Add -z option to s6-tlsc/s6-tlsd to clean TLS env vars before spawning (default)

17 files changed, 83 insertions, 27 deletions

diff --git a/package/deps.mak b/package/deps.mak
index 7173855..1690d19 100644
--- a/package/deps.mak
+++ b/package/deps.mak
@@ -2,7 +2,7 @@
 # This file has been generated by tools/gen-deps.sh
 #
 
-src/include/s6-networking/s6net.h: src/include/s6-networking/ident.h
+src/include/s6-networking/s6net.h: src/include/s6-networking/ident.h src/include/s6-networking/s6net-utils.h
 src/sbearssl/sbearssl-internal.h: src/include/s6-networking/sbearssl.h
 src/clock/s6-clockadd.o src/clock/s6-clockadd.lo: src/clock/s6-clockadd.c
 src/clock/s6-clockview.o src/clock/s6-clockview.lo: src/clock/s6-clockview.c
@@ -24,6 +24,7 @@ src/conn-tools/s6-tlsc.o src/conn-tools/s6-tlsc.lo: src/conn-tools/s6-tlsc.c src
 src/conn-tools/s6-tlsclient.o src/conn-tools/s6-tlsclient.lo: src/conn-tools/s6-tlsclient.c src/include/s6-networking/config.h
 src/conn-tools/s6-tlsd.o src/conn-tools/s6-tlsd.lo: src/conn-tools/s6-tlsd.c src/include/s6-networking/config.h src/include/s6-networking/sbearssl.h src/include/s6-networking/stls.h
 src/conn-tools/s6-tlsserver.o src/conn-tools/s6-tlsserver.lo: src/conn-tools/s6-tlsserver.c src/include/s6-networking/config.h
+src/libs6net/s6net_clean_tls_and_spawn.o src/libs6net/s6net_clean_tls_and_spawn.lo: src/libs6net/s6net_clean_tls_and_spawn.c src/include/s6-networking/s6net-utils.h
 src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_client.lo: src/libs6net/s6net_ident_client.c src/include/s6-networking/ident.h
 src/libs6net/s6net_ident_error.o src/libs6net/s6net_ident_error.lo: src/libs6net/s6net_ident_error.c src/include/s6-networking/ident.h
 src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_get.lo: src/libs6net/s6net_ident_reply_get.c src/include/s6-networking/ident.h
@@ -52,8 +53,8 @@ src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_to.lo: src/sb
 src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_from.lo: src/sbearssl/sbearssl_rsa_skey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_rsa_skey_to.lo: src/sbearssl/sbearssl_rsa_skey_to.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_run.lo: src/sbearssl/sbearssl_run.c src/include/s6-networking/sbearssl.h
-src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsc.lo: src/sbearssl/sbearssl_s6tlsc.c src/include/s6-networking/sbearssl.h
-src/sbearssl/sbearssl_s6tlsd.o src/sbearssl/sbearssl_s6tlsd.lo: src/sbearssl/sbearssl_s6tlsd.c src/include/s6-networking/sbearssl.h
+src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsc.lo: src/sbearssl/sbearssl_s6tlsc.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/sbearssl.h
+src/sbearssl/sbearssl_s6tlsd.o src/sbearssl/sbearssl_s6tlsd.lo: src/sbearssl/sbearssl_s6tlsd.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_from.lo: src/sbearssl/sbearssl_skey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_readfile.lo: src/sbearssl/sbearssl_skey_readfile.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_skey_to.lo: src/sbearssl/sbearssl_skey_to.c src/include/s6-networking/sbearssl.h
@@ -64,8 +65,8 @@ src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_readfile.lo: src/sb
 src/sbearssl/sbearssl_ta_readfile_internal.o src/sbearssl/sbearssl_ta_readfile_internal.lo: src/sbearssl/sbearssl_ta_readfile_internal.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_ta_to.lo: src/sbearssl/sbearssl_ta_to.c src/include/s6-networking/sbearssl.h
 src/stls/stls_run.o src/stls/stls_run.lo: src/stls/stls_run.c src/include/s6-networking/stls.h
-src/stls/stls_s6tlsc.o src/stls/stls_s6tlsc.lo: src/stls/stls_s6tlsc.c src/include/s6-networking/stls.h
-src/stls/stls_s6tlsd.o src/stls/stls_s6tlsd.lo: src/stls/stls_s6tlsd.c src/include/s6-networking/stls.h
+src/stls/stls_s6tlsc.o src/stls/stls_s6tlsc.lo: src/stls/stls_s6tlsc.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/stls.h
+src/stls/stls_s6tlsd.o src/stls/stls_s6tlsd.lo: src/stls/stls_s6tlsd.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/stls.h
 
