diff --git a/.hgtags b/.hgtags
index 8127beb..ebd9f1a 100644
--- a/.hgtags
+++ b/.hgtags
@@ -420,3 +420,4 @@
 0d45b4cf7c2e4e626a5a16e1fe604402ace1cea5 release-1.13.5
 f87da7d9ca02b8ced4caa6c5eb9013ccd47b0117 release-1.13.6
 47cca243d0ed39bf5dcb9859184affc958b79b6f release-1.13.7
+20ca4bcff108d3e66977f4d97508637093492287 release-1.13.8
diff --git a/BUILD b/BUILD
index 326d3a4..f2ec262 100644
--- a/BUILD
+++ b/BUILD
@@ -1485,5 +1485,5 @@
     preinst = "@nginx_pkgoss//:debian_preinst",
     prerm = "@nginx_pkgoss//:debian_prerm",
     section = "httpd",
-    version = "1.13.7",
+    version = "1.13.8",
 )
diff --git a/auto/cc/clang b/auto/cc/clang
index a82aeb9..5ea6dac 100644
--- a/auto/cc/clang
+++ b/auto/cc/clang
@@ -5,7 +5,7 @@
 # clang
 
 
-NGX_CLANG_VER=`$CC -v 2>&1 | grep '\(clang\|LLVM\) version' 2>&1 \
+NGX_CLANG_VER=`$CC -v 2>&1 | grep 'version' 2>&1 \
                            | sed -e 's/^.* version \(.*\)/\1/'`
 
 echo " + clang version: $NGX_CLANG_VER"
diff --git a/auto/cc/name b/auto/cc/name
index d7943bc..51ec4d3 100644
--- a/auto/cc/name
+++ b/auto/cc/name
@@ -44,7 +44,11 @@
     NGX_CC_NAME=gcc
     echo " + using GNU C compiler"
 
-elif `$CC -v 2>&1 | grep '\(clang\|LLVM\) version' >/dev/null 2>&1`; then
+elif `$CC -v 2>&1 | grep 'clang version' >/dev/null 2>&1`; then
+    NGX_CC_NAME=clang
+    echo " + using Clang C compiler"
+
+elif `$CC -v 2>&1 | grep 'LLVM version' >/dev/null 2>&1`; then
     NGX_CC_NAME=clang
     echo " + using Clang C compiler"
 
diff --git a/auto/os/conf b/auto/os/conf
index 449279b..b197ed0 100644
--- a/auto/os/conf
+++ b/auto/os/conf
@@ -110,6 +110,11 @@
         NGX_MACH_CACHE_LINE=64
     ;;
 
+    aarch64 )
+        have=NGX_ALIGNMENT value=16 . $NGX_AUTO/define
+        NGX_MACH_CACHE_LINE=64
+    ;;
+
     *)
         have=NGX_ALIGNMENT value=16 . $NGX_AUTO/define
         NGX_MACH_CACHE_LINE=32
diff --git a/auto/os/linux b/auto/os/linux
index bbd1b8d..c636907 100644
--- a/auto/os/linux
+++ b/auto/os/linux
@@ -157,6 +157,38 @@
 . $NGX_AUTO/feature
 
 
+# prctl(PR_SET_KEEPCAPS)
+
+ngx_feature="prctl(PR_SET_KEEPCAPS)"
+ngx_feature_name="NGX_HAVE_PR_SET_KEEPCAPS"
+ngx_feature_run=yes
+ngx_feature_incs="#include <sys/prctl.h>"
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_test="if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) return 1"
+. $NGX_AUTO/feature
+
+
+# capabilities
+
+ngx_feature="capabilities"
+ngx_feature_name="NGX_HAVE_CAPABILITIES"
+ngx_feature_run=no
+ngx_feature_incs="#include <linux/capability.h>
+                  #include <sys/syscall.h>"
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_test="struct __user_cap_data_struct    data;
+                  struct __user_cap_header_struct  header;
+
+                  header.version = _LINUX_CAPABILITY_VERSION_1;
+                  data.effective = CAP_TO_MASK(CAP_NET_RAW);
+                  data.permitted = 0;
+
+                  (void) SYS_capset"
+. $NGX_AUTO/feature
+
+
 # crypt_r()
 
 ngx_feature="crypt_r()"
diff --git a/auto/unix b/auto/unix
index f721192..be43017 100644
--- a/auto/unix
+++ b/auto/unix
@@ -342,7 +342,7 @@
 . $NGX_AUTO/feature
 
