ngIRCd Release 26~rc1

Update config.guess and config.sub to recent versions
- config.guess: 2020-04-26 - config.sub: 2020-05-04 And set both scripts +x, they are executable.
2025-10-17 07:37:39 +00:00 · 2020-05-10 17:13:51 +02:00 · 2020-05-10 17:09:23 +02:00 · 2020-05-10 01:09:34 +02:00 · 2020-05-10 00:16:11 +02:00 · 2020-05-10 00:14:04 +02:00
106 changed files with 5200 additions and 3081 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -0,0 +1,20 @@
 # ngIRCd -- The Next Generation IRC Daemon
 # Copyright (c)2001-2016 Alexander Barton (alex@barton.de) and Contributors.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
 # Please read the file COPYING, README and AUTHORS for more information.
 # .editorconfig: Editor settings, see <http://editorconfig.org>.
 root = true
 [*]
 indent_style = tab
 indent_size = 8
 end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
--- a/.gitignore
+++ b/.gitignore
@@ -23,7 +23,9 @@ depcomp
 install-sh
 missing
 ngircd.dest
 .*.swp
 .deps
 .vscode
 *.a
 *.o
 doc/sample-ngircd.conf
@@ -42,7 +44,11 @@ src/portab/portabtest
 src/portab/portabtest.exe
 src/testsuite/*.e_
 src/testsuite/channel-test
 src/testsuite/connect-ssl-cert1-test
 src/testsuite/connect-ssl-cert2-test
 src/testsuite/connect-test
 src/testsuite/connect-tls-cert1-test
 src/testsuite/connect-tls-cert2-test
 src/testsuite/invite-test
 src/testsuite/join-test
 src/testsuite/kick-test
@@ -54,12 +60,20 @@ src/testsuite/ngircd-test1.log
 src/testsuite/ngircd-test1.motd
 src/testsuite/ngircd-test2.log
 src/testsuite/ngircd-test2.motd
 src/testsuite/ngircd-test3.log
 src/testsuite/ngircd-test3.motd
 src/testsuite/opless-channel-test
 src/testsuite/server-link-test
 src/testsuite/server-login-test
 src/testsuite/ssl/cert.pem
 src/testsuite/ssl/dhparams.pem
 src/testsuite/ssl/key.pem
 src/testsuite/T-ngircd1
 src/testsuite/T-ngircd1.exe
 src/testsuite/T-ngircd2
 src/testsuite/T-ngircd2.exe
 src/testsuite/T-ngircd3
 src/testsuite/T-ngircd3.exe
 src/testsuite/tests
 src/testsuite/tests-skipped.lst
 src/testsuite/who-test
--- a/.mailmap
+++ b/.mailmap
@@ -6,9 +6,17 @@ Alexander Barton <alex@barton.de> <alex@kfreebsd.barton.de>
 Ali Shemiran <ashemira@ucsd.edu>
 Christoph Biedl <ngircd.anoy@manchmal.in-ulm.de> <debian.axhn@manchmal.in-ulm.de>
 Dana Dahlstrom <dana+ngIRCd@cs.ucsd.edu> <dana@cs.ucsd.edu>
 Dana Dahlstrom <dana+ngIRCd@cs.ucsd.edu> <dana+70@cs.ucsd.edu>
 DNS <dns@rbose.org>
 Götz Hoffart <goetz@hoffart.de>
 LucentW <lucent@zebes.info> <LucentW@users.noreply.github.com>
 Michi <michi+ngircd@dataswamp.org>
 Sam James <sam@cmpct.info> <11667869+thesamesam@users.noreply.github.com>
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,7 +1,14 @@
 language: c
-before_install:
+addons:
-  - sudo apt-get update -qq
+  apt:
-  - sudo apt-get install -qq libident-dev libpam0g-dev libssl-dev libwrap0-dev zlib1g-dev expect telnet
+    packages:
    - libident-dev
    - libpam0g-dev
    - libssl-dev
    - libwrap0-dev
    - zlib1g-dev
    - expect
    - telnet
 compiler:
  - gcc
  - clang
--- a/27
+++ b/27
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2020 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
@@ -13,7 +13,7 @@ Note:
 If you have comments, patches or something else, please feel free to post
 a mail to the ngIRCd mailing list: <ngircd-ml@ngircd.barton.de> (please see
 <http://ngircd.barton.de/support.php> for details) or join the ngIRCd IRC
-channel: <irc://irc.barton.de/ngircd>.
+channel "#ngircd" on irc.barton.de: <irc://irc.barton.de/ngircd>.
 Don't mail the people listed here directly, if possible!
@@ -29,40 +29,53 @@ Contributors
 Ali Shemiran <ashemira@ucsd.edu>
 Ask Bjørn Hansen <ask@develooper.com>
 Benjamin Pineau <ben@zouh.org>
 Bernd Kuhls <bernd.kuhls@t-online.de>
 Brandon Beresini <beresini@google.com>
 Brett Smith <brett@w3.org>
 Brian Collins <bricollins@gmail.com>
 Bryan Caldwell <bcaldwel@ucsd.edu>
 Christian Aistleitner <christian@quelltextlich.at>
 Christoph Biedl <ngircd.anoy@manchmal.in-ulm.de>
 DNS <dns@rbose.org>
 Dana Dahlstrom <dana+ngIRCd@cs.ucsd.edu>
 David Kingston <deathking1337@aim.com>
 DNS <dns@rbose.org>
 Eric Grunow <egrunow@ucsd.edu>
 Fabrice Fontaine <fontaine.fabrice@gmail.com>
 Federico G. Schwindt <fgsch@lodoss.net>
 Gabor Adam Toth <tg@tgbit.net>
-Goetz Hoffart <goetz@hoffart.de>
+Götz Hoffart <goetz@hoffart.de>
 Hilko Bengen <bengen@hilluzination.de>
 Ian Chard <ian@chard.org>
 Ilja Osthoff <i.osthoff@gmx.net>
 ItsOnlyBinary <ItsOnlyBinary@users.noreply.github.com>
 James Lu <james@overdrivenetworks.com>
 Jari Aalto <jari.aalto@cante.net>
 Johann Hartwig Hauschild <git@hauschild.it>
 JRMU <jrmu@lecturify.com>
 LucentW <lucent@zebes.info>
 Mantas Mikulėnas <grawity@gmail.com>
 Michi <michi+ngircd@dataswamp.org>
 Neale Pickett <neale@woozle.org>
 Peter Powell <petpow@saberuk.com>
 Rolf Eike Beer <eike@sf-mail.de>
 Rosen Penev <rosenp@gmail.com>
 Roy Sindre Norangshol <roy.sindre@norangshol.no>
 Sam James <sam@cmpct.info>
 Scott Perry <scperry@ucsd.edu>
 Sean Reifschneider <jafo-rpms@tummy.com>
 Sebastian Köhler <sebkoehler@whoami.org.uk>
 shankari <shankari@eecs.berkeley.edu>
 Tassilo Schweyer <dev@welterde.de>
 Tom Ryder <tom@sanctum.geek.nz>
 Unit 193 <unit193@ubuntu.com>
 William Pitcock <nenolod@dereferenced.org>
-Yecheng Fu <cofyc.jackson@gmail.com>
+Windree <57554809+Windree@users.noreply.github.com>
 xor <xorboy@gmail.com>
 Yecheng Fu <cofyc.jackson@gmail.com>
 Code snippets
 ~~~~~~~~~~~~~
 J. Kercheval: pattern matching functions
 Patrick Powell <papowell@astart.com>: snprintf()-function
 Andrew Tridgell & Martin Pool: strl{cpy|cat}()-functions
 John Kercheval: pattern matching functions
 Patrick Powell <papowell@astart.com>: snprintf()-function
--- a/251
+++ b/251
@@ -2,12 +2,257 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2020 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
                               -- ChangeLog --
 ngIRCd 26
  ngIRCd 26~rc1 (2020-05-10)
  - Tweak & update doc/HowToRelease.txt, .mailmap and AUTHORS files.
  - Allow up to 512 characters per line in MOTD and help text files (but keep
    in mind that lines can't get that long, because they have to be prefixed
    before being sent to the client). But this allows for more fancy MOTDs :-)
    Closes #271.
  - Show the actually allowed channel types in the ISUPPORT(005) numeric which
    are configured by the "AllowedChannelTypes" configuration variable.
    Closes #273.
  - Handle commands in the read buffer before reading more data and don't wait
    for the network in this case: If there are more bytes in the read buffer
    already than a single valid IRC command can get long (513 bytes), wait for
    this/those command(s) to be handled first and don't try to read even more
    data from the network (which most probably would overflow the read buffer
    of this connection soon).
  - Update Travis-CI configuration, "sudo" is depreacted.
  - Log G-/K-Line changes only when not initiated by a server: this prevents
    the log from becomming spammed during "net bursts".
  - Update test suite to include SSL tests, including checking for reloading
    certificates during runtime.
  - Makefile.am: Replace "make" with "${MAKE}". This fixes warnings like this:
    "warning: jobserver unavailable: using -j1. Add `+' to parent make rule."
    Thanks to Sam James (sam_c) <sam@cmpct.info>!
    Closes #270.
  - Add support for GnuTLS certificate reload, which is quite handy when using
    Let's Encrypt, for example. Until now this was only supported when linked
    with OpenSSL. Thanks a lot, Hilko Bengen <bengen@hilluzination.de>!
  - Remove deprecated legacy configuration options and related functions that
    have been marked for removal for quite some time:
    - PredefChannelsOnly (v22)
    - NoticeAuth (v24)
    - NoXXX (v19)
    - Old '[GLOBAL]' section handling (v19)
    Thanks to Michi <michi+ngircd@dataswamp.org> for the patch!
  - Fix recursion bug on write errors: Depending on the stack size, too many
    clients on the same channel quitting at the same time would trigger a crash
    due to too many recursive calls to Conn_Close(). Thanks to Michi
    <michi+ngircd@dataswamp.org> for the patch!
  - Fix builds using GCC option -fno-common, which is the default starting with
    GCC 10. Thanks to Michi <michi+ngircd@dataswamp.org> for the patch!
    Closes #266.
  - Convert INSTALL and README files to Markdown.
  - Allow setting arbitrary channel modes in the configuration file by handling
    them like in MODE commands, and allow multiple "Modes =" lines per [Channel]
    section. Thanks to Michi <michi+ngircd@dataswamp.org>!
    Closes #55.
  - Add "FNC" (forced nick changes) to ISUPPORT(005) numeric. Most probably
    this doesn't make any difference to any client, but it seems correct.
    See <http://www.irc.org/tech_docs/005.html> for details.
  - Reuse old SSL key if loading a new one failed.
  - Remove outdated OpenBSD/NetBSD systrace.policy.
  - Enhance handling of command line errors, and return with exit code 0 ("no
    error") when "--help" or "--version" is used (which resulted in exit code 1,
    "error" before). Exit with code 2 ("command line error") for all other
    invalid command line options, and show the error message itself on stderr
    (instead of stdout and exit code 1, "generic error", as before).
    This new behaviour is more in line with the GNU "coding standards",
    see <https://www.gnu.org/prep/standards/html_node/_002d_002dhelp.html>.
  - Fix and update Xcode project: Reference correct contrib/Makefile.am file,
    correctly sort contrib/nglog.sh and add "ORGANIZATIONNAME" setting.
  - contrib/ngindent.sh: Add more GNU indent options for better results, and
    add the ".sh" suffix to bring this script in line with the others in the
    contrib/ folder.
  - Add ./contrib/nglog.sh: This script parses the log output of ngircd(8),
    and colorizes the messages according to their log level. Example usage:
    ngircd -f $PWD/doc/sample-ngircd.conf -np | ./contrib/nglog.sh
  - Log received signals with their names using strsignal(3), when available.
  - Make test suite compatible with Haiku OS.
  - Fix host mask cloaking bug, don't cloak multiple times: Previously, each
    server would cloak every user's host mask. The problem is that if a network
    has more than one server, then a user's host mask would get cloaked twice.
    This patch ensures that a server only cloaks the host mask if it has not yet
    been cloaked (the period indicates it's still an IP address). Thanks to
    JRMU <jrmu@lecturify.com> for the patch!
    Closes #228.
  - Enlarge buffers of info texts to 128 bytes. This includes:
    - "Real name" of a client (4th filed of the USER command).
    - Server info text ("Info" configuration option).
    - Admin info texts and email address ("AdminInfo1", "AdminInfo2" and
      "AdminEmail" configuration options).
    - Network name ("Network" configuration option).
    The limit was 64 bytes before ...
    Closes #258.
  - Streamline handling of invalid and unset server name: Don't exit during
    runtime (REHASH command, HUP signal), because the server name can't be
    changed in this case anyway and the new invalid name will be ignored.
  - Fix and extend documentation: Fix some typos, fix syntax of LINKS and LIST
    commands, whitespace and spelling fixes, update dependencies and add some
    more information about IRCv3 support.
    Thanks to Thanks Windree, Étienne Mollier <etienne.mollier@mailoo.org> and
    Christoph Biedl <debian.axhn@manchmal.in-ulm.de>.
    Closes #264.
  - Slightly reorder startup steps, and enhance logging:
    - Show name of configuration file at the beginning of start up.
    - Add a message when ngIRCd is ready, including its host name.
    - Show name of configuration file on REHASH (SIGHUP), too.
    - Change level of "done message" to NOTICE, like "starting" & "ready".
    - Initialize IO functions before channels, connections, clients, ...
  - configure.ng: OpenSSL can depends on lz or latomic so use pkg-config to
    find those dependencies and fallback to existing mechanism.
    Closes #256.
  - ngircd.conf.5: Fix wording as suggested by lintian.
 ngIRCd 25 (2019-01-23)
  - Fix documentation of MotdPhrase length, which actually is 126 characters:
    update sample configuration file as well as the man page. Thanks to
    shankari <shankari@eecs.berkeley.edu>.
    Closes #254.
  - Implement new configuration option "MaxPenaltyTime", which configures the
    maximum penalty time increase in seconds, per penalty event. Set to -1 for
    no limit (the default), 0 to disable penalties altogether. ngIRCd doesn't
    use penalty increases higher than 2 seconds during normal operation, so
    values higher than 1 rarely make sense.
    Disabling (or reducing) penalties can greatly speed up "make check" runs
    for example, see below, but are mostly a debugging feature and normally
    not meant to be used on production systems!
    Some example timings running "make check" from my macOS workstation:
     - MaxPenaltyTime not set: 4:41,79s
     - "MaxPenaltyTime = 1":   3:14,71s
     - "MaxPenaltyTime = 0":     25,46s
    Closes #249 and #251.
  - Fix compilation without deprecated OpenSSL APIs. Thanks to Rosen Penev
    <rosenp@gmail.com> for the patch!
    Closes #252.
  - Update Xcode project for latest Xcode version (10.0)
  - Fix some compiler warnings of Apple Xcode/Clang
  - Allow a 5th parameter in WEBIRC. Thanks to "ItsOnlyBinary".
    Closes #247.
  - Update some more documentation files and source code comments.
  - Platforms.txt: Add and update systems.
  ngIRCd 25~rc1 (2018-08-11)
  - Update config.guess (2018-03-08) and config.sub (2018-03-08) files.
  - Correctly retry to establish an outgoing connections when forking of the
    resolver sub-process failed (for example because of lack of free memory).
    Until now, such a connection was never retried once this error was hit.
    Thanks to Robert Obermeier for reporting this bug!
    Closes #243.
  - Fix a "use after free" bug which can be triggered on a newly established
    connection when the daemon handles an ERROR command received from the peer
    during client login. Thanks a lot to Joseph Bisch <joseph.bisch@gmail.com>
    for discovering and reporting this issue!
  - Only send TOPIC updates to a channel when the topic actually changed:
    This prevents the channel from becoming flooded by unnecessary TOPIC update
    messages, that can happen when IRC services try to enforce a certain topic
    but which is already set (at least on the local server), for example.
    Therefore still forward it to all servers, but don't inform local clients
    (still update setter and timestamp information, though).
  - Update Xcode project for latest Xcode version (9.2). This includes adding
    missing and deleting obsolete file references.
  - Handle user mode "C" ("Only users that share a channel are allowed to send
    messages") like user mode "b" ("block private messages and notices"): allow
    messages from servers, services, and IRC Operators, too. Change proposed by
    "wowaname" back in 2015 in #ngircd, thanks!
  - Fix some compiler warnings.
  - Add contrib/ngircd.logcheck: Some sample logcheck(8) rules.
  - Allow IRC Ops and remote servers to KILL service clients: such clients
    behave like regular users, therefore IRC operators and servers should be
    able to KILL them: for example to resolve nick collisions.
    Closes #242.
  - Don't forward KILLs to other servers if they've been blocked locally:
    This prevents clients from killing IRC services, for example.
    Closes #238 and #239.
  - Fix a cross-compiler issue related to the Get_Error() function.
    Closes #240 and #241.
  - Update ./doc/Services.txt, enhance configuration examples.
 ngIRCd 24 (2017-01-20)
  - Make sure that ./contrib/platformtest.sh aborts when ./autogen.sh fails.
  - Update config.guess (2016-10-02) and config.sub (2016-11-04) files.
  - Build Debian packages with OpenSSL instead of GnuTLS: OpenSSL allows
    to reload used certificates on runtime for example (which is very
    useful when using Let's Encrypt), and therefore is preferred. And
    explicitly specify the "source format".
  - Fix handling of connection pool allocation and enlargement: up to now,
    the daemon only enlarged its connection pool when accepting new incoming
    client or server connections, not when establishing new outgoing server
    links, which could lead to problems when hitting the configured limit,
    see "MaxConnections". Thanks to Lukas Braun (k00mi) for reporting this!
    Closes #231.
  ngIRCd 24~rc1 (2017-01-07)
  - Enhance systemd service file, and install it in Debian package.
  - Update configuration of Debian package.
  - Log privilege violations and failed OPER request with log level "error"
    and send it to the "&SERVER" channel, too.
  - Immediately shut down connection when receiving an "ERROR" command,
    don't wait for the peer to close the connection. This allows the daemon
    to forward the received "ERROR" message in the network, instead of the
    very generic "client closed connection" message.
  - Fix sending of entry duration (no negative values!) when synchronizing
    "x-lines" (G-LINES).
  - List expiration (G-LINES): use same log level as when setting, and log
    this event to the &SERVER channel, too.
  - Explicitly forbid remote servers to modify "x-lines" (G-LINES) when the
    "AllowRemoteOper" configuration option isn't set, even when the command
    seems to originate from the remote server itself: this prevents GLINE's
    to become set during server handshake in this case (what wouldn't be
    possible during regular runtime when a remote IRC Op sends the command)
    and what can't be undone by IRC Ops later on (because of the missing
    "AllowRemoteOper" option) ...
  - Make scripts and init-files in ./contrib executable.
  - Fix building ngIRCd with OpenSSL 1.1. Thanks to Christoph Biedl
    <ngircd.anoy@manchmal.in-ulm.de> for the patch!
  - Fix code indentation warnings of gcc 6.2.
  - Update config.guess (2016-04-02) and config.sub (2016-03-30) files.
  - Fix warnings of the "shellcheck" linter in autogen.sh, contrib/ngindent
    and contrib/platformtest.sh.
  - Update Xcode project for latest Xcode version (8.0), and fix "duplicate
    symbols" error messages when building (linking) the binary.
  - Add "Documentation" variables to systemd configuration files.
  - Make sure that SYSCONFDIR is always set, which can be handy when
    using source code linters when ./configure hasn't been run already.
  - Add the new "PAMServiceName" configuration option to specify the name
    used as PAM service name. This setting allows to run multiple ngIRCd
    instances with different PAM configurations for each instance.
    Thanks to Christian Aistleitner <christian@quelltextlich.at> for the
    patch, closes #226.
  - Add an ".editorconfig" file to the project.
  - Travis-CI: use "container-based infrastructure".
  - Limit the number of message targets, and suppress duplicates: This
    prevents an user from flooding the server using commands like this:
    "PRIVMSG nick1,nick1,nick1,...".
    Duplicate targets are suppressed silently (channels and clients).
    In addition, the maximum number of targets per PRIVMSG, NOTICE, ...
    command are limited to MAX_HNDL_TARGETS (25). If there are more, the
    daemon sends the new 407 (ERR_TOOMANYTARGETS_MSG) numeric, containing
    the first target that hasn't been handled any more. Closes #187.
  - Test suite: Add new test for server-server logins.
  - contrib/ngindent: Fix shebang line.
  - Make contrib/platformtest.sh script more portable, and only show
    "runs=Y" when the test suite really has been passed successfully.
  - Code cleanup in the NJON handler and the function killing clients as
    well as the function sending messages to a "mask" (cleaner code, more
    fault tolerant, better code comments).
  - Update and enhance documentation: README file, doc/Platforms.txt,
    doc/Modes.txt, doc/Commands.txt, doc/PAM.txt.
  - Fix NJOIN not propagating "half ops" status: ngIRCd tested for the wrong
    prefix of "half ops" when processing NJOIN commands and therefore never
    classified a remote user as "half op".
    Thanks to wowaname for pointing this out on #ngircd!
 ngIRCd 23 (2015-11-16)
@@ -60,7 +305,7 @@ ngIRCd 23 (2015-11-16)
    Idea and implementation by LucentW, Thanks! Closes #207.
  - Update ngircd.conf.5: "CloakUserToNick" hides user _and_ real name.
    This closes #208.
-  - Fix case insensitive pattern matching: Up to now, only the the input
+  - Fix case insensitive pattern matching: Up to now, only the input
    string became lowercased and was then compared to the pattern -- which
    failed when the pattern itself wasn't all lowercase!
  - Streamline the effect of "MorePrivacy" option: Update documentation
@@ -413,7 +658,7 @@ ngIRCd 20.3 (2013-08-23)
 ngIRCd 20.2 (2013-02-15)
  - Security: Fix a denial of service bug in the function handling KICK
-    commands that could be used by arbitrary users to to crash the daemon
+    commands that could be used by arbitrary users to crash the daemon
    (CVE-2013-1747).
  - WHO command: Use the currently "displayed hostname" (which can be cloaked!)
    for hostname matching, not the real one. In other words: don't display all
--- a/367
+++ b/367
@@ -1,367 +0,0 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
               (c)2001-2015 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
                                -- INSTALL --
 I. Upgrade Information
 ~~~~~~~~~~~~~~~~~~~~~~
 Differences to version 22.x
 - The "NoticeAuth" ngircd.conf configuration variable has been renamed to
  "NoticeBeforeRegistration". The old "NoticeAuth" variable still works but
  is deprecated now.
