Fix case where s6-tls[cd] would sometimes not detect an application and remain there forever with its zombie, both condemned to err in limbo for all eternity, the living and the dead, hand in hand

19 files changed, 243 insertions, 169 deletions

diff --git a/doc/libsbearssl/index.html b/doc/libsbearssl/index.html
index 1c797c7..20cdb06 100644
--- a/doc/libsbearssl/index.html
+++ b/doc/libsbearssl/index.html
@@ -473,23 +473,28 @@ i.e. a <tt>tai_t</tt> plus nanoseconds (which are simply ignored).
 
 <h3> Running the TLS/SSL engine (both clients and servers) </h3>
 
-<h4> <code> int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity, uint32_t options, tain_t const *tto) </code> </h4>
+<h4> <code> int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto) </code> </h4>
 
 <p>
  This function runs a full-duplex TLS/SSL engine, reading/writing
 clear text from/to two file descriptors, and writing/reading
 ciphertext to/from two other file descriptors, until the
 connection is closed both ways (either with a SSL close, or
-with EOF).
+with EOF) or a given subprocess dies.
 </p>
 
 <ul>
  <li> <em>ctx</em> is a pointer to a fully initialized context,
 connected to <em>fds</em>[2] and <em>fds</em>[3]. The
 TLS/SSL handshake does not have to be completed. </li>
- <li> <em>fds</em> is an array of 4 file descriptors, in this
+ <li> <em>fds</em> is an array of 5 file descriptors, in this
 order: fd reading clear text, fd writing clear text, fd reading
-ciphertext, fd writing ciphertext. </li>
+ciphertext, fd writing ciphertext, selfpipe. </li>
+ <li> <em>pid</em> is the pid of the application subprocess.
+When a SIGCHLD is detected on the selfpipe, the newly deceased
+process is reaped, and if it was <em>pid</em>, then the function
+returns as soon as it doesn't have anything left to write to
+the network peer. </li>
  <li> <em>verbosity</em> defines the engine's verbosity: the
 higher the more verbose. This parameter is currently ignored. </li>
  <li> <em>options</em> is a bitfield.
@@ -520,12 +525,13 @@ if you don't want the engine to ever timeout. </li>
 
 <p>
  <tt>sbearssl_run</tt> will make the process die with an appropriate error
-message if it encounters an unrecoverable error. If there were no problems
-and the SSL/TLS connection closed cleanly, it returns 0. If a SSL/TLS-level
-error occurred, it returns nonzero; a corresponding error message for the
-return value can be obtained via <tt>sbearssl_error_str()</tt>.
-All four descriptors in <em>fds</em> are closed when
-<tt>sbearssl_run</tt> returns.
+message if it encounters an unrecoverable error. If there were no problems and the
+SSL/TLS connection closed cleanly, it returns -1. If the application
+subprocess dies early, <tt>sbearssl_run</tt> returns the <em>wstat</em>
+for that subprocess, i.e. the integer containing the information about
+its exit code or crash signal. No matter how <tt>sbearssl_run</tt> returns,
+the first four descriptors in <em>fds</em> are closed, but the
+selfpipe is untouched and the caller should free <em>ctx</em> itself.
 </p>
 
 <h4> <code> int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd) </code> </h4>
diff --git a/doc/libstls/index.html b/doc/libstls/index.html
index 4c6819b..8b30b20 100644
--- a/doc/libstls/index.html
+++ b/doc/libstls/index.html
@@ -54,23 +54,28 @@ sysdeps directory. </li>
 
 <h3> Running the TLS/SSL engine </h3>
 
-<h4> <code> int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t options, tain_t const *tto) </code> </h4>
+<h4> <code> int stls_run (struct tls *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto) </code> </h4>
 
 <p>
  This function runs a full-duplex TLS/SSL engine, reading/writing
 clear text from/to two file descriptors, and writing/reading
 ciphertext to/from two other file descriptors, until the
 connection is closed both ways (either with a SSL close, or
-with EOF).
+with EOF) or a given subprocess dies.
 </p>
 
 <ul>
  <li> <em>ctx</em> is a pointer to a fully initialized context,
 connected to <em>fds</em>[2] and <em>fds</em>[3]. The TLS
 handshake must already be completed. </li>
- <li> <em>fds</em> is an array of 4 file descriptors, in this
+ <li> <em>fds</em> is an array of 5 file descriptors, in this
 order: fd reading clear text, fd writing clear text, fd reading
-ciphertext, fd writing ciphertext. </li>
+ciphertext, fd writing ciphertext, selfpipe. </li>
+ <li> <em>pid</em> is the pid of the application subprocess.
+When a SIGCHLD is detected on the selfpipe, the newly deceased
+process is reaped, and if it was <em>pid</em>, then the function
+returns as soon as it doesn't have anything left to write to
+the network peer. </li>
  <li> <em>verbosity</em> defines the engine's verbosity: the
 higher the more verbose. This parameter is currently ignored. </li>
  <li> <em>options</em> is a bitfield.
@@ -101,10 +106,13 @@ if you don't want the engine to ever timeout. </li>
 
 <p>
  <tt>stls_run</tt> will make the process die with an appropriate error
-message if it encounters an error. If there were no problems and the
-SSL/TLS connection closed cleanly, it returns 0. All four descriptors
-in <em>fds</em> are closed when <tt>stls_run</tt> returns, but the
-caller should still free <em>ctx</em> itself.
+message if it encounters an unrecoverable error. If there were no problems and the
+SSL/TLS connection closed cleanly, it returns -1. If the application
+subprocess dies early, <tt>stls_run</tt> returns the <em>wstat</em>
+for that subprocess, i.e. the integer containing the information about
+its exit code or crash signal. No matter how <tt>stls_run</tt> returns,
+the first four descriptors in <em>fds</em> are closed, but the
+selfpipe is untouched and the caller should free <em>ctx</em> itself.
 </p>
 
