Adding upstream version 1.37.1.upstream/1.37.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

6 files changed, 2595 insertions, 0 deletions

diff --git a/libnetdata/socket/Makefile.am b/libnetdata/socket/Makefile.am
new file mode 100644
index 0000000..161784b
--- /dev/null
+++ b/libnetdata/socket/Makefile.am
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+AUTOMAKE_OPTIONS = subdir-objects
+MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
+
+dist_noinst_DATA = \
+    README.md \
+    $(NULL)
diff --git a/libnetdata/socket/README.md b/libnetdata/socket/README.md
new file mode 100644
index 0000000..70bfd34
--- /dev/null
+++ b/libnetdata/socket/README.md
@@ -0,0 +1,5 @@
+<!--
+custom_edit_url: https://github.com/netdata/netdata/edit/master/libnetdata/socket/README.md
+-->
+
+
diff --git a/libnetdata/socket/security.c b/libnetdata/socket/security.c
new file mode 100644
index 0000000..88b3f6d
--- /dev/null
+++ b/libnetdata/socket/security.c
@@ -0,0 +1,390 @@
+#include "../libnetdata.h"
+
+#ifdef ENABLE_HTTPS
+
+SSL_CTX *netdata_ssl_exporting_ctx =NULL;
+SSL_CTX *netdata_ssl_client_ctx =NULL;
+SSL_CTX *netdata_ssl_srv_ctx =NULL;
+const char *netdata_ssl_security_key =NULL;
+const char *netdata_ssl_security_cert =NULL;
+const char *tls_version=NULL;
+const char *tls_ciphers=NULL;
+int netdata_ssl_validate_server =  NETDATA_SSL_VALID_CERTIFICATE;
+
+/**
+ * Info Callback
+ *
+ * Function used as callback for the OpenSSL Library
+ *
+ * @param ssl a pointer to the SSL structure of the client
+ * @param where the variable with the flags set.
+ * @param ret the return of the caller
+ */
+static void security_info_callback(const SSL *ssl, int where, int ret __maybe_unused) {
+    (void)ssl;
+    if (where & SSL_CB_ALERT) {
+        debug(D_WEB_CLIENT,"SSL INFO CALLBACK %s %s", SSL_alert_type_string(ret), SSL_alert_desc_string_long(ret));
+    }
+}
+
+/**
+ * OpenSSL Library
+ *
+ * Starts the openssl library for the Netdata.
+ */
+void security_openssl_library()
+{
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
+# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097)
+    OPENSSL_config(NULL);
+# endif
+
+    SSL_load_error_strings();
+
+    SSL_library_init();
+#else
+    if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL) != 1) {
+        error("SSL library cannot be initialized.");
+    }
+#endif
+}
+
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_110
+/**
+ * TLS version
+ *
+ * Returns the TLS version depending of the user input.
+ *
+ * @param lversion is the user input.
+ *
+ * @return it returns the version number.
+ */
+int tls_select_version(const char *lversion) {
+    if (!strcmp(lversion, "1") || !strcmp(lversion, "1.0"))
+        return TLS1_VERSION;
+    else if (!strcmp(lversion, "1.1"))
+        return TLS1_1_VERSION;
+    else if (!strcmp(lversion, "1.2"))
+        return TLS1_2_VERSION;
+#if defined(TLS1_3_VERSION)
+    else if (!strcmp(lversion, "1.3"))
+        return TLS1_3_VERSION;
+#endif
+
+#if defined(TLS_MAX_VERSION)
+    return TLS_MAX_VERSION;
+#else
+    return TLS1_2_VERSION;
+#endif
+}
+#endif
+
+/**
+ * OpenSSL common options
+ *
+ * Clients and SERVER have common options, this function is responsible to set them in the context.
+ *
+ * @param ctx the initialized SSL context.
+ * @param side 0 means server, and 1 client.
+ */
+void security_openssl_common_options(SSL_CTX *ctx, int side) {
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_110
+    if (!side) {
+        int version =  tls_select_version(tls_version) ;
+#endif
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
+        SSL_CTX_set_options (ctx,SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
+#else
+        SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
+        SSL_CTX_set_max_proto_version(ctx, version);
+
+        if(tls_ciphers  && strcmp(tls_ciphers, "none") != 0) {
+            if (!SSL_CTX_set_cipher_list(ctx, tls_ciphers)) {
+                error("SSL error. cannot set the cipher list");
+            }
+        }
+    }
+#endif
+
+    SSL_CTX_set_mode(ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+}
+
+/**
+ * Initialize Openssl Client
+ *
+ * Starts the client context with TLS 1.2.
+ *
+ * @return It returns the context on success or NULL otherwise
+ */
+SSL_CTX * security_initialize_openssl_client() {
+    SSL_CTX *ctx;
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
+    ctx = SSL_CTX_new(SSLv23_client_method());
+#else
+    ctx = SSL_CTX_new(TLS_client_method());
+#endif
+    if(ctx) {
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
+        SSL_CTX_set_options (ctx,SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
+#else
+        SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
+# if defined(TLS_MAX_VERSION)
+        SSL_CTX_set_max_proto_version(ctx, TLS_MAX_VERSION);
+# elif defined(TLS1_3_VERSION)
+        SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION);
+# elif defined(TLS1_2_VERSION)
+        SSL_CTX_set_max_proto_version(ctx, TLS1_2_VERSION);
+# endif
+#endif
+    }
+
+    return ctx;
+}
+
+/**
+ * Initialize OpenSSL server
+ *
+ * Starts the server context with TLS 1.2 and load the certificate.
+ *
+ * @return It returns the context on success or NULL otherwise
+ */
+static SSL_CTX * security_initialize_openssl_server() {
+    SSL_CTX *ctx;
+    char lerror[512];
+	static int netdata_id_context = 1;
+
+    //TO DO: Confirm the necessity to check return for other OPENSSL function
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
+	ctx = SSL_CTX_new(SSLv23_server_method());
+    if (!ctx) {
+		error("Cannot create a new SSL context, netdata won't encrypt communication");
+        return NULL;
+    }
+
+    SSL_CTX_use_certificate_file(ctx, netdata_ssl_security_cert, SSL_FILETYPE_PEM);
+#else
+    ctx = SSL_CTX_new(TLS_server_method());
+    if (!ctx) {
+		error("Cannot create a new SSL context, netdata won't encrypt communication");
+        return NULL;
+    }
+
+    SSL_CTX_use_certificate_chain_file(ctx, netdata_ssl_security_cert);
+#endif
+    security_openssl_common_options(ctx, 0);
+
+    SSL_CTX_use_PrivateKey_file(ctx, netdata_ssl_security_key,SSL_FILETYPE_PEM);
+
+    if (!SSL_CTX_check_private_key(ctx)) {
+        ERR_error_string_n(ERR_get_error(),lerror,sizeof(lerror));
+		error("SSL cannot check the private key: %s",lerror);
+        SSL_CTX_free(ctx);
+        return NULL;
+    }
+
+	SSL_CTX_set_session_id_context(ctx,(void*)&netdata_id_context,(unsigned int)sizeof(netdata_id_context));
+    SSL_CTX_set_info_callback(ctx,security_info_callback);
+
+#if (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_095)
+	SSL_CTX_set_verify_depth(ctx,1);
+#endif
+    debug(D_WEB_CLIENT,"SSL GLOBAL CONTEXT STARTED\n");
+
+    return ctx;
+}
+
+/**
+ * Start SSL
+ *
+ * Call the correct function to start the SSL context.
+ *
+ * @param selector informs the context that must be initialized, the following list has the valid values:
+ *      NETDATA_SSL_CONTEXT_SERVER - the server context
+ *      NETDATA_SSL_CONTEXT_STREAMING - Starts the streaming context.
+ *      NETDATA_SSL_CONTEXT_EXPORTING - Starts the OpenTSDB context
+ */
+void security_start_ssl(int selector) {
+    static SPINLOCK sp = NETDATA_SPINLOCK_INITIALIZER;
+    netdata_spinlock_lock(&sp);
+
+    switch (selector) {
+        case NETDATA_SSL_CONTEXT_SERVER: {
+            if(!netdata_ssl_srv_ctx) {
+                struct stat statbuf;
+                if (stat(netdata_ssl_security_key, &statbuf) || stat(netdata_ssl_security_cert, &statbuf))
+                    info("To use encryption it is necessary to set \"ssl certificate\" and \"ssl key\" in [web] !\n");
+                else {
+                    netdata_ssl_srv_ctx = security_initialize_openssl_server();
+                    SSL_CTX_set_mode(netdata_ssl_srv_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
+                }
+            }
+            break;
+        }
+
+        case NETDATA_SSL_CONTEXT_STREAMING: {
+            if(!netdata_ssl_client_ctx) {
+                netdata_ssl_client_ctx = security_initialize_openssl_client();
+                //This is necessary for the stream, because it is working sometimes with nonblock socket.
+                //It returns the bitmask after to change, there is not any description of errors in the documentation
+                SSL_CTX_set_mode(netdata_ssl_client_ctx,
+                                 SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
+                                 SSL_MODE_AUTO_RETRY);
+            }
+            break;
+        }
+
+        case NETDATA_SSL_CONTEXT_EXPORTING: {
+            if(!netdata_ssl_exporting_ctx)
+                netdata_ssl_exporting_ctx = security_initialize_openssl_client();
+            break;
+        }
+    }
+
+    netdata_spinlock_unlock(&sp);
+}
+
+/**
+ * Clean Open SSL
+ *
+ * Clean all the allocated contexts from netdata.
+ */
+void security_clean_openssl()
+{
+    if (netdata_ssl_srv_ctx) {
+        SSL_CTX_free(netdata_ssl_srv_ctx);
+    }
+
+    if (netdata_ssl_client_ctx) {
+        SSL_CTX_free(netdata_ssl_client_ctx);
+    }
+
+    if (netdata_ssl_exporting_ctx) {
+        SSL_CTX_free(netdata_ssl_exporting_ctx);
+    }
+
+#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
+    ERR_free_strings();
+#endif
+}
+
+/**
+ * Process accept
+ *
+ * Process the SSL handshake with the client case it is necessary.
+ *
+ * @param ssl is a pointer for the SSL structure
+ * @param msg is a copy of the first 8 bytes of the initial message received
+ *
+ * @return it returns 0 case it performs the handshake, 8 case it is clean connection
+ *  and another integer power of 2 otherwise.
+ */
+int security_process_accept(SSL *ssl,int msg) {
+    int sock = SSL_get_fd(ssl);
+    int test;
+    if (msg > 0x17)
+    {
+        return NETDATA_SSL_NO_HANDSHAKE;
+    }
+
+    ERR_clear_error();
+    if ((test = SSL_accept(ssl)) <= 0) {
+         int sslerrno = SSL_get_error(ssl, test);
+         switch(sslerrno) {
+             case SSL_ERROR_WANT_READ:
+             {
+                 error("SSL handshake did not finish and it wanna read on socket %d!", sock);
+                 return NETDATA_SSL_WANT_READ;
+             }
+             case SSL_ERROR_WANT_WRITE:
+             {
+                 error("SSL handshake did not finish and it wanna read on socket %d!", sock);
+                 return NETDATA_SSL_WANT_WRITE;
+             }
+             case SSL_ERROR_NONE:
+             case SSL_ERROR_SSL:
+             case SSL_ERROR_SYSCALL:
+             default:
+			 {
+                 u_long err;
+                 char buf[256];
+                 int counter = 0;
+                 while ((err = ERR_get_error()) != 0) {
+                     ERR_error_string_n(err, buf, sizeof(buf));
+                     info("%d SSL Handshake error (%s) on socket %d ", counter++, ERR_error_string((long)SSL_get_error(ssl, test), NULL), sock);
+			     }
+                 return NETDATA_SSL_NO_HANDSHAKE;
+			 }
+         }
+    }
+
+    if (SSL_is_init_finished(ssl))
+    {
+        debug(D_WEB_CLIENT_ACCESS,"SSL Handshake finished %s errno %d on socket fd %d", ERR_error_string((long)SSL_get_error(ssl, test), NULL), errno, sock);
+    }
+
+    return NETDATA_SSL_HANDSHAKE_COMPLETE;
+}
+
+/**
+ * Test Certificate
+ *
+ * Check the certificate of Netdata parent
+ *
+ * @param ssl is the connection structure
+ *
+ * @return It returns 0 on success and -1 otherwise
+ */
+int security_test_certificate(SSL *ssl) {
+    X509* cert = SSL_get_peer_certificate(ssl);
+    int ret;
+    long status;
+    if (!cert) {
+        return -1;
+    }
+
+    status = SSL_get_verify_result(ssl);
+    if((X509_V_OK != status))
+    {
+        char error[512];
+        ERR_error_string_n(ERR_get_error(), error, sizeof(error));
+        error("SSL RFC4158 check:  We have a invalid certificate, the tests result with %ld and message %s", status, error);
+        ret = -1;
+    } else {
+        ret = 0;
+    }
+
+    return ret;
+}
+
+/**
+ * Location for context
+ *
+ * Case the user give us a directory with the certificates available and
+ * the Netdata parent certificate, we use this function to validate the certificate.
