Prepare for 2.8.0.0; convert tls programs to gol, add noverifycert

10 files changed, 259 insertions, 158 deletions

diff --git a/src/tls/s6-tlsc-io.c b/src/tls/s6-tlsc-io.c
index 9098fdc..5dc56f8 100644
--- a/src/tls/s6-tlsc-io.c
+++ b/src/tls/s6-tlsc-io.c
@@ -98,7 +98,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
   static gol_arg const rgola[] =
   {
     { .so = 'v', .lo = "verbosity", .i = GOLA_VERBOSITY },
-    { .so = 'K', .lo = "kimeout", .i = GOLA_KIMEOUT },
+    { .so = 'K', .lo = "handshake-timeout", .i = GOLA_KIMEOUT },
     { .so = 'k', .lo = "servername", .i = GOLA_SERVERNAME },
     { .so = 'd', .lo = "notification-fd", .i = GOLA_NOTIF },
   } ;
@@ -122,7 +122,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
   {
     unsigned int kimeout ;
     if (!uint0_scan(wgola[GOLA_KIMEOUT], &kimeout))
-      strerr_dief2x(100, "kimeout", " must be an unsigned integer") ;
+      strerr_dief2x(100, "handshake-timeout", " must be an unsigned integer") ;
     if (kimeout) tain_from_millisecs(&tto, kimeout) ;
   }
   if (wgola[GOLA_NOTIF])
diff --git a/src/tls/s6-tlsc.c b/src/tls/s6-tlsc.c
index 2308a52..48a94ff 100644
--- a/src/tls/s6-tlsc.c
+++ b/src/tls/s6-tlsc.c
@@ -50,7 +50,7 @@ int main (int argc, char const *const *argv)
   static gol_arg const rgola[] =
   {
     { .so = 'v', .lo = "verbosity", .i = GOLA_VERBOSITY },
-    { .so = 'K', .lo = "kimeout", .i = GOLA_KIMEOUT },
+    { .so = 'K', .lo = "handshake-timeout", .i = GOLA_KIMEOUT },
     { .so = 'k', .lo = "servername", .i = GOLA_SERVERNAME },
     { .so = '6', .lo = "read-fd", .i = GOLA_RFD },
     { .so = '7', .lo = "write-fd", .i = GOLA_WFD },
@@ -75,7 +75,7 @@ int main (int argc, char const *const *argv)
       strerr_dief2x(100, "verbosity", " must be an unsigned integer") ;
   if (wgola[GOLA_KIMEOUT])
     if (!uint0_scan(wgola[GOLA_KIMEOUT], &kimeout))
-      strerr_dief2x(100, "kimeout", " must be an unsigned integer") ;
+      strerr_dief2x(100, "handshake-timeout", " must be an unsigned integer") ;
   if (wgola[GOLA_RFD])
   {
     unsigned int fd ;
diff --git a/src/tls/s6-tlsclient.c b/src/tls/s6-tlsclient.c
index 00cd58a..ba3caf4 100644
--- a/src/tls/s6-tlsclient.c
+++ b/src/tls/s6-tlsclient.c
@@ -102,7 +102,7 @@ int main (int argc, char const *const *argv)
   static gol_arg const rgola[] =
   {
     { .so = 't', .lo = "timeout", .i = GOLA_TIMEOUT },
-    { .so = 'l', .lo = "localname", .i = GOLA_LOCALNAME },
+    { .so = 'l', .lo = "local-name", .i = GOLA_LOCALNAME },
     { .so = 'T', .lo = "connection-timeouts", .i = GOLA_XYIMEOUT },
     { .so = 'i', .lo = "local-ip", .i = GOLA_IP },
     { .so = 'p', .lo = "local-port", .i = GOLA_PORT },
diff --git a/src/tls/s6-tlsd-io.c b/src/tls/s6-tlsd-io.c
index 08eee77..98b3a19 100644
--- a/src/tls/s6-tlsd-io.c
+++ b/src/tls/s6-tlsd-io.c
@@ -3,10 +3,12 @@
 #include <stdint.h>
 #include <signal.h>
 
+#include <skalibs/uint64.h>
 #include <skalibs/gccattributes.h>
 #include <skalibs/types.h>
-#include <skalibs/sgetopt.h>
+#include <skalibs/prog.h>
 #include <skalibs/strerr.h>
+#include <skalibs/gol.h>
 #include <skalibs/tai.h>
 #include <skalibs/sig.h>
 #include <skalibs/djbunix.h>
@@ -16,6 +18,25 @@
 #define USAGE "s6-tlsd-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -J | -j ] [ -Y | -y ] [ -K timeout ] [ -k snilevel ] fdr fdw"
 #define dieusage() strerr_dieusage(100, USAGE)
 
+enum golb_e
+{
+  GOLB_CLOSENOTIFY = 0x01,
+  GOLB_STRICTCN = 0x02,
+  GOLB_CLIENTCERT = 0x10,
+  GOLB_CLIENTCERT_ONLY = 0x20,
+  GOLB_SNI = 0x40,
+  GOLB_SNI_ONLY = 0x80,
+} ;
+
+enum gola_e
+{
+  GOLA_VERBOSITY,
+  GOLA_KIMEOUT,
+  GOLA_SNILEVEL,
+  GOLA_NOTIF,
+  GOLA_N
+} ;
+
 static inline void doit (int *, tain const *tto, uint32_t, uint32_t, unsigned int, unsigned int) gccattr_noreturn ;
 
