From: watanaby <>
Date: Fri, 2 Mar 2007 06:37:35 +0000 (+0000)
Subject: Ver.1.4.11: Add ldap authentication. Fix malfunction in exceptional terminals.
X-Git-Url: http://git.osdn.net/view?p=opengate%2Fopengate.git;a=commitdiff_plain;h=ae225dd25d34c6978be5a174b931d1cc32b0b682

Ver.1.4.11: Add ldap authentication. Fix malfunction in exceptional terminals.
---

diff --git a/opengate/README b/opengate/README
index ae2fb1b..e985ba6 100644
--- a/opengate/README
+++ b/opengate/README
@@ -74,6 +74,7 @@ opengatesrv/	Opengate server program source files
   auth-pam.c		Authentication by PAM 
   auth-pop3s.c		Authentication by POP3S
   auth-rad.c		Authentication by RADIUS
+  auth-ldap.c		Authentication by LDAP/LDAPS
   comm-arp.c		Communication with ARP
   comm-ndp.c            Communication with NDP
   comm-auth.c		Communication with authentication systems
diff --git a/opengate/conf/opengatesrv.conf.sample b/opengate/conf/opengatesrv.conf.sample
index b09539b..9120efc 100644
--- a/opengate/conf/opengatesrv.conf.sample
+++ b/opengate/conf/opengatesrv.conf.sample
@@ -1,15 +1,17 @@
 <?xml version="1.0"?>
-<Opengate ConfigVersion="1.4.10">
+<Opengate ConfigVersion="1.4.11">
 
 <!-- ################################################# 
 #    ####### NEED TO MODIFY FOLLOWING PARAMETERS #####  -->
 
-	<!-- opengate gateway server hostname(FQDN or IP address) -->
+	<!-- #########################################################
+	     ## Opengate gateway server hostname(FQDN or IP address)## -->
 
 	<OpengateServerName>opengate.og.saga-u.ac.jp</OpengateServerName>
 
-	<!-- Authentication server -->
-	<!-- The AuthServer format is documented at the end of this file -->
+	<!-- ############################################
+	     ## Authentication server                  ##
+	     ## REFER document at the end of this file ## -->
 
 	<AuthServer>
 		<Address>192.168.0.2</Address>
@@ -22,9 +24,10 @@
 <!-- ###################################################
 #	if you want to switch parameters with userID or extraID
 #	(entered by user as [userID@extraID] in auth page),
-#	see the information of ExtraSet at the end of this file.
+#	REFER the information of ExtraSet at the end of this file.
 #    ###################################################  --> 
 
+	<!-- Debug dump level -->
 	<!-- Set 0 to write only open/close and error messages to syslog -->
 	<!-- Set 1 to write some information adding to 0 -->
 	<!-- Set 2 to write many information to syslog -->
@@ -43,7 +46,7 @@
 	<!-- If no connection with java/http, network is closed after this. -->
 	<Duration>
 		<Default>1200</Default>
-		<Max>10800</Max>
+		<Max>3600</Max>
 	</Duration>
 	
 	<!-- Client Live Check (seconds) -->
@@ -92,6 +95,9 @@
 	<!-- communication reply timeout(second) -->
 	<CommWaitTimeout>10</CommWaitTimeout>
 
+	<!-- Java connection timeout(second) -->
+	<JavaWaitTimeout>600</JavaWaitTimeout>
+
 	<!-- http reconnect timeout(second) -->
 	<ReconnectTimeout>10</ReconnectTimeout>
 
@@ -167,6 +173,18 @@
 	<!-- Separate char between userID and extraID [userID@extraID] -->
 	<UserIdSeparator>@</UserIdSeparator>
 
