ngIRCd Release 25

Platforms.txt: Add and update systems
- Update x86_64/apple/darwin16.5.0 (Apple clang 8.1) - Add x86_64/apple/darwin17.7.0 (Apple clang 10.0) - Add x86_64/apple/darwin18.2.0 (Apple clang 10.0) - Add x86_64/unknown/haiku (gcc 7.3) - Update x86_64/pc/linux-gnu (gcc 6.3.0)
2025-09-24 21:14:05 +00:00 · 2019-01-23 23:15:02 +01:00 · 2019-01-23 22:45:07 +01:00 · 2019-01-03 14:06:01 +01:00 · 2019-01-02 00:10:06 +01:00 · 2018-11-28 14:13:09 +01:00
77 changed files with 1893 additions and 994 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -0,0 +1,20 @@
+# ngIRCd -- The Next Generation IRC Daemon
+# Copyright (c)2001-2016 Alexander Barton (alex@barton.de) and Contributors.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+# Please read the file COPYING, README and AUTHORS for more information.
+
+# .editorconfig: Editor settings, see <http://editorconfig.org>.
+
+root = true
+
+[*]
+indent_style = tab
+indent_size = 8
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
--- a/.gitignore
+++ b/.gitignore
@@ -56,6 +56,7 @@ src/testsuite/ngircd-test2.log
 src/testsuite/ngircd-test2.motd
 src/testsuite/opless-channel-test
 src/testsuite/server-link-test
+src/testsuite/server-login-test
 src/testsuite/T-ngircd1
 src/testsuite/T-ngircd1.exe
 src/testsuite/T-ngircd2
--- a/.mailmap
+++ b/.mailmap
@@ -11,4 +11,6 @@ Dana Dahlstrom <dana+ngIRCd@cs.ucsd.edu> <dana+70@cs.ucsd.edu>

 DNS <dns@rbose.org>

+Götz Hoffart <goetz@hoffart.de>
+
 LucentW <lucent@zebes.info> <LucentW@users.noreply.github.com>
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,7 +1,15 @@
 language: c
-before_install:
-  - sudo apt-get update -qq
-  - sudo apt-get install -qq libident-dev libpam0g-dev libssl-dev libwrap0-dev zlib1g-dev expect telnet
+sudo: false
+addons:
+  apt:
+    packages:
+    - libident-dev
+    - libpam0g-dev
+    - libssl-dev
+    - libwrap0-dev
+    - zlib1g-dev
+    - expect
+    - telnet
 compiler:
  - gcc
  - clang
--- a/20
+++ b/20
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/

-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

@@ -13,7 +13,7 @@ Note:
 If you have comments, patches or something else, please feel free to post
 a mail to the ngIRCd mailing list: <ngircd-ml@ngircd.barton.de> (please see
 <http://ngircd.barton.de/support.php> for details) or join the ngIRCd IRC
-channel: <irc://irc.barton.de/ngircd>.
+channel "#ngircd" on irc.barton.de: <irc://irc.barton.de/ngircd>.

 Don't mail the people listed here directly, if possible!

@@ -29,40 +29,46 @@ Contributors
 Ali Shemiran <ashemira@ucsd.edu>
 Ask Bjørn Hansen <ask@develooper.com>
 Benjamin Pineau <ben@zouh.org>
+Bernd Kuhls <bernd.kuhls@t-online.de>
 Brandon Beresini <beresini@google.com>
 Brett Smith <brett@w3.org>
 Brian Collins <bricollins@gmail.com>
 Bryan Caldwell <bcaldwel@ucsd.edu>
+Christian Aistleitner <christian@quelltextlich.at>
 Christoph Biedl <ngircd.anoy@manchmal.in-ulm.de>
-DNS <dns@rbose.org>
 Dana Dahlstrom <dana+ngIRCd@cs.ucsd.edu>
 David Kingston <deathking1337@aim.com>
+DNS <dns@rbose.org>
 Eric Grunow <egrunow@ucsd.edu>
 Federico G. Schwindt <fgsch@lodoss.net>
 Gabor Adam Toth <tg@tgbit.net>
-Goetz Hoffart <goetz@hoffart.de>
+Götz Hoffart <goetz@hoffart.de>
 Ian Chard <ian@chard.org>
 Ilja Osthoff <i.osthoff@gmx.net>
+ItsOnlyBinary <ItsOnlyBinary@users.noreply.github.com>
+James Lu <james@overdrivenetworks.com>
 Jari Aalto <jari.aalto@cante.net>
 LucentW <lucent@zebes.info>
 Mantas Mikulėnas <grawity@gmail.com>
 Neale Pickett <neale@woozle.org>
 Peter Powell <petpow@saberuk.com>
 Rolf Eike Beer <eike@sf-mail.de>
+Rosen Penev <rosenp@gmail.com>
 Roy Sindre Norangshol <roy.sindre@norangshol.no>
 Scott Perry <scperry@ucsd.edu>
 Sean Reifschneider <jafo-rpms@tummy.com>
 Sebastian Köhler <sebkoehler@whoami.org.uk>
+shankari <shankari@eecs.berkeley.edu>
 Tassilo Schweyer <dev@welterde.de>
 Tom Ryder <tom@sanctum.geek.nz>
 Unit 193 <unit193@ubuntu.com>
 William Pitcock <nenolod@dereferenced.org>
-Yecheng Fu <cofyc.jackson@gmail.com>
 xor <xorboy@gmail.com>
+Yecheng Fu <cofyc.jackson@gmail.com>


 Code snippets
 ~~~~~~~~~~~~~
-J. Kercheval: pattern matching functions
-Patrick Powell <papowell@astart.com>: snprintf()-function
 Andrew Tridgell & Martin Pool: strl{cpy|cat}()-functions
+John Kercheval: pattern matching functions
+Patrick Powell <papowell@astart.com>: snprintf()-function
--- a/188
+++ b/188
@@ -2,14 +2,162 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/

-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

                               -- ChangeLog --


-ngIRCd 23
+ngIRCd 25 (2019-01-23)
+
+  - Fix documentation of MotdPhrase length, which actually is 126 characters:
+    update sample configuration file as well as the man page. Thanks to
+    shankari <shankari@eecs.berkeley.edu>.
+    Closes #254.
+  - Implement new configuration option "MaxPenaltyTime", which configures the
+    maximum penalty time increase in seconds, per penalty event. Set to -1 for
+    no limit (the default), 0 to disable penalties altogether. ngIRCd doesn't
+    use penalty increases higher than 2 seconds during normal operation, so
+    values higher than 1 rarely make sense.
+    Disabling (or reducing) penalties can greatly speed up "make check" runs
+    for example, see below, but are mostly a debugging feature and normally
+    not meant to be used on production systems!
+    Some example timings running "make check" from my macOS workstation:
+     - MaxPenaltyTime not set: 4:41,79s
+     - "MaxPenaltyTime = 1":   3:14,71s
+     - "MaxPenaltyTime = 0":     25,46s
+    Closes #249 and #251.
+  - Fix compilation without deprecated OpenSSL APIs. Thanks to Rosen Penev
+    <rosenp@gmail.com> for the patch!
+    Closes #252.
+  - Update Xcode project for latest Xcode version (10.0)
+  - Fix some compiler warnings of Apple Xcode/Clang
+  - Allow a 5th parameter in WEBIRC. Thanks to "ItsOnlyBinary".
+    Closes #247.
+  - Update some more documentation files and source code comments.
+  - Platforms.txt: Add and update systems.
+
+  ngIRCd 25~rc1 (2018-08-11)
+  - Update config.guess (2018-03-08) and config.sub (2018-03-08) files.
+  - Correctly retry to establish an outgoing connections when forking of the
+    resolver sub-process failed (for example because of lack of free memory).
+    Until now, such a connection was never retried once this error was hit.
+    Thanks to Robert Obermeier for reporting this bug!
+    Closes #243.
+  - Fix a "use after free" bug which can be triggered on a newly established
+    connection when the daemon handles an ERROR command received from the peer
+    during client login. Thanks a lot to Joseph Bisch <joseph.bisch@gmail.com>
+    for discovering and reporting this issue!
+  - Only send TOPIC updates to a channel when the topic actually changed:
+    This prevents the channel from becoming flooded by unnecessary TOPIC update
+    messages, that can happen when IRC services try to enforce a certain topic
+    but which is already set (at least on the local server), for example.
+    Therefore still forward it to all servers, but don't inform local clients
+    (still update setter and timestamp information, though).
+  - Update Xcode project for latest Xcode version (9.2). This includes adding
+    missing and deleting obsolete file references.
+  - Handle user mode "C" ("Only users that share a channel are allowed to send
+    messages") like user mode "b" ("block private messages and notices"): allow
+    messages from servers, services, and IRC Operators, too. Change proposed by
+    "wowaname" back in 2015 in #ngircd, thanks!
+  - Fix some compiler warnings.
+  - Add contrib/ngircd.logcheck: Some sample logcheck(8) rules.
+  - Allow IRC Ops and remote servers to KILL service clients: such clients
+    behave like regular users, therefore IRC operators and servers should be
+    able to KILL them: for example to resolve nick collisions.
+    Closes #242.
+  - Don't forward KILLs to other servers if they've been blocked locally:
+    This prevents clients from killing IRC services, for example.
+    Closes #238 and #239.
+  - Fix a cross-compiler issue related to the Get_Error() function.
+    Closes #240 and #241.
+  - Update ./doc/Services.txt, enhance configuration examples.
+
+ngIRCd 24 (2017-01-20)
+
+  - Make sure that ./contrib/platformtest.sh aborts when ./autogen.sh fails.
+  - Update config.guess (2016-10-02) and config.sub (2016-11-04) files.
+  - Build Debian packages with OpenSSL instead of GnuTLS: OpenSSL allows
+    to reload used certificates on runtime for example (which is very
+    useful when using Let's Encrypt), and therefore is preferred. And
+    explicitly specify the "source format".
+  - Fix handling of connection pool allocation and enlargement: up to now,
+    the daemon only enlarged its connection pool when accepting new incoming
+    client or server connections, not when establishing new outgoing server
+    links, which could lead to problems when hitting the configured limit,
+    see "MaxConnections". Thanks to Lukas Braun (k00mi) for reporting this!
+    Closes #231.
+
+  ngIRCd 24~rc1 (2017-01-07)
+  - Enhance systemd service file, and install it in Debian package.
+  - Update configuration of Debian package.
+  - Log privilege violations and failed OPER request with log level "error"
+    and send it to the "&SERVER" channel, too.
+  - Immediately shut down connection when receiving an "ERROR" command,
+    don't wait for the peer to close the connection. This allows the daemon
+    to forward the received "ERROR" message in the network, instead of the
+    very generic "client closed connection" message.
+  - Fix sending of entry duration (no negative values!) when synchronizing
+    "x-lines" (G-LINES).
+  - List expiration (G-LINES): use same log level as when setting, and log
+    this event to the &SERVER channel, too.
+  - Explicitly forbid remote servers to modify "x-lines" (G-LINES) when the
+    "AllowRemoteOper" configuration option isn't set, even when the command
+    seems to originate from the remote server itself: this prevents GLINE's
+    to become set during server handshake in this case (what wouldn't be
+    possible during regular runtime when a remote IRC Op sends the command)
+    and what can't be undone by IRC Ops later on (because of the missing
+    "AllowRemoteOper" option) ...
+  - Make scripts and init-files in ./contrib executable.
+  - Fix building ngIRCd with OpenSSL 1.1. Thanks to Christoph Biedl
+    <ngircd.anoy@manchmal.in-ulm.de> for the patch!
+  - Fix code indentation warnings of gcc 6.2.
+  - Update config.guess (2016-04-02) and config.sub (2016-03-30) files.
+  - Fix warnings of the "shellcheck" linter in autogen.sh, contrib/ngindent
+    and contrib/platformtest.sh.
+  - Update Xcode project for latest Xcode version (8.0), and fix "duplicate
+    symbols" error messages when building (linking) the binary.
+  - Add "Documentation" variables to systemd configuration files.
+  - Make sure that SYSCONFDIR is always set, which can be handy when
+    using source code linters when ./configure hasn't been run already.
+  - Add the new "PAMServiceName" configuration option to specify the name
+    used as PAM service name. This setting allows to run multiple ngIRCd
+    instances with different PAM configurations for each instance.
+    Thanks to Christian Aistleitner <christian@quelltextlich.at> for the
+    patch, closes #226.
+  - Add an ".editorconfig" file to the project.
+  - Travis-CI: use "container-based infrastructure".
+  - Limit the number of message targets, and suppress duplicates: This
+    prevents an user from flooding the server using commands like this:
+    "PRIVMSG nick1,nick1,nick1,...".
+    Duplicate targets are suppressed silently (channels and clients).
+    In addition, the maximum number of targets per PRIVMSG, NOTICE, ...
+    command are limited to MAX_HNDL_TARGETS (25). If there are more, the
+    daemon sends the new 407 (ERR_TOOMANYTARGETS_MSG) numeric, containing
+    the first target that hasn't been handled any more. Closes #187.
+  - Test suite: Add new test for server-server logins.
+  - contrib/ngindent: Fix shebang line.
+  - Make contrib/platformtest.sh script more portable, and only show
+    "runs=Y" when the test suite really has been passed successfully.
+  - Code cleanup in the NJON handler and the function killing clients as
+    well as the function sending messages to a "mask" (cleaner code, more
+    fault tolerant, better code comments).
+  - Update and enhance documentation: README file, doc/Platforms.txt,
+    doc/Modes.txt, doc/Commands.txt, doc/PAM.txt.
+  - Fix NJOIN not propagating "half ops" status: ngIRCd tested for the wrong
+    prefix of "half ops" when processing NJOIN commands and therefore never
+    classified a remote user as "half op".
+    Thanks to wowaname for pointing this out on #ngircd!
+
+ngIRCd 23 (2015-11-16)
+
+  - Explicitly cast time_t to long when printing it out: this prevents
+    wrong sized data types on platforms where time_t doesn't equal a
+    long any more, for example on OpenBSD (which would result in garbled
+    output on those platforms).
+  - contrib/Debian/changelog: Fix email address.
+  - Documentation: Spelling fixes; update doc/Platforms.txt.

  ngIRCd 23~rc1 (2015-09-06)
  - Add ".clang_complete" file, which is used by the "linter-clang" package
@@ -29,7 +177,7 @@ ngIRCd 23
  - Use "NOTICE *" before registration instead of "NOTICE AUTH". "AUTH" is
    a valid nickname so sending notices to it is probably not a good idea.
    Use "*" as the target instead as done with numerics when the nick is not
-    available. This mimics the behaviour in Charybdis, IRCD-Hybrid, InspIRCd
+    available. This mimics the behavior in Charybdis, IRCD-Hybrid, InspIRCd
    2.2, Plexus 4, etc. Closes #217.
    The "NoticeAuth" configuration variable (ngircd.conf) has been renamed
    to "NoticeBeforeRegistration" accordingly, but the old name is still
@@ -44,14 +192,14 @@ ngIRCd 23
    clients, including Pidgin and stunnel 5.06, to reuse a session.
    Patch by Tom Ryder <tom@sanctum.geek.nz>, thanks! Closes #182.
  - Keep track of who placed bans, invites, and excepts.
-    Idee and implementation by LucentW, Thanks! Closes #203.
+    Idea and implementation by LucentW, Thanks! Closes #203.
  - Make setgroups(3) function optional: For example, Interix is missing
    this function, which prevented ngIRCd to build on this platform. When
    setgroups(3) isn't available, a warning message is issued on startup.
  - Implement numeric RPL_LISTSTART(321). lightIRC and other clients
    expecting RPL_LISTSTART should now behave correctly.
-    Idee and implementation by LucentW, Thanks! Closes #207.
-  - Update ngircd.conf.5: "CloadUserToNick" hides user _and_ real name.
+    Idea and implementation by LucentW, Thanks! Closes #207.
+  - Update ngircd.conf.5: "CloakUserToNick" hides user _and_ real name.
    This closes #208.
  - Fix case insensitive pattern matching: Up to now, only the the input
    string became lowercased and was then compared to the pattern -- which
@@ -61,11 +209,11 @@ ngIRCd 23
    hide IP addresses/hostnames on WHOIS when "MorePrivacy" is in effect.
    This closes #198.
  - IRC operators now can kick anyone when "OperCanMode" is set.
-    Idee and implementation by LucentW, Thanks! Closes #202.
+    Idea and implementation by LucentW, Thanks! Closes #202.
  - Implement user mode "I": Hide channels on WHOIS: this mode prevents
    ngIRCd from showing channels on WHOIS (IRC Operators can always see
    the channel list).
-    Idee and implementation by LucentW, Thanks! Closes #197.
+    Idea and implementation by LucentW, Thanks! Closes #197.
  - INVITE command: Implement ERR_USERNOTONSERV(504) numeric and make sure
    that the target user is on the same server when inviting other users
    to local ("&") channels.
@@ -630,7 +778,7 @@ ngIRCd 19.2 (2012-06-19)
    "CC=xxx MAKE=yyy ./platformtest.sh" calling convention.
  - Add instructions for setting up Atheme IRC services.
  - Implement support for IRC capability handling, the new "CAP" command,
-    and capablity "multi-prefix" which allows both the NAME and	WHO command
+    and capability "multi-prefix" which allows both the NAME and WHO command
    handlers to return more than one "class prefix" to the client.
  - Update Xcode project files: reference missing documentation files.
  - Fix: Don't ignore "permission denied" errors when enabling chroot.
@@ -930,7 +1078,7 @@ ngIRCd 17 (2010-11-07)
  - contrib/platformtest.sh: make command name quoting consistent

  ngIRCd 17~rc3 (2010-10-27)
-  - Xcode builds: detect version number correctly, updateed project file
+  - Xcode builds: detect version number correctly, updated project file
    to use the Mac OS X 10.5.x SDK, disable pam_fail_delay() because it
    is only available starting with Mac OS X 10.6, and generate a default
    PAM configuration for the Mac OS X Installer.app package of ngIRCd.
@@ -942,7 +1090,7 @@ ngIRCd 17 (2010-11-07)
  ngIRCd 17~rc2 (2010-10-25)
  - ZeroConf: include header files missing since commit a988bbc86a.
  - Generate ngIRCd version number from GIT tag.
-  - Make sourcecode compatible with ansi2knr again. This allows to compile
+  - Make source code compatible with ansi2knr again. This allows to compile
    ngIRCd using a pre-ANSI K&R C compiler again.
  - ./configure: check if C compiler can compile ISO Standard C.
  - ./configure: check support for C prototypes again.
@@ -958,7 +1106,7 @@ ngIRCd 17 (2010-11-07)
    Howl, Avahi or on Mac OS X).
  - New configuration option "SyslogFacility" to define the syslog "facility"
    (the "target"), to which ngIRCd should send its log messages.
-    Possible values are system dependant, but most probably "auth", "daemon",
+    Possible values are system dependent, but most probably "auth", "daemon",
    "user" and "local1" through "local7" are possible values; see syslog(3).
    Default is "local5" for historical reasons.
  - Dump the "internal server state" (configured servers, established
@@ -979,7 +1127,7 @@ ngIRCd 17 (2010-11-07)
  - Make configure switch "--docdir" work (closes: #108).
  - Reformat and update FAQ.txt a little bit.
  - INSTALL: mention SSL, IPv6, and changed handling of MotdFile.
-  - Change MOTD file handling: ngIRCd now caches the contens of the MOTD
+  - Change MOTD file handling: ngIRCd now caches the contents of the MOTD
    file, so the daemon now requires a HUP signal or REHASH command to
    re-read the MOTD file when its content changed.
  - Startup: open /dev/null before chroot'ing the daemon.
@@ -1015,14 +1163,14 @@ ngIRCd 16 (2010-05-02)
  - Include netinet/{in.h, in_systm.h} when checking for netinet/ip.h
  - Only include <netinet/in_systm.h> if it exists
  - Updated doc/Platforms.txt
-  - Enhace connection statistics counters: display total number of served
+  - Enhance connection statistics counters: display total number of served
    connections on daemon shutdown and when a new client connects using
    the new numeric RPL_STATSCONN (250).

  ngIRCd 16~rc1 (2010-03-25)
  - Various fixes to the build system and code cleanups.
  - contrib/platformtest.sh: Only show latest commit.
-  - Updatet doc/Platforms.txt, added new README-Interix.txt documenting
+  - Updated doc/Platforms.txt, added new README-Interix.txt documenting
    how to tun ngIRCd on Microsoft Services for UNIX (MS SFU, MS SUA).
  - Updated links to the ngIRCd homepage (bug tracker, mailing list).
  - Added missing modes to USERMODES #define
@@ -1050,7 +1198,7 @@ ngIRCd 15 (2009-11-07)
  ngIRCd 15~rc1 (2009-10-15)
  - Do not add default listening port (6667) if SSL ports were specified, so
    ngIRCd can be configured to only accept SSL-encrypted connections now.
-  - Enable IRC operators to use the IRC command SQUIT (insted of the already
+  - Enable IRC operators to use the IRC command SQUIT (instead of the already
    implemented but non-standard DISCONNECT command).
  - New configuration option "AllowRemoteOper" (disabled by default) that
    enables remote IRC operators to use the IRC commands SQUIT and CONNECT
@@ -1104,7 +1252,7 @@ ngIRCd 14 (2009-04-20)
  - Fix memory leak when a encrypted and compressed server link goes down.
    (closes bug #95, reported by Christoph, fiesh@fiesh.homeip.net)
  - Fix handling of channels containing dots.
-    (closes ug #93, reported by Gonosz Csiga)
+    (closes bug #93, reported by Gonosz Csiga)

 ngIRCd 13 (2008-12-25)

@@ -1334,7 +1482,7 @@ ngIRCd 0.9.0 (2005-07-24)
  - Fixed ./configure test for TCP Wrappers: now it runs on Mac OS X as well.
  - Enhanced configure script: now you can pass an (optional) search path
    to all --with-XXX parameters, e. g. "--with-ident=/opt/ident".
-  - Removed typedefs for the native C datatypes.
+  - Removed typedefs for the native C data types.
    Use stdbool.h / inttypes.h if available.
  - New configuration option "OperServerMode" to enable a workaround needed
    when running an network with ircd2 servers and "OperCanUseMode" enabled
@@ -1515,7 +1663,7 @@ ngIRCd 0.7.0 (2003-05-01)
    to add a new server (ngIRCd tries to connect new servers only once!).
  - Added DISCONNECT command ("DISCONNECT <name>") to disable servers.
  - Restructured the documentation: Now the main language is English. The
-    german documentation has been removed (until there is a maintainer).
+    German documentation has been removed (until there is a maintainer).
  - Enhanced killing of users caused by a nickname collision.
  - Better error detection for status code ("numerics") forwarding.
  - Moved tool functions to own library: "libngtool".
@@ -1556,7 +1704,7 @@ ngIRCd 0.6.1 (2003-01-21)
    member when changing his channel user modes which could crash ngIRCd.


-Older changes (sorry, only available in german language):
+Older changes (sorry, only available in German language):

 ngIRCd 0.6.0, 24.12.2002

--- a/10
+++ b/10
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/

-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

@@ -36,9 +36,9 @@ Differences to version 20.x
  the new mask will be KILL'ed. This was not the case with earlier versions
  that only added the mask but didn't kill already connected users.

- The "PredefChannelsOnly" configuration variable has been superseeded by the
+- The "PredefChannelsOnly" configuration variable has been superseded by the
  new "AllowedChannelTypes" variable. It is still supported and translated to
-  the apropriate "AllowedChannelTypes" setting but is deprecated now.
+  the appropriate "AllowedChannelTypes" setting but is deprecated now.

 Differences to version 19.x

@@ -162,7 +162,7 @@ If you are using one of the "big" operating systems or Linux distributions,
 you can use the following commands to install all the required packages to
 build the sources including all optional features and to run the test suite:

-* RedHat / Fedora based distributions:
+* Red Hat / Fedora based distributions:

  yum install \
    autoconf automake expect gcc glibc-devel gnutls-devel \
@@ -186,7 +186,7 @@ This step is therefore only interesting for developers.
 autogen.sh produces the Makefile.in's, which are necessary for the configure
 script itself, and some more files for make. To run autogen.sh you'll need
 GNU autoconf and GNU automake: at least autoconf 2.61 and automake 1.10 are
-requird, newer is better. But don't use automake 1.12 or newer for creating
+required, newer is better. But don't use automake 1.12 or newer for creating
 distribution archives: it will work but lack "de-ANSI-fication" support in the
 generated Makefile's! Stick with automake 1.11.x for this purpose ...
 So automake 1.11.x and autoconf 2.67+ is recommended.
--- a/102
+++ b/102
@@ -2,20 +2,94 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/

-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

                                  -- NEWS --

+ngIRCd 25 (2019-01-23)

-ngIRCd 23
+  - Implement new configuration option "MaxPenaltyTime", which configures the
+    maximum penalty time increase in seconds, per penalty event. Set to -1 for
+    no limit (the default), 0 to disable penalties altogether. ngIRCd doesn't
+    use penalty increases higher than 2 seconds during normal operation, so
+    values higher than 1 rarely make sense.
+    Disabling (or reducing) penalties can greatly speed up "make check" runs
+    for example, see below, but are mostly a debugging feature and normally
+    not meant to be used on production systems!
+    Some example timings running "make check" from my macOS workstation:
+     - MaxPenaltyTime not set: 4:41,79s
+     - "MaxPenaltyTime = 1":   3:14,71s
+     - "MaxPenaltyTime = 0":     25,46s
+    Closes #249 and #251.
+  - Update Xcode project for latest Xcode version (10.0)
+  - Allow a 5th parameter in WEBIRC. Thanks to "ItsOnlyBinary".
+    Closes #247.
+
+  ngIRCd 25~rc1 (2018-08-11)
+  - Only send TOPIC updates to a channel when the topic actually changed:
+    This prevents the channel from becoming flooded by unecessary TOPIC update
+    messages, that can happen when IRC services try to enforce a certain topic
+    but which is already set (at least on the local server), for example.
+    Therefore still forward it to all servers, but don't inform local clients
+    (still update setter and timestamp information, though!).
+  - Update Xcode project for latest Xcode version (9.2). This includes adding
+    missing and deleting obsolete file references.
+  - Handle user mode "C" ("Only users that share a channel are allowed to send
+    messages") like user mode "b" ("block private messages and notices"): allow
+    messages from servers, services, and IRC Operators, too. Change proposed by
+    "wowaname" back in 2015 in #ngircd, thanks!
+  - Allow IRC Ops and remote servers to KILL service clients: such clients
+    behave like regular users, therefore IRC operators and servers should be
+    able to KILL them: for example to resolve nick collisions.
+    Closes #242.
+
+ngIRCd 24 (2017-01-20)
+
+  ngIRCd 24~rc1 (2017-01-07)
+  - Log privilege violations and failed OPER request with log level "error"
+    and send it to the "&SERVER" channel, too.
+  - Immediately shut down connection when receiving an "ERROR" command,
+    don't wait for the peer to close the connection. This allows the daemon
+    to forward the received "ERROR" message in the network, instead of the
+    very generic "client closed connection" message.
+  - Explicitly forbid remote servers to modify "x-lines" (G-LINES) when the
+    "AllowRemoteOper" configuration option isn't set, even when the command
+    seems to originate from the remote server itself: this prevents GLINE's
+    to become set during server handshake in this case (what wouldn't be
+    possible during regular runtime when a remote IRC Op sends the command)
+    and what can't be undone by IRC Ops later on (because of the missing
+    "AllowRemoteOper" option) ...
+  - Update Xcode project for latest Xcode version (8.0), and fix "duplicate
+    symbols" error messages when building (linking) the binary.
+  - Add "Documentation" variables to systemd configuration files.
+  - Make sure that SYSCONFDIR is always set, which can be handy when
+    using source code linters when ./configure hasn't been run already.
+  - Add the new "PAMServiceName" configuration option to specify the name
+    used as PAM service name. This setting allows to run multiple ngIRCd
+    instances with different PAM configurations for each instance.
+    Thanks to Christian Aistleitner <christian@quelltextlich.at> for the
+    patch, closes #226.
+  - Add an ".editorconfig" file to the project.
+  - Limit the number of message target, and suppress duplicates: This
+    prevents an user from flooding the server using commands like this:
+    "PRIVMSG nick1,nick1,nick1,...".
+    Duplicate targets are suppressed silently (channels and clients).
+    In addition, the maximum number of targets per PRIVMSG, NOTICE, ...
+    command are limited to MAX_HNDL_TARGETS (25). If there are more, the
+    daemon sends the new 407 (ERR_TOOMANYTARGETS_MSG) numeric, containing
+    the first target that hasn't been handled any more. Closes #187.
+  - Make contrib/platformtest.sh script more portable, and only show
+    "runs=Y" when the test suite really has been passed successfully.
+
+ngIRCd 23 (2015-11-16)

  ngIRCd 23~rc1 (2015-09-06)
  - Use "NOTICE *" before registration instead of "NOTICE AUTH". "AUTH" is
    a valid nickname so sending notices to it is probably not a good idea.
    Use "*" as the target instead as done with numerics when the nick is not
-    available. This mimics the behaviour in Charybdis, IRCD-Hybrid, InspIRCd
+    available. This mimics the behavior in Charybdis, IRCD-Hybrid, InspIRCd
    2.2, Plexus 4, etc. Closes #217.
    The "NoticeAuth" configuration variable (ngircd.conf) has been renamed
    to "NoticeBeforeRegistration" accordingly, but the old name is still
@@ -23,20 +97,20 @@ ngIRCd 23
  - Implement new channel mode "N" (regular users can't change their nick
    name while on this channel). Closes #214.
  - Keep track of who placed bans, invites, and excepts.
-    Idee and implementation by LucentW, Thanks! Closes #203.
+    Idea and implementation by LucentW, Thanks! Closes #203.
  - Implement numeric RPL_LISTSTART(321). lightIRC and other clients
    expecting RPL_LISTSTART should now behave correctly.
-    Idee and implementation by LucentW, Thanks! Closes #207.
+    Idea and implementation by LucentW, Thanks! Closes #207.
  - Streamline the effect of "MorePrivacy" option: Update documentation
    in ngircd.conf(5); don't hide channels for IRC Ops on LIST and don't
    hide IP addresses/hostnames on WHOIS when "MorePrivacy" is in effect.
    This closes #198.
  - IRC operators now can kick anyone when "OperCanMode" is set.
-    Idee and implementation by LucentW, Thanks! Closes #202.
+    Idea and implementation by LucentW, Thanks! Closes #202.
  - Implement user mode "I": Hide channels on WHOIS: this mode prevents
    ngIRCd from showing channels on WHOIS (IRC Operators can always see
    the channel list).
-    Idee and implementation by LucentW, Thanks! Closes #197.
+    Idea and implementation by LucentW, Thanks! Closes #197.
  - INVITE command: Implement ERR_USERNOTONSERV(504) numeric and make sure
    that the target user is on the same server when inviting other users
    to local ("&") channels.
@@ -324,7 +398,7 @@ ngIRCd 19.2 (2012-06-19)
    which still is the default when "CloakHostModeX" isn't set.
  - Add instructions for setting up Atheme IRC services.
  - Implement support for IRC capability handling, the new "CAP" command,
-    and capablity "multi-prefix" which allows both the NAME and	WHO command
+    and capability "multi-prefix" which allows both the NAME and WHO command
    handlers to return more than one "class prefix" to the client.

 ngIRCd 19.1 (2012-03-19)
@@ -487,7 +561,7 @@ ngIRCd 17 (2010-11-07)

  ngIRCd 17~rc2 (2010-10-25)
  - Generate ngIRCd version number from GIT tag.
-  - Make sourcecode compatible with ansi2knr again. This allows to compile
+  - Make source code compatible with ansi2knr again. This allows to compile
    ngIRCd using a pre-ANSI K&R C compiler again.

  ngIRCd 17~rc1 (2010-10-11)
@@ -496,7 +570,7 @@ ngIRCd 17 (2010-11-07)
    Howl, Avahi or on Mac OS X).
  - New configuration option "SyslogFacility" to define the syslog "facility"
    (the "target"), to which ngIRCd should send its log messages.
-    Possible values are system dependant, but most probably "auth", "daemon",
+    Possible values are system dependent, but most probably "auth", "daemon",
    "user" and "local1" through "local7" are possible values; see syslog(3).
    Default is "local5" for historical reasons.
  - Dump the "internal server state" (configured servers, established
@@ -506,7 +580,7 @@ ngIRCd 17 (2010-11-07)
    signal SIGUSR1, when debug code is compiled in, not only on startup
    using the command line parameters.
  - Implement user mode "x": host name cloaking (closes: #102).
-  - Change MOTD file handling: ngIRCd now caches the contens of the MOTD
+  - Change MOTD file handling: ngIRCd now caches the contents of the MOTD
    file, so the daemon now requires a HUP signal or REHASH command to
    re-read the MOTD file when its content changed.
  - Allow IRC ops to change channel modes even without OperServerMode set.
@@ -522,7 +596,7 @@ ngIRCd 17 (2010-11-07)
 ngIRCd 16 (2010-05-02)

  ngIRCd 16~rc2 (2010-04-25)
-  - Enhace connection statistics counters: display total number of served
+  - Enhance connection statistics counters: display total number of served
    connections on daemon shutdown and when a new client connects using
    the new numeric RPL_STATSCONN (250).

@@ -544,7 +618,7 @@ ngIRCd 15 (2009-11-07)
  ngIRCd 15~rc1 (2009-10-15)
  - Do not add default listening port (6667) if SSL ports were specified, so
    ngIRCd can be configured to only accept SSL-encrypted connections now.
-  - Enable IRC operators to use the IRC command SQUIT (insted of the already
+  - Enable IRC operators to use the IRC command SQUIT (instead of the already
    implemented but non-standard DISCONNECT command).
  - New configuration option "AllowRemoteOper" (disabled by default) that
    enables remote IRC operators to use the IRC commands SQUIT and CONNECT
@@ -727,7 +801,7 @@ ngIRCd 0.7.0 (2003-05-01)
  - Documentation is now installed in $(datadir)/doc/ngircd.


-Older news (sorry, only available in german language):
+Older news (sorry, only available in German language):

 ngIRCd 0.6.0, 24.12.2002

--- a/68
+++ b/68
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/

-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

@@ -28,31 +28,26 @@ Please see the INSTALL document for installation and upgrade information!
 II. Status
 ~~~~~~~~~~~

