507 0.02879 0.41021 0 0.58533-0.46059l0.14634-0.37423z"/>
+   </g>
+  </g>
+ </g>
+</svg>
diff --git a/minimal-examples/raw/minimal-raw-proxy/CMakeLists.txt b/minimal-examples/raw/minimal-raw-proxy/CMakeLists.txt
new file mode 100644
index 00000000..da033dde
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy/CMakeLists.txt
@@ -0,0 +1,84 @@
+cmake_minimum_required(VERSION 2.8)
+include(CheckCSourceCompiles)
+
+set(SAMP lws-minimal-raw-proxy)
+set(SRCS minimal-raw-proxy.c)
+
+# NOTE... if you are building this standalone, you must point LWS_PLUGINS_DIR
+# to the lws plugins dir so it can pick up the plugin source.  Eg,
+# cmake . -DLWS_PLUGINS_DIR=~/libwebsockets/plugins
+
+# If we are being built as part of lws, confirm current build config supports
+# reqconfig, else skip building ourselves.
+#
+# If we are being built externally, confirm installed lws was configured to
+# support reqconfig, else error out with a helpful message about the problem.
+#
+MACRO(require_lws_config reqconfig _val result)
+
+	if (DEFINED ${reqconfig})
+	if (${reqconfig})
+		set (rq 1)
+	else()
+		set (rq 0)
+	endif()
+	else()
+		set(rq 0)
+	endif()
+
+	if (${_val} EQUAL ${rq})
+		set(SAME 1)
+	else()
+		set(SAME 0)
+	endif()
+
+	if (LWS_WITH_MINIMAL_EXAMPLES AND NOT ${SAME})
+		if (${_val})
+			message("${SAMP}: skipping as lws being built without ${reqconfig}")
+		else()
+			message("${SAMP}: skipping as lws built with ${reqconfig}")
+		endif()
+		set(${result} 0)
+	else()
+		if (LWS_WITH_MINIMAL_EXAMPLES)
+			set(MET ${SAME})
+		else()
+			CHECK_C_SOURCE_COMPILES("#include <libwebsockets.h>\nint main(void) {\n#if defined(${reqconfig})\n return 0;\n#else\n fail;\n#endif\n return 0;\n}\n" HAS_${reqconfig})
+			if (NOT DEFINED HAS_${reqconfig} OR NOT HAS_${reqconfig})
+				set(HAS_${reqconfig} 0)
+			else()
+				set(HAS_${reqconfig} 1)
+			endif()
+			if ((HAS_${reqconfig} AND ${_val}) OR (NOT HAS_${reqconfig} AND NOT ${_val}))
+				set(MET 1)
+			else()
+				set(MET 0)
+			endif()
+		endif()
+		if (NOT MET)
+			if (${_val})
+				message(FATAL_ERROR "This project requires lws must have been configured with ${reqconfig}")
+			else()
+				message(FATAL_ERROR "Lws configuration of ${reqconfig} is incompatible with this project")
+			endif()
+		endif()	
+	endif()
+ENDMACRO()
+
+set(requirements 1)
+require_lws_config(LWS_ROLE_RAW_PROXY 1 requirements)
+
+if (requirements)
+	add_executable(${SAMP} ${SRCS})
+	
+	if (LWS_PLUGINS_DIR)
+		include_directories(${LWS_PLUGINS_DIR})
+	endif()
+
+	if (websockets_shared)
+		target_link_libraries(${SAMP} websockets_shared)
+		add_dependencies(${SAMP} websockets_shared)
+	else()
+		target_link_libraries(${SAMP} websockets)
+	endif()
+endif()
diff --git a/minimal-examples/raw/minimal-raw-proxy/README.md b/minimal-examples/raw/minimal-raw-proxy/README.md
new file mode 100644
index 00000000..53793a8b
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy/README.md
@@ -0,0 +1,41 @@
+# lws minimal ws server raw proxy
+
+This demonstrates how a vhost can be bound to a specific role and protocol,
+with the example using a lws plugin that performs raw packet proxying.
+
+By default the example will proxy 127.0.0.1:22, usually your ssh server
+listen port, on 127.0.0.1:7681.  You should be able to ssh into port 7681
+the same as you can port 22.  But your ssh server is only listening on port 22...