 - The default value of the SSL "CipherList" variable has been changed to
  "HIGH:!aNULL:@STRENGTH:!SSLv3" (OpenSSL) and "SECURE128:-VERS-SSL3.0"
  (GnuTLS) to disable the old SSLv3 protocol by default.
  To enable connections of clients still requiring the weak SSLv3 protocol,
  the "CipherList" must be set to its old value (not recommended!), which
  was "HIGH:!aNULL:@STRENGTH" (OpenSSL) and "SECURE128" (GnuTLS), see below.
 Differences to version 20.x
 - Starting with ngIRCd 21, the ciphers used by SSL are configurable and
  default to "HIGH:!aNULL:@STRENGTH" (OpenSSL) or "SECURE128" (GnuTLS).
  Previous version were using the OpenSSL or GnuTLS defaults, "DEFAULT"
  and "NORMAL" respectively.
 - When adding GLINE's or KLINE's to ngIRCd 21 (or newer), all clients matching
  the new mask will be KILL'ed. This was not the case with earlier versions
  that only added the mask but didn't kill already connected users.
 - The "PredefChannelsOnly" configuration variable has been superseded by the
  new "AllowedChannelTypes" variable. It is still supported and translated to
  the appropriate "AllowedChannelTypes" setting but is deprecated now.
 Differences to version 19.x
 - Starting with ngIRCd 20, users can "cloak" their hostname only when the
  configuration variable "CloakHostModeX" (introduced in 19.2) is set.
  Otherwise, only IRC operators, other servers, and services are allowed to
  set mode +x. This prevents regular users from changing their hostmask to
  the name of the IRC server itself, which confused quite a few people ;-)
 Differences to version 17.x
 - Support for ZeroConf/Bonjour/Rendezvous service registration has been
  removed. The configuration option "NoZeroconf" is no longer available.
 - The structure of ngircd.conf has been cleaned up and three new configuration
  sections have been introduced: [Limits], [Options], and [SSL].
  Lots of configuration variables stored in the [Global] section are now
  deprecated there and should be stored in one of these new sections (but
  still work in [Global]):
    "AllowRemoteOper"    -> [Options]
    "ChrootDir"          -> [Options]
    "ConnectIPv4"        -> [Options]
    "ConnectIPv6"        -> [Options]
    "ConnectRetry"       -> [Limits]
    "MaxConnections"     -> [Limits]
    "MaxConnectionsIP"   -> [Limits]
    "MaxJoins"           -> [Limits]
    "MaxNickLength"      -> [Limits]
    "NoDNS"              -> [Options], and renamed to "DNS"
    "NoIdent"            -> [Options], and renamed to "Ident"
    "NoPAM"              -> [Options], and renamed to "PAM"
    "OperCanUseMode"     -> [Options]
    "OperServerMode"     -> [Options]
    "PingTimeout"        -> [Limits]
    "PongTimeout"        -> [Limits]
    "PredefChannelsOnly" -> [Options]
    "SSLCertFile"        -> [SSL], and renamed to "CertFile"
    "SSLDHFile"          -> [SSL], and renamed to "DHFile"
    "SSLKeyFile"         -> [SSL], and renamed to "KeyFile"
    "SSLKeyFilePassword" -> [SSL], and renamed to "KeyFilePassword"
    "SSLPorts"           -> [SSL], and renamed to "Ports"
    "SyslogFacility"     -> [Options]
    "WebircPassword"     -> [Options]
  You should adjust your ngircd.conf and run "ngircd --configtest" to make
  sure that your settings are correct and up to date!
 Differences to version 16.x
 - Changes to the "MotdFile" specified in ngircd.conf now require a ngircd
  configuration reload to take effect (HUP signal, REHASH command).
 Differences to version 0.9.x
 - The option of the configure script to enable support for Zeroconf/Bonjour/
  Rendezvous/WhateverItIsNamedToday has been renamed:
    --with-rendezvous  ->  --with-zeroconf
 Differences to version 0.8.x
 - The maximum length of passwords has been raised to 20 characters (instead
  of 8 characters). If your passwords are longer than 8 characters then they
  are cut at an other position now.
 Differences to version 0.6.x
 - Some options of the configure script have been renamed:
    --disable-syslog  ->  --without-syslog
    --disable-zlib    ->  --without-zlib
  Please call "./configure --help" to review the full list of options!
 Differences to version 0.5.x
 - Starting with version 0.6.0, other servers are identified using asynchronous
  passwords: therefore the variable "Password" in [Server]-sections has been
  replaced by "MyPassword" and "PeerPassword".
 - New configuration variables, section [Global]: MaxConnections, MaxJoins
  (see example configuration file "doc/sample-ngircd.conf"!).
 II. Standard Installation
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 ngIRCd is developed for UNIX-based systems, which means that the installation
 on modern UNIX-like systems that are supported by GNU autoconf and GNU
 automake ("configure") should be no problem.
 The normal installation procedure after getting (and expanding) the source
 files (using a distribution archive or GIT) is as following:
  0) Satisfy prerequisites
  1) ./autogen.sh  [only necessary when using GIT]
  2) ./configure
  3) make
  4) make install
 (Please see details below!)
 Now the newly compiled executable "ngircd" is installed in its standard
 location, /usr/local/sbin/.
 The next step is to configure and afterwards starting the daemon. Please
 have a look at the ngircd(8) and ngircd.conf(5) manual pages for details
 and all possible options -- and don't forget to run "ngircd --configtest"
 to validate your configuration file!
 If no previous version of the configuration file exists (the standard name
 is /usr/local/etc/ngircd.conf), a sample configuration file containing all
 possible options will be installed there. You'll find its template in the
 doc/ directory: sample-ngircd.conf.
 0): Satisfy prerequisites
 When building from source, you'll need some other software to build ngIRCd:
 for example a working C compiler, make tool, GNU automake and autoconf (only
 when not using a distribution archive), and a few libraries depending on the
 features you want to compile in (like IDENT support, SSL, and PAM).
 If you are using one of the "big" operating systems or Linux distributions,
 you can use the following commands to install all the required packages to
 build the sources including all optional features and to run the test suite:
 * Red Hat / Fedora based distributions:
  yum install \
    autoconf automake expect gcc glibc-devel gnutls-devel \
    libident-devel make pam-devel tcp_wrappers-devel telnet zlib-devel
 * Debian / Ubuntu based distributions:
  apt-get install \
    autoconf automake build-essential expect libgnutls-dev \
    libident-dev libpam-dev libwrap0-dev libz-dev telnet
 1): "autogen.sh"
 The first step, autogen.sh, is only necessary if the configure-script isn't
 already generated. This never happens in official ("stable") releases in
 tar.gz-archives, but when using GIT.
 This step is therefore only interesting for developers.
 autogen.sh produces the Makefile.in's, which are necessary for the configure
 script itself, and some more files for make. To run autogen.sh you'll need
 GNU autoconf and GNU automake: at least autoconf 2.61 and automake 1.10 are
 required, newer is better. But don't use automake 1.12 or newer for creating
 distribution archives: it will work but lack "de-ANSI-fication" support in the
 generated Makefile's! Stick with automake 1.11.x for this purpose ...
 So automake 1.11.x and autoconf 2.67+ is recommended.
 Again: "end users" do not need this step and neither need GNU autoconf nor GNU
 automake at all!
 2): "./configure"
 The configure-script is used to detect local system dependencies.
 In the perfect case, configure should recognize all needed libraries, header
 files and so on. If this shouldn't work, "./configure --help" shows all
 possible options.
 In addition, you can pass some command line options to "configure" to enable
 and/or disable some features of ngIRCd. All these options are shown using
 "./configure --help", too.
 Compiling a static binary will avoid you the hassle of feeding a chroot dir
 (if you want use the chroot feature). Just do something like:
  CFLAGS=-static ./configure [--your-options ...]
 Then you can use a void directory as ChrootDir (like OpenSSH's /var/empty).
 3): "make"
 The make command uses the Makefiles produced by configure and compiles the
 ngIRCd daemon.
 4): "make install"
 Use "make install" to install the server and a sample configuration file on
 the local system. Normally, root privileges are necessary to complete this
 step. If there is already an older configuration file present, it won't be
 overwritten.
 These files and folders will be installed by default:
 - /usr/local/sbin/ngircd: executable server
 - /usr/local/etc/ngircd.conf: sample configuration (if not already present)
 - /usr/local/share/doc/ngircd/: documentation
 - /usr/local/share/man/: manual pages
 III. Additional features
 ~~~~~~~~~~~~~~~~~~~~~~~~
 The following optional features can be compiled into the daemon by passing
 options to the "configure" script. Most options can handle a <path> argument
 which will be used to search for the required libraries and header files in
 the given paths ("<path>/lib/...", "<path>/include/...") in addition to the
 standard locations.
 * Syslog Logging (autodetected by default):
  --with-syslog[=<path>] / --without-syslog
  Enable (disable) support for logging to "syslog", which should be
  available on most modern UNIX-like operating systems by default.
 * ZLib Compression (autodetected by default):
  --with-zlib[=<path>] / --without-zlib
  Enable (disable) support for compressed server-server links.
  The Z compression library ("libz") is required for this option.
 * IO Backend (autodetected by default):
  --with-select[=<path>] / --without-select
  --with-poll[=<path>] / --without-poll
  --with-devpoll[=<path>] / --without-devpoll
  --with-epoll[=<path>] / --without-epoll
  --with-kqueue[=<path>] / --without-kqueue
  ngIRCd can use different IO "backends": the "old school" select() and poll()
  API which should be supported by most UNIX-like operating systems, or the
  more efficient and flexible epoll() (Linux >=2.6), kqueue() (BSD) and
  /dev/poll APIs.
  By default the IO backend is autodetected, but you can use "--without-xxx"
  to disable a more enhanced API.
  When using the epoll() API, support for select() is compiled in as well by
  default to enable the binary to run on older Linux kernels (<2.6), too.
 * IDENT-Support:
  --with-ident[=<path>]
  Include support for IDENT ("AUTH") lookups. The "ident" library is
  required for this option.
 * TCP-Wrappers:
  --with-tcp-wrappers[=<path>]
  Include support for Wietse Venemas "TCP Wrappers" to limit client access
  to the daemon, for example by using "/etc/hosts.{allow|deny}".
  The "libwrap" is required for this option.
 * PAM:
  --with-pam[=<path>]
  Enable support for PAM, the Pluggable Authentication Modules library.
  See doc/PAM.txt for details.
 * SSL:
  --with-openssl[=<path>]
  --with-gnutls[=<path>]
  Enable support for SSL/TLS using OpenSSL or gnutls libraries.
  See doc/SSL.txt for details.
 * IPv6:
  --enable-ipv6
  Adds support for version 6 of the Internet Protocol.
 IV. Useful make-targets
 ~~~~~~~~~~~~~~~~~~~~~~~
 The Makefile produced by the configure-script contains always these useful
 targets:
 - clean: delete every product from the compiler/linker
   next step: -> make
 - distclean: the above plus erase all generated Makefiles
   next step: -> ./configure
 - maintainer-clean: erase all automatic generated files
   next step: -> ./autogen.sh
 V. Sample configuration file ngircd.conf
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 In the sample configuration file, there are comments beginning with "#" OR
 ";" -- this is only for the better understanding of the file.
 The file is separated in five blocks: [Global], [Features], [Operator],
 [Server], and [Channel].
 In the [Global] section, there is the main configuration like the server
 name and the ports, on which the server should be listening. Options in
 the [Features] section enable or disable functionality in the daemon.
 IRC operators of this server are defined in [Operator] blocks, remote
 servers are configured in [Server] sections, and [Channel] blocks are
 used to configure pre-defined ("persistent") IRC channels.
 The meaning of the variables in the configuration file is explained in the
 "doc/sample-ngircd.conf", which is used as sample configuration file in
 /usr/local/etc after running "make install" (if you don't already have one)
 and in the ngircd.conf(5) manual page.
 VI. Command line options
 ~~~~~~~~~~~~~~~~~~~~~~~~
 These parameters could be passed to the ngIRCd:
 -f, --config <file>
 	The daemon uses the file <file> as configuration file rather than
 	the standard configuration /usr/local/etc/ngircd.conf.
 -n, --nodaemon
 	ngIRCd should be running as a foreground process.
 -p, --passive
 	Server-links won't be automatically established.
 -t, --configtest
 	Reads, validates and dumps the configuration file as interpreted
 	by the server. Then exits.
 Use "--help" to see a short help text describing all available parameters
 the server understands, with "--version" the ngIRCd shows its version
 number. In both cases the server exits after the output.
 Please see the ngircd(8) manual page for complete details!
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -0,0 +1,411 @@
 # [ngIRCd](https://ngircd.barton.de) - Internet Relay Chat Server
 This document explains how to install ngIRCd, the lightweight Internet Relay
 Chat (IRC) server.
 The first section lists noteworthy changes to earlier releases; you definitely
 should read this when upgrading your setup! But you can skip over this section
 when you do a fresh installation.
 All the subsequent sections describe the steps required to install and
 configure ngIRCd.
 ## Upgrade Information
 Differences to version 25
 - **Attention**:
  All already deprecated legacy options (besides the newly deprecated *Key* and
  *MaxUsers* settings, see below) were removed in ngIRCd 26, so make sure to
  update your configuration before upgrading, if you haven't done so already
  (you got a warning on daemon startup when using deprecated options): you can
  check your configuration using `ngircd --configtest` -- which is a good idea
  anyway ;-)
 - Setting modes for predefined channels in *[Channel]* sections has been
  enhanced: now you can set *all* modes, like in IRC "MODE" commands, and have
  this setting multiple times per *[Channel]* block. Modifying lists (ban list,
  invite list, exception list) is supported, too.
  Both the *Key* and *MaxUsers* settings are now deprecated and should be
  replaced by `Modes = +l <limit>` and `Modes = +k <key>` respectively.
 Differences to version 22.x
 - The *NoticeAuth* `ngircd.conf` configuration variable has been renamed to
  *NoticeBeforeRegistration*. The old *NoticeAuth* variable still works but
  is deprecated now.
 - The default value of the SSL *CipherList* variable has been changed to
  "HIGH:!aNULL:@STRENGTH:!SSLv3" (OpenSSL) and "SECURE128:-VERS-SSL3.0"
  (GnuTLS) to disable the old SSLv3 protocol by default.
  To enable connections of clients still requiring the weak SSLv3 protocol,
  the *CipherList* must be set to its old value (not recommended!), which
  was "HIGH:!aNULL:@STRENGTH" (OpenSSL) and "SECURE128" (GnuTLS), see below.
 Differences to version 20.x
 - Starting with ngIRCd 21, the ciphers used by SSL are configurable and
  default to "HIGH:!aNULL:@STRENGTH" (OpenSSL) or "SECURE128" (GnuTLS).
  Previous version were using the OpenSSL or GnuTLS defaults, "DEFAULT"
  and "NORMAL" respectively.
 - When adding GLINE's or KLINE's to ngIRCd 21 (or newer), all clients matching
  the new mask will be KILL'ed. This was not the case with earlier versions
  that only added the mask but didn't kill already connected users.
 - The *PredefChannelsOnly* configuration variable has been superseded by the
  new *AllowedChannelTypes* variable. It is still supported and translated to
  the appropriate *AllowedChannelTypes* setting but is deprecated now.
 Differences to version 19.x
 - Starting with ngIRCd 20, users can "cloak" their hostname only when the
  configuration variable *CloakHostModeX* (introduced in 19.2) is set.
  Otherwise, only IRC operators, other servers, and services are allowed to
  set mode +x. This prevents regular users from changing their hostmask to
  the name of the IRC server itself, which confused quite a few people ;-)
 Differences to version 17.x
 - Support for ZeroConf/Bonjour/Rendezvous service registration has been
  removed. The configuration option *NoZeroconf* is no longer available.
 - The structure of `ngircd.conf` has been cleaned up and three new configuration
  sections have been introduced: *[Limits]*, *[Options]*, and *[SSL]*.
  Lots of configuration variables stored in the *[Global]* section are now
  deprecated there and should be stored in one of these new sections (but
  still work in *[Global]*):
  - *AllowRemoteOper*    -> [Options]
  - *ChrootDir*          -> [Options]
  - *ConnectIPv4*        -> [Options]
  - *ConnectIPv6*        -> [Options]
  - *ConnectRetry*       -> [Limits]
  - *MaxConnections*     -> [Limits]
  - *MaxConnectionsIP*   -> [Limits]
  - *MaxJoins*           -> [Limits]
  - *MaxNickLength*      -> [Limits]
  - *NoDNS*              -> [Options], and renamed to *DNS*
  - *NoIdent*            -> [Options], and renamed to *Ident*
  - *NoPAM*              -> [Options], and renamed to *PAM*
  - *OperCanUseMode*     -> [Options]
  - *OperServerMode*     -> [Options]
  - *PingTimeout*        -> [Limits]
  - *PongTimeout*        -> [Limits]
  - *PredefChannelsOnly* -> [Options]
  - *SSLCertFile*        -> [SSL], and renamed to *CertFile*
  - *SSLDHFile*          -> [SSL], and renamed to *DHFile*
  - *SSLKeyFile*         -> [SSL], and renamed to *KeyFile*
  - *SSLKeyFilePassword* -> [SSL], and renamed to *KeyFilePassword*
  - *SSLPorts*           -> [SSL], and renamed to *Ports*
  - *SyslogFacility*     -> [Options]
  - *WebircPassword*     -> [Options]
  You should adjust your `ngircd.conf` and run `ngircd --configtest` to make
  sure that your settings are correct and up to date!
 Differences to version 16.x
 - Changes to the *MotdFile* specified in `ngircd.conf` now require a ngIRCd
  configuration reload to take effect (HUP signal, *REHASH* command).
 Differences to version 0.9.x
 - The option of the configure script to enable support for Zeroconf/Bonjour/
  Rendezvous/WhateverItIsNamedToday has been renamed:
  - `--with-rendezvous`  ->  `--with-zeroconf`
 Differences to version 0.8.x
 - The maximum length of passwords has been raised to 20 characters (instead
  of 8 characters). If your passwords are longer than 8 characters then they
  are cut at an other position now.
 Differences to version 0.6.x
 - Some options of the configure script have been renamed:
  - `--disable-syslog`  ->  `--without-syslog`
  - `--disable-zlib`    ->  `--without-zlib`
  Please call `./configure --help` to review the full list of options!
 Differences to version 0.5.x
 - Starting with version 0.6.0, other servers are identified using asynchronous
  passwords: therefore the variable *Password* in *[Server]*-sections has been
  replaced by *MyPassword* and *PeerPassword*.
 - New configuration variables, section *[Global]*: *MaxConnections*, *MaxJoins*
  (see example configuration file `doc/sample-ngircd.conf`!).
 ## Standard Installation
 *Note*: This sections describes installing ngIRCd *from sources*. If you use
 packages available for your operating system distribution you should skip over
 and continue with the *Configuration* section, see below.
 ngIRCd is developed for UNIX-based systems, which means that the installation
 on modern UNIX-like systems that are supported by GNU autoconf and GNU
 automake ("`configure` script") should be no problem.
 The normal installation procedure after getting (and expanding) the source
 files (using a distribution archive or Git) is as following:
 1) Satisfy prerequisites
 2) `./autogen.sh` [only necessary when using "raw" sources with Git]
 3) `./configure`
 4) `make`
 5) `make install`
 (Please see details below!)
 Now the newly compiled executable "ngircd" is installed in its standard
 location, `/usr/local/sbin/`.
 If no previous version of the configuration file exists (the standard name
 is `/usr/local/etc/ngircd.conf)`, a sample configuration file containing all
 possible options will be installed there. You'll find its template in the
 `doc/` directory: `sample-ngircd.conf`.
 The next step is to configure and afterwards start the daemon. See the section
 *Configuration* below.
 ### Satisfy prerequisites
 When building from source, you'll need some other software to build ngIRCd:
 for example a working C compiler, make tool, and a few libraries depending on
 the feature set you want to enable at compile time (like IDENT, SSL, and PAM).
 And if you aren't using a distribution archive ("tar.gz" file), but cloned the
 plain source archive, you need a few additional tools to generate the build
 system itself: GNU automake and autoconf, as well as pkg-config.
 If you are using one of the "big" operating systems or Linux distributions,
 you can use the following commands to install all the required packages to
 build the sources including all optional features and to run the test suite:
 #### Red Hat / Fedora based distributions
 ``` shell
  yum install \
    autoconf automake expect gcc glibc-devel gnutls-devel \
    libident-devel make pam-devel pkg-config tcp_wrappers-devel \
    telnet zlib-devel
 ```
 #### Debian / Ubuntu based distributions
 ``` shell
  apt-get install \
    autoconf automake build-essential expect libgnutls28-dev \
    libident-dev libpam-dev pkg-config libwrap0-dev libz-dev telnet
 ```
 ### `./autogen.sh`
 The first step, to run `./autogen.sh`, is *only* necessary if the `configure`
 script itself isn't already generated and available. This never happens in
 official ("stable") releases in "tar.gz" archives, but when cloning the source
 code repository using Git.
 **This step is therefore only interesting for developers!**
 The `autogen.sh` script produces the `Makefile.in`'s, which are necessary for
 the configure script itself, and some more files for `make(1)`.
 To run `autogen.sh` you'll need GNU autoconf, GNU automake and pkg-config: at
 least autoconf 2.61 and automake 1.10 are required, newer is better. But don't
 use automake 1.12 or newer for creating distribution archives: it will work
 but lack "de-ANSI-fication" support in the generated Makefile's! Stick with
 automake 1.11.x for this purpose ...
 So *automake 1.11.x* and *autoconf 2.67+* is recommended.
 Again: "end users" do not need this step and neither need GNU autoconf nor GNU
 automake at all!
 ### `./configure`
 The `configure` script is used to detect local system dependencies.
 In the perfect case, `configure` should recognize all needed libraries, header
 files and so on. If this shouldn't work, `./configure --help` shows all
 possible options.
 In addition, you can pass some command line options to `configure` to enable
 and/or disable some features of ngIRCd. All these options are shown using
 `./configure --help`, too.
 Compiling a static binary will avoid you the hassle of feeding a chroot dir
 (if you want use the chroot feature). Just do something like:
 ``` shell
  CFLAGS=-static ./configure [--your-options ...]
 ```
 Then you can use a void directory as ChrootDir (like OpenSSH's `/var/empty`).
 ### `make`
 The `make(1)` command uses the `Makefile`'s produced by `configure` and
 compiles the ngIRCd daemon.
 ### `make install`
 Use `make install` to install the server and a sample configuration file on
 the local system. Normally, root privileges are necessary to complete this
 step. If there is already an older configuration file present, it won't be
 overwritten.
