Make changes required for CIci

9 files changed, 2602 insertions, 0 deletions

diff --git a/openssl/agent/pkcs11/options.cxx b/openssl/agent/pkcs11/options.cxx
new file mode 100644
index 0000000..592ca79
--- /dev/null
+++ b/openssl/agent/pkcs11/options.cxx
@@ -0,0 +1,635 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+// Begin prologue.
+//
+#include <openssl/types-parsers.hxx>
+//
+// End prologue.
+
+#include <openssl/agent/pkcs11/options.hxx>
+
+#include <map>
+#include <set>
+#include <string>
+#include <vector>
+#include <utility>
+#include <ostream>
+#include <sstream>
+#include <cstring>
+
+namespace openssl
+{
+  namespace cli
+  {
+    template <typename X>
+    struct parser
+    {
+      static void
+      parse (X& x, bool& xs, scanner& s)
+      {
+        using namespace std;
+
+        const char* o (s.next ());
+        if (s.more ())
+        {
+          string v (s.next ());
+          istringstream is (v);
+          if (!(is >> x && is.peek () == istringstream::traits_type::eof ()))
+            throw invalid_value (o, v);
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <>
+    struct parser<bool>
+    {
+      static void
+      parse (bool& x, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          const char* v (s.next ());
+
+          if (std::strcmp (v, "1")    == 0 ||
+              std::strcmp (v, "true") == 0 ||
+              std::strcmp (v, "TRUE") == 0 ||
+              std::strcmp (v, "True") == 0)
+            x = true;
+          else if (std::strcmp (v, "0")     == 0 ||
+                   std::strcmp (v, "false") == 0 ||
+                   std::strcmp (v, "FALSE") == 0 ||
+                   std::strcmp (v, "False") == 0)
+            x = false;
+          else
+            throw invalid_value (o, v);
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <>
+    struct parser<std::string>
+    {
+      static void
+      parse (std::string& x, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+          x = s.next ();
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename X>
+    struct parser<std::pair<X, std::size_t> >
+    {
+      static void
+      parse (std::pair<X, std::size_t>& x, bool& xs, scanner& s)
+      {
+        x.second = s.position ();
+        parser<X>::parse (x.first, xs, s);
+      }
+    };
+
+    template <typename X>
+    struct parser<std::vector<X> >
+    {
+      static void
+      parse (std::vector<X>& c, bool& xs, scanner& s)
+      {
+        X x;
+        bool dummy;
+        parser<X>::parse (x, dummy, s);
+        c.push_back (x);
+        xs = true;
+      }
+    };
+
+    template <typename X, typename C>
+    struct parser<std::set<X, C> >
+    {
+      static void
+      parse (std::set<X, C>& c, bool& xs, scanner& s)
+      {
+        X x;
+        bool dummy;
+        parser<X>::parse (x, dummy, s);
+        c.insert (x);
+        xs = true;
+      }
+    };
+
+    template <typename K, typename V, typename C>
+    struct parser<std::map<K, V, C> >
+    {
+      static void
+      parse (std::map<K, V, C>& m, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          std::size_t pos (s.position ());
+          std::string ov (s.next ());
+          std::string::size_type p = ov.find ('=');
+
+          K k = K ();
+          V v = V ();
+          std::string kstr (ov, 0, p);
+          std::string vstr (ov, (p != std::string::npos ? p + 1 : ov.size ()));
+
+          int ac (2);
+          char* av[] =
+          {
+            const_cast<char*> (o),
+            0
+          };
+
+          bool dummy;
+          if (!kstr.empty ())
+          {
+            av[1] = const_cast<char*> (kstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<K>::parse (k, dummy, s);
+          }
+
+          if (!vstr.empty ())
+          {
+            av[1] = const_cast<char*> (vstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<V>::parse (v, dummy, s);
+          }
+
+          m[k] = v;
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename K, typename V, typename C>
+    struct parser<std::multimap<K, V, C> >
+    {
+      static void
+      parse (std::multimap<K, V, C>& m, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          std::size_t pos (s.position ());
+          std::string ov (s.next ());
+          std::string::size_type p = ov.find ('=');
+
+          K k = K ();
+          V v = V ();
+          std::string kstr (ov, 0, p);
+          std::string vstr (ov, (p != std::string::npos ? p + 1 : ov.size ()));
+
+          int ac (2);
+          char* av[] =
+          {
+            const_cast<char*> (o),
+            0
+          };
+
+          bool dummy;
+          if (!kstr.empty ())
+          {
+            av[1] = const_cast<char*> (kstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<K>::parse (k, dummy, s);
+          }
+
+          if (!vstr.empty ())
+          {
+            av[1] = const_cast<char*> (vstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<V>::parse (v, dummy, s);
+          }
+
+          m.insert (typename std::multimap<K, V, C>::value_type (k, v));
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename X, typename T, T X::*M>
+    void
+    thunk (X& x, scanner& s)
+    {
+      parser<T>::parse (x.*M, s);
+    }
+
+    template <typename X, bool X::*M>
+    void
+    thunk (X& x, scanner& s)
+    {
+      s.next ();
+      x.*M = true;
+    }
+
+    template <typename X, typename T, T X::*M, bool X::*S>
+    void
+    thunk (X& x, scanner& s)
+    {
+      parser<T>::parse (x.*M, x.*S, s);
+    }
+  }
+}
+
+#include <map>
+
+namespace openssl
+{
+  namespace agent
+  {
+    namespace pkcs11
+    {
+      // options
+      //
+
+      options::
+      options ()
+      : help_ (),
+        version_ (),
+        simulate_ (),
+        simulate_specified_ (false)
+      {
+      }
+
+      bool options::
+      parse (int& argc,
+             char** argv,
+             bool erase,
+             ::openssl::cli::unknown_mode opt,
+             ::openssl::cli::unknown_mode arg)
+      {
+        ::openssl::cli::argv_scanner s (argc, argv, erase);
+        bool r = _parse (s, opt, arg);
+        return r;
+      }
+
+      bool options::
+      parse (int start,
+             int& argc,
+             char** argv,
+             bool erase,
+             ::openssl::cli::unknown_mode opt,
+             ::openssl::cli::unknown_mode arg)
+      {
+        ::openssl::cli::argv_scanner s (start, argc, argv, erase);
+        bool r = _parse (s, opt, arg);
+        return r;
+      }
+
+      bool options::
+      parse (int& argc,
+             char** argv,
+             int& end,
+             bool erase,
+             ::openssl::cli::unknown_mode opt,
+             ::openssl::cli::unknown_mode arg)
+      {
+        ::openssl::cli::argv_scanner s (argc, argv, erase);
+        bool r = _parse (s, opt, arg);
+        end = s.end ();
+        return r;
+      }
+
+      bool options::
+      parse (int start,
+             int& argc,
+             char** argv,
+             int& end,
+             bool erase,
+             ::openssl::cli::unknown_mode opt,
+             ::openssl::cli::unknown_mode arg)
+      {
+        ::openssl::cli::argv_scanner s (start, argc, argv, erase);
+        bool r = _parse (s, opt, arg);
+        end = s.end ();
+        return r;
+      }
+
+      bool options::
+      parse (::openssl::cli::scanner& s,
+             ::openssl::cli::unknown_mode opt,
+             ::openssl::cli::unknown_mode arg)
+      {
+        bool r = _parse (s, opt, arg);
+        return r;
+      }
+
+      ::openssl::cli::usage_para options::
+      print_usage (::std::ostream& os, ::openssl::cli::usage_para p)
+      {
+        CLI_POTENTIALLY_UNUSED (os);
+
+        if (p != ::openssl::cli::usage_para::none)
+          os << ::std::endl;
+
+        os << "\033[1mOPTIONS\033[0m" << ::std::endl;
+
+        os << std::endl
+           << "\033[1m--help\033[0m               Print usage information and exit." << ::std::endl;
+
+        os << std::endl
+           << "\033[1m--version\033[0m            Print version and exit." << ::std::endl;
+
+        os << std::endl
+           << "\033[1m--simulate\033[0m \033[4moutcome\033[0m   Run the daemon in the simulation mode." << ::std::endl;
+
+        p = ::openssl::cli::usage_para::option;
+
+        return p;
+      }
+
+      typedef
+      std::map<std::string, void (*) (options&, ::openssl::cli::scanner&)>
+      _cli_options_map;
+
+      static _cli_options_map _cli_options_map_;
+
+      struct _cli_options_map_init
+      {
+        _cli_options_map_init ()
+        {
+          _cli_options_map_["--help"] =
+          &::openssl::cli::thunk< options, &options::help_ >;
+          _cli_options_map_["--version"] =
+          &::openssl::cli::thunk< options, &options::version_ >;
+          _cli_options_map_["--simulate"] =
+          &::openssl::cli::thunk< options, simulate_outcome, &options::simulate_,
+            &options::simulate_specified_ >;
+        }
+      };
+
+      static _cli_options_map_init _cli_options_map_init_;
+
+      bool options::
+      _parse (const char* o, ::openssl::cli::scanner& s)
+      {
+        _cli_options_map::const_iterator i (_cli_options_map_.find (o));
+
+        if (i != _cli_options_map_.end ())
+        {
+          (*(i->second)) (*this, s);
+          return true;
+        }
+
+        return false;
+      }
+
+      bool options::
+      _parse (::openssl::cli::scanner& s,
+              ::openssl::cli::unknown_mode opt_mode,
+              ::openssl::cli::unknown_mode arg_mode)
+      {
+        // Can't skip combined flags (--no-combined-flags).