 #ifdef S6_NETWORKING_USE_TLS
@@ -65,47 +86,59 @@ static inline void doit (int *fds, tain const *tto, uint32_t preoptions, uint32_
 
 int main (int argc, char const *const *argv)
 {
-  tain tto ;
+  static gol_bool const rgolb[] =
+  {
+    { .so = 's', .lo = "no-close-notify", .clear = GOLB_CLOSENOTIFY, .set = 0 },
+    { .so = 'S', .lo = "close-notify", .clear = 0, .set = GOLB_CLOSENOTIFY },
+    { .so = 'j', .lo = "no-enforce-close-notify", .clear = GOLB_STRICTCN, .set = 0 },
+    { .so = 'J', .lo = "enforce-close-notify", .clear = 0, .set = GOLB_STRICTCN },
+    { .so = 'Y', .lo = "client-cert", .clear = GOLB_CLIENTCERT_ONLY, .set = GOLB_CLIENTCERT },
+    { .so = 'y', .lo = "mandatory-client-cert", .clear = 0, .set = GOLB_CLIENTCERT | GOLB_CLIENTCERT_ONLY },
+    { .so = 0, .lo = "sni", .clear = GOLB_SNI_ONLY, .set = GOLB_SNI },
+    { .so = 0, .lo = "mandatory-sni", .clear = 0, .set = GOLB_SNI | GOLB_SNI_ONLY },
+  } ;
+  static gol_arg const rgola[] =
+  {
+    { .so = 'v', .lo = "verbosity", .i = GOLA_VERBOSITY },
+    { .so = 'K', .lo = "handshake-timeout", .i = GOLA_KIMEOUT },
+    { .so = 'k', .lo = "sni-level", .i = GOLA_SNILEVEL },
+    { .so = 'd', .lo = "notification-fd", .i = GOLA_NOTIF },
+  } ;
   int fds[4] = { [2] = 0, [3] = 1 } ;
+  tain tto = TAIN_INFINITE_RELATIVE ;
   unsigned int verbosity = 1 ;
   unsigned int notif = 0 ;
-  uint32_t preoptions = 0 ;
-  uint32_t options = 0 ;
-
+  uint64_t wgolb = 0 ;
+  char const *wgola[GOLA_N] = { 0 } ;
+  unsigned int golc ;
   PROG = "s6-tlsd-io" ;
+
+  golc = GOL_main(argc, argv, rgolb, rgola, &wgolb, wgola) ;
+  argc -= golc ; argv += golc ;
+  if (argc < 2) dieusage() ;
+
+  if (wgola[GOLA_VERBOSITY])
+    if (!uint0_scan(wgola[GOLA_VERBOSITY], &verbosity))
+      strerr_dief2x(100, "verbosity", " must be an unsigned integer") ;
+  if (wgola[GOLA_KIMEOUT])
   {
-    subgetopt l = SUBGETOPT_ZERO ;
-    unsigned int t = 0 ;
-    for (;;)
-    {
-      int opt = subgetopt_r(argc, argv, "d:SsJjYyv:K:k:", &l) ;
-      if (opt == -1) break ;
-      switch (opt)
-      {
-        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
-        case 'd' : if (!uint0_scan(l.arg, &notif)) dieusage() ; break ;
-        case 'S' : options |= 1 ; break ;
-        case 's' : options &= ~1 ; break ;
-        case 'J' : options |= 2 ; break ;
-        case 'j' : options &= ~2 ; break ;
-        case 'Y' : preoptions |= 1 ; preoptions &= ~2 ; break ;
-        case 'y' : preoptions |= 3 ; break ;
-        case 'K' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
-        case 'k' :
-        {
-          unsigned int snilevel ;
-          if (!uint0_scan(l.arg, &snilevel)) dieusage() ;
-          if (snilevel) preoptions |= 4 ;
-          if (snilevel >= 2) preoptions |= 8 ;
-          break ;
-        }
-        default : dieusage() ;
-      }
-    }
-    argc -= l.ind ; argv += l.ind ;
-    if (t) tain_from_millisecs(&tto, t) ; else tto = tain_infinite_relative ;
+    unsigned int kimeout ;
+    if (!uint0_scan(wgola[GOLA_KIMEOUT], &kimeout))
+      strerr_dief2x(100, "handshake-timeout", " must be an unsigned integer") ;
+    if (kimeout) tain_from_millisecs(&tto, kimeout) ;
   }
-  if (argc < 2) dieusage() ;
+  if (wgola[GOLA_SNILEVEL])
+  {
+    unsigned int snilevel ;
+    if (!uint0_scan(wgola[GOLA_SNILEVEL], &snilevel))
+      strerr_dief2x(100, "sni-level", " must be an unsigned integer") ;
+    wgolb &= ~(GOLB_SNI | GOLB_SNI_ONLY) ;
+    wgolb |= (snilevel ? GOLB_SNI : 0) | (snilevel >= 2 ? GOLB_SNI_ONLY : 0) ;
+  }
+  if (wgola[GOLA_NOTIF])
+    if (!uint0_scan(wgola[GOLA_NOTIF], &notif))
+      strerr_dief2x(100, "notification-fd", " must be an unsigned integer") ;
+
   {
     unsigned int u ;
     if (!uint0_scan(argv[0], &u)) dieusage() ;
@@ -116,5 +149,5 @@ int main (int argc, char const *const *argv)
 
   if (!sig_ignore(SIGPIPE)) strerr_diefu1sys(111, "ignore SIGPIPE") ;
   tain_now_set_stopwatch_g() ;
-  doit(fds, &tto, preoptions, options, verbosity, notif) ;
+  doit(fds, &tto, wgolb >> 4, wgolb & 0xf, verbosity, notif) ;
 }
diff --git a/src/tls/s6-tlsd.c b/src/tls/s6-tlsd.c
index acd2945..7d144f8 100644
--- a/src/tls/s6-tlsd.c
+++ b/src/tls/s6-tlsd.c
@@ -3,57 +3,91 @@
 #include <stdint.h>
 #include <unistd.h>
 
