Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/proxy/proxy_cli.c
===================================================================
--- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/proxy/proxy_cli.c	(revision 20314)
+++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/proxy/proxy_cli.c	(working copy)
@@ -97,6 +97,7 @@
 extern struct comp_uagent_head comp_uagent_head;
 extern struct comp_ie_uagent_head comp_ie_uagent_head;
 extern err_page_head_t err_page_head;
+extern int cookie_check_enable;
 
 extern int32_t slb_array_model; /* used to check SLB License */
 extern int triangle_flag;		/*bug 17186, kouhb, 20070918*/
@@ -10604,6 +10605,12 @@
 		ui_printf(pcb, CMD_HTTP_BUFFER_NOMSGLEN_ON);
 	}
 
+	if (cookie_check_enable)  {
+		ui_printf(pcb, CMD_HTTP_COOKIE_CHECK_ON);
+	} else {
+		ui_printf(pcb, CMD_HTTP_COOKIE_CHECK_OFF);
+	}
+
 	if (pc->shunt_reset == FALSE) {
 		ui_printf(pcb, CMD_HTTP_SHUNTRESET_OFF);
 	} else {
Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/smanager/sec_ui.c
===================================================================
--- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/smanager/sec_ui.c	(revision 20314)
+++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/smanager/sec_ui.c	(working copy)
@@ -160,6 +160,7 @@
 
 
 extern struct quicklink_ipport_list quicklink_list;
+extern int cookie_check_enable;
 
 ca_errcode_t
 urlpolicy_external(void *pcb, char *site_id, uint32_t priority, char *string)
@@ -4582,6 +4583,20 @@
 	return 0;
 }
 
+int 
+http_cookie_check_on(void *pcb)
+{
+	cookie_check_enable = 1;
+	return 0;
+}
+
+int 
+http_cookie_check_off(void *pcb)
+{
+	cookie_check_enable = 0;
+	return 0;
+}
+
 /* Number of active sessions */
 int32_t snmp_get_nsession(void *pcb)
 {
Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/netinet/click_input.c
===================================================================
--- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/netinet/click_input.c	(revision 20314)
+++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/netinet/click_input.c	(working copy)
@@ -289,6 +289,14 @@
 SYSCTL_INT(_net_inet_clicktcp, OID_AUTO, ntp_type, CTLFLAG_RW, 
         &ntp_type, 0, "ntp type"); 
 
+int mp_prelogin_enable=0; 
+SYSCTL_INT(_net_inet_clicktcp, OID_AUTO, mp_prelogin_enable, CTLFLAG_RW, 
+        &mp_prelogin_enable, 0, "Enable mp prelogin"); 
+ 
+int cookie_check_enable=1; 
+int *cookie_check_enable_ptr = &cookie_check_enable;
+SYSCTL_ULONG(_net_inet_clicktcp, OID_AUTO, cookie_check_enable_ptr, CTLFLAG_RW, 
+        &cookie_check_enable_ptr, 0, "Enable cookie check"); 
 
 /* Statistic variable */
 static int syn_stat_ip_total = 0;
@@ -1991,7 +1999,8 @@
 	nrmbfree = nrclfree = maxconnections / 128;
     }
     connection_limit = maxconnections;
-
+	
+    getenv_int("mp_prelogin_enable", &mp_prelogin_enable);
 #ifndef CLICKPCB_USE_MALLOC
        /* uma_prealloc() goes here... */ 
 #ifdef CLICKTCP 
Index: /branches/rel_ag_9_4_5/ui/generator/commands.pm
===================================================================
--- /branches/rel_ag_9_4_5/ui/generator/commands.pm	(revision 20317)
+++ /branches/rel_ag_9_4_5/ui/generator/commands.pm	(working copy)
@@ -25059,7 +25059,7 @@
 		parent_menu => "root_http",
 		uniq_name => "root_http_cookie",
 		user_level => "CLI_LEVEL_CONFIG",
-		cmd_attribute => "CMD_SPROXY|CMD_NORMAL|CMD_SCOPE_VIRTUAL|CMD_SITE_EXCLUSIVE|CMD_SITE_ALIAS",
+		cmd_attribute => "CMD_SPROXY|CMD_NORMAL|CMD_SCOPE_VIRTUAL|CMD_SITE_EXCLUSIVE|CMD_SITE_ALIAS|CMD_SCOPE_GLOBAL",
 		help_string => "Manage handling of cookies in HTTP responses",
 	},
 	{
@@ -25239,6 +25239,38 @@
 	},
 	{
 		obj_type => "MENU",
+		name => "check",
+		module => "http",
+		parent_menu => "root_http_cookie",
+		uniq_name => "root_http_cookie_check",
+		user_level => "CLI_LEVEL_CONFIG",
+		cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_SCOPE_GLOBAL",
+		help_string => "Manage whether to check the cookies in HTTP request",
+	},
+	{
+		obj_type => "ITEM",
+		name => "on",
+		module => "http",
+		menu => "root_http_cookie_check",
+		help_string => "Enable the HTTP cookie check function",
+		cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_KERN_API|CMD_SCOPE_GLOBAL",
+		user_level => "CLI_LEVEL_CONFIG",
+		function_name => "http_cookie_check_on",
+		function_args => [],
+	},
+	{
+		obj_type => "ITEM",
+		name => "off",
+		module => "http",
+		menu => "root_http_cookie_check",
+		help_string => "Disable the HTTP cookie check function",
+		cmd_attribute => "CMD_ARRAYOS|CMD_SPROXY|CMD_NORMAL|CMD_KERN_API|CMD_SCOPE_GLOBAL",
+		user_level => "CLI_LEVEL_CONFIG",
+		function_name => "http_cookie_check_off",
+		function_args => [],
+	},
+	{
+		obj_type => "MENU",
 		name => "expire",
 		module => "http",
 		parent_menu => "root_http_cookie",
Index: /branches/rel_ag_9_4_5/uproxy/driver/amp_driver.c
===================================================================
--- /branches/rel_ag_9_4_5/uproxy/driver/amp_driver.c	(revision 20314)
+++ /branches/rel_ag_9_4_5/uproxy/driver/amp_driver.c	(working copy)
@@ -84,6 +84,7 @@
 int32_t *default_lang_id;
 struct mbuf *mbuf_vpn_addr;
 
