Initial commit

37 files changed, 3585 insertions, 0 deletions

diff --git a/src/conn-tools/deps-exe/s6-accessrules-cdb-from-fs b/src/conn-tools/deps-exe/s6-accessrules-cdb-from-fs
new file mode 100644
index 0000000..7229c44
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-accessrules-cdb-from-fs
@@ -0,0 +1,4 @@
+-ls6net
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-accessrules-fs-from-cdb b/src/conn-tools/deps-exe/s6-accessrules-fs-from-cdb
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-accessrules-fs-from-cdb
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-connlimit b/src/conn-tools/deps-exe/s6-connlimit
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-connlimit
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-getservbyname b/src/conn-tools/deps-exe/s6-getservbyname
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-getservbyname
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-ident-client b/src/conn-tools/deps-exe/s6-ident-client
new file mode 100644
index 0000000..7229c44
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ident-client
@@ -0,0 +1,4 @@
+-ls6net
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ioconnect b/src/conn-tools/deps-exe/s6-ioconnect
new file mode 100644
index 0000000..1840bc1
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ioconnect
@@ -0,0 +1,2 @@
+-lskarnet
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ipcclient b/src/conn-tools/deps-exe/s6-ipcclient
new file mode 100644
index 0000000..19869b2
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcclient
@@ -0,0 +1,2 @@
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ipcserver b/src/conn-tools/deps-exe/s6-ipcserver
new file mode 100644
index 0000000..19869b2
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcserver
@@ -0,0 +1,2 @@
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ipcserver-access b/src/conn-tools/deps-exe/s6-ipcserver-access
new file mode 100644
index 0000000..fceb21d
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcserver-access
@@ -0,0 +1,2 @@
+-ls6net
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-sudo b/src/conn-tools/deps-exe/s6-sudo
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-sudo
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-sudoc b/src/conn-tools/deps-exe/s6-sudoc
new file mode 100644
index 0000000..1840bc1
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-sudoc
@@ -0,0 +1,2 @@
+-lskarnet
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-sudod b/src/conn-tools/deps-exe/s6-sudod
new file mode 100644
index 0000000..1840bc1
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-sudod
@@ -0,0 +1,2 @@
+-lskarnet
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-tcpclient b/src/conn-tools/deps-exe/s6-tcpclient
new file mode 100644
index 0000000..13ea615
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-tcpclient
@@ -0,0 +1,5 @@
+-ls6net
+-ls6dns
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-tcpserver b/src/conn-tools/deps-exe/s6-tcpserver
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-tcpserver
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-tcpserver-access b/src/conn-tools/deps-exe/s6-tcpserver-access
new file mode 100644
index 0000000..13ea615
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-tcpserver-access
@@ -0,0 +1,5 @@
+-ls6net
+-ls6dns
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-tcpserver4 b/src/conn-tools/deps-exe/s6-tcpserver4
new file mode 100644
index 0000000..19869b2
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-tcpserver4
@@ -0,0 +1,2 @@
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-tcpserver6 b/src/conn-tools/deps-exe/s6-tcpserver6
new file mode 100644
index 0000000..19869b2
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-tcpserver6
@@ -0,0 +1,2 @@
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/seekablepipe b/src/conn-tools/deps-exe/seekablepipe
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/seekablepipe
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/s6-accessrules-cdb-from-fs.c b/src/conn-tools/s6-accessrules-cdb-from-fs.c
new file mode 100644
index 0000000..82da64c
--- /dev/null
+++ b/src/conn-tools/s6-accessrules-cdb-from-fs.c
@@ -0,0 +1,195 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <errno.h>
+#include <stdio.h>  /* for rename() */
+#include <skalibs/bytestr.h>
+#include <skalibs/uint16.h>
+#include <skalibs/fmtscan.h>
+#include <skalibs/cdb_make.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/direntry.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/skamisc.h>
+#include <skalibs/random.h>
+
+#define USAGE "s6-accessrules-cdb-from-fs cdbfile dir"
+
+static stralloc tmp = STRALLOC_ZERO ;
+
+static void cleanup (void)
+{
+  register int e = errno ;
+  unlink(tmp.s) ;
+  errno = e ;
+}
+
+static void dienomem (void)
+{
+  cleanup() ;
+  strerr_diefu1sys(111, "stralloc_catb") ;
+}
+
+static void doit (struct cdb_make *c, stralloc *sa, unsigned int start)
+{
+  unsigned int tmpbase = tmp.len ;
+  unsigned int k = sa->len ;
+  if (!stralloc_readyplus(sa, 10)) dienomem() ;
+  stralloc_catb(sa, "/allow", 7) ;
+  tmp.s[tmpbase] = 0 ;
+  if (access(sa->s, R_OK) < 0)
+  {
+    if ((errno != ENOENT) && (errno != EACCES))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "access ", sa->s) ;
+    }
+    sa->len = k+1 ;
+    stralloc_catb(sa, "deny", 5) ;
+    if (access(sa->s, R_OK) < 0)
+      if ((errno != ENOENT) && (errno != EACCES))
+      {
+        cleanup() ;
+        strerr_diefu2sys(111, "access ", sa->s) ;
+      }
+      else return ;
+    else if (cdb_make_add(c, sa->s + start, k - start, "D", 1) < 0)
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_make_add") ;
+    }
+  }
+  else
+  {
+    uint16 envlen = 0 ;
+    uint16 execlen = 0 ;
+    register int r ;
+    tmp.s[tmpbase] = 'A' ;
+    sa->len = k+1 ;
+    stralloc_catb(sa, "env", 4) ;
+    tmp.len = tmpbase + 3 ;
+    if ((envdir(sa->s, &tmp) < 0) && (errno != ENOENT))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "s6_envdir ", sa->s) ;
+    }
+    if (tmp.len > tmpbase + 4103)
+    {
+      cleanup() ;
+      strerr_diefu2sys(100, sa->s, "too big") ;
+    }
+    envlen = tmp.len - tmpbase - 3 ;
+    tmp.len = tmpbase ;
+    uint16_pack_big(tmp.s + tmpbase + 1, envlen) ;
+    sa->len = k+1 ;
+    stralloc_catb(sa, "exec", 5) ;
+    r = openreadnclose(sa->s, tmp.s + tmpbase + 5 + envlen, 4096) ;
+    if ((r < 0) && (errno != ENOENT))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "openreadnclose ", sa->s) ;
+    }
+    if (r > 0) execlen = r ;
+    uint16_pack_big(tmp.s + tmpbase + 3 + envlen, execlen) ;
+    if (cdb_make_add(c, sa->s + start, k - start, tmp.s + tmpbase, 5 + envlen + execlen) < 0)
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_make_add") ;
+    }
+  }
+}
+
+
+int main (int argc, char const *const *argv)
+{
+  stralloc sa = STRALLOC_ZERO ;
+  struct cdb_make c = CDB_MAKE_ZERO ;
+  DIR *dir ;
+  unsigned int start ;
+  int fd ;
+  PROG = "s6-accessrules-cdb-from-fs" ;
+  if (argc < 3) strerr_dieusage(100, USAGE) ;
+  if (!stralloc_cats(&tmp, argv[1])) return 0 ;
+  if (random_sauniquename(&tmp, 8) < 0)
+    strerr_diefu1sys(111, "random_sauniquename") ;
+  if (!stralloc_readyplus(&tmp, 8210))
+    strerr_diefu1sys(111, "stralloc_catb") ;
+  stralloc_0(&tmp) ;
+  fd = open_trunc(tmp.s) ;
+  if (fd < 0) strerr_diefu2sys(111, "open_trunc ", tmp.s) ;
+  if (cdb_make_start(&c, fd) < 0)
+  {
+    cleanup() ;
+    strerr_diefu1sys(111, "cdb_make_start") ;
+  }
+  dir = opendir(argv[2]) ;
+  if (!dir)
+  {
+    cleanup() ;
+    strerr_diefu2sys(111, "opendir ", argv[2]) ;
+  }
+  if (!stralloc_cats(&sa, argv[2]) || !stralloc_catb(&sa, "/", 1)) dienomem() ;
+  start = sa.len ;
+
+  for (;;)
+  {
+    DIR *subdir ;
+    direntry *d ;
+    unsigned int base ;
+    errno = 0 ;
+    d = readdir(dir) ;
+    if (!d) break ;
+    if (d->d_name[0] == '.') continue ;
+    sa.len = start ;
+    if (!stralloc_cats(&sa, d->d_name) || !stralloc_0(&sa)) dienomem() ;
+    base = sa.len ;
+    subdir = opendir(sa.s) ;
+    if (!subdir)
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "opendir ", sa.s) ;
+    }
+    sa.s[base-1] = '/' ;
+    for (;;)
+    {
+      errno = 0 ;
+      d = readdir(subdir) ;
+      if (!d) break ;
+      if (d->d_name[0] == '.') continue ;
+      sa.len = base ;
+      if (!stralloc_cats(&sa, d->d_name)) dienomem() ;
+      doit(&c, &sa, start) ;
+    }
+    if (errno)
+    {
+      sa.s[base-1] = 0 ;
+      cleanup() ;
+      strerr_diefu2sys(111, "readdir ", sa.s) ;
+    }
+    dir_close(subdir) ;
+  }
+  if (errno)
+  {
+    cleanup() ;
+    strerr_diefu2sys(111, "readdir ", argv[2]) ;
+  }
+  dir_close(dir) ;
+  if (cdb_make_finish(&c) < 0)
+  {
+    cleanup() ;
+    strerr_diefu1sys(111, "cdb_make_finish") ;
+  }
+  if (fd_sync(fd) < 0)
+  {
+    cleanup() ;
+    strerr_diefu1sys(111, "fd_sync") ;
+  }
+  fd_close(fd) ;
+  if (rename(tmp.s, argv[1]) < 0)
+  {
+    cleanup() ;
+    strerr_diefu4sys(111, "rename ", tmp.s, " to ", argv[1]) ;
+  }
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-accessrules-fs-from-cdb.c b/src/conn-tools/s6-accessrules-fs-from-cdb.c
new file mode 100644
index 0000000..cbe67ef
--- /dev/null
+++ b/src/conn-tools/s6-accessrules-fs-from-cdb.c
@@ -0,0 +1,177 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <unistd.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/uint16.h>
+#include <skalibs/uint32.h>
+#include <skalibs/cdb.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+
+#define USAGE "s6-accessrules-fs-from-cdb dir cdbfile"
+
+static char const *basedir ;
+unsigned int basedirlen ;
+
+static void cleanup ()
+{
+  int e = errno ;
+  rm_rf(basedir) ;
+  errno = e ;
+}
+
+static int domkdir (char const *s)
+{
+  return mkdir(s, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH | S_ISGID) < 0 ? (errno == EEXIST) : 1 ;
+}
+
+static void mkdirp (char *s)
+{
+  mode_t m = umask(0) ;
+  unsigned int len = str_len(s) ;
+  register unsigned int i = basedirlen + 1 ;
+  for (; i < len ; i++) if (s[i] == '/')
+  {
+    s[i] = 0 ;
+    if (!domkdir(s)) goto err ;
+    s[i] = '/' ;
+  }
+  if (!domkdir(s)) goto err ;
+  umask(m) ;
+  return ;
+
+ err:
+  cleanup() ;
+  strerr_diefu2sys(111, "mkdir ", s) ;
+}
+
+static void touchtrunc (char const *file)
+{
+  register int fd = open_trunc(file) ;
+  if (fd < 0) strerr_diefu2sys(111, "open_trunc ", file) ;
+  fd_close(fd) ;
+}
+
+static int doenv (char const *dir, unsigned int dirlen, char *env, unsigned int envlen)
+{
+  mode_t m = umask(0) ;
+  unsigned int i = 0 ;
+  if (!domkdir(dir))
+  {
+    cleanup() ;
+    strerr_diefu2sys(111, "mkdir ", dir) ;
+  }
+  umask(m) ;
+  while (i < envlen)
+  {
+    unsigned int n = byte_chr(env + i, envlen - i, 0) ;
+    if (i + n >= envlen) return 0 ;
+    {
+      unsigned int p = byte_chr(env + i, n, '=') ;
+      char tmp[dirlen + p + 2] ;
+      byte_copy(tmp, dirlen, dir) ;
+      tmp[dirlen] = '/' ;
+      byte_copy(tmp + dirlen + 1, p, env + i) ;
+      tmp[dirlen + p + 1] = 0 ;
+      if (p < n)
+      {
+         env[i+n] = '\n' ;
+         if (!openwritenclose_unsafe(tmp, env + i + p + 1, n - p))
+         {
+           cleanup() ;
+           strerr_diefu2sys(111, "openwritenclose_unsafe ", tmp) ;
+         }
+      }
+      else touchtrunc(tmp) ;
+    }
+    i += n + 1 ;
+  }
+  return 1 ;
+}
+
+static int doit (struct cdb *c)
+{
+  unsigned int klen = cdb_keylen(c) ;
+  unsigned int dlen = cdb_datalen(c) ;
+  {
+    uint16 envlen, execlen ;
+    char name[basedirlen + klen + 8] ;
+    char data[dlen] ;
+    byte_copy(name, basedirlen, basedir) ;
+    name[basedirlen] = '/' ;
+    if (!dlen || (dlen > 8201)) return (errno = EINVAL, 0) ;
+    if ((cdb_read(c, name+basedirlen+1, klen, cdb_keypos(c)) < 0)
+     || (cdb_read(c, data, dlen, cdb_datapos(c)) < 0))
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_read") ;
+    }
+    name[basedirlen + klen + 1] = 0 ;
+    mkdirp(name) ;
+    name[basedirlen + klen + 1] = '/' ;
+    if (data[0] == 'A')
+    {
+      byte_copy(name + basedirlen + klen + 2, 6, "allow") ;
+      touchtrunc(name) ;
+    }
+    else if (data[0] == 'D')
+    {
+      byte_copy(name + basedirlen + klen + 2, 5, "deny") ;
+      touchtrunc(name) ;
+    }
+    if (dlen < 3) return 1 ;
+    uint16_unpack_big(data + 1, &envlen) ;
+    if ((envlen > 4096U) || (3U + envlen > dlen)) return (errno = EINVAL, 0) ;
+    uint16_unpack_big(data + 3 + envlen, &execlen) ;
+    if ((execlen > 4096U) || (5U + envlen + execlen != dlen)) return (errno = EINVAL, 0) ;
+    if (envlen)
+    {
+      byte_copy(name + basedirlen + klen + 2, 4, "env") ;
+      if (!doenv(name, basedirlen + klen + 5, data + 3, envlen)) return (errno = EINVAL, 0) ;
+    }
+    byte_copy(name + basedirlen + klen + 2, 5, "exec") ;
+    if (execlen && !openwritenclose_unsafe(name, data + 5 + envlen, execlen))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "openwritenclose_unsafe ", name) ;
+    }
+  }
+  return 1 ;
+}
+
+int main (int argc, char const *const *argv)
+{
+  struct cdb c = CDB_ZERO ;
+  uint32 kpos ;
+  PROG = "s6-accessrules-fs-from-cdb" ;
+  if (argc < 3) strerr_dieusage(100, USAGE) ;
+  if (cdb_mapfile(&c, argv[2]) < 0) strerr_diefu1sys(111, "cdb_mapfile") ;
+  basedir = argv[1] ;
