Add -A|-a to s6-tcpserver-access and s6-tlsserver; prepare for 2.8.1.0HEADmain

8 files changed, 176 insertions, 141 deletions

diff --git a/NEWS b/NEWS
index 749712e..82f9141 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,13 @@
 Changelog for s6-networking.
 
+In 2.8.1.0
+----------
+
+ - New options to s6-tcpserver-access: -A, -a.
+Used to control default policy if a client matches no rule.
+ - New -A, -a options to s6-tlsserver to mirror them.
+
+
 In 2.8.0.1
 ----------
 
diff --git a/doc/index.html b/doc/index.html
index 219b397..ddfc7d5 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -92,8 +92,8 @@ run-time requirement if you link against its shared version. </li>
 
 <ul>
  <li> The current released version of s6-networking is
-<a href="s6-networking-2.8.0.1.tar.gz">2.8.0.1</a>.
-You can access its checksum <a href="s6-networking-2.8.0.1.tar.gz.sha256">here</a>. </li>
+<a href="s6-networking-2.8.1.0.tar.gz">2.8.1.0</a>.
+You can access its checksum <a href="s6-networking-2.8.1.0.tar.gz.sha256">here</a>. </li>
  <li> Alternatively, you can checkout a copy of the
 <a href="//git.skarnet.org/cgit/s6-networking/">s6-networking
 git repository</a>:
diff --git a/doc/s6-tcpserver-access.html b/doc/s6-tcpserver-access.html
index 6de1ca6..b0a4bbd 100644
--- a/doc/s6-tcpserver-access.html
+++ b/doc/s6-tcpserver-access.html
@@ -31,7 +31,7 @@ just like tcpwrappers' <tt>tcpd</tt> program.
 <h2> Interface </h2>
 
 <pre>
-     s6-tcpserver-access [ -v <em>verbosity</em> ] [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -l <em>localname</em> ] [ -B <em>banner</em> ] [ -t <em>timeout</em> ] [ -i <em>rulesdir</em> | -x <em>rulesfile</em> ] <em>prog...</em>
+     s6-tcpserver-access [ -v <em>verbosity</em> ] [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -A | -a ] [ -l <em>localname</em> ] [ -B <em>banner</em> ] [ -t <em>timeout</em> ] [ -i <em>rulesdir</em> | -x <em>rulesfile</em> ] <em>prog...</em>
 </pre>
 
 <ul>
@@ -126,6 +126,16 @@ the connection if none of the results matches the address the connection
 is originating from. For safest results, pair that option with <tt>-w</tt>
 so any DNS error drops the connection. (Note that this still does not replace real
 authentication via a cryptographic protocol.) </li>
+ <li> <tt>-A</tt>&nbsp;: do not accept by default. If the <tt>-i</tt> or
+<tt>-x</tt> option is given, and the IP address and host name of the client
+do not match any rule in the ruleset, deny the connection. This is the
+default. </li>
+ <li> <tt>-a</tt>&nbsp;: accept by default. If the <tt>-i</tt> or
+<tt>-x</tt> option is given, and the IP address and host name of the client
+do not match any rule in the ruleset, accept the connection. This is
+useful for instance when expecting clients that may have a broken reverse
+DNS and so cannot match against rules involving host names, and these
+clients need to be able to connect. </li>
  <li> <tt>-l&nbsp;<em>localname</em></tt>&nbsp;: use <em>localname</em>
 as the value for the ${PROTO}LOCALHOST environment variable, instead of
 looking it up in the DNS. </li>
diff --git a/doc/s6-tlsserver.html b/doc/s6-tlsserver.html
index 313e369..b0d91df 100644
--- a/doc/s6-tlsserver.html
+++ b/doc/s6-tlsserver.html
@@ -177,6 +177,7 @@ to <em>prog</em>. </li>
  <li> <tt>-d</tt>, <tt>-D</tt>&nbsp;: enable or disable Nagle's algorithm </li>
  <li> <tt>-r</tt>, <tt>-R</tt>&nbsp;: enable or disable IDENT lookups </li>
  <li> <tt>-p</tt>, <tt>-P</tt>&nbsp;: enable or disable paranoid DNS cross-checking </li>
+ <li> <tt>-A</tt>, <tt>-a</tt>&nbsp;: reject or accept clients that do not match any rule in the ruleset </li>
  <li> <tt>-H</tt>&nbsp;: disable DNS lookups </li>
  <li> <tt>-h</tt>&nbsp;: consult <tt>/etc/hosts</tt> before DNS </li>
  <li> <tt>-l <em>localname</em></tt>&nbsp;: get the local name from the command line, don't look it up </li>
diff --git a/doc/upgrade.html b/doc/upgrade.html
index f36280b..dd18487 100644
--- a/doc/upgrade.html
+++ b/doc/upgrade.html
@@ -19,6 +19,14 @@
 