 <h4> <code> int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd) </code> </h4>
diff --git a/package/deps.mak b/package/deps.mak
index 63074bb..840e716 100644
--- a/package/deps.mak
+++ b/package/deps.mak
@@ -36,7 +36,6 @@ src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_from.lo: src/sbears
 src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readbigpem.lo: src/sbearssl/sbearssl_cert_readbigpem.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_readfile.lo: src/sbearssl/sbearssl_cert_readfile.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_cert_to.lo: src/sbearssl/sbearssl_cert_to.c src/include/s6-networking/sbearssl.h
-src/sbearssl/sbearssl_clean_tls_and_spawn.o src/sbearssl/sbearssl_clean_tls_and_spawn.lo: src/sbearssl/sbearssl_clean_tls_and_spawn.c src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_issuer_keytype.lo: src/sbearssl/sbearssl_ec_issuer_keytype.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_from.lo: src/sbearssl/sbearssl_ec_pkey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_pkey_to.lo: src/sbearssl/sbearssl_ec_pkey_to.c src/include/s6-networking/sbearssl.h
@@ -49,6 +48,7 @@ src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_decode_
 src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pem_push.lo: src/sbearssl/sbearssl_pem_push.c src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_from.lo: src/sbearssl/sbearssl_pkey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_pkey_to.lo: src/sbearssl/sbearssl_pkey_to.c src/include/s6-networking/sbearssl.h
+src/sbearssl/sbearssl_prep_spawn_drop.o src/sbearssl/sbearssl_prep_spawn_drop.lo: src/sbearssl/sbearssl_prep_spawn_drop.c src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_from.lo: src/sbearssl/sbearssl_rsa_pkey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_to.lo: src/sbearssl/sbearssl_rsa_pkey_to.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_from.lo: src/sbearssl/sbearssl_rsa_skey_from.c src/include/s6-networking/sbearssl.h
@@ -56,7 +56,6 @@ src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_rsa_skey_to.lo: src/sb
 src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_run.lo: src/sbearssl/sbearssl_run.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsc.lo: src/sbearssl/sbearssl_s6tlsc.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_s6tlsd.o src/sbearssl/sbearssl_s6tlsd.lo: src/sbearssl/sbearssl_s6tlsd.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h
-src/sbearssl/sbearssl_setclientcert.o src/sbearssl/sbearssl_setclientcert.lo: src/sbearssl/sbearssl_setclientcert.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_from.lo: src/sbearssl/sbearssl_skey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_readfile.lo: src/sbearssl/sbearssl_skey_readfile.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_skey_to.lo: src/sbearssl/sbearssl_skey_to.c src/include/s6-networking/sbearssl.h
@@ -69,7 +68,7 @@ src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_ta_to.lo: src/sbearssl/sbear
 src/sbearssl/sbearssl_x500_from_ta.o src/sbearssl/sbearssl_x500_from_ta.lo: src/sbearssl/sbearssl_x500_from_ta.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_x500_name_len.o src/sbearssl/sbearssl_x500_name_len.lo: src/sbearssl/sbearssl_x500_name_len.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_x509_minimal_set_tai.lo: src/sbearssl/sbearssl_x509_minimal_set_tai.c src/include/s6-networking/sbearssl.h
-src/stls/stls_clean_tls_and_spawn.o src/stls/stls_clean_tls_and_spawn.lo: src/stls/stls_clean_tls_and_spawn.c src/stls/stls-internal.h
+src/stls/stls_prep_spawn_drop.o src/stls/stls_prep_spawn_drop.lo: src/stls/stls_prep_spawn_drop.c src/stls/stls-internal.h
 src/stls/stls_run.o src/stls/stls_run.lo: src/stls/stls_run.c src/include/s6-networking/stls.h
 src/stls/stls_s6tlsc.o src/stls/stls_s6tlsc.lo: src/stls/stls_s6tlsc.c src/include/s6-networking/stls.h src/stls/stls-internal.h
 src/stls/stls_s6tlsd.o src/stls/stls_s6tlsd.lo: src/stls/stls_s6tlsd.c src/include/s6-networking/stls.h src/stls/stls-internal.h
@@ -119,9 +118,9 @@ libs6net.so.xyzzy: EXTRA_LIBS := -lskarnet
 libs6net.so.xyzzy: src/libs6net/s6net_ident_client.lo src/libs6net/s6net_ident_reply_get.lo src/libs6net/s6net_ident_reply_parse.lo src/libs6net/s6net_ident_error.lo
 minidentd: EXTRA_LIBS := ${SOCKET_LIB} ${TAINNOW_LIB}
 minidentd: src/minidentd/minidentd.o src/minidentd/mgetuid.o -lskarnet