-It is not the goal of ngIRCd to implement all the nasty behaviours of the
+ngIRCd should be quite feature complete and stable to be used as daemon in
+real world IRC networks.
+
+It is not the goal of ngIRCd to implement all the nasty behaviors of the
 original ircd, but to implement most of the useful commands and semantics
-specified by the RFCs.
+specified by the RFCs that are used by existing clients.

-In the meantime ngIRCd should be quite feature complete and stable to be
-used in real IRC networks.
-
-Implemented IRC-commands are:
-
-ADMIN, AWAY, CHANINFO, CONNECT, DIE, DISCONNECT, ERROR, GLINE, HELP, INFO,
-INVITE, ISON, JOIN, KICK, KILL, KLINE, LINKS, LIST, LUSERS, MODE, MOTD,
-NAMES, NICK, NJOIN, NOTICE, OPER, PART, PASS, PING, PONG, PRIVMSG, QUIT,
-REHASH, RESTART, SERVER, SERVICE, SERVLIST, SQUERY, SQUIT, STATS, SUMMON,
-TIME, TOPIC, TRACE, USER, USERHOST, USERS, VERSION, WALLOPS, WEBIRC, WHO,
-WHOIS, WHOWAS.

 III. Features (or: why use ngIRCd?)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

- well arranged (lean) configuration file
- simple to build/install, configure and maintain
- supports IPv6 and SSL
- no problems with servers that have dynamic IP addresses
- freely available, modern, portable and tidy C-source
- wide field of supported platforms, including AIX, A/UX, FreeBSD, HP-UX,
+- Well arranged (lean) configuration file.
+- Simple to build, install, configure, and maintain.
+- Supports IPv6 and SSL.
+- Can use PAM for user authentication.
+- Lots of popular user and channel modes are implemented.
+- Supports "cloaking" of users.
+- No problems with servers that have dynamic IP addresses.
+- Freely available, modern, portable and tidy C source.
+- Wide field of supported platforms, including AIX, A/UX, FreeBSD, HP-UX,
  IRIX, Linux, Mac OS X, NetBSD, OpenBSD, Solaris, and Windows with Cygwin.
 - ngIRCd is being actively developed since 2001.

@@ -61,33 +56,34 @@ IV. Documentation
 ~~~~~~~~~~~~~~~~~

 More documentation can be found in the "doc/" directory and the homepage of
-the ngIRCd: <http://ngircd.barton.de/>.
+ngIRCd: <http://ngircd.barton.de/>.


 V. Download
 ~~~~~~~~~~~

-The homepage of the ngIRCd is: <http://ngircd.barton.de/>; you will find
+The homepage of the ngIRCd is <http://ngircd.barton.de/>; you will find
 the newest information about the ngIRCd and the most recent ("stable")
 releases there.

-If you are interested in the latest development versions (which are not
-always stable), then please read the section about "GIT" on the homepage and
-the file "doc/GIT.txt" which describes the use of GIT, the version control
-system used by ngIRCd (homepage: <http://git-scm.com/>).
+Visit our source code repository at GitHub if you are interested in the
+latest development version: <https://github.com/ngircd/ngircd>.


-VI. Bugs
-~~~~~~~~
+VI. Problems, Bugs, Patches
+~~~~~~~~~~~~~~~~~~~~~~~~~~~

-If you find bugs in the ngIRCd (which might be there :-), please report
-them at the following URL:
+Please don't hesitate to contact us if you encounter problems:

-<https://github.com/ngircd/ngircd/issues>
+- On IRC: <irc://irc.barton.de/ngircd>
+- Via the mailing list: <ngircd-ml@ngircd.barton.de>
+
+See <http://ngircd.barton.de/support.php> for details.
+
+If you find bugs in ngIRCd (which will be there most probably ...), please
+report them to our issue tracker at GitHub:
+
+- Bug tracker: <https://github.com/ngircd/ngircd/issues>
+- Patches, "pull requests": <https://github.com/ngircd/ngircd/pulls>

 There you can read about known bugs and limitations, too.
-
-If you have comments, patches or something else, please feel free to post
-a mail to the ngIRCd mailing list: <ngircd-ml@ngircd.barton.de> (please see
-<http://ngircd.barton.de/support.php> for details) or join the ngIRCd IRC
-channel: <irc://irc.barton.de/ngircd>.
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2013 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -95,7 +95,7 @@ Search()
 				return 0
 			fi
 		done
-		minor=`expr $minor - 1`
+		minor=$(expr $minor - 1)
 	done
 	return 1
 }
@@ -139,26 +139,26 @@ fi
 # Try to detect the needed tools when no environment variable already
 # specifies one:
 echo "Searching for required tools ..."
-[ -z "$ACLOCAL" ] && ACLOCAL=`Search aclocal 1`
+[ -z "$ACLOCAL" ] && ACLOCAL=$(Search aclocal 1)
 [ "$VERBOSE" = "1" ] && echo " - ACLOCAL=$ACLOCAL"
-[ -z "$AUTOHEADER" ] && AUTOHEADER=`Search autoheader 2`
+[ -z "$AUTOHEADER" ] && AUTOHEADER=$(Search autoheader 2)
 [ "$VERBOSE" = "1" ] && echo " - AUTOHEADER=$AUTOHEADER"
-[ -z "$AUTOMAKE" ] && AUTOMAKE=`Search automake 1`
+[ -z "$AUTOMAKE" ] && AUTOMAKE=$(Search automake 1)
 [ "$VERBOSE" = "1" ] && echo " - AUTOMAKE=$AUTOMAKE"
-[ -z "$AUTOCONF" ] && AUTOCONF=`Search autoconf 2`
+[ -z "$AUTOCONF" ] && AUTOCONF=$(Search autoconf 2)
 [ "$VERBOSE" = "1" ] && echo " - AUTOCONF=$AUTOCONF"

-AUTOCONF_VERSION=`echo $AUTOCONF | cut -d'-' -f2-`
-[ -n "$AUTOCONF_VERSION" -a "$AUTOCONF_VERSION" != "autoconf" ] \
+AUTOCONF_VERSION=$(echo "$AUTOCONF" | cut -d'-' -f2-)
+[ -n "$AUTOCONF_VERSION" ] && [ "$AUTOCONF_VERSION" != "autoconf" ] \
 	&& export AUTOCONF_VERSION || unset AUTOCONF_VERSION
 [ "$VERBOSE" = "1" ] && echo " - AUTOCONF_VERSION=$AUTOCONF_VERSION"
-AUTOMAKE_VERSION=`echo $AUTOMAKE | cut -d'-' -f2-`
-[ -n "$AUTOMAKE_VERSION" -a "$AUTOMAKE_VERSION" != "automake" ] \
+AUTOMAKE_VERSION=$(echo $AUTOMAKE | cut -d'-' -f2-)
+[ -n "$AUTOMAKE_VERSION" ] && [ "$AUTOMAKE_VERSION" != "automake" ] \
 	&& export AUTOMAKE_VERSION || unset AUTOMAKE_VERSION
 [ "$VERBOSE" = "1" ] && echo " - AUTOMAKE_VERSION=$AUTOMAKE_VERSION"

 [ $# -gt 0 ] && CONFIGURE_ARGS=" $*" || CONFIGURE_ARGS=""
-[ -z "$GO" -a -n "$CONFIGURE_ARGS" ] && GO=1
+[ -z "$GO" ] && [ -n "$CONFIGURE_ARGS" ] && GO=1

 # Verify that all tools have been found
 [ -z "$ACLOCAL" ] && Notfound aclocal
@@ -166,15 +166,15 @@ AUTOMAKE_VERSION=`echo $AUTOMAKE | cut -d'-' -f2-`
 [ -z "$AUTOMAKE" ] && Notfound automake
 [ -z "$AUTOCONF" ] && Notfound autoconf

-AM_VERSION=`$AUTOMAKE --version | head -n 1 | sed -e 's/.* //g'`
+AM_VERSION=$($AUTOMAKE --version | head -n 1 | sed -e 's/.* //g')
 ifs=$IFS; IFS="."; set $AM_VERSION; IFS=$ifs
-AM_MAJOR="$1"; AM_MINOR="$2"; AM_PATCHLEVEL="$3"
+AM_MAJOR="$1"; AM_MINOR="$2"
 echo "Detected automake $AM_VERSION ..."

 AM_MAKEFILES="src/ipaddr/Makefile.ng src/ngircd/Makefile.ng src/testsuite/Makefile.ng src/tool/Makefile.ng"

 # De-ANSI-fication?
-if [ "$AM_MAJOR" -eq "1" -a "$AM_MINOR" -lt "12" ]; then
+if [ "$AM_MAJOR" -eq "1" ] && [ "$AM_MINOR" -lt "12" ]; then
 	# automake < 1.12 => automatic de-ANSI-fication support available
 	echo " - Enabling de-ANSI-fication support."
 	sed -e "s|^__ng_PROTOTYPES__|AM_C_PROTOTYPES|g" configure.ng >configure.ac
@@ -188,19 +188,20 @@ else
 	DEANSI_END=" (disabled by ./autogen.sh script)"
 fi
 # Serial test harness?
-if [ "$AM_MAJOR" -eq "1" -a "$AM_MINOR" -ge "13" ]; then
+if [ "$AM_MAJOR" -eq "1" ] && [ "$AM_MINOR" -ge "13" ]; then
 	# automake >= 1.13 => enforce "serial test harness"
 	echo " - Enforcing serial test harness."
 	SERIAL_TESTS="serial-tests"
 else
 	# automake < 1.13 => no new test harness, nothing to do
+	# shellcheck disable=SC2034
 	SERIAL_TEST=""
 fi

 sed -e "s|^__ng_Makefile_am_template__|AUTOMAKE_OPTIONS = ${SERIAL_TESTS} ${DEANSI_START}ansi2knr${DEANSI_END}|g" \
 	src/portab/Makefile.ng >src/portab/Makefile.am
 for makefile_ng in $AM_MAKEFILES; do
-	makefile_am=`echo "$makefile_ng" | sed -e "s|\.ng\$|\.am|g"`
+	makefile_am=$(echo "$makefile_ng" | sed -e "s|\.ng\$|\.am|g")
 	sed -e "s|^__ng_Makefile_am_template__|AUTOMAKE_OPTIONS = ${SERIAL_TESTS} ${DEANSI_START}../portab/ansi2knr${DEANSI_END}|g" \
 		$makefile_ng >$makefile_am
 done
@@ -214,10 +215,10 @@ Run $ACLOCAL && \
 	Run $AUTOHEADER && \
 	Run $AUTOMAKE --add-missing --no-force

-if [ $? -eq 0 -a -x ./configure ]; then
+if [ $? -eq 0 ] && [ -x ./configure ]; then
 	# Success: if we got some parameters we call ./configure and pass
 	# all of them to it.
-	NAME=`grep PACKAGE_STRING= configure | cut -d"'" -f2`
+	NAME=$(grep PACKAGE_STRING= configure | cut -d"'" -f2)
 	if [ "$GO" = "1" ]; then
 		[ -n "$PREFIX" ] && p=" --prefix=$PREFIX" || p=""
 		c="./configure${p}${CONFIGURE_ARGS}"
--- a/config.guess
+++ b/config.guess
--- a/config.sub
+++ b/config.sub
@@ -1,8 +1,8 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2014 Free Software Foundation, Inc.
+#   Copyright 1992-2018 Free Software Foundation, Inc.

-timestamp='2014-05-01'
+timestamp='2018-03-08'

 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@ timestamp='2014-05-01'
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -25,7 +25,7 @@ timestamp='2014-05-01'
 # of the GNU General Public License, version 3 ("GPLv3").


-# Please send patches with a ChangeLog entry to config-patches@gnu.org.
+# Please send patches to <config-patches@gnu.org>.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
@@ -33,7 +33,7 @@ timestamp='2014-05-01'
 # Otherwise, we print the canonical config type on stdout and succeed.

 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+# https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub

 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@@ -53,12 +53,11 @@ timestamp='2014-05-01'
 me=`echo "$0" | sed -e 's,.*/,,'`

 usage="\
-Usage: $0 [OPTION] CPU-MFR-OPSYS
-       $0 [OPTION] ALIAS
+Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS

 Canonicalize a configuration name.