 <h1> What has changed in s6-networking </h1>
 
+<h2> in 2.8.1.0 </h2>
+
+<ul>
+ <li> New <tt>-A</tt>, <tt>-a</tt> options to
+<a href="s6-tcpserver-access.html">s6-tcpserver-access</a> and
+<a href="s6-tlsserver.html">s6-tlsserver</a>. </li>
+</ul>
+
 <h2> in 2.8.0.1 </h2>
 
 <ul>
diff --git a/package/info b/package/info
index ba09779..0e417c4 100644
--- a/package/info
+++ b/package/info
@@ -1,4 +1,4 @@
 package=s6-networking
-version=2.8.0.1
+version=2.8.1.0
 category=net
 package_macro_name=S6_NETWORKING
diff --git a/src/conn-tools/s6-tcpserver-access.c b/src/conn-tools/s6-tcpserver-access.c
index 4fa0b9c..c2b1e54 100644
--- a/src/conn-tools/s6-tcpserver-access.c
+++ b/src/conn-tools/s6-tcpserver-access.c
@@ -31,7 +31,7 @@
 #endif
 
 #define NAME "s6-tcpserver-access"
-#define USAGE NAME " [ -v verbosity ] [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ] prog..."
+#define USAGE NAME " [ -v verbosity ] [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -A | -a ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ] prog..."
 #define dieusage() strerr_dieusage(100, USAGE)
 #define dienomem() strerr_diefu1sys(111, "update environment")
 #define X() strerr_dief(101, "internal inconsistency. Please submit a bug-report.")
@@ -44,6 +44,7 @@ enum golb_e
   GOLB_HOSTS = 0x08,
   GOLB_IDENT = 0x10,
   GOLB_PARANOID = 0x20,
+  GOLB_ACCEPT = 0x40
 } ;
 
 enum gola_e
@@ -91,6 +92,8 @@ int main (int argc, char const *const *argv)
     { .so = 'r', .lo = "ident", .clear = 0, .set = GOLB_IDENT },
     { .so = 'p', .lo = "no-paranoid", .clear = GOLB_PARANOID, .set = 0 },
     { .so = 'P', .lo = "paranoid", .clear = GOLB_NODNS, .set = GOLB_PARANOID },
+    { .so = 'A', .lo = "no-default-accept", .clear = GOLB_ACCEPT, .set = 0 },
+    { .so = 'a', .lo = "default-accept", .clear = 0, .set = GOLB_ACCEPT },
   } ;
   static gol_arg const rgola[] =
   {
@@ -111,7 +114,7 @@ int main (int argc, char const *const *argv)
   int e = 0 ;
   size_t protolen ;
   s6_accessrules_params_t params = S6_ACCESSRULES_PARAMS_ZERO ;
-  s6_accessrules_result_t accepted = S6_ACCESSRULES_ALLOW ;
+  s6_accessrules_result_t accepted ;
   uint16_t remoteport, localport ;
   ip46 remoteip, localip ;
   char prog_storage[PROG_pid_len(NAME)] ;
@@ -190,6 +193,7 @@ int main (int argc, char const *const *argv)
     accepted = s6_accessrules_ip46_cdb(&remoteip, &c, &params) ;
     if (accepted == S6_ACCESSRULES_ALLOW) cdb_free(&c) ;
   }
+  else accepted = S6_ACCESSRULES_ALLOW ;
 