-libsbearssl.a.xyzzy: src/sbearssl/sbearssl_append.o src/sbearssl/sbearssl_clean_tls_and_spawn.o src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_skey_from.o src/sbearssl/sbearssl_ec_skey_to.o src/sbearssl/sbearssl_error_str.o src/sbearssl/sbearssl_isder.o src/sbearssl/sbearssl_pem_decode_from_buffer.o src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_ta_cert.o src/sbearssl/sbearssl_ta_certs.o src/sbearssl/sbearssl_ta_from.o src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_x500_name_len.o src/sbearssl/sbearssl_x500_from_ta.o src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsd.o
+libsbearssl.a.xyzzy: src/sbearssl/sbearssl_append.o src/sbearssl/sbearssl_prep_spawn_drop.o src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_skey_from.o src/sbearssl/sbearssl_ec_skey_to.o src/sbearssl/sbearssl_error_str.o src/sbearssl/sbearssl_isder.o src/sbearssl/sbearssl_pem_decode_from_buffer.o src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_ta_cert.o src/sbearssl/sbearssl_ta_certs.o src/sbearssl/sbearssl_ta_from.o src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_x500_name_len.o src/sbearssl/sbearssl_x500_from_ta.o src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsd.o
 libsbearssl.so.xyzzy: EXTRA_LIBS := -lbearssl -lskarnet
-libsbearssl.so.xyzzy: src/sbearssl/sbearssl_append.lo src/sbearssl/sbearssl_clean_tls_and_spawn.lo src/sbearssl/sbearssl_cert_from.lo src/sbearssl/sbearssl_cert_readbigpem.lo src/sbearssl/sbearssl_cert_readfile.lo src/sbearssl/sbearssl_cert_to.lo src/sbearssl/sbearssl_ec_issuer_keytype.lo src/sbearssl/sbearssl_ec_pkey_from.lo src/sbearssl/sbearssl_ec_pkey_to.lo src/sbearssl/sbearssl_ec_skey_from.lo src/sbearssl/sbearssl_ec_skey_to.lo src/sbearssl/sbearssl_error_str.lo src/sbearssl/sbearssl_isder.lo src/sbearssl/sbearssl_pem_decode_from_buffer.lo src/sbearssl/sbearssl_pem_decode_from_string.lo src/sbearssl/sbearssl_pem_push.lo src/sbearssl/sbearssl_pkey_from.lo src/sbearssl/sbearssl_pkey_to.lo src/sbearssl/sbearssl_rsa_pkey_from.lo src/sbearssl/sbearssl_rsa_pkey_to.lo src/sbearssl/sbearssl_rsa_skey_from.lo src/sbearssl/sbearssl_rsa_skey_to.lo src/sbearssl/sbearssl_run.lo src/sbearssl/sbearssl_skey_from.lo src/sbearssl/sbearssl_skey_readfile.lo src/sbearssl/sbearssl_skey_to.lo src/sbearssl/sbearssl_ta_cert.lo src/sbearssl/sbearssl_ta_certs.lo src/sbearssl/sbearssl_ta_from.lo src/sbearssl/sbearssl_ta_readdir.lo src/sbearssl/sbearssl_ta_readfile.lo src/sbearssl/sbearssl_ta_to.lo src/sbearssl/sbearssl_x500_name_len.lo src/sbearssl/sbearssl_x500_from_ta.lo src/sbearssl/sbearssl_x509_minimal_set_tai.lo src/sbearssl/sbearssl_s6tlsc.lo src/sbearssl/sbearssl_s6tlsd.lo
-libstls.a.xyzzy: src/stls/stls_clean_tls_and_spawn.o src/stls/stls_run.o src/stls/stls_s6tlsc.o src/stls/stls_s6tlsd.o
+libsbearssl.so.xyzzy: src/sbearssl/sbearssl_append.lo src/sbearssl/sbearssl_prep_spawn_drop.lo src/sbearssl/sbearssl_cert_from.lo src/sbearssl/sbearssl_cert_readbigpem.lo src/sbearssl/sbearssl_cert_readfile.lo src/sbearssl/sbearssl_cert_to.lo src/sbearssl/sbearssl_ec_issuer_keytype.lo src/sbearssl/sbearssl_ec_pkey_from.lo src/sbearssl/sbearssl_ec_pkey_to.lo src/sbearssl/sbearssl_ec_skey_from.lo src/sbearssl/sbearssl_ec_skey_to.lo src/sbearssl/sbearssl_error_str.lo src/sbearssl/sbearssl_isder.lo src/sbearssl/sbearssl_pem_decode_from_buffer.lo src/sbearssl/sbearssl_pem_decode_from_string.lo src/sbearssl/sbearssl_pem_push.lo src/sbearssl/sbearssl_pkey_from.lo src/sbearssl/sbearssl_pkey_to.lo src/sbearssl/sbearssl_rsa_pkey_from.lo src/sbearssl/sbearssl_rsa_pkey_to.lo src/sbearssl/sbearssl_rsa_skey_from.lo src/sbearssl/sbearssl_rsa_skey_to.lo src/sbearssl/sbearssl_run.lo src/sbearssl/sbearssl_skey_from.lo src/sbearssl/sbearssl_skey_readfile.lo src/sbearssl/sbearssl_skey_to.lo src/sbearssl/sbearssl_ta_cert.lo src/sbearssl/sbearssl_ta_certs.lo src/sbearssl/sbearssl_ta_from.lo src/sbearssl/sbearssl_ta_readdir.lo src/sbearssl/sbearssl_ta_readfile.lo src/sbearssl/sbearssl_ta_to.lo src/sbearssl/sbearssl_x500_name_len.lo src/sbearssl/sbearssl_x500_from_ta.lo src/sbearssl/sbearssl_x509_minimal_set_tai.lo src/sbearssl/sbearssl_s6tlsc.lo src/sbearssl/sbearssl_s6tlsd.lo
+libstls.a.xyzzy: src/stls/stls_prep_spawn_drop.o src/stls/stls_run.o src/stls/stls_s6tlsc.o src/stls/stls_s6tlsd.o
 libstls.so.xyzzy: EXTRA_LIBS := -ltls -lskarnet
-libstls.so.xyzzy: src/stls/stls_clean_tls_and_spawn.lo src/stls/stls_run.lo src/stls/stls_s6tlsc.lo src/stls/stls_s6tlsd.lo
+libstls.so.xyzzy: src/stls/stls_prep_spawn_drop.lo src/stls/stls_run.lo src/stls/stls_s6tlsc.lo src/stls/stls_s6tlsd.lo
diff --git a/src/include/s6-networking/sbearssl.h b/src/include/s6-networking/sbearssl.h
index a91eea9..ab94d75 100644
--- a/src/include/s6-networking/sbearssl.h
+++ b/src/include/s6-networking/sbearssl.h
@@ -202,7 +202,7 @@ extern char const *sbearssl_error_str (int) ;
 