+  basedirlen = str_len(argv[1]) ;
+  {
+    mode_t m = umask(0) ;
+    if (mkdir(basedir, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH | S_ISGID) < 0)
+      strerr_diefu2sys(111, "mkdir ", basedir) ;
+    umask(m) ;
+  }
+  cdb_traverse_init(&c, &kpos) ;
+  for (;;)
+  {
+    register int r = cdb_nextkey(&c, &kpos) ;
+    if (r < 0)
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_nextkey") ;
+    }
+    else if (!r) break ;
+    else if (!doit(&c))
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "handle key") ;
+    }
+  }
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-connlimit.c b/src/conn-tools/s6-connlimit.c
new file mode 100644
index 0000000..19f4a2d
--- /dev/null
+++ b/src/conn-tools/s6-connlimit.c
@@ -0,0 +1,39 @@
+/* ISC license. */
+
+#include <skalibs/uint.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  char const *x ;
+  unsigned int protolen ;
+  PROG = "s6-connlimit" ;
+  x = env_get2(envp, "PROTO") ;
+  if (!x) strerr_dienotset(100, "PROTO") ;
+  protolen = str_len(x) ;
+  if (!protolen) strerr_dief1x(100, "empty PROTO") ;
+  {
+    unsigned int num ;
+    char s[protolen + 8] ;
+    byte_copy(s, protolen, x) ;
+    byte_copy(s + protolen, 8, "CONNNUM") ;
+    x = env_get2(envp, s) ;
+    if (!x) strerr_dienotset(100, s) ;
+    if (!uint0_scan(x, &num)) strerr_dief2x(100, "invalid ", s) ;
+    byte_copy(s + protolen + 4, 4, "MAX") ;
+    x = env_get2(envp, s) ;
+    if (x)
+    {
+      unsigned int max ;
+      if (!uint0_scan(x, &max)) strerr_dief2x(100, "invalid ", s) ;
+      if (num > max)
+        strerr_dief2x(1, "number of connections from this client limited to ", x) ;
+    }
+  }
+  pathexec0_run(argv+1, envp) ;
+  (void)argc ;
+  strerr_dieexec(111, argv[1]) ;
+}
diff --git a/src/conn-tools/s6-getservbyname.c b/src/conn-tools/s6-getservbyname.c
new file mode 100644
index 0000000..0888df5
--- /dev/null
+++ b/src/conn-tools/s6-getservbyname.c
@@ -0,0 +1,28 @@
+/* ISC license. */
+
+#include <netdb.h>
+#include <skalibs/uint16.h>
+#include <skalibs/buffer.h>
+#include <skalibs/strerr2.h>
+
+#define USAGE "s6-getservbyname service proto"
+
+int main (int argc, char const *const *argv)
+{
+  char fmt[UINT16_FMT] ;
+  uint16 port ;
+  PROG = "s6-getservbyname" ;
+  if (argc < 3) strerr_dieusage(100, USAGE) ;
+  if (!uint160_scan(argv[1], &port))
+  {
+    struct servent *se = getservbyname(argv[1], argv[2]) ;
+    uint16 tmpport ;
+    if (!se) return 1 ;
+    tmpport = (uint16)se->s_port ;
+    uint16_unpack_big((char const *)&tmpport, &port) ;
+  }
+  if ((buffer_put(buffer_1small, fmt, uint16_fmt(fmt, port)) < 0)
+   || (buffer_putflush(buffer_1small, "\n", 1) < 1))
+    strerr_diefu1sys(111, "write to stdout") ;
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-ident-client.c b/src/conn-tools/s6-ident-client.c
new file mode 100644
index 0000000..e475870
--- /dev/null
+++ b/src/conn-tools/s6-ident-client.c
@@ -0,0 +1,71 @@
+/* ISC license. */
+
+#include <errno.h>
+#include <skalibs/uint16.h>
+#include <skalibs/uint.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/buffer.h>
+#include <skalibs/tai.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/ip46.h>
+#include <skalibs/unix-timed.h>
+#include <s6-networking/ident.h>
+
+#define USAGE "s6-ident-client [ -t timeout ] ra rp la lp"
+#define dieusage() strerr_dieusage(100, USAGE)
+
+int main (int argc, char const *const *argv)
+{
+  tain_t deadline ;
+  ip46_t ra, la ;
+  uint16 rp, lp ;
+  PROG = "s6-ident-client" ;
+  {
+    unsigned int t = 0 ;
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "t:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+    if (t) tain_from_millisecs(&deadline, t) ; else deadline = tain_infinite_relative ;
+  }
+  if (argc < 4) dieusage() ;
+
+ if (!ip46_scan(argv[0], &ra))
+    strerr_dief2x(100, "invalid IP address: ", argv[0]) ;
+  if (!uint160_scan(argv[1], &rp))
+    strerr_dief2x(100, "invalid port number: ", argv[1]) ;
+  if (!ip46_scan(argv[2], &la))
+    strerr_dief2x(100, "invalid IP address: ", argv[2]) ;
+  if (!uint160_scan(argv[3], &lp))
+    strerr_dief2x(100, "invalid port number: ", argv[3]) ;
+  if (ip46_is6(&ra) != ip46_is6(&la))
+    strerr_dief1x(100, "address family mismatch") ;
+
+  tain_now_g() ;
+  tain_add_g(&deadline, &deadline) ;
+
+  {
+    char buf[BUFFER_OUTSIZE_SMALL] ;
+    register int r = s6net_ident_client_g(buf, BUFFER_OUTSIZE_SMALL, &ra, rp, &la, lp, &deadline) ;
+    if (r < 0) strerr_diefu1sys(errno == ETIMEDOUT ? 99 : 111, "s6net_ident_client") ;
+    else if (!r)
+    {
+      strerr_warnw2x("ident server replied: ", s6net_ident_error_str(errno)) ;
+      return 1 ;
+    }
+    buffer_putnoflush(buffer_1small, buf, r-1) ;
+  }
+  buffer_putnoflush(buffer_1small, "\n", 1) ;
+  if (!buffer_timed_flush_g(buffer_1small, &deadline))
+    strerr_diefu1sys(111, "write to stdout") ;
+  return 0 ;  
+}
diff --git a/src/conn-tools/s6-ioconnect.c b/src/conn-tools/s6-ioconnect.c
new file mode 100644
index 0000000..e687d70
--- /dev/null
+++ b/src/conn-tools/s6-ioconnect.c
@@ -0,0 +1,189 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <errno.h>
+#include <signal.h>
+#include <skalibs/uint.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/error.h>
+#include <skalibs/iobuffer.h>
+#include <skalibs/sig.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/tai.h>
+#include <skalibs/iopause.h>
+#include <skalibs/djbunix.h>
+
+#define USAGE "s6-ioconnect [ -t timeout ] [ -r fdr ] [ -w fdw ] [ -0 ] [ -1 ] [ -6 ] [ -7 ]"
+#define dieusage() strerr_dieusage(100, USAGE)
+
+
+typedef struct ioblah_s ioblah_t, *ioblah_t_ref ;
+struct ioblah_s
+{
+  unsigned int fd ;
+  unsigned int xindex ;
+  unsigned int flagsocket : 1 ;
+  unsigned int flagopen : 1 ;
+} ;
+
+static ioblah_t a[2][2] = { { { 0, 4, 0, 1 }, { 7, 4, 0, 1 } }, { { 6, 4, 0, 1 }, { 1, 4, 0, 1 } } } ;
+static iobuffer b[2] ;
+static iopause_fd x[5] = { { -1, IOPAUSE_READ, 0 } } ;
+
+static void closeit (unsigned int i, unsigned int j)
+{
+  if (a[i][j].flagsocket)
+  {
+    if ((shutdown(a[i][j].fd, j) < 0) && (errno != ENOTSOCK) && (errno != ENOTCONN))
+      strerr_warnwu4sys("shutdown ", i ? "incoming" : "outgoing", " socket for ", j ? "writing" : "reading") ;
+  }
+  fd_close(a[i][j].fd) ;
+  a[i][j].flagopen = 0 ;
+  a[i][j].xindex = 5 ;
+}
+
+static inline void finishit (unsigned int i)
+{
+  closeit(i, 1) ;
+  iobuffer_finish(&b[i]) ;
+}
+
+static void handle_signals (void)
+{
+  for (;;)
+  {
+    char c = selfpipe_read() ;
+    switch (c)
+    {
+      case -1 : strerr_diefu1sys(111, "selfpipe_read") ;
+      case 0 : return ;
+      case SIGTERM :
+      {
+        if (a[0][0].xindex < 5) x[a[0][0].xindex].revents |= IOPAUSE_EXCEPT ;
+        if (a[1][0].xindex < 5) x[a[1][0].xindex].revents |= IOPAUSE_EXCEPT ;
+        break ;
+      }
+      default :
+        strerr_dief1x(101, "internal error: inconsistent signal state. Please submit a bug-report.") ;
+    }
+  }
+}
+
+int main (int argc, char const *const *argv)
+{
+  tain_t tto ;
+  register unsigned int i, j ;
+  PROG = "s6-ioconnect" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    unsigned int t = 0 ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "0167t:r:w:", &l) ;
+      if (opt < 0) break ;
+      switch (opt)
+      {
+        case '0' : a[0][0].flagsocket = 1 ; break ;
+        case '1' : a[1][1].flagsocket = 1 ; break ;
+        case '6' : a[1][0].flagsocket = 1 ; break ;
+        case '7' : a[0][1].flagsocket = 1 ; break ;
+        case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+        case 'r' : if (!uint0_scan(l.arg, &a[1][0].fd)) dieusage() ; break ;
+        case 'w' : if (!uint0_scan(l.arg, &a[0][1].fd)) dieusage() ; break ;
+        default : dieusage() ;
+      }
+    }
+    if (t) tain_from_millisecs(&tto, t) ; else tto = tain_infinite_relative ;
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if ((a[0][1].fd < 3) || (a[1][0].fd < 3)) dieusage() ;
+  for (i = 0 ; i < 2 ; i++)
+  {
+    for (j = 0 ; j < 2 ; j++)
+      if (ndelay_on(a[i][j].fd) == -1) strerr_diefu1sys(111, "ndelay_on") ;
+    if (!iobuffer_init(&b[i], a[i][0].fd, a[i][1].fd) < 0) strerr_diefu1sys(111, "iobuffer_init") ;
+  }
+  if (sig_ignore(SIGPIPE) == -1) strerr_diefu1sys(111, "sig_ignore") ;
+  
+  tain_now_g() ;
+  x[0].fd = selfpipe_init() ;
+  if (x[0].fd < 0) strerr_diefu1sys(111, "selfpipe_init") ;
+  if (selfpipe_trap(SIGTERM) < 0)
+    strerr_diefu1sys(111, "trap SIGTERM") ;
+
+  for (;;)
+  {
+    tain_t deadline ;
+    unsigned int xlen = 1 ;
+    int r ;
+
+    tain_add_g(&deadline, iobuffer_isempty(&b[0]) && iobuffer_isempty(&b[1]) ? &tto : &tain_infinite_relative) ;
+    for (i = 0 ; i < 2 ; i++)
+    {
+      a[i][0].xindex = 5 ;
+      if (a[i][0].flagopen && iobuffer_isreadable(&b[i]))
+      {
+        x[xlen].fd = a[i][0].fd ;
+        x[xlen].events = IOPAUSE_READ ;
+        a[i][0].xindex = xlen++ ;
+      }
+      a[i][1].xindex = 5 ;
+      if (a[i][1].flagopen)
+      {
+        x[xlen].fd = a[i][1].fd ;
+        x[xlen].events = IOPAUSE_EXCEPT | (iobuffer_isempty(&b[i]) ? 0 : IOPAUSE_WRITE) ;
+        a[i][1].xindex = xlen++ ;
+      }
+    }
+    if (xlen <= 1) break ;
+
+    r = iopause_g(x, xlen, &deadline) ;
+    if (r < 0) strerr_diefu1sys(111, "iopause") ;
+    else if (!r) return 1 ;
+
+    if (x[0].revents & IOPAUSE_READ) handle_signals() ;
+
+    for (i = 0 ; i < 2 ; i++) if (a[i][1].xindex < 4)
+    {
+      if (x[a[i][1].xindex].revents & IOPAUSE_WRITE)
+      {
+        if (!iobuffer_flush(&b[i]))
+        {
+          if (!error_isagain(errno)) x[a[i][1].xindex].revents |= IOPAUSE_EXCEPT ;
+        }
+        else if (!a[i][0].flagopen) finishit(i) ;
+      }
+      if (x[a[i][1].xindex].revents & IOPAUSE_EXCEPT)
+      {
+        if (!iobuffer_isempty(&b[i]))
+        {
+          iobuffer_flush(&b[i]) ; /* sets errno */
+          strerr_warnwu3sys("write ", i ? "incoming" : "outgoing", " data") ;
+        }
+        closeit(i, 0) ; finishit(i) ;
+      }
+    }
+
+    for (i = 0 ; i < 2 ; i++) if (a[i][0].xindex < 4)
+    {
+      if (x[a[i][0].xindex].revents & IOPAUSE_READ)
+      {
+        if (sanitize_read(iobuffer_fill(&b[i])) < 0)
+        {
+          if (errno != EPIPE) strerr_warnwu3sys("read ", i ? "incoming" : "outgoing", " data") ;
+          x[a[i][0].xindex].revents |= IOPAUSE_EXCEPT ;
+        }
+      }
+      if (x[a[i][0].xindex].revents & IOPAUSE_EXCEPT)
+      {
+        closeit(i, 0) ;
+        if (iobuffer_isempty(&b[i])) finishit(i) ;
+      }
+    }
+  }
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-ipcclient.c b/src/conn-tools/s6-ipcclient.c
new file mode 100644
index 0000000..3e3162c
--- /dev/null
+++ b/src/conn-tools/s6-ipcclient.c
@@ -0,0 +1,66 @@
+/* ISC license. */
+
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/webipc.h>
+
+#define USAGE "s6-ipcclient [ -q | -Q | -v ] [ -p bindpath ] [ -l localname ] path prog..."
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  char const *bindpath = 0 ;
+  char const *localname = 0 ;
+  unsigned int verbosity = 1 ;
+  PROG = "s6-ipcclient" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "qQvp:l:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'q' : if (verbosity) verbosity-- ; break ;
+        case 'Q' : verbosity = 1 ; break ;
+        case 'v' : verbosity++ ; break ;
+        case 'p' : bindpath = l.arg ; break ;
+        case 'l' : localname = l.arg ; break ;
+        default : strerr_dieusage(100, USAGE) ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (argc < 2) strerr_dieusage(100, USAGE) ;
+  {
+    char modif[24 + IPCPATH_MAX] = "PROTO=IPC\0IPCLOCALPATH=" ;
+    unsigned int i = 23 ;
+    int s = ipc_stream() ;
+    if (s == -1) strerr_diefu1sys(111, "create socket") ;
+    if (bindpath && (ipc_bind(s, bindpath) == -1))
+      strerr_diefu2sys(111, "bind socket to ", bindpath) ;
+    if (ipc_connect(s, argv[0]) < 0)
+      strerr_diefu2sys(111, "connect to ", argv[0]) ;
+    if (verbosity >= 2) strerr_warn3x(PROG, ": connected to ", argv[0]) ;
+    if (localname)
+    {
+      register unsigned int n = str_len(localname) ;
+      if (n > IPCPATH_MAX) n = IPCPATH_MAX ;
+      byte_copy(modif + i, n, localname) ;
+      i += n ; modif[i++] = 0 ;
+    }
+    else
+    {
+      int dummy ;
+      if (ipc_local(s, modif + i, IPCPATH_MAX, &dummy) < 0) modif[--i] = 0 ;
+      else i += str_len(modif + i) + 1 ;
+    }
+    if (fd_move(6, s) < 0)
+      strerr_diefu2sys(111, "set up fd ", "6") ;
+    if (fd_copy(7, 6) < 0)
+      strerr_diefu2sys(111, "set up fd ", "7") ;
+    pathexec_r(argv+1, envp, env_len(envp), modif, i) ;
+  }
+  strerr_dieexec(111, argv[1]) ;
+}
diff --git a/src/conn-tools/s6-ipcserver-access.c b/src/conn-tools/s6-ipcserver-access.c
new file mode 100644
index 0000000..183f56c
--- /dev/null
+++ b/src/conn-tools/s6-ipcserver-access.c
@@ -0,0 +1,211 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <errno.h>
+#include <skalibs/gccattributes.h>
+#include <skalibs/uint.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/cdb.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/webipc.h>
+#include <execline/config.h>
+#include <s6-networking/accessrules.h>
+
+#define USAGE "s6-ipcserver-access [ -v verbosity ] [ -e | -E ] [ -l localname ] [ -i rulesdir | -x rulesfile ] prog..."