   switch (accepted)
   {
@@ -197,7 +201,7 @@ int main (int argc, char const *const *argv)
       strerr_diefusys(111, "check ruleset for ", "IP", " in ", wgola[GOLA_RULESDIR] ? wgola[GOLA_RULESDIR] : wgola[GOLA_RULESFILE]) ;
     case S6_ACCESSRULES_ALLOW : break ;
     case S6_ACCESSRULES_NOTFOUND :
-      if (!(wgolb & GOLB_NODNS)) break ;
+      if (!(wgolb & GOLB_NODNS) || (wgolb & GOLB_ACCEPT)) break ;
     case S6_ACCESSRULES_DENY : e = 1 ; goto reject ;
     default: X() ;
   }
@@ -273,187 +277,187 @@ int main (int argc, char const *const *argv)
         goto reject ;
       }
       if (verbosity >= 2) strerr_warnwusys("init DNS") ;
-      goto afterdns ;
     }
-    if (wgolb & GOLB_HOSTS)
+    else
     {
-      int r = s6dns_hosts_name(remoteip.ip, &sa, &ga, ip46_is6(&remoteip)) ;
-      if (r == -1)
+      if (wgolb & GOLB_HOSTS)
       {
-        if (wgolb & GOLB_FATAL)
-        {
-          e = 111 ;
-          if (verbosity >= 2) strerr_warnfusys("look up ", "remote", " ip in hosts database") ;
-          goto reject ;
-        }
-        if (verbosity >= 2) strerr_warnwusys("look up ", "remote", " ip in hosts database") ;
-      }
-      else if (r)
-      {
-        if (!env_addmodif(&modifs, tcpremotehost, sa.s + genalloc_s(size_t, &ga)[0])) dienomem() ;
-        genalloc_setlen(size_t, &ga, 0) ;
-        sa.len = 0 ;  
-        gotname |= 2 ;
-      }
-      if (!(gotname & 1))
-      {
-        r = s6dns_hosts_name(localip.ip, &sa, &ga, ip46_is6(&localip)) ;
+        int r = s6dns_hosts_name(remoteip.ip, &sa, &ga, ip46_is6(&remoteip)) ;
         if (r == -1)
         {
           if (wgolb & GOLB_FATAL)
           {
             e = 111 ;
-            if (verbosity >= 2) strerr_warnfusys("look up ", "local", " ip in hosts database") ;
+            if (verbosity >= 2) strerr_warnfusys("look up ", "remote", " ip in hosts database") ;
             goto reject ;
           }
-          if (verbosity >= 2) strerr_warnwusys("look up ", "local", " ip in hosts database") ;
+          if (verbosity >= 2) strerr_warnwusys("look up ", "remote", " ip in hosts database") ;
         }
         else if (r)
         {
-          if (!env_addmodif(&modifs, tcplocalhost, sa.s + genalloc_s(size_t, &ga)[0])) dienomem() ;
+          if (!env_addmodif(&modifs, tcpremotehost, sa.s + genalloc_s(size_t, &ga)[0])) dienomem() ;
           genalloc_setlen(size_t, &ga, 0) ;
           sa.len = 0 ;  
-          gotname |= 1 ;
+          gotname |= 2 ;
         }
-      }
-    }
-    if (!(gotname & 1))
-    {
-      s6dns_domain_arpafromip46(&blob[0].q, &localip) ;
-      s6dns_domain_encode(&blob[0].q) ;
-      blob[0].qtype = S6DNS_T_PTR ;
-      blob[0].deadline = deadline ;
-      blob[0].parsefunc = &s6dns_message_parse_answer_domain ;
-      blob[0].data = &data[0] ;
-      blob[0].options = S6DNS_O_RECURSIVE ;
-      data[0].rtype = S6DNS_T_PTR ;
-    }
-    if (!(gotname & 2))
-    {
-      s6dns_domain_arpafromip46(&blob[1].q, &remoteip) ;
-      s6dns_domain_encode(&blob[1].q) ;
-      blob[1].qtype = S6DNS_T_PTR ;
-      blob[1].deadline = deadline ;
-      blob[1].parsefunc = &s6dns_message_parse_answer_domain ;
-      blob[1].data = &data[1] ;
-      blob[1].options = S6DNS_O_RECURSIVE ;
-      data[1].rtype = S6DNS_T_PTR ;
-    }
-
-    if (gotname < 3)
-    {
-      if (!s6dns_resolven_parse_g(blob + (gotname & 1), !(gotname & 1) + !(gotname & 2), &infinite))