+#include <skalibs/uint64.h>
 #include <skalibs/types.h>
-#include <skalibs/sgetopt.h>
+#include <skalibs/prog.h>
 #include <skalibs/strerr.h>
+#include <skalibs/gol.h>
 
 #include "s6tls-internal.h"
 
 #define USAGE "s6-tlsd [ -S | -s ] [ -J | -j ] [ -Y | -y ] [ -k snilevel ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..."
 #define dieusage() strerr_dieusage(100, USAGE)
 
+enum golb_e
+{
+  GOLB_CLOSENOTIFY = 0x0001,
+  GOLB_STRICTCN = 0x0002,
+  GOLB_CLIENTCERT = 0x0004,
+  GOLB_CLIENTCERT_ONLY = 0x0008,
+  GOLB_SNI = 0x0010,
+  GOLB_SNI_ONLY = 0x0020,
+  GOLB_KEEP = 0x100,
+} ;
+
+enum gola_e
+{
+  GOLA_VERBOSITY,
+  GOLA_KIMEOUT,
+  GOLA_SNILEVEL,
+  GOLA_N
+} ;
+
 int main (int argc, char const *const *argv)
 {
+  static gol_bool const rgolb[] =
+  {
+    { .so = 's', .lo = "no-close-notify", .clear = GOLB_CLOSENOTIFY, .set = 0 },
+    { .so = 'S', .lo = "close-notify", .clear = 0, .set = GOLB_CLOSENOTIFY },
+    { .so = 'j', .lo = "no-enforce-close-notify", .clear = GOLB_STRICTCN, .set = 0 },
+    { .so = 'J', .lo = "enforce-close-notify", .clear = 0, .set = GOLB_STRICTCN },
+    { .so = 'Y', .lo = "client-cert", .clear = GOLB_CLIENTCERT_ONLY, .set = GOLB_CLIENTCERT },
+    { .so = 'y', .lo = "mandatory-client-cert", .clear = 0, .set = GOLB_CLIENTCERT | GOLB_CLIENTCERT_ONLY },
+    { .so = 'z', .lo = "no-keep", .clear = GOLB_KEEP, .set = 0 },
+    { .so = 'Z', .lo = "keep", .clear = 0, .set = GOLB_KEEP },
+    { .so = 0, .lo = "sni", .clear = GOLB_SNI_ONLY, .set = GOLB_SNI },
+    { .so = 0, .lo = "mandatory-sni", .clear = 0, .set = GOLB_SNI | GOLB_SNI_ONLY },
+  } ;
+  static gol_arg const rgola[] =
+  {
+    { .so = 'v', .lo = "verbosity", .i = GOLA_VERBOSITY },
+    { .so = 'K', .lo = "handshake-timeout", .i = GOLA_KIMEOUT },
+    { .so = 'k', .lo = "sni-level", .i = GOLA_SNILEVEL },
+  } ;
+  int p[8] = { [6] = 0, [7] = 1 } ;
   unsigned int verbosity = 1 ;
   unsigned int kimeout = 0 ;
-  unsigned int snilevel = 0 ;
-  uint32_t coptions = 0 ;
-  uint32_t poptions = 1 ;
   pid_t pid ;
-  int p[8] = { [6] = 0, [7] = 1 } ;
+  uint64_t wgolb = 0 ;
+  char const *wgola[GOLA_N] = { 0 } ;
   char const *newargv[S6TLS_PREP_IO_ARGC] ;
   char buf[S6TLS_PREP_IO_BUFLEN] ;
+  unsigned int golc ;
   PROG = "s6-tlsd" ;
+
+  golc = GOL_main(argc, argv, rgolb, rgola, &wgolb, wgola) ;
+  argc -= golc ; argv += golc ;
+  if (!argc) dieusage() ;
+
+  if (wgola[GOLA_VERBOSITY])
+    if (!uint0_scan(wgola[GOLA_VERBOSITY], &verbosity))
+      strerr_dief2x(100, "verbosity", " must be an unsigned integer") ;
+  if (wgola[GOLA_KIMEOUT])
+    if (!uint0_scan(wgola[GOLA_KIMEOUT], &kimeout))
+      strerr_dief2x(100, "handshake-timeout", " must be an unsigned integer") ;
+  if (wgola[GOLA_SNILEVEL])
   {
-    subgetopt l = SUBGETOPT_ZERO ;
-    for (;;)
-    {
-      int opt = subgetopt_r(argc, argv, "SsJjyYv:K:Zzk:", &l) ;
-      if (opt == -1) break ;
-      switch (opt)
-      {
-        case 'S' : coptions |= 4 ; break ;
-        case 's' : coptions &= ~4 ; break ;
-        case 'J' : coptions |= 8 ; break ;
-        case 'j' : coptions &= ~8 ; break ;
-        case 'y' : coptions |= 3 ; break ;
-        case 'Y' : coptions |= 1 ; coptions &= ~2 ; break ;
-        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
-        case 'K' : if (!uint0_scan(l.arg, &kimeout)) dieusage() ; break ;
-        case 'Z' : poptions &= ~1 ; break ;
-        case 'z' : poptions |= 1 ; break ;
-        case 'k' : if (!uint0_scan(l.arg, &snilevel)) dieusage() ; break ;
-        default : dieusage() ;
-      }
-    }
-    argc -= l.ind ; argv += l.ind ;
+    unsigned int snilevel ;
+    if (!uint0_scan(wgola[GOLA_SNILEVEL], &snilevel))
+      strerr_dief2x(100, "sni-level", " must be an unsigned integer") ;
+    wgolb &= ~(GOLB_SNI | GOLB_SNI_ONLY) ;
+    wgolb |= (snilevel ? GOLB_SNI : 0) | (snilevel >= 2 ? GOLB_SNI_ONLY : 0) ;
   }
-  if (!argc) dieusage() ;
 
