Merge branch 'busybox' into merge

31 files changed, 243 insertions, 269 deletions

diff --git a/networking/arping.c b/networking/arping.c
index 71672957e..f9967d81e 100644
--- a/networking/arping.c
+++ b/networking/arping.c
@@ -295,8 +295,8 @@ int arping_main(int argc UNUSED_PARAM, char **argv)
 
         sock_fd = xsocket(AF_PACKET, SOCK_DGRAM, 0);
 
-        // Drop suid root privileges
-        // Need to remove SUID_NEVER from applets.h for this to work
+        // If you ever change BB_SUID_DROP to BB_SUID_REQUIRE,
+        // drop suid root privileges here:
         //xsetuid(getuid());
 
         {
@@ -306,9 +306,9 @@ int arping_main(int argc UNUSED_PARAM, char **argv)
                 /* Dad also sets quit_on_reply.
                  * Advert also sets unsolicited.
                  */
-                opt_complementary = "=1:Df:AU";
-                opt = getopt32(argv, "DUAqfbc:+w:I:s:",
-                                &count, &str_timeout, &device, &source);
+                opt = getopt32(argv, "^" "DUAqfbc:+w:I:s:" "\0" "=1:Df:AU",
+                                &count, &str_timeout, &device, &source
+                );
                 if (opt & 0x80) /* -w: timeout */
                         timeout_us = xatou_range(str_timeout, 0, INT_MAX/2000000) * 1000000 + 500000;
                 //if (opt & 0x200) /* -s: source */
diff --git a/networking/brctl.c b/networking/brctl.c
index 690791e4c..5d5f0af30 100644
--- a/networking/brctl.c
+++ b/networking/brctl.c
@@ -39,7 +39,7 @@
 //config:       Add support for option which prints the current config:
 //config:               show
 
-//applet:IF_BRCTL(APPLET(brctl, BB_DIR_USR_SBIN, BB_SUID_DROP))
+//applet:IF_BRCTL(APPLET_NOEXEC(brctl, brctl, BB_DIR_USR_SBIN, BB_SUID_DROP, brctl))
 
 //kbuild:lib-$(CONFIG_BRCTL) += brctl.o
 
diff --git a/networking/ether-wake.c b/networking/ether-wake.c
index 52522e76d..6677f07d5 100644
--- a/networking/ether-wake.c
+++ b/networking/ether-wake.c
@@ -212,8 +212,7 @@ int ether_wake_main(int argc UNUSED_PARAM, char **argv)
         struct whereto_t whereto;  /* who to wake up */
 
         /* handle misc user options */
-        opt_complementary = "=1";
-        flags = getopt32(argv, "bi:p:", &ifname, &pass);
+        flags = getopt32(argv, "^" "bi:p:" "\0" "=1", &ifname, &pass);
         if (flags & 4) /* -p */
                 wol_passwd_sz = get_wol_pw(pass, wol_passwd);
         flags &= 1; /* we further interested only in -b [bcast] flag */
diff --git a/networking/ftpd.c b/networking/ftpd.c
index c562c2886..8af5acac2 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -1174,17 +1174,20 @@ int ftpd_main(int argc UNUSED_PARAM, char **argv)
         abs_timeout = 1 * 60 * 60;
         verbose_S = 0;
         G.timeout = 2 * 60;
-        opt_complementary = "vv:SS";
 #if BB_MMU
-        opts = getopt32(argv,    "vS"
-                IF_FEATURE_FTPD_WRITE("w") "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:"),
+        opts = getopt32(argv, "^"    "vS"
+                IF_FEATURE_FTPD_WRITE("w") "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:")
+                "\0" "vv:SS",
                 &G.timeout, &abs_timeout, IF_FEATURE_FTPD_AUTHENTICATION(&anon_opt,)
-                &G.verbose, &verbose_S);
+                &G.verbose, &verbose_S
+        );
 #else
-        opts = getopt32(argv, "l1AvS"
-                IF_FEATURE_FTPD_WRITE("w") "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:"),
+        opts = getopt32(argv, "^" "l1AvS"
+                IF_FEATURE_FTPD_WRITE("w") "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:")
+                "\0" "vv:SS",
                 &G.timeout, &abs_timeout, IF_FEATURE_FTPD_AUTHENTICATION(&anon_opt,)
-                &G.verbose, &verbose_S);
+                &G.verbose, &verbose_S
+        );
         if (opts & (OPT_l|OPT_1)) {
                 /* Our secret backdoor to ls */
                 if (fchdir(3) != 0)
diff --git a/networking/ftpgetput.c b/networking/ftpgetput.c
index cb0a96b59..029587aa2 100644
--- a/networking/ftpgetput.c
+++ b/networking/ftpgetput.c
@@ -39,37 +39,20 @@
 //usage:       "[OPTIONS] HOST [LOCAL_FILE] REMOTE_FILE"
 //usage:#define ftpget_full_usage "\n\n"
 //usage:       "Download a file via FTP\n"
-//usage:        IF_FEATURE_FTPGETPUT_LONG_OPTIONS(
-//usage:     "\n        -c,--continue           Continue previous transfer"
-//usage:     "\n        -v,--verbose            Verbose"
-//usage:     "\n        -u,--username USER      Username"
-//usage:     "\n        -p,--password PASS      Password"
-//usage:     "\n        -P,--port NUM           Port"
-//usage:        )
-//usage:        IF_NOT_FEATURE_FTPGETPUT_LONG_OPTIONS(
 //usage:     "\n        -c      Continue previous transfer"
 //usage:     "\n        -v      Verbose"
 //usage:     "\n        -u USER Username"
 //usage:     "\n        -p PASS Password"
 //usage:     "\n        -P NUM  Port"
-//usage:        )
 //usage:
 //usage:#define ftpput_trivial_usage
 //usage:       "[OPTIONS] HOST [REMOTE_FILE] LOCAL_FILE"
 //usage:#define ftpput_full_usage "\n\n"
 //usage:       "Upload a file to a FTP server\n"
-//usage:        IF_FEATURE_FTPGETPUT_LONG_OPTIONS(
-//usage:     "\n        -v,--verbose            Verbose"
-//usage:     "\n        -u,--username USER      Username"
-//usage:     "\n        -p,--password PASS      Password"
-//usage:     "\n        -P,--port NUM           Port"
-//usage:        )
-//usage:        IF_NOT_FEATURE_FTPGETPUT_LONG_OPTIONS(
 //usage:     "\n        -v      Verbose"
 //usage:     "\n        -u USER Username"
 //usage:     "\n        -p PASS Password"
 //usage:     "\n        -P NUM  Port number"
-//usage:        )
 
 #include "libbb.h"
 #include "common_bufsiz.h"
@@ -367,12 +350,15 @@ int ftpgetput_main(int argc UNUSED_PARAM, char **argv)
         /*
          * Decipher the command line
          */
+        /* must have 2 to 3 params; -v and -c count */
+#define OPTSTRING "^cvu:p:P:" "\0" "-2:?3:vv:cc"
 #if ENABLE_FEATURE_FTPGETPUT_LONG_OPTIONS
-        applet_long_options = ftpgetput_longopts;
+        getopt32long(argv, OPTSTRING, ftpgetput_longopts,
+#else
+        getopt32(argv, OPTSTRING,
 #endif
-        opt_complementary = "-2:vv:cc"; /* must have 2 to 3 params; -v and -c count */
-        getopt32(argv, "cvu:p:P:", &user, &password, &port,
-                                        &verbose_flag, &do_continue);
+                        &user, &password, &port, &verbose_flag, &do_continue
+        );
         argv += optind;
 
         /* We want to do exactly _one_ DNS lookup, since some
diff --git a/networking/hostname.c b/networking/hostname.c
index 4b305d2b6..d87f6562f 100644
--- a/networking/hostname.c
+++ b/networking/hostname.c
@@ -22,9 +22,9 @@
 //config:       help
 //config:       Alias to "hostname -d".
 