+        //
+        assert (opt_mode != ::openssl::cli::unknown_mode::skip);
+
+        bool r = false;
+        bool opt = true;
+
+        while (s.more ())
+        {
+          const char* o = s.peek ();
+
+          if (std::strcmp (o, "--") == 0)
+          {
+            opt = false;
+            s.skip ();
+            r = true;
+            continue;
+          }
+
+          if (opt)
+          {
+            if (_parse (o, s))
+            {
+              r = true;
+              continue;
+            }
+
+            if (std::strncmp (o, "-", 1) == 0 && o[1] != '\0')
+            {
+              // Handle combined option values.
+              //
+              std::string co;
+              if (const char* v = std::strchr (o, '='))
+              {
+                co.assign (o, 0, v - o);
+                ++v;
+
+                int ac (2);
+                char* av[] =
+                {
+                  const_cast<char*> (co.c_str ()),
+                  const_cast<char*> (v)
+                };
+
+                ::openssl::cli::argv_scanner ns (0, ac, av);
+
+                if (_parse (co.c_str (), ns))
+                {
+                  // Parsed the option but not its value?
+                  //
+                  if (ns.end () != 2)
+                    throw ::openssl::cli::invalid_value (co, v);
+
+                  s.next ();
+                  r = true;
+                  continue;
+                }
+                else
+                {
+                  // Set the unknown option and fall through.
+                  //
+                  o = co.c_str ();
+                }
+              }
+
+              // Handle combined flags.
+              //
+              char cf[3];
+              {
+                const char* p = o + 1;
+                for (; *p != '\0'; ++p)
+                {
+                  if (!((*p >= 'a' && *p <= 'z') ||
+                        (*p >= 'A' && *p <= 'Z') ||
+                        (*p >= '0' && *p <= '9')))
+                    break;
+                }
+
+                if (*p == '\0')
+                {
+                  for (p = o + 1; *p != '\0'; ++p)
+                  {
+                    std::strcpy (cf, "-");
+                    cf[1] = *p;
+                    cf[2] = '\0';
+
+                    int ac (1);
+                    char* av[] =
+                    {
+                      cf
+                    };
+
+                    ::openssl::cli::argv_scanner ns (0, ac, av);
+
+                    if (!_parse (cf, ns))
+                      break;
+                  }
+
+                  if (*p == '\0')
+                  {
+                    // All handled.
+                    //
+                    s.next ();
+                    r = true;
+                    continue;
+                  }
+                  else
+                  {
+                    // Set the unknown option and fall through.
+                    //
+                    o = cf;
+                  }
+                }
+              }
+
+              switch (opt_mode)
+              {
+                case ::openssl::cli::unknown_mode::skip:
+                {
+                  s.skip ();
+                  r = true;
+                  continue;
+                }
+                case ::openssl::cli::unknown_mode::stop:
+                {
+                  break;
+                }
+                case ::openssl::cli::unknown_mode::fail:
+                {
+                  throw ::openssl::cli::unknown_option (o);
+                }
+              }
+
+              break;
+            }
+          }
+
+          switch (arg_mode)
+          {
+            case ::openssl::cli::unknown_mode::skip:
+            {
+              s.skip ();
+              r = true;
+              continue;
+            }
+            case ::openssl::cli::unknown_mode::stop:
+            {
+              break;
+            }
+            case ::openssl::cli::unknown_mode::fail:
+            {
+              throw ::openssl::cli::unknown_argument (o);
+            }
+          }
+
+          break;
+        }
+
+        return r;
+      }
+    }
+  }
+}
+
+namespace openssl
+{
+  ::openssl::cli::usage_para
+  print_openssl_agent_pkcs11_usage (::std::ostream& os, ::openssl::cli::usage_para p)
+  {
+    CLI_POTENTIALLY_UNUSED (os);
+
+    if (p != ::openssl::cli::usage_para::none)
+      os << ::std::endl;
+
+    os << "\033[1mSYNOPSIS\033[0m" << ::std::endl
+       << ::std::endl
+       << "\033[1mopenssl-agent-pkcs11 --help\033[0m" << ::std::endl
+       << "\033[1mopenssl-agent-pkcs11 --version\033[0m" << ::std::endl
+       << "\033[1mopenssl-agent-pkcs11\033[0m [\033[4moptions\033[0m] \033[4murl\033[0m\033[0m" << ::std::endl
+       << ::std::endl
+       << "\033[1mDESCRIPTION\033[0m" << ::std::endl
+       << ::std::endl
+       << "The \033[1mPKCS#11\033[0m key agent prompts for a PIN for the specified token and forks off" << ::std::endl
+       << "the daemon, which unlocks the key, opens a UNIX domain socket, and waits for" << ::std::endl
+       << "cryptographic operation requests from the OpenSSL client \033[1mopenssl-client(1)\033[0m. The" << ::std::endl
+       << "agent also prints to \033[1mstdout\033[0m a shell script fragment that sets the environment" << ::std::endl
+       << "variables necessary for locating the agent. See the ENVIRONMENT section for" << ::std::endl
+       << "details." << ::std::endl
+       << ::std::endl
+       << "The daemon can be run in the simulation mode without actually logging into the" << ::std::endl
+       << "\033[1mPKCS#11\033[0m token. If the \033[1m--simulate\033[0m option is specified with the \033[1msuccess\033[0m outcome," << ::std::endl
+       << "the daemon pretends to unlock the requested key and responds with a dummy" << ::std::endl
+       << "signature to the subsequent data signing requests. The \033[1mfailure\033[0m outcome causes" << ::std::endl
+       << "the daemon to exit with non-zero status, as if it failed to find the key. This" << ::std::endl
+       << "mode is mostly useful for testing." << ::std::endl;
+
+    p = ::openssl::agent::pkcs11::options::print_usage (os, ::openssl::cli::usage_para::text);
+
+    if (p != ::openssl::cli::usage_para::none)
+      os << ::std::endl;
+
+    os << "\033[1mENVIRONMENT\033[0m" << ::std::endl
+       << ::std::endl
+       << "The printed shell script fragment sets the \033[1mOPENSSL_AGENT_PKCS11_SOCK\033[0m and" << ::std::endl
+       << "\033[1mOPENSSL_AGENT_PKCS11_PID\033[0m environment variables. The former refers to the" << ::std::endl
+       << "Unix-domain socket that should be used by \033[1mopenssl-client(1)\033[0m for communicating" << ::std::endl
+       << "with the daemon. The latter contains the daemon process id that can be used to" << ::std::endl
+       << "terminate the daemon by sending it the \033[1mSIGTERM\033[0m signal." << ::std::endl;
+
+    os << std::endl
+       << "\033[1mEXIT STATUS\033[0m" << ::std::endl
+       << ::std::endl
+       << "Non-zero exit status is returned in case of an error." << ::std::endl;
+
+    p = ::openssl::cli::usage_para::text;
+
+    return p;
+  }
+}
+
+// Begin epilogue.