   if (pipe(p) == -1 || pipe(p+2) == -1 || pipe(p+4) == -1)
     strerr_diefu1sys(111, "create pipe") ;
-  s6tls_prep_tlsdio(newargv, buf, p, coptions, verbosity, kimeout, snilevel) ;
+  s6tls_prep_tlsdio(newargv, buf, p, wgolb & 0xff, verbosity, kimeout) ;
   pid = s6tls_io_spawn(newargv, p, 0) ;
   if (!pid) strerr_diefu2sys(111, "spawn ", newargv[0]) ;
-  s6tls_sync_and_exec_app(argv, p, pid, poptions) ;
+  s6tls_sync_and_exec_app(argv, p, pid, wgolb >> 8) ;
 }
diff --git a/src/tls/s6-tlsserver.c b/src/tls/s6-tlsserver.c
index b2c3683..0d1526f 100644
--- a/src/tls/s6-tlsserver.c
+++ b/src/tls/s6-tlsserver.c
@@ -17,6 +17,7 @@
 "s6-tlsd options: [ -S | -s ] [ -J | -j ] [ -Y | -y ] [ -K timeout ] [ -Z | -z ] [ -k snilevel ]"
 
 #define dieusage() strerr_dieusage(100, USAGE)
+#define dieint(s) strerr_dief(100, (s), " must be an unsigned integer")
 
 typedef struct options_s options_t, *options_t_ref ;
 struct options_s
@@ -30,7 +31,6 @@ struct options_s
   unsigned int backlog ;
   unsigned int timeout ;
   unsigned int kimeout ;
-  unsigned int snilevel ;
 } ;
 
 #define OPTIONS_ZERO \
@@ -43,7 +43,6 @@ struct options_s
   .backlog = (unsigned int)-1, \
   .timeout = 0, \
   .kimeout = 0, \
-  .snilevel = 0, \
 }
 
 enum golb_e
@@ -64,6 +63,8 @@ enum golb_e
   GOLB_OPTCERT = 0x2000,
   GOLB_MANDCERT = 0x4000,
   GOLB_KEEPENV = 0x8000,
+  GOLB_SNI = 0x10000,
+  GOLB_SNI_ONLY = 0x20000,
 } ;
 
 enum gola_e
@@ -93,25 +94,27 @@ int main (int argc, char const *const *argv)
     { .so = 'v', .lo = "verbose", .clear = GOLB_QUIET, .set = GOLB_VERBOSE },
     { .so = '1', .lo = "notify", .clear = 0, .set = GOLB_NOTIF },
     { .so = 'L', .lo = "proxy", .clear = 0, .set = GOLB_PROXY },
-    { .so = 'U', .lo = "with-envuidgid", .clear = 0, .set = GOLB_UIDGID },
+    { .so = 'U', .lo = "envuidgid", .clear = 0, .set = GOLB_UIDGID },
     { .so = 'W', .lo = "no-strict-resolution", .clear = GOLB_STRICTRES, .set = 0 },
     { .so = 'w', .lo = "strict-resolution", .clear = 0, .set = GOLB_STRICTRES },
-    { .so = 'd', .lo = "enable-nagle", .clear = GOLB_NONAGLE, .set = 0 },
-    { .so = 'D', .lo = "disable-nagle", .clear = 0, .set = GOLB_NONAGLE },
-    { .so = 'H', .lo = "disable-dns-lookups", .clear = 0, .set = GOLB_NOLOOKUPS },
-    { .so = 'h', .lo = "with-etchosts", .clear = 0, .set = GOLB_HOSTS },
-    { .so = 'R', .lo = "disable-ident-lookups", .clear = GOLB_IDENT, .set = 0 },
-    { .so = 'r', .lo = "enable-ident-lookups", .clear = 0, .set = GOLB_IDENT },
-    { .so = 'P', .lo = "disable-paranoid-lookups", .clear = GOLB_PARANOID, .set = 0 },
-    { .so = 'p', .lo = "enable-paranoid-lookups", .clear = 0, .set = GOLB_PARANOID },
-    { .so = 's', .lo = "disable-closenotify", .clear = GOLB_CLOSENOTIFY, .set = 0 },
-    { .so = 'S', .lo = "enable-closenotify", .clear = 0, .set = GOLB_CLOSENOTIFY },
-    { .so = 'j', .lo = "allow-raw-eof", .clear = GOLB_FATALEOF, .set = 0 },
-    { .so = 'J', .lo = "disallow-raw-eof", .clear = 0, .set = GOLB_FATALEOF },
-    { .so = 'Y', .lo = "request-client-certificate", .clear = GOLB_MANDCERT, .set = GOLB_OPTCERT },
-    { .so = 'y', .lo = "demand-client-certificate", .clear = GOLB_OPTCERT, .set = GOLB_MANDCERT },
-    { .so = 'z', .lo = "no-keep-tlsd-environment", .clear = GOLB_KEEPENV, .set = 0 },
-    { .so = 'Z', .lo = "keep-tlsd-environment", .clear = 0, .set = GOLB_KEEPENV },
+    { .so = 'd', .lo = "nagle", .clear = GOLB_NONAGLE, .set = 0 },
+    { .so = 'D', .lo = "no-nagle", .clear = 0, .set = GOLB_NONAGLE },
+    { .so = 0, .lo = "dns", .clear = GOLB_NOLOOKUPS, .set = 0 },
+    { .so = 'H', .lo = "no-dns", .clear = 0, .set = GOLB_NOLOOKUPS },
+    { .so = 0, .lo = "no-hosts", .clear = GOLB_HOSTS, .set = 0 },
+    { .so = 'h', .lo = "hosts", .clear = 0, .set = GOLB_HOSTS },
+    { .so = 'R', .lo = "no-ident", .clear = GOLB_IDENT, .set = 0 },
+    { .so = 'r', .lo = "ident", .clear = 0, .set = GOLB_IDENT },
+    { .so = 'P', .lo = "no-paranoid", .clear = GOLB_PARANOID, .set = 0 },
+    { .so = 'p', .lo = "paranoid", .clear = 0, .set = GOLB_PARANOID },
+    { .so = 's', .lo = "no-close-notify", .clear = GOLB_CLOSENOTIFY, .set = 0 },
+    { .so = 'S', .lo = "close-notify", .clear = 0, .set = GOLB_CLOSENOTIFY },
+    { .so = 'j', .lo = "no-enforce-close-notify", .clear = GOLB_FATALEOF, .set = 0 },
+    { .so = 'J', .lo = "enforce-close-notify", .clear = 0, .set = GOLB_FATALEOF },
+    { .so = 'Y', .lo = "client-cert", .clear = GOLB_MANDCERT, .set = GOLB_OPTCERT },
+    { .so = 'y', .lo = "mandatory-client-cert", .clear = GOLB_OPTCERT, .set = GOLB_MANDCERT },
+    { .so = 'z', .lo = "no-keep", .clear = GOLB_KEEPENV, .set = 0 },
+    { .so = 'Z', .lo = "keep", .clear = 0, .set = GOLB_KEEPENV },
   } ;
   static gol_arg const rgola[] =
   {
@@ -143,17 +146,17 @@ int main (int argc, char const *const *argv)
 