 These files and folders will be installed by default:
 - `/usr/local/sbin/ngircd`: executable server
 - `/usr/local/etc/ngircd.conf`: sample configuration (if not already present)
 - `/usr/local/share/doc/ngircd/`: documentation
 - `/usr/local/share/man/`: manual pages
 ### Additional features
 The following optional features can be compiled into the daemon by passing
 options to the `configure` script. Most options can handle a `<path>` argument
 which will be used to search for the required libraries and header files in
 the given paths (`<path>/lib/...`, `<path>/include/...`) in addition to the
 standard locations.
 - Syslog Logging (autodetected by default):
  `--with-syslog[=<path>]` / `--without-syslog`
  Enable (disable) support for logging to "syslog", which should be
  available on most modern UNIX-like operating systems by default.
 - ZLib Compression (autodetected by default):
  `--with-zlib[=<path>]` / `--without-zlib`
  Enable (disable) support for compressed server-server links.
  The Z compression library ("libz") is required for this option.
 - IO Backend (autodetected by default):
  - `--with-select[=<path>]` / `--without-select`
  - `--with-poll[=<path>]` / `--without-poll`
  - `--with-devpoll[=<path>]` / `--without-devpoll`
  - `--with-epoll[=<path>]` / `--without-epoll`
  - `--with-kqueue[=<path>]` / `--without-kqueue`
  ngIRCd can use different IO "backends": the "old school" `select(2)` and
  `poll(2)` API which should be supported by most UNIX-like operating systems,
  or the more efficient and flexible `epoll(7)` (Linux >=2.6), `kqueue(2)`
  (BSD) and `/dev/poll` APIs.
  By default the IO backend is autodetected, but you can use `--without-xxx`
  to disable a more enhanced API.
  When using the `epoll(7)` API, support for `select(2)` is compiled in as
  well by default, to enable the binary to run on older Linux kernels (<2.6),
  too.
 - IDENT-Support:
  `--with-ident[=<path>]`
  Include support for IDENT ("AUTH") lookups. The "ident" library is
  required for this option.
 - TCP-Wrappers:
  `--with-tcp-wrappers[=<path>]`
  Include support for Wietse Venemas "TCP Wrappers" to limit client access
  to the daemon, for example by using `/etc/hosts.{allow|deny}`.
  The "libwrap" is required for this option.
 - PAM:
  `--with-pam[=<path>]`
  Enable support for PAM, the Pluggable Authentication Modules library.
  See `doc/PAM.txt` for details.
 - SSL:
  - `--with-openssl[=<path>]`
  - `--with-gnutls[=<path>]`
  Enable support for SSL/TLS using OpenSSL or GnuTLS libraries.
  See `doc/SSL.txt` for details.
 - IPv6:
  `--enable-ipv6`
  Adds support for version 6 of the Internet Protocol.
 ## Configuration
 Please have a look at the `ngircd(8)` and `ngircd.conf(5)` manual pages for
 details and all possible command line and configuration options -- **and don't
 forget to run `ngircd --configtest` to validate your configuration file!**
 After installing ngIRCd, a sample configuration file will be set up (if it
 does not exist already). By default, when installing from sources, the file is
 named `/usr/local/etc/ngircd.conf` (other common names, especially for
 distribution packages, are `/etc/ngircd.conf` or `/etc/ngircd/ngircd.conf`).
 You can find the template of the sample configuration file in the `doc/`
 directory as `sample-ngircd.conf` and
 [online](https://ngircd.barton.de/doc/sample-ngircd.conf) on the homepage. It
 contains all available options.
 In the sample configuration file, there are comments beginning with `#` *or*
 `;` -- this is only for the better understanding of the file, both comment
 styles are equal.
 The file is separated in five blocks: *[Global]*, *[Features]*, *[Operator]*,
 *[Server]*, and *[Channel]*.
 In the *[Global]* section, there is the main configuration like the server
 name and the ports, on which the server should be listening. Options in
 the *[Features]* section enable or disable functionality in the daemon.
 IRC operators of this server are defined in *[Operator]* blocks, remote
 servers are configured in *[Server]* sections, and *[Channel]* blocks are
 used to configure pre-defined ("persistent") IRC channels.
 ### Manual Pages Online
 - Daemon: [ngircd.8](https://manpages.debian.org/ngircd.8)
 - Configutation file: [ngircd.conf.5](https://manpages.debian.org/ngircd.conf.5)
 ## Command line options
 ngIRCd supports the following command line options:
 - `-f`, `--config <file>`
  The daemon uses the file `<file>` as configuration file rather than
  the standard configuration `/usr/local/etc/ngircd.conf`.
 - `-n`, `--nodaemon`
  ngIRCd should be running as a foreground process.
 - `-p`, `--passive`
  Server-links won't be automatically established.
 - `-t`, `--configtest`
  Reads, validates and dumps the configuration file as interpreted
  by the server. Then exits.
 Use `--help` to see a short help text describing all available parameters
 the server understands, with `--version` the ngIRCd shows its version
 number. In both cases the server exits after the output.
 Please see the `ngircd(8)` manual page for more details!
--- a/Makefile.am
+++ b/Makefile.am
@@ -9,11 +9,9 @@
 # Please read the file COPYING, README and AUTHORS for more information.
 #
 AUTOMAKE_OPTIONS = gnu
 SUBDIRS = doc src man contrib
-EXTRA_DIST = autogen.sh configure.ng .clang_complete .mailmap
+EXTRA_DIST = README.md INSTALL.md autogen.sh configure.ng .clang_complete .mailmap
 clean-local: osxpkg-clean
 	rm -f build-stamp*
@@ -25,13 +23,13 @@ maintainer-clean-local:
 	rm -f config.log debian
 testsuite:
-	cd src/testsuite && make check
+	cd src/testsuite && ${MAKE} check
 lint:
-	cd src/ngircd && make lint
+	cd src/ngircd && ${MAKE} lint
 srcdoc:
-	cd doc && make srcdoc
+	cd doc && ${MAKE} srcdoc
 have-xcodebuild:
 	@xcodebuild -project contrib/MacOSX/ngIRCd.xcodeproj -list \
@@ -66,7 +64,7 @@ osxpkg: have-packagemaker osxpkg-dest
 	 --out ../../$(distdir).mpkg
 	rm -f $(distdir).mpkg.zip
 	zip -ro9 $(distdir).mpkg.zip $(distdir).mpkg
-	make osxpkg-clean
+	${MAKE} osxpkg-clean
 osxpkg-clean:
 	[ ! -r ngircd.dest ] || sudo -n rm -rf ngircd.dest
@@ -74,12 +72,12 @@ osxpkg-clean:
 osxpkg-dest: have-xcodebuild osxpkg-clean clean
 	./configure --prefix=/opt/ngircd
-	make xcode
+	${MAKE} xcode
-	make -C contrib/MacOSX de.barton.ngircd.plist
+	${MAKE} -C contrib/MacOSX de.barton.ngircd.plist
 	mkdir -p ngircd.dest/opt/ngircd/sbin
-	DESTDIR="$$PWD/ngircd.dest" make -C doc install
+	DESTDIR="$$PWD/ngircd.dest" ${MAKE} -C doc install
-	DESTDIR="$$PWD/ngircd.dest" make -C contrib install
+	DESTDIR="$$PWD/ngircd.dest" ${MAKE} -C contrib install
-	DESTDIR="$$PWD/ngircd.dest" make -C man install
+	DESTDIR="$$PWD/ngircd.dest" ${MAKE} -C man install
 	cp contrib/MacOSX/build/Default/ngIRCd \
 	 ngircd.dest/opt/ngircd/sbin/ngircd
 	rm ngircd.dest/opt/ngircd/etc/ngircd.conf
--- a/139
+++ b/139
@@ -2,12 +2,147 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-               (c)2001-2015 Alexander Barton and Contributors.
+               (c)2001-2020 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
                                  -- NEWS --
 ngIRCd 26
  ngIRCd 26~rc1 (2020-05-10)
  - Allow up to 512 characters per line in MOTD and help text files (but keep
    in mind that lines can't get that long, because they have to be prefixed
    before being sent to the client). But this allows for more fancy MOTDs :-)
    Closes #271.
  - Show the actually allowed channel types in the ISUPPORT(005) numeric which
    are configured by the "AllowedChannelTypes" configuration variable.
    Closes #273.
  - Handle commands in the read buffer before reading more data and don't wait
    for the network in this case: If there are more bytes in the read buffer
    already than a single valid IRC command can get long (513 bytes), wait for
    this/those command(s) to be handled first and don't try to read even more
    data from the network (which most probably would overflow the read buffer
    of this connection soon).
  - Log G-/K-Line changes only when not initiated by a server: this prevents
    the log from becomming spammed during "net bursts".
  - Update test suite to include SSL tests, including checking for reloading
    certificates during runtime.
  - Add support for GnuTLS certificate reload, which is quite handy when using
    Let's Encrypt, for example. Until now this was only supported when linked
    with OpenSSL. Thanks a lot, Hilko Bengen <bengen@hilluzination.de>!
  - Allow setting arbitrary channel modes in the configuration file by handling
    them like in MODE commands, and allow multiple "Modes =" lines per [Channel]
    section. Thanks to Michi <michi+ngircd@dataswamp.org>!
    Closes #55.
  - Add "FNC" (forced nick changes) to ISUPPORT(005) numeric. Most probably
    this doesn't make any difference to any client, but it seems correct.
    See <http://www.irc.org/tech_docs/005.html> for details.
  - Enhance handling of command line errors, and return with exit code 0 ("no
    error") when "--help" or "--version" is used (which resulted in exit code 1,
    "error" before). Exit with code 2 ("command line error") for all other
    invalid command line options, and show the error message itself on stderr
    (instead of stdout and exit code 1, "generic error", as before).
    This new behaviour is more in line with the GNU "coding standards",
    see <https://www.gnu.org/prep/standards/html_node/_002d_002dhelp.html>.
  - Add ./contrib/nglog.sh: This script parses the log output of ngircd(8),
    and colorizes the messages according to their log level. Example usage:
    ngircd -f $PWD/doc/sample-ngircd.conf -np | ./contrib/nglog.sh
  - Enlarge buffers of info texts to 128 bytes. This includes:
    - "Real name" of a client (4th filed of the USER command).
    - Server info text ("Info" configuration option).
    - Admin info texts and email address ("AdminInfo1", "AdminInfo2" and
      "AdminEmail" configuration options).
    - Network name ("Network" configuration option).
    The limit was 64 bytes before ...
    Closes #258.
  - Streamline handling of invalid and unset server name: Don't exit during
    runtime (REHASH command, HUP signal), because the server name can't be
    changed in this case anyway and the new invalid name will be ignored.
  - Slightly reorder startup steps, and enhance logging:
    - Show name of configuration file at the beginning of start up.
    - Add a message when ngIRCd is ready, including its host name.
    - Show name of configuration file on REHASH (SIGHUP), too.
    - Change level of "done message" to NOTICE, like "starting" & "ready".
    - Initialize IO functions before channels, connections, clients, ...
  - configure.ng: OpenSSL can depends on lz or latomic so use pkg-config to
    find those dependencies and fallback to existing mechanism.
    Closes #256.
 ngIRCd 25 (2019-01-23)
  - Implement new configuration option "MaxPenaltyTime", which configures the
    maximum penalty time increase in seconds, per penalty event. Set to -1 for
    no limit (the default), 0 to disable penalties altogether. ngIRCd doesn't
    use penalty increases higher than 2 seconds during normal operation, so
    values higher than 1 rarely make sense.
    Disabling (or reducing) penalties can greatly speed up "make check" runs
    for example, see below, but are mostly a debugging feature and normally
    not meant to be used on production systems!
    Some example timings running "make check" from my macOS workstation:
     - MaxPenaltyTime not set: 4:41,79s
     - "MaxPenaltyTime = 1":   3:14,71s
     - "MaxPenaltyTime = 0":     25,46s
    Closes #249 and #251.
  - Update Xcode project for latest Xcode version (10.0)
  - Allow a 5th parameter in WEBIRC. Thanks to "ItsOnlyBinary".
    Closes #247.
  ngIRCd 25~rc1 (2018-08-11)
  - Only send TOPIC updates to a channel when the topic actually changed:
    This prevents the channel from becoming flooded by unecessary TOPIC update
    messages, that can happen when IRC services try to enforce a certain topic
    but which is already set (at least on the local server), for example.
    Therefore still forward it to all servers, but don't inform local clients
    (still update setter and timestamp information, though!).
  - Update Xcode project for latest Xcode version (9.2). This includes adding
    missing and deleting obsolete file references.
  - Handle user mode "C" ("Only users that share a channel are allowed to send
    messages") like user mode "b" ("block private messages and notices"): allow
    messages from servers, services, and IRC Operators, too. Change proposed by
    "wowaname" back in 2015 in #ngircd, thanks!
  - Allow IRC Ops and remote servers to KILL service clients: such clients
    behave like regular users, therefore IRC operators and servers should be
    able to KILL them: for example to resolve nick collisions.
    Closes #242.
 ngIRCd 24 (2017-01-20)
  ngIRCd 24~rc1 (2017-01-07)
  - Log privilege violations and failed OPER request with log level "error"
    and send it to the "&SERVER" channel, too.
  - Immediately shut down connection when receiving an "ERROR" command,
    don't wait for the peer to close the connection. This allows the daemon
    to forward the received "ERROR" message in the network, instead of the
    very generic "client closed connection" message.
  - Explicitly forbid remote servers to modify "x-lines" (G-LINES) when the
    "AllowRemoteOper" configuration option isn't set, even when the command
    seems to originate from the remote server itself: this prevents GLINE's
    to become set during server handshake in this case (what wouldn't be
    possible during regular runtime when a remote IRC Op sends the command)
    and what can't be undone by IRC Ops later on (because of the missing
    "AllowRemoteOper" option) ...
  - Update Xcode project for latest Xcode version (8.0), and fix "duplicate
    symbols" error messages when building (linking) the binary.
  - Add "Documentation" variables to systemd configuration files.
  - Make sure that SYSCONFDIR is always set, which can be handy when
    using source code linters when ./configure hasn't been run already.
  - Add the new "PAMServiceName" configuration option to specify the name
    used as PAM service name. This setting allows to run multiple ngIRCd
    instances with different PAM configurations for each instance.
    Thanks to Christian Aistleitner <christian@quelltextlich.at> for the
    patch, closes #226.
  - Add an ".editorconfig" file to the project.
  - Limit the number of message target, and suppress duplicates: This
    prevents an user from flooding the server using commands like this:
    "PRIVMSG nick1,nick1,nick1,...".
    Duplicate targets are suppressed silently (channels and clients).
    In addition, the maximum number of targets per PRIVMSG, NOTICE, ...
    command are limited to MAX_HNDL_TARGETS (25). If there are more, the
    daemon sends the new 407 (ERR_TOOMANYTARGETS_MSG) numeric, containing
    the first target that hasn't been handled any more. Closes #187.
  - Make contrib/platformtest.sh script more portable, and only show
    "runs=Y" when the test suite really has been passed successfully.
 ngIRCd 23 (2015-11-16)
@@ -223,7 +358,7 @@ ngIRCd 20.2 (2013-02-15)
  - This release is a bugfix release only, without new features.
  - Security: Fix a denial of service bug in the function handling KICK
-    commands that could be used by arbitrary users to to crash the daemon
+    commands that could be used by arbitrary users to crash the daemon
    (CVE-2013-1747).
 ngIRCd 20.1 (2013-01-02)
--- a/93
+++ b/93
@@ -1,93 +0,0 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
               (c)2001-2015 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
                                -- README --
 I. Introduction
 ~~~~~~~~~~~~~~~
 ngIRCd is a free, portable and lightweight Internet Relay Chat server for
 small or private networks, developed under the GNU General Public License
 (GPL; please see the file COPYING for details). It is simple to configure,
 can cope with dynamic IP addresses, and supports IPv6 as well as SSL. It is
 written from scratch and not based on the original IRCd.
 The name ngIRCd means next generation IRC daemon, which is a little bit
 exaggerated: lightweight Internet Relay Chat server most probably would be a
 better name :-)
 Please see the INSTALL document for installation and upgrade information!
 II. Status
 ~~~~~~~~~~~
 It is not the goal of ngIRCd to implement all the nasty behaviors of the
 original ircd, but to implement most of the useful commands and semantics
 specified by the RFCs.
 In the meantime ngIRCd should be quite feature complete and stable to be
 used in real IRC networks.
 Implemented IRC-commands are:
 ADMIN, AWAY, CHANINFO, CONNECT, DIE, DISCONNECT, ERROR, GLINE, HELP, INFO,
 INVITE, ISON, JOIN, KICK, KILL, KLINE, LINKS, LIST, LUSERS, MODE, MOTD,
 NAMES, NICK, NJOIN, NOTICE, OPER, PART, PASS, PING, PONG, PRIVMSG, QUIT,
 REHASH, RESTART, SERVER, SERVICE, SERVLIST, SQUERY, SQUIT, STATS, SUMMON,
 TIME, TOPIC, TRACE, USER, USERHOST, USERS, VERSION, WALLOPS, WEBIRC, WHO,
 WHOIS, WHOWAS.
 III. Features (or: why use ngIRCd?)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 - well arranged (lean) configuration file
 - simple to build/install, configure and maintain
 - supports IPv6 and SSL
 - no problems with servers that have dynamic IP addresses
 - freely available, modern, portable and tidy C-source
 - wide field of supported platforms, including AIX, A/UX, FreeBSD, HP-UX,
  IRIX, Linux, Mac OS X, NetBSD, OpenBSD, Solaris, and Windows with Cygwin.
 - ngIRCd is being actively developed since 2001.
 IV. Documentation
 ~~~~~~~~~~~~~~~~~
 More documentation can be found in the "doc/" directory and the homepage of
 the ngIRCd: <http://ngircd.barton.de/>.
 V. Download
 ~~~~~~~~~~~
 The homepage of the ngIRCd is: <http://ngircd.barton.de/>; you will find
 the newest information about the ngIRCd and the most recent ("stable")
 releases there.
 If you are interested in the latest development versions (which are not
 always stable), then please read the section about "GIT" on the homepage and
 the file "doc/GIT.txt" which describes the use of GIT, the version control
 system used by ngIRCd (homepage: <http://git-scm.com/>).
 VI. Bugs
 ~~~~~~~~
 If you find bugs in the ngIRCd (which might be there :-), please report
 them at the following URL:
 <https://github.com/ngircd/ngircd/issues>
 There you can read about known bugs and limitations, too.
 If you have comments, patches or something else, please feel free to post
 a mail to the ngIRCd mailing list: <ngircd-ml@ngircd.barton.de> (please see
 <http://ngircd.barton.de/support.php> for details) or join the ngIRCd IRC
 channel: <irc://irc.barton.de/ngircd>.
--- a/README.md
+++ b/README.md
@@ -0,0 +1,76 @@
 # [ngIRCd](https://ngircd.barton.de) - Internet Relay Chat Server
 ## Introduction
 *ngIRCd* is a free, portable and lightweight *Internet Relay Chat* ([IRC])
 server for small or private networks, developed under the terms of the GNU
 General Public License ([GPL]); please see the file `COPYING` for licensing
 information.
 The server is simple to configure, can cope with dynamic IP addresses, and
 supports IPv6 as well as SSL. It is written from scratch and not based on the
 original IRCd.
 The name ngIRCd means *next generation IRC daemon*, which is a little bit
 exaggerated: *lightweight Internet Relay Chat server* most probably would have
 been a better name :-)
 Please see the `INSTALL.md` document for installation and upgrade information,
 online available here: <https://ngircd.barton.de/doc/INSTALL.md>!
 ## Status
 ngIRCd should be quite feature complete and stable to be used as daemon in
 real world IRC networks.
 It is not the goal of ngIRCd to implement all the nasty behaviors of the
 original ircd, but to implement most of the useful commands and semantics
 specified by the RFCs that are used by existing clients.
 ## Features (or: why use ngIRCd?)
 - Well arranged (lean) configuration file.
 - Simple to build, install, configure, and maintain.
 - Supports IPv6 and SSL.
 - Can use PAM for user authentication.
 - Lots of popular user and channel modes are implemented.
 - Supports "cloaking" of users.
 - No problems with servers that have dynamic IP addresses.
 - Freely available, modern, portable and tidy C source.
 - Wide field of supported platforms, including AIX, A/UX, FreeBSD, HP-UX,
  IRIX, Linux, macOS, NetBSD, OpenBSD, Solaris, and Windows with Cygwin.
 - ngIRCd is being actively developed since 2001.
 ## Documentation
 The **homepage** of the ngIRCd project is <https://ngircd.barton.de>.
 More documentation can be found in the `doc/` directory and
 [online](https://ngircd.barton.de/documentation).
 ## Downloads & Source Code
 You can find the latest information about the ngIRCd and the most recent
 stable release on the [news](https://ngircd.barton.de/news) and
 [downloads](https://ngircd.barton.de/download) pages of the homepage.
 Visit our source code repository at [GitHub](https://github.com) if you are
 interested in the latest development code: <https://github.com/ngircd/ngircd>.
 ## Problems, Bugs, Patches
 Please don't hesitate to contact us if you encounter problems:
 - On IRC: <irc://irc.barton.de/ngircd>
 - Via the mailing list: <ngircd-ml@ngircd.barton.de>
 See <http://ngircd.barton.de/support> for details.
 If you find any bugs in ngIRCd (which most probably will be there ...), please
 report them to our issue tracker at GitHub:
 - Bug tracker: <https://github.com/ngircd/ngircd/issues>
 - Patches, "pull requests": <https://github.com/ngircd/ngircd/pulls>
 [IRC]: https://wikipedia.org/wiki/Internet_Relay_Chat
 [GPL]: https://wikipedia.org/wiki/GNU_General_Public_License
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2013 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -95,7 +95,7 @@ Search()
 				return 0
 			fi
 		done
-		minor=`expr $minor - 1`
+		minor=$(expr $minor - 1)
 	done
 	return 1
 }
@@ -103,7 +103,8 @@ Search()
 Notfound()
 {
 	echo "Error: $* not found!"
-	echo "Please install recent versions of GNU autoconf and GNU automake."
+	echo 'Please install supported versions of GNU autoconf, GNU automake'
 	echo 'and pkg-config: see the INSTALL file for details.'
 	exit 1
 }
@@ -139,42 +140,43 @@ fi
 # Try to detect the needed tools when no environment variable already
 # specifies one:
 echo "Searching for required tools ..."