+	<!-- Config for exceptional users, See below -->
+<!--
+	<ExtraSet ExtraId="guest">
+		<AuthServer>
+			<Address>192.168.0.1</Address>
+			<Protocol>ftp</Protocol>
+		</AuthServer>
+	</ExtraSet>
+-->
+
+</Opengate> 
+
 <!-- ########################################################## 
 #     #### ExtraSet overwritten on default settings ####
 #
@@ -190,40 +208,34 @@
 #
 #	Word "default" is set to extraID, when extraID is not entered.
 #     #######################################################  
--->
-
-<!--
+#
 #	<ExtraSet ExtraId="guest">
 #		<AuthServer>
 #			<Address>192.168.0.1</Address>
-#			<Protocol>pop3s</Protocol>
+#			<Protocol>ftp</Protocol>
 #		</AuthServer>
 #		<Duration>
 #			<Default>1200</Default>
 #			<Max>1200</Max>
 #		</Duration>
 #	</ExtraSet>
--->
-<!--
+#
 #	<ExtraSet ExtraId="admin">
 #		<AuthServer>
 #			<Protocol>pam</Protocol>
 #		</AuthServer>
 #	</ExtraSet>
--->
-<!--
+#
 #	<ExtraSet ExtraId="default" UserIdPattern="^user1$|^user2$">	
 #		<Syslog>
 #			<Enable>1</Enable>
 #			<Facility>local2</Facility>
 #		</Syslog>
 #	</ExtraSet>
--->
-</Opengate> 
-
-
-
-<!--    ###################################################
+#
+#
+#
+#       ###################################################
 #	######Documentation about AuthServer setting ######
 #	
 #	########### Format ############# 
@@ -258,7 +270,19 @@
 #	#   Auth by RADIUS
 #	#   If not define <ConfigFile>, "/etc/radius.conf" is used.
 #	
-#	#### TYPE 4 (ACCEPT or DENY) ####
+#	#### TYPE 4 (LDAP) ####
+#	<AuthServer>
+#		<Protocol>ldap</Protocol>
+#		<Uri>-uri-of-ldap-server-</Uri>
+#		<BaseDN>-ldap_base_dn_to_search-</BaseDN>
+#	</AuthServer>
+#	#   Auth by LDAP/LDAPS
+#	#   Uri examples
+#	#     'ldap://foo.bar.com' for NonSSL
+#	#     'ldaps://foo.bar.com' for SSL
+#	#     'ldaps://foo.bar.com:1234' to use specific port
+#	
+#	#### TYPE 5 (ACCEPT or DENY) ####
 #	<AuthServer>
 #		<Protocol>{accept|deny}</Protocol>
 #	</AuthServer>
@@ -269,7 +293,12 @@
 #	<AuthServer>
 #		<Address>pop.saga-u.ac.jp</Address>
 #		<Protocol>pop3s</Protocol>
-#		<Port>10000</Port>
+#	</AuthServer>
+#
+#	<AuthServer>
+#		<Protocol>ldap</Protocol>
+#		<Uri>ldaps://ldap.saga-u.ac.jp</Uri>
+#		<BaseDN>ou=people,dc=saga-u,dc=ac,dc=jp</BaseDN>
 #	</AuthServer>
 #
 #	<AuthServer>
diff --git a/opengate/doc/Changes.html b/opengate/doc/Changes.html
index 777065d..cbe02ba 100644
--- a/opengate/doc/Changes.html
+++ b/opengate/doc/Changes.html
@@ -533,6 +533,11 @@ Ver.1.4.10 at 2006.12.26</DT>
 <DD>
 Change parameter's name and value in config file.
 </DD>
+<DT>
+Ver.1.4.11 at 2007.2.2</DT>
+<DD>
+Add ldap/ldaps authentication. Fix mulfunction in exceptional terminals.
+</DD>
 
 </DL>
 <b>Please see CVS in SourceForge.net to check the file difference between versions.</b>
diff --git a/opengate/doc/en/install.html b/opengate/doc/en/install.html
index f19a809..6af7e14 100644
--- a/opengate/doc/en/install.html
+++ b/opengate/doc/en/install.html
@@ -510,7 +510,7 @@ named_flags="-u bind -c /etc/namedb/named.conf"
 <!-- ************ 2 ************** -->
 <h4>D.2&nbsp;Setup of DHCP<A class=anchor href="#dhcp2" name=dhcp2>õ</A></h4>
 
-<p>There is a configuration file "/usr/local/etc/dhcpd.conf.sample" after instalation. Copy "dhcpd.conf.sample" to "dhcpd.conf" and edit the file. Following is a setting example.</p>
+<p>There is a configuration file "/usr/local/etc/dhcpd.conf.sample" after instalation. Copy "dhcpd.conf.sample" to "dhcpd.conf" and edit the file. Following is a setting example. The lease time must be greater than the maximum usage duration (Duration/Max in opengatesrv.conf) used at sellecting time watching mode.</p>
 
