Merge branch 'busybox' into merge

26 files changed, 708 insertions, 484 deletions

diff --git a/networking/arping.c b/networking/arping.c
index f9967d81e..788fded3c 100644
--- a/networking/arping.c
+++ b/networking/arping.c
@@ -11,7 +11,6 @@
 //config:       select PLATFORM_LINUX
 //config:       help
 //config:       Ping hosts by ARP packets.
-//config:
 
 //applet:IF_ARPING(APPLET(arping, BB_DIR_USR_SBIN, BB_SUID_DROP))
 
@@ -29,6 +28,7 @@
 //usage:     "\n        -A              ARP answer mode, update your neighbors"
 //usage:     "\n        -c N            Stop after sending N ARP requests"
 //usage:     "\n        -w TIMEOUT      Seconds to wait for ARP reply"
+//NB: in iputils-s20160308, iface is mandatory, no default
 //usage:     "\n        -I IFACE        Interface to use (default eth0)"
 //usage:     "\n        -s SRC_IP       Sender IP address"
 //usage:     "\n        DST_IP          Target IP address"
@@ -45,21 +45,29 @@
 #define MONOTONIC_US() ((unsigned)monotonic_us())
 
 enum {
-        DAD = 1,
-        UNSOLICITED = 2,
-        ADVERT = 4,
-        QUIET = 8,
-        QUIT_ON_REPLY = 16,
-        BCAST_ONLY = 32,
-        UNICASTING = 64
+        UNSOLICITED   = 1 << 0,
+        DAD           = 1 << 1,
+        ADVERT        = 1 << 2,
+        QUIET         = 1 << 3,
+        QUIT_ON_REPLY = 1 << 4,
+        BCAST_ONLY    = 1 << 5,
+        UNICASTING    = 1 << 6,
+        TIMEOUT       = 1 << 7,
 };
+#define GETOPT32(str_timeout, device, source) \
+        getopt32(argv, "^" \
+                "UDAqfbc:+w:I:s:" \
+                /* DAD also sets quit_on_reply, */ \
+                /* advert also sets unsolicited: */ \
+                "\0" "=1:Df:AU", \
+                &count, &str_timeout, &device, &source \
+        );
 
 struct globals {
         struct in_addr src;
         struct in_addr dst;
         struct sockaddr_ll me;
         struct sockaddr_ll he;
-        int sock_fd;
 
         int count; // = -1;
         unsigned last;
@@ -71,13 +79,17 @@ struct globals {
         unsigned received;
         unsigned brd_recv;
         unsigned req_recv;
+
+        /* should be in main(), but are here to reduce stack use: */
+        struct ifreq ifr;
+        struct sockaddr_in probe_saddr;
+        sigset_t sset;
+        unsigned char packet[4096];
 } FIX_ALIASING;
-#define G (*(struct globals*)bb_common_bufsiz1)
 #define src        (G.src       )
 #define dst        (G.dst       )
 #define me         (G.me        )
 #define he         (G.he        )
-#define sock_fd    (G.sock_fd   )
 #define count      (G.count     )
 #define last       (G.last      )
 #define timeout_us (G.timeout_us)
@@ -87,26 +99,25 @@ struct globals {
 #define received   (G.received  )
 #define brd_recv   (G.brd_recv  )
 #define req_recv   (G.req_recv  )
+//#define G (*(struct globals*)bb_common_bufsiz1)
+#define G (*ptr_to_globals)
 #define INIT_G() do { \
-        setup_common_bufsiz(); \
+        /*setup_common_bufsiz();*/ \
+        SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
         count = -1; \
 } while (0)
 
-// If GNUisms are not available...
-//static void *mempcpy(void *_dst, const void *_src, int n)
-//{
-//      memcpy(_dst, _src, n);
-//      return (char*)_dst + n;
-//}
+#define sock_fd 3
 
 static int send_pack(struct in_addr *src_addr,
-                        struct in_addr *dst_addr, struct sockaddr_ll *ME,
+                        struct in_addr *dst_addr,
+                        struct sockaddr_ll *ME,
                         struct sockaddr_ll *HE)
 {
         int err;
         unsigned char buf[256];
         struct arphdr *ah = (struct arphdr *) buf;
-        unsigned char *p = (unsigned char *) (ah + 1);
+        unsigned char *p;
 
         ah->ar_hrd = htons(ARPHRD_ETHER);
         ah->ar_pro = htons(ETH_P_IP);
@@ -114,6 +125,7 @@ static int send_pack(struct in_addr *src_addr,
         ah->ar_pln = 4;
         ah->ar_op = option_mask32 & ADVERT ? htons(ARPOP_REPLY) : htons(ARPOP_REQUEST);
 
+        p = (unsigned char *) (ah + 1);
         p = mempcpy(p, &ME->sll_addr, ah->ar_hln);
         p = mempcpy(p, src_addr, 4);
 
@@ -139,10 +151,10 @@ static void finish(void)
 {
         if (!(option_mask32 & QUIET)) {
                 printf("Sent %u probe(s) (%u broadcast(s))\n"
-                        "Received %u repl%s"
+                        "Received %u response(s)"
                         " (%u request(s), %u broadcast(s))\n",
                         sent, brd_sent,
-                        received, (received == 1) ? "ies" : "y",
+                        received,
                         req_recv, brd_recv);
         }
         if (option_mask32 & DAD)
@@ -180,15 +192,10 @@ static void recv_pack(unsigned char *buf, int len, struct sockaddr_ll *FROM)
         struct arphdr *ah = (struct arphdr *) buf;
         unsigned char *p = (unsigned char *) (ah + 1);
         struct in_addr src_ip, dst_ip;
+
         /* moves below assume in_addr is 4 bytes big, ensure that */
-        struct BUG_in_addr_must_be_4 {
-                char BUG_in_addr_must_be_4[
-                        sizeof(struct in_addr) == 4 ? 1 : -1
-                ];
-                char BUG_s_addr_must_be_4[
-                        sizeof(src_ip.s_addr) == 4 ? 1 : -1
-                ];
-        };
+        BUILD_BUG_ON(sizeof(struct in_addr) != 4);
+        BUILD_BUG_ON(sizeof(src_ip.s_addr) != 4);
 
         /* Filter out wild packets */
         if (FROM->sll_pkttype != PACKET_HOST
@@ -209,8 +216,10 @@ static void recv_pack(unsigned char *buf, int len, struct sockaddr_ll *FROM)
         if (ah->ar_pro != htons(ETH_P_IP)
          || (ah->ar_pln != 4)
          || (ah->ar_hln != me.sll_halen)
-         || (len < (int)(sizeof(*ah) + 2 * (4 + ah->ar_hln))))
+         || (len < (int)(sizeof(*ah) + 2 * (4 + ah->ar_hln)))
+        ) {
                 return;
+        }
 
         move_from_unaligned32(src_ip.s_addr, p + ah->ar_hln);
         move_from_unaligned32(dst_ip.s_addr, p + ah->ar_hln + 4 + ah->ar_hln);
@@ -242,6 +251,7 @@ static void recv_pack(unsigned char *buf, int len, struct sockaddr_ll *FROM)
         if (!(option_mask32 & QUIET)) {
                 int s_printed = 0;
 
+//TODO: arping from iputils-s20160308 print upprcase hex in MAC, follow them?
                 printf("%scast re%s from %s [%02x:%02x:%02x:%02x:%02x:%02x]",
                         FROM->sll_pkttype == PACKET_HOST ? "Uni" : "Broad",
                         ah->ar_op == htons(ARPOP_REPLY) ? "ply" : "quest",
@@ -249,14 +259,14 @@ static void recv_pack(unsigned char *buf, int len, struct sockaddr_ll *FROM)
                         p[0], p[1], p[2], p[3], p[4], p[5]
                 );
                 if (dst_ip.s_addr != src.s_addr) {
-                        printf("for %s ", inet_ntoa(dst_ip));
+                        printf("for %s", inet_ntoa(dst_ip));
                         s_printed = 1;
                 }
                 if (memcmp(p + ah->ar_hln + 4, me.sll_addr, ah->ar_hln)) {
                         unsigned char *pp = p + ah->ar_hln + 4;
                         if (!s_printed)
-                                printf("for ");
-                        printf("[%02x:%02x:%02x:%02x:%02x:%02x]",
+                                printf(" for");
+                        printf(" [%02x:%02x:%02x:%02x:%02x:%02x]",
                                 pp[0], pp[1], pp[2], pp[3], pp[4], pp[5]
                         );
                 }
@@ -288,12 +298,11 @@ int arping_main(int argc UNUSED_PARAM, char **argv)
         const char *device = "eth0";
         char *source = NULL;
         char *target;
-        unsigned char *packet;
         char *err_str;
 
         INIT_G();
 
-        sock_fd = xsocket(AF_PACKET, SOCK_DGRAM, 0);
+        xmove_fd(xsocket(AF_PACKET, SOCK_DGRAM, 0), sock_fd);
 
         // If you ever change BB_SUID_DROP to BB_SUID_REQUIRE,
         // drop suid root privileges here:
@@ -303,41 +312,30 @@ int arping_main(int argc UNUSED_PARAM, char **argv)
                 unsigned opt;
                 char *str_timeout;
 
-                /* Dad also sets quit_on_reply.
-                 * Advert also sets unsolicited.
-                 */
-                opt = getopt32(argv, "^" "DUAqfbc:+w:I:s:" "\0" "=1:Df:AU",
-                                &count, &str_timeout, &device, &source
-                );
-                if (opt & 0x80) /* -w: timeout */
+                opt = GETOPT32(str_timeout, device, source);
+                if (opt & TIMEOUT)
                         timeout_us = xatou_range(str_timeout, 0, INT_MAX/2000000) * 1000000 + 500000;
-                //if (opt & 0x200) /* -s: source */
-                option_mask32 &= 0x3f; /* set respective flags */
         }
 
         target = argv[optind];
         err_str = xasprintf("interface %s %%s", device);
         xfunc_error_retval = 2;
 
-        {
-                struct ifreq ifr;
-
-                memset(&ifr, 0, sizeof(ifr));
-                strncpy_IFNAMSIZ(ifr.ifr_name, device);
-                /* We use ifr.ifr_name in error msg so that problem
-                 * with truncated name will be visible */
-                ioctl_or_perror_and_die(sock_fd, SIOCGIFINDEX, &ifr, err_str, "not found");
-                me.sll_ifindex = ifr.ifr_ifindex;
+        /*memset(&G.ifr, 0, sizeof(G.ifr)); - zeroed by INIT_G */
+        strncpy_IFNAMSIZ(G.ifr.ifr_name, device);
+        ioctl_or_perror_and_die(sock_fd, SIOCGIFINDEX, &G.ifr, err_str, "not found");
+        me.sll_ifindex = G.ifr.ifr_ifindex;
 
-                xioctl(sock_fd, SIOCGIFFLAGS, (char *) &ifr);
+        xioctl(sock_fd, SIOCGIFFLAGS, (char *) &G.ifr);
 
-                if (!(ifr.ifr_flags & IFF_UP)) {
-                        bb_error_msg_and_die(err_str, "is down");
-                }
-                if (ifr.ifr_flags & (IFF_NOARP | IFF_LOOPBACK)) {
-                        bb_error_msg(err_str, "is not ARPable");
-                        return (option_mask32 & DAD ? 0 : 2);
-                }
+        if (!(G.ifr.ifr_flags & IFF_UP)) {
+                bb_error_msg_and_die(err_str, "is down");
+        }
+        if (G.ifr.ifr_flags & (IFF_NOARP | IFF_LOOPBACK)) {
+                bb_error_msg(err_str, "is not ARPable");
+                BUILD_BUG_ON(DAD != 2);
+                /* exit 0 if DAD, else exit 2 */
+                return (~option_mask32 & DAD);
         }
 
         /* if (!inet_aton(target, &dst)) - not needed */ {
@@ -356,33 +354,29 @@ int arping_main(int argc UNUSED_PARAM, char **argv)
                 src = dst;
 
         if (!(option_mask32 & DAD) || src.s_addr) {
-                struct sockaddr_in saddr;
+                /*struct sockaddr_in probe_saddr;*/
                 int probe_fd = xsocket(AF_INET, SOCK_DGRAM, 0);
 
                 setsockopt_bindtodevice(probe_fd, device);
-                memset(&saddr, 0, sizeof(saddr));
-                saddr.sin_family = AF_INET;
+
+                /*memset(&G.probe_saddr, 0, sizeof(G.probe_saddr)); - zeroed by INIT_G */
+                G.probe_saddr.sin_family = AF_INET;
                 if (src.s_addr) {
                         /* Check that this is indeed our IP */
-                        saddr.sin_addr = src;
-                        xbind(probe_fd, (struct sockaddr *) &saddr, sizeof(saddr));
+                        G.probe_saddr.sin_addr = src;
+                        xbind(probe_fd, (struct sockaddr *) &G.probe_saddr, sizeof(G.probe_saddr));
                 } else { /* !(option_mask32 & DAD) case */
                         /* Find IP address on this iface */
-                        socklen_t alen = sizeof(saddr);
-
-                        saddr.sin_port = htons(1025);
-                        saddr.sin_addr = dst;
+                        G.probe_saddr.sin_port = htons(1025);
+                        G.probe_saddr.sin_addr = dst;
 