 
-# NetBSD bind to any address for transparent proxying
+# OpenBSD bind to any address for transparent proxying
 
 ngx_feature="SO_BINDANY"
 ngx_feature_name="NGX_HAVE_TRANSPARENT_PROXY"
@@ -354,19 +354,6 @@
 . $NGX_AUTO/feature
 
 
-# Linux IP_BIND_ADDRESS_NO_PORT
-
-ngx_feature="IP_BIND_ADDRESS_NO_PORT"
-ngx_feature_name="NGX_HAVE_IP_BIND_ADDRESS_NO_PORT"
-ngx_feature_run=no
-ngx_feature_incs="#include <sys/socket.h>
-                  #include <netinet/in.h>"
-ngx_feature_path=
-ngx_feature_libs=
-ngx_feature_test="setsockopt(0, IPPROTO_IP, IP_BIND_ADDRESS_NO_PORT, NULL, 0)"
-. $NGX_AUTO/feature
-
-
 # Linux transparent proxying
 
 ngx_feature="IP_TRANSPARENT"
@@ -393,6 +380,19 @@
 . $NGX_AUTO/feature
 
 
+# Linux IP_BIND_ADDRESS_NO_PORT
+
+ngx_feature="IP_BIND_ADDRESS_NO_PORT"
+ngx_feature_name="NGX_HAVE_IP_BIND_ADDRESS_NO_PORT"
+ngx_feature_run=no
+ngx_feature_incs="#include <sys/socket.h>
+                  #include <netinet/in.h>"
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_test="setsockopt(0, IPPROTO_IP, IP_BIND_ADDRESS_NO_PORT, NULL, 0)"
+. $NGX_AUTO/feature
+
+
 # BSD way to get IPv4 datagram destination address
 
 ngx_feature="IP_RECVDSTADDR"
@@ -964,6 +964,16 @@
 . $NGX_AUTO/feature
 
 
+ngx_feature="sysconf(_SC_LEVEL1_DCACHE_LINESIZE)"
+ngx_feature_name="NGX_HAVE_LEVEL1_DCACHE_LINESIZE"
+ngx_feature_run=no
+ngx_feature_incs=
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_test="sysconf(_SC_LEVEL1_DCACHE_LINESIZE)"
+. $NGX_AUTO/feature
+
+
 ngx_feature="openat(), fstatat()"
 ngx_feature_name="NGX_HAVE_OPENAT"
 ngx_feature_run=no
diff --git a/build.bzl b/build.bzl
index cc87871..3e3a157 100644
--- a/build.bzl
+++ b/build.bzl
@@ -663,7 +663,7 @@
         name = "nginx_pkgoss",
         build_file_content = _PKGOSS_BUILD_FILE.format(nginx = nginx) +
                              _PKGOSS_BUILD_FILE_TAIL,
-        commit = "3f500f26ea239edfdd992040107872b88bac875d",  # nginx-1.13.7
+        commit = "a3f54b8b1448fb590ff1e1de2ec8b90a9067d90b",  # nginx-1.13.8
         remote = "https://nginx.googlesource.com/nginx-pkgoss",
     )
 
diff --git a/contrib/vim/syntax/nginx.vim b/contrib/vim/syntax/nginx.vim
index dc8c0cb..3615e22 100644
--- a/contrib/vim/syntax/nginx.vim
+++ b/contrib/vim/syntax/nginx.vim
@@ -15,7 +15,7 @@
 syn match ngxName '\([^;{} \t\\]\|\\.\)\+'
     \ contains=@ngxDirectives
     \ nextgroup=@ngxParams skipwhite skipempty
-syn match ngxParam '\([^;{ \t\\]\|\\.\)\+'
+syn match ngxParam '\(\${\|[^;{ \t\\]\|\\.\)\+'
     \ contained
     \ contains=ngxVariable
     \ nextgroup=@ngxParams skipwhite skipempty
@@ -29,7 +29,7 @@
     \ contains=@ngxTopLevel
 syn match ngxComment '#.*$'
 