+ *
+ * @param ctx the context where the path will be set.
+ * @param file the file with Netdata parent certificate.
+ * @param path the directory where the certificates are stored.
+ *
+ * @return It returns 0 on success and -1 otherwise.
+ */
+int ssl_security_location_for_context(SSL_CTX *ctx, char *file, char *path) {
+    int load_custom = 1, load_default = 1;
+    if (file || path) {
+        if(!SSL_CTX_load_verify_locations(ctx, file, path)) {
+            info("Netdata can not verify custom CAfile or CApath for parent's SSL certificate, so it will use the default OpenSSL configuration to validate certificates!");
+            load_custom = 0;
+        }
+    }
+
+    if(!SSL_CTX_set_default_verify_paths(ctx)) {
+        info("Can not verify default OpenSSL configuration to validate certificates!");
+        load_default = 0;
+    }
+
+    if (load_custom  == 0 && load_default == 0)
+        return -1;
+
+    return 0;
+}
+#endif
diff --git a/libnetdata/socket/security.h b/libnetdata/socket/security.h
new file mode 100644
index 0000000..ae7c595
--- /dev/null
+++ b/libnetdata/socket/security.h
@@ -0,0 +1,63 @@
+#ifndef NETDATA_SECURITY_H
+# define NETDATA_SECURITY_H
+
+# define NETDATA_SSL_HANDSHAKE_COMPLETE 0    //All the steps were successful
+# define NETDATA_SSL_START 1                 //Starting handshake, conn variable is NULL
+# define NETDATA_SSL_WANT_READ 2             //The connection wanna read from socket
+# define NETDATA_SSL_WANT_WRITE 4            //The connection wanna write on socket
+# define NETDATA_SSL_NO_HANDSHAKE 8          //Continue without encrypt connection.
+# define NETDATA_SSL_OPTIONAL 16             //Flag to define the HTTP request
+# define NETDATA_SSL_FORCE 32                //We only accepts HTTPS request
+# define NETDATA_SSL_INVALID_CERTIFICATE 64  //Accepts invalid certificate
+# define NETDATA_SSL_VALID_CERTIFICATE 128  //Accepts invalid certificate
+# define NETDATA_SSL_PROXY_HTTPS 256        //Proxy is using HTTPS
+
+#define NETDATA_SSL_CONTEXT_SERVER 0
+#define NETDATA_SSL_CONTEXT_STREAMING 1
+#define NETDATA_SSL_CONTEXT_EXPORTING 2
+
+# ifdef ENABLE_HTTPS
+
+#define OPENSSL_VERSION_095 0x00905100L
+#define OPENSSL_VERSION_097 0x0907000L
+#define OPENSSL_VERSION_110 0x10100000L
+#define OPENSSL_VERSION_111 0x10101000L
+#define OPENSSL_VERSION_300 0x30000000L
+
+#  include <openssl/ssl.h>
+#  include <openssl/err.h>
+#  include <openssl/evp.h>
+#  include <openssl/pem.h>
+#  if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
+#   include <openssl/conf.h>
+#  endif
+
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
+#include <openssl/core_names.h>
+#include <openssl/decoder.h>
+#endif
+
+struct netdata_ssl {
+    SSL *conn; //SSL connection
+    uint32_t flags; //The flags for SSL connection
+};
+
+extern SSL_CTX *netdata_ssl_exporting_ctx;
+extern SSL_CTX *netdata_ssl_client_ctx;
+extern SSL_CTX *netdata_ssl_srv_ctx;
+extern const char *netdata_ssl_security_key;
+extern const char *netdata_ssl_security_cert;
+extern const char *tls_version;
+extern const char *tls_ciphers;
+extern int netdata_ssl_validate_server;
+int ssl_security_location_for_context(SSL_CTX *ctx,char *file,char *path);
+
+void security_openssl_library();
+void security_clean_openssl();
+void security_start_ssl(int selector);
+int security_process_accept(SSL *ssl,int msg);
+int security_test_certificate(SSL *ssl);
+SSL_CTX * security_initialize_openssl_client();
+
+# endif //ENABLE_HTTPS
+#endif //NETDATA_SECURITY_H
diff --git a/libnetdata/socket/socket.c b/libnetdata/socket/socket.c
new file mode 100644
index 0000000..40271b6
--- /dev/null
+++ b/libnetdata/socket/socket.c
@@ -0,0 +1,1914 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#include "../libnetdata.h"
+
+// --------------------------------------------------------------------------------------------------------------------
+// various library calls
+
+#ifdef __gnu_linux__
+#define LARGE_SOCK_SIZE 33554431 // don't ask why - I found it at brubeck source - I guess it is just a large number
+#else
+#define LARGE_SOCK_SIZE 4096
+#endif
+
+int sock_setnonblock(int fd) {
+    int flags;
+
+    flags = fcntl(fd, F_GETFL);
+    flags |= O_NONBLOCK;
+
+    int ret = fcntl(fd, F_SETFL, flags);
+    if(ret < 0)
+        error("Failed to set O_NONBLOCK on socket %d", fd);
+
+    return ret;
+}
+
+int sock_delnonblock(int fd) {
+    int flags;
+
+    flags = fcntl(fd, F_GETFL);
+    flags &= ~O_NONBLOCK;
+
+    int ret = fcntl(fd, F_SETFL, flags);
+    if(ret < 0)
+        error("Failed to remove O_NONBLOCK on socket %d", fd);
+
+    return ret;
+}
+
+int sock_setreuse(int fd, int reuse) {
+    int ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse));
+
+    if(ret == -1)
+        error("Failed to set SO_REUSEADDR on socket %d", fd);
+
+    return ret;
+}
+
+int sock_setreuse_port(int fd, int reuse) {
+    int ret;
+
+#ifdef SO_REUSEPORT
+    ret = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &reuse, sizeof(reuse));
+    if(ret == -1 && errno != ENOPROTOOPT)
+        error("failed to set SO_REUSEPORT on socket %d", fd);
+#else
+    ret = -1;
+#endif
+
+    return ret;
+}
+
+int sock_enlarge_in(int fd) {
+    int ret, bs = LARGE_SOCK_SIZE;
+
+    ret = setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &bs, sizeof(bs));
+
+    if(ret == -1)
+        error("Failed to set SO_RCVBUF on socket %d", fd);
+
+    return ret;
+}
+
+int sock_enlarge_out(int fd) {
+    int ret, bs = LARGE_SOCK_SIZE;
+    ret = setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &bs, sizeof(bs));
+
+    if(ret == -1)
+        error("Failed to set SO_SNDBUF on socket %d", fd);
+
+    return ret;
+}
+
+
+// --------------------------------------------------------------------------------------------------------------------
+
+char *strdup_client_description(int family, const char *protocol, const char *ip, uint16_t port) {
+    char buffer[100 + 1];
+
+    switch(family) {
+        case AF_INET:
+            snprintfz(buffer, 100, "%s:%s:%d", protocol, ip, port);
+            break;
+
+        case AF_INET6:
+        default:
+            snprintfz(buffer, 100, "%s:[%s]:%d", protocol, ip, port);
+            break;
+
+        case AF_UNIX:
+            snprintfz(buffer, 100, "%s:%s", protocol, ip);
+            break;
+    }
+
+    return strdupz(buffer);
+}
+
+// --------------------------------------------------------------------------------------------------------------------
+// listening sockets
+
+int create_listen_socket_unix(const char *path, int listen_backlog) {
+    int sock;
+
+    debug(D_LISTENER, "LISTENER: UNIX creating new listening socket on path '%s'", path);
+
+    sock = socket(AF_UNIX, SOCK_STREAM, 0);
+    if(sock < 0) {
+        error("LISTENER: UNIX socket() on path '%s' failed.", path);
+        return -1;
+    }
+
+    sock_setnonblock(sock);
+    sock_enlarge_in(sock);
+
+    struct sockaddr_un name;
+    memset(&name, 0, sizeof(struct sockaddr_un));
+    name.sun_family = AF_UNIX;
+    strncpy(name.sun_path, path, sizeof(name.sun_path)-1);
+
+    errno = 0;
+    if (unlink(path) == -1 && errno != ENOENT)
+        error("LISTENER: failed to remove existing (probably obsolete or left-over) file on UNIX socket path '%s'.", path);
+
+    if(bind (sock, (struct sockaddr *) &name, sizeof (name)) < 0) {
+        close(sock);
+        error("LISTENER: UNIX bind() on path '%s' failed.", path);
+        return -1;
+    }
+
+    // we have to chmod this to 0777 so that the client will be able
+    // to read from and write to this socket.
+    if(chmod(path, 0777) == -1)
+        error("LISTENER: failed to chmod() socket file '%s'.", path);
+
+    if(listen(sock, listen_backlog) < 0) {
+        close(sock);
+        error("LISTENER: UNIX listen() on path '%s' failed.", path);
+        return -1;
+    }
+
+    debug(D_LISTENER, "LISTENER: Listening on UNIX path '%s'", path);
+    return sock;
+}
+
+int create_listen_socket4(int socktype, const char *ip, uint16_t port, int listen_backlog) {
+    int sock;
+
+    debug(D_LISTENER, "LISTENER: IPv4 creating new listening socket on ip '%s' port %d, socktype %d", ip, port, socktype);
+
+    sock = socket(AF_INET, socktype, 0);
+    if(sock < 0) {
+        error("LISTENER: IPv4 socket() on ip '%s' port %d, socktype %d failed.", ip, port, socktype);
+        return -1;
+    }
+
+    sock_setreuse(sock, 1);
+    sock_setreuse_port(sock, 1);
+    sock_setnonblock(sock);
+    sock_enlarge_in(sock);
+
+    struct sockaddr_in name;
+    memset(&name, 0, sizeof(struct sockaddr_in));
+    name.sin_family = AF_INET;
+    name.sin_port = htons (port);
+
+    int ret = inet_pton(AF_INET, ip, (void *)&name.sin_addr.s_addr);
+    if(ret != 1) {
+        error("LISTENER: Failed to convert IP '%s' to a valid IPv4 address.", ip);
+        close(sock);
+        return -1;
+    }
+
+    if(bind (sock, (struct sockaddr *) &name, sizeof (name)) < 0) {
+        close(sock);
+        error("LISTENER: IPv4 bind() on ip '%s' port %d, socktype %d failed.", ip, port, socktype);
+        return -1;
+    }
+
+    if(socktype == SOCK_STREAM && listen(sock, listen_backlog) < 0) {
+        close(sock);
+        error("LISTENER: IPv4 listen() on ip '%s' port %d, socktype %d failed.", ip, port, socktype);
+        return -1;
+    }
+
+    debug(D_LISTENER, "LISTENER: Listening on IPv4 ip '%s' port %d, socktype %d", ip, port, socktype);
+    return sock;
+}
+
+int create_listen_socket6(int socktype, uint32_t scope_id, const char *ip, int port, int listen_backlog) {
+    int sock;
+    int ipv6only = 1;
+
+    debug(D_LISTENER, "LISTENER: IPv6 creating new listening socket on ip '%s' port %d, socktype %d", ip, port, socktype);
+
+    sock = socket(AF_INET6, socktype, 0);
+    if (sock < 0) {
+        error("LISTENER: IPv6 socket() on ip '%s' port %d, socktype %d, failed.", ip, port, socktype);
+        return -1;
+    }
+
+    sock_setreuse(sock, 1);
+    sock_setreuse_port(sock, 1);
+    sock_setnonblock(sock);
+    sock_enlarge_in(sock);
+
+    /* IPv6 only */
+    if(setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, (void*)&ipv6only, sizeof(ipv6only)) != 0)
+        error("LISTENER: Cannot set IPV6_V6ONLY on ip '%s' port %d, socktype %d.", ip, port, socktype);
+
+    struct sockaddr_in6 name;
+    memset(&name, 0, sizeof(struct sockaddr_in6));
+    name.sin6_family = AF_INET6;
+    name.sin6_port = htons ((uint16_t) port);
+    name.sin6_scope_id = scope_id;
+
+    int ret = inet_pton(AF_INET6, ip, (void *)&name.sin6_addr.s6_addr);
+    if(ret != 1) {
+        error("LISTENER: Failed to convert IP '%s' to a valid IPv6 address.", ip);
+        close(sock);
+        return -1;
+    }
+
+    name.sin6_scope_id = scope_id;
+
+    if (bind (sock, (struct sockaddr *) &name, sizeof (name)) < 0) {
+        close(sock);
+        error("LISTENER: IPv6 bind() on ip '%s' port %d, socktype %d failed.", ip, port, socktype);
+        return -1;
+    }
+
+    if (socktype == SOCK_STREAM && listen(sock, listen_backlog) < 0) {
+        close(sock);
+        error("LISTENER: IPv6 listen() on ip '%s' port %d, socktype %d failed.", ip, port, socktype);
+        return -1;
+    }
+
+    debug(D_LISTENER, "LISTENER: Listening on IPv6 ip '%s' port %d, socktype %d", ip, port, socktype);
+    return sock;
+}
+
+static inline int listen_sockets_add(LISTEN_SOCKETS *sockets, int fd, int family, int socktype, const char *protocol, const char *ip, uint16_t port, int acl_flags) {
+    if(sockets->opened >= MAX_LISTEN_FDS) {
+        error("LISTENER: Too many listening sockets. Failed to add listening %s socket at ip '%s' port %d, protocol %s, socktype %d", protocol, ip, port, protocol, socktype);
+        close(fd);
+        return -1;
+    }
+
+    sockets->fds[sockets->opened] = fd;
+    sockets->fds_types[sockets->opened] = socktype;
+    sockets->fds_families[sockets->opened] = family;
+    sockets->fds_names[sockets->opened] = strdup_client_description(family, protocol, ip, port);
+    sockets->fds_acl_flags[sockets->opened] = acl_flags;
+
+    sockets->opened++;
+    return 0;
+}
+
+int listen_sockets_check_is_member(LISTEN_SOCKETS *sockets, int fd) {
+    size_t i;
+    for(i = 0; i < sockets->opened ;i++)
+        if(sockets->fds[i] == fd) return 1;
+
+    return 0;
+}
+
+static inline void listen_sockets_init(LISTEN_SOCKETS *sockets) {
+    size_t i;
+    for(i = 0; i < MAX_LISTEN_FDS ;i++) {
+        sockets->fds[i] = -1;
+        sockets->fds_names[i] = NULL;
+        sockets->fds_types[i] = -1;
+    }
+
+    sockets->opened = 0;
+    sockets->failed = 0;
+}
+
+void listen_sockets_close(LISTEN_SOCKETS *sockets) {
+    size_t i;
+    for(i = 0; i < sockets->opened ;i++) {
+        close(sockets->fds[i]);
+        sockets->fds[i] = -1;
+
+        freez(sockets->fds_names[i]);
+        sockets->fds_names[i] = NULL;
+
+        sockets->fds_types[i] = -1;
+    }
+
+    sockets->opened = 0;
+    sockets->failed = 0;
+}
+
+/*
+ *  SSL ACL
+ *
+ *  Search the SSL acl and apply it case it is set.