 s6-clockadd: EXTRA_LIBS := ${SYSCLOCK_LIB}
 s6-clockadd: src/clock/s6-clockadd.o -lskarnet
@@ -100,21 +101,21 @@ s6-tcpserver6-socketbinder: src/conn-tools/s6-tcpserver6-socketbinder.o -lskarne
 s6-tcpserver6d: EXTRA_LIBS := ${SOCKET_LIB}
 s6-tcpserver6d: src/conn-tools/s6-tcpserver6d.o -lskarnet
 s6-tlsc: EXTRA_LIBS := ${CRYPTO_LIB} ${SOCKET_LIB} ${TAINNOW_LIB}
-s6-tlsc: src/conn-tools/s6-tlsc.o ${LIBCRYPTOSUPPORT} -lskarnet
+s6-tlsc: src/conn-tools/s6-tlsc.o ${LIBCRYPTOSUPPORT} ${LIBS6NET} -lskarnet
 s6-tlsclient: EXTRA_LIBS :=
 s6-tlsclient: src/conn-tools/s6-tlsclient.o -lskarnet
 s6-tlsd: EXTRA_LIBS := ${CRYPTO_LIB} ${SOCKET_LIB} ${TAINNOW_LIB}
-s6-tlsd: src/conn-tools/s6-tlsd.o ${LIBCRYPTOSUPPORT} -lskarnet
+s6-tlsd: src/conn-tools/s6-tlsd.o ${LIBCRYPTOSUPPORT} ${LIBS6NET} -lskarnet
 s6-tlsserver: EXTRA_LIBS :=
 s6-tlsserver: src/conn-tools/s6-tlsserver.o -lskarnet
-libs6net.a.xyzzy: src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_parse.o src/libs6net/s6net_ident_error.o
+libs6net.a.xyzzy: src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_parse.o src/libs6net/s6net_ident_error.o src/libs6net/s6net_clean_tls_and_spawn.o
 libs6net.so.xyzzy: EXTRA_LIBS := -lskarnet
-libs6net.so.xyzzy: src/libs6net/s6net_ident_client.lo src/libs6net/s6net_ident_reply_get.lo src/libs6net/s6net_ident_reply_parse.lo src/libs6net/s6net_ident_error.lo
+libs6net.so.xyzzy: src/libs6net/s6net_ident_client.lo src/libs6net/s6net_ident_reply_get.lo src/libs6net/s6net_ident_reply_parse.lo src/libs6net/s6net_ident_error.lo src/libs6net/s6net_clean_tls_and_spawn.lo
 minidentd: EXTRA_LIBS := ${SOCKET_LIB} ${TAINNOW_LIB}
 minidentd: src/minidentd/minidentd.o src/minidentd/mgetuid.o -lskarnet
 libsbearssl.a.xyzzy: src/sbearssl/sbearssl_append.o src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_skey_from.o src/sbearssl/sbearssl_ec_skey_to.o src/sbearssl/sbearssl_error_str.o src/sbearssl/sbearssl_isder.o src/sbearssl/sbearssl_pem_decode_from_buffer.o src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_ta_cert.o src/sbearssl/sbearssl_ta_from.o src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_readfile_internal.o src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsd.o
-libsbearssl.so.xyzzy: EXTRA_LIBS := -lbearssl -lskarnet