+
+static unsigned int verbosity = 1 ;
+
+ /* Utility functions */
+
+static inline void dieusage (void) gccattr_noreturn ;
+static inline void dieusage ()
+{
+  strerr_dieusage(100, USAGE) ;
+}
+
+static inline void dienomem (void) gccattr_noreturn ;
+static inline void dienomem ()
+{
+  strerr_diefu1sys(111, "update environment") ;
+}
+
+static inline void X (void) gccattr_noreturn ;
+static inline void X ()
+{
+  strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ;
+}
+
+
+ /* Logging */
+
+static void logit (unsigned int pid, unsigned int uid, unsigned int gid, int h)
+{
+  char fmtpid[UINT_FMT] ;
+  char fmtuid[UINT_FMT] ;
+  char fmtgid[UINT_FMT] ;
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  fmtuid[uint_fmt(fmtuid, uid)] = 0 ;
+  fmtgid[uint_fmt(fmtgid, gid)] = 0 ;
+  if (h) strerr_warni7x("allow", " pid ", fmtpid, " uid ", fmtuid, " gid ", fmtgid) ;
+  else strerr_warni7sys("deny", " pid ", fmtpid, " uid ", fmtuid, " gid ", fmtgid) ;
+}
+
+static inline void log_accept (unsigned int pid, unsigned int uid, unsigned int gid)
+{
+  logit(pid, uid, gid, 1) ;
+}
+
+static inline void log_deny (unsigned int pid, unsigned int uid, unsigned int gid)
+{
+  logit(pid, uid, gid, 0) ;
+}
+
+
+ /* Checking */
+
+static s6net_accessrules_result_t check_cdb (unsigned int uid, unsigned int gid, char const *file, s6net_accessrules_params_t *params)
+{
+  struct cdb c = CDB_ZERO ;
+  int fd = open_readb(file) ;
+  register s6net_accessrules_result_t r ;
+  if (fd < 0) return -1 ;
+  if (cdb_init(&c, fd) < 0) strerr_diefu2sys(111, "cdb_init ", file) ;
+  r = s6net_accessrules_uidgid_cdb(uid, gid, &c, params) ;
+  cdb_free(&c) ;
+  fd_close(fd) ;
+  return r ;
+}
+
+static inline int check (s6net_accessrules_params_t *params, char const *rules, unsigned int rulestype, unsigned int uid, unsigned int gid)
+{
+  char const *x = "" ;
+  s6net_accessrules_result_t r ;
+  switch (rulestype)
+  {
+    case 0 :
+      if (verbosity >= 2) strerr_warnw1x("invoked without a ruleset!") ;
+      return 1 ;
+    case 1 :
+      r = s6net_accessrules_uidgid_fs(uid, gid, rules, params) ;
+      x = "fs" ;
+      break ;
+    case 2 :
+      r = check_cdb(uid, gid, rules, params) ;
+      x = "cdb" ;
+      break ;
+    default : X() ;
+  }
+  switch (r)
+  {
+    case S6NET_ACCESSRULES_ERROR : strerr_diefu4sys(111, "check ", x, " ruleset in ", rules) ;
+    case S6NET_ACCESSRULES_ALLOW :    return 1 ;
+    case S6NET_ACCESSRULES_DENY :     return (errno = EACCES, 0) ;
+    case S6NET_ACCESSRULES_NOTFOUND : return (errno = ENOENT, 0) ;
+    default : X() ;
+  }
+}
+
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  s6net_accessrules_params_t params = S6NET_ACCESSRULES_PARAMS_ZERO ;
+  char const *rules = 0 ;
+  char const *localname = 0 ;
+  char const *proto ;
+  unsigned int protolen ;
+  unsigned int uid = 0, gid = 0 ;
+  unsigned int rulestype = 0 ;
+  int doenv = 1 ;
+  PROG = "s6-ipcserver-access" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "v:Eel:i:x:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
+        case 'E' : doenv = 0 ; break ;
+        case 'e' : doenv = 1 ; break ;
+        case 'l' : localname = l.arg ; break ;
+        case 'i' : rules = l.arg ; rulestype = 1 ; break ;
+        case 'x' : rules = l.arg ; rulestype = 2 ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (!argc) dieusage() ;
+  if (!*argv[0]) dieusage() ;
+
+  proto = env_get2(envp, "PROTO") ;
+  if (!proto) strerr_dienotset(100, "PROTO") ;
+  protolen = str_len(proto) ;
+
+  {
+    char const *x ;
+    char tmp[protolen + 11] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 11, "REMOTEEUID") ;
+    x = env_get2(envp, tmp) ;
+    if (!x) strerr_dienotset(100, tmp) ;
+    if (!uint0_scan(x, &uid)) strerr_dieinvalid(100, tmp) ;
+    tmp[protolen + 7] = 'G' ;
+    x = env_get2(envp, tmp) ;
+    if (!x) strerr_dienotset(100, tmp) ;
+    if (!uint0_scan(x, &gid)) strerr_dieinvalid(100, tmp) ;
+  }
+
+  if (!check(&params, rules, rulestype, uid, gid))
+  {
+    if (verbosity >= 2) log_deny(getpid(), uid, gid) ;
+    return 1 ;
+  }
+  if (verbosity) log_accept(getpid(), uid, gid) ;
+
+  if (doenv)
+  {
+    char tmp[protolen + 10] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 10, "LOCALPATH") ;
+    if (localname)
+    {
+      if (!env_addmodif(&params.env, tmp, localname)) dienomem() ;
+    }
+    else
+    {
+      char curname[IPCPATH_MAX+1] ;
+      int dummy ;
+      if (ipc_local(0, curname, IPCPATH_MAX+1, &dummy) < 0)
+        strerr_diefu1sys(111, "ipc_local") ;
+      if (!env_addmodif(&params.env, tmp, curname)) dienomem() ;
+    }
+  }
+  else
+  {
+    char tmp[protolen + 11] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 11, "REMOTEEUID") ;
+    if (!env_addmodif(&params.env, "PROTO", 0)) dienomem() ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+    tmp[protolen + 7] = 'G' ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+    byte_copy(tmp + protolen + 6, 5, "PATH") ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+    byte_copy(tmp + protolen, 10, "LOCALPATH") ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+  }
+
+  if (params.exec.len)
+  {
+    char *specialargv[4] = { EXECLINE_EXTBINPREFIX "execlineb", "-c", params.exec.s, 0 } ;
+    pathexec_r((char const *const *)specialargv, envp, env_len(envp), params.env.s, params.env.len) ;
+    strerr_dieexec(111, specialargv[0]) ;
+  }
+
+  pathexec_r(argv, envp, env_len(envp), params.env.s, params.env.len) ;
+  strerr_dieexec(111, argv[0]) ;
+}
diff --git a/src/conn-tools/s6-ipcserver.c b/src/conn-tools/s6-ipcserver.c
new file mode 100644
index 0000000..edee033
--- /dev/null
+++ b/src/conn-tools/s6-ipcserver.c
@@ -0,0 +1,441 @@
+/* ISC license. */
+
+#ifndef _BSD_SOURCE
+#define _BSD_SOURCE
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <errno.h>
+#include <unistd.h>
+#include <grp.h>
+#include <limits.h>
+#include <signal.h>
+#include <skalibs/uint.h>
+#include <skalibs/gidstuff.h>
+#include <skalibs/setgroups.h>
+#include <skalibs/gccattributes.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/diuint.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/sig.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/iopause.h>
+#include <skalibs/webipc.h>
+
+#define USAGE "s6-ipcserver [ -q | -Q | -v ] [ -d | -D ] [ -P | -p ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] path prog..."
+
+#define ABSOLUTE_MAXCONN 1000
+
+static unsigned int maxconn = 40 ;
+static unsigned int localmaxconn = 40 ;
+static char fmtmaxconn[UINT_FMT+1] = "/" ;
+static char fmtlocalmaxconn[UINT_FMT+1] = "/" ;
+static int flaglookup = 1 ;
+static unsigned int verbosity = 1 ;
+static int cont = 1 ;
+
+static diuint *piduid ;
+static unsigned int numconn = 0 ;
+static diuint *uidnum ;
+static unsigned int uidlen = 0 ;
+
+
+ /* Utility functions */
+
+static inline void dieusage ()
+{
+  strerr_dieusage(100, USAGE) ;
+}
+
+static inline void X (void)
+{
+  strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ;
+}
+
+
+ /* Lookup primitives */
+
+static unsigned int lookup_diuint (diuint const *tab, unsigned int tablen, unsigned int key)
+{
+  register unsigned int i = 0 ;
+  for (; i < tablen ; i++) if (key == tab[i].left) break ;
+  return i ;
+}
+
+static inline unsigned int lookup_pid (unsigned int pid)
+{
+  return lookup_diuint(piduid, numconn, pid) ;
+}
+
+static inline unsigned int lookup_uid (unsigned int uid)
+{
+  return lookup_diuint(uidnum, uidlen, uid) ;
+}
+
+
+ /* Logging */
+
+static inline void log_start (char const *path)
+{
+  strerr_warni2x("starting - listening on ", path) ;
+}
+
+static inline void log_exit (void)
+{
+  strerr_warni1x("exiting") ;
+}
+
+static void log_status (void)
+{
+  char fmt[UINT_FMT] ;
+  fmt[uint_fmt(fmt, numconn)] = 0 ;
+  strerr_warni3x("status: ", fmt, fmtmaxconn) ;
+}
+
+static void log_deny (unsigned int uid, unsigned int gid, unsigned int num)
+{
+  char fmtuid[UINT_FMT] = "?" ;
+  char fmtgid[UINT_FMT] = "?" ;
+  char fmtnum[UINT_FMT] = "?" ;
+  if (flaglookup)
+  {
+    fmtuid[uint_fmt(fmtuid, uid)] = 0 ;
+    fmtgid[uint_fmt(fmtgid, gid)] = 0 ;
+    fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  }
+  strerr_warni7sys("deny ", fmtuid, ":", fmtgid, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_accept (unsigned int pid, unsigned int uid, unsigned int gid, unsigned int num)
+{
+  char fmtuidgid[UINT_FMT * 2 + 1] = "?:?" ;
+  char fmtpid[UINT_FMT] ;
+  char fmtnum[UINT_FMT] = "?" ;
+  if (flaglookup)
+  {
+    register unsigned int n = uint_fmt(fmtuidgid, uid) ;
+    fmtuidgid[n++] = ':' ;
+    n += uint_fmt(fmtuidgid + n, gid) ;
+    fmtuidgid[n] = 0 ;
+    fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  }
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  strerr_warni7x("allow ", fmtuidgid, " pid ", fmtpid, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_close (unsigned int pid, unsigned int uid, int w)
+{
+  char fmtpid[UINT_FMT] ;
+  char fmtuid[UINT_FMT] = "?" ;
+  char fmtw[UINT_FMT] ;
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  if (flaglookup) fmtuid[uint_fmt(fmtuid, uid)] = 0 ;
+  fmtw[uint_fmt(fmtw, WIFSIGNALED(w) ? WTERMSIG(w) : WEXITSTATUS(w))] = 0 ;
+  strerr_warni6x("end pid ", fmtpid, " uid ", fmtuid, WIFSIGNALED(w) ? " signal " : " exitcode ", fmtw) ;
+}
+
+
+ /* Signal handling */
+
+static void killthem (int sig)
+{
+  register unsigned int i = 0 ;
+  for (; i < numconn ; i++) kill(piduid[i].left, sig) ;
+}
+
+static void wait_children (void)
+{
+  for (;;)
+  {
+    unsigned int i ;
+    int w ;
+    register int pid = wait_nohang(&w) ;
+    if (pid < 0)
+      if (errno != ECHILD) strerr_diefu1sys(111, "wait_nohang") ;
+      else break ;
+    else if (!pid) break ;
+    i = lookup_pid(pid) ;
+    if (i < numconn)
+    {
+      unsigned int uid = piduid[i].right ;
+      register unsigned int j = lookup_uid(uid) ;
+      if (j >= uidlen) X() ;
+      if (!--uidnum[j].right) uidnum[j] = uidnum[--uidlen] ;
+      piduid[i] = piduid[--numconn] ;
+      if (verbosity >= 2)
+      {
+        log_close(pid, uid, w) ;
+        log_status() ;
+      }
+    }
+  }
+}
+
+static void handle_signals (void)
+{
+  for (;;) switch (selfpipe_read())
+  {
+    case -1 : strerr_diefu1sys(111, "read selfpipe") ;
+    case 0 : return ;
+    case SIGCHLD : wait_children() ; break ;
+    case SIGTERM :
+    {
+      if (verbosity >= 2)
+        strerr_warni3x("received ", "SIGTERM,", " quitting") ;
+      cont = 0 ;
+      break ;
+    }
+    case SIGHUP :
+    {
+      if (verbosity >= 2)
+        strerr_warni5x("received ", "SIGHUP,", " sending ", "SIGTERM+SIGCONT", " to all connections") ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGQUIT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGQUIT,", " sending ", "SIGTERM+SIGCONT", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGABRT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGABRT,", " sending ", "SIGKILL", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGKILL) ;
+      break ;
+    }
+    default : X() ;
+  }
+}
+
+
+ /* New connection handling */
+
+static void run_child (int, unsigned int, unsigned int, unsigned int, char const *, char const *const *, char const *const *) gccattr_noreturn ;
+static void run_child (int s, unsigned int uid, unsigned int gid, unsigned int num, char const *remotepath, char const *const *argv, char const *const *envp)
+{
+  unsigned int rplen = str_len(remotepath) + 1 ;
+  unsigned int n = 0 ;
+  char fmt[65 + UINT_FMT * 3 + rplen] ;
+  PROG = "s6-ipcserver (child)" ;
+  if ((fd_move(0, s) < 0) || (fd_copy(1, 0) < 0))
+    strerr_diefu1sys(111, "move fds") ;
+  byte_copy(fmt+n, 23, "PROTO=IPC\0IPCREMOTEEUID") ; n += 23 ;
+  if (flaglookup)
+  {
+    fmt[n++] = '=' ;
+    n += uint_fmt(fmt+n, uid) ;
+  }
+  fmt[n++] = 0 ;
+  byte_copy(fmt+n, 13, "IPCREMOTEEGID") ; n += 13 ;
+  if (flaglookup)
+  {
+    fmt[n++] = '=' ;
+    n += uint_fmt(fmt+n, gid) ;
+  }
+  fmt[n++] = 0 ;
+  byte_copy(fmt+n, 11, "IPCCONNNUM=") ; n += 11 ;
+  if (flaglookup) n += uint_fmt(fmt+n, num) ;
+  fmt[n++] = 0 ;
+  byte_copy(fmt+n, 14, "IPCREMOTEPATH=") ; n += 14 ;
+  byte_copy(fmt+n, rplen, remotepath) ; n += rplen ;
+  pathexec_r(argv, envp, env_len(envp), fmt, n) ;
+  strerr_dieexec(111, argv[0]) ;
+}
+
+static void new_connection (int s, char const *remotepath, char const *const *argv, char const *const *envp)
+{
+  unsigned int uid = 0, gid = 0 ;
+  unsigned int num, i ;
+  register int pid ;
+  if (flaglookup && (ipc_eid(s, &uid, &gid) < 0))
+  {
+    if (verbosity) strerr_warnwu1sys("ipc_eid") ;
+    return ;
+  }
+  i = lookup_uid(uid) ;
+  num = (i < uidlen) ? uidnum[i].right : 0 ;
+  if (num >= localmaxconn)
+  {
+    log_deny(uid, gid, num) ;
+    return ;
+  }
+  pid = fork() ;
+  if (pid < 0)
+  {
+    if (verbosity) strerr_warnwu1sys("fork") ;
+    return ;
+  }
+  else if (!pid)
+  {
+    selfpipe_finish() ;
+    run_child(s, uid, gid, num+1, remotepath, argv, envp) ;
+  }
+
+  if (i < uidlen) uidnum[i].right = num + 1 ;
+  else
+  {
+    uidnum[uidlen].left = uid ;
+    uidnum[uidlen++].right = 1 ;
+  }
+  piduid[numconn].left = (unsigned int)pid ;
+  piduid[numconn++].right = uid ;
+  if (verbosity >= 2)
+  {
+    log_accept((unsigned int)pid, uid, gid, uidnum[i].right) ;
+    log_status() ;
+  }
+}
+
+
+ /* And the main */
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  iopause_fd x[2] = { { -1, IOPAUSE_READ, 0 }, { -1, IOPAUSE_READ | IOPAUSE_EXCEPT, 0 } } ;
+  PROG = "s6-ipcserver" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    unsigned int uid = 0, gid = 0 ;
+    gid_t gids[NGROUPS_MAX] ;
+    unsigned int gidn = 0 ;
+    unsigned int backlog = 20 ;
+    int flagreuse = 1, flag1 = 0 ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "qQvDd1UPpc:C:b:u:g:G:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'q' : verbosity = 0 ; break ;
+        case 'Q' : verbosity = 1 ; break ;
+        case 'v' : verbosity = 2 ; break ;
+        case 'D' : flagreuse = 0 ; break ;
+        case 'd' : flagreuse = 1 ; break ;
+        case 'P' : flaglookup = 0 ; break ;
+        case 'p' : flaglookup = 1 ; break ;
+        case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; break ;
+        case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; break ;
+        case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ;
+        case 'u' : if (!uint0_scan(l.arg, &uid)) dieusage() ; break ;
+        case 'g' : if (!uint0_scan(l.arg, &gid)) dieusage() ; break ;
+        case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn)) dieusage() ; break ;
+        case '1' : flag1 = 1 ; break ;
+        case 'U' :
+        {
+          char const *x = env_get2(envp, "UID") ;
+          if (!x) strerr_dienotset(100, "UID") ;
+          if (!uint0_scan(x, &uid)) strerr_dieinvalid(100, "UID") ;
+          x = env_get2(envp, "GID") ;
+          if (!x) strerr_dienotset(100, "GID") ;
+          if (!uint0_scan(x, &gid)) strerr_dieinvalid(100, "GID") ;
+          x = env_get2(envp, "GIDLIST") ;
+          if (!x) strerr_dienotset(100, "GIDLIST") ;
+          if (!gid_scanlist(gids, NGROUPS_MAX, x, &gidn) && *x)
+            strerr_dieinvalid(100, "GIDLIST") ;
+          break ;
+        }
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+    if (argc < 2) dieusage() ;
+    if (!*argv[0]) dieusage() ;
+    fd_close(0) ;
+    if (!flag1) fd_close(1) ;
+    if (!maxconn) maxconn = 1 ;
+    if (maxconn > ABSOLUTE_MAXCONN) maxconn = ABSOLUTE_MAXCONN ;
+    if (!flaglookup || (localmaxconn > maxconn)) localmaxconn = maxconn ;
+    x[1].fd = ipc_stream() ;
+    if ((x[1].fd < 0) || (coe(x[1].fd) < 0))
+      strerr_diefu1sys(111, "create socket") ;
+    {
+      mode_t m = umask(0) ;
+      if ((flagreuse ? ipc_bind_reuse(x[1].fd, argv[0]) : ipc_bind(x[1].fd, argv[0])) < 0)
+        strerr_diefu2sys(111, "bind to ", argv[0]) ;
+      umask(m) ;
+    }
+    if (ipc_listen(x[1].fd, backlog) < 0) strerr_diefu1sys(111, "listen") ;
+    if (gidn && (setgroups(gidn, gids) < 0)) strerr_diefu1sys(111, "setgroups") ;
+    if (gid && (setgid(gid) < 0)) strerr_diefu1sys(111, "drop gid") ;
+    if (uid && (setuid(uid) < 0)) strerr_diefu1sys(111, "drop uid") ;
+
+    x[0].fd = selfpipe_init() ;
+    if (x[0].fd == -1) strerr_diefu1sys(111, "create selfpipe") ;
+    if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ;
+    {
+      sigset_t set ;
+      sigemptyset(&set) ;
+      sigaddset(&set, SIGCHLD) ;
+      sigaddset(&set, SIGTERM) ;
+      sigaddset(&set, SIGHUP) ;
+      sigaddset(&set, SIGQUIT) ;
+      sigaddset(&set, SIGABRT) ;