+
+## build
+
+To build this standalone, you must tell cmake where the lws source tree
+./plugins directory can be found, since it relies on including the source
+of the raw-proxy plugin.
+
+```
+ $ cmake . -DLWS_PLUGINS_DIR=~/libwebsockets/plugins && make
+```
+
+## usage
+
+Commandline option|Meaning
+---|---
+-d <loglevel>|Debug verbosity in decimal, eg, -d15
+-r ipv4:address:port|Configure the remote IP and port that will be proxied, by default ipv4:127.0.0.1:22
+
+```
+ $ ./lws-minimal-raw-proxy
+[2018/11/30 19:22:35:7290] USER: LWS minimal raw proxy | nc localhost 7681
+[2018/11/30 19:22:35:7291] NOTICE: Creating Vhost 'default' port 7681, 1 protocols, IPv6 off
+[2018/11/30 19:22:35:7336] NOTICE: callback_raw_proxy: onward ipv4 127.0.0.1:22
+...
+```
+
+```
+ $ ssh -p7681 me@127.0.0.1
+Last login: Fri Nov 30 19:29:23 2018 from 127.0.0.1
+[me@learn ~]$
+```
+
+
diff --git a/minimal-examples/raw/minimal-raw-proxy/minimal-raw-proxy.c b/minimal-examples/raw/minimal-raw-proxy/minimal-raw-proxy.c
new file mode 100644
index 00000000..aa952e2c
--- /dev/null
+++ b/minimal-examples/raw/minimal-raw-proxy/minimal-raw-proxy.c
@@ -0,0 +1,91 @@
+/*
+ * lws-minimal-raw-proxy
+ *
+ * Copyright (C) 2018 Andy Green <andy@warmcat.com>
+ *
+ * This file is made available under the Creative Commons CC0 1.0
+ * Universal Public Domain Dedication.
+ *
+ * This demonstrates a vhost that acts as a raw tcp proxy.  Incoming connections
+ * cause an outgoing connection to be initiated, and if successfully established
+ * then traffic coming in one side is placed on a ringbuffer and sent out the
+ * opposite side as soon as possible.
+ */
+
+#include <libwebsockets.h>
+#include <string.h>
+#include <signal.h>
+#include <sys/types.h>
+
+#define LWS_PLUGIN_STATIC
+#include "../plugins/raw-proxy/protocol_lws_raw_proxy.c"
+
+static struct lws_protocols protocols[] = {
+	LWS_PLUGIN_PROTOCOL_RAW_PROXY,
+	{ NULL, NULL, 0, 0 } /* terminator */
+};
+
+static int interrupted;
+
+void sigint_handler(int sig)
+{
+	interrupted = 1;
+}
+
+static struct lws_protocol_vhost_options pvo1 = {
+        NULL,
+        NULL,
+        "onward",          /* pvo name */
+        "ipv4:127.0.0.1:22"    /* pvo value */
+};
+
+static const struct lws_protocol_vhost_options pvo = {
+        NULL,           /* "next" pvo linked-list */
+        &pvo1,       /* "child" pvo linked-list */
+        "raw-proxy",      /* protocol name we belong to on this vhost */
+        ""              /* ignored */
+};
+
+
+int main(int argc, const char **argv)
+{
+	int n = 0, logs = LLL_USER | LLL_ERR | LLL_WARN | LLL_NOTICE;
+	struct lws_context_creation_info info;
+	struct lws_context *context;
+	char outward[256];
+	const char *p;
+
+	signal(SIGINT, sigint_handler);
+
+	if ((p = lws_cmdline_option(argc, argv, "-d")))
+		logs = atoi(p);
+
+	lws_set_log_level(logs, NULL);
+	lwsl_user("LWS minimal raw proxy\n");
+
+	if ((p = lws_cmdline_option(argc, argv, "-r"))) {
+		lws_strncpy(outward, p, sizeof(outward));
+		pvo1.value = outward;
+	}
+
+	memset(&info, 0, sizeof info); /* otherwise uninitialized garbage */
+	info.port = 7681;
+	info.protocols = protocols;
+	info.pvo = &pvo;
+	info.options = LWS_SERVER_OPTION_ADOPT_APPLY_LISTEN_ACCEPT_CONFIG;
+	info.listen_accept_role = "raw-proxy";
+	info.listen_accept_protocol = "raw-proxy";
+
+	context = lws_create_context(&info);
+	if (!context) {
+		lwsl_err("lws init failed\n");
+		return 1;
+	}
+
+	while (n >= 0 && !interrupted)
+		n = lws_service(context, 1000);
+
+	lws_context_destroy(context);
+
+	return 0;
+}