 
 <table><tr><td><pre>
@@ -520,8 +520,8 @@ option subnet-mask 255.255.255.0;
 option broadcast-address 192.168.1.255;
 option routers 192.168.1.1;
 
-default-lease-time 600;
-max-lease-time 7200;
+default-lease-time 86400;
+max-lease-time 604800;
 ddns-update-style none;
 log-facility local7;
 
diff --git a/opengate/doc/ja/install.html b/opengate/doc/ja/install.html
index 7c90679..cdcfb4a 100644
--- a/opengate/doc/ja/install.html
+++ b/opengate/doc/ja/install.html
@@ -500,7 +500,7 @@ Opengate
 
 <p>
 CXg[ìÆª®¹·éÆA/usr/local/etcÈºÉdhcpd.conf.sampleª¶¬³êÄ¢éB¯fBNgÉdhcpd.confÆµÄRs[µAdhcpdpÌÝèt@Cðì¬·éB</p>
-<p>ÈºÉAÝèáð¦·B</p>
+<p>ÈºÉAÝèáð¦·B[XÔÍAÔÄÌêÉg¤eÅåÔiopengatesrv.confàÌDuration/Maxjæè·­·é±ÆB</p>
 
 <table><tr><td><pre>
 option domain-name "og.saga-u.ac.jp";
@@ -509,8 +509,8 @@ option subnet-mask 255.255.255.0;
 option broadcast-address 192.168.1.255;
 option routers 192.168.1.1;
 
-default-lease-time 600;
-max-lease-time 7200;
+default-lease-time 86400;
+max-lease-time 604800;
 ddns-update-style none;
 log-facility local7;
 
diff --git a/opengate/javahtml/en/accept-http.html b/opengate/javahtml/en/accept-http.html
index 7c705bd..d0f68a3 100644
--- a/opengate/javahtml/en/accept-http.html
+++ b/opengate/javahtml/en/accept-http.html
@@ -39,7 +39,7 @@ if(!navigator.javaEnabled()){
 <hr />
 
 <p>If yellow bar is not displayed between above two lines, please click <a href="%%TERMINATEURL%%"><b>TERMINATE</b></a> 
-and close your browser. 
+and close your browser. If authentication page is not displayed, access to other web page.</p>
 
 <SCRIPT LANGUAGE="JavaScript">
 <!--
diff --git a/opengate/javahtml/en/accept-java.html b/opengate/javahtml/en/accept-java.html
index b7f94de..996a8bb 100644
--- a/opengate/javahtml/en/accept-java.html
+++ b/opengate/javahtml/en/accept-java.html
@@ -37,7 +37,7 @@ if(!navigator.javaEnabled()){
 <p>If yellow bar is not displayed between above two lines, Java does not run. 
 In this case, please click <a href="%%TERMINATEURL%%"><b>TERMINATE</b></a>, 
  close your browser, and try to select other watch mode in authentication page. 
-Or you can run Java, if you download JavaPlugIn from <a href=http://java.com/ja/index.jsp><b>java.com</b></a>.</p>
+Or you can run Java, if you download JavaPlugIn from <a href=http://java.com/ja/index.jsp><b>java.com</b></a>.If authentication page is not displayed, access to other web page.</p>
 
 
 <script language="JavaScript">
diff --git a/opengate/javahtml/en/accept-time.html b/opengate/javahtml/en/accept-time.html
index fb3ef59..91a4032 100644
--- a/opengate/javahtml/en/accept-time.html
+++ b/opengate/javahtml/en/accept-time.html
@@ -10,7 +10,7 @@
 <p>When you finish to use the network, click the link:
 <a href="%%TERMINATEURL%%">TERMINATE</a> for security.</p>
 <p>Please use this method only when other watch modes cannot be used.</p>
-
+<p>If authentication page is not displayed, access to other web page.</p>
 <script language="JavaScript">
 <!--
   window.open("%%STARTURL%%","window1");
diff --git a/opengate/javahtml/en/httpkeep.html b/opengate/javahtml/en/httpkeep.html
index fb33375..d8ddabc 100644
--- a/opengate/javahtml/en/httpkeep.html
+++ b/opengate/javahtml/en/httpkeep.html
@@ -40,7 +40,8 @@ You will be disconnected from the network automatically.</p>
 or other malfunction is occured, 
 click <a href="%%TERMINATEURL%%"><b>TERMINATE</b></a>, 
  close your browser, and try to select other watch mode
- in authentication page.</p>
+ in authentication page.
+If authentication page is not displayed, access to other web page.</p>
 