-syn match ngxVariable '\$\w\+' contained
+syn match ngxVariable '\$\(\w\+\|{\w\+}\)' contained
 syn match ngxVariableString '\$\(\w\+\|{\w\+}\)' contained
 
 syn cluster ngxTopLevel
@@ -52,7 +52,7 @@
 syn cluster ngxTopLevel add=ngxDirectiveListen
 syn keyword ngxDirectiveListen listen
     \ nextgroup=@ngxListenParams skipwhite skipempty
-syn match ngxListenParam '\([^;{ \t\\]\|\\.\)\+'
+syn match ngxListenParam '\(\${\|[^;{ \t\\]\|\\.\)\+'
     \ contained
     \ nextgroup=@ngxListenParams skipwhite skipempty
 syn region ngxListenString start=+\z(["']\)+ end=+\z1+ skip=+\\\\\|\\\z1+
@@ -62,15 +62,19 @@
     \ contained
     \ nextgroup=@ngxListenParams skipwhite skipempty
 syn keyword ngxListenOptions contained
-    \ default_server ssl http2 spdy proxy_protocol
+    \ default_server ssl http2 proxy_protocol
     \ setfib fastopen backlog rcvbuf sndbuf accept_filter deferred bind
-    \ ipv6only reuseport so_keepalive keepidle
+    \ ipv6only reuseport so_keepalive
+    \ nextgroup=@ngxListenParams skipwhite skipempty
+syn keyword ngxListenOptionsDeprecated contained
+    \ spdy
     \ nextgroup=@ngxListenParams skipwhite skipempty
 syn cluster ngxListenParams
     \ contains=ngxListenParam,ngxListenString,ngxListenComment
-    \ add=ngxListenOptions
+    \ add=ngxListenOptions,ngxListenOptionsDeprecated
 
 syn keyword ngxDirectiveBlock contained http
+syn keyword ngxDirectiveBlock contained stream
 syn keyword ngxDirectiveBlock contained mail
 syn keyword ngxDirectiveBlock contained events
 syn keyword ngxDirectiveBlock contained server
@@ -105,14 +109,16 @@
 syn keyword ngxDirectiveError contained error_page
 syn keyword ngxDirectiveError contained post_action
 
-syn keyword ngxDirectiveDeprecated contained connections
-syn keyword ngxDirectiveDeprecated contained imap
-syn keyword ngxDirectiveDeprecated contained limit_zone
-syn keyword ngxDirectiveDeprecated contained mysql_test
-syn keyword ngxDirectiveDeprecated contained open_file_cache_retest
-syn keyword ngxDirectiveDeprecated contained optimize_server_names
-syn keyword ngxDirectiveDeprecated contained satisfy_any
-syn keyword ngxDirectiveDeprecated contained so_keepalive
+syn keyword ngxDirectiveDeprecated contained proxy_downstream_buffer
+syn keyword ngxDirectiveDeprecated contained proxy_upstream_buffer
+syn keyword ngxDirectiveDeprecated contained spdy_chunk_size
+syn keyword ngxDirectiveDeprecated contained spdy_headers_comp
+syn keyword ngxDirectiveDeprecated contained spdy_keepalive_timeout
+syn keyword ngxDirectiveDeprecated contained spdy_max_concurrent_streams
+syn keyword ngxDirectiveDeprecated contained spdy_pool_size
+syn keyword ngxDirectiveDeprecated contained spdy_recv_buffer_size
+syn keyword ngxDirectiveDeprecated contained spdy_recv_timeout
+syn keyword ngxDirectiveDeprecated contained spdy_streams_index_size
 