+ *
+ *  @param acl is the acl given by the user.
+ */
+WEB_CLIENT_ACL socket_ssl_acl(char *acl) {
+    char *ssl = strchr(acl,'^');
+    if(ssl) {
+        //Due the format of the SSL command it is always the last command,
+        //we finish it here to avoid problems with the ACLs
+        *ssl = '\0';
+#ifdef ENABLE_HTTPS
+        ssl++;
+        if (!strncmp("SSL=",ssl,4)) {
+            ssl += 4;
+            if (!strcmp(ssl,"optional")) {
+                return WEB_CLIENT_ACL_SSL_OPTIONAL;
+            }
+            else if (!strcmp(ssl,"force")) {
+                return WEB_CLIENT_ACL_SSL_FORCE;
+            }
+        }
+#endif
+    }
+
+    return WEB_CLIENT_ACL_NONE;
+}
+
+WEB_CLIENT_ACL read_acl(char *st) {
+    WEB_CLIENT_ACL ret = socket_ssl_acl(st);
+
+    if (!strcmp(st,"dashboard")) ret |= WEB_CLIENT_ACL_DASHBOARD;
+    if (!strcmp(st,"registry")) ret |= WEB_CLIENT_ACL_REGISTRY;
+    if (!strcmp(st,"badges")) ret |= WEB_CLIENT_ACL_BADGE;
+    if (!strcmp(st,"management")) ret |= WEB_CLIENT_ACL_MGMT;
+    if (!strcmp(st,"streaming")) ret |= WEB_CLIENT_ACL_STREAMING;
+    if (!strcmp(st,"netdata.conf")) ret |= WEB_CLIENT_ACL_NETDATACONF;
+
+    return ret;
+}
+
+static inline int bind_to_this(LISTEN_SOCKETS *sockets, const char *definition, uint16_t default_port, int listen_backlog) {
+    int added = 0;
+    WEB_CLIENT_ACL acl_flags = WEB_CLIENT_ACL_NONE;
+
+    struct addrinfo hints;
+    struct addrinfo *result = NULL, *rp = NULL;
+
+    char buffer[strlen(definition) + 1];
+    strcpy(buffer, definition);
+
+    char buffer2[10 + 1];
+    snprintfz(buffer2, 10, "%d", default_port);
+
+    char *ip = buffer, *port = buffer2, *interface = "", *portconfig;;
+
+    int protocol = IPPROTO_TCP, socktype = SOCK_STREAM;
+    const char *protocol_str = "tcp";
+
+    if(strncmp(ip, "tcp:", 4) == 0) {
+        ip += 4;
+        protocol = IPPROTO_TCP;
+        socktype = SOCK_STREAM;
+        protocol_str = "tcp";
+    }
+    else if(strncmp(ip, "udp:", 4) == 0) {
+        ip += 4;
+        protocol = IPPROTO_UDP;
+        socktype = SOCK_DGRAM;
+        protocol_str = "udp";
+    }
+    else if(strncmp(ip, "unix:", 5) == 0) {
+        char *path = ip + 5;
+        socktype = SOCK_STREAM;
+        protocol_str = "unix";
+        int fd = create_listen_socket_unix(path, listen_backlog);
+        if (fd == -1) {
+            error("LISTENER: Cannot create unix socket '%s'", path);
+            sockets->failed++;
+        } else {
+            acl_flags = WEB_CLIENT_ACL_DASHBOARD | WEB_CLIENT_ACL_REGISTRY | WEB_CLIENT_ACL_BADGE | WEB_CLIENT_ACL_MGMT | WEB_CLIENT_ACL_NETDATACONF | WEB_CLIENT_ACL_STREAMING | WEB_CLIENT_ACL_SSL_DEFAULT;
+            listen_sockets_add(sockets, fd, AF_UNIX, socktype, protocol_str, path, 0, acl_flags);
+            added++;
+        }
+        return added;
+    }
+
+    char *e = ip;
+    if(*e == '[') {
+        e = ++ip;
+        while(*e && *e != ']') e++;
+        if(*e == ']') {
+            *e = '\0';
+            e++;
+        }
+    }
+    else {
+        while(*e && *e != ':' && *e != '%' && *e != '=') e++;
+    }
+
+    if(*e == '%') {
+        *e = '\0';
+        e++;
+        interface = e;
+        while(*e && *e != ':' && *e != '=') e++;
+    }
+
+    if(*e == ':') {
+        port = e + 1;
+        *e = '\0';
+        e++;
+        while(*e && *e != '=') e++;
+    }
+
+    if(*e == '=') {
+        *e='\0';
+        e++;
+        portconfig = e;
+        while (*e != '\0') {
+            if (*e == '|') {
+                *e = '\0';
+                acl_flags |= read_acl(portconfig);
+                e++;
+                portconfig = e;
+                continue;
+            }
+            e++;
+        }
+        acl_flags |= read_acl(portconfig);
+    } else {
+        acl_flags = WEB_CLIENT_ACL_DASHBOARD | WEB_CLIENT_ACL_REGISTRY | WEB_CLIENT_ACL_BADGE | WEB_CLIENT_ACL_MGMT | WEB_CLIENT_ACL_NETDATACONF | WEB_CLIENT_ACL_STREAMING | WEB_CLIENT_ACL_SSL_DEFAULT;
+    }
+
+    //Case the user does not set the option SSL in the "bind to", but he has
+    //the certificates, I must redirect, so I am assuming here the default option
+    if(!(acl_flags & WEB_CLIENT_ACL_SSL_OPTIONAL) && !(acl_flags & WEB_CLIENT_ACL_SSL_FORCE)) {
+        acl_flags |= WEB_CLIENT_ACL_SSL_DEFAULT;
+    }
+
+    uint32_t scope_id = 0;
+    if(*interface) {
+        scope_id = if_nametoindex(interface);
+        if(!scope_id)
+            error("LISTENER: Cannot find a network interface named '%s'. Continuing with limiting the network interface", interface);
+    }
+
+    if(!*ip || *ip == '*' || !strcmp(ip, "any") || !strcmp(ip, "all"))
+        ip = NULL;
+
+    if(!*port)
+        port = buffer2;
+
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_UNSPEC;  /* Allow IPv4 or IPv6 */
+    hints.ai_socktype = socktype;
+    hints.ai_flags = AI_PASSIVE;  /* For wildcard IP address */
+    hints.ai_protocol = protocol;
+    hints.ai_canonname = NULL;
+    hints.ai_addr = NULL;
+    hints.ai_next = NULL;
+
+    int r = getaddrinfo(ip, port, &hints, &result);
+    if (r != 0) {
+        error("LISTENER: getaddrinfo('%s', '%s'): %s\n", ip, port, gai_strerror(r));
+        return -1;
+    }
+
+    for (rp = result; rp != NULL; rp = rp->ai_next) {
+        int fd = -1;
+        int family;
+
+        char rip[INET_ADDRSTRLEN + INET6_ADDRSTRLEN] = "INVALID";
+        uint16_t rport = default_port;
+
+        family = rp->ai_addr->sa_family;
+        switch (family) {
+            case AF_INET: {
+                struct sockaddr_in *sin = (struct sockaddr_in *) rp->ai_addr;
+                inet_ntop(AF_INET, &sin->sin_addr, rip, INET_ADDRSTRLEN);
+                rport = ntohs(sin->sin_port);
+                // info("Attempting to listen on IPv4 '%s' ('%s'), port %d ('%s'), socktype %d", rip, ip, rport, port, socktype);
+                fd = create_listen_socket4(socktype, rip, rport, listen_backlog);
+                break;
+            }
+
+            case AF_INET6: {
+                struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) rp->ai_addr;
+                inet_ntop(AF_INET6, &sin6->sin6_addr, rip, INET6_ADDRSTRLEN);
+                rport = ntohs(sin6->sin6_port);
+                // info("Attempting to listen on IPv6 '%s' ('%s'), port %d ('%s'), socktype %d", rip, ip, rport, port, socktype);
+                fd = create_listen_socket6(socktype, scope_id, rip, rport, listen_backlog);
+                break;
+            }
+
+            default:
+                debug(D_LISTENER, "LISTENER: Unknown socket family %d", family);
+                break;
+        }
+
+        if (fd == -1) {
+            error("LISTENER: Cannot bind to ip '%s', port %d", rip, rport);
+            sockets->failed++;
+        }
+        else {
+            listen_sockets_add(sockets, fd, family, socktype, protocol_str, rip, rport, acl_flags);
+            added++;
+        }
+    }
+
+    freeaddrinfo(result);
+
+    return added;
+}
+
+int listen_sockets_setup(LISTEN_SOCKETS *sockets) {
+    listen_sockets_init(sockets);
+
+    sockets->backlog = (int) appconfig_get_number(sockets->config, sockets->config_section, "listen backlog", sockets->backlog);
+
+    long long int old_port = sockets->default_port;
+    long long int new_port = appconfig_get_number(sockets->config, sockets->config_section, "default port", sockets->default_port);
+    if(new_port < 1 || new_port > 65535) {
+        error("LISTENER: Invalid listen port %lld given. Defaulting to %lld.", new_port, old_port);
+        sockets->default_port = (uint16_t) appconfig_set_number(sockets->config, sockets->config_section, "default port", old_port);
+    }
+    else sockets->default_port = (uint16_t)new_port;
+
+    debug(D_OPTIONS, "LISTENER: Default listen port set to %d.", sockets->default_port);
+
+    char *s = appconfig_get(sockets->config, sockets->config_section, "bind to", sockets->default_bind_to);
+    while(*s) {
+        char *e = s;
+
+        // skip separators, moving both s(tart) and e(nd)
+        while(isspace(*e) || *e == ',') s = ++e;
+
+        // move e(nd) to the first separator
+        while(*e && !isspace(*e) && *e != ',') e++;
+
+        // is there anything?