                         if (setsockopt_SOL_SOCKET_1(probe_fd, SO_DONTROUTE) != 0)
                                 bb_perror_msg("setsockopt(%s)", "SO_DONTROUTE");
-                        xconnect(probe_fd, (struct sockaddr *) &saddr, sizeof(saddr));
-                        getsockname(probe_fd, (struct sockaddr *) &saddr, &alen);
-                        //never happens:
-                        //if (getsockname(probe_fd, (struct sockaddr *) &saddr, &alen) == -1)
-                        //      bb_perror_msg_and_die("getsockname");
-                        if (saddr.sin_family != AF_INET)
+                        xconnect(probe_fd, (struct sockaddr *) &G.probe_saddr, sizeof(G.probe_saddr));
+                        bb_getsockname(probe_fd, (struct sockaddr *) &G.probe_saddr, sizeof(G.probe_saddr));
+                        if (G.probe_saddr.sin_family != AF_INET)
                                 bb_error_msg_and_die("no IP address configured");
-                        src = saddr.sin_addr;
+                        src = G.probe_saddr.sin_addr;
                 }
                 close(probe_fd);
         }
@@ -392,48 +386,53 @@ int arping_main(int argc UNUSED_PARAM, char **argv)
         me.sll_protocol = htons(ETH_P_ARP);
         xbind(sock_fd, (struct sockaddr *) &me, sizeof(me));
 
-        {
-                socklen_t alen = sizeof(me);
-                getsockname(sock_fd, (struct sockaddr *) &me, &alen);
-                //never happens:
-                //if (getsockname(sock_fd, (struct sockaddr *) &me, &alen) == -1)
-                //      bb_perror_msg_and_die("getsockname");
-        }
+        bb_getsockname(sock_fd, (struct sockaddr *) &me, sizeof(me));
+        //never happens:
+        //if (getsockname(sock_fd, (struct sockaddr *) &me, &alen) == -1)
+        //      bb_perror_msg_and_die("getsockname");
         if (me.sll_halen == 0) {
                 bb_error_msg(err_str, "is not ARPable (no ll address)");
-                return (option_mask32 & DAD ? 0 : 2);
+                BUILD_BUG_ON(DAD != 2);
+                /* exit 0 if DAD, else exit 2 */
+                return (~option_mask32 & DAD);
         }
         he = me;
         memset(he.sll_addr, -1, he.sll_halen);
 
         if (!(option_mask32 & QUIET)) {
                 /* inet_ntoa uses static storage, can't use in same printf */
-                printf("ARPING to %s", inet_ntoa(dst));
-                printf(" from %s via %s\n", inet_ntoa(src), device);
+                printf("ARPING %s", inet_ntoa(dst));
+                printf(" from %s %s\n", inet_ntoa(src), device);
         }
 
+        /*sigemptyset(&G.sset); - zeroed by INIT_G */
+        sigaddset(&G.sset, SIGALRM);
+        sigaddset(&G.sset, SIGINT);
         signal_SA_RESTART_empty_mask(SIGINT,  (void (*)(int))finish);
         signal_SA_RESTART_empty_mask(SIGALRM, (void (*)(int))catcher);
 
+        /* Send the first packet, arm ALRM */
         catcher();
 
-        packet = xmalloc(4096);
         while (1) {
-                sigset_t sset, osset;
                 struct sockaddr_ll from;
                 socklen_t alen = sizeof(from);
                 int cc;
 
-                cc = recvfrom(sock_fd, packet, 4096, 0, (struct sockaddr *) &from, &alen);
+                /* Unblock SIGALRM so that the previously called alarm()
+                 * can prevent recvfrom from blocking forever in case the
+                 * inherited procmask is blocking SIGALRM.
+                 */
+                sigprocmask(SIG_UNBLOCK, &G.sset, NULL);
+
+                cc = recvfrom(sock_fd, G.packet, sizeof(G.packet), 0, (struct sockaddr *) &from, &alen);
+
+                /* Don't allow SIGALRMs while we process the reply */
+                sigprocmask(SIG_BLOCK, &G.sset, NULL);
                 if (cc < 0) {
                         bb_perror_msg("recvfrom");
                         continue;
                 }
-                sigemptyset(&sset);
-                sigaddset(&sset, SIGALRM);
-                sigaddset(&sset, SIGINT);
-                sigprocmask(SIG_BLOCK, &sset, &osset);
-                recv_pack(packet, cc, &from);
-                sigprocmask(SIG_SETMASK, &osset, NULL);
+                recv_pack(G.packet, cc, &from);
         }
 }
diff --git a/networking/ftpd.c b/networking/ftpd.c
index 8af5acac2..8abbf7f57 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -171,9 +171,13 @@ struct globals {
         char msg_ok [(sizeof("NNN " MSG_OK ) + 3) & 0xfffc];
         char msg_err[(sizeof("NNN " MSG_ERR) + 3) & 0xfffc];
 } FIX_ALIASING;
-#define G (*(struct globals*)bb_common_bufsiz1)
+#define G (*ptr_to_globals)
+/* ^^^ about 75 bytes smaller code than this: */
+//#define G (*(struct globals*)bb_common_bufsiz1)
 #define INIT_G() do { \
-        setup_common_bufsiz(); \
+        SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
+        /*setup_common_bufsiz();*/ \
+        \
         /* Moved to main */ \
         /*strcpy(G.msg_ok  + 4, MSG_OK );*/ \
         /*strcpy(G.msg_err + 4, MSG_ERR);*/ \
@@ -258,7 +262,7 @@ cmdio_write(uint32_t status_str, const char *str)
 static void
 cmdio_write_ok(unsigned status)
 {
-        *(uint32_t *) G.msg_ok = status;
+        *(bb__aliased_uint32_t *) G.msg_ok = status;
         xwrite(STDOUT_FILENO, G.msg_ok, sizeof("NNN " MSG_OK) - 1);
         if (G.verbose > 1)
                 verbose_log(G.msg_ok);
@@ -269,7 +273,7 @@ cmdio_write_ok(unsigned status)
 static void
 cmdio_write_error(unsigned status)
 {
-        *(uint32_t *) G.msg_err = status;
+        *(bb__aliased_uint32_t *) G.msg_err = status;
         xwrite(STDOUT_FILENO, G.msg_err, sizeof("NNN " MSG_ERR) - 1);
         if (G.verbose > 0)
                 verbose_log(G.msg_err);
@@ -599,7 +603,7 @@ static void
 handle_rest(void)
 {
         /* When ftp_arg == NULL simply restart from beginning */
-        G.restart_pos = G.ftp_arg ? xatoi_positive(G.ftp_arg) : 0;
+        G.restart_pos = G.ftp_arg ? XATOOFF(G.ftp_arg) : 0;
         WRITE_OK(FTP_RESTOK);
 }
 
diff --git a/networking/ftpgetput.c b/networking/ftpgetput.c
index 029587aa2..ffc4cd5f1 100644
--- a/networking/ftpgetput.c
+++ b/networking/ftpgetput.c
@@ -158,46 +158,16 @@ static void ftp_login(void)
 
 static int xconnect_ftpdata(void)
 {
-        char *buf_ptr;
-        unsigned port_num;
+        int port_num;
 
-/*
-TODO: PASV command will not work for IPv6. RFC2428 describes
-IPv6-capable "extended PASV" - EPSV.
-
-"EPSV [protocol]" asks server to bind to and listen on a data port
-in specified protocol. Protocol is 1 for IPv4, 2 for IPv6.
-If not specified, defaults to "same as used for control connection".
-If server understood you, it should answer "229 <some text>(|||port|)"
-where "|" are literal pipe chars and "port" is ASCII decimal port#.
-
-There is also an IPv6-capable replacement for PORT (EPRT),
-but we don't need that.
-
-NB: PASV may still work for some servers even over IPv6.
-For example, vsftp happily answers
-"227 Entering Passive Mode (0,0,0,0,n,n)" and proceeds as usual.
-
-TODO2: need to stop ignoring IP address in PASV response.
-*/
-
-        if (ftpcmd("PASV", NULL) != 227) {
+        if (ENABLE_FEATURE_IPV6 && ftpcmd("EPSV", NULL) == 229) {
+                /* good */
+        } else if (ftpcmd("PASV", NULL) != 227) {
                 ftp_die("PASV");
         }
-
-        /* Response is "NNN garbageN1,N2,N3,N4,P1,P2[)garbage]
-         * Server's IP is N1.N2.N3.N4 (we ignore it)
-         * Server's port for data connection is P1*256+P2 */
-        buf_ptr = strrchr(buf, ')');
-        if (buf_ptr) *buf_ptr = '\0';
-
-        buf_ptr = strrchr(buf, ',');
-        *buf_ptr = '\0';
-        port_num = xatoul_range(buf_ptr + 1, 0, 255);
-
-        buf_ptr = strrchr(buf, ',');
-        *buf_ptr = '\0';
-        port_num += xatoul_range(buf_ptr + 1, 0, 255) * 256;
+        port_num = parse_pasv_epsv(buf);
+        if (port_num < 0)
+                ftp_die("PASV");
 
         set_nport(&lsa->u.sa, htons(port_num));
         return xconnect_stream(lsa);
diff --git a/networking/inetd.c b/networking/inetd.c
index 4dfa0089a..6843845fb 100644
--- a/networking/inetd.c
+++ b/networking/inetd.c
@@ -497,10 +497,9 @@ static void register_rpc(servtab_t *sep)
 {
         int n;
         struct sockaddr_in ir_sin;
-        socklen_t size;
 
-        size = sizeof(ir_sin);
-        if (getsockname(sep->se_fd, (struct sockaddr *) &ir_sin, &size) < 0) {
+        if (bb_getsockname(sep->se_fd, (struct sockaddr *) &ir_sin, sizeof(ir_sin)) < 0) {
+//TODO: verify that such failure is even possible in Linux kernel
                 bb_perror_msg("getsockname");
                 return;
         }
diff --git a/networking/libiproute/Kbuild.src b/networking/libiproute/Kbuild.src
index 056a58540..d94e4c6e5 100644
--- a/networking/libiproute/Kbuild.src
+++ b/networking/libiproute/Kbuild.src
@@ -12,6 +12,12 @@ INSERT
 lib-$(CONFIG_SLATTACH) += \
         utils.o
 
+lib-$(CONFIG_TC) += \
+        libnetlink.o \
+        ll_map.o \
+        ll_proto.o \
+        utils.o
+
 lib-$(CONFIG_IP) += \
         ip_parse_common_args.o \
         libnetlink.o \
diff --git a/networking/libiproute/ipaddress.c b/networking/libiproute/ipaddress.c
index 921ecf0d9..d7f888176 100644
--- a/networking/libiproute/ipaddress.c
+++ b/networking/libiproute/ipaddress.c
@@ -113,7 +113,7 @@ static NOINLINE int print_linkinfo(const struct nlmsghdr *n)
         if (G_filter.up && !(ifi->ifi_flags & IFF_UP))
                 return 0;
 
-        memset(tb, 0, sizeof(tb));
+        //memset(tb, 0, sizeof(tb)); - parse_rtattr does this
         parse_rtattr(tb, IFLA_MAX, IFLA_RTA(ifi), len);
         if (tb[IFLA_IFNAME] == NULL) {
                 bb_error_msg("nil ifname");
@@ -227,7 +227,7 @@ static int FAST_FUNC print_addrinfo(const struct sockaddr_nl *who UNUSED_PARAM,
         if (G_filter.flushb && n->nlmsg_type != RTM_NEWADDR)
                 return 0;
 
-        memset(rta_tb, 0, sizeof(rta_tb));
+        //memset(rta_tb, 0, sizeof(rta_tb)); - parse_rtattr does this
         parse_rtattr(rta_tb, IFA_MAX, IFA_RTA(ifa), n->nlmsg_len - NLMSG_LENGTH(sizeof(*ifa)));
 
         if (!rta_tb[IFA_LOCAL])
@@ -535,7 +535,7 @@ int FAST_FUNC ipaddr_list_or_flush(char **argv, int flush)
                                         continue;
                                 if (G_filter.pfx.family || G_filter.label) {
                                         struct rtattr *tb[IFA_MAX+1];
-                                        memset(tb, 0, sizeof(tb));
+                                        //memset(tb, 0, sizeof(tb)); - parse_rtattr does this
                                         parse_rtattr(tb, IFA_MAX, IFA_RTA(ifa), IFA_PAYLOAD(n));
                                         if (!tb[IFA_LOCAL])
                                                 tb[IFA_LOCAL] = tb[IFA_ADDRESS];
diff --git a/networking/libiproute/iplink.c b/networking/libiproute/iplink.c
index aef5f6490..f38fba055 100644
--- a/networking/libiproute/iplink.c
+++ b/networking/libiproute/iplink.c
@@ -132,7 +132,6 @@ static int get_address(char *dev, int *htype)
 {
         struct ifreq ifr;
         struct sockaddr_ll me;
-        socklen_t alen;
         int s;
 
         s = xsocket(PF_PACKET, SOCK_DGRAM, 0);
@@ -146,8 +145,7 @@ static int get_address(char *dev, int *htype)
         me.sll_ifindex = ifr.ifr_ifindex;
         me.sll_protocol = htons(ETH_P_LOOP);
         xbind(s, (struct sockaddr*)&me, sizeof(me));
-        alen = sizeof(me);
-        getsockname(s, (struct sockaddr*)&me, &alen);
+        bb_getsockname(s, (struct sockaddr*)&me, sizeof(me));
         //never happens:
         //if (getsockname(s, (struct sockaddr*)&me, &alen) == -1)
         //      bb_perror_msg_and_die("getsockname");
diff --git a/networking/libiproute/ipneigh.c b/networking/libiproute/ipneigh.c
index 1cd90d707..f572414e9 100644
--- a/networking/libiproute/ipneigh.c
+++ b/networking/libiproute/ipneigh.c
@@ -110,11 +110,13 @@ static int FAST_FUNC print_neigh(const struct sockaddr_nl *who UNUSED_PARAM,
                 return 0;
         if (G_filter.index && G_filter.index != r->ndm_ifindex)
                 return 0;
-        if (!(G_filter.state&r->ndm_state) &&
-            !(r->ndm_flags & NTF_PROXY) &&
-            (r->ndm_state || !(G_filter.state & 0x100)) &&
-            (r->ndm_family != AF_DECnet))
+        if (!(G_filter.state&r->ndm_state)
+         && !(r->ndm_flags & NTF_PROXY)
+         && (r->ndm_state || !(G_filter.state & 0x100))
+         && (r->ndm_family != AF_DECnet)
+        ) {
                 return 0;
+        }
 
         parse_rtattr(tb, NDA_MAX, NDA_RTA(r), n->nlmsg_len - NLMSG_LENGTH(sizeof(*r)));
 
diff --git a/networking/libiproute/iproute.c b/networking/libiproute/iproute.c
index 95dafe183..2a8610ea6 100644
--- a/networking/libiproute/iproute.c
+++ b/networking/libiproute/iproute.c
@@ -83,7 +83,7 @@ static int FAST_FUNC print_route(const struct sockaddr_nl *who UNUSED_PARAM,
         if (len < 0)
                 bb_error_msg_and_die("wrong nlmsg len %d", len);
 