+//
+//
+// End epilogue.
+
diff --git a/openssl/agent/pkcs11/options.hxx b/openssl/agent/pkcs11/options.hxx
new file mode 100644
index 0000000..0e3aa08
--- /dev/null
+++ b/openssl/agent/pkcs11/options.hxx
@@ -0,0 +1,125 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+#ifndef OPENSSL_AGENT_PKCS11_OPTIONS_HXX
+#define OPENSSL_AGENT_PKCS11_OPTIONS_HXX
+
+// Begin prologue.
+//
+//
+// End prologue.
+
+#include <openssl/options.hxx>
+
+namespace openssl
+{
+  namespace agent
+  {
+    namespace pkcs11
+    {
+      class options
+      {
+        public:
+        options ();
+
+        // Return true if anything has been parsed.
+        //
+        bool
+        parse (int& argc,
+               char** argv,
+               bool erase = false,
+               ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+               ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+        bool
+        parse (int start,
+               int& argc,
+               char** argv,
+               bool erase = false,
+               ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+               ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+        bool
+        parse (int& argc,
+               char** argv,
+               int& end,
+               bool erase = false,
+               ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+               ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+        bool
+        parse (int start,
+               int& argc,
+               char** argv,
+               int& end,
+               bool erase = false,
+               ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+               ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+        bool
+        parse (::openssl::cli::scanner&,
+               ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+               ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+        // Option accessors.
+        //
+        const bool&
+        help () const;
+
+        const bool&
+        version () const;
+
+        const simulate_outcome&
+        simulate () const;
+
+        bool
+        simulate_specified () const;
+
+        // Print usage information.
+        //
+        static ::openssl::cli::usage_para
+        print_usage (::std::ostream&,
+                     ::openssl::cli::usage_para = ::openssl::cli::usage_para::none);
+
+        // Implementation details.
+        //
+        protected:
+        bool
+        _parse (const char*, ::openssl::cli::scanner&);
+
+        private:
+        bool
+        _parse (::openssl::cli::scanner&,
+                ::openssl::cli::unknown_mode option,
+                ::openssl::cli::unknown_mode argument);
+
+        public:
+        bool help_;
+        bool version_;
+        simulate_outcome simulate_;
+        bool simulate_specified_;
+      };
+    }
+  }
+}
+
+// Print page usage information.
+//
+namespace openssl
+{
+  ::openssl::cli::usage_para
+  print_openssl_agent_pkcs11_usage (::std::ostream&,
+                                    ::openssl::cli::usage_para = ::openssl::cli::usage_para::none);
+}
+
+#include <openssl/agent/pkcs11/options.ixx>
+
+// Begin epilogue.
+//
+//
+// End epilogue.
+
+#endif // OPENSSL_AGENT_PKCS11_OPTIONS_HXX
diff --git a/openssl/agent/pkcs11/options.ixx b/openssl/agent/pkcs11/options.ixx
new file mode 100644
index 0000000..f6cc1d7
--- /dev/null
+++ b/openssl/agent/pkcs11/options.ixx
@@ -0,0 +1,51 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+// Begin prologue.
+//
+//
+// End prologue.
+
+namespace openssl
+{
+  namespace agent
+  {
+    namespace pkcs11
+    {
+      // options
+      //
+
+      inline const bool& options::
+      help () const
+      {
+        return this->help_;
+      }
+
+      inline const bool& options::
+      version () const
+      {
+        return this->version_;
+      }
+
+      inline const simulate_outcome& options::
+      simulate () const
+      {
+        return this->simulate_;
+      }
+
+      inline bool options::
+      simulate_specified () const
+      {
+        return this->simulate_specified_;
+      }
+    }
+  }
+}
+
+// Begin epilogue.
+//
+//
+// End epilogue.
diff --git a/openssl/client/options.cxx b/openssl/client/options.cxx
new file mode 100644
index 0000000..c0a2c7f
--- /dev/null
+++ b/openssl/client/options.cxx
@@ -0,0 +1,673 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+// Begin prologue.
+//
+#include <openssl/types-parsers.hxx>
+//
+// End prologue.