  /* Engine */
 
-extern int sbearssl_run (br_ssl_engine_context *, int *, unsigned int, uint32_t, tain_t const *) ;
+extern int sbearssl_run (br_ssl_engine_context *, int *, pid_t, unsigned int, uint32_t, tain_t const *) ;
 
 
  /* s6-tlsc and s6-tlsd implementations */
diff --git a/src/include/s6-networking/stls.h b/src/include/s6-networking/stls.h
index 9e418b1..963e7a1 100644
--- a/src/include/s6-networking/stls.h
+++ b/src/include/s6-networking/stls.h
@@ -13,7 +13,7 @@
 
  /* Engine */
 
-extern int stls_run (struct tls *, int *, unsigned int, uint32_t, tain_t const *) ;
+extern int stls_run (struct tls *, int *, pid_t, unsigned int, uint32_t, tain_t const *) ;
 
 
  /* s6-tlsc and s6-tlsd implementations */
diff --git a/src/sbearssl/deps-lib/sbearssl b/src/sbearssl/deps-lib/sbearssl
index 4945ad8..c0acfb6 100644
--- a/src/sbearssl/deps-lib/sbearssl
+++ b/src/sbearssl/deps-lib/sbearssl
@@ -1,5 +1,5 @@
 sbearssl_append.o
-sbearssl_clean_tls_and_spawn.o
+sbearssl_prep_spawn_drop.o
 sbearssl_cert_from.o
 sbearssl_cert_readbigpem.o
 sbearssl_cert_readfile.o
diff --git a/src/sbearssl/sbearssl-internal.h b/src/sbearssl/sbearssl-internal.h
index df3e3e5..cbf355b 100644
--- a/src/sbearssl/sbearssl-internal.h
+++ b/src/sbearssl/sbearssl-internal.h
@@ -19,6 +19,6 @@ struct sbearssl_strallocerr_s
 
 extern void sbearssl_append (void *, void const *, size_t) ;
 extern int sbearssl_pem_push (br_pem_decoder_context *, char const *, size_t, sbearssl_pemobject *, genalloc *, sbearssl_strallocerr *, int *) ;
-extern pid_t sbearssl_clean_tls_and_spawn (char const *const *, char const *const *, int *, uint32_t) ;
+extern pid_t sbearssl_prep_spawn_drop (char const *const *, char const *const *, int *, uid_t, gid_t, uint32_t) ;
 
 #endif
diff --git a/src/sbearssl/sbearssl_clean_tls_and_spawn.c b/src/sbearssl/sbearssl_clean_tls_and_spawn.c
deleted file mode 100644
index 258db90..0000000
--- a/src/sbearssl/sbearssl_clean_tls_and_spawn.c
+++ /dev/null
@@ -1,21 +0,0 @@
-/* ISC license. */
-
-#include <sys/types.h>
-#include <skalibs/env.h>
-#include <skalibs/djbunix.h>
-#include "sbearssl-internal.h"
-
-pid_t sbearssl_clean_tls_and_spawn (char const *const *argv, char const *const *envp, int *fds, uint32_t options)
-{
-  if (!(options & 1)) return child_spawn2(argv[0], argv, envp, fds) ;
-  else
-  {
-    char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ;
-    size_t modiflen = sizeof(modifs) ;
-    size_t n = env_len(envp) ;
-    char const *newenv[n + 7] ;
-    size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ;
-    if (!newenvlen) return 0 ;
-    return child_spawn2(argv[0], argv, newenv, fds) ;
-  }
-}
diff --git a/src/sbearssl/sbearssl_prep_spawn_drop.c b/src/sbearssl/sbearssl_prep_spawn_drop.c
new file mode 100644
index 0000000..1ca7eb8
--- /dev/null
+++ b/src/sbearssl/sbearssl_prep_spawn_drop.c
@@ -0,0 +1,35 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <signal.h>
+#include <skalibs/env.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/selfpipe.h>
+#include "sbearssl-internal.h"
+
+pid_t sbearssl_prep_spawn_drop (char const *const *argv, char const *const *envp, int *fds, uid_t uid, gid_t gid, uint32_t options)
+{
+  pid_t pid ;
+
+  fds[4] = selfpipe_init() ;
+  if (fds[4] < 0) strerr_diefu1sys(111, "init selfpipe") ;
+  if (selfpipe_trap(SIGCHLD) < 0) strerr_diefu1sys(111, "trap SIGCHLD") ;
+
+  if (!(options & 1)) pid = child_spawn2(argv[0], argv, envp, fds) ;
+  else
+  {
+    char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ;
+    size_t modiflen = sizeof(modifs) ;
+    size_t n = env_len(envp) ;
+    char const *newenv[n + 7] ;
+    size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ;
+    if (!newenvlen) return 0 ;
+    pid = child_spawn2(argv[0], argv, newenv, fds) ;
+  }
+
+  if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
+  if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
+  if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
+  return pid ;
+}
diff --git a/src/sbearssl/sbearssl_run.c b/src/sbearssl/sbearssl_run.c
index ca4a79e..26a8bd3 100644
--- a/src/sbearssl/sbearssl_run.c
+++ b/src/sbearssl/sbearssl_run.c
@@ -1,7 +1,6 @@
 /* ISC license. */
 
 #include <skalibs/nonposix.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 #include <errno.h>
 #include <signal.h>
@@ -12,13 +11,33 @@
 #include <skalibs/tai.h>
 #include <skalibs/iopause.h>
 #include <skalibs/djbunix.h>
+#include <skalibs/selfpipe.h>
 #include <s6-networking/sbearssl.h>
 
-int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity, uint32_t options, tain_t const *tto)
+static inline void handle_signals (pid_t pid, int *e)
 {
-  iopause_fd x[4] ;
+  for (;;) switch (selfpipe_read())
+  {
+    case -1 : strerr_diefu1sys(111, "read selfpipe") ;
+    case 0 : return ;
+    case SIGCHLD :
+    {
+      int wstat ;
+      if (wait_pid_nohang(pid, &wstat) == pid)
+      {
+        *e = wstat ;
+        return ;
+      }
+    }
+  }
+}
+
+int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto)
+{
+  iopause_fd x[5] = { { .fd = fds[4], .events = IOPAUSE_READ } } ;
   unsigned int xindex[4] ;
   int markedforflush = 0 ;
+  int e = -1 ;
 
   if (ndelay_on(fds[2]) < 0 || ndelay_on(fds[3]) < 0)
     strerr_diefu1sys(111, "set fds non-blocking") ;
@@ -28,11 +47,16 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
   for (;;)
   {
     tain_t deadline ;
-    unsigned int j = 0 ;
+    unsigned int j = 1 ;
     unsigned int state = br_ssl_engine_current_state(ctx) ;
     int r ;
 