   if (wgola[GOLA_MAXCONN])
   {
-    if (!uint0_scan(wgola[GOLA_MAXCONN], &o.maxconn)) dieusage() ;
+    if (!uint0_scan(wgola[GOLA_MAXCONN], &o.maxconn)) dieint("global-max-connections") ;
     if (!o.maxconn) o.maxconn = 1 ;
   }
   if (wgola[GOLA_LMAXCONN])
   {
-    if (!uint0_scan(wgola[GOLA_LMAXCONN], &o.localmaxconn)) dieusage() ;
+    if (!uint0_scan(wgola[GOLA_LMAXCONN], &o.localmaxconn)) dieint("local-max-connections") ;
     if (!o.localmaxconn) o.localmaxconn = 1 ;
   }
   if (wgola[GOLA_BACKLOG])
   {
-    if (!uint0_scan(wgola[GOLA_BACKLOG], &o.backlog)) dieusage() ;
+    if (!uint0_scan(wgola[GOLA_BACKLOG], &o.backlog)) dieint("backlog") ;
   }
   if (wgola[GOLA_GIDLIST])
   {
@@ -162,25 +165,29 @@ int main (int argc, char const *const *argv)
   }
   if (wgola[GOLA_GID])
   {
-    if (!gid0_scan(wgola[GOLA_GID], &o.gid)) dieusage() ;
+    if (!gid0_scan(wgola[GOLA_GID], &o.gid)) dieint("gid") ;
     doapply = 1 ;
   }
   if (wgola[GOLA_UID])
   {
-    if (!uid0_scan(wgola[GOLA_UID], &o.uid)) dieusage() ;
+    if (!uid0_scan(wgola[GOLA_UID], &o.uid)) dieint("uid") ;
     doapply = 1 ;
   }
   if (wgola[GOLA_TIMEOUT])
   {
-    if (!uint0_scan(wgola[GOLA_TIMEOUT], &o.timeout)) dieusage() ;
+    if (!uint0_scan(wgola[GOLA_TIMEOUT], &o.timeout)) dieint("timeout") ;
   }
   if (wgola[GOLA_KIMEOUT])
   {
-    if (!uint0_scan(wgola[GOLA_KIMEOUT], &o.kimeout)) dieusage() ;
+    if (!uint0_scan(wgola[GOLA_KIMEOUT], &o.kimeout)) dieint("handshake-timeout") ;
   }
   if (wgola[GOLA_SNILEVEL])
   {
-    if (!uint0_scan(wgola[GOLA_SNILEVEL], &o.snilevel)) dieusage() ;
+    unsigned int snilevel ;
+    if (!uint0_scan(wgola[GOLA_SNILEVEL], &snilevel))
+      strerr_dief2x(100, "snilevel", " must be an unsigned integer") ;
+    wgolb &= ~(GOLB_SNI | GOLB_SNI_ONLY) ;
+    wgolb |= (snilevel ? GOLB_SNI : 0) | (snilevel >= 2 ? GOLB_SNI_ONLY : 0) ;
   }
   if (wgolb & GOLB_UIDGID)
   {
@@ -197,11 +204,12 @@ int main (int argc, char const *const *argv)
      || !!(wgolb & (GOLB_STRICTRES | GOLB_NONAGLE | GOLB_IDENT | GOLB_PARANOID))
      || !!wgola[GOLA_LOCALNAME] || !!wgola[GOLA_BANNER] || !!wgola[GOLA_RULESDIR] || !!wgola[GOLA_RULESFILE]
      || !!o.timeout ;
-    char fmt[UINT_FMT * 5 + UID_FMT + GID_FMT * (NGROUPS_MAX + 1)] ;
-    char const *newargv[54 + argc] ;
+    char const *newargv[55 + argc] ;
+    char fmt[UINT_FMT * 5 + UID_FMT + GID_FMT + (o.gidn == (size_t)-1 ? 0 : o.gidn * GID_FMT)] ;
 
     newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver" ;
-    if (wgolb & GOLB_QUIET) newargv[m++] = "-q" ; else if (wgolb & GOLB_VERBOSE) newargv[m++] = "-v" ;
+    if (wgolb & GOLB_QUIET) newargv[m++] = "-q" ;
+    else if (wgolb & GOLB_VERBOSE) newargv[m++] = "-v" ;
     if (wgolb & GOLB_NOTIF) newargv[m++] = "-1" ;
     if (o.maxconn)
     {
@@ -230,7 +238,8 @@ int main (int argc, char const *const *argv)
     if (doaccess)
     {
       newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver-access" ;
-      if (wgolb & GOLB_QUIET) newargv[m++] = "-v0" ; else if (wgolb & GOLB_VERBOSE) newargv[m++] = "-v2" ;
+      if (wgolb & GOLB_QUIET) newargv[m++] = "-v0" ;
+      else if (wgolb & GOLB_VERBOSE) newargv[m++] = "-v2" ;
       if (wgolb & GOLB_STRICTRES) newargv[m++] = "-w" ;
       if (wgolb & GOLB_NONAGLE) newargv[m++] = "-D" ;
       if (wgolb & GOLB_NOLOOKUPS) newargv[m++] = "-H" ;
@@ -273,7 +282,8 @@ int main (int argc, char const *const *argv)
       newargv[m++] = "--" ;
     }
     newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tlsd" ;
-    if (wgolb & GOLB_QUIET) newargv[m++] = "-v0" ; else if (wgolb & GOLB_VERBOSE) newargv[m++] = "-v2" ;
+    if (wgolb & GOLB_QUIET) newargv[m++] = "-v0" ;
+    else if (wgolb & GOLB_VERBOSE) newargv[m++] = "-v2" ;
     if (wgolb & GOLB_CLOSENOTIFY) newargv[m++] = "-S" ;
     if (wgolb & GOLB_FATALEOF) newargv[m++] = "-J" ;
     if (wgolb & GOLB_MANDCERT) newargv[m++] = "-y" ;
@@ -286,8 +296,7 @@ int main (int argc, char const *const *argv)
       fmt[pos++] = 0 ;
     }
     if (wgolb & GOLB_KEEPENV) newargv[m++] = "-Z" ;
-    if (o.snilevel >= 2) newargv[m++] = "-k2" ;
-    else if (o.snilevel) newargv[m++] = "-k1" ;
+    if (wgolb & GOLB_SNI) newargv[m++] = wgolb & GOLB_SNI_ONLY ? "--mandatory-sni" : "--sni" ;
     newargv[m++] = "--" ;
     if (doapply)
     {
diff --git a/src/tls/s6-ucspitlsc.c b/src/tls/s6-ucspitlsc.c
index 60f76de..fec2513 100644
--- a/src/tls/s6-ucspitlsc.c
+++ b/src/tls/s6-ucspitlsc.c
@@ -101,7 +101,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
   static gol_arg const rgola[] =
   {
     { .so = 'v', .lo = "verbosity", .i = GOLA_VERBOSITY },
-    { .so = 'K', .lo = "kimeout", .i = GOLA_KIMEOUT },
+    { .so = 'K', .lo = "handshake-timeout", .i = GOLA_KIMEOUT },
     { .so = 'k', .lo = "servername", .i = GOLA_SERVERNAME },
     { .so = '6', .lo = "read-fd", .i = GOLA_RFD },
     { .so = '7', .lo = "write-fd", .i = GOLA_WFD },
@@ -125,7 +125,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
       strerr_dief2x(100, "verbosity", " must be an unsigned integer") ;
   if (wgola[GOLA_KIMEOUT])
     if (!uint0_scan(wgola[GOLA_KIMEOUT], &kimeout))
-      strerr_dief2x(100, "kimeout", " must be an unsigned integer") ;
+      strerr_dief2x(100, "handshake-timeout", " must be an unsigned integer") ;
   if (wgola[GOLA_RFD])
   {
     unsigned int fd ;
diff --git a/src/tls/s6-ucspitlsd.c b/src/tls/s6-ucspitlsd.c
index d2b9580..d94e815 100644
--- a/src/tls/s6-ucspitlsd.c
+++ b/src/tls/s6-ucspitlsd.c
@@ -4,12 +4,11 @@
 #include <unistd.h>
 
 #include <skalibs/gccattributes.h>
+#include <skalibs/uint64.h>
 #include <skalibs/types.h>
-#include <skalibs/sgetopt.h>
-#include <skalibs/strerr.h>
+#include <skalibs/envexec.h>
 #include <skalibs/djbunix.h>
 #include <skalibs/socket.h>
-#include <skalibs/exec.h>
 