-//                        APPLET_ODDNAME:name           main      location    suid_type     help
-//applet:IF_DNSDOMAINNAME(APPLET_ODDNAME(dnsdomainname, hostname, BB_DIR_BIN, BB_SUID_DROP, dnsdomainname))
-//applet:IF_HOSTNAME(APPLET(hostname, BB_DIR_BIN, BB_SUID_DROP))
+//                        APPLET_NOEXEC:name           main      location    suid_type     help
+//applet:IF_DNSDOMAINNAME(APPLET_NOEXEC(dnsdomainname, hostname, BB_DIR_BIN, BB_SUID_DROP, dnsdomainname))
+//applet:IF_HOSTNAME(     APPLET_NOEXEC(hostname,      hostname, BB_DIR_BIN, BB_SUID_DROP, hostname     ))
 
 //kbuild: lib-$(CONFIG_HOSTNAME) += hostname.o
 //kbuild: lib-$(CONFIG_DNSDOMAINNAME) += hostname.o
@@ -114,7 +114,7 @@ static void do_sethostname(char *s, int isfile)
  *  { bbox: not supported }
  * -F, --file filename
  *  Read the host name from the specified file. Comments (lines
- *  starting with a `#') are ignored.
+ *  starting with a '#') are ignored.
  */
 int hostname_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int hostname_main(int argc UNUSED_PARAM, char **argv)
@@ -132,8 +132,9 @@ int hostname_main(int argc UNUSED_PARAM, char **argv)
         char *buf;
         char *hostname_str;
 
-#if ENABLE_LONG_OPTS
-        applet_long_options =
+        /* dnsdomainname from net-tools 1.60, hostname 1.100 (2001-04-14),
+         * supports hostname's options too (not just -v as manpage says) */
+        opts = getopt32(argv, "dfisF:v", &hostname_str,
                 "domain\0"     No_argument "d"
                 "fqdn\0"       No_argument "f"
         //Enable if seen in active use in some distro:
@@ -142,12 +143,7 @@ int hostname_main(int argc UNUSED_PARAM, char **argv)
         //      "short\0"      No_argument "s"
         //      "verbose\0"    No_argument "v"
                 "file\0"       No_argument "F"
-                ;
-
-#endif
-        /* dnsdomainname from net-tools 1.60, hostname 1.100 (2001-04-14),
-         * supports hostname's options too (not just -v as manpage says) */
-        opts = getopt32(argv, "dfisF:v", &hostname_str);
+        );
         argv += optind;
         buf = safe_gethostname();
         if (ENABLE_DNSDOMAINNAME) {
diff --git a/networking/httpd.c b/networking/httpd.c
index 079145757..9369de824 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -2636,17 +2636,19 @@ int httpd_main(int argc UNUSED_PARAM, char **argv)
 #endif
 
         home_httpd = xrealloc_getcwd_or_warn(NULL);
-        /* -v counts, -i implies -f */
-        opt_complementary = "vv:if";
         /* We do not "absolutize" path given by -h (home) opt.
          * If user gives relative path in -h,
          * $SCRIPT_FILENAME will not be set. */
-        opt = getopt32(argv, "c:d:h:"
+        opt = getopt32(argv, "^"
+                        "c:d:h:"
                         IF_FEATURE_HTTPD_ENCODE_URL_STR("e:")
                         IF_FEATURE_HTTPD_BASIC_AUTH("r:")
                         IF_FEATURE_HTTPD_AUTH_MD5("m:")
                         IF_FEATURE_HTTPD_SETUID("u:")
-                        "p:ifv",
+                        "p:ifv"
+                        "\0"
+                        /* -v counts, -i implies -f */
+                        "vv:if",
                         &opt_c_configFile, &url_for_decode, &home_httpd
                         IF_FEATURE_HTTPD_ENCODE_URL_STR(, &url_for_encode)
                         IF_FEATURE_HTTPD_BASIC_AUTH(, &g_realm)
diff --git a/networking/ifenslave.c b/networking/ifenslave.c
index 26e5e8cf3..5e769b61d 100644
--- a/networking/ifenslave.c
+++ b/networking/ifenslave.c
@@ -105,7 +105,7 @@
 //config:       Userspace application to bind several interfaces
 //config:       to a logical interface (use with kernel bonding driver).
 
-//applet:IF_IFENSLAVE(APPLET(ifenslave, BB_DIR_SBIN, BB_SUID_DROP))
+//applet:IF_IFENSLAVE(APPLET_NOEXEC(ifenslave, ifenslave, BB_DIR_SBIN, BB_SUID_DROP, ifenslave))
 
 //kbuild:lib-$(CONFIG_IFENSLAVE) += ifenslave.o interface.o
 
@@ -113,10 +113,10 @@
 //usage:       "[-cdf] MASTER_IFACE SLAVE_IFACE..."
 //usage:#define ifenslave_full_usage "\n\n"
 //usage:       "Configure network interfaces for parallel routing\n"
-//usage:     "\n        -c,--change-active      Change active slave"
-//usage:     "\n        -d,--detach             Remove slave interface from bonding device"
-//usage:     "\n        -f,--force              Force, even if interface is not Ethernet"
-/* //usage:  "\n        -r,--receive-slave      Create a receive-only slave" */
+//usage:     "\n        -c      Change active slave"
+//usage:     "\n        -d      Remove slave interface from bonding device"
+//usage:     "\n        -f      Force, even if interface is not Ethernet"
+/* //usage:  "\n        -r      Create a receive-only slave" */
 //usage:
 //usage:#define ifenslave_example_usage
 //usage:       "To create a bond device, simply follow these three steps:\n"
@@ -493,19 +493,15 @@ int ifenslave_main(int argc UNUSED_PARAM, char **argv)
                 OPT_d = (1 << 1),
                 OPT_f = (1 << 2),
         };
-#if ENABLE_LONG_OPTS
-        static const char ifenslave_longopts[] ALIGN1 =
+
+        INIT_G();
+
+        opt = getopt32long(argv, "cdfa",
                 "change-active\0"  No_argument "c"
                 "detach\0"         No_argument "d"
                 "force\0"          No_argument "f"
                 /* "all-interfaces\0" No_argument "a" */
-                ;
-
-        applet_long_options = ifenslave_longopts;
-#endif
-        INIT_G();
-
-        opt = getopt32(argv, "cdfa");
+        );
         argv += optind;
         if (opt & (opt-1)) /* Only one option can be given */
                 bb_show_usage();
diff --git a/networking/inetd.c b/networking/inetd.c
index 91545d0a3..67984accb 100644
--- a/networking/inetd.c
+++ b/networking/inetd.c
@@ -217,7 +217,6 @@
 //config:       bool "Support RPC services"
 //config:       default n  # very rarely used, and needs Sun RPC support in libc
 //config:       depends on INETD
-//config:       select FEATURE_HAVE_RPC
 //config:       help
 //config:       Support Sun-RPC based services
 