-Operation modes:
+Options:
  -h, --help         print this help, then exit
  -t, --time-stamp   print date of last modification, then exit
  -v, --version      print version number, then exit
@@ -68,7 +67,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)

-Copyright 1992-2014 Free Software Foundation, Inc.
+Copyright 1992-2018 Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -95,7 +94,7 @@ while test $# -gt 0 ; do

    *local*)
       # First pass through any local machine types.
-       echo $1
+       echo "$1"
       exit ;;

    * )
@@ -113,24 +112,24 @@ esac

 # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
 # Here we must recognize all the valid KERNEL-OS combinations.
-maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
+maybe_os=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
-  knetbsd*-gnu* | netbsd*-gnu* | \
-  kopensolaris*-gnu* | \
+  knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
+  kopensolaris*-gnu* | cloudabi*-eabi* | \
  storm-chaos* | os2-emx* | rtmk-nova*)
    os=-$maybe_os
-    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
+    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
    ;;
  android-linux)
    os=-linux-android
-    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
+    basic_machine=`echo "$1" | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
    ;;
  *)
-    basic_machine=`echo $1 | sed 's/-[^-]*$//'`
-    if [ $basic_machine != $1 ]
-    then os=`echo $1 | sed 's/.*-/-/'`
+    basic_machine=`echo "$1" | sed 's/-[^-]*$//'`
+    if [ "$basic_machine" != "$1" ]
+    then os=`echo "$1" | sed 's/.*-/-/'`
    else os=; fi
    ;;
 esac
@@ -179,44 +178,44 @@ case $os in
 		;;
 	-sco6)
 		os=-sco5v6
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5)
 		os=-sco3.2v5
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco4)
 		os=-sco3.2v4
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2.[4-9]*)
 		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco3.2v[4-9]*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco5v6*)
 		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-sco*)
 		os=-sco3.2v2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-udk*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-isc)
 		os=-isc2.2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-clix*)
 		basic_machine=clipper-intergraph
 		;;
 	-isc*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-pc/'`
 		;;
 	-lynx*178)
 		os=-lynxos178
@@ -228,10 +227,7 @@ case $os in
 		os=-lynxos
 		;;
 	-ptx*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
-		;;
-	-windowsnt*)
-		os=`echo $os | sed -e 's/windowsnt/winnt/'`
+		basic_machine=`echo "$1" | sed -e 's/86-.*/86-sequent/'`
 		;;
 	-psos*)
 		os=-psos
@@ -255,15 +251,16 @@ case $basic_machine in
 	| arc | arceb \
 	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
 	| avr | avr32 \
+	| ba \
 	| be32 | be64 \
 	| bfin \
 	| c4x | c8051 | clipper \
 	| d10v | d30v | dlx | dsp16xx \
-	| epiphany \
-	| fido | fr30 | frv \
+	| e2k | epiphany \
+	| fido | fr30 | frv | ft32 \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| hexagon \
-	| i370 | i860 | i960 | ia64 \
+	| i370 | i860 | i960 | ia16 | ia64 \
 	| ip2k | iq2000 \
 	| k1om \
 	| le32 | le64 \
@@ -299,12 +296,14 @@ case $basic_machine in
 	| nios | nios2 | nios2eb | nios2el \
 	| ns16k | ns32k \
 	| open8 | or1k | or1knd | or32 \
-	| pdp10 | pdp11 | pj | pjl \
+	| pdp10 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
+	| pru \
 	| pyramid \
+	| riscv32 | riscv64 \
 	| rl78 | rx \
 	| score \
-	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
 	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
@@ -312,7 +311,8 @@ case $basic_machine in
 	| tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \
 	| ubicom32 \
 	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
-	| we32k \
+	| visium \
+	| wasm32 \
 	| x86 | xc16x | xstormy16 | xtensa \
 	| z8k | z80)
 		basic_machine=$basic_machine-unknown
@@ -326,11 +326,14 @@ case $basic_machine in
 	c6x)
 		basic_machine=tic6x-unknown
 		;;
+	leon|leon[3-9])
+		basic_machine=sparc-$basic_machine
+		;;
 	m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
 		basic_machine=$basic_machine-unknown
 		os=-none
 		;;
-	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
+	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65)
 		;;
 	ms1)
 		basic_machine=mt-unknown
@@ -359,7 +362,7 @@ case $basic_machine in
 	  ;;
 	# Object if more than one company name word.
 	*-*-*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
+		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
 		exit 1
 		;;
 	# Recognize the basic CPU types with company name.
@@ -371,17 +374,18 @@ case $basic_machine in
 	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
 	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
 	| avr-* | avr32-* \
+	| ba-* \
 	| be32-* | be64-* \
 	| bfin-* | bs2000-* \
 	| c[123]* | c30-* | [cjt]90-* | c4x-* \
 	| c8051-* | clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
-	| elxsi-* \
+	| e2k-* | elxsi-* \
 	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| hexagon-* \
-	| i*86-* | i860-* | i960-* | ia64-* \
+	| i*86-* | i860-* | i960-* | ia16-* | ia64-* \
 	| ip2k-* | iq2000-* \
 	| k1om-* \
 	| le32-* | le64-* \
@@ -422,13 +426,15 @@ case $basic_machine in
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
+	| pru-* \
 	| pyramid-* \
+	| riscv32-* | riscv64-* \
 	| rl78-* | romp-* | rs6000-* | rx-* \
 	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
 	| sparclite-* \
-	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \
 	| tahoe-* \
 	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
 	| tile*-* \
@@ -436,6 +442,8 @@ case $basic_machine in
 	| ubicom32-* \
 	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
 	| vax-* \
+	| visium-* \
+	| wasm32-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* \
 	| xstormy16-* | xtensa*-* \
@@ -449,7 +457,7 @@ case $basic_machine in
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
 	386bsd)
-		basic_machine=i386-unknown
+		basic_machine=i386-pc
 		os=-bsd
 		;;
 	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
@@ -483,7 +491,7 @@ case $basic_machine in
 		basic_machine=x86_64-pc
 		;;
 	amd64-*)
-		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=x86_64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	amdahl)
 		basic_machine=580-amdahl
@@ -512,6 +520,9 @@ case $basic_machine in
 		basic_machine=i386-pc
 		os=-aros
 		;;
+	asmjs)
+		basic_machine=asmjs-unknown
+		;;
 	aux)
 		basic_machine=m68k-apple
 		os=-aux
@@ -525,7 +536,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	blackfin-*)
-		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=bfin-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	bluegene*)
@@ -533,13 +544,13 @@ case $basic_machine in
 		os=-cnk
 		;;
 	c54x-*)
-		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=tic54x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	c55x-*)
-		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=tic55x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	c6x-*)
-		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=tic6x-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	c90)
 		basic_machine=c90-cray
@@ -628,10 +639,18 @@ case $basic_machine in
 		basic_machine=rs6000-bull
 		os=-bosx
 		;;
-	dpx2* | dpx2*-bull)
+	dpx2*)
 		basic_machine=m68k-bull
 		os=-sysv3
 		;;
+	e500v[12])
+		basic_machine=powerpc-unknown
+		os=$os"spe"
+		;;
+	e500v[12]-*)
+		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
+		os=$os"spe"
+		;;
 	ebmon29k)
 		basic_machine=a29k-amd
 		os=-ebmon
@@ -721,9 +740,6 @@ case $basic_machine in
 	hp9k8[0-9][0-9] | hp8[0-9][0-9])
 		basic_machine=hppa1.0-hp
 		;;
-	hppa-next)
-		os=-nextstep3
-		;;
 	hppaosf)
 		basic_machine=hppa1.1-hp
 		os=-osf
@@ -736,26 +752,26 @@ case $basic_machine in
 		basic_machine=i370-ibm
 		;;
 	i*86v32)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
 		os=-sysv32
 		;;
 	i*86v4*)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
 		os=-sysv4
 		;;
 	i*86v)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
 		os=-sysv
 		;;
 	i*86sol2)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
+		basic_machine=`echo "$1" | sed -e 's/86.*/86-pc/'`
 		os=-solaris2
 		;;
 	i386mach)
 		basic_machine=i386-mach
 		os=-mach
 		;;
-	i386-vsta | vsta)
+	vsta)
 		basic_machine=i386-unknown
 		os=-vsta
 		;;
@@ -773,17 +789,17 @@ case $basic_machine in
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
+	leon-*|leon[3-9]-*)
+		basic_machine=sparc-`echo "$basic_machine" | sed 's/-.*//'`
+		;;
 	m68knommu)
 		basic_machine=m68k-unknown
 		os=-linux
 		;;
 	m68knommu-*)
-		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=m68k-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
-	m88k-omron*)
-		basic_machine=m88k-omron
-		;;
 	magnum | m3230)
 		basic_machine=mips-mips
 		os=-sysv
@@ -815,10 +831,10 @@ case $basic_machine in
 		os=-mint
 		;;
 	mips3*-*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
+		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`
 		;;
 	mips3*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
+		basic_machine=`echo "$basic_machine" | sed -e 's/mips3/mips64/'`-unknown
 		;;
 	monitor)
 		basic_machine=m68k-rom68k
@@ -828,12 +844,16 @@ case $basic_machine in
 		basic_machine=powerpc-unknown
 		os=-morphos
 		;;
+	moxiebox)
+		basic_machine=moxie-unknown
+		os=-moxiebox
+		;;
 	msdos)
 		basic_machine=i386-pc
 		os=-msdos
 		;;
 	ms1-*)
-		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
+		basic_machine=`echo "$basic_machine" | sed -e 's/ms1-/mt-/'`
 		;;
 	msys)
 		basic_machine=i686-pc
@@ -875,7 +895,7 @@ case $basic_machine in
 		basic_machine=v70-nec
 		os=-sysv
 		;;
-	next | m*-next )
+	next | m*-next)
 		basic_machine=m68k-next
 		case $os in
 		    -nextstep* )
@@ -920,6 +940,12 @@ case $basic_machine in
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
+	nsv-tandem)
+		basic_machine=nsv-tandem
+		;;
+	nsx-tandem)
+		basic_machine=nsx-tandem
+		;;
 	op50n-* | op60c-*)
 		basic_machine=hppa1.1-oki
 		os=-proelf
@@ -952,7 +978,7 @@ case $basic_machine in
 		os=-linux
 		;;
 	parisc-*)
-		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=hppa-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
 	pbd)
@@ -968,7 +994,7 @@ case $basic_machine in
 		basic_machine=i386-pc
 		;;
 	pc98-*)
-		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=i386-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	pentium | p5 | k5 | k6 | nexgen | viac3)
 		basic_machine=i586-pc
@@ -983,16 +1009,16 @@ case $basic_machine in
 		basic_machine=i786-pc
 		;;
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
-		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=i586-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=i686-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	pentium4-*)
-		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=i786-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	pn)
 		basic_machine=pn-gould
@@ -1002,23 +1028,23 @@ case $basic_machine in
 	ppc | ppcbe)	basic_machine=powerpc-unknown
 		;;
 	ppc-* | ppcbe-*)
-		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=powerpc-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
-	ppcle | powerpclittle | ppc-le | powerpc-little)
+	ppcle | powerpclittle)
 		basic_machine=powerpcle-unknown
 		;;
 	ppcle-* | powerpclittle-*)
-		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=powerpcle-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
 		;;
-	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
+	ppc64-*) basic_machine=powerpc64-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
-	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
+	ppc64le | powerpc64little)
 		basic_machine=powerpc64le-unknown
 		;;
 	ppc64le-* | powerpc64little-*)
-		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=powerpc64le-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	ps2)
 		basic_machine=i386-ibm
@@ -1072,17 +1098,10 @@ case $basic_machine in
 	sequent)
 		basic_machine=i386-sequent
 		;;
-	sh)
-		basic_machine=sh-hitachi
-		os=-hms
-		;;
 	sh5el)
 		basic_machine=sh5le-unknown
 		;;
-	sh64)
-		basic_machine=sh64-unknown
-		;;
-	sparclite-wrs | simso-wrs)
+	simso-wrs)
 		basic_machine=sparclite-wrs
 		os=-vxworks
 		;;
@@ -1101,7 +1120,7 @@ case $basic_machine in
 		os=-sysv4
 		;;
 	strongarm-* | thumb-*)
-		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
+		basic_machine=arm-`echo "$basic_machine" | sed 's/^[^-]*-//'`
 		;;
 	sun2)
 		basic_machine=m68000-sun
@@ -1223,6 +1242,9 @@ case $basic_machine in
 		basic_machine=hppa1.1-winbond
 		os=-proelf
 		;;
+	x64)
+		basic_machine=x86_64-pc
+		;;
 	xbox)
 		basic_machine=i686-pc
 		os=-mingw32
@@ -1231,20 +1253,12 @@ case $basic_machine in
 		basic_machine=xps100-honeywell
 		;;
 	xscale-* | xscalee[bl]-*)
-		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
+		basic_machine=`echo "$basic_machine" | sed 's/^xscale/arm/'`
 		;;
 	ymp)
 		basic_machine=ymp-cray
 		os=-unicos
 		;;
-	z8k-*-coff)
-		basic_machine=z8k-unknown
-		os=-sim
-		;;
-	z80-*-coff)
-		basic_machine=z80-unknown
-		os=-sim
-		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -1273,10 +1287,6 @@ case $basic_machine in
 	vax)
 		basic_machine=vax-dec
 		;;
-	pdp10)
-		# there are many clones, so DEC is not a safe bet
-		basic_machine=pdp10-unknown
-		;;
 	pdp11)
 		basic_machine=pdp11-dec
 		;;
@@ -1286,9 +1296,6 @@ case $basic_machine in
 	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
-	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
-		basic_machine=sparc-sun
-		;;
 	cydra)
 		basic_machine=cydra-cydrome
 		;;
@@ -1308,7 +1315,7 @@ case $basic_machine in
 		# Make sure to match an already-canonicalized machine name.
 		;;
 	*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
+		echo Invalid configuration \`"$1"\': machine \`"$basic_machine"\' not recognized 1>&2
 		exit 1
 		;;
 esac
@@ -1316,10 +1323,10 @@ esac
 # Here we canonicalize certain aliases for manufacturers.
 case $basic_machine in
 	*-digital*)
-		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
+		basic_machine=`echo "$basic_machine" | sed 's/digital.*/dec/'`
 		;;
 	*-commodore*)
-		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
+		basic_machine=`echo "$basic_machine" | sed 's/commodore.*/cbm/'`
 		;;
 	*)
 		;;
@@ -1330,8 +1337,8 @@ esac
 if [ x"$os" != x"" ]
 then
 case $os in
-	# First match some system type aliases
-	# that might get confused with valid system types.
+	# First match some system type aliases that might get confused
+	# with valid system types.
 	# -solaris* is a basic system type, with this one exception.
 	-auroraux)
 		os=-auroraux
@@ -1342,45 +1349,48 @@ case $os in
 	-solaris)
 		os=-solaris2
 		;;
-	-svr4*)
-		os=-sysv4
-		;;
 	-unixware*)
 		os=-sysv4.2uw
 		;;
 	-gnu/linux*)
 		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
 		;;
-	# First accept the basic system types.
+	# es1800 is here to avoid being matched by es* (a different OS)
+	-es1800*)
+		os=-ose
+		;;
+	# Now accept the basic system types.
 	# The portable systems comes first.
-	# Each alternative MUST END IN A *, to match a version number.
+	# Each alternative MUST end in a * to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
 	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
 	      | -sym* | -kopensolaris* | -plan9* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* | -aros* \
+	      | -aos* | -aros* | -cloudabi* | -sortix* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -bitrig* | -openbsd* | -solidbsd* \
+	      | -hiux* | -knetbsd* | -mirbsd* | -netbsd* \
+	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
-	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* \
+	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* | -hcos* \
+	      | -chorusos* | -chorusrdb* | -cegcc* | -glidix* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
+	      | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
 	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
-	      | -uxpv* | -beos* | -mpeix* | -udk* \
-	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
+	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
+	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
-	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
+	      | -morphos* | -superux* | -rtmk* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
+	      | -onefs* | -tirtos* | -phoenix* | -fuchsia* | -redox* | -bme* \
+	      | -midnightbsd*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1397,12 +1407,12 @@ case $os in
 	-nto*)
 		os=`echo $os | sed -e 's|nto|nto-qnx|'`
 		;;
-	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
+	-sim | -xray | -os68k* | -v88r* \
+	      | -windows* | -osx | -abug | -netware* | -os9* \
 	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
 		;;
 	-mac*)
-		os=`echo $os | sed -e 's|mac|macos|'`
+		os=`echo "$os" | sed -e 's|mac|macos|'`
 		;;
 	-linux-dietlibc)
 		os=-linux-dietlibc
@@ -1411,10 +1421,10 @@ case $os in
 		os=`echo $os | sed -e 's|linux|linux-gnu|'`
 		;;
 	-sunos5*)
-		os=`echo $os | sed -e 's|sunos5|solaris2|'`
+		os=`echo "$os" | sed -e 's|sunos5|solaris2|'`
 		;;
 	-sunos6*)
-		os=`echo $os | sed -e 's|sunos6|solaris3|'`
+		os=`echo "$os" | sed -e 's|sunos6|solaris3|'`
 		;;
 	-opened*)
 		os=-openedition
@@ -1425,12 +1435,6 @@ case $os in
 	-wince*)
 		os=-wince
 		;;
-	-osfrose*)
-		os=-osfrose
-		;;
-	-osf*)
-		os=-osf
-		;;
 	-utek*)
 		os=-bsd
 		;;
@@ -1455,7 +1459,7 @@ case $os in
 	-nova*)
 		os=-rtmk-nova
 		;;
-	-ns2 )
+	-ns2)
 		os=-nextstep2
 		;;
 	-nsk*)
@@ -1477,7 +1481,7 @@ case $os in
 	-oss*)
 		os=-sysv3
 		;;
-	-svr4)
+	-svr4*)
 		os=-sysv4
 		;;
 	-svr3)
@@ -1492,32 +1496,38 @@ case $os in
 	-ose*)
 		os=-ose
 		;;
-	-es1800*)
-		os=-ose
-		;;
-	-xenix)
-		os=-xenix
-		;;
 	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
 		os=-mint
 		;;
-	-aros*)
-		os=-aros
-		;;
 	-zvmoe)
 		os=-zvmoe
 		;;
 	-dicos*)
 		os=-dicos
 		;;
+	-pikeos*)
+		# Until real need of OS specific support for
+		# particular features comes up, bare metal
+		# configurations are quite functional.
+		case $basic_machine in
+		    arm*)
+			os=-eabi
+			;;
+		    *)
+			os=-elf
+			;;
+		esac
+		;;
 	-nacl*)
 		;;
+	-ios)
+		;;
 	-none)
 		;;
 	*)
 		# Get rid of the `-' at the beginning of $os.
 		os=`echo $os | sed 's/[^-]*-//'`
-		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
+		echo Invalid configuration \`"$1"\': system \`"$os"\' not recognized 1>&2
 		exit 1
 		;;
 esac
@@ -1607,12 +1617,12 @@ case $basic_machine in
 	sparc-* | *-sun)
 		os=-sunos4.1.1
 		;;
+	pru-*)
+		os=-elf
+		;;
 	*-be)
 		os=-beos
 		;;
-	*-haiku)
-		os=-haiku
-		;;
 	*-ibm)
 		os=-aix
 		;;
@@ -1652,7 +1662,7 @@ case $basic_machine in
 	m88k-omron*)
 		os=-luna
 		;;
-	*-next )
+	*-next)
 		os=-nextstep
 		;;
 	*-sequent)
@@ -1667,9 +1677,6 @@ case $basic_machine in
 	i370-*)
 		os=-mvs
 		;;
-	*-next)
-		os=-nextstep3
-		;;
 	*-gould)
 		os=-sysv
 		;;
@@ -1779,15 +1786,15 @@ case $basic_machine in
 				vendor=stratus
 				;;
 		esac
-		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
+		basic_machine=`echo "$basic_machine" | sed "s/unknown/$vendor/"`
 		;;
 esac

-echo $basic_machine$os
+echo "$basic_machine$os"
 exit

 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
--- a/configure.ng
+++ b/configure.ng
@@ -154,15 +154,30 @@ AC_HEADER_TIME

 # Required header files
 AC_CHECK_HEADERS([ \
-	fcntl.h netdb.h netinet/in.h stdlib.h string.h \
-	strings.h sys/socket.h sys/time.h sys/types.h unistd.h \
+		fcntl.h \
+		netdb.h \
+		netinet/in.h \
+		stdlib.h \
+		string.h \
+		strings.h \
+		sys/socket.h \
+		sys/time.h \
+		sys/types.h \
+		unistd.h \
 	],,AC_MSG_ERROR([required C header missing!]))

 # Optional header files
 AC_CHECK_HEADERS_ONCE([ \
-	arpa/inet.h inttypes.h malloc.h netinet/in_systm.h netinet/ip.h \
-	stdbool.h stddef.h stdint.h varargs.h \
-	])
+	arpa/inet.h \
+	inttypes.h \
+	malloc.h \
+	netinet/in_systm.h \
+	netinet/ip.h \
+	stdbool.h \
+	stddef.h \
+	stdint.h \
+	varargs.h \
+])

 # -- Datatypes --

@@ -212,17 +227,49 @@ AC_FUNC_STRFTIME

 # Required functions
 AC_CHECK_FUNCS([ \
-	alarm dup2 endpwent gethostbyaddr gethostbyname gethostname \
-	gettimeofday inet_ntoa memmove memset setsid socket strcasecmp \
-	strchr strcspn strerror strncasecmp strrchr strspn strstr \
+		alarm \
+		dup2 \
+		endpwent \
+		gethostbyaddr \
+		gethostbyname \
+		gethostname \
+		gettimeofday \
+		inet_ntoa \
+		memmove \
+		memset \
+		setsid \
+		socket \
+		strcasecmp \
+		strchr \
+		strcspn \
+		strerror \
+		strncasecmp \
+		strrchr \
+		strspn \
+		strstr \
 	],,
 	AC_MSG_ERROR([required function missing!]))

 # Optional functions
 AC_CHECK_FUNCS_ONCE([
-	arc4random arc4random_stir gai_strerror getnameinfo inet_aton \
-	setgroups sigaction sigprocmask snprintf strdup strlcat strlcpy \
-	strndup strtok_r unsetenv vsnprintf waitpid])
+	arc4random \
+	arc4random_stir \
+	gai_strerror \
+	getnameinfo \
+	inet_aton \
+	setgroups \
+	sigaction \
+	sigprocmask \
+	snprintf \
+	strdup \
+	strlcat \
+	strlcpy \
+	strndup \
+	strtok_r \
+	unsetenv \
+	vsnprintf \
+	waitpid \
+])

 WORKING_GETADDRINFO

@@ -418,8 +465,8 @@ AC_ARG_WITH(openssl,
 				LDFLAGS="-L$withval/lib $LDFLAGS"
 			fi
 			AC_CHECK_LIB(crypto, BIO_s_mem)
-			AC_CHECK_LIB(ssl, SSL_library_init)
-			AC_CHECK_FUNCS(SSL_library_init, x_ssl_openssl=yes,
+			AC_CHECK_LIB(ssl, SSL_new)
+			AC_CHECK_FUNCS(SSL_new, x_ssl_openssl=yes,
 				AC_MSG_ERROR([Can't enable openssl])
 			)
 		fi
--- a/contrib/Debian/.gitignore
+++ b/contrib/Debian/.gitignore
@@ -4,10 +4,13 @@
 files
 ngircd/
 ngircd-full/
+ngircd.service
 ngircd-full.default
 ngircd-full.init
 ngircd-full.postinst
+ngircd-full.service
 ngircd-full-dbg/
 ngircd-full-dbg.default
 ngircd-full-dbg.init
 ngircd-full-dbg.postinst
+ngircd-full-dbg.service
--- a/contrib/Debian/Makefile.am
+++ b/contrib/Debian/Makefile.am
@@ -1,6 +1,6 @@
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2010 Alexander Barton (alex@barton.de)
+# Copyright (c)2001-2017 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -10,7 +10,8 @@
 #

 EXTRA_DIST = rules changelog compat control copyright \
-	ngircd.init ngircd.default ngircd.pam ngircd.postinst
+	ngircd.init ngircd.default ngircd.pam ngircd.postinst \
+	source/format

 maintainer-clean-local:
 	rm -f Makefile Makefile.in
--- a/contrib/Debian/changelog
+++ b/contrib/Debian/changelog
@@ -1,8 +1,44 @@
+ngircd (25-0ab1) unstable; urgency=low
+
+  * New "upstream" release: ngIRCd 25.
+
+ -- Alexander Barton <alex@barton.de>  Wed, 23 Jan 2019 23:13:03 +0100
+
+ngircd (25~rc1-0ab1) unstable; urgency=low
+
+  * New "upstream" release candidate 1 for ngIRCd Release 25.
+
+ -- Alexander Barton <alex@barton.de>  Sat, 11 Aug 2018 21:35:08 +0200
+
+ngircd (24-0ab1) unstable; urgency=low
+
+  * New "upstream" release: ngIRCd 24.
+
+ -- Alexander Barton <alex@barton.de>  Fri, 20 Jan 2017 16:43:09 +0100
+
+ngircd (24~rc1-0ab2) unstable; urgency=low
+
+  * Use OpenSSL instead of GnuTLS for SSL-enabled packages.
+
+ -- Alexander Barton <alex@barton.de>  Fri, 20 Jan 2017 15:20:07 +0100
+
+ngircd (24~rc1-0ab1) unstable; urgency=low
+
+  * New "upstream" release candidate 1 for ngIRCd Release 24.
+
+ -- Alexander Barton <alex@barton.de>  Sat, 07 Jan 2017 18:58:02 +0100
+
+ngircd (23-0ab1) unstable; urgency=low
+
+  * New "upstream" release: ngIRCd 23.
+
+ -- Alexander Barton <alex@barton.de>  Mon, 16 Nov 2015 21:27:03 +0100
+
 ngircd (23~rc1-0ab1) unstable; urgency=low

  * New "upstream" release candidate 1 for ngIRCd Release 23.