+      if (selfpipe_trapset(&set) < 0) strerr_diefu1sys(111, "trap signals") ;
+    }
+
+    if (flag1)
+    {
+      unsigned int n = str_len(argv[0]) ;
+      char s[n+1] ;
+      byte_copy(s, n, argv[0]) ;
+      s[n++] = '\n' ;
+      if (allwrite(1, s, n) < n) strerr_diefu1sys(111, "write to stdout") ;
+      fd_close(1) ;
+    }
+    fmtlocalmaxconn[1+uint_fmt(fmtlocalmaxconn+1, localmaxconn)] = 0 ;
+    if (verbosity >= 2)
+    {
+      fmtmaxconn[1+uint_fmt(fmtmaxconn+1, maxconn)] = 0 ;
+      log_start(argv[0]) ;
+      log_status() ;
+    }
+  }
+
+  {
+    diuint inyostack[maxconn + (flaglookup ? maxconn : 1)] ;
+    piduid = inyostack ; uidnum = inyostack + maxconn ;
+
+    while (cont)
+    {
+      if (iopause(x, 1 + (numconn < maxconn), 0, 0) == -1)
+        strerr_diefu1sys(111, "iopause") ;
+
+      if (x[0].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with selfpipe") ;
+      if (x[0].revents & IOPAUSE_READ) handle_signals() ;
+      if (numconn < maxconn)
+      {
+        if (x[1].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with socket") ;
+        if (x[1].revents & IOPAUSE_READ)
+        {
+          int dummy ;
+          char remotepath[IPCPATH_MAX+1] ;
+          register int s = ipc_accept(x[1].fd, remotepath, IPCPATH_MAX+1, &dummy) ;
+          if (s < 0)
+          {
+            if (verbosity) strerr_warnwu1sys("accept") ;
+          }
+          else
+          {
+            new_connection(s, remotepath, argv+1, envp) ;
+            fd_close(s) ;
+          }
+        }
+      }
+    }
+  }
+  if (verbosity >= 2) log_exit() ;
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-sudo.c b/src/conn-tools/s6-sudo.c
new file mode 100644
index 0000000..8541b60
--- /dev/null
+++ b/src/conn-tools/s6-sudo.c
@@ -0,0 +1,67 @@
+/* ISC license. */
+
+#include <skalibs/uint.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <s6-networking/config.h>
+
+#define USAGE "s6-sudo [ -q | -Q | -v ] [ -p bindpath ] [ -l localname ] [ -e ] [ -t timeout ] [ -T timeoutrun ] path [ args... ]"
+#define dieusage() strerr_dieusage(100, USAGE)
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  unsigned int verbosity = 1, t = 0, T = 0 ;
+  char const *bindpath = 0 ;
+  char const *localname = 0 ;
+  int nodoenv = 0 ;
+  PROG = "s6-sudo" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "qQvp:l:et:T:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'q' : if (verbosity) verbosity-- ; break ;
+        case 'Q' : verbosity = 1 ; break ;
+        case 'v' : verbosity++ ; break ;
+        case 'p' : bindpath = l.arg ; break ;
+        case 'l' : localname = l.arg ; break ;
+        case 'e' : nodoenv = 1 ; break ;
+        case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+        case 'T' : if (!uint0_scan(l.arg, &T)) dieusage() ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (!argc) dieusage() ;
+  {
+    char const *eargv[9 + argc + ((verbosity < 2 ? 1 : verbosity-1)) + ((!!bindpath + !!localname) << 1) + nodoenv] ;
+    char fmt1[UINT_FMT] ;
+    char fmt2[UINT_FMT] ;
+    unsigned int n = 0 ;
+    eargv[n++] = "s6-ipcclient" ;
+    if (!verbosity) eargv[n++] = "-Q" ;
+    else while (--verbosity) eargv[n++] = "-v" ;
+    if (bindpath) { eargv[n++] = "-p" ; eargv[n++] = bindpath ; }
+    if (localname) { eargv[n++] = "-l" ; eargv[n++] = localname ; }
+    eargv[n++] = "--" ;
+    eargv[n++] = *argv++ ; argc-- ;
+    eargv[n++] = S6_NETWORKING_BINPREFIX "s6-sudoc" ;
+    if (nodoenv) eargv[n++] = "-e" ;
+    eargv[n++] = "-t" ;
+    fmt1[uint_fmt(fmt1, t)] = 0 ;
+    eargv[n++] = fmt1 ;
+    eargv[n++] = "-T" ;
+    fmt2[uint_fmt(fmt2, T)] = 0 ;
+    eargv[n++] = fmt2 ;
+    eargv[n++] = "--" ;
+    while (argc--) eargv[n++] = *argv++ ;
+    eargv[n++] = 0 ;
+    pathexec_run(eargv[0], eargv, envp) ;
+  }
+  strerr_dieexec(111, S6_NETWORKING_BINPREFIX "s6-ipcclient") ;
+}
diff --git a/src/conn-tools/s6-sudo.h b/src/conn-tools/s6-sudo.h
new file mode 100644
index 0000000..8c5797f
--- /dev/null
+++ b/src/conn-tools/s6-sudo.h
@@ -0,0 +1,11 @@
+/* ISC license. */
+
+#ifndef S6_SUDO_H
+#define S6_SUDO_H
+
+#define S6_SUDO_BANNERB "s6-sudo b v1.0\n"
+#define S6_SUDO_BANNERB_LEN (sizeof(S6_SUDO_BANNERB) - 1)
+#define S6_SUDO_BANNERA "s6-sudo a v1.0\n"
+#define S6_SUDO_BANNERA_LEN (sizeof(S6_SUDO_BANNERA) - 1)
+
+#endif
diff --git a/src/conn-tools/s6-sudoc.c b/src/conn-tools/s6-sudoc.c
new file mode 100644
index 0000000..c417efc
--- /dev/null
+++ b/src/conn-tools/s6-sudoc.c
@@ -0,0 +1,115 @@
+/* ISC license. */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <sys/wait.h>
+#include <skalibs/uint.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/buffer.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/tai.h>
+#include <skalibs/env.h>
+#include <skalibs/unix-timed.h>
+#include <skalibs/unixmessage.h>
+#include "s6-sudo.h"
+
+#define USAGE "s6-sudoc [ -e ] [ -t timeoutconn ] [ -T timeoutrun ] [ args... ]"
+#define dieusage() strerr_dieusage(100, USAGE)
+#define dienomem() strerr_diefu1sys(111, "stralloc_catb")
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  char buf6[64] ;
+  buffer b6 = BUFFER_INIT(&buffer_read, 6, buf6, 64) ;
+  unixmessage_sender_t b7 = UNIXMESSAGE_SENDER_INIT(7) ;
+  subgetopt_t l = SUBGETOPT_ZERO ;
+  unsigned int t = 0, T = 0 ;
+  int doenv = 1 ;
+  
+  tain_t deadline = TAIN_INFINITE_RELATIVE ;
+  PROG = "s6-sudoc" ;
+  for (;;)
+  {
+    register int opt = subgetopt_r(argc, argv, "et:T:", &l) ;
+    if (opt < 0) break ;
+    switch (opt)
+    {
+      case 'e' : doenv = 0 ; break ;
+      case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+      case 'T' : if (!uint0_scan(l.arg, &T)) dieusage() ; break ;
+      default : dieusage() ;
+    }
+  }
+  argc -= l.ind ; argv += l.ind ;
+  if (t) tain_from_millisecs(&deadline, t) ;
+  if ((ndelay_on(6) < 0) || (ndelay_on(7) < 0))
+    strerr_diefu1sys(111, "make socket non-blocking") ;
+  if (!fd_sanitize() || !fd_ensure_open(2, 1))
+    strerr_diefu1sys(111, "sanitize stdin/stdout/stderr") ;
+
+  tain_now_g() ;
+  tain_add_g(&deadline, &deadline) ;
+  {
+    char tmp[S6_SUDO_BANNERB_LEN] ;
+    if (buffer_timed_get_g(&b6, tmp, S6_SUDO_BANNERB_LEN, &deadline) < S6_SUDO_BANNERB_LEN)
+      strerr_diefu1sys(111, "read banner from s6-sudod") ;
+    if (str_diffn(tmp, S6_SUDO_BANNERB, S6_SUDO_BANNERB_LEN))
+      strerr_dief1x(100, "wrong server banner") ;
+  }
+  {
+    int fds[3] = { 0, 1, 2 } ;
+    char pack[16] ;
+    siovec_t v[3] = {
+      { .s = S6_SUDO_BANNERA, .len = S6_SUDO_BANNERA_LEN },
+      { .s = pack, .len = 16 },
+      { .s = 0, .len = 0 } } ;
+    unixmessage_v_t mv = { .v = v, .vlen = 3, .fds = fds, .nfds = 3 } ;
+    stralloc sa = STRALLOC_ZERO ;
+    unsigned int envlen = doenv ? env_len(envp) : 0 ;
+    uint32_pack_big(pack, (uint32)argc) ;
+    uint32_pack_big(pack + 4, (uint32)envlen) ;
+    if (!env_string(&sa, argv, argc)) dienomem() ;
+    uint32_pack_big(pack + 8, (uint32)sa.len) ;
+    if (doenv)
+    {
+      unsigned int start = sa.len ;
+      if (!env_string(&sa, envp, envlen)) dienomem() ;
+      envlen = sa.len - start ;
+    }
+    else envlen = 0 ;
+    uint32_pack_big(pack + 12, (uint32)envlen) ;
+    v[2].s = sa.s ;
+    v[2].len = sa.len ;
+    if (!unixmessage_putv_and_close(&b7, &mv, (unsigned char const *)"\003"))
+      strerr_diefu1sys(111, "unixmessage_putv") ;
+    stralloc_free(&sa) ;
+  }
+  if (!unixmessage_sender_timed_flush_g(&b7, &deadline))
+    strerr_diefu1sys(111, "send args to server") ;
+  unixmessage_sender_free(&b7) ;
+  {
+    char c ;
+    if (buffer_timed_get_g(&b6, &c, 1, &deadline) < 1)
+      strerr_diefu1sys(111, "get confirmation from server") ;
+    if (c)
+    {
+      errno = c ;
+      strerr_diefu1sys(111, "start privileged program: server answered: ") ;
+    }
+  }
+
+  if (T) tain_from_millisecs(&deadline, T) ; else deadline = tain_infinite_relative ;
+  tain_add_g(&deadline, &deadline) ;
+  {
+    char pack[UINT_PACK] ;
+    if (buffer_timed_get_g(&b6, pack, UINT_PACK, &deadline) < UINT_PACK)
+      strerr_diefu1sys(111, "get exit status from server") ;
+    uint_unpack_big(pack, &t) ;
+  }
+  if (WIFSIGNALED(t)) raise(WTERMSIG(t)) ;
+  return WEXITSTATUS(t) ;
+}
diff --git a/src/conn-tools/s6-sudod.c b/src/conn-tools/s6-sudod.c
new file mode 100644
index 0000000..9ea6167
--- /dev/null
+++ b/src/conn-tools/s6-sudod.c
@@ -0,0 +1,233 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <skalibs/uint.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/buffer.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/tai.h>
+#include <skalibs/iopause.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/unix-timed.h>
+#include <skalibs/unixmessage.h>
+#include "s6-sudo.h"
+
+#define USAGE "s6-sudod [ -0 ] [ -1 ] [ -2 ] [ -t timeout ] args..."
+#define dieusage() strerr_dieusage(100, USAGE)
+#define dienomem() strerr_diefu1sys(111, "stralloc_catb")
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  subgetopt_t l = SUBGETOPT_ZERO ;
+  unixmessage_t m ;
+  unsigned int nullfds = 0, t = 2000 ;
+  pid_t pid ;
+  uint32 envc = env_len(envp) ;
+  uint32 cargc, cenvc, carglen, cenvlen ;
+  int spfd ;
+  tain_t deadline = TAIN_INFINITE_RELATIVE ;
+  PROG = "s6-sudod" ;
+  for (;;)
+  {
+    register int opt = subgetopt_r(argc, argv, "012t:", &l) ;
+    if (opt < 0) break ;
+    switch (opt)
+    {
+      case '0' : nullfds |= 1 ; break ;
+      case '1' : nullfds |= 2 ; break ;
+      case '2' : nullfds |= 4 ; break ;
+      case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+      default : dieusage() ;
+    }
+  }
+  argc -= l.ind ; argv += l.ind ;
+  if (t) tain_from_millisecs(&deadline, t) ;
+  if ((ndelay_on(0) < 0) || (ndelay_on(1) < 0))
+    strerr_diefu1sys(111, "make socket non-blocking") ;
+
+  tain_now_g() ;
+  tain_add_g(&deadline, &deadline) ;
+  buffer_putnoflush(buffer_1small, S6_SUDO_BANNERB, S6_SUDO_BANNERB_LEN) ;
+  if (!buffer_timed_flush_g(buffer_1small, &deadline))
+    strerr_diefu1sys(111, "write banner to client") ;
+  if (unixmessage_timed_receive_g(unixmessage_receiver_0, &m, &deadline) <= 0)
+    strerr_diefu1sys(111, "read message from client") ;
+  if (m.nfds != 3)
+    strerr_dief1x(100, "client did not send 3 fds") ;
+  if (m.len < 16 + S6_SUDO_BANNERA_LEN)
+    strerr_dief1x(100, "wrong client message") ;
+  if (str_diffn(m.s, S6_SUDO_BANNERA, S6_SUDO_BANNERA_LEN))
+    strerr_dief1x(100, "wrong client banner") ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN, &cargc) ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN + 4, &cenvc) ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN + 8, &carglen) ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN + 12, &cenvlen) ;
+  if (S6_SUDO_BANNERA_LEN + 16 + carglen + cenvlen != m.len)
+    strerr_dief1x(100, "wrong client argc/envlen") ;
+  if ((cargc > 131072) || (cenvc > 131072))
+    strerr_dief1x(100, "too many args/envvars from client") ;
+
+  if (nullfds & 1)
+  {
+    close(m.fds[0]) ;
+    m.fds[0] = open2("/dev/null", O_RDONLY) ;
+    if (m.fds[0] < 0) strerr_diefu2sys(111, "open /dev/null for ", "reading") ;
+  }
+  if (nullfds & 2)
+  {
+    close(m.fds[1]) ;
+    m.fds[1] = open2("/dev/null", O_WRONLY) ;
+    if (m.fds[1] < 0) strerr_diefu2sys(111, "open /dev/null for ", "writing") ;
+  }
+  if (nullfds & 4)
+  {
+    close(m.fds[2]) ;
+    m.fds[2] = 2 ;
+  }
+ 
+  {
+    char const *targv[argc + 1 + cargc] ;
+    char const *tenvp[envc + 1 + cenvc] ;
+    int p[2] ;
+    register unsigned int i = 0 ;
+    for (; i < (unsigned int)argc ; i++) targv[i] = argv[i] ;
+    for (i = 0 ; i <= envc ; i++) tenvp[i] = envp[i] ;
+    if (!env_make(targv + argc, cargc, m.s + S6_SUDO_BANNERA_LEN + 16, carglen))
+    {
+      char c = errno ;
+      buffer_putnoflush(buffer_1small, &c, 1) ;
+      buffer_timed_flush_g(buffer_1small, &deadline) ;
+      errno = c ;
+      strerr_diefu1sys(111, "make child argv") ;
+    }
+    if (!env_make(tenvp + envc + 1, cenvc, m.s + S6_SUDO_BANNERA_LEN + 16 + carglen, cenvlen))
+    {
+      char c = errno ;
+      buffer_putnoflush(buffer_1small, &c, 1) ;
+      buffer_timed_flush_g(buffer_1small, &deadline) ;
+      errno = c ;
+      strerr_diefu1sys(111, "make child envp") ;
+    }
+    targv[argc + cargc] = 0 ;
+
+    for (i = 0 ; i < cenvlen ; i++)
+    {
+      char const *var = tenvp[envc + 1 + i] ;
+      register unsigned int j = 0 ;
+      register unsigned int len = str_chr(var, '=') ;
+      if (!var[len])
+      {
+        char c = EINVAL ;
+        buffer_putnoflush(buffer_1small, &c, 1) ;
+        buffer_timed_flush_g(buffer_1small, &deadline) ;
+        strerr_dief1x(100, "bad environment from client") ;
+      }
+      for (; j < envc ; j++) if (!str_diffn(var, tenvp[j], len+1)) break ;
+      if ((j < envc) && !tenvp[j][len+1]) tenvp[j] = var ;
+    }
+
+    spfd = selfpipe_init() ;
+    if (spfd < 0) strerr_diefu1sys(111, "selfpipe_init") ;
+    if (selfpipe_trap(SIGCHLD) < 0) strerr_diefu1sys(111, "trap SIGCHLD") ;
+    if (pipe(p) < 0) strerr_diefu1sys(111, "pipe") ;
+    if (coe(p[1]) < 0) strerr_diefu1sys(111, "coe pipe") ;
+    pid = fork() ;
+    if (pid < 0) strerr_diefu1sys(111, "fork") ;
+    if (!pid)
+    {
+      PROG = "s6-sudod (child)" ;
+      fd_close(p[0]) ;
+      if ((fd_move(2, m.fds[2]) < 0)
+       || (fd_move(1, m.fds[1]) < 0)
+       || (fd_move(0, m.fds[0]) < 0))
+      {
+        char c = errno ;
+        fd_write(p[1], &c, 1) ;
+        strerr_diefu1sys(111, "move fds") ;
+      }
+      selfpipe_finish() ;
+      pathexec0_run(targv, tenvp) ;
+      {
+        char c = errno ;
+        fd_write(p[1], &c, 1) ;
+      }
+      strerr_dieexec(111, targv[0]) ;
+    }
+    fd_close(p[1]) ;
+    {
+      char c ;
+      register int r = fd_read(p[0], &c, 1) ;
+      if (r < 0) strerr_diefu1sys(111, "read from child") ;
+      if (r)
+      {
+        buffer_putnoflush(buffer_1small, &c, 1) ;
+        buffer_timed_flush_g(buffer_1small, &deadline) ;
+        return 111 ;
+      }
+    }
+    fd_close(p[0]) ;
+  }
+
+  fd_close(m.fds[0]) ;
+  fd_close(m.fds[1]) ;
+  if (!(nullfds & 4)) fd_close(m.fds[2]) ;
+  unixmessage_receiver_free(unixmessage_receiver_0) ;
+  buffer_putnoflush(buffer_1small, "", 1) ;
+  if (!buffer_timed_flush_g(buffer_1small, &deadline))
+    strerr_diefu1sys(111, "send confirmation to client") ;
+
+  {
+    iopause_fd x[2] = { { .fd = 0, .events = 0 }, { .fd = spfd, .events = IOPAUSE_READ } } ;
+    int cont = 1 ;
+    while (cont)
+    {
+      if (iopause_g(x, 2, 0) < 0) strerr_diefu1sys(111, "iopause") ;
+      if (x[1].revents)
+      {
+        for (;;)
+        {
+          int c = selfpipe_read() ;
+          if (c < 0) strerr_diefu1sys(111, "read from selfpipe") ;
+          else if (!c) break ;
+          else if (c == SIGCHLD)
+          {
+            int wstat ;
+            register int r = wait_pid_nohang(pid, &wstat) ;
+            if ((r < 0) && (errno != ECHILD))
+              strerr_diefu1sys(111, "wait_pid_nohang") ;
+            else if (r > 0)
+            {
+              char pack[UINT_PACK] ;
+              uint_pack_big(pack, (unsigned int)wstat) ;
+              buffer_putnoflush(buffer_1small, pack, UINT_PACK) ;
+              cont = 0 ;
+            }
+          }
+          else
+            strerr_dief1sys(101, "internal inconsistency, please submit a bug-report") ;
+        }
+      }
+      if (x[0].revents && cont)
+      {
+        kill(pid, SIGTERM) ;
+        kill(pid, SIGCONT) ;
+        x[0].fd = -1 ;
+        return 1 ;
+      }
+    }
+  }
+  if (ndelay_off(1) < 0)
+    strerr_diefu1sys(111, "set stdout blocking") ;
+  if (!buffer_flush(buffer_1small))
+    strerr_diefu1sys(111, "write status to client") ;
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-tcpclient.c b/src/conn-tools/s6-tcpclient.c
new file mode 100644
index 0000000..4686636
--- /dev/null
+++ b/src/conn-tools/s6-tcpclient.c
@@ -0,0 +1,377 @@
+/* ISC license. */
+
+#include <errno.h>
+#include <skalibs/uint16.h>
+#include <skalibs/uint.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/fmtscan.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/genalloc.h>
+#include <skalibs/tai.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/skamisc.h>
+#include <skalibs/socket.h>
+#include <skalibs/ip46.h>
+#include <s6-dns/s6dns.h>
+#include <s6-networking/ident.h>
+
+#ifdef SKALIBS_IPV6_ENABLED
+# define USAGE "s6-tcpclient [ -q | -Q | -v ] [ -4 | -6 ] [ -d | -D ] [ -r | -R ] [ -h | -H ] [ -n | -N ] [ -t timeoutinfo ] [ -l localname ] [ -T timeoutconn ] [ -i localip ] [ -p localport ] host port prog..."