+        if(!*s || s == e) break;
+
+        char buf[e - s + 1];
+        strncpyz(buf, s, e - s);
+        bind_to_this(sockets, buf, sockets->default_port, sockets->backlog);
+
+        s = e;
+    }
+
+    if(sockets->failed) {
+        size_t i;
+        for(i = 0; i < sockets->opened ;i++)
+            info("LISTENER: Listen socket %s opened successfully.", sockets->fds_names[i]);
+    }
+
+    return (int)sockets->opened;
+}
+
+
+// --------------------------------------------------------------------------------------------------------------------
+// connect to another host/port
+
+// connect_to_this_unix()
+// path        the path of the unix socket
+// timeout     the timeout for establishing a connection
+
+static inline int connect_to_unix(const char *path, struct timeval *timeout) {
+    int fd = socket(AF_UNIX, SOCK_STREAM, 0);
+    if(fd == -1) {
+        error("Failed to create UNIX socket() for '%s'", path);
+        return -1;
+    }
+
+    if(timeout) {
+        if(setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, (char *) timeout, sizeof(struct timeval)) < 0)
+            error("Failed to set timeout on UNIX socket '%s'", path);
+    }
+
+    struct sockaddr_un addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sun_family = AF_UNIX;
+    strncpy(addr.sun_path, path, sizeof(addr.sun_path)-1);
+
+    if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) == -1) {
+        error("Cannot connect to UNIX socket on path '%s'.", path);
+        close(fd);
+        return -1;
+    }
+
+    debug(D_CONNECT_TO, "Connected to UNIX socket on path '%s'.", path);
+
+    return fd;
+}
+
+// connect_to_this_ip46()
+// protocol    IPPROTO_TCP, IPPROTO_UDP
+// socktype    SOCK_STREAM, SOCK_DGRAM
+// host        the destination hostname or IP address (IPv4 or IPv6) to connect to
+//             if it resolves to many IPs, all are tried (IPv4 and IPv6)
+// scope_id    the if_index id of the interface to use for connecting (0 = any)
+//             (used only under IPv6)
+// service     the service name or port to connect to
+// timeout     the timeout for establishing a connection
+
+int connect_to_this_ip46(int protocol, int socktype, const char *host, uint32_t scope_id, const char *service, struct timeval *timeout) {
+    struct addrinfo hints;
+    struct addrinfo *ai_head = NULL, *ai = NULL;
+
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family   = PF_UNSPEC;   /* Allow IPv4 or IPv6 */
+    hints.ai_socktype = socktype;
+    hints.ai_protocol = protocol;
+
+    int ai_err = getaddrinfo(host, service, &hints, &ai_head);
+    if (ai_err != 0) {
+        error("Cannot resolve host '%s', port '%s': %s", host, service, gai_strerror(ai_err));
+        return -1;
+    }
+
+    int fd = -1;
+    for (ai = ai_head; ai != NULL && fd == -1; ai = ai->ai_next) {
+
+        if (ai->ai_family == PF_INET6) {
+            struct sockaddr_in6 *pSadrIn6 = (struct sockaddr_in6 *) ai->ai_addr;
+            if(pSadrIn6->sin6_scope_id == 0) {
+                pSadrIn6->sin6_scope_id = scope_id;
+            }
+        }
+
+        char hostBfr[NI_MAXHOST + 1];
+        char servBfr[NI_MAXSERV + 1];
+
+        getnameinfo(ai->ai_addr,
+                    ai->ai_addrlen,
+                    hostBfr,
+                    sizeof(hostBfr),
+                    servBfr,
+                    sizeof(servBfr),
+                    NI_NUMERICHOST | NI_NUMERICSERV);
+
+        debug(D_CONNECT_TO, "Address info: host = '%s', service = '%s', ai_flags = 0x%02X, ai_family = %d (PF_INET = %d, PF_INET6 = %d), ai_socktype = %d (SOCK_STREAM = %d, SOCK_DGRAM = %d), ai_protocol = %d (IPPROTO_TCP = %d, IPPROTO_UDP = %d), ai_addrlen = %lu (sockaddr_in = %lu, sockaddr_in6 = %lu)",
+              hostBfr,
+              servBfr,
+              (unsigned int)ai->ai_flags,
+              ai->ai_family,
+              PF_INET,
+              PF_INET6,
+              ai->ai_socktype,
+              SOCK_STREAM,
+              SOCK_DGRAM,
+              ai->ai_protocol,
+              IPPROTO_TCP,
+              IPPROTO_UDP,
+              (unsigned long)ai->ai_addrlen,
+              (unsigned long)sizeof(struct sockaddr_in),
+              (unsigned long)sizeof(struct sockaddr_in6));
+
+        switch (ai->ai_addr->sa_family) {
+            case PF_INET: {
+                struct sockaddr_in *pSadrIn = (struct sockaddr_in *)ai->ai_addr;
+                (void)pSadrIn;
+
+                debug(D_CONNECT_TO, "ai_addr = sin_family: %d (AF_INET = %d, AF_INET6 = %d), sin_addr: '%s', sin_port: '%s'",
+                      pSadrIn->sin_family,
+                      AF_INET,
+                      AF_INET6,
+                      hostBfr,
+                      servBfr);
+                break;
+            }
+
+            case PF_INET6: {
+                struct sockaddr_in6 *pSadrIn6 = (struct sockaddr_in6 *) ai->ai_addr;
+                (void)pSadrIn6;
+
+                debug(D_CONNECT_TO,"ai_addr = sin6_family: %d (AF_INET = %d, AF_INET6 = %d), sin6_addr: '%s', sin6_port: '%s', sin6_flowinfo: %u, sin6_scope_id: %u",
+                      pSadrIn6->sin6_family,
+                      AF_INET,
+                      AF_INET6,
+                      hostBfr,
+                      servBfr,
+                      pSadrIn6->sin6_flowinfo,
+                      pSadrIn6->sin6_scope_id);
+                break;
+            }
+
+            default: {
+                debug(D_CONNECT_TO, "Unknown protocol family %d.", ai->ai_family);
+                continue;
+            }
+        }
+
+        fd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
+        if(fd != -1) {
+            if(timeout) {
+                if(setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, (char *) timeout, sizeof(struct timeval)) < 0)
+                    error("Failed to set timeout on the socket to ip '%s' port '%s'", hostBfr, servBfr);
+            }
+
+            errno = 0;
+            if(connect(fd, ai->ai_addr, ai->ai_addrlen) < 0) {
+                if(errno == EALREADY || errno == EINPROGRESS) {
+                    info("Waiting for connection to ip %s port %s to be established", hostBfr, servBfr);
+
+                    fd_set fds;
+                    FD_ZERO(&fds);
+                    FD_SET(0, &fds);
+                    int rc = select (1, NULL, &fds, NULL, timeout);
+
+                    if(rc > 0 && FD_ISSET(fd, &fds)) {
+                        info("connect() to ip %s port %s completed successfully", hostBfr, servBfr);
+                    }
+                    else if(rc == -1) {
+                        error("Failed to connect to '%s', port '%s'. select() returned %d", hostBfr, servBfr, rc);
+                        close(fd);
+                        fd = -1;
+                    }
+                    else {
+                        error("Timed out while connecting to '%s', port '%s'. select() returned %d", hostBfr, servBfr, rc);
+                        close(fd);
+                        fd = -1;
+                    }
+                }
+                else {
+                    error("Failed to connect to '%s', port '%s'", hostBfr, servBfr);
+                    close(fd);
+                    fd = -1;
+                }
+            }
+
+            if(fd != -1)
+                debug(D_CONNECT_TO, "Connected to '%s' on port '%s'.", hostBfr, servBfr);
+        }
+    }
+
+    freeaddrinfo(ai_head);
+
+    return fd;
+}
+
+// connect_to_this()
+//
+// definition format:
+//
+//    [PROTOCOL:]IP[%INTERFACE][:PORT]
+//
+// PROTOCOL  = tcp or udp
+// IP        = IPv4 or IPv6 IP or hostname, optionally enclosed in [] (required for IPv6)
+// INTERFACE = for IPv6 only, the network interface to use
+// PORT      = port number or service name
+
+int connect_to_this(const char *definition, int default_port, struct timeval *timeout) {
+    char buffer[strlen(definition) + 1];
+    strcpy(buffer, definition);
+
+    char default_service[10 + 1];
+    snprintfz(default_service, 10, "%d", default_port);
+
+    char *host = buffer, *service = default_service, *interface = "";
+    int protocol = IPPROTO_TCP, socktype = SOCK_STREAM;
+    uint32_t scope_id = 0;
+
+    if(strncmp(host, "tcp:", 4) == 0) {
+        host += 4;
+        protocol = IPPROTO_TCP;
+        socktype = SOCK_STREAM;
+    }
+    else if(strncmp(host, "udp:", 4) == 0) {
+        host += 4;
+        protocol = IPPROTO_UDP;
+        socktype = SOCK_DGRAM;
+    }
+    else if(strncmp(host, "unix:", 5) == 0) {
+        char *path = host + 5;
+        return connect_to_unix(path, timeout);
+    }
+    else if(*host == '/') {
+        char *path = host;
+        return connect_to_unix(path, timeout);
+    }
+
+    char *e = host;
+    if(*e == '[') {
+        e = ++host;
+        while(*e && *e != ']') e++;
+        if(*e == ']') {
+            *e = '\0';
+            e++;
+        }
+    }
+    else {
+        while(*e && *e != ':' && *e != '%') e++;
+    }
+
+    if(*e == '%') {
+        *e = '\0';
+        e++;
+        interface = e;
+        while(*e && *e != ':') e++;
+    }
+
+    if(*e == ':') {
+        *e = '\0';
+        e++;
+        service = e;
+    }
+
+    debug(D_CONNECT_TO, "Attempting connection to host = '%s', service = '%s', interface = '%s', protocol = %d (tcp = %d, udp = %d)", host, service, interface, protocol, IPPROTO_TCP, IPPROTO_UDP);
+
+    if(!*host) {
+        error("Definition '%s' does not specify a host.", definition);
+        return -1;
+    }
+
+    if(*interface) {
+        scope_id = if_nametoindex(interface);
+        if(!scope_id)
+            error("Cannot find a network interface named '%s'. Continuing with limiting the network interface", interface);
+    }
+
+    if(!*service)
+        service = default_service;
+
+
+    return connect_to_this_ip46(protocol, socktype, host, scope_id, service, timeout);
+}
+
+void foreach_entry_in_connection_string(const char *destination, bool (*callback)(char *entry, void *data), void *data) {
+    const char *s = destination;
+    while(*s) {
+        const char *e = s;
+
+        // skip separators, moving both s(tart) and e(nd)
+        while(isspace(*e) || *e == ',') s = ++e;
+
+        // move e(nd) to the first separator
+        while(*e && !isspace(*e) && *e != ',') e++;
+
+        // is there anything?