-        memset(tb, 0, sizeof(tb));
+        //memset(tb, 0, sizeof(tb)); - parse_rtattr does this
         parse_rtattr(tb, RTA_MAX, RTM_RTA(r), len);
 
 #if HAVE_RTA_TABLE
@@ -1081,7 +1081,7 @@ static int iproute_get(char **argv)
                         bb_error_msg_and_die("wrong len %d", len);
                 }
 
-                memset(tb, 0, sizeof(tb));
+                //memset(tb, 0, sizeof(tb)); - parse_rtattr does this
                 parse_rtattr(tb, RTA_MAX, RTM_RTA(r), len);
 
                 if (tb[RTA_PREFSRC]) {
diff --git a/networking/libiproute/iprule.c b/networking/libiproute/iprule.c
index 53b11e16c..0ce0dfeef 100644
--- a/networking/libiproute/iprule.c
+++ b/networking/libiproute/iprule.c
@@ -63,7 +63,7 @@ static int FAST_FUNC print_rule(const struct sockaddr_nl *who UNUSED_PARAM,
         if (len < 0)
                 return -1;
 
-        memset(tb, 0, sizeof(tb));
+        //memset(tb, 0, sizeof(tb)); - parse_rtattr does this
         parse_rtattr(tb, RTA_MAX, RTM_RTA(r), len);
 
         if (r->rtm_family == AF_INET)
diff --git a/networking/libiproute/libnetlink.c b/networking/libiproute/libnetlink.c
index 3f0f70326..40955fcae 100644
--- a/networking/libiproute/libnetlink.c
+++ b/networking/libiproute/libnetlink.c
@@ -15,16 +15,13 @@
 
 void FAST_FUNC xrtnl_open(struct rtnl_handle *rth/*, unsigned subscriptions*/)
 {
-        socklen_t addr_len;
-
         memset(rth, 0, sizeof(*rth));
         rth->fd = xsocket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
         rth->local.nl_family = AF_NETLINK;
         /*rth->local.nl_groups = subscriptions;*/
 
         xbind(rth->fd, (struct sockaddr*)&rth->local, sizeof(rth->local));
-        addr_len = sizeof(rth->local);
-        getsockname(rth->fd, (struct sockaddr*)&rth->local, &addr_len);
+        bb_getsockname(rth->fd, (struct sockaddr*)&rth->local, sizeof(rth->local));
 
 /* too much paranoia
         if (getsockname(rth->fd, (struct sockaddr*)&rth->local, &addr_len) < 0)
@@ -401,6 +398,8 @@ int FAST_FUNC rta_addattr_l(struct rtattr *rta, int maxlen, int type, void *data
 
 void FAST_FUNC parse_rtattr(struct rtattr *tb[], int max, struct rtattr *rta, int len)
 {
+        memset(tb, 0, (max + 1) * sizeof(tb[0]));
+
         while (RTA_OK(rta, len)) {
                 if (rta->rta_type <= max) {
                         tb[rta->rta_type] = rta;
diff --git a/networking/libiproute/ll_map.c b/networking/libiproute/ll_map.c
index be88a04e8..66401da77 100644
--- a/networking/libiproute/ll_map.c
+++ b/networking/libiproute/ll_map.c
@@ -51,7 +51,7 @@ int FAST_FUNC ll_remember_index(const struct sockaddr_nl *who UNUSED_PARAM,
         if (n->nlmsg_len < NLMSG_LENGTH(sizeof(ifi)))
                 return -1;
 
-        memset(tb, 0, sizeof(tb));
+        //memset(tb, 0, sizeof(tb)); - parse_rtattr does this
         parse_rtattr(tb, IFLA_MAX, IFLA_RTA(ifi), IFLA_PAYLOAD(n));
         if (tb[IFLA_IFNAME] == NULL)
                 return 0;
diff --git a/networking/ntpd.c b/networking/ntpd.c
index 0b60d003b..17e5c7da6 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -2362,7 +2362,9 @@ int ntpd_main(int argc UNUSED_PARAM, char **argv)
 
                 /* Nothing between here and poll() blocks for any significant time */
 
-                nextaction = G.cur_time + 3600;
+                nextaction = G.last_script_run + (11*60);
+                if (nextaction < G.cur_time + 1)
+                        nextaction = G.cur_time + 1;
 
                 i = 0;
 #if ENABLE_FEATURE_NTPD_SERVER
diff --git a/networking/parse_pasv_epsv.c b/networking/parse_pasv_epsv.c
new file mode 100644
index 000000000..14f4d4258
--- /dev/null
+++ b/networking/parse_pasv_epsv.c
@@ -0,0 +1,66 @@
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2018 Denys Vlasenko
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_FTPGET) += parse_pasv_epsv.o
+//kbuild:lib-$(CONFIG_FTPPUT) += parse_pasv_epsv.o
+//kbuild:lib-$(CONFIG_WGET) += parse_pasv_epsv.o
+
+#include "libbb.h"
+
+int FAST_FUNC parse_pasv_epsv(char *buf)
+{
+/*
+ * PASV command will not work for IPv6. RFC2428 describes
+ * IPv6-capable "extended PASV" - EPSV.
+ *
+ * "EPSV [protocol]" asks server to bind to and listen on a data port
+ * in specified protocol. Protocol is 1 for IPv4, 2 for IPv6.
+ * If not specified, defaults to "same as used for control connection".
+ * If server understood you, it should answer "229 <some text>(|||port|)"
+ * where "|" are literal pipe chars and "port" is ASCII decimal port#.
+ *
+ * There is also an IPv6-capable replacement for PORT (EPRT),
+ * but we don't need that.
+ *
+ * NB: PASV may still work for some servers even over IPv6.
+ * For example, vsftp happily answers
+ * "227 Entering Passive Mode (0,0,0,0,n,n)" and proceeds as usual.
+ */
+        char *ptr;
+        int port;
+
+        if (!ENABLE_FEATURE_IPV6 || buf[2] == '7' /* "227" */) {
+                /* Response is "227 garbageN1,N2,N3,N4,P1,P2[)garbage]"
+                 * Server's IP is N1.N2.N3.N4 (we ignore it)
+                 * Server's port for data connection is P1*256+P2 */
+                ptr = strrchr(buf, ')');
+                if (ptr) *ptr = '\0';
+
+                ptr = strrchr(buf, ',');
+                if (!ptr) return -1;
+                *ptr = '\0';
+                port = xatou_range(ptr + 1, 0, 255);
+
+                ptr = strrchr(buf, ',');
+                if (!ptr) return -1;
+                *ptr = '\0';
+                port += xatou_range(ptr + 1, 0, 255) * 256;
+        } else {
+                /* Response is "229 garbage(|||P1|)"
+                 * Server's port for data connection is P1 */
+                ptr = strrchr(buf, '|');
+                if (!ptr) return -1;
+                *ptr = '\0';
+
+                ptr = strrchr(buf, '|');
+                if (!ptr) return -1;
+                *ptr = '\0';
+                port = xatou_range(ptr + 1, 0, 65535);
+        }
+
+        return port;
+}
diff --git a/networking/ssl_client.c b/networking/ssl_client.c
index d479846d7..eb84e7726 100644
--- a/networking/ssl_client.c
+++ b/networking/ssl_client.c
@@ -15,7 +15,7 @@
 //kbuild:lib-$(CONFIG_SSL_CLIENT) += ssl_client.o
 
 //usage:#define ssl_client_trivial_usage
-//usage:       "-s FD [-r FD] [-n SNI]"
+//usage:       "[-e] -s FD [-r FD] [-n SNI]"
 //usage:#define ssl_client_full_usage ""
 
 #include "libbb.h"
@@ -30,26 +30,28 @@ int ssl_client_main(int argc UNUSED_PARAM, char **argv)
         // INIT_G();
 
         tls = new_tls_state();
-        opt = getopt32(argv, "s:#r:#n:", &tls->ofd, &tls->ifd, &sni);
-        if (!(opt & 2)) {
+        opt = getopt32(argv, "es:#r:#n:", &tls->ofd, &tls->ifd, &sni);
+        if (!(opt & (1<<2))) {
                 /* -r N defaults to -s N */
                 tls->ifd = tls->ofd;
         }
 
-        if (!(opt & 3)) {
+        if (!(opt & (3<<1))) {
                 if (!argv[1])
                         bb_show_usage();
                 /* Undocumented debug feature: without -s and -r, takes HOST arg and connects to it */
                 //
                 // Talk to kernel.org:
-                // printf "GET / HTTP/1.1\r\nHost: kernel.org\r\n\r\n" | ./busybox ssl_client kernel.org
+                // printf "GET / HTTP/1.1\r\nHost: kernel.org\r\n\r\n" | busybox ssl_client kernel.org
                 if (!sni)
                         sni = argv[1];
                 tls->ifd = tls->ofd = create_and_connect_stream_or_die(argv[1], 443);
         }
 
         tls_handshake(tls, sni);
-        tls_run_copy_loop(tls);
+
+        BUILD_BUG_ON(TLSLOOP_EXIT_ON_LOCAL_EOF != 1);
+        tls_run_copy_loop(tls, /*flags*/ opt & 1);
 
         return EXIT_SUCCESS;
 }
diff --git a/networking/tc.c b/networking/tc.c
index 23abf636c..4fa3e47bf 100644
--- a/networking/tc.c
+++ b/networking/tc.c
@@ -6,22 +6,20 @@
  *
  * Bernhard Reutner-Fischer adjusted for busybox
  */
+//config:config TC
+//config:       bool "tc (3.1 kb)"
+//config:       default y
+//config:       help
+//config:       Show / manipulate traffic control settings
+//config:
+//config:config FEATURE_TC_INGRESS
+//config:       bool "Enable ingress"
+//config:       default y
+//config:       depends on TC
 
-/* Was disabled in 2008 by Bernhard, not known why.
---//config:#config TC
---//config:#    bool "tc"
---//config:#    default y
---//config:#    help
---//config:#      Show / manipulate traffic control settings
---//config:#
---//config:#config FEATURE_TC_INGRESS
---//config:#    default y
---//config:#    depends on TC
---
---//applet:IF_TC(APPLET(tc, BB_DIR_SBIN, BB_SUID_DROP))
---
---//kbuild:lib-$(CONFIG_TC) += tc.o
-*/
+//applet:IF_TC(APPLET(tc, BB_DIR_SBIN, BB_SUID_DROP))
+
+//kbuild:lib-$(CONFIG_TC) += tc.o
 
 //usage:#define tc_trivial_usage
 /* //usage: "[OPTIONS] OBJECT CMD [dev STRING]" */
@@ -52,22 +50,37 @@
 #include "libiproute/rt_names.h"
 #include <linux/pkt_sched.h> /* for the TC_H_* macros */
 
+/* This is the deprecated multiqueue interface */
+#ifndef TCA_PRIO_MAX
+enum
+{
+        TCA_PRIO_UNSPEC,
+        TCA_PRIO_MQ,
+        __TCA_PRIO_MAX
+};
+#define TCA_PRIO_MAX    (__TCA_PRIO_MAX - 1)
+#endif
+
 #define parse_rtattr_nested(tb, max, rta) \
         (parse_rtattr((tb), (max), RTA_DATA(rta), RTA_PAYLOAD(rta)))
 
 /* nullifies tb on error */
 #define __parse_rtattr_nested_compat(tb, max, rta, len) \
-        ({if ((RTA_PAYLOAD(rta) >= len) && \
-                 (RTA_PAYLOAD(rta) >= RTA_ALIGN(len) + sizeof(struct rtattr))) { \
-                        rta = RTA_DATA(rta) + RTA_ALIGN(len); \
-                        parse_rtattr_nested(tb, max, rta); \
-          } else \
-                        memset(tb, 0, sizeof(struct rtattr *) * (max + 1)); \
-        })
+({ \
+        if ((RTA_PAYLOAD(rta) >= len) \
+         && (RTA_PAYLOAD(rta) >= RTA_ALIGN(len) + sizeof(struct rtattr)) \
+        ) { \
+                rta = RTA_DATA(rta) + RTA_ALIGN(len); \
+                parse_rtattr_nested(tb, max, rta); \
+        } else \
+                memset(tb, 0, sizeof(struct rtattr *) * (max + 1)); \
+})
 