diff --git a/minimal-examples/raw/minimal-raw-vhost/minimal-raw-vhost.c b/minimal-examples/raw/minimal-raw-vhost/minimal-raw-vhost.c
index 05043d08..77839c3f 100644
--- a/minimal-examples/raw/minimal-raw-vhost/minimal-raw-vhost.c
+++ b/minimal-examples/raw/minimal-raw-vhost/minimal-raw-vhost.c
@@ -95,7 +95,7 @@ callback_raw_test(struct lws *wsi, enum lws_callback_reasons reason,
 		break;
 	}
 
-	return 0;
+	return lws_callback_http_dummy(wsi, reason, user, in, len);
 }
 
 static struct lws_protocols protocols[] = {
diff --git a/plugins/raw-proxy/README.md b/plugins/raw-proxy/README.md
new file mode 100644
index 00000000..bc5987c2
--- /dev/null
+++ b/plugins/raw-proxy/README.md
@@ -0,0 +1,66 @@
+# raw-proxy plugin
+
+## Enabling for build
+
+```
+$ cmake .. -DLWS_ROLE_RAW_PROXY=1
+```
+
+## configuration pvo
+
+|pvo|value meaning|
+|---|---|
+|onward|The onward proxy destination, in the form `ipv4:addr[:port]`|
+
+## Note for vhost selection
+
+Notice that since it proxies the packets "raw", there's no SNI or Host:
+header to resolve amongst multiple vhosts on the same listen port.  So the
+vhost you associate with this protocol must be alone on its own port.
+
+It's also possible to apply this or other role + protocols as a fallback after
+http[s] processing rejected the first packet from an incoming connection.
+See `./READMEs/README-http-fallback.md`
+
+## Note for packet size
+
+For throughput, since often one side is localhost that can handle larger
+packets easily, you should create the context used with this plugin with
+
+```
+	info.pt_serv_buf_size = 8192;
+```
+
+lwsws already does this.
+
+## Using with C
+
+See the minimal example `./minimal-example/raw/minimal-raw-proxy` for
+a working example of a vhost that accepts connections and then
+proxies them using this plugin.  The example is almost all boilerplate
+for setting up the context and the pvo.
+
+## Using with lwsws
+
+For a usage where the plugin "owns" the whole vhost, you should enable the
+plugin protocol on the vhost as usual, and specify the "onward" pvo with:
+
+```
+                "ws-protocols": [{
+                        "raw-proxy": {
+                         "status": "ok",
+                         "onward": "ipv4:remote.address.com:port"
+                        }
+                 }],
+```
+
+and then define the vhost with:
+
+```
+    "apply-listen-accept": "1",
+    "listen-accept-role": "raw-proxy",
+    "listen-accept-protocol": "raw-proxy"
+```
+
+which tells it to apply the role and protocol as soon as a connection is
+accepted on the vhost.
diff --git a/plugins/raw-proxy/protocol_lws_raw_proxy.c b/plugins/raw-proxy/protocol_lws_raw_proxy.c
new file mode 100644
index 00000000..8f52e661
--- /dev/null
+++ b/plugins/raw-proxy/protocol_lws_raw_proxy.c
@@ -0,0 +1,574 @@
+/*
+ * libwebsockets - plugin for raw proxying
+ *
+ * Copyright (C) 2010-2018 Andy Green <andy@warmcat.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation:
+ *  version 2.1 of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ *  MA  02110-1301  USA
+ */
+
+#if !defined (LWS_PLUGIN_STATIC)
+#define LWS_DLL
+#define LWS_INTERNAL
+#include <libwebsockets.h>
+#endif
+
+#include <string.h>
+#include <sys/types.h>
+#include <fcntl.h>
+
+#define RING_DEPTH 8
+
+struct packet {
+	void *payload;
+	uint32_t len;
+	uint32_t ticket;
+};
+
+enum {
+	ACC,
+	ONW
+};
+
+/*
+ * Because both sides of the connection want to share this, we allocate it
+ * during accepted adoption and both sides have a pss that is just a wrapper
+ * pointing to this.