+# define TFLAGS_DEFAULT { 0, 0, { 2, 58 }, IP46_ZERO, 0, 1, 0, 0, 1, 0, 1, 1 }
+# define OPTSTRING "qQv46dDrRhHnNt:l:T:i:p:"
+#else
+# define USAGE "s6-tcpclient [ -q | -Q | -v ] [ -d | -D ] [ -r | -R ] [ -h | -H ] [ -n | -N ] [ -t timeoutinfo ] [ -l localname ] [ -T timeoutconn ] [ -i localip ] [ -p localport ] host port prog..."
+# define TFLAGS_DEFAULT { 0, 0, { 2, 58 }, IP46_ZERO, 0, 1, 1, 0, 1, 1 }
+# define OPTSTRING "qQvdDrRhHnNt:l:T:i:p:"
+#endif
+
+#define usage() strerr_dieusage(100, USAGE)
+#define dienomem() strerr_diefu1sys(111, "allocate")
+
+#define MAXIP 16
+
+typedef struct tflags_s tflags, *tflags_ref ;
+struct tflags_s
+{
+  char const *localname ;
+  unsigned int timeout ;
+  unsigned int timeoutconn[2] ;
+  ip46_t localip ;
+  uint16 localport ;
+  unsigned int verbosity : 2 ;
+#ifdef SKALIBS_IPV6_ENABLED
+  unsigned int ip4 : 1 ;
+  unsigned int ip6 : 1 ;
+#endif
+  unsigned int delay : 1 ;
+  unsigned int remoteinfo : 1 ;
+  unsigned int remotehost : 1 ;
+  unsigned int qualif : 1 ;
+} ;
+
+static tain_t deadline ;
+
+int main (int argc, char const *const *argv)
+{
+  int s ;
+  tflags flags = TFLAGS_DEFAULT ;
+  uint16 remoteport ;
+  PROG = "s6-tcpclient" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, OPTSTRING, &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'q' : if (flags.verbosity) flags.verbosity-- ; break ;
+        case 'Q' : flags.verbosity = 1 ; break ;
+        case 'v' : flags.verbosity++ ; break ;
+#ifdef SKALIBS_IPV6_ENABLED
+        case '4' : flags.ip4 = 1 ; break ;
+        case '6' : flags.ip6 = 1 ; break ;
+#endif
+        case 'd' : flags.delay = 1 ; break ;
+        case 'D' : flags.delay = 0 ; break ;
+        case 'r' : flags.remoteinfo = 1 ; break ;
+        case 'R' : flags.remoteinfo = 0 ; break ;
+        case 'h' : flags.remotehost = 1 ; break ;
+        case 'H' : flags.remotehost = 0 ; break ;
+        case 'n' : flags.qualif = 1 ; break ;
+        case 'N' : flags.qualif = 0 ; break ;
+        case 't' : if (!uint0_scan(l.arg, &flags.timeout)) usage() ; break ;
+        case 'l' : flags.localname = l.arg ; break ;
+        case 'T' :
+        {
+          unsigned int n = uint_scan(l.arg, &flags.timeoutconn[0]) ;
+          if (!n) usage() ;
+          if (!l.arg[n])
+          {
+            flags.timeoutconn[1] = 0 ;
+            break ;
+          }
+          if (l.arg[n] != '+') usage() ;
+          if (!uint0_scan(l.arg + n + 1, &flags.timeoutconn[1])) usage() ;
+          break ;
+        }
+        case 'i' : if (!ip46_scan(l.arg, &flags.localip)) usage() ; break ;
+        case 'p' : if (!uint160_scan(l.arg, &flags.localport)) usage() ; break ;
+        default : usage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (argc < 3) usage() ;
+#ifdef SKALIBS_IPV6_ENABLED
+  if (!flags.ip6) flags.ip4 = 1 ;
+#endif
+  if (!uint160_scan(argv[1], &remoteport))
+    strerr_dief2x(100, "invalid port number: ", argv[1]) ;
+  tain_now_g() ;
+  if (flags.timeout) tain_addsec_g(&deadline, flags.timeout) ;
+  else tain_add_g(&deadline, &tain_infinite_relative) ;
+  
+  {
+    ip46_t ip[2][MAXIP] ;
+    unsigned int j = 0 ;
+    unsigned int n[2] = { 0, 0 } ;
+    register unsigned int i = 0 ;
+    if (!**argv || ((**argv == '0') && !argv[0][1]))
+    {
+#ifdef SKALIBS_IPV6_ENABLED
+      ip46_from_ip6(&ip[0][n[0]++], IP6_LOCAL) ; 
+#endif
+      ip46_from_ip4(&ip[0][n[0]++], IP4_LOCAL) ; 
+    }
+    else
+    {
+      if (!flags.remotehost)
+      {
+#ifdef SKALIBS_IPV6_ENABLED
+        if (flags.ip6 && !flags.ip4)
+        {
+          char ip6[MAXIP << 4] ;
+          register unsigned int i = 0 ;
+          if (!ip6_scanlist(ip6, MAXIP, argv[0], &n[0])) usage() ;
+          for (; i < n[0] ; i++) ip46_from_ip6(&ip[0][i], ip6 + (i << 4)) ;
+        }
+        else if (!flags.ip6)
+        {
+          char ip4[MAXIP << 2] ;
+          register unsigned int i = 0 ;
+          if (!ip4_scanlist(ip4, MAXIP, argv[0], &n[0])) usage() ;
+          for (; i < n[0] ; i++) ip46_from_ip4(&ip[0][i], ip4 + (i << 2)) ;
+        }
+        else
+#endif
+        if (!ip46_scanlist(ip[0], MAXIP, argv[0], &n[0])) usage() ;
+      }
+      else
+      {
+#ifdef SKALIBS_IPV6_ENABLED
+        if (flags.ip6 && flags.ip4)
+        {
+          if (!ip46_scanlist(ip[0], MAXIP, argv[0], &n[0]))
+          {
+            genalloc ips = STRALLOC_ZERO ;
+            if (s6dns_resolve_aaaaa_g(&ips, argv[0], str_len(argv[0]), flags.qualif, &deadline) <= 0)
+              strerr_diefu4x(111, "resolve ", argv[0], ": ", s6dns_constants_error_str(errno)) ;
+            n[0] = genalloc_len(ip46_t, &ips) ;
+            if (n[0] >= MAXIP) n[0] = MAXIP ;
+            for (; i < n[0] ; i++) ip[0][i] = genalloc_s(ip46_t, &ips)[i] ;
+            genalloc_free(ip46_t, &ips) ;
+          }
+        }
+        else if (flags.ip6)
+        {
+          char ip6[MAXIP << 4] ;
+          if (ip6_scanlist(ip6, MAXIP, argv[0], &n[0]))
+          {
+            register unsigned int i = 0 ;
+            for (; i < n[0] ; i++) ip46_from_ip6(&ip[0][i], ip6 + (i << 4)) ;
+          }
+          else
+          {
+            stralloc ip6s = STRALLOC_ZERO ;
+            if (s6dns_resolve_aaaa_g(&ip6s, argv[0], str_len(argv[0]), flags.qualif, &deadline) <= 0)
+              strerr_diefu4x(111, "resolve ", argv[0], ": ", s6dns_constants_error_str(errno)) ;
+            n[0] = ip6s.len >> 4 ;
+            if (n[0] >= MAXIP) n[0] = MAXIP ;
+            for (; i < n[0] ; i++) ip46_from_ip6(&ip[0][i], ip6s.s + (i << 4)) ;
+            stralloc_free(&ip6s) ;
+          }
+        }
+        else
+#endif
+        {
+          char ip4[MAXIP << 2] ;
+          if (ip4_scanlist(ip4, MAXIP, argv[0], &n[0]))
+          {
+            register unsigned int i = 0 ;
+            for (; i < n[0] ; i++) ip46_from_ip4(&ip[0][i], ip4 + (i << 2)) ;
+          }
+          else
+          {
+            stralloc ip4s = STRALLOC_ZERO ;
+            if (s6dns_resolve_a_g(&ip4s, argv[0], str_len(argv[0]), flags.qualif, &deadline) <= 0)
+              strerr_diefu4x(111, "resolve ", argv[0], ": ", s6dns_constants_error_str(errno)) ;
+            n[0] = ip4s.len >> 2 ;
+            if (n[0] >= MAXIP) n[0] = MAXIP ;
+            for (; i < n[0] ; i++) ip46_from_ip4(&ip[0][i], ip4s.s + (i << 2)) ;
+            stralloc_free(&ip4s) ;
+          }
+        } 
+      }
+      if (!n[0]) strerr_dief2x(100, "no IP address for ", argv[0]) ;
+    }
+
+    if (n[0] == 1)
+    {
+      flags.timeoutconn[0] += flags.timeoutconn[1] ;
+      flags.timeoutconn[1] = 0 ;
+    }
+
+    for (; j < 2 ; j++)
+    {
+      unsigned int i = 0 ;
+      for (; i < n[j] ; i++)
+      {
+        tain_t localdeadline ;
+        s = socket_tcp46(ip46_is6(&flags.localip)) ;
+        if (s < 0) strerr_diefu1sys(111, "create socket") ;
+        if (socket_bind46(s, &flags.localip, flags.localport) < 0)
+          strerr_diefu1sys(111, "bind socket") ;
+        tain_addsec_g(&localdeadline, flags.timeoutconn[j]) ;
+        if (tain_less(&deadline, &localdeadline)) localdeadline = deadline ;
+        if (socket_deadlineconnstamp46_g(s, &ip[j][i], remoteport, &localdeadline)) goto connected ;
+        fd_close(s) ;
+        if (!j && flags.timeoutconn[1]) ip[1][n[1]++] = ip[0][i] ;
+        else
+        {
+          char fmtip[IP46_FMT] ;
+          char fmtport[UINT16_FMT] ;
+          fmtip[ip46_fmt(fmtip, &ip[j][i])] = 0 ;
+          fmtport[uint16_fmt(fmtport, remoteport)] = 0 ;
+          strerr_warnwu4sys("connect to ", fmtip, " port ", fmtport) ;
+        }
+      }
+    }
+    strerr_diefu2x(111, "connect to ", "a suitable IP address") ;
+  }
+
+ connected:
+
+  if (ndelay_off(s) == -1)
+    strerr_diefu1sys(111, "ndelay_off") ;
+  if (!flags.delay) socket_tcpnodelay(s) ;
+  if (socket_local46(s, &flags.localip, &flags.localport) == -1)
+    strerr_diefu2sys(111, "get local", " address and port") ;
+
+  {
+    ip46_t remoteip ;
+    char fmtip[IP46_FMT] ;
+    char fmtport[UINT16_FMT] ;
+
+    if (socket_remote46(s, &remoteip, &remoteport) == -1)
+      strerr_diefu2sys(111, "get remote", " address and port") ;
+    fmtip[ip46_fmt(fmtip, &remoteip)] = 0 ;
+    fmtport[uint16_fmt(fmtport, remoteport)] = 0 ;
+    if (flags.verbosity >= 2)
+      strerr_warni4x("connected to ", fmtip, " port ", fmtport) ;
+    if (!pathexec_env("PROTO", "TCP")
+     || !pathexec_env("TCPREMOTEIP", fmtip)
+     || !pathexec_env("TCPREMOTEPORT", fmtport)) dienomem() ;
+
+    fmtip[ip46_fmt(fmtip, &flags.localip)] = 0 ;
+    fmtport[uint16_fmt(fmtport, flags.localport)] = 0 ;
+    if (!pathexec_env("TCPLOCALIP", fmtip)
+     || !pathexec_env("TCPLOCALPORT", fmtport)) dienomem() ;
+
+    if (flags.localname)
+    {
+      if (!pathexec_env("TCPLOCALHOST", flags.localname)) dienomem() ;
+    }
+
+ /* DNS resolution for TCPLOCALHOST and TCPREMOTEHOST */
+
+    if (!flags.localname || flags.remotehost)
+    {
+      s6dns_resolve_t blob[2] ;
+      s6dns_dpag_t data[2] = { S6DNS_DPAG_ZERO, S6DNS_DPAG_ZERO } ;
+      if (!flags.localname)
+      {
+        s6dns_domain_arpafromip46(&blob[0].q, &flags.localip) ;
+        s6dns_domain_encode(&blob[0].q) ;
+        blob[0].qtype = S6DNS_T_PTR ;
+        blob[0].deadline = deadline ;
+        blob[0].parsefunc = &s6dns_message_parse_answer_domain ;
+        blob[0].data = &data[0] ;
+        blob[0].options = S6DNS_O_RECURSIVE ;
+        data[0].rtype = S6DNS_T_PTR ;
+      }
+      if (flags.remotehost)
+      {
+        s6dns_domain_arpafromip46(&blob[1].q, &remoteip) ;
+        s6dns_domain_encode(&blob[1].q) ;
+        blob[1].qtype = S6DNS_T_PTR ;
+        blob[1].deadline = deadline ;
+        blob[1].parsefunc = &s6dns_message_parse_answer_domain ;
+        blob[1].data = &data[1] ;
+        blob[1].options = S6DNS_O_RECURSIVE ;
+        data[1].rtype = S6DNS_T_PTR ;
+      }
+      {
+        tain_t infinite = TAIN_INFINITE ;
+        if (!s6dns_resolven_parse_g(blob + !!flags.localname, !flags.localname + !!flags.remotehost, &infinite))
+          strerr_diefu2x(111, "resolve IP addresses: ", s6dns_constants_error_str(errno)) ;
+      }
+      if (!flags.localname)
+      {
+        if (blob[0].status)
+        {
+          if (!pathexec_env("TCPLOCALHOST", 0)) dienomem() ;
+        }
+        else
+        {
+          char s[256] ;
+          register unsigned int len = 0 ;
+          if (genalloc_len(s6dns_domain_t, &data[0].ds))
+           len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[0].ds)) ;
+          genalloc_free(s6dns_domain_t, &data[0].ds) ;
+          s[len] = 0 ;
+          if (!pathexec_env("TCPLOCALHOST", s)) dienomem() ;
+        }
+      }
+      if (flags.remotehost)
+      {
+        if (blob[1].status)
+        {
+          if (!pathexec_env("TCPREMOTEHOST", 0)) dienomem() ;
+        }
+        else
+        {
+          char s[256] ;
+          register unsigned int len = 0 ;
+          if (genalloc_len(s6dns_domain_t, &data[1].ds))
+           len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[1].ds)) ;
+          genalloc_free(s6dns_domain_t, &data[1].ds) ;
+          s[len] = 0 ;
+          if (!pathexec_env("TCPREMOTEHOST", s)) dienomem() ;
+        }
+      }
+    }
+
+
+ /* TCPREMOTEINFO */
+ /*
+    Yes, I should have made all the network queries in parallel,
+    not only the DNS ones, but the IDENT one too. Well, that was
+    too much work for an obsolete protocol. Sue me.