-      {
-        if (wgolb & GOLB_FATAL)
+        if (!(gotname & 1))
         {
-          e = errno == ENOENT ? 1 : 111 ;
-          if (verbosity >= 3) strerr_warnfu("resolve IP addresses: ", s6dns_constants_error_str(errno)) ;
-          goto reject ;
+          r = s6dns_hosts_name(localip.ip, &sa, &ga, ip46_is6(&localip)) ;
+          if (r == -1)
+          {
+            if (wgolb & GOLB_FATAL)
+            {
+              e = 111 ;
+              if (verbosity >= 2) strerr_warnfusys("look up ", "local", " ip in hosts database") ;
+              goto reject ;
+            }
+            if (verbosity >= 2) strerr_warnwusys("look up ", "local", " ip in hosts database") ;
+          }
+          else if (r)
+          {
+            if (!env_addmodif(&modifs, tcplocalhost, sa.s + genalloc_s(size_t, &ga)[0])) dienomem() ;
+            genalloc_setlen(size_t, &ga, 0) ;
+            sa.len = 0 ;  
+            gotname |= 1 ;
+          }
         }
-        if (verbosity >= 3) strerr_warnwu("resolve IP addresses: ", s6dns_constants_error_str(errno)) ;
       }
-      else
+      if (!(gotname & 1))
+      {
+        s6dns_domain_arpafromip46(&blob[0].q, &localip) ;
+        s6dns_domain_encode(&blob[0].q) ;
+        blob[0].qtype = S6DNS_T_PTR ;
+        blob[0].deadline = deadline ;
+        blob[0].parsefunc = &s6dns_message_parse_answer_domain ;
+        blob[0].data = &data[0] ;
+        blob[0].options = S6DNS_O_RECURSIVE ;
+        data[0].rtype = S6DNS_T_PTR ;
+      }
+      if (!(gotname & 2))
+      {
+        s6dns_domain_arpafromip46(&blob[1].q, &remoteip) ;
+        s6dns_domain_encode(&blob[1].q) ;
+        blob[1].qtype = S6DNS_T_PTR ;
+        blob[1].deadline = deadline ;
+        blob[1].parsefunc = &s6dns_message_parse_answer_domain ;
+        blob[1].data = &data[1] ;
+        blob[1].options = S6DNS_O_RECURSIVE ;
+        data[1].rtype = S6DNS_T_PTR ;
+      }
+
+      if (gotname < 3)
       {
-        if (!(gotname & 1) && !blob[0].status)
+        if (!s6dns_resolven_parse_g(blob + (gotname & 1), !(gotname & 1) + !(gotname & 2), &infinite))
         {
-          char s[256] ;
-          unsigned int len = 0 ;
-          if (genalloc_len(s6dns_domain_t, &data[0].ds))
+          if (wgolb & GOLB_FATAL)
           {
-            s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[0].ds)) ;
-            len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[0].ds)) ;
+            e = errno == ENOENT ? 1 : 111 ;
+            if (verbosity >= 3) strerr_warnfu("resolve IP addresses: ", s6dns_constants_error_str(errno)) ;
+            goto reject ;
           }
-          genalloc_free(s6dns_domain_t, &data[0].ds) ;
-          s[len] = 0 ;
-          if (!env_addmodif(&modifs, tcplocalhost, s)) dienomem() ;
-          gotname |= 1 ;
+          if (verbosity >= 3) strerr_warnwu("resolve IP addresses: ", s6dns_constants_error_str(errno)) ;
         }
-        if (!(gotname & 2) && !blob[1].status)
+        else
         {
-          char s[256] ;
-          unsigned int len = 0 ;
-          if (genalloc_len(s6dns_domain_t, &data[1].ds))
+          if (!(gotname & 1) && !blob[0].status)
           {
-            s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[1].ds)) ;
-            len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[1].ds)) ;