-    if (state & BR_SSL_CLOSED) break ;
+    if (state & BR_SSL_CLOSED)
+    {
+      r = br_ssl_engine_last_error(ctx) ;
+      if (r) strerr_diefu2x(98, "establish or maintain SSL connection to peer: ", sbearssl_error_str(r)) ;
+      break ;
+    }
 
     tain_add_g(&deadline, fds[0] >= 0 && fds[2] >= 0 && state & (BR_SSL_SENDAPP | BR_SSL_RECVREC) ? tto : &tain_infinite_relative) ;
 
@@ -42,30 +66,30 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
       x[j].events = IOPAUSE_READ ;
       xindex[0] = j++ ;
     }
-    else xindex[0] = 4 ;
+    else xindex[0] = 5 ;
     if (fds[1] >= 0 && state & BR_SSL_RECVAPP)
     {
       x[j].fd = fds[1] ;
       x[j].events = IOPAUSE_WRITE ;
       xindex[1] = j++ ;
     }
-    else xindex[1] = 4 ;
+    else xindex[1] = 5 ;
     if (fds[2] >= 0 && state & BR_SSL_RECVREC)
     {
       x[j].fd = fds[2] ;
       x[j].events = IOPAUSE_READ ;
       xindex[2] = j++ ;
     }
-    else xindex[2] = 4 ;
+    else xindex[2] = 5 ;
     if (fds[3] >= 0 && state & BR_SSL_SENDREC)
     {
       x[j].fd = fds[3] ;
       x[j].events = IOPAUSE_WRITE ;
       xindex[3] = j++ ;
     }
-    else xindex[3] = 4 ;
+    else xindex[3] = 5 ;
 
-    if (!j) break ;
+    if (j == 1) break ;
     r = iopause_g(x, j, &deadline) ;
     if (r < 0) strerr_diefu1sys(111, "iopause") ;
     else if (!r)
@@ -77,6 +101,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
         fd_close(fds[3]) ; fds[3] = -1 ;
       }
       else br_ssl_engine_close(ctx) ;
+      if (e >= 0) break ;
       continue ;
     }
 
@@ -85,6 +110,11 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
         x[j].revents |= IOPAUSE_READ | IOPAUSE_WRITE ;
 
 
+   /* Signal */
+
+    if (x[0].revents & IOPAUSE_READ) handle_signals(pid, &e) ;
+
+
    /* Flush to local */
 
     if (state & BR_SSL_RECVAPP && x[xindex[1]].events & x[xindex[1]].revents & IOPAUSE_WRITE)
@@ -111,7 +141,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
 
    /* Flush to remote */
 
-    if (state & BR_SSL_SENDREC && x[xindex[3]].events & x[xindex[3]].revents & IOPAUSE_WRITE)
+    if (state & BR_SSL_SENDREC && xindex[3] < 5 && x[xindex[3]].events & x[xindex[3]].revents & IOPAUSE_WRITE)
     {
       size_t len ;
       unsigned char const *s = br_ssl_engine_sendrec_buf(ctx, &len) ;
@@ -132,6 +162,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
             fd_close(fds[3]) ; fds[3] = -1 ;
           }
           else br_ssl_engine_close(ctx) ;
+          if (e >= 0) break ;
         }
         state = br_ssl_engine_current_state(ctx) ;
       }
@@ -140,7 +171,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
 
    /* Fill from local */
 
-    if (state & BR_SSL_SENDAPP && x[xindex[0]].events & IOPAUSE_READ && (markedforflush || x[xindex[0]].revents & IOPAUSE_READ))
+    if (state & BR_SSL_SENDAPP && xindex[0] < 5 && x[xindex[0]].events & IOPAUSE_READ && (markedforflush || x[xindex[0]].revents & IOPAUSE_READ))
     {
       size_t len ;
       unsigned char *s = br_ssl_engine_sendapp_buf(ctx, &len) ;
@@ -160,6 +191,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
               fd_close(fds[3]) ; fds[3] = -1 ;
             }
             else br_ssl_engine_close(ctx) ;
+            if (e >= 0) break ;
           }
         }
       }
@@ -179,7 +211,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
 
    /* Fill from remote */
 
-    if (state & BR_SSL_RECVREC && x[xindex[2]].events & x[xindex[2]].revents & IOPAUSE_READ)
+    if (state & BR_SSL_RECVREC && xindex[2] < 5 && x[xindex[2]].events & x[xindex[2]].revents & IOPAUSE_READ)
     {
       size_t len ;
       unsigned char *s = br_ssl_engine_recvrec_buf(ctx, &len) ;
@@ -204,5 +236,5 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, unsigned int verbosity,
   if (fds[0] >= 0) fd_close(fds[0]) ;
   if (fds[3] >= 0) fd_close(fds[3]) ;
   if (fds[2] >= 0) fd_close(fds[2]) ;
-  return br_ssl_engine_last_error(ctx) ;
+  return e ;
 }
diff --git a/src/sbearssl/sbearssl_s6tlsc.c b/src/sbearssl/sbearssl_s6tlsc.c
index e01e25e..267d79c 100644
--- a/src/sbearssl/sbearssl_s6tlsc.c
+++ b/src/sbearssl/sbearssl_s6tlsc.c
@@ -14,10 +14,11 @@
 
 int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd)
 {
-  int fds[4] = { sfd[0], sfd[1], sfd[0], sfd[1] } ;
+  int fds[5] = { sfd[0], sfd[1], sfd[0], sfd[1] } ;
   stralloc storage = STRALLOC_ZERO ;
   genalloc tas = GENALLOC_ZERO ;
   size_t talen ;
+  pid_t pid ;
 
   if (preoptions & 1)
     strerr_dief1x(100, "client certificates are not supported yet") ;
@@ -44,31 +45,26 @@ int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t co
       strerr_dief2x(96, "no trust anchor found in ", x) ;
   }
 