-[ -z "$ACLOCAL" ] && ACLOCAL=`Search aclocal 1`
+[ -z "$ACLOCAL" ] && ACLOCAL=$(Search aclocal 1)
 [ "$VERBOSE" = "1" ] && echo " - ACLOCAL=$ACLOCAL"
-[ -z "$AUTOHEADER" ] && AUTOHEADER=`Search autoheader 2`
+[ -z "$AUTOHEADER" ] && AUTOHEADER=$(Search autoheader 2)
 [ "$VERBOSE" = "1" ] && echo " - AUTOHEADER=$AUTOHEADER"
-[ -z "$AUTOMAKE" ] && AUTOMAKE=`Search automake 1`
+[ -z "$AUTOMAKE" ] && AUTOMAKE=$(Search automake 1)
 [ "$VERBOSE" = "1" ] && echo " - AUTOMAKE=$AUTOMAKE"
-[ -z "$AUTOCONF" ] && AUTOCONF=`Search autoconf 2`
+[ -z "$AUTOCONF" ] && AUTOCONF=$(Search autoconf 2)
 [ "$VERBOSE" = "1" ] && echo " - AUTOCONF=$AUTOCONF"
-AUTOCONF_VERSION=`echo $AUTOCONF | cut -d'-' -f2-`
+AUTOCONF_VERSION=$(echo "$AUTOCONF" | cut -d'-' -f2-)
-[ -n "$AUTOCONF_VERSION" -a "$AUTOCONF_VERSION" != "autoconf" ] \
+[ -n "$AUTOCONF_VERSION" ] && [ "$AUTOCONF_VERSION" != "autoconf" ] \
 	&& export AUTOCONF_VERSION || unset AUTOCONF_VERSION
 [ "$VERBOSE" = "1" ] && echo " - AUTOCONF_VERSION=$AUTOCONF_VERSION"
-AUTOMAKE_VERSION=`echo $AUTOMAKE | cut -d'-' -f2-`
+AUTOMAKE_VERSION=$(echo $AUTOMAKE | cut -d'-' -f2-)
-[ -n "$AUTOMAKE_VERSION" -a "$AUTOMAKE_VERSION" != "automake" ] \
+[ -n "$AUTOMAKE_VERSION" ] && [ "$AUTOMAKE_VERSION" != "automake" ] \
 	&& export AUTOMAKE_VERSION || unset AUTOMAKE_VERSION
 [ "$VERBOSE" = "1" ] && echo " - AUTOMAKE_VERSION=$AUTOMAKE_VERSION"
 [ $# -gt 0 ] && CONFIGURE_ARGS=" $*" || CONFIGURE_ARGS=""
-[ -z "$GO" -a -n "$CONFIGURE_ARGS" ] && GO=1
+[ -z "$GO" ] && [ -n "$CONFIGURE_ARGS" ] && GO=1
 # Verify that all tools have been found
 command -v pkg-config >/dev/null || Notfound pkg-config
 [ -z "$ACLOCAL" ] && Notfound aclocal
 [ -z "$AUTOHEADER" ] && Notfound autoheader
 [ -z "$AUTOMAKE" ] && Notfound automake
 [ -z "$AUTOCONF" ] && Notfound autoconf
-AM_VERSION=`$AUTOMAKE --version | head -n 1 | sed -e 's/.* //g'`
+AM_VERSION=$($AUTOMAKE --version | head -n 1 | sed -e 's/.* //g')
 ifs=$IFS; IFS="."; set $AM_VERSION; IFS=$ifs
-AM_MAJOR="$1"; AM_MINOR="$2"; AM_PATCHLEVEL="$3"
+AM_MAJOR="$1"; AM_MINOR="$2"
 echo "Detected automake $AM_VERSION ..."
 AM_MAKEFILES="src/ipaddr/Makefile.ng src/ngircd/Makefile.ng src/testsuite/Makefile.ng src/tool/Makefile.ng"
 # De-ANSI-fication?
-if [ "$AM_MAJOR" -eq "1" -a "$AM_MINOR" -lt "12" ]; then
+if [ "$AM_MAJOR" -eq "1" ] && [ "$AM_MINOR" -lt "12" ]; then
 	# automake < 1.12 => automatic de-ANSI-fication support available
 	echo " - Enabling de-ANSI-fication support."
 	sed -e "s|^__ng_PROTOTYPES__|AM_C_PROTOTYPES|g" configure.ng >configure.ac
@@ -188,19 +190,20 @@ else
 	DEANSI_END=" (disabled by ./autogen.sh script)"
 fi
 # Serial test harness?
-if [ "$AM_MAJOR" -eq "1" -a "$AM_MINOR" -ge "13" ]; then
+if [ "$AM_MAJOR" -eq "1" ] && [ "$AM_MINOR" -ge "13" ]; then
 	# automake >= 1.13 => enforce "serial test harness"
 	echo " - Enforcing serial test harness."
 	SERIAL_TESTS="serial-tests"
 else
 	# automake < 1.13 => no new test harness, nothing to do
 	# shellcheck disable=SC2034
 	SERIAL_TEST=""
 fi
 sed -e "s|^__ng_Makefile_am_template__|AUTOMAKE_OPTIONS = ${SERIAL_TESTS} ${DEANSI_START}ansi2knr${DEANSI_END}|g" \
 	src/portab/Makefile.ng >src/portab/Makefile.am
 for makefile_ng in $AM_MAKEFILES; do
-	makefile_am=`echo "$makefile_ng" | sed -e "s|\.ng\$|\.am|g"`
+	makefile_am=$(echo "$makefile_ng" | sed -e "s|\.ng\$|\.am|g")
 	sed -e "s|^__ng_Makefile_am_template__|AUTOMAKE_OPTIONS = ${SERIAL_TESTS} ${DEANSI_START}../portab/ansi2knr${DEANSI_END}|g" \
 		$makefile_ng >$makefile_am
 done
@@ -214,10 +217,10 @@ Run $ACLOCAL && \
 	Run $AUTOHEADER && \
 	Run $AUTOMAKE --add-missing --no-force
-if [ $? -eq 0 -a -x ./configure ]; then
+if [ $? -eq 0 ] && [ -x ./configure ]; then
 	# Success: if we got some parameters we call ./configure and pass
 	# all of them to it.
-	NAME=`grep PACKAGE_STRING= configure | cut -d"'" -f2`
+	NAME=$(grep PACKAGE_STRING= configure | cut -d"'" -f2)
 	if [ "$GO" = "1" ]; then
 		[ -n "$PREFIX" ] && p=" --prefix=$PREFIX" || p=""
 		c="./configure${p}${CONFIGURE_ARGS}"
--- a/config.guess
+++ b/config.guess
--- a/config.sub
+++ b/config.sub
--- a/configure.ng
+++ b/configure.ng
@@ -29,7 +29,7 @@ AC_CONFIG_SRCDIR([src/ngircd/ngircd.c])
 AC_CONFIG_HEADER([src/config.h])
 AC_CANONICAL_HOST
-AM_INIT_AUTOMAKE([-Wall 1.10 ]ng_color_tests)
+AM_INIT_AUTOMAKE([-Wall 1.10 foreign ]ng_color_tests)
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
@@ -154,15 +154,30 @@ AC_HEADER_TIME
 # Required header files
 AC_CHECK_HEADERS([ \
-	fcntl.h netdb.h netinet/in.h stdlib.h string.h \
+		fcntl.h \
-	strings.h sys/socket.h sys/time.h sys/types.h unistd.h \
+		netdb.h \
 		netinet/in.h \
 		stdlib.h \
 		string.h \
 		strings.h \
 		sys/socket.h \
 		sys/time.h \
 		sys/types.h \
 		unistd.h \
 	],,AC_MSG_ERROR([required C header missing!]))
 # Optional header files
 AC_CHECK_HEADERS_ONCE([ \
-	arpa/inet.h inttypes.h malloc.h netinet/in_systm.h netinet/ip.h \
+	arpa/inet.h \
-	stdbool.h stddef.h stdint.h varargs.h \
+	inttypes.h \
-	])
+	malloc.h \
 	netinet/in_systm.h \
 	netinet/ip.h \
 	stdbool.h \
 	stddef.h \
 	stdint.h \
 	varargs.h \
 ])
 # -- Datatypes --
@@ -212,17 +227,50 @@ AC_FUNC_STRFTIME
 # Required functions
 AC_CHECK_FUNCS([ \
-	alarm dup2 endpwent gethostbyaddr gethostbyname gethostname \
+		alarm \
-	gettimeofday inet_ntoa memmove memset setsid socket strcasecmp \
+		dup2 \
-	strchr strcspn strerror strncasecmp strrchr strspn strstr \
+		endpwent \
 		gethostbyaddr \
 		gethostbyname \
 		gethostname \
 		gettimeofday \
 		inet_ntoa \
 		memmove \
 		memset \
 		setsid \
 		socket \
 		strcasecmp \
 		strchr \
 		strcspn \
 		strerror \
 		strncasecmp \
 		strrchr \
 		strspn \
 		strstr \
 	],,
 	AC_MSG_ERROR([required function missing!]))
 # Optional functions
 AC_CHECK_FUNCS_ONCE([
-	arc4random arc4random_stir gai_strerror getnameinfo inet_aton \
+	arc4random \
-	setgroups sigaction sigprocmask snprintf strdup strlcat strlcpy \
+	arc4random_stir \
-	strndup strtok_r unsetenv vsnprintf waitpid])
+	gai_strerror \
 	getnameinfo \
 	inet_aton \
 	setgroups \
 	sigaction \
 	sigprocmask \
 	snprintf \
 	strdup \
 	strlcat \
 	strlcpy \
 	strndup \
 	strsignal \
 	strtok_r \
 	unsetenv \
 	vsnprintf \
 	waitpid \
 ])
 WORKING_GETADDRINFO
@@ -417,9 +465,13 @@ AC_ARG_WITH(openssl,
 				CPPFLAGS="-I$withval/include $CPPFLAGS"
 				LDFLAGS="-L$withval/lib $LDFLAGS"
 			fi
-			AC_CHECK_LIB(crypto, BIO_s_mem)
+			PKG_CHECK_MODULES([OPENSSL], [libssl libcrypto],
-			AC_CHECK_LIB(ssl, SSL_library_init)
+				[LIBS="$LIBS $OPENSSL_LIBS" CFLAGS="$CFLAGS $OPENSSL_CFLAGS"
-			AC_CHECK_FUNCS(SSL_library_init, x_ssl_openssl=yes,
+				AC_DEFINE(HAVE_LIBSSL, 1)],
 				[AC_CHECK_LIB(crypto, BIO_s_mem)
 				AC_CHECK_LIB(ssl, SSL_new)]
 			)
 			AC_CHECK_FUNCS(SSL_new, x_ssl_openssl=yes,
 				AC_MSG_ERROR([Can't enable openssl])
 			)
 		fi
@@ -454,6 +506,8 @@ if test "$x_ssl_openssl" = "yes"; then
 	x_ssl_lib=openssl
 fi
 AM_CONDITIONAL(HAVE_SSL, [test $x_ssl_lib != "no"])
 # use TCP wrappers?
 x_tcpwrap_on=no
--- a/contrib/Debian/.gitignore
+++ b/contrib/Debian/.gitignore
@@ -4,10 +4,13 @@
 files
 ngircd/
 ngircd-full/
 ngircd.service
 ngircd-full.default
 ngircd-full.init
 ngircd-full.postinst
 ngircd-full.service
 ngircd-full-dbg/
 ngircd-full-dbg.default
 ngircd-full-dbg.init
 ngircd-full-dbg.postinst
 ngircd-full-dbg.service
--- a/contrib/Debian/Makefile.am
+++ b/contrib/Debian/Makefile.am
@@ -1,6 +1,6 @@
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2010 Alexander Barton (alex@barton.de)
+# Copyright (c)2001-2017 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -10,7 +10,8 @@
 #
 EXTRA_DIST = rules changelog compat control copyright \
-	ngircd.init ngircd.default ngircd.pam ngircd.postinst
+	ngircd.init ngircd.default ngircd.pam ngircd.postinst \
 	source/format
 maintainer-clean-local:
 	rm -f Makefile Makefile.in
--- a/contrib/Debian/changelog
+++ b/contrib/Debian/changelog
@@ -1,3 +1,39 @@
 ngircd (26~rc1-0ab1) unstable; urgency=low
  * New "upstream" release candidate 1 for ngIRCd Release 26.
 -- Alexander Barton <alex@barton.de>  Sun, 10 May 2020 17:13:17 +0200
 ngircd (25-0ab1) unstable; urgency=low
  * New "upstream" release: ngIRCd 25.
 -- Alexander Barton <alex@barton.de>  Wed, 23 Jan 2019 23:13:03 +0100
 ngircd (25~rc1-0ab1) unstable; urgency=low
  * New "upstream" release candidate 1 for ngIRCd Release 25.
 -- Alexander Barton <alex@barton.de>  Sat, 11 Aug 2018 21:35:08 +0200
 ngircd (24-0ab1) unstable; urgency=low
  * New "upstream" release: ngIRCd 24.
 -- Alexander Barton <alex@barton.de>  Fri, 20 Jan 2017 16:43:09 +0100
 ngircd (24~rc1-0ab2) unstable; urgency=low
  * Use OpenSSL instead of GnuTLS for SSL-enabled packages.
 -- Alexander Barton <alex@barton.de>  Fri, 20 Jan 2017 15:20:07 +0100
 ngircd (24~rc1-0ab1) unstable; urgency=low
  * New "upstream" release candidate 1 for ngIRCd Release 24.
 -- Alexander Barton <alex@barton.de>  Sat, 07 Jan 2017 18:58:02 +0100
 ngircd (23-0ab1) unstable; urgency=low
  * New "upstream" release: ngIRCd 23.
--- a/contrib/Debian/compat
+++ b/contrib/Debian/compat
@@ -1 +1 @@
-4
+9
--- a/contrib/Debian/control
+++ b/contrib/Debian/control
@@ -2,14 +2,15 @@ Source: ngircd
 Section: net
 Priority: optional
 Maintainer: Alexander Barton <alex@barton.de>
-Build-Depends: debhelper (>> 4.0.0),
+Build-Depends: debhelper (>> 9.0.0),
    autotools-dev,
    dh-systemd (>= 1.5),
    expect,
    libz-dev,
    libwrap0-dev,
    libident-dev,
    libgnutls-dev,
    libpam0g-dev,
    libssl-dev,
    libwrap0-dev,
    libz-dev,
    telnet | telnet-ssl,
 Standards-Version: 3.9.1
--- a/contrib/Debian/ngircd.postinst
+++ b/contrib/Debian/ngircd.postinst
@@ -1,7 +1,6 @@
 #!/bin/sh
 #
 # Debian post-installation script
 # $Id: ngircd.postinst,v 1.2 2006/12/26 14:44:40 alex Exp $
 #
 set -e
@@ -12,6 +11,7 @@ case "$1" in
 			# make sure that the configuration file is not
 			# world-readable, it contains passwords!
 			chmod o= /etc/ngircd/ngircd.conf
 			chgrp irc /etc/ngircd/ngircd.conf
 		fi
 		;;
 esac
--- a/contrib/Debian/rules
+++ b/contrib/Debian/rules
@@ -1,7 +1,7 @@
 #!/usr/bin/make -f
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2016 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -55,7 +55,7 @@ configure-ngircd-full: configure
 	  --mandir=\$${prefix}/share/man \
 	  --docdir=\$${prefix}/share/doc/ngircd-full \
 	  --with-syslog --with-zlib \
-	  --with-gnutls --with-iconv --with-ident --with-tcp-wrappers \
+	  --with-openssl --with-iconv --with-ident --with-tcp-wrappers \
 	  --with-pam \
 	  --enable-ipv6
@@ -70,12 +70,12 @@ configure-ngircd-full-dbg: configure
 	  --docdir=\$${prefix}/share/doc/ngircd-full-dbg \
 	  --enable-debug --enable-sniffer \
 	  --with-syslog --with-zlib \
-	  --with-gnutls --with-iconv --with-ident --with-tcp-wrappers \
+	  --with-openssl --with-iconv --with-ident --with-tcp-wrappers \
 	  --with-pam \
 	  --enable-ipv6
 build:
-	dh_clean -k
+	dh_prep
 build-ngircd: build-stamp-ngircd
 build-stamp-ngircd: configure-ngircd
@@ -111,12 +111,15 @@ clean:
 	dh_testdir
 	dh_testroot
 	rm -f build-stamp*
 	rm -f $(CURDIR)/debian/ngircd.service
 	rm -f $(CURDIR)/debian/ngircd-full.default
 	rm -f $(CURDIR)/debian/ngircd-full.init
 	rm -f $(CURDIR)/debian/ngircd-full.postinst
 	rm -f $(CURDIR)/debian/ngircd-full.service
 	rm -f $(CURDIR)/debian/ngircd-full-dbg.default
 	rm -f $(CURDIR)/debian/ngircd-full-dbg.postinst
 	rm -f $(CURDIR)/debian/ngircd-full-dbg.init
 	rm -f $(CURDIR)/debian/ngircd-full-dbg.service
 	# Add here commands to clean up after the build process:
 	[ ! -f Makefile ] || $(MAKE) distclean
@@ -140,7 +143,6 @@ install-ngircd: build-ngircd
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/ngircd
 	rm $(CURDIR)/debian/ngircd/usr/share/doc/ngircd/INSTALL*
 	rm $(CURDIR)/debian/ngircd/usr/share/doc/ngircd/COPYING*
 	mkdir -p $(CURDIR)/debian/ngircd/var/run/ircd
 	cat $(CURDIR)/debian/ngircd/usr/share/doc/ngircd/sample-ngircd.conf | \
 	 sed -e "s|;ServerUID = 65534|ServerUID = irc|g" | \
 	 sed -e "s|;ServerGID = 65534|ServerGID = irc|g" | \
@@ -157,7 +159,6 @@ install-ngircd-full: build-ngircd-full
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/ngircd-full
 	rm $(CURDIR)/debian/ngircd-full/usr/share/doc/ngircd-full/INSTALL*
 	rm $(CURDIR)/debian/ngircd-full/usr/share/doc/ngircd-full/COPYING*
 	mkdir -p $(CURDIR)/debian/ngircd-full/var/run/ircd
 	cat $(CURDIR)/debian/ngircd-full/usr/share/doc/ngircd-full/sample-ngircd.conf | \
 	 sed -e "s|;ServerUID = 65534|ServerUID = irc|g" | \
 	 sed -e "s|;ServerGID = 65534|ServerGID = irc|g" | \
@@ -176,7 +177,6 @@ install-ngircd-full-dbg: build-ngircd-full-dbg
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/ngircd-full-dbg
 	rm $(CURDIR)/debian/ngircd-full-dbg/usr/share/doc/ngircd-full-dbg/INSTALL*
 	rm $(CURDIR)/debian/ngircd-full-dbg/usr/share/doc/ngircd-full-dbg/COPYING*
 	mkdir -p $(CURDIR)/debian/ngircd-full-dbg/var/run/ircd
 	cat $(CURDIR)/debian/ngircd-full-dbg/usr/share/doc/ngircd-full-dbg/sample-ngircd.conf | \
 	 sed -e "s|;ServerUID = 65534|ServerUID = irc|g" | \
 	 sed -e "s|;ServerGID = 65534|ServerGID = irc|g" | \
@@ -192,12 +192,18 @@ binary-indep:
 # Build architecture-dependent files here.
 binary-arch: build install
 	ln -s $(CURDIR)/contrib/ngircd.service \
 	 $(CURDIR)/debian/ngircd.service
 	ln -s $(CURDIR)/debian/ngircd.default \
 	 $(CURDIR)/debian/ngircd-full.default
 	ln -s $(CURDIR)/debian/ngircd.init \
 	 $(CURDIR)/debian/ngircd-full.init
 	ln -s $(CURDIR)/debian/ngircd.postinst \
 	 $(CURDIR)/debian/ngircd-full.postinst
 	cp $(CURDIR)/contrib/ngircd.service \
 	 $(CURDIR)/debian/ngircd-full.service
 	echo "Alias=ngircd.service" >>$(CURDIR)/debian/ngircd-full.service
 	ln -s $(CURDIR)/debian/ngircd.default \
 	 $(CURDIR)/debian/ngircd-full-dbg.default
@@ -205,12 +211,17 @@ binary-arch: build install
 	 $(CURDIR)/debian/ngircd-full-dbg.init
 	ln -s $(CURDIR)/debian/ngircd.postinst \
 	 $(CURDIR)/debian/ngircd-full-dbg.postinst
 	cp $(CURDIR)/contrib/ngircd.service \
 	 $(CURDIR)/debian/ngircd-full-dbg.service
 	echo "Alias=ngircd.service" >>$(CURDIR)/debian/ngircd-full-dbg.service
 	dh_testdir
 	dh_testroot
 	dh_installchangelogs -a -A ChangeLog
 	dh_installdocs -a
 	dh_systemd_enable -a
 	dh_installinit -a
 	dh_systemd_start -a
 	dh_strip -a --no-package=ngircd-full-dbg
 	dh_compress -a -XCommands.txt
 	dh_fixperms -a
@@ -222,6 +233,6 @@ binary-arch: build install
 binary: binary-indep binary-arch
-.PHONY: build clean binary-indep binary-arch binary install 
+.PHONY: build clean binary-indep binary-arch binary install
 # -eof-
--- a/contrib/Debian/source/format
+++ b/contrib/Debian/source/format
@@ -0,0 +1 @@
 1.0
--- a/contrib/MacOSX/config.h
+++ b/contrib/MacOSX/config.h
@@ -113,6 +113,8 @@
 #define HAVE_SIGACTION 1
 /* Define to 1 if you have the `setsid' function. */
 #define HAVE_SETSID 1
 /* Define to 1 if you have the `strsignal' function. */
 #define HAVE_STRSIGNAL 1
 /* Define if socklen_t exists */
 #define HAVE_socklen_t 1
--- a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj
+++ b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj
@@ -51,18 +51,6 @@
 		FAE5CC2E0CF2308A007D69B6 /* numeric.c in Sources */ = {isa = PBXBuildFile; fileRef = FAE5CC2D0CF2308A007D69B6 /* numeric.c */; };
 /* End PBXBuildFile section */
 /* Begin PBXCopyFilesBuildPhase section */
 		8DD76FAF0486AB0100D96B5E /* CopyFiles */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 8;
 			dstPath = /usr/share/man/man1/;
 			dstSubfolderSpec = 0;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 1;
 		};
 /* End PBXCopyFilesBuildPhase section */
 /* Begin PBXFileReference section */
 		FA18A63E16CEDDCE00132F66 /* configure.ng */ = {isa = PBXFileReference; lastKnownFileType = text; name = configure.ng; path = ../../configure.ng; sourceTree = "<group>"; };
 		FA18A63F16CEDE2300132F66 /* ngircd.service */ = {isa = PBXFileReference; lastKnownFileType = text; path = ngircd.service; sourceTree = "<group>"; };
@@ -166,10 +154,10 @@
 		FA322D5E0CEF750F001761B3 /* config.guess */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text.script.sh; name = config.guess; path = ../../config.guess; sourceTree = SOURCE_ROOT; };
 		FA322D5F0CEF750F001761B3 /* config.sub */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text.script.sh; name = config.sub; path = ../../config.sub; sourceTree = SOURCE_ROOT; };
 		FA322D610CEF750F001761B3 /* COPYING */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; name = COPYING; path = ../../COPYING; sourceTree = SOURCE_ROOT; };
-		FA322D620CEF750F001761B3 /* INSTALL */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; name = INSTALL; path = ../../INSTALL; sourceTree = SOURCE_ROOT; };
+		FA322D620CEF750F001761B3 /* INSTALL.md */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = net.daringfireball.markdown; name = INSTALL.md; path = ../../INSTALL.md; sourceTree = SOURCE_ROOT; };
 		FA322D630CEF750F001761B3 /* Makefile.am */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; name = Makefile.am; path = ../../Makefile.am; sourceTree = SOURCE_ROOT; };
 		FA322D640CEF750F001761B3 /* NEWS */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; name = NEWS; path = ../../NEWS; sourceTree = SOURCE_ROOT; };
-		FA322D650CEF750F001761B3 /* README */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; name = README; path = ../../README; sourceTree = SOURCE_ROOT; };
+		FA322D650CEF750F001761B3 /* README.md */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = net.daringfireball.markdown; name = README.md; path = ../../README.md; sourceTree = SOURCE_ROOT; };
 		FA322D6A0CEF7523001761B3 /* changelog */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = changelog; sourceTree = "<group>"; };
 		FA322D6B0CEF7523001761B3 /* compat */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = compat; sourceTree = "<group>"; };
 		FA322D6C0CEF7523001761B3 /* control */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = control; sourceTree = "<group>"; };
@@ -179,12 +167,10 @@
 		FA322D700CEF7523001761B3 /* ngircd.init */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text.script.sh; path = ngircd.init; sourceTree = "<group>"; };
 		FA322D710CEF7523001761B3 /* ngircd.postinst */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text.script.sh; path = ngircd.postinst; sourceTree = "<group>"; };
 		FA322D720CEF7523001761B3 /* rules */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = rules; sourceTree = "<group>"; };
 		FA322D8D0CEF7523001761B3 /* Makefile.am */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; name = Makefile.am; path = MacOSX/Makefile.am; sourceTree = "<group>"; };
 		FA322D8E0CEF7523001761B3 /* ngIRCd.xcodeproj */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.pb-project"; path = ngIRCd.xcodeproj; sourceTree = "<group>"; };
-		FA322D920CEF7523001761B3 /* ngindent */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = ngindent; sourceTree = "<group>"; };
+		FA322D920CEF7523001761B3 /* ngindent.sh */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text.script.sh; path = ngindent.sh; sourceTree = "<group>"; };
 		FA322D940CEF7523001761B3 /* ngircd.spec */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = ngircd.spec; sourceTree = "<group>"; };
 		FA322D950CEF7523001761B3 /* README */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = README; sourceTree = "<group>"; };
 		FA322D960CEF7523001761B3 /* systrace.policy */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = systrace.policy; sourceTree = "<group>"; };
 		FA322D9A0CEF752C001761B3 /* FAQ.txt */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = FAQ.txt; sourceTree = "<group>"; };
 		FA322D9B0CEF752C001761B3 /* Makefile.am */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = Makefile.am; sourceTree = "<group>"; };
 		FA322D9C0CEF752C001761B3 /* Platforms.txt */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = Platforms.txt; sourceTree = "<group>"; };
@@ -203,11 +189,12 @@
 		FA322DC00CEF77CB001761B3 /* libz.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libz.dylib; path = /usr/lib/libz.dylib; sourceTree = "<absolute>"; };
 		FA407F2C0DB159F400271AF1 /* ng_ipaddr.c */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.c; name = ng_ipaddr.c; path = ipaddr/ng_ipaddr.c; sourceTree = "<group>"; };
 		FA407F2D0DB159F400271AF1 /* ng_ipaddr.h */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.h; name = ng_ipaddr.h; path = ipaddr/ng_ipaddr.h; sourceTree = "<group>"; };
 		FA407F380DB15AC700271AF1 /* GIT.txt */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = GIT.txt; sourceTree = "<group>"; };
 		FA4B08E513E7F8FB00765BA3 /* ngircd-bsd.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = "ngircd-bsd.sh"; sourceTree = "<group>"; };
 		FA4B08E613E7F91700765BA3 /* ngIRCd-Logo.gif */ = {isa = PBXFileReference; lastKnownFileType = image.gif; path = "ngIRCd-Logo.gif"; sourceTree = "<group>"; };
 		FA4B08E713E7F91700765BA3 /* ngircd-redhat.init */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = "ngircd-redhat.init"; sourceTree = "<group>"; };
 		FA4B08E813E7F91C00765BA3 /* platformtest.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = platformtest.sh; sourceTree = "<group>"; };
 		FA4B4F542055B47C00A04296 /* ngircd.logcheck */ = {isa = PBXFileReference; lastKnownFileType = text; path = ngircd.logcheck; sourceTree = "<group>"; };
 		FA4B4F552055B4C800A04296 /* source */ = {isa = PBXFileReference; lastKnownFileType = folder; path = source; sourceTree = "<group>"; };
 		FA4F1659164836B100DBD011 /* irc-metadata.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = "irc-metadata.c"; sourceTree = "<group>"; };
 		FA4F165C164836BF00DBD011 /* irc-metadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "irc-metadata.h"; sourceTree = "<group>"; };
 		FA6BBC5F1605F0AB0004247A /* conn-encoding.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = "conn-encoding.c"; sourceTree = "<group>"; };
@@ -216,6 +203,8 @@
 		FA6BBC621605F0AC0004247A /* irc-encoding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "irc-encoding.h"; sourceTree = "<group>"; };
 		FA6BBC651605F6D60004247A /* libiconv.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libiconv.dylib; path = ../../../../../../../usr/lib/libiconv.dylib; sourceTree = "<group>"; };
 		FA77849A133FB9FF00740057 /* sample-ngircd.conf.tmpl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = "sample-ngircd.conf.tmpl"; sourceTree = "<group>"; };
 		FA7E9FEE242FFC4500A04296 /* server-link-test.e */ = {isa = PBXFileReference; lastKnownFileType = text; path = "server-link-test.e"; sourceTree = "<group>"; };
 		FA7E9FF0242FFC6C00A04296 /* server-login-test.e */ = {isa = PBXFileReference; lastKnownFileType = text; path = "server-login-test.e"; sourceTree = "<group>"; };
 		FA85178A0FA061EC006A1F5A /* op.h */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.h; path = op.h; sourceTree = "<group>"; };
 		FA85178B0FA061EC006A1F5A /* op.c */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.c; path = op.c; sourceTree = "<group>"; };
 		FA99428A10E82A27007F27ED /* proc.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = proc.h; sourceTree = "<group>"; };
@@ -244,8 +233,10 @@
 		FAA3D28B0F139D2E00B2447E /* preinstall.sh */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text.script.sh; path = preinstall.sh; sourceTree = "<group>"; };
 		FAA97C55124A271400D5BBA9 /* sighandlers.c */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.c; path = sighandlers.c; sourceTree = "<group>"; };
 		FAA97C56124A271400D5BBA9 /* sighandlers.h */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.h; path = sighandlers.h; sourceTree = "<group>"; };
 		FAA9C8162377186900A04296 /* nglog.sh */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = nglog.sh; sourceTree = "<group>"; };
 		FAACD5F314A6099C006ED74F /* class.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = class.c; sourceTree = "<group>"; };
 		FAACD5F414A6099C006ED74F /* class.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = class.h; sourceTree = "<group>"; };
 		FAC4E5CD23A7DE2400A04296 /* Makefile.am */ = {isa = PBXFileReference; lastKnownFileType = text; path = Makefile.am; sourceTree = "<group>"; };
 		FAD5852F15271A7800328741 /* Capabilities.txt */ = {isa = PBXFileReference; lastKnownFileType = text; path = Capabilities.txt; sourceTree = "<group>"; };
 		FAD5853015271AAB00328741 /* client-cap.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = "client-cap.c"; sourceTree = "<group>"; };
 		FAD5853115271AAB00328741 /* client-cap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "client-cap.h"; sourceTree = "<group>"; };
@@ -288,9 +279,9 @@
 				FA322D5A0CEF750F001761B3 /* AUTHORS */,
 				FA322D5C0CEF750F001761B3 /* ChangeLog */,
 				FA322D610CEF750F001761B3 /* COPYING */,
-				FA322D620CEF750F001761B3 /* INSTALL */,
+				FA322D620CEF750F001761B3 /* INSTALL.md */,
 				FA322D640CEF750F001761B3 /* NEWS */,
-				FA322D650CEF750F001761B3 /* README */,
+				FA322D650CEF750F001761B3 /* README.md */,
 				FA322D5B0CEF750F001761B3 /* autogen.sh */,
 				FA322D5E0CEF750F001761B3 /* config.guess */,
 				FA322D5F0CEF750F001761B3 /* config.sub */,
@@ -437,32 +428,34 @@
 			isa = PBXGroup;
 			children = (
 				FA18A64A16CEE18100132F66 /* Makefile.ng */,
 				FA322D250CEF74B1001761B3 /* README */,
 				FA322D1D0CEF74B1001761B3 /* channel-test.e */,
 				FA322D1E0CEF74B1001761B3 /* check-idle.e */,
 				FA322D1F0CEF74B1001761B3 /* connect-test.e */,
 				FA322D200CEF74B1001761B3 /* functions.inc */,
 				FA322D210CEF74B1001761B3 /* getpid.sh */,
 				FAA3D2700F139CB300B2447E /* invite-test.e */,
 				FAA3D2710F139CB300B2447E /* join-test.e */,
 				FAA3D2720F139CB300B2447E /* kick-test.e */,
 				FAA3D2730F139CB300B2447E /* message-test.e */,
 				FA18A64E16CEE24B00132F66 /* misc-test.e */,
 				FA18A64C16CEE1AC00132F66 /* mode-test.e */,
 				FAA3D2760F139CB300B2447E /* opless-channel-test.e */,
 				FAA3D2770F139CB300B2447E /* server-link-test.e */,
 				FA322D280CEF74B1001761B3 /* stress-A.e */,
 				FA322D290CEF74B1001761B3 /* stress-B.e */,
 				FA1A6BBD0D6857D900AA8F71 /* who-test.e */,
 				FA18A64D16CEE1D900132F66 /* whois-test.e */,
 				FA322D200CEF74B1001761B3 /* functions.inc */,
 				FAA3D2740F139CB300B2447E /* ngircd-test1.conf */,
 				FAA3D2750F139CB300B2447E /* ngircd-test2.conf */,
-				FA322D210CEF74B1001761B3 /* getpid.sh */,
+				FAA3D2760F139CB300B2447E /* opless-channel-test.e */,
 				FA322D250CEF74B1001761B3 /* README */,
 				FAA3D2770F139CB300B2447E /* server-link-test.e */,
 				FA322D260CEF74B1001761B3 /* start-server.sh */,
 				FA322D270CEF74B1001761B3 /* stop-server.sh */,
 				FA322D280CEF74B1001761B3 /* stress-A.e */,
 				FA322D290CEF74B1001761B3 /* stress-B.e */,
 				FA7E9FEE242FFC4500A04296 /* server-link-test.e */,
 				FA7E9FF0242FFC6C00A04296 /* server-login-test.e */,
 				FA322D2A0CEF74B1001761B3 /* stress-server.sh */,
 				FA322D2B0CEF74B1001761B3 /* test-loop.sh */,
 				FA322D2C0CEF74B1001761B3 /* tests.sh */,
 				FA322D2D0CEF74B1001761B3 /* wait-tests.sh */,
 				FA1A6BBD0D6857D900AA8F71 /* who-test.e */,
 				FA18A64D16CEE1D900132F66 /* whois-test.e */,
 			);
 			path = testsuite;
 			sourceTree = "<group>";
@@ -480,19 +473,20 @@
 		FA322D660CEF7523001761B3 /* contrib */ = {
 			isa = PBXGroup;
 			children = (
-				FA322D8D0CEF7523001761B3 /* Makefile.am */,
+				FAC4E5CD23A7DE2400A04296 /* Makefile.am */,
 				FA322D680CEF7523001761B3 /* Debian */,
 				FA322D730CEF7523001761B3 /* MacOSX */,
 				FA322D950CEF7523001761B3 /* README */,
-				FA322D920CEF7523001761B3 /* ngindent */,
+				FA322D920CEF7523001761B3 /* ngindent.sh */,
 				FA4B08E513E7F8FB00765BA3 /* ngircd-bsd.sh */,
 				FA4B08E613E7F91700765BA3 /* ngIRCd-Logo.gif */,
 				FA4B08E713E7F91700765BA3 /* ngircd-redhat.init */,
 				FA4B4F542055B47C00A04296 /* ngircd.logcheck */,
 				FA18A63F16CEDE2300132F66 /* ngircd.service */,
 				FA18A64016CEDE2300132F66 /* ngircd.socket */,
 				FA322D940CEF7523001761B3 /* ngircd.spec */,
 				FAA9C8162377186900A04296 /* nglog.sh */,
 				FA4B08E813E7F91C00765BA3 /* platformtest.sh */,
 				FA322D960CEF7523001761B3 /* systrace.policy */,
 			);
 			name = contrib;
 			path = ..;
@@ -511,6 +505,7 @@
 				FA18A64116CEDE3500132F66 /* ngircd.pam */,
 				FA322D710CEF7523001761B3 /* ngircd.postinst */,
 				FA322D720CEF7523001761B3 /* rules */,
 				FA4B4F552055B4C800A04296 /* source */,
 			);
 			path = Debian;
 			sourceTree = "<group>";
@@ -546,7 +541,6 @@
 				FA18A64416CEDFCE00132F66 /* Commands.txt */,
 				FAE22BD415270EA300F1A5AB /* Contributing.txt */,
 				FA322D9A0CEF752C001761B3 /* FAQ.txt */,
 				FA407F380DB15AC700271AF1 /* GIT.txt */,
 				FAE22BD515270EB500F1A5AB /* HowToRelease.txt */,
 				FAE22BD615270EB500F1A5AB /* Modes.txt */,
 				FAE22BD715270EB500F1A5AB /* PAM.txt */,
@@ -617,7 +611,6 @@
 			buildPhases = (
 				8DD76FAB0486AB0100D96B5E /* Sources */,
 				8DD76FAD0486AB0100D96B5E /* Frameworks */,
 				8DD76FAF0486AB0100D96B5E /* CopyFiles */,
 			);
 			buildRules = (
 			);
@@ -635,17 +628,16 @@
 		08FB7793FE84155DC02AAC07 /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				LastUpgradeCheck = 0630;
+				LastUpgradeCheck = 1140;
 				ORGANIZATIONNAME = "ngIRCd Development Team";
 			};
 			buildConfigurationList = 1DEB928908733DD80010E9CD /* Build configuration list for PBXProject "ngIRCd" */;
 			compatibilityVersion = "Xcode 3.2";
-			developmentRegion = English;
+			developmentRegion = en;
 			hasScannedForEncodings = 1;
 			knownRegions = (
-				English,
+				en,
-				Japanese,
+				Base,
 				French,
 				German,
 			);
 			mainGroup = 08FB7794FE84155DC02AAC07 /* ngIRCd */;
 			projectDirPath = "";
@@ -715,80 +707,102 @@
 		1DEB928708733DD80010E9CD /* Default */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
 				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
 				GCC_WARN_CHECK_SWITCH_STATEMENTS = YES;
 				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
 				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
 				GCC_WARN_MISSING_PARENTHESES = YES;
 				GCC_WARN_PEDANTIC = YES;
 				GCC_WARN_SHADOW = YES;
 				GCC_WARN_SIGN_COMPARE = YES;
 				GCC_WARN_TYPECHECK_CALLS_TO_PRINTF = YES;
 				GCC_WARN_UNINITIALIZED_AUTOS = YES;
 				GCC_WARN_UNKNOWN_PRAGMAS = YES;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_LABEL = YES;
 				GCC_WARN_UNUSED_PARAMETER = YES;
 				GCC_WARN_UNUSED_VALUE = YES;
 				INSTALL_PATH = /usr/local/bin;
 				PRODUCT_NAME = ngircd;
 			};
 			name = Default;
 		};
 		1DEB928B08733DD80010E9CD /* Default */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				CODE_SIGN_IDENTITY = "";
+				ALWAYS_SEARCH_USER_PATHS = NO;
-				GCC_VERSION = "";
+				CLANG_WARN_ASSIGN_ENUM = YES;
 				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
 				CLANG_WARN_COMMA = YES;
 				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
 				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
 				CLANG_WARN_EMPTY_BODY = YES;
 				CLANG_WARN_INFINITE_RECURSION = YES;
 				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
 				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
 				CLANG_WARN_SEMICOLON_BEFORE_METHOD_BODY = YES;
 				CLANG_WARN_STRICT_PROTOTYPES = YES;
 				CLANG_WARN_SUSPICIOUS_IMPLICIT_CONVERSION = YES;
 				CLANG_WARN_SUSPICIOUS_MOVE = YES;
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				GCC_NO_COMMON_BLOCKS = YES;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_MISSING_FIELD_INITIALIZERS = YES;
 				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES;
 				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
 				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
 				GCC_WARN_PEDANTIC = YES;
 				GCC_WARN_SHADOW = YES;
 				GCC_WARN_SIGN_COMPARE = YES;
 				GCC_WARN_UNDECLARED_SELECTOR = YES;
 				GCC_WARN_UNINITIALIZED_AUTOS = YES;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_LABEL = YES;
 				GCC_WARN_UNUSED_PARAMETER = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 10.6;
-				SDKROOT = "";
+				PRODUCT_NAME = ngircd;
 			};
 			name = Default;
 		};
 		FAB0570C105D917F006AF9E2 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				GCC_DEBUGGING_SYMBOLS = full;
+				ALWAYS_SEARCH_USER_PATHS = NO;
-				GCC_OPTIMIZATION_LEVEL = 0;
+				CLANG_WARN_ASSIGN_ENUM = YES;
-				GCC_VERSION = "";
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
 				CLANG_WARN_COMMA = YES;
 				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
 				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
 				CLANG_WARN_EMPTY_BODY = YES;
 				CLANG_WARN_INFINITE_RECURSION = YES;
 				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
 				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
 				CLANG_WARN_SEMICOLON_BEFORE_METHOD_BODY = YES;
 				CLANG_WARN_STRICT_PROTOTYPES = YES;
 				CLANG_WARN_SUSPICIOUS_IMPLICIT_CONVERSION = YES;
 				CLANG_WARN_SUSPICIOUS_MOVE = YES;
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				GCC_NO_COMMON_BLOCKS = YES;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_MISSING_FIELD_INITIALIZERS = YES;
 				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES;
 				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
 				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
 				GCC_WARN_PEDANTIC = YES;
 				GCC_WARN_SHADOW = YES;
 				GCC_WARN_SIGN_COMPARE = YES;
 				GCC_WARN_UNDECLARED_SELECTOR = YES;
 				GCC_WARN_UNINITIALIZED_AUTOS = YES;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_LABEL = YES;
 				GCC_WARN_UNUSED_PARAMETER = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 10.6;
 				ONLY_ACTIVE_ARCH = YES;
 				PRODUCT_NAME = ngircd;
 				SDKROOT = "";
 				STRIP_INSTALLED_PRODUCT = NO;
 			};
 			name = Debug;
 		};
 		FAB0570D105D917F006AF9E2 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				GCC_TREAT_IMPLICIT_FUNCTION_DECLARATIONS_AS_ERRORS = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
 				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
 				GCC_WARN_CHECK_SWITCH_STATEMENTS = YES;
 				GCC_WARN_FOUR_CHARACTER_CONSTANTS = YES;
 				GCC_WARN_INITIALIZER_NOT_FULLY_BRACKETED = YES;
 				GCC_WARN_MISSING_PARENTHESES = YES;
 				GCC_WARN_PEDANTIC = YES;
 				GCC_WARN_SHADOW = YES;
 				GCC_WARN_SIGN_COMPARE = YES;
 				GCC_WARN_TYPECHECK_CALLS_TO_PRINTF = YES;
 				GCC_WARN_UNINITIALIZED_AUTOS = NO;
 				GCC_WARN_UNKNOWN_PRAGMAS = YES;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_LABEL = YES;
 				GCC_WARN_UNUSED_PARAMETER = YES;
 				GCC_WARN_UNUSED_VALUE = YES;
 				INSTALL_PATH = /usr/local/bin;
 				PRODUCT_NAME = ngircd;
 			};
 			name = Debug;
 		};
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -1,6 +1,6 @@
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2013 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2020 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -12,15 +12,16 @@
 SUBDIRS = Debian MacOSX
 EXTRA_DIST = README \
-	ngindent \
+	ngindent.sh \
 	ngircd-bsd.sh \
 	ngIRCd-Logo.gif \
 	ngircd-redhat.init \
 	ngircd.logcheck \
 	ngircd.service \
 	ngircd.socket \
 	ngircd.spec \
-	platformtest.sh \
+	nglog.sh \
-	systrace.policy
+	platformtest.sh
 maintainer-clean-local:
 	rm -f Makefile Makefile.in
--- a/contrib/README
+++ b/contrib/README
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-               (c)2001-2013 Alexander Barton and Contributors.
+               (c)2001-2020 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
@@ -18,7 +18,7 @@ MacOSX/
 - Project files for XCode, the "project builder" of Apple Mac OS X.
 	- de.barton.ngircd.plist[.tmpl]: launchd(8) property list.
-ngindent
+ngindent.sh
 - Script to indent the code of ngIRCd in the "standard way".
 ngircd-bsd.sh
@@ -27,6 +27,9 @@ ngircd-bsd.sh
 ngircd-redhat.init
 - Start/stop script for RedHat-based distributions (like CentOS).
 ngircd.logcheck
 - Sample rules for logcheck(8) to ignore "normal" log messages of ngIRCd.
 ngircd.service
 - systemd(8) service unit configuration file.
@@ -36,8 +39,8 @@ ngircd.socket
 ngircd.spec
 - RPM "spec" file.
 nglog.sh
 - Colorizes the log messages of ngircd(8) accoring to their log level.
 platformtest.sh
 - Build ngIRCd and output a "result line" suitable for doc/Platforms.txt.
 systrace.policy
 - Systrace policy file for OpenBSD (and probably NetBSD).