 syn keyword ngxDirective contained absolute_redirect
 syn keyword ngxDirective contained accept_mutex
@@ -122,6 +128,7 @@
 syn keyword ngxDirective contained add_after_body
 syn keyword ngxDirective contained add_before_body
 syn keyword ngxDirective contained add_header
+syn keyword ngxDirective contained add_trailer
 syn keyword ngxDirective contained addition_types
 syn keyword ngxDirective contained aio
 syn keyword ngxDirective contained aio_write
@@ -186,6 +193,7 @@
 syn keyword ngxDirective contained fastcgi_buffers
 syn keyword ngxDirective contained fastcgi_busy_buffers_size
 syn keyword ngxDirective contained fastcgi_cache
+syn keyword ngxDirective contained fastcgi_cache_background_update
 syn keyword ngxDirective contained fastcgi_cache_bypass
 syn keyword ngxDirective contained fastcgi_cache_key
 syn keyword ngxDirective contained fastcgi_cache_lock
@@ -258,15 +266,17 @@
 syn keyword ngxDirective contained hls_fragment
 syn keyword ngxDirective contained hls_mp4_buffer_size
 syn keyword ngxDirective contained hls_mp4_max_buffer_size
-syn keyword ngxDirective contained http2_chunk_size
 syn keyword ngxDirective contained http2_body_preread_size
+syn keyword ngxDirective contained http2_chunk_size
 syn keyword ngxDirective contained http2_idle_timeout
 syn keyword ngxDirective contained http2_max_concurrent_streams
 syn keyword ngxDirective contained http2_max_field_size
 syn keyword ngxDirective contained http2_max_header_size
 syn keyword ngxDirective contained http2_max_requests
+syn keyword ngxDirective contained http2_pool_size
 syn keyword ngxDirective contained http2_recv_buffer_size
 syn keyword ngxDirective contained http2_recv_timeout
+syn keyword ngxDirective contained http2_streams_index_size
 syn keyword ngxDirective contained if_modified_since
 syn keyword ngxDirective contained ignore_invalid_headers
 syn keyword ngxDirective contained image_filter
@@ -332,6 +342,8 @@
 syn keyword ngxDirective contained memcached_send_timeout
 syn keyword ngxDirective contained merge_slashes
 syn keyword ngxDirective contained min_delete_depth
+syn keyword ngxDirective contained mirror
+syn keyword ngxDirective contained mirror_request_body
 syn keyword ngxDirective contained modern_browser
 syn keyword ngxDirective contained modern_browser_value
 syn keyword ngxDirective contained mp4
@@ -374,6 +386,7 @@
 syn keyword ngxDirective contained proxy_buffers
 syn keyword ngxDirective contained proxy_busy_buffers_size
 syn keyword ngxDirective contained proxy_cache
+syn keyword ngxDirective contained proxy_cache_background_update
 syn keyword ngxDirective contained proxy_cache_bypass
 syn keyword ngxDirective contained proxy_cache_convert_head
 syn keyword ngxDirective contained proxy_cache_key
@@ -421,6 +434,7 @@
 syn keyword ngxDirective contained proxy_send_timeout
 syn keyword ngxDirective contained proxy_set_body
 syn keyword ngxDirective contained proxy_set_header
+syn keyword ngxDirective contained proxy_ssl
 syn keyword ngxDirective contained proxy_ssl_certificate
 syn keyword ngxDirective contained proxy_ssl_certificate_key
 syn keyword ngxDirective contained proxy_ssl_ciphers
@@ -463,6 +477,7 @@
 syn keyword ngxDirective contained scgi_buffers
 syn keyword ngxDirective contained scgi_busy_buffers_size
 syn keyword ngxDirective contained scgi_cache
+syn keyword ngxDirective contained scgi_cache_background_update
 syn keyword ngxDirective contained scgi_cache_bypass
 syn keyword ngxDirective contained scgi_cache_key
 syn keyword ngxDirective contained scgi_cache_lock
@@ -520,14 +535,6 @@
 syn keyword ngxDirective contained smtp_client_buffer
 syn keyword ngxDirective contained smtp_greeting_delay
 syn keyword ngxDirective contained source_charset
-syn keyword ngxDirective contained spdy_chunk_size
-syn keyword ngxDirective contained spdy_headers_comp
-syn keyword ngxDirective contained spdy_keepalive_timeout
-syn keyword ngxDirective contained spdy_max_concurrent_streams
-syn keyword ngxDirective contained spdy_pool_size
-syn keyword ngxDirective contained spdy_recv_buffer_size
-syn keyword ngxDirective contained spdy_recv_timeout
-syn keyword ngxDirective contained spdy_streams_index_size
 syn keyword ngxDirective contained ssi
 syn keyword ngxDirective contained ssi_ignore_recycled_buffers
 syn keyword ngxDirective contained ssi_last_modified
@@ -600,11 +607,13 @@
 syn keyword ngxDirective contained uwsgi_buffers
 syn keyword ngxDirective contained uwsgi_busy_buffers_size
 syn keyword ngxDirective contained uwsgi_cache
+syn keyword ngxDirective contained uwsgi_cache_background_update
 syn keyword ngxDirective contained uwsgi_cache_bypass
 syn keyword ngxDirective contained uwsgi_cache_key
 syn keyword ngxDirective contained uwsgi_cache_lock
 syn keyword ngxDirective contained uwsgi_cache_lock_age
 syn keyword ngxDirective contained uwsgi_cache_lock_timeout
+syn keyword ngxDirective contained uwsgi_cache_max_range_offset
 syn keyword ngxDirective contained uwsgi_cache_methods
 syn keyword ngxDirective contained uwsgi_cache_min_uses
 syn keyword ngxDirective contained uwsgi_cache_path
@@ -662,6 +671,7 @@
 syn keyword ngxDirective contained worker_rlimit_core
 syn keyword ngxDirective contained worker_rlimit_nofile
 syn keyword ngxDirective contained worker_rlimit_sigpending
+syn keyword ngxDirective contained worker_shutdown_timeout
 syn keyword ngxDirective contained worker_threads
 syn keyword ngxDirective contained working_directory
 syn keyword ngxDirective contained xclient
@@ -2170,5 +2180,6 @@
 hi link ngxDirectiveThirdParty Special
 