+
+#include <openssl/client/options.hxx>
+
+#include <map>
+#include <set>
+#include <string>
+#include <vector>
+#include <utility>
+#include <ostream>
+#include <sstream>
+#include <cstring>
+
+namespace openssl
+{
+  namespace cli
+  {
+    template <typename X>
+    struct parser
+    {
+      static void
+      parse (X& x, bool& xs, scanner& s)
+      {
+        using namespace std;
+
+        const char* o (s.next ());
+        if (s.more ())
+        {
+          string v (s.next ());
+          istringstream is (v);
+          if (!(is >> x && is.peek () == istringstream::traits_type::eof ()))
+            throw invalid_value (o, v);
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <>
+    struct parser<bool>
+    {
+      static void
+      parse (bool& x, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          const char* v (s.next ());
+
+          if (std::strcmp (v, "1")    == 0 ||
+              std::strcmp (v, "true") == 0 ||
+              std::strcmp (v, "TRUE") == 0 ||
+              std::strcmp (v, "True") == 0)
+            x = true;
+          else if (std::strcmp (v, "0")     == 0 ||
+                   std::strcmp (v, "false") == 0 ||
+                   std::strcmp (v, "FALSE") == 0 ||
+                   std::strcmp (v, "False") == 0)
+            x = false;
+          else
+            throw invalid_value (o, v);
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <>
+    struct parser<std::string>
+    {
+      static void
+      parse (std::string& x, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+          x = s.next ();
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename X>
+    struct parser<std::pair<X, std::size_t> >
+    {
+      static void
+      parse (std::pair<X, std::size_t>& x, bool& xs, scanner& s)
+      {
+        x.second = s.position ();
+        parser<X>::parse (x.first, xs, s);
+      }
+    };
+
+    template <typename X>
+    struct parser<std::vector<X> >
+    {
+      static void
+      parse (std::vector<X>& c, bool& xs, scanner& s)
+      {
+        X x;
+        bool dummy;
+        parser<X>::parse (x, dummy, s);
+        c.push_back (x);
+        xs = true;
+      }
+    };
+
+    template <typename X, typename C>
+    struct parser<std::set<X, C> >
+    {
+      static void
+      parse (std::set<X, C>& c, bool& xs, scanner& s)
+      {
+        X x;
+        bool dummy;
+        parser<X>::parse (x, dummy, s);
+        c.insert (x);
+        xs = true;
+      }
+    };
+
+    template <typename K, typename V, typename C>
+    struct parser<std::map<K, V, C> >
+    {
+      static void
+      parse (std::map<K, V, C>& m, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          std::size_t pos (s.position ());
+          std::string ov (s.next ());
+          std::string::size_type p = ov.find ('=');
+
+          K k = K ();
+          V v = V ();
+          std::string kstr (ov, 0, p);
+          std::string vstr (ov, (p != std::string::npos ? p + 1 : ov.size ()));
+
+          int ac (2);
+          char* av[] =
+          {
+            const_cast<char*> (o),
+            0
+          };
+
+          bool dummy;
+          if (!kstr.empty ())
+          {
+            av[1] = const_cast<char*> (kstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<K>::parse (k, dummy, s);
+          }
+
+          if (!vstr.empty ())
+          {
+            av[1] = const_cast<char*> (vstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<V>::parse (v, dummy, s);
+          }
+
+          m[k] = v;
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename K, typename V, typename C>
+    struct parser<std::multimap<K, V, C> >
+    {
+      static void
+      parse (std::multimap<K, V, C>& m, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          std::size_t pos (s.position ());
+          std::string ov (s.next ());
+          std::string::size_type p = ov.find ('=');
+
+          K k = K ();
+          V v = V ();
+          std::string kstr (ov, 0, p);
+          std::string vstr (ov, (p != std::string::npos ? p + 1 : ov.size ()));
+
+          int ac (2);
+          char* av[] =
+          {
+            const_cast<char*> (o),
+            0
+          };
+
+          bool dummy;
+          if (!kstr.empty ())
+          {
+            av[1] = const_cast<char*> (kstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<K>::parse (k, dummy, s);
+          }
+
+          if (!vstr.empty ())
+          {
+            av[1] = const_cast<char*> (vstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<V>::parse (v, dummy, s);
+          }
+
+          m.insert (typename std::multimap<K, V, C>::value_type (k, v));
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename X, typename T, T X::*M>
+    void
+    thunk (X& x, scanner& s)
+    {
+      parser<T>::parse (x.*M, s);
+    }
+
+    template <typename X, bool X::*M>
+    void
+    thunk (X& x, scanner& s)
+    {
+      s.next ();
+      x.*M = true;
+    }
+
+    template <typename X, typename T, T X::*M, bool X::*S>
+    void
+    thunk (X& x, scanner& s)
+    {
+      parser<T>::parse (x.*M, x.*S, s);
+    }
+  }
+}
+
+#include <map>
+
+namespace openssl
+{
+  namespace client
+  {
+    // options
+    //
+
+    options::
+    options ()
+    : help_ (),
+      version_ (),
+      sign_ (),
+      keyform_ (),
+      keyform_specified_ (false),
+      engine_ (),
+      engine_specified_ (false),
+      inkey_ (),
+      inkey_specified_ (false),
+      simulate_ (),
+      simulate_specified_ (false)
+    {
+    }
+
+    bool options::
+    parse (int& argc,
+           char** argv,
+           bool erase,
+           ::openssl::cli::unknown_mode opt,
+           ::openssl::cli::unknown_mode arg)
+    {
+      ::openssl::cli::argv_scanner s (argc, argv, erase);
+      bool r = _parse (s, opt, arg);
+      return r;
+    }
+
+    bool options::
+    parse (int start,
+           int& argc,
+           char** argv,
+           bool erase,
+           ::openssl::cli::unknown_mode opt,
+           ::openssl::cli::unknown_mode arg)
+    {
+      ::openssl::cli::argv_scanner s (start, argc, argv, erase);
+      bool r = _parse (s, opt, arg);
+      return r;
+    }
+
+    bool options::
+    parse (int& argc,
+           char** argv,
+           int& end,
+           bool erase,
+           ::openssl::cli::unknown_mode opt,
+           ::openssl::cli::unknown_mode arg)
+    {
+      ::openssl::cli::argv_scanner s (argc, argv, erase);
+      bool r = _parse (s, opt, arg);
+      end = s.end ();
+      return r;
+    }
+
+    bool options::
+    parse (int start,
+           int& argc,
+           char** argv,
+           int& end,
+           bool erase,
+           ::openssl::cli::unknown_mode opt,
+           ::openssl::cli::unknown_mode arg)
+    {
+      ::openssl::cli::argv_scanner s (start, argc, argv, erase);
+      bool r = _parse (s, opt, arg);
+      end = s.end ();
+      return r;
+    }
+
+    bool options::
+    parse (::openssl::cli::scanner& s,
+           ::openssl::cli::unknown_mode opt,
+           ::openssl::cli::unknown_mode arg)
+    {
+      bool r = _parse (s, opt, arg);
+      return r;
+    }
+
+    ::openssl::cli::usage_para options::
+    print_usage (::std::ostream& os, ::openssl::cli::usage_para p)
+    {
+      CLI_POTENTIALLY_UNUSED (os);
+
+      if (p != ::openssl::cli::usage_para::none)
+        os << ::std::endl;
+
+      os << "\033[1mOPTIONS\033[0m" << ::std::endl;
+
+      os << std::endl
+         << "\033[1m--help\033[0m               Print usage information and exit." << ::std::endl;
+
+      os << std::endl
+         << "\033[1m--version\033[0m            Print version and exit." << ::std::endl;
+
+      os << std::endl
+         << "\033[1m-sign\033[0m                Sign data read from \033[1mstdin\033[0m." << ::std::endl;
+
+      os << std::endl
+         << "\033[1m-keyform\033[0m \033[4mform\033[0m        Private key format. The only supported format is \033[1mengine\033[0m." << ::std::endl;
+
+      os << std::endl
+         << "\033[1m-engine\033[0m \033[4mengine\033[0m       Engine to use for the cryptographic operation. The only" << ::std::endl
+         << "                     supported engine is \033[1mpkcs11\033[0m." << ::std::endl;
+
+      os << std::endl
+         << "\033[1m-inkey\033[0m \033[4mlocation\033[0m      Private key location. Its format (file path, URL, etc)" << ::std::endl
+         << "                     depends on the engine used. For the \033[1mpkcs11\033[0m engine it" << ::std::endl
+         << "                     should be a \033[1mPKCS#11\033[0m URL." << ::std::endl;
+
+      os << std::endl
+         << "\033[1m--simulate\033[0m \033[4moutcome\033[0m   Ask the agent to simulate the cryptographic operation" << ::std::endl
+         << "                     instead of performing it for real." << ::std::endl;
+
+      p = ::openssl::cli::usage_para::option;
+
+      return p;
+    }
+
+    typedef
+    std::map<std::string, void (*) (options&, ::openssl::cli::scanner&)>
+    _cli_options_map;
+
+    static _cli_options_map _cli_options_map_;
+
+    struct _cli_options_map_init
+    {
+      _cli_options_map_init ()
+      {
+        _cli_options_map_["--help"] =
+        &::openssl::cli::thunk< options, &options::help_ >;
+        _cli_options_map_["--version"] =
+        &::openssl::cli::thunk< options, &options::version_ >;
+        _cli_options_map_["-sign"] =
+        &::openssl::cli::thunk< options, &options::sign_ >;
+        _cli_options_map_["-keyform"] =
+        &::openssl::cli::thunk< options, string, &options::keyform_,
+          &options::keyform_specified_ >;
+        _cli_options_map_["-engine"] =
+        &::openssl::cli::thunk< options, string, &options::engine_,
+          &options::engine_specified_ >;
+        _cli_options_map_["-inkey"] =
+        &::openssl::cli::thunk< options, string, &options::inkey_,
+          &options::inkey_specified_ >;
+        _cli_options_map_["--simulate"] =
+        &::openssl::cli::thunk< options, simulate_outcome, &options::simulate_,
+          &options::simulate_specified_ >;
+      }
+    };
+
+    static _cli_options_map_init _cli_options_map_init_;
+
+    bool options::
+    _parse (const char* o, ::openssl::cli::scanner& s)
+    {
+      _cli_options_map::const_iterator i (_cli_options_map_.find (o));
+
+      if (i != _cli_options_map_.end ())
+      {
+        (*(i->second)) (*this, s);
+        return true;
+      }
+
+      return false;
+    }
+
+    bool options::
+    _parse (::openssl::cli::scanner& s,
+            ::openssl::cli::unknown_mode opt_mode,
+            ::openssl::cli::unknown_mode arg_mode)
+    {
+      // Can't skip combined flags (--no-combined-flags).