+        if(!*s || s == e) break;
+
+        char buf[e - s + 1];
+        strncpyz(buf, s, e - s);
+
+        if(callback(buf, data)) break;
+
+        s = e;
+    }
+}
+
+struct connect_to_one_of_data {
+    int default_port;
+    struct timeval *timeout;
+    size_t *reconnects_counter;
+    char *connected_to;
+    size_t connected_to_size;
+    int sock;
+};
+
+static bool connect_to_one_of_callback(char *entry, void *data) {
+    struct connect_to_one_of_data *t = data;
+
+    if(t->reconnects_counter)
+        t->reconnects_counter++;
+
+    t->sock = connect_to_this(entry, t->default_port, t->timeout);
+    if(t->sock != -1) {
+        if(t->connected_to && t->connected_to_size) {
+            strncpyz(t->connected_to, entry, t->connected_to_size);
+            t->connected_to[t->connected_to_size - 1] = '\0';
+        }
+
+        return true;
+    }
+
+    return false;
+}
+
+int connect_to_one_of(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size) {
+    struct connect_to_one_of_data t = {
+        .default_port = default_port,
+        .timeout = timeout,
+        .reconnects_counter = reconnects_counter,
+        .connected_to = connected_to,
+        .connected_to_size = connected_to_size,
+        .sock = -1,
+    };
+
+    foreach_entry_in_connection_string(destination, connect_to_one_of_callback, &t);
+
+    return t.sock;
+}
+
+static bool connect_to_one_of_urls_callback(char *entry, void *data) {
+    char *s = strchr(entry, '/');
+    if(s) *s = '\0';
+
+    return connect_to_one_of_callback(entry, data);
+}
+
+int connect_to_one_of_urls(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size) {
+    struct connect_to_one_of_data t = {
+        .default_port = default_port,
+        .timeout = timeout,
+        .reconnects_counter = reconnects_counter,
+        .connected_to = connected_to,
+        .connected_to_size = connected_to_size,
+        .sock = -1,
+    };
+
+    foreach_entry_in_connection_string(destination, connect_to_one_of_urls_callback, &t);
+
+    return t.sock;
+}
+
+
+#ifdef ENABLE_HTTPS
+ssize_t netdata_ssl_read(SSL *ssl, void *buf, size_t num) {
+    error_limit_static_thread_var(erl, 1, 0);
+
+    int bytes, err, retries = 0;
+
+    //do {
+        bytes = SSL_read(ssl, buf, (int)num);
+        err = SSL_get_error(ssl, bytes);
+        retries++;
+    //} while (bytes <= 0 && (err == SSL_ERROR_WANT_READ));
+
+    if(unlikely(bytes <= 0))
+        error("SSL_read() returned %d bytes, SSL error %d", bytes, err);
+
+    if(retries > 1)
+        error_limit(&erl, "SSL_read() retried %d times", retries);
+
+    return bytes;
+}
+
+ssize_t netdata_ssl_write(SSL *ssl, const void *buf, size_t num) {
+    error_limit_static_thread_var(erl, 1, 0);
+
+    int bytes, err, retries = 0;
+    size_t total = 0;
+
+    //do {
+        bytes = SSL_write(ssl, (uint8_t *)buf + total, (int)(num - total));
+        err = SSL_get_error(ssl, bytes);
+        retries++;
+
+        if(bytes > 0)
+            total += bytes;
+
+    //} while ((bytes <= 0 && (err == SSL_ERROR_WANT_WRITE)) || (bytes > 0 && total < num));
+
+    if(unlikely(bytes <= 0))
+        error("SSL_write() returned %d bytes, SSL error %d", bytes, err);
+
+    if(retries > 1)
+        error_limit(&erl, "SSL_write() retried %d times", retries);
+
+    return bytes;
+}
+#endif
+
+// --------------------------------------------------------------------------------------------------------------------
+// helpers to send/receive data in one call, in blocking mode, with a timeout
+
+#ifdef ENABLE_HTTPS
+ssize_t recv_timeout(struct netdata_ssl *ssl,int sockfd, void *buf, size_t len, int flags, int timeout) {
+#else
+ssize_t recv_timeout(int sockfd, void *buf, size_t len, int flags, int timeout) {
+#endif
+
+    for(;;) {
+        struct pollfd fd = {
+                .fd = sockfd,
+                .events = POLLIN,
+                .revents = 0
+        };
+
+        errno = 0;
+        int retval = poll(&fd, 1, timeout * 1000);
+
+        if(retval == -1) {
+            // failed
+
+            if(errno == EINTR || errno == EAGAIN)
+                continue;
+
+            return -1;
+        }
+
+        if(!retval) {
+            // timeout
+            return 0;
+        }
+
+        if(fd.events & POLLIN) break;
+    }
+
+#ifdef ENABLE_HTTPS
+    if (ssl->conn && ssl->flags == NETDATA_SSL_HANDSHAKE_COMPLETE)
+        return netdata_ssl_read(ssl->conn, buf, len);
+#endif
+
+    return recv(sockfd, buf, len, flags);
+}
+
+#ifdef ENABLE_HTTPS
+ssize_t send_timeout(struct netdata_ssl *ssl,int sockfd, void *buf, size_t len, int flags, int timeout) {
+#else
+ssize_t send_timeout(int sockfd, void *buf, size_t len, int flags, int timeout) {
+#endif
+
+    for(;;) {
+        struct pollfd fd = {
+                .fd = sockfd,
+                .events = POLLOUT,
+                .revents = 0
+        };
+
+        errno = 0;
+        int retval = poll(&fd, 1, timeout * 1000);
+
+        if(retval == -1) {
+            // failed
+
+            if(errno == EINTR || errno == EAGAIN)
+                continue;
+
+            return -1;
+        }
+
+        if(!retval) {
+            // timeout
+            return 0;
+        }
+
+        if(fd.events & POLLOUT) break;
+    }
+
+#ifdef ENABLE_HTTPS
+    if(ssl->conn) {
+        if (ssl->flags == NETDATA_SSL_HANDSHAKE_COMPLETE) {
+            return netdata_ssl_write(ssl->conn, buf, len);
+        }
+        else {
+            error("cannot write to SSL connection - connection is not ready.");
+            return -1;
+        }
+    }
+#endif
+    return send(sockfd, buf, len, flags);
+}
+
+
+// --------------------------------------------------------------------------------------------------------------------
+// accept4() replacement for systems that do not have one
+
+#ifndef HAVE_ACCEPT4
+int accept4(int sock, struct sockaddr *addr, socklen_t *addrlen, int flags) {
+    int fd = accept(sock, addr, addrlen);
+    int newflags = 0;
+
+    if (fd < 0) return fd;
+
+    if (flags & SOCK_NONBLOCK) {
+        newflags |= O_NONBLOCK;
+        flags &= ~SOCK_NONBLOCK;
+    }
+
+#ifdef SOCK_CLOEXEC
+#ifdef O_CLOEXEC
+    if (flags & SOCK_CLOEXEC) {
+        newflags |= O_CLOEXEC;
+        flags &= ~SOCK_CLOEXEC;
+    }
+#endif
+#endif
+
+    if (flags) {
+        close(fd);
+        errno = EINVAL;
+        return -1;
+    }
+
+    if (fcntl(fd, F_SETFL, newflags) < 0) {
+        int saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        return -1;
+    }
+
+    return fd;
+}
+#endif
+
+/*
+ * ---------------------------------------------------------------------------------------------------------------------
+ * connection_allowed() - if there is an access list then check the connection matches a pattern.
+ *                        Numeric patterns are checked against the IP address first, only if they
+ *                        do not match is the hostname resolved (reverse-DNS) and checked. If the
+ *                        hostname matches then we perform forward DNS resolution to check the IP
+ *                        is really associated with the DNS record. This call is repeatable: the
+ *                        web server may check more refined matches against the connection. Will
+ *                        update the client_host if uninitialized - ensure the hostsize is the number
+ *                        of *writable* bytes (i.e. be aware of the strdup used to compact the pollinfo).
+ */
+extern int connection_allowed(int fd, char *client_ip, char *client_host, size_t hostsize, SIMPLE_PATTERN *access_list,
+                              const char *patname, int allow_dns)
+{
+    debug(D_LISTENER,"checking %s... (allow_dns=%d)", patname, allow_dns);
+    if (!access_list)
+        return 1;
+    if (simple_pattern_matches(access_list, client_ip))
+        return 1;
+    // If the hostname is unresolved (and needed) then attempt the DNS lookups.
+    //if (client_host[0]==0 && simple_pattern_is_potential_name(access_list))
+    if (client_host[0]==0 && allow_dns)
+    {
+        struct sockaddr_storage sadr;
+        socklen_t addrlen = sizeof(sadr);
+        int err = getpeername(fd, (struct sockaddr*)&sadr, &addrlen);
+        if (err != 0 ||
+            (err = getnameinfo((struct sockaddr *)&sadr, addrlen, client_host, (socklen_t)hostsize,
+                              NULL, 0, NI_NAMEREQD)) != 0) {
+            error("Incoming %s on '%s' does not match a numeric pattern, and host could not be resolved (err=%s)",
+                  patname, client_ip, gai_strerror(err));
+            if (hostsize >= 8)
+                strcpy(client_host,"UNKNOWN");
+            return 0;
+        }
+        struct addrinfo *addr_infos = NULL;
+        if (getaddrinfo(client_host, NULL, NULL, &addr_infos) !=0 ) {
+            error("LISTENER: cannot validate hostname '%s' from '%s' by resolving it",
+                  client_host, client_ip);
+            if (hostsize >= 8)
+                strcpy(client_host,"UNKNOWN");
+            return 0;
+        }
+        struct addrinfo *scan = addr_infos;
+        int    validated = 0;
+        while (scan) {
+            char address[INET6_ADDRSTRLEN];
+            address[0] = 0;
+            switch (scan->ai_addr->sa_family) {
+                case AF_INET:
+                    inet_ntop(AF_INET, &((struct sockaddr_in*)(scan->ai_addr))->sin_addr, address, INET6_ADDRSTRLEN);
+                    break;
+                case AF_INET6:
+                    inet_ntop(AF_INET6, &((struct sockaddr_in6*)(scan->ai_addr))->sin6_addr, address, INET6_ADDRSTRLEN);
+                    break;
+            }
+            debug(D_LISTENER, "Incoming ip %s rev-resolved onto %s, validating against forward-resolution %s",
+                  client_ip, client_host, address);
+            if (!strcmp(client_ip, address)) {
+                validated = 1;
+                break;
+            }
+            scan = scan->ai_next;
+        }
+        if (!validated) {
+            error("LISTENER: Cannot validate '%s' as ip of '%s', not listed in DNS", client_ip, client_host);
+            if (hostsize >= 8)
+                strcpy(client_host,"UNKNOWN");
+        }
+        if (addr_infos!=NULL)
+            freeaddrinfo(addr_infos);
+    }
+    if (!simple_pattern_matches(access_list, client_host)) {
+        debug(D_LISTENER, "Incoming connection on '%s' (%s) does not match allowed pattern for %s",
+              client_ip, client_host, patname);
+        return 0;
+    }
+    return 1;
+}
+
+// --------------------------------------------------------------------------------------------------------------------
+// accept_socket() - accept a socket and store client IP and port
+int accept_socket(int fd, int flags, char *client_ip, size_t ipsize, char *client_port, size_t portsize,
+                  char *client_host, size_t hostsize, SIMPLE_PATTERN *access_list, int allow_dns) {
+    struct sockaddr_storage sadr;
+    socklen_t addrlen = sizeof(sadr);
+
+    int nfd = accept4(fd, (struct sockaddr *)&sadr, &addrlen, flags);
+    if (likely(nfd >= 0)) {
+        if (getnameinfo((struct sockaddr *)&sadr, addrlen, client_ip, (socklen_t)ipsize,
+                        client_port, (socklen_t)portsize, NI_NUMERICHOST | NI_NUMERICSERV) != 0) {
+            error("LISTENER: cannot getnameinfo() on received client connection.");
+            strncpyz(client_ip, "UNKNOWN", ipsize);
+            strncpyz(client_port, "UNKNOWN", portsize);
+        }
+        if (!strcmp(client_ip, "127.0.0.1") || !strcmp(client_ip, "::1")) {
+            strncpyz(client_ip, "localhost", ipsize);
+        }
+
+#ifdef __FreeBSD__
+        if(((struct sockaddr *)&sadr)->sa_family == AF_LOCAL)
+            strncpyz(client_ip, "localhost", ipsize);
+#endif
+
+        client_ip[ipsize - 1] = '\0';
+        client_port[portsize - 1] = '\0';
+
+        switch (((struct sockaddr *)&sadr)->sa_family) {