 #include <s6-networking/config.h>
 #include "s6tls-internal.h"
@@ -17,8 +16,27 @@
 #define USAGE "s6-ucspitlsd [ -S | -s ] [ -J | -j ] [ -Y | -y ] [ -k snilevel ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..."
 #define dieusage() strerr_dieusage(100, USAGE)
 
-static inline void child (int *, uint32_t, unsigned int, unsigned int, unsigned int, pid_t) gccattr_noreturn ;
-static inline void child (int *p, uint32_t options, unsigned int verbosity, unsigned int kimeout, unsigned int snilevel, pid_t pid)
+enum golb_e
+{
+  GOLB_CLOSENOTIFY = 0x0001,
+  GOLB_STRICTCN = 0x0002,
+  GOLB_CLIENTCERT = 0x0004,
+  GOLB_CLIENTCERT_ONLY = 0x0008,
+  GOLB_SNI = 0x0010,
+  GOLB_SNI_ONLY = 0x0020,
+  GOLB_KEEP = 0x100,
+} ;
+
+enum gola_e
+{
+  GOLA_VERBOSITY,
+  GOLA_KIMEOUT,
+  GOLA_SNILEVEL,
+  GOLA_N
+} ;
+
+static inline void child (int *, uint32_t, unsigned int, unsigned int, pid_t) gccattr_noreturn ;
+static inline void child (int *p, uint32_t options, unsigned int verbosity, unsigned int kimeout, pid_t pid)
 {
   ssize_t r ;
   char const *newargv[S6TLS_PREP_IO_ARGC] ;
@@ -52,7 +70,7 @@ static inline void child (int *p, uint32_t options, unsigned int verbosity, unsi
     default :
       strerr_dief1x(100, "unrecognized command on control socket") ;
   }
-  s6tls_prep_tlsdio(newargv, buf, p, options, verbosity, kimeout, snilevel) ;
+  s6tls_prep_tlsdio(newargv, buf, p, options, verbosity, kimeout) ;
   if (verbosity >= 2)
   {
     char fmt[PID_FMT] ;
@@ -64,40 +82,52 @@ static inline void child (int *p, uint32_t options, unsigned int verbosity, unsi
 
 int main (int argc, char const *const *argv)
 {
+  static gol_bool const rgolb[] =
+  {
+    { .so = 's', .lo = "no-close-notify", .clear = GOLB_CLOSENOTIFY, .set = 0 },
+    { .so = 'S', .lo = "close-notify", .clear = 0, .set = GOLB_CLOSENOTIFY },
+    { .so = 'j', .lo = "no-enforce-close-notify", .clear = GOLB_STRICTCN, .set = 0 },
+    { .so = 'J', .lo = "enforce-close-notify", .clear = 0, .set = GOLB_STRICTCN },
+    { .so = 'Y', .lo = "client-cert", .clear = GOLB_CLIENTCERT_ONLY, .set = GOLB_CLIENTCERT },
+    { .so = 'y', .lo = "mandatory-client-cert", .clear = 0, .set = GOLB_CLIENTCERT | GOLB_CLIENTCERT_ONLY },
+    { .so = 'z', .lo = "no-keep", .clear = GOLB_KEEP, .set = 0 },
+    { .so = 'Z', .lo = "keep", .clear = 0, .set = GOLB_KEEP },
+    { .so = 0, .lo = "sni", .clear = GOLB_SNI_ONLY, .set = GOLB_SNI },
+    { .so = 0, .lo = "mandatory-sni", .clear = 0, .set = GOLB_SNI | GOLB_SNI_ONLY },
+  } ;
+  static gol_arg const rgola[] =
+  {
+    { .so = 'v', .lo = "verbosity", .i = GOLA_VERBOSITY },
+    { .so = 'K', .lo = "handshake-timeout", .i = GOLA_KIMEOUT },
+    { .so = 'k', .lo = "sni-level", .i = GOLA_SNILEVEL },
+  } ;
+  int p[6] ;
   unsigned int verbosity = 1 ;
   unsigned int kimeout = 0 ;
-  unsigned int snilevel = 0 ;
-  uint32_t coptions = 0 ;
-  uint32_t poptions = 1 ;
-  int p[6] ;
   pid_t pid ;
-
+  uint64_t wgolb = 0 ;
+  char const *wgola[GOLA_N] = { 0 } ;
+  unsigned int golc ;
   PROG = "s6-ucspitlsd (parent)" ;
+
+  golc = GOL_main(argc, argv, rgolb, rgola, &wgolb, wgola) ;
+  argc -= golc ; argv += golc ;
+  if (!argc) dieusage() ;
+
+  if (wgola[GOLA_VERBOSITY])
+    if (!uint0_scan(wgola[GOLA_VERBOSITY], &verbosity))
+      strerr_dief2x(100, "verbosity", " must be an unsigned integer") ;
+  if (wgola[GOLA_KIMEOUT])
+    if (!uint0_scan(wgola[GOLA_KIMEOUT], &kimeout))
+      strerr_dief2x(100, "handshake-timeout", " must be an unsigned integer") ;
+  if (wgola[GOLA_SNILEVEL])
   {
-    subgetopt l = SUBGETOPT_ZERO ;
-    for (;;)
-    {
-      int opt = subgetopt_r(argc, argv, "SsJjyYv:K:Zzk:", &l) ;
-      if (opt == -1) break ;
-      switch (opt)
-      {
-        case 'S' : coptions |= 4 ; break ;
-        case 's' : coptions &= ~4 ; break ;
-        case 'J' : coptions |= 8 ; break ;
-        case 'j' : coptions &= ~8 ; break ;
-        case 'y' : coptions |= 3 ; break ;
-        case 'Y' : coptions |= 1 ; coptions &= ~2 ; break ;
-        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
-        case 'K' : if (!uint0_scan(l.arg, &kimeout)) dieusage() ; break ;
-        case 'Z' : poptions &= ~1 ; break ;
-        case 'z' : poptions |= 1 ; break ;
-        case 'k' : if (!uint0_scan(l.arg, &snilevel)) dieusage() ; break ;
-        default : dieusage() ;
-      }
-    }
-    argc -= l.ind ; argv += l.ind ;
+    unsigned int snilevel ;
+    if (!uint0_scan(wgola[GOLA_SNILEVEL], &snilevel))
+      strerr_dief2x(100, "sni-level", " must be an unsigned integer") ;
+    wgolb &= ~(GOLB_SNI | GOLB_SNI_ONLY) ;
+    wgolb |= (snilevel ? GOLB_SNI : 0) | (snilevel >= 2 ? GOLB_SNI_ONLY : 0) ;
   }
-  if (!argc) dieusage() ;
 