+ *
+ * The last one of the accepted side and the onward side to close frees it.
+ * This removes any chance of one side or the other having an invalidated
+ * pointer to the pss.
+ */
+
+struct conn {
+	struct lws *wsi[2];
+
+	/* rings containing unsent rx from accepted and onward sides */
+	struct lws_ring *r[2];
+	uint32_t t[2]; /* ring tail */
+
+	uint32_t ticket_next;
+	uint32_t ticket_retired;
+
+	char rx_enabled[2];
+	char closed[2];
+	char established[2];
+};
+
+struct raw_pss {
+	struct conn *conn;
+};
+
+/* one of these is created for each vhost our protocol is used with */
+
+struct raw_vhd {
+	char addr[128];
+	uint16_t port;
+	char ipv6;
+};
+
+static void
+__destroy_packet(void *_pkt)
+{
+	struct packet *pkt = _pkt;
+
+	free(pkt->payload);
+	pkt->payload = NULL;
+	pkt->len = 0;
+}
+
+static void
+destroy_conn(struct raw_vhd *vhd, struct raw_pss *pss)
+{
+	struct conn *conn = pss->conn;
+
+	if (conn->r[ACC])
+		lws_ring_destroy(conn->r[ACC]);
+	if (conn->r[ONW])
+		lws_ring_destroy(conn->r[ONW]);
+
+	pss->conn = NULL;
+
+	free(conn);
+}
+
+static int
+connect_client(struct raw_vhd *vhd, struct raw_pss *pss)
+{
+	struct lws_client_connect_info i;
+	char host[128];
+	struct lws *cwsi;
+
+	lws_snprintf(host, sizeof(host), "%s:%u", vhd->addr, vhd->port);
+
+	memset(&i, 0, sizeof(i));
+
+	i.method = "RAW";
+	i.context = lws_get_context(pss->conn->wsi[ACC]);
+	i.port = vhd->port;
+	i.address = vhd->addr;
+	i.host = host;
+	i.origin = host;
+	i.ssl_connection = 0;
+	i.vhost = lws_get_vhost(pss->conn->wsi[ACC]);
+	i.local_protocol_name = "raw-proxy";
+	i.protocol = "raw-proxy";
+	i.path = "/";
+	/*
+	 * The "onward" client wsi has its own pss but shares the "conn"
+	 * created when the inbound connection was accepted.  We need to stash
+	 * the address of the shared conn and apply it to the client psss
+	 * when the client connection completes.
