From af645fcbec26f6b228703e048e58e32ffb01cda1 Mon Sep 17 00:00:00 2001
From: Justine Tunney <jtunney@gmail.com>
Date: Fri, 18 Mar 2022 02:33:37 -0700
Subject: [PATCH] Make exciting improvements

- Add Lua backtraces to redbean!
- Wipe serving keys after redbean forks
- Audit redbean to remove free via exit
- Log SSL client ciphersuite preferences
- Increase ASAN malloc() backtrace depth
- Make GetSslRoots() behave as a singleton
- Move leaks.c from LIBC_TESTLIB to LIBC_LOG
- Add undocumented %n to printf() for newlines
- Fix redbean memory leak reindexing inode change
- Fix redbean memory leak with Fetch() DNS object
- Restore original environ after __cxa_finalize()
- Make backtrace always work after __cxa_finalize()
- Introduce COUNTEXPR() diagnostic / benchmark tool
- Fix a few more instances of errno being clobbered
- Consolidate the ANSI color disabling internal APIs
---
 build/definitions.mk                          |   3 +-
 dsp/tty/hidecursor.c                          |   3 +-
 examples/auto-memory-safety-crash.c           |   9 +
 examples/auto-memory-safety-crash2.c          |   9 +
 examples/auto-memory-safety-crash3.c          |   7 +
 examples/curl.c                               |   5 +-
 libc/fmt/dirname.c                            |   6 +-
 libc/fmt/fmt.c                                |   7 +
 libc/intrin/asan.c                            |  26 +-
 libc/{runtime => intrin}/ftrace.c             |   0
 libc/{calls => intrin}/getenv.c               |  37 +-
 ...articulate.c => isatleastwindows10.greg.c} |  38 +-
 ...ggerpresent.c => isdebuggerpresent.greg.c} |   2 +-
 libc/intrin/isrunningundermake.c              |   5 +-
 libc/{log/cancolor.c => intrin/nocolor.c}     |  57 +-
 ...mmappings.c => printsystemmappings.greg.c} |   0
 libc/log/addr2linepath.c                      |  18 +-
 libc/log/backtrace2.c                         |  19 +-
 libc/log/checkfail_ndebug.c                   |   4 +-
 libc/log/color.internal.h                     |  23 +-
 libc/log/commandvenv.c                        |   2 +-
 libc/log/countbranch.h                        |   6 +-
 libc/log/countbranch_report.c                 |  24 +-
 libc/log/countexpr.h                          |  85 +++
 libc/log/countexpr_data.S                     |  33 +
 libc/log/countexpr_report.c                   |  82 ++
 libc/log/getsymboltable.c                     |   6 +-
 libc/log/getttysize.c                         |   3 +-
 libc/log/internal.h                           |   2 +-
 libc/{testlib => log}/leaks.c                 |   4 +-
 libc/log/libfatal.internal.h                  |  34 +-
 libc/log/log.h                                |   1 +
 libc/log/log.mk                               |   5 +-
 libc/log/oncrash.c                            |  46 +-
 libc/log/restoretty.c                         |  23 +-
 libc/log/showcrashreports.c                   |   2 +-
 libc/log/startfatal.c                         |  19 +-
 libc/macros-cpp.internal.inc                  |  28 +
 libc/mem/putenv.c                             |  92 ++-
 libc/mem/setenv.c                             |  14 +-
 libc/runtime/finddebugbinary.c                |  68 +-
 libc/str/longsort.c                           |   4 +
 libc/testlib/testlib.h                        |   1 -
 libc/testlib/testlib.mk                       |   1 -
 libc/testlib/testmain.c                       |   4 +-
 net/https/getsslroots.c                       |  38 +-
 test/libc/{calls => intrin}/getenv_test.c     |   0
 test/libc/log/backtrace_test.c                |  62 +-
 test/libc/stdio/vappendf_test.c               |  10 +
 third_party/lua/lapi.c                        |   1 +
 third_party/mbedtls/formatclientciphers.c     |  41 +
 third_party/mbedtls/getciphersuitename.c      | 714 +++++++++---------
 third_party/mbedtls/iana.h                    |   2 +
 third_party/mbedtls/ssl.h                     |   1 +
 third_party/mbedtls/ssl_srv.c                 |  23 +-
 third_party/python/Modules/tlsmodule.c        |   4 +-
 tool/build/blinkenlights.c                    |   3 +-
 tool/build/calculator.c                       |   5 +-
 tool/build/compile.c                          |  18 +-
 tool/net/demo/fetch.lua                       |  13 +-
 tool/net/redbean.c                            | 366 +++++----
 61 files changed, 1354 insertions(+), 814 deletions(-)
 rename libc/{runtime => intrin}/ftrace.c (100%)
 rename libc/{calls => intrin}/getenv.c (82%)
 rename libc/intrin/{isterminalinarticulate.c => isatleastwindows10.greg.c} (66%)
 rename libc/intrin/{isdebuggerpresent.c => isdebuggerpresent.greg.c} (98%)
 rename libc/{log/cancolor.c => intrin/nocolor.c} (62%)
 rename libc/intrin/{printsystemmappings.c => printsystemmappings.greg.c} (100%)
 create mode 100644 libc/log/countexpr.h
 create mode 100644 libc/log/countexpr_data.S
 create mode 100644 libc/log/countexpr_report.c
 rename libc/{testlib => log}/leaks.c (97%)
 rename test/libc/{calls => intrin}/getenv_test.c (100%)
 create mode 100644 third_party/mbedtls/formatclientciphers.c

diff --git a/build/definitions.mk b/build/definitions.mk
index 86c77d595..3464432bb 100644
--- a/build/definitions.mk
+++ b/build/definitions.mk
@@ -100,7 +100,8 @@ SANITIZER =								\
 NO_MAGIC =								\
 	-mno-fentry							\
 	-fno-stack-protector						\
-	-fwrapv
+	-fwrapv								\
+	-fno-sanitize=all
 
 OLD_CODE =								\
 	-fno-strict-aliasing						\
diff --git a/dsp/tty/hidecursor.c b/dsp/tty/hidecursor.c
index b5dfa8950..50f5addeb 100644
--- a/dsp/tty/hidecursor.c
+++ b/dsp/tty/hidecursor.c
@@ -19,6 +19,7 @@
 #include "dsp/tty/tty.h"
 #include "libc/bits/pushpop.h"
 #include "libc/dce.h"
+#include "libc/log/internal.h"
 #include "libc/log/log.h"
 #include "libc/nt/console.h"
 #include "libc/nt/runtime.h"
@@ -30,7 +31,7 @@
 static int ttysetcursor(int fd, bool visible) {
   struct NtConsoleCursorInfo ntcursor;
   char code[8] = "\e[?25l";
-  if (IsTerminalInarticulate()) return 0;
+  if (__nocolor) return 0;
   if (visible) code[5] = 'h';
   if (SupportsWindows()) {
     GetConsoleCursorInfo(GetStdHandle(kNtStdOutputHandle), &ntcursor);
diff --git a/examples/auto-memory-safety-crash.c b/examples/auto-memory-safety-crash.c
index fa98cad9d..9d8253148 100644
--- a/examples/auto-memory-safety-crash.c
+++ b/examples/auto-memory-safety-crash.c
@@ -8,7 +8,10 @@
 ╚─────────────────────────────────────────────────────────────────*/
 #endif
 #include "libc/bits/bits.h"
+#include "libc/dce.h"
 #include "libc/log/log.h"
+#include "libc/runtime/runtime.h"
+#include "libc/stdio/stdio.h"
 
 /**
  * ASAN static memory safety crash example.
@@ -40,11 +43,17 @@
  *     0x000000000040268d: cosmo at libc/runtime/cosmo.S:64
  *     0x00000000004021ae: _start at libc/crt/crt.S:77
  *
+ * @see libc/intrin/asancodes.h for meaning of G, etc. and negative numbers
+ * @see libc/nexgen32e/kcp437.S for meaning of symbols
  */
 
 char buffer[13] = "hello";
 
 int main(int argc, char *argv[]) {
+  if (!IsAsan()) {
+    printf("this example is intended for MODE=asan or MODE=dbg\n");
+    exit(1);
+  }
   ShowCrashReports(); /* not needed but yoinks appropriate symbols */
   int i = 13;
   asm("" : "+r"(i)); /* prevent compiler being smart */
diff --git a/examples/auto-memory-safety-crash2.c b/examples/auto-memory-safety-crash2.c
index 8c30c3773..9525d52a9 100644
--- a/examples/auto-memory-safety-crash2.c
+++ b/examples/auto-memory-safety-crash2.c
@@ -8,8 +8,11 @@
 ╚─────────────────────────────────────────────────────────────────*/
 #endif
 #include "libc/bits/bits.h"
+#include "libc/dce.h"
 #include "libc/log/log.h"
 #include "libc/mem/mem.h"
+#include "libc/runtime/runtime.h"
+#include "libc/stdio/stdio.h"
 #include "libc/str/str.h"
 
 /**
@@ -50,9 +53,15 @@
  *     0x000000000040270f: cosmo at libc/runtime/cosmo.S:64
  *     0x00000000004021ae: _start at libc/crt/crt.S:77
  *
+ * @see libc/intrin/asancodes.h for meaning of U, O, etc. and negative numbers
+ * @see libc/nexgen32e/kcp437.S for meaning of symbols
  */
 
 int main(int argc, char *argv[]) {
+  if (!IsAsan()) {
+    printf("this example is intended for MODE=asan or MODE=dbg\n");
+    exit(1);
+  }
   char *buffer;
   ShowCrashReports(); /* not needed but yoinks appropriate symbols */
   buffer = malloc(13);
diff --git a/examples/auto-memory-safety-crash3.c b/examples/auto-memory-safety-crash3.c
index 616b09a0d..b5730f976 100644
--- a/examples/auto-memory-safety-crash3.c
+++ b/examples/auto-memory-safety-crash3.c
@@ -8,8 +8,11 @@
 ╚─────────────────────────────────────────────────────────────────*/
 #endif
 #include "libc/bits/bits.h"
+#include "libc/dce.h"
 #include "libc/log/log.h"
 #include "libc/mem/mem.h"
+#include "libc/runtime/runtime.h"
+#include "libc/stdio/stdio.h"
 #include "libc/str/str.h"
 
 /**
@@ -21,6 +24,10 @@
  */
 
 int main(int argc, char *argv[]) {
+  if (!IsAsan()) {
+    printf("this example is intended for MODE=asan or MODE=dbg\n");
+    exit(1);
+  }
   char *buffer;
   ShowCrashReports(); /* not needed but yoinks appropriate symbols */
   buffer = malloc(13);
diff --git a/examples/curl.c b/examples/curl.c
index 82d2f5ab8..97e7c81cf 100644
--- a/examples/curl.c
+++ b/examples/curl.c
@@ -240,19 +240,17 @@ int main(int argc, char *argv[]) {
    */
   mbedtls_ssl_config conf;
   mbedtls_ssl_context ssl;
-  mbedtls_x509_crt *cachain = 0;
   mbedtls_ctr_drbg_context drbg;
   if (usessl) {
     mbedtls_ssl_init(&ssl);
     mbedtls_ctr_drbg_init(&drbg);
     mbedtls_ssl_config_init(&conf);
-    cachain = GetSslRoots();
     CHECK_EQ(0, mbedtls_ctr_drbg_seed(&drbg, GetEntropy, 0, "justine", 7));
     CHECK_EQ(0, mbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_CLIENT,
                                             MBEDTLS_SSL_TRANSPORT_STREAM,
                                             MBEDTLS_SSL_PRESET_DEFAULT));
     mbedtls_ssl_conf_authmode(&conf, authmode);
-    mbedtls_ssl_conf_ca_chain(&conf, cachain, 0);
+    mbedtls_ssl_conf_ca_chain(&conf, GetSslRoots(), 0);
     mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &drbg);
     if (!IsTiny()) mbedtls_ssl_conf_dbg(&conf, TlsDebug, 0);
     CHECK_EQ(0, mbedtls_ssl_setup(&ssl, &conf));
@@ -413,7 +411,6 @@ Finished:
     mbedtls_ssl_free(&ssl);
     mbedtls_ctr_drbg_free(&drbg);
     mbedtls_ssl_config_free(&conf);
-    mbedtls_x509_crt_free(cachain);
     mbedtls_ctr_drbg_free(&drbg);
   }
 
diff --git a/libc/fmt/dirname.c b/libc/fmt/dirname.c
index 4101daec8..7810829a8 100644
--- a/libc/fmt/dirname.c
+++ b/libc/fmt/dirname.c
@@ -24,7 +24,11 @@
 
 /**
  * Returns directory portion of path.
- * @param s is mutated
+ *
+ * This returns "." if path doesn't have slashes. If path is empty then
+ * this returns empty string.
+ *
+ * @param s is mutated and must not be NULL
  */
 char *dirname(char *s) {
   size_t i, n;
diff --git a/libc/fmt/fmt.c b/libc/fmt/fmt.c
index 5fb417319..0a872643e 100644
--- a/libc/fmt/fmt.c
+++ b/libc/fmt/fmt.c
@@ -40,6 +40,8 @@
     }                             \
   } while (0)
 
+extern bool __nomultics;
+
 static const char kSpecialFloats[2][2][4] = {{"INF", "inf"}, {"NAN", "nan"}};
 
 static void __fmt_free_dtoa(char **mem) {
@@ -385,6 +387,11 @@ hidden int __fmt(void *fn, void *arg, const char *format, va_list va) {
         }
         break;
 
+      case 'n':
+        if (__nomultics) PUT('\r');
+        PUT('\n');
+        break;
+
       case 'F':
       case 'f':
         if (!(flags & FLAGS_PRECISION)) prec = 6;
diff --git a/libc/intrin/asan.c b/libc/intrin/asan.c
index 1d57e67ec..73a0879fa 100644
--- a/libc/intrin/asan.c
+++ b/libc/intrin/asan.c
@@ -52,6 +52,10 @@
 
 STATIC_YOINK("_init_asan");
 
+#define ASAN_MORGUE_ITEMS     512
+#define ASAN_MORGUE_THRESHOLD 65536  // morgue memory O(ITEMS*THRESHOLD)
+#define ASAN_TRACE_ITEMS      16  // backtrace limit on malloc origin
+
 /**
  * @fileoverview Cosmopolitan Address Sanitizer Runtime.
  *
@@ -83,8 +87,6 @@ STATIC_YOINK("_init_asan");
  *     movq (%addr),%dst
  */
 
-#define ASAN_MORGUE_SIZE 128
-
 #define HOOK(HOOK, IMPL)    \
   do {                      \
     if (weaken(HOOK)) {     \
@@ -104,7 +106,7 @@ STATIC_YOINK("_init_asan");
 typedef char xmm_t __attribute__((__vector_size__(16), __aligned__(1)));
 
 struct AsanTrace {
-  intptr_t p[4];
+  uint32_t p[ASAN_TRACE_ITEMS];  // assumes linkage into 32-bit space
 };
 
 struct AsanExtra {
@@ -139,7 +141,12 @@ struct AsanGlobal {
 
 struct AsanMorgue {
   unsigned i;
-  void *p[ASAN_MORGUE_SIZE];
+  void *p[ASAN_MORGUE_ITEMS];
+};
+
+struct ReportOriginHeap {
+  const unsigned char *a;
+  int z;
 };
 
 bool __asan_noreentry;
@@ -657,11 +664,6 @@ static void __asan_report_memory_origin_image(intptr_t a, int z) {
   }
 }
 
-struct ReportOriginHeap {
-  const unsigned char *a;
-  int z;
-};
-
 static noasan void OnMemory(void *x, void *y, size_t n, void *a) {
   const unsigned char *p = x;
   struct ReportOriginHeap *t = a;
@@ -725,6 +727,7 @@ nodiscard static __asan_die_f *__asan_report(const void *addr, int size,
   uint64_t x, y, z;
   char *p, *q, *base;
   struct MemoryIntervals *m;
+  ++g_ftrace;
   p = __fatalbuf;
   kprintf("%n\e[J\e[1;31masan error\e[0m: %s %d-byte %s at %p shadow %p%n%s%n",
           __asan_describe_access_poison(kind), size, message, addr,
@@ -805,6 +808,7 @@ nodiscard static __asan_die_f *__asan_report(const void *addr, int size,
   kprintf("%s", __fatalbuf);
   __asan_report_memory_origin(addr, size, kind);
   kprintf("%nthe crash was caused by%n");
+  --g_ftrace;
   return __asan_die();
 }
 
@@ -1005,7 +1009,7 @@ int __asan_print_trace(void *p) {
     kprintf(" bad cookie");
     return -1;
   }
-  kprintf("%n%p %,lu bytes [asan]", (char *)p + 16, n);
+  kprintf("%n%p %,lu bytes [asan]", (char *)p, n);
   if (!__asan_is_mapped((((intptr_t)p >> 3) + 0x7fff8000) >> 16)) {
     kprintf(" (shadow not mapped?!)");
   }
@@ -1024,7 +1028,7 @@ static void __asan_deallocate(char *p, long kind) {
   if ((e = __asan_get_extra(p, &c))) {
     if (__asan_read48(e->size, &n)) {
       __asan_poison((uintptr_t)p, c, kind);
-      if (c <= FRAMESIZE) {
+      if (c <= ASAN_MORGUE_THRESHOLD) {
         p = __asan_morgue_add(p);
       }
       weaken(dlfree)(p);
diff --git a/libc/runtime/ftrace.c b/libc/intrin/ftrace.c
similarity index 100%
rename from libc/runtime/ftrace.c
rename to libc/intrin/ftrace.c
diff --git a/libc/calls/getenv.c b/libc/intrin/getenv.c
similarity index 82%
rename from libc/calls/getenv.c
rename to libc/intrin/getenv.c
index 6d0025cef..3aa83de4a 100644
--- a/libc/calls/getenv.c
+++ b/libc/intrin/getenv.c
@@ -16,18 +16,19 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/calls/sysdebug.internal.h"
 #include "libc/dce.h"
 #include "libc/runtime/runtime.h"
 
-#define ToUpper(c) \
-  (IsWindows() && (c) >= 'a' && (c) <= 'z' ? (c) - 'a' + 'A' : (c))
+forceinline int Identity(int c) {
+  return c;
+}
 
-/**
- * Returns value of environment variable, or NULL if not found.
- *
- * Environment variables can store empty string on Unix but not Windows.
- */
-char *getenv(const char *s) {
+forceinline int ToUpper(int c) {
+  return 'a' <= c && c <= 'z' ? c - ('a' - 'A') : c;
+}
+
+forceinline char *GetEnv(const char *s, int xlat(int)) {
   char **p;
   size_t i, j;
   if ((p = environ)) {
@@ -39,7 +40,7 @@ char *getenv(const char *s) {
           }
           break;
         }
-        if (ToUpper(s[j]) != ToUpper(p[i][j])) {
+        if (xlat(s[j]) != xlat(p[i][j])) {
           break;
         }
       }
@@ -47,3 +48,21 @@ char *getenv(const char *s) {
   }
   return 0;
 }
+
+/**
+ * Returns value of environment variable, or NULL if not found.
+ *
+ * Environment variables can store empty string on Unix but not Windows.
+ *
+ * @note should not be used after __cxa_finalize() is called
+ */
+char *getenv(const char *s) {
+  char *r;
+  if (!IsWindows()) {
+    r = GetEnv(s, Identity);
+  } else {
+    r = GetEnv(s, ToUpper);
+  }
+  SYSDEBUG("getenv(%#s) → %#s", s, r);
+  return r;
+}
diff --git a/libc/intrin/isterminalinarticulate.c b/libc/intrin/isatleastwindows10.greg.c
similarity index 66%
rename from libc/intrin/isterminalinarticulate.c
rename to libc/intrin/isatleastwindows10.greg.c
index 9ee478299..100098058 100644
--- a/libc/intrin/isterminalinarticulate.c
+++ b/libc/intrin/isatleastwindows10.greg.c
@@ -1,7 +1,7 @@
 /*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
 │vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8                                :vi│
 ╞══════════════════════════════════════════════════════════════════════════════╡
-│ Copyright 2020 Justine Alexandra Roberts Tunney                              │
+│ Copyright 2021 Justine Alexandra Roberts Tunney                              │
 │                                                                              │
 │ Permission to use, copy, modify, and/or distribute this software for         │
 │ any purpose with or without fee is hereby granted, provided that the         │
@@ -16,31 +16,17 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
-#include "libc/bits/safemacros.internal.h"
-#include "libc/log/internal.h"
-#include "libc/log/libfatal.internal.h"
-#include "libc/log/log.h"
+#include "libc/assert.h"
+#include "libc/dce.h"
 #include "libc/nt/enum/version.h"
-#include "libc/runtime/runtime.h"
-#include "libc/str/str.h"
+#include "libc/nt/version.h"
 
-bool g_isterminalinarticulate;
-
-bool IsTerminalInarticulate(void) {
-  return g_isterminalinarticulate;
+/**
+ * Returns true if we're running at least Windows 10.
+ *
+ * This function may only be called if IsWindows() is true.
+ */
+privileged bool(IsAtLeastWindows10)(void) {
+  assert(IsWindows());
+  return IsAtLeastWindows10();
 }
-
-textstartup noasan void g_isterminalinarticulate_init(int argc, char **argv,
-                                                      char **envp,
-                                                      intptr_t *auxv) {
-  char *s;
-  if (IsWindows() && NtGetVersion() < kNtVersionWindows10) {
-    g_isterminalinarticulate = true;
-  } else if ((s = __getenv(envp, "TERM"))) {
-    g_isterminalinarticulate = !__strcmp(s, "dumb");
-  }
-}
-
-const void *const g_isterminalinarticulate_ctor[] initarray = {
-    g_isterminalinarticulate_init,
-};
diff --git a/libc/intrin/isdebuggerpresent.c b/libc/intrin/isdebuggerpresent.greg.c
similarity index 98%
rename from libc/intrin/isdebuggerpresent.c
rename to libc/intrin/isdebuggerpresent.greg.c
index 772236469..a786d8b62 100644
--- a/libc/intrin/isdebuggerpresent.c
+++ b/libc/intrin/isdebuggerpresent.greg.c
@@ -37,7 +37,7 @@ noasan noubsan int IsDebuggerPresent(bool force) {
   char *p, buf[1024];
   if (!force) {
     if (IsGenuineCosmo()) return 0;
-    if (__getenv(__envp, "HEISENDEBUG")) return 0;
+    if (getenv("HEISENDEBUG")) return 0;
   }
   if (IsWindows()) {
     return NtGetPeb()->BeingDebugged; /* needs noasan */
diff --git a/libc/intrin/isrunningundermake.c b/libc/intrin/isrunningundermake.c
index 9d94b59a2..b6744cf11 100644
--- a/libc/intrin/isrunningundermake.c
+++ b/libc/intrin/isrunningundermake.c
@@ -30,9 +30,8 @@ bool IsRunningUnderMake(void) {
   return g_isrunningundermake;
 }
 