+libsbearssl.so.xyzzy: EXTRA_LIBS := -lbearssl -ls6net -lskarnet
 libsbearssl.so.xyzzy: src/sbearssl/sbearssl_append.lo src/sbearssl/sbearssl_cert_from.lo src/sbearssl/sbearssl_cert_readfile.lo src/sbearssl/sbearssl_cert_to.lo src/sbearssl/sbearssl_ec_issuer_keytype.lo src/sbearssl/sbearssl_ec_pkey_from.lo src/sbearssl/sbearssl_ec_pkey_to.lo src/sbearssl/sbearssl_ec_skey_from.lo src/sbearssl/sbearssl_ec_skey_to.lo src/sbearssl/sbearssl_error_str.lo src/sbearssl/sbearssl_isder.lo src/sbearssl/sbearssl_pem_decode_from_buffer.lo src/sbearssl/sbearssl_pem_decode_from_string.lo src/sbearssl/sbearssl_pem_push.lo src/sbearssl/sbearssl_pkey_from.lo src/sbearssl/sbearssl_pkey_to.lo src/sbearssl/sbearssl_rsa_pkey_from.lo src/sbearssl/sbearssl_rsa_pkey_to.lo src/sbearssl/sbearssl_rsa_skey_from.lo src/sbearssl/sbearssl_rsa_skey_to.lo src/sbearssl/sbearssl_run.lo src/sbearssl/sbearssl_skey_from.lo src/sbearssl/sbearssl_skey_readfile.lo src/sbearssl/sbearssl_skey_to.lo src/sbearssl/sbearssl_ta_cert.lo src/sbearssl/sbearssl_ta_from.lo src/sbearssl/sbearssl_ta_readdir.lo src/sbearssl/sbearssl_ta_readfile.lo src/sbearssl/sbearssl_ta_readfile_internal.lo src/sbearssl/sbearssl_ta_to.lo src/sbearssl/sbearssl_s6tlsc.lo src/sbearssl/sbearssl_s6tlsd.lo
 libstls.a.xyzzy: src/stls/stls_run.o src/stls/stls_s6tlsc.o src/stls/stls_s6tlsd.o
-libstls.so.xyzzy: EXTRA_LIBS := -ltls -lskarnet
+libstls.so.xyzzy: EXTRA_LIBS := -ltls -ls6net -lskarnet
 libstls.so.xyzzy: src/stls/stls_run.lo src/stls/stls_s6tlsc.lo src/stls/stls_s6tlsd.lo
diff --git a/src/conn-tools/deps-exe/s6-tlsc b/src/conn-tools/deps-exe/s6-tlsc
index d00d2b8..5ae8124 100644
--- a/src/conn-tools/deps-exe/s6-tlsc
+++ b/src/conn-tools/deps-exe/s6-tlsc
@@ -1,4 +1,5 @@
 ${LIBCRYPTOSUPPORT}
+${LIBS6NET}
 -lskarnet
 ${CRYPTO_LIB}
 ${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-tlsd b/src/conn-tools/deps-exe/s6-tlsd
index d00d2b8..5ae8124 100644
--- a/src/conn-tools/deps-exe/s6-tlsd
+++ b/src/conn-tools/deps-exe/s6-tlsd
@@ -1,4 +1,5 @@
 ${LIBCRYPTOSUPPORT}
+${LIBS6NET}
 -lskarnet
 ${CRYPTO_LIB}
 ${SOCKET_LIB}
diff --git a/src/conn-tools/s6-tlsc.c b/src/conn-tools/s6-tlsc.c
index 4476690..0c26ab0 100644
--- a/src/conn-tools/s6-tlsc.c
+++ b/src/conn-tools/s6-tlsc.c
@@ -31,7 +31,7 @@
 #endif
 