+      //
+      assert (opt_mode != ::openssl::cli::unknown_mode::skip);
+
+      bool r = false;
+      bool opt = true;
+
+      while (s.more ())
+      {
+        const char* o = s.peek ();
+
+        if (std::strcmp (o, "--") == 0)
+        {
+          opt = false;
+          s.skip ();
+          r = true;
+          continue;
+        }
+
+        if (opt)
+        {
+          if (_parse (o, s))
+          {
+            r = true;
+            continue;
+          }
+
+          if (std::strncmp (o, "-", 1) == 0 && o[1] != '\0')
+          {
+            // Handle combined option values.
+            //
+            std::string co;
+            if (const char* v = std::strchr (o, '='))
+            {
+              co.assign (o, 0, v - o);
+              ++v;
+
+              int ac (2);
+              char* av[] =
+              {
+                const_cast<char*> (co.c_str ()),
+                const_cast<char*> (v)
+              };
+
+              ::openssl::cli::argv_scanner ns (0, ac, av);
+
+              if (_parse (co.c_str (), ns))
+              {
+                // Parsed the option but not its value?
+                //
+                if (ns.end () != 2)
+                  throw ::openssl::cli::invalid_value (co, v);
+
+                s.next ();
+                r = true;
+                continue;
+              }
+              else
+              {
+                // Set the unknown option and fall through.
+                //
+                o = co.c_str ();
+              }
+            }
+
+            // Handle combined flags.
+            //
+            char cf[3];
+            {
+              const char* p = o + 1;
+              for (; *p != '\0'; ++p)
+              {
+                if (!((*p >= 'a' && *p <= 'z') ||
+                      (*p >= 'A' && *p <= 'Z') ||
+                      (*p >= '0' && *p <= '9')))
+                  break;
+              }
+
+              if (*p == '\0')
+              {
+                for (p = o + 1; *p != '\0'; ++p)
+                {
+                  std::strcpy (cf, "-");
+                  cf[1] = *p;
+                  cf[2] = '\0';
+
+                  int ac (1);
+                  char* av[] =
+                  {
+                    cf
+                  };
+
+                  ::openssl::cli::argv_scanner ns (0, ac, av);
+
+                  if (!_parse (cf, ns))
+                    break;
+                }
+
+                if (*p == '\0')
+                {
+                  // All handled.
+                  //
+                  s.next ();
+                  r = true;
+                  continue;
+                }
+                else
+                {
+                  // Set the unknown option and fall through.
+                  //
+                  o = cf;
+                }
+              }
+            }
+
+            switch (opt_mode)
+            {
+              case ::openssl::cli::unknown_mode::skip:
+              {
+                s.skip ();
+                r = true;
+                continue;
+              }
+              case ::openssl::cli::unknown_mode::stop:
+              {
+                break;
+              }
+              case ::openssl::cli::unknown_mode::fail:
+              {
+                throw ::openssl::cli::unknown_option (o);
+              }
+            }
+
+            break;
+          }
+        }
+
+        switch (arg_mode)
+        {
+          case ::openssl::cli::unknown_mode::skip:
+          {
+            s.skip ();
+            r = true;
+            continue;
+          }
+          case ::openssl::cli::unknown_mode::stop:
+          {
+            break;
+          }
+          case ::openssl::cli::unknown_mode::fail:
+          {
+            throw ::openssl::cli::unknown_argument (o);
+          }
+        }
+
+        break;
+      }
+
+      return r;
+    }
+  }
+}
+
+namespace openssl
+{
+  ::openssl::cli::usage_para
+  print_openssl_client_usage (::std::ostream& os, ::openssl::cli::usage_para p)
+  {
+    CLI_POTENTIALLY_UNUSED (os);
+
+    if (p != ::openssl::cli::usage_para::none)
+      os << ::std::endl;
+
+    os << "\033[1mSYNOPSIS\033[0m" << ::std::endl
+       << ::std::endl
+       << "\033[1mopenssl-client --help\033[0m" << ::std::endl
+       << "\033[1mopenssl-client --version\033[0m" << ::std::endl
+       << "\033[1mopenssl-client\033[0m pkeyutl [\033[4moptions\033[0m]\033[0m" << ::std::endl
+       << ::std::endl
+       << "\033[1mDESCRIPTION\033[0m" << ::std::endl
+       << ::std::endl
+       << "The \033[1mpkeyutl\033[0m command is a drop-in replacement for the \033[1mopenssl-pkeyutl(1)\033[0m" << ::std::endl
+       << "cryptographic operations. Instead of performing the operations itself, it" << ::std::endl
+       << "forwards the request to an OpenSSL key agent that keeps the private key" << ::std::endl
+       << "unlocked for the session." << ::std::endl
+       << ::std::endl
+       << "Currently, data signing with a private key stored in a \033[1mPKCS#11\033[0m token is the" << ::std::endl
+       << "only supported arrangement. This limits the \033[1mopenssl-pkeyutl(1)\033[0m options and" << ::std::endl
+       << "values to the following usage:" << ::std::endl
+       << ::std::endl
+       << "$ openssl-client pkeyutl -sign -keyform engine -engine pkcs11 -inkey pkcs11:..." << ::std::endl
+       << ::std::endl
+       << "This command reads data from \033[1mstdin\033[0m, asks \033[1mopenssl-agent-pkcs11(1)\033[0m to sign it" << ::std::endl
+       << "using the specified unlocked private key, and prints the resulting signature to" << ::std::endl
+       << "\033[1mstdout\033[0m." << ::std::endl
+       << ::std::endl
+       << "Note that the \033[1mrsautl\033[0m command is also accepted for backwards compatibility." << ::std::endl
+       << ::std::endl
+       << "The command can be simulated without actually performing any cryptographic" << ::std::endl
+       << "operations. If the \033[1m--simulate\033[0m option is specified with the \033[1msuccess\033[0m outcome," << ::std::endl
+       << "then the command prints a dummy signature produced by the agent and exits with" << ::std::endl
+       << "zero status. The \033[1mfailure\033[0m outcome causes it to print the diagnostics to \033[1mstderr\033[0m" << ::std::endl
+       << "and exit with non-zero status. This mode is mostly useful for OpenSSL key" << ::std::endl
+       << "agents testing." << ::std::endl;
+
+    p = ::openssl::client::options::print_usage (os, ::openssl::cli::usage_para::text);
+
+    if (p != ::openssl::cli::usage_para::none)
+      os << ::std::endl;
+
+    os << "\033[1mENVIRONMENT\033[0m" << ::std::endl
+       << ::std::endl
+       << "If \033[1m-engine\033[0m is \033[1mpkcs11\033[0m, then the \033[1mOPENSSL_AGENT_PKCS11_SOCK\033[0m environment variable" << ::std::endl
+       << "should be set to the Unix-domain socket of the \033[1mopenssl-agent-pkcs11(1)\033[0m daemon." << ::std::endl;
+
+    os << std::endl
+       << "\033[1mEXIT STATUS\033[0m" << ::std::endl
+       << ::std::endl
+       << "Non-zero exit status is returned in case of an error." << ::std::endl;
+
+    p = ::openssl::cli::usage_para::text;
+
+    return p;
+  }
+}
+
+// Begin epilogue.