-textstartup void g_isrunningundermake_init(int argc, char **argv, char **envp,
-                                           intptr_t *auxv) {
-  g_isrunningundermake = !!__getenv(envp, "MAKEFLAGS");
+textstartup void g_isrunningundermake_init(void) {
+  g_isrunningundermake = !!getenv("MAKEFLAGS");
 }
 
 const void *const g_isrunningundermake_ctor[] initarray = {
diff --git a/libc/log/cancolor.c b/libc/intrin/nocolor.c
similarity index 62%
rename from libc/log/cancolor.c
rename to libc/intrin/nocolor.c
index b4f144afe..316f3eda6 100644
--- a/libc/log/cancolor.c
+++ b/libc/intrin/nocolor.c
@@ -16,45 +16,46 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
-#include "libc/bits/safemacros.internal.h"
-#include "libc/calls/calls.h"
 #include "libc/dce.h"
-#include "libc/log/color.internal.h"
-#include "libc/log/log.h"
-#include "libc/nt/enum/version.h"
+#include "libc/log/internal.h"
+#include "libc/nt/version.h"
 #include "libc/runtime/runtime.h"
-#include "libc/str/str.h"
+
+#define IsDumb(s) \
+  (s[0] == 'd' && s[1] == 'u' && s[2] == 'm' && s[3] == 'b' && !s[4])
 
 /**
- * Returns true if ANSI terminal colors are appropriate.
+ * Indicates if ANSI terminal colors are inappropriate.
  *
- * We take an optimistic approach here. We use colors, unless we see the
- * environment variable TERM=dumb, which is set by software like Emacs.
- * It's a common antipattern to check isatty(STDERR_FILENO), since that
- * usually makes colors harder to get than they are to remove:
+ * Normally this variable should be false. We only set it to true if
+ * we're running on an old version of Windows or the environment
+ * variable `TERM` is set to `dumb`.
+ *
+ * We think colors should be the norm, since most software is usually
+ * too conservative about removing them. Rather than using `isatty`
+ * consider using sed for instances where color must be removed:
  *
  *      sed 's/\x1b\[[;[:digit:]]*m//g' <color.txt >uncolor.txt
  *
- * Ideally, all software should be updated to understand color, since
- * it's been formally standardized nearly as long as ASCII. Even old
- * MS-DOS supports it (but Windows didn't until Windows 10) yet even
- * tools like less may need wrapper scripts, e.g.:
+ * For some reason, important software is configured by default in many
+ * operating systems, to not only disable colors, but utf-8 too! Here's
+ * an example of how a wrapper script can fix that for `less`.
  *
  *      #!/bin/sh
  *      LESSCHARSET=UTF-8 exec /usr/bin/less -RS "$@"
  *
- * It's that easy fam.
+ * Thank you for using colors!
  */
-bool cancolor(void) {
-  static bool once;
-  static bool result;
-  return 1;
-  if (!once) {
-    result = (!IsWindows() || NtGetVersion() >= kNtVersionWindows10 ||
-              !ischardev(1)) &&
-             !!strcmp(nulltoempty(getenv("DONTANSIMEBRO")), "1") &&
-             !!strcmp(nulltoempty(getenv("TERM")), "dumb");
-    once = true;
-  }
-  return result;
+bool __nocolor;
+
+optimizesize textstartup noasan void __nocolor_init(int argc, char **argv,
+                                                    char **envp,
+                                                    intptr_t *auxv) {
+  char *s;
+  __nocolor = (IsWindows() && !IsAtLeastWindows10()) ||
+              ((s = getenv("TERM")) && IsDumb(s));
 }
+
+const void *const __nocolor_ctor[] initarray = {
+    __nocolor_init,
+};
diff --git a/libc/intrin/printsystemmappings.c b/libc/intrin/printsystemmappings.greg.c
similarity index 100%
rename from libc/intrin/printsystemmappings.c
rename to libc/intrin/printsystemmappings.greg.c
diff --git a/libc/log/addr2linepath.c b/libc/log/addr2linepath.c
index 44b51de5a..82bf0b289 100644
--- a/libc/log/addr2linepath.c
+++ b/libc/log/addr2linepath.c
@@ -18,6 +18,20 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/log/log.h"
 
-const char *GetAddr2linePath(void) {
-  return commandvenv("ADDR2LINE", "addr2line");
+static const char *__addr2line;
+
+static textstartup void __addr2line_init() {
+  static bool once;
+  if (!once) {
+    __addr2line = commandvenv("ADDR2LINE", "addr2line");
+    once = true;
+  }
 }
+
+const char *GetAddr2linePath(void) {
+  return __addr2line;
+}
+
+const void *const __addr2line_ctor[] initarray = {
+    __addr2line_init,
+};
diff --git a/libc/log/backtrace2.c b/libc/log/backtrace2.c
index 74872127f..d06a8a4d3 100644
--- a/libc/log/backtrace2.c
+++ b/libc/log/backtrace2.c
@@ -29,6 +29,7 @@
 #include "libc/fmt/itoa.h"
 #include "libc/intrin/kprintf.h"
 #include "libc/log/backtrace.internal.h"
+#include "libc/log/color.internal.h"
 #include "libc/log/libfatal.internal.h"
 #include "libc/log/log.h"
 #include "libc/nexgen32e/gc.internal.h"
@@ -47,6 +48,10 @@
 #define kBacktraceMaxFrames 128
 #define kBacktraceBufSize   ((kBacktraceMaxFrames - 1) * (18 + 1))
 
+static void ShowHint(const char *s) {
+  kprintf("%snote: %s%s%n", SUBTLE, s, RESET);
+}
+
 static int PrintBacktraceUsingAddr2line(int fd, const struct StackFrame *bp) {
   ssize_t got;
   intptr_t addr;
@@ -59,15 +64,13 @@ static int PrintBacktraceUsingAddr2line(int fd, const struct StackFrame *bp) {
   char buf[kBacktraceBufSize], *argv[kBacktraceMaxFrames];
 
   if (!(debugbin = FindDebugBinary())) {
-    if (IsLinux()) {
-      kprintf("warning: can't find debug binary try setting COMDBG%n");
-    }
+    ShowHint("can't find .com.dbg file try setting COMDBG");
     return -1;
   }
 
   if (!(addr2line = GetAddr2linePath())) {
     if (IsLinux()) {
-      kprintf("warning: can't find addr2line try setting ADDR2LINE%n");
+      ShowHint("can't find addr2line on path or in ADDR2LINE");
     }
     return -1;
   }
@@ -79,7 +82,7 @@ static int PrintBacktraceUsingAddr2line(int fd, const struct StackFrame *bp) {
    * tooling which can be counted upon.
    */
   if (!IsLinux()) {
-    kprintf("note: won't print addr2line backtrace on non-linux%n");
+    ShowHint("won't print addr2line backtrace on non-linux");
     return -1;
   }
 
@@ -170,16 +173,14 @@ void ShowBacktrace(int fd, const struct StackFrame *bp) {
 #ifdef __FNO_OMIT_FRAME_POINTER__
   /* asan runtime depends on this function */
   static bool noreentry;
-  --g_ftrace;
+  ++g_ftrace;
   if (!bp) bp = __builtin_frame_address(0);
   if (!noreentry) {
     noreentry = true;
     PrintBacktrace(fd, bp);
     noreentry = false;
-  } else {
-    kprintf("warning: re-entered ShowBackTrace()%n");
   }
-  ++g_ftrace;
+  --g_ftrace;
 #else
   kprintf("ShowBacktrace() needs these flags to show C backtrace:%n"
           "\t-D__FNO_OMIT_FRAME_POINTER__%n"
diff --git a/libc/log/checkfail_ndebug.c b/libc/log/checkfail_ndebug.c
index e1f655883..a950ae663 100644
--- a/libc/log/checkfail_ndebug.c
+++ b/libc/log/checkfail_ndebug.c
@@ -36,7 +36,7 @@ relegated void ___check_fail_ndebug(uint64_t want, uint64_t got,
                                     const char *opchar) {
   __restore_tty(1);
   kprintf("%n%serror: %s: check failed: 0x%x %s 0x%x (%s)%n",
-          !g_isterminalinarticulate ? "\e[J" : "", program_invocation_name,
-          want, opchar, got, strerror(errno));
+          !__nocolor ? "\e[J" : "", program_invocation_name, want, opchar, got,
+          strerror(errno));
   exit(1);
 }
diff --git a/libc/log/color.internal.h b/libc/log/color.internal.h
index 05c7cb564..663e554b9 100644
--- a/libc/log/color.internal.h
+++ b/libc/log/color.internal.h
@@ -1,20 +1,17 @@
 #ifndef COSMOPOLITAN_LIBC_LOG_COLOR_H_
 #define COSMOPOLITAN_LIBC_LOG_COLOR_H_
+#include "libc/log/internal.h"
 #if !(__ASSEMBLER__ + __LINKER__ + 0)
-COSMOPOLITAN_C_START_
 
-#define CLS    (cancolor() ? "\r\e[J" : "")
-#define RED    (cancolor() ? "\e[30;101m" : "")
-#define GREEN  (cancolor() ? "\e[32m" : "")
-#define UNBOLD (cancolor() ? "\e[22m" : "")
-#define RED2   (cancolor() ? "\e[91;1m" : "")
-#define BLUE1  (cancolor() ? "\e[94;49m" : "")
-#define BLUE2  (cancolor() ? "\e[34m" : "")
-#define RESET  (cancolor() ? "\e[0m" : "")
-#define SUBTLE (cancolor() ? "\e[35m" : "")
+#define CLS    (!__nocolor ? "\r\e[J" : "")
+#define RED    (!__nocolor ? "\e[30;101m" : "")
+#define GREEN  (!__nocolor ? "\e[32m" : "")
+#define UNBOLD (!__nocolor ? "\e[22m" : "")
+#define RED2   (!__nocolor ? "\e[91;1m" : "")
+#define BLUE1  (!__nocolor ? "\e[94;49m" : "")
+#define BLUE2  (!__nocolor ? "\e[34m" : "")
+#define RESET  (!__nocolor ? "\e[0m" : "")
+#define SUBTLE (!__nocolor ? "\e[35m" : "")
 
-bool cancolor(void) nothrow nocallback nosideeffect;
-
-COSMOPOLITAN_C_END_
 #endif /* !(__ASSEMBLER__ + __LINKER__ + 0) */
 #endif /* COSMOPOLITAN_LIBC_LOG_COLOR_H_ */
diff --git a/libc/log/commandvenv.c b/libc/log/commandvenv.c
index 4b1712a38..5b1f10385 100644
--- a/libc/log/commandvenv.c
+++ b/libc/log/commandvenv.c
@@ -45,7 +45,7 @@
  *     or the environment variable was empty; noting that the caller
  *     should copy this string before saving it
  */
-noasan const char *commandvenv(const char *var, const char *cmd) {
+const char *commandvenv(const char *var, const char *cmd) {
   const char *exepath;
   static char pathbuf[PATH_MAX];
   if (*cmd == '/' || *cmd == '\\') return cmd;
diff --git a/libc/log/countbranch.h b/libc/log/countbranch.h
index b8d79e6a6..f396bf30a 100644
--- a/libc/log/countbranch.h
+++ b/libc/log/countbranch.h
@@ -1,12 +1,12 @@
 #ifndef COSMOPOLITAN_LIBC_LOG_COUNTBRANCH_H_
 #define COSMOPOLITAN_LIBC_LOG_COUNTBRANCH_H_
+#include "libc/macros.internal.h"
 #if !(__ASSEMBLER__ + __LINKER__ + 0)
 COSMOPOLITAN_C_START_
-#include "libc/macros.internal.h"
 
 #define COUNTBRANCH(x) COUNTBRANCH_(x, #x, STRINGIFY(__FILE__), __LINE__)
 #define COUNTBRANCH_(x, xs, file, line) \
-  COUNTBRANCH__(x, STRINGIFY(xs), STRINGIFY(#x), file, line)
+  COUNTBRANCH__(x, STRINGIFY(xs), STRINGIFY(xs), file, line)
 #define COUNTBRANCH__(x, xs, xss, file, line)                   \
   ({                                                            \
     bool Cond;                                                  \
@@ -46,7 +46,7 @@ struct countbranch {
   const char *code;
   const char *xcode;
   const char *file;
-  int line;
+  long line;
 };
 
 extern struct countbranch countbranch_data[];
diff --git a/libc/log/countbranch_report.c b/libc/log/countbranch_report.c
index 5a6b70985..b3a1864ee 100644
--- a/libc/log/countbranch_report.c
+++ b/libc/log/countbranch_report.c
@@ -18,8 +18,10 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/alg/alg.h"
 #include "libc/calls/calls.h"
+#include "libc/intrin/kprintf.h"
 #include "libc/log/countbranch.h"
 #include "libc/macros.internal.h"
+#include "libc/math.h"
 #include "libc/runtime/runtime.h"
 #include "libc/stdio/stdio.h"
 
@@ -35,7 +37,7 @@ static double GetPercent(const struct countbranch *p) {
   }
 }
 
-static double RankCounter(const struct countbranch *p) {
+static int RankCounter(const struct countbranch *p) {
   double x;
   x = GetPercent(p);
   x = MIN(x, 100 - x);
@@ -65,18 +67,28 @@ static void SortCounters(size_t n) {
 }
 
 void countbranch_report(void) {
+  double r;
   size_t i, n;
+  int pct, nines;
   struct countbranch *p;
   n = CountCounters();
   SortCounters(n);
   for (i = n; i--;) {
     p = countbranch_data + i;
-    if (strcmp(p->code, p->xcode)) {
-      dprintf(2, "%s:%d: %g%% taken (%,ld/%,ld) %s [%s]\n", p->file, p->line,
-              GetPercent(p), p->taken, p->total, p->code, p->xcode);
+    if (p->total) {
+      r = (double)p->taken / p->total;
+      pct = floor(r * 100);
+      nines = floor(fmod(r * 100, 1) * 100000);
     } else {
-      dprintf(2, "%s:%d: %g%% taken (%,ld/%,ld) %s\n", p->file, p->line,
-              GetPercent(p), p->taken, p->total, p->code);
+      pct = 0;
+      nines = 0;
+    }
+    if (strcmp(p->code, p->xcode)) {
+      kprintf("%s:%-4d: %3d.%05d%% taken (%'ld/%'ld) %s [%s]\n", p->file,
+              p->line, pct, nines, p->taken, p->total, p->code, p->xcode);
+    } else {
+      kprintf("%s:%-4d: %3d.%05d%% taken (%'ld/%'ld) %s\n", p->file, p->line,
+              pct, nines, p->taken, p->total, p->code);
     }
   }
 }
diff --git a/libc/log/countexpr.h b/libc/log/countexpr.h
new file mode 100644
index 000000000..967c329ef
--- /dev/null
+++ b/libc/log/countexpr.h
@@ -0,0 +1,85 @@
+#ifndef COSMOPOLITAN_LIBC_LOG_COUNTEXPR_H_
+#define COSMOPOLITAN_LIBC_LOG_COUNTEXPR_H_
+#include "libc/macros.internal.h"
+#include "libc/nexgen32e/bench.h"
+#include "libc/nexgen32e/bsr.h"
+#if !(__ASSEMBLER__ + __LINKER__ + 0)
+COSMOPOLITAN_C_START_
+
+/**
+ * Shows nanosecond timings histogram for expr at exit().
+ */
+#define COUNTEXPR(expr)                                                \
+  COUNTEXPR_(expr, #expr, STRINGIFY(__FILE__), __LINE__, rdtsc, rdtsc, \
+             "COUNTEXPR")
+
+/**
+ * Like COUNTEXPR() but can be used on function calls that return void.
+ */
+#define COUNTSTMT(stmt)                                                    \
+  (void)COUNTEXPR_((stmt, 0), #stmt, STRINGIFY(__FILE__), __LINE__, rdtsc, \
+                   rdtsc, "COUNTSTMT")
+
+/**
+ * Same as COUNTEXPR() but uses Intel's expensive measurement technique.
+ */
+#define BENCHEXPR(expr)                                                \
+  COUNTEXPR_(expr, #expr, STRINGIFY(__FILE__), __LINE__, __startbench, \
+             __endbench, "BENCHEXPR")
+
+#define COUNTEXPR_(expr, code, file, line, start, stop, macro) \
+  COUNTEXPR__(expr, STRINGIFY(code), file, line, start, stop, STRINGIFY(macro))
+
+#define COUNTEXPR__(expr, code, file, line, start, stop, macro) \
+  ({                                                            \
+    struct countexpr *InfO;                                     \
+    uint64_t t1_, t2_, TiCkS, NaNoS;                            \
+    t1_ = start();                                              \
+    asm volatile("" ::: "memory");                              \
+    autotype(expr) ReS = (expr);                                \
+    asm volatile("" ::: "memory");                              \
+    t2_ = stop();                                               \
+    TiCkS = t2_ >= t1_ ? t2_ - t1_ : ~t1_ + t2_ + 1;            \
+    asm(".section .rodata.str1.1,\"aMS\",@progbits,1\n\t"       \
+        ".align\t1\n"                                           \
+        "31340:\t.asciz\t" file "\n\t"                          \
+        "31338:\t.asciz\t" code "\n"                            \
+        "31332:\t.asciz\t" macro "\n"                           \
+        ".previous\n\t"                                         \
+        ".section .yoink\n\t"                                   \
+        "nopl\tcountexpr_data(%%rip)\n\t"                       \
+        ".previous\n\t"                                         \
+        ".section .sort.data.countexpr.2,\"a\",@progbits\n\t"   \
+        ".align\t8\n31337:\t"                                   \
+        ".quad\t" #line "\n\t"                                  \
+        ".quad\t31340b\n\t"                                     \
+        ".quad\t31338b\n\t"                                     \
+        ".quad\t31332b\n\t"                                     \
+        ".rept\t65\n\t"                                         \
+        ".quad\t0\n\t"                                          \
+        ".endr\n\t"                                             \
+        ".previous\n\t"                                         \
+        "lea\t31337b(%%rip),%0"                                 \
+        : "=r"(InfO));                                          \
+    /* approximation of round(x*.323018) which is usually */    \
+    /* the ratio, between x86 rdtsc ticks and nanoseconds */    \
+    NaNoS = (TiCkS * 338709) >> 20;                             \
+    ++InfO->logos[NaNoS ? bsrl(NaNoS) + 1 : 0];                 \
+    ReS;                                                        \
+  })
+
+struct countexpr {
+  long line; /* zero for last entry */
+  const char *file;
+  const char *code;
+  const char *macro;
+  long logos[65];
+};
+
+extern struct countexpr countexpr_data[];
+
+void countexpr_report(void);
+
+COSMOPOLITAN_C_END_
+#endif /* !(__ASSEMBLER__ + __LINKER__ + 0) */
+#endif /* COSMOPOLITAN_LIBC_LOG_COUNTEXPR_H_ */
diff --git a/libc/log/countexpr_data.S b/libc/log/countexpr_data.S
new file mode 100644
index 000000000..c8b15d566
--- /dev/null
+++ b/libc/log/countexpr_data.S
@@ -0,0 +1,33 @@
+/*-*- mode:unix-assembly; indent-tabs-mode:t; tab-width:8; coding:utf-8     -*-│
+│vi: set et ft=asm ts=8 tw=8 fenc=utf-8                                     :vi│
+╞══════════════════════════════════════════════════════════════════════════════╡
+│ Copyright 2021 Justine Alexandra Roberts Tunney                              │
+│                                                                              │
+│ Permission to use, copy, modify, and/or distribute this software for         │
+│ any purpose with or without fee is hereby granted, provided that the         │
+│ above copyright notice and this permission notice appear in all copies.      │
+│                                                                              │
+│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL                │
+│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED                │
+│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE             │
+│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL         │
+│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR        │
+│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER               │
+│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
+│ PERFORMANCE OF THIS SOFTWARE.                                                │
+╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/macros.internal.h"
+#include "libc/notice.inc"
+
+	.yoink	countexpr_report
+
+	.section .sort.data.countexpr.1,"a",@progbits
+	.align	8
+	.globl	countexpr_data
+countexpr_data:
+	.previous
+
+	.section .sort.data.countexpr.3,"a",@progbits
+	.align	8
+	.quad	0
+	.previous
diff --git a/libc/log/countexpr_report.c b/libc/log/countexpr_report.c
new file mode 100644
index 000000000..baba2caec
--- /dev/null
+++ b/libc/log/countexpr_report.c
@@ -0,0 +1,82 @@
+/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
+│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8                                :vi│
+╞══════════════════════════════════════════════════════════════════════════════╡
+│ Copyright 2021 Justine Alexandra Roberts Tunney                              │
+│                                                                              │
+│ Permission to use, copy, modify, and/or distribute this software for         │
+│ any purpose with or without fee is hereby granted, provided that the         │
+│ above copyright notice and this permission notice appear in all copies.      │
+│                                                                              │
+│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL                │
+│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED                │
+│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE             │
+│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL         │
+│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR        │
+│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER               │
+│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
+│ PERFORMANCE OF THIS SOFTWARE.                                                │
+╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/alg/alg.h"
+#include "libc/assert.h"
+#include "libc/calls/calls.h"
+#include "libc/intrin/kprintf.h"
+#include "libc/limits.h"
+#include "libc/log/countexpr.h"
+#include "libc/macros.internal.h"
+#include "libc/runtime/runtime.h"
+#include "libc/stdio/stdio.h"
+
+static long GetLongSum(const long *h, size_t n) {
+  long t;
+  size_t i;
+  for (t = i = 0; i < n; ++i) {
+    if (__builtin_add_overflow(t, h[i], &t)) {
+      t = LONG_MAX;
+      break;
+    }
+  }
+  return t;
+}
+
+static size_t GetRowCount(const long *h, size_t n) {
+  while (n && !h[n - 1]) --n;
+  return n;
+}
+
+static void PrintHistogram(const long *h, size_t n, long t) {
+  size_t i;
+  long j, p;
+  char s[101];
+  unsigned long logos;
+  for (i = 0; i < n; ++i) {
+    p = (h[i] * 10000 + (t >> 1)) / t;
+    assert(0 <= p && p <= 10000);
+    if (p) {
+      for (j = 0; j < p / 100; ++j) s[j] = '#';
+      s[j] = 0;
+      logos = i ? 1ul << (i - 1) : 0;
+      kprintf("%'12lu %'16ld %3d.%02d%% %s%n", logos, h[i], p / 100, p % 100,
+              s);
+    }
+  }
+}
+
+void countexpr_report(void) {
+  long hits;
+  struct countexpr *p;
+  for (p = countexpr_data; p->line; ++p) {
+    if ((hits = GetLongSum(p->logos, 64))) {
+      kprintf("%s:%d: %s(%s) %'ld hits\n", p->file, p->line, p->macro, p->code,
+              hits);
+      PrintHistogram(p->logos, 64, hits);
+    }
+  }
+}
+
+static textstartup void countexpr_init() {
+  atexit(countexpr_report);
+}
+
+const void *const countexpr_ctor[] initarray = {
+    countexpr_init,
+};
diff --git a/libc/log/getsymboltable.c b/libc/log/getsymboltable.c
index c8388f2df..9f1d279bc 100644
--- a/libc/log/getsymboltable.c
+++ b/libc/log/getsymboltable.c
@@ -25,12 +25,8 @@
  * @return symbol table, or NULL w/ errno on first call
  */
 noasan struct SymbolTable *GetSymbolTable(void) {
-  /* asan runtime depends on this function */
-  static bool once;
   static struct SymbolTable *singleton;
-  const char *debugbin;
-  if (!once) {
-    once = true;
+  if (!singleton) {
     ++g_ftrace;
     singleton = OpenSymbolTable(FindDebugBinary());
     --g_ftrace;
diff --git a/libc/log/getttysize.c b/libc/log/getttysize.c
index b9ef3c65a..a50731924 100644
--- a/libc/log/getttysize.c
+++ b/libc/log/getttysize.c
@@ -20,6 +20,7 @@
 #include "libc/calls/calls.h"
 #include "libc/calls/termios.h"
 #include "libc/fmt/conv.h"
+#include "libc/log/internal.h"
 #include "libc/log/log.h"
 #include "libc/runtime/runtime.h"
 #include "libc/sysv/consts/termios.h"
@@ -34,7 +35,7 @@
  * @returns -1 on error or something else on success
  */
 int getttysize(int fd, struct winsize *out) {
-  if (IsTerminalInarticulate()) {
+  if (__nocolor) {
     out->ws_col = strtoimax(firstnonnull(getenv("COLUMNS"), "80"), NULL, 0);
     out->ws_row = strtoimax(firstnonnull(getenv("ROWS"), "40"), NULL, 0);
     out->ws_xpixel = 0;
diff --git a/libc/log/internal.h b/libc/log/internal.h
index 866579a1d..e2353016a 100644
--- a/libc/log/internal.h
+++ b/libc/log/internal.h
@@ -7,9 +7,9 @@
 #if !(__ASSEMBLER__ + __LINKER__ + 0)
 COSMOPOLITAN_C_START_
 