 <table bgcolor="lightyellow" border="1">
 <tr><td>
diff --git a/opengate/javahtml/ja/accept-http.html b/opengate/javahtml/ja/accept-http.html
index dbddceb..85c069e 100644
--- a/opengate/javahtml/ja/accept-http.html
+++ b/opengate/javahtml/ja/accept-http.html
@@ -38,7 +38,9 @@ if(!navigator.javaEnabled()){
 
 <p>$B>e$N(B2$BK\$N@~$N4V$K2+?'$N%P!<$,I=<($5$l$J$$>l9g!"(B
 <a href="%%TERMINATEURL%%"><b>$BMxMQCfCG(B</b></a>$B$r%/%j%C%/$7$F$+$i(B
-$B%V%i%&%6$r=*N;$7$F$/$@$5$$!#(B
+$B%V%i%&%6$r=*N;$7$F$/$@$5$$!#$^$?G'>Z%Z!<%8$,I=<($5$l$J$$>l9g$O!"(B
+$BDL>o$H$OJL$N%Z!<%8$r%"%/%;%9$7$F$_$F$/$@$5$$!#(B
+
 
 <script language="JavaScript">
 <!--
diff --git a/opengate/javahtml/ja/accept-java.html b/opengate/javahtml/ja/accept-java.html
index 8764589..0b9fa60 100644
--- a/opengate/javahtml/ja/accept-java.html
+++ b/opengate/javahtml/ja/accept-java.html
@@ -37,6 +37,8 @@ if(!navigator.javaEnabled()){
 $B%V%i%&%6$r=*N;$7$?8e!"G'>Z%Z!<%8$K$*$$$FB>$N4F;kJ}<0$rA*Br$7$F$/$@$5$$!#(B
 $B$^$?$O!"(B<a href=http://java.com/ja/index.jsp><b>java.com</b></a>
 $B$+$i(BJavaPlugIn$B$r%@%&%s%m!<%I$9$l$P!"(BJava$B$rF0$+$9$3$H$,$G$-$^$9!#(B
+$B$^$?G'>Z%Z!<%8$,I=<($5$l$J$$>l9g$O!"(B
+$BDL>o$H$OJL$N%Z!<%8$r%"%/%;%9$7$F$_$F$/$@$5$$!#(B
 
 <script language="JavaScript">
 <!--
diff --git a/opengate/javahtml/ja/accept-time.html b/opengate/javahtml/ja/accept-time.html
index 354231b..31eafee 100644
--- a/opengate/javahtml/ja/accept-time.html
+++ b/opengate/javahtml/ja/accept-time.html
@@ -10,6 +10,8 @@
 <p>$B0BA4$N$?$a$K!"MxMQ=*N;;~$K$O!"(B<a href="%%TERMINATEURL%%">
 <b>$BMxMQCfCG(B</b></a>$B$r%/%j%C%/$7$F$/$@$5$$!#(B</p>
 <p>$B$3$NJ}K!$O!"B>$N4F;kJ}K!$,;HMQ$G$-$J$$>l9g$K$N$_MxMQ$7$F2<$5$$!#(B</p>
+<p>$BG'>Z%Z!<%8$,I=<($5$l$J$$>l9g$O!"(B
+$BDL>o$H$OJL$N%Z!<%8$r%"%/%;%9$7$F$_$F$/$@$5$$!#(B</p>
 
 <script language="JavaScript">
 <!--
diff --git a/opengate/javahtml/ja/httpkeep.html b/opengate/javahtml/ja/httpkeep.html
index a8e339e..71ac295 100644
--- a/opengate/javahtml/ja/httpkeep.html
+++ b/opengate/javahtml/ja/httpkeep.html
@@ -14,7 +14,8 @@
 