diff --git a/networking/ipcalc.c b/networking/ipcalc.c
index 9888a6ff2..cdae8eea8 100644
--- a/networking/ipcalc.c
+++ b/networking/ipcalc.c
@@ -31,7 +31,7 @@
 //config:       Adds the options hostname, prefix and silent to the output of
 //config:       "ipcalc".
 
-//applet:IF_IPCALC(APPLET(ipcalc, BB_DIR_BIN, BB_SUID_DROP))
+//applet:IF_IPCALC(APPLET_NOEXEC(ipcalc, ipcalc, BB_DIR_BIN, BB_SUID_DROP, ipcalc))
 
 //kbuild:lib-$(CONFIG_IPCALC) += ipcalc.o
 
@@ -39,26 +39,14 @@
 //usage:       "[OPTIONS] ADDRESS"
 //usage:       IF_FEATURE_IPCALC_FANCY("[/PREFIX]") " [NETMASK]"
 //usage:#define ipcalc_full_usage "\n\n"
-//usage:       "Calculate IP network settings from a IP address\n"
-//usage:        IF_FEATURE_IPCALC_LONG_OPTIONS(
-//usage:     "\n        -b,--broadcast  Display calculated broadcast address"
-//usage:     "\n        -n,--network    Display calculated network address"
-//usage:     "\n        -m,--netmask    Display default netmask for IP"
+//usage:       "Calculate and display network settings from IP address\n"
+//usage:     "\n        -b      Broadcast address"
+//usage:     "\n        -n      Network address"
+//usage:     "\n        -m      Default netmask for IP"
 //usage:        IF_FEATURE_IPCALC_FANCY(
-//usage:     "\n        -p,--prefix     Display the prefix for IP/NETMASK"
-//usage:     "\n        -h,--hostname   Display first resolved host name"
-//usage:     "\n        -s,--silent     Don't ever display error messages"
-//usage:        )
-//usage:        )
-//usage:        IF_NOT_FEATURE_IPCALC_LONG_OPTIONS(
-//usage:     "\n        -b      Display calculated broadcast address"
-//usage:     "\n        -n      Display calculated network address"
-//usage:     "\n        -m      Display default netmask for IP"
-//usage:        IF_FEATURE_IPCALC_FANCY(
-//usage:     "\n        -p      Display the prefix for IP/NETMASK"
-//usage:     "\n        -h      Display first resolved host name"
-//usage:     "\n        -s      Don't ever display error messages"
-//usage:        )
+//usage:     "\n        -p      Prefix for IP/NETMASK"
+//usage:     "\n        -h      Resolved host name"
+//usage:     "\n        -s      No error messages"
 //usage:        )
 
 #include "libbb.h"
@@ -120,6 +108,11 @@ int get_prefix(unsigned long netmask);
                 "silent\0"    No_argument "s" // don’t ever display error messages
 # endif
                 ;
+# define GETOPT32 getopt32long
+# define LONGOPTS ,ipcalc_longopts
+#else
+# define GETOPT32 getopt32
+# define LONGOPTS
 #endif
 
 int ipcalc_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
@@ -137,11 +130,11 @@ int ipcalc_main(int argc UNUSED_PARAM, char **argv)
 #define ipaddr    (s_ipaddr.s_addr)
         char *ipstr;
 
-#if ENABLE_FEATURE_IPCALC_LONG_OPTIONS
-        applet_long_options = ipcalc_longopts;
-#endif
-        opt_complementary = "-1:?2"; /* minimum 1 arg, maximum 2 args */
-        opt = getopt32(argv, "mbn" IF_FEATURE_IPCALC_FANCY("phs"));
+        opt = GETOPT32(argv, "^"
+                        "mbn" IF_FEATURE_IPCALC_FANCY("phs")
+                        "\0" "-1:?2"/*min 1, max 2 args*/
+                        LONGOPTS
+        );
         argv += optind;
         if (opt & SILENT)
                 logmode = LOGMODE_NONE; /* suppress error_msg() output */
diff --git a/networking/nameif.c b/networking/nameif.c
index 31ee98a39..1f2695495 100644
--- a/networking/nameif.c
+++ b/networking/nameif.c
@@ -40,7 +40,7 @@
 //config:               new_interface_name  mac=00:80:C8:38:91:B5
 //config:               new_interface_name  00:80:C8:38:91:B5
 
-//applet:IF_NAMEIF(APPLET(nameif, BB_DIR_SBIN, BB_SUID_DROP))
+//applet:IF_NAMEIF(APPLET_NOEXEC(nameif, nameif, BB_DIR_SBIN, BB_SUID_DROP, nameif))
 
 //kbuild:lib-$(CONFIG_NAMEIF) += nameif.o
 
diff --git a/networking/nbd-client.c b/networking/nbd-client.c
index a5e25e6aa..cf1857231 100644
--- a/networking/nbd-client.c
+++ b/networking/nbd-client.c
@@ -7,7 +7,7 @@
 #include <netinet/tcp.h>
 #include <linux/fs.h>
 
-//applet:IF_NBDCLIENT(APPLET_ODDNAME(nbd-client, nbdclient, BB_DIR_USR_SBIN, BB_SUID_DROP, nbdclient))
+//applet:IF_NBDCLIENT(APPLET_NOEXEC(nbd-client, nbdclient, BB_DIR_USR_SBIN, BB_SUID_DROP, nbdclient))
 
 //kbuild:lib-$(CONFIG_NBDCLIENT) += nbd-client.o
 
@@ -43,7 +43,7 @@
 //blocksizes other than 1024 without patches
 
 int nbdclient_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
-int nbdclient_main(int argc, char **argv)
+int nbdclient_main(int argc UNUSED_PARAM, char **argv)
 {
         unsigned long timeout = 0;
 #if BB_MMU
@@ -61,7 +61,7 @@ int nbdclient_main(int argc, char **argv)
         BUILD_BUG_ON(offsetof(struct nbd_header_t, data) != 8+8+8+4);
 