 
-#define USAGE "s6-tlsc [ -S | -s ]  [ -Y | -y ] [ -v verbosity ] [ -K timeout ] [ -k servername ] [ -6 rfd ] [ -7 wfd ] prog..."
+#define USAGE "s6-tlsc [ -S | -s ]  [ -Y | -y ] [ -v verbosity ] [ -K timeout ] [ -k servername ] [ -Z | -z ] [ -6 rfd ] [ -7 wfd ] prog..."
 #define dieusage() strerr_dieusage(100, USAGE)
 
 int main (int argc, char const *const *argv, char const *const *envp)
@@ -41,7 +41,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
   unsigned int verbosity = 1 ;
   uid_t uid = 0 ;
   gid_t gid = 0 ;
-  uint32_t preoptions = 0 ;
+  uint32_t preoptions = 2 ;
   uint32_t options = 1 ;
   int fds[2] = { 6, 7 } ;
 
@@ -51,7 +51,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
     unsigned int t = 0 ;
     for (;;)
     {
-      register int opt = subgetopt_r(argc, argv, "SsYyv:K:k:6:7:", &l) ;
+      register int opt = subgetopt_r(argc, argv, "SsYyv:K:k:Zz6:7:", &l) ;
       if (opt == -1) break ;
       switch (opt)
       {
@@ -62,6 +62,8 @@ int main (int argc, char const *const *argv, char const *const *envp)
         case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
         case 'K' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
         case 'k' : servername = l.arg ; break ;
+        case 'Z' : preoptions &= ~(uint32_t)2 ; break ;
+        case 'z' : preoptions |= 2 ; break ;
         case '6' :
         {
           unsigned int fd ;
diff --git a/src/conn-tools/s6-tlsclient.c b/src/conn-tools/s6-tlsclient.c
index a1cd75d..1aa66fb 100644
--- a/src/conn-tools/s6-tlsclient.c
+++ b/src/conn-tools/s6-tlsclient.c
@@ -11,7 +11,7 @@
 
 #define USAGE "s6-tlsclient [ options ] host port prog...\n" \
 "s6-tcpclient options: [ -q | -Q | -v ] [ -4 | -6 ] [ -d | -D ] [ -r | -R ] [ -h | -H ] [ -n | -N ] [ -t timeout ] [ -l localname ] [ -T timeoutconn ] [ -i localip ] [ -p localport ]\n" \
-"s6-tlsc options: [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -k servername ]"
+"s6-tlsc options: [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -k servername ] [ -Z | -z ]"
 
 #define dieusage() strerr_dieusage(100, USAGE)
 
@@ -35,6 +35,7 @@ struct options_s
   unsigned int flagN : 1 ;
   unsigned int flagS : 1 ;
   unsigned int flagy : 1 ;
+  unsigned int flagZ : 1 ;
   unsigned int doxy : 1 ;
 } ;
 
@@ -57,6 +58,7 @@ struct options_s
   .flagN = 0, \
   .flagS = 0, \
   .flagy = 0, \
+  .flagZ = 0, \
   .doxy = 0 \
 }
 
@@ -68,7 +70,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
     subgetopt_t l = SUBGETOPT_ZERO ;
     for (;;)
     {
-      register int opt = subgetopt_r(argc, argv, "qQv46DdHhRrnNt:l:T:i:p:SsYyK:k:", &l) ;
+      register int opt = subgetopt_r(argc, argv, "qQv46DdHhRrnNt:l:T:i:p:SsYyK:k:Zz", &l) ;
       if (opt == -1) break ;
       switch (opt)
       {
@@ -109,6 +111,8 @@ int main (int argc, char const *const *argv, char const *const *envp)
         case 'y' : o.flagy = 1 ; break ;
         case 'K' : if (!uint0_scan(l.arg, &o.kimeout)) dieusage() ; break ;
         case 'k' : o.servername = l.arg ; break ;
+        case 'Z' : o.flagZ = 1 ; break ;
+        case 'z' : o.flagZ = 0 ; break ;
         default : dieusage() ;
       }
     }
@@ -127,7 +131,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
     unsigned int m = 0 ;
     unsigned int pos = 0 ;
     char fmt[UINT_FMT * 4 + UINT16_FMT + IP46_FMT] ;
-    char const *newargv[28 + argc] ;
+    char const *newargv[29 + argc] ;
     newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpclient" ;
     if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v" : "-q" ;
     if (o.flag4) newargv[m++] = "-4" ;
@@ -187,6 +191,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
       newargv[m++] = "-k" ;
       newargv[m++] = o.servername ;
     }
+    if (o.flagZ) newargv[m++] = "-Z" ;
     newargv[m++] = "--" ;
     while (*argv) newargv[m++] = *argv++ ;
     newargv[m++] = 0 ;
diff --git a/src/conn-tools/s6-tlsd.c b/src/conn-tools/s6-tlsd.c
index 6a6d4ef..a4a1d4c 100644
--- a/src/conn-tools/s6-tlsd.c
+++ b/src/conn-tools/s6-tlsd.c
@@ -30,7 +30,7 @@
 #endif
 