+  if (!random_init()) strerr_diefu1sys(111, "initialize random generator") ;
+
+  pid = sbearssl_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ;
+
   {
     unsigned char buf[BR_SSL_BUFSIZE_BIDI] ;
     br_x509_minimal_context xc ;
     br_ssl_client_context cc ;
     br_x509_trust_anchor btas[talen] ;
     size_t i = talen ;
-    pid_t pid ;
+    int wstat ;
 
     stralloc_shrink(&storage) ;
     while (i--)
       sbearssl_ta_to(genalloc_s(sbearssl_ta, &tas) + i, btas + i, storage.s) ;
     genalloc_free(sbearssl_ta, &tas) ;
-    
     br_ssl_client_init_full(&cc, &xc, btas, talen) ;
-
-    if (!random_init())
-      strerr_diefu1sys(111, "initialize random generator") ;
     random_string((char *)buf, 32) ;
     br_ssl_engine_inject_entropy(&cc.eng, buf, 32) ;
     random_finish() ;
-
-    pid = sbearssl_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
-    if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
-    if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
-
     br_ssl_engine_set_buffer(&cc.eng, buf, sizeof(buf), 1) ;
     if (!br_ssl_client_reset(&cc, servername, 0))
       strerr_diefu2x(97, "reset client context: ", sbearssl_error_str(br_ssl_engine_last_error(&cc.eng))) ;
@@ -76,13 +72,8 @@ int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t co
     if (!sbearssl_x509_minimal_set_tain(&xc, &STAMP))
       strerr_diefu1sys(111, "initialize validation time") ;
 
-    {
-      int wstat ;
-      int r = sbearssl_run(&cc.eng, fds, verbosity, options, tto) ;
-      if (r < 0) strerr_diefu1sys(111, "run SSL engine") ;
-      else if (r) strerr_diefu2x(98, "establish or maintain SSL connection to peer: ", sbearssl_error_str(r)) ;
-      if (wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
-      return wait_estatus(wstat) ;
-    }
+    wstat = sbearssl_run(&cc.eng, fds, pid, verbosity, options, tto) ;
+    if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
+    return wait_estatus(wstat) ;
   }
 }
diff --git a/src/sbearssl/sbearssl_s6tlsd.c b/src/sbearssl/sbearssl_s6tlsd.c
index dd7f52a..6c3d163 100644
--- a/src/sbearssl/sbearssl_s6tlsd.c
+++ b/src/sbearssl/sbearssl_s6tlsd.c
@@ -14,10 +14,12 @@
 
 int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity)
 {
+  int fds[5] = { 0, 1, 0, 1 } ;
   stralloc storage = STRALLOC_ZERO ;
   sbearssl_skey skey ;
   genalloc certs = GENALLOC_ZERO ;
   size_t chainlen ;
+  pid_t pid ;
 
   if (preoptions & 1)
     strerr_dief1x(100, "client certificates are not supported yet") ;
@@ -44,14 +46,17 @@ int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t co
       strerr_diefu2x(96, "find a certificate in ", x) ;
   }
 
+  if (!random_init()) strerr_diefu1sys(111, "initialize random generator") ;
+
+  pid = sbearssl_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ;
+
   {
-    int fds[4] = { 0, 1, 0, 1 } ;
     unsigned char buf[BR_SSL_BUFSIZE_BIDI] ;
     br_ssl_server_context sc ;
     union br_skey_u key ;
     br_x509_certificate chain[chainlen] ;
     size_t i = chainlen ;
-    pid_t pid ;
+    int wstat ;
 
     stralloc_shrink(&storage) ;
     while (i--)
@@ -83,17 +88,6 @@ int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t co
       strerr_dief1x(96, "unsupported private key type") ;
     }
 
-    if (!random_init())
-      strerr_diefu1sys(111, "initialize random generator") ;
-    random_string((char *)buf, 32) ;
-    br_ssl_engine_inject_entropy(&sc.eng, buf, 32) ;
-    random_finish() ;
-
-    pid = sbearssl_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
-    if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
-    if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
-    if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
-
     {
       uint32_t flags = BR_OPT_ENFORCE_SERVER_PREFERENCES | BR_OPT_NO_RENEGOTIATION ;
       if (preoptions & 1)
@@ -104,17 +98,15 @@ int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t co
       br_ssl_engine_add_flags(&sc.eng, flags) ;
     }
 
+    random_string((char *)buf, 32) ;
+    br_ssl_engine_inject_entropy(&sc.eng, buf, 32) ;
+    random_finish() ;
     br_ssl_engine_set_buffer(&sc.eng, buf, sizeof(buf), 1) ;
     br_ssl_server_reset(&sc) ;
     tain_now_g() ;
 
-    {
-      int wstat ;
-      int r = sbearssl_run(&sc.eng, fds, verbosity, options, tto) ;
-      if (r < 0) strerr_diefu1sys(111, "run SSL engine") ;
-      else if (r) strerr_diefu2x(98, "establish or maintain SSL connection to peer: ", sbearssl_error_str(r)) ;
-      if (wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
-      return wait_estatus(wstat) ;
-    }
+    wstat = sbearssl_run(&sc.eng, fds, pid, verbosity, options, tto) ;
+    if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
+    return wait_estatus(wstat) ;
   }
 }
diff --git a/src/stls/deps-lib/stls b/src/stls/deps-lib/stls
index 03cebfa..7ecfa0b 100644
--- a/src/stls/deps-lib/stls
+++ b/src/stls/deps-lib/stls
@@ -1,4 +1,4 @@
-stls_clean_tls_and_spawn.o
+stls_prep_spawn_drop.o
 stls_run.o
 stls_s6tlsc.o
 stls_s6tlsd.o
diff --git a/src/stls/stls-internal.h b/src/stls/stls-internal.h
index 48a119e..d5c59e7 100644
--- a/src/stls/stls-internal.h
+++ b/src/stls/stls-internal.h
@@ -6,6 +6,6 @@
 #include <sys/types.h>
 #include <stdint.h>
 
-extern pid_t stls_clean_tls_and_spawn (char const *const *, char const *const *, int *, uint32_t) ;
+extern pid_t stls_prep_spawn_drop (char const *const *, char const *const *, int *, uid_t, gid_t, uint32_t) ;
 