+            char s[256] ;
+            unsigned int len = 0 ;
+            if (genalloc_len(s6dns_domain_t, &data[0].ds))
+            {
+              s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[0].ds)) ;
+              len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[0].ds)) ;
+            }
+            genalloc_free(s6dns_domain_t, &data[0].ds) ;
+            s[len] = 0 ;
+            if (!env_addmodif(&modifs, tcplocalhost, s)) dienomem() ;
+            gotname |= 1 ;
           }
-          s[len] = 0 ;
-
-          if (wgolb & GOLB_PARANOID)
+          if (!(gotname & 2) && !blob[1].status)
           {
-            int r ;
-            data[1].ds.len = 0 ;
-            r = ip46_is6(&remoteip) ? s6dns_resolve_aaaa_g(&data[1].ds, s, len, 0, &deadline) : s6dns_resolve_a_g(&data[1].ds, s, len, 0, &deadline) ;
-            if (r <= 0)
+            char s[256] ;
+            unsigned int len = 0 ;
+            if (genalloc_len(s6dns_domain_t, &data[1].ds))
             {
-              if (wgolb & GOLB_FATAL)
-              {
-                e = errno == ETIMEDOUT ? 99 : errno == ENOENT ? 1 : 111 ;
-                if (verbosity >= 3) strerr_warnfu("(paranoidly) resolve ", s, ": ", s6dns_constants_error_str(errno)) ;
-                goto reject ;
-              }
-              if (verbosity >= 3) strerr_warnwu("(paranoidly) resolve ", s, ": ", s6dns_constants_error_str(errno)) ;
+              s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[1].ds)) ;
+              len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[1].ds)) ;
             }
-            else
+            s[len] = 0 ;
+
+            if (wgolb & GOLB_PARANOID)
             {
-              size_t i = 0 ;
-              for (; i < data[1].ds.len ; i += ip46_is6(&remoteip) ? 16 : 4)
-                if (!memcmp(remoteip.ip, data[1].ds.s + i, ip46_is6(&remoteip) ? 16 : 4)) break ;
-              if (i >= data[1].ds.len)
+              int r ;
+              data[1].ds.len = 0 ;
+              r = ip46_is6(&remoteip) ? s6dns_resolve_aaaa_g(&data[1].ds, s, len, 0, &deadline) : s6dns_resolve_a_g(&data[1].ds, s, len, 0, &deadline) ;
+              if (r <= 0)
+              {
+                if (wgolb & GOLB_FATAL)
+                {
+                  e = errno == ETIMEDOUT ? 99 : errno == ENOENT ? 1 : 111 ;
+                  if (verbosity >= 3) strerr_warnfu("(paranoidly) resolve ", s, ": ", s6dns_constants_error_str(errno)) ;
+                  goto reject ;
+                }
+                if (verbosity >= 3) strerr_warnwu("(paranoidly) resolve ", s, ": ", s6dns_constants_error_str(errno)) ;
+              }
+              else
               {
-                e = 1 ;
-                if (verbosity >= 3) strerr_warnf("paranoid IP verification", " rejected available IPs") ;
-                goto reject ;
+                size_t i = 0 ;
+                for (; i < data[1].ds.len ; i += ip46_is6(&remoteip) ? 16 : 4)
+                  if (!memcmp(remoteip.ip, data[1].ds.s + i, ip46_is6(&remoteip) ? 16 : 4)) break ;
+                if (i >= data[1].ds.len)
+                {
+                  e = 1 ;
+                  if (verbosity >= 3) strerr_warnf("paranoid IP verification", " rejected available IPs") ;
+                  goto reject ;
+                }
               }
             }
-          }
 