+ */
+    {
+      char idbuf[S6NET_IDENT_ID_SIZE] ;
+      if (flags.remoteinfo)
+      {
+        register int r = s6net_ident_client_g(idbuf, S6NET_IDENT_ID_SIZE, &remoteip, remoteport, &flags.localip, flags.localport, &deadline) ;
+        if (r <= 0)
+        {
+          if (flags.verbosity)
+          {
+            if (r < 0) strerr_warnwu1sys("s6net_ident_client") ;
+            else strerr_warnw2x("ident server replied: ", s6net_ident_error_str(errno)) ;
+          }
+          if (!pathexec_env("TCPREMOTEINFO", "")) dienomem() ;
+        }
+        else if (!pathexec_env("TCPREMOTEINFO", idbuf)) dienomem() ;
+      }
+    }
+  }
+
+  if (fd_move(6, s) < 0) strerr_diefu2sys(111, "set up fd ", "6") ;
+  if (fd_copy(7, 6) < 0) strerr_diefu2sys(111, "set up fd ", "7") ;
+  pathexec(argv+2) ;
+  strerr_dieexec(111, argv[2]) ;
+}
diff --git a/src/conn-tools/s6-tcpserver-access.c b/src/conn-tools/s6-tcpserver-access.c
new file mode 100644
index 0000000..ef2771b
--- /dev/null
+++ b/src/conn-tools/s6-tcpserver-access.c
@@ -0,0 +1,387 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <errno.h>
+#include <skalibs/gccattributes.h>
+#include <skalibs/uint16.h>
+#include <skalibs/uint.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/buffer.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/genalloc.h>
+#include <skalibs/cdb.h>
+#include <skalibs/tai.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/socket.h>
+#include <skalibs/ip46.h>
+#include <skalibs/unix-timed.h>
+#include <execline/config.h>
+#include <s6-dns/s6dns.h>
+#include <s6-networking/s6net.h>
+
+#define USAGE "s6-tcpserver-access [ -v verbosity ] [ -W | -w ] [ -D | -d ] [ -H | -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ] prog..."
+#define dieusage() strerr_dieusage(100, USAGE)
+#define dienomem() strerr_diefu1sys(111, "update environment")
+#define X() strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.")
+
+
+static void logit (unsigned int pid, ip46_t const *ip, int h)
+{
+  char fmtpid[UINT_FMT] ;
+  char fmtip[IP46_FMT] ;
+  fmtip[ip46_fmt(fmtip, ip)] = 0 ;
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  if (h) strerr_warni5x("allow", " pid ", fmtpid, " ip ", fmtip) ;
+  else strerr_warni5sys("deny", " pid ", fmtpid, " ip ", fmtip) ;
+}
+
+static inline void log_accept (unsigned int pid, ip46_t const *ip)
+{
+  logit(pid, ip, 1) ;
+}
+
+static inline void log_deny (unsigned int pid, ip46_t const *ip)
+{
+  logit(pid, ip, 0) ;
+}
+
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  s6net_accessrules_params_t params = S6NET_ACCESSRULES_PARAMS_ZERO ;
+  stralloc modifs = STRALLOC_ZERO ;
+  tain_t deadline, tto ;
+  char const *rulestypestr[3] = { "no", "fs", "cdb" } ;
+  char const *rules = 0 ;
+  char const *localname = 0 ;
+  char const *proto ;
+  struct cdb c = CDB_ZERO ;
+  int cdbfd = -1 ;
+  unsigned int rulestype = 0 ;
+  unsigned int verbosity = 1 ;
+  unsigned int protolen ;
+  s6net_accessrules_result_t accepted ;
+  ip46_t remoteip, localip ;
+  int flagfatal = 1, flagnodelay = 0, flagdnslookup = 1,
+    flagident = 0, flagparanoid = 0, e = 0 ;
+  uint16 remoteport, localport ;
+  PROG = "s6-tcpserver-access" ;
+  {
+    unsigned int timeout = 0 ;
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "WwDdHhRrPpv:l:B:t:i:x:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'W' : flagfatal = 0 ; break ;
+        case 'w' : flagfatal = 1 ; break ;
+        case 'D' : flagnodelay = 1 ; break ;
+        case 'd' : flagnodelay = 0 ; break ;
+        case 'H' : flagdnslookup = 0 ; break ;
+        case 'h' : flagdnslookup = 1 ; break ;
+        case 'R' : flagident = 0 ; break ;
+        case 'r' : flagident = 1 ; break ;
+        case 'P' : flagparanoid = 0 ; break ;
+        case 'p' : flagparanoid = 1 ; break ;
+        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
+        case 'l' : localname = l.arg ; break ;
+        case 'B' :
+        {
+          register unsigned int n = str_len(l.arg) ;
+          if (buffer_putnoflush(buffer_1small, l.arg, n) < n)
+            strerr_dief1x(100, "banner too long") ;
+          break ;
+        }
+        case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ;
+        case 'i' : rules = l.arg ; rulestype = 1 ; break ;
+        case 'x' : rules = l.arg ; rulestype = 2 ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+    if (timeout) tain_from_millisecs(&tto, timeout) ;
+    else tto = tain_infinite_relative ;
+  }
+  if (!argc) dieusage() ;
+  if (!*argv[0]) dieusage() ;
+
+  proto = env_get2(envp, "PROTO") ;
+  if (!proto) strerr_dienotset(100, "PROTO") ;
+  protolen = str_len(proto) ;
+  {
+    char const *x ;
+    char tmp[protolen + 11] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 9, "REMOTEIP") ;
+    x = env_get2(envp, tmp) ;
+    if (!x) strerr_dienotset(100, tmp) ;
+    if (!ip46_scan(x, &remoteip)) strerr_dieinvalid(100, tmp) ;
+    byte_copy(tmp + protolen + 6, 5, "PORT") ;
+    x = env_get2(envp, tmp) ;
+    if (!x) strerr_dienotset(100, tmp) ;
+    if (!uint160_scan(x, &remoteport)) strerr_dieinvalid(100, tmp) ;
+  }
+
+  if (flagnodelay)
+  {
+    if (socket_tcpnodelay(1) < 0)
+      if (verbosity) strerr_warnwu1sys("socket_tcpnodelay") ;
+  }
+  tain_now_g() ;
+  tain_add_g(&deadline, &tto) ;
+  if (!buffer_timed_flush_g(buffer_1small, &deadline))
+    strerr_diefu1sys(111, "write banner") ;
+
+  switch (rulestype)
+  {
+    case 0 :
+      if (verbosity >= 2) strerr_warnw1x("invoked without a ruleset!") ;
+      accepted = S6NET_ACCESSRULES_ALLOW ;
+      break ;
+    case 1 :
+      accepted = s6net_accessrules_ip46_fs(&remoteip, (void *)rules, &params) ;
+      break ;
+    case 2 :
+      cdbfd = open_readb(rules) ;
+      if (cdbfd < 0) strerr_diefu2sys(111, "open_readb ", rules) ;
+      if (cdb_init(&c, cdbfd) < 0) strerr_diefu2sys(111, "cdb_init ", rules) ;
+      accepted = s6net_accessrules_ip46_cdb(&remoteip, &c, &params) ;
+      if (accepted == S6NET_ACCESSRULES_ALLOW)
+      {
+        cdb_free(&c) ;
+        fd_close(cdbfd) ;
+      }
+      break ;
+    default : X() ;
+  }
+  switch (accepted)
+  {
+    case S6NET_ACCESSRULES_ERROR :
+      strerr_diefu6sys(111, "check ", rulestypestr[rulestype], " ruleset for ", "IP", " in ", rules) ;
+    case S6NET_ACCESSRULES_ALLOW : break ;
+    case S6NET_ACCESSRULES_DENY :
+      if (verbosity >= 2) { errno = EACCES ; log_deny(getpid(), &remoteip) ; }
+      return 1 ;
+    case S6NET_ACCESSRULES_NOTFOUND :
+      if (flagdnslookup) break ;
+      if (verbosity >= 2) { errno = ENOENT ; log_deny(getpid(), &remoteip) ; }
+      return 1 ;
+    default: X() ;
+  }
+
+  {
+    char const *x = 0 ;
+    char idbuf[S6NET_IDENT_ID_SIZE] ;
+    char fmt[IP46_FMT] ;
+    char tmp[protolen + 11] ;
+    if (socket_local46(0, &localip, &localport) < 0)
+      strerr_diefu1sys(111, "socket_local") ;
+    fmt[ip46_fmt(fmt, &localip)] = 0 ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 8, "LOCALIP") ;
+    if (!env_addmodif(&modifs, tmp, fmt)) dienomem() ;
+    fmt[uint16_fmt(fmt, localport)] = 0 ;
+    byte_copy(tmp + protolen + 5, 5, "PORT") ;
+    if (!env_addmodif(&modifs, tmp, fmt)) dienomem() ;
+    byte_copy(tmp + protolen, 11, "REMOTEINFO") ;
+    if (flagident)
+    {
+      register int r = s6net_ident_client_g(idbuf, S6NET_IDENT_ID_SIZE, &remoteip, remoteport, &localip, localport, &deadline) ;
+      if (r < 0)
+      {
+        if (verbosity >= 3) strerr_warnwu1sys("s6net_ident_client") ;
+        if (flagfatal)
+        {
+          e = errno == ETIMEDOUT ? 99 : 111 ;
+          goto reject ;
+        }
+      }
+      else if (!r)
+      {
+        if (verbosity >= 3) strerr_warnw2x("ident server replied: ", s6net_ident_error_str(errno)) ;
+        if (flagfatal)
+        {
+          e = 2 ;
+          goto reject ;
+        }
+      }
+      else x = idbuf ;
+    }
+
+    if (!env_addmodif(&modifs, tmp, x)) dienomem() ;
+  }
+
+  if (!flagdnslookup)
+  {
+    char tmp[protolen + 11] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 10, "LOCALHOST") ;
+    if (!env_addmodif(&modifs, tmp, localname)) dienomem() ;
+    byte_copy(tmp + protolen, 11, "REMOTEHOST") ;
+    if (!env_addmodif(&modifs, tmp, 0)) dienomem() ;
+  }
+  else
+  {
+    static tain_t const infinite = TAIN_INFINITE ;
+    s6dns_dpag_t data[2] = { S6DNS_DPAG_ZERO, S6DNS_DPAG_ZERO } ;
+    s6dns_resolve_t blob[2] ;
+    char remotebuf[256] ;
+    unsigned int remotelen = 0 ;
+    char tcplocalhost[(protolen << 1) + 21] ;
+    char *tcpremotehost = tcplocalhost + protolen + 10 ;
+    byte_copy(tcplocalhost, protolen, proto) ;
+    byte_copy(tcplocalhost + protolen, 10, "LOCALHOST") ;
+    byte_copy(tcpremotehost, protolen, proto) ;
+    byte_copy(tcpremotehost + protolen, 11, "REMOTEHOST") ;
+
+    if (localname)
+    {
+      if (!env_addmodif(&modifs, tcplocalhost, localname)) dienomem() ;
+    }
+    {
+      s6dns_domain_arpafromip46(&blob[0].q, &localip) ;
+      s6dns_domain_encode(&blob[0].q) ;
+      blob[0].qtype = S6DNS_T_PTR ;
+      blob[0].deadline = deadline ;
+      blob[0].parsefunc = &s6dns_message_parse_answer_domain ;
+      blob[0].data = &data[0] ;
+      blob[0].options = S6DNS_O_RECURSIVE ;
+      data[0].rtype = S6DNS_T_PTR ;
+    }
+    s6dns_domain_arpafromip46(&blob[1].q, &remoteip) ;
+    s6dns_domain_encode(&blob[1].q) ;
+    blob[1].qtype = S6DNS_T_PTR ;
+    blob[1].deadline = deadline ;
+    blob[1].parsefunc = &s6dns_message_parse_answer_domain ;
+    blob[1].data = &data[1] ;
+    blob[1].options = S6DNS_O_RECURSIVE ;
+    data[1].rtype = S6DNS_T_PTR ;
+    if (!s6dns_resolven_parse_g(blob + !!localname, 1 + !localname, &infinite))
+    {
+      if (verbosity >= 3) strerr_warnwu2x("resolve IP addresses: ", s6dns_constants_error_str(errno)) ;
+      if (flagfatal)
+      {
+        e = 111 ;
+        goto reject ;
+      }
+    }
+    else
+    {
+      if (!localname)
+      {
+        if (blob[0].status)
+        {
+          if (!env_addmodif(&modifs, tcplocalhost, 0)) dienomem() ;
+        }
+        else
+        {
+          char s[256] ;
+          register unsigned int len = 0 ;
+          if (genalloc_len(s6dns_domain_t, &data[0].ds))
+          {
+            s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[0].ds)) ;
+            len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[0].ds)) ;
+          }
+          genalloc_free(s6dns_domain_t, &data[0].ds) ;
+          s[len] = 0 ;
+          if (!env_addmodif(&modifs, tcplocalhost, s)) dienomem() ;
+        }
+      }
+      if (!blob[1].status)
+      {
+        if (genalloc_len(s6dns_domain_t, &data[1].ds))
+        {
+          s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[1].ds)) ;
+          remotelen = s6dns_domain_tostring(remotebuf, 255, genalloc_s(s6dns_domain_t, &data[1].ds)) ;
+        }
+        remotebuf[remotelen] = 0 ;
+        if (flagparanoid)
+        {
+          register int r ;
+          data[1].ds.len = 0 ;
+          r = ip46_is6(&remoteip) ? s6dns_resolve_aaaa_g(&data[1].ds, remotebuf, remotelen, 0, &deadline) : s6dns_resolve_a_g(&data[1].ds, remotebuf, remotelen, 0, &deadline) ;
+          if (r <= 0)
+          {
+            if (verbosity >= 3) strerr_warnwu4x("(paranoidly) resolve ", remotebuf, ": ", s6dns_constants_error_str(errno)) ;
+            if (flagfatal)
+            {
+              e = errno == ETIMEDOUT ? 99 : 111 ;
+              goto reject ;
+            }
+            remotelen = 0 ;
+          }
+          else
+          {
+            register unsigned int i = 0 ;
+            for (; i < data[1].ds.len ; i += ip46_is6(&remoteip) ? 16 : 4)
+              if (!byte_diff(remoteip.ip, ip46_is6(&remoteip) ? 16 : 4, data[1].ds.s + i)) break ;
+            if (i >= data[1].ds.len) remotelen = 0 ;
+          }
+        }
+        stralloc_free(&data[1].ds) ;
+      }
+    }
+    if (!env_addmodif(&modifs, tcpremotehost, remotelen ? remotebuf : 0)) dienomem() ;
+    if (remotelen && (accepted == S6NET_ACCESSRULES_NOTFOUND))
+    {
+      switch (rulestype)
+      {
+        case 1 :
+          accepted = s6net_accessrules_reversedns_fs(remotebuf, (void *)rules, &params) ;
+          break ;
+        case 2 : 
+          accepted = s6net_accessrules_reversedns_cdb(remotebuf, &c, &params) ;
+          break ;
+        default : X() ;
+      }
+    }
+
+    if ((rulestype == 2) && (accepted != S6NET_ACCESSRULES_ALLOW))
+    {
+      cdb_free(&c) ;
+      fd_close(cdbfd) ;
+    }
+
+    switch (accepted)
+    {
+      case S6NET_ACCESSRULES_ERROR :
+        strerr_diefu6sys(111, "check ", rulestypestr[rulestype], " ruleset for ", "reverse DNS", " in ", rules) ;
+      case S6NET_ACCESSRULES_ALLOW : break ;
+      case S6NET_ACCESSRULES_DENY :
+        if (verbosity >= 2) { errno = EACCES ; log_deny(getpid(), &remoteip) ; }
+        return 1 ;
+      case S6NET_ACCESSRULES_NOTFOUND :
+        if (verbosity >= 2) { errno = ENOENT ; log_deny(getpid(), &remoteip) ; }
+        return 1 ;
+      default : X() ;
+    }
+  }
+
+  if (!stralloc_catb(&params.env, modifs.s, modifs.len)) dienomem() ;
+  stralloc_free(&modifs) ;
+  if (verbosity) log_accept(getpid(), &remoteip) ;
+  if (params.exec.len)
+  {
+    char *specialargv[4] = { EXECLINE_EXTBINPREFIX "execlineb", "-c", params.exec.s, 0 } ;
+    pathexec_r((char const *const *)specialargv, envp, env_len(envp), params.env.s, params.env.len) ;
+    strerr_dieexec(111, specialargv[0]) ;
+  }
+
+  pathexec_r(argv, envp, env_len(envp), params.env.s, params.env.len) ;
+  strerr_dieexec(111, argv[0]) ;
+
+ reject:
+  if (verbosity >= 2)
+  {
+    char fmtpid[UINT_FMT] ;
+    char fmtip[IP46_FMT] ;
+    fmtip[ip46_fmt(fmtip, &remoteip)] = 0 ;
+    fmtpid[uint_fmt(fmtpid, getpid())] = 0 ;
+    strerr_dief5x(e, "reject", " pid ", fmtpid, " ip ", fmtip) ;
+  }
+  else return e ;
+}
diff --git a/src/conn-tools/s6-tcpserver.c b/src/conn-tools/s6-tcpserver.c
new file mode 100644
index 0000000..fcbf4f2
--- /dev/null
+++ b/src/conn-tools/s6-tcpserver.c
@@ -0,0 +1,71 @@
+/* ISC license. */
+
+#include <skalibs/uint.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/ip46.h>
+#include <s6-networking/config.h>
+
+#define USAGE "s6-tcpserver [ -q | -Q | -v ] [ -1 ] [ -4 | -6 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] ip port prog..."