+	 */
+	i.opaque_user_data = pss->conn;
+	i.pwsi = &pss->conn->wsi[ONW];
+
+	lwsl_info("%s: onward: %s:%d%s\n", __func__, i.address, i.port, i.path);
+
+	cwsi = lws_client_connect_via_info(&i);
+	if (!cwsi)
+		lwsl_err("%s: client connect failed early\n", __func__);
+
+	return !cwsi;
+}
+
+static int
+flow_control(struct conn *conn, int side, int enable)
+{
+	if (conn->closed[side] ||
+	    enable == conn->rx_enabled[side] ||
+	    !conn->established[side])
+		return 0;
+
+	if (lws_rx_flow_control(conn->wsi[side], enable))
+		return 1;
+
+	conn->rx_enabled[side] = enable;
+	lwsl_info("%s: %s side: %s\n", __func__, side ? "ONW" : "ACC",
+		  enable ? "rx enabled" : "rx flow controlled");
+
+	return 0;
+}
+
+static int
+callback_raw_proxy(struct lws *wsi, enum lws_callback_reasons reason,
+		   void *user, void *in, size_t len)
+{
+	struct raw_pss *pss = (struct raw_pss *)user;
+	struct raw_vhd *vhd = (struct raw_vhd *)lws_protocol_vh_priv_get(
+				     lws_get_vhost(wsi), lws_get_protocol(wsi));
+	const struct packet *ppkt;
+	struct conn *conn = NULL;
+	struct lws_tokenize ts;
+	lws_tokenize_elem e;
+	struct packet pkt;
+	const char *cp;
+	int n;
+
+	if (pss)
+		conn = pss->conn;
+
+	switch (reason) {
+	case LWS_CALLBACK_PROTOCOL_INIT:
+		vhd = lws_protocol_vh_priv_zalloc(lws_get_vhost(wsi),
+				lws_get_protocol(wsi), sizeof(struct raw_vhd));
+		if (lws_pvo_get_str(in, "onward", &cp)) {
+			lwsl_err("%s: vh %s: pvo 'onward' required\n", __func__,
+				 lws_get_vhost_name(lws_get_vhost(wsi)));
+
+			return -1;
+		}
+		lws_tokenize_init(&ts, cp, LWS_TOKENIZE_F_DOT_NONTERM |
+					   LWS_TOKENIZE_F_MINUS_NONTERM |
+					   LWS_TOKENIZE_F_NO_FLOATS);
+
+		if (lws_tokenize(&ts) != LWS_TOKZE_TOKEN)
+			goto bad_onward;
+		if (!strncmp(ts.token, "ipv6", ts.token_len))
+			vhd->ipv6 = 1;
+		else
+			if (strncmp(ts.token, "ipv4", ts.token_len))
+				goto bad_onward;
+
+		/* then the colon */
+		if (lws_tokenize(&ts) != LWS_TOKZE_DELIMITER)
+			goto bad_onward;
+
+		e = lws_tokenize(&ts);
+		if (!vhd->ipv6) {
+			if (e != LWS_TOKZE_TOKEN ||
+			    ts.token_len + 1 >= (int)sizeof(vhd->addr))
+				goto bad_onward;
+
+			lws_strncpy(vhd->addr, ts.token, ts.token_len + 1);
+			e = lws_tokenize(&ts);
+			if (e == LWS_TOKZE_DELIMITER) {
+				/* there should be a port then */
+				e = lws_tokenize(&ts);
+				if (e != LWS_TOKZE_INTEGER)
+					goto bad_onward;
+				vhd->port = atoi(ts.token);
+				e = lws_tokenize(&ts);
+			}
+			if (e != LWS_TOKZE_ENDED)
+				goto bad_onward;
+		} else
+			lws_strncpy(vhd->addr, ts.token, sizeof(vhd->addr));
+
+		lwsl_notice("%s: vh %s: onward %s:%s:%d\n", __func__,
+			    lws_get_vhost_name(lws_get_vhost(wsi)),
+			    vhd->ipv6 ? "ipv6": "ipv4", vhd->addr, vhd->port);
+		break;
+
+bad_onward:
+		lwsl_err("%s: onward pvo format must be ipv4:addr[:port] "
+			 " or ipv6:addr, not '%s'\n", __func__, cp);
+		return -1;
+
+	case LWS_CALLBACK_PROTOCOL_DESTROY:
+		break;
+
+	/* callbacks related to client "onward side" */
+
+	case LWS_CALLBACK_CLIENT_CONNECTION_ERROR:
+		lwsl_err("CLIENT_CONNECTION_ERROR: %s\n",
+			 in ? (char *)in : "(null)");
+		break;
+
+        case LWS_CALLBACK_RAW_PROXY_CLI_ADOPT:
+		lwsl_debug("LWS_CALLBACK_RAW_CLI_ADOPT: pss %p\n", pss);
+		if (conn)
+			break;
+		conn = pss->conn = lws_get_opaque_user_data(wsi);
+		conn->established[ONW] = 1;
+		/* they start enabled */
+		conn->rx_enabled[ACC] = 1;
+		conn->rx_enabled[ONW] = 1;
+
+		/* he disabled his rx while waiting for use to be established */
+		flow_control(conn, ACC, 1);
+
+		lws_callback_on_writable(wsi);
+		lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+		break;
+
+	case LWS_CALLBACK_RAW_PROXY_CLI_CLOSE:
+		lwsl_debug("LWS_CALLBACK_RAW_PROXY_CLI_CLOSE\n");
+		if (!conn)
+			break;
+
+		conn->closed[ONW] = 1;
+
+		if (conn->closed[ACC])
+			destroy_conn(vhd, pss);
+
+		break;
+
+	case LWS_CALLBACK_RAW_PROXY_CLI_RX:
+		lwsl_debug("LWS_CALLBACK_RAW_PROXY_CLI_RX: %d\n", (int)len);
+
+		if (!pss || !conn->wsi[ACC] || conn->closed[ACC]) {
+			lwsl_info(" pss %p, wsi[ACC] %p, closed[ACC] %d\n",
+				  pss, conn->wsi[ACC], conn->closed[ACC]);
+			return -1;
+		}
+		pkt.payload = malloc(len);
+		if (!pkt.payload) {
+			lwsl_notice("OOM: dropping\n");
+			return -1;
+		}
+		pkt.len = len;
+		pkt.ticket = conn->ticket_next++;
+
+		memcpy(pkt.payload, in, len);
+		if (!lws_ring_insert(conn->r[ONW], &pkt, 1)) {
+			__destroy_packet(&pkt);
+			lwsl_notice("dropping!\n");
+			return -1;
+		}
+
+		lwsl_debug("After onward RX: acc free: %d...\n",
+			   (int)lws_ring_get_count_free_elements(conn->r[ONW]));
+
+		if (conn->rx_enabled[ONW] &&
+		    lws_ring_get_count_free_elements(conn->r[ONW]) < 2)
+			flow_control(conn, ONW, 0);
+
+		if (!conn->closed[ACC])
+			lws_callback_on_writable(conn->wsi[ACC]);
+		break;
+
+	case LWS_CALLBACK_RAW_PROXY_CLI_WRITEABLE:
+		lwsl_debug("LWS_CALLBACK_RAW_PROXY_CLI_WRITEABLE\n");
+
+		ppkt = lws_ring_get_element(conn->r[ACC], &conn->t[ACC]);
+		if (!ppkt) {
+			lwsl_info("%s: CLI_WRITABLE had nothing in acc ring\n",
+				  __func__);
+			break;
+		}
+
+		if (ppkt->ticket != conn->ticket_retired + 1) {
+			lwsl_info("%s: acc ring has %d but next %d\n", __func__,
+				  ppkt->ticket, conn->ticket_retired + 1);
+			lws_callback_on_writable(conn->wsi[ACC]);
+			break;
+		}
+
+		n = lws_write(wsi, ppkt->payload, ppkt->len, LWS_WRITE_RAW);
+		if (n < 0) {
+			lwsl_info("%s: WRITEABLE: %d\n", __func__, n);
+
+			return -1;
+		}
+
+		conn->ticket_retired = ppkt->ticket;
+		lws_ring_consume(conn->r[ACC], &conn->t[ACC], NULL, 1);
+		lws_ring_update_oldest_tail(conn->r[ACC], conn->t[ACC]);
+
+		lwsl_debug("acc free: %d...\n",
+			  (int)lws_ring_get_count_free_elements(conn->r[ACC]));
+
+		if (!conn->rx_enabled[ACC] &&
+		    lws_ring_get_count_free_elements(conn->r[ACC]) > 2)
+			flow_control(conn, ACC, 1);
+
+		ppkt = lws_ring_get_element(conn->r[ACC], &conn->t[ACC]);
+		lwsl_debug("%s: CLI_WRITABLE: next acc pkt %p idx %d vs %d\n",
+			   __func__, ppkt, ppkt ? ppkt->ticket : 0,
+					   conn->ticket_retired + 1);
+