-          if (!env_addmodif(&modifs, tcpremotehost, s)) dienomem() ;
-          gotname |= 2 ;
+            if (!env_addmodif(&modifs, tcpremotehost, s)) dienomem() ;
+            gotname |= 2 ;
 
-          if (accepted == S6_ACCESSRULES_NOTFOUND)
-          {
-            if (wgola[GOLA_RULESDIR])
-              accepted = s6_accessrules_reversedns_fs(s, wgola[GOLA_RULESDIR], &params) ;
-            else if (wgola[GOLA_RULESFILE])
-            {
-              accepted = s6_accessrules_reversedns_cdb(s, &c, &params) ;
-              cdb_free(&c) ;
-            }
-            switch (accepted)
+            if (accepted == S6_ACCESSRULES_NOTFOUND)
             {
-              case S6_ACCESSRULES_ERROR :
+              if (wgola[GOLA_RULESDIR])
+                accepted = s6_accessrules_reversedns_fs(s, wgola[GOLA_RULESDIR], &params) ;
+              else if (wgola[GOLA_RULESFILE])
+              {
+                accepted = s6_accessrules_reversedns_cdb(s, &c, &params) ;
+                cdb_free(&c) ;
+              }
+              switch (accepted)
+              {
+                case S6_ACCESSRULES_ERROR :
                 strerr_diefusys(111, "check ruleset for ", "reverse DNS", " in ", wgola[GOLA_RULESDIR] ? wgola[GOLA_RULESDIR] : wgola[GOLA_RULESFILE]) ;
-              case S6_ACCESSRULES_ALLOW : break ;
-              case S6_ACCESSRULES_NOTFOUND :
-              case S6_ACCESSRULES_DENY : e = 1 ; goto reject ;
-              default : X() ;
+                case S6_ACCESSRULES_ALLOW : break ;
+                case S6_ACCESSRULES_NOTFOUND : break ;
+                case S6_ACCESSRULES_DENY : e = 1 ; goto reject ;
+                default : X() ;
+              }
             }
           }
         }
       }
-    }
 