+//
+//
+// End epilogue.
+
diff --git a/openssl/client/options.hxx b/openssl/client/options.hxx
new file mode 100644
index 0000000..5b61682
--- /dev/null
+++ b/openssl/client/options.hxx
@@ -0,0 +1,150 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+#ifndef OPENSSL_CLIENT_OPTIONS_HXX
+#define OPENSSL_CLIENT_OPTIONS_HXX
+
+// Begin prologue.
+//
+//
+// End prologue.
+
+#include <openssl/options.hxx>
+
+namespace openssl
+{
+  namespace client
+  {
+    class options
+    {
+      public:
+      options ();
+
+      // Return true if anything has been parsed.
+      //
+      bool
+      parse (int& argc,
+             char** argv,
+             bool erase = false,
+             ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+             ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+      bool
+      parse (int start,
+             int& argc,
+             char** argv,
+             bool erase = false,
+             ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+             ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+      bool
+      parse (int& argc,
+             char** argv,
+             int& end,
+             bool erase = false,
+             ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+             ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+      bool
+      parse (int start,
+             int& argc,
+             char** argv,
+             int& end,
+             bool erase = false,
+             ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+             ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+      bool
+      parse (::openssl::cli::scanner&,
+             ::openssl::cli::unknown_mode option = ::openssl::cli::unknown_mode::fail,
+             ::openssl::cli::unknown_mode argument = ::openssl::cli::unknown_mode::stop);
+
+      // Option accessors.
+      //
+      const bool&
+      help () const;
+
+      const bool&
+      version () const;
+
+      const bool&
+      sign () const;
+
+      const string&
+      keyform () const;
+
+      bool
+      keyform_specified () const;
+
+      const string&
+      engine () const;
+
+      bool
+      engine_specified () const;
+
+      const string&
+      inkey () const;
+
+      bool
+      inkey_specified () const;
+
+      const simulate_outcome&
+      simulate () const;
+
+      bool
+      simulate_specified () const;
+
+      // Print usage information.
+      //
+      static ::openssl::cli::usage_para
+      print_usage (::std::ostream&,
+                   ::openssl::cli::usage_para = ::openssl::cli::usage_para::none);
+
+      // Implementation details.
+      //
+      protected:
+      bool
+      _parse (const char*, ::openssl::cli::scanner&);
+
+      private:
+      bool
+      _parse (::openssl::cli::scanner&,
+              ::openssl::cli::unknown_mode option,
+              ::openssl::cli::unknown_mode argument);
+
+      public:
+      bool help_;
+      bool version_;
+      bool sign_;
+      string keyform_;
+      bool keyform_specified_;
+      string engine_;
+      bool engine_specified_;
+      string inkey_;
+      bool inkey_specified_;
+      simulate_outcome simulate_;
+      bool simulate_specified_;
+    };
+  }
+}
+
+// Print page usage information.
+//
+namespace openssl
+{
+  ::openssl::cli::usage_para
+  print_openssl_client_usage (::std::ostream&,
+                              ::openssl::cli::usage_para = ::openssl::cli::usage_para::none);
+}
+
+#include <openssl/client/options.ixx>
+
+// Begin epilogue.
+//
+//
+// End epilogue.
+
+#endif // OPENSSL_CLIENT_OPTIONS_HXX
diff --git a/openssl/client/options.ixx b/openssl/client/options.ixx
new file mode 100644
index 0000000..2ecad17
--- /dev/null
+++ b/openssl/client/options.ixx
@@ -0,0 +1,90 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+// Begin prologue.
+//
+//
+// End prologue.
+
+namespace openssl
+{
+  namespace client
+  {
+    // options
+    //
+
+    inline const bool& options::
+    help () const
+    {
+      return this->help_;
+    }
+
+    inline const bool& options::
+    version () const
+    {
+      return this->version_;
+    }
+
+    inline const bool& options::
+    sign () const
+    {
+      return this->sign_;
+    }
+
+    inline const string& options::
+    keyform () const
+    {
+      return this->keyform_;
+    }
+
+    inline bool options::
+    keyform_specified () const
+    {
+      return this->keyform_specified_;
+    }
+
+    inline const string& options::
+    engine () const
+    {
+      return this->engine_;
+    }
+
+    inline bool options::
+    engine_specified () const
+    {
+      return this->engine_specified_;
+    }
+
+    inline const string& options::
+    inkey () const
+    {
+      return this->inkey_;
+    }
+
+    inline bool options::
+    inkey_specified () const
+    {
+      return this->inkey_specified_;
+    }
+
+    inline const simulate_outcome& options::
+    simulate () const
+    {
+      return this->simulate_;
+    }
+
+    inline bool options::
+    simulate_specified () const
+    {
+      return this->simulate_specified_;
+    }
+  }
+}
+
+// Begin epilogue.
+//
+//
+// End epilogue.
diff --git a/openssl/options.cxx b/openssl/options.cxx
new file mode 100644
index 0000000..2a35a7c
--- /dev/null
+++ b/openssl/options.cxx
@@ -0,0 +1,434 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+// Begin prologue.
+//
+#include <openssl/types-parsers.hxx>
+//
+// End prologue.