--- a/contrib/ngindent
+++ b/contrib/ngindent
@@ -1,17 +0,0 @@
 #/bin/sh
 INDENTARGS="-kr -i8 -ts8 -l80 -c3 -cd41 -ss -ncs -psl"
 # check if indent(1) is available
 type indent >/dev/null 2>&1 && INDENT="indent"
 type gindent >/dev/null 2>&1 && INDENT="gindent"
 type gnuindent >/dev/null 2>&1 && INDENT="gnuindent"
 if [ -z "$INDENT" ]; then
 	echo "Error: GNU \"indent\" not found!"
 	exit 1
 fi
 $INDENT -v $INDENTARGS $*
 # -eof-
--- a/contrib/ngindent.sh
+++ b/contrib/ngindent.sh
@@ -0,0 +1,46 @@
 #!/bin/sh
 #
 # ngIRCd -- The Next Generation IRC Daemon
 # Copyright (c)2001-2019 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
 # Please read the file COPYING, README and AUTHORS for more information.
 #
 # This script uses GNU indent(1) to format C source code files of ngIRCd.
 # Usage:
 #  - ./contrib/ngindent.sh [<file> [<file> [...]]]
 #  - cat ./src/ngircd/<c_file> | ./contrib/ngindent.sh
 # Use a coding-style based on "Kernighan & Ritchie" (-kr):
 INDENTARGS="-kr
 	-bad
 	-c3
 	-cd41
 	-i8
 	-l80
 	-ncs
 	-psl
 	-sob
 	-ss
 	-ts8
 	-blf
 	-il0
 "
 # check if indent(1) is available
 command -v indent >/dev/null 2>&1 && INDENT="indent"
 command -v gindent >/dev/null 2>&1 && INDENT="gindent"
 command -v gnuindent >/dev/null 2>&1 && INDENT="gnuindent"
 if [ -z "$INDENT" ]; then
 	echo "Error: GNU \"indent\" not found!"
 	exit 1
 fi
 # shellcheck disable=SC2086
 $INDENT -v $INDENTARGS "$@"
 # -eof-
--- a/contrib/ngircd-bsd.sh
+++ b/contrib/ngircd-bsd.sh
--- a/contrib/ngircd-redhat.init
+++ b/contrib/ngircd-redhat.init
--- a/contrib/ngircd.logcheck
+++ b/contrib/ngircd.logcheck
@@ -0,0 +1,61 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Accepted connection [0-9]+ from ".*:[0-9]+" on socket [0-9]+\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve address ".*": Name or service not known \[.*\]\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve ".*": host not found$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve ".*": Name or service not known$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Can't resolve ".*": No address associated with hostname$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Can't connect\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Client closed connection\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Got QUIT command\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Read error\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): SSL accept error, closing socket\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client ".*" unregistered (connection [0-9]+): Timeout\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Timeout\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Client unregistered \(connection [0-9]+\): Write error\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized SSL3\.0 using cipher .*\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized TLS1\.[012] using cipher .*\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized TLSv1\.[012] using cipher .*\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+: initialized TLSv1 using cipher .*\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+ \(socket [0-9]+\) with ".*:[0-9]+" established\. Now logging in \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Connection [0-9]+ with ".*:[0-9]+" closed \(in: .*, out: .*\)\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Enabled link compression \(zlib\) on connection [0-9]+\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Establishing connection for ".*" to ".*:[0-9]+" \(.*\), socket [0-9]+ \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: IDENT lookup for connection [0-9]+: ".*"\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: IDENT lookup for connection [0-9]+: no result\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Now listening on .*:[0-9]+ \(socket [0-9]+\)\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: OpenSSL .* initialized\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Possible forgery: .* resolved to ".*", which has no IP address!$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Preparing to establish a new server link for ".*" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Read error on connection [0-9]+ \(socket [0-9]+\): Connection reset by peer!$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Server ".*" registered \(via .*, connected to .*, [0-9]+ hops\)\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Server ".*" unregistered: .* .*\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Server ".*" unregistered: ".*" \(SQUIT from .*\)\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down all listening sockets \([0-9]+ total\) \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Can't connect\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Client closed connection\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Got QUIT command\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Ping timeout: [0-9]+ seconds\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Read error\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Server going down\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(SSL accept error, closing socket\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Timeout\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Shutting down connection [0-9]+ \(Write error\) with ".*:[0-9]+" \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL connection [0-9]+ shutting down \.\.\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL connection [0-9]+ with ".*:[0-9]+" established\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL connection on socket [0-9]+ failed!$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: A TLS packet with unexpected length was received\. \[ConnSSL_Read\]\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: A TLS packet with unexpected length was received\. \[gnutls_handshake\]\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: Broken pipe \[in ConnSSL_Write\(\)\]!$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: Connection reset by peer \[in ConnSSL_Read\(\)\]!$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL error: Connection reset by peer \[in SSL_connect\(\)\]!$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: SSL protocol error: SSL_accept \(.*\)$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" changed nick \(connection [0-9]+\): ".*" -> ".*"\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" registered \(connection [0-9]+\)\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Client closed connection\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Got QUIT command\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Ping timeout: [0-9]+ seconds\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Read error\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: User ".*!.*@.*" unregistered \(connection [0-9]+\): Server going down\.$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: warning: can't get client address: Connection reset by peer$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: warning: /etc/hosts\.allow, line [0-9]+: can't verify hostname: getaddrinfo\(.*, AF_INET\) failed$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Write error on connection [0-9]+ \(socket [0-9]+\): Broken pipe!$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ngircd\[[0-9]+\]: Write error on connection [0-9]+ \(socket [0-9]+\): Connection reset by peer!$
--- a/contrib/ngircd.service
+++ b/contrib/ngircd.service
@@ -1,20 +1,41 @@
 # ngIRCd systemd service unit.
 # See systemd(1), systemd.unit(5), systemd.service(5), systemd.exec(5).
 [Unit]
 Description=Next Generation IRC Daemon
 Documentation=man:ngircd(8) man:ngircd.conf(5) https://ngircd.barton.de
 After=network.target
 Wants=anope.service atheme.service irc-services.service
 Wants=bopm.service
 Before=anope.service atheme.service irc-services.service
 Before=bopm.service
 [Service]
 Type=forking
 User=irc
 Group=irc
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SYS_CHROOT CAP_NET_BIND_SERVICE
+# Settings & limits:
-PrivateTmp=yes
+CapabilityBoundingSet=CAP_SYS_CHROOT CAP_NET_BIND_SERVICE
 MemoryDenyWriteExecute=yes
 NoNewPrivileges=yes
 PrivateDevices=yes
 PrivateTmp=yes
 ProtectControlGroups=yes
 ProtectHome=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 ProtectSystem=full
-ProtectHome=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-NoNewPrivileges=true
+RestrictRealtime=yes
 RuntimeDirectory=ircd
 RuntimeDirectoryMode=750
-ExecStart=/usr/sbin/ngircd
+# Try to load "default files" from any Debian package variant to keep this
 # unit generic.
 EnvironmentFile=-/etc/default/ngircd
 EnvironmentFile=-/etc/default/ngircd-full
 EnvironmentFile=-/etc/default/ngircd-full-dbg
 # Start ngIRCd. Note: systemd doesn't allow to use $DAEMON here!
 ExecStart=/usr/sbin/ngircd $PARAMS
 ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure
--- a/contrib/ngircd.socket
+++ b/contrib/ngircd.socket
@@ -1,5 +1,6 @@
 [Unit]
 Description=Next Generation IRC Daemon (Socket)
 Documentation=man:ngircd(8) man:ngircd.conf(5)
 [Socket]
 BindIPv6Only=ipv6-only
--- a/contrib/ngircd.spec
+++ b/contrib/ngircd.spec
@@ -1,5 +1,5 @@
 %define name    ngircd
-%define version 23
+%define version 26~rc1
 %define release 1
 %define prefix  %{_prefix}
@@ -27,7 +27,7 @@ Advantages:
 - supports IPv6 and SSL
 - no problems with servers that have dynamic IP addresses
 - freely available, modern, portable and tidy C-source
- - ngIRCd is being actively developed since 11 years.
+ - ngIRCd is being actively developed since 2001
 %prep
 %setup -q
--- a/contrib/nglog.sh
+++ b/contrib/nglog.sh
@@ -0,0 +1,28 @@
 #!/bin/bash
 #
 # ngIRCd -- The Next Generation IRC Daemon
 # Copyright (c)2001-2020 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
 # Please read the file COPYING, README and AUTHORS for more information.
 #
 # This script parses the log output of ngircd(8), and colorizes the messages
 # accoring to their log level. Example usage:
 # ./src/ngircd/ngircd -f $PWD/doc/sample-ngircd.conf -np | ./contrib/nglog.sh
 #
 gawk '
  /^\[[[:digit:]]+:0 / {print "\033[1;95m" $0 "\033[0m"}
  /^\[[[:digit:]]+:1 / {print "\033[1;35m" $0 "\033[0m"}
  /^\[[[:digit:]]+:2 / {print "\033[1;91m" $0 "\033[0m"}
  /^\[[[:digit:]]+:3 / {print "\033[1;31m" $0 "\033[0m"}
  /^\[[[:digit:]]+:4 / {print "\033[1;33m" $0 "\033[0m"}
  /^\[[[:digit:]]+:5 / {print "\033[1m" $0 "\033[0m"}
  /^\[[[:digit:]]+:6 / {print $0}
  /^\[[[:digit:]]+:7 / {print "\033[90m" $0 "\033[0m"}
 ' </dev/stdin &
 wait
--- a/contrib/platformtest.sh
+++ b/contrib/platformtest.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2016 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,14 +14,14 @@
 # suitable for inclusion in doc/Platforms.txt -- please send reports
 # to the ngIRCd mailing list: <ngircd-ml@ngircd.barton.de>.
-NAME=`basename "$0"`
+NAME=$(basename "$0")
 VERBOSE=
 CLEAN=1
 PLATFORM=
 COMPILER="unknown"
 VERSION="unknown"
-DATE=`date "+%y-%m-%d"`
+DATE=$(date "+%y-%m-%d")
 COMMENT=
 R_CONFIGURE=
@@ -30,7 +30,7 @@ R_CHECK=
 R_CHECK_Y="?"
 R_RUN=
-SRC_D=`dirname "$0"`
+SRC_D=$(dirname "$0")
 MY_D="$PWD"
 [ -n "$MAKE" ] || MAKE="make"
@@ -55,6 +55,11 @@ while [ $# -gt 0 ]; do
 	shift
 done
 for cmd in telnet expect; do
 	command -v "$cmd" >/dev/null 2>&1 \
 		|| echo "$NAME: WARNING: $cmd(1) not found, \"make check\" won't run all tests!"
 done
 echo "$NAME: Checking ngIRCd base source directory ..."
 grep "ngIRCd" "$SRC_D/ChangeLog" >/dev/null 2>&1
 if [ $? -ne 0 ]; then
@@ -72,10 +77,14 @@ echo "$NAME: Checking for GIT tree ..."
 if [ -d "$SRC_D/.git" ]; then
 	echo "$NAME: Checking for \"git\" command ..."
 	git version >/dev/null 2>&1
-	if [ $? -eq 0 -a -n "$CLEAN" ]; then
+	if [ $? -eq 0 ] && [ -n "$CLEAN" ]; then
 		echo "$NAME: Running \"git clean\" ..."
 		cd "$SRC_D" || exit 1
-		[ -n "$VERBOSE" ] && git clean -dxf || git clean -dxf >/dev/null
+		if [ -n "$VERBOSE" ]; then
 			git clean -dxf
 		else
 			git clean -dxf >/dev/null
 		fi
 		cd "$MY_D" || exit 1
 	fi
 fi
@@ -84,21 +93,42 @@ echo "$NAME: Checking for \"$SRC_D/configure\" script ..."
 if [ ! -r "$SRC_D/configure" ]; then
 	echo "$NAME: Running \"$SRC_D/autogen.sh\" ..."
 	cd "$SRC_D" || exit 1
-	[ -n "$VERBOSE" ] && ./autogen.sh || ./autogen.sh >/dev/null
+	if [ -n "$VERBOSE" ]; then
 		./autogen.sh
 	else
 		./autogen.sh >/dev/null
 	fi
 	if [ $? -ne 0 ]; then
 		echo "$NAME: \"$SRC_D/autogen.sh\" script failed, aborting!"
 		exit 1
 	fi
 	cd "$MY_D" || exit 1
 fi
 if [ -r "$SRC_D/configure" ]; then
 	echo "$NAME: Running \"$SRC_D/configure\" script ..."
-	[ -n "$VERBOSE" ] && "$SRC_D/configure" -C || "$SRC_D/configure" -C >/dev/null
+	if [ -n "$VERBOSE" ]; then
-	if [ $? -eq 0 -a -r ./Makefile ]; then
+		"$SRC_D/configure" -C
 	else
 		"$SRC_D/configure" -C >/dev/null
 	fi
 	if [ $? -eq 0 ] && [ -r ./Makefile ]; then
 		R_CONFIGURE=1
 		rm -f "src/ngircd/ngircd"
 		echo "$NAME: Running \"$MAKE\" ..."
-		[ -n "$VERBOSE" ] && "$MAKE" || "$MAKE" >/dev/null
+		if [ -n "$VERBOSE" ]; then
-		if [ $? -eq 0 -a -x src/ngircd/ngircd ]; then
+			"$MAKE"
 		else
 			"$MAKE" >/dev/null
 		fi
 		if [ $? -eq 0 ] && [ -x src/ngircd/ngircd ]; then
 			R_MAKE=1
 			echo "$NAME: Running \"$MAKE check\" ..."
-			[ -n "$VERBOSE" ] && "$MAKE" check || "$MAKE" check >/dev/null
+			if [ -n "$VERBOSE" ]; then
 				"$MAKE" check
 			else
 				"$MAKE" check >/dev/null
 			fi
 			if [ $? -eq 0 ]; then
 				R_CHECK=1
 				R_RUN=$R_CHECK
@@ -115,13 +145,13 @@ fi
 # Get target platform information
 if [ -r "src/config.h" ]; then
-	CPU=`grep "HOST_CPU" "src/config.h" | cut -d'"' -f2`
+	CPU=$(grep "HOST_CPU" "src/config.h" | cut -d'"' -f2)
-	OS=`grep "HOST_OS" "src/config.h" | cut -d'"' -f2`
+	OS=$(grep "HOST_OS" "src/config.h" | cut -d'"' -f2)
-	VENDOR=`grep "HOST_VENDOR" "src/config.h" | cut -d'"' -f2`
+	VENDOR=$(grep "HOST_VENDOR" "src/config.h" | cut -d'"' -f2)
 	PLATFORM="$CPU/$VENDOR/$OS"
 fi
 if [ -z "$PLATFORM" ]; then
-	PLATFORM="`uname 2>/dev/null` `uname -r 2>/dev/null`, `uname -m 2>/dev/null`"
+	PLATFORM="$(uname 2>/dev/null) $(uname -r 2>/dev/null), $(uname -m 2>/dev/null)"
 fi
 # Get compiler information
@@ -153,8 +183,8 @@ if [ -r "Makefile" ]; then
 			  | cut -d'(' -f1 | sed -e 's/version //g')
 		fi
 		if [ "$COMPILER" = "unknown" ]; then
-			v="`$CC --version 2>/dev/null | head -1`"
+			v="$($CC --version 2>/dev/null | head -1)"
-			[ -z "$v" ] && v="`$CC -version 2>/dev/null | head -1`"
+			[ -z "$v" ] && v="$($CC -version 2>/dev/null | head -1)"
 			[ -n "$v" ] && COMPILER="$v"
 		fi
 	fi
@@ -164,7 +194,7 @@ fi
 eval "$(grep "^VERSION = " Makefile | sed -e 's/ //g')"
 case "$VERSION" in
 	*~*-*)
-		VERSION=`echo "$VERSION" | cut -b1-10`
+		VERSION=$(echo "$VERSION" | cut -b1-10)
 		;;
 esac
 [ -n "$VERSION" ] || VERSION="unknown"
@@ -184,7 +214,12 @@ fi
 [ -n "$R_CONFIGURE" ] && C="Y" || C="N"
 [ -n "$R_MAKE" ] && M="Y" || M="N"
 [ -n "$R_CHECK" ] && T="$R_CHECK_Y" || T="N"
-[ -n "$R_RUN" ] && R="Y" || R="N"
+if [ -n "$R_RUN" ]; then
 	# Mark "runs" with "Y" only when the test suite succeeded:
 	[ "$T" = "N" ] && R="?" || R="Y"
 else
 	R="N"
 fi
 [ -n "$COMMENT" ] && COMMENT=" $COMMENT"
 echo
@@ -195,17 +230,29 @@ echo "                                                  ./configure works --+ |
 echo "                                                                      | | | |"
 echo "Platform                    Compiler     ngIRCd     Date     Tester   C M T R *"
 echo "--------------------------- ------------ ---------- -------- -------- - - - - -"
-type printf >/dev/null 2>&1
+command -v printf >/dev/null 2>&1
 if [ $? -eq 0 ]; then
 	printf "%-27s %-12s %-10s %s %-8s %s %s %s %s%s\n" \
-	 "$PLATFORM" "$COMPILER" "$VERSION" "$DATE" "$USER" \
+	 "$PLATFORM" "$COMPILER" "$VERSION" "$DATE" "$LOGNAME" \
 	 "$C" "$M" "$T" "$R" "$COMMENT"
 else
-	echo "$PLATFORM $COMPILER $VERSION $DATE $USER" \
+	echo "$PLATFORM $COMPILER $VERSION $DATE $LOGNAME" \
 	 "$C" "$M" "$T" "$R" "$COMMENT"
 fi
 echo
 double_check() {
 	echo "Please double check that the ngIRCd daemon starts up, runs and handles IRC"
 	echo "connections successfully!"
 }
 if [ "$R_CHECK_Y" = "y" ]; then
-	echo "$NAME: Warning: Some tests have been skipped!"
+	echo "WARNING: Some tests have been skipped!"
 	double_check
 	echo
 fi
 if [ "$R" = "?" ]; then
 	echo "WARNING: The resulting binary passed simple tests, but the test suite failed!"
 	double_check
 	echo
 fi
--- a/contrib/systrace.policy
+++ b/contrib/systrace.policy
@@ -1,77 +0,0 @@
 #
 # Sample systrace policy for ngIRCd on OpenBSD
 # Author: Benjamin Pineau <ben@zouh.org>
 #
 # $Id: systrace.policy,v 1.1 2004/04/28 12:16:59 alex Exp $
 #
 # Tune me, put me in /etc/systrace/usr_local_bin_ngircd and start ngIRCd
 # (with root privileges) as:
 #
 #   systrace -a /usr/local/bin/ngircd
 #
 # I didn't tried this on NetBSD, but it should work as is.
 #
 # On systems with pf, it can be supplemented by strict firewall rules:
 # for a ngircd running as '$ircuser', binding on '$ircport' and accepting
 # 30 connections:
 #
 #   block out log quick proto tcp from any port $ircport to any \
 #    user != $ircuser
 #   pass in inet proto tcp from any to any port $ircport user $ircuser \
 #    keep state (max 30) flags S/SA
 #
 Policy: /usr/local/bin/ngircd, Emulation: native
 	native-__sysctl: permit
 	native-fsread: filename eq "/etc/malloc.conf" then permit
 	native-fsread: filename sub "/usr/share/zoneinfo/" then permit
 	native-fsread: filename eq "/usr/local/etc/ngircd.conf" then permit
 	native-fsread: filename eq "/usr/local/etc/ngircd.motd" then permit
 	native-fsread: filename eq "/etc/ngircd.conf" then permit
 	native-fsread: filename eq "/etc/ngircd.motd" then permit
 	native-fsread: filename eq "/etc/spwd.db" then deny[eperm]
 	native-fsread: filename eq "/etc/group" then permit
 	native-fsread: filename eq "/etc/resolv.conf" then permit
 	native-fsread: filename eq "/etc/localtime" then permit
 	native-fsread: filename eq "/etc/hosts" then permit
 	native-fsread: filename sub "<non-existent filename>" then deny[enoent]
 	native-socket: sockdom eq "AF_UNIX" and socktype eq "SOCK_DGRAM" then permit
 	native-socket: sockdom eq "AF_INET" and socktype eq "SOCK_STREAM" then permit
 	native-bind: sockaddr match "inet-*:6667" then permit, if user != root
 	native-connect: sockaddr eq "/dev/log" then permit, if user != root
 	native-connect: sockaddr match "inet-*:53" then permit, if user != root
 	native-setsockopt: permit, if user != root
 	native-listen: permit, if user != root
 	native-accept: permit, if user != root
 	native-sendto: true then permit, if user != root
 	native-recvfrom: permit, if user != root
 	native-read: permit
 	native-pread: permit
 	native-write: permit, if user != root
 	native-mmap: permit
 	native-munmap: permit
 	native-mprotect: permit
 	native-break: permit
 	native-umask: permit
 	native-fork: permit
 	native-setsid: permit
 	native-chdir: permit
 	native-chroot: permit
 	native-setgid: gid neq "0" then permit
 	native-setuid: uid neq "0" and uname neq "root" then permit
 	native-getuid: permit
 	native-getgid: permit
 	native-gettimeofday: permit
 	native-getpid: permit
 	native-select: permit
 	native-fcntl: permit
 	native-fstat: permit
 	native-issetugid: permit
 	native-sigaction: permit
 	native-pipe: permit
 	native-sigreturn: permit
 	native-close: permit
 	native-exit: permit
 	native-fswrite: deny[eperm]
 # -eof-
--- a/doc/Commands.txt
+++ b/doc/Commands.txt
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-               (c)2001-2013 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
@@ -324,7 +324,7 @@ General Commands
 	In addition, IRC Ops can use these two forms to specify the <target>:
 	.
 	 - #<hostmask>
-	 - #<servermask>
+	 - $<servermask>
 	.
 	The <mask> can contain the wildcard characters "*" and "?", but must
 	contain at least one dot (".") and no wildcard after the last one.
@@ -386,7 +386,7 @@ Status and Informational Commands
 	 - RFC 2812, 4.9 "Ison message"
 - LINKS
-	LINKS [[<target>] [<mask>]
+	LINKS [[<target>] <mask>]
 	.
 	List all servers currently registered in the network matching <mask>,
 	or all servers if <mask> has been omitted, as seen by the server
@@ -617,9 +617,10 @@ Channel Commands
 	 - RFC 2812, 3.2.8 "Kick command"
 - LIST
-	LIST [<channel>[,<channel>[,...]] [<server>]]
+	LIST [<mask>[,<mask>[,...]] [<server>]]
 	.