+int *cookie_check_enable_ptr = NULL;
 int    *callhome_switch = NULL;
 char *callhome_url = NULL;
 char *callhome_uname = NULL;
@@ -529,6 +530,14 @@
 		ulog_error_no_conn(AMP_ULOG_DRIVER, "Unable to read vpn acceleration mode");
 	}
 
+    len = sizeof(cookie_check_enable_ptr);
+	if (sysctlbyname("net.inet.clicktcp.cookie_check_enable_ptr",
+	            &cookie_check_enable_ptr, &len, NULL, 0) < 0)
+	{
+		printf("Unable to read cookie check value\n");
+		ulog_error_no_conn(AMP_ULOG_DRIVER, "Unable to read cookie check value");
+	}
+
     if (mpool_init()!=0){
 	printf("Could not init mpool.. exiting\n");
         ulog_error_no_conn(AMP_ULOG_DRIVER, "Could not init mpool.. exiting");
Index: /branches/rel_ag_9_4_5/uproxy/http_proxy/parser_utils.c
===================================================================
--- /branches/rel_ag_9_4_5/uproxy/http_proxy/parser_utils.c	(revision 20314)
+++ /branches/rel_ag_9_4_5/uproxy/http_proxy/parser_utils.c	(working copy)
@@ -4953,6 +4953,7 @@
 {
 	uint16_t token = HTTP_REQ_HDRS_INITIAL;
 	uint16_t retval = 0;
+	int ret = 0;
 	struct frame *header_start_frame_p = rwp->wr_frame_p;
 	uint8_t *header_start_p = rwp->wr_p;
 	uint32_t header_start = rwp->new_headers_len;
@@ -5165,13 +5166,15 @@
 				 retval == GLOBAL_HTTP_NEXT_HDR) &&
 				!SLIST_EMPTY(&(proxy_p->cookie_list))) 
 			{
-				if (cookie_decode(surl_info_p,
+				ret = cookie_decode(surl_info_p,
 								  client_conn_data,
 						  (retval == GLOBAL_HTTP_END_LF || 
 						   retval == GLOBAL_HTTP_END_CRLF),
-						  rwp, header_start_frame_p, header_start_p,
-						  header_start) > 0) {
+						  rwp, header_start_frame_p, header_start_p, header_start);
+				if (ret	> 0) {
 					cookie_list_destroy(proxy_p);
+				} else if (ret == -1) {
+					return GLOBAL_HTTP_INVALID_HDR;
 				}
 			}
 			break;
Index: /branches/rel_ag_9_4_5/uproxy/http_proxy/smanager/smanager_states.c
===================================================================
--- /branches/rel_ag_9_4_5/uproxy/http_proxy/smanager/smanager_states.c	(revision 20314)
+++ /branches/rel_ag_9_4_5/uproxy/http_proxy/smanager/smanager_states.c	(working copy)
@@ -1201,6 +1201,8 @@
 	static int url_len = 0;
 	int url_len_tmp = 0;
 	char *query_mark = NULL;
+	int mp_prelogin_enable = 0;
+	size_t mp_prelogin_len = 4;
 