+
+#include <openssl/options.hxx>
+
+#include <map>
+#include <set>
+#include <string>
+#include <vector>
+#include <utility>
+#include <ostream>
+#include <sstream>
+#include <cstring>
+
+namespace openssl
+{
+  namespace cli
+  {
+    // unknown_option
+    //
+    unknown_option::
+    ~unknown_option () noexcept
+    {
+    }
+
+    void unknown_option::
+    print (::std::ostream& os) const
+    {
+      os << "unknown option '" << option ().c_str () << "'";
+    }
+
+    const char* unknown_option::
+    what () const noexcept
+    {
+      return "unknown option";
+    }
+
+    // unknown_argument
+    //
+    unknown_argument::
+    ~unknown_argument () noexcept
+    {
+    }
+
+    void unknown_argument::
+    print (::std::ostream& os) const
+    {
+      os << "unknown argument '" << argument ().c_str () << "'";
+    }
+
+    const char* unknown_argument::
+    what () const noexcept
+    {
+      return "unknown argument";
+    }
+
+    // missing_value
+    //
+    missing_value::
+    ~missing_value () noexcept
+    {
+    }
+
+    void missing_value::
+    print (::std::ostream& os) const
+    {
+      os << "missing value for option '" << option ().c_str () << "'";
+    }
+
+    const char* missing_value::
+    what () const noexcept
+    {
+      return "missing option value";
+    }
+
+    // invalid_value
+    //
+    invalid_value::
+    ~invalid_value () noexcept
+    {
+    }
+
+    void invalid_value::
+    print (::std::ostream& os) const
+    {
+      os << "invalid value '" << value ().c_str () << "' for option '"
+         << option ().c_str () << "'";
+
+      if (!message ().empty ())
+        os << ": " << message ().c_str ();
+    }
+
+    const char* invalid_value::
+    what () const noexcept
+    {
+      return "invalid option value";
+    }
+
+    // eos_reached
+    //
+    void eos_reached::
+    print (::std::ostream& os) const
+    {
+      os << what ();
+    }
+
+    const char* eos_reached::
+    what () const noexcept
+    {
+      return "end of argument stream reached";
+    }
+
+    // scanner
+    //
+    scanner::
+    ~scanner ()
+    {
+    }
+
+    // argv_scanner
+    //
+    bool argv_scanner::
+    more ()
+    {
+      return i_ < argc_;
+    }
+
+    const char* argv_scanner::
+    peek ()
+    {
+      if (i_ < argc_)
+        return argv_[i_];
+      else
+        throw eos_reached ();
+    }
+
+    const char* argv_scanner::
+    next ()
+    {
+      if (i_ < argc_)
+      {
+        const char* r (argv_[i_]);
+
+        if (erase_)
+        {
+          for (int i (i_ + 1); i < argc_; ++i)
+            argv_[i - 1] = argv_[i];
+
+          --argc_;
+          argv_[argc_] = 0;
+        }
+        else
+          ++i_;
+
+        ++start_position_;
+        return r;
+      }
+      else
+        throw eos_reached ();
+    }
+
+    void argv_scanner::
+    skip ()
+    {
+      if (i_ < argc_)
+      {
+        ++i_;
+        ++start_position_;
+      }
+      else
+        throw eos_reached ();
+    }
+
+    std::size_t argv_scanner::
+    position ()
+    {
+      return start_position_;
+    }
+
+    template <typename X>
+    struct parser
+    {
+      static void
+      parse (X& x, bool& xs, scanner& s)
+      {
+        using namespace std;
+
+        const char* o (s.next ());
+        if (s.more ())
+        {
+          string v (s.next ());
+          istringstream is (v);
+          if (!(is >> x && is.peek () == istringstream::traits_type::eof ()))
+            throw invalid_value (o, v);
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <>
+    struct parser<bool>
+    {
+      static void
+      parse (bool& x, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          const char* v (s.next ());
+
+          if (std::strcmp (v, "1")    == 0 ||
+              std::strcmp (v, "true") == 0 ||
+              std::strcmp (v, "TRUE") == 0 ||
+              std::strcmp (v, "True") == 0)
+            x = true;
+          else if (std::strcmp (v, "0")     == 0 ||
+                   std::strcmp (v, "false") == 0 ||
+                   std::strcmp (v, "FALSE") == 0 ||
+                   std::strcmp (v, "False") == 0)
+            x = false;
+          else
+            throw invalid_value (o, v);
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <>
+    struct parser<std::string>
+    {
+      static void
+      parse (std::string& x, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+          x = s.next ();
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename X>
+    struct parser<std::pair<X, std::size_t> >
+    {
+      static void
+      parse (std::pair<X, std::size_t>& x, bool& xs, scanner& s)
+      {
+        x.second = s.position ();
+        parser<X>::parse (x.first, xs, s);
+      }
+    };
+
+    template <typename X>
+    struct parser<std::vector<X> >
+    {
+      static void
+      parse (std::vector<X>& c, bool& xs, scanner& s)
+      {
+        X x;
+        bool dummy;
+        parser<X>::parse (x, dummy, s);
+        c.push_back (x);
+        xs = true;
+      }
+    };
+
+    template <typename X, typename C>
+    struct parser<std::set<X, C> >
+    {
+      static void
+      parse (std::set<X, C>& c, bool& xs, scanner& s)
+      {
+        X x;
+        bool dummy;
+        parser<X>::parse (x, dummy, s);
+        c.insert (x);
+        xs = true;
+      }
+    };
+
+    template <typename K, typename V, typename C>
+    struct parser<std::map<K, V, C> >
+    {
+      static void
+      parse (std::map<K, V, C>& m, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          std::size_t pos (s.position ());
+          std::string ov (s.next ());
+          std::string::size_type p = ov.find ('=');
+
+          K k = K ();
+          V v = V ();
+          std::string kstr (ov, 0, p);
+          std::string vstr (ov, (p != std::string::npos ? p + 1 : ov.size ()));
+
+          int ac (2);
+          char* av[] =
+          {
+            const_cast<char*> (o),
+            0
+          };
+
+          bool dummy;
+          if (!kstr.empty ())
+          {
+            av[1] = const_cast<char*> (kstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<K>::parse (k, dummy, s);
+          }
+
+          if (!vstr.empty ())
+          {
+            av[1] = const_cast<char*> (vstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<V>::parse (v, dummy, s);
+          }
+
+          m[k] = v;
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename K, typename V, typename C>
+    struct parser<std::multimap<K, V, C> >
+    {
+      static void
+      parse (std::multimap<K, V, C>& m, bool& xs, scanner& s)
+      {
+        const char* o (s.next ());
+
+        if (s.more ())
+        {
+          std::size_t pos (s.position ());
+          std::string ov (s.next ());
+          std::string::size_type p = ov.find ('=');
+
+          K k = K ();
+          V v = V ();
+          std::string kstr (ov, 0, p);
+          std::string vstr (ov, (p != std::string::npos ? p + 1 : ov.size ()));
+
+          int ac (2);
+          char* av[] =
+          {
+            const_cast<char*> (o),
+            0
+          };
+
+          bool dummy;
+          if (!kstr.empty ())
+          {
+            av[1] = const_cast<char*> (kstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<K>::parse (k, dummy, s);
+          }
+
+          if (!vstr.empty ())
+          {
+            av[1] = const_cast<char*> (vstr.c_str ());
+            argv_scanner s (0, ac, av, false, pos);
+            parser<V>::parse (v, dummy, s);
+          }
+
+          m.insert (typename std::multimap<K, V, C>::value_type (k, v));
+        }
+        else
+          throw missing_value (o);
+
+        xs = true;
+      }
+    };
+
+    template <typename X, typename T, T X::*M>
+    void
+    thunk (X& x, scanner& s)
+    {
+      parser<T>::parse (x.*M, s);
+    }
+
+    template <typename X, bool X::*M>
+    void
+    thunk (X& x, scanner& s)
+    {
+      s.next ();
+      x.*M = true;
+    }
+
+    template <typename X, typename T, T X::*M, bool X::*S>
+    void
+    thunk (X& x, scanner& s)
+    {
+      parser<T>::parse (x.*M, x.*S, s);
+    }
+  }
+}
+
+#include <map>
+
+namespace openssl
+{
+}
+
+// Begin epilogue.
+//
+//
+// End epilogue.
+
diff --git a/openssl/options.hxx b/openssl/options.hxx
new file mode 100644
index 0000000..458a4e9
--- /dev/null
+++ b/openssl/options.hxx
@@ -0,0 +1,285 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+#ifndef OPENSSL_OPTIONS_HXX
+#define OPENSSL_OPTIONS_HXX
+
+// Begin prologue.
+//
+//
+// End prologue.
+
+#include <iosfwd>
+#include <string>
+#include <cstddef>
+#include <exception>
+
+#ifndef CLI_POTENTIALLY_UNUSED
+#  if defined(_MSC_VER) || defined(__xlC__)
+#    define CLI_POTENTIALLY_UNUSED(x) (void*)&x
+#  else
+#    define CLI_POTENTIALLY_UNUSED(x) (void)x
+#  endif
+#endif
+
+namespace openssl
+{
+  namespace cli
+  {
+    class usage_para
+    {
+      public:
+      enum value
+      {
+        none,
+        text,
+        option
+      };
+
+      usage_para (value);
+
+      operator value () const 
+      {
+        return v_;
+      }
+
+      private:
+      value v_;
+    };
+
+    class unknown_mode
+    {
+      public:
+      enum value
+      {
+        skip,
+        stop,
+        fail
+      };
+
+      unknown_mode (value);
+
+      operator value () const 
+      {
+        return v_;
+      }
+
+      private:
+      value v_;
+    };
+
+    // Exceptions.