+#define dieusage() strerr_dieusage(100, USAGE)
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  char const *newargv[2 + (argc << 1)] ;
+  char const *path ;
+  unsigned int m = 3 ;
+  int what = 0 ;
+  unsigned int verbosity = 1 ;
+  char fmtv[UINT_FMT] ;
+  PROG = "s6-tcpserver" ;
+  newargv[1] = "-v" ;
+  newargv[2] = fmtv ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "qQv146Uc:C:b:u:g:G:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case '4' : if (what) dieusage() ; what = 4 ; break ;
+        case '6' : if (what) dieusage() ; what = 6 ; break ;
+        case 'q' : verbosity = 0 ; break ;
+        case 'Q' : verbosity = 1 ; break ;
+        case 'v' : verbosity = 2 ; break ;
+        case '1' : newargv[m++] = "-1" ; break ;
+        case 'U' : newargv[m++] = "-U" ; break ;
+        case 'c' : newargv[m++] = "-c" ; newargv[m++] = l.arg ; break ;
+        case 'C' : newargv[m++] = "-C" ; newargv[m++] = l.arg ; break ;
+        case 'b' : newargv[m++] = "-b" ; newargv[m++] = l.arg ; break ;
+        case 'u' : newargv[m++] = "-u" ; newargv[m++] = l.arg ; break ;
+        case 'g' : newargv[m++] = "-g" ; newargv[m++] = l.arg ; break ;
+        case 'G' : newargv[m++] = "-G" ; newargv[m++] = l.arg ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (argc < 3) dieusage() ;
+  fmtv[uint_fmt(fmtv, verbosity)] = 0 ;
+  newargv[m++] = 0 ;
+  if (!what)
+  {
+    ip46_t ip ;
+    if (!ip46_scan(argv[0], &ip)) dieusage() ;
+    what = ip46_is6(&ip) ? 6 : 4 ;
+  }
+  if (what == 6)
+  {
+    newargv[0] = "s6-tcpserver6" ;
+    path = S6_NETWORKING_BINPREFIX "s6-tcpserver6" ;
+  }
+  else
+  {
+    newargv[0] = "s6-tcpserver4" ;
+    path = S6_NETWORKING_BINPREFIX "s6-tcpserver4" ;
+  }
+  pathexec_run(path, newargv, envp) ;
+  strerr_dieexec(111, path) ;
+}
diff --git a/src/conn-tools/s6-tcpserver4.c b/src/conn-tools/s6-tcpserver4.c
new file mode 100644
index 0000000..5435f55
--- /dev/null
+++ b/src/conn-tools/s6-tcpserver4.c
@@ -0,0 +1,414 @@
+/* ISC license. */
+
+#ifndef _BSD_SOURCE
+#define _BSD_SOURCE
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <errno.h>
+#include <unistd.h>
+#include <limits.h>
+#include <grp.h>
+#include <signal.h>
+#include <skalibs/gccattributes.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/uint16.h>
+#include <skalibs/uint32.h>
+#include <skalibs/uint.h>
+#include <skalibs/gidstuff.h>
+#include <skalibs/setgroups.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/fmtscan.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/diuint32.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/sig.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/iopause.h>
+#include <skalibs/socket.h>
+
+#define ABSOLUTE_MAXCONN 1000
+
+#define USAGE "s6-tcpserver4 [ -v verbosity ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] ip port prog..."
+
+static unsigned int maxconn = 40 ;
+static unsigned int localmaxconn = 40 ;
+static unsigned int verbosity = 1 ;
+static int cont = 1 ;
+static diuint32 *pidip = 0 ;
+static unsigned int numconn = 0 ;
+static diuint32 *ipnum = 0 ;
+static unsigned int iplen = 0 ;
+
+static char fmtmaxconn[UINT_FMT+1] = "/" ;
+static char fmtlocalmaxconn[UINT_FMT+1] = "/" ;
+
+
+ /* Utility functions */
+
+static inline void dieusage ()
+{
+  strerr_dieusage(100, USAGE) ;
+}
+
+static inline void X (void)
+{
+  strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ;
+}
+
+
+ /* Lookup primitives */
+ 
+static unsigned int lookup_diuint32 (diuint32 const *, unsigned int, unsigned int) gccattr_pure ;
+static unsigned int lookup_diuint32 (diuint32 const *tab, unsigned int tablen, unsigned int key)
+{
+  register unsigned int i = 0 ;
+  for (; i < tablen ; i++) if (key == tab[i].left) break ;
+  return i ;
+}
+
+static inline unsigned int lookup_pid (uint32 pid)
+{
+  return lookup_diuint32(pidip, numconn, pid) ;
+}
+
+static inline unsigned int lookup_ip (uint32 ip)
+{
+  return lookup_diuint32(ipnum, iplen, ip) ;
+}
+
+
+ /* Logging */
+
+static void log_start (char const *ip, uint16 port)
+{
+  char fmtip[IP4_FMT] ;
+  char fmtport[UINT16_FMT] ;
+  fmtip[ip4_fmt(fmtip, ip)] = 0 ;
+  fmtport[uint16_fmt(fmtport, port)] = 0 ;
+  strerr_warni4x("starting - listening on ", fmtip, ":", fmtport) ;
+}
+
+static inline void log_exit (void)
+{
+  strerr_warni1x("exiting") ;
+}
+
+static void log_status (void)
+{
+  char fmt[UINT_FMT] ;
+  fmt[uint_fmt(fmt, numconn)] = 0 ;
+  strerr_warni3x("status: ", fmt, fmtmaxconn) ;
+}
+
+static void log_deny (uint32 ip, uint16 port, unsigned int num)
+{
+  char fmtip[UINT32_FMT] ;
+  char fmtport[UINT16_FMT] ;
+  char fmtnum[UINT_FMT] ;
+  fmtip[ip4_fmtu32(fmtip, ip)] = 0 ;
+  fmtport[uint16_fmt(fmtport, port)] = 0 ;
+  fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  strerr_warni7sys("deny ", fmtip, ":", fmtport, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_accept (uint32 pid, uint32 ip, uint16 port, unsigned int num)
+{
+  char fmtipport[IP4_FMT + UINT16_FMT + 1] ;
+  char fmtpid[UINT32_FMT] ;
+  char fmtnum[UINT_FMT] ;
+  register unsigned int n ;
+  n = ip4_fmtu32(fmtipport, ip) ;
+  fmtipport[n++] = ':' ;
+  n += uint16_fmt(fmtipport + n, port) ;
+  fmtipport[n] = 0 ;
+  fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  fmtpid[uint32_fmt(fmtpid, pid)] = 0 ;
+  strerr_warni7x("allow ", fmtipport, " pid ", fmtpid, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_close (uint32 pid, uint32 ip, int w)
+{
+  char fmtpid[UINT32_FMT] ;
+  char fmtip[IP4_FMT] = "?" ;
+  char fmtw[UINT_FMT] ;
+  fmtpid[uint32_fmt(fmtpid, pid)] = 0 ;
+  fmtip[ip4_fmtu32(fmtip, ip)] = 0 ;
+  fmtw[uint_fmt(fmtw, WIFSIGNALED(w) ? WTERMSIG(w) : WEXITSTATUS(w))] = 0 ;
+  strerr_warni6x("end pid ", fmtpid, " ip ", fmtip, WIFSIGNALED(w) ? " signal " : " exitcode ", fmtw) ;
+}
+
+
+ /* Signal handling */
+
+static void killthem (int sig)
+{
+  register unsigned int i = 0 ;
+  for (; i < numconn ; i++) kill(pidip[i].left, sig) ;
+}
+
+static void wait_children (void)
+{
+  for (;;)
+  {
+    unsigned int i ;
+    int w ;
+    register int pid = wait_nohang(&w) ;
+    if (pid < 0)
+      if (errno != ECHILD) strerr_diefu1sys(111, "wait_nohang") ;
+      else break ;
+    else if (!pid) break ;
+    i = lookup_pid(pid) ;
+    if (i < numconn) /* it's one of ours ! */
+    {
+      uint32 ip = pidip[i].right ;
+      register unsigned int j = lookup_ip(ip) ;
+      if (j >= iplen) X() ;
+      if (!--ipnum[j].right) ipnum[j] = ipnum[--iplen] ;
+      pidip[i] = pidip[--numconn] ;
+      if (verbosity >= 2)
+      {
+        log_close(pid, ip, w) ;
+        log_status() ;
+      }
+    }
+  }
+}
+
+static void handle_signals (void)
+{
+  for (;;) switch (selfpipe_read())
+  {
+    case -1 : strerr_diefu1sys(111, "read selfpipe") ;
+    case 0 : return ;
+    case SIGCHLD : wait_children() ; break ;
+    case SIGTERM :
+    {
+      if (verbosity >= 2)
+        strerr_warni3x("received ", "SIGTERM,", " quitting") ;
+      cont = 0 ;
+      break ;
+    }
+    case SIGHUP :
+    {
+      if (verbosity >= 2)
+        strerr_warni5x("received ", "SIGHUP,", " sending ", "SIGTERM+SIGCONT", " to all connections") ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGQUIT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGQUIT,", " sending ", "SIGTERM+SIGCONT", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGABRT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGABRT,", " sending ", "SIGKILL", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGKILL) ;
+      break ;
+    }
+    default : X() ;
+  }
+}
+
+
+ /* New connection handling */
+
+static void run_child (int, uint32, uint16, unsigned int, char const *const *, char const *const *) gccattr_noreturn ;
+static void run_child (int s, uint32 ip, uint16 port, unsigned int num, char const *const *argv, char const *const *envp)
+{
+  char fmt[74] ;
+  unsigned int n = 0 ;
+  PROG = "s6-tcpserver (child)" ;
+  if ((fd_move(0, s) < 0) || (fd_copy(1, 0) < 0))
+    strerr_diefu1sys(111, "move fds") ;
+  byte_copy(fmt+n, 22, "PROTO=TCP\0TCPREMOTEIP=") ; n += 22 ;
+  n += ip4_fmtu32(fmt+n, ip) ; fmt[n++] = 0 ;
+  byte_copy(fmt+n, 14, "TCPREMOTEPORT=") ; n += 14 ;
+  n += uint16_fmt(fmt+n, port) ; fmt[n++] = 0 ;
+  byte_copy(fmt+n, 11, "TCPCONNNUM=") ; n += 11 ;
+  n += uint_fmt(fmt+n, num) ; fmt[n++] = 0 ;
+  pathexec_r(argv, envp, env_len(envp), fmt, n) ;
+  strerr_dieexec(111, argv[0]) ;
+}
+
+static void new_connection (int s, uint32 ip, uint16 port, char const *const *argv, char const *const *envp)
+{
+  unsigned int i = lookup_ip(ip) ;
+  unsigned int num = (i < iplen) ? ipnum[i].right : 0 ;
+  register int pid ;
+  if (num >= localmaxconn)
+  {
+    log_deny(ip, port, num) ;
+    return ;
+  }
+  pid = fork() ;
+  if (pid < 0)
+  {
+    if (verbosity) strerr_warnwu1sys("fork") ;
+    return ;
+  }
+  else if (!pid)
+  {
+    selfpipe_finish() ;
+    run_child(s, ip, port, num+1, argv, envp) ;
+  }
+
+  if (i < iplen) ipnum[i].right = num + 1 ;
+  else
+  {
+    ipnum[iplen].left = ip ;
+    ipnum[iplen++].right = 1 ;
+  }
+  pidip[numconn].left = (uint32)pid ;
+  pidip[numconn++].right = ip ;
+  if (verbosity >= 2)
+  {
+    log_accept((uint32)pid, ip, port, ipnum[i].right) ;
+    log_status() ;
+  }
+}
+
+
+ /* And the main */
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  iopause_fd x[2] = { { -1, IOPAUSE_READ, 0 }, { -1, IOPAUSE_READ | IOPAUSE_EXCEPT, 0 } } ;
+  PROG = "s6-tcpserver4" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    unsigned int uid = 0, gid = 0 ;
+    gid_t gids[NGROUPS_MAX] ;
+    unsigned int gidn = 0 ;
+    unsigned int backlog = 20 ;
+    char ip[4] ;
+    int flag1 = 0 ;
+    uint16 port ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "1Uc:C:b:u:g:G:v:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case '1' : flag1 = 1 ; break ;
+        case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; break ;
+        case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; break ;
+        case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ;
+        case 'u' : if (!uint0_scan(l.arg, &uid)) dieusage() ; break ;
+        case 'g' : if (!uint0_scan(l.arg, &gid)) dieusage() ; break ;
+        case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn)) dieusage() ; break ;
+        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
+        case 'U' :
+        {
+          char const *x = env_get2(envp, "UID") ;
+          if (!x) strerr_dienotset(100, "UID") ;
+          if (!uint0_scan(x, &uid)) strerr_dieinvalid(100, "UID") ;
+          x = env_get2(envp, "GID") ;
+          if (!x) strerr_dienotset(100, "GID") ;
+          if (!uint0_scan(x, &gid)) strerr_dieinvalid(100, "GID") ;
+          x = env_get2(envp, "GIDLIST") ;
+          if (!x) strerr_dienotset(100, "GIDLIST") ;
+          if (!gid_scanlist(gids, NGROUPS_MAX, x, &gidn) && *x)
+            strerr_dieinvalid(100, "GIDLIST") ;
+          break ;
+        }
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+    if (argc < 3) dieusage() ;
+    if (!ip4_scan(argv[0], ip) || !uint160_scan(argv[1], &port)) dieusage() ;
+    fd_close(0) ;
+    if (!flag1) fd_close(1) ;
+    if (!maxconn) maxconn = 1 ;
+    if (maxconn > ABSOLUTE_MAXCONN) maxconn = ABSOLUTE_MAXCONN ;
+    if (localmaxconn > maxconn) localmaxconn = maxconn ;
+    x[1].fd = socket_tcp4() ;
+    if ((x[1].fd == -1) || (coe(x[1].fd) == -1))
+      strerr_diefu1sys(111, "create socket") ;
+    if (socket_bind4_reuse(x[1].fd, ip, port) < 0)
+      strerr_diefu2sys(111, "bind to ", argv[0]) ;
+    if (socket_listen(x[1].fd, backlog) == -1)
+      strerr_diefu1sys(111, "listen") ;
+    if (gidn && (setgroups(gidn, gids) < 0)) strerr_diefu1sys(111, "setgroups") ;
+    if (gid && (setgid(gid) < 0)) strerr_diefu1sys(111, "drop gid") ;
+    if (uid && (setuid(uid) < 0)) strerr_diefu1sys(111, "drop uid") ;
+
+    x[0].fd = selfpipe_init() ;
+    if (x[0].fd == -1) strerr_diefu1sys(111, "create selfpipe") ;
+    if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ;
+    {
+      sigset_t set ;
+      sigemptyset(&set) ;
+      sigaddset(&set, SIGCHLD) ;
+      sigaddset(&set, SIGTERM) ;
+      sigaddset(&set, SIGHUP) ;
+      sigaddset(&set, SIGQUIT) ;
+      sigaddset(&set, SIGABRT) ;
+      if (selfpipe_trapset(&set) < 0) strerr_diefu1sys(111, "trap signals") ;
+    }
+    if (flag1)
+    {
+      char fmt[UINT16_FMT] ;
+      unsigned int n = uint16_fmt(fmt, port) ;
+      fmt[n++] = '\n' ;
+      if (allwrite(1, fmt, n) < n) strerr_diefu1sys(111, "write to stdout") ;
+      fd_close(1) ;
+    }
+    fmtlocalmaxconn[1+uint_fmt(fmtlocalmaxconn+1, localmaxconn)] = 0 ;
+    if (verbosity >= 2)
+    {
+      fmtmaxconn[1+uint_fmt(fmtmaxconn+1, maxconn)] = 0 ;
+      log_start(ip, port) ;
+      log_status() ;
+    }
+  }
+
+  {
+    diuint32 inyostack[maxconn<<1] ;
+    pidip = inyostack ; ipnum = inyostack + maxconn ;
+    while (cont)
+    {
+      if (iopause(x, 1 + (numconn < maxconn), 0, 0) == -1)
+        strerr_diefu1sys(111, "iopause") ;
+
+      if (x[0].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with selfpipe") ;
+      if (x[0].revents & IOPAUSE_READ) handle_signals() ;
+      if (numconn < maxconn)
+      {
+        if (x[1].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with socket") ;
+        if (x[1].revents & IOPAUSE_READ)
+        {
+          char packedip[4] ;
+          uint16 port ;
+          register int fd = socket_accept4(x[1].fd, packedip, &port) ;
+          if (fd < 0)
+          {
+            if (verbosity) strerr_warnwu1sys("accept") ;
+          }
+          else
+          {
+            uint32 ip ;
+            uint32_unpack_big(packedip, &ip) ;
+            new_connection(fd, ip, port, argv+2, envp) ;
+            fd_close(fd) ;
+          }
+        }
+      }
+    }
+  }
+  if (verbosity >= 2) log_exit() ;
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-tcpserver6.c b/src/conn-tools/s6-tcpserver6.c
new file mode 100644
index 0000000..9b27f42
--- /dev/null
+++ b/src/conn-tools/s6-tcpserver6.c
@@ -0,0 +1,412 @@
+/* ISC license. */
+
+#ifndef _BSD_SOURCE
+#define _BSD_SOURCE
+#endif
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <errno.h>
+#include <unistd.h>
+#include <limits.h>
+#include <grp.h>
+#include <signal.h>
+#include <skalibs/gccattributes.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/uint16.h>
+#include <skalibs/uint.h>
+#include <skalibs/gidstuff.h>
+#include <skalibs/setgroups.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/fmtscan.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/sig.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/iopause.h>
+#include <skalibs/socket.h>
+
+#define ABSOLUTE_MAXCONN 1000
+
+#define USAGE "s6-tcpserver6 [ -v verbosity ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] ip6 port prog..."