 #define parse_rtattr_nested_compat(tb, max, rta, data, len) \
-        ({data = RTA_PAYLOAD(rta) >= len ? RTA_DATA(rta) : NULL; \
-        __parse_rtattr_nested_compat(tb, max, rta, len); })
+({ \
+        data = RTA_PAYLOAD(rta) >= len ? RTA_DATA(rta) : NULL; \
+        __parse_rtattr_nested_compat(tb, max, rta, len); \
+})
 
 #define show_details (0) /* not implemented. Does anyone need it? */
 #define use_iec (0) /* not currently documented in the upstream manpage */
@@ -184,11 +197,13 @@ static void print_rate(char *buf, int len, uint32_t rate)
         }
 }
 
+#if 0
 /* This is "pfifo_fast".  */
 static int prio_parse_opt(int argc, char **argv, struct nlmsghdr *n)
 {
         return 0;
 }
+#endif
 static int prio_print_opt(struct rtattr *opt)
 {
         int i;
@@ -211,11 +226,13 @@ static int prio_print_opt(struct rtattr *opt)
         return 0;
 }
 
+#if 0
 /* Class Based Queue */
 static int cbq_parse_opt(int argc, char **argv, struct nlmsghdr *n)
 {
         return 0;
 }
+#endif
 static int cbq_print_opt(struct rtattr *opt)
 {
         struct rtattr *tb[TCA_CBQ_MAX+1];
@@ -308,8 +325,10 @@ static int cbq_print_opt(struct rtattr *opt)
         return 0;
 }
 
-static int print_qdisc(const struct sockaddr_nl *who UNUSED_PARAM,
-                                                struct nlmsghdr *hdr, void *arg UNUSED_PARAM)
+static FAST_FUNC int print_qdisc(
+                const struct sockaddr_nl *who UNUSED_PARAM,
+                struct nlmsghdr *hdr,
+                void *arg UNUSED_PARAM)
 {
         struct tcmsg *msg = NLMSG_DATA(hdr);
         int len = hdr->nlmsg_len;
@@ -364,8 +383,10 @@ static int print_qdisc(const struct sockaddr_nl *who UNUSED_PARAM,
         return 0;
 }
 
-static int print_class(const struct sockaddr_nl *who UNUSED_PARAM,
-                                                struct nlmsghdr *hdr, void *arg UNUSED_PARAM)
+static FAST_FUNC int print_class(
+                const struct sockaddr_nl *who UNUSED_PARAM,
+                struct nlmsghdr *hdr,
+                void *arg UNUSED_PARAM)
 {
         struct tcmsg *msg = NLMSG_DATA(hdr);
         int len = hdr->nlmsg_len;
@@ -432,8 +453,10 @@ static int print_class(const struct sockaddr_nl *who UNUSED_PARAM,
         return 0;
 }
 
-static int print_filter(const struct sockaddr_nl *who UNUSED_PARAM,
-                                                struct nlmsghdr *hdr, void *arg UNUSED_PARAM)
+static FAST_FUNC int print_filter(
+                const struct sockaddr_nl *who UNUSED_PARAM,
+                struct nlmsghdr *hdr UNUSED_PARAM,
+                void *arg UNUSED_PARAM)
 {
         return 0;
 }
@@ -451,6 +474,12 @@ int tc_main(int argc UNUSED_PARAM, char **argv)
                 "replace\0"
                 "show\0""list\0"
                 ;
+        enum {
+                CMD_add = 0, CMD_del, CMD_change,
+                CMD_link,
+                CMD_replace,
+                CMD_show
+        };
         static const char args[] ALIGN1 =
                 "dev\0" /* qdisc, class, filter */
                 "root\0" /* class, filter */
@@ -460,9 +489,15 @@ int tc_main(int argc UNUSED_PARAM, char **argv)
                 "classid\0" /* change: for class use "handle" */
                 "preference\0""priority\0""protocol\0" /* filter */
                 ;
-        enum { CMD_add = 0, CMD_del, CMD_change, CMD_link, CMD_replace, CMD_show };
-        enum { ARG_dev = 0, ARG_root, ARG_parent, ARG_qdisc,
-                        ARG_handle, ARG_classid, ARG_pref, ARG_prio, ARG_proto};
+        enum {
+                ARG_dev = 0,
+                ARG_root,
+                ARG_parent,
+                ARG_qdisc,
+                ARG_handle,
+                ARG_classid,
+                ARG_pref, ARG_prio, ARG_proto
+        };
         struct rtnl_handle rth;
         struct tcmsg msg;
         int ret, obj, cmd, arg;
@@ -487,9 +522,12 @@ int tc_main(int argc UNUSED_PARAM, char **argv)
                         invarg_1_to_2(*argv, argv[-1]);
                 argv++;
         }
+
         memset(&msg, 0, sizeof(msg));
-        msg.tcm_family = AF_UNSPEC;
+        if (AF_UNSPEC != 0)
+                msg.tcm_family = AF_UNSPEC;
         ll_init_map(&rth);
+
         while (*argv) {
                 arg = index_in_substrings(args, *argv);
                 if (arg == ARG_dev) {
@@ -526,7 +564,8 @@ int tc_main(int argc UNUSED_PARAM, char **argv)
                         msg.tcm_parent = TC_H_ROOT;
                         if (obj == OBJ_filter)
                                 filter_parent = TC_H_ROOT;
-                } else if (arg == ARG_parent) {
+                } else
+                if (arg == ARG_parent) {
                         uint32_t handle;
                         if (msg.tcm_parent)
                                 duparg(*argv, "parent");
@@ -535,23 +574,31 @@ int tc_main(int argc UNUSED_PARAM, char **argv)
                         msg.tcm_parent = handle;
                         if (obj == OBJ_filter)
                                 filter_parent = handle;
-                } else if (arg == ARG_handle) { /* filter::list */
+                } else
+                if (arg == ARG_handle) { /* filter::list */
                         if (msg.tcm_handle)
                                 duparg(*argv, "handle");
                         /* reject LONG_MIN || LONG_MAX */
                         /* TODO: for fw
                         slash = strchr(handle, '/');
                         if (slash != NULL)
-                                   *slash = '\0';
+                                *slash = '\0';
                          */
                         msg.tcm_handle = get_u32(*argv, "handle");
                         /* if (slash) {if (get_u32(uint32_t &mask, slash+1, NULL)) inv mask; addattr32(n, MAX_MSG, TCA_FW_MASK, mask); */
-                } else if (arg == ARG_classid && obj == OBJ_class && cmd == CMD_change){
-                } else if (arg == ARG_pref || arg == ARG_prio) { /* filter::list */
+                } else
+                if (arg == ARG_classid
+                 && obj == OBJ_class
+                 && cmd == CMD_change
+                ) {
+                        /* TODO */
+                } else
+                if (arg == ARG_pref || arg == ARG_prio) { /* filter::list */
                         if (filter_prio)
                                 duparg(*argv, "priority");
                         filter_prio = get_u32(*argv, "priority");
-                } else if (arg == ARG_proto) { /* filter::list */
+                } else
+                if (arg == ARG_proto) { /* filter::list */
                         uint16_t tmp;
                         if (filter_proto)
                                 duparg(*argv, "protocol");
@@ -560,6 +607,7 @@ int tc_main(int argc UNUSED_PARAM, char **argv)
                         filter_proto = tmp;
                 }
         }
+
         if (cmd >= CMD_show) { /* show or list */
                 if (obj == OBJ_filter)
                         msg.tcm_info = TC_H_MAKE(filter_prio<<16, filter_proto);
diff --git a/networking/tftp.c b/networking/tftp.c
index 73a9829aa..4cd39186a 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -208,7 +208,7 @@ struct globals {
 #define G_error_pkt_reason (G.error_pkt[3])
 #define G_error_pkt_str    ((char*)(G.error_pkt + 4))
 
-#if ENABLE_FEATURE_TFTP_PROGRESS_BAR
+#if ENABLE_FEATURE_TFTP_PROGRESS_BAR && ENABLE_FEATURE_TFTP_BLOCKSIZE
 static void tftp_progress_update(void)
 {
         bb_progress_update(&G.pmt, 0, G.pos, G.size);
@@ -227,6 +227,7 @@ static void tftp_progress_done(void)
         }
 }
 #else
+# define tftp_progress_update() ((void)0)
 # define tftp_progress_init() ((void)0)
 # define tftp_progress_done() ((void)0)
 #endif
diff --git a/networking/tls.c b/networking/tls.c
index fd3cb0dba..da7b6058f 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -84,23 +84,23 @@
 # define dbg_der(...) ((void)0)
 #endif
 
-#define RECORD_TYPE_CHANGE_CIPHER_SPEC  20
-#define RECORD_TYPE_ALERT               21
-#define RECORD_TYPE_HANDSHAKE           22
-#define RECORD_TYPE_APPLICATION_DATA    23
-
-#define HANDSHAKE_HELLO_REQUEST         0
-#define HANDSHAKE_CLIENT_HELLO          1
-#define HANDSHAKE_SERVER_HELLO          2
-#define HANDSHAKE_HELLO_VERIFY_REQUEST  3
-#define HANDSHAKE_NEW_SESSION_TICKET    4
-#define HANDSHAKE_CERTIFICATE           11
-#define HANDSHAKE_SERVER_KEY_EXCHANGE   12
-#define HANDSHAKE_CERTIFICATE_REQUEST   13
-#define HANDSHAKE_SERVER_HELLO_DONE     14
-#define HANDSHAKE_CERTIFICATE_VERIFY    15
-#define HANDSHAKE_CLIENT_KEY_EXCHANGE   16
-#define HANDSHAKE_FINISHED              20
+#define RECORD_TYPE_CHANGE_CIPHER_SPEC  20 /* 0x14 */
+#define RECORD_TYPE_ALERT               21 /* 0x15 */
+#define RECORD_TYPE_HANDSHAKE           22 /* 0x16 */
+#define RECORD_TYPE_APPLICATION_DATA    23 /* 0x17 */
+
+#define HANDSHAKE_HELLO_REQUEST         0  /* 0x00 */
+#define HANDSHAKE_CLIENT_HELLO          1  /* 0x01 */
+#define HANDSHAKE_SERVER_HELLO          2  /* 0x02 */
+#define HANDSHAKE_HELLO_VERIFY_REQUEST  3  /* 0x03 */
+#define HANDSHAKE_NEW_SESSION_TICKET    4  /* 0x04 */
+#define HANDSHAKE_CERTIFICATE           11 /* 0x0b */
+#define HANDSHAKE_SERVER_KEY_EXCHANGE   12 /* 0x0c */
+#define HANDSHAKE_CERTIFICATE_REQUEST   13 /* 0x0d */
+#define HANDSHAKE_SERVER_HELLO_DONE     14 /* 0x0e */
+#define HANDSHAKE_CERTIFICATE_VERIFY    15 /* 0x0f */
+#define HANDSHAKE_CLIENT_KEY_EXCHANGE   16 /* 0x10 */
+#define HANDSHAKE_FINISHED              20 /* 0x14 */
 
 #define SSL_NULL_WITH_NULL_NULL                 0x0000
 #define SSL_RSA_WITH_NULL_MD5                   0x0001
@@ -512,10 +512,12 @@ static void bad_record_die(tls_state_t *tls, const char *expected, int len)
         bb_error_msg("got bad TLS record (len:%d) while expecting %s", len, expected);
         if (len > 0) {
                 uint8_t *p = tls->inbuf;
-                while (len > 0) {
+                if (len > 99)
+                        len = 99; /* don't flood, a few lines should be enough */
+                do {
                         fprintf(stderr, " %02x", *p++);
                         len--;
-                }
+                } while (len != 0);
                 fputc('\n', stderr);
         }
         xfunc_die();
@@ -671,9 +673,11 @@ static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
         // AES_128_CBC   Block      16      16     16
         // AES_256_CBC   Block      32      16     16
 
-        /* Fill IV and padding in outbuf */
         tls_get_random(buf - AES_BLOCKSIZE, AES_BLOCKSIZE); /* IV */
-        dbg("before crypt: 5 hdr + %u data + %u hash bytes\n", size, tls->MAC_size);
+        dbg("before crypt: 5 hdr + %u data + %u hash bytes\n",
+                        size - tls->MAC_size, tls->MAC_size);
+
+        /* Fill IV and padding in outbuf */
         // RFC is talking nonsense:
         //    "Padding that is added to force the length of the plaintext to be
         //    an integral multiple of the block cipher's block length."
@@ -773,7 +777,7 @@ static const char *alert_text(int code)
         return itoa(code);
 }
 