 	ulog_error_no_conn(AMP_ULOG_AMPCONNAPI, "Before sec_content_search, host %s, port %d,"
 	          "url %s, url len %d, vsite_p %p",
@@ -1496,7 +1498,18 @@
 				(strcmp(sec_data_p->servername, DNS_LOCAL_HOST) == 0 || strcmp(sec_data_p->servername, DNS_LOCAL_HOST_ALIAS) == 0) &&
 				sec_data_p->port == MOTIONPRO_DEFAULT_PORT) {
 		SEC_SET(sec_data_p->flags, MP_PRELOGIN);
-		sec_data_p->url_classify = URL_PUBLIC;
+		sec_data_p->url_classify = URL_BLOCK;
+		if (sysctlbyname("net.inet.clicktcp.mp_prelogin_enable", &mp_prelogin_enable, &mp_prelogin_len, NULL, 0) == 0) {
+			if (mp_prelogin_enable) {
+				sec_data_p->url_classify = URL_PUBLIC;
+			} else {
+				ulog_error_conn(SM_CLIENT_CONN(sm_data_p), AMP_ULOG_SMANAGER, "prelogin service is blocked.");
+				sec_generate_error_response(sec_data_p, FALSE, BAD_REQUEST, SEC_CUSTOM_ERR_REQ, "prelogin service is blocked.");
+			}
+		} else {
+			ulog_error_conn(SM_CLIENT_CONN(sm_data_p), AMP_ULOG_SMANAGER, "prelogin service unavailable.");
+			sec_generate_error_response(sec_data_p, FALSE, BAD_REQUEST, SEC_CUSTOM_ERR_REQ, "prelogin service is unavailable.");
+		}
 	} else if (!strncmp(url_host, MP_POSTLOGIN_PATH, strlen(MP_POSTLOGIN_PATH)) || !strncmp(url_host, MP_BOOKMARK_PATH, strlen(MP_BOOKMARK_PATH))) {
 		SEC_SET(sec_data_p->flags, MP_POSTLOGIN);
 	} else if (!strncmp(url_host, MP_APPS_PATH, strlen(MP_APPS_PATH))) {
Index: /branches/rel_ag_9_4_5/uproxy/http_proxy/sproxy_dummy.c
===================================================================
--- /branches/rel_ag_9_4_5/uproxy/http_proxy/sproxy_dummy.c	(revision 20314)
+++ /branches/rel_ag_9_4_5/uproxy/http_proxy/sproxy_dummy.c	(working copy)
@@ -88,6 +88,7 @@
 char sec_cookie_session_name[SEC_COOKIE_SESSION_NAME_PREFIX_LEN + CLICK_ID_LENGTH + 1] = {0};
 uint32_t sec_cookie_session_name_length = 0;
 extern char *ha_cookie_session_name;
+extern int *cookie_check_enable_ptr;
 
 extern uint8_t bookmark_cookie_buffer[];
 int sp_without_ssl = FALSE;
@@ -1588,6 +1589,7 @@
 	struct frame *new_cookie_wr_frame_p = NULL;
 	uint8_t *new_cookie_write_p = NULL;
 	uint32_t sess_id_from_cookie = INVALID_SESSION_ID;
+	size_t cookie_check_len = 4;
 	
 	/* Buffers for cookie rewrite operations */
 	static char copy_name[MAX_COOKIE_SIZE] = {0};
@@ -1683,6 +1685,15 @@
 		 */
 		n_unescape(orig_name, copy_name, node_p->name_len, MAX_COOKIE_SIZE, &copy_name_len);
 
+		if (cookie_check_enable_ptr && *cookie_check_enable_ptr && (strstr(copy_name, "\r") || strstr(copy_name, "\n"))) {
+			ulog_error_conn(PROXY_CONNP(client_conn_data), AMP_ULOG_HTTP_PROXY, "Cookie name decode failed");
+			if (new_cookie_frame_p) {
+				parser_frame_chain_free(new_cookie_frame_p);
+				new_cookie_frame_p = NULL;
+			}
+			return -1;
+		}
+
 		memset(orig_value, 0, sizeof(orig_value));
 		memset(copy_value, 0, sizeof(copy_value));
 		if (node_p->value_p != NULL) {
@@ -1692,6 +1703,14 @@
 			 * Our encoded cookie values are escaped.. unescape these.
 			 */
 			n_unescape(orig_value, copy_value, node_p->value_len, MAX_COOKIE_SIZE, &copy_value_len);
+			if (cookie_check_enable_ptr && *cookie_check_enable_ptr && (strstr(copy_value, "\r") || strstr(copy_value, "\n"))) {
+				ulog_error_conn(PROXY_CONNP(client_conn_data), AMP_ULOG_HTTP_PROXY, "Cookie value decode failed");
+				if (new_cookie_frame_p) {
+					parser_frame_chain_free(new_cookie_frame_p);
+					new_cookie_frame_p = NULL;
+				}
+				return -1;
+			}
 		}
 
 		/*