 hi link ngxListenOptions Keyword
+hi link ngxListenOptionsDeprecated Error
 
 let b:current_syntax = "nginx"
diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml
index ec871d8..9005680 100644
--- a/docs/xml/nginx/changes.xml
+++ b/docs/xml/nginx/changes.xml
@@ -5,6 +5,112 @@
 <change_log title="nginx">
 
 
+<changes ver="1.13.8" date="2017-12-26">
+
+<change type="feature">
+<para lang="ru">
+теперь при использовании параметра transparent директив proxy_bind,
+fastcgi_bind, memcached_bind, scgi_bind и uwsgi_bind
+nginx автоматически сохраняет capability CAP_NET_RAW в рабочих процессах.
+</para>
+<para lang="en">
+now nginx automatically preserves the CAP_NET_RAW capability in worker processes
+when using the "transparent" parameter of the "proxy_bind",
+"fastcgi_bind", "memcached_bind", "scgi_bind", and "uwsgi_bind" directives.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+улучшения в определении размера строки кэша процессора.<br/>
+Спасибо Debayan Ghosh.
+</para>
+<para lang="en">
+improved CPU cache line size detection.<br/>
+Thanks to Debayan Ghosh.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+новые директивы в скриптах подсветки синтаксиса для vim.<br/>
+Спасибо Геннадию Махомеду.
+</para>
+<para lang="en">
+new directives in vim syntax highlighting scripts.<br/>
+Thanks to Gena Makhomed.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+процедура обновления исполняемого файла не работала,
+если после завершения родительского процесса
+новым родительским процессом nginx'а становился процесс с PID, отличным от 1.
+</para>
+<para lang="en">
+binary upgrade refused to work
+if nginx was re-parented to a process with PID different from 1
+after its parent process has finished.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+модуль ngx_http_autoindex_module неправильно обрабатывал запросы с телом.
+</para>
+<para lang="en">
+the ngx_http_autoindex_module incorrectly handled requests with bodies.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+в директиве proxy_limit_rate при использовании с директивой keepalive.
+</para>
+<para lang="en">
+in the "proxy_limit_rate" directive when used with the "keepalive" directive.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+при использовании "proxy_buffering off" часть ответа могла буферизироваться,
+если клиентское соединение использовало SSL.<br/>
+Спасибо Patryk Lesiewicz.
+</para>
+<para lang="en">
+some parts of a response might be buffered when using "proxy_buffering off"
+if the client connection used SSL.<br/>
+Thanks to Patryk Lesiewicz.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+в директиве proxy_cache_background_update.
+</para>
+<para lang="en">
+in the "proxy_cache_background_update" directive.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+переменную вида "${name}" с именем в фигурных скобках
+нельзя было использовать в начале параметра
+не заключив весь параметр в кавычки.
+</para>
+<para lang="en">
+it was not possible to start a parameter
+with a variable in the "${name}" form with the name in curly brackets
+without enclosing the parameter into single or double quotes.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="1.13.7" date="2017-11-21">
 
 <change type="bugfix">
diff --git a/misc/GNUmakefile b/misc/GNUmakefile
index 19a70e0..9a9405c 100644
--- a/misc/GNUmakefile
+++ b/misc/GNUmakefile
@@ -6,7 +6,7 @@
 
 CC =		cl
 OBJS =		objs.msvc8
-OPENSSL =	openssl-1.0.2m
+OPENSSL =	openssl-1.0.2n
 ZLIB =		zlib-1.2.11
 PCRE =		pcre-8.41
 
diff --git a/src/core/nginx.c b/src/core/nginx.c
index 373cdbc..d5d00f2 100644
--- a/src/core/nginx.c
+++ b/src/core/nginx.c
@@ -236,6 +236,7 @@
 #endif
 
     ngx_pid = ngx_getpid();
+    ngx_parent = ngx_getppid();
 
     log = ngx_log_init(ngx_prefix);
     if (log == NULL) {
diff --git a/src/core/nginx.h b/src/core/nginx.h
index 0cc4623..53a506c 100644
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -13,8 +13,8 @@
 #define NGINX_NAME         "nginx"
 #endif
 