+    //
+
+    class exception: public std::exception
+    {
+      public:
+      virtual void
+      print (::std::ostream&) const = 0;
+    };
+
+    ::std::ostream&
+    operator<< (::std::ostream&, const exception&);
+
+    class unknown_option: public exception
+    {
+      public:
+      virtual
+      ~unknown_option () noexcept;
+
+      unknown_option (const std::string& option);
+
+      const std::string&
+      option () const;
+
+      virtual void
+      print (::std::ostream&) const;
+
+      virtual const char*
+      what () const noexcept;
+
+      private:
+      std::string option_;
+    };
+
+    class unknown_argument: public exception
+    {
+      public:
+      virtual
+      ~unknown_argument () noexcept;
+
+      unknown_argument (const std::string& argument);
+
+      const std::string&
+      argument () const;
+
+      virtual void
+      print (::std::ostream&) const;
+
+      virtual const char*
+      what () const noexcept;
+
+      private:
+      std::string argument_;
+    };
+
+    class missing_value: public exception
+    {
+      public:
+      virtual
+      ~missing_value () noexcept;
+
+      missing_value (const std::string& option);
+
+      const std::string&
+      option () const;
+
+      virtual void
+      print (::std::ostream&) const;
+
+      virtual const char*
+      what () const noexcept;
+
+      private:
+      std::string option_;
+    };
+
+    class invalid_value: public exception
+    {
+      public:
+      virtual
+      ~invalid_value () noexcept;
+
+      invalid_value (const std::string& option,
+                     const std::string& value,
+                     const std::string& message = std::string ());
+
+      const std::string&
+      option () const;
+
+      const std::string&
+      value () const;
+
+      const std::string&
+      message () const;
+
+      virtual void
+      print (::std::ostream&) const;
+
+      virtual const char*
+      what () const noexcept;
+
+      private:
+      std::string option_;
+      std::string value_;
+      std::string message_;
+    };
+
+    class eos_reached: public exception
+    {
+      public:
+      virtual void
+      print (::std::ostream&) const;
+
+      virtual const char*
+      what () const noexcept;
+    };
+
+    // Command line argument scanner interface.
+    //
+    // The values returned by next() are guaranteed to be valid
+    // for the two previous arguments up until a call to a third
+    // peek() or next().
+    //
+    // The position() function returns a monotonically-increasing
+    // number which, if stored, can later be used to determine the
+    // relative position of the argument returned by the following
+    // call to next(). Note that if multiple scanners are used to
+    // extract arguments from multiple sources, then the end
+    // position of the previous scanner should be used as the
+    // start position of the next.
+    //
+    class scanner
+    {
+      public:
+      virtual
+      ~scanner ();
+
+      virtual bool
+      more () = 0;
+
+      virtual const char*
+      peek () = 0;
+
+      virtual const char*
+      next () = 0;
+
+      virtual void
+      skip () = 0;
+
+      virtual std::size_t
+      position () = 0;
+    };
+
+    class argv_scanner: public scanner
+    {
+      public:
+      argv_scanner (int& argc,
+                    char** argv,
+                    bool erase = false,
+                    std::size_t start_position = 0);
+
+      argv_scanner (int start,
+                    int& argc,
+                    char** argv,
+                    bool erase = false,
+                    std::size_t start_position = 0);
+
+      int
+      end () const;
+
+      virtual bool
+      more ();
+
+      virtual const char*
+      peek ();
+
+      virtual const char*
+      next ();
+
+      virtual void
+      skip ();
+
+      virtual std::size_t
+      position ();
+
+      protected:
+      std::size_t start_position_;
+      int i_;
+      int& argc_;
+      char** argv_;
+      bool erase_;
+    };
+
+    template <typename X>
+    struct parser;
+  }
+}
+
+#include <openssl/types.hxx>
+
+namespace openssl
+{
+}
+
+#include <openssl/options.ixx>
+
+// Begin epilogue.
+//
+//
+// End epilogue.
+
+#endif // OPENSSL_OPTIONS_HXX
diff --git a/openssl/options.ixx b/openssl/options.ixx
new file mode 100644
index 0000000..df92cf8
--- /dev/null
+++ b/openssl/options.ixx
@@ -0,0 +1,159 @@
+// -*- C++ -*-
+//
+// This file was generated by CLI, a command line interface
+// compiler for C++.
+//
+
+// Begin prologue.
+//
+//
+// End prologue.
+
+#include <cassert>
+
+namespace openssl
+{
+  namespace cli
+  {
+    // usage_para
+    //
+    inline usage_para::
+    usage_para (value v)
+    : v_ (v)
+    {
+    }
+
+    // unknown_mode
+    //
+    inline unknown_mode::
+    unknown_mode (value v)
+    : v_ (v)
+    {
+    }
+
+    // exception
+    //
+    inline ::std::ostream&
+    operator<< (::std::ostream& os, const exception& e)
+    {
+      e.print (os);
+      return os;
+    }
+
+    // unknown_option
+    //
+    inline unknown_option::
+    unknown_option (const std::string& option)
+    : option_ (option)
+    {
+    }
+
+    inline const std::string& unknown_option::
+    option () const
+    {
+      return option_;
+    }
+
+    // unknown_argument
+    //
+    inline unknown_argument::
+    unknown_argument (const std::string& argument)
+    : argument_ (argument)
+    {
+    }
+
+    inline const std::string& unknown_argument::
+    argument () const
+    {
+      return argument_;
+    }
+
+    // missing_value
+    //
+    inline missing_value::
+    missing_value (const std::string& option)
+    : option_ (option)
+    {
+    }
+
+    inline const std::string& missing_value::
+    option () const
+    {
+      return option_;
+    }
+
+    // invalid_value
+    //
+    inline invalid_value::
+    invalid_value (const std::string& option,
+                   const std::string& value,
+                   const std::string& message)
+    : option_ (option),
+      value_ (value),
+      message_ (message)
+    {
+    }
+
+    inline const std::string& invalid_value::
+    option () const
+    {
+      return option_;
+    }
+
+    inline const std::string& invalid_value::
+    value () const
+    {
+      return value_;
+    }
+
+    inline const std::string& invalid_value::
+    message () const
+    {
+      return message_;
+    }
+
+    // argv_scanner
+    //
+    inline argv_scanner::
+    argv_scanner (int& argc,
+                  char** argv,
+                  bool erase,
+                  std::size_t sp)
+    : start_position_ (sp + 1),
+      i_ (1),
+      argc_ (argc),
+      argv_ (argv),
+      erase_ (erase)
+    {
+    }
+
+    inline argv_scanner::
+    argv_scanner (int start,
+                  int& argc,
+                  char** argv,
+                  bool erase,
+                  std::size_t sp)
+    : start_position_ (sp + static_cast<std::size_t> (start)),
+      i_ (start),
+      argc_ (argc),
+      argv_ (argv),
+      erase_ (erase)
+    {
+    }
+
+    inline int argv_scanner::
+    end () const
+    {
+      return i_;
+    }
+  }
+}
+
+namespace openssl
+{
+}
+
+// Begin epilogue.
+//
+//
+// End epilogue.