         // Parse command line stuff (just a stub now)
-        if (argc != 4)
+        if (!argv[1] || !argv[2] || !argv[3] || argv[4])
                 bb_show_usage();
 
 #if !BB_MMU
diff --git a/networking/nc_bloaty.c b/networking/nc_bloaty.c
index 3db784982..64098648a 100644
--- a/networking/nc_bloaty.c
+++ b/networking/nc_bloaty.c
@@ -787,11 +787,15 @@ int nc_main(int argc UNUSED_PARAM, char **argv)
  e_found:
 
         // -g -G -t -r deleted, unimplemented -a deleted too
-        opt_complementary = "?2:vv:ll"; /* max 2 params; -v and -l are counters; -w N */
-        getopt32(argv, "np:s:uvw:+" IF_NC_SERVER("lk")
-                        IF_NC_EXTRA("i:o:z"),
-                        &str_p, &str_s, &o_wait
-                        IF_NC_EXTRA(, &str_i, &str_o), &o_verbose IF_NC_SERVER(, &cnt_l));
+        getopt32(argv, "^"
+                "np:s:uvw:+"/* -w N */ IF_NC_SERVER("lk")
+                IF_NC_EXTRA("i:o:z")
+                        "\0"
+                        "?2:vv:ll", /* max 2 params; -v and -l are counters */
+                &str_p, &str_s, &o_wait
+                IF_NC_EXTRA(, &str_i, &str_o)
+                        , &o_verbose IF_NC_SERVER(, &cnt_l)
+        );
         argv += optind;
 #if ENABLE_NC_EXTRA
         if (option_mask32 & OPT_i) /* line-interval time */
diff --git a/networking/ntpd.c b/networking/ntpd.c
index f21f9513d..25fa44389 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -2230,15 +2230,16 @@ static NOINLINE void ntp_init(char **argv)
 
         /* Parse options */
         peers = NULL;
-        opt_complementary = "dd:wn"  /* -d: counter; -p: list; -w implies -n */
-                IF_FEATURE_NTPD_SERVER(":Il"); /* -I implies -l */
-        opts = getopt32(argv,
+        opts = getopt32(argv, "^"
                         "nqNx" /* compat */
                         "wp:*S:"IF_FEATURE_NTPD_SERVER("l") /* NOT compat */
                         IF_FEATURE_NTPD_SERVER("I:") /* compat */
                         "d" /* compat */
                         "46aAbgL", /* compat, ignored */
-                        &peers, &G.script_name,
+                                "\0"
+                                "dd:wn"  /* -d: counter; -p: list; -w implies -n */
+                                IF_FEATURE_NTPD_SERVER(":Il") /* -I implies -l */
+                        , &peers, &G.script_name,
 #if ENABLE_FEATURE_NTPD_SERVER
                         &G.if_name,
 #endif
diff --git a/networking/ping.c b/networking/ping.c
index 506e7b11b..7460e4414 100644
--- a/networking/ping.c
+++ b/networking/ping.c
@@ -340,7 +340,8 @@ static int common_ping_main(sa_family_t af, char **argv)
 
 /* Full(er) version */
 
-#define OPT_STRING ("qvc:+s:t:+w:+W:+I:np:4" IF_PING6("6"))
+/* -c NUM, -t NUM, -w NUM, -W NUM */
+#define OPT_STRING "qvc:+s:t:+w:+W:+I:np:4"IF_PING6("6")
 enum {
         OPT_QUIET = 1 << 0,
         OPT_VERBOSE = 1 << 1,
@@ -863,9 +864,12 @@ static int common_ping_main(int opt, char **argv)
 
         INIT_G();
 
-        /* exactly one argument needed; -v and -q don't mix; -c NUM, -t NUM, -w NUM, -W NUM */
-        opt_complementary = "=1:q--v:v--q";
-        opt |= getopt32(argv, OPT_STRING, &pingcount, &str_s, &opt_ttl, &deadline, &timeout, &str_I, &str_p);
+        opt |= getopt32(argv, "^"
+                        OPT_STRING
+                        /* exactly one arg; -v and -q don't mix */
+                        "\0" "=1:q--v:v--q",
+                        &pingcount, &str_s, &opt_ttl, &deadline, &timeout, &str_I, &str_p
+        );
         if (opt & OPT_s)
                 datalen = xatou16(str_s); // -s
         if (opt & OPT_I) { // -I
@@ -953,7 +957,7 @@ int ping6_main(int argc UNUSED_PARAM, char **argv)
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ''AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
diff --git a/networking/pscan.c b/networking/pscan.c
index 17985d2c8..95b0a937d 100644
--- a/networking/pscan.c
+++ b/networking/pscan.c
@@ -75,8 +75,11 @@ int pscan_main(int argc UNUSED_PARAM, char **argv)
         unsigned rtt_4;
         unsigned start, diff;
 
-        opt_complementary = "=1"; /* exactly one non-option */
-        opt = getopt32(argv, "cbp:P:t:T:", &opt_min_port, &opt_max_port, &opt_timeout, &opt_min_rtt);
+        opt = getopt32(argv, "^"
+                "cbp:P:t:T:"
+                "\0" "=1", /* exactly one non-option */
+                &opt_min_port, &opt_max_port, &opt_timeout, &opt_min_rtt
+        );
         argv += optind;
         max_port = xatou_range(opt_max_port, 1, 65535);
         port = xatou_range(opt_min_port, 1, max_port);
diff --git a/networking/slattach.c b/networking/slattach.c
index 71b5bf427..e0a388926 100644
--- a/networking/slattach.c
+++ b/networking/slattach.c
@@ -17,23 +17,23 @@
 //config:       default y
 //config:       select PLATFORM_LINUX
 //config:       help
-//config:       slattach is a small utility to attach network interfaces to serial
-//config:       lines.
+//config:       slattach configures serial line as SLIP network interface.
 
 //applet:IF_SLATTACH(APPLET(slattach, BB_DIR_SBIN, BB_SUID_DROP))
+/* shouldn't be NOEXEC: may sleep indefinitely */
 
 //kbuild:lib-$(CONFIG_SLATTACH) += slattach.o
 
 //usage:#define slattach_trivial_usage
-//usage:       "[-cehmLF] [-s SPEED] [-p PROTOCOL] DEVICE"
+//usage:       "[-ehmLF] [-c SCRIPT] [-s BAUD] [-p PROTOCOL] SERIAL_DEVICE"
 //usage:#define slattach_full_usage "\n\n"
-//usage:       "Attach network interface(s) to serial line(s)\n"
-//usage:     "\n        -p PROT Set protocol (slip, cslip, slip6, clisp6 or adaptive)"
-//usage:     "\n        -s SPD  Set line speed"
-//usage:     "\n        -e      Exit after initializing device"
-//usage:     "\n        -h      Exit when the carrier is lost"
-//usage:     "\n        -c PROG Run PROG when the line is hung up"
-//usage:     "\n        -m      Do NOT initialize the line in raw 8 bits mode"
+//usage:       "Configure serial line as SLIP network interface\n"
+//usage:     "\n        -p PROT Protocol: slip, cslip (default), slip6, clisp6, adaptive"
+//usage:     "\n        -s BAUD Line speed"
+//usage:     "\n        -e      Exit after initialization"
+//usage:     "\n        -h      Exit if carrier is lost (else never exits)"
+//usage:     "\n        -c PROG Run PROG on carrier loss"
+//usage:     "\n        -m      Do NOT set raw 8bit mode"
 //usage:     "\n        -L      Enable 3-wire operation"
 //usage:     "\n        -F      Disable RTS/CTS flow control"
 