 
 <p>$B%M%C%H%o!<%/$rMxMQ$G$-$^$9!#(B</p>
-<p>$BMxMQ$,=*$C$?$iI,$:(BWeb$B%V%i%&%6$r=*N;$7$F$/$@$5$$!#%M%C%H%o!<%/MxMQ5v2D$b<+F0E*$K<h$j>C$5$l$^$9!#(B</p>
+<p>$BMxMQ$,=*$C$?$iI,$:(BWeb$B%V%i%&%6$r=*N;$7$F$/$@$5$$!#(B
+$B%M%C%H%o!<%/MxMQ5v2D$b<+F0E*$K<h$j>C$5$l$^$9!#(B</p>
 <noscript>
 <p><b>JavaScript$B$,L58z$K@_Dj$5$l$F$$$^$9!#JQ99$7$F2<$5$$!#(B</b></p>
 </noscript>
@@ -35,8 +36,10 @@
 
 <p>$B>e$N(B2$BK\$N@~$N4V$K2+?'$N%P!<$,I=<($5$l$J$+$C$?$j%M%C%H%o!<%/$,JD:?$5$l$k(B
 $B$J$IF0:n$,$*$+$7$$>l9g$O!"(B<a href="%%TERMINATEURL%%"><b>$BMxMQCfCG(B
-</b></a>$B$r%/%j%C%/$7$F%V%i%&%6$r=*N;$7$?8e!"G'>Z%Z!<%8$K$*$$$FB>$N4F;k(B
-$BJ}<0$rA*Br$7$F$/$@$5$$!#(B
+</b></a>$B$r%/%j%C%/$7$F%V%i%&%6$r=*N;$7$?8e!"G'>Z%Z!<%8$K$*$$$F(B
+$BB>$N4F;kJ}<0$rA*Br$7$F$/$@$5$$!#(B
+$B$^$?G'>Z%Z!<%8$,I=<($5$l$J$$>l9g$O!"(B
+$BDL>o$H$OJL$N%Z!<%8$r%"%/%;%9$7$F$_$F$/$@$5$$!#(B
 </p>
 
 <table bgcolor="lightyellow" border="1">
diff --git a/opengate/opengatesrv/Makefile b/opengate/opengatesrv/Makefile
index 2f4a4de..a87ee77 100644
--- a/opengate/opengatesrv/Makefile
+++ b/opengate/opengatesrv/Makefile
@@ -6,16 +6,15 @@ WWWTOP = /usr/local/www
 DOCDIR = /data
 CGIDIR = /cgi-bin
 OPENGATEDIR = /opengate
+CONFIGPATH = /etc/opengate
 
 DOCUMENTROOT = ${WWWTOP}${DOCDIR}
 INSTALLDOCPATH = ${WWWTOP}${DOCDIR}${OPENGATEDIR}
 INSTALLCGIPATH = ${WWWTOP}${CGIDIR}${OPENGATEDIR}
 
-CONFIGPATH = /etc/opengate
-
 CFLAGS= -O4 -Wall
-LIBS = -lssl -lcrypto -lradius -lpam -lezxml -L../ezxml
-OBJS = utilities.o comm-auth.o comm-cgi.o watch-client.o comm-ipfw.o comm-ip6fw.c comm-arp.o comm-ndp.o error.o tcp_connect.o sock_ntop_host.o wrapper.o signal.o auth-pam.o auth-rad.o auth-pop3s.o comm-userdb.o get-param.o auth-ftps.o htmltemplate.o addr-convert.o get-mac.o ctrl-firewall.o ctrl-alarms.o
+LIBS = -lssl -lcrypto -lradius -lpam -lldap -llber -lezxml -L/usr/local/lib -L../ezxml
+OBJS = utilities.o comm-auth.o comm-cgi.o watch-client.o comm-ipfw.o comm-ip6fw.c comm-arp.o comm-ndp.o error.o tcp_connect.o sock_ntop_host.o wrapper.o signal.o auth-pam.o auth-rad.o auth-pop3s.o comm-userdb.o get-param.o auth-ftps.o auth-ldap.o htmltemplate.o addr-convert.o get-mac.o ctrl-firewall.o ctrl-alarms.o
 MAINPROGO = main.o
 HDRS = opengatesrv.h
 MAINPROG = opengatesrv
@@ -139,6 +138,15 @@ auth-rad.o:	${HDRS}
 