+            case AF_UNIX:
+                debug(D_LISTENER, "New UNIX domain web client from %s on socket %d.", client_ip, fd);
+                // set the port - certain versions of libc return garbage on unix sockets
+                strncpyz(client_port, "UNIX", portsize);
+                break;
+
+            case AF_INET:
+                debug(D_LISTENER, "New IPv4 web client from %s port %s on socket %d.", client_ip, client_port, fd);
+                break;
+
+            case AF_INET6:
+                if (strncmp(client_ip, "::ffff:", 7) == 0) {
+                    memmove(client_ip, &client_ip[7], strlen(&client_ip[7]) + 1);
+                    debug(D_LISTENER, "New IPv4 web client from %s port %s on socket %d.", client_ip, client_port, fd);
+                }
+                else
+                    debug(D_LISTENER, "New IPv6 web client from %s port %s on socket %d.", client_ip, client_port, fd);
+                break;
+
+            default:
+                debug(D_LISTENER, "New UNKNOWN web client from %s port %s on socket %d.", client_ip, client_port, fd);
+                break;
+        }
+        if (!connection_allowed(nfd, client_ip, client_host, hostsize, access_list, "connection", allow_dns)) {
+            errno = 0;
+            error("Permission denied for client '%s', port '%s'", client_ip, client_port);
+            close(nfd);
+            nfd = -1;
+            errno = EPERM;
+        }
+    }
+#ifdef HAVE_ACCEPT4
+    else if (errno == ENOSYS)
+        error("netdata has been compiled with the assumption that the system has the accept4() call, but it is not here. Recompile netdata like this: ./configure --disable-accept4 ...");
+#endif
+
+    return nfd;
+}
+
+
+// --------------------------------------------------------------------------------------------------------------------
+// poll() based listener
+// this should be the fastest possible listener for up to 100 sockets
+// above 100, an epoll() interface is needed on Linux
+
+#define POLL_FDS_INCREASE_STEP 10
+
+inline POLLINFO *poll_add_fd(POLLJOB *p
+                             , int fd
+                             , int socktype
+                             , WEB_CLIENT_ACL port_acl
+                             , uint32_t flags
+                             , const char *client_ip
+                             , const char *client_port
+                             , const char *client_host
+                             , void *(*add_callback)(POLLINFO * /*pi*/, short int * /*events*/, void * /*data*/)
+                             , void  (*del_callback)(POLLINFO * /*pi*/)
+                             , int   (*rcv_callback)(POLLINFO * /*pi*/, short int * /*events*/)
+                             , int   (*snd_callback)(POLLINFO * /*pi*/, short int * /*events*/)
+                             , void *data
+) {
+    debug(D_POLLFD, "POLLFD: ADD: request to add fd %d, slots = %zu, used = %zu, min = %zu, max = %zu, next free = %zd", fd, p->slots, p->used, p->min, p->max, p->first_free?(ssize_t)p->first_free->slot:(ssize_t)-1);
+
+    if(unlikely(fd < 0)) return NULL;
+
+    //if(p->limit && p->used >= p->limit) {
+    //    info("Max sockets limit reached (%zu sockets), dropping connection", p->used);
+    //    close(fd);
+    //    return NULL;
+    //}
+
+    if(unlikely(!p->first_free)) {
+        size_t new_slots = p->slots + POLL_FDS_INCREASE_STEP;
+        debug(D_POLLFD, "POLLFD: ADD: increasing size (current = %zu, new = %zu, used = %zu, min = %zu, max = %zu)", p->slots, new_slots, p->used, p->min, p->max);
+
+        p->fds = reallocz(p->fds, sizeof(struct pollfd) * new_slots);
+        p->inf = reallocz(p->inf, sizeof(POLLINFO) * new_slots);
+
+        // reset all the newly added slots
+        ssize_t i;
+        for(i = new_slots - 1; i >= (ssize_t)p->slots ; i--) {
+            debug(D_POLLFD, "POLLFD: ADD: resetting new slot %zd", i);
+            p->fds[i].fd = -1;
+            p->fds[i].events = 0;
+            p->fds[i].revents = 0;
+
+            p->inf[i].p = p;
+            p->inf[i].slot = (size_t)i;
+            p->inf[i].flags = 0;
+            p->inf[i].socktype = -1;
+            p->inf[i].port_acl = -1;
+
+            p->inf[i].client_ip = NULL;
+            p->inf[i].client_port = NULL;
+            p->inf[i].client_host = NULL;
+            p->inf[i].del_callback = p->del_callback;
+            p->inf[i].rcv_callback = p->rcv_callback;
+            p->inf[i].snd_callback = p->snd_callback;
+            p->inf[i].data = NULL;
+
+            // link them so that the first free will be earlier in the array
+            // (we loop decrementing i)
+            p->inf[i].next = p->first_free;
+            p->first_free = &p->inf[i];
+        }
+
+        p->slots = new_slots;
+    }
+
+    POLLINFO *pi = p->first_free;
+    p->first_free = p->first_free->next;
+
+    debug(D_POLLFD, "POLLFD: ADD: selected slot %zu, next free is %zd", pi->slot, p->first_free?(ssize_t)p->first_free->slot:(ssize_t)-1);
+
+    struct pollfd *pf = &p->fds[pi->slot];
+    pf->fd = fd;
+    pf->events = POLLIN;
+    pf->revents = 0;
+
+    pi->fd = fd;
+    pi->p = p;
+    pi->socktype = socktype;
+    pi->port_acl = port_acl;
+    pi->flags = flags;
+    pi->next = NULL;
+    pi->client_ip   = strdupz(client_ip);
+    pi->client_port = strdupz(client_port);
+    pi->client_host = strdupz(client_host);
+
+    pi->del_callback = del_callback;
+    pi->rcv_callback = rcv_callback;
+    pi->snd_callback = snd_callback;
+
+    pi->connected_t = now_boottime_sec();
+    pi->last_received_t = 0;
+    pi->last_sent_t = 0;
+    pi->last_sent_t = 0;
+    pi->recv_count = 0;
+    pi->send_count = 0;
+
+    netdata_thread_disable_cancelability();
+    p->used++;
+    if(unlikely(pi->slot > p->max))
+        p->max = pi->slot;
+
+    if(pi->flags & POLLINFO_FLAG_CLIENT_SOCKET) {
+        pi->data = add_callback(pi, &pf->events, data);
+    }
+
+    if(pi->flags & POLLINFO_FLAG_SERVER_SOCKET) {
+        p->min = pi->slot;
+    }
+    netdata_thread_enable_cancelability();
+
+    debug(D_POLLFD, "POLLFD: ADD: completed, slots = %zu, used = %zu, min = %zu, max = %zu, next free = %zd", p->slots, p->used, p->min, p->max, p->first_free?(ssize_t)p->first_free->slot:(ssize_t)-1);
+
+    return pi;
+}
+
+inline void poll_close_fd(POLLINFO *pi) {
+    POLLJOB *p = pi->p;
+
+    struct pollfd *pf = &p->fds[pi->slot];
+    debug(D_POLLFD, "POLLFD: DEL: request to clear slot %zu (fd %d), old next free was %zd", pi->slot, pf->fd, p->first_free?(ssize_t)p->first_free->slot:(ssize_t)-1);
+
+    if(unlikely(pf->fd == -1)) return;
+
+    netdata_thread_disable_cancelability();
+
+    if(pi->flags & POLLINFO_FLAG_CLIENT_SOCKET) {
+        pi->del_callback(pi);
+
+        if(likely(!(pi->flags & POLLINFO_FLAG_DONT_CLOSE))) {
+            if(close(pf->fd) == -1)
+                error("Failed to close() poll_events() socket %d", pf->fd);
+        }
+    }
+
+    pf->fd = -1;
+    pf->events = 0;
+    pf->revents = 0;
+
+    pi->fd = -1;
+    pi->socktype = -1;
+    pi->flags = 0;
+    pi->data = NULL;
+
+    pi->del_callback = NULL;
+    pi->rcv_callback = NULL;
+    pi->snd_callback = NULL;
+
+    freez(pi->client_ip);
+    pi->client_ip = NULL;
+
+    freez(pi->client_port);
+    pi->client_port = NULL;
+
+    freez(pi->client_host);
+    pi->client_host = NULL;
+
+    pi->next = p->first_free;
+    p->first_free = pi;
+
+    p->used--;
+    if(unlikely(p->max == pi->slot)) {
+        p->max = p->min;
+        ssize_t i;
+        for(i = (ssize_t)pi->slot; i > (ssize_t)p->min ;i--) {
+            if (unlikely(p->fds[i].fd != -1)) {
+                p->max = (size_t)i;
+                break;
+            }
+        }
+    }
+    netdata_thread_enable_cancelability();
+
+    debug(D_POLLFD, "POLLFD: DEL: completed, slots = %zu, used = %zu, min = %zu, max = %zu, next free = %zd", p->slots, p->used, p->min, p->max, p->first_free?(ssize_t)p->first_free->slot:(ssize_t)-1);
+}
+
+void *poll_default_add_callback(POLLINFO *pi, short int *events, void *data) {
+    (void)pi;
+    (void)events;
+    (void)data;
+
+    // error("POLLFD: internal error: poll_default_add_callback() called");
+
+    return NULL;
+}
+
+void poll_default_del_callback(POLLINFO *pi) {
+    if(pi->data)
+        error("POLLFD: internal error: del_callback_default() called with data pointer - possible memory leak");
+}
+
+int poll_default_rcv_callback(POLLINFO *pi, short int *events) {
+    *events |= POLLIN;
+
+    char buffer[1024 + 1];
+
+    ssize_t rc;
+    do {
+        rc = recv(pi->fd, buffer, 1024, MSG_DONTWAIT);
+        if (rc < 0) {
+            // read failed
+            if (errno != EWOULDBLOCK && errno != EAGAIN) {
+                error("POLLFD: poll_default_rcv_callback(): recv() failed with %zd.", rc);
+                return -1;
+            }
+        } else if (rc) {
+            // data received
+            info("POLLFD: internal error: poll_default_rcv_callback() is discarding %zd bytes received on socket %d", rc, pi->fd);
+        }
+    } while (rc != -1);
+
+    return 0;
+}
+
+int poll_default_snd_callback(POLLINFO *pi, short int *events) {
+    *events &= ~POLLOUT;
+
+    info("POLLFD: internal error: poll_default_snd_callback(): nothing to send on socket %d", pi->fd);
+    return 0;
+}
+
+void poll_default_tmr_callback(void *timer_data) {
+    (void)timer_data;
+}
+
+static void poll_events_cleanup(void *data) {
+    POLLJOB *p = (POLLJOB *)data;
+
+    size_t i;
+    for(i = 0 ; i <= p->max ; i++) {
+        POLLINFO *pi = &p->inf[i];
+        poll_close_fd(pi);
+    }
+
+    freez(p->fds);
+    freez(p->inf);
+}
+
+static int poll_process_error(POLLINFO *pi, struct pollfd *pf, short int revents) {
+    error("POLLFD: LISTENER: received %s %s %s on socket at slot %zu (fd %d) client '%s' port '%s' expecting %s %s %s, having %s %s %s"
+          , revents & POLLERR  ? "POLLERR" : ""
+          , revents & POLLHUP  ? "POLLHUP" : ""
+          , revents & POLLNVAL ? "POLLNVAL" : ""
+          , pi->slot
+          , pi->fd
+          , pi->client_ip ? pi->client_ip : "<undefined-ip>"
+          , pi->client_port ? pi->client_port : "<undefined-port>"
+          , pf->events & POLLIN ? "POLLIN" : "", pf->events & POLLOUT ? "POLLOUT" : "", pf->events & POLLPRI ? "POLLPRI" : ""
+          , revents & POLLIN ? "POLLIN" : "", revents & POLLOUT ? "POLLOUT" : "", revents & POLLPRI ? "POLLPRI" : ""
+          );
+
+    pf->events = 0;
+    poll_close_fd(pi);
+    return 1;
+}
+
+static inline int poll_process_send(POLLJOB *p, POLLINFO *pi, struct pollfd *pf, time_t now) {
+    pi->last_sent_t = now;
+    pi->send_count++;
+
+    debug(D_POLLFD, "POLLFD: LISTENER: sending data to socket on slot %zu (fd %d)", pi->slot, pf->fd);
+
+    pf->events = 0;
+
+    // remember the slot, in case we need to close it later
+    // the callback may manipulate the socket list and our pf and pi pointers may be invalid after that call
+    size_t slot = pi->slot;
+
+    if (unlikely(pi->snd_callback(pi, &pf->events) == -1))
+        poll_close_fd(&p->inf[slot]);
+
+    // IMPORTANT:
+    // pf and pi may be invalid below this point, they may have been reallocated.
+
+    return 1;
+}
+
+static inline int poll_process_tcp_read(POLLJOB *p, POLLINFO *pi, struct pollfd *pf, time_t now) {
+    pi->last_received_t = now;
+    pi->recv_count++;
+
+    debug(D_POLLFD, "POLLFD: LISTENER: reading data from TCP client slot %zu (fd %d)", pi->slot, pf->fd);
+
+    pf->events = 0;
+
+    // remember the slot, in case we need to close it later
+    // the callback may manipulate the socket list and our pf and pi pointers may be invalid after that call
+    size_t slot = pi->slot;
+
+    if (pi->rcv_callback(pi, &pf->events) == -1)
+        poll_close_fd(&p->inf[slot]);
+
+    // IMPORTANT:
+    // pf and pi may be invalid below this point, they may have been reallocated.