- -- Alexander Barton <alex@arthur.barton.de>  Sun, 06 Sep 2015 16:55:23 +0200
+ -- Alexander Barton <alex@barton.de>  Sun, 06 Sep 2015 16:55:23 +0200

 ngircd (22.1-0ab1) unstable; urgency=low

--- a/contrib/Debian/compat
+++ b/contrib/Debian/compat
@@ -1 +1 @@
-4
+9
--- a/contrib/Debian/control
+++ b/contrib/Debian/control
@@ -2,14 +2,15 @@ Source: ngircd
 Section: net
 Priority: optional
 Maintainer: Alexander Barton <alex@barton.de>
-Build-Depends: debhelper (>> 4.0.0),
+Build-Depends: debhelper (>> 9.0.0),
    autotools-dev,
+    dh-systemd (>= 1.5),
    expect,
-    libz-dev,
-    libwrap0-dev,
    libident-dev,
-    libgnutls-dev,
    libpam0g-dev,
+    libssl-dev,
+    libwrap0-dev,
+    libz-dev,
    telnet | telnet-ssl,
 Standards-Version: 3.9.1

--- a/contrib/Debian/ngircd.postinst
+++ b/contrib/Debian/ngircd.postinst
@@ -1,7 +1,6 @@
 #!/bin/sh
 #
 # Debian post-installation script
-# $Id: ngircd.postinst,v 1.2 2006/12/26 14:44:40 alex Exp $
 #

 set -e
@@ -12,6 +11,7 @@ case "$1" in
 			# make sure that the configuration file is not
 			# world-readable, it contains passwords!
 			chmod o= /etc/ngircd/ngircd.conf
+			chgrp irc /etc/ngircd/ngircd.conf
 		fi
 		;;
 esac
--- a/contrib/Debian/rules
+++ b/contrib/Debian/rules
@@ -1,7 +1,7 @@
 #!/usr/bin/make -f
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2016 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -55,7 +55,7 @@ configure-ngircd-full: configure
 	  --mandir=\$${prefix}/share/man \
 	  --docdir=\$${prefix}/share/doc/ngircd-full \
 	  --with-syslog --with-zlib \
-	  --with-gnutls --with-iconv --with-ident --with-tcp-wrappers \
+	  --with-openssl --with-iconv --with-ident --with-tcp-wrappers \
 	  --with-pam \
 	  --enable-ipv6

@@ -70,12 +70,12 @@ configure-ngircd-full-dbg: configure
 	  --docdir=\$${prefix}/share/doc/ngircd-full-dbg \
 	  --enable-debug --enable-sniffer \
 	  --with-syslog --with-zlib \
-	  --with-gnutls --with-iconv --with-ident --with-tcp-wrappers \
+	  --with-openssl --with-iconv --with-ident --with-tcp-wrappers \
 	  --with-pam \
 	  --enable-ipv6

 build:
-	dh_clean -k
+	dh_prep

 build-ngircd: build-stamp-ngircd
 build-stamp-ngircd: configure-ngircd
@@ -111,12 +111,15 @@ clean:
 	dh_testdir
 	dh_testroot
 	rm -f build-stamp*
+	rm -f $(CURDIR)/debian/ngircd.service
 	rm -f $(CURDIR)/debian/ngircd-full.default
 	rm -f $(CURDIR)/debian/ngircd-full.init
 	rm -f $(CURDIR)/debian/ngircd-full.postinst
+	rm -f $(CURDIR)/debian/ngircd-full.service
 	rm -f $(CURDIR)/debian/ngircd-full-dbg.default
 	rm -f $(CURDIR)/debian/ngircd-full-dbg.postinst
 	rm -f $(CURDIR)/debian/ngircd-full-dbg.init
+	rm -f $(CURDIR)/debian/ngircd-full-dbg.service

 	# Add here commands to clean up after the build process:
 	[ ! -f Makefile ] || $(MAKE) distclean
@@ -140,7 +143,6 @@ install-ngircd: build-ngircd
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/ngircd
 	rm $(CURDIR)/debian/ngircd/usr/share/doc/ngircd/INSTALL*
 	rm $(CURDIR)/debian/ngircd/usr/share/doc/ngircd/COPYING*
-	mkdir -p $(CURDIR)/debian/ngircd/var/run/ircd
 	cat $(CURDIR)/debian/ngircd/usr/share/doc/ngircd/sample-ngircd.conf | \
 	 sed -e "s|;ServerUID = 65534|ServerUID = irc|g" | \
 	 sed -e "s|;ServerGID = 65534|ServerGID = irc|g" | \
@@ -157,7 +159,6 @@ install-ngircd-full: build-ngircd-full
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/ngircd-full
 	rm $(CURDIR)/debian/ngircd-full/usr/share/doc/ngircd-full/INSTALL*
 	rm $(CURDIR)/debian/ngircd-full/usr/share/doc/ngircd-full/COPYING*
-	mkdir -p $(CURDIR)/debian/ngircd-full/var/run/ircd
 	cat $(CURDIR)/debian/ngircd-full/usr/share/doc/ngircd-full/sample-ngircd.conf | \
 	 sed -e "s|;ServerUID = 65534|ServerUID = irc|g" | \
 	 sed -e "s|;ServerGID = 65534|ServerGID = irc|g" | \
@@ -176,7 +177,6 @@ install-ngircd-full-dbg: build-ngircd-full-dbg
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/ngircd-full-dbg
 	rm $(CURDIR)/debian/ngircd-full-dbg/usr/share/doc/ngircd-full-dbg/INSTALL*
 	rm $(CURDIR)/debian/ngircd-full-dbg/usr/share/doc/ngircd-full-dbg/COPYING*
-	mkdir -p $(CURDIR)/debian/ngircd-full-dbg/var/run/ircd
 	cat $(CURDIR)/debian/ngircd-full-dbg/usr/share/doc/ngircd-full-dbg/sample-ngircd.conf | \
 	 sed -e "s|;ServerUID = 65534|ServerUID = irc|g" | \
 	 sed -e "s|;ServerGID = 65534|ServerGID = irc|g" | \
@@ -192,12 +192,18 @@ binary-indep:

 # Build architecture-dependent files here.
 binary-arch: build install
+	ln -s $(CURDIR)/contrib/ngircd.service \
+	 $(CURDIR)/debian/ngircd.service
+
 	ln -s $(CURDIR)/debian/ngircd.default \
 	 $(CURDIR)/debian/ngircd-full.default
 	ln -s $(CURDIR)/debian/ngircd.init \
 	 $(CURDIR)/debian/ngircd-full.init
 	ln -s $(CURDIR)/debian/ngircd.postinst \
 	 $(CURDIR)/debian/ngircd-full.postinst
+	cp $(CURDIR)/contrib/ngircd.service \
+	 $(CURDIR)/debian/ngircd-full.service
+	echo "Alias=ngircd.service" >>$(CURDIR)/debian/ngircd-full.service

 	ln -s $(CURDIR)/debian/ngircd.default \
 	 $(CURDIR)/debian/ngircd-full-dbg.default
@@ -205,12 +211,17 @@ binary-arch: build install
 	 $(CURDIR)/debian/ngircd-full-dbg.init
 	ln -s $(CURDIR)/debian/ngircd.postinst \
 	 $(CURDIR)/debian/ngircd-full-dbg.postinst
+	cp $(CURDIR)/contrib/ngircd.service \
+	 $(CURDIR)/debian/ngircd-full-dbg.service
+	echo "Alias=ngircd.service" >>$(CURDIR)/debian/ngircd-full-dbg.service

 	dh_testdir
 	dh_testroot
 	dh_installchangelogs -a -A ChangeLog
 	dh_installdocs -a
+	dh_systemd_enable -a
 	dh_installinit -a
+	dh_systemd_start -a
 	dh_strip -a --no-package=ngircd-full-dbg
 	dh_compress -a -XCommands.txt
 	dh_fixperms -a
@@ -222,6 +233,6 @@ binary-arch: build install

 binary: binary-indep binary-arch

-.PHONY: build clean binary-indep binary-arch binary install 
+.PHONY: build clean binary-indep binary-arch binary install

 # -eof-
--- a/contrib/Debian/source/format
+++ b/contrib/Debian/source/format
@@ -0,0 +1 @@
+1.0
--- a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj
+++ b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj
@@ -51,18 +51,6 @@
 		FAE5CC2E0CF2308A007D69B6 /* numeric.c in Sources */ = {isa = PBXBuildFile; fileRef = FAE5CC2D0CF2308A007D69B6 /* numeric.c */; };
 /* End PBXBuildFile section */

-/* Begin PBXCopyFilesBuildPhase section */
-		8DD76FAF0486AB0100D96B5E /* CopyFiles */ = {
-			isa = PBXCopyFilesBuildPhase;
-			buildActionMask = 8;
-			dstPath = /usr/share/man/man1/;
-			dstSubfolderSpec = 0;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 1;
-		};
-/* End PBXCopyFilesBuildPhase section */
-
 /* Begin PBXFileReference section */
 		FA18A63E16CEDDCE00132F66 /* configure.ng */ = {isa = PBXFileReference; lastKnownFileType = text; name = configure.ng; path = ../../configure.ng; sourceTree = "<group>"; };
 		FA18A63F16CEDE2300132F66 /* ngircd.service */ = {isa = PBXFileReference; lastKnownFileType = text; path = ngircd.service; sourceTree = "<group>"; };
@@ -203,11 +191,12 @@
 		FA322DC00CEF77CB001761B3 /* libz.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libz.dylib; path = /usr/lib/libz.dylib; sourceTree = "<absolute>"; };
 		FA407F2C0DB159F400271AF1 /* ng_ipaddr.c */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.c; name = ng_ipaddr.c; path = ipaddr/ng_ipaddr.c; sourceTree = "<group>"; };
 		FA407F2D0DB159F400271AF1 /* ng_ipaddr.h */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.h; name = ng_ipaddr.h; path = ipaddr/ng_ipaddr.h; sourceTree = "<group>"; };
-		FA407F380DB15AC700271AF1 /* GIT.txt */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = GIT.txt; sourceTree = "<group>"; };
 		FA4B08E513E7F8FB00765BA3 /* ngircd-bsd.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = "ngircd-bsd.sh"; sourceTree = "<group>"; };
 		FA4B08E613E7F91700765BA3 /* ngIRCd-Logo.gif */ = {isa = PBXFileReference; lastKnownFileType = image.gif; path = "ngIRCd-Logo.gif"; sourceTree = "<group>"; };
 		FA4B08E713E7F91700765BA3 /* ngircd-redhat.init */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = "ngircd-redhat.init"; sourceTree = "<group>"; };
 		FA4B08E813E7F91C00765BA3 /* platformtest.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = platformtest.sh; sourceTree = "<group>"; };
+		FA4B4F542055B47C00A04296 /* ngircd.logcheck */ = {isa = PBXFileReference; lastKnownFileType = text; path = ngircd.logcheck; sourceTree = "<group>"; };
+		FA4B4F552055B4C800A04296 /* source */ = {isa = PBXFileReference; lastKnownFileType = folder; path = source; sourceTree = "<group>"; };
 		FA4F1659164836B100DBD011 /* irc-metadata.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = "irc-metadata.c"; sourceTree = "<group>"; };
 		FA4F165C164836BF00DBD011 /* irc-metadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "irc-metadata.h"; sourceTree = "<group>"; };
 		FA6BBC5F1605F0AB0004247A /* conn-encoding.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = "conn-encoding.c"; sourceTree = "<group>"; };
@@ -488,6 +477,7 @@
 				FA4B08E513E7F8FB00765BA3 /* ngircd-bsd.sh */,
 				FA4B08E613E7F91700765BA3 /* ngIRCd-Logo.gif */,
 				FA4B08E713E7F91700765BA3 /* ngircd-redhat.init */,
+				FA4B4F542055B47C00A04296 /* ngircd.logcheck */,
 				FA18A63F16CEDE2300132F66 /* ngircd.service */,
 				FA18A64016CEDE2300132F66 /* ngircd.socket */,
 				FA322D940CEF7523001761B3 /* ngircd.spec */,
@@ -511,6 +501,7 @@
 				FA18A64116CEDE3500132F66 /* ngircd.pam */,
 				FA322D710CEF7523001761B3 /* ngircd.postinst */,
 				FA322D720CEF7523001761B3 /* rules */,
+				FA4B4F552055B4C800A04296 /* source */,
 			);
 			path = Debian;
 			sourceTree = "<group>";
@@ -546,7 +537,6 @@
 				FA18A64416CEDFCE00132F66 /* Commands.txt */,
 				FAE22BD415270EA300F1A5AB /* Contributing.txt */,
 				FA322D9A0CEF752C001761B3 /* FAQ.txt */,
-				FA407F380DB15AC700271AF1 /* GIT.txt */,
 				FAE22BD515270EB500F1A5AB /* HowToRelease.txt */,
 				FAE22BD615270EB500F1A5AB /* Modes.txt */,
 				FAE22BD715270EB500F1A5AB /* PAM.txt */,
@@ -617,7 +607,6 @@
 			buildPhases = (
 				8DD76FAB0486AB0100D96B5E /* Sources */,
 				8DD76FAD0486AB0100D96B5E /* Frameworks */,
-				8DD76FAF0486AB0100D96B5E /* CopyFiles */,
 			);
 			buildRules = (
 			);
@@ -635,7 +624,7 @@
 		08FB7793FE84155DC02AAC07 /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				LastUpgradeCheck = 0630;
+				LastUpgradeCheck = 1000;
 			};
 			buildConfigurationList = 1DEB928908733DD80010E9CD /* Build configuration list for PBXProject "ngIRCd" */;
 			compatibilityVersion = "Xcode 3.2";
@@ -715,80 +704,81 @@
 		1DEB928708733DD80010E9CD /* Default */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS = YES;
-				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
-				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
-				GCC_WARN_CHECK_SWITCH_STATEMENTS = YES;
-				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
-				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
-				GCC_WARN_MISSING_PARENTHESES = YES;
-				GCC_WARN_PEDANTIC = YES;
-				GCC_WARN_SHADOW = YES;
-				GCC_WARN_SIGN_COMPARE = YES;
-				GCC_WARN_TYPECHECK_CALLS_TO_PRINTF = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES;
-				GCC_WARN_UNKNOWN_PRAGMAS = YES;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_LABEL = YES;
-				GCC_WARN_UNUSED_PARAMETER = YES;
-				GCC_WARN_UNUSED_VALUE = YES;
-				INSTALL_PATH = /usr/local/bin;
-				PRODUCT_NAME = ngircd;
 			};
 			name = Default;
 		};
 		1DEB928B08733DD80010E9CD /* Default */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				CODE_SIGN_IDENTITY = "";
-				GCC_VERSION = "";
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_WARN_ASSIGN_ENUM = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_SEMICOLON_BEFORE_METHOD_BODY = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_IMPLICIT_CONVERSION = YES;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_MISSING_FIELD_INITIALIZERS = YES;
+				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
+				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES;
+				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
+				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
+				GCC_WARN_PEDANTIC = YES;
+				GCC_WARN_SHADOW = YES;
+				GCC_WARN_SIGN_COMPARE = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_LABEL = YES;
+				GCC_WARN_UNUSED_PARAMETER = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 10.6;
-				SDKROOT = "";
+				PRODUCT_NAME = ngircd;
 			};
 			name = Default;
 		};
 		FAB0570C105D917F006AF9E2 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				GCC_DEBUGGING_SYMBOLS = full;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_VERSION = "";
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_WARN_ASSIGN_ENUM = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_SEMICOLON_BEFORE_METHOD_BODY = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_IMPLICIT_CONVERSION = YES;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_MISSING_FIELD_INITIALIZERS = YES;
+				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
+				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES;
+				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
+				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
+				GCC_WARN_PEDANTIC = YES;
+				GCC_WARN_SHADOW = YES;
+				GCC_WARN_SIGN_COMPARE = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_LABEL = YES;
+				GCC_WARN_UNUSED_PARAMETER = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 10.6;
 				ONLY_ACTIVE_ARCH = YES;
+				PRODUCT_NAME = ngircd;
 				SDKROOT = "";
+				STRIP_INSTALLED_PRODUCT = NO;
 			};
 			name = Debug;
 		};
 		FAB0570D105D917F006AF9E2 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS = YES;
-				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
-				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
-				GCC_WARN_CHECK_SWITCH_STATEMENTS = YES;
-				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
-				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
-				GCC_WARN_MISSING_PARENTHESES = YES;
-				GCC_WARN_PEDANTIC = YES;
-				GCC_WARN_SHADOW = YES;
-				GCC_WARN_SIGN_COMPARE = YES;
-				GCC_WARN_TYPECHECK_CALLS_TO_PRINTF = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = NO;
-				GCC_WARN_UNKNOWN_PRAGMAS = YES;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_LABEL = YES;
-				GCC_WARN_UNUSED_PARAMETER = YES;
-				GCC_WARN_UNUSED_VALUE = YES;
-				INSTALL_PATH = /usr/local/bin;
-				PRODUCT_NAME = ngircd;
 			};
 			name = Debug;
 		};
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -1,6 +1,6 @@
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2013 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2017 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,6 +16,7 @@ EXTRA_DIST = README \
 	ngircd-bsd.sh \
 	ngIRCd-Logo.gif \
 	ngircd-redhat.init \
+	ngircd.logcheck \
 	ngircd.service \
 	ngircd.socket \
 	ngircd.spec \
--- a/contrib/README
+++ b/contrib/README
@@ -12,7 +12,7 @@
 Debian/
 - Various files for building Debian GNU/Linux packages (".deb's").
 	- ngircd.init; ngircd.default: init script for Debian-based systems.
-	- ngircd.pam: example PAM configuraton.
+	- ngircd.pam: example PAM configuration.

 MacOSX/
 - Project files for XCode, the "project builder" of Apple Mac OS X.
@@ -27,6 +27,9 @@ ngircd-bsd.sh
 ngircd-redhat.init
 - Start/stop script for RedHat-based distributions (like CentOS).

+ngircd.logcheck
+ - Sample rules for logcheck(8) to ignore "normal" log messages of ngIRCd.
+
 ngircd.service
 - systemd(8) service unit configuration file.

--- a/contrib/ngindent
+++ b/contrib/ngindent
@@ -1,17 +1,17 @@
-#/bin/sh
+#!/bin/sh

 INDENTARGS="-kr -i8 -ts8 -l80 -c3 -cd41 -ss -ncs -psl"

 # check if indent(1) is available
-type indent >/dev/null 2>&1 && INDENT="indent"
-type gindent >/dev/null 2>&1 && INDENT="gindent"
-type gnuindent >/dev/null 2>&1 && INDENT="gnuindent"
+command -v indent >/dev/null 2>&1 && INDENT="indent"
+command -v gindent >/dev/null 2>&1 && INDENT="gindent"
+command -v gnuindent >/dev/null 2>&1 && INDENT="gnuindent"

 if [ -z "$INDENT" ]; then
 	echo "Error: GNU \"indent\" not found!"
 	exit 1
 fi

-$INDENT -v $INDENTARGS $*
+$INDENT -v $INDENTARGS "$@"

 # -eof-
--- a/contrib/ngircd-bsd.sh
+++ b/contrib/ngircd-bsd.sh
--- a/contrib/ngircd-redhat.init
+++ b/contrib/ngircd-redhat.init
--- a/contrib/ngircd.logcheck
+++ b/contrib/ngircd.logcheck
@@ -0,0 +1,61 @@
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Accepted connection [0-9]+ from ".*:[0-9]+" on socket [0-9]+\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve address ".*": Name or service not known \[.*\]\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve ".*": host not found$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve ".*": Name or service not known$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve ".*": No address associated with hostname$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Can't connect\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Client closed connection\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Got QUIT command\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Read error\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): SSL accept error, closing socket\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client ".*" unregistered (connection [0-9]+): Timeout\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Timeout\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Write error\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized SSL3\.0 using cipher .*\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized TLS1\.[012] using cipher .*\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized TLSv1\.[012] using cipher .*\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized TLSv1 using cipher .*\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+ \(socket [0-9]+\) with ".*:[0-9]+" established\. Now logging in \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+ with ".*:[0-9]+" closed \(in: .*, out: .*\)\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Enabled link compression \(zlib\) on connection [0-9]+\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Establishing connection for ".*" to ".*:[0-9]+" \(.*\), socket [0-9]+ \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: IDENT lookup for connection [0-9]+: ".*"\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: IDENT lookup for connection [0-9]+: no result\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Now listening on .*:[0-9]+ \(socket [0-9]+\)\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: OpenSSL .* initialized\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Possible forgery: .* resolved to ".*", which has no IP address!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Preparing to establish a new server link for ".*" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Read error on connection [0-9]+ \(socket [0-9]+\): Connection reset by peer!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Server ".*" registered \(via .*, connected to .*, [0-9]+ hops\)\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Server ".*" unregistered: .* .*\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Server ".*" unregistered: ".*" \(SQUIT from .*\)\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down all listening sockets \([0-9]+ total\) \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Can't connect\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Client closed connection\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Got QUIT command\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Ping timeout: [0-9]+ seconds\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Read error\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Server going down\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(SSL accept error, closing socket\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Timeout\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Write error\) with ".*:[0-9]+" \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL connection [0-9]+ shutting down \.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL connection [0-9]+ with ".*:[0-9]+" established\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL connection on socket [0-9]+ failed!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: A TLS packet with unexpected length was received\. \[ConnSSL_Read\]\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: A TLS packet with unexpected length was received\. \[gnutls_handshake\]\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: Broken pipe \[in ConnSSL_Write\(\)\]!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: Connection reset by peer \[in ConnSSL_Read\(\)\]!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: Connection reset by peer \[in SSL_connect\(\)\]!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL protocol error: SSL_accept \(.*\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" changed nick \(connection [0-9]+\): ".*" -> ".*"\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" registered \(connection [0-9]+\)\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Client closed connection\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Got QUIT command\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Ping timeout: [0-9]+ seconds\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Read error\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Server going down\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: warning: can't get client address: Connection reset by peer$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: warning: /etc/hosts\.allow, line [0-9]+: can't verify hostname: getaddrinfo\(.*, AF_INET\) failed$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Write error on connection [0-9]+ \(socket [0-9]+\): Broken pipe!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Write error on connection [0-9]+ \(socket [0-9]+\): Connection reset by peer!$
--- a/contrib/ngircd.service
+++ b/contrib/ngircd.service
@@ -1,20 +1,41 @@
+# ngIRCd systemd service unit.
+# See systemd(1), systemd.unit(5), systemd.service(5), systemd.exec(5).
+
 [Unit]
 Description=Next Generation IRC Daemon
+Documentation=man:ngircd(8) man:ngircd.conf(5) https://ngircd.barton.de
 After=network.target
+Wants=anope.service atheme.service irc-services.service
+Wants=bopm.service
+Before=anope.service atheme.service irc-services.service
+Before=bopm.service

 [Service]
 Type=forking
 User=irc
 Group=irc
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SYS_CHROOT CAP_NET_BIND_SERVICE
-PrivateTmp=yes
+# Settings & limits:
+CapabilityBoundingSet=CAP_SYS_CHROOT CAP_NET_BIND_SERVICE
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
 PrivateDevices=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
 ProtectSystem=full
-ProtectHome=true
-NoNewPrivileges=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=yes
 RuntimeDirectory=ircd
 RuntimeDirectoryMode=750
-ExecStart=/usr/sbin/ngircd
+# Try to load "default files" from any Debian package variant to keep this
+# unit generic.
+EnvironmentFile=-/etc/default/ngircd
+EnvironmentFile=-/etc/default/ngircd-full
+EnvironmentFile=-/etc/default/ngircd-full-dbg
+# Start ngIRCd. Note: systemd doesn't allow to use $DAEMON here!
+ExecStart=/usr/sbin/ngircd $PARAMS
 ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure

--- a/contrib/ngircd.socket
+++ b/contrib/ngircd.socket
@@ -1,5 +1,6 @@
 [Unit]
 Description=Next Generation IRC Daemon (Socket)
+Documentation=man:ngircd(8) man:ngircd.conf(5)

 [Socket]
 BindIPv6Only=ipv6-only
--- a/contrib/ngircd.spec
+++ b/contrib/ngircd.spec
@@ -1,5 +1,5 @@
 %define name    ngircd
-%define version 23~rc1
+%define version 25
 %define release 1
 %define prefix  %{_prefix}

@@ -27,7 +27,7 @@ Advantages:
 - supports IPv6 and SSL
 - no problems with servers that have dynamic IP addresses
 - freely available, modern, portable and tidy C-source
- - ngIRCd is being actively developed since 11 years.
+ - ngIRCd is being actively developed since 2001

 %prep
 %setup -q
--- a/contrib/platformtest.sh
+++ b/contrib/platformtest.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2016 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,14 +14,14 @@
 # suitable for inclusion in doc/Platforms.txt -- please send reports
 # to the ngIRCd mailing list: <ngircd-ml@ngircd.barton.de>.