+extern hidden bool __nocolor;
 extern hidden int kCrashSigs[7];
 extern hidden bool g_isrunningundermake;
-extern hidden bool g_isterminalinarticulate;
 extern hidden struct termios g_oldtermios;
 extern hidden struct sigaction g_oldcrashacts[7];
 
diff --git a/libc/testlib/leaks.c b/libc/log/leaks.c
similarity index 97%
rename from libc/testlib/leaks.c
rename to libc/log/leaks.c
index 3a775cf2f..5c091f3ae 100644
--- a/libc/testlib/leaks.c
+++ b/libc/log/leaks.c
@@ -69,10 +69,10 @@ static noasan bool HasLeaks(void) {
  * services that depend on malloc() cannot be used, after calling this
  * function.
  */
-noasan void testlib_checkformemoryleaks(void) {
+noasan void CheckForMemoryLeaks(void) {
   struct mallinfo mi;
   if (!cmpxchg(&once, false, true)) {
-    kprintf("testlib_checkformemoryleaks() may only be called once\n");
+    kprintf("CheckForMemoryLeaks() may only be called once\n");
     exit(1);
   }
   __cxa_finalize(0);
diff --git a/libc/log/libfatal.internal.h b/libc/log/libfatal.internal.h
index 63dd53c0f..7e8a77a5d 100644
--- a/libc/log/libfatal.internal.h
+++ b/libc/log/libfatal.internal.h
@@ -11,6 +11,8 @@
 #if !(__ASSEMBLER__ + __LINKER__ + 0)
 COSMOPOLITAN_C_START_
 
+#define __ToUpper(c) ((c) >= 'a' && (c) <= 'z' ? (c) - 'a' + 'A' : (c))
+
 extern char __fatalbuf[];
 
 forceinline long __sysv_exit(long rc) {
@@ -113,8 +115,6 @@ forceinline int __getpid(void) {
 }
 
 forceinline ssize_t __write(const void *p, size_t n) {
-  char cf;
-  ssize_t rc;
   uint32_t wrote;
   if (!IsWindows()) {
     return __sysv_write(2, p, n);
@@ -157,25 +157,23 @@ forceinline void *__repstosb(void *di, char al, size_t cx) {
       : "0"(di), "1"(cx), "a"(al));
   return di;
 #else
-  size_t i;
   volatile char *volatile d = di;
   while (cx--) *d++ = al;
-  return d;
+  return (void *)d;
 #endif
 }
 
-forceinline void *__repmovsb(void *di, void *si, size_t cx) {
+forceinline void *__repmovsb(void *di, const void *si, size_t cx) {
 #if defined(__x86__) && defined(__GNUC__) && !defined(__STRICT_ANSI__)
   asm("rep movsb"
       : "=D"(di), "=S"(si), "=c"(cx), "=m"(*(char(*)[cx])di)
       : "0"(di), "1"(si), "2"(cx), "m"(*(char(*)[cx])si));
   return di;
 #else
-  size_t i;
   volatile char *volatile d = di;
   volatile char *volatile s = si;
   while (cx--) *d++ = *s++;
-  return d;
+  return (void *)d;
 #endif
 }
 
@@ -244,24 +242,12 @@ forceinline char *__strstr(const char *haystack, const char *needle) {
   return 0;
 }
 
-forceinline char *__getenv(char **p, const char *s) {
-  size_t i, j;
-  if (p) {
-    for (i = 0; p[i]; ++i) {
-      for (j = 0;; ++j) {
-        if (!s[j]) {
-          if (p[i][j] == '=') {
-            return p[i] + j + 1;
-          }
-          break;
-        }
-        if (s[j] != p[i][j]) {
-          break;
-        }
-      }
-    }
+forceinline const char *__strchr(const char *s, unsigned char c) {
+  char *r;
+  for (;; ++s) {
+    if ((*s & 255) == c) return s;
+    if (!*s) return 0;
   }
-  return 0;
 }
 
 forceinline unsigned long __atoul(const char *p) {
diff --git a/libc/log/log.h b/libc/log/log.h
index dac2adc47..0d519b0f2 100644
--- a/libc/log/log.h
+++ b/libc/log/log.h
@@ -58,6 +58,7 @@ void AppendResourceReport(char **, struct rusage *, const char *);
 char *__get_symbol_by_addr(int64_t);
 void PrintGarbage(void);
 void PrintGarbageNumeric(FILE *);
+void CheckForMemoryLeaks(void);
 
 #define showcrashreports() ShowCrashReports()
 
diff --git a/libc/log/log.mk b/libc/log/log.mk
index 9f3494c5c..9186ad300 100644
--- a/libc/log/log.mk
+++ b/libc/log/log.mk
@@ -63,6 +63,10 @@ o/$(MODE)/libc/log/backtrace3.o:			\
 		OVERRIDE_CFLAGS +=			\
 			-fno-sanitize=all
 
+o/$(MODE)/libc/log/checkfail.o:				\
+		OVERRIDE_CFLAGS +=			\
+			-mgeneral-regs-only
+
 o/$(MODE)/libc/log/attachdebugger.o			\
 o/$(MODE)/libc/log/backtrace2.o				\
 o/$(MODE)/libc/log/backtrace3.o				\
@@ -70,7 +74,6 @@ o/$(MODE)/libc/log/checkaligned.o			\
 o/$(MODE)/libc/log/checkfail.o				\
 o/$(MODE)/libc/log/checkfail_ndebug.o			\
 o/$(MODE)/libc/log/getsymboltable.o			\
-o/$(MODE)/libc/log/cancolor.o				\
 o/$(MODE)/libc/log/restoretty.o				\
 o/$(MODE)/libc/log/oncrash.o				\
 o/$(MODE)/libc/log/onkill.o				\
diff --git a/libc/log/oncrash.c b/libc/log/oncrash.c
index aa166d28a..02fc8ab38 100644
--- a/libc/log/oncrash.c
+++ b/libc/log/oncrash.c
@@ -18,50 +18,27 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/bits/bits.h"
 #include "libc/bits/weaken.h"
-#include "libc/calls/calls.h"
 #include "libc/calls/internal.h"
 #include "libc/calls/sigbits.h"
 #include "libc/calls/struct/sigaction.h"
-#include "libc/calls/struct/siginfo.h"
-#include "libc/calls/struct/termios.h"
-#include "libc/calls/struct/utsname.h"
-#include "libc/calls/termios.h"
-#include "libc/calls/ucontext.h"
-#include "libc/dce.h"
 #include "libc/errno.h"
-#include "libc/fmt/fmt.h"
 #include "libc/intrin/asan.internal.h"
 #include "libc/intrin/kprintf.h"
 #include "libc/log/backtrace.internal.h"
-#include "libc/log/color.internal.h"
 #include "libc/log/gdb.h"
 #include "libc/log/internal.h"
 #include "libc/log/libfatal.internal.h"
 #include "libc/log/log.h"
 #include "libc/macros.internal.h"
-#include "libc/nexgen32e/bsr.h"
 #include "libc/nexgen32e/stackframe.h"
-#include "libc/nt/process.h"
-#include "libc/nt/runtime.h"
-#include "libc/runtime/internal.h"
-#include "libc/runtime/memtrack.internal.h"
 #include "libc/runtime/pc.internal.h"
-#include "libc/runtime/runtime.h"
-#include "libc/runtime/stack.h"
-#include "libc/str/str.h"
-#include "libc/sysv/consts/auxv.h"
-#include "libc/sysv/consts/fileno.h"
-#include "libc/sysv/consts/nr.h"
-#include "libc/sysv/consts/o.h"
-#include "libc/sysv/consts/sig.h"
-#include "libc/sysv/consts/termios.h"
 
 /**
  * @fileoverview Abnormal termination handling & GUI debugging.
  * @see libc/onkill.c
  */
 
-STATIC_YOINK("strerror_r");
+STATIC_YOINK("strerror_r"); /* for kprintf %m */
 
 static const char kGregOrder[17] forcealign(1) = {
     13, 11, 8, 14, 12, 9, 10, 15, 16, 0, 1, 2, 3, 4, 5, 6, 7,
@@ -89,7 +66,7 @@ static const char kCrashSigNames[7][5] forcealign(1) = {
 };
 /* </SYNC-LIST>: showcrashreports.c, oncrashthunks.S, oncrash.c */
 
-static relegated noasan noinstrument const char *TinyStrSignal(int sig) {
+static relegated noinstrument const char *TinyStrSignal(int sig) {
   size_t i;
   for (i = 0; i < ARRAYLEN(kCrashSigs); ++i) {
     if (kCrashSigs[i] && sig == kCrashSigs[i]) {
@@ -111,7 +88,6 @@ relegated static void ShowFunctionCalls(ucontext_t *ctx) {
     goodframe.addr = ctx->uc_mcontext.rip;
     bp = &goodframe;
     ShowBacktrace(2, bp);
-    kprintf("%n");
   }
 }
 
@@ -157,7 +133,7 @@ relegated static void ShowGeneralRegisters(ucontext_t *ctx) {
   long double st;
   char *p, buf[128];
   p = buf;
-  printf("%n");
+  kprintf("%n");
   for (i = 0, j = 0, k = 0; i < ARRAYLEN(kGregNames); ++i) {
     if (j > 0) *p++ = ' ';
     if (!(s = kGregNames[(unsigned)kGregOrder[i]])[2]) *p++ = ' ';
@@ -248,8 +224,8 @@ relegated void ShowCrashReport(int err, int sig, struct siginfo *si,
           "  %s%n"
           "  %m%n"
           "  %s %s %s %s%n",
-          !g_isterminalinarticulate ? "\e[30;101m" : "",
-          !g_isterminalinarticulate ? "\e[0m" : "", TinyStrSignal(sig),
+          !__nocolor ? "\e[30;101m" : "", !__nocolor ? "\e[0m" : "",
+          TinyStrSignal(sig),
           (ctx && (ctx->uc_mcontext.rsp >= GetStaticStackAddr(0) &&
                    ctx->uc_mcontext.rsp <= GetStaticStackAddr(0) + PAGESIZE))
               ? "Stack Overflow"
@@ -285,8 +261,10 @@ relegated static void RestoreDefaultCrashSignalHandlers(void) {
   }
 }
 
-static wontreturn noasan relegated noinstrument void __minicrash(
-    int sig, struct siginfo *si, ucontext_t *ctx, const char *kind) {
+static wontreturn relegated noinstrument void __minicrash(int sig,
+                                                          struct siginfo *si,
+                                                          ucontext_t *ctx,
+                                                          const char *kind) {
   kprintf("%n"
           "%n"
           "CRASHED %s WITH SIG%s%n"
@@ -313,8 +291,8 @@ static wontreturn noasan relegated noinstrument void __minicrash(
  *
  * This function never returns, except for traps w/ human supervision.
  */
-noasan relegated noinstrument void __oncrash(int sig, struct siginfo *si,
-                                             ucontext_t *ctx) {
+relegated noinstrument void __oncrash(int sig, struct siginfo *si,
+                                      ucontext_t *ctx) {
   intptr_t rip;
   int gdbpid, err;
   static bool noreentry, notpossible;
@@ -325,7 +303,7 @@ noasan relegated noinstrument void __oncrash(int sig, struct siginfo *si,
       err = errno;
       if ((gdbpid = IsDebuggerPresent(true))) {
         DebugBreak();
-      } else if (g_isterminalinarticulate || g_isrunningundermake) {
+      } else if (__nocolor || g_isrunningundermake) {
         gdbpid = -1;
       } else if (IsLinux() && FindDebugBinary()) {
         RestoreDefaultCrashSignalHandlers();
diff --git a/libc/log/restoretty.c b/libc/log/restoretty.c
index b5e50c4bd..059a2015a 100644
--- a/libc/log/restoretty.c
+++ b/libc/log/restoretty.c
@@ -17,13 +17,19 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/calls/calls.h"
+#include "libc/calls/struct/termios.h"
 #include "libc/calls/termios.h"
-#include "libc/dce.h"
+#include "libc/errno.h"
 #include "libc/log/color.internal.h"
 #include "libc/log/internal.h"
-#include "libc/nt/runtime.h"
-#include "libc/str/str.h"
-#include "libc/sysv/consts/nr.h"
+#include "libc/sysv/consts/termios.h"
+
+/**
+ * @fileoverview Terminal Restoration Helper
+ *
+ * This is used by the crash reporting functions, e.g. __die(), to help
+ * ensure the terminal is in an unborked state after a crash happens.
+ */
 
 #define RESET_COLOR   "\e[0m"
 #define SHOW_CURSOR   "\e[?25h"
@@ -32,13 +38,10 @@
 
 struct termios g_oldtermios;
 
-asm(".section .privileged,\"ax\",@progbits\n__syscall:\n\t"
-    "syscall\n\t"
-    "ret\n\t"
-    ".previous");
-
 static textstartup void g_oldtermios_init() {
+  int e = errno;
   tcgetattr(1, &g_oldtermios);
+  errno = e;
 }
 
 const void *const g_oldtermios_ctor[] initarray = {
@@ -46,7 +49,7 @@ const void *const g_oldtermios_ctor[] initarray = {
 };
 
 void __restore_tty(int fd) {
-  if (g_oldtermios.c_lflag && isatty(fd) && cancolor()) {
+  if (g_oldtermios.c_lflag && !__nocolor && isatty(fd)) {
     write(fd, ANSI_RESTORE, strlen(ANSI_RESTORE));
     tcsetattr(fd, TCSAFLUSH, &g_oldtermios);
   }
diff --git a/libc/log/showcrashreports.c b/libc/log/showcrashreports.c
index 013cd99b0..7297becf5 100644
--- a/libc/log/showcrashreports.c
+++ b/libc/log/showcrashreports.c
@@ -72,7 +72,7 @@ void ShowCrashReports(void) {
   for (i = 0; i < ARRAYLEN(kCrashSigs); ++i) {
     sigdelset(&sa.sa_mask, kCrashSigs[i]);
   }
-  sigaltstack(&ss, 0);
+  if (!IsWindows()) sigaltstack(&ss, 0);
   for (i = 0; i < ARRAYLEN(kCrashSigs); ++i) {
     if (kCrashSigs[i]) {
       sa.sa_sigaction = (sigaction_f)__oncrash_thunks[i];
diff --git a/libc/log/startfatal.c b/libc/log/startfatal.c
index ac3b65096..9a50bd4db 100644
--- a/libc/log/startfatal.c
+++ b/libc/log/startfatal.c
@@ -16,9 +16,9 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/intrin/kprintf.h"
 #include "libc/log/color.internal.h"
 #include "libc/log/internal.h"
-#include "libc/log/libfatal.internal.h"
 #include "libc/runtime/runtime.h"
 
 /**
@@ -27,19 +27,8 @@
  * @note this is support code for __check_fail(), __assert_fail(), etc.
  */
 relegated void __start_fatal(const char *file, int line) {
-  bool colorful;
-  char s[16 + 16 + 16 + 16 + PATH_MAX + 16 + NAME_MAX + 16], *p = s;
   __restore_tty(1);
-  colorful = cancolor();
-  *p++ = '\r';
-  if (colorful) p = __stpcpy(p, "\e[J\e[30;101m");
-  p = __stpcpy(p, "error");
-  if (colorful) p = __stpcpy(p, "\e[94;49m"), *p++ = ':';
-  p = __stpcpy(p, file), *p++ = ':';
-  p = __intcpy(p, line), *p++ = ':';
-  p = __stpcpy(p, program_invocation_short_name);
-  if (colorful) p = __stpcpy(p, "\e[0m");
-  *p++ = ':';
-  *p++ = ' ';
-  __write(s, p - s);
+  kprintf("\r%serror%s:%s:%d:%s%s: ", !__nocolor ? "\e[J\e[30;101m" : "",
+          !__nocolor ? "\e[94;49m" : "", file, line,
+          program_invocation_short_name, !__nocolor ? "\e[0m" : "");
 }
diff --git a/libc/macros-cpp.internal.inc b/libc/macros-cpp.internal.inc
index 2593c40fa..98f41ca46 100644
--- a/libc/macros-cpp.internal.inc
+++ b/libc/macros-cpp.internal.inc
@@ -192,3 +192,31 @@
 #endif
  .endif
 .endm
+
+.macro	.poison	name:req kind:req
+#ifdef __FSANITIZE_ADDRESS__
+2323:	.quad	0
+	.init.start 304,"_init_\name\()_poison_\@"
+	push	%rdi
+	push	%rsi
+	ezlea	2323b,di
+	mov	$8,%esi
+	mov	$\kind,%edx
+	call	__asan_poison
+	pop	%rsi
+	pop	%rdi
+	.init.end 304,"_init_\name\()_poison_\@"
+#endif
+.endm
+
+.macro	.underrun
+#ifdef __FSANITIZE_ADDRESS__
+	.poison	__BASE_FILE__ kAsanGlobalUnderrun
+#endif
+.endm
+
+.macro	.overrun
+#ifdef __FSANITIZE_ADDRESS__
+	.poison	__BASE_FILE__ kAsanGlobalUnderrun
+#endif
+.endm
diff --git a/libc/mem/putenv.c b/libc/mem/putenv.c
index 56011f090..b2f6c41a9 100644
--- a/libc/mem/putenv.c
+++ b/libc/mem/putenv.c
@@ -17,46 +17,63 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/alg/alg.h"
+#include "libc/calls/sysdebug.internal.h"
 #include "libc/dce.h"
+#include "libc/macros.internal.h"
 #include "libc/mem/internal.h"
 #include "libc/mem/mem.h"
 #include "libc/runtime/runtime.h"
 #include "libc/str/str.h"
 #include "libc/sysv/errfuns.h"
 
-#define MAX_VARS 512
-
 #define ToUpper(c) ((c) >= 'a' && (c) <= 'z' ? (c) - 'a' + 'A' : (c))
 
 static bool once;
+static size_t capacity;
 
-static void PutEnvDestroy(void) {
+static size_t GetEnvironLen(char **env) {
+  char **p = env;
+  while (*p) ++p;
+  return p - env;
+}
+
+static void RestoreOriginalEnvironment(char **envp) {
+  environ = envp;
+}
+
+static void PutEnvImplAtExit(void *p) {
+  free(p);
+}
+
+static void FreeEnviron(char **env) {
   char **a;
-  for (a = environ; *a; ++a) free(*a);
-  free(environ);
-}
-
-static void PutEnvInit(void) {
-  char **pin, **pout;
-  pin = environ;
-  pout = malloc(sizeof(char *) * MAX_VARS);
-  environ = pout;
-  while (*pin) *pout++ = strdup(*pin++);
-  *pout = NULL;
-  atexit(PutEnvDestroy);
-}
-
-void __freeenv(void *p) {
-  if (once) {
-    free(p);
+  for (a = env; *a; ++a) {
+    free(*a);
   }
+  free(env);
+}
+
+static void GrowEnviron(void) {
+  size_t n, c;
+  char **a, **b, **p;
+  a = environ;
+  n = GetEnvironLen(a);
+  c = MAX(16ul, n) << 1;
+  b = calloc(c, sizeof(char *));
+  for (p = b; *a;) {
+    *p++ = strdup(*a++);
+  }
+  __cxa_atexit(FreeEnviron, b, 0);
+  environ = b;
+  capacity = c;
 }
 
 int PutEnvImpl(char *s, bool overwrite) {
   char *p;
   unsigned i, namelen;
   if (!once) {
-    PutEnvInit();
+    __cxa_atexit(RestoreOriginalEnvironment, environ, 0);
+    GrowEnviron();
     once = true;
   }
   for (p = s; *p && *p != '='; ++p) {
@@ -64,7 +81,7 @@ int PutEnvImpl(char *s, bool overwrite) {
       *p = ToUpper(*p);
     }
   }
-  if (*p != '=') goto fail;
+  if (*p != '=') goto Fail;
   namelen = p + 1 - s;
   for (i = 0; environ[i]; ++i) {
     if (!strncmp(environ[i], s, namelen)) {
@@ -72,27 +89,38 @@ int PutEnvImpl(char *s, bool overwrite) {
         free(s);
         return 0;
       }
-      goto replace;
+      goto Replace;
     }
   }
-  if (i + 1 >= MAX_VARS) {
-    free(s);
-    return enomem();
+  if (i + 1 >= capacity) {
+    GrowEnviron();
   }
-  environ[i + 1] = NULL;
-replace:
-  free(environ[i]);
+  environ[i + 1] = 0;
+Replace:
+  __cxa_atexit(PutEnvImplAtExit, environ[i], 0);
   environ[i] = s;
   return 0;
-fail:
+Fail:
   free(s);
   return einval();
 }
 