-	List all visible <channels> (comma-separated list).
+	List all visible channels matching the <mask> (comma-separated list),
 	or all channels when no <mask> was specified.
 	.
 	If <server> is given, the command will be forwarded to <server> for
 	evaluation.
@@ -882,7 +883,7 @@ Server Protocol Commands
 - ERROR
 	ERROR [<message> [<> [...]]]
 	.
-	Inform a client or a server about an error condition. The first 
+	Inform a client or a server about an error condition. The first
 	parameter, if given, is logged by the server receiving the message,
 	all other parameters are silently ignored.
 	.
--- a/doc/HowToRelease.txt
+++ b/doc/HowToRelease.txt
@@ -1,9 +1,8 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-                        (c)2001-2010 Alexander Barton,
+               (c)2001-2020 Alexander Barton and Contributors.
                    alex@barton.de, http://www.barton.de/
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
@@ -36,13 +35,20 @@ up-to-date (e.g. using ./autogen.sh) before generating the archives!
 II. How to prepare a new ngIRCd release?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-a) Make sure the source tree is in a releasable state ;-)
+a) Make sure you have working versions of GNU autoconf and GNU automake
    - is the AUTHORS file up to date?
 b) Make sure you have working versions of GNU autoconf and GNU automake
   installed on the system you use for generating the release:
-   as of October 2010 we are using GNU autoconf 2.67 and GNU automake 1.11.1
+   as of May 2020 we are using GNU autoconf 2.69 and GNU automake 1.11.6
   which seem to work just fine.
   NOTE: new releases of GNU automake DO NOT work, as they lack support for
   the "ansi2knr" wrapper and "de-ANSI-fication" support!
 b) Make sure the source tree is in a releasable state ;-)
    - Are all branches & patches merged? Check GitHub issues, pull requests
      and milestones!
    - Run as many tests as you can!
    - Is the AUTHORS file up to date? This command may be helpful:
      "( grep '>$' AUTHORS; git shortlog -se | cut -c8- ) | grep -Ev \
       '(alex@barton.de|fw@strlen.de)' | LC_ALL=de_DE.UTF-8 sort -u"
 c) Update the files describing the new release:
    - ChangeLog
@@ -66,15 +72,16 @@ h) Run "./autogen.sh" to update the ./configure script with the correct
 i) Run "./configure" to rebuild all generated Makefiles.
-j) Run "make distcheck" to generate the distribution archives.
+j) Run "make distcheck" (and "make dist-tarZ dist-xz") to generate all of the
   distribution archives.
 k) Sign the distribution archive(s) using GnuPG: "gpg -b <archivefile>"
 l) Upload and distribute the newly generated ngIRCd release archive(s)
-   and GnuPG signatures.
+   and GnuPG signatures (to the website, its mirrors, and GitHub).
-m) Write an announcement to the mailing list, freshmeat, Twitter, ...
+m) Update the ngIRCd website and its mirrors!
-n) Update the list of releases in our bug tracker.
+n) Write an announcement to the mailing list, Twitter, ...
 o) Relax :-)
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -1,6 +1,6 @@
 #
 # ngIRCd -- The Next Generation IRC Daemon
-# Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors
+# Copyright (c)2001-2020 Alexander Barton (alex@barton.de) and Contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -39,7 +39,7 @@ doc_templates = sample-ngircd.conf.tmpl
 generated_docs = sample-ngircd.conf
-toplevel_docs = ../AUTHORS ../COPYING ../ChangeLog ../INSTALL ../NEWS ../README
+toplevel_docs = ../AUTHORS ../COPYING ../ChangeLog ../INSTALL.md ../NEWS ../README.md
 SUBDIRS = src
@@ -55,7 +55,7 @@ all: $(generated_docs)
 install-data-hook: $(static_docs) $(toplevel_docs) $(generated_docs)
 	$(MKDIR_P) -m 755 $(DESTDIR)$(sysconfdir)
 	@if [ ! -f $(DESTDIR)$(sysconfdir)/ngircd.conf ]; then \
-	  make install-config; \
+	  ${MAKE} install-config; \
 	 fi
 	$(MKDIR_P) -m 755 $(DESTDIR)$(docdir)
 	for f in $(static_docs) $(toplevel_docs); do \
@@ -75,7 +75,7 @@ install-config:
 uninstall-hook:
 	rm -rf $(DESTDIR)$(docdir)
 	@if cmp --silent sample-ngircd.conf $(DESTDIR)$(sysconfdir)/ngircd.conf; then \
-	  make uninstall-config; \
+	  ${MAKE} uninstall-config; \
 	 else \
 	  echo; \
 	  echo " ** NOTE: Not uninstalling changed configuration file:"; \
@@ -87,7 +87,7 @@ uninstall-config:
 	rm -f $(DESTDIR)$(sysconfdir)/ngircd.conf
 srcdoc:
-	make -C src srcdoc
+	${MAKE} -C src srcdoc
 .PHONY: install-config uninstall-config srcdoc
--- a/doc/Modes.txt
+++ b/doc/Modes.txt
@@ -75,13 +75,17 @@ channel of which he is a member.
  mode	since	description
-  q	20	User is channel owner can only be set by a service, other
+  q	20	User is channel owner. This mode can only be set by an IRC
-		owner and irc op. Can promote other users to q, a, o, h, v.
+		service, other owner or IRC operator. Channel owners can
-  a	20	User is channel admin and can promote other users to v, h, o
+		promote other users to all levels: q, a, o, h, v. Prefix: "~".
  a	20	User is channel admin and can promote other users to v, h, o.
 		Prefix: "&".
  o	0.2.0	User is channel operator and can op/kick/... other members.
 		Prefix: "@".
  h	20	User is half op and can set channel modes imntvIbek and kick
-		voiced and normal users.
+		voiced and normal users. Prefix: "%".
  v	0.2.0	User is "voiced" and can speak even if channel is moderated.
 		Prefix: "+".
 Notes
--- a/doc/PAM.txt
+++ b/doc/PAM.txt
@@ -26,6 +26,10 @@ A very simple -- and quite useless ;-) -- example would be:
 Here the "pam_debug" module will be called each time a client connects to
 the ngIRCd and has sent its PASS, NICK, and USER commands.
 The PAM library used by the ngIRCd daemon must be able to access its
 configuration file, so don't forget to check permissions and run something
 like this: "chmod 644 /etc/pam.d/ngircd".
 Please note ONE VERY IMPORTANT THING:
 All the PAM modules are executed with the privileges of the user ngIRCd
--- a/doc/Platforms.txt
+++ b/doc/Platforms.txt
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-               (c)2001-2013 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
@@ -32,6 +32,7 @@ armv6l/unk./linux-gnueabihf gcc 4.6.3    21~rc2     13-10-26 pi       Y Y Y Y 5
 armv7l/unk./linux-gnueabi   gcc 4.4.3    19.1       12-04-29 goetz    Y Y Y Y 5
 armv7l/unk./linux-gnueabihf gcc 4.6.3    22~rc1-3   14-10-10 alex     Y Y Y Y 5
 armv7l/unk./linux-gnueabihf gcc 4.8.2    21.1       14-07-15 goetz    Y Y Y Y 5
 armv7l/unk./linux-gnueabihf gcc 4.9.2    23         16-01-10 alex     Y Y Y Y 5
 hppa/unknown/openbsd3.5     gcc 2.95.3   CVSHEAD    04-05-25 alex     Y Y Y Y
 hppa/unknown/openbsd5.4     gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y y Y 3
 hppa1.1/unknown/linux-gnu   gcc 3.3.3    0.8.0      04-05-30 alex     Y Y Y Y
@@ -40,45 +41,51 @@ hppa2.0w-hp-hpux11.11       gcc 4.2.3    14.1       09-07-22 goetz    Y Y Y Y
 i386/apple/darwin9.7.0      gcc 4.0.1    14.1       09-08-04 alex     Y Y Y Y 3
 i386/apple/darwin10.8.0     gcc 4.2.1    19         12-02-26 alex     Y Y Y Y 3
 i386/apple/darwin11.3.0     gcc 4.2.1    19         12-02-26 alex     Y Y Y Y 3
 i386/pc/linux-gnu           gcc 4.1.2    13~rc1     08-12-05 alex     Y Y Y Y 1
 i386/pc/linux-gnu           gcc 4.4.5    22~rc1-3   14-10-10 alex     Y Y Y Y 1
 i386/pc/minix               clang 3.4    23         16-01-06 goetz    Y Y N Y
 i386/pc/solaris2.9          gcc 3.2.2    CVSHEAD    04-02-24 alex     Y Y Y Y
-i386/pc/solaris2.11         gcc 4.5.2    21~rc2     13-10-27 alex     Y Y N Y 4
+i386/pc/solaris2.11         gcc 4.8.2    24         17-01-21 goetz    Y Y Y Y 4
 i386/unknown/freebsd5.2.1   gcc 3.3.3    0.8.0      04-05-30 alex     Y Y Y Y
 i386/unknown/freebsd6.2     gcc 3.4.6    20~rc1     12-11-13 alex     Y Y Y Y 3
-i386/unknown/freebsd7.3     gcc 4.2.1    20~rc1     12-11-13 alex     Y Y Y Y 3
+i386/unknown/freebsd7.3     gcc 4.2.1    24~rc1-7   17-01-20 alex     Y Y Y Y 3
 i686/pc/minix               gcc 4.4.6    21~rc2     13-10-27 alex     Y Y N N
 i686/unknown/gnu0.3         gcc 4.4.5    19         12-02-29 alex     Y Y Y Y
 i686/unknown/gnu0.5         gcc 4.9.1    22~rc1-3   14-10-11 alex     Y Y Y Y
 i686/unkn./kfreebsd7.2-gnu  gcc 4.3.4    15         09-12-02 alex     Y Y Y Y 3
 i386/unknown/netbsdelf1.5.2 egcs-1.1.2   21         13-11-25 goetz    Y Y N Y
 i386/unknown/netbsdelf1.6.2 gcc 2.95.3   18         11-07-10 goetz    Y Y Y Y
 i386/unknown/netbsdelf3.0.1 gcc 3.3.3    0.10.0-p1  06-08-30 alex     Y Y Y Y 3
-i386/unknown/netbsdelf4.0   gcc 4.1.2    19         12-02-29 alex     Y Y Y Y 3
+i386/unknown/netbsdelf4.0   gcc 4.1.2    24~rc1-7   17-01-20 alex     Y Y Y Y 3
 i386/unknown/netbsdelf5.0.2 gcc 4.1.3    19         12-02-26 alex     Y Y Y Y 3
-i386/unknown/openbsd3.5     gcc 2.95.3   21         13-11-17 goetz    Y Y Y Y 3
+i386/unknown/openbsd3.5     gcc 2.95.3   23         15-11-27 goetz    Y Y y Y 3
 i386/unknown/openbsd3.9     gcc 3.3.5    0.10.0-p1  06-08-30 alex     Y Y Y Y 3
 i386/unknown/openbsd4.1     gcc 3.3.5    16         10-04-11 alex     Y Y Y Y 3
 i386/unknown/openbsd5.3     gcc 4.2.1    21         13-11-28 goetz    Y Y Y Y 3
 i386/unknown/openbsd5.4     gcc 4.2.1    21         13-11-28 goetz    Y Y Y Y 3
 i586/pc/haiku               gcc 2.95.3   19.2~138   12-10-11 user     Y Y N N
-i586/pc/interix3.5          gcc 3.3      19         12-02-29 alex     Y Y N Y
+i586/pc/interix3.5          gcc 3.3      23         16-01-29 alex     Y Y N Y
-i686/pc/cygwin              gcc 4.8.3    22~rc1-3   14-10-10 alex     Y Y N Y
+i686/pc/cygwin              gcc 4.9.3    23         16-01-06 alex     Y Y Y Y
-i686/pc/linux-gnu           gcc 2.7.2    21~38      14-01-06 goetz    Y Y Y Y 1
+i686/pc/linux-gnu           gcc 2.6.3    23         16-01-06 goetz    Y Y y Y 1
 i686/pc/linux-gnu           gcc 2.7.2.1  23         15-11-30 goetz    Y Y N Y 1
 i686/pc/linux-gnu           gcc 2.95.2   23         15-12-23 goetz    Y Y Y Y 1
 i686/pc/linux-gnu           gcc 2.95.4   0.8.0      04-05-30 alex     Y Y Y Y 1
 i686/pc/linux-gnu           gcc 3.3.5    14.1       09-08-04 alex     Y Y Y Y 1
 i386/pc/linux-gnu           gcc 4.1.2    13~rc1     08-12-05 alex     Y Y Y Y 1
 i386/pc/linux-gnu           gcc 4.4.5    22~rc1-3   14-10-10 alex     Y Y Y Y 1
 i686/pc/linux-gnu           gcc 4.3.2    14.1       09-08-04 alex     Y Y Y Y 1
 i686/pc/minix               gcc 4.4.6    21~rc2     13-10-27 alex     Y Y N N
 i686/unknown/gnu0.3         gcc 4.4.5    19         12-02-29 alex     Y Y Y Y
 i686/unknown/gnu0.5         gcc 4.9.1    22~rc1-3   14-10-11 alex     Y Y Y Y
 i686/unkn./kfreebsd7.2-gnu  gcc 4.3.4    15         09-12-02 alex     Y Y Y Y 3
 m68k/apple/aux3.0.1         gcc 2.7.2    17         10-11-07 alex     Y Y N Y
 m68k/apple/aux3.0.1         Orig. A/UX   17         10-11-07 alex     Y Y N Y 2
 m68k/apple/aux3.1.1         gcc 2.7.2    19         12-02-26 alex     Y Y N Y
 m68k/apple/aux3.1.1         Orig. A/UX   19         12-02-26 alex     Y Y N Y 2
 m68k/hp/hp-ux9.10           Orig. HPUX   0.7.x-CVS  03-04-30 goetz    Y Y Y Y
 m88k/dg/dgux5.4R3.10        gcc 2.5.8    CVSHEAD    04-03-15 alex     Y Y ? ?
 mips/sgi/irix6.5            SGI          25         19-12-29 goetz    Y Y ? ?
 mipsel/openwrt/linux-uclibc gcc 4.8      24~9-g619a 18-01-28 goetz    - - - Y 6
 mipsel/unknown/linux-gnu    gcc 4.1.2    18         11-07-05 goetz    Y Y N Y 1
 mipsel/unknown/linux-gnu    gcc 4.4.5    21         13-11-24 goetz    Y Y Y Y 1
 mipsel/unknown/netbsd8.0    gcc 5.5.0    25         19-08-09 root     Y Y y Y 3
 powerpc/apple/darwin6.8     gcc 3.1      21         14-01-03 goetz    Y Y Y Y
 powerpc/apple/darwin7.9.0   gcc 3.3      22         15-03-22 goetz    Y Y Y Y 3
-powerpc/apple/darwin8.11.0  gcc 4.0.1    18         11-07-02 goetz    Y Y Y Y 3
+powerpc/apple/darwin8.11.0  gcc 4.0.1    25         19-11-24 goetz    Y Y Y Y 3
 powerpc/apple/darwin9.8.0   gcc 4.0.1    21         14-01-04 goetz    Y Y Y Y 3
 powerpc/unknown/linux-gnu   gcc 3.3.3    0.8.0      04-05-30 alex     Y Y Y Y
 powerpc/unknown/openbsd3.6  gcc 2.95.3   0.10.0     06-10-08 alex     Y Y N Y
@@ -90,21 +97,32 @@ x86_64/apple/darwin10.8.0   gcc 4.2.1    21~rc2     13-10-30 alex     Y Y Y Y 3
 x86_64/apple/darwin12.3.0   gcc 4.2.1    20.2       13-04-01 alex     Y Y Y Y 3
 x86_64/apple/darwin13.0.0   A-clang 5.0  21         14-01-02 alex     Y Y Y Y 3
 x86_64/apple/darwin14.5.0   A-clang 6.1  23~rc1     15-09-06 alex     Y Y Y Y 3
 x86_64/apple/darwin15.6.0   A-clang 8.0  23~38-g455 16-11-04 alex     Y Y Y Y 3
 x86_64/apple/darwin16.5.0   A-clang 8.1  25~rc1-7-g 18-11-04 alex     Y Y Y Y 3
 x86_64/apple/darwin17.7.0   A-clang 10.0 25~rc1     18-11-04 alex     Y Y Y Y 3
 x86_64/apple/darwin18.2.0   A-clang 10.0 25~rc1-11  19-01-23 alex     Y Y Y Y 3
 x86_64/apple/darwin19.0.0   A-clang 11.0 25~19-g928 19-12-07 alex     Y Y Y Y 3
 x86_64/unknown/dragonfly3.4 gcc 4.7.2    21         13-11-12 goetz    Y Y N Y 3
 x86_64/unknown/freebsd8.4   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y y Y 3
 x86_64/unknown/freebsd9.2   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
 x86_64/unknown/freebsd10.0  F-clang 3.3  22~rc1-3   14-10-10 alex     Y Y Y Y 3
 x86_64/unkn./freebsd8.1-gnu gcc 4.4.5    19         12-02-26 alex     Y Y Y Y 3
 x86_64/unknown/freebsd8.4   gcc 4.2.1    24~rc1-7   17-01-20 alex     Y Y Y Y 3
 x86_64/unknown/freebsd9.2   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
 x86_64/unknown/freebsd10.3  F-clang 3.4  24         17-01-20 goetz    Y Y Y Y 3
 x86_64/unknown/freebsd11.0  F-clang 3.8  24         17-01-21 goetz    Y Y Y Y 3
 x86_64/unknown/haiku        gcc 7.3.0    25~rc1-11  19-01-06 alex     Y Y N Y
 x86_64/unknown/linux-gnu    clang 3.3    21         14-01-07 alex     Y Y Y Y 1
 x86_64/unknown/linux-gnu    clang 3.4    22~rc1-3   14-10-11 alex     Y Y Y Y 1
-x86_64/unknown/linux-gnu    gcc 4.4.5    23~rc1-3   15-11-15 alex     Y Y Y Y 1
+x86_64/pc/linux-gnu         gcc 4.4.5    24~rc1-7   17-01-20 alex     Y Y Y Y 1
 x86_64/unknown/linux-gnu    gcc 4.7.2    23~rc1-3   15-11-15 alex     Y Y Y Y 1
-x86_64/unknown/linux-gnu    gcc 4.8.2    21         13-12-29 alex     Y Y Y Y 1
+x86_64/pc/linux-gnu         gcc 4.8.4    24~rc1-7   17-01-20 alex     Y Y Y Y 1
-x86_64/unknown/linux-gnu    gcc 4.9.2    23~rc1-3   15-11-15 alex     Y Y Y Y 1
+x86_64/pc/linux-gnu         gcc 4.9.2    24~rc1-7   17-01-20 alex     Y Y Y Y 1
 x86_64/unknown/linux-gnu    gcc 5.3.0    23         15-12-14 goetz    Y Y Y Y 1
 x86_64/pc/linux-gnu [WSL]   gcc 5.4.0    24         18-03-07 goetz    Y Y y Y 7
 x86_64/pc/linux-gnu         gcc 6.2.1    24~rc1-7   17-01-20 alex     Y Y Y Y 1
 x86_64/pc/linux-gnu         gcc 6.3.0    25~rc1-11  19-01-23 alex     Y Y Y Y 1
 x86_64/unknown/linux-gnu    icc 16       23         16-01-13 goetz    Y Y Y Y 1
 x86_64/unknown/linux-gnu    nwcc 0.8.2   21         13-12-01 goetz    Y Y Y Y 1
 x86_64/unknown/linux-gnu    Open64       21.1       14-03-27 goetz    Y Y Y Y 1
 x86_64/unknown/linux-gnu    Sun C 5.12   21.1       14-03-27 goetz    Y Y Y Y 1
 x86_64/unknown/linux-gnu    tcc 0.9.25   21.1       14-03-27 goetz    Y Y Y Y 1
 x86_64/unknown/openbsd4.7   gcc 3.3.5    20~rc1     12-02-26 alex     Y Y Y Y 3
 x86_64/unknown/openbsd4.8   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y y Y 3
 x86_64/unknown/openbsd5.1   gcc 4.2.1    21         13-12-28 alex     Y Y Y Y 3
@@ -115,14 +133,15 @@ x86_64/unknown/openbsd5.5   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
 ~~~~~~~
 (1) */*/linux-gnu (Linux platforms):
-    ngIRCd has been tested with various Linux distributions, such as SuSE,
+    ngIRCd has been tested with various Linux distributions, such as ArchLinux,
-    RedHat, Debian, and Gentoo using Kernels 2.2.x, 2.4.x and 2.6.x with
+    Debian, Gentoo, Red Hat (Fedora) and SuSE using Linux kernels 2.2.x, 2.4.x,
-    various versions of the GNU C compiler (starting with 2.95.x and up to
+    2.6.x, 3.x, and 4.x, with various versions of the GNU C compiler (starting
-    version 4.3.x). The eldest glibc used was glibc-2.0.7. ngIRCd compiled
+    with 2.95.x) and Clang. The eldest glibc used was glibc-2.0.7.
-    and run on all these systems without problems.
+    ngIRCd compiled and ran on all of these systems successfully.
-    Actual Linux kernels (2.6.x) and glibc's support the epoll() IO interface.
+    Current Linux kernels (starting with 2.6.x) and glibc's support the more
    efficient epoll() IO interface, see (5) below.
-(2) This compiler is an pre-ANSI C compiler, therefore the source code is
+(2) This compiler is a pre-ANSI C compiler (K&R), therefore the source code is
    automatically converted using the included ansi2knr tool while building.
 (3) Using the kqueue() IO interface.
@@ -130,3 +149,9 @@ x86_64/unknown/openbsd5.5   gcc 4.2.1    22~rc1-3   14-10-10 alex     Y Y Y Y 3
 (4) Using the /dev/poll IO interface.
 (5) Using the epoll() IO interface.
 (6) ngIRCd has been cross-compiled with gcc 4.8 on Ubuntu x86-64 for
    MIPSEL Linux OpenWRT distribution (uclibc), for the target computer
    Vocore2, where the created binary ran well.
 (7) This actually is Windows 10 running Windows Subsystem for Linux (WSL).
--- a/doc/Protocol.txt
+++ b/doc/Protocol.txt
@@ -2,7 +2,7 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-               (c)2001-2012 Alexander Barton and Contributors.
+               (c)2001-2019 Alexander Barton and Contributors.
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
@@ -26,6 +26,12 @@ clients are compatible with a server configured that way, some can't even
 connect at all! Therefore this option usually isn't desired for "normal
 server operation".