+		if (ppkt && ppkt->ticket == conn->ticket_retired + 1)
+			lws_callback_on_writable(wsi);
+		else {
+			/*
+			 * defer checking for accepted side closing until we
+			 * sent everything in the ring to onward
+			 */
+			if (conn->closed[ACC])
+				/*
+				 * there is never going to be any more... but
+				 * we may have some tx still in tx buflist /
+				 * partial
+				 */
+				return lws_raw_transaction_completed(wsi);
+
+			if (lws_ring_get_element(conn->r[ONW], &conn->t[ONW]))
+				lws_callback_on_writable(conn->wsi[ACC]);
+		}
+		break;
+
+	/* callbacks related to raw socket descriptor "accepted side" */
+
+        case LWS_CALLBACK_RAW_PROXY_SRV_ADOPT:
+		lwsl_debug("LWS_CALLBACK_RAW_SRV_ADOPT\n");
+
+		conn = pss->conn = malloc(sizeof(struct conn));
+		if (!pss->conn)
+			return -1;
+		memset(conn, 0, sizeof(*conn));
+
+		conn->wsi[ACC] = wsi;
+		conn->ticket_next = 1;
+
+		conn->r[ACC] = lws_ring_create(sizeof(struct packet),
+					       RING_DEPTH, __destroy_packet);
+		if (!conn->r[ACC]) {
+			lwsl_err("%s: OOM\n", __func__);
+			return -1;
+		}
+		conn->r[ONW] = lws_ring_create(sizeof(struct packet),
+					       RING_DEPTH, __destroy_packet);
+		if (!conn->r[ONW]) {
+			lws_ring_destroy(conn->r[ACC]);
+			conn->r[ACC] = NULL;
+			lwsl_err("%s: OOM\n", __func__);
+
+			return -1;
+		}
+
+		conn->established[ACC] = 1;
+
+		/* disable any rx until the client side is up */
+		flow_control(conn, ACC, 0);
+
+		lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+
+		/* try to create the onward client connection */
+		connect_client(vhd, pss);
+                break;
+
+	case LWS_CALLBACK_RAW_PROXY_SRV_CLOSE:
+		lwsl_debug("LWS_CALLBACK_RAW_PROXY_SRV_CLOSE:\n");
+
+		if (!conn)
+			break;
+
+		conn->closed[ACC] = 1;
+		if (conn->closed[ONW])
+			destroy_conn(vhd, pss);
+		break;
+
+	case LWS_CALLBACK_RAW_PROXY_SRV_RX:
+		lwsl_debug("LWS_CALLBACK_RAW_PROXY_SRV_RX: rx %d\n", (int)len);
+
+		if (!conn || !conn->wsi[ONW]) {
+			lwsl_err("%s: LWS_CALLBACK_RAW_PROXY_SRV_RX: "
+				 "conn->wsi[ONW] NULL\n", __func__);
+			return -1;
+		}
+		if (conn->closed[ONW]) {
+			lwsl_info(" closed[ONW] %d\n", conn->closed[ONW]);
+			return -1;
+		}
+
+		pkt.payload = malloc(len);
+		if (!pkt.payload) {
+			lwsl_notice("OOM: dropping\n");
+			return -1;
+		}
+		pkt.len = len;
+		pkt.ticket = conn->ticket_next++;
+
+		memcpy(pkt.payload, in, len);
+		if (!lws_ring_insert(conn->r[ACC], &pkt, 1)) {
+			__destroy_packet(&pkt);
+			lwsl_notice("dropping!\n");
+			return -1;
+		}
+
+		lwsl_debug("After acc RX: acc free: %d...\n",
+			   (int)lws_ring_get_count_free_elements(conn->r[ACC]));
+
+		if (conn->rx_enabled[ACC] &&
+		    lws_ring_get_count_free_elements(conn->r[ACC]) <= 2)
+			flow_control(conn, ACC, 0);
+
+		if (conn->established[ONW] && !conn->closed[ONW])
+			lws_callback_on_writable(conn->wsi[ONW]);
+		break;
+
+	case LWS_CALLBACK_RAW_PROXY_SRV_WRITEABLE:
+		lwsl_debug("LWS_CALLBACK_RAW_PROXY_SRV_WRITEABLE\n");
+
+		if (!conn->established[ONW] || conn->closed[ONW])
+			break;
+