-NAME=`basename "$0"`
+NAME=$(basename "$0")
 VERBOSE=
 CLEAN=1

 PLATFORM=
 COMPILER="unknown"
 VERSION="unknown"
-DATE=`date "+%y-%m-%d"`
+DATE=$(date "+%y-%m-%d")
 COMMENT=

 R_CONFIGURE=
@@ -30,7 +30,7 @@ R_CHECK=
 R_CHECK_Y="?"
 R_RUN=

-SRC_D=`dirname "$0"`
+SRC_D=$(dirname "$0")
 MY_D="$PWD"

 [ -n "$MAKE" ] || MAKE="make"
@@ -55,6 +55,11 @@ while [ $# -gt 0 ]; do
 	shift
 done

+for cmd in telnet expect; do
+	command -v "$cmd" >/dev/null 2>&1 \
+		|| echo "$NAME: WARNING: $cmd(1) not found, \"make check\" won't run all tests!"
+done
+
 echo "$NAME: Checking ngIRCd base source directory ..."
 grep "ngIRCd" "$SRC_D/ChangeLog" >/dev/null 2>&1
 if [ $? -ne 0 ]; then
@@ -72,10 +77,14 @@ echo "$NAME: Checking for GIT tree ..."
 if [ -d "$SRC_D/.git" ]; then
 	echo "$NAME: Checking for \"git\" command ..."
 	git version >/dev/null 2>&1
-	if [ $? -eq 0 -a -n "$CLEAN" ]; then
+	if [ $? -eq 0 ] && [ -n "$CLEAN" ]; then
 		echo "$NAME: Running \"git clean\" ..."
 		cd "$SRC_D" || exit 1
-		[ -n "$VERBOSE" ] && git clean -dxf || git clean -dxf >/dev/null
+		if [ -n "$VERBOSE" ]; then
+			git clean -dxf
+		else
+			git clean -dxf >/dev/null
+		fi
 		cd "$MY_D" || exit 1
 	fi
 fi
@@ -84,21 +93,42 @@ echo "$NAME: Checking for \"$SRC_D/configure\" script ..."
 if [ ! -r "$SRC_D/configure" ]; then
 	echo "$NAME: Running \"$SRC_D/autogen.sh\" ..."
 	cd "$SRC_D" || exit 1
-	[ -n "$VERBOSE" ] && ./autogen.sh || ./autogen.sh >/dev/null
+	if [ -n "$VERBOSE" ]; then
+		./autogen.sh
+	else
+		./autogen.sh >/dev/null
+	fi
+	if [ $? -ne 0 ]; then
+		echo "$NAME: \"$SRC_D/autogen.sh\" script failed, aborting!"
+		exit 1
+	fi
 	cd "$MY_D" || exit 1
 fi

 if [ -r "$SRC_D/configure" ]; then
 	echo "$NAME: Running \"$SRC_D/configure\" script ..."
-	[ -n "$VERBOSE" ] && "$SRC_D/configure" -C || "$SRC_D/configure" -C >/dev/null
-	if [ $? -eq 0 -a -r ./Makefile ]; then
+	if [ -n "$VERBOSE" ]; then
+		"$SRC_D/configure" -C
+	else
+		"$SRC_D/configure" -C >/dev/null
+	fi
+	if [ $? -eq 0 ] && [ -r ./Makefile ]; then
 		R_CONFIGURE=1
+		rm -f "src/ngircd/ngircd"
 		echo "$NAME: Running \"$MAKE\" ..."
-		[ -n "$VERBOSE" ] && "$MAKE" || "$MAKE" >/dev/null
-		if [ $? -eq 0 -a -x src/ngircd/ngircd ]; then
+		if [ -n "$VERBOSE" ]; then
+			"$MAKE"
+		else
+			"$MAKE" >/dev/null
+		fi
+		if [ $? -eq 0 ] && [ -x src/ngircd/ngircd ]; then
 			R_MAKE=1
 			echo "$NAME: Running \"$MAKE check\" ..."
-			[ -n "$VERBOSE" ] && "$MAKE" check || "$MAKE" check >/dev/null
+			if [ -n "$VERBOSE" ]; then
+				"$MAKE" check
+			else
+				"$MAKE" check >/dev/null
+			fi
 			if [ $? -eq 0 ]; then
 				R_CHECK=1
 				R_RUN=$R_CHECK
@@ -115,13 +145,13 @@ fi

 # Get target platform information
 if [ -r "src/config.h" ]; then
-	CPU=`grep "HOST_CPU" "src/config.h" | cut -d'"' -f2`
-	OS=`grep "HOST_OS" "src/config.h" | cut -d'"' -f2`
-	VENDOR=`grep "HOST_VENDOR" "src/config.h" | cut -d'"' -f2`
+	CPU=$(grep "HOST_CPU" "src/config.h" | cut -d'"' -f2)
+	OS=$(grep "HOST_OS" "src/config.h" | cut -d'"' -f2)
+	VENDOR=$(grep "HOST_VENDOR" "src/config.h" | cut -d'"' -f2)
 	PLATFORM="$CPU/$VENDOR/$OS"
 fi
 if [ -z "$PLATFORM" ]; then
-	PLATFORM="`uname 2>/dev/null` `uname -r 2>/dev/null`, `uname -m 2>/dev/null`"
+	PLATFORM="$(uname 2>/dev/null) $(uname -r 2>/dev/null), $(uname -m 2>/dev/null)"
 fi

 # Get compiler information
@@ -153,8 +183,8 @@ if [ -r "Makefile" ]; then
 			  | cut -d'(' -f1 | sed -e 's/version //g')
 		fi
 		if [ "$COMPILER" = "unknown" ]; then
-			v="`$CC --version 2>/dev/null | head -1`"
-			[ -z "$v" ] && v="`$CC -version 2>/dev/null | head -1`"
+			v="$($CC --version 2>/dev/null | head -1)"
+			[ -z "$v" ] && v="$($CC -version 2>/dev/null | head -1)"
 			[ -n "$v" ] && COMPILER="$v"
 		fi
 	fi
@@ -164,7 +194,7 @@ fi
 eval "$(grep "^VERSION = " Makefile | sed -e 's/ //g')"
 case "$VERSION" in
 	*~*-*)
-		VERSION=`echo "$VERSION" | cut -b1-10`
+		VERSION=$(echo "$VERSION" | cut -b1-10)
 		;;
 esac
 [ -n "$VERSION" ] || VERSION="unknown"
@@ -184,7 +214,12 @@ fi
 [ -n "$R_CONFIGURE" ] && C="Y" || C="N"
 [ -n "$R_MAKE" ] && M="Y" || M="N"
 [ -n "$R_CHECK" ] && T="$R_CHECK_Y" || T="N"
-[ -n "$R_RUN" ] && R="Y" || R="N"
+if [ -n "$R_RUN" ]; then
+	# Mark "runs" with "Y" only when the test suite succeeded:
+	[ "$T" = "N" ] && R="?" || R="Y"
+else
+	R="N"
+fi
 [ -n "$COMMENT" ] && COMMENT=" $COMMENT"

 echo
@@ -195,17 +230,29 @@ echo "                                                  ./configure works --+ |
 echo "                                                                      | | | |"
 echo "Platform                    Compiler     ngIRCd     Date     Tester   C M T R *"
 echo "--------------------------- ------------ ---------- -------- -------- - - - - -"
-type printf >/dev/null 2>&1
+command -v printf >/dev/null 2>&1
 if [ $? -eq 0 ]; then
 	printf "%-27s %-12s %-10s %s %-8s %s %s %s %s%s\n" \
-	 "$PLATFORM" "$COMPILER" "$VERSION" "$DATE" "$USER" \
+	 "$PLATFORM" "$COMPILER" "$VERSION" "$DATE" "$LOGNAME" \
 	 "$C" "$M" "$T" "$R" "$COMMENT"
 else
-	echo "$PLATFORM $COMPILER $VERSION $DATE $USER" \
+	echo "$PLATFORM $COMPILER $VERSION $DATE $LOGNAME" \
 	 "$C" "$M" "$T" "$R" "$COMMENT"
 fi
 echo
+
+double_check() {
+	echo "Please double check that the ngIRCd daemon starts up, runs and handles IRC"
+	echo "connections successfully!"
+}
+
 if [ "$R_CHECK_Y" = "y" ]; then
-	echo "$NAME: Warning: Some tests have been skipped!"
+	echo "WARNING: Some tests have been skipped!"
+	double_check
+	echo
+fi
+if [ "$R" = "?" ]; then
+	echo "WARNING: The resulting binary passed simple tests, but the test suite failed!"
+	double_check
 	echo
 fi
--- a/doc/Commands.txt
+++ b/doc/Commands.txt
@@ -324,7 +324,7 @@ General Commands
 	In addition, IRC Ops can use these two forms to specify the <target>:
 	.
 	 - #<hostmask>
-	 - #<servermask>
+	 - $<servermask>
 	.
 	The <mask> can contain the wildcard characters "*" and "?", but must
 	contain at least one dot (".") and no wildcard after the last one.
@@ -380,7 +380,7 @@ Status and Informational Commands

 	Please note that "all" IRC daemons even parse separate nicknames in
 	a single parameter (like ":nick1 nick2"), and therefore ngIRCd
-	implements this behaviour, too.
+	implements this behavior, too.

 	References:
 	 - RFC 2812, 4.9 "Ison message"
--- a/doc/Contributing.txt
+++ b/doc/Contributing.txt
@@ -15,7 +15,7 @@ get an idea of how to do it the best :-)
 - Use GIT

   The source code of ngIRCd is maintained using GIT, see doc/GIT.txt. So if
-   remotely possible, use GIT for your work, too. It makes your and our lifes
+   remotely possible, use GIT for your work, too. It makes your and our lives
   much easier ;-)

 - Don't forget to include documentation
--- a/doc/FAQ.txt
+++ b/doc/FAQ.txt
@@ -99,7 +99,7 @@ IV. Bugs!?
 ~~~~~~~~~~

 Q: Is there a list of known bugs and desired feature enhancements?
-A: Yes. Have a look at the bug tracking system (Github issues) for ngIRCd located
+A: Yes. Have a look at the bug tracking system (GitHub issues) for ngIRCd located
   at <https://github.com/ngircd/ngircd/issues>. There you can file bug
   reports and feature requests as well as search the bug database.

--- a/doc/HowToRelease.txt
+++ b/doc/HowToRelease.txt
@@ -1,9 +1,8 @@

                     ngIRCd - Next Generation IRC Server
+                           http://ngircd.barton.de/

-                        (c)2001-2010 Alexander Barton,
-                    alex@barton.de, http://www.barton.de/
-
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

@@ -66,15 +65,16 @@ h) Run "./autogen.sh" to update the ./configure script with the correct

 i) Run "./configure" to rebuild all generated Makefiles.

-j) Run "make distcheck" to generate the distribution archives.
+j) Run "make distcheck" (and "make dist-tarZ dist-xz") to generate all of the
+   distribution archives.

 k) Sign the distribution archive(s) using GnuPG: "gpg -b <archivefile>"

 l) Upload and distribute the newly generated ngIRCd release archive(s)
-   and GnuPG signatures.
+   and GnuPG signatures (to the website, its mirrors, and GitHub).

-m) Write an announcement to the mailing list, freshmeat, Twitter, ...
+m) Update the ngIRCd website and its mirrors!

-n) Update the list of releases in our bug tracker.
+n) Write an announcement to the mailing list, Twitter, ...

 o) Relax :-)
--- a/doc/Modes.txt
+++ b/doc/Modes.txt
@@ -75,17 +75,21 @@ channel of which he is a member.

  mode	since	description

-  q	20	User is channel owner can only be set by a service, other
-		owner and irc op. Can promote other users to q, a, o, h, v.
-  a	20	User is channel admin and can promote other users to v, h, o
+  q	20	User is channel owner. This mode can only be set by an IRC
+		service, other owner or IRC operator. Channel owners can
+		promote other users to all levels: q, a, o, h, v. Prefix: "~".
+  a	20	User is channel admin and can promote other users to v, h, o.
+		Prefix: "&".
  o	0.2.0	User is channel operator and can op/kick/... other members.
+		Prefix: "@".
  h	20	User is half op and can set channel modes imntvIbek and kick
-		voiced and normal users.
+		voiced and normal users. Prefix: "%".
  v	0.2.0	User is "voiced" and can speak even if channel is moderated.
+		Prefix: "+".


 Notes
 ~~~~~

 (1) This mode is not set by ngIRCd itself but by services. ngIRCd handles
-    the mode transparently and possibly adjusts its behaviour.
+    the mode transparently and possibly adjusts its behavior.
--- a/doc/PAM.txt
+++ b/doc/PAM.txt
@@ -26,6 +26,10 @@ A very simple -- and quite useless ;-) -- example would be:
 Here the "pam_debug" module will be called each time a client connects to
 the ngIRCd and has sent its PASS, NICK, and USER commands.

+The PAM library used by the ngIRCd daemon must be able to access its
+configuration file, so don't forget to check permissions and run something
+like this: "chmod 644 /etc/pam.d/ngircd".
+
 Please note ONE VERY IMPORTANT THING:

 All the PAM modules are executed with the privileges of the user ngIRCd
--- a/doc/Platforms.txt
+++ b/doc/Platforms.txt
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/

-               (c)2001-2013 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