 #endif
diff --git a/src/stls/stls_clean_tls_and_spawn.c b/src/stls/stls_clean_tls_and_spawn.c
deleted file mode 100644
index 37ea619..0000000
--- a/src/stls/stls_clean_tls_and_spawn.c
+++ /dev/null
@@ -1,21 +0,0 @@
-/* ISC license. */
-
-#include <sys/types.h>
-#include <skalibs/env.h>
-#include <skalibs/djbunix.h>
-#include "stls-internal.h"
-
-pid_t stls_clean_tls_and_spawn (char const *const *argv, char const *const *envp, int *fds, uint32_t options)
-{
-  if (!(options & 1)) return child_spawn2(argv[0], argv, envp, fds) ;
-  else
-  {
-    char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ;
-    size_t modiflen = sizeof(modifs) ;
-    size_t n = env_len(envp) ;
-    char const *newenv[n + 7] ;
-    size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ;
-    if (!newenvlen) return 0 ;
-    return child_spawn2(argv[0], argv, newenv, fds) ;
-  }
-}
diff --git a/src/stls/stls_prep_spawn_drop.c b/src/stls/stls_prep_spawn_drop.c
new file mode 100644
index 0000000..c6f4e13
--- /dev/null
+++ b/src/stls/stls_prep_spawn_drop.c
@@ -0,0 +1,35 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <signal.h>
+#include <skalibs/env.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/selfpipe.h>
+#include "stls-internal.h"
+
+pid_t stls_prep_spawn_drop (char const *const *argv, char const *const *envp, int *fds, uid_t uid, gid_t gid, uint32_t options)
+{
+  pid_t pid ;
+
+  fds[4] = selfpipe_init() ;
+  if (fds[4] < 0) strerr_diefu1sys(111, "init selfpipe") ;
+  if (selfpipe_trap(SIGCHLD) < 0) strerr_diefu1sys(111, "trap SIGCHLD") ;
+
+  if (!(options & 1)) pid = child_spawn2(argv[0], argv, envp, fds) ;
+  else
+  {
+    char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ;
+    size_t modiflen = sizeof(modifs) ;
+    size_t n = env_len(envp) ;
+    char const *newenv[n + 7] ;
+    size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ;
+    if (!newenvlen) return 0 ;
+    pid = child_spawn2(argv[0], argv, newenv, fds) ;
+  }
+
+  if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
+  if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
+  if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
+  return pid ;
+}
diff --git a/src/stls/stls_run.c b/src/stls/stls_run.c
index 1a035e2..3f2742d 100644
--- a/src/stls/stls_run.c
+++ b/src/stls/stls_run.c
@@ -114,12 +114,31 @@ static void closeit (struct tls *ctx, int *fds, int brutal)
   fd_close(fds[3]) ; fds[3] = -1 ;
 }
 
-int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t options, tain_t const *tto)
+static void handle_signals (pid_t pid, int *e)
+{
+  for (;;) switch (selfpipe_read())
+  {
+    case -1 : strerr_diefu1sys(111, "read selfpipe") ;
+    case 0 : return ;
+    case SIGCHLD :
+    {
+      int wstat ;
+      if (wait_pid_nohang(pid, &wstat) == pid)
+      {
+        *e = wstat ;
+        return ;
+      }
+    }
+  }
+}
+
+int stls_run (struct tls *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto)
 {
   tlsbuf_t b[2] = { { .blockedonother = 0 }, { .blockedonother = 0 } } ;
-  iopause_fd x[4] ;
+  iopause_fd x[5] = { { .fd = fds[4], .events = IOPAUSE_READ } } ;
   unsigned int xindex[4] ;
   unsigned int i = 0 ;
+  int e = -1 ;
 
   for (; i < 2 ; i++)
   {
@@ -133,7 +152,7 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
   for (;;)
   {
     tain_t deadline ;
-    unsigned int xlen = 0 ;
+    unsigned int xlen = 1 ;
     int r ;
 
     tain_add_g(&deadline, fds[0] >= 0 && fds[2] >= 0 && buffer_isempty(&b[0].b) && buffer_isempty(&b[1].b) ? tto : &tain_infinite_relative) ;
@@ -147,7 +166,7 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
       x[xlen].events = IOPAUSE_READ ;
       xindex[0] = xlen++ ;
     }
-    else xindex[0] = 4 ;
+    else xindex[0] = 5 ;
 
     if (fds[1] >= 0 && buffer_iswritable(&b[1].b))
     {
@@ -155,7 +174,7 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
       x[xlen].events = IOPAUSE_WRITE ;
       xindex[1] = xlen++ ;
     }
-    else xindex[1] = 4 ;
+    else xindex[1] = 5 ;
 
     if (fds[2] >= 0 && !b[1].blockedonother && buffer_isreadable(&b[1].b))
     {
@@ -163,7 +182,7 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
       x[xlen].events = IOPAUSE_READ ;
       xindex[2] = xlen++ ;
     }
-    else xindex[2] = 4 ;
+    else xindex[2] = 5 ;
 
     if (fds[3] >= 0 && !b[0].blockedonother && buffer_iswritable(&b[0].b))
     {
@@ -171,9 +190,9 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
       x[xlen].events = IOPAUSE_WRITE ;
       xindex[3] = xlen++ ;
     }
-    else xindex[3] = 4 ;
+    else xindex[3] = 5 ;
 
-    if (!xlen) break ;
+    if (xlen == 1) break ;
 
 
    /* poll() */
@@ -184,6 +203,7 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
     {
       fd_close(fds[0]) ; fds[0] = -1 ;
       closeit(ctx, fds, options & 1) ;
+      if (e >= 0) break ;
       continue ;
     }
 
@@ -192,9 +212,14 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
         x[xlen].revents |= IOPAUSE_READ | IOPAUSE_WRITE ;
 
 
+   /* Signal */
+
+    if (x[0].revents & IOPAUSE_READ) handle_signals(pid, &e) ;
+
+
    /* Flush to local */
 