-static int tls_xread_record(tls_state_t *tls)
+static int tls_xread_record(tls_state_t *tls, const char *expected)
 {
         struct record_hdr *xhdr;
         int sz;
@@ -796,13 +800,16 @@ static int tls_xread_record(tls_state_t *tls)
                 if (total >= RECHDR_LEN && target == MAX_INBUF) {
                         xhdr = (void*)tls->inbuf;
                         target = RECHDR_LEN + (0x100 * xhdr->len16_hi + xhdr->len16_lo);
-                        if (target > MAX_INBUF) {
-                                /* malformed input (too long): yell and die */
-                                tls->buffered_size = 0;
-                                tls->ofs_to_buffered = total;
-                                tls_error_die(tls);
+
+                        if (target > MAX_INBUF /* malformed input (too long) */
+                         || xhdr->proto_maj != TLS_MAJ
+                         || xhdr->proto_min != TLS_MIN
+                        ) {
+                                sz = total < target ? total : target;
+                                if (sz > 24)
+                                        sz = 24; /* don't flood */
+                                bad_record_die(tls, expected, sz);
                         }
-                        /* can also check type/proto_maj/proto_min here */
                         dbg("xhdr type:%d ver:%d.%d len:%d\n",
                                 xhdr->type, xhdr->proto_maj, xhdr->proto_min,
                                 0x100 * xhdr->len16_hi + xhdr->len16_lo
@@ -1137,13 +1144,11 @@ static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len)
 static int tls_xread_handshake_block(tls_state_t *tls, int min_len)
 {
         struct record_hdr *xhdr;
-        int len = tls_xread_record(tls);
+        int len = tls_xread_record(tls, "handshake record");
 
         xhdr = (void*)tls->inbuf;
         if (len < min_len
          || xhdr->type != RECORD_TYPE_HANDSHAKE
-         || xhdr->proto_maj != TLS_MAJ
-         || xhdr->proto_min != TLS_MIN
         ) {
                 bad_record_die(tls, "handshake record", len);
         }
@@ -1195,7 +1200,9 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
 //   0023 0000 - session_ticket
 //   000a 0008 0006001700180019 - supported_groups
 //   000b 0002 0100 - ec_point_formats
-//   000d 0016 00140401040305010503060106030301030302010203 - signature_algorithms
+//   000d 0016 0014 0401 0403 0501 0503 0601 0603 0301 0303 0201 0203 - signature_algorithms
+// wolfssl library sends this option, RFC 7627 (closes a security weakness, some servers may require it. TODO?):
+//   0017 0000 - extended master secret
         };
         struct client_hello *record;
         int len;
@@ -1354,7 +1361,7 @@ static void get_server_cert(tls_state_t *tls)
         xhdr = (void*)tls->inbuf;
         certbuf = (void*)(xhdr + 1);
         if (certbuf[0] != HANDSHAKE_CERTIFICATE)
-                tls_error_die(tls);
+                bad_record_die(tls, "certificate", len);
         dbg("<< CERTIFICATE\n");
         // 4392 bytes:
         // 0b  00|11|24 00|11|21 00|05|b0 30|82|05|ac|30|82|04|94|a0|03|02|01|02|02|11|00|9f|85|bf|66|4b|0c|dd|af|ca|50|86|79|50|1b|2b|e4|30|0d...
@@ -1611,6 +1618,7 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
         //                      <-------             Finished
         // Application Data     <------>     Application Data
         int len;
+        int got_cert_req;
 
         send_client_hello_and_alloc_hsd(tls, sni);
         get_server_hello(tls);
@@ -1638,7 +1646,8 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
                 len = tls_xread_handshake_block(tls, 4);
         }
 
-        if (tls->inbuf[RECHDR_LEN] == HANDSHAKE_CERTIFICATE_REQUEST) {
+        got_cert_req = (tls->inbuf[RECHDR_LEN] == HANDSHAKE_CERTIFICATE_REQUEST);
+        if (got_cert_req) {
                 dbg("<< CERTIFICATE_REQUEST\n");
                 // RFC 5246: "If no suitable certificate is available,
                 // the client MUST send a certificate message containing no
@@ -1647,7 +1656,9 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
                 // Client certificates are sent using the Certificate structure
                 // defined in Section 7.4.2."
                 // (i.e. the same format as server certs)
-                send_empty_client_cert(tls);
+
+                /*send_empty_client_cert(tls); - WRONG (breaks handshake hash calc) */
+                /* need to hash _all_ server replies first, up to ServerHelloDone */
                 len = tls_xread_handshake_block(tls, 4);
         }
 
@@ -1657,6 +1668,9 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
         // 0e 000000 (len:0)
         dbg("<< SERVER_HELLO_DONE\n");
 
+        if (got_cert_req)
+                send_empty_client_cert(tls);
+
         send_client_key_exchange(tls);
 
         send_change_cipher_spec(tls);
@@ -1667,7 +1681,7 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
         send_client_finished(tls);
 
         /* Get CHANGE_CIPHER_SPEC */
-        len = tls_xread_record(tls);
+        len = tls_xread_record(tls, "switch to encrypted traffic");
         if (len != 1 || memcmp(tls->inbuf, rec_CHANGE_CIPHER_SPEC, 6) != 0)
                 bad_record_die(tls, "switch to encrypted traffic", len);
         dbg("<< CHANGE_CIPHER_SPEC\n");
@@ -1685,9 +1699,9 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
         }
 
         /* Get (encrypted) FINISHED from the server */
-        len = tls_xread_record(tls);
+        len = tls_xread_record(tls, "'server finished'");
         if (len < 4 || tls->inbuf[RECHDR_LEN] != HANDSHAKE_FINISHED)
-                tls_error_die(tls);
+                bad_record_die(tls, "'server finished'", len);
         dbg("<< FINISHED\n");
         /* application data can be sent/received */
 
@@ -1713,7 +1727,7 @@ static void tls_xwrite(tls_state_t *tls, int len)
 // openssl s_server -key key.pem -cert server.pem -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher NULL
 // openssl s_client -connect 127.0.0.1:4433 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher NULL-SHA256
 
-void FAST_FUNC tls_run_copy_loop(tls_state_t *tls)
+void FAST_FUNC tls_run_copy_loop(tls_state_t *tls, unsigned flags)
 {
         int inbuf_size;
         const int INBUF_STEP = 4 * 1024;
@@ -1748,6 +1762,8 @@ void FAST_FUNC tls_run_copy_loop(tls_state_t *tls)
                                  */
                                 pfds[0].fd = -1;
                                 tls_free_outbuf(tls); /* mem usage optimization */
+                                if (flags & TLSLOOP_EXIT_ON_LOCAL_EOF)
+                                        break;
                         } else {
                                 if (nread == inbuf_size) {
                                         /* TLS has per record overhead, if input comes fast,
@@ -1763,7 +1779,7 @@ void FAST_FUNC tls_run_copy_loop(tls_state_t *tls)
                 if (pfds[1].revents) {
                         dbg("NETWORK HAS DATA\n");
  read_record:
-                        nread = tls_xread_record(tls);
+                        nread = tls_xread_record(tls, "encrypted data");
                         if (nread < 1) {
                                 /* TLS protocol has no real concept of one-sided shutdowns:
                                  * if we get "TLS EOF" from the peer, writes will fail too
@@ -1775,7 +1791,7 @@ void FAST_FUNC tls_run_copy_loop(tls_state_t *tls)
                                 break;
                         }
                         if (tls->inbuf[0] != RECORD_TYPE_APPLICATION_DATA)
-                                bb_error_msg_and_die("unexpected record type %d", tls->inbuf[0]);
+                                bad_record_die(tls, "encrypted data", nread);
                         xwrite(STDOUT_FILENO, tls->inbuf + RECHDR_LEN, nread);
                         /* We may already have a complete next record buffered,
                          * can process it without network reads (and possible blocking)
diff --git a/networking/udhcp/Config.src b/networking/udhcp/Config.src
index 8ab8d30ce..50bff2e8c 100644
--- a/networking/udhcp/Config.src
+++ b/networking/udhcp/Config.src
@@ -94,7 +94,7 @@ config FEATURE_UDHCPC_SANITIZEOPT
 config UDHCPC_DEFAULT_SCRIPT
         string "Absolute path to config script"
         default "/usr/share/udhcpc/default.script"
-        depends on UDHCPC
+        depends on UDHCPC || UDHCPC6
         help
         This script is called after udhcpc receives an answer. See
         examples/udhcp for a working example. Normally it is safe
diff --git a/networking/udhcp/d6_common.h b/networking/udhcp/d6_common.h
index 310550371..e9c0397ae 100644
--- a/networking/udhcp/d6_common.h
+++ b/networking/udhcp/d6_common.h
@@ -133,6 +133,7 @@ struct d6_option {
 struct client6_data_t {
         struct d6_option *server_id;
         struct d6_option *ia_na;
+        struct d6_option *ia_pd;
         char **env_ptr;
         unsigned env_idx;
         /* link-local IPv6 address */
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
index 37ffd064d..35c99e89c 100644
--- a/networking/udhcp/d6_dhcpc.c
+++ b/networking/udhcp/d6_dhcpc.c
@@ -96,6 +96,7 @@ static const char udhcpc6_longopts[] ALIGN1 =
         "quit\0"           No_argument       "q"
         "release\0"        No_argument       "R"
         "request\0"        Required_argument "r"
+        "requestprefix\0"  No_argument       "d"
         "script\0"         Required_argument "s"
         "timeout\0"        Required_argument "T"
         "retries\0"        Required_argument "t"
@@ -128,8 +129,9 @@ enum {
         OPT_o = 1 << 12,
         OPT_x = 1 << 13,
         OPT_f = 1 << 14,
+        OPT_d = 1 << 15,
 /* The rest has variable bit positions, need to be clever */
-        OPTBIT_f = 14,
+        OPTBIT_d = 15,
         USE_FOR_MMU(             OPTBIT_b,)
         ///IF_FEATURE_UDHCPC_ARPING(OPTBIT_a,)
         IF_FEATURE_UDHCP_PORT(   OPTBIT_P,)
@@ -277,11 +279,11 @@ static void option_to_env(uint8_t *option, uint8_t *option_end)
  * |               |
  * +-+-+-+-+-+-+-+-+
  */
-                        //move_from_unaligned32(v32, option + 4 + 4);
-                        //*new_env() = xasprintf("lease=%u", (unsigned)v32);
+                        move_from_unaligned32(v32, option + 4 + 4);
+                        *new_env() = xasprintf("ipv6prefix_lease=%u", (unsigned)v32);
 
-                        sprint_nip6(ipv6str, option + 4 + 4 + 1);
-                        *new_env() = xasprintf("ipv6prefix=%s/%u", ipv6str, (unsigned)(option[4 + 4]));
+                        sprint_nip6(ipv6str, option + 4 + 4 + 4 + 1);
+                        *new_env() = xasprintf("ipv6prefix=%s/%u", ipv6str, (unsigned)(option[4 + 4 + 4]));
                         break;
 #if ENABLE_FEATURE_UDHCPC6_RFC3646
                 case D6_OPT_DNS_SERVERS: {
@@ -561,18 +563,33 @@ static NOINLINE int send_d6_discover(uint32_t xid, struct in6_addr *requested_ip
 
         /* Create new IA_NA, optionally with included IAADDR with requested IP */
         free(client6_data.ia_na);
-        len = requested_ipv6 ? 2+2+4+4+4 + 2+2+16+4+4 : 2+2+4+4+4;
-        client6_data.ia_na = xzalloc(len);
-        client6_data.ia_na->code = D6_OPT_IA_NA;
-        client6_data.ia_na->len = len - 4;
-        *(uint32_t*)client6_data.ia_na->data = rand(); /* IAID */
-        if (requested_ipv6) {
-                struct d6_option *iaaddr = (void*)(client6_data.ia_na->data + 4+4+4);
-                iaaddr->code = D6_OPT_IAADDR;
-                iaaddr->len = 16+4+4;
-                memcpy(iaaddr->data, requested_ipv6, 16);
+        client6_data.ia_na = NULL;
+        if (option_mask32 & OPT_r) {
+                len = requested_ipv6 ? 2+2+4+4+4 + 2+2+16+4+4 : 2+2+4+4+4;
+                client6_data.ia_na = xzalloc(len);
+                client6_data.ia_na->code = D6_OPT_IA_NA;
+                client6_data.ia_na->len = len - 4;
+                *(uint32_t*)client6_data.ia_na->data = rand(); /* IAID */
+                if (requested_ipv6) {
+                        struct d6_option *iaaddr = (void*)(client6_data.ia_na->data + 4+4+4);
+                        iaaddr->code = D6_OPT_IAADDR;
+                        iaaddr->len = 16+4+4;
+                        memcpy(iaaddr->data, requested_ipv6, 16);
+                }
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, len);
+        }
+
+        /* IA_PD */
+        free(client6_data.ia_pd);
+        client6_data.ia_pd = NULL;
+        if (option_mask32 & OPT_d) {
+                len = 2+2+4+4+4;
+                client6_data.ia_pd = xzalloc(len);
+                client6_data.ia_pd->code = D6_OPT_IA_PD;
+                client6_data.ia_pd->len = len - 4;
+                *(uint32_t*)client6_data.ia_pd->data = rand(); /* IAID */
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_pd, len);
         }
-        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, len);
 
         /* Add options:
          * "param req" option according to -O, options specified with -x
@@ -625,7 +642,11 @@ static NOINLINE int send_d6_select(uint32_t xid)
         /* server id */
         opt_ptr = mempcpy(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
         /* IA NA (contains requested IP) */
-        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        if (client6_data.ia_na)
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        /* IA PD */
+        if (client6_data.ia_pd)
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_pd, client6_data.ia_pd->len + 2+2);
 
         /* Add options:
          * "param req" option according to -O, options specified with -x
@@ -694,7 +715,11 @@ static NOINLINE int send_d6_renew(uint32_t xid, struct in6_addr *server_ipv6, st
         /* server id */
         opt_ptr = mempcpy(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
         /* IA NA (contains requested IP) */
-        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        if (client6_data.ia_na)
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        /* IA PD */
+        if (client6_data.ia_pd)
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_pd, client6_data.ia_pd->len + 2+2);
 