 auth-pop3s.o:	${HDRS}
 
+auth-ftps.o:	${HDRS}
+
+auth-ldap.o:	${HDRS}
+.if exists(/usr/local/include/ldap.h)
+		${CC} ${CFLAGS}  -I/usr/local/include -c $<
+.else
+		${CC} ${CFLAGS} -DLDAP_NOT_INSTALLED -c $<
+.endif
+
 get-param.o:	${HDRS}
 
 get-mac.o:	${HDRS}
diff --git a/opengate/opengatesrv/comm-auth.c b/opengate/opengatesrv/comm-auth.c
index bb63172..c7a2763 100644
--- a/opengate/opengatesrv/comm-auth.c
+++ b/opengate/opengatesrv/comm-auth.c
@@ -37,6 +37,8 @@ int authFtpse(char *userid, char *passwd);
 int AuthFtpse(char *userid, char *passwd);
 int authFtpsi(char *userid, char *passwd);
 int AuthFtpsi(char *userid, char *passwd);
+int authLdap(char *userid, char *passwd);
+int AuthLdap(char *userid, char *passwd);
 
 /*******************************************************/
 /* Authenticate user by accessing to ftp server        */
@@ -75,6 +77,10 @@ int authenticateUser(char *userid, char *passwd)
     /* authenticate by pop3s */
     authResult=AuthPop3s(userid, passwd);
 
+  }else if(strcmp(proto, "ldap")==0){
+    /* authenticate by ldap */
+    authResult=AuthLdap(userid, passwd);
+
   }else if(strcmp(proto, "ftpse")==0){
     /* authenticate by ftps-explicit */
     authResult=AuthFtpse(userid, passwd);
diff --git a/opengate/opengatesrv/get-param.c b/opengate/opengatesrv/get-param.c
index 4ebcd16..2459c7f 100644
--- a/opengate/opengatesrv/get-param.c
+++ b/opengate/opengatesrv/get-param.c
@@ -28,7 +28,7 @@ Programmed by Yoshiaki WATANABE
 #include "opengatesrv.h"
 #include "../ezxml/ezxml.h"
 
-#define CONFIG_VERSION "1.4.10"
+#define CONFIG_VERSION "1.4.11"
 #define SEPARATOR "/"
 
 int debug=0;
diff --git a/opengate/opengatesrv/test-comm-auth.c b/opengate/opengatesrv/test-comm-auth.c
index bdbff99..7c48562 100644
--- a/opengate/opengatesrv/test-comm-auth.c
+++ b/opengate/opengatesrv/test-comm-auth.c
@@ -49,9 +49,11 @@ int  main(int argc, char **argv)
 
   printf("Config file=[%s]\n",CONFIGFILE);
 
-  /* get serverid, userid and password */
+  /* get extraid, userid and password */
+  /*
   printf("Enter extraID=");
-  scanf("%s", extraID);
+  scanf("%s\n", extraID);
+  */
   printf("Enter userID=");
   scanf("%s", userID);
   printf("Enter password=");
diff --git a/opengate/opengatesrv/watch-client.c b/opengate/opengatesrv/watch-client.c
index a9faeef..a9f2180 100644
--- a/opengate/opengatesrv/watch-client.c
+++ b/opengate/opengatesrv/watch-client.c
@@ -35,7 +35,6 @@ void AcceptHttpReConnect(void);
 int MacAddrCheck(int ipStatus,char *clientAddr4, char *clientAddr6, char *macAddr4, char *macAddr6);
 int IsRightKey(char *pNowKey, char *sessionId);
 void SendHttpReply(char *reply);
-void CheckAjaxAbility(char *buff, char *sessionId);
 
 void OnUsageTimeLimitAlarm(int signo);
 void OnCheckBasicAlarm(int signo);
@@ -140,6 +139,10 @@ int waitClientConnect(char *userid, char *userProperty, char *sessionId, char *c
   char connectAddr[ADDRMAXLN];      /* connected client address */
   char httpStr[BUFFMAXLN];          /* HTTP GET string at terminate */
   char useridAndSessionId[BUFFMAXLN]; /* comcat userid and sessionid */
+  int timeSendHttpkeep=0;
+  int timeStart;
+
+  timeStart=time(NULL);
 