 
-#define USAGE "s6-tlsd [ -S | -s ] [ -Y | -y ] [ -v verbosity ] [ -K timeout ] prog..."
+#define USAGE "s6-tlsd [ -S | -s ] [ -Y | -y ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..."
 #define dieusage() strerr_dieusage(100, USAGE)
 
 int main (int argc, char const *const *argv, char const *const *envp)
@@ -39,7 +39,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
   unsigned int verbosity = 1 ;
   uid_t uid = 0 ;
   gid_t gid = 0 ;
-  uint32_t preoptions = 0 ;
+  uint32_t preoptions = 2 ;
   uint32_t options = 1 ;
 
   PROG = "s6-tlsd" ;
@@ -48,7 +48,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
     unsigned int t = 0 ;
     for (;;)
     {
-      register int opt = subgetopt_r(argc, argv, "SsYyv:K:", &l) ;
+      register int opt = subgetopt_r(argc, argv, "SsYyv:K:Zz", &l) ;
       if (opt == -1) break ;
       switch (opt)
       {
@@ -58,6 +58,8 @@ int main (int argc, char const *const *argv, char const *const *envp)
         case 'y' : preoptions |= 1 ; break ;
         case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
         case 'K' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+        case 'Z' : preoptions &= ~(uint32_t)2 ; break ;
+        case 'z' : preoptions |= 2 ; break ;
         default : dieusage() ;
       }
     }
diff --git a/src/conn-tools/s6-tlsserver.c b/src/conn-tools/s6-tlsserver.c
index ef5abe4..d7604a9 100644
--- a/src/conn-tools/s6-tlsserver.c
+++ b/src/conn-tools/s6-tlsserver.c
@@ -14,7 +14,7 @@
 #define USAGE "s6-tlsserver [ options ] ip port prog...\n" \
 "s6-tcpserver options: [ -q | -Q | -v ] [ -4 | -6 ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ]\n" \
 "s6-tcpserver-access options: [ -W | -w ] [ -D | -d ] [ -H | -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ]\n" \
-"s6-tlsd options: [ -S | -s ] [ -Y | -y ] [ -K timeout ]"
+"s6-tlsd options: [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -Z | -z ]"
 
 #define dieusage() strerr_dieusage(100, USAGE)
 