         /* Add options:
          * "param req" option according to -O, options specified with -x
@@ -725,7 +750,11 @@ static int send_d6_release(struct in6_addr *server_ipv6, struct in6_addr *our_cu
         /* server id */
         opt_ptr = mempcpy(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
         /* IA NA (contains our current IP) */
-        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        if (client6_data.ia_na)
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        /* IA PD */
+        if (client6_data.ia_pd)
+                opt_ptr = mempcpy(opt_ptr, client6_data.ia_pd, client6_data.ia_pd->len + 2+2);
 
         bb_error_msg("sending %s", "release");
         return d6_send_kernel_packet(
@@ -1001,44 +1030,9 @@ static void client_background(void)
 //usage:# define IF_UDHCP_VERBOSE(...)
 //usage:#endif
 //usage:#define udhcpc6_trivial_usage
-//usage:       "[-fbnq"IF_UDHCP_VERBOSE("v")"oR] [-i IFACE] [-r IP] [-s PROG] [-p PIDFILE]\n"
+//usage:       "[-fbnq"IF_UDHCP_VERBOSE("v")"odR] [-i IFACE] [-r IPv6] [-s PROG] [-p PIDFILE]\n"
 //usage:       "        [-x OPT:VAL]... [-O OPT]..." IF_FEATURE_UDHCP_PORT(" [-P N]")
 //usage:#define udhcpc6_full_usage "\n"
-//usage:        IF_LONG_OPTS(
-//usage:     "\n        -i,--interface IFACE    Interface to use (default eth0)"
-//usage:     "\n        -p,--pidfile FILE       Create pidfile"
-//usage:     "\n        -s,--script PROG        Run PROG at DHCP events (default "CONFIG_UDHCPC_DEFAULT_SCRIPT")"
-//usage:     "\n        -B,--broadcast          Request broadcast replies"
-//usage:     "\n        -t,--retries N          Send up to N discover packets"
-//usage:     "\n        -T,--timeout N          Pause between packets (default 3 seconds)"
-//usage:     "\n        -A,--tryagain N         Wait N seconds after failure (default 20)"
-//usage:     "\n        -f,--foreground         Run in foreground"
-//usage:        USE_FOR_MMU(
-//usage:     "\n        -b,--background         Background if lease is not obtained"
-//usage:        )
-//usage:     "\n        -n,--now                Exit if lease is not obtained"
-//usage:     "\n        -q,--quit               Exit after obtaining lease"
-//usage:     "\n        -R,--release            Release IP on exit"
-//usage:     "\n        -S,--syslog             Log to syslog too"
-//usage:        IF_FEATURE_UDHCP_PORT(
-//usage:     "\n        -P,--client-port N      Use port N (default 546)"
-//usage:        )
-////usage:      IF_FEATURE_UDHCPC_ARPING(
-////usage:     "\n      -a,--arping             Use arping to validate offered address"
-////usage:      )
-//usage:     "\n        -O,--request-option OPT Request option OPT from server (cumulative)"
-//usage:     "\n        -o,--no-default-options Don't request any options (unless -O is given)"
-//usage:     "\n        -r,--request IP         Request this IP address"
-//usage:     "\n        -x OPT:VAL              Include option OPT in sent packets (cumulative)"
-//usage:     "\n                                Examples of string, numeric, and hex byte opts:"
-//usage:     "\n                                -x hostname:bbox - option 12"
-//usage:     "\n                                -x lease:3600 - option 51 (lease time)"
-//usage:     "\n                                -x 0x3d:0100BEEFC0FFEE - option 61 (client id)"
-//usage:        IF_UDHCP_VERBOSE(
-//usage:     "\n        -v                      Verbose"
-//usage:        )
-//usage:        )
-//usage:        IF_NOT_LONG_OPTS(
 //usage:     "\n        -i IFACE        Interface to use (default eth0)"
 //usage:     "\n        -p FILE         Create pidfile"
 //usage:     "\n        -s PROG         Run PROG at DHCP events (default "CONFIG_UDHCPC_DEFAULT_SCRIPT")"
@@ -1062,7 +1056,8 @@ static void client_background(void)
 ////usage:      )
 //usage:     "\n        -O OPT          Request option OPT from server (cumulative)"
 //usage:     "\n        -o              Don't request any options (unless -O is given)"
-//usage:     "\n        -r IP           Request this IP address"
+//usage:     "\n        -r IPv6         Request this address ('no' to not request any IP)"
+//usage:     "\n        -d              Request prefix"
 //usage:     "\n        -x OPT:VAL      Include option OPT in sent packets (cumulative)"
 //usage:     "\n                        Examples of string, numeric, and hex byte opts:"
 //usage:     "\n                        -x hostname:bbox - option 12"
@@ -1071,7 +1066,6 @@ static void client_background(void)
 //usage:        IF_UDHCP_VERBOSE(
 //usage:     "\n        -v              Verbose"
 //usage:        )
-//usage:        )
 //usage:     "\nSignals:"
 //usage:     "\n        USR1    Renew lease"
 //usage:     "\n        USR2    Release lease"
@@ -1099,6 +1093,8 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
         int retval;
 
         setup_common_bufsiz();
+        /* We want random_xid to be random */
+        srand(monotonic_us());
 
         /* Default options */
         IF_FEATURE_UDHCP_PORT(SERVER_PORT6 = 547;)
@@ -1109,7 +1105,7 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
         /* Parse command line */
         opt = getopt32long(argv, "^"
                 /* O,x: list; -T,-t,-A take numeric param */
-                "i:np:qRr:s:T:+t:+SA:+O:*ox:*f"
+                "i:np:qRr:s:T:+t:+SA:+O:*ox:*fd"
                 USE_FOR_MMU("b")
                 ///IF_FEATURE_UDHCPC_ARPING("a")
                 IF_FEATURE_UDHCP_PORT("P:")
@@ -1125,10 +1121,15 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                 IF_UDHCP_VERBOSE(, &dhcp_verbose)
         );
         requested_ipv6 = NULL;
+        option_mask32 |= OPT_r;
         if (opt & OPT_r) {
-                if (inet_pton(AF_INET6, str_r, &ipv6_buf) <= 0)
-                        bb_error_msg_and_die("bad IPv6 address '%s'", str_r);
-                requested_ipv6 = &ipv6_buf;
+                if (strcmp(str_r, "no") == 0) {
+                        option_mask32 -= OPT_r;
+                } else {
+                        if (inet_pton(AF_INET6, str_r, &ipv6_buf) <= 0)
+                                bb_error_msg_and_die("bad IPv6 address '%s'", str_r);
+                        requested_ipv6 = &ipv6_buf;
+                }
         }
 #if ENABLE_FEATURE_UDHCP_PORT
         if (opt & OPT_P) {
@@ -1200,16 +1201,12 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
 
         /* Make sure fd 0,1,2 are open */
         bb_sanitize_stdio();
-        /* Equivalent of doing a fflush after every \n */
-        setlinebuf(stdout);
         /* Create pidfile */
         write_pidfile(client_config.pidfile);
         /* Goes to stdout (unless NOMMU) and possibly syslog */
         bb_error_msg("started, v"BB_VER);
         /* Set up the signal pipe */
         udhcp_sp_setup();
-        /* We want random_xid to be random... */
-        srand(monotonic_us());
 
         state = INIT_SELECTING;
         d6_run_script(NULL, "deconfig");
@@ -1465,8 +1462,12 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                 case REBINDING:
                         if (packet.d6_msg_type == D6_MSG_REPLY) {
                                 uint32_t lease_seconds;
-                                struct d6_option *option, *iaaddr;
+                                struct d6_option *option;
+                                unsigned address_timeout;
+                                unsigned prefix_timeout;
  type_is_ok:
+                                address_timeout = 0;
+                                prefix_timeout = 0;
                                 option = d6_find_option(packet.d6_options, packet_end, D6_OPT_STATUS_CODE);
                                 if (option && (option->data[0] | option->data[1]) != 0) {
                                         /* return to init state */
@@ -1589,44 +1590,87 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
  * .                                                               .
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
-                                free(client6_data.ia_na);
-                                client6_data.ia_na = d6_copy_option(packet.d6_options, packet_end, D6_OPT_IA_NA);
-                                if (!client6_data.ia_na) {
-                                        bb_error_msg("no %s option, ignoring packet", "IA_NA");
-                                        continue;
-                                }
-                                if (client6_data.ia_na->len < (4 + 4 + 4) + (2 + 2 + 16 + 4 + 4)) {
-                                        bb_error_msg("IA_NA option is too short:%d bytes", client6_data.ia_na->len);
-                                        continue;
-                                }
-                                iaaddr = d6_find_option(client6_data.ia_na->data + 4 + 4 + 4,
-                                                client6_data.ia_na->data + client6_data.ia_na->len,
-                                                D6_OPT_IAADDR
-                                );
-                                if (!iaaddr) {
-                                        bb_error_msg("no %s option, ignoring packet", "IAADDR");
-                                        continue;
+                                if (option_mask32 & OPT_r) {
+                                        struct d6_option *iaaddr;
+
+                                        free(client6_data.ia_na);
+                                        client6_data.ia_na = d6_copy_option(packet.d6_options, packet_end, D6_OPT_IA_NA);
+                                        if (!client6_data.ia_na) {
+                                                bb_error_msg("no %s option, ignoring packet", "IA_NA");
+                                                continue;
+                                        }
+                                        if (client6_data.ia_na->len < (4 + 4 + 4) + (2 + 2 + 16 + 4 + 4)) {
+                                                bb_error_msg("%s option is too short:%d bytes",
+                                                        "IA_NA", client6_data.ia_na->len);
+                                                continue;
+                                        }
+                                        iaaddr = d6_find_option(client6_data.ia_na->data + 4 + 4 + 4,
+                                                        client6_data.ia_na->data + client6_data.ia_na->len,
+                                                        D6_OPT_IAADDR
+                                        );
+                                        if (!iaaddr) {
+                                                bb_error_msg("no %s option, ignoring packet", "IAADDR");
+                                                continue;
+                                        }
+                                        if (iaaddr->len < (16 + 4 + 4)) {
+                                                bb_error_msg("%s option is too short:%d bytes",
+                                                        "IAADDR", iaaddr->len);
+                                                continue;
+                                        }
+                                        /* Note: the address is sufficiently aligned for cast:
+                                         * we _copied_ IA-NA, and copy is always well-aligned.
+                                         */
+                                        requested_ipv6 = (struct in6_addr*) iaaddr->data;
+                                        move_from_unaligned32(lease_seconds, iaaddr->data + 16 + 4);
+                                        lease_seconds = ntohl(lease_seconds);
+/// TODO: check for 0 lease time?
+                                        bb_error_msg("%s obtained, lease time %u",
+                                                "IPv6", /*inet_ntoa(temp_addr),*/ (unsigned)lease_seconds);
+                                        address_timeout = lease_seconds;
                                 }
-                                if (iaaddr->len < (16 + 4 + 4)) {
-                                        bb_error_msg("IAADDR option is too short:%d bytes", iaaddr->len);
-                                        continue;
+                                if (option_mask32 & OPT_d) {
+                                        struct d6_option *iaprefix;
+
+                                        free(client6_data.ia_pd);
+                                        client6_data.ia_pd = d6_copy_option(packet.d6_options, packet_end, D6_OPT_IA_PD);
+                                        if (!client6_data.ia_pd) {
+                                                bb_error_msg("no %s option, ignoring packet", "IA_PD");
+                                                continue;
+                                        }
+                                        if (client6_data.ia_pd->len < (4 + 4 + 4) + (2 + 2 + 4 + 4 + 1 + 16)) {
+                                                bb_error_msg("%s option is too short:%d bytes",
+                                                        "IA_PD", client6_data.ia_pd->len);
+                                                continue;
+                                        }
+                                        iaprefix = d6_find_option(client6_data.ia_pd->data + 4 + 4 + 4,
+                                                        client6_data.ia_pd->data + client6_data.ia_pd->len,
+                                                        D6_OPT_IAPREFIX
+                                        );
+                                        if (!iaprefix) {
+                                                bb_error_msg("no %s option, ignoring packet", "IAPREFIX");
+                                                continue;
+                                        }
+                                        if (iaprefix->len < (4 + 4 + 1 + 16)) {
+                                                bb_error_msg("%s option is too short:%d bytes",
+                                                        "IAPREFIX", iaprefix->len);
+                                                continue;
+                                        }
+                                        move_from_unaligned32(lease_seconds, iaprefix->data + 4);
+                                        lease_seconds = ntohl(lease_seconds);
+                                        bb_error_msg("%s obtained, lease time %u",
+                                                "prefix", /*inet_ntoa(temp_addr),*/ (unsigned)lease_seconds);
+                                        prefix_timeout = lease_seconds;
                                 }
-                                /* Note: the address is sufficiently aligned for cast:
-                                 * we _copied_ IA-NA, and copy is always well-aligned.
-                                 */
-                                requested_ipv6 = (struct in6_addr*) iaaddr->data;
-                                move_from_unaligned32(lease_seconds, iaaddr->data + 16 + 4);
-                                lease_seconds = ntohl(lease_seconds);
-                                /* paranoia: must not be too small and not prone to overflows */
-                                if (lease_seconds < 0x10)
-                                        lease_seconds = 0x10;
-/// TODO: check for 0 lease time?
-                                if (lease_seconds > 0x7fffffff / 1000)
-                                        lease_seconds = 0x7fffffff / 1000;
+                                if (!address_timeout)
+                                        address_timeout = prefix_timeout;
+                                if (!prefix_timeout)
+                                        prefix_timeout = address_timeout;
+                                /* note: "int timeout" will not overflow even with 0xffffffff inputs here: */
+                                timeout = (prefix_timeout < address_timeout ? prefix_timeout : address_timeout) / 2;
+                                /* paranoia: must not be too small */
+                                if (timeout < 0x10)
+                                        timeout = 0x10;
                                 /* enter bound state */
-                                timeout = lease_seconds / 2;
-                                bb_error_msg("lease obtained, lease time %u",
-                                        /*inet_ntoa(temp_addr),*/ (unsigned)lease_seconds);
                                 d6_run_script(&packet, state == REQUESTING ? "bound" : "renew");
 