@@ -42,103 +42,53 @@
 #include "libiproute/utils.h" /* invarg_1_to_2() */
 
 struct globals {
-        int handle;
         int saved_disc;
         struct termios saved_state;
 } FIX_ALIASING;
 #define G (*(struct globals*)bb_common_bufsiz1)
-#define handle       (G.handle      )
-#define saved_disc   (G.saved_disc  )
-#define saved_state  (G.saved_state )
 #define INIT_G() do { setup_common_bufsiz(); } while (0)
 
+#define serial_fd 3
 
-/*
- * Save tty state and line discipline
- *
- * It is fine here to bail out on errors, since we haven modified anything yet
- */
-static void save_state(void)
-{
-        /* Save line status */
-        if (tcgetattr(handle, &saved_state) < 0)
-                bb_perror_msg_and_die("get state");
-
-        /* Save line discipline */
-        xioctl(handle, TIOCGETD, &saved_disc);
-}
-
-static int set_termios_state_or_warn(struct termios *state)
+static int tcsetattr_serial_or_warn(struct termios *state)
 {
         int ret;
 
-        ret = tcsetattr(handle, TCSANOW, state);
-        if (ret < 0) {
-                bb_perror_msg("set state");
+        ret = tcsetattr(serial_fd, TCSANOW, state);
+        if (ret != 0) {
+                bb_perror_msg("tcsetattr");
                 return 1; /* used as exitcode */
         }
-        return 0;
+        return ret; /* 0 */
 }
 
-/*
- * Restore state and line discipline for ALL managed ttys
- *
- * Restoring ALL managed ttys is the only way to have a single
- * hangup delay.
- *
- * Go on after errors: we want to restore as many controlled ttys
- * as possible.
- */
 static void restore_state_and_exit(int exitcode) NORETURN;
 static void restore_state_and_exit(int exitcode)
 {
         struct termios state;
 
         /* Restore line discipline */
-        if (ioctl_or_warn(handle, TIOCSETD, &saved_disc) < 0) {
+        if (ioctl_or_warn(serial_fd, TIOCSETD, &G.saved_disc)) {
                 exitcode = 1;
         }
 
         /* Hangup */
-        memcpy(&state, &saved_state, sizeof(state));
+        memcpy(&state, &G.saved_state, sizeof(state));
         cfsetispeed(&state, B0);
         cfsetospeed(&state, B0);
-        if (set_termios_state_or_warn(&state))
-                exitcode = 1;
+        exitcode |= tcsetattr_serial_or_warn(&state);
         sleep(1);
 
         /* Restore line status */
-        if (set_termios_state_or_warn(&saved_state))
+        if (tcsetattr_serial_or_warn(&G.saved_state))
                 exit(EXIT_FAILURE);
+
         if (ENABLE_FEATURE_CLEAN_UP)
-                close(handle);
+                close(serial_fd);
 
         exit(exitcode);
 }
 
-/*
- * Set tty state, line discipline and encapsulation
- */
-static void set_state(struct termios *state, int encap)
-{
-        int disc;
-
-        /* Set line status */
-        if (set_termios_state_or_warn(state))
-                goto bad;
-        /* Set line discliple (N_SLIP always) */
-        disc = N_SLIP;
-        if (ioctl_or_warn(handle, TIOCSETD, &disc) < 0) {
-                goto bad;
-        }
-
-        /* Set encapsulation (SLIP, CSLIP, etc) */
-        if (ioctl_or_warn(handle, SIOCSIFENCAP, &encap) < 0) {
- bad:
-                restore_state_and_exit(EXIT_FAILURE);
-        }
-}
-
 static void sig_handler(int signo UNUSED_PARAM)
 {
         restore_state_and_exit(EXIT_SUCCESS);
@@ -155,13 +105,14 @@ int slattach_main(int argc UNUSED_PARAM, char **argv)
                 "cslip6\0"      /* 3 */
                 "adaptive\0"    /* 8 */
                 ;
+        static const int int_N_SLIP = N_SLIP;
 
-        int i, encap, opt;
+        int encap, opt, fd;
         struct termios state;
         const char *proto = "cslip";
         const char *extcmd;   /* Command to execute after hangup */
         const char *baud_str;
-        int baud_code = -1;   /* Line baud rate (system code) */
+        int baud_code = baud_code; /* for compiler */
 
         enum {
                 OPT_p_proto  = 1 << 0,
@@ -177,15 +128,13 @@ int slattach_main(int argc UNUSED_PARAM, char **argv)
         INIT_G();
 
         /* Parse command line options */
-        opt = getopt32(argv, "p:s:c:ehmLF", &proto, &baud_str, &extcmd);
+        opt = getopt32(argv, "^" "p:s:c:ehmLF" "\0" "=1",
+                                &proto, &baud_str, &extcmd
+        );
         /*argc -= optind;*/
         argv += optind;
 
-        if (!*argv)
-                bb_show_usage();
-
         encap = index_in_strings(proto_names, proto);
-
         if (encap < 0)
                 invarg_1_to_2(proto, "protocol");
         if (encap > 3)
@@ -198,6 +147,22 @@ int slattach_main(int argc UNUSED_PARAM, char **argv)
                         invarg_1_to_2(baud_str, "baud rate");
         }
 
+        /* Open tty */
+        fd = open(*argv, O_RDWR | O_NDELAY);
+        if (fd < 0) {
+                char *buf = concat_path_file("/dev", *argv);
+                fd = xopen(buf, O_RDWR | O_NDELAY);
+                /* maybe if (ENABLE_FEATURE_CLEAN_UP) ?? */
+                free(buf);
+        }
+        xmove_fd(fd, serial_fd);
+
+        /* Save current tty state */
+        if (tcgetattr(serial_fd, &G.saved_state) != 0)
+                bb_perror_msg_and_die("tcgetattr");
+        /* Save line discipline */
+        xioctl(serial_fd, TIOCGETD, &G.saved_disc);
+
         /* Trap signals in order to restore tty states upon exit */
         if (!(opt & OPT_e_quit)) {
                 bb_signals(0
@@ -208,43 +173,37 @@ int slattach_main(int argc UNUSED_PARAM, char **argv)
                         , sig_handler);
         }
 