   /* set alarm function arguments */
   alarmArg.pClientAddr=pClientAddr;
@@ -168,22 +171,20 @@ int waitClientConnect(char *userid, char *userProperty, char *sessionId, char *c
     /* start alarms */
     EnableAlarm();
 
-    /* connection wait */
-    connfd = SelectAccept();
-
-    /*at abnormal connect */
-    if(connfd < 0) continue;
+    /* connection wait. retry at abnormal  */
+    if((connfd = SelectAccept()) < 0 ){
+      Close(connfd);
+      continue;
+    }
 
     /* at normal connection */
     /* stop alarm interupt between checking */
     DisableAlarm();
     
-    /* is it from the correct client addr */
-    /* the check is skipped for IPv6 */
+    /* is it from the correct client addr(the check is skipped for IPv6) */
     if(ipType==IPV4 && ipStatus!=IPV6ONLY){
       GetPeerAddr(connfd, connectAddr);
       if(isNull(connectAddr)||strcmp(connectAddr, clientAddr4)!=0){
-	connectMode=NOCONNECT;
 	Close(connfd);
 	continue;
       }
@@ -193,21 +194,27 @@ int waitClientConnect(char *userid, char *userProperty, char *sessionId, char *c
     AddAlarm("ReadWaitAlarm",atoi(GetConfValue("CommWaitTimeout")),
 	     TRUE, OnReadWaitAlarm); 
     EnableAlarm();
+
     /* get string from connection */
     if(readln(connfd, buff, BUFFMAXLN) <0){
       /* if abnormal, wait next request */
-      connectMode=NOCONNECT;
       Close(connfd);
       continue;
     }
     RemoveAlarm("ReadWaitAlarm");
-
-    /* is it the correct userid from java applet */
+    
+    /* is it the correct request from java applet */
     /* the request is [<userid>:<sessionId>] */
     snprintf(useridAndSessionId, BUFFMAXLN, "%s-%s", userid,sessionId);
     if(strcmp(buff, useridAndSessionId)==0){
 
-      /* enter to the Java watch mode on the connection */
+      /* if too late request, ingore */
+      if((time(NULL)-timeStart) > atoi(GetConfValue("JavaWaitTimeout"))){
+	Close(connfd);
+	continue;
+      }
+
+      /* enter to the Java watch mode on the connection keeped */
       connectMode=JAVACONNECT;
       break;
     }
@@ -215,17 +222,42 @@ int waitClientConnect(char *userid, char *userProperty, char *sessionId, char *c
     /* is it the httpkeep page download request */
     /* the request is [GET /httpkeep.html ....] */
     snprintf(httpStr, BUFFMAXLN, "GET /httpkeep-%s-%s", userid,sessionId);
-    
     if(strstr(buff, httpStr)==buff){
       
-      /* page download request found */
       /* read out the remained headers and send the page */
       ReadHttpHeaders();
       SendHttpKeepPage(userid, sessionId, language, port);
+      timeSendHttpkeep=time(NULL);
 
-      /* to check ajax ability, wait XMLHttpRequest for a while */
-      CheckAjaxAbility(buff, sessionId);
+      /* return to wait next request (that night be GET /hello) */
+      Close(connfd);
+      continue;
+    }
 
+    /* is it hello request from javascript in httpkeep.html */
+    if(strstr(buff, "GET /hello-")==buff){
+      
+      /* read out the remained headers */
+      ReadHttpHeaders();
+
+      /* if the request is premature or too late, ignore */
+      if((timeSendHttpkeep == 0)||
+	 (time(NULL)-timeSendHttpkeep)> atoi(GetConfValue("CommWaitTimeout"))){
+	Close(connfd);
+	continue;
+      }
+
+      /* if received key is incorrect, exit */
+      /* [GET /hello-key1-key2 ..] */
+      if( IsRightKey(buff+strlen("GET /hello-"), sessionId)==FALSE){
+	connectMode=ENDCONNECT;
+	Close(connfd);
+	break;
+      }
+      
+      /* enter to the Http watch mode on the connection keeped(not close) */
+      /* reply to the hello request is done in the watch routine */
+      connectMode=HTTPCONNECT;
       break;
     }
 