                                 state = BOUND;
diff --git a/networking/udhcp/d6_socket.c b/networking/udhcp/d6_socket.c
index d00c217d6..315c8d98a 100644
--- a/networking/udhcp/d6_socket.c
+++ b/networking/udhcp/d6_socket.c
@@ -16,7 +16,6 @@ int FAST_FUNC d6_read_interface(const char *interface, int *ifindex, struct in6_
         struct ifaddrs *ifap, *ifa;
 
         getifaddrs(&ifap);
-
         for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
                 struct sockaddr_in6 *sip6;
 
@@ -29,9 +28,9 @@ int FAST_FUNC d6_read_interface(const char *interface, int *ifindex, struct in6_
                         struct sockaddr_ll *sll = (struct sockaddr_ll*)(ifa->ifa_addr);
                         memcpy(mac, sll->sll_addr, 6);
                         log2("MAC %02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
-                        log2("ifindex %d", sll->sll_ifindex);
                         *ifindex = sll->sll_ifindex;
-                        retval &= (0xf - (1<<0));
+                        log2("ifindex %d", *ifindex);
+                        retval &= (3 - (1<<0));
                 }
 #if 0
                 if (ifa->ifa_addr->sa_family == AF_INET) {
@@ -54,11 +53,33 @@ int FAST_FUNC d6_read_interface(const char *interface, int *ifindex, struct in6_
                                 nip6->s6_addr[12], nip6->s6_addr[13],
                                 nip6->s6_addr[14], nip6->s6_addr[15]
                         );
-                        retval &= (0xf - (1<<1));
+                        retval &= (3 - (1<<1));
                 }
         }
-
         freeifaddrs(ifap);
+
+        if (retval & (1<<0)) {
+                /* This iface has no MAC (e.g. ppp), generate a random one */
+                struct ifreq ifr;
+                int fd;
+
+                memset(&ifr, 0, sizeof(ifr));
+                strncpy_IFNAMSIZ(ifr.ifr_name, interface);
+                fd = xsocket(AF_INET6, SOCK_RAW, IPPROTO_RAW);
+                if (ioctl(fd, SIOCGIFINDEX, &ifr) == 0) {
+                        *ifindex = ifr.ifr_ifindex;
+                        log2("ifindex %d", *ifindex);
+                        if (((uint32_t*)mac)[0] == 0) {
+                                /* invent a fictitious MAC (once) */
+                                ((uint32_t*)mac)[0] = rand();
+                                ((uint16_t*)mac)[2] = rand();
+                                mac[0] &= 0xfc; /* make sure it's not bcast */
+                        }
+                        retval &= (3 - (1<<0));
+                }
+                close(fd);
+        }
+
         if (retval == 0)
                 return retval;
 
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index 55f21c187..35694fbe3 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -1386,8 +1386,6 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
 
         /* Make sure fd 0,1,2 are open */
         bb_sanitize_stdio();
-        /* Equivalent of doing a fflush after every \n */
-        setlinebuf(stdout);
         /* Create pidfile */
         write_pidfile(client_config.pidfile);
         /* Goes to stdout (unless NOMMU) and possibly syslog */
@@ -1732,8 +1730,10 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                                         /* paranoia: must not be too small and not prone to overflows */
                                         if (lease_seconds < 0x10)
                                                 lease_seconds = 0x10;
-                                        if (lease_seconds > 0x7fffffff / 1000)
-                                                lease_seconds = 0x7fffffff / 1000;
+                                        //if (lease_seconds > 0x7fffffff)
+                                        //      lease_seconds = 0x7fffffff;
+                                        //^^^not necessary since "timeout = lease_seconds / 2"
+                                        //does not overflow even for 0xffffffff.
                                 }
 #if ENABLE_FEATURE_UDHCPC_ARPING
                                 if (opt & OPT_a) {
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 238542bb0..093239536 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -45,7 +45,7 @@
 #include "dhcpd.h"
 
 /* globals */
-struct dyn_lease *g_leases;
+#define g_leases ((struct dyn_lease*)ptr_to_globals)
 /* struct server_config_t server_config is in bb_common_bufsiz1 */
 
 /* Takes the address of the pointer to the static_leases linked list,
@@ -856,8 +856,6 @@ int udhcpd_main(int argc UNUSED_PARAM, char **argv)
 
         /* Make sure fd 0,1,2 are open */
         bb_sanitize_stdio();
-        /* Equivalent of doing a fflush after every \n */
-        setlinebuf(stdout);
 
         /* Create pidfile */
         write_pidfile(server_config.pidfile);
@@ -880,7 +878,9 @@ int udhcpd_main(int argc UNUSED_PARAM, char **argv)
                 server_config.max_leases = num_ips;
         }
 
-        g_leases = xzalloc(server_config.max_leases * sizeof(g_leases[0]));
+        /* this sets g_leases */
+        SET_PTR_TO_GLOBALS(xzalloc(server_config.max_leases * sizeof(g_leases[0])));
+
         read_leases(server_config.lease_file);
 
         if (udhcp_read_interface(server_config.interface,
diff --git a/networking/udhcp/dhcprelay.c b/networking/udhcp/dhcprelay.c
index 4d5644093..86dcb1af0 100644
--- a/networking/udhcp/dhcprelay.c
+++ b/networking/udhcp/dhcprelay.c
@@ -254,7 +254,7 @@ static void pass_to_client(struct dhcp_packet *p, int packet_len, int *fds)
 }
 
 int dhcprelay_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
-int dhcprelay_main(int argc, char **argv)
+int dhcprelay_main(int argc UNUSED_PARAM, char **argv)
 {
         struct sockaddr_in server_addr;
         char **iface_list;
@@ -269,11 +269,11 @@ int dhcprelay_main(int argc, char **argv)
         server_addr.sin_port = htons(SERVER_PORT);
 
         /* dhcprelay CLIENT_IFACE1[,CLIENT_IFACE2...] SERVER_IFACE [SERVER_IP] */
-        if (argc == 4) {
+        if (!argv[1] || !argv[2])
+                bb_show_usage();
+        if (argv[3]) {
                 if (!inet_aton(argv[3], &server_addr.sin_addr))
                         bb_perror_msg_and_die("bad server IP");
-        } else if (argc != 3) {
-                bb_show_usage();
         }
 
         iface_list = make_iface_list(argv + 1, &num_sockets);
diff --git a/networking/wget.c b/networking/wget.c
index 1f5ab8bc2..b9225fac0 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -48,6 +48,7 @@
 //config:
 //config:config FEATURE_WGET_HTTPS
 //config:       bool "Support HTTPS using internal TLS code"
+//it also enables FTPS support, but it's not well tested yet
 //config:       default y
 //config:       depends on WGET
 //config:       select TLS
@@ -176,6 +177,9 @@ struct host_info {
 static const char P_FTP[] ALIGN1 = "ftp";
 static const char P_HTTP[] ALIGN1 = "http";
 #if SSL_SUPPORTED
+# if ENABLE_FEATURE_WGET_HTTPS
+static const char P_FTPS[] ALIGN1 = "ftps";
+# endif
 static const char P_HTTPS[] ALIGN1 = "https";
 #endif
 
@@ -348,15 +352,6 @@ static char *base64enc(const char *str)
 }
 #endif
 
-static char* sanitize_string(char *s)
-{
-        unsigned char *p = (void *) s;
-        while (*p >= ' ')
-                p++;
-        *p = '\0';
-        return s;
-}
-
 #if ENABLE_FEATURE_WGET_TIMEOUT
 static void alarm_handler(int sig UNUSED_PARAM)
 {
@@ -419,22 +414,49 @@ static FILE *open_socket(len_and_sockaddr *lsa)
         return fp;
 }
 
+/* We balk at any control chars in other side's messages.
+ * This prevents nasty surprises (e.g. ESC sequences) in "Location:" URLs
+ * and error messages.
+ *
+ * The only exception is tabs, which are converted to (one) space:
+ * HTTP's "headers: <whitespace> values" may have those.
+ */
+static char* sanitize_string(char *s)
+{
+        unsigned char *p = (void *) s;
+        while (*p) {
+                if (*p < ' ') {
+                        if (*p != '\t')
+                                break;
+                        *p = ' ';
+                }
+                p++;
+        }
+        *p = '\0';
+        return s;
+}
+
 /* Returns '\n' if it was seen, else '\0'. Trims at first '\r' or '\n' */
-static char fgets_and_trim(FILE *fp, const char *fmt)
+static char fgets_trim_sanitize(FILE *fp, const char *fmt)
 {
         char c;
         char *buf_ptr;
 
         set_alarm();
-        if (fgets(G.wget_buf, sizeof(G.wget_buf) - 1, fp) == NULL)
+        if (fgets(G.wget_buf, sizeof(G.wget_buf), fp) == NULL)
                 bb_perror_msg_and_die("error getting response");
         clear_alarm();
 
         buf_ptr = strchrnul(G.wget_buf, '\n');
         c = *buf_ptr;
+#if 1
+        /* Disallow any control chars: trim at first char < 0x20 */
+        sanitize_string(G.wget_buf);
+#else
         *buf_ptr = '\0';
         buf_ptr = strchrnul(G.wget_buf, '\r');
         *buf_ptr = '\0';
+#endif
 
         log_io("< %s", G.wget_buf);
 
@@ -461,8 +483,10 @@ static int ftpcmd(const char *s1, const char *s2, FILE *fp)
 #endif
         }
 
+        /* Read until "Nxx something" is received */
+        G.wget_buf[3] = 0;
         do {
-                fgets_and_trim(fp, "%s\n");
+                fgets_trim_sanitize(fp, "%s\n");
         } while (!isdigit(G.wget_buf[0]) || G.wget_buf[3] != ' ');
 #if ENABLE_PLATFORM_MINGW32
         fseek(fp, 0L, SEEK_CUR);
@@ -490,6 +514,12 @@ static void parse_url(const char *src_url, struct host_info *h)
                         h->port = bb_lookup_port(P_FTP, "tcp", 21);
                 } else
 #if SSL_SUPPORTED
+# if ENABLE_FEATURE_WGET_HTTPS
+                if (strcmp(url, P_FTPS) == 0) {
+                        h->port = bb_lookup_port(P_FTPS, "tcp", 990);
+                        h->protocol = P_FTPS;
+                } else
+# endif
                 if (strcmp(url, P_HTTPS) == 0) {
                         h->port = bb_lookup_port(P_HTTPS, "tcp", 443);
                         h->protocol = P_HTTPS;
@@ -501,7 +531,7 @@ static void parse_url(const char *src_url, struct host_info *h)
                         h->protocol = P_HTTP;
                 } else {
                         *p = ':';
-                        bb_error_msg_and_die("not an http or ftp url: %s", sanitize_string(url));
+                        bb_error_msg_and_die("not an http or ftp url: %s", url);
                 }
         } else {
                 // GNU wget is user-friendly and falls back to http://
@@ -556,13 +586,13 @@ static void parse_url(const char *src_url, struct host_info *h)
          */
 }
 
-static char *gethdr(FILE *fp)
+static char *get_sanitized_hdr(FILE *fp)
 {
         char *s, *hdrval;
         int c;
 
         /* retrieve header line */
-        c = fgets_and_trim(fp, "  %s\n");
+        c = fgets_trim_sanitize(fp, "  %s\n");
 
         /* end of the headers? */
         if (G.wget_buf[0] == '\0')
@@ -584,7 +614,7 @@ static char *gethdr(FILE *fp)
 
         /* verify we are at the end of the header name */
         if (*s != ':')
-                bb_error_msg_and_die("bad header line: %s", sanitize_string(G.wget_buf));
+                bb_error_msg_and_die("bad header line: %s", G.wget_buf);
 
         /* locate the start of the header value */
         *s++ = '\0';
@@ -608,87 +638,6 @@ static void reset_beg_range_to_zero(void)
         /* ftruncate(G.output_fd, 0); */
 }
 