-        /* Open tty */
-        handle = open(*argv, O_RDWR | O_NDELAY);
-        if (handle < 0) {
-                char *buf = concat_path_file("/dev", *argv);
-                handle = xopen(buf, O_RDWR | O_NDELAY);
-                /* maybe if (ENABLE_FEATURE_CLEAN_UP) ?? */
-                free(buf);
-        }
-
-        /* Save current tty state */
-        save_state();
-
         /* Configure tty */
-        memcpy(&state, &saved_state, sizeof(state));
+        memcpy(&state, &G.saved_state, sizeof(state));
         if (!(opt & OPT_m_nonraw)) { /* raw not suppressed */
                 memset(&state.c_cc, 0, sizeof(state.c_cc));
                 state.c_cc[VMIN] = 1;
                 state.c_iflag = IGNBRK | IGNPAR;
-                state.c_oflag = 0;
-                state.c_lflag = 0;
+                /*state.c_oflag = 0;*/
+                /*state.c_lflag = 0;*/
                 state.c_cflag = CS8 | HUPCL | CREAD
                               | ((opt & OPT_L_local) ? CLOCAL : 0)
                               | ((opt & OPT_F_noflow) ? 0 : CRTSCTS);
-                cfsetispeed(&state, cfgetispeed(&saved_state));
-                cfsetospeed(&state, cfgetospeed(&saved_state));
+                cfsetispeed(&state, cfgetispeed(&G.saved_state));
+                cfsetospeed(&state, cfgetospeed(&G.saved_state));
         }
-
         if (opt & OPT_s_baud) {
                 cfsetispeed(&state, baud_code);
                 cfsetospeed(&state, baud_code);
         }
-
-        set_state(&state, encap);
+        /* Set line status */
+        if (tcsetattr_serial_or_warn(&state))
+                goto bad;
+        /* Set line disclipline (N_SLIP always) */
+        if (ioctl_or_warn(serial_fd, TIOCSETD, (void*)&int_N_SLIP))
+                goto bad;
+        /* Set encapsulation (SLIP, CSLIP, etc) */
+        if (ioctl_or_warn(serial_fd, SIOCSIFENCAP, &encap))
+                goto bad;
 
         /* Exit now if option -e was passed */
         if (opt & OPT_e_quit)
-                return 0;
+                return EXIT_SUCCESS;
 
         /* If we're not requested to watch, just keep descriptor open
          * until we are killed */
@@ -254,17 +213,20 @@ int slattach_main(int argc UNUSED_PARAM, char **argv)
 
         /* Watch line for hangup */
         while (1) {
-                if (ioctl(handle, TIOCMGET, &i) < 0 || !(i & TIOCM_CAR))
-                        goto no_carrier;
+                int modem_stat;
+                if (ioctl(serial_fd, TIOCMGET, &modem_stat))
+                        break;
+                if (!(modem_stat & TIOCM_CAR))
+                        break;
                 sleep(15);
         }
 
- no_carrier:
-
         /* Execute command on hangup */
         if (opt & OPT_c_extcmd)
                 system(extcmd);
 
         /* Restore states and exit */
         restore_state_and_exit(EXIT_SUCCESS);
+ bad:
+        restore_state_and_exit(EXIT_FAILURE);
 }
diff --git a/networking/tcpudp.c b/networking/tcpudp.c
index 270325164..d4c69e0f7 100644
--- a/networking/tcpudp.c
+++ b/networking/tcpudp.c
@@ -269,10 +269,11 @@ int tcpudpsvd_main(int argc UNUSED_PARAM, char **argv)
 
         tcp = (applet_name[0] == 't');
 
-        /* 3+ args, -i at most once, -p implies -h, -v is counter, -b N, -c N */
-        opt_complementary = "-3:i--i:ph:vv";
 #ifdef SSLSVD
-        opts = getopt32(argv, "+c:+C:i:x:u:l:Eb:+hpt:vU:/:Z:K:",
+        opts = getopt32(argv, "^+"
+                "c:+C:i:x:u:l:Eb:+hpt:vU:/:Z:K:" /* -c NUM, -b NUM */
+                /* 3+ args, -i at most once, -p implies -h, -v is a counter */
+                "\0" "-3:i--i:ph:vv",
                 &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname,
                 &backlog, &str_t, &ssluser, &root, &cert, &key, &verbose
         );
diff --git a/networking/telnet.c b/networking/telnet.c
index 9f191f7ad..1f8a44466 100644
--- a/networking/telnet.c
+++ b/networking/telnet.c
@@ -44,7 +44,7 @@
 //config:       Setting this option will forward the USER environment variable to the
 //config:       remote host you are connecting to. This is useful when you need to
 //config:       log into a machine without telling the username (autologin). This
-//config:       option enables `-a' and `-l USER' arguments.
+//config:       option enables '-a' and '-l USER' options.
 //config:
 //config:config FEATURE_TELNET_WIDTH
 //config:       bool "Enable window size autodetection"
@@ -643,8 +643,10 @@ int telnet_main(int argc UNUSED_PARAM, char **argv)
         }
 
 #if ENABLE_FEATURE_TELNET_AUTOLOGIN
-        if (1 & getopt32(argv, "al:", &G.autologin))
+        if (1 == getopt32(argv, "al:", &G.autologin)) {
+                /* Only -a without -l USER picks $USER from envvar */
                 G.autologin = getenv("USER");
+        }
         argv += optind;
 #else
         argv++;
diff --git a/networking/telnetd.c b/networking/telnetd.c
index 16c572e8d..a6bafa21d 100644
--- a/networking/telnetd.c
+++ b/networking/telnetd.c
@@ -659,13 +659,15 @@ int telnetd_main(int argc UNUSED_PARAM, char **argv)
 #endif
         INIT_G();
 
-        /* -w NUM, and implies -F. -w and -i don't mix */
-        IF_FEATURE_TELNETD_INETD_WAIT(opt_complementary = "wF:i--w:w--i";)
         /* Even if !STANDALONE, we accept (and ignore) -i, thus people
          * don't need to guess whether it's ok to pass -i to us */
-        opt = getopt32(argv, "f:l:Ki"
+        opt = getopt32(argv, "^"
+                        "f:l:Ki"
                         IF_FEATURE_TELNETD_STANDALONE("p:b:F")
-                        IF_FEATURE_TELNETD_INETD_WAIT("Sw:+"),
+                        IF_FEATURE_TELNETD_INETD_WAIT("Sw:+") /* -w NUM */
+                        "\0"
+                        /* -w implies -F. -w and -i don't mix */
+                        IF_FEATURE_TELNETD_INETD_WAIT("wF:i--w:w--i"),
                         &G.issuefile, &G.loginpath
                         IF_FEATURE_TELNETD_STANDALONE(, &opt_portnbr, &opt_bindaddr)
                         IF_FEATURE_TELNETD_INETD_WAIT(, &sec_linger)
diff --git a/networking/tftp.c b/networking/tftp.c
index 5baa80448..73a9829aa 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -761,15 +761,16 @@ int tftp_main(int argc UNUSED_PARAM, char **argv)
 
         INIT_G();
 