@@ -45,6 +45,7 @@ struct options_s
   unsigned int ruleswhat : 2 ;
   unsigned int flagS : 1 ;
   unsigned int flagy : 1 ;
+  unsigned int flagZ : 1 ;
   unsigned int doaccess : 1 ;
   unsigned int doapply : 1 ;
 } ;
@@ -74,6 +75,7 @@ struct options_s
   .ruleswhat = 0, \
   .flagS = 0, \
   .flagy = 0, \
+  .flagZ = 0, \
   .doaccess = 0, \
   .doapply = 0 \
 }
@@ -86,7 +88,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
     subgetopt_t l = SUBGETOPT_ZERO ;
     for (;;)
     {
-      register int opt = subgetopt_r(argc, argv, "qQv461c:C:b:G:g:u:UWwDdHhRrPpl:B:t:i:x:SsYyK:", &l) ;
+      register int opt = subgetopt_r(argc, argv, "qQv461c:C:b:G:g:u:UWwDdHhRrPpl:B:t:i:x:SsYyK:Zz", &l) ;
       if (opt == -1) break ;
       switch (opt)
       {
@@ -123,6 +125,8 @@ int main (int argc, char const *const *argv, char const *const *envp)
         case 'Y' : o.flagy = 0 ; break ;
         case 'y' : o.flagy = 1 ; break ;
         case 'K' : if (!uint0_scan(l.arg, &o.kimeout)) dieusage() ; break ;
+        case 'Z' : o.flagZ = 1 ; break ;
+        case 'z' : o.flagZ = 0 ; break ;
         default : dieusage() ;
       }
     }
@@ -134,7 +138,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
     unsigned int m = 0 ;
     unsigned int pos = 0 ;
     char fmt[UINT_FMT * 5 + GID_FMT * (NGROUPS_MAX + 1) + UINT64_FMT] ;
-    char const *newargv[46 + argc] ;
+    char const *newargv[47 + argc] ;
     newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver" ;
     if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v" : "-q" ;
     if (o.flag46) newargv[m++] = o.flag46 == 1 ? "-4" : "-6" ;
@@ -215,6 +219,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
       pos += uint_fmt(fmt + pos, o.kimeout) ;
       fmt[pos++] = 0 ;
     }
+    if (o.flagZ) newargv[m++] = "-Z" ;
     newargv[m++] = "--" ;
     if (o.doapply)
     {
diff --git a/src/include/s6-networking/s6net-utils.h b/src/include/s6-networking/s6net-utils.h
new file mode 100644
index 0000000..2e7d2f9
--- /dev/null
+++ b/src/include/s6-networking/s6net-utils.h
@@ -0,0 +1,10 @@
+/* ISC license. */
+
+#ifndef S6NET_UTILS_H
+#define S6NET_UTILS_H
+
+#include <sys/types.h>
+
+extern pid_t s6net_clean_tls_and_spawn (char const *const *, char const *const *, int *, uint32_t) ;
+
+#endif
diff --git a/src/include/s6-networking/s6net.h b/src/include/s6-networking/s6net.h
index 8778527..fef4ef7 100644
--- a/src/include/s6-networking/s6net.h
+++ b/src/include/s6-networking/s6net.h
@@ -4,5 +4,6 @@
 #define S6NET_H
 
 #include <s6-networking/ident.h>
+#include <s6-networking/s6net-utils.h>
 
 #endif
diff --git a/src/libs6net/deps-lib/s6net b/src/libs6net/deps-lib/s6net
index 27067c4..b8be843 100644
--- a/src/libs6net/deps-lib/s6net
+++ b/src/libs6net/deps-lib/s6net
@@ -2,4 +2,5 @@ s6net_ident_client.o
 s6net_ident_reply_get.o
 s6net_ident_reply_parse.o
 s6net_ident_error.o
+s6net_clean_tls_and_spawn.o
 -lskarnet
diff --git a/src/libs6net/s6net_clean_tls_and_spawn.c b/src/libs6net/s6net_clean_tls_and_spawn.c
new file mode 100644
index 0000000..67ba79b
--- /dev/null
+++ b/src/libs6net/s6net_clean_tls_and_spawn.c
@@ -0,0 +1,21 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <s6-networking/s6net-utils.h>
+
+pid_t s6net_clean_tls_and_spawn (char const *const *argv, char const *const *envp, int *fds, uint32_t options)
+{
+  if (!(options & 1)) return child_spawn2(argv[0], argv, envp, fds) ;
+  else
+  {
+    char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ;
+    size_t modiflen = sizeof(modifs) ;
+    size_t n = env_len(envp) ;
+    char const *newenv[n + 7] ;
+    size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ;
+    if (!newenvlen) return 0 ;
+    return child_spawn2(argv[0], argv, newenv, fds) ;
+  }
+}
diff --git a/src/sbearssl/deps-lib/sbearssl b/src/sbearssl/deps-lib/sbearssl
index 0b7b02f..4e2d76c 100644
--- a/src/sbearssl/deps-lib/sbearssl
+++ b/src/sbearssl/deps-lib/sbearssl
@@ -31,4 +31,5 @@ sbearssl_ta_to.o
 sbearssl_s6tlsc.o
 sbearssl_s6tlsd.o
 -lbearssl
+-ls6net
 -lskarnet
diff --git a/src/sbearssl/sbearssl_s6tlsc.c b/src/sbearssl/sbearssl_s6tlsc.c
index 8bc8f65..5665edc 100644
--- a/src/sbearssl/sbearssl_s6tlsc.c
+++ b/src/sbearssl/sbearssl_s6tlsc.c
@@ -11,6 +11,7 @@
 #include <skalibs/genalloc.h>
 #include <skalibs/djbunix.h>
 #include <skalibs/random.h>
+#include <s6-networking/s6net-utils.h>
 #include <s6-networking/sbearssl.h>
 