-    if (xindex[1] < 4 && x[xindex[1]].revents & IOPAUSE_WRITE)
+    if (xindex[1] < 5 && x[xindex[1]].revents & IOPAUSE_WRITE)
     {
       r = buffer_flush(&b[1].b) ;
       if (!r && !error_isagain(errno))
@@ -217,7 +242,7 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
 
    /* Flush to remote */
 
-    if (xindex[3] < 4 && x[xindex[3]].revents & IOPAUSE_WRITE)
+    if (xindex[3] < 5 && x[xindex[3]].revents & IOPAUSE_WRITE)
     {
       r = buffer_tls_flush(ctx, b) ;
       if (r < 0)
@@ -225,27 +250,35 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
         strerr_warnwu2x("write to peer: ", tls_error(ctx)) ;
         fd_close(fds[0]) ; fds[0] = -1 ;
       }
-      if (r && fds[0] < 0) closeit(ctx, fds, options & 1) ;
+      if (r && fds[0] < 0)
+      {
+        closeit(ctx, fds, options & 1) ;
+        if (e >= 0) break ;
+      }
     }
 
 
    /* Fill from local */
 
-    if (xindex[0] < 4 && x[xindex[0]].revents & IOPAUSE_READ)
+    if (xindex[0] < 5 && x[xindex[0]].revents & IOPAUSE_READ)
     {
       r = sanitize_read(buffer_fill(&b[0].b)) ;
       if (r < 0)
       {
         if (errno != EPIPE) strerr_warnwu1sys("read from application") ;
         fd_close(fds[0]) ; fds[0] = -1 ;
-        if (buffer_isempty(&b[0].b)) closeit(ctx, fds, options & 1) ;
+        if (buffer_isempty(&b[0].b))
+        {
+          closeit(ctx, fds, options & 1) ;
+          if (e >= 0) break ;
+        }
       }
     }
 
 
    /* Fill from remote */
 
-    if (xindex[2] < 4 && x[xindex[2]].revents & IOPAUSE_READ)
+    if (xindex[2] < 5 && x[xindex[2]].revents & IOPAUSE_READ)
     {
       r = buffer_tls_fill(ctx, b) ;
       if (r < 0)
@@ -273,5 +306,5 @@ int stls_run (struct tls *ctx, int *fds, unsigned int verbosity, uint32_t option
   if (fds[0] >= 0) fd_close(fds[0]) ;
   if (fds[3] >= 0) fd_close(fds[3]) ;
   if (fds[2] >= 0) fd_close(fds[2]) ;
-  return 0 ;
+  return e ;
 }
diff --git a/src/stls/stls_s6tlsc.c b/src/stls/stls_s6tlsc.c
index a9a2c98..87a45ac 100644
--- a/src/stls/stls_s6tlsc.c
+++ b/src/stls/stls_s6tlsc.c
@@ -14,11 +14,12 @@
 
 int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd)
 {
-  int fds[4] = { sfd[0], sfd[1], sfd[0], sfd[1] } ;
+  int fds[5] = { sfd[0], sfd[1], sfd[0], sfd[1] } ;
   struct tls *ctx ;
   struct tls_config *cfg ;
   pid_t pid ;
   char const *x ;
+  int wstat ;
 
   if (tls_init() < 0) strerr_diefu1sys(111, "tls_init") ;
   cfg = tls_config_new() ;
@@ -72,23 +73,14 @@ int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const
   if (!ctx) strerr_diefu1sys(111, "tls_client") ;
   if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ;
 
-  pid = stls_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
-  if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
-  if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
-  if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
+  pid = stls_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ;
 
   if (tls_connect_fds(ctx, fds[2], fds[3], servername) < 0)
     diectx(97, ctx, "tls_connect_fds") ;
   tls_config_free(cfg) ;
   if (tls_handshake(ctx) < 0) diectx(97, ctx, "perform SSL handshake") ;
 
-  {
-    int wstat ;
-    int r = stls_run(ctx, fds, verbosity, options, tto) ;
-    if (r < 0) strerr_diefu1sys(111, "run SSL engine") ;
-    else if (r) diectx(98, ctx, "maintain SSL connection to peer") ;
-    tls_free(ctx) ;
-    if (wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
-    return wait_estatus(wstat) ;
-  }
+  wstat = stls_run(ctx, fds, pid, verbosity, options, tto) ;
+  if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
+  return wait_estatus(wstat) ;
 }
diff --git a/src/stls/stls_s6tlsd.c b/src/stls/stls_s6tlsd.c
index fd59d48..07446e7 100644
--- a/src/stls/stls_s6tlsd.c
+++ b/src/stls/stls_s6tlsd.c
@@ -15,12 +15,13 @@
 
 int stls_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity)
 {
-  int fds[4] = { 0, 1, 0, 1 } ;
+  int fds[5] = { 0, 1, 0, 1 } ;
   struct tls *cctx ;
   struct tls *ctx ;
   struct tls_config *cfg ;
   pid_t pid ;
   char const *x ;
+  int wstat ;
 
   if (tls_init() < 0) strerr_diefu1sys(111, "tls_init") ;
   cfg = tls_config_new() ;
@@ -76,22 +77,14 @@ int stls_s6tlsd (char const *const *argv, char const *const *envp, tain_t const
   if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ;
   tls_config_free(cfg) ;
 
-  pid = stls_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
-  if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
-  if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
-  if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
+  pid = stls_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ;
 
   if (tls_accept_fds(ctx, &cctx, fds[2], fds[3]) < 0)
     diectx(97, ctx, "tls_accept_fds") ;
   tls_free(ctx) ;
   if (tls_handshake(cctx) < 0) diectx(97, cctx, "perform SSL handshake") ;
 
-  {
-    int wstat ;
-    int r = stls_run(cctx, fds, verbosity, options, tto) ;
-    if (r < 0) strerr_diefu1sys(111, "run SSL engine") ;
-    else if (r) diectx(98, cctx, "maintain SSL connection to peer") ;
-    if (wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
-    return wait_estatus(wstat) ;
-  }
+  wstat = stls_run(cctx, fds, pid, verbosity, options, tto) ;
+  if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ;
+  return wait_estatus(wstat) ;
 }