-    if (!(gotname & 1))
-    {
-      if (!env_addmodif(&modifs, tcplocalhost, 0)) dienomem() ;
-    }
+      if (!(gotname & 1))
+      {
+        if (!env_addmodif(&modifs, tcplocalhost, 0)) dienomem() ;
+      }
 
-    if (!(gotname & 2))
-    {
-      if (wgolb & GOLB_PARANOID)
+      if (!(gotname & 2))
       {
-        if (verbosity >= 3) strerr_warnfu("get a valid remote host name for ", "paranoid IP verification") ;
-        e = 1 ;
-        goto reject ;
+        if (wgolb & GOLB_PARANOID)
+        {
+          if (verbosity >= 3) strerr_warnfu("get a valid remote host name for ", "paranoid IP verification") ;
+          e = 1 ;
+          goto reject ;
+        }
+        if (!env_addmodif(&modifs, tcpremotehost, 0)) dienomem() ;
       }
-      if (!env_addmodif(&modifs, tcpremotehost, 0)) dienomem() ;
     }
   }
 
- afterdns:
-
-  if (accepted != S6_ACCESSRULES_ALLOW)
+  if (!(accepted == S6_ACCESSRULES_ALLOW || (wgolb & GOLB_ACCEPT && accepted == S6_ACCESSRULES_NOTFOUND)))
   {
     e = 1 ;
     if (verbosity >= 3) strerr_warnf("inconclusive access control result") ;
diff --git a/src/tls/s6-tlsserver.c b/src/tls/s6-tlsserver.c
index 0d1526f..291eab4 100644
--- a/src/tls/s6-tlsserver.c
+++ b/src/tls/s6-tlsserver.c
@@ -13,7 +13,7 @@
 #define USAGE "s6-tlsserver [ options ] ip port prog...\n" \
 "proxy-server options: [ -L ]" \
 "s6-tcpserver options: [ -q | -Q | -v ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ]\n" \
-"s6-tcpserver-access options: [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ]\n" \
+"s6-tcpserver-access options: [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -A | -a ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ]\n" \
 "s6-tlsd options: [ -S | -s ] [ -J | -j ] [ -Y | -y ] [ -K timeout ] [ -Z | -z ] [ -k snilevel ]"
 
 #define dieusage() strerr_dieusage(100, USAGE)
@@ -65,6 +65,7 @@ enum golb_e
   GOLB_KEEPENV = 0x8000,
   GOLB_SNI = 0x10000,
   GOLB_SNI_ONLY = 0x20000,
+  GOLB_ACCEPT = 0x40000,
 } ;
 
 enum gola_e
@@ -107,6 +108,8 @@ int main (int argc, char const *const *argv)
     { .so = 'r', .lo = "ident", .clear = 0, .set = GOLB_IDENT },
     { .so = 'P', .lo = "no-paranoid", .clear = GOLB_PARANOID, .set = 0 },
     { .so = 'p', .lo = "paranoid", .clear = 0, .set = GOLB_PARANOID },
+    { .so = 'A', .lo = "no-default-accept", .clear = GOLB_ACCEPT, .set = 0 },
+    { .so = 'a', .lo = "default-accept", .clear = 0, .set = GOLB_ACCEPT },
     { .so = 's', .lo = "no-close-notify", .clear = GOLB_CLOSENOTIFY, .set = 0 },
     { .so = 'S', .lo = "close-notify", .clear = 0, .set = GOLB_CLOSENOTIFY },
     { .so = 'j', .lo = "no-enforce-close-notify", .clear = GOLB_FATALEOF, .set = 0 },
@@ -204,7 +207,7 @@ int main (int argc, char const *const *argv)
      || !!(wgolb & (GOLB_STRICTRES | GOLB_NONAGLE | GOLB_IDENT | GOLB_PARANOID))
      || !!wgola[GOLA_LOCALNAME] || !!wgola[GOLA_BANNER] || !!wgola[GOLA_RULESDIR] || !!wgola[GOLA_RULESFILE]
      || !!o.timeout ;
-    char const *newargv[55 + argc] ;
+    char const *newargv[56 + argc] ;
     char fmt[UINT_FMT * 5 + UID_FMT + GID_FMT + (o.gidn == (size_t)-1 ? 0 : o.gidn * GID_FMT)] ;
 
     newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver" ;
@@ -246,6 +249,7 @@ int main (int argc, char const *const *argv)
       if (wgolb & GOLB_HOSTS) newargv[m++] = "-h" ;
       if (wgolb & GOLB_IDENT) newargv[m++] = "-r" ;
       if (wgolb & GOLB_PARANOID) newargv[m++] = "-p" ;
+      if (wgolb & GOLB_ACCEPT) newargv[m++] = "-a" ;
       if (wgola[GOLA_LOCALNAME])
       {
         newargv[m++] = "-l" ;