-        /* -p or -g is mandatory, and they are mutually exclusive */
-        opt_complementary = "" IF_FEATURE_TFTP_GET("g:") IF_FEATURE_TFTP_PUT("p:")
-                        IF_GETPUT("g--p:p--g:");
-
-        IF_GETPUT(opt =) getopt32(argv,
+        IF_GETPUT(opt =) getopt32(argv, "^"
                         IF_FEATURE_TFTP_GET("g") IF_FEATURE_TFTP_PUT("p")
-                                "l:r:" IF_FEATURE_TFTP_BLOCKSIZE("b:"),
+                        "l:r:" IF_FEATURE_TFTP_BLOCKSIZE("b:")
+                        "\0"
+                        /* -p or -g is mandatory, and they are mutually exclusive */
+                        IF_FEATURE_TFTP_GET("g:") IF_FEATURE_TFTP_PUT("p:")
+                        IF_GETPUT("g--p:p--g:"),
                         &local_file, &remote_file
-                        IF_FEATURE_TFTP_BLOCKSIZE(, &blksize_str));
+                        IF_FEATURE_TFTP_BLOCKSIZE(, &blksize_str)
+        );
         argv += optind;
 
 # if ENABLE_FEATURE_TFTP_BLOCKSIZE
diff --git a/networking/traceroute.c b/networking/traceroute.c
index a958a2c6c..8b6247482 100644
--- a/networking/traceroute.c
+++ b/networking/traceroute.c
@@ -12,12 +12,12 @@
  * this paragraph in its entirety in the documentation or other materials
  * provided with the distribution, and (3) all advertising materials mentioning
  * features or use of this software display the following acknowledgement:
- * ``This product includes software developed by the University of California,
+ * ''This product includes software developed by the University of California,
  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  * the University nor the names of its contributors may be used to endorse
  * or promote products derived from this software without specific prior
  * written permission.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * THIS SOFTWARE IS PROVIDED ''AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
@@ -833,9 +833,9 @@ common_traceroute_main(int op, char **argv)
 
         INIT_G();
 
-        /* minimum 1 arg */
-        opt_complementary = "-1:x-x";
-        op |= getopt32(argv, OPT_STRING
+        op |= getopt32(argv, "^"
+                OPT_STRING
+                "\0" "-1:x-x" /* minimum 1 arg */
                 , &tos_str, &device, &max_ttl_str, &port_str, &nprobes_str
                 , &source, &waittime_str, &pausemsecs_str, &first_ttl_str
         );
diff --git a/networking/tunctl.c b/networking/tunctl.c
index 0a26ff7fb..f2dc645a1 100644
--- a/networking/tunctl.c
+++ b/networking/tunctl.c
@@ -24,7 +24,7 @@
 //config:       Allow to specify owner and group of newly created interface.
 //config:       340 bytes of pure bloat. Say no here.
 
-//applet:IF_TUNCTL(APPLET(tunctl, BB_DIR_SBIN, BB_SUID_DROP))
+//applet:IF_TUNCTL(APPLET_NOEXEC(tunctl, tunctl, BB_DIR_SBIN, BB_SUID_DROP, tunctl))
 
 //kbuild:lib-$(CONFIG_TUNCTL) += tunctl.o
 
@@ -83,10 +83,13 @@ int tunctl_main(int argc UNUSED_PARAM, char **argv)
 #endif
         };
 
-        opt_complementary = "=0:t--d:d--t"; // no arguments; t ^ d
-        opts = getopt32(argv, "f:t:d:" IF_FEATURE_TUNCTL_UG("u:g:b"),
+        opts = getopt32(argv, "^"
+                        "f:t:d:" IF_FEATURE_TUNCTL_UG("u:g:b")
+                        "\0"
+                        "=0:t--d:d--t", // no arguments; t ^ d
                         &opt_device, &opt_name, &opt_name
-                        IF_FEATURE_TUNCTL_UG(, &opt_user, &opt_group));
+                        IF_FEATURE_TUNCTL_UG(, &opt_user, &opt_group)
+        );
 
         // select device
         memset(&ifr, 0, sizeof(ifr));
@@ -153,9 +156,12 @@ int tunctl_main(int argc UNUSED_PARAM, char **argv)
                 OPT_d = 1 << 2, // delete named interface
         };
 
-        opt_complementary = "=0:t--d:d--t"; // no arguments; t ^ d
-        opts = getopt32(argv, "f:t:d:u:g:b", // u, g, b accepted and ignored
-                        &opt_device, &opt_name, &opt_name, NULL, NULL);
+        opts = getopt32(argv, "^"
+                        "f:t:d:u:g:b" // u, g, b accepted and ignored
+                        "\0"
+                        "=0:t--d:d--t", // no arguments; t ^ d
+                        &opt_device, &opt_name, &opt_name, NULL, NULL
+        );
 
         // set interface name
         memset(&ifr, 0, sizeof(ifr));
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
index 43081efca..849ca1388 100644
--- a/networking/udhcp/d6_dhcpc.c
+++ b/networking/udhcp/d6_dhcpc.c
@@ -1101,14 +1101,15 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
         client_config.script = CONFIG_UDHCPC_DEFAULT_SCRIPT;
 
         /* Parse command line */
-        /* O,x: list; -T,-t,-A take numeric param */
-        IF_UDHCP_VERBOSE(opt_complementary = "vv";)
-        IF_LONG_OPTS(applet_long_options = udhcpc6_longopts;)
-        opt = getopt32(argv, "i:np:qRr:s:T:+t:+SA:+O:*ox:*f"
+        opt = getopt32long(argv, "^"
+                /* O,x: list; -T,-t,-A take numeric param */
+                "i:np:qRr:s:T:+t:+SA:+O:*ox:*f"
                 USE_FOR_MMU("b")
                 ///IF_FEATURE_UDHCPC_ARPING("a")
                 IF_FEATURE_UDHCP_PORT("P:")
                 "v"
+                "\0" IF_UDHCP_VERBOSE("vv") /* -v is a counter */
+                , udhcpc6_longopts
                 , &client_config.interface, &client_config.pidfile, &str_r /* i,p */
                 , &client_config.script /* s */
                 , &discover_timeout, &discover_retries, &tryagain_timeout /* T,t,A */
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index ccf04993d..55e0400b9 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -1295,16 +1295,18 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
         str_V = "udhcp "BB_VER;
 