+
+    return 1;
+}
+
+static inline int poll_process_udp_read(POLLINFO *pi, struct pollfd *pf, time_t now __maybe_unused) {
+    pi->last_received_t = now;
+    pi->recv_count++;
+
+    debug(D_POLLFD, "POLLFD: LISTENER: reading data from UDP slot %zu (fd %d)", pi->slot, pf->fd);
+
+    // TODO: access_list is not applied to UDP
+    // but checking the access list on every UDP packet will destroy
+    // performance, especially for statsd.
+
+    pf->events = 0;
+    if(pi->rcv_callback(pi, &pf->events) == -1)
+        return 0;
+
+    // IMPORTANT:
+    // pf and pi may be invalid below this point, they may have been reallocated.
+
+    return 1;
+}
+
+static int poll_process_new_tcp_connection(POLLJOB *p, POLLINFO *pi, struct pollfd *pf, time_t now) {
+    pi->last_received_t = now;
+    pi->recv_count++;
+
+    debug(D_POLLFD, "POLLFD: LISTENER: accepting connections from slot %zu (fd %d)", pi->slot, pf->fd);
+
+    char client_ip[INET6_ADDRSTRLEN] = "";
+    char client_port[NI_MAXSERV] = "";
+    char client_host[NI_MAXHOST] = "";
+
+    debug(D_POLLFD, "POLLFD: LISTENER: calling accept4() slot %zu (fd %d)", pi->slot, pf->fd);
+
+    int nfd = accept_socket(
+        pf->fd,SOCK_NONBLOCK,
+        client_ip, INET6_ADDRSTRLEN, client_port,NI_MAXSERV, client_host, NI_MAXHOST,
+        p->access_list, p->allow_dns
+        );
+
+    if (unlikely(nfd < 0)) {
+        // accept failed
+
+        debug(D_POLLFD, "POLLFD: LISTENER: accept4() slot %zu (fd %d) failed.", pi->slot, pf->fd);
+
+        if(unlikely(errno == EMFILE)) {
+            error_limit_static_global_var(erl, 10, 1000);
+            error_limit(&erl, "POLLFD: LISTENER: too many open files - used by this thread %zu, max for this thread %zu",
+                      p->used, p->limit);
+        }
+        else if(unlikely(errno != EWOULDBLOCK && errno != EAGAIN))
+            error("POLLFD: LISTENER: accept() failed.");
+
+    }
+    else {
+        // accept ok
+
+        poll_add_fd(p
+                    , nfd
+                    , SOCK_STREAM
+                    , pi->port_acl
+                    , POLLINFO_FLAG_CLIENT_SOCKET
+                    , client_ip
+                    , client_port
+                    , client_host
+                    , p->add_callback
+                    , p->del_callback
+                    , p->rcv_callback
+                    , p->snd_callback
+                    , NULL
+        );
+
+        // IMPORTANT:
+        // pf and pi may be invalid below this point, they may have been reallocated.
+
+        return 1;
+    }
+
+    return 0;
+}
+
+void poll_events(LISTEN_SOCKETS *sockets
+        , void *(*add_callback)(POLLINFO * /*pi*/, short int * /*events*/, void * /*data*/)
+        , void  (*del_callback)(POLLINFO * /*pi*/)
+        , int   (*rcv_callback)(POLLINFO * /*pi*/, short int * /*events*/)
+        , int   (*snd_callback)(POLLINFO * /*pi*/, short int * /*events*/)
+        , void  (*tmr_callback)(void * /*timer_data*/)
+        , SIMPLE_PATTERN *access_list
+        , int allow_dns
+        , void *data
+        , time_t tcp_request_timeout_seconds
+        , time_t tcp_idle_timeout_seconds
+        , time_t timer_milliseconds
+        , void *timer_data
+        , size_t max_tcp_sockets
+) {
+    if(!sockets || !sockets->opened) {
+        error("POLLFD: internal error: no listening sockets are opened");
+        return;
+    }
+
+    if(timer_milliseconds <= 0) timer_milliseconds = 0;
+
+    int retval;
+
+    POLLJOB p = {
+            .slots = 0,
+            .used = 0,
+            .max = 0,
+            .limit = max_tcp_sockets,
+            .fds = NULL,
+            .inf = NULL,
+            .first_free = NULL,
+
+            .complete_request_timeout = tcp_request_timeout_seconds,
+            .idle_timeout = tcp_idle_timeout_seconds,
+            .checks_every = (tcp_idle_timeout_seconds / 3) + 1,
+
+            .access_list = access_list,
+            .allow_dns   = allow_dns,
+
+            .timer_milliseconds = timer_milliseconds,
+            .timer_data = timer_data,
+
+            .add_callback = add_callback?add_callback:poll_default_add_callback,
+            .del_callback = del_callback?del_callback:poll_default_del_callback,
+            .rcv_callback = rcv_callback?rcv_callback:poll_default_rcv_callback,
+            .snd_callback = snd_callback?snd_callback:poll_default_snd_callback,
+            .tmr_callback = tmr_callback?tmr_callback:poll_default_tmr_callback
+    };
+
+    size_t i;
+    for(i = 0; i < sockets->opened ;i++) {
+
+        POLLINFO *pi = poll_add_fd(&p
+                                   , sockets->fds[i]
+                                   , sockets->fds_types[i]
+                                   , sockets->fds_acl_flags[i]
+                                   , POLLINFO_FLAG_SERVER_SOCKET
+                                   , (sockets->fds_names[i])?sockets->fds_names[i]:"UNKNOWN"
+                                   , ""
+                                   , ""
+                                   , p.add_callback
+                                   , p.del_callback
+                                   , p.rcv_callback
+                                   , p.snd_callback
+                                   , NULL
+        );
+
+        pi->data = data;
+        info("POLLFD: LISTENER: listening on '%s'", (sockets->fds_names[i])?sockets->fds_names[i]:"UNKNOWN");
+    }
+
+    int listen_sockets_active = 1;
+
+    int timeout_ms = 1000; // in milliseconds
+    time_t last_check = now_boottime_sec();
+
+    usec_t timer_usec = timer_milliseconds * USEC_PER_MS;
+    usec_t now_usec = 0, next_timer_usec = 0, last_timer_usec = 0;
+    (void)last_timer_usec;
+
+    if(unlikely(timer_usec)) {
+        now_usec = now_boottime_usec();
+        next_timer_usec = now_usec - (now_usec % timer_usec) + timer_usec;
+    }
+
+    netdata_thread_cleanup_push(poll_events_cleanup, &p);
+
+    while(!netdata_exit) {
+        if(unlikely(timer_usec)) {
+            now_usec = now_boottime_usec();
+
+            if(unlikely(timer_usec && now_usec >= next_timer_usec)) {
+                debug(D_POLLFD, "Calling timer callback after %zu usec", (size_t)(now_usec - last_timer_usec));
+                last_timer_usec = now_usec;
+                p.tmr_callback(p.timer_data);
+                now_usec = now_boottime_usec();
+                next_timer_usec = now_usec - (now_usec % timer_usec) + timer_usec;
+            }
+
+            usec_t dt_usec = next_timer_usec - now_usec;
+            if(dt_usec < 1000 * USEC_PER_MS)
+                timeout_ms = 1000;
+            else
+                timeout_ms = (int)(dt_usec / USEC_PER_MS);
+        }
+
+        // enable or disable the TCP listening sockets, based on the current number of sockets used and the limit set
+        if((listen_sockets_active && (p.limit && p.used >= p.limit)) || (!listen_sockets_active && (!p.limit || p.used < p.limit))) {
+            listen_sockets_active = !listen_sockets_active;
+            info("%s listening sockets (used TCP sockets %zu, max allowed for this worker %zu)", (listen_sockets_active)?"ENABLING":"DISABLING", p.used, p.limit);
+            for (i = 0; i <= p.max; i++) {
+                if(p.inf[i].flags & POLLINFO_FLAG_SERVER_SOCKET && p.inf[i].socktype == SOCK_STREAM) {
+                    p.fds[i].events = (short int) ((listen_sockets_active) ? POLLIN : 0);
+                }
+            }
+        }
+
+        debug(D_POLLFD, "POLLFD: LISTENER: Waiting on %zu sockets for %zu ms...", p.max + 1, (size_t)timeout_ms);
+        retval = poll(p.fds, p.max + 1, timeout_ms);
+        time_t now = now_boottime_sec();
+
+        if(unlikely(retval == -1)) {
+            error("POLLFD: LISTENER: poll() failed while waiting on %zu sockets.", p.max + 1);
+            break;
+        }
+        else if(unlikely(!retval)) {
+            debug(D_POLLFD, "POLLFD: LISTENER: poll() timeout.");
+        }
+        else {
+            POLLINFO *pi;
+            struct pollfd *pf;
+            size_t idx, processed = 0;
+            short int revents;
+
+            // keep fast lookup arrays per function
+            // to avoid looping through the entire list every time
+            size_t sends[p.max + 1], sends_max = 0;
+            size_t reads[p.max + 1], reads_max = 0;
+            size_t conns[p.max + 1], conns_max = 0;
+            size_t udprd[p.max + 1], udprd_max = 0;
+
+            for (i = 0; i <= p.max; i++) {
+                pi = &p.inf[i];
+                pf = &p.fds[i];
+                revents = pf->revents;
+
+                if(unlikely(revents == 0 || pf->fd == -1))
+                    continue;
+
+                if (unlikely(revents & (POLLERR|POLLHUP|POLLNVAL))) {
+                    // something is wrong to one of our sockets
+
+                    pf->revents = 0;
+                    processed += poll_process_error(pi, pf, revents);
+                }
+                else if (likely(revents & POLLOUT)) {
+                    // a client is ready to receive data
+
+                    sends[sends_max++] = i;
+                }
+                else if (likely(revents & (POLLIN|POLLPRI))) {
+                    if (pi->flags & POLLINFO_FLAG_CLIENT_SOCKET) {
+                        // a client sent data to us
+
+                        reads[reads_max++] = i;
+                    }
+                    else if (pi->flags & POLLINFO_FLAG_SERVER_SOCKET) {
+                        // something is coming to our server sockets
+
+                        if(pi->socktype == SOCK_DGRAM) {
+                            // UDP receive, directly on our listening socket
+
+                            udprd[udprd_max++] = i;
+                        }
+                        else if(pi->socktype == SOCK_STREAM) {
+                            // new TCP connection
+
+                            conns[conns_max++] = i;
+                        }
+                        else
+                            error("POLLFD: LISTENER: server slot %zu (fd %d) connection from %s port %s using unhandled socket type %d."
+                                 , i
+                                 , pi->fd
+                                 , pi->client_ip ? pi->client_ip : "<undefined-ip>"
+                                 , pi->client_port ? pi->client_port : "<undefined-port>"
+                                 , pi->socktype
+                            );
+                    }
+                    else
+                        error("POLLFD: LISTENER: client slot %zu (fd %d) data from %s port %s using flags %08X is neither client nor server."
+                              , i
+                              , pi->fd
+                              , pi->client_ip ? pi->client_ip : "<undefined-ip>"
+                              , pi->client_port ? pi->client_port : "<undefined-port>"
+                              , pi->flags
+                        );
+                }
+                else
+                    error("POLLFD: LISTENER: socket slot %zu (fd %d) client %s port %s unhandled event id %d."