+/* weakly called by unsetenv() when removing a pointer */
+void __freeenv(void *p) {
+  if (once) {
+    __cxa_atexit(free, p, 0);
+  }
+}
+
 /**
  * Emplaces environment key=value.
+ *
+ * @return 0 on success or non-zero on error
  * @see setenv(), getenv()
  */
-int putenv(char *string) {
-  return PutEnvImpl(strdup(string), true);
+int putenv(char *s) {
+  int rc;
+  rc = PutEnvImpl(strdup(s), true);
+  SYSDEBUG("putenv(%#s) → %d", s, rc);
+  return rc;
 }
diff --git a/libc/mem/setenv.c b/libc/mem/setenv.c
index cb0b72262..c7e24ff26 100644
--- a/libc/mem/setenv.c
+++ b/libc/mem/setenv.c
@@ -16,6 +16,7 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/calls/sysdebug.internal.h"
 #include "libc/mem/internal.h"
 #include "libc/mem/mem.h"
 #include "libc/runtime/runtime.h"
@@ -28,9 +29,14 @@
  * @see putenv(), getenv()
  */
 int setenv(const char *name, const char *value, int overwrite) {
-  size_t namelen = strlen(name);
-  size_t valuelen = strlen(value);
-  char *s = malloc(namelen + valuelen + 2);
+  int rc;
+  char *s;
+  size_t namelen, valuelen;
+  namelen = strlen(name);
+  valuelen = strlen(value);
+  s = malloc(namelen + valuelen + 2);
   memcpy(mempcpy(mempcpy(s, name, namelen), "=", 1), value, valuelen + 1);
-  return PutEnvImpl(s, overwrite);
+  rc = PutEnvImpl(s, overwrite);
+  SYSDEBUG("setenv(%#s, %#s, %d) → %d", name, value, overwrite, rc);
+  return rc;
 }
diff --git a/libc/runtime/finddebugbinary.c b/libc/runtime/finddebugbinary.c
index 98ab23545..5df30e39d 100644
--- a/libc/runtime/finddebugbinary.c
+++ b/libc/runtime/finddebugbinary.c
@@ -17,15 +17,40 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/bits/bits.h"
-#include "libc/bits/safemacros.internal.h"
 #include "libc/calls/calls.h"
-#include "libc/calls/sysdebug.internal.h"
-#include "libc/errno.h"
-#include "libc/macros.internal.h"
 #include "libc/runtime/runtime.h"
 #include "libc/runtime/symbols.internal.h"
 #include "libc/str/str.h"
-#include "libc/sysv/consts/auxv.h"
+
+static char *g_comdbg;
+static char g_comdbg_buf[PATH_MAX + 1];
+
+static optimizesize textstartup void g_comdbg_init() {
+  char *p;
+  size_t n;
+  static bool once;
+  if (!once) {
+    if (!(g_comdbg = getenv("COMDBG"))) {
+      p = program_executable_name;
+      n = strlen(p);
+      if (n > 4 && READ32LE(p + n - 4) == READ32LE(".dbg")) {
+        g_comdbg = p;
+      } else if (n > 4 && READ32LE(p + n - 4) == READ32LE(".com") &&
+                 n + 4 <= PATH_MAX) {
+        mempcpy(mempcpy(g_comdbg_buf, p, n), ".dbg", 5);
+        if (fileexists(g_comdbg_buf)) {
+          g_comdbg = g_comdbg_buf;
+        }
+      } else if (n + 8 <= PATH_MAX) {
+        mempcpy(mempcpy(g_comdbg_buf, p, n), ".com.dbg", 9);
+        if (fileexists(g_comdbg_buf)) {
+          g_comdbg = g_comdbg_buf;
+        }
+      }
+    }
+    once = true;
+  }
+}
 
 /**
  * Returns path of binary with the debug information, or null.
@@ -33,31 +58,10 @@
  * @return path to debug binary, or NULL
  */
 const char *FindDebugBinary(void) {
-  static bool once;
-  static char *res;
-  static char buf[PATH_MAX + 1];
-  char *p;
-  size_t n;
-  if (!once) {
-    if (!(res = getenv("COMDBG"))) {
-      p = program_executable_name;
-      n = strlen(p);
-      if (n > 4 && READ32LE(p + n - 4) == READ32LE(".dbg")) {
-        res = p;
-      } else if (n > 4 && READ32LE(p + n - 4) == READ32LE(".com") &&
-                 n + 4 <= PATH_MAX) {
-        mempcpy(mempcpy(buf, p, n), ".dbg", 5);
-        if (fileexists(buf)) {
-          res = buf;
-        }
-      } else if (n + 8 <= PATH_MAX) {
-        mempcpy(mempcpy(buf, p, n), ".com.dbg", 9);
-        if (fileexists(buf)) {
-          res = buf;
-        }
-      }
-    }
-    once = true;
-  }
-  return res;
+  g_comdbg_init();
+  return g_comdbg;
 }
+
+const void *const g_comdbg_ctor[] initarray = {
+    g_comdbg_init,
+};
diff --git a/libc/str/longsort.c b/libc/str/longsort.c
index 0155302f4..6235485d3 100644
--- a/libc/str/longsort.c
+++ b/libc/str/longsort.c
@@ -61,6 +61,10 @@ static optimizesize noasan void longsort_pure(long *x, size_t n, size_t t) {
 
 /**
  * Sorting algorithm for longs that doesn't take long.
+ *
+ *     "What disorder is this? Give me my long sort!"
+ *                               -Lord Capulet
+ *
  */
 void longsort(long *x, size_t n) {
   size_t t, m;
diff --git a/libc/testlib/testlib.h b/libc/testlib/testlib.h
index 6e3fb3263..a1e266856 100644
--- a/libc/testlib/testlib.h
+++ b/libc/testlib/testlib.h
@@ -352,7 +352,6 @@ void thrashcodecache(void);
 void testlib_finish(void);
 void testlib_runalltests(void);
 void testlib_runallbenchmarks(void);
-void testlib_checkformemoryleaks(void);
 void testlib_runtestcases(testfn_t *, testfn_t *, testfn_t);
 void testlib_runcombos(testfn_t *, testfn_t *, const struct TestFixture *,
                        const struct TestFixture *);
diff --git a/libc/testlib/testlib.mk b/libc/testlib/testlib.mk
index fc2274f50..9f71f865d 100644
--- a/libc/testlib/testlib.mk
+++ b/libc/testlib/testlib.mk
@@ -59,7 +59,6 @@ LIBC_TESTLIB_A_SRCS_C =						\
 	libc/testlib/comborunner.c				\
 	libc/testlib/contains.c					\
 	libc/testlib/endswith.c					\
-	libc/testlib/leaks.c					\
 	libc/testlib/yield.c					\
 	libc/testlib/ezbenchcontrol.c				\
 	libc/testlib/ezbenchreport.c				\
diff --git a/libc/testlib/testmain.c b/libc/testlib/testmain.c
index 80c1463e3..629915bab 100644
--- a/libc/testlib/testmain.c
+++ b/libc/testlib/testmain.c
@@ -95,13 +95,13 @@ noasan int main(int argc, char *argv[]) {
   if (!g_testlib_failed && runbenchmarks_ && weaken(testlib_runallbenchmarks)) {
     weaken(testlib_runallbenchmarks)();
     if (!g_testlib_failed) {
-      testlib_checkformemoryleaks();
+      CheckForMemoryLeaks();
     }
     if (!g_testlib_failed && IsRunningUnderMake()) {
       return 254; /* compile.com considers this 0 and propagates output */
     }
   } else if (!g_testlib_failed) {
-    testlib_checkformemoryleaks();
+    CheckForMemoryLeaks();
   }
   exit(min(255, g_testlib_failed));
 }
diff --git a/net/https/getsslroots.c b/net/https/getsslroots.c
index 267c12e20..d6bd77fcb 100644
--- a/net/https/getsslroots.c
+++ b/net/https/getsslroots.c
@@ -32,26 +32,40 @@
 
 STATIC_YOINK("ssl_root_support");
 
+static void FreeSslRoots(mbedtls_x509_crt *c) {
+  mbedtls_x509_crt_free(c);
+  free(c);
+}
+
+/**
+ * Returns singleton of SSL roots stored in /zip/usr/share/ssl/root/...
+ */
 mbedtls_x509_crt *GetSslRoots(void) {
   int fd;
   DIR *d;
   uint8_t *p;
   size_t n, m;
   struct dirent *e;
-  mbedtls_x509_crt *c;
+  static bool once;
+  static mbedtls_x509_crt *c;
   char path[PATH_MAX + 1];
-  c = calloc(1, sizeof(*c));
-  m = stpcpy(path, "/zip/usr/share/ssl/root/") - path;
-  if ((d = opendir(path))) {
-    while ((e = readdir(d))) {
-      if (e->d_type != DT_REG) continue;
-      if (m + (n = strlen(e->d_name)) > PATH_MAX) continue;
-      memcpy(path + m, e->d_name, n + 1);
-      CHECK((p = xslurp(path, &n)));
-      CHECK_GE(mbedtls_x509_crt_parse(c, p, n + 1), 0, "%s", path);
-      free(p);
+  if (!once) {
+    if ((c = calloc(1, sizeof(*c)))) {
+      m = stpcpy(path, "/zip/usr/share/ssl/root/") - path;
+      if ((d = opendir(path))) {
+        while ((e = readdir(d))) {
+          if (e->d_type != DT_REG) continue;
+          if (m + (n = strlen(e->d_name)) > PATH_MAX) continue;
+          memcpy(path + m, e->d_name, n + 1);
+          CHECK((p = xslurp(path, &n)));
+          CHECK_GE(mbedtls_x509_crt_parse(c, p, n + 1), 0, "%s", path);
+          free(p);
+        }
+        closedir(d);
+      }
+      __cxa_atexit(FreeSslRoots, c, 0);
     }
-    closedir(d);
+    once = true;
   }
   return c;
 }
diff --git a/test/libc/calls/getenv_test.c b/test/libc/intrin/getenv_test.c
similarity index 100%
rename from test/libc/calls/getenv_test.c
rename to test/libc/intrin/getenv_test.c
diff --git a/test/libc/log/backtrace_test.c b/test/libc/log/backtrace_test.c
index e89bfbb12..2b6474ee7 100644
--- a/test/libc/log/backtrace_test.c
+++ b/test/libc/log/backtrace_test.c
@@ -25,6 +25,7 @@
 #include "libc/log/log.h"
 #include "libc/mem/mem.h"
 #include "libc/runtime/gc.internal.h"
+#include "libc/runtime/internal.h"
 #include "libc/runtime/runtime.h"
 #include "libc/runtime/symbols.internal.h"
 #include "libc/stdio/append.internal.h"
@@ -84,7 +85,7 @@ char *StackOverrunCrash(int n) {
 
 char *MemoryLeakCrash(void) {
   char *p = strdup("doge");
-  testlib_checkformemoryleaks();
+  CheckForMemoryLeaks();
   return p;
 }
 
@@ -123,6 +124,9 @@ void SetUp(void) {
         exit((intptr_t)pMemoryLeakCrash());
       case 7:
         exit(pNpeCrash(0));
+      case 8:
+        __cxa_finalize(0);
+        exit(pNpeCrash(0));
       default:
         printf("preventing fork recursion: %s\n", __argv[1]);
         exit(1);
@@ -550,7 +554,7 @@ TEST(ShowCrashReports, testNpeCrash) {
   ASSERT_NE(-1, wait(&ws));
   EXPECT_TRUE(WIFEXITED(ws));
   EXPECT_EQ(77, WEXITSTATUS(ws));
-  /* NULL is stopgap until we can copy symbol tablces into binary */
+  /* NULL is stopgap until we can copy symbol tables into binary */
   if (!strstr(output, "null pointer dereference")) {
     fprintf(stderr, "ERROR: crash report didn't diagnose the problem\n%s\n",
             gc(IndentLines(output, -1, 0, 4)));
@@ -619,3 +623,57 @@ TEST(ShowCrashReports, testDataOverrunCrash) {
   }
   free(output);
 }
+
+TEST(ShowCrashReports, testNpeCrashAfterFinalize) {
+  /*
+   * this test makes sure we're not doing things like depending on
+   * environment variables after __cxa_finalize is called in cases
+   * where putenv() is used
+   */
+  size_t got;
+  ssize_t rc;
+  int ws, pid, fds[2];
+  char *output, buf[512];
+  ASSERT_NE(-1, pipe2(fds, O_CLOEXEC));
+  ASSERT_NE(-1, (pid = vfork()));
+  if (!pid) {
+    dup2(fds[1], 1);
+    dup2(fds[1], 2);
+    execv(program_executable_name,
+          (char *const[]){program_executable_name, "8", 0});
+    _exit(127);
+  }
+  close(fds[1]);
+  output = 0;
+  appends(&output, "");
+  for (;;) {
+    rc = read(fds[0], buf, sizeof(buf));
+    if (rc == -1) {
+      ASSERT_EQ(EINTR, errno);
+      continue;
+    }
+    if ((got = rc)) {
+      appendd(&output, buf, got);
+    } else {
+      break;
+    }
+  }
+  ASSERT_NE(-1, wait(&ws));
+  EXPECT_TRUE(WIFEXITED(ws));
+  EXPECT_EQ(IsAsan() ? 77 : 128 + SIGSEGV, WEXITSTATUS(ws));
+  /* NULL is stopgap until we can copy symbol tables into binary */
+  if (!strstr(output, IsAsan() ? "null pointer dereference"
+                               : "Uncaught SIGSEGV (SEGV_MAPERR)")) {
+    fprintf(stderr, "ERROR: crash report didn't diagnose the problem\n%s\n",
+            gc(IndentLines(output, -1, 0, 4)));
+    __die();
+  }
+#ifdef __FNO_OMIT_FRAME_POINTER__
+  if (!OutputHasSymbol(output, "NpeCrash")) {
+    fprintf(stderr, "ERROR: crash report didn't have backtrace\n%s\n",
+            gc(IndentLines(output, -1, 0, 4)));
+    __die();
+  }
+#endif
+  free(output);
+}
diff --git a/test/libc/stdio/vappendf_test.c b/test/libc/stdio/vappendf_test.c
index d3475859c..6535ee66d 100644
--- a/test/libc/stdio/vappendf_test.c
+++ b/test/libc/stdio/vappendf_test.c
@@ -157,6 +157,16 @@ TEST(appendd, testMemFail_doesntFreeExistingAllocation) {
   free(b);
 }
 
+TEST(appendd, nontrivialAmountOfMemory) {
+  char *b = 0;
+  int i, n = 40000;
+  for (i = 0; i < n; ++i) {
+    ASSERT_EQ(2, appendd(&b, "hi", 2));
+  }
+  EXPECT_EQ(40000 * 2, appendz(b).i);
+  free(b);
+}
+
 BENCH(vappendf, bench) {
   const char t[] = {0};
   char *b = 0;
diff --git a/third_party/lua/lapi.c b/third_party/lua/lapi.c
index 0f8c7c001..ff7158411 100644
--- a/third_party/lua/lapi.c
+++ b/third_party/lua/lapi.c
@@ -726,6 +726,7 @@ LUA_API void lua_pushcclosure (lua_State *L, lua_CFunction fn, int n) {
  */
 LUA_API void lua_pushboolean (lua_State *L, int b) {
   lua_lock(L);
+  /* a.k.a. L->top->val.tt_ = b ? LUA_VTRUE : LUA_VFALSE; */
   if (b)
     setbtvalue(s2v(L->top));
   else
diff --git a/third_party/mbedtls/formatclientciphers.c b/third_party/mbedtls/formatclientciphers.c
new file mode 100644
index 000000000..70afb7122
--- /dev/null
+++ b/third_party/mbedtls/formatclientciphers.c
@@ -0,0 +1,41 @@
+/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
+│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8                                :vi│
+╞══════════════════════════════════════════════════════════════════════════════╡
+│ Copyright 2022 Justine Alexandra Roberts Tunney                              │
+│                                                                              │
+│ Permission to use, copy, modify, and/or distribute this software for         │
+│ any purpose with or without fee is hereby granted, provided that the         │
+│ above copyright notice and this permission notice appear in all copies.      │
+│                                                                              │
+│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL                │
+│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED                │
+│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE             │
+│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL         │
+│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR        │
+│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER               │
+│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
+│ PERFORMANCE OF THIS SOFTWARE.                                                │
+╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/bits/bits.h"
+#include "libc/macros.internal.h"
+#include "libc/stdio/append.internal.h"
+#include "third_party/mbedtls/iana.h"
+
+/**
+ * Returns string of joined list of first 𝑘 client preferred ciphers.
+ * @return string that must be free'd, or null if none set
+ */
+nodiscard char *FormatSslClientCiphers(const mbedtls_ssl_context *ssl) {
+  int i;
+  char *b = 0;
+  for (i = 0; i < ARRAYLEN(ssl->client_ciphers); ++i) {
+    if (!ssl->client_ciphers[i]) break;
+    if (i) appendw(&b, READ16LE(", "));
+    appendf(&b, "%s[0x%04x]", GetCipherSuiteName(ssl->client_ciphers[i]),
+            ssl->client_ciphers[i]);
+  }
+  if (i == ARRAYLEN(ssl->client_ciphers)) {
+    appends(&b, ", ...");
+  }
+  return b;
+}
diff --git a/third_party/mbedtls/getciphersuitename.c b/third_party/mbedtls/getciphersuitename.c
index 3b722d3e2..ca2f46f86 100644
--- a/third_party/mbedtls/getciphersuitename.c
+++ b/third_party/mbedtls/getciphersuitename.c
@@ -17,708 +17,714 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "third_party/mbedtls/iana.h"
 