@@ -32,6 +32,7 @@ armv6l/unk./linux-gnueabihf gcc 4.6.3    21~rc2     13-10-26 pi       Y Y Y Y 5
 armv7l/unk./linux-gnueabi   gcc 4.4.3    19.1       12-04-29 goetz    Y Y Y Y 5
 armv7l/unk./linux-gnueabihf gcc 4.6.3    22~rc1-3   14-10-10 alex     Y Y Y Y 5
 armv7l/unk./linux-gnueabihf gcc 4.8.2    21.1       14-07-15 goetz    Y Y Y Y 5
+armv7l/unk./linux-gnueabihf gcc 4.9.2    23         16-01-10 alex     Y Y Y Y 5
 hppa/unknown/openbsd3.5     gcc 2.95.3   CVSHEAD    04-05-25 alex     Y Y Y Y
 hppa/unknown/openbsd5.4     gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y y Y 3
 hppa1.1/unknown/linux-gnu   gcc 3.3.3    0.8.0      04-05-30 alex     Y Y Y Y
@@ -40,40 +41,44 @@ hppa2.0w-hp-hpux11.11       gcc 4.2.3    14.1       09-07-22 goetz    Y Y Y Y
 i386/apple/darwin9.7.0      gcc 4.0.1    14.1       09-08-04 alex     Y Y Y Y 3
 i386/apple/darwin10.8.0     gcc 4.2.1    19         12-02-26 alex     Y Y Y Y 3
 i386/apple/darwin11.3.0     gcc 4.2.1    19         12-02-26 alex     Y Y Y Y 3
+i386/pc/linux-gnu           gcc 4.1.2    13~rc1     08-12-05 alex     Y Y Y Y 1
+i386/pc/linux-gnu           gcc 4.4.5    22~rc1-3   14-10-10 alex     Y Y Y Y 1
+i386/pc/minix               clang 3.4    23         16-01-06 goetz    Y Y N Y
 i386/pc/solaris2.9          gcc 3.2.2    CVSHEAD    04-02-24 alex     Y Y Y Y
-i386/pc/solaris2.11         gcc 4.5.2    21~rc2     13-10-27 alex     Y Y N Y 4
+i386/pc/solaris2.11         gcc 4.8.2    24         17-01-21 goetz    Y Y Y Y 4
 i386/unknown/freebsd5.2.1   gcc 3.3.3    0.8.0      04-05-30 alex     Y Y Y Y
 i386/unknown/freebsd6.2     gcc 3.4.6    20~rc1     12-11-13 alex     Y Y Y Y 3
-i386/unknown/freebsd7.3     gcc 4.2.1    20~rc1     12-11-13 alex     Y Y Y Y 3
-i686/pc/minix               gcc 4.4.6    21~rc2     13-10-27 alex     Y Y N N
-i686/unknown/gnu0.3         gcc 4.4.5    19         12-02-29 alex     Y Y Y Y
-i686/unknown/gnu0.5         gcc 4.9.1    22~rc1-3   14-10-11 alex     Y Y Y Y
-i686/unkn./kfreebsd7.2-gnu  gcc 4.3.4    15         09-12-02 alex     Y Y Y Y 3
+i386/unknown/freebsd7.3     gcc 4.2.1    24~rc1-7   17-01-20 alex     Y Y Y Y 3
 i386/unknown/netbsdelf1.5.2 egcs-1.1.2   21         13-11-25 goetz    Y Y N Y
 i386/unknown/netbsdelf1.6.2 gcc 2.95.3   18         11-07-10 goetz    Y Y Y Y
 i386/unknown/netbsdelf3.0.1 gcc 3.3.3    0.10.0-p1  06-08-30 alex     Y Y Y Y 3
-i386/unknown/netbsdelf4.0   gcc 4.1.2    19         12-02-29 alex     Y Y Y Y 3
+i386/unknown/netbsdelf4.0   gcc 4.1.2    24~rc1-7   17-01-20 alex     Y Y Y Y 3
 i386/unknown/netbsdelf5.0.2 gcc 4.1.3    19         12-02-26 alex     Y Y Y Y 3
-i386/unknown/openbsd3.5     gcc 2.95.3   21         13-11-17 goetz    Y Y Y Y 3
+i386/unknown/openbsd3.5     gcc 2.95.3   23         15-11-27 goetz    Y Y y Y 3
 i386/unknown/openbsd3.9     gcc 3.3.5    0.10.0-p1  06-08-30 alex     Y Y Y Y 3
 i386/unknown/openbsd4.1     gcc 3.3.5    16         10-04-11 alex     Y Y Y Y 3
 i386/unknown/openbsd5.3     gcc 4.2.1    21         13-11-28 goetz    Y Y Y Y 3
 i386/unknown/openbsd5.4     gcc 4.2.1    21         13-11-28 goetz    Y Y Y Y 3
 i586/pc/haiku               gcc 2.95.3   19.2~138   12-10-11 user     Y Y N N
-i586/pc/interix3.5          gcc 3.3      19         12-02-29 alex     Y Y N Y
-i686/pc/cygwin              gcc 4.8.3    22~rc1-3   14-10-10 alex     Y Y N Y
-i686/pc/linux-gnu           gcc 2.7.2    21~38      14-01-06 goetz    Y Y Y Y 1
+i586/pc/interix3.5          gcc 3.3      23         16-01-29 alex     Y Y N Y
+i686/pc/cygwin              gcc 4.9.3    23         16-01-06 alex     Y Y Y Y
+i686/pc/linux-gnu           gcc 2.6.3    23         16-01-06 goetz    Y Y y Y 1
+i686/pc/linux-gnu           gcc 2.7.2.1  23         15-11-30 goetz    Y Y N Y 1
+i686/pc/linux-gnu           gcc 2.95.2   23         15-12-23 goetz    Y Y Y Y 1
 i686/pc/linux-gnu           gcc 2.95.4   0.8.0      04-05-30 alex     Y Y Y Y 1
 i686/pc/linux-gnu           gcc 3.3.5    14.1       09-08-04 alex     Y Y Y Y 1
-i386/pc/linux-gnu           gcc 4.1.2    13~rc1     08-12-05 alex     Y Y Y Y 1
-i386/pc/linux-gnu           gcc 4.4.5    22~rc1-3   14-10-10 alex     Y Y Y Y 1
 i686/pc/linux-gnu           gcc 4.3.2    14.1       09-08-04 alex     Y Y Y Y 1
+i686/pc/minix               gcc 4.4.6    21~rc2     13-10-27 alex     Y Y N N
+i686/unknown/gnu0.3         gcc 4.4.5    19         12-02-29 alex     Y Y Y Y
+i686/unknown/gnu0.5         gcc 4.9.1    22~rc1-3   14-10-11 alex     Y Y Y Y
+i686/unkn./kfreebsd7.2-gnu  gcc 4.3.4    15         09-12-02 alex     Y Y Y Y 3
 m68k/apple/aux3.0.1         gcc 2.7.2    17         10-11-07 alex     Y Y N Y
 m68k/apple/aux3.0.1         Orig. A/UX   17         10-11-07 alex     Y Y N Y 2
 m68k/apple/aux3.1.1         gcc 2.7.2    19         12-02-26 alex     Y Y N Y
 m68k/apple/aux3.1.1         Orig. A/UX   19         12-02-26 alex     Y Y N Y 2
 m68k/hp/hp-ux9.10           Orig. HPUX   0.7.x-CVS  03-04-30 goetz    Y Y Y Y
 m88k/dg/dgux5.4R3.10        gcc 2.5.8    CVSHEAD    04-03-15 alex     Y Y ? ?
+mipsel/openwrt/linux-uclibc gcc 4.8      24~9-g619a 18-01-28 goetz    - - - Y 6
 mipsel/unknown/linux-gnu    gcc 4.1.2    18         11-07-05 goetz    Y Y N Y 1
 mipsel/unknown/linux-gnu    gcc 4.4.5    21         13-11-24 goetz    Y Y Y Y 1
 powerpc/apple/darwin6.8     gcc 3.1      21         14-01-03 goetz    Y Y Y Y
@@ -89,22 +94,32 @@ sparc/unknown/openbsd5.5    gcc 4.2.1    21.1       14-05-03 goetz    Y Y Y Y 3
 x86_64/apple/darwin10.8.0   gcc 4.2.1    21~rc2     13-10-30 alex     Y Y Y Y 3
 x86_64/apple/darwin12.3.0   gcc 4.2.1    20.2       13-04-01 alex     Y Y Y Y 3
 x86_64/apple/darwin13.0.0   A-clang 5.0  21         14-01-02 alex     Y Y Y Y 3
-x86_64/apple/darwin14.0.0   A-clang 6.0  22~rc1-3   14-10-10 alex     Y Y Y Y 3
+x86_64/apple/darwin14.5.0   A-clang 6.1  23~rc1     15-09-06 alex     Y Y Y Y 3
+x86_64/apple/darwin15.6.0   A-clang 8.0  23~38-g455 16-11-04 alex     Y Y Y Y 3
+x86_64/apple/darwin16.5.0   A-clang 8.1  25~rc1-7-g 18-11-04 alex     Y Y Y Y 3
+x86_64/apple/darwin17.7.0   A-clang 10.0 25~rc1     18-11-04 alex     Y Y Y Y 3
+x86_64/apple/darwin18.2.0   A-clang 10.0 25~rc1-11  19-01-23 alex     Y Y Y Y 3
 x86_64/unknown/dragonfly3.4 gcc 4.7.2    21         13-11-12 goetz    Y Y N Y 3
-x86_64/unknown/freebsd8.4   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y y Y 3
-x86_64/unknown/freebsd9.2   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
-x86_64/unknown/freebsd10.0  F-clang 3.3  22~rc1-3   14-10-10 alex     Y Y Y Y 3
 x86_64/unkn./freebsd8.1-gnu gcc 4.4.5    19         12-02-26 alex     Y Y Y Y 3
+x86_64/unknown/freebsd8.4   gcc 4.2.1    24~rc1-7   17-01-20 alex     Y Y Y Y 3
+x86_64/unknown/freebsd9.2   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
+x86_64/unknown/freebsd10.3  F-clang 3.4  24         17-01-20 goetz    Y Y Y Y 3
+x86_64/unknown/freebsd11.0  F-clang 3.8  24         17-01-21 goetz    Y Y Y Y 3
+x86_64/unknown/haiku        gcc 7.3.0    25~rc1-11  19-01-06 alex     Y Y N Y
 x86_64/unknown/linux-gnu    clang 3.3    21         14-01-07 alex     Y Y Y Y 1
 x86_64/unknown/linux-gnu    clang 3.4    22~rc1-3   14-10-11 alex     Y Y Y Y 1
-x86_64/unknown/linux-gnu    gcc 4.4.5    22~rc1-3   14-10-10 alex     Y Y Y Y 1
-x86_64/unknown/linux-gnu    gcc 4.7.2    22~rc1-3   14-10-10 alex     Y Y Y Y 1
-x86_64/unknown/linux-gnu    gcc 4.8.2    21         13-12-29 alex     Y Y Y Y 1
-x86_64/unknown/linux-gnu    gcc 4.9.1    22~rc1-3   14-10-10 alex     Y Y Y Y 1
+x86_64/pc/linux-gnu         gcc 4.4.5    24~rc1-7   17-01-20 alex     Y Y Y Y 1
+x86_64/unknown/linux-gnu    gcc 4.7.2    23~rc1-3   15-11-15 alex     Y Y Y Y 1
+x86_64/pc/linux-gnu         gcc 4.8.4    24~rc1-7   17-01-20 alex     Y Y Y Y 1
+x86_64/pc/linux-gnu         gcc 4.9.2    24~rc1-7   17-01-20 alex     Y Y Y Y 1
+x86_64/unknown/linux-gnu    gcc 5.3.0    23         15-12-14 goetz    Y Y Y Y 1
+x86_64/pc/linux-gnu [WSL]   gcc 5.4.0    24         18-03-07 goetz    Y Y y Y 7
+x86_64/pc/linux-gnu         gcc 6.2.1    24~rc1-7   17-01-20 alex     Y Y Y Y 1
+x86_64/pc/linux-gnu         gcc 6.3.0    25~rc1-11  19-01-23 alex     Y Y Y Y 1
+x86_64/unknown/linux-gnu    icc 16       23         16-01-13 goetz    Y Y Y Y 1
 x86_64/unknown/linux-gnu    nwcc 0.8.2   21         13-12-01 goetz    Y Y Y Y 1
 x86_64/unknown/linux-gnu    Open64       21.1       14-03-27 goetz    Y Y Y Y 1
 x86_64/unknown/linux-gnu    Sun C 5.12   21.1       14-03-27 goetz    Y Y Y Y 1
-x86_64/unknown/linux-gnu    tcc 0.9.25   21.1       14-03-27 goetz    Y Y Y Y 1
 x86_64/unknown/openbsd4.7   gcc 3.3.5    20~rc1     12-02-26 alex     Y Y Y Y 3
 x86_64/unknown/openbsd4.8   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y y Y 3
 x86_64/unknown/openbsd5.1   gcc 4.2.1    21         13-12-28 alex     Y Y Y Y 3
@@ -115,14 +130,15 @@ x86_64/unknown/openbsd5.5   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
 ~~~~~~~

 (1) */*/linux-gnu (Linux platforms):
-    ngIRCd has been tested with various Linux distributions, such as SuSE,
-    RedHat, Debian, and Gentoo using Kernels 2.2.x, 2.4.x and 2.6.x with
-    various versions of the GNU C compiler (starting with 2.95.x and up to
-    version 4.3.x). The eldest glibc used was glibc-2.0.7. ngIRCd compiled
-    and run on all these systems without problems.
-    Actual Linux kernels (2.6.x) and glibc's support the epoll() IO interface.
+    ngIRCd has been tested with various Linux distributions, such as ArchLinux,
+    Debian, Gentoo, Red Hat (Fedora) and SuSE using Linux kernels 2.2.x, 2.4.x,
+    2.6.x, 3.x, and 4.x, with various versions of the GNU C compiler (starting
+    with 2.95.x) and Clang. The eldest glibc used was glibc-2.0.7.
+    ngIRCd compiled and ran on all of these systems successfully.
+    Current Linux kernels (starting with 2.6.x) and glibc's support the more
+    efficient epoll() IO interface, see (5) below.

-(2) This compiler is an pre-ANSI C compiler, therefore the source code is
+(2) This compiler is a pre-ANSI C compiler (K&R), therefore the source code is
    automatically converted using the included ansi2knr tool while building.

 (3) Using the kqueue() IO interface.
@@ -130,3 +146,9 @@ x86_64/unknown/openbsd5.5   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
 (4) Using the /dev/poll IO interface.

 (5) Using the epoll() IO interface.
+
+(6) ngIRCd has been cross-compiled with gcc 4.8 on Ubuntu x86-64 for
+    MIPSEL Linux OpenWRT distribution (uclibc), for the target computer
+    Vocore2, where the created binary ran well.
+
+(7) This actually is Windows 10 running Windows Subsystem for Linux (WSL).
--- a/doc/Protocol.txt
+++ b/doc/Protocol.txt
@@ -176,7 +176,7 @@ channel mode). In this case <limit> should be "0".
 II.4 Update webchat/proxy client information

     Command: WEBIRC
-  Parameters: <password> <username> <hostname> <ip-address>
+  Parameters: <password> <username> <hostname> <ip-address> [<ignored>]
     Used by: unregistered clients only

 The WEBIRC command is used by some Web-to-IRC gateways to set the correct
@@ -186,6 +186,9 @@ first command sent to the server, even before USER and NICK commands!
 The <password> must be set in the server configuration file to prevent
 unauthorized clients to fake their identity; it is an arbitrary string.

+Optionally, a 5th parameter is accepted to comply with an IRCv3 extension,
+see <https://github.com/ircv3/ircv3-ideas/issues/12>, but ignored.
+

 II.5 Client character encoding conversion

--- a/doc/RFC.txt
+++ b/doc/RFC.txt
@@ -1,9 +1,8 @@

                     ngIRCd - Next Generation IRC Server
+                           http://ngircd.barton.de/

-                      (c)2001-2003 by Alexander Barton,
-                    alex@barton.de, http://www.barton.de/
-
+               (c)2001-2017 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.

@@ -11,7 +10,8 @@


 The Internet Relay Chat (IRC) protocol is documented in these Request for
-Comments (RFC), which you can get e.g. via <http://www.faqs.org/>:
+Comments (RFCs), which you can get via <http://www.faqs.org/rfcs/> or
+<https://www.ietf.org/rfc.html> for example.

  1459	Oikarinen, J. & D. Reed, "Internet Relay Chat Protocol",
 	May 1993, [IRC].
@@ -28,6 +28,5 @@ Comments (RFC), which you can get e.g. via <http://www.faqs.org/>:
  2813	Kalt, C., "Internet Relay Chat: Server Protocol",
 	April 2000, [IRC-SERVER].

-
-- 
-$Id: RFC.txt,v 1.6 2003/03/07 20:42:20 alex Exp $
+  7194	Hartmann, R., "Default Port for Internet Relay Chat (IRC) via TLS/SSL",
+	August 2014.
--- a/doc/Services.txt
+++ b/doc/Services.txt
@@ -34,6 +34,10 @@ services instead of regular IRC users.

 Example:

+  [GLOBAL]
+     Name = server.irc.net
+     Ports = 6667
+
  [SERVER]
     Name = services.irc.net
     MyPassword = 123abc
@@ -104,6 +108,10 @@ The following settings need to be in atheme.conf:

  loadmodule "modules/protocol/ngircd";

+  serverinfo {
+	name = "services.irc.net";
+  }
+
  uplink "server.irc.net" {
 	password = "123abc";
 	port = 6667;
--- a/doc/sample-ngircd.conf.tmpl
+++ b/doc/sample-ngircd.conf.tmpl
@@ -51,7 +51,7 @@
 	# be shown to all users connecting to the server:
 	;MotdFile = :ETCDIR:/ngircd.motd

-	# A simple Phrase (<256 chars) if you don't want to use a motd file.
+	# A simple Phrase (<127 chars) if you don't want to use a motd file.
 	;MotdPhrase = "Hello world!"

 	# The name of the IRC network to which this server belongs. This name
@@ -117,6 +117,12 @@
 	# maximum nickname length!
 	;MaxNickLength = 9

+	# Maximum penalty time increase in seconds, per penalty event. Set to -1
+	# for no limit (the default), 0 to disable penalties altogether. The
+	# daemon doesn't use penalty increases higher than 2 seconds during
+	# normal operation, so values greater than 1 rarely make sense.
+	;MaxPenaltyTime = -1
+
 	# Maximum number of channels returned in response to a /list
 	# command (0: unlimited):
 	;MaxListSize = 100
@@ -226,6 +232,15 @@
 	# character prepended to their respective user names!
 	;PAMIsOptional = no

+	# When PAM is enabled, this value determines the used PAM
+	# configuration.
+	# This setting allows to run multiple ngIRCd instances with
+	# different PAM configurations on each instance.
+	# If you set it to "ngircd-foo", PAM will use
+	# /etc/pam.d/ngircd-foo instead of the default
+	# /etc/pam.d/ngircd.
+	;PAMServiceName = ngircd
+
 	# Let ngIRCd send an "authentication PING" when a new client connects,
 	# and register this client only after receiving the corresponding
 	# "PONG" reply.
--- a/man/ngircd.8.tmpl
+++ b/man/ngircd.8.tmpl
@@ -1,7 +1,7 @@
 .\"
 .\" ngircd(8) manual page template
 .\"
-.TH ngircd 8 "Oct 2013" ngIRCd "ngIRCd Manual"
+.TH ngircd 8 "Jan 2019" ngIRCd "ngIRCd Manual"
 .SH NAME
 ngIRCd \- the "next generation" IRC daemon
 .SH SYNOPSIS
--- a/man/ngircd.conf.5.tmpl
+++ b/man/ngircd.conf.5.tmpl
@@ -1,7 +1,7 @@
 .\"
 .\" ngircd.conf(5) manual page template
 .\"
-.TH ngircd.conf 5 "Oct 2014" ngIRCd "ngIRCd Manual"
+.TH ngircd.conf 5 "Jan 2019" ngIRCd "ngIRCd Manual"
 .SH NAME
 ngircd.conf \- configuration file of ngIRCd
 .SH SYNOPSIS
@@ -83,7 +83,7 @@ blocks are used to configure pre-defined ("persistent") IRC channels.
 .PP
 There can be more than one [Operator], [Server] and [Channel] section per
 configuration file, one for each operator, server, and channel. [Global],
-[Limits], [Options], and [SSL] sections can occure multiple times, too, but
+[Limits], [Options], and [SSL] sections can occur multiple times, too, but
 each variable overwrites itself, only the last assignment is relevant.
 .SH [GLOBAL]
 The
@@ -125,7 +125,7 @@ take effect when ngircd starts up or is instructed to re-read its
 configuration file.
 .TP
 \fBMotdPhrase\fR (string)
-A simple Phrase (<256 chars) if you don't want to use a MOTD file.
+A simple Phrase (<127 chars) if you don't want to use a MOTD file.
 .TP
 \fBNetwork\fR (string)
 The name of the IRC network to which this server belongs. This name is
@@ -201,6 +201,12 @@ Maximum length of an user nickname (Default: 9, as in RFC 2812). Please
 note that all servers in an IRC network MUST use the same maximum nickname
 length!
 .TP
+\fBMaxPenaltyTime\fR (number)
+Maximum penalty time increase in seconds, per penalty event. Set to -1 for no
+limit (the default), 0 to disable penalties altogether. ngIRCd doesn't use
+penalty increases higher than 2 seconds during normal operation, so values
+greater than 1 rarely make sense.
+.TP
 \fBMaxListSize\fR (number)
 Maximum number of channels returned in response to a LIST command. Default: 100.
 .TP
@@ -339,6 +345,14 @@ able to distinguish between Ident'ified and PAM-authenticated users: both
 don't have a "~" character prepended to their respective user names!
 Default: no.
 .TP
+\fBPAMServiceName\fR (string)
+When PAM is enabled, this value determines the used PAM configuration.
+This setting allows to run multiple ngIRCd instances with different
+PAM configurations on each instance. If you set it to "ngircd-foo",
+PAM will use /etc/pam.d/ngircd-foo instead of the default
+/etc/pam.d/ngircd.
+Default: ngircd.
+.TP
 \fBRequireAuthPing\fR (boolean)
 Let ngIRCd send an "authentication PING" when a new client connects, and
 register this client only after receiving the corresponding "PONG" reply.
--- a/src/ngircd/conf-ssl.h
+++ b/src/ngircd/conf-ssl.h
@@ -13,6 +13,10 @@
 #ifdef HAVE_LIBSSL
 #define SSL_SUPPORT
 #include <openssl/ssl.h>
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define OpenSSL_version SSLeay_version
+#define OPENSSL_VERSION SSLEAY_VERSION
+#endif
 #endif
 #ifdef HAVE_LIBGNUTLS
 #define SSL_SUPPORT
--- a/src/ngircd/conf.c
+++ b/src/ngircd/conf.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -388,6 +388,7 @@ Conf_Test( void )
 	printf("  MaxConnectionsIP = %d\n", Conf_MaxConnectionsIP);
 	printf("  MaxJoins = %d\n", Conf_MaxJoins > 0 ? Conf_MaxJoins : -1);
 	printf("  MaxNickLength = %u\n", Conf_MaxNickLength - 1);
+	printf("  MaxPenaltyTime = %ld\n", Conf_MaxPenaltyTime);
 	printf("  MaxListSize = %d\n", Conf_MaxListSize);
 	printf("  PingTimeout = %d\n", Conf_PingTimeout);
 	printf("  PongTimeout = %d\n", Conf_PongTimeout);
@@ -419,6 +420,7 @@ Conf_Test( void )
 #ifdef PAM
 	printf("  PAM = %s\n", yesno_to_str(Conf_PAM));
 	printf("  PAMIsOptional = %s\n", yesno_to_str(Conf_PAMIsOptional));
+	printf("  PAMServiceName = %s\n", Conf_PAMServiceName);
 #endif
 #ifndef STRICT_RFC
 	printf("  RequireAuthPing = %s\n", yesno_to_str(Conf_AuthPing));
@@ -710,7 +712,6 @@ Conf_NickIsService(int ConfServer, const char *Nick)
 /**
 * Check if the given nickname is blocked for "normal client" use.
 *
- * @param ConfServer The server index or NONE to check all configured servers.
 * @param Nick The nickname to check.
 * @returns true if the given nickname belongs to an "IRC service".
 */
@@ -765,6 +766,7 @@ Set_Defaults(bool InitServers)
 	Conf_MaxConnectionsIP = 5;
 	Conf_MaxJoins = 10;
 	Conf_MaxNickLength = CLIENT_NICK_LEN_DEFAULT;
+	Conf_MaxPenaltyTime = -1;
 	Conf_MaxListSize = 100;
 	Conf_PingTimeout = 120;
 	Conf_PongTimeout = 20;
@@ -807,6 +809,7 @@ Set_Defaults(bool InitServers)
 	Conf_PAM = false;
 #endif
 	Conf_PAMIsOptional = false;
+	strcpy(Conf_PAMServiceName, "ngircd");
 	Conf_ScrubCTCP = false;
 #ifdef SYSLOG
 #ifdef LOG_LOCAL5
@@ -843,7 +846,7 @@ no_listenports(void)
 *
 * This function is used to read the MOTD and help text file, for example.
 *
- * @param filename	Name of the file to read.
+ * @param Filename	Name of the file to read.
 * @return		true, when the file has been read in.
 */
 static bool
@@ -885,9 +888,9 @@ Read_TextFile(const char *Filename, const char *Name, array *Destination)
 * Please note that this function uses exit(1) on fatal errors and therefore
 * can result in ngIRCd terminating!
 *
- * @param ngircd_starting	Flag indicating if ngIRCd is starting or not.
- * @returns			true when the configuration file has been read
- *				successfully; false otherwise.
+ * @param IsStarting	Flag indicating if ngIRCd is starting or not.
+ * @returns		true when the configuration file has been read
+ *			successfully; false otherwise.
 */
 static bool
 Read_Config(bool TestOnly, bool IsStarting)
@@ -1640,6 +1643,12 @@ Handle_LIMITS(const char *File, int Line, char *Var, char *Arg)
 			Config_Error_NaN(File, Line, Var);
 		return;
 	}
+	if (strcasecmp(Var, "MaxPenaltyTime") == 0) {
+		Conf_MaxPenaltyTime = atol(Arg);
+		if (Conf_MaxPenaltyTime < -1)
+			Conf_MaxPenaltyTime = -1;	/* "unlimited" */
+		return;
+	}
 	if (strcasecmp(Var, "PingTimeout") == 0) {
 		Conf_PingTimeout = atoi(Arg);
 		if (Conf_PingTimeout < 5) {
@@ -1833,6 +1842,12 @@ Handle_OPTIONS(const char *File, int Line, char *Var, char *Arg)
 		Conf_PAMIsOptional = Check_ArgIsTrue(Arg);
 		return;
 	}
+	if (strcasecmp(Var, "PAMServiceName") == 0) {
+		len = strlcpy(Conf_PAMServiceName, Arg, sizeof(Conf_PAMServiceName));
+		if (len >= sizeof(Conf_PAMServiceName))
+			Config_Error_TooLong(File, Line, Var);
+		return;
+	}
 	if (strcasecmp(Var, "PredefChannelsOnly") == 0) {
 		/*
 		 * TODO: This section and support for "PredefChannelsOnly"
@@ -2274,6 +2289,11 @@ Validate_Config(bool Configtest, bool Rehash)
 			     "This server uses PAM, \"Password\" in [Global] section will be ignored!");
 #endif

+	if (Conf_MaxPenaltyTime != -1)
+		Config_Error(LOG_WARNING,
+			     "Maximum penalty increase ('MaxPenaltyTime') is set to %ld, this is not recommended!",
+			     Conf_MaxPenaltyTime);
+
 #ifdef DEBUG
 	servers = servers_once = 0;
 	for (i = 0; i < MAX_SERVERS; i++) {
--- a/src/ngircd/conf.h
+++ b/src/ngircd/conf.h
@@ -203,6 +203,9 @@ GLOBAL bool Conf_PAM;
 /** Don't require all clients to send a password an to be PAM authenticated */
 GLOBAL bool Conf_PAMIsOptional;

+/** The service name to use for PAM */
+GLOBAL char Conf_PAMServiceName[MAX_PAM_SERVICE_NAME_LEN];
+
 /** Disable all CTCP commands except for /me ? */
 GLOBAL bool Conf_ScrubCTCP;

@@ -236,6 +239,9 @@ GLOBAL unsigned int Conf_MaxNickLength;
 /** Maximum number of channels returned to /list */
 GLOBAL int Conf_MaxListSize;

+/** Maximium seconds to add per "penalty". -1 = unlimited. */
+GLOBAL time_t Conf_MaxPenaltyTime;
+
 #ifndef STRICT_RFC

 /** Require "AUTH PING-PONG" on login */
--- a/src/ngircd/conn-func.c
+++ b/src/ngircd/conn-func.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -26,6 +26,7 @@
 #endif
 #include "conn.h"