 int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd)
@@ -65,7 +66,7 @@ int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t co
     br_ssl_engine_inject_entropy(&cc.eng, buf, 32) ;
     random_finish() ;
 
-    pid = child_spawn2(argv[0], argv, envp, fds) ;
+    pid = s6net_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
     if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
     if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
 
diff --git a/src/sbearssl/sbearssl_s6tlsd.c b/src/sbearssl/sbearssl_s6tlsd.c
index 35dd18a..3a27e9f 100644
--- a/src/sbearssl/sbearssl_s6tlsd.c
+++ b/src/sbearssl/sbearssl_s6tlsd.c
@@ -11,6 +11,7 @@
 #include <skalibs/genalloc.h>
 #include <skalibs/djbunix.h>
 #include <skalibs/random.h>
+#include <s6-networking/s6net-utils.h>
 #include <s6-networking/sbearssl.h>
 
 int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity)
@@ -90,7 +91,7 @@ int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t co
     br_ssl_engine_inject_entropy(&sc.eng, buf, 32) ;
     random_finish() ;
 
-    pid = child_spawn2(argv[0], argv, envp, fds) ;
+    pid = s6net_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
     if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
     if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
     if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
diff --git a/src/stls/deps-lib/stls b/src/stls/deps-lib/stls
index 799c7ae..f215998 100644
--- a/src/stls/deps-lib/stls
+++ b/src/stls/deps-lib/stls
@@ -2,4 +2,5 @@ stls_run.o
 stls_s6tlsc.o
 stls_s6tlsd.o
 -ltls
+-ls6net
 -lskarnet
diff --git a/src/stls/stls_s6tlsc.c b/src/stls/stls_s6tlsc.c
index aa82087..194afb9 100644
--- a/src/stls/stls_s6tlsc.c
+++ b/src/stls/stls_s6tlsc.c
@@ -8,6 +8,7 @@
 #include <skalibs/tai.h>
 #include <skalibs/env.h>
 #include <skalibs/djbunix.h>
+#include <s6-networking/s6net-utils.h>
 #include <s6-networking/stls.h>
 
 #define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg))
@@ -73,7 +74,7 @@ int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const
   if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ;
   tls_config_free(cfg) ;
 
-  pid = child_spawn2(argv[0], argv, envp, fds) ;
+  pid = s6net_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
   if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
   if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
   if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
diff --git a/src/stls/stls_s6tlsd.c b/src/stls/stls_s6tlsd.c
index 61b1343..ff1b308 100644
--- a/src/stls/stls_s6tlsd.c
+++ b/src/stls/stls_s6tlsd.c
@@ -8,6 +8,7 @@
 #include <skalibs/tai.h>
 #include <skalibs/env.h>
 #include <skalibs/djbunix.h>
+#include <s6-networking/s6net-utils.h>
 #include <s6-networking/stls.h>
 
 #define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg))
@@ -70,7 +71,7 @@ int stls_s6tlsd (char const *const *argv, char const *const *envp, tain_t const
   if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ;
   tls_config_free(cfg) ;
 
-  pid = child_spawn2(argv[0], argv, envp, fds) ;
+  pid = s6net_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
   if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
   if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
   if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;