+/**
+ * Returns ciphersuite name.
+ *
+ * This contains a superset of what's actually supported. It should
+ * include all IANA assignments.
+ */
 const char *GetCipherSuiteName(uint16_t x) {
   switch (x) {
     case 0x0000:
-      return "TLS_NULL_WITH_NULL_NULL";
+      return "NULL-NULL-NULL";
     case 0x0001:
-      return "TLS_RSA_WITH_NULL_MD5";
+      return "RSA-NULL-MD5";
     case 0x0002:
-      return "TLS_RSA_WITH_NULL_SHA";
+      return "RSA-NULL-SHA";
     case 0x0003:
-      return "TLS_RSA_EXPORT_WITH_RC4_40_MD5";
+      return "RSA-EXPORT-RC4-40-MD5";
     case 0x0004:
-      return "TLS_RSA_WITH_RC4_128_MD5";
+      return "RSA-RC4-128-MD5";
     case 0x0005:
-      return "TLS_RSA_WITH_RC4_128_SHA";
+      return "RSA-RC4-128-SHA";
     case 0x0006:
-      return "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5";
+      return "RSA-EXPORT-RC2-CBC-40-MD5";
     case 0x0007:
-      return "TLS_RSA_WITH_IDEA_CBC_SHA";
+      return "RSA-IDEA-CBC-SHA";
     case 0x0008:
-      return "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA";
+      return "RSA-EXPORT-DES40-CBC-SHA";
     case 0x0009:
-      return "TLS_RSA_WITH_DES_CBC_SHA";
+      return "RSA-DES-CBC-SHA";
     case 0x000A:
-      return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
+      return "RSA-3DES-EDE-CBC-SHA";
     case 0x000B:
-      return "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA";
+      return "DH-DSS-EXPORT-DES40-CBC-SHA";
     case 0x000C:
-      return "TLS_DH_DSS_WITH_DES_CBC_SHA";
+      return "DH-DSS-DES-CBC-SHA";
     case 0x000D:
-      return "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA";
+      return "DH-DSS-3DES-EDE-CBC-SHA";
     case 0x000E:
-      return "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA";
+      return "DH-RSA-EXPORT-DES40-CBC-SHA";
     case 0x000F:
-      return "TLS_DH_RSA_WITH_DES_CBC_SHA";
+      return "DH-RSA-DES-CBC-SHA";
     case 0x0010:
-      return "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA";
+      return "DH-RSA-3DES-EDE-CBC-SHA";
     case 0x0011:
-      return "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA";
+      return "DHE-DSS-EXPORT-DES40-CBC-SHA";
     case 0x0012:
-      return "TLS_DHE_DSS_WITH_DES_CBC_SHA";
+      return "DHE-DSS-DES-CBC-SHA";
     case 0x0013:
-      return "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA";
+      return "DHE-DSS-3DES-EDE-CBC-SHA";
     case 0x0014:
-      return "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA";
+      return "DHE-RSA-EXPORT-DES40-CBC-SHA";
     case 0x0015:
-      return "TLS_DHE_RSA_WITH_DES_CBC_SHA";
+      return "DHE-RSA-DES-CBC-SHA";
     case 0x0016:
-      return "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA";
+      return "DHE-RSA-3DES-EDE-CBC-SHA";
     case 0x0017:
-      return "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5";
+      return "DH-anon-EXPORT-RC4-40-MD5";
     case 0x0018:
-      return "TLS_DH_anon_WITH_RC4_128_MD5";
+      return "DH-anon-RC4-128-MD5";
     case 0x0019:
-      return "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA";
+      return "DH-anon-EXPORT-DES40-CBC-SHA";
     case 0x001A:
-      return "TLS_DH_anon_WITH_DES_CBC_SHA";
+      return "DH-anon-DES-CBC-SHA";
     case 0x001B:
-      return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA";
+      return "DH-anon-3DES-EDE-CBC-SHA";
     case 0x001E:
-      return "TLS_KRB5_WITH_DES_CBC_SHA";
+      return "KRB5-DES-CBC-SHA";
     case 0x001F:
-      return "TLS_KRB5_WITH_3DES_EDE_CBC_SHA";
+      return "KRB5-3DES-EDE-CBC-SHA";
     case 0x0020:
-      return "TLS_KRB5_WITH_RC4_128_SHA";
+      return "KRB5-RC4-128-SHA";
     case 0x0021:
-      return "TLS_KRB5_WITH_IDEA_CBC_SHA";
+      return "KRB5-IDEA-CBC-SHA";
     case 0x0022:
-      return "TLS_KRB5_WITH_DES_CBC_MD5";
+      return "KRB5-DES-CBC-MD5";
     case 0x0023:
-      return "TLS_KRB5_WITH_3DES_EDE_CBC_MD5";
+      return "KRB5-3DES-EDE-CBC-MD5";
     case 0x0024:
-      return "TLS_KRB5_WITH_RC4_128_MD5";
+      return "KRB5-RC4-128-MD5";
     case 0x0025:
-      return "TLS_KRB5_WITH_IDEA_CBC_MD5";
+      return "KRB5-IDEA-CBC-MD5";
     case 0x0026:
-      return "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA";
+      return "KRB5-EXPORT-DES-CBC-40-SHA";
     case 0x0027:
-      return "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA";
+      return "KRB5-EXPORT-RC2-CBC-40-SHA";
     case 0x0028:
-      return "TLS_KRB5_EXPORT_WITH_RC4_40_SHA";
+      return "KRB5-EXPORT-RC4-40-SHA";
     case 0x0029:
-      return "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5";
+      return "KRB5-EXPORT-DES-CBC-40-MD5";
     case 0x002A:
-      return "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5";
+      return "KRB5-EXPORT-RC2-CBC-40-MD5";
     case 0x002B:
-      return "TLS_KRB5_EXPORT_WITH_RC4_40_MD5";
+      return "KRB5-EXPORT-RC4-40-MD5";
     case 0x002C:
-      return "TLS_PSK_WITH_NULL_SHA";
+      return "PSK-NULL-SHA";
     case 0x002D:
-      return "TLS_DHE_PSK_WITH_NULL_SHA";
+      return "DHE-PSK-NULL-SHA";
     case 0x002E:
-      return "TLS_RSA_PSK_WITH_NULL_SHA";
+      return "RSA-PSK-NULL-SHA";
     case 0x002F:
-      return "TLS_RSA_WITH_AES_128_CBC_SHA";
+      return "RSA-AES128-CBC-SHA";
     case 0x0030:
-      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA";
+      return "DH-DSS-AES128-CBC-SHA";
     case 0x0031:
-      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA";
+      return "DH-RSA-AES128-CBC-SHA";
     case 0x0032:
-      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA";
+      return "DHE-DSS-AES128-CBC-SHA";
     case 0x0033:
-      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
+      return "DHE-RSA-AES128-CBC-SHA";
     case 0x0034:
-      return "TLS_DH_anon_WITH_AES_128_CBC_SHA";
+      return "DH-anon-AES128-CBC-SHA";
     case 0x0035:
-      return "TLS_RSA_WITH_AES_256_CBC_SHA";
+      return "RSA-AES256-CBC-SHA";
     case 0x0036:
-      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA";
+      return "DH-DSS-AES256-CBC-SHA";
     case 0x0037:
-      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA";
+      return "DH-RSA-AES256-CBC-SHA";
     case 0x0038:
-      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA";
+      return "DHE-DSS-AES256-CBC-SHA";
     case 0x0039:
-      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
+      return "DHE-RSA-AES256-CBC-SHA";
     case 0x003A:
-      return "TLS_DH_anon_WITH_AES_256_CBC_SHA";
+      return "DH-anon-AES256-CBC-SHA";
     case 0x003B:
-      return "TLS_RSA_WITH_NULL_SHA256";
+      return "RSA-NULL-SHA256";
     case 0x003C:
-      return "TLS_RSA_WITH_AES_128_CBC_SHA256";
+      return "RSA-AES128-CBC-SHA256";
     case 0x003D:
-      return "TLS_RSA_WITH_AES_256_CBC_SHA256";
+      return "RSA-AES256-CBC-SHA256";
     case 0x003E:
-      return "TLS_DH_DSS_WITH_AES_128_CBC_SHA256";
+      return "DH-DSS-AES128-CBC-SHA256";
     case 0x003F:
-      return "TLS_DH_RSA_WITH_AES_128_CBC_SHA256";
+      return "DH-RSA-AES128-CBC-SHA256";
     case 0x0040:
-      return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256";
+      return "DHE-DSS-AES128-CBC-SHA256";
     case 0x0041:
-      return "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA";
+      return "RSA-CAMELLIA128-CBC-SHA";
     case 0x0042:
-      return "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA";
+      return "DH-DSS-CAMELLIA128-CBC-SHA";
     case 0x0043:
-      return "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA";
+      return "DH-RSA-CAMELLIA128-CBC-SHA";
     case 0x0044:
-      return "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA";
+      return "DHE-DSS-CAMELLIA128-CBC-SHA";
     case 0x0045:
-      return "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA";
+      return "DHE-RSA-CAMELLIA128-CBC-SHA";
     case 0x0046:
-      return "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA";
+      return "DH-anon-CAMELLIA128-CBC-SHA";
     case 0x0067:
-      return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256";
+      return "DHE-RSA-AES128-CBC-SHA256";
     case 0x0068:
-      return "TLS_DH_DSS_WITH_AES_256_CBC_SHA256";
+      return "DH-DSS-AES256-CBC-SHA256";
     case 0x0069:
-      return "TLS_DH_RSA_WITH_AES_256_CBC_SHA256";
+      return "DH-RSA-AES256-CBC-SHA256";
     case 0x006A:
-      return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256";
+      return "DHE-DSS-AES256-CBC-SHA256";
     case 0x006B:
-      return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256";
+      return "DHE-RSA-AES256-CBC-SHA256";
     case 0x006C:
-      return "TLS_DH_anon_WITH_AES_128_CBC_SHA256";
+      return "DH-anon-AES128-CBC-SHA256";
     case 0x006D:
-      return "TLS_DH_anon_WITH_AES_256_CBC_SHA256";
+      return "DH-anon-AES256-CBC-SHA256";
     case 0x0084:
-      return "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA";
+      return "RSA-CAMELLIA256-CBC-SHA";
     case 0x0085:
-      return "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA";
+      return "DH-DSS-CAMELLIA256-CBC-SHA";
     case 0x0086:
-      return "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA";
+      return "DH-RSA-CAMELLIA256-CBC-SHA";
     case 0x0087:
-      return "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA";
+      return "DHE-DSS-CAMELLIA256-CBC-SHA";
     case 0x0088:
-      return "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA";
+      return "DHE-RSA-CAMELLIA256-CBC-SHA";
     case 0x0089:
-      return "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA";
+      return "DH-anon-CAMELLIA256-CBC-SHA";
     case 0x008A:
-      return "TLS_PSK_WITH_RC4_128_SHA";
+      return "PSK-RC4-128-SHA";
     case 0x008B:
-      return "TLS_PSK_WITH_3DES_EDE_CBC_SHA";
+      return "PSK-3DES-EDE-CBC-SHA";
     case 0x008C:
-      return "TLS_PSK_WITH_AES_128_CBC_SHA";
+      return "PSK-AES128-CBC-SHA";
     case 0x008D:
-      return "TLS_PSK_WITH_AES_256_CBC_SHA";
+      return "PSK-AES256-CBC-SHA";
     case 0x008E:
-      return "TLS_DHE_PSK_WITH_RC4_128_SHA";
+      return "DHE-PSK-RC4-128-SHA";
     case 0x008F:
-      return "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA";
+      return "DHE-PSK-3DES-EDE-CBC-SHA";
     case 0x0090:
-      return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA";
+      return "DHE-PSK-AES128-CBC-SHA";
     case 0x0091:
-      return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA";
+      return "DHE-PSK-AES256-CBC-SHA";
     case 0x0092:
-      return "TLS_RSA_PSK_WITH_RC4_128_SHA";
+      return "RSA-PSK-RC4-128-SHA";
     case 0x0093:
-      return "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA";
+      return "RSA-PSK-3DES-EDE-CBC-SHA";
     case 0x0094:
-      return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA";
+      return "RSA-PSK-AES128-CBC-SHA";
     case 0x0095:
-      return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA";
+      return "RSA-PSK-AES256-CBC-SHA";
     case 0x0096:
-      return "TLS_RSA_WITH_SEED_CBC_SHA";
+      return "RSA-SEED-CBC-SHA";
     case 0x0097:
-      return "TLS_DH_DSS_WITH_SEED_CBC_SHA";
+      return "DH-DSS-SEED-CBC-SHA";
     case 0x0098:
-      return "TLS_DH_RSA_WITH_SEED_CBC_SHA";
+      return "DH-RSA-SEED-CBC-SHA";
     case 0x0099:
-      return "TLS_DHE_DSS_WITH_SEED_CBC_SHA";
+      return "DHE-DSS-SEED-CBC-SHA";
     case 0x009A:
-      return "TLS_DHE_RSA_WITH_SEED_CBC_SHA";
+      return "DHE-RSA-SEED-CBC-SHA";
     case 0x009B:
-      return "TLS_DH_anon_WITH_SEED_CBC_SHA";
+      return "DH-anon-SEED-CBC-SHA";
     case 0x009C:
-      return "TLS_RSA_WITH_AES_128_GCM_SHA256";
+      return "RSA-AES128-GCM-SHA256";
     case 0x009D:
-      return "TLS_RSA_WITH_AES_256_GCM_SHA384";
+      return "RSA-AES256-GCM-SHA384";
     case 0x009E:
-      return "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256";
+      return "DHE-RSA-AES128-GCM-SHA256";
     case 0x009F:
-      return "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384";
+      return "DHE-RSA-AES256-GCM-SHA384";
     case 0x00A0:
-      return "TLS_DH_RSA_WITH_AES_128_GCM_SHA256";
+      return "DH-RSA-AES128-GCM-SHA256";
     case 0x00A1:
-      return "TLS_DH_RSA_WITH_AES_256_GCM_SHA384";
+      return "DH-RSA-AES256-GCM-SHA384";
     case 0x00A2:
-      return "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256";
+      return "DHE-DSS-AES128-GCM-SHA256";
     case 0x00A3:
-      return "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384";
+      return "DHE-DSS-AES256-GCM-SHA384";
     case 0x00A4:
-      return "TLS_DH_DSS_WITH_AES_128_GCM_SHA256";
+      return "DH-DSS-AES128-GCM-SHA256";
     case 0x00A5:
-      return "TLS_DH_DSS_WITH_AES_256_GCM_SHA384";
+      return "DH-DSS-AES256-GCM-SHA384";
     case 0x00A6:
-      return "TLS_DH_anon_WITH_AES_128_GCM_SHA256";
+      return "DH-anon-AES128-GCM-SHA256";
     case 0x00A7:
-      return "TLS_DH_anon_WITH_AES_256_GCM_SHA384";
+      return "DH-anon-AES256-GCM-SHA384";
     case 0x00A8:
-      return "TLS_PSK_WITH_AES_128_GCM_SHA256";
+      return "PSK-AES128-GCM-SHA256";
     case 0x00A9:
-      return "TLS_PSK_WITH_AES_256_GCM_SHA384";
+      return "PSK-AES256-GCM-SHA384";
     case 0x00AA:
-      return "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256";
+      return "DHE-PSK-AES128-GCM-SHA256";
     case 0x00AB:
-      return "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384";
+      return "DHE-PSK-AES256-GCM-SHA384";
     case 0x00AC:
-      return "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256";
+      return "RSA-PSK-AES128-GCM-SHA256";
     case 0x00AD:
-      return "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384";
+      return "RSA-PSK-AES256-GCM-SHA384";
     case 0x00AE:
-      return "TLS_PSK_WITH_AES_128_CBC_SHA256";
+      return "PSK-AES128-CBC-SHA256";
     case 0x00AF:
-      return "TLS_PSK_WITH_AES_256_CBC_SHA384";
+      return "PSK-AES256-CBC-SHA384";
     case 0x00B0:
-      return "TLS_PSK_WITH_NULL_SHA256";
+      return "PSK-NULL-SHA256";
     case 0x00B1:
-      return "TLS_PSK_WITH_NULL_SHA384";
+      return "PSK-NULL-SHA384";
     case 0x00B2:
-      return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256";
+      return "DHE-PSK-AES128-CBC-SHA256";
     case 0x00B3:
-      return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384";
+      return "DHE-PSK-AES256-CBC-SHA384";
     case 0x00B4:
-      return "TLS_DHE_PSK_WITH_NULL_SHA256";
+      return "DHE-PSK-NULL-SHA256";
     case 0x00B5:
-      return "TLS_DHE_PSK_WITH_NULL_SHA384";
+      return "DHE-PSK-NULL-SHA384";
     case 0x00B6:
-      return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256";
+      return "RSA-PSK-AES128-CBC-SHA256";
     case 0x00B7:
-      return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384";
+      return "RSA-PSK-AES256-CBC-SHA384";
     case 0x00B8:
-      return "TLS_RSA_PSK_WITH_NULL_SHA256";
+      return "RSA-PSK-NULL-SHA256";
     case 0x00B9:
-      return "TLS_RSA_PSK_WITH_NULL_SHA384";
+      return "RSA-PSK-NULL-SHA384";
     case 0x00BA:
-      return "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256";
+      return "RSA-CAMELLIA128-CBC-SHA256";
     case 0x00BB:
-      return "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256";
+      return "DH-DSS-CAMELLIA128-CBC-SHA256";
     case 0x00BC:
-      return "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256";
+      return "DH-RSA-CAMELLIA128-CBC-SHA256";
     case 0x00BD:
-      return "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256";
+      return "DHE-DSS-CAMELLIA128-CBC-SHA256";
     case 0x00BE:
-      return "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256";
+      return "DHE-RSA-CAMELLIA128-CBC-SHA256";
     case 0x00BF:
-      return "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256";
+      return "DH-anon-CAMELLIA128-CBC-SHA256";
     case 0x00C0:
-      return "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256";
+      return "RSA-CAMELLIA256-CBC-SHA256";
     case 0x00C1:
-      return "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256";
+      return "DH-DSS-CAMELLIA256-CBC-SHA256";
     case 0x00C2:
-      return "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256";
+      return "DH-RSA-CAMELLIA256-CBC-SHA256";
     case 0x00C3:
-      return "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256";
+      return "DHE-DSS-CAMELLIA256-CBC-SHA256";
     case 0x00C4:
-      return "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256";
+      return "DHE-RSA-CAMELLIA256-CBC-SHA256";
     case 0x00C5:
-      return "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256";
+      return "DH-anon-CAMELLIA256-CBC-SHA256";
     case 0x00C6:
-      return "TLS_SM4_GCM_SM3";
+      return "SM4-GCM-SM3";
     case 0x00C7:
-      return "TLS_SM4_CCM_SM3";
+      return "SM4-CCM-SM3";
     case 0x00FF:
-      return "TLS_EMPTY_RENEGOTIATION_INFO_SCSV";
+      return "EMPTY-RENEGOTIATION-INFO-SCSV";
     case 0x1301:
-      return "TLS_AES_128_GCM_SHA256";
+      return "AES128-GCM-SHA256";
     case 0x1302:
-      return "TLS_AES_256_GCM_SHA384";
+      return "AES256-GCM-SHA384";
     case 0x1303:
-      return "TLS_CHACHA20_POLY1305_SHA256";
+      return "CHACHA20-POLY1305-SHA256";
     case 0x1304:
-      return "TLS_AES_128_CCM_SHA256";
+      return "AES128-CCM-SHA256";
     case 0x1305:
-      return "TLS_AES_128_CCM_8_SHA256";
+      return "AES128-CCM8-SHA256";
     case 0x5600:
-      return "TLS_FALLBACK_SCSV";
+      return "FALLBACK-SCSV";
     case 0xC001:
-      return "TLS_ECDH_ECDSA_WITH_NULL_SHA";
+      return "ECDH-ECDSA-NULL-SHA";
     case 0xC002:
-      return "TLS_ECDH_ECDSA_WITH_RC4_128_SHA";
+      return "ECDH-ECDSA-RC4-128-SHA";
     case 0xC003:
-      return "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA";
+      return "ECDH-ECDSA-3DES-EDE-CBC-SHA";
     case 0xC004:
-      return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA";
+      return "ECDH-ECDSA-AES128-CBC-SHA";
     case 0xC005:
-      return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA";
+      return "ECDH-ECDSA-AES256-CBC-SHA";
     case 0xC006:
-      return "TLS_ECDHE_ECDSA_WITH_NULL_SHA";
+      return "ECDHE-ECDSA-NULL-SHA";
     case 0xC007:
-      return "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA";
+      return "ECDHE-ECDSA-RC4-128-SHA";
     case 0xC008:
-      return "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA";
+      return "ECDHE-ECDSA-3DES-EDE-CBC-SHA";
     case 0xC009:
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA";
+      return "ECDHE-ECDSA-AES128-CBC-SHA";
     case 0xC00A:
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA";
+      return "ECDHE-ECDSA-AES256-CBC-SHA";
     case 0xC00B:
-      return "TLS_ECDH_RSA_WITH_NULL_SHA";
+      return "ECDH-RSA-NULL-SHA";
     case 0xC00C:
-      return "TLS_ECDH_RSA_WITH_RC4_128_SHA";
+      return "ECDH-RSA-RC4-128-SHA";
     case 0xC00D:
-      return "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA";
+      return "ECDH-RSA-3DES-EDE-CBC-SHA";
     case 0xC00E:
-      return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA";
+      return "ECDH-RSA-AES128-CBC-SHA";
     case 0xC00F:
-      return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA";
+      return "ECDH-RSA-AES256-CBC-SHA";
     case 0xC010:
-      return "TLS_ECDHE_RSA_WITH_NULL_SHA";
+      return "ECDHE-RSA-NULL-SHA";
     case 0xC011:
-      return "TLS_ECDHE_RSA_WITH_RC4_128_SHA";
+      return "ECDHE-RSA-RC4-128-SHA";
     case 0xC012:
-      return "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA";
+      return "ECDHE-RSA-3DES-EDE-CBC-SHA";
     case 0xC013:
-      return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA";
+      return "ECDHE-RSA-AES128-CBC-SHA";
     case 0xC014:
-      return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA";
+      return "ECDHE-RSA-AES256-CBC-SHA";
     case 0xC015:
-      return "TLS_ECDH_anon_WITH_NULL_SHA";
+      return "ECDH-anon-NULL-SHA";
     case 0xC016:
-      return "TLS_ECDH_anon_WITH_RC4_128_SHA";
+      return "ECDH-anon-RC4-128-SHA";
     case 0xC017:
-      return "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
+      return "ECDH-anon-3DES-EDE-CBC-SHA";
     case 0xC018:
-      return "TLS_ECDH_anon_WITH_AES_128_CBC_SHA";
+      return "ECDH-anon-AES128-CBC-SHA";
     case 0xC019:
-      return "TLS_ECDH_anon_WITH_AES_256_CBC_SHA";
+      return "ECDH-anon-AES256-CBC-SHA";
     case 0xC01A:
-      return "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA";
+      return "SRP-SHA-3DES-EDE-CBC-SHA";
     case 0xC01B:
-      return "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA";
+      return "SRP-SHA-RSA-3DES-EDE-CBC-SHA";
     case 0xC01C:
-      return "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA";
+      return "SRP-SHA-DSS-3DES-EDE-CBC-SHA";
     case 0xC01D:
-      return "TLS_SRP_SHA_WITH_AES_128_CBC_SHA";
+      return "SRP-SHA-AES128-CBC-SHA";
     case 0xC01E:
-      return "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA";
+      return "SRP-SHA-RSA-AES128-CBC-SHA";
     case 0xC01F:
-      return "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA";
+      return "SRP-SHA-DSS-AES128-CBC-SHA";
     case 0xC020:
-      return "TLS_SRP_SHA_WITH_AES_256_CBC_SHA";
+      return "SRP-SHA-AES256-CBC-SHA";
     case 0xC021:
-      return "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA";
+      return "SRP-SHA-RSA-AES256-CBC-SHA";
     case 0xC022:
-      return "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA";
+      return "SRP-SHA-DSS-AES256-CBC-SHA";
     case 0xC023:
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256";
+      return "ECDHE-ECDSA-AES128-CBC-SHA256";
     case 0xC024:
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384";
+      return "ECDHE-ECDSA-AES256-CBC-SHA384";
     case 0xC025:
-      return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256";
+      return "ECDH-ECDSA-AES128-CBC-SHA256";
     case 0xC026:
-      return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384";
+      return "ECDH-ECDSA-AES256-CBC-SHA384";
     case 0xC027:
-      return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256";
+      return "ECDHE-RSA-AES128-CBC-SHA256";
     case 0xC028:
-      return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384";
+      return "ECDHE-RSA-AES256-CBC-SHA384";
     case 0xC029:
-      return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256";
+      return "ECDH-RSA-AES128-CBC-SHA256";
     case 0xC02A:
-      return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384";
+      return "ECDH-RSA-AES256-CBC-SHA384";
     case 0xC02B:
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
+      return "ECDHE-ECDSA-AES128-GCM-SHA256";
     case 0xC02C:
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384";
+      return "ECDHE-ECDSA-AES256-GCM-SHA384";
     case 0xC02D:
-      return "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256";
+      return "ECDH-ECDSA-AES128-GCM-SHA256";
     case 0xC02E:
-      return "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384";
+      return "ECDH-ECDSA-AES256-GCM-SHA384";
     case 0xC02F:
-      return "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
+      return "ECDHE-RSA-AES128-GCM-SHA256";
     case 0xC030:
-      return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
+      return "ECDHE-RSA-AES256-GCM-SHA384";
     case 0xC031:
-      return "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256";
+      return "ECDH-RSA-AES128-GCM-SHA256";
     case 0xC032:
-      return "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384";
+      return "ECDH-RSA-AES256-GCM-SHA384";
     case 0xC033:
-      return "TLS_ECDHE_PSK_WITH_RC4_128_SHA";
+      return "ECDHE-PSK-RC4-128-SHA";
     case 0xC034:
-      return "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA";
+      return "ECDHE-PSK-3DES-EDE-CBC-SHA";
     case 0xC035:
-      return "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA";
+      return "ECDHE-PSK-AES128-CBC-SHA";
     case 0xC036:
-      return "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA";
+      return "ECDHE-PSK-AES256-CBC-SHA";
     case 0xC037:
-      return "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256";
+      return "ECDHE-PSK-AES128-CBC-SHA256";
     case 0xC038:
-      return "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384";
+      return "ECDHE-PSK-AES256-CBC-SHA384";
     case 0xC039:
-      return "TLS_ECDHE_PSK_WITH_NULL_SHA";
+      return "ECDHE-PSK-NULL-SHA";
     case 0xC03A:
-      return "TLS_ECDHE_PSK_WITH_NULL_SHA256";
+      return "ECDHE-PSK-NULL-SHA256";
     case 0xC03B:
-      return "TLS_ECDHE_PSK_WITH_NULL_SHA384";
+      return "ECDHE-PSK-NULL-SHA384";
     case 0xC03C:
-      return "TLS_RSA_WITH_ARIA_128_CBC_SHA256";
+      return "RSA-ARIA128-CBC-SHA256";
     case 0xC03D:
-      return "TLS_RSA_WITH_ARIA_256_CBC_SHA384";
+      return "RSA-ARIA256-CBC-SHA384";
     case 0xC03E:
-      return "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256";
+      return "DH-DSS-ARIA128-CBC-SHA256";
     case 0xC03F:
-      return "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384";
+      return "DH-DSS-ARIA256-CBC-SHA384";
     case 0xC040:
-      return "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256";
+      return "DH-RSA-ARIA128-CBC-SHA256";
     case 0xC041:
-      return "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384";
+      return "DH-RSA-ARIA256-CBC-SHA384";
     case 0xC042:
-      return "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256";
+      return "DHE-DSS-ARIA128-CBC-SHA256";
     case 0xC043:
-      return "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384";
+      return "DHE-DSS-ARIA256-CBC-SHA384";
     case 0xC044:
-      return "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256";
+      return "DHE-RSA-ARIA128-CBC-SHA256";
     case 0xC045:
-      return "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384";
+      return "DHE-RSA-ARIA256-CBC-SHA384";
     case 0xC046:
-      return "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256";
+      return "DH-anon-ARIA128-CBC-SHA256";
     case 0xC047:
-      return "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384";
+      return "DH-anon-ARIA256-CBC-SHA384";
     case 0xC048:
-      return "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256";
+      return "ECDHE-ECDSA-ARIA128-CBC-SHA256";
     case 0xC049:
-      return "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384";
+      return "ECDHE-ECDSA-ARIA256-CBC-SHA384";
     case 0xC04A:
-      return "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256";
+      return "ECDH-ECDSA-ARIA128-CBC-SHA256";
     case 0xC04B:
-      return "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384";
+      return "ECDH-ECDSA-ARIA256-CBC-SHA384";
     case 0xC04C:
-      return "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256";
+      return "ECDHE-RSA-ARIA128-CBC-SHA256";
     case 0xC04D:
-      return "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384";
+      return "ECDHE-RSA-ARIA256-CBC-SHA384";
     case 0xC04E:
-      return "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256";
+      return "ECDH-RSA-ARIA128-CBC-SHA256";
     case 0xC04F:
-      return "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384";
+      return "ECDH-RSA-ARIA256-CBC-SHA384";
     case 0xC050:
-      return "TLS_RSA_WITH_ARIA_128_GCM_SHA256";
+      return "RSA-ARIA128-GCM-SHA256";
     case 0xC051:
-      return "TLS_RSA_WITH_ARIA_256_GCM_SHA384";
+      return "RSA-ARIA256-GCM-SHA384";
     case 0xC052:
-      return "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256";
+      return "DHE-RSA-ARIA128-GCM-SHA256";
     case 0xC053:
-      return "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384";
+      return "DHE-RSA-ARIA256-GCM-SHA384";
     case 0xC054:
-      return "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256";
+      return "DH-RSA-ARIA128-GCM-SHA256";
     case 0xC055:
-      return "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384";
+      return "DH-RSA-ARIA256-GCM-SHA384";
     case 0xC056:
-      return "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256";
+      return "DHE-DSS-ARIA128-GCM-SHA256";
     case 0xC057:
-      return "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384";
+      return "DHE-DSS-ARIA256-GCM-SHA384";
     case 0xC058:
-      return "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256";
+      return "DH-DSS-ARIA128-GCM-SHA256";
     case 0xC059:
-      return "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384";
+      return "DH-DSS-ARIA256-GCM-SHA384";
     case 0xC05A:
-      return "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256";
+      return "DH-anon-ARIA128-GCM-SHA256";
     case 0xC05B:
-      return "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384";
+      return "DH-anon-ARIA256-GCM-SHA384";
     case 0xC05C:
-      return "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256";
+      return "ECDHE-ECDSA-ARIA128-GCM-SHA256";
     case 0xC05D:
-      return "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384";
+      return "ECDHE-ECDSA-ARIA256-GCM-SHA384";
     case 0xC05E:
-      return "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256";
+      return "ECDH-ECDSA-ARIA128-GCM-SHA256";
     case 0xC05F:
-      return "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384";
+      return "ECDH-ECDSA-ARIA256-GCM-SHA384";
     case 0xC060:
-      return "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256";
+      return "ECDHE-RSA-ARIA128-GCM-SHA256";
     case 0xC061:
-      return "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384";
+      return "ECDHE-RSA-ARIA256-GCM-SHA384";
     case 0xC062:
-      return "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256";
+      return "ECDH-RSA-ARIA128-GCM-SHA256";
     case 0xC063:
-      return "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384";
+      return "ECDH-RSA-ARIA256-GCM-SHA384";
     case 0xC064:
-      return "TLS_PSK_WITH_ARIA_128_CBC_SHA256";
+      return "PSK-ARIA128-CBC-SHA256";
     case 0xC065:
-      return "TLS_PSK_WITH_ARIA_256_CBC_SHA384";
+      return "PSK-ARIA256-CBC-SHA384";
     case 0xC066:
-      return "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256";
+      return "DHE-PSK-ARIA128-CBC-SHA256";
     case 0xC067:
-      return "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384";
+      return "DHE-PSK-ARIA256-CBC-SHA384";
     case 0xC068:
-      return "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256";
+      return "RSA-PSK-ARIA128-CBC-SHA256";
     case 0xC069:
-      return "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384";
+      return "RSA-PSK-ARIA256-CBC-SHA384";
     case 0xC06A:
-      return "TLS_PSK_WITH_ARIA_128_GCM_SHA256";
+      return "PSK-ARIA128-GCM-SHA256";
     case 0xC06B:
-      return "TLS_PSK_WITH_ARIA_256_GCM_SHA384";
+      return "PSK-ARIA256-GCM-SHA384";
     case 0xC06C:
-      return "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256";
+      return "DHE-PSK-ARIA128-GCM-SHA256";
     case 0xC06D:
-      return "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384";
+      return "DHE-PSK-ARIA256-GCM-SHA384";
     case 0xC06E:
-      return "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256";
+      return "RSA-PSK-ARIA128-GCM-SHA256";
     case 0xC06F:
-      return "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384";
+      return "RSA-PSK-ARIA256-GCM-SHA384";
     case 0xC070:
-      return "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256";
+      return "ECDHE-PSK-ARIA128-CBC-SHA256";
     case 0xC071:
-      return "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384";
+      return "ECDHE-PSK-ARIA256-CBC-SHA384";
     case 0xC072:
-      return "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256";
+      return "ECDHE-ECDSA-CAMELLIA128-CBC-SHA256";
     case 0xC073:
-      return "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384";
+      return "ECDHE-ECDSA-CAMELLIA256-CBC-SHA384";
     case 0xC074:
-      return "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256";
+      return "ECDH-ECDSA-CAMELLIA128-CBC-SHA256";
     case 0xC075:
-      return "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384";
+      return "ECDH-ECDSA-CAMELLIA256-CBC-SHA384";
     case 0xC076:
-      return "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256";
+      return "ECDHE-RSA-CAMELLIA128-CBC-SHA256";
     case 0xC077:
-      return "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384";
+      return "ECDHE-RSA-CAMELLIA256-CBC-SHA384";
     case 0xC078:
-      return "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256";
+      return "ECDH-RSA-CAMELLIA128-CBC-SHA256";
     case 0xC079:
-      return "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384";
+      return "ECDH-RSA-CAMELLIA256-CBC-SHA384";
     case 0xC07A:
-      return "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256";
+      return "RSA-CAMELLIA128-GCM-SHA256";
     case 0xC07B:
-      return "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384";
+      return "RSA-CAMELLIA256-GCM-SHA384";
     case 0xC07C:
-      return "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256";
+      return "DHE-RSA-CAMELLIA128-GCM-SHA256";
     case 0xC07D:
-      return "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384";
+      return "DHE-RSA-CAMELLIA256-GCM-SHA384";
     case 0xC07E:
-      return "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256";
+      return "DH-RSA-CAMELLIA128-GCM-SHA256";
     case 0xC07F:
-      return "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384";
+      return "DH-RSA-CAMELLIA256-GCM-SHA384";
     case 0xC080:
-      return "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256";
+      return "DHE-DSS-CAMELLIA128-GCM-SHA256";
     case 0xC081:
-      return "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384";
+      return "DHE-DSS-CAMELLIA256-GCM-SHA384";
     case 0xC082:
-      return "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256";
+      return "DH-DSS-CAMELLIA128-GCM-SHA256";
     case 0xC083:
-      return "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384";
+      return "DH-DSS-CAMELLIA256-GCM-SHA384";
     case 0xC084:
-      return "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256";
+      return "DH-anon-CAMELLIA128-GCM-SHA256";
     case 0xC085:
-      return "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384";
+      return "DH-anon-CAMELLIA256-GCM-SHA384";
     case 0xC086:
-      return "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256";
+      return "ECDHE-ECDSA-CAMELLIA128-GCM-SHA256";
     case 0xC087:
-      return "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384";
+      return "ECDHE-ECDSA-CAMELLIA256-GCM-SHA384";
     case 0xC088:
-      return "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256";
+      return "ECDH-ECDSA-CAMELLIA128-GCM-SHA256";
     case 0xC089:
-      return "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384";
+      return "ECDH-ECDSA-CAMELLIA256-GCM-SHA384";
     case 0xC08A:
-      return "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256";
+      return "ECDHE-RSA-CAMELLIA128-GCM-SHA256";
     case 0xC08B:
-      return "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384";
+      return "ECDHE-RSA-CAMELLIA256-GCM-SHA384";
     case 0xC08C:
-      return "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256";
+      return "ECDH-RSA-CAMELLIA128-GCM-SHA256";
     case 0xC08D:
-      return "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384";
+      return "ECDH-RSA-CAMELLIA256-GCM-SHA384";
     case 0xC08E:
-      return "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256";
+      return "PSK-CAMELLIA128-GCM-SHA256";
     case 0xC08F:
-      return "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384";
+      return "PSK-CAMELLIA256-GCM-SHA384";
     case 0xC090:
-      return "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256";
+      return "DHE-PSK-CAMELLIA128-GCM-SHA256";
     case 0xC091:
-      return "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384";
+      return "DHE-PSK-CAMELLIA256-GCM-SHA384";
     case 0xC092:
-      return "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256";
+      return "RSA-PSK-CAMELLIA128-GCM-SHA256";
     case 0xC093:
-      return "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384";
+      return "RSA-PSK-CAMELLIA256-GCM-SHA384";
     case 0xC094:
-      return "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256";
+      return "PSK-CAMELLIA128-CBC-SHA256";
     case 0xC095:
-      return "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384";
+      return "PSK-CAMELLIA256-CBC-SHA384";
     case 0xC096:
-      return "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256";
+      return "DHE-PSK-CAMELLIA128-CBC-SHA256";
     case 0xC097:
-      return "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384";
+      return "DHE-PSK-CAMELLIA256-CBC-SHA384";
     case 0xC098:
-      return "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256";
+      return "RSA-PSK-CAMELLIA128-CBC-SHA256";
     case 0xC099:
-      return "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384";
+      return "RSA-PSK-CAMELLIA256-CBC-SHA384";
     case 0xC09A:
-      return "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256";
+      return "ECDHE-PSK-CAMELLIA128-CBC-SHA256";
     case 0xC09B:
-      return "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384";
+      return "ECDHE-PSK-CAMELLIA256-CBC-SHA384";
     case 0xC09C:
-      return "TLS_RSA_WITH_AES_128_CCM";
+      return "RSA-AES128-CCM";
     case 0xC09D:
-      return "TLS_RSA_WITH_AES_256_CCM";
+      return "RSA-AES256-CCM";
     case 0xC09E:
-      return "TLS_DHE_RSA_WITH_AES_128_CCM";
+      return "DHE-RSA-AES128-CCM";
     case 0xC09F:
-      return "TLS_DHE_RSA_WITH_AES_256_CCM";
+      return "DHE-RSA-AES256-CCM";
     case 0xC0A0:
-      return "TLS_RSA_WITH_AES_128_CCM_8";
+      return "RSA-AES128-CCM8";
     case 0xC0A1:
-      return "TLS_RSA_WITH_AES_256_CCM_8";
+      return "RSA-AES256-CCM8";
     case 0xC0A2:
-      return "TLS_DHE_RSA_WITH_AES_128_CCM_8";
+      return "DHE-RSA-AES128-CCM8";
     case 0xC0A3:
-      return "TLS_DHE_RSA_WITH_AES_256_CCM_8";
+      return "DHE-RSA-AES256-CCM8";
     case 0xC0A4:
-      return "TLS_PSK_WITH_AES_128_CCM";
+      return "PSK-AES128-CCM";
     case 0xC0A5:
-      return "TLS_PSK_WITH_AES_256_CCM";
+      return "PSK-AES256-CCM";
     case 0xC0A6:
-      return "TLS_DHE_PSK_WITH_AES_128_CCM";
+      return "DHE-PSK-AES128-CCM";
     case 0xC0A7:
-      return "TLS_DHE_PSK_WITH_AES_256_CCM";
+      return "DHE-PSK-AES256-CCM";
     case 0xC0A8:
-      return "TLS_PSK_WITH_AES_128_CCM_8";
+      return "PSK-AES128-CCM8";
     case 0xC0A9:
-      return "TLS_PSK_WITH_AES_256_CCM_8";
+      return "PSK-AES256-CCM8";
     case 0xC0AA:
-      return "TLS_PSK_DHE_WITH_AES_128_CCM_8";
+      return "PSK-DHE-AES128-CCM8";
     case 0xC0AB:
-      return "TLS_PSK_DHE_WITH_AES_256_CCM_8";
+      return "PSK-DHE-AES256-CCM8";
     case 0xC0AC:
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_CCM";
+      return "ECDHE-ECDSA-AES128-CCM";
     case 0xC0AD:
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_CCM";
+      return "ECDHE-ECDSA-AES256-CCM";
     case 0xC0AE:
-      return "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8";
+      return "ECDHE-ECDSA-AES128-CCM8";
     case 0xC0AF:
-      return "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8";
+      return "ECDHE-ECDSA-AES256-CCM8";
     case 0xC0B0:
-      return "TLS_ECCPWD_WITH_AES_128_GCM_SHA256";
+      return "ECCPWD-AES128-GCM-SHA256";
     case 0xC0B1:
-      return "TLS_ECCPWD_WITH_AES_256_GCM_SHA384";
+      return "ECCPWD-AES256-GCM-SHA384";
     case 0xC0B2:
-      return "TLS_ECCPWD_WITH_AES_128_CCM_SHA256";
+      return "ECCPWD-AES128-CCM-SHA256";
     case 0xC0B3:
-      return "TLS_ECCPWD_WITH_AES_256_CCM_SHA384";
+      return "ECCPWD-AES256-CCM-SHA384";
     case 0xC0B4:
-      return "TLS_SHA256_SHA256";
+      return "SHA256-SHA256";
     case 0xC0B5:
-      return "TLS_SHA384_SHA384";
+      return "SHA384-SHA384";
     case 0xC100:
-      return "TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC";
+      return "GOSTR341112-256-KUZNYECHIK-CTR-OMAC";
     case 0xC101:
-      return "TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC";
+      return "GOSTR341112-256-MAGMA-CTR-OMAC";
     case 0xC102:
-      return "TLS_GOSTR341112_256_WITH_28147_CNT_IMIT";
+      return "GOSTR341112-256-28147-CNT-IMIT";
     case 0xC103:
-      return "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L";
+      return "GOSTR341112-256-KUZNYECHIK-MGM-L";
     case 0xC104:
-      return "TLS_GOSTR341112_256_WITH_MAGMA_MGM_L";
+      return "GOSTR341112-256-MAGMA-MGM-L";
     case 0xC105:
-      return "TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S";
+      return "GOSTR341112-256-KUZNYECHIK-MGM-S";
     case 0xC106:
-      return "TLS_GOSTR341112_256_WITH_MAGMA_MGM_S";
+      return "GOSTR341112-256-MAGMA-MGM-S";
     case 0xCCA8:
-      return "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256";
+      return "ECDHE-RSA-CHACHA20-POLY1305-SHA256";
     case 0xCCA9:
-      return "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256";
+      return "ECDHE-ECDSA-CHACHA20-POLY1305-SHA256";
     case 0xCCAA:
-      return "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256";
+      return "DHE-RSA-CHACHA20-POLY1305-SHA256";
     case 0xCCAB:
-      return "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256";
+      return "PSK-CHACHA20-POLY1305-SHA256";
     case 0xCCAC:
-      return "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256";
+      return "ECDHE-PSK-CHACHA20-POLY1305-SHA256";
     case 0xCCAD:
-      return "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256";
+      return "DHE-PSK-CHACHA20-POLY1305-SHA256";
     case 0xCCAE:
-      return "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256";
+      return "RSA-PSK-CHACHA20-POLY1305-SHA256";
     case 0xD001:
-      return "TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256";
+      return "ECDHE-PSK-AES128-GCM-SHA256";
     case 0xD002:
-      return "TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384";
+      return "ECDHE-PSK-AES256-GCM-SHA384";
     case 0xD003:
-      return "TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256";
+      return "ECDHE-PSK-AES128-CCM8-SHA256";
     case 0xD005:
-      return "TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256";
+      return "ECDHE-PSK-AES128-CCM-SHA256";
     case 0x0A0A:
     case 0x1A1A:
     case 0x2A2A:
@@ -735,17 +741,17 @@ const char *GetCipherSuiteName(uint16_t x) {
     case 0xDADA:
     case 0xEAEA:
     case 0xFAFA:
-      return "GREASE_RFC8701";
+      return "GREASE-RFC8701";
     case 0x0047 ... 0x004F:
     case 0x0050 ... 0x0058:
     case 0x0059 ... 0x005C:
     case 0x0060 ... 0x0066:
     case 0xFEFE ... 0xFEFF:
-      return "RESERVED_NO_CONFLICT";
+      return "RESERVED-NO-CONFLICT";
     case 0x001C ... 0x001D:
-      return "RESERVED_SSLV3_RFC5246";
+      return "RESERVED-SSLV3-RFC5246";
     case 0xFF00 ... 0xFFFF:
-      return "PRIVATE_USE_RFC8446";
+      return "PRIVATE-USE-RFC8446";
     default:
       return "UNASSIGNED";
   }
diff --git a/third_party/mbedtls/iana.h b/third_party/mbedtls/iana.h
index dc1e7e8cb..072e1c207 100644
--- a/third_party/mbedtls/iana.h
+++ b/third_party/mbedtls/iana.h
@@ -1,11 +1,13 @@
 #ifndef COSMOPOLITAN_THIRD_PARTY_MBEDTLS_IANA_H_
 #define COSMOPOLITAN_THIRD_PARTY_MBEDTLS_IANA_H_
+#include "third_party/mbedtls/ssl.h"
 #if !(__ASSEMBLER__ + __LINKER__ + 0)
 COSMOPOLITAN_C_START_
 