+#include "conf.h"
 #include "conn-func.h"

 /**
@@ -85,7 +86,7 @@ Conn_LastPing( CONN_ID Idx )
 * is read. This function only increases the penalty, it is not possible to
 * decrease the penalty time.
 *
- * @param Idex Connection index.
+ * @param Idx Connection index.
 * @param Seconds Seconds to add.
 * @see Conn_ResetPenalty
 */
@@ -97,6 +98,14 @@ Conn_SetPenalty(CONN_ID Idx, time_t Seconds)
 	assert(Idx > NONE);
 	assert(Seconds >= 0);

+	/* Limit new penalty to maximum configured, when less than 10 seconds. *
+	   The latter is used to limit brute force attacks, therefore we don't *
+	   want to limit that! */
+	if (Conf_MaxPenaltyTime >= 0
+	    && Seconds > Conf_MaxPenaltyTime
+	    && Seconds < 10)
+		Seconds = Conf_MaxPenaltyTime;
+
 	t = time(NULL);
 	if (My_Connections[Idx].delaytime < t)
 		My_Connections[Idx].delaytime = t;
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -42,6 +42,7 @@ extern struct SSLOptions Conf_SSLOptions;
 #ifdef HAVE_LIBSSL
 #include <openssl/err.h>
 #include <openssl/rand.h>
+#include <openssl/dh.h>

 static SSL_CTX * ssl_ctx;
 static DH *dh_params;
@@ -283,10 +284,12 @@ ConnSSL_InitLibrary( void )
 #ifdef HAVE_LIBSSL
 	SSL_CTX *newctx;

+#if OPENSSL_API_COMPAT < 0x10100000L
 	if (!ssl_ctx) {
 		SSL_library_init();
 		SSL_load_error_strings();
 	}
+#endif

 	if (!RAND_status()) {
 		Log(LOG_ERR, "OpenSSL PRNG not seeded: /dev/urandom missing?");
@@ -324,7 +327,7 @@ ConnSSL_InitLibrary( void )
 			   Verify_openssl);
 	SSL_CTX_free(ssl_ctx);
 	ssl_ctx = newctx;
-	Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION));
+	Log(LOG_INFO, "%s initialized.", OpenSSL_version(OPENSSL_VERSION));
 	return true;
 out:
 	SSL_CTX_free(newctx);
--- a/src/ngircd/conn.c
+++ b/src/ngircd/conn.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -182,7 +182,6 @@ cb_connserver(int sock, UNUSED short what)
 	CONN_ID idx = Socket2Index( sock );

 	if (idx <= NONE) {
-		LogDebug("cb_connserver wants to write on unknown socket?!");
 		io_close(sock);
 		return;
 	}
@@ -280,12 +279,11 @@ cb_clientserver(int sock, short what)
 {
 	CONN_ID idx = Socket2Index(sock);

-	assert(idx >= 0);
-
-	if (idx < 0) {
+	if (idx <= NONE) {
 		io_close(sock);
 		return;
 	}
+
 #ifdef SSL_SUPPORT
 	if (what & IO_WANTREAD
 	    || (Conn_OPTION_ISSET(&My_Connections[idx], CONN_SSL_WANT_WRITE))) {
@@ -307,32 +305,20 @@ cb_clientserver(int sock, short what)
 GLOBAL void
 Conn_Init( void )
 {
-	CONN_ID i;
+	int size;

-	Pool_Size = CONNECTION_POOL;
-	if ((Conf_MaxConnections > 0) &&
-		(Pool_Size > Conf_MaxConnections))
-			Pool_Size = Conf_MaxConnections;
-
-	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)Pool_Size)) {
-		Log(LOG_EMERG, "Can't allocate memory! [Conn_Init]");
+	/* Initialize the "connection pool".
+	 * FIXME: My_Connetions/Pool_Size is needed by other parts of the
+	 * code; remove them! */
+	Pool_Size = 0;
+	size = Conf_MaxConnections > 0 ? Conf_MaxConnections : CONNECTION_POOL;
+	if (Socket2Index(size) <= NONE) {
+		Log(LOG_EMERG, "Failed to initialize connection pool!");
 		exit(1);
 	}

-	/* FIXME: My_Connetions/Pool_Size is needed by other parts of the
-	 * code; remove them! */
-	My_Connections = (CONNECTION*) array_start(&My_ConnArray);
-
-	LogDebug("Allocated connection pool for %d items (%ld bytes).",
-		array_length(&My_ConnArray, sizeof(CONNECTION)),
-		array_bytes(&My_ConnArray));
-
-	assert(array_length(&My_ConnArray, sizeof(CONNECTION)) >= (size_t)Pool_Size);
-
+	/* Initialize "listener" array. */
 	array_free( &My_Listeners );
-
-	for (i = 0; i < Pool_Size; i++)
-		Init_Conn_Struct(i);
 } /* Conn_Init */

 /**
@@ -570,8 +556,8 @@ InitSinaddrListenAddr(ng_ipaddr_t *addr, const char *listen_addrstr, UINT16 Port
 	if (!ret) {
 		assert(listen_addrstr);
 		Log(LOG_CRIT,
-		    "Can't bind to [%s]:%u: can't convert ip address \"%s\"!",
-		    listen_addrstr, Port, listen_addrstr);
+		    "Can't listen on [%s]:%u: Failed to parse IP address!",
+		    listen_addrstr, Port);
 	}
 	return ret;
 }
@@ -1095,9 +1081,9 @@ Conn_Close(CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClien
 		 * the calculation of in_p and out_p: in_z_k and out_z_k
 		 * are non-zero, that's guaranteed by the protocol until
 		 * compression can be enabled. */
-		if (! in_z_k)
+		if (in_z_k <= 0)
 			in_z_k = in_k;
-		if (! out_z_k)
+		if (out_z_k <= 0)
 			out_z_k = out_k;
 		in_p = (int)(( in_k * 100 ) / in_z_k );
 		out_p = (int)(( out_k * 100 ) / out_z_k );
@@ -1378,8 +1364,8 @@ New_Connection(int Sock, UNUSED bool IsSSL)
 	/* Check global connection limit */
 	if ((Conf_MaxConnections > 0) &&
 	    (NumConnections >= (size_t) Conf_MaxConnections)) {
-		Log(LOG_ALERT, "Can't accept connection: limit (%d) reached!",
-		    Conf_MaxConnections);
+		Log(LOG_ALERT, "Can't accept new connection on socket %d: Limit (%d) reached!",
+		    Sock, Conf_MaxConnections);
 		Simple_Message(new_sock, "ERROR :Connection limit reached");
 		close(new_sock);
 		return -1;
@@ -1398,23 +1384,10 @@ New_Connection(int Sock, UNUSED bool IsSSL)
 		return -1;
 	}

-	if (new_sock >= Pool_Size) {
-		if (!array_alloc(&My_ConnArray, sizeof(CONNECTION),
-				 (size_t) new_sock)) {
-			Log(LOG_EMERG,
-			    "Can't allocate memory! [New_Connection]");
-			Simple_Message(new_sock, "ERROR: Internal error");
-			close(new_sock);
-			return -1;
-		}
-		LogDebug("Bumped connection pool to %ld items (internal: %ld items, %ld bytes)",
-			 new_sock, array_length(&My_ConnArray,
-			 sizeof(CONNECTION)), array_bytes(&My_ConnArray));
-
-		/* Adjust pointer to new block */
-		My_Connections = array_start(&My_ConnArray);
-		while (Pool_Size <= new_sock)
-			Init_Conn_Struct(Pool_Size++);
+	if (Socket2Index(new_sock) <= NONE) {
+		Simple_Message(new_sock, "ERROR: Internal error");
+		close(new_sock);
+		return -1;
 	}

 	/* register callback */
@@ -1523,24 +1496,38 @@ Account_Connection(void)
 } /* Account_Connection */

 /**
- * Translate socket handle into connection index.
+ * Translate socket handle into connection index (for historical reasons, it is
+ * a 1:1 mapping today) and enlarge the "connection pool" accordingly.
 *
 * @param Sock	Socket handle.
- * @returns	Connecion index or NONE, if no connection could be found.
+ * @returns	Connecion index or NONE when the pool is too small.
 */
 static CONN_ID
 Socket2Index( int Sock )
 {
-	assert( Sock >= 0 );
+	assert(Sock > 0);
+	assert(Pool_Size >= 0);

-	if( Sock >= Pool_Size || My_Connections[Sock].sock != Sock ) {
-		/* the Connection was already closed again, likely due to
-		 * an error. */
-		LogDebug("Socket2Index: can't get connection for socket %d!", Sock);
+	if (Sock < Pool_Size)
+		return Sock;
+
+	/* Try to allocate more memory ... */
+	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)Sock)) {
+		Log(LOG_EMERG,
+		    "Can't allocate memory to enlarge connection pool!");
 		return NONE;
 	}
+	LogDebug("Enlarged connection pool for %ld sockets (%ld items, %ld bytes)",
+		 Sock, array_length(&My_ConnArray, sizeof(CONNECTION)),
+		 array_bytes(&My_ConnArray));
+
+	/* Adjust pointer to new block, update size and initialize new items. */
+	My_Connections = array_start(&My_ConnArray);
+	while (Pool_Size <= Sock)
+		Init_Conn_Struct(Pool_Size++);
+
 	return Sock;
-} /* Socket2Index */
+}

 /**
 * Read data from the network to the read buffer. If an error occurs,
@@ -1931,8 +1918,11 @@ Check_Servers(void)
 		Conf_Server[i].lasttry = time_now;
 		Conf_Server[i].conn_id = SERVER_WAIT;
 		assert(Proc_GetPipeFd(&Conf_Server[i].res_stat) < 0);
-		Resolve_Name(&Conf_Server[i].res_stat, Conf_Server[i].host,
-			     cb_Connect_to_Server);
+
+		/* Start resolver subprocess ... */
+		if (!Resolve_Name(&Conf_Server[i].res_stat, Conf_Server[i].host,
+				  cb_Connect_to_Server))
+			Conf_Server[i].conn_id = NONE;
 	}
 } /* Check_Servers */

@@ -2007,10 +1997,7 @@ New_Server( int Server , ng_ipaddr_t *dest)
 		return;
 	}

-	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)new_sock)) {
-		Log(LOG_ALERT,
-		    "Cannot allocate memory for server connection (socket %d)",
-		    new_sock);
+	if (Socket2Index(new_sock) <= NONE) {
 		close( new_sock );
 		Conf_Server[Server].conn_id = NONE;
 		return;
@@ -2024,8 +2011,6 @@ New_Server( int Server , ng_ipaddr_t *dest)
 		return;
 	}

-	My_Connections = array_start(&My_ConnArray);
-
 	assert(My_Connections[new_sock].sock <= 0);

 	Init_Conn_Struct(new_sock);
@@ -2417,7 +2402,7 @@ Conn_GetFromProc(int fd)
 * @param Reason The reason, see THROTTLE_xxx constants.
 * @param Idx The connection index.
 * @param Client The client of this connection.
- * @param Seconds The time to delay this connection.
+ * @param Value The time to delay this connection.
 */
 static void
 Throttle_Connection(const CONN_ID Idx, CLIENT *Client, const int Reason,
@@ -2472,9 +2457,7 @@ cb_clientserver_ssl(int sock, UNUSED short what)
 {
 	CONN_ID idx = Socket2Index(sock);

-	assert(idx >= 0);
-
-	if (idx < 0) {
+	if (idx <= NONE) {
 		io_close(sock);
 		return;
 	}
@@ -2524,12 +2507,13 @@ cb_connserver_login_ssl(int sock, short unused)
 {
 	CONN_ID idx = Socket2Index(sock);

-	assert(idx >= 0);
-	if (idx < 0) {
+	(void) unused;
+
+	if (idx <= NONE) {
 		io_close(sock);
 		return;
 	}
-	(void) unused;
+
 	switch (ConnSSL_Connect( &My_Connections[idx])) {
 		case 1: break;
 		case 0: LogDebug("ConnSSL_Connect: not ready");
--- a/src/ngircd/defines.h
+++ b/src/ngircd/defines.h
@@ -61,6 +61,9 @@
 /** Size of default connection pool. */
 #define CONNECTION_POOL 100

+/** Size of buffer for PAM service name. */
+#define MAX_PAM_SERVICE_NAME_LEN 64
+

 /* Hard-coded (default) options */

@@ -206,6 +209,9 @@
 /** Max. number of channel modes with arguments per MODE command. */
 #define MAX_HNDL_MODES_ARG 5

+/** Max. number of targets per PRIVMSG/NOTICE/... command. */
+#define MAX_HNDL_TARGETS 25
+
 /** Max. number of WHO replies. */
 #define MAX_RPL_WHO 25

--- a/src/ngircd/irc-channel.c
+++ b/src/ngircd/irc-channel.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -497,7 +497,7 @@ IRC_TOPIC( CLIENT *Client, REQUEST *Req )
 		topic_power = true;

 	if (Req->argc == 1) {
-		/* Request actual topic */
+		/* Request current topic */
 		topic = Channel_Topic(chan);
 		if (*topic) {
 			r = IRC_WriteStrClient(from, RPL_TOPIC_MSG,
@@ -532,8 +532,6 @@ IRC_TOPIC( CLIENT *Client, REQUEST *Req )
 						  Channel_Name(chan));
 	}

-	/* Set new topic */
-	Channel_SetTopic(chan, from, Req->argv[1]);
 	LogDebug("%s \"%s\" set topic on \"%s\": %s",
 		 Client_TypeText(from), Client_Mask(from), Channel_Name(chan),
 		 Req->argv[1][0] ? Req->argv[1] : "<none>");
@@ -545,9 +543,17 @@ IRC_TOPIC( CLIENT *Client, REQUEST *Req )
 	if (!Channel_IsLocal(chan))
 		IRC_WriteStrServersPrefix(Client, from, "TOPIC %s :%s",
 					  Req->argv[0], Req->argv[1]);
-	IRC_WriteStrChannelPrefix(Client, chan, from, false, "TOPIC %s :%s",
-				  Req->argv[0], Req->argv[1]);

+	/* Infrom local clients, but only when the topic really changed. */
+	if (strcmp(Req->argv[1], Channel_Topic(chan)) != 0)
+		IRC_WriteStrChannelPrefix(Client, chan, from, false,
+					    "TOPIC %s :%s", Req->argv[0],
+					    Req->argv[1]);
+
+	/* Update topic, setter, and timestamp. */
+	Channel_SetTopic(chan, from, Req->argv[1]);
+
+	/* Send confirmation when the local client is a user. */
 	if (Client_Type(Client) == CLIENT_USER)
 		return IRC_WriteStrClientPrefix(Client, Client, "TOPIC %s :%s",
 						Req->argv[0], Req->argv[1]);
--- a/src/ngircd/irc-info.c
+++ b/src/ngircd/irc-info.c
@@ -894,16 +894,16 @@ IRC_STATS( CLIENT *Client, REQUEST *Req )
 			list = Class_GetList(CLASS_GLINE);
 		else
 			list = Class_GetList(CLASS_KLINE);
-			list_item = Lists_GetFirst(list);
-			while (list_item) {
-				if (!IRC_WriteStrClient(from, RPL_STATSXLINE_MSG,
+		list_item = Lists_GetFirst(list);
+		while (list_item) {
+			if (!IRC_WriteStrClient(from, RPL_STATSXLINE_MSG,
 						Client_ID(from), query,
 						Lists_GetMask(list_item),
 						Lists_GetValidity(list_item),
 						Lists_GetReason(list_item)))
-					return DISCONNECTED;
-				list_item = Lists_GetNext(list_item);
-			}
+				return DISCONNECTED;
+			list_item = Lists_GetNext(list_item);
+		}
 		break;
 	case 'L':	/* Link status (servers and user links) */
 		if (!Op_Check(from, Req))
--- a/src/ngircd/irc-login.c
+++ b/src/ngircd/irc-login.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -89,7 +89,7 @@ IRC_PASS( CLIENT *Client, REQUEST *Req )

 	/* Protocol version */
 	if (Req->argc >= 2 && strlen(Req->argv[1]) >= 4) {
-		int c2, c4;
+		char c2, c4;

 		c2 = Req->argv[1][2];
 		c4 = Req->argv[1][4];
@@ -873,13 +873,14 @@ IRC_PONG(CLIENT *Client, REQUEST *Req)
 	if (Client_Type(Client) == CLIENT_SERVER && Conn_LastPing(conn) == 0) {
 		Log(LOG_INFO,
 		    "Synchronization with \"%s\" done (connection %d): %ld second%s [%ld users, %ld channels].",
-		    Client_ID(Client), conn, time(NULL) - Conn_GetSignon(conn),
+		    Client_ID(Client), conn,
+		    (long)(time(NULL) - Conn_GetSignon(conn)),
 		    time(NULL) - Conn_GetSignon(conn) == 1 ? "" : "s",
 		    Client_UserCount(), Channel_CountVisible(NULL));
 		Conn_UpdatePing(conn);
 	} else
 		LogDebug("Connection %d: received PONG. Lag: %ld seconds.",
-			 conn, time(NULL) - Conn_LastPing(conn));
+			 conn, (long)(time(NULL) - Conn_LastPing(conn)));

 	return CONNECTED;
 } /* IRC_PONG */
--- a/src/ngircd/irc-oper.c
+++ b/src/ngircd/irc-oper.c
@@ -47,7 +47,7 @@
 static bool
 Bad_OperPass(CLIENT *Client, char *errtoken, char *errmsg)
 {
-	Log(LOG_WARNING, "Got invalid OPER from \"%s\": \"%s\" -- %s!",
+	Log(LOG_ERR|LOG_snotice, "Got invalid OPER from \"%s\": \"%s\" -- %s!",
 	    Client_Mask(Client), errtoken, errmsg);
 	/* Increase penalty to slow down possible brute force attacks */
 	IRC_SetPenalty(Client, 10);
@@ -398,7 +398,16 @@ IRC_xLINE(CLIENT *Client, REQUEST *Req)
 		return IRC_WriteErrClient(Client, ERR_NEEDMOREPARAMS_MSG,
 					  Client_ID(Client), Req->command);

-	from = Op_Check(Client, Req);
+	if (!Conf_AllowRemoteOper && Client_Type(Client) == CLIENT_SERVER) {
+		/* Explicitely forbid remote servers to modify "x-lines" when
+		 * the "AllowRemoteOper" configuration option isn't set, even
+		 * when the command seems to originate from the remote server
+		 * itself: this prevents GLINE's to become set during server
+		 * handshake in this case (what wouldn't be possible during
+		 * regular runtime when a remote IRC Op sends the command). */
+		from = NULL;
+	} else
+		from = Op_Check(Client, Req);
 	if (!from)
 		return Op_NoPrivileges(Client, Req);

--- a/src/ngircd/irc-server.c
+++ b/src/ngircd/irc-server.c
@@ -31,6 +31,7 @@
 #include "parse.h"
 #include "numeric.h"
 #include "ngircd.h"
+#include "irc.h"
 #include "irc-info.h"
 #include "irc-write.h"
 #include "op.h"
@@ -245,66 +246,96 @@ IRC_NJOIN( CLIENT *Client, REQUEST *Req )
 	CHANNEL *chan;
 	CLIENT *c;

-	assert( Client != NULL );
-	assert( Req != NULL );
+	assert(Client != NULL);
+	assert(Req != NULL);

-	strlcpy( nick_in, Req->argv[1], sizeof( nick_in ));
-	strcpy( nick_out, "" );
+	strlcpy(nick_in, Req->argv[1], sizeof(nick_in));
+	strcpy(nick_out, "");

 	channame = Req->argv[0];
-	ptr = strtok( nick_in, "," );
-	while( ptr )
-	{
+
+	ptr = strtok(nick_in, ",");
+	while (ptr) {
 		is_owner = is_chanadmin = is_op = is_halfop = is_voiced = false;

 		/* cut off prefixes */
-		while(( *ptr == '~') || ( *ptr == '&' ) || ( *ptr == '@' ) ||
-			( *ptr == '%') || ( *ptr == '+' ))
-		{
-			if( *ptr == '~' ) is_owner = true;
-			if( *ptr == '&' ) is_chanadmin = true;
-			if( *ptr == '@' ) is_op = true;
-			if( *ptr == 'h' ) is_halfop = true;
-			if( *ptr == '+' ) is_voiced = true;
+		while ((*ptr == '~') || (*ptr == '&') || (*ptr == '@') ||
+		       (*ptr == '%') || (*ptr == '+')) {
+			if (*ptr == '~')
+				is_owner = true;
+			if (*ptr == '&')
+				is_chanadmin = true;
+			if (*ptr == '@')
+				is_op = true;
+			if (*ptr == '%')
+				is_halfop = true;
+			if (*ptr == '+')
+				is_voiced = true;
 			ptr++;
 		}

-		c = Client_Search( ptr );
-		if( c )
-		{
-			Channel_Join( c, channame );
-			chan = Channel_Search( channame );
-			assert( chan != NULL );
-
-			if( is_owner ) Channel_UserModeAdd( chan, c, 'q' );
-			if( is_chanadmin ) Channel_UserModeAdd( chan, c, 'a' );
-			if( is_op ) Channel_UserModeAdd( chan, c, 'o' );
-			if( is_halfop ) Channel_UserModeAdd( chan, c, 'h' );
-			if( is_voiced ) Channel_UserModeAdd( chan, c, 'v' );
-
-			/* announce to channel... */
-			IRC_WriteStrChannelPrefix( Client, chan, c, false, "JOIN :%s", channame );
-
-			/* set Channel-User-Modes */
-			strlcpy( modes, Channel_UserModes( chan, c ), sizeof( modes ));
-			if( modes[0] )
-			{
-				/* send modes to channel */
-				IRC_WriteStrChannelPrefix( Client, chan, Client, false, "MODE %s +%s %s", channame, modes, Client_ID( c ));
-			}
-
-			if( nick_out[0] != '\0' ) strlcat( nick_out, ",", sizeof( nick_out ));
-			if( is_owner ) strlcat( nick_out, "~", sizeof( nick_out ));
-			if( is_chanadmin ) strlcat( nick_out, "&", sizeof( nick_out ));
-			if( is_op ) strlcat( nick_out, "@", sizeof( nick_out ));
-			if( is_halfop ) strlcat( nick_out, "%", sizeof( nick_out ));
-			if( is_voiced ) strlcat( nick_out, "+", sizeof( nick_out ));
-			strlcat( nick_out, ptr, sizeof( nick_out ));
+		c = Client_Search(ptr);
+		if (!c) {
+			/* Client not found? */
+			Log(LOG_ERR,
+			    "Got NJOIN for unknown nick \"%s\" for channel \"%s\"!",
+			    ptr, channame);
+			goto skip_njoin;
 		}
-		else Log( LOG_ERR, "Got NJOIN for unknown nick \"%s\" for channel \"%s\"!", ptr, channame );

-		/* search for next Nick */
-		ptr = strtok( NULL, "," );
+		if (!Channel_Join(c, channame)) {
+			/* Failed to join channel. Ooops!? */
+			Log(LOG_ALERT,
+			    "Failed to join client \"%s\" to channel \"%s\" (NJOIN): killing it!",
+			    ptr, channame);
+			IRC_KillClient(NULL, NULL, ptr, "Internal NJOIN error!");
+			Log(LOG_DEBUG, "... done.");
+			goto skip_njoin;
+		}
+
+		chan = Channel_Search(channame);
+		assert(chan != NULL);
+
+		if (is_owner)
+			Channel_UserModeAdd(chan, c, 'q');
+		if (is_chanadmin)
+			Channel_UserModeAdd(chan, c, 'a');
+		if (is_op)
+			Channel_UserModeAdd(chan, c, 'o');
+		if (is_halfop)
+			Channel_UserModeAdd(chan, c, 'h');
+		if (is_voiced)
+			Channel_UserModeAdd(chan, c, 'v');
+
+		/* Announce client to the channel */
+		IRC_WriteStrChannelPrefix(Client, chan, c, false,
+					  "JOIN :%s", channame);
+
+		/* Announce "channel user modes" to the channel, if any */
+		strlcpy(modes, Channel_UserModes(chan, c), sizeof(modes));
+		if (modes[0])
+			IRC_WriteStrChannelPrefix(Client, chan, Client, false,
+						  "MODE %s +%s %s", channame,
+						  modes, Client_ID(c));
+
+		/* Build nick list for forwarding command */
+		if (nick_out[0] != '\0')
+			strlcat(nick_out, ",", sizeof(nick_out));
+		if (is_owner)
+			strlcat(nick_out, "~", sizeof(nick_out));
+		if (is_chanadmin)
+			strlcat(nick_out, "&", sizeof(nick_out));
+		if (is_op)
+			strlcat(nick_out, "@", sizeof(nick_out));
+		if (is_halfop)
+			strlcat(nick_out, "%", sizeof(nick_out));
+		if (is_voiced)
+			strlcat(nick_out, "+", sizeof(nick_out));
+		strlcat(nick_out, ptr, sizeof(nick_out));
+
+	      skip_njoin:
+		/* Get next nick, if any ... */
+		ptr = strtok(NULL, ",");
 	}

 	/* forward to other servers */
--- a/src/ngircd/irc-write.c
+++ b/src/ngircd/irc-write.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -380,11 +380,10 @@ va_dcl
 * Send a message to all the servers in the network using a specific prefix
 * and matching a "client flag" using a callback function.
 *
- * @param Client The sending client, excluded while forwarding the message.
+ * @param ExceptOf The sending client, excluded while forwarding the message.
 * @param Prefix The prefix to use.
 * @param Flag Client flag that must be set on the target.
 * @param callback Callback function.
- * @param Format Format string.
 */
 GLOBAL void
 IRC_WriteStrServersPrefixFlag_CB(CLIENT *ExceptOf, CLIENT *Prefix, char Flag,
@@ -521,12 +520,12 @@ va_dcl
 			if (Client_HasMode(to, 'w'))
 				IRC_WriteStrClientPrefix(to, From,
 							 "WALLOPS :%s", msg);
-				break;
+			break;
 		case CLIENT_SERVER:
 			if (to != Client)
 				IRC_WriteStrClientPrefix(to, From,
 							 "WALLOPS :%s", msg);
-				break;
+			break;
 		}
 	}
 } /* IRC_SendWallops */
--- a/src/ngircd/irc.c
+++ b/src/ngircd/irc.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -85,6 +85,8 @@ IRC_CheckListTooBig(CLIENT *From, const int Count, const int Limit,
 GLOBAL bool
 IRC_ERROR(CLIENT *Client, REQUEST *Req)
 {
+	char *msg;
+
 	assert( Client != NULL );
 	assert( Req != NULL );

@@ -99,12 +101,20 @@ IRC_ERROR(CLIENT *Client, REQUEST *Req)
 		return CONNECTED;
 	}

-	if (Req->argc < 1)
+	if (Req->argc < 1) {
+		msg = "Got ERROR command";
 		Log(LOG_NOTICE, "Got ERROR from \"%s\"!",
 		    Client_Mask(Client));
-	else
+	} else {
+		msg = Req->argv[0];
 		Log(LOG_NOTICE, "Got ERROR from \"%s\": \"%s\"!",
-		    Client_Mask(Client), Req->argv[0]);
+		    Client_Mask(Client), msg);
+	}
+
+	if (Client_Conn(Client) != NONE) {
+		Conn_Close(Client_Conn(Client), NULL, msg, false);
+		return DISCONNECTED;
+	}

 	return CONNECTED;
 } /* IRC_ERROR */
@@ -240,7 +250,7 @@ IRC_TRACE(CLIENT *Client, REQUEST *Req)
 					PACKAGE_VERSION, Client_ID(target),
 					Client_ID(Client_NextHop(target)),
 					Option_String(idx2),
-					time(NULL) - Conn_StartTime(idx2),
+					(long)(time(NULL) - Conn_StartTime(idx2)),
 					Conn_SendQ(idx), Conn_SendQ(idx2)))
 			return DISCONNECTED;

@@ -339,9 +349,12 @@ GLOBAL bool
 IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reason)
 {
 	const char *msg;
-	CONN_ID my_conn, conn;
+	CONN_ID my_conn = NONE, conn;
 	CLIENT *c;

+	assert(Nick != NULL);
+	assert(Reason != NULL);
+
 	/* Do we know such a client in the network? */
 	c = Client_Search(Nick);
 	if (!c) {
@@ -349,12 +362,8 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
 		return CONNECTED;
 	}

-	/* Inform other servers */
-	IRC_WriteStrServersPrefix(From ? Client : NULL,
-				  From ? From : Client_ThisServer(),
-				  "KILL %s :%s", Nick, Reason);
-
-	if (Client_Type(c) != CLIENT_USER && Client_Type(c) != CLIENT_GOTNICK) {
+	if (Client_Type(c) != CLIENT_USER && Client_Type(c) != CLIENT_GOTNICK
+	    && Client_Type(c) != CLIENT_SERVICE) {
 		/* Target of this KILL is not a regular user, this is