         /* Parse command line */
-        /* O,x: list; -T,-t,-A take numeric param */
-        IF_UDHCP_VERBOSE(opt_complementary = "vv";)
-        IF_LONG_OPTS(applet_long_options = udhcpc_longopts;)
-        opt = getopt32(argv, "CV:H:h:F:i:np:qRr:s:T:+t:+SA:+O:*ox:*fB"
+        opt = getopt32long(argv, "^"
+                /* O,x: list; -T,-t,-A take numeric param */
+                "CV:H:h:F:i:np:qRr:s:T:+t:+SA:+O:*ox:*fB"
                 USE_FOR_MMU("b")
                 IF_FEATURE_UDHCPC_ARPING("a::")
                 IF_FEATURE_UDHCP_PORT("P:")
                 "v"
+                "\0" IF_UDHCP_VERBOSE("vv") /* -v is a counter */
+                , udhcpc_longopts
                 , &str_V, &str_h, &str_h, &str_F
-                , &client_config.interface, &client_config.pidfile, &str_r /* i,p */
+                , &client_config.interface, &client_config.pidfile /* i,p */
+                , &str_r /* r */
                 , &client_config.script /* s */
                 , &discover_timeout, &discover_retries, &tryagain_timeout /* T,t,A */
                 , &list_O
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 3a5fc2db7..05ddc8649 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -814,11 +814,12 @@ int udhcpd_main(int argc UNUSED_PARAM, char **argv)
         IF_FEATURE_UDHCP_PORT(SERVER_PORT = 67;)
         IF_FEATURE_UDHCP_PORT(CLIENT_PORT = 68;)
 
+        opt = getopt32(argv, "^"
+                "fSI:va:"IF_FEATURE_UDHCP_PORT("P:")
+                "\0"
 #if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 1
-        opt_complementary = "vv";
+                "vv"
 #endif
-        opt = getopt32(argv, "fSI:va:"
-                IF_FEATURE_UDHCP_PORT("P:")
                 , &str_I
                 , &str_a
                 IF_FEATURE_UDHCP_PORT(, &str_P)
diff --git a/networking/udhcp/dumpleases.c b/networking/udhcp/dumpleases.c
index dce9084b3..70d2d1434 100644
--- a/networking/udhcp/dumpleases.c
+++ b/networking/udhcp/dumpleases.c
@@ -2,7 +2,7 @@
 /*
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-//applet:IF_DUMPLEASES(APPLET(dumpleases, BB_DIR_USR_BIN, BB_SUID_DROP))
+//applet:IF_DUMPLEASES(APPLET_NOEXEC(dumpleases, dumpleases, BB_DIR_USR_BIN, BB_SUID_DROP, dumpleases))
 
 //kbuild:lib-$(CONFIG_DUMPLEASES) += dumpleases.o
 
@@ -51,12 +51,15 @@ int dumpleases_main(int argc UNUSED_PARAM, char **argv)
                 "decimal\0"   No_argument       "d"
                 ;
 
-        applet_long_options = dumpleases_longopts;
 #endif
         init_unicode();
 
-        opt_complementary = "=0:a--r:r--a";
-        opt = getopt32(argv, "arf:d", &file);
+        opt = getopt32long(argv, "^"
+                        "arf:d"
+                        "\0" "=0:a--r:r--a",
+                        dumpleases_longopts,
+                        &file
+        );
 
         fd = xopen(file, O_RDONLY);
 
diff --git a/networking/vconfig.c b/networking/vconfig.c
index e6e2872bf..62a483865 100644
--- a/networking/vconfig.c
+++ b/networking/vconfig.c
@@ -16,7 +16,7 @@
 //config:       help
 //config:       Creates, removes, and configures VLAN interfaces
 
-//applet:IF_VCONFIG(APPLET(vconfig, BB_DIR_SBIN, BB_SUID_DROP))
+//applet:IF_VCONFIG(APPLET_NOEXEC(vconfig, vconfig, BB_DIR_SBIN, BB_SUID_DROP, vconfig))
 
 //kbuild:lib-$(CONFIG_VCONFIG) += vconfig.o
 
diff --git a/networking/wget.c b/networking/wget.c
index ab9bc1836..0001ddcba 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -1371,6 +1371,11 @@ IF_DESKTOP(	"no-clobber\0"       No_argument       "\xf0")
 IF_DESKTOP(     "no-host-directories\0" No_argument    "\xf0")
 IF_DESKTOP(     "no-parent\0"        No_argument       "\xf0")
                 ;
+# define GETOPT32 getopt32long
+# define LONGOPTS ,wget_longopts
+#else
+# define GETOPT32 getopt32
+# define LONGOPTS
 #endif
 
 #if ENABLE_FEATURE_WGET_LONG_OPTIONS
@@ -1387,11 +1392,9 @@ IF_DESKTOP(	"no-parent\0"        No_argument       "\xf0")
         G.user_agent = "Wget"; /* "User-Agent" header field */
 
 #if ENABLE_FEATURE_WGET_LONG_OPTIONS
-        applet_long_options = wget_longopts;
 #endif
-        opt_complementary = "-1" /* at least one URL */
-                IF_FEATURE_WGET_LONG_OPTIONS(":\xff::"); /* --header is a list */
-        getopt32(argv, "cqSO:P:Y:U:T:+"
+        GETOPT32(argv, "^"
+                "cqSO:P:Y:U:T:+"
                 /*ignored:*/ "t:"
                 /*ignored:*/ "n::"
                 /* wget has exactly four -n<letter> opts, all of which we can ignore:
@@ -1402,6 +1405,10 @@ IF_DESKTOP(	"no-parent\0"        No_argument       "\xf0")
                  * "n::" above says that we accept -n[ARG].
                  * Specifying "n:" would be a bug: "-n ARG" would eat ARG!
                  */
+                "\0"
+                "-1" /* at least one URL */
+                IF_FEATURE_WGET_LONG_OPTIONS(":\xff::") /* --header is a list */
+                LONGOPTS
                 , &G.fname_out, &G.dir_prefix,
                 &G.proxy_flag, &G.user_agent,
                 IF_FEATURE_WGET_TIMEOUT(&G.timeout_seconds) IF_NOT_FEATURE_WGET_TIMEOUT(NULL),
diff --git a/networking/whois.c b/networking/whois.c
index 0cb7e5411..fd1cdf43e 100644
--- a/networking/whois.c
+++ b/networking/whois.c
@@ -167,8 +167,7 @@ int whois_main(int argc UNUSED_PARAM, char **argv)
         int port = 43;
         const char *host = "whois.iana.org";
 
-        opt_complementary = "-1";
-        getopt32(argv, "ih:p:+", &host, &port);
+        getopt32(argv, "^" "ih:p:+" "\0" "-1", &host, &port);
         argv += optind;
 
         do {
diff --git a/networking/zcip.c b/networking/zcip.c
index 94174a165..55440285f 100644
--- a/networking/zcip.c
+++ b/networking/zcip.c
@@ -253,8 +253,9 @@ int zcip_main(int argc UNUSED_PARAM, char **argv)
 #define QUIT       (opts & 2)
         // Parse commandline: prog [options] ifname script
         // exactly 2 args; -v accumulates and implies -f
-        opt_complementary = "=2:vv:vf";
-        opts = getopt32(argv, "fqr:l:v", &r_opt, &l_opt, &verbose);
+        opts = getopt32(argv, "^" "fqr:l:v" "\0" "=2:vv:vf",
+                                &r_opt, &l_opt, &verbose
+        );
 #if !BB_MMU
         // on NOMMU reexec early (or else we will rerun things twice)
         if (!FOREGROUND)