 bool IsCipherSuiteGood(uint16_t);
 const char *GetCipherSuiteName(uint16_t);
 const char *GetAlertDescription(unsigned char);
+nodiscard char *FormatSslClientCiphers(const mbedtls_ssl_context *);
 
 COSMOPOLITAN_C_END_
 #endif /* !(__ASSEMBLER__ + __LINKER__ + 0) */
diff --git a/third_party/mbedtls/ssl.h b/third_party/mbedtls/ssl.h
index eb632fb14..b194af584 100644
--- a/third_party/mbedtls/ssl.h
+++ b/third_party/mbedtls/ssl.h
@@ -1250,6 +1250,7 @@ struct mbedtls_ssl_context
                             *   Possible values are #MBEDTLS_SSL_CID_ENABLED
                             *   and #MBEDTLS_SSL_CID_DISABLED. */
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
+  uint16_t client_ciphers[16]; /* [jart] clarifies MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE */
 };
 
 /**
diff --git a/third_party/mbedtls/ssl_srv.c b/third_party/mbedtls/ssl_srv.c
index b71431ca8..78012e153 100644
--- a/third_party/mbedtls/ssl_srv.c
+++ b/third_party/mbedtls/ssl_srv.c
@@ -16,6 +16,8 @@
 │ limitations under the License.                                               │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/log/log.h"
+#include "libc/macros.internal.h"
+#include "libc/str/str.h"
 #include "third_party/mbedtls/common.h"
 #include "third_party/mbedtls/debug.h"
 #include "third_party/mbedtls/ecp.h"
@@ -1159,9 +1161,9 @@ static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
 #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
 static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
 {
-    int ret, got_common_suite;
-    unsigned int i, j;
     size_t n;
+    unsigned int i, j;
+    int ret, got_common_suite;
     unsigned int ciph_len, sess_len, chal_len;
     unsigned char *buf, *p;
     const uint16_t *ciphersuites;
@@ -1357,6 +1359,13 @@ static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
     got_common_suite = 0;
     ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
     ciphersuite_info = NULL;
+
+    /* [jart] grab some client ciphers for error messages */
+    bzero(ssl->client_ciphers, sizeof(ssl->client_ciphers));
+    for( i = j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
+        if( !p[0] && i < ARRAYLEN( ssl->client_ciphers ) )
+            ssl->client_ciphers[i++] = p[1] << 8 | p[2];
+
 #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
     for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
         for( i = 0; ciphersuites[i] != 0; i++ )
@@ -1365,9 +1374,7 @@ static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
         for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
 #endif
         {
-            if( p[0] != 0 ||
-                p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
-                p[2] != ( ( ciphersuites[i]      ) & 0xFF ) )
+            if( p[0] || (p[1] << 8 | p[2]) != ciphersuites[i] )
                 continue;
 
             got_common_suite = 1;
@@ -2198,6 +2205,12 @@ read_record_header:
         return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
     }
 
+    /* [jart] grab some client ciphers for error messages */
+    bzero(ssl->client_ciphers, sizeof(ssl->client_ciphers));
+    for( i = j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
+        if( i < ARRAYLEN( ssl->client_ciphers ) )
+            ssl->client_ciphers[i++] = p[0] << 8 | p[1];
+
     /*
      * Search for a matching ciphersuite
      * (At the end because we need information from the EC-based extensions
diff --git a/third_party/python/Modules/tlsmodule.c b/third_party/python/Modules/tlsmodule.c
index b1aa81821..2d4d21399 100644
--- a/third_party/python/Modules/tlsmodule.c
+++ b/third_party/python/Modules/tlsmodule.c
@@ -62,7 +62,6 @@ struct Tls {
 
 static PyObject *TlsError;
 static PyTypeObject tls_type;
-static mbedtls_x509_crt *roots;
 
 static PyObject *
 SetTlsError(int rc)
@@ -130,7 +129,7 @@ tls_new(int fd, const char *host, PyObject *todo)
                                     MBEDTLS_SSL_TRANSPORT_STREAM,
                                     MBEDTLS_SSL_PRESET_DEFAULT);
         mbedtls_ssl_conf_rng(&self->conf, mbedtls_ctr_drbg_random, &self->rng);
-        mbedtls_ssl_conf_ca_chain(&self->conf, roots, 0);
+        mbedtls_ssl_conf_ca_chain(&self->conf, GetSslRoots(), 0);
         /* mbedtls_ssl_conf_dbg(&self->conf, TlsDebug, 0); */
         /* mbedtls_debug_threshold = 5; */
         if (host && *host) {
@@ -493,7 +492,6 @@ PyInit_tls(void)
     TlsError = PyErr_NewException("tls.TlsError", NULL, NULL);
     Py_INCREF(TlsError);
     PyModule_AddObject(m, "TlsError", TlsError);
-    roots = GetSslRoots();
     return m;
 }
 
diff --git a/tool/build/blinkenlights.c b/tool/build/blinkenlights.c
index 6c4d92d30..4f261d35c 100644
--- a/tool/build/blinkenlights.c
+++ b/tool/build/blinkenlights.c
@@ -41,6 +41,7 @@
 #include "libc/limits.h"
 #include "libc/log/check.h"
 #include "libc/log/color.internal.h"
+#include "libc/log/internal.h"
 #include "libc/log/log.h"
 #include "libc/macros.internal.h"
 #include "libc/math.h"
@@ -3114,7 +3115,7 @@ int main(int argc, char *argv[]) {
   speed = 32;
   SetXmmSize(2);
   SetXmmDisp(kXmmHex);
-  if ((colorize = cancolor())) {
+  if ((colorize = !__nocolor)) {
     g_high.keyword = 155;
     g_high.reg = 215;
     g_high.literal = 182;
diff --git a/tool/build/calculator.c b/tool/build/calculator.c
index 6c6a5843b..dbda58008 100644
--- a/tool/build/calculator.c
+++ b/tool/build/calculator.c
@@ -20,6 +20,7 @@
 #include "libc/fmt/itoa.h"
 #include "libc/limits.h"
 #include "libc/log/color.internal.h"
+#include "libc/log/internal.h"
 #include "libc/log/log.h"
 #include "libc/macros.internal.h"
 #include "libc/math.h"
@@ -680,8 +681,8 @@ void CleanupTerminal(void) {
 }
 
 void StartInteractive(void) {
-  if (!interactive && !IsTerminalInarticulate() && isatty(fileno(stdin)) &&
-      isatty(fileno(stdout)) && cancolor()) {
+  if (!interactive && !__nocolor && isatty(fileno(stdin)) &&
+      isatty(fileno(stdout)) && !__nocolor) {
     interactive = true;
   }
   if (interactive) {
diff --git a/tool/build/compile.c b/tool/build/compile.c
index e2522a2b5..d6fb9af26 100644
--- a/tool/build/compile.c
+++ b/tool/build/compile.c
@@ -141,7 +141,6 @@ bool wantfentry;
 bool wantrecord;
 bool fulloutput;
 bool touchtarget;
-bool inarticulate;
 bool wantnoredzone;
 bool stdoutmustclose;
 bool no_sanitize_null;
@@ -198,7 +197,7 @@ const char *const kSafeEnv[] = {
     "PATH",       // needed by clang
     "PWD",        // just seems plain needed
     "STRACE",     // useful for troubleshooting
-    "TERM",       // needed by IsTerminalInarticulate
+    "TERM",       // needed to detect colors
     "TMPDIR",     // needed by compiler
 };
 