   if (pipe(p) == -1 || pipe(p+2) == -1) strerr_diefu1sys(111, "pipe") ;
   if (ipc_pair_b(p+4) == -1) strerr_diefu1sys(111, "ipc_pair") ;
@@ -106,8 +136,8 @@ int main (int argc, char const *const *argv)
   switch (fork())
   {
     case -1 : strerr_diefu1sys(111, "fork") ;
-    case 0 : child(p, coptions, verbosity, kimeout, snilevel, pid) ;
+    case 0 : child(p, wgolb & 0xff, verbosity, kimeout, pid) ;
     default : break ;
   }
-  s6tls_ucspi_exec_app(argv, p, poptions) ;
+  s6tls_ucspi_exec_app(argv, p, wgolb >> 8) ;
 }
diff --git a/src/tls/s6tls-internal.h b/src/tls/s6tls-internal.h
index 1ab77f6..87b781b 100644
--- a/src/tls/s6tls-internal.h
+++ b/src/tls/s6tls-internal.h
@@ -9,12 +9,12 @@
 #include <skalibs/gccattributes.h>
 #include <skalibs/types.h>
 
-#define S6TLS_PREP_IO_ARGC 16
+#define S6TLS_PREP_IO_ARGC 15
 #define S6TLS_PREP_IO_BUFLEN (5 * UINT_FMT)
 
 extern pid_t s6tls_io_spawn (char const *const *argv, int const *, int) ;
 extern void s6tls_prep_tlscio (char const **, char *, int const *, uint32_t, unsigned int, unsigned int, char const *) ;
-extern void s6tls_prep_tlsdio (char const **, char *, int const *, uint32_t, unsigned int, unsigned int, unsigned int) ;
+extern void s6tls_prep_tlsdio (char const **, char *, int const *, uint32_t, unsigned int, unsigned int) ;
 extern void s6tls_sync_and_exec_app (char const *const *, int const *, pid_t, uint32_t) gccattr_noreturn ;
 extern void s6tls_ucspi_exec_app (char const *const *, int const *, uint32_t) gccattr_noreturn ;
 extern void s6tls_clean_and_exec (char const *const *, uint32_t, char const *, size_t) gccattr_noreturn ;
diff --git a/src/tls/s6tls_prep_tlsdio.c b/src/tls/s6tls_prep_tlsdio.c
index 8408010..b459bc1 100644
--- a/src/tls/s6tls_prep_tlsdio.c
+++ b/src/tls/s6tls_prep_tlsdio.c
@@ -5,7 +5,7 @@
 #include <s6-networking/config.h>
 #include "s6tls-internal.h"
 
-void s6tls_prep_tlsdio (char const **argv, char *buf, int const *p, uint32_t options, unsigned int verbosity, unsigned int kimeout, unsigned int snilevel)
+void s6tls_prep_tlsdio (char const **argv, char *buf, int const *p, uint32_t options, unsigned int verbosity, unsigned int kimeout)
 {
   size_t m = 0 ;
   size_t n = 0 ;
@@ -25,10 +25,10 @@ void s6tls_prep_tlsdio (char const **argv, char *buf, int const *p, uint32_t opt
     n += uint_fmt(buf + n, p[5]) ;
     buf[n++] = 0 ;
   }
-  if (options & 4) argv[m++] = "-S" ;
-  if (options & 8) argv[m++] = "-J" ;
-  if (options & 1)
-    argv[m++] = options & 2 ? "-y" : "-Y" ;
+  if (options & 0x01) argv[m++] = "-S" ;
+  if (options & 0x02) argv[m++] = "-J" ;
+  if (options & 0x04)
+    argv[m++] = options & 0x08 ? "-y" : "-Y" ;
   if (kimeout)
   {
     argv[m++] = "-K" ;
@@ -36,13 +36,8 @@ void s6tls_prep_tlsdio (char const **argv, char *buf, int const *p, uint32_t opt
     n += uint_fmt(buf + n, kimeout) ;
     buf[n++] = 0 ;
   }
-  if (snilevel)
-  {
-    argv[m++] = "-k" ;
-    argv[m++] = buf + n ;
-    n += uint_fmt(buf + n, snilevel) ;
-    buf[n++] = 0 ;
-  }
+  if (options & 0x20) argv[m++] = "--mandatory-sni" ;
+  else if (options & 0x10) argv[m++] = "--sni" ;
   argv[m++] = "--" ;
   argv[m++] = buf + n ;
   n += uint_fmt(buf + n, p[0]) ;