+                      , i
+                      , pi->fd
+                      , pi->client_ip ? pi->client_ip : "<undefined-ip>"
+                      , pi->client_port ? pi->client_port : "<undefined-port>"
+                      , revents
+                );
+            }
+
+            // process sends
+            for (idx = 0; idx < sends_max; idx++) {
+                i = sends[idx];
+                pi = &p.inf[i];
+                pf = &p.fds[i];
+                pf->revents = 0;
+                processed += poll_process_send(&p, pi, pf, now);
+            }
+
+            // process UDP reads
+            for (idx = 0; idx < udprd_max; idx++) {
+                i = udprd[idx];
+                pi = &p.inf[i];
+                pf = &p.fds[i];
+                pf->revents = 0;
+                processed += poll_process_udp_read(pi, pf, now);
+            }
+
+            // process TCP reads
+            for (idx = 0; idx < reads_max; idx++) {
+                i = reads[idx];
+                pi = &p.inf[i];
+                pf = &p.fds[i];
+                pf->revents = 0;
+                processed += poll_process_tcp_read(&p, pi, pf, now);
+            }
+
+            if(!processed && (!p.limit || p.used < p.limit)) {
+                // nothing processed above (rcv, snd) and we have room for another TCP connection
+                // so, accept one TCP connection
+                for (idx = 0; idx < conns_max; idx++) {
+                    i = conns[idx];
+                    pi = &p.inf[i];
+                    pf = &p.fds[i];
+                    pf->revents = 0;
+                    if (poll_process_new_tcp_connection(&p, pi, pf, now))
+                        break;
+                }
+            }
+        }
+
+        if(unlikely(p.checks_every > 0 && now - last_check > p.checks_every)) {
+            last_check = now;
+
+            // cleanup old sockets
+            for(i = 0; i <= p.max; i++) {
+                POLLINFO *pi = &p.inf[i];
+
+                if(likely(pi->flags & POLLINFO_FLAG_CLIENT_SOCKET)) {
+                    if (unlikely(pi->send_count == 0 && p.complete_request_timeout > 0 && (now - pi->connected_t) >= p.complete_request_timeout)) {
+                        info("POLLFD: LISTENER: client slot %zu (fd %d) from %s port %s has not sent a complete request in %zu seconds - closing it. "
+                              , i
+                              , pi->fd
+                              , pi->client_ip ? pi->client_ip : "<undefined-ip>"
+                              , pi->client_port ? pi->client_port : "<undefined-port>"
+                              , (size_t) p.complete_request_timeout
+                        );
+                        poll_close_fd(pi);
+                    }
+                    else if(unlikely(pi->recv_count && p.idle_timeout > 0 && now - ((pi->last_received_t > pi->last_sent_t) ? pi->last_received_t : pi->last_sent_t) >= p.idle_timeout )) {
+                        info("POLLFD: LISTENER: client slot %zu (fd %d) from %s port %s is idle for more than %zu seconds - closing it. "
+                              , i
+                              , pi->fd
+                              , pi->client_ip ? pi->client_ip : "<undefined-ip>"
+                              , pi->client_port ? pi->client_port : "<undefined-port>"
+                              , (size_t) p.idle_timeout
+                        );
+                        poll_close_fd(pi);
+                    }
+                }
+            }
+        }
+    }
+
+    netdata_thread_cleanup_pop(1);
+    debug(D_POLLFD, "POLLFD: LISTENER: cleanup completed");
+}
diff --git a/libnetdata/socket/socket.h b/libnetdata/socket/socket.h
new file mode 100644
index 0000000..2823242
--- /dev/null
+++ b/libnetdata/socket/socket.h
@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#ifndef NETDATA_SOCKET_H
+#define NETDATA_SOCKET_H
+
+#include "../libnetdata.h"
+
+#ifndef MAX_LISTEN_FDS
+#define MAX_LISTEN_FDS 50
+#endif
+
+typedef enum web_client_acl {
+    WEB_CLIENT_ACL_NONE         = 0,
+    WEB_CLIENT_ACL_NOCHECK      = 0,
+    WEB_CLIENT_ACL_DASHBOARD    = 1 << 0,
+    WEB_CLIENT_ACL_REGISTRY     = 1 << 1,
+    WEB_CLIENT_ACL_BADGE        = 1 << 2,
+    WEB_CLIENT_ACL_MGMT         = 1 << 3,
+    WEB_CLIENT_ACL_STREAMING    = 1 << 4,
+    WEB_CLIENT_ACL_NETDATACONF  = 1 << 5,
+    WEB_CLIENT_ACL_SSL_OPTIONAL = 1 << 6,
+    WEB_CLIENT_ACL_SSL_FORCE    = 1 << 7,
+    WEB_CLIENT_ACL_SSL_DEFAULT  = 1 << 8,
+    WEB_CLIENT_ACL_ACLK         = 1 << 9,
+} WEB_CLIENT_ACL;
+
+#define WEB_CLIENT_ACL_ALL 0xFFFF
+
+#define web_client_can_access_dashboard(w) ((w)->acl & WEB_CLIENT_ACL_DASHBOARD)
+#define web_client_can_access_registry(w) ((w)->acl & WEB_CLIENT_ACL_REGISTRY)
+#define web_client_can_access_badges(w) ((w)->acl & WEB_CLIENT_ACL_BADGE)
+#define web_client_can_access_mgmt(w) ((w)->acl & WEB_CLIENT_ACL_MGMT)
+#define web_client_can_access_stream(w) ((w)->acl & WEB_CLIENT_ACL_STREAMING)
+#define web_client_can_access_netdataconf(w) ((w)->acl & WEB_CLIENT_ACL_NETDATACONF)
+#define web_client_is_using_ssl_optional(w) ((w)->port_acl & WEB_CLIENT_ACL_SSL_OPTIONAL)
+#define web_client_is_using_ssl_force(w) ((w)->port_acl & WEB_CLIENT_ACL_SSL_FORCE)
+#define web_client_is_using_ssl_default(w) ((w)->port_acl & WEB_CLIENT_ACL_SSL_DEFAULT)
+
+typedef struct listen_sockets {
+    struct config *config;              // the config file to use
+    const char *config_section;         // the netdata configuration section to read settings from
+    const char *default_bind_to;        // the default bind to configuration string
+    uint16_t default_port;              // the default port to use
+    int backlog;                        // the default listen backlog to use
+
+    size_t opened;                      // the number of sockets opened
+    size_t failed;                      // the number of sockets attempted to open, but failed
+    int fds[MAX_LISTEN_FDS];            // the open sockets
+    char *fds_names[MAX_LISTEN_FDS];    // descriptions for the open sockets
+    int fds_types[MAX_LISTEN_FDS];      // the socktype for the open sockets (SOCK_STREAM, SOCK_DGRAM)
+    int fds_families[MAX_LISTEN_FDS];   // the family of the open sockets (AF_UNIX, AF_INET, AF_INET6)
+    WEB_CLIENT_ACL fds_acl_flags[MAX_LISTEN_FDS];  // the acl to apply to the open sockets (dashboard, badges, streaming, netdata.conf, management)
+} LISTEN_SOCKETS;
+
+char *strdup_client_description(int family, const char *protocol, const char *ip, uint16_t port);
+
+int listen_sockets_setup(LISTEN_SOCKETS *sockets);
+void listen_sockets_close(LISTEN_SOCKETS *sockets);
+
+void foreach_entry_in_connection_string(const char *destination, bool (*callback)(char *entry, void *data), void *data);
+int connect_to_this_ip46(int protocol, int socktype, const char *host, uint32_t scope_id, const char *service, struct timeval *timeout);
+int connect_to_this(const char *definition, int default_port, struct timeval *timeout);
+int connect_to_one_of(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size);
+int connect_to_one_of_urls(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size);
+
+
+#ifdef ENABLE_HTTPS
+ssize_t recv_timeout(struct netdata_ssl *ssl,int sockfd, void *buf, size_t len, int flags, int timeout);
+ssize_t send_timeout(struct netdata_ssl *ssl,int sockfd, void *buf, size_t len, int flags, int timeout);
+ssize_t netdata_ssl_read(SSL *ssl, void *buf, size_t num);
+ssize_t netdata_ssl_write(SSL *ssl, const void *buf, size_t num);
+#else
+ssize_t recv_timeout(int sockfd, void *buf, size_t len, int flags, int timeout);
+ssize_t send_timeout(int sockfd, void *buf, size_t len, int flags, int timeout);
+#endif
+
+int sock_setnonblock(int fd);
+int sock_delnonblock(int fd);
+int sock_setreuse(int fd, int reuse);
+int sock_setreuse_port(int fd, int reuse);
+int sock_enlarge_in(int fd);
+int sock_enlarge_out(int fd);
+
+int connection_allowed(int fd, char *client_ip, char *client_host, size_t hostsize,
+                              SIMPLE_PATTERN *access_list, const char *patname, int allow_dns);
+int accept_socket(int fd, int flags, char *client_ip, size_t ipsize, char *client_port, size_t portsize,
+                         char *client_host, size_t hostsize, SIMPLE_PATTERN *access_list, int allow_dns);
+
+#ifndef HAVE_ACCEPT4
+int accept4(int sock, struct sockaddr *addr, socklen_t *addrlen, int flags);
+
+#ifndef SOCK_NONBLOCK
+#define SOCK_NONBLOCK 00004000
+#endif  /* #ifndef SOCK_NONBLOCK */
+
+#ifndef SOCK_CLOEXEC
+#define SOCK_CLOEXEC 02000000
+#endif /* #ifndef SOCK_CLOEXEC */
+
+#endif /* #ifndef HAVE_ACCEPT4 */
+
+
+// ----------------------------------------------------------------------------
+// poll() based listener
+
+#define POLLINFO_FLAG_SERVER_SOCKET 0x00000001
+#define POLLINFO_FLAG_CLIENT_SOCKET 0x00000002
+#define POLLINFO_FLAG_DONT_CLOSE    0x00000004
+
+typedef struct poll POLLJOB;
+
+typedef struct pollinfo {
+    POLLJOB *p;             // the parent
+    size_t slot;            // the slot id
+
+    int fd;                 // the file descriptor
+    int socktype;           // the client socket type
+    WEB_CLIENT_ACL port_acl; // the access lists permitted on this web server port (it's -1 for client sockets)
+    char *client_ip;         // Max INET6_ADDRSTRLEN bytes
+    char *client_port;       // Max NI_MAXSERV bytes
+    char *client_host;       // Max NI_MAXHOST bytes
+
+    time_t connected_t;     // the time the socket connected
+    time_t last_received_t; // the time the socket last received data
+    time_t last_sent_t;     // the time the socket last sent data
+
+    size_t recv_count;      // the number of times the socket was ready for inbound traffic
+    size_t send_count;      // the number of times the socket was ready for outbound traffic
+
+    uint32_t flags;         // internal flags
+
+    // callbacks for this socket
+    void  (*del_callback)(struct pollinfo *pi);
+    int   (*rcv_callback)(struct pollinfo *pi, short int *events);
+    int   (*snd_callback)(struct pollinfo *pi, short int *events);
+
+    // the user data
+    void *data;
+
+    // linking of free pollinfo structures
+    // for quickly finding the next available
+    // this is like a stack, it grows and shrinks
+    // (with gaps - lower empty slots are preferred)
+    struct pollinfo *next;
+} POLLINFO;
+
+struct poll {
+    size_t slots;
+    size_t used;
+    size_t min;
+    size_t max;
+
+    size_t limit;
+
+    time_t complete_request_timeout;
+    time_t idle_timeout;
+    time_t checks_every;
+
+    time_t timer_milliseconds;
+    void *timer_data;
+
+    struct pollfd *fds;
+    struct pollinfo *inf;
+    struct pollinfo *first_free;
+
+    SIMPLE_PATTERN *access_list;
+    int allow_dns;
+
+    void *(*add_callback)(POLLINFO *pi, short int *events, void *data);
+    void  (*del_callback)(POLLINFO *pi);
+    int   (*rcv_callback)(POLLINFO *pi, short int *events);
+    int   (*snd_callback)(POLLINFO *pi, short int *events);
+    void  (*tmr_callback)(void *timer_data);
+};
+
+#define pollinfo_from_slot(p, slot) (&((p)->inf[(slot)]))
+
+int poll_default_snd_callback(POLLINFO *pi, short int *events);
+int poll_default_rcv_callback(POLLINFO *pi, short int *events);
+void poll_default_del_callback(POLLINFO *pi);
+void *poll_default_add_callback(POLLINFO *pi, short int *events, void *data);
+
+POLLINFO *poll_add_fd(POLLJOB *p
+                             , int fd
+                             , int socktype
+                             , WEB_CLIENT_ACL port_acl
+                             , uint32_t flags
+                             , const char *client_ip
+                             , const char *client_port
+                             , const char *client_host
+                             , void *(*add_callback)(POLLINFO *pi, short int *events, void *data)
+                             , void  (*del_callback)(POLLINFO *pi)
+                             , int   (*rcv_callback)(POLLINFO *pi, short int *events)
+                             , int   (*snd_callback)(POLLINFO *pi, short int *events)
+                             , void *data
+);
+void poll_close_fd(POLLINFO *pi);
+
+void poll_events(LISTEN_SOCKETS *sockets
+        , void *(*add_callback)(POLLINFO *pi, short int *events, void *data)
+        , void  (*del_callback)(POLLINFO *pi)
+        , int   (*rcv_callback)(POLLINFO *pi, short int *events)
+        , int   (*snd_callback)(POLLINFO *pi, short int *events)
+        , void  (*tmr_callback)(void *timer_data)
+        , SIMPLE_PATTERN *access_list
+        , int allow_dns
+        , void *data
+        , time_t tcp_request_timeout_seconds
+        , time_t tcp_idle_timeout_seconds
+        , time_t timer_milliseconds
+        , void *timer_data
+        , size_t max_tcp_sockets
+);
+
+#endif //NETDATA_SOCKET_H