+		ppkt = lws_ring_get_element(conn->r[ONW], &conn->t[ONW]);
+		if (!ppkt) {
+			lwsl_info("%s: SRV_WRITABLE nothing in onw ring\n",
+				  __func__);
+			break;
+		}
+
+		if (ppkt->ticket != conn->ticket_retired + 1) {
+			lwsl_info("%s: onw ring has %d but next %d\n", __func__,
+				  ppkt->ticket, conn->ticket_retired + 1);
+			lws_callback_on_writable(conn->wsi[ONW]);
+			break;
+		}
+
+		n = lws_write(wsi, ppkt->payload, ppkt->len, LWS_WRITE_RAW);
+		if (n < 0) {
+			lwsl_info("%s: WRITEABLE: %d\n", __func__, n);
+
+			return -1;
+		}
+
+		conn->ticket_retired = ppkt->ticket;
+		lws_ring_consume(conn->r[ONW], &conn->t[ONW], NULL, 1);
+		lws_ring_update_oldest_tail(conn->r[ONW], conn->t[ONW]);
+
+		lwsl_debug("onward free: %d... waiting %d\n",
+			  (int)lws_ring_get_count_free_elements(conn->r[ONW]),
+			  (int)lws_ring_get_count_waiting_elements(conn->r[ONW],
+								&conn->t[ONW]));
+
+		if (!conn->rx_enabled[ONW] &&
+		    lws_ring_get_count_free_elements(conn->r[ONW]) > 2)
+			flow_control(conn, ONW, 1);
+
+		ppkt = lws_ring_get_element(conn->r[ONW], &conn->t[ONW]);
+		lwsl_debug("%s: SRV_WRITABLE: next onw pkt %p idx %d vs %d\n",
+			   __func__, ppkt, ppkt ? ppkt->ticket : 0,
+					   conn->ticket_retired + 1);
+
+		if (ppkt && ppkt->ticket == conn->ticket_retired + 1)
+			lws_callback_on_writable(wsi);
+		else {
+			/*
+			 * defer checking for onward side closing until we
+			 * sent everything in the ring to accepted side
+			 */
+			if (conn->closed[ONW])
+				/*
+				 * there is never going to be any more... but
+				 * we may have some tx still in tx buflist /
+				 * partial
+				 */
+				return lws_raw_transaction_completed(wsi);
+
+		if (lws_ring_get_element(conn->r[ACC], &conn->t[ACC]))
+			lws_callback_on_writable(conn->wsi[ONW]);
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	return lws_callback_http_dummy(wsi, reason, user, in, len);
+}
+
+#define LWS_PLUGIN_PROTOCOL_RAW_PROXY { \
+		"raw-proxy", \
+		callback_raw_proxy, \
+		sizeof(struct raw_pss), \
+		8192, \
+		8192, NULL, 0 \
+	}
+
+#if !defined (LWS_PLUGIN_STATIC)
+
+static const struct lws_protocols protocols[] = {
+	LWS_PLUGIN_PROTOCOL_RAW_PROXY
+};
+
+LWS_EXTERN LWS_VISIBLE int
+init_protocol_lws_raw_proxy(struct lws_context *context,
+			    struct lws_plugin_capability *c)
+{
+	if (c->api_magic != LWS_PLUGIN_API_MAGIC) {
+		lwsl_err("Plugin API %d, library API %d", LWS_PLUGIN_API_MAGIC,
+			 c->api_magic);
+		return 1;
+	}
+
+	c->protocols = protocols;
+	c->count_protocols = LWS_ARRAY_SIZE(protocols);
+	c->extensions = NULL;
+	c->count_extensions = 0;
+
+	return 0;
+}
+
+LWS_EXTERN LWS_VISIBLE int
+destroy_protocol_lws_raw_proxy(struct lws_context *context)
+{
+	return 0;
+}
+#endif
+
+
diff --git a/test-apps/test-server.c b/test-apps/test-server.c
index 2319cb49..5c2f085b 100644
--- a/test-apps/test-server.c
+++ b/test-apps/test-server.c
@@ -26,7 +26,7 @@
 
 int close_testing;
 int max_poll_elements;
-int debug_level = 7;
+int debug_level = LLL_USER | 7;
 
 #ifdef EXTERNAL_POLL
 struct lws_pollfd *pollfds;
-- 
GitLab