+
+typedef struct ipnum_s ipnum_t, *ipnum_t_ref ;
+struct ipnum_s
+{
+  char ip[16] ;
+  unsigned int num ;
+} ;
+#define IPNUM_ZERO { "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 0 }
+
+static unsigned int maxconn = 40 ;
+static unsigned int localmaxconn = 40 ;
+static unsigned int verbosity = 1 ;
+static int cont = 1 ;
+static ipnum_t_ref pidip = 0 ;
+static unsigned int numconn = 0 ;
+static ipnum_t_ref ipnum = 0 ;
+static unsigned int iplen = 0 ;
+
+static char fmtmaxconn[UINT_FMT+1] = "/" ;
+static char fmtlocalmaxconn[UINT_FMT+1] = "/" ;
+
+
+ /* Utility functions */
+
+static inline void dieusage ()
+{
+  strerr_dieusage(100, USAGE) ;
+}
+
+static inline void X (void)
+{
+  strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ;
+}
+
+
+ /* Lookup primitives */
+ 
+static unsigned int lookup_pid (unsigned int pid)
+{
+  register unsigned int i = 0 ;
+  for (; i < numconn ; i++) if (pid == pidip[i].num) break ;
+  return i ;
+}
+
+static unsigned int lookup_ip (char const *ip)
+{
+  register unsigned int i = 0 ;
+  for (; i < iplen ; i++) if (!byte_diff(ip, 16, ipnum[i].ip)) break ;
+  return i ;
+}
+
+
+ /* Logging */
+
+static void log_start (char const *ip, uint16 port)
+{
+  char fmtip[IP6_FMT] ;
+  char fmtport[UINT16_FMT] ;
+  fmtip[ip6_fmt(fmtip, ip)] = 0 ;
+  fmtport[uint16_fmt(fmtport, port)] = 0 ;
+  strerr_warni4x("starting - listening on ", fmtip, " port ", fmtport) ;
+}
+
+static inline void log_exit (void)
+{
+  strerr_warni1x("exiting") ;
+}
+
+static void log_status (void)
+{
+  char fmt[UINT_FMT] ;
+  fmt[uint_fmt(fmt, numconn)] = 0 ;
+  strerr_warni3x("status: ", fmt, fmtmaxconn) ;
+}
+
+static void log_deny (char const *ip, uint16 port, unsigned int num)
+{
+  char fmtip[IP6_FMT] ;
+  char fmtport[UINT16_FMT] ;
+  char fmtnum[UINT_FMT] ;
+  fmtip[ip6_fmt(fmtip, ip)] = 0 ;
+  fmtport[uint16_fmt(fmtport, port)] = 0 ;
+  fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  strerr_warni7sys("deny ", fmtip, " port ", fmtport, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_accept (unsigned int pid, char const *ip, uint16 port, unsigned int num)
+{
+  char fmtipport[IP6_FMT + UINT16_FMT + 6] ;
+  char fmtpid[UINT_FMT] ;
+  char fmtnum[UINT_FMT] ;
+  register unsigned int n ;
+  n = ip6_fmt(fmtipport, ip) ;
+  byte_copy(fmtipport + n, 6, " port ") ; n += 6 ;
+  n += uint16_fmt(fmtipport + n, port) ;
+  fmtipport[n] = 0 ;
+  fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  strerr_warni7x("allow ", fmtipport, " pid ", fmtpid, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_close (unsigned int pid, char const *ip, int w)
+{
+  char fmtpid[UINT_FMT] ;
+  char fmtip[IP6_FMT] = "?" ;
+  char fmtw[UINT_FMT] ;
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  fmtip[ip6_fmt(fmtip, ip)] = 0 ;
+  fmtw[uint_fmt(fmtw, WIFSIGNALED(w) ? WTERMSIG(w) : WEXITSTATUS(w))] = 0 ;
+  strerr_warni6x("end pid ", fmtpid, " ip ", fmtip, WIFSIGNALED(w) ? " signal " : " exitcode ", fmtw) ;
+}
+
+
+ /* Signal handling */
+
+static void killthem (int sig)
+{
+  register unsigned int i = 0 ;
+  for (; i < numconn ; i++) kill(pidip[i].num, sig) ;
+}
+
+static void wait_children (void)
+{
+  for (;;)
+  {
+    unsigned int i ;
+    int w ;
+    register int pid = wait_nohang(&w) ;
+    if (pid < 0)
+      if (errno != ECHILD) strerr_diefu1sys(111, "wait_nohang") ;
+      else break ;
+    else if (!pid) break ;
+    i = lookup_pid(pid) ;
+    if (i < numconn) /* it's one of ours ! */
+    {
+      register unsigned int j = lookup_ip(pidip[i].ip) ;
+      if (j >= iplen) X() ;
+      if (!--ipnum[j].num) ipnum[j] = ipnum[--iplen] ;
+      --numconn ;
+      if (verbosity >= 2)
+      {
+        log_close(pid, pidip[i].ip, w) ;
+        log_status() ;
+      }
+      pidip[i] = pidip[numconn] ;
+    }
+  }
+}
+
+static void handle_signals (void)
+{
+  for (;;) switch (selfpipe_read())
+  {
+    case -1 : strerr_diefu1sys(111, "read selfpipe") ;
+    case 0 : return ;
+    case SIGCHLD : wait_children() ; break ;
+    case SIGTERM :
+    {
+      if (verbosity >= 2)
+        strerr_warni3x("received ", "SIGTERM,", " quitting") ;
+      cont = 0 ;
+      break ;
+    }
+    case SIGHUP :
+    {
+      if (verbosity >= 2)
+        strerr_warni5x("received ", "SIGHUP,", " sending ", "SIGTERM+SIGCONT", " to all connections") ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGQUIT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGQUIT,", " sending ", "SIGTERM+SIGCONT", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGABRT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGABRT,", " sending ", "SIGKILL", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGKILL) ;
+      break ;
+    }
+    default : X() ;
+  }
+}
+
+
+ /* New connection handling */
+
+static void run_child (int, char const *, uint16, unsigned int, char const *const *, char const *const *) gccattr_noreturn ;
+static void run_child (int s, char const *ip, uint16 port, unsigned int num, char const *const *argv, char const *const *envp)
+{
+  char fmt[98] ;
+  unsigned int n = 0 ;
+  PROG = "s6-tcpserver6 (child)" ;
+  if ((fd_move(0, s) < 0) || (fd_copy(1, 0) < 0))
+    strerr_diefu1sys(111, "move fds") ;
+  byte_copy(fmt+n, 24, "PROTO=TCP\0TCPREMOTEIP=") ; n += 22 ;
+  n += ip6_fmt(fmt+n, ip) ; fmt[n++] = 0 ;
+  byte_copy(fmt+n, 14, "TCPREMOTEPORT=") ; n += 14 ;
+  n += uint16_fmt(fmt+n, port) ; fmt[n++] = 0 ;
+  byte_copy(fmt+n, 11, "TCPCONNNUM=") ; n += 11 ;
+  n += uint_fmt(fmt+n, num) ; fmt[n++] = 0 ;
+  pathexec_r(argv, envp, env_len(envp), fmt, n) ;
+  strerr_dieexec(111, argv[0]) ;
+}
+
+static void new_connection (int s, char const *ip, uint16 port, char const *const *argv, char const *const *envp)
+{
+  unsigned int i = lookup_ip(ip) ;
+  unsigned int num = (i < iplen) ? ipnum[i].num : 0 ;
+  register int pid ;
+  if (num >= localmaxconn)
+  {
+    log_deny(ip, port, num) ;
+    return ;
+  }
+  pid = fork() ;
+  if (pid < 0)
+  {
+    if (verbosity) strerr_warnwu1sys("fork") ;
+    return ;
+  }
+  else if (!pid)
+  {
+    selfpipe_finish() ;
+    run_child(s, ip, port, num+1, argv, envp) ;
+  }
+
+  if (i < iplen) ipnum[i].num = num + 1 ;
+  else
+  {
+    byte_copy(ipnum[iplen].ip, 16, ip) ;
+    ipnum[iplen++].num = 1 ;
+  }
+  pidip[numconn].num = pid ;
+  byte_copy(pidip[numconn++].ip, 16, ip) ;
+  if (verbosity >= 2)
+  {
+    log_accept(pid, ip, port, ipnum[i].num) ;
+    log_status() ;
+  }
+}
+
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  iopause_fd x[2] = { { -1, IOPAUSE_READ, 0 }, { -1, IOPAUSE_READ | IOPAUSE_EXCEPT, 0 } } ;
+  PROG = "s6-tcpserver6" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    unsigned int uid = 0, gid = 0 ;
+    gid_t gids[NGROUPS_MAX] ;
+    unsigned int gidn = 0 ;
+    unsigned int backlog = 20 ;
+    char ip[16] ;
+    int flag1 = 0 ;
+    uint16 port ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "1Uc:C:b:u:g:G:v:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case '1' : flag1 = 1 ; break ;
+        case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; break ;
+        case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; break ;
+        case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ;
+        case 'u' : if (!uint0_scan(l.arg, &uid)) dieusage() ; break ;
+        case 'g' : if (!uint0_scan(l.arg, &gid)) dieusage() ; break ;
+        case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn)) dieusage() ; break ;
+        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
+        case 'U' :
+        {
+          char const *x = env_get2(envp, "UID") ;
+          if (!x) strerr_dienotset(100, "UID") ;
+          if (!uint0_scan(x, &uid)) strerr_dieinvalid(100, "UID") ;
+          x = env_get2(envp, "GID") ;
+          if (!x) strerr_dienotset(100, "GID") ;
+          if (!uint0_scan(x, &gid)) strerr_dieinvalid(100, "GID") ;
+          x = env_get2(envp, "GIDLIST") ;
+          if (!x) strerr_dienotset(100, "GIDLIST") ;
+          if (!gid_scanlist(gids, NGROUPS_MAX, x, &gidn) && *x)
+            strerr_dieinvalid(100, "GIDLIST") ;
+          break ;
+        }
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+    if (argc < 3) dieusage() ;
+    if (!ip6_scan(argv[0], ip) || !uint160_scan(argv[1], &port)) dieusage() ;
+    fd_close(0) ;
+    if (!flag1) fd_close(1) ;
+    if (!maxconn) maxconn = 1 ;
+    if (maxconn > ABSOLUTE_MAXCONN) maxconn = ABSOLUTE_MAXCONN ;
+    if (localmaxconn > maxconn) localmaxconn = maxconn ;
+    x[1].fd = socket_tcp6() ;
+    if ((x[1].fd == -1) || (coe(x[1].fd) == -1))
+      strerr_diefu1sys(111, "create socket") ;
+    if (socket_bind6_reuse(x[1].fd, ip, port) < 0)
+      strerr_diefu2sys(111, "bind to ", argv[0]) ;
+    if (socket_listen(x[1].fd, backlog) == -1)
+      strerr_diefu1sys(111, "listen") ;
+    if (gidn && (setgroups(gidn, gids) < 0)) strerr_diefu1sys(111, "setgroups") ;
+    if (gid && (setgid(gid) < 0)) strerr_diefu1sys(111, "drop gid") ;
+    if (uid && (setuid(uid) < 0)) strerr_diefu1sys(111, "drop uid") ;
+
+    x[0].fd = selfpipe_init() ;
+    if (x[0].fd == -1) strerr_diefu1sys(111, "create selfpipe") ;
+    if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ;
+    {
+      sigset_t set ;
+      sigemptyset(&set) ;
+      sigaddset(&set, SIGCHLD) ;
+      sigaddset(&set, SIGTERM) ;
+      sigaddset(&set, SIGHUP) ;
+      sigaddset(&set, SIGQUIT) ;
+      sigaddset(&set, SIGABRT) ;
+      if (selfpipe_trapset(&set) < 0) strerr_diefu1sys(111, "trap signals") ;
+    }
+    if (flag1)
+    {
+      char fmt[UINT16_FMT] ;
+      unsigned int n = uint16_fmt(fmt, port) ;
+      fmt[n++] = '\n' ;
+      if (allwrite(1, fmt, n) < n) strerr_diefu1sys(111, "write to stdout") ;
+      fd_close(1) ;
+    }
+    fmtlocalmaxconn[1+uint_fmt(fmtlocalmaxconn+1, localmaxconn)] = 0 ;
+    if (verbosity >= 2)
+    {
+      fmtmaxconn[1+uint_fmt(fmtmaxconn+1, maxconn)] = 0 ;
+      log_start(ip, port) ;
+      log_status() ;
+    }
+  }
+
+  {
+    ipnum_t inyostack[maxconn<<1] ;
+    pidip = inyostack ; ipnum = inyostack + maxconn ;
+    while (cont)
+    {
+      if (iopause(x, 1 + (numconn < maxconn), 0, 0) == -1)
+        strerr_diefu1sys(111, "iopause") ;
+
+      if (x[0].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with selfpipe") ;
+      if (x[0].revents & IOPAUSE_READ) handle_signals() ;
+      if (numconn < maxconn)
+      {
+        if (x[1].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with socket") ;
+        if (x[1].revents & IOPAUSE_READ)
+        {
+          char ip[16] ;
+          uint16 port ;
+          register int fd = socket_accept6(x[1].fd, ip, &port) ;
+          if (fd < 0)
+          {
+            if (verbosity) strerr_warnwu1sys("accept") ;
+          }
+          else
+          {
+            new_connection(fd, ip, port, argv+2, envp) ;
+            fd_close(fd) ;
+          }
+        }
+      }
+    }
+  }
+  if (verbosity >= 2) log_exit() ;
+  return 0 ;
+}
diff --git a/src/conn-tools/seekablepipe.c b/src/conn-tools/seekablepipe.c
new file mode 100644
index 0000000..611f227
--- /dev/null
+++ b/src/conn-tools/seekablepipe.c
@@ -0,0 +1,41 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/iobuffer.h>
+#include <skalibs/djbunix.h>
+
+#define USAGE "seekablepipe tempfile prog..."
+
+#define N 8192
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  iobuffer b ;
+  int fdr, fdw ;
+  int r ;
+  PROG = "seekablepipe" ;
+  if (argc < 3) strerr_dieusage(100, USAGE) ;
+  fdw = open_trunc(argv[1]) ;
+  if (fdw < 0)
+    strerr_diefu2sys(111, "create temporary ", argv[1]) ;
+  fdr = open_readb(argv[1]) ;
+  if (fdr < 0)
+    strerr_diefu3sys(111, "open ", argv[1], " for reading") ;
+  if (unlink(argv[1]) < 0)
+    strerr_diefu2sys(111, "unlink ", argv[1]) ;
+  if (ndelay_off(fdw) < 0)
+    strerr_diefu1sys(111, "set fdw blocking") ;
+  if (!iobuffer_init(&b, 0, fdw))
+    strerr_diefu1sys(111, "iobuffer_init") ;
+  while ((r = iobuffer_fill(&b)) > 0)
+    if (!iobuffer_flush(&b))
+      strerr_diefu2sys(111, "write to ", argv[1]) ;
+  if (r < 0) strerr_diefu1sys(111, "read from stdin") ;
+  iobuffer_finish(&b) ;
+  fd_close(fdw) ;
+  if (fd_move(0, fdr) < 0)
+    strerr_diefu1sys(111, "move fdr to stdin") ;
+  pathexec_run(argv[2], argv+2, envp) ;
+  strerr_dieexec(111, argv[2]) ;
+}