-#define nginx_version      1013007
-#define NGINX_VERSION      "1.13.7"
+#define nginx_version      1013008
+#define NGINX_VERSION      "1.13.8"
 #define NGINX_VER          NGINX_NAME "/" NGINX_VERSION
 
 #ifdef NGX_BUILD
diff --git a/src/core/ngx_conf_file.c b/src/core/ngx_conf_file.c
index fb28a5a..ba454de 100644
--- a/src/core/ngx_conf_file.c
+++ b/src/core/ngx_conf_file.c
@@ -709,6 +709,11 @@
                 last_space = 0;
                 continue;
 
+            case '$':
+                variable = 1;
+                last_space = 0;
+                continue;
+
             default:
                 last_space = 0;
             }
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
index 24b2add..cab2580 100644
--- a/src/core/ngx_cycle.h
+++ b/src/core/ngx_cycle.h
@@ -114,6 +114,8 @@
 
     ngx_array_t               env;
     char                    **environment;
+
+    ngx_uint_t                transparent;  /* unsigned  transparent:1; */
 } ngx_core_conf_t;
 
 
diff --git a/src/http/modules/ngx_http_autoindex_module.c b/src/http/modules/ngx_http_autoindex_module.c
index b3bf652..94b91db 100644
--- a/src/http/modules/ngx_http_autoindex_module.c
+++ b/src/http/modules/ngx_http_autoindex_module.c
@@ -180,6 +180,12 @@
         return NGX_DECLINED;
     }
 
+    rc = ngx_http_discard_request_body(r);
+
+    if (rc != NGX_OK) {
+        return rc;
+    }
+
     /* NGX_DIR_MASK_LEN is lesser than NGX_HTTP_AUTOINDEX_PREALLOCATE */
 
     last = ngx_http_map_uri_to_path(r, &path, &root,
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
index 6157db5..655355e 100644
--- a/src/http/modules/ngx_http_proxy_module.c
+++ b/src/http/modules/ngx_http_proxy_module.c
@@ -1093,8 +1093,7 @@
 
         return NGX_OK;
 
-    } else if (ctx->vars.uri.len == 0 && r->valid_unparsed_uri && r == r->main)
-    {
+    } else if (ctx->vars.uri.len == 0 && r->valid_unparsed_uri) {
         *key = r->unparsed_uri;
         u->uri = r->unparsed_uri;
 
@@ -1103,7 +1102,7 @@
 
     loc_len = (r->valid_location && ctx->vars.uri.len) ? plcf->location.len : 0;
 
-    if (r->quoted_uri || r->internal) {
+    if (r->quoted_uri || r->space_in_uri || r->internal) {
         escape = 2 * ngx_escape_uri(NULL, r->uri.data + loc_len,
                                     r->uri.len - loc_len, NGX_ESCAPE_URI);
     } else {
@@ -1208,8 +1207,7 @@
     if (plcf->proxy_lengths && ctx->vars.uri.len) {
         uri_len = ctx->vars.uri.len;
 
-    } else if (ctx->vars.uri.len == 0 && r->valid_unparsed_uri && r == r->main)
-    {
+    } else if (ctx->vars.uri.len == 0 && r->valid_unparsed_uri) {
         unparsed_uri = 1;
         uri_len = r->unparsed_uri.len;
 
diff --git a/src/http/modules/ngx_http_upstream_keepalive_module.c b/src/http/modules/ngx_http_upstream_keepalive_module.c
index 0048e6b..90a226d 100644
--- a/src/http/modules/ngx_http_upstream_keepalive_module.c
+++ b/src/http/modules/ngx_http_upstream_keepalive_module.c
@@ -340,6 +340,7 @@
     pc->connection = NULL;
 
     if (c->read->timer_set) {
+        c->read->delayed = 0;
         ngx_del_timer(c->read);
     }
     if (c->write->timer_set) {
diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 7b1b797..90c73a4 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -2363,6 +2363,7 @@
         sr->method_name = r->method_name;
         sr->loc_conf = r->loc_conf;
         sr->valid_location = r->valid_location;
+        sr->valid_unparsed_uri = r->valid_unparsed_uri;
         sr->content_handler = r->content_handler;
         sr->phase_handler = r->phase_handler;
         sr->write_event_handler = ngx_http_core_run_phases;
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index ce3d8e9..f4f6465 100644
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -6214,6 +6214,12 @@
     if (cf->args->nelts > 2) {
         if (ngx_strcmp(value[2].data, "transparent") == 0) {
 #if (NGX_HAVE_TRANSPARENT_PROXY)
+            ngx_core_conf_t  *ccf;
+
+            ccf = (ngx_core_conf_t *) ngx_get_conf(cf->cycle->conf_ctx,
+                                                   ngx_core_module);
+
+            ccf->transparent = 1;
             local->transparent = 1;
 #else
             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c
index ab67211..385c49b 100644
--- a/src/os/unix/ngx_daemon.c
+++ b/src/os/unix/ngx_daemon.c
@@ -26,6 +26,7 @@
         exit(0);
     }
 