-static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_sockaddr *lsa)
-{
-        FILE *sfp;
-        char *str;
-        int port;
-
-        if (!target->user)
-                target->user = xstrdup("anonymous:busybox@");
-
-        sfp = open_socket(lsa);
-        if (ftpcmd(NULL, NULL, sfp) != 220)
-                bb_error_msg_and_die("%s", sanitize_string(G.wget_buf + 4));
-
-        /*
-         * Splitting username:password pair,
-         * trying to log in
-         */
-        str = strchr(target->user, ':');
-        if (str)
-                *str++ = '\0';
-        switch (ftpcmd("USER ", target->user, sfp)) {
-        case 230:
-                break;
-        case 331:
-                if (ftpcmd("PASS ", str, sfp) == 230)
-                        break;
-                /* fall through (failed login) */
-        default:
-                bb_error_msg_and_die("ftp login: %s", sanitize_string(G.wget_buf + 4));
-        }
-
-        ftpcmd("TYPE I", NULL, sfp);
-
-        /*
-         * Querying file size
-         */
-        if (ftpcmd("SIZE ", target->path, sfp) == 213) {
-                G.content_len = BB_STRTOOFF(G.wget_buf + 4, NULL, 10);
-                if (G.content_len < 0 || errno) {
-                        bb_error_msg_and_die("SIZE value is garbage");
-                }
-                G.got_clen = 1;
-        }
-
-        /*
-         * Entering passive mode
-         */
-        if (ftpcmd("PASV", NULL, sfp) != 227) {
- pasv_error:
-                bb_error_msg_and_die("bad response to %s: %s", "PASV", sanitize_string(G.wget_buf));
-        }
-        // Response is "227 garbageN1,N2,N3,N4,P1,P2[)garbage]
-        // Server's IP is N1.N2.N3.N4 (we ignore it)
-        // Server's port for data connection is P1*256+P2
-        str = strrchr(G.wget_buf, ')');
-        if (str) str[0] = '\0';
-        str = strrchr(G.wget_buf, ',');
-        if (!str) goto pasv_error;
-        port = xatou_range(str+1, 0, 255);
-        *str = '\0';
-        str = strrchr(G.wget_buf, ',');
-        if (!str) goto pasv_error;
-        port += xatou_range(str+1, 0, 255) * 256;
-        set_nport(&lsa->u.sa, htons(port));
-
-        *dfpp = open_socket(lsa);
-
-        if (G.beg_range != 0) {
-                sprintf(G.wget_buf, "REST %"OFF_FMT"u", G.beg_range);
-                if (ftpcmd(G.wget_buf, NULL, sfp) == 350)
-                        G.content_len -= G.beg_range;
-                else
-                        reset_beg_range_to_zero();
-        }
-
-        if (ftpcmd("RETR ", target->path, sfp) > 150)
-                bb_error_msg_and_die("bad response to %s: %s", "RETR", sanitize_string(G.wget_buf));
-
-        return sfp;
-}
-
 #if ENABLE_FEATURE_WGET_OPENSSL
 static int spawn_https_helper_openssl(const char *host, unsigned port)
 {
@@ -765,7 +714,7 @@ static int spawn_https_helper_openssl(const char *host, unsigned port)
 #endif
 
 #if ENABLE_FEATURE_WGET_HTTPS
-static void spawn_ssl_client(const char *host, int network_fd)
+static void spawn_ssl_client(const char *host, int network_fd, int flags)
 {
         int sp[2];
         int pid;
@@ -790,17 +739,19 @@ static void spawn_ssl_client(const char *host, int network_fd)
                         tls_state_t *tls = new_tls_state();
                         tls->ifd = tls->ofd = network_fd;
                         tls_handshake(tls, servername);
-                        tls_run_copy_loop(tls);
+                        tls_run_copy_loop(tls, flags);
                         exit(0);
                 } else {
-                        char *argv[5];
+                        char *argv[6];
+
                         xmove_fd(network_fd, 3);
                         argv[0] = (char*)"ssl_client";
                         argv[1] = (char*)"-s3";
                         //TODO: if (!is_ip_address(servername))...
                         argv[2] = (char*)"-n";
                         argv[3] = servername;
-                        argv[4] = NULL;
+                        argv[4] = (flags & TLSLOOP_EXIT_ON_LOCAL_EOF ? (char*)"-e" : NULL);
+                        argv[5] = NULL;
                         BB_EXECVP(argv[0], argv);
                         bb_perror_msg_and_die("can't execute '%s'", argv[0]);
                 }
@@ -814,6 +765,101 @@ static void spawn_ssl_client(const char *host, int network_fd)
 }
 #endif
 
+static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_sockaddr *lsa)
+{
+        FILE *sfp;
+        char *str;
+        int port;
+
+        if (!target->user)
+                target->user = xstrdup("anonymous:busybox@");
+
+        sfp = open_socket(lsa);
+#if ENABLE_FEATURE_WGET_HTTPS
+        if (target->protocol == P_FTPS)
+                spawn_ssl_client(target->host, fileno(sfp), TLSLOOP_EXIT_ON_LOCAL_EOF);
+#endif
+
+        if (ftpcmd(NULL, NULL, sfp) != 220)
+                bb_error_msg_and_die("%s", G.wget_buf);
+                /* note: ftpcmd() sanitizes G.wget_buf, ok to print */
+
+        /*
+         * Splitting username:password pair,
+         * trying to log in
+         */
+        str = strchr(target->user, ':');
+        if (str)
+                *str++ = '\0';
+        switch (ftpcmd("USER ", target->user, sfp)) {
+        case 230:
+                break;
+        case 331:
+                if (ftpcmd("PASS ", str, sfp) == 230)
+                        break;
+                /* fall through (failed login) */
+        default:
+                bb_error_msg_and_die("ftp login: %s", G.wget_buf);
+        }
+
+        ftpcmd("TYPE I", NULL, sfp);
+
+        /*
+         * Querying file size
+         */
+        if (ftpcmd("SIZE ", target->path, sfp) == 213) {
+                G.content_len = BB_STRTOOFF(G.wget_buf + 4, NULL, 10);
+                if (G.content_len < 0 || errno) {
+                        bb_error_msg_and_die("SIZE value is garbage");
+                }
+                G.got_clen = 1;
+        }
+
+        /*
+         * Entering passive mode
+         */
+        if (ENABLE_FEATURE_IPV6 && ftpcmd("EPSV", NULL, sfp) == 229) {
+                /* good */
+        } else
+        if (ftpcmd("PASV", NULL, sfp) != 227) {
+ pasv_error:
+                bb_error_msg_and_die("bad response to %s: %s", "PASV", G.wget_buf);
+        }
+        port = parse_pasv_epsv(G.wget_buf);
+        if (port < 0)
+                goto pasv_error;
+
+        set_nport(&lsa->u.sa, htons(port));
+
+        *dfpp = open_socket(lsa);
+
+#if ENABLE_FEATURE_WGET_HTTPS
+        if (target->protocol == P_FTPS) {
+                /* "PROT P" enables encryption of data stream.
+                 * Without it (or with "PROT C"), data is sent unencrypted.
+                 */
+                if (ftpcmd("PROT P", NULL, sfp) == 200)
+                        spawn_ssl_client(target->host, fileno(*dfpp), /*flags*/ 0);
+        }
+#endif
+
+        if (G.beg_range != 0) {
+                sprintf(G.wget_buf, "REST %"OFF_FMT"u", G.beg_range);
+                if (ftpcmd(G.wget_buf, NULL, sfp) == 350)
+                        G.content_len -= G.beg_range;
+                else
+                        reset_beg_range_to_zero();
+        }
+
+//TODO: needs ftp-escaping 0xff and '\n' bytes here.
+//Or disallow '\n' altogether via sanitize_string() in parse_url().
+//But 0xff's are possible in valid utf8 filenames.
+        if (ftpcmd("RETR ", target->path, sfp) > 150)
+                bb_error_msg_and_die("bad response to %s: %s", "RETR", G.wget_buf);
+
+        return sfp;
+}
+
 static void NOINLINE retrieve_file_data(FILE *dfp)
 {
 #if ENABLE_FEATURE_WGET_STATUSBAR || ENABLE_FEATURE_WGET_TIMEOUT
@@ -930,9 +976,9 @@ static void NOINLINE retrieve_file_data(FILE *dfp)
                 if (!G.chunked)
                         break;
 
-                fgets_and_trim(dfp, NULL); /* Eat empty line */
+                fgets_trim_sanitize(dfp, NULL); /* Eat empty line */
  get_clen:
-                fgets_and_trim(dfp, NULL);
+                fgets_trim_sanitize(dfp, NULL);
                 G.content_len = STRTOOFF(G.wget_buf, NULL, 16);
                 /* FIXME: error check? */
                 if (G.content_len == 0)
@@ -987,7 +1033,7 @@ static void download_one_url(const char *url)
         /* Use the proxy if necessary */
         use_proxy = (strcmp(G.proxy_flag, "off") != 0);
         if (use_proxy) {
-                proxy = getenv(target.protocol == P_FTP ? "ftp_proxy" : "http_proxy");
+                proxy = getenv(target.protocol[0] == 'f' ? "ftp_proxy" : "http_proxy");
 //FIXME: what if protocol is https? Ok to use http_proxy?
                 use_proxy = (proxy && proxy[0]);
                 if (use_proxy)
@@ -1048,7 +1094,7 @@ static void download_one_url(const char *url)
         /*G.content_len = 0; - redundant, got_clen = 0 is enough */
         G.got_clen = 0;
         G.chunked = 0;
-        if (use_proxy || target.protocol != P_FTP) {
+        if (use_proxy || target.protocol[0] != 'f' /*not ftp[s]*/) {
                 /*
                  *  HTTP session
                  */
@@ -1066,7 +1112,7 @@ static void download_one_url(const char *url)
 # if ENABLE_FEATURE_WGET_HTTPS
                         if (fd < 0) { /* no openssl? try internal */
                                 sfp = open_socket(lsa);
-                                spawn_ssl_client(server.host, fileno(sfp));
+                                spawn_ssl_client(server.host, fileno(sfp), /*flags*/ 0);
                                 goto socket_opened;
                         }
 # else
@@ -1083,7 +1129,7 @@ static void download_one_url(const char *url)
                 /* Only internal TLS support is configured */
                 sfp = open_socket(lsa);
                 if (target.protocol == P_HTTPS)
-                        spawn_ssl_client(server.host, fileno(sfp));
+                        spawn_ssl_client(server.host, fileno(sfp), /*flags*/ 0);
 #else
                 /* ssl (https) support is not configured */
                 sfp = open_socket(lsa);
@@ -1162,7 +1208,7 @@ static void download_one_url(const char *url)
                  * Retrieve HTTP response line and check for "200" status code.
                  */
  read_response:
-                fgets_and_trim(sfp, "  %s\n");
+                fgets_trim_sanitize(sfp, "  %s\n");
 
                 str = G.wget_buf;
                 str = skip_non_whitespace(str);
@@ -1173,7 +1219,7 @@ static void download_one_url(const char *url)
                 switch (status) {
                 case 0:
                 case 100:
-                        while (gethdr(sfp) != NULL)
+                        while (get_sanitized_hdr(sfp) != NULL)
                                 /* eat all remaining headers */;
                         goto read_response;
 
@@ -1237,13 +1283,13 @@ However, in real world it was observed that some web servers
                         /* Partial Content even though we did not ask for it??? */
                         /* fall through */
                 default:
-                        bb_error_msg_and_die("server returned error: %s", sanitize_string(G.wget_buf));
+                        bb_error_msg_and_die("server returned error: %s", G.wget_buf);
                 }
 
                 /*
                  * Retrieve HTTP headers.
                  */
-                while ((str = gethdr(sfp)) != NULL) {
+                while ((str = get_sanitized_hdr(sfp)) != NULL) {
                         static const char keywords[] ALIGN1 =
                                 "content-length\0""transfer-encoding\0""location\0";
                         enum {
@@ -1251,7 +1297,7 @@ However, in real world it was observed that some web servers
                         };
                         smalluint key;
 
-                        /* gethdr converted "FOO:" string to lowercase */
+                        /* get_sanitized_hdr converted "FOO:" string to lowercase */
 
                         /* strip trailing whitespace */
                         char *s = strchrnul(str, '\0') - 1;
@@ -1263,14 +1309,14 @@ However, in real world it was observed that some web servers
                         if (key == KEY_content_length) {
                                 G.content_len = BB_STRTOOFF(str, NULL, 10);
                                 if (G.content_len < 0 || errno) {
-                                        bb_error_msg_and_die("content-length %s is garbage", sanitize_string(str));
+                                        bb_error_msg_and_die("content-length %s is garbage", str);
                                 }
                                 G.got_clen = 1;
                                 continue;
                         }
                         if (key == KEY_transfer_encoding) {
                                 if (strcmp(str_tolower(str), "chunked") != 0)
-                                        bb_error_msg_and_die("transfer encoding '%s' is not supported", sanitize_string(str));
+                                        bb_error_msg_and_die("transfer encoding '%s' is not supported", str);
                                 G.chunked = 1;
                         }
                         if (key == KEY_location && status >= 300) {
@@ -1279,7 +1325,7 @@ However, in real world it was observed that some web servers
                                 fclose(sfp);
                                 if (str[0] == '/') {
                                         free(redirected_path);
-                                        target.path = redirected_path = xstrdup(str+1);
+                                        target.path = redirected_path = xstrdup(str + 1);
                                         /* lsa stays the same: it's on the same server */
                                 } else {
                                         parse_url(str, &target);
@@ -1326,7 +1372,7 @@ However, in real world it was observed that some web servers
                 /* It's ftp. Close data connection properly */
                 fclose(dfp);
                 if (ftpcmd(NULL, NULL, sfp) != 226)
-                        bb_error_msg_and_die("ftp error: %s", sanitize_string(G.wget_buf + 4));
+                        bb_error_msg_and_die("ftp error: %s", G.wget_buf);
                 /* ftpcmd("QUIT", NULL, sfp); - why bother? */
         }
         fclose(sfp);