@@ -268,19 +267,19 @@ void OnChld(int sig, siginfo_t *si, ucontext_t *ctx) {
 }
 
 void PrintBold(void) {
-  if (!inarticulate) {
+  if (!__nocolor) {
     appends(&output, "\e[1m");
   }
 }
 
 void PrintRed(void) {
-  if (!inarticulate) {
+  if (!__nocolor) {
     appends(&output, "\e[91;1m");
   }
 }
 
 void PrintReset(void) {
-  if (!inarticulate) {
+  if (!__nocolor) {
     appends(&output, "\e[0m");
   }
 }
@@ -806,11 +805,6 @@ int main(int argc, char *argv[]) {
     ispkg = true;
   }
 
-  /*
-   * get information about stdout
-   */
-  inarticulate = IsTerminalInarticulate();
-
   /*
    * ingest arguments
    */
@@ -942,7 +936,7 @@ int main(int argc, char *argv[]) {
       AddArg("-Wno-incompatible-pointer-types-discards-qualifiers");
     }
     AddArg("-no-canonical-prefixes");
-    if (!inarticulate) {
+    if (!__nocolor) {
       AddArg(firstnonnull(colorflag, "-fdiagnostics-color=always"));
     }
     if (wantpg && !wantnopg) {
@@ -1181,7 +1175,7 @@ int main(int argc, char *argv[]) {
     if (fulloutput) {
       ReportResources();
     }
-    if (!inarticulate && ischardev(2)) {
+    if (!__nocolor && ischardev(2)) {
       /* clear line forward */
       appendw(&output, READ32LE("\e[K"));
     }
diff --git a/tool/net/demo/fetch.lua b/tool/net/demo/fetch.lua
index 6ab0f6fae..7833ab3e8 100644
--- a/tool/net/demo/fetch.lua
+++ b/tool/net/demo/fetch.lua
@@ -23,8 +23,11 @@ local function WriteForm(url)
        p {
          word-break: break-word;
        }
-       p span {
-         display: block;
+       dd {
+         margin-top: 1em;
+         margin-bottom: 1em;
+       }
+       .hdr {
          text-indent: -1em;
          padding-left: 1em;
        }
@@ -53,13 +56,13 @@ local function main()
       Write('<dt>Status\r\n')
       Write(string.format('<dd><p>%d %s\r\n', status, GetHttpReason(status)))
       Write('<dt>Headers\r\n')
-      Write('<dd><p>\r\n')
+      Write('<dd>\r\n')
       for k,v in pairs(headers) do
-         Write('<span><strong>')
+         Write('<div class="hdr"><strong>')
          Write(EscapeHtml(k))
          Write('</strong>: ')
          Write(EscapeHtml(v))
-         Write('</span>\r\n')
+         Write('</div>\r\n')
       end
       Write('<dt>Payload\r\n')
       Write('<dd><pre>')
diff --git a/tool/net/redbean.c b/tool/net/redbean.c
index aa4392ea9..5398e7702 100644
--- a/tool/net/redbean.c
+++ b/tool/net/redbean.c
@@ -28,6 +28,7 @@
 #include "libc/calls/struct/rusage.h"
 #include "libc/calls/struct/sigaction.h"
 #include "libc/calls/struct/stat.h"
+#include "libc/dce.h"
 #include "libc/dns/dns.h"
 #include "libc/dns/hoststxt.h"
 #include "libc/dos.h"
@@ -85,6 +86,7 @@
 #include "libc/sysv/consts/sol.h"
 #include "libc/sysv/consts/tcp.h"
 #include "libc/sysv/consts/w.h"
+#include "libc/testlib/testlib.h"
 #include "libc/time/time.h"
 #include "libc/x/x.h"
 #include "libc/zip.h"
@@ -164,6 +166,15 @@ STATIC_STACK_SIZE(0x40000);
 #define HeaderEqualCase(H, S) \
   SlicesEqualCase(S, strlen(S), HeaderData(H), HeaderLength(H))
 
+#define AssertLuaStackIsEmpty(L)                  \
+  do {                                            \
+    if (lua_gettop(L)) {                          \
+      char *s = LuaFormatStack(L);                \
+      WARNF("lua stack should be empty!\n%s", s); \
+      free(s);                                    \
+    }                                             \
+  } while (0)
+
 static const uint8_t kGzipHeader[] = {
     0x1F,        // MAGNUM
     0x8B,        // MAGNUM
@@ -379,9 +390,9 @@ static int messageshandled;
 static int sslticketlifetime;
 static uint32_t clientaddrsize;
 
-static lua_State *GL;
 static size_t zsize;
 static char *outbuf;
+static lua_State *GL;
 static char *content;
 static uint8_t *zmap;
 static uint8_t *zbase;
@@ -406,11 +417,11 @@ static int64_t cacheseconds;
 static const char *serverheader;
 static struct Strings stagedirs;
 static struct Strings hidepaths;
-static mbedtls_x509_crt *cachain;
 static const char *launchbrowser;
 static const char *referrerpolicy;
 static ssize_t (*generator)(struct iovec[3]);
 
+static struct Buffer inbuf_actual;
 static struct Buffer inbuf;
 static struct Buffer oldin;
 static struct Buffer hdrbuf;
@@ -443,6 +454,7 @@ static struct TlsBio g_bio;
 static char slashpath[PATH_MAX];
 static struct DeflateGenerator dg;
 
+static wontreturn void ExitWorker(void);
 static char *Route(const char *, size_t, const char *, size_t);
 static char *RouteHost(const char *, size_t, const char *, size_t);
 static char *RoutePath(const char *, size_t);
@@ -485,6 +497,11 @@ static void OnHup(void) {
   }
 }
 
+static void Free(void *p) {
+  free(*(void **)p);
+  *(void **)p = 0;
+}
+
 static long ParseInt(const char *s) {
   return strtol(s, 0, 0);
 }
@@ -605,7 +622,8 @@ static void InternCertificate(mbedtls_x509_crt *cert, mbedtls_x509_crt *prev) {
     }
   }
   if (mbedtls_x509_time_is_past(&cert->valid_to)) {
-    WARNF("(ssl) certificate %`'s is expired", gc(FormatX509Name(&cert->subject)));
+    WARNF("(ssl) certificate %`'s is expired",
+          gc(FormatX509Name(&cert->subject)));
   } else if (mbedtls_x509_time_is_future(&cert->valid_from)) {
     WARNF("(ssl) certificate %`'s is from the future",
           gc(FormatX509Name(&cert->subject)));
@@ -823,11 +841,9 @@ static inline void GetRemoteAddr(uint32_t *ip, uint16_t *port) {
   if (HasHeader(kHttpXForwardedFor) &&
       (IsPrivateIp(*ip) || IsLoopbackIp(*ip))) {
     if (ParseForwarded(HeaderData(kHttpXForwardedFor),
-                       HeaderLength(kHttpXForwardedFor),
-                       ip, port) == -1)
+                       HeaderLength(kHttpXForwardedFor), ip, port) == -1)
       WARNF("invalid X-Forwarded-For value: %`'.*s",
-            HeaderLength(kHttpXForwardedFor),
-            HeaderData(kHttpXForwardedFor));
+            HeaderLength(kHttpXForwardedFor), HeaderData(kHttpXForwardedFor));
   }
 }
 
@@ -1006,25 +1022,59 @@ static void Daemonize(void) {
   ChangeUser();
 }
 
-static int LuaCallWithTrace(lua_State *L, int nargs, int nres) {
+static nodiscard char *LuaFormatStack(lua_State *L) {
+  int i, top;
+  char *b = 0;
+  top = lua_gettop(L);
+  for (i = 1; i <= top; i++) {
+    if (i > 1) appendw(&b, '\n');
+    appendf(&b, "\t%d\t%s\t", i, luaL_typename(L, i));
+    switch (lua_type(L, i)) {
+      case LUA_TNUMBER:
+        appendf(&b, "%g", lua_tonumber(L, i));
+        break;
+      case LUA_TSTRING:
+        appends(&b, lua_tostring(L, i));
+        break;
+      case LUA_TBOOLEAN:
+        appends(&b, lua_toboolean(L, i) ? "true" : "false");
+        break;
+      case LUA_TNIL:
+        appends(&b, "nil");
+        break;
+      default:
+        appendf(&b, "%p", lua_topointer(L, i));
+        break;
+    }
+  }
+  return b;
+}
+
+// calling convention for lua stack of L is:
+//   -3 is lua_newthread() called by caller
+//   -2 is function
+//   -1 is is argument (assuming nargs == 1)
+// L will have this after the call
+//   -2 is lua_newthread() called by caller
+//   -1 is result (assuming nres == 1)
+// @param L is main Lua interpreter
+// @param C should be the result of lua_newthread()
+// @note this needs to be reentrant
+static int LuaCallWithTrace(lua_State *L, lua_State *C, int nargs, int nres) {
   int nresults, status;
-  // create a coroutine to retrieve traceback on failure
-  lua_State *co = lua_newthread(L);
-  // pop the coroutine, so that the function is at the top
-  lua_pop(L, 1);
   // move the function (and arguments) to the top of the coro stack
-  lua_xmove(L, co, nargs + 1);
+  lua_xmove(L, C, 1 + nargs);
   // resume the coroutine thus executing the function
-  status = lua_resume(co, L, nargs, &nresults);
+  status = lua_resume(C, L, nargs, &nresults);
   if (status != LUA_OK && status != LUA_YIELD) {
     // move the error message
-    lua_xmove(co, L, 1);
+    lua_xmove(C, L, 1);
     // replace the error with the traceback on failure
-    luaL_traceback(L, co, lua_tostring(L, -1), 0);
+    luaL_traceback(L, C, lua_tostring(L, -1), 0);
     lua_remove(L, -2);  // remove the error message
   } else {
     // move results to the main stack
-    lua_xmove(co, L, nresults);
+    lua_xmove(C, L, nresults);
     // make sure the stack has enough space to grow
     luaL_checkstack(L, nres - nresults, NULL);
     // grow the stack in case returned fewer results
@@ -1036,21 +1086,21 @@ static int LuaCallWithTrace(lua_State *L, int nargs, int nres) {
   return status;
 }
 
-/* TODO(paul): Regression with /redbean.lua */
-#define LuaCallWithTrace(L, N, Z) lua_pcall(L, N, Z, 0)
-
 static void LogLuaError(char *hook, char *err) {
   ERRORF("(lua) failed to run %s: %s", hook, err);
 }
 
 static bool LuaRunCode(const char *code) {
   lua_State *L = GL;
+  lua_State *C = lua_newthread(L);
   int status = luaL_loadstring(L, code);
-  if (status != LUA_OK || LuaCallWithTrace(L, 0, 0) != LUA_OK) {
+  if (status != LUA_OK || LuaCallWithTrace(L, C, 0, 0) != LUA_OK) {
     LogLuaError("lua code", lua_tostring(L, -1));
-    lua_pop(L, 1);
+    lua_pop(L, 2);  // pop error and thread
     return false;
   }
+  lua_pop(L, 1);  // pop thread
+  AssertLuaStackIsEmpty(L);
   return true;
 }
 
@@ -1059,6 +1109,7 @@ static bool LuaOnClientConnection(void) {
   uint32_t ip, serverip;
   uint16_t port, serverport;
   lua_State *L = GL;
+  lua_State *C = lua_newthread(L);
   lua_getglobal(L, "OnClientConnection");
   GetClientAddr(&ip, &port);
   GetServerAddr(&serverip, &serverport);
@@ -1066,13 +1117,15 @@ static bool LuaOnClientConnection(void) {
   lua_pushinteger(L, port);
   lua_pushinteger(L, serverip);
   lua_pushinteger(L, serverport);
-  if (LuaCallWithTrace(L, 4, 1) == LUA_OK) {
+  if (LuaCallWithTrace(L, C, 4, 1) == LUA_OK) {
     dropit = lua_toboolean(L, -1);
   } else {
     LogLuaError("OnClientConnection", lua_tostring(L, -1));
+    lua_pop(L, 1);  // pop error
     dropit = false;
   }
-  lua_pop(L, 1);
+  lua_pop(L, 1);  // pop thread
+  AssertLuaStackIsEmpty(L);
   return dropit;
 }
 
@@ -1080,6 +1133,7 @@ static void LuaOnProcessCreate(int pid) {
   uint32_t ip, serverip;
   uint16_t port, serverport;
   lua_State *L = GL;
+  lua_State *C = lua_newthread(L);
   lua_getglobal(L, "OnProcessCreate");
   GetClientAddr(&ip, &port);
   GetServerAddr(&serverip, &serverport);
@@ -1088,20 +1142,25 @@ static void LuaOnProcessCreate(int pid) {
   lua_pushinteger(L, port);
   lua_pushinteger(L, serverip);
   lua_pushinteger(L, serverport);
-  if (LuaCallWithTrace(L, 5, 0) != LUA_OK) {
+  if (LuaCallWithTrace(L, C, 5, 0) != LUA_OK) {
     LogLuaError("OnProcessCreate", lua_tostring(L, -1));
-    lua_pop(L, 1);
+    lua_pop(L, 1);  // pop error
   }
+  lua_pop(L, 1);  // pop thread
+  AssertLuaStackIsEmpty(L);
 }
 
 static void LuaOnProcessDestroy(int pid) {
   lua_State *L = GL;
+  lua_State *C = lua_newthread(L);
   lua_getglobal(L, "OnProcessDestroy");
   lua_pushinteger(L, pid);
-  if (LuaCallWithTrace(L, 1, 0) != LUA_OK) {
+  if (LuaCallWithTrace(L, C, 1, 0) != LUA_OK) {
     LogLuaError("OnProcessDestroy", lua_tostring(L, -1));
-    lua_pop(L, 1);
+    lua_pop(L, 1);  // pop error
   }
+  lua_pop(L, 1);  // pop thread
+  AssertLuaStackIsEmpty(L);
 }
 
 static inline bool IsHookDefined(const char *s) {
@@ -1117,11 +1176,14 @@ static inline bool IsHookDefined(const char *s) {
 
 static void CallSimpleHook(const char *s) {
   lua_State *L = GL;
+  lua_State *C = lua_newthread(L);
   lua_getglobal(L, s);
-  if (LuaCallWithTrace(L, 0, 0) != LUA_OK) {
+  if (LuaCallWithTrace(L, C, 0, 0) != LUA_OK) {
     LogLuaError(s, lua_tostring(L, -1));
-    lua_pop(L, 1);
+    lua_pop(L, 1);  // pop error
   }
+  lua_pop(L, 1);  // pop thread
+  AssertLuaStackIsEmpty(L);
 }
 
 static void CallSimpleHookIfDefined(const char *s) {
@@ -1384,7 +1446,7 @@ static void NotifyClose(void) {
 #endif
 }
 
-static void WipeKeySigningKeys(void) {
+static void WipeSigningKeys(void) {
   size_t i;
   if (uniprocess) return;
   for (i = 0; i < certs.n; ++i) {
@@ -1396,15 +1458,36 @@ static void WipeKeySigningKeys(void) {
   }
 }
 
+static void PsksDestroy(void) {
+  size_t i;
+  for (i = 0; i < psks.n; ++i) {
+    mbedtls_platform_zeroize(psks.p[i].key, psks.p[i].key_len);
+    free(psks.p[i].key);
+    free(psks.p[i].identity);
+  }
+  Free(&psks.p);
+  psks.n = 0;
+}
+
+static void CertsDestroy(void) {
+  size_t i;
+  for (i = 0; i < certs.n; ++i) {
+    mbedtls_x509_crt_free(certs.p[i].cert);
+    free(certs.p[i].cert);
+    mbedtls_pk_free(certs.p[i].key);
+    free(certs.p[i].key);
+  }
+  Free(&certs.p);
+  certs.n = 0;
+}
+
 static void WipeServingKeys(void) {
   size_t i;
   if (uniprocess) return;
-  /* TODO(jart): We need to figure out MbedTLS ownership semantics here. */
-  /* mbedtls_ssl_ticket_free(&ssltick); */
-  /* mbedtls_ssl_key_cert_free(conf.key_cert); */
-  for (i = 0; i < psks.n; ++i) {
-    mbedtls_platform_zeroize(psks.p[i].key, psks.p[i].key_len);
-  }
+  mbedtls_ssl_ticket_free(&ssltick);
+  mbedtls_ssl_key_cert_free(conf.key_cert), conf.key_cert = 0;
+  CertsDestroy();
+  PsksDestroy();
 }
 
 bool CertHasCommonName(const mbedtls_x509_crt *cert, const void *s, size_t n) {
@@ -1479,7 +1562,7 @@ static int TlsRoutePsk(void *ctx, mbedtls_ssl_context *ssl,
       DEBUGF("(ssl) TlsRoutePsk(%`'.*s)", identity_len, identity);
       mbedtls_ssl_set_hs_psk(ssl, psks.p[i].key, psks.p[i].key_len);
       // keep track of selected psk to report its identity
-      sslpskindex = i+1; // use index+1 to check against 0 (when not set)
+      sslpskindex = i + 1;  // use index+1 to check against 0 (when not set)
       return 0;
     }
   }
@@ -1511,7 +1594,9 @@ static bool TlsSetup(void) {
       VERBOSEF("(ssl) shaken %s %s %s%s %s", DescribeClient(),
                mbedtls_ssl_get_ciphersuite(&ssl), mbedtls_ssl_get_version(&ssl),
                ssl.session->compression ? " COMPRESSED" : "",
-               ssl.curve ? ssl.curve->name : "");
+               ssl.curve ? ssl.curve->name : "uncurved");
+      DEBUGF("(ssl) client ciphersuite preference was %s",
+             gc(FormatSslClientCiphers(&ssl)));
       return true;
     } else if (r == MBEDTLS_ERR_SSL_WANT_READ) {
       LockInc(&shared->c.handshakeinterrupts);
@@ -1534,15 +1619,18 @@ static bool TlsSetup(void) {
           return false;
         case MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN:
           LockInc(&shared->c.sslnociphers);
-          WARNF("(ssl) %s %s", DescribeClient(), "sslnociphers");
+          WARNF("(ssl) %s %s %s", DescribeClient(), "sslnociphers",
+                gc(FormatSslClientCiphers(&ssl)));
           return false;
         case MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE:
           LockInc(&shared->c.sslcantciphers);
-          WARNF("(ssl) %s %s", DescribeClient(), "sslcantciphers");
+          WARNF("(ssl) %s %s %s", DescribeClient(), "sslcantciphers",
+                gc(FormatSslClientCiphers(&ssl)));
           return false;
         case MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION:
           LockInc(&shared->c.sslnoversion);
-          WARNF("(ssl) %s %s", DescribeClient(), "sslnoversion");
+          WARNF("(ssl) %s %s %s", DescribeClient(), "sslnoversion",
+                mbedtls_ssl_get_version(&ssl));
           return false;
         case MBEDTLS_ERR_SSL_INVALID_MAC:
           LockInc(&shared->c.sslshakemacs);
@@ -1749,7 +1837,7 @@ static void LoadCertificates(void) {
     AppendCert(rsa.cert, rsa.key);
 #endif
   }
-  WipeKeySigningKeys();
+  WipeSigningKeys();
 }
 
 static bool ClientAcceptsGzip(void) {
@@ -1801,15 +1889,10 @@ static inline unsigned Hash(const void *p, unsigned long n) {
   return MAX(1, h);
 }
 