+    ngx_parent = ngx_pid;
     ngx_pid = ngx_getpid();
 
     if (setsid() == -1) {
diff --git a/src/os/unix/ngx_linux_config.h b/src/os/unix/ngx_linux_config.h
index 2f6129d..3036cae 100644
--- a/src/os/unix/ngx_linux_config.h
+++ b/src/os/unix/ngx_linux_config.h
@@ -99,6 +99,11 @@
 #endif
 
 
+#if (NGX_HAVE_CAPABILITIES)
+#include <linux/capability.h>
+#endif
+
+
 #define NGX_LISTEN_BACKLOG        511
 
 
diff --git a/src/os/unix/ngx_posix_config.h b/src/os/unix/ngx_posix_config.h
index 5d1358e..2a8c413 100644
--- a/src/os/unix/ngx_posix_config.h
+++ b/src/os/unix/ngx_posix_config.h
@@ -145,26 +145,6 @@
 #define ngx_debug_init()
 
 
-#if (__FreeBSD__) && (__FreeBSD_version < 400017)
-
-#include <sys/param.h>          /* ALIGN() */
-
-/*
- * FreeBSD 3.x has no CMSG_SPACE() and CMSG_LEN() and has the broken CMSG_DATA()
- */
-
-#undef  CMSG_SPACE
-#define CMSG_SPACE(l)       (ALIGN(sizeof(struct cmsghdr)) + ALIGN(l))
-
-#undef  CMSG_LEN
-#define CMSG_LEN(l)         (ALIGN(sizeof(struct cmsghdr)) + (l))
-
-#undef  CMSG_DATA
-#define CMSG_DATA(cmsg)     ((u_char *)(cmsg) + ALIGN(sizeof(struct cmsghdr)))
-
-#endif
-
-
 extern char **environ;
 
 
diff --git a/src/os/unix/ngx_posix_init.c b/src/os/unix/ngx_posix_init.c
index 4bd14a6..80cbd27 100644
--- a/src/os/unix/ngx_posix_init.c
+++ b/src/os/unix/ngx_posix_init.c
@@ -37,6 +37,9 @@
     long         value;
     ngx_time_t  *tp;
     ngx_uint_t   n;
+#if (NGX_HAVE_LEVEL1_DCACHE_LINESIZE)
+    long         size;
+#endif
 
 #if (NGX_HAVE_OS_SPECIFIC_INIT)
     if (ngx_os_specific_init(log) != NGX_OK) {
@@ -70,6 +73,13 @@
         ngx_ncpu = 1;
     }
 
+#if (NGX_HAVE_LEVEL1_DCACHE_LINESIZE)
+    size = sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+    if (size > 0) {
+        ngx_cacheline_size = size;
+    }
+#endif
+
     ngx_cpuinfo();
 
     if (getrlimit(RLIMIT_NOFILE, &rlmt) == -1) {
diff --git a/src/os/unix/ngx_process.c b/src/os/unix/ngx_process.c
index 993c032..1568023 100644
--- a/src/os/unix/ngx_process.c
+++ b/src/os/unix/ngx_process.c
@@ -194,6 +194,7 @@
         return NGX_INVALID_PID;
 
     case 0:
+        ngx_parent = ngx_pid;
         ngx_pid = ngx_getpid();
         proc(cycle, data);
         break;
@@ -371,12 +372,12 @@
             break;
 
         case ngx_signal_value(NGX_CHANGEBIN_SIGNAL):
-            if (getppid() > 1 || ngx_new_binary > 0) {
+            if (ngx_getppid() == ngx_parent || ngx_new_binary > 0) {
 
                 /*
                  * Ignore the signal in the new binary if its parent is
-                 * not the init process, i.e. the old binary's process
-                 * is still running.  Or ignore the signal in the old binary's
+                 * not changed, i.e. the old binary's process is still
+                 * running.  Or ignore the signal in the old binary's
                  * process if the new binary's process is already running.
                  */
 
diff --git a/src/os/unix/ngx_process.h b/src/os/unix/ngx_process.h
index 7b5e8c0..3986639 100644
--- a/src/os/unix/ngx_process.h
+++ b/src/os/unix/ngx_process.h
@@ -54,6 +54,7 @@
 