@@ -240,12 +272,8 @@ int waitClientConnect(char *userid, char *userProperty, char *sessionId, char *c
       break;
     }
 
-    /* some other unknown request */    
-    err_msg("ERR at %s#%d: unknown request [%s] sent from client",
-    	    __FILE__,__LINE__,buff);
-    connectMode=NOCONNECT;
+    /* other request is ignored */
     Close(connfd);
-    
     continue;
   }
 
@@ -255,59 +283,6 @@ int waitClientConnect(char *userid, char *userProperty, char *sessionId, char *c
   return connectMode;
 }
 
-/***************************************/
-/* check ajax ability                  */
-/* read hello sent by XMLhttpRequest   */
-/*  (reply is delayed)                 */
-/* check result is set in connectMode  */ 
-/***************************************/ 
-void checkAjaxAbility(char *buff, char *sessionId)
-{
-
-  /* to check the ajax ablility of the client, wait ajax request */
-  AddAlarm("AjaxWaitAlarm",atoi(GetConfValue("CommWaitTimeout")), 
-	   TRUE, OnAjaxWaitAlarm); 
-  EnableAlarm();
-
-  /* read wait for ajax request in the connection */
-  while(1){
-    if(readln(connfd, buff, BUFFMAXLN) <0){
-      
-      /* if timeout, no ajax ability */
-      /* java might be connected */
-      connectMode=NOCONNECT; 	
-      Close(connfd);
-      break;
-    }
-    
-    /* recieved normal request */
-    RemoveAlarm("AjaxWaitAlarm");
-    ReadHttpHeaders();
-    
-    /* usually, hello request is recieve */
-    if(strstr(buff, "GET /hello-")==buff){
-      
-      /* if received hello-key is incorrect, exit */
-      /* [GET /hello-key1-key2 ..] */
-      if( IsRightKey(buff+strlen("GET /hello-"), sessionId)==FALSE){
-	connectMode=ENDCONNECT;
-	Close(connfd);
-	break;
-      }
-      
-      /* enter to the Http watch mode on the connection */
-      connectMode=HTTPCONNECT;
-      break;
-    }
-    /* or some request might be inserted. eg:[GET /favicon.ico] */
-    /* ignore it */
-    else{
-      SendHttpReply("");
-      continue;
-    }
-  }
-}
-
 /****************************/
 /* wait for TCP connection  */
 /****************************/
@@ -727,23 +702,8 @@ void acceptHttpReConnect(void){
   /* connection wait */
   connfd = SelectAccept();
 
-  if(connfd<0){
-    /* abnormal return from selectAccept */
-    if(errno==EINTR){ /* timeout interupt */
-      err_msg("ERR at %s#%d: http reconnect timeout",
-	      __FILE__,__LINE__);
-      connectMode=ENDCONNECT;
-    }else{           /* other errors */
-      err_msg("ERR: http reconnect error [%s]",strerror(errno)); 
-      connectMode=ENDCONNECT;
-    }
-
-  }else{
-    /* normal return from selectAccept */
-    if(debug>0)err_msg("INFO: http reconnect after %d seconds",
-		       time(NULL)-startTime); 
-    connectMode=HTTPCONNECT;
-  }
+  if(connfd<0) connectMode=ENDCONNECT; /* timeout or abnormal */
+  else         connectMode=HTTPCONNECT; /* reconnected */
 
   /* receive request */
   RemoveAlarm("ReadWaitAlarm");
@@ -1184,8 +1144,5 @@ void SendHttpReply(char *reply){
   if(debug>1) err_msg("DEBUG:<=sendHttpReply()");
 }
 
-void CheckAjaxAbility(char *buff, char *sessionId){
-  if(debug>1) err_msg("DEBUG:=>checkAjaxAbility(%s,%s)",buff,sessionId);
-  checkAjaxAbility(buff,sessionId);
-  if(debug>1) err_msg("DEBUG:<=checkAjaxAbility()");
-}
+
+