-static void Free(void *p) {
-  free(*(void **)p);
-  *(void **)p = 0;
-}
-
 static void FreeAssets(void) {
   size_t i;
   for (i = 0; i < assets.n; ++i) {
-    free(assets.p[i].lastmodifiedstr);
+    Free(&assets.p[i].lastmodifiedstr);
   }
   Free(&assets.p);
   assets.n = 0;
@@ -1818,7 +1901,7 @@ static void FreeAssets(void) {
 static void FreeStrings(struct Strings *l) {
   size_t i;
   for (i = 0; i < l->n; ++i) {
-    free(l->p[i].s);
+    Free(&l->p[i].s);
   }
   Free(&l->p);
   l->n = 0;
@@ -1830,6 +1913,7 @@ static void IndexAssets(void) {
   struct timespec lm;
   uint32_t i, n, m, step, hash;
   DEBUGF("(zip) indexing assets (inode %#lx)", zst.st_ino);
+  FreeAssets();
   CHECK_GE(HASH_LOAD_FACTOR, 2);
   CHECK(READ32LE(zcdir) == kZipCdir64HdrMagic ||
         READ32LE(zcdir) == kZipCdirHdrMagic);
@@ -2214,7 +2298,7 @@ static char *ServeDefaultErrorPage(char *p, unsigned code, const char *reason,
 <!doctype html>\r\n\
 <title>");
   appendf(&outbuf, "%d %s", code, reason);
-  appendf(&outbuf, "\
+  appends(&outbuf, "\
 </title>\r\n\
 <style>\r\n\
 html { color: #111; font-family: sans-serif; }\r\n\
@@ -2556,8 +2640,8 @@ static void LaunchBrowser(const char *path) {
   if (!servers.n || !addr.s_addr) addr.s_addr = htonl(INADDR_LOOPBACK);
   if (*path != '/') path = gc(xasprintf("/%s", path));
   if ((prog = commandv(GetSystemUrlLauncherCommand(), gc(malloc(PATH_MAX))))) {
-    u = gc(xasprintf("http://%s:%d%s", inet_ntoa(addr),
-                     port, gc(EscapePath(path, -1, 0))));
+    u = gc(xasprintf("http://%s:%d%s", inet_ntoa(addr), port,
+                     gc(EscapePath(path, -1, 0))));
     DEBUGF("(srvr) opening browser with command %`'s %s", prog, u);
     ignore.sa_flags = 0;
     ignore.sa_handler = SIG_IGN;
@@ -2861,19 +2945,23 @@ static bool IsLoopbackClient() {
 }
 
 static char *LuaOnHttpRequest(void) {
+  char *error;
   lua_State *L = GL;
+  lua_State *C = lua_newthread(L);
   effectivepath.p = url.path.p;
   effectivepath.n = url.path.n;
   lua_getglobal(L, "OnHttpRequest");
-  if (LuaCallWithTrace(L, 0, 0) == LUA_OK) {
+  if (LuaCallWithTrace(L, C, 0, 0) == LUA_OK) {
+    lua_pop(L, 1);  // pop thread
+    AssertLuaStackIsEmpty(L);
     return CommitOutput(GetLuaResponse());
   } else {
-    char *error;
     LogLuaError("OnHttpRequest", lua_tostring(L, -1));
     error =
         ServeErrorWithDetail(500, "Internal Server Error",
                              IsLoopbackClient() ? lua_tostring(L, -1) : NULL);
-    lua_pop(L, 1);
+    lua_pop(L, 2);  // pop error and thread
+    AssertLuaStackIsEmpty(L);
     return error;
   }
 }
@@ -2882,6 +2970,7 @@ static char *ServeLua(struct Asset *a, const char *s, size_t n) {
   char *code;
   size_t codelen;
   lua_State *L = GL;
+  lua_State *C = lua_newthread(L);
   LockInc(&shared->c.dynamicrequests);
   effectivepath.p = s;
   effectivepath.n = n;
@@ -2889,7 +2978,8 @@ static char *ServeLua(struct Asset *a, const char *s, size_t n) {
     int status =
         luaL_loadbuffer(L, code, codelen,
                         FreeLater(xasprintf("@%s", FreeLater(strndup(s, n)))));
-    if (status == LUA_OK && LuaCallWithTrace(L, 0, 0) == LUA_OK) {
+    if (status == LUA_OK && LuaCallWithTrace(L, C, 0, 0) == LUA_OK) {
+      lua_pop(L, 1);  // pop thread
       return CommitOutput(GetLuaResponse());
     } else {
       char *error;
@@ -2897,7 +2987,7 @@ static char *ServeLua(struct Asset *a, const char *s, size_t n) {
       error =
           ServeErrorWithDetail(500, "Internal Server Error",
                                IsLoopbackClient() ? lua_tostring(L, -1) : NULL);
-      lua_pop(L, 1);
+      lua_pop(L, 2);  // pop error and thread
       return error;
     }
   }
@@ -3143,10 +3233,11 @@ static int LuaSetStatus(lua_State *L) {
 
 static int LuaGetStatus(lua_State *L) {
   OnlyCallDuringRequest(L, "GetStatus");
-  if (!luaheaderp)
+  if (!luaheaderp) {
     lua_pushnil(L);
-  else
+  } else {
     lua_pushinteger(L, statuscode);
+  }
   return 1;
 }
 
@@ -3157,9 +3248,9 @@ static int LuaGetSslIdentity(lua_State *L) {
     lua_pushnil(L);
   } else {
     if (sslpskindex) {
-      CHECK((sslpskindex-1) >= 0 && (sslpskindex-1) < psks.n);
-      lua_pushlstring(L, psks.p[sslpskindex-1].identity,
-                         psks.p[sslpskindex-1].identity_len);
+      CHECK((sslpskindex - 1) >= 0 && (sslpskindex - 1) < psks.n);
+      lua_pushlstring(L, psks.p[sslpskindex - 1].identity,
+                      psks.p[sslpskindex - 1].identity_len);
     } else {
       cert = mbedtls_ssl_get_peer_cert(&ssl);
       lua_pushstring(L, cert ? gc(FormatX509Name(&cert->subject)) : "");
@@ -3168,7 +3259,6 @@ static int LuaGetSslIdentity(lua_State *L) {
   return 1;
 }
 
-
 static int LuaServeError(lua_State *L) {
   return LuaRespond(L, ServeError);
 }
@@ -3211,7 +3301,7 @@ static void GetDosLocalTime(int64_t utcunixts, uint16_t *out_time,
 }
 
 static void StoreAsset(char *path, size_t pathlen, char *data, size_t datalen,
-                      int mode) {
+                       int mode) {
   int64_t ft;
   int i;
   uint32_t crc;
@@ -3306,9 +3396,9 @@ static void StoreAsset(char *path, size_t pathlen, char *data, size_t datalen,
     v[4].iov_len = a->cf - oldcdiroffset;
     // and then the rest of the central directory
     v[5].iov_base = zbase + oldcdiroffset +
-        (v[4].iov_len + ZIP_CFILE_HDRSIZE(zbase + a->cf));
-    v[5].iov_len = oldcdirsize -
-        (v[4].iov_len + ZIP_CFILE_HDRSIZE(zbase + a->cf));
+                    (v[4].iov_len + ZIP_CFILE_HDRSIZE(zbase + a->cf));
+    v[5].iov_len =
+        oldcdirsize - (v[4].iov_len + ZIP_CFILE_HDRSIZE(zbase + a->cf));
   } else {
     v[4].iov_base = zbase + oldcdiroffset;
     v[4].iov_len = oldcdirsize;
@@ -3567,9 +3657,9 @@ static int LuaFetch(lua_State *L) {
   int t, ret, sock, methodidx;
   char *host, *port;
   struct TlsBio *bio;
-  struct Buffer inbuf;
   struct addrinfo *addr;
-  struct HttpMessage msg;
+  struct Buffer inbuf;     // shadowing intentional
+  struct HttpMessage msg;  // shadowing intentional
   struct HttpUnchunker u;
   const char *urlarg, *request, *body, *method;
   char *conlenhdr = "";
@@ -3697,11 +3787,14 @@ static int LuaFetch(lua_State *L) {
          ip >> 8, ip, ntohs(((struct sockaddr_in *)addr->ai_addr)->sin_port));
   CHECK_NE(-1, (sock = GoodSocket(addr->ai_family, addr->ai_socktype,
                                   addr->ai_protocol, false, &timeout)));
-  if (connect(sock, addr->ai_addr, addr->ai_addrlen) == -1) {
+  rc = connect(sock, addr->ai_addr, addr->ai_addrlen);
+  freeaddrinfo(addr), addr = 0;
+  if (rc == -1) {
     close(sock);
     luaL_error(L, "connect(%s:%s) error: %s", host, port, strerror(errno));
     unreachable;
   }
+
   if (usessl) {
     if (sslcliused) {
       mbedtls_ssl_session_reset(&sslcli);
@@ -3728,6 +3821,7 @@ static int LuaFetch(lua_State *L) {
         default:
           close(sock);
           LuaThrowTlsError(L, "handshake", ret);
+          unreachable;
       }
     }
     LockInc(&shared->c.sslhandshakes);
@@ -3746,6 +3840,7 @@ static int LuaFetch(lua_State *L) {
       if (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) goto VerifyFailed;
       close(sock);
       LuaThrowTlsError(L, "write", ret);
+      unreachable;
     }
   } else if (write(sock, request, requestlen) != requestlen) {
     close(sock);
@@ -3778,6 +3873,7 @@ static int LuaFetch(lua_State *L) {
           free(inbuf.p);
           DestroyHttpMessage(&msg);
           LuaThrowTlsError(L, "read", rc);
+          unreachable;
         }
       }
     } else if ((rc = read(sock, inbuf.p + inbuf.n, inbuf.c - inbuf.n)) == -1) {
@@ -3925,9 +4021,9 @@ Finished:
     return 3;
   }
 TransportError:
-  close(sock);
-  free(inbuf.p);
   DestroyHttpMessage(&msg);
+  free(inbuf.p);
+  close(sock);
   luaL_error(L, "transport error");
   unreachable;
 VerifyFailed:
@@ -3936,6 +4032,7 @@ VerifyFailed:
   LuaThrowTlsError(
       L, gc(DescribeSslVerifyFailure(sslcli.session_negotiate->verify_result)),
       ret);
+  unreachable;
 #undef ssl
 }
 
@@ -4739,7 +4836,8 @@ static int LuaGetHttpReason(lua_State *L) {
   return 1;
 }
 
-static int EncodeJsonData(lua_State *L, char **buf, int level, char *numformat) {
+static int EncodeJsonData(lua_State *L, char **buf, int level,
+                          char *numformat) {
   size_t idx = -1;
   size_t tbllen, buflen;
   bool isarray;
@@ -4756,20 +4854,20 @@ static int EncodeJsonData(lua_State *L, char **buf, int level, char *numformat)
   } else if (LUA_TTABLE == t) {
     tbllen = lua_rawlen(L, idx);
     // encode tables with numeric indices and empty tables as arrays
-    isarray = tbllen > 0 || // integer keys present
-      (lua_pushnil(L), lua_next(L, -2) == 0) || // no non-integer keys
-      (lua_pop(L, 2), false); // pop key/value pushed by lua_next
+    isarray = tbllen > 0 ||                              // integer keys present
+              (lua_pushnil(L), lua_next(L, -2) == 0) ||  // no non-integer keys
+              (lua_pop(L, 2), false);  // pop key/value pushed by lua_next
     appendw(buf, isarray ? '[' : '{');
     if (isarray) {
       for (int i = 1; i <= tbllen; i++) {
         if (i > 1) appendw(buf, ',');
-        lua_rawgeti(L, -1, i); // table/-2, value/-1
-        EncodeJsonData(L, buf, level-1, numformat);
+        lua_rawgeti(L, -1, i);  // table/-2, value/-1
+        EncodeJsonData(L, buf, level - 1, numformat);
         lua_pop(L, 1);
       }
     } else {
       int i = 1;
-      lua_pushnil(L); // push the first key
+      lua_pushnil(L);  // push the first key
       while (lua_next(L, -2) != 0) {
         if (!lua_isstring(L, -2))
           return luaL_argerror(L, 1, "expected number or string as key value");
@@ -4779,14 +4877,15 @@ static int EncodeJsonData(lua_State *L, char **buf, int level, char *numformat)
           appends(buf, gc(EscapeJsStringLiteral(lua_tostring(L, -2), -1, 0)));
         } else {
           // we'd still prefer to use lua_tostring on a numeric index, but can't
-          // use it in-place, as it breaks lua_next (changes numeric key to a string)
-          lua_pushvalue(L, -2); // table/-4, key/-3, value/-2, key/-1
-          appends(buf, lua_tostring(L, idx)); // use the copy
-          lua_remove(L, -1); // remove copied key: table/-3, key/-2, value/-1
+          // use it in-place, as it breaks lua_next (changes numeric key to a
+          // string)
+          lua_pushvalue(L, -2);  // table/-4, key/-3, value/-2, key/-1
+          appends(buf, lua_tostring(L, idx));  // use the copy
+          lua_remove(L, -1);  // remove copied key: table/-3, key/-2, value/-1
         }
         appendw(buf, '"' | ':' << 010);
-        EncodeJsonData(L, buf, level-1, numformat);
-        lua_pop(L, 1); // table/-2, key/-1
+        EncodeJsonData(L, buf, level - 1, numformat);
+        lua_pop(L, 1);  // table/-2, key/-1
       }
       // stack: table/-1, as the key was popped by lua_next
     }
@@ -4802,13 +4901,13 @@ static int EncodeJsonData(lua_State *L, char **buf, int level, char *numformat)
 static void EscapeLuaString(char *s, size_t len, char **buf) {
   appendw(buf, '"');
   for (size_t i = 0; i < len; i++) {
-    if (s[i] == '\\' || s[i] == '\"' || s[i] == '\n' ||
-        s[i] == '\0' || s[i] == '\r') {
+    if (s[i] == '\\' || s[i] == '\"' || s[i] == '\n' || s[i] == '\0' ||
+        s[i] == '\r') {
       appendw(buf, '\\' | 'x' << 010 |
-        "0123456789abcdef"[(s[i] & 0xF0) >> 4] << 020 |
-        "0123456789abcdef"[(s[i] & 0x0F) >> 0] << 030);
+                       "0123456789abcdef"[(s[i] & 0xF0) >> 4] << 020 |
+                       "0123456789abcdef"[(s[i] & 0x0F) >> 0] << 030);
     } else {
-      appendd(buf, s+i, 1);
+      appendd(buf, s + i, 1);
     }
   }
   appendw(buf, '"');
@@ -4831,7 +4930,7 @@ static int EncodeLuaData(lua_State *L, char **buf, int level, char *numformat) {
   } else if (LUA_TTABLE == t) {
     appendw(buf, '{');
     int i = 0;
-    lua_pushnil(L); // push the first key
+    lua_pushnil(L);  // push the first key
     while (lua_next(L, -2) != 0) {
       ktype = lua_type(L, -2);
       if (ktype == LUA_TTABLE)
@@ -4839,13 +4938,13 @@ static int EncodeLuaData(lua_State *L, char **buf, int level, char *numformat) {
       if (i++ > 0) appendd(buf, ",", 1);
       if (ktype != LUA_TNUMBER || floor(lua_tonumber(L, -2)) != i) {
         appendw(buf, '[');
-        lua_pushvalue(L, -2); // table/-4, key/-3, value/-2, key/-1
+        lua_pushvalue(L, -2);  // table/-4, key/-3, value/-2, key/-1
         EncodeLuaData(L, buf, level, numformat);
-        lua_remove(L, -1); // remove copied key: table/-3, key/-2, value/-1
+        lua_remove(L, -1);  // remove copied key: table/-3, key/-2, value/-1
         appendw(buf, ']' | '=' << 010);
       }
-      EncodeLuaData(L, buf, level-1, numformat);
-      lua_pop(L, 1); // table/-2, key/-1
+      EncodeLuaData(L, buf, level - 1, numformat);
+      lua_pop(L, 1);  // table/-2, key/-1
     }
     // stack: table/-1, as the key was popped by lua_next
     appendw(buf, '}');
@@ -4857,25 +4956,25 @@ static int EncodeLuaData(lua_State *L, char **buf, int level, char *numformat) {
   return 0;
 }
 
-static int LuaEncodeSmth(lua_State *L, int Encoder(lua_State *, char **, int, char *)) {
+static int LuaEncodeSmth(lua_State *L,
+                         int Encoder(lua_State *, char **, int, char *)) {
   int useoutput = false;
   int maxdepth = 64;
   char *numformat = "%.14g";
   char *p = 0;
-
   if (lua_istable(L, 2)) {
     lua_settop(L, 2);  // discard any extra arguments
     lua_getfield(L, 2, "useoutput");
     // ignore useoutput outside of request handling
-    if (ishandlingrequest && lua_isboolean(L, -1)) useoutput = lua_toboolean(L, -1);
+    if (ishandlingrequest && lua_isboolean(L, -1))
+      useoutput = lua_toboolean(L, -1);
     lua_getfield(L, 2, "maxdepth");
     maxdepth = luaL_optinteger(L, -1, maxdepth);
     lua_getfield(L, 2, "numformat");
     numformat = luaL_optstring(L, -1, numformat);
   }
-  lua_settop(L, 1); // keep the passed argument on top
+  lua_settop(L, 1);  // keep the passed argument on top
   Encoder(L, useoutput ? &outbuf : &p, maxdepth, numformat);
-
   if (useoutput) {
     lua_pushnil(L);
   } else {
@@ -5035,7 +5134,7 @@ static int LuaProgramUniprocess(lua_State *L) {
     return luaL_argerror(L, 1, "invalid uniprocess mode; boolean expected");
 
   lua_pushboolean(L, uniprocess);
-  if (!IsWindows()) { // uniprocess can't be disabled on Windows yet
+  if (!IsWindows()) {  // uniprocess can't be disabled on Windows yet
     if (lua_isboolean(L, 1)) uniprocess = lua_toboolean(L, 1);
   }
   return 1;
@@ -5546,16 +5645,18 @@ static bool LuaRunAsset(const char *path, bool mandatory) {
   if ((a = GetAsset(path, pathlen))) {
     if ((code = FreeLater(LoadAsset(a, &codelen)))) {
       lua_State *L = GL;
+      lua_State *C = lua_newthread(L);
       effectivepath.p = path;
       effectivepath.n = pathlen;
       DEBUGF("(lua) LuaRunAsset(%`'s)", path);
       status =
           luaL_loadbuffer(L, code, codelen, FreeLater(xasprintf("@%s", path)));
-      if (status != LUA_OK || LuaCallWithTrace(L, 0, 0) != LUA_OK) {
+      if (status != LUA_OK || LuaCallWithTrace(L, C, 0, 0) != LUA_OK) {
         LogLuaError("lua code", lua_tostring(L, -1));
-        lua_pop(L, 1);
+        lua_pop(L, 1);  // pop error
         if (mandatory) exit(1);
       }
+      lua_pop(L, 1);  // pop thread
     }
   }
   return !!a;
@@ -5801,6 +5902,7 @@ static void LuaDestroy(void) {
 #ifndef STATIC
   lua_State *L = GL;
   lua_close(L);
+  free(g_lua_path_default);
 #endif
 }
 
@@ -6417,7 +6519,7 @@ static char *SetStatus(unsigned code, const char *reason) {
     if (code == 308) code = 301;
   }
   statuscode = code;
-  hascontenttype = false; // reset, as the headers are reset
+  hascontenttype = false;  // reset, as the headers are reset
   stpcpy(hdrbuf.p, "HTTP/1.0 000 ");
   hdrbuf.p[7] += msg.version & 1;
   hdrbuf.p[9] += code / 100;
@@ -6783,7 +6885,7 @@ static void HandleConnection(size_t i) {
       if (hasonworkerstop) {
         CallSimpleHook("OnWorkerStop");
       }
-      _exit(0);
+      ExitWorker();
     } else {
       close(client);
       oldin.p = 0;
@@ -6998,7 +7100,6 @@ static void TlsInit(void) {
   if (!sslinitialized) {
     InitializeRng(&rng);
     InitializeRng(&rngcli);
-    cachain = GetSslRoots();
     suite = suiteb ? MBEDTLS_SSL_PRESET_SUITEB : MBEDTLS_SSL_PRESET_SUITEC;
     mbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_SERVER,
                                 MBEDTLS_SSL_TRANSPORT_STREAM, suite);
@@ -7034,11 +7135,11 @@ static void TlsInit(void) {
   mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &rng);
   mbedtls_ssl_conf_rng(&confcli, mbedtls_ctr_drbg_random, &rngcli);
   if (sslclientverify) {
-    mbedtls_ssl_conf_ca_chain(&conf, cachain, 0);
+    mbedtls_ssl_conf_ca_chain(&conf, GetSslRoots(), 0);
     mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_REQUIRED);
   }
   if (sslfetchverify) {
-    mbedtls_ssl_conf_ca_chain(&confcli, cachain, 0);
+    mbedtls_ssl_conf_ca_chain(&confcli, GetSslRoots(), 0);
     mbedtls_ssl_conf_authmode(&confcli, MBEDTLS_SSL_VERIFY_REQUIRED);
   } else {
     mbedtls_ssl_conf_authmode(&confcli, MBEDTLS_SSL_VERIFY_NONE);
@@ -7054,41 +7155,30 @@ static void TlsInit(void) {
 
 static void TlsDestroy(void) {
 #ifndef UNSECURE
-  size_t i;
-  for (i = 0; i < psks.n; ++i) {
-    mbedtls_platform_zeroize(psks.p[i].key, psks.p[i].key_len);
-    free(psks.p[i].key);
-    free(psks.p[i].identity);
-  }
   mbedtls_ssl_free(&ssl);
   mbedtls_ssl_free(&sslcli);
   mbedtls_ctr_drbg_free(&rng);
-  mbedtls_x509_crt_free(cachain);
   mbedtls_ctr_drbg_free(&rngcli);
   mbedtls_ssl_config_free(&conf);
   mbedtls_ssl_config_free(&confcli);
   mbedtls_ssl_ticket_free(&ssltick);
-  /* TODO(jart): We need to learn more about ownership of this memory. */
-  /* for (i = 0; i < certs.n; ++i) { */
-  /*   mbedtls_x509_crt_free(certs.p[i].cert); */
-  /*   mbedtls_pk_free(certs.p[i].key); */
-  /* } */
+  CertsDestroy();
+  PsksDestroy();
   Free(&suites.p), suites.n = 0;
-  Free(&certs.p), certs.n = 0;
-  Free(&ports.p), ports.n = 0;
-  Free(&psks.p), psks.n = 0;
-  Free(&ips.p), ips.n = 0;
 #endif
 }
 
 static void MemDestroy(void) {
   FreeAssets();
   CollectGarbage();
-  Free(&unmaplist.p), unmaplist.n = 0;
-  Free(&freelist.p), freelist.n = 0;
+  inbuf.p = 0, inbuf.n = 0, inbuf.c = 0;
+  Free(&inbuf_actual.p), inbuf_actual.n = inbuf_actual.c = 0;
+  Free(&unmaplist.p), unmaplist.n = unmaplist.c = 0;
+  Free(&freelist.p), freelist.n = freelist.c = 0;
+  Free(&hdrbuf.p), hdrbuf.n = hdrbuf.c = 0;
   Free(&servers.p), servers.n = 0;
-  Free(&hdrbuf.p), hdrbuf.n = 0;
-  Free(&inbuf.p), inbuf.n = 0;
+  Free(&ports.p), ports.n = 0;
+  Free(&ips.p), ips.n = 0;
   Free(&outbuf);
   FreeStrings(&stagedirs);
   FreeStrings(&hidepaths);
@@ -7101,6 +7191,16 @@ static void MemDestroy(void) {
   Free(&polls);
 }
 
+static wontreturn void ExitWorker(void) {
+  if (IsModeDbg()) {
+    LuaDestroy();
+    TlsDestroy();
+    MemDestroy();
+    CheckForMemoryLeaks();
+  }
+  _Exit(0);
+}
+
 static void GetOpts(int argc, char *argv[]) {
   int opt;
   bool storeasset = false;
@@ -7191,8 +7291,9 @@ void RedBean(int argc, char *argv[]) {
   CollectGarbage();
   hdrbuf.n = 4 * 1024;
   hdrbuf.p = xmalloc(hdrbuf.n);
-  inbuf.n = maxpayloadsize;
-  inbuf.p = xmalloc(inbuf.n);
+  inbuf_actual.n = maxpayloadsize;
+  inbuf_actual.p = xmalloc(inbuf_actual.n);
+  inbuf = inbuf_actual;
   isinitialized = true;
   CallSimpleHookIfDefined("OnServerStart");
   HandleEvents();
@@ -7212,5 +7313,8 @@ int main(int argc, char *argv[]) {
     showcrashreports();
   }
   RedBean(argc, argv);
+  if (IsModeDbg()) {
+    CheckForMemoryLeaks();
+  }
   return 0;
 }