 
 #define ngx_getpid   getpid
+#define ngx_getppid  getppid
 
 #ifndef ngx_log_pid
 #define ngx_log_pid  ngx_pid
@@ -79,6 +80,7 @@
 extern char         **ngx_os_argv;
 
 extern ngx_pid_t      ngx_pid;
+extern ngx_pid_t      ngx_parent;
 extern ngx_socket_t   ngx_channel;
 extern ngx_int_t      ngx_process_slot;
 extern ngx_int_t      ngx_last_process;
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index 1710ea8..5817a2c 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -31,6 +31,7 @@
 ngx_uint_t    ngx_process;
 ngx_uint_t    ngx_worker;
 ngx_pid_t     ngx_pid;
+ngx_pid_t     ngx_parent;
 
 sig_atomic_t  ngx_reap;
 sig_atomic_t  ngx_sigio;
@@ -838,12 +839,44 @@
                           ccf->username, ccf->group);
         }
 
+#if (NGX_HAVE_PR_SET_KEEPCAPS && NGX_HAVE_CAPABILITIES)
+        if (ccf->transparent && ccf->user) {
+            if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "prctl(PR_SET_KEEPCAPS, 1) failed");
+                /* fatal */
+                exit(2);
+            }
+        }
+#endif
+
         if (setuid(ccf->user) == -1) {
             ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
                           "setuid(%d) failed", ccf->user);
             /* fatal */
             exit(2);
         }
+
+#if (NGX_HAVE_CAPABILITIES)
+        if (ccf->transparent && ccf->user) {
+            struct __user_cap_data_struct    data;
+            struct __user_cap_header_struct  header;
+
+            ngx_memzero(&header, sizeof(struct __user_cap_header_struct));
+            ngx_memzero(&data, sizeof(struct __user_cap_data_struct));
+
+            header.version = _LINUX_CAPABILITY_VERSION_1;
+            data.effective = CAP_TO_MASK(CAP_NET_RAW);
+            data.permitted = data.effective;
+
+            if (syscall(SYS_capset, &header, &data) == -1) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "capset() failed");
+                /* fatal */
+                exit(2);
+            }
+        }
+#endif
     }
 
     if (worker >= 0) {
diff --git a/src/os/win32/ngx_process.h b/src/os/win32/ngx_process.h
index a6a5aa2..7ec4cd9 100644
--- a/src/os/win32/ngx_process.h
+++ b/src/os/win32/ngx_process.h
@@ -14,6 +14,7 @@
 
 
 #define ngx_getpid          GetCurrentProcessId
+#define ngx_getppid()       0
 #define ngx_log_pid         ngx_pid
 
 
@@ -73,6 +74,7 @@
 extern ngx_process_t        ngx_processes[NGX_MAX_PROCESSES];
 
 extern ngx_pid_t            ngx_pid;
+extern ngx_pid_t            ngx_parent;
 
 
 #endif /* _NGX_PROCESS_H_INCLUDED_ */
diff --git a/src/os/win32/ngx_process_cycle.c b/src/os/win32/ngx_process_cycle.c
index 293b967..3aea874 100644
--- a/src/os/win32/ngx_process_cycle.c
+++ b/src/os/win32/ngx_process_cycle.c
@@ -31,6 +31,7 @@
 ngx_uint_t     ngx_process;
 ngx_uint_t     ngx_worker;
 ngx_pid_t      ngx_pid;
+ngx_pid_t      ngx_parent;
 
 ngx_uint_t     ngx_inherited;
 ngx_pid_t      ngx_new_binary;
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
index ad81cc8..818d732 100644
--- a/src/stream/ngx_stream_proxy_module.c
+++ b/src/stream/ngx_stream_proxy_module.c
@@ -2155,6 +2155,12 @@
     if (cf->args->nelts > 2) {
         if (ngx_strcmp(value[2].data, "transparent") == 0) {
 #if (NGX_HAVE_TRANSPARENT_PROXY)
+            ngx_core_conf_t  *ccf;
+
+            ccf = (ngx_core_conf_t *) ngx_get_conf(cf->cycle->conf_ctx,
+                                                   ngx_core_module);
+
+            ccf->transparent = 1;
             local->transparent = 1;
 #else
             ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,