 		 * invalid! So we ignore this case if we received a
 		 * regular KILL from the network and try to kill the
@@ -375,8 +384,15 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
 		    Client_Type(c), Nick);
 	}

+	/* Inform other servers */
+	IRC_WriteStrServersPrefix(From ? Client : NULL,
+				  From ? From : Client_ThisServer(),
+				  "KILL %s :%s", Nick, Reason);
+
+
 	/* Save ID of this connection */
-	my_conn = Client_Conn(Client);
+	if (Client)
+		my_conn = Client_Conn(Client);

 	/* Kill the client NOW:
 	 *  - Close the local connection (if there is one),
@@ -399,7 +415,7 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
 * Send help for a given topic to the client.
 *
 * @param Client The client requesting help.
- * @param Topoc The help topic requested.
+ * @param Topic The help topic requested.
 * @return CONNECTED or DISCONNECTED.
 */
 static bool
@@ -467,11 +483,8 @@ Help(CLIENT *Client, const char *Topic)
 * @return Pointer to static (global) string buffer.
 */
 static char *
-#ifdef ZLIB
+#if defined(SSL_SUPPORT) || defined(ZLIB)
 Option_String(CONN_ID Idx)
-#else
-Option_String(UNUSED CONN_ID Idx)
-#endif
 {
 	static char option_txt[8];
 	UINT16 options;
@@ -489,11 +502,27 @@ Option_String(UNUSED CONN_ID Idx)
 	if(options & CONN_ZIP)		/* zlib compression enabled */
 		strlcat(option_txt, "z", sizeof(option_txt));
 #endif
-	LogDebug(" *** %d: %d = %s", Idx, options, option_txt);

 	return option_txt;
+#else
+Option_String(UNUSED CONN_ID Idx)
+{
+	return "";
+#endif
 } /* Option_String */

+/**
+ * Send a message to target(s).
+ *
+ * This function is used by IRC_{PRIVMSG|NOTICE|SQUERY} to actualy
+ * send the message(s).
+ *
+ * @param Client The client from which this command has been received.
+ * @param Req Request structure with prefix and all parameters.
+ * @param ForceType Required type of the destination of the message(s).
+ * @param SendErrors Whether to report errors back to the client or not.
+ * @return CONNECTED or DISCONNECTED.
+ */
 static bool
 Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 {
@@ -501,8 +530,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 	CL2CHAN *cl2chan;
 	CHANNEL *chan;
 	char *currentTarget = Req->argv[0];
-	char *lastCurrentTarget = NULL;
+	char *strtok_last = NULL;
 	char *message = NULL;
+	char *targets[MAX_HNDL_TARGETS];
+	int i, target_nr = 0;

 	assert(Client != NULL);
 	assert(Req != NULL);
@@ -542,10 +573,19 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 		message = Req->argv[1];

 	/* handle msgtarget = msgto *("," msgto) */
-	currentTarget = strtok_r(currentTarget, ",", &lastCurrentTarget);
+	currentTarget = strtok_r(currentTarget, ",", &strtok_last);
 	ngt_UpperStr(Req->command);

+	/* Please note that "currentTarget" is NULL when the target contains
+	 * the separator character only, e. g. "," or ",,,," etc.! */
 	while (currentTarget) {
+		/* Make sure that there hasn't been such a target already: */
+		targets[target_nr++] = currentTarget;
+		for(i = 0; i < target_nr - 1; i++) {
+			if (strcasecmp(currentTarget, targets[i]) == 0)
+				goto send_next_target;
+		}
+
 		/* Check for and handle valid <msgto> of form:
 		 * RFC 2812 2.3.1:
 		 *   msgto =  channel / ( user [ "%" host ] "@" servername )
@@ -654,7 +694,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 				goto send_next_target;
 			}

-			if (Client_HasMode(cl, 'C')) {
+			if (Client_HasMode(cl, 'C') &&
+			    !Client_HasMode(from, 'o') &&
+			    !(Client_Type(from) == CLIENT_SERVER) &&
+			    !(Client_Type(from) == CLIENT_SERVICE)) {
 				cl2chan = Channel_FirstChannelOf(cl);
 				while (cl2chan) {
 					chan = Channel_GetChannel(cl2chan);
@@ -689,14 +732,14 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 				return DISCONNECTED;
 		} else if (ForceType != CLIENT_SERVICE
 			   && (chan = Channel_Search(currentTarget))) {
+			/* Target is a channel */
 			if (!Channel_Write(chan, from, Client, Req->command,
 					   SendErrors, message))
 					return DISCONNECTED;
 		} else if (ForceType != CLIENT_SERVICE
-			/* $#: server/target mask, RFC 2812, sec. 3.3.1 */
 			   && strchr("$#", currentTarget[0])
 			   && strchr(currentTarget, '.')) {
-			/* targetmask */
+			/* $#: server/host mask, RFC 2812, sec. 3.3.1 */
 			if (!Send_Message_Mask(from, Req->command, currentTarget,
 					       message, SendErrors))
 				return DISCONNECTED;
@@ -709,14 +752,35 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 		}

 	send_next_target:
-		currentTarget = strtok_r(NULL, ",", &lastCurrentTarget);
-		if (currentTarget)
-			Conn_SetPenalty(Client_Conn(Client), 1);
+		currentTarget = strtok_r(NULL, ",", &strtok_last);
+		if (!currentTarget)
+			break;
+
+		Conn_SetPenalty(Client_Conn(Client), 1);
+
+		if (target_nr >= MAX_HNDL_TARGETS) {
+			/* Too many targets given! */
+			return IRC_WriteErrClient(Client,
+						  ERR_TOOMANYTARGETS_MSG,
+						  currentTarget);
+		}
 	}

 	return CONNECTED;
 } /* Send_Message */

+/**
+ * Send a message to "target mask" target(s).
+ *
+ * See RFC 2812, sec. 3.3.1 for details.
+ *
+ * @param from The client from which this command has been received.
+ * @param command The command to use (PRIVMSG, NOTICE, ...).
+ * @param targetMask The "target mask" (will be verified by this function).
+ * @param message The message to send.
+ * @param SendErrors Whether to report errors back to the client or not.
+ * @return CONNECTED or DISCONNECTED.
+ */
 static bool
 Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
 		  char * message, bool SendErrors)
@@ -740,17 +804,15 @@ Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
 	 * dot (".") and no wildcards ("*", "?") following the last one.
 	 */
 	check_wildcards = strrchr(targetMask, '.');
-	assert(check_wildcards != NULL);
-	if (check_wildcards &&
-		check_wildcards[strcspn(check_wildcards, "*?")])
-	{
+	if (!check_wildcards || check_wildcards[strcspn(check_wildcards, "*?")]) {
 		if (!SendErrors)
 			return true;
-		return IRC_WriteErrClient(from, ERR_WILDTOPLEVEL, targetMask);
+		return IRC_WriteErrClient(from, ERR_WILDTOPLEVEL_MSG,
+					  targetMask);
 	}

-	/* #: hostmask, see RFC 2812, sec. 3.3.1 */
 	if (targetMask[0] == '#') {
+		/* #: hostmask, see RFC 2812, sec. 3.3.1 */
 		for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
 			if (Client_Type(cl) != CLIENT_USER)
 				continue;
@@ -761,7 +823,8 @@ Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
 					return false;
 		}
 	} else {
-		assert(targetMask[0] == '$'); /* $: server mask, see RFC 2812, sec. 3.3.1 */
+		/* $: server mask, see RFC 2812, sec. 3.3.1 */
+		assert(targetMask[0] == '$');
 		for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
 			if (Client_Type(cl) != CLIENT_USER)
 				continue;
--- a/src/ngircd/lists.c
+++ b/src/ngircd/lists.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -39,7 +39,7 @@ struct list_elem {
 /**
 * Get IRC mask stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return Pointer to IRC mask
 */
 GLOBAL const char *
@@ -52,7 +52,7 @@ Lists_GetMask(const struct list_elem *e)
 /**
 * Get optional "reason" text stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return Pointer to "reason" text or empty string ("").
 */
 GLOBAL const char *
@@ -65,7 +65,7 @@ Lists_GetReason(const struct list_elem *e)
 /**
 * Get "validity" value stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return Validity: 0=unlimited, >0 until this time stamp.
 */
 GLOBAL time_t
@@ -78,7 +78,7 @@ Lists_GetValidity(const struct list_elem *e)
 /**
 * Get "onlyonce" value stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return True if the element was stored for single use, false otherwise.
 */
 GLOBAL bool
@@ -381,11 +381,11 @@ Lists_Expire(struct list_head *h, const char *ListName)
 		if (e->valid_until > 0 && e->valid_until < now) {
 			/* Entry is expired, delete it */
 			if (e->reason)
-				Log(LOG_INFO,
+				Log(LOG_NOTICE|LOG_snotice,
 				    "Deleted \"%s\" (\"%s\") from %s list (expired).",
 				    e->mask, e->reason, ListName);
 			else
-				Log(LOG_INFO,
+				Log(LOG_NOTICE|LOG_snotice,
 				    "Deleted \"%s\" from %s list (expired).",
 				    e->mask, ListName);
 			Lists_Unlink(h, last, e);
--- a/src/ngircd/match.c
+++ b/src/ngircd/match.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -77,7 +77,7 @@ MatchCaseInsensitive(const char *Pattern, const char *String)
 /**
 * Match string with pattern case-insensitive.
 *
- * @param pattern Pattern to match with
+ * @param Pattern Pattern to match with
 * @param String Input string, at most COMMAND_LEN-1 characters long
 * @param Separator Character separating the individual patterns in the list
 * @return true if pattern matches
--- a/src/ngircd/messages.h
+++ b/src/ngircd/messages.h
@@ -110,11 +110,12 @@
 #define ERR_CANNOTSENDTOCHAN_MSG	"404 %s %s :Cannot send to channel"
 #define ERR_TOOMANYCHANNELS_MSG		"405 %s %s :You have joined too many channels"
 #define ERR_WASNOSUCHNICK_MSG		"406 %s %s :There was no such nickname"
+#define ERR_TOOMANYTARGETS_MSG		"407 %s :Too many recipients"
 #define ERR_NOORIGIN_MSG		"409 %s :No origin specified"
 #define ERR_INVALIDCAP_MSG		"410 %s %s :Invalid CAP subcommand"
 #define ERR_NORECIPIENT_MSG		"411 %s :No recipient given (%s)"
 #define ERR_NOTEXTTOSEND_MSG		"412 %s :No text to send"
-#define ERR_WILDTOPLEVEL		"414 %s :Wildcard in toplevel domain"
+#define ERR_WILDTOPLEVEL_MSG		"414 %s :Wildcard in toplevel domain"
 #define ERR_UNKNOWNCOMMAND_MSG		"421 %s %s :Unknown command"
 #define ERR_NOMOTD_MSG			"422 %s :MOTD file is missing"
 #define ERR_NONICKNAMEGIVEN_MSG		"431 %s :No nickname given"
--- a/src/ngircd/ngircd.c
+++ b/src/ngircd/ngircd.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2019 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -451,7 +451,7 @@ static void
 Show_Version( void )
 {
 	puts( NGIRCd_Version );
-	puts( "Copyright (c)2001-2014 Alexander Barton (<alex@barton.de>) and Contributors." );
+	puts( "Copyright (c)2001-2019 Alexander Barton (<alex@barton.de>) and Contributors." );
 	puts( "Homepage: <http://ngircd.barton.de/>\n" );
 	puts( "This is free software; see the source for copying conditions. There is NO" );
 	puts( "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." );
--- a/src/ngircd/numeric.c
+++ b/src/ngircd/numeric.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -176,6 +176,7 @@ Synchronize_Lists(CLIENT * Client)
 	CHANNEL *c;
 	struct list_head *head;
 	struct list_elem *elem;
+	time_t t;

 	assert(Client != NULL);

@@ -183,9 +184,10 @@ Synchronize_Lists(CLIENT * Client)
 	head = Class_GetList(CLASS_GLINE);
 	elem = Lists_GetFirst(head);
 	while (elem) {
+		t = Lists_GetValidity(elem) - time(NULL);
 		if (!IRC_WriteStrClient(Client, "GLINE %s %ld :%s",
 					Lists_GetMask(elem),
-					Lists_GetValidity(elem) - time(NULL),
+					t > 0 ? (long)t : 0,
 					Lists_GetReason(elem)))
 			return DISCONNECTED;
 		elem = Lists_GetNext(elem);
--- a/src/ngircd/op.c
+++ b/src/ngircd/op.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -40,12 +40,14 @@ Op_NoPrivileges(CLIENT * Client, REQUEST * Req)
 		from = Client_Search(Req->prefix);

 	if (from) {
-		Log(LOG_NOTICE, "No privileges: client \"%s\" (%s), command \"%s\"!",
+		Log(LOG_ERR|LOG_snotice,
+		    "No privileges: client \"%s\" (%s), command \"%s\"!",
 		    Req->prefix, Client_Mask(Client), Req->command);
 		return IRC_WriteErrClient(from, ERR_NOPRIVILEGES_MSG,
 					  Client_ID(from));
 	} else {
-		Log(LOG_NOTICE, "No privileges: client \"%s\", command \"%s\"!",
+		Log(LOG_ERR|LOG_snotice,
+		    "No privileges: client \"%s\", command \"%s\"!",
 		    Client_Mask(Client), Req->command);
 		return IRC_WriteErrClient(Client, ERR_NOPRIVILEGES_MSG,
 					  Client_ID(Client));
@@ -56,7 +58,7 @@ Op_NoPrivileges(CLIENT * Client, REQUEST * Req)
 * Check that the originator of a request is an IRC operator and allowed
 * to administer this server.
 *
- * @param CLient Client from which the command has been received.
+ * @param Client Client from which the command has been received.
 * @param Req Request structure.
 * @return CLIENT structure of the client that initiated the command or
 *	   NULL if client is not allowed to execute operator commands.
--- a/src/ngircd/pam.c
+++ b/src/ngircd/pam.c
@@ -32,6 +32,7 @@
 #include "log.h"
 #include "conn.h"
 #include "client.h"
+#include "conf.h"

 #include "pam.h"

@@ -101,7 +102,7 @@ PAM_Authenticate(CLIENT *Client) {
 	conv.appdata_ptr = Conn_Password(Client_Conn(Client));

 	/* Initialize PAM */
-	retval = pam_start("ngircd", Client_OrigUser(Client), &conv, &pam);
+	retval = pam_start(Conf_PAMServiceName, Client_OrigUser(Client), &conv, &pam);
 	if (retval != PAM_SUCCESS) {
 		Log(LOG_ERR, "PAM: Failed to create authenticator! (%d)", retval);
 		return false;
--- a/src/ngircd/parse.c
+++ b/src/ngircd/parse.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -111,7 +111,7 @@ static COMMAND My_Commands[] =
 	_CMD("USERS", IRC_USERS, CLIENT_USER|CLIENT_SERVER, 0, -1, 0),
 	_CMD("VERSION", IRC_VERSION, CLIENT_USER|CLIENT_SERVER, 0, 1, 1),
 	_CMD("WALLOPS", IRC_WALLOPS, CLIENT_USER|CLIENT_SERVER, 1, 1, 0),
-	_CMD("WEBIRC", IRC_WEBIRC, CLIENT_UNKNOWN, 4, 4, 0),
+	_CMD("WEBIRC", IRC_WEBIRC, CLIENT_UNKNOWN, 4, 5, 0),
 	_CMD("WHO", IRC_WHO, CLIENT_USER, 0, 2, 1),
 	_CMD("WHOIS", IRC_WHOIS, CLIENT_USER|CLIENT_SERVER, 0, -1, 1),
 	_CMD("WHOWAS", IRC_WHOWAS, CLIENT_USER|CLIENT_SERVER, 0, -1, 0),
@@ -169,8 +169,8 @@ Parse_GetCommandStruct( void )
 *
 * @param Idx Index of the connection from which the command has been received.
 * @param Request NULL terminated line of text (the "command").
- * @return true on success (valid command or "regular" error), false if a
- * 	fatal error occurred and the connection has been shut down.
+ * @return CONNECTED on success (valid command or "regular" error), DISCONNECTED
+ *	if a fatal error occurred and the connection has been shut down.
 */
 GLOBAL bool
 Parse_Request( CONN_ID Idx, char *Request )
@@ -257,11 +257,14 @@ Parse_Request( CONN_ID Idx, char *Request )
 		}
 	}

-	if( ! Validate_Prefix( Idx, &req, &closed )) return ! closed;
-	if( ! Validate_Command( Idx, &req, &closed )) return ! closed;
-	if( ! Validate_Args( Idx, &req, &closed )) return ! closed;
+	if(!Validate_Prefix(Idx, &req, &closed))
+		return !closed;
+	if(!Validate_Command(Idx, &req, &closed))
+		return !closed;
+	if(!Validate_Args(Idx, &req, &closed))
+		return !closed;

-	return Handle_Request( Idx, &req );
+	return Handle_Request(Idx, &req);
 } /* Parse_Request */


@@ -490,7 +493,7 @@ static bool
 Handle_Request( CONN_ID Idx, REQUEST *Req )
 {
 	CLIENT *client;
-	bool result = true;
+	bool result = CONNECTED;
 	int client_type;
 	COMMAND *cmd;

@@ -546,6 +549,8 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
 			cmd->lcount++;
 		else
 			cmd->rcount++;
+
+		/* Return result of command (CONNECTED/DISCONNECTED). */
 		return result;
 	}

@@ -554,13 +559,13 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
 	    client_type != CLIENT_SERVICE )
 		return true;

-	/* Unknown command and registered connection: generate error: */
 	LogDebug("Connection %d: Unknown command \"%s\", %d %s,%s prefix.",
 			Client_Conn( client ), Req->command, Req->argc,
 			Req->argc == 1 ? "parameter" : "parameters",
 			Req->prefix ? "" : " no" );

-	if (Client_Type(client) != CLIENT_SERVER)
+	/* Unknown command and registered connection: generate error: */
+	if (client_type != CLIENT_SERVER)
 		result = IRC_WriteErrClient(client, ERR_UNKNOWNCOMMAND_MSG,
 				Client_ID(client), Req->command);

--- a/src/ngircd/resolve.c
+++ b/src/ngircd/resolve.c
@@ -108,9 +108,8 @@ Resolve_Name( PROC_STAT *s, const char *Host, void (*cbfunc)(int, short))
 	return false;
 } /* Resolve_Name */

-
-#if !defined(HAVE_GETADDRINFO) || !defined(HAVE_GETNAMEINFO)
-#if !defined(WANT_IPV6) && defined(h_errno)
+#if !defined(HAVE_WORKING_GETADDRINFO) || !defined(HAVE_GETNAMEINFO)
+#ifdef h_errno
 static char *
 Get_Error( int H_Error )
 {
@@ -233,7 +232,11 @@ ReverseLookup(const ng_ipaddr_t *IpAddr, char *resbuf, size_t reslen)
 * @return true if lookup successful, false if domain name not found
 */
 static bool
+#ifdef HAVE_WORKING_GETADDRINFO
 ForwardLookup(const char *hostname, array *IpAddr, int af)
+#else
+ForwardLookup(const char *hostname, array *IpAddr, UNUSED int af)
+#endif
 {
 	ng_ipaddr_t addr;

--- a/src/ngircd/sighandlers.c
+++ b/src/ngircd/sighandlers.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -48,7 +48,11 @@ Dump_State(void)
 {
 	Log(LOG_DEBUG, "--- Internal server state: %s ---",
 	    Client_ID(Client_ThisServer()));
-	Log(LOG_DEBUG, "time()=%ld", time(NULL));
+#ifdef HAVE_LONG_LONG
+	Log(LOG_DEBUG, "time()=%llu", (unsigned long long)time(NULL));
+#else
+	Log(LOG_DEBUG, "time()=%lu", (unsigned long)time(NULL));
+#endif
 	Conf_DebugDump();
 	Conn_DebugDump();
 	Client_DebugDump();
--- a/src/portab/Makefile.ng
+++ b/src/portab/Makefile.ng
@@ -15,7 +15,13 @@ EXTRA_DIST = Makefile.ng

 noinst_LIBRARIES = libngportab.a

-libngportab_a_SOURCES = strdup.c strndup.c strlcpy.c strtok_r.c vsnprintf.c waitpid.c
+libngportab_a_SOURCES = \
+	strdup.c \
+	strlcpy.c \
+	strndup.c \
+	strtok_r.c \
+	vsnprintf.c \
+	waitpid.c

 check_PROGRAMS = portabtest

--- a/src/portab/portab.h
+++ b/src/portab/portab.h
@@ -175,6 +175,10 @@ extern int vsnprintf PARAMS(( char *str, size_t count, const char *fmt, va_list
 # define PACKAGE_VERSION VERSION
 #endif

+#ifndef SYSCONFDIR
+# define SYSCONFDIR "/etc"
+#endif
+
 #endif

 /* -eof- */
--- a/src/testsuite/Makefile.ng
+++ b/src/testsuite/Makefile.ng
@@ -21,6 +21,7 @@ EXTRA_DIST = \
 	join-test.e kick-test.e message-test.e misc-test.e mode-test.e \
 	opless-channel-test.e server-link-test.e who-test.e whois-test.e \
 	stress-A.e stress-B.e \
+	server-login-test.e \
 	start-server1 stop-server1 ngircd-test1.conf \
 	start-server2 stop-server2 ngircd-test2.conf

@@ -81,6 +82,10 @@ server-link-test: tests.sh
 	rm -f server-link-test
 	ln -s $(srcdir)/tests.sh server-link-test

+server-login-test: tests.sh
+	rm -f server-login-test
+	ln -s $(srcdir)/tests.sh server-login-test
+
 who-test: tests.sh
 	rm -f who-test
 	ln -s $(srcdir)/tests.sh who-test
@@ -103,6 +108,7 @@ TESTS = start-server1 \
 	who-test \
 	whois-test \
 	server-link-test \
+	server-login-test \
 	stop-server2 \
 	stress-server.sh \
 	stop-server1
--- a/src/testsuite/message-test.e
+++ b/src/testsuite/message-test.e
@@ -35,13 +35,24 @@ expect {
 send "privmsg nick,nick :test\r"
 expect {
 	timeout { exit 1 }
-	"@* PRIVMSG nick :test\r*@* PRIVMSG nick :test"
+	"@* PRIVMSG nick :test"
+}
+
+send "privmsg ,,,, :dummy\r"
+send "privmsg ,,,nick,,&server,,, :test\r"
+expect {
+	timeout { exit 1 }
+	"@* PRIVMSG nick :test"
+}
+expect {
+	timeout { exit 1 }
+	"404"
 }

 send "privmsg Nick,#testChannel,nick :test\r"
 expect {
 	timeout { exit 1 }
-	"@* PRIVMSG nick :test\r*401*@* PRIVMSG nick :test"
+	"@* PRIVMSG nick :test\r*401"
 }

 send "privmsg doesnotexist :test\r"
--- a/src/testsuite/ngircd-test1.conf
+++ b/src/testsuite/ngircd-test1.conf
@@ -12,6 +12,7 @@
 [Limits]
 	MaxConnectionsIP = 0
 	MaxJoins = 4
+	MaxPenaltyTime = 1

 [Options]
 	OperCanUseMode = yes
@@ -29,6 +30,11 @@
 	MyPassword = pwd1
 	PeerPassword = pwd2

+[Server]
+	Name = ngircd.test.server3
+	MyPassword = pwd1
+	PeerPassword = pwd3
+
 [Channel]
 	Name = InviteChannel
 	Modes = i
--- a/src/testsuite/ngircd-test2.conf
+++ b/src/testsuite/ngircd-test2.conf
@@ -12,6 +12,7 @@
 [Limits]
 	MaxConnectionsIP = 0
 	MaxJoins = 4
+	MaxPenaltyTime = 1

 [Options]
 	OperCanUseMode = yes
--- a/src/testsuite/server-login-test.e
+++ b/src/testsuite/server-login-test.e
@@ -0,0 +1,94 @@
+# ngIRCd test suite
+# server-server login test
+
+spawn telnet 127.0.0.1 6789
+expect {
+	timeout { exit 1 }
+	"Connected"
+}
+
+# Register server
+send "PASS pwd1 0210-IRC+ ngIRCd|testsuite0:CHLMSX P\r"
+send "SERVER ngircd.test.server3 :Testsuite Server Emulation\r"
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server PASS pwd3 0210-IRC+ ngIRCd|"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server SERVER ngircd.test.server 1 :"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server 005 "
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server 376 "
+}
+
+# End of handshake
+send ":ngircd.test.server3 376 ngircd.test.server :End of MOTD command\r"
+
+# Receive existing channels
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server CHANINFO +ModelessChannel +P :A modeless Channel"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server CHANINFO #SecretChannel +Ps :A secret Channel"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server CHANINFO #TopicChannel +Pt :the topic"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server CHANINFO #FullKeyed +Plk Secret 0 :"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server CHANINFO #InviteChannel +Pi"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server PING :ngircd.test.server"
+}
+
+# Emulate network burst
+send ":ngircd.test.server3 NICK NickName 1 ~User localhost 1 + :Real Name\r"
+send ":ngircd.test.server3 NJOIN #Channel :@NickName\r"
+
+# End of burst
+send ":ngircd.test.server3 PONG :ngircd.test.server\r"
+
+# Test server-server link ...
+send ":ngircd.test.server3 VERSION\r"
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server 351 ngircd.test.server3 "
+}
+
+# Make sure our test client is still known in the network
+send ":ngircd.test.server3 WHOIS NickName\r"
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server 311 ngircd.test.server3 NickName ~User localhost * :Real Name"
+}
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server 319 ngircd.test.server3 NickName :@#Channel"
+}
+
+expect {
+	timeout { exit 1 }
+	":ngircd.test.server 318 ngircd.test.server3 NickName :"
+}
+
+# Logout
+send ":ngircd.test.server3 QUIT\r"
+expect {
+	timeout { exit 1 }
+	"ERROR :Closing connection"
+}
--- a/src/tool/tool.c
+++ b/src/tool/tool.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -82,7 +82,7 @@ ngt_UpperStr(char *String)

 	ptr = String;
 	while(*ptr) {
-		*ptr = toupper((int)*ptr);
+		*ptr = (char)toupper(*ptr);
 		ptr++;
 	}
 	return String;
@@ -101,7 +101,7 @@ ngt_LowerStr(char *String)

 	ptr = String;
 	while(*ptr) {
-		*ptr = tolower((int)*ptr);
+		*ptr = (char)tolower(*ptr);
 		ptr++;
 	}
 	return String;