 In addition, ngIRCd implements some "IRCv3" features. This includes:
 - IRCv3 Client Capability Negotiation
 - IRCv3.1 multi-prefix Extension
 - IRCv3.2 userhost-in-names Extension
 Please see the IRCv3 homepage for more information: <https://ircv3.net>.
 II. The IRC+ Protocol
 ~~~~~~~~~~~~~~~~~~~~~
@@ -176,7 +182,7 @@ channel mode). In this case <limit> should be "0".
 II.4 Update webchat/proxy client information
     Command: WEBIRC
-  Parameters: <password> <username> <hostname> <ip-address>
+  Parameters: <password> <username> <hostname> <ip-address> [<ignored>]
     Used by: unregistered clients only
 The WEBIRC command is used by some Web-to-IRC gateways to set the correct
@@ -186,6 +192,9 @@ first command sent to the server, even before USER and NICK commands!
 The <password> must be set in the server configuration file to prevent
 unauthorized clients to fake their identity; it is an arbitrary string.
 Optionally, a 5th parameter is accepted to comply with an IRCv3 extension,
 see <https://github.com/ircv3/ircv3-ideas/issues/12>, but ignored.
 II.5 Client character encoding conversion
--- a/doc/RFC.txt
+++ b/doc/RFC.txt
@@ -1,9 +1,8 @@
                     ngIRCd - Next Generation IRC Server
                           http://ngircd.barton.de/
-                      (c)2001-2003 by Alexander Barton,
+               (c)2001-2017 Alexander Barton and Contributors.
                    alex@barton.de, http://www.barton.de/
               ngIRCd is free software and published under the
                   terms of the GNU General Public License.
@@ -11,7 +10,8 @@
 The Internet Relay Chat (IRC) protocol is documented in these Request for
-Comments (RFC), which you can get e.g. via <http://www.faqs.org/>:
+Comments (RFCs), which you can get via <http://www.faqs.org/rfcs/> or
 <https://www.ietf.org/rfc.html> for example.
  1459	Oikarinen, J. & D. Reed, "Internet Relay Chat Protocol",
 	May 1993, [IRC].
@@ -28,6 +28,5 @@ Comments (RFC), which you can get e.g. via <http://www.faqs.org/>:
  2813	Kalt, C., "Internet Relay Chat: Server Protocol",
 	April 2000, [IRC-SERVER].
-
+  7194	Hartmann, R., "Default Port for Internet Relay Chat (IRC) via TLS/SSL",
-- 
+	August 2014.
 $Id: RFC.txt,v 1.6 2003/03/07 20:42:20 alex Exp $
--- a/doc/Services.txt
+++ b/doc/Services.txt
@@ -34,6 +34,10 @@ services instead of regular IRC users.
 Example:
  [GLOBAL]
     Name = server.irc.net
     Ports = 6667
  [SERVER]
     Name = services.irc.net
     MyPassword = 123abc
@@ -104,6 +108,10 @@ The following settings need to be in atheme.conf:
  loadmodule "modules/protocol/ngircd";
  serverinfo {
 	name = "services.irc.net";
  }
  uplink "server.irc.net" {
 	password = "123abc";
 	port = 6667;
--- a/doc/sample-ngircd.conf.tmpl
+++ b/doc/sample-ngircd.conf.tmpl
@@ -51,7 +51,7 @@
 	# be shown to all users connecting to the server:
 	;MotdFile = :ETCDIR:/ngircd.motd
-	# A simple Phrase (<256 chars) if you don't want to use a motd file.
+	# A simple Phrase (<127 chars) if you don't want to use a motd file.
 	;MotdPhrase = "Hello world!"
 	# The name of the IRC network to which this server belongs. This name
@@ -117,6 +117,12 @@
 	# maximum nickname length!
 	;MaxNickLength = 9
 	# Maximum penalty time increase in seconds, per penalty event. Set to -1
 	# for no limit (the default), 0 to disable penalties altogether. The
 	# daemon doesn't use penalty increases higher than 2 seconds during
 	# normal operation, so values greater than 1 rarely make sense.
 	;MaxPenaltyTime = -1
 	# Maximum number of channels returned in response to a /list
 	# command (0: unlimited):
 	;MaxListSize = 100
@@ -226,6 +232,15 @@
 	# character prepended to their respective user names!
 	;PAMIsOptional = no
 	# When PAM is enabled, this value determines the used PAM
 	# configuration.
 	# This setting allows to run multiple ngIRCd instances with
 	# different PAM configurations on each instance.
 	# If you set it to "ngircd-foo", PAM will use
 	# /etc/pam.d/ngircd-foo instead of the default
 	# /etc/pam.d/ngircd.
 	;PAMServiceName = ngircd
 	# Let ngIRCd send an "authentication PING" when a new client connects,
 	# and register this client only after receiving the corresponding
 	# "PONG" reply.
@@ -294,7 +309,7 @@
 [Server]
 	# Other servers are configured in [Server] sections. If you
 	# configure a port for the connection, then this ngircd tries to
-	# connect to to the other server on the given port; if not it waits
+	# connect to the other server on the given port; if not it waits
 	# for the other server to connect.
 	# There may be more than one server block, one for each server.
 	#
@@ -370,19 +385,16 @@
 	# Topic for this channel
 	;Topic = a great topic
-	# Initial channel modes
+	# Initial channel modes, as used in "MODE" commands. Modifying lists
-	;Modes = tnk
+	# (ban list, invite list, exception list) is supported.
-
+	# This option can be specified multiple times, evaluated top to bottom.
-	# initial channel password (mode k)
+	;Modes = +tnk mykey +l 5
-	;Key = Secret
+	;Modes = +b nick!~user@bad.host.example.com
 	# Key file, syntax for each line: "<user>:<nick>:<key>".
 	# Default: none.
 	;KeyFile = :ETCDIR:/#chan.key
 	# maximum users per channel (mode l)
 	;MaxUsers = 23
 [Channel]
 	# More [Channel] sections, if you like ...
--- a/man/ngircd.8.tmpl
+++ b/man/ngircd.8.tmpl
@@ -1,7 +1,7 @@
 .\"
 .\" ngircd(8) manual page template
 .\"
-.TH ngircd 8 "Oct 2013" ngIRCd "ngIRCd Manual"
+.TH ngircd 8 "May 2020" ngIRCd "ngIRCd Manual"
 .SH NAME
 ngIRCd \- the "next generation" IRC daemon
 .SH SYNOPSIS
--- a/man/ngircd.conf.5.tmpl
+++ b/man/ngircd.conf.5.tmpl
@@ -1,7 +1,7 @@
 .\"
 .\" ngircd.conf(5) manual page template
 .\"
-.TH ngircd.conf 5 "Oct 2014" ngIRCd "ngIRCd Manual"
+.TH ngircd.conf 5 "May 2020" ngIRCd "ngIRCd Manual"
 .SH NAME
 ngircd.conf \- configuration file of ngIRCd
 .SH SYNOPSIS
@@ -83,7 +83,7 @@ blocks are used to configure pre-defined ("persistent") IRC channels.
 .PP
 There can be more than one [Operator], [Server] and [Channel] section per
 configuration file, one for each operator, server, and channel. [Global],
-[Limits], [Options], and [SSL] sections can occure multiple times, too, but
+[Limits], [Options], and [SSL] sections can occur multiple times, too, but
 each variable overwrites itself, only the last assignment is relevant.
 .SH [GLOBAL]
 The
@@ -125,7 +125,7 @@ take effect when ngircd starts up or is instructed to re-read its
 configuration file.
 .TP
 \fBMotdPhrase\fR (string)
-A simple Phrase (<256 chars) if you don't want to use a MOTD file.
+A simple Phrase (<127 chars) if you don't want to use a MOTD file.
 .TP
 \fBNetwork\fR (string)
 The name of the IRC network to which this server belongs. This name is
@@ -201,6 +201,12 @@ Maximum length of an user nickname (Default: 9, as in RFC 2812). Please
 note that all servers in an IRC network MUST use the same maximum nickname
 length!
 .TP
 \fBMaxPenaltyTime\fR (number)
 Maximum penalty time increase in seconds, per penalty event. Set to -1 for no
 limit (the default), 0 to disable penalties altogether. ngIRCd doesn't use
 penalty increases higher than 2 seconds during normal operation, so values
 greater than 1 rarely make sense.
 .TP
 \fBMaxListSize\fR (number)
 Maximum number of channels returned in response to a LIST command. Default: 100.
 .TP
@@ -339,6 +345,14 @@ able to distinguish between Ident'ified and PAM-authenticated users: both
 don't have a "~" character prepended to their respective user names!
 Default: no.
 .TP
 \fBPAMServiceName\fR (string)
 When PAM is enabled, this value determines the used PAM configuration.
 This setting allows running multiple ngIRCd instances with different
 PAM configurations on each instance. If you set it to "ngircd-foo",
 PAM will use /etc/pam.d/ngircd-foo instead of the default
 /etc/pam.d/ngircd.
 Default: ngircd.
 .TP
 \fBRequireAuthPing\fR (boolean)
 Let ngIRCd send an "authentication PING" when a new client connects, and
 register this client only after receiving the corresponding "PONG" reply.
@@ -418,7 +432,7 @@ Example: nick!ident@*.example.com
 Other servers are configured in
 .I [Server]
 sections. If you configure a port for the connection, then this ngIRCd
-tries to connect to to the other server on the given port (active);
+tries to connect to the other server on the given port (active);
 if not, it waits for the other server to connect (passive).
 .PP
 ngIRCd supports "server groups": You can assign an "ID" to every server
@@ -496,10 +510,12 @@ Name of the channel, including channel prefix ("#" or "&").
 Topic for this channel.
 .TP
 \fBModes\fR (string)
-Initial channel modes.
+Initial channel modes, as used in "MODE" commands. Modifying lists (ban list,
-.TP
+invite list, exception list) is supported.
-\fBKey\fR (string)
+.PP
-Sets initial channel key (only relevant if channel mode "k" is set).
+.RS
 This option can be specified multiple times, evaluated top to bottom.
 .RE
 .TP
 \fBKeyFile\fR (string)
 Path and file name of a "key file" containing individual channel keys for
@@ -543,10 +559,6 @@ The file is not reopened on each access, so you can modify and overwrite it
 without problems, but moving or deleting the file will have not effect until
 the daemon re-reads its configuration!
 .RE
 .TP
 \fBMaxUsers\fR (number)
 Set maximum user limit for this channel (only relevant if channel mode "l"
 is set).
 .SH HINTS
 It's wise to use "ngircd \-\-configtest" to validate the configuration file
 after changing it. See
--- a/src/ngircd/channel.c
+++ b/src/ngircd/channel.c
@@ -36,6 +36,8 @@
 #include "log.h"
 #include "messages.h"
 #include "match.h"
 #include "parse.h"
 #include "irc-mode.h"
 #define REMOVE_PART 0
 #define REMOVE_QUIT 1
@@ -93,9 +95,11 @@ GLOBAL void
 Channel_InitPredefined( void )
 {
 	CHANNEL *new_chan;
 	REQUEST Req;
 	const struct Conf_Channel *conf_chan;
-	const char *c;
+	char *c;
-	size_t i, channel_count = array_length(&Conf_Channels, sizeof(*conf_chan));
+	char modes[COMMAND_LEN], name[CHANNEL_NAME_LEN];
 	size_t i, n, channel_count = array_length(&Conf_Channels, sizeof(*conf_chan));
 	conf_chan = array_start(&Conf_Channels);
@@ -126,21 +130,61 @@ Channel_InitPredefined( void )
 							conf_chan->name);
 			continue;
 		}
 		Log(LOG_INFO, "Created pre-defined channel \"%s\".",
 						conf_chan->name);
 		Channel_ModeAdd(new_chan, 'P');
 		if (conf_chan->topic[0])
 			Channel_SetTopic(new_chan, NULL, conf_chan->topic);
-		c = conf_chan->modes;
+		/* Evaluate modes strings with fake requests */
-		while (*c)
+		if (conf_chan->modes_num) {
-			Channel_ModeAdd(new_chan, *c++);
+			/* Prepare fake request structure */
 			strlcpy(name, conf_chan->name, sizeof(name));
 			Log(LOG_INFO, "Evaluating predefined channel modes for \"%s\".", name);
 			Req.argv[0] = name;
 			Req.prefix = Client_ID(Client_ThisServer());
 			Req.command = "MODE";
 			/* Iterate over channel modes strings */
 			for (n = 0; n < conf_chan->modes_num; n++) {
 				Req.argc = 1;
 				strlcpy(modes, conf_chan->modes[n], sizeof(modes));
 				Log(LOG_DEBUG, "Evaluate \"MODE %s %s\".", name, modes);
 				c = strtok(modes, " ");
 				while (c && Req.argc < 15) {
 					Req.argv[Req.argc++] = c;
 					c = strtok(0, " ");
 				}
 				if (Req.argc > 1) {
 					/* Handling of legacy "Key" and "MaxUsers" settings:
 					 * Enforce setting the respective mode(s), to support
 					 * the legacy "Mode = kl" notation, which was valid but
 					 * is an invalid MODE string: key and limit are missing!
 					 * So set them manually when "k" or "l" are detected in
 					 * the first MODE parameter ... */
 					if (Req.argc > 1 && strchr(Req.argv[1], 'k')) {
 						Channel_SetKey(new_chan, conf_chan->key);
 						Channel_ModeAdd(new_chan, 'k');
 					}
 					if (strchr(Req.argv[1], 'l')) {
 						Channel_SetMaxUsers(new_chan, conf_chan->maxusers);
 						Channel_ModeAdd(new_chan, 'l');
 					}
 					IRC_MODE(Client_ThisServer(), &Req);
 				}
 				/* Original channel modes srings are no longer needed */
 				free(conf_chan->modes[n]);
 			}
 		}
 		Channel_SetKey(new_chan, conf_chan->key);
 		Channel_SetMaxUsers(new_chan, conf_chan->maxusers);
 		Set_KeyFile(new_chan, conf_chan->keyfile);
 		Log(LOG_INFO,
 		    "Created pre-defined channel \"%s\", mode \"%s\" (key \"%s\", limit %d).",
 		    new_chan->name, new_chan->modes, new_chan->key,
 		    new_chan->maxusers);
 	}
 	if (channel_count)
 		array_free(&Conf_Channels);
--- a/src/ngircd/client.c
+++ b/src/ngircd/client.c
@@ -337,7 +337,11 @@ Client_SetHostname( CLIENT *Client, const char *Hostname )
 	assert(Client != NULL);
 	assert(Hostname != NULL);
-	if (Conf_CloakHost[0]) {
+	/* Only cloak the hostmask if it has not yet been cloaked.
 	 * The period or colon indicates it's still an IP address.
 	 * An empty string means a rDNS lookup did not happen (yet). */
 	if (Conf_CloakHost[0] && (!Client->host[0] || strchr(Client->host, '.')
 				  || strchr(Client->host, ':'))) {
 		char cloak[GETID_LEN];
 		strlcpy(cloak, Hostname, GETID_LEN);
--- a/src/ngircd/conf-ssl.h
+++ b/src/ngircd/conf-ssl.h
@@ -13,6 +13,10 @@
 #ifdef HAVE_LIBSSL
 #define SSL_SUPPORT
 #include <openssl/ssl.h>
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 #define OpenSSL_version SSLeay_version
 #define OPENSSL_VERSION SSLEAY_VERSION
 #endif
 #endif
 #ifdef HAVE_LIBGNUTLS
 #define SSL_SUPPORT
@@ -36,6 +40,7 @@ struct ConnSSL_State {
 	gnutls_session_t gnutls_session;
 	void *cookie;		/* pointer to server configuration structure
 				   (for outgoing connections), or NULL. */
 	size_t x509_cred_idx;	/* index of active x509 credential record */
 #endif
 	char *fingerprint;
 };
--- a/src/ngircd/conf.c
+++ b/src/ngircd/conf.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2019 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -328,7 +328,7 @@ Conf_Test( void )
 {
 	struct passwd *pwd;
 	struct group *grp;
-	unsigned int i;
+	unsigned int i, j;
 	bool config_valid;
 	size_t predef_channel_count;
 	struct Conf_Channel *predef_chan;
@@ -388,6 +388,7 @@ Conf_Test( void )
 	printf("  MaxConnectionsIP = %d\n", Conf_MaxConnectionsIP);
 	printf("  MaxJoins = %d\n", Conf_MaxJoins > 0 ? Conf_MaxJoins : -1);
 	printf("  MaxNickLength = %u\n", Conf_MaxNickLength - 1);
 	printf("  MaxPenaltyTime = %ld\n", Conf_MaxPenaltyTime);
 	printf("  MaxListSize = %d\n", Conf_MaxListSize);
 	printf("  PingTimeout = %d\n", Conf_PingTimeout);
 	printf("  PongTimeout = %d\n", Conf_PongTimeout);
@@ -419,6 +420,7 @@ Conf_Test( void )
 #ifdef PAM
 	printf("  PAM = %s\n", yesno_to_str(Conf_PAM));
 	printf("  PAMIsOptional = %s\n", yesno_to_str(Conf_PAMIsOptional));
 	printf("  PAMServiceName = %s\n", Conf_PAMServiceName);
 #endif
 #ifndef STRICT_RFC
 	printf("  RequireAuthPing = %s\n", yesno_to_str(Conf_AuthPing));
@@ -481,7 +483,8 @@ Conf_Test( void )
 		/* Valid "Channel" section */
 		puts( "[CHANNEL]" );
 		printf("  Name = %s\n", predef_chan->name);
-		printf("  Modes = %s\n", predef_chan->modes);
+		for(j = 0; j < predef_chan->modes_num; j++)
 			printf("  Modes = %s\n", predef_chan->modes[j]);
 		printf("  Key = %s\n", predef_chan->key);
 		printf("  MaxUsers = %lu\n", predef_chan->maxusers);
 		printf("  Topic = %s\n", predef_chan->topic);
@@ -710,7 +713,6 @@ Conf_NickIsService(int ConfServer, const char *Nick)
 /**
 * Check if the given nickname is blocked for "normal client" use.
 *
 * @param ConfServer The server index or NONE to check all configured servers.
 * @param Nick The nickname to check.
 * @returns true if the given nickname belongs to an "IRC service".
 */
@@ -765,6 +767,7 @@ Set_Defaults(bool InitServers)
 	Conf_MaxConnectionsIP = 5;
 	Conf_MaxJoins = 10;
 	Conf_MaxNickLength = CLIENT_NICK_LEN_DEFAULT;
 	Conf_MaxPenaltyTime = -1;
 	Conf_MaxListSize = 100;
 	Conf_PingTimeout = 120;
 	Conf_PongTimeout = 20;
@@ -807,6 +810,7 @@ Set_Defaults(bool InitServers)
 	Conf_PAM = false;
 #endif
 	Conf_PAMIsOptional = false;
 	strcpy(Conf_PAMServiceName, "ngircd");
 	Conf_ScrubCTCP = false;
 #ifdef SYSLOG
 #ifdef LOG_LOCAL5
@@ -843,13 +847,13 @@ no_listenports(void)
 *
 * This function is used to read the MOTD and help text file, for example.
 *
- * @param filename	Name of the file to read.
+ * @param Filename	Name of the file to read.
 * @return		true, when the file has been read in.
 */
 static bool
 Read_TextFile(const char *Filename, const char *Name, array *Destination)
 {
-	char line[127];
+	char line[COMMAND_LEN];
 	FILE *fp;
 	int line_no = 1;
@@ -885,9 +889,9 @@ Read_TextFile(const char *Filename, const char *Name, array *Destination)
 * Please note that this function uses exit(1) on fatal errors and therefore
 * can result in ngIRCd terminating!
 *
- * @param ngircd_starting	Flag indicating if ngIRCd is starting or not.
+ * @param IsStarting	Flag indicating if ngIRCd is starting or not.
- * @returns			true when the configuration file has been read
+ * @returns		true when the configuration file has been read
- *				successfully; false otherwise.
+ *			successfully; false otherwise.
 */
 static bool
 Read_Config(bool TestOnly, bool IsStarting)
@@ -899,6 +903,8 @@ Read_Config(bool TestOnly, bool IsStarting)
 	FILE *fd;
 	DIR *dh;
 	Config_Error(LOG_INFO, "Using configuration file \"%s\" ...", NGIRCd_ConfFile);
 	/* Open configuration file */
 	fd = fopen( NGIRCd_ConfFile, "r" );
 	if( ! fd ) {
@@ -1284,116 +1290,6 @@ WarnPAM(const char UNUSED *File, int UNUSED Line)
 #endif
 }
 /**
 * Handle legacy "NoXXX" options in [GLOBAL] section.
 *
 * TODO: This function and support for "NoXXX" could be removed starting
 * with ngIRCd release 19 (one release after marking it "deprecated").
 *
 * @param Var	Variable name.
 * @param Arg	Argument string.
 * @returns	true if a NoXXX option has been processed; false otherwise.
 */
 static bool
 CheckLegacyNoOption(const char *Var, const char *Arg)
 {
 	if(strcasecmp(Var, "NoDNS") == 0) {
 		Conf_DNS = !Check_ArgIsTrue( Arg );
 		return true;
 	}
 	if (strcasecmp(Var, "NoIdent") == 0) {
 		Conf_Ident = !Check_ArgIsTrue(Arg);
 		return true;
 	}
 	if(strcasecmp(Var, "NoPAM") == 0) {
 		Conf_PAM = !Check_ArgIsTrue(Arg);
 		return true;
 	}
 	return false;
 }
 /**
 * Handle deprecated legacy options in [GLOBAL] section.
 *
 * TODO: This function and support for these options in the [Global] section
 * could be removed starting with ngIRCd release 19 (one release after
 * marking it "deprecated").
 *
 * @param Var	Variable name.
 * @param Arg	Argument string.
 * @returns	true if a legacy option has been processed; false otherwise.
 */
 static const char*
 CheckLegacyGlobalOption(const char *File, int Line, char *Var, char *Arg)
 {
 	if (strcasecmp(Var, "AllowRemoteOper") == 0
 	    || strcasecmp(Var, "ChrootDir") == 0
 	    || strcasecmp(Var, "ConnectIPv4") == 0
 	    || strcasecmp(Var, "ConnectIPv6") == 0
 	    || strcasecmp(Var, "OperCanUseMode") == 0
 	    || strcasecmp(Var, "OperChanPAutoOp") == 0
 	    || strcasecmp(Var, "OperServerMode") == 0
 	    || strcasecmp(Var, "PredefChannelsOnly") == 0
 	    || strcasecmp(Var, "SyslogFacility") == 0
 	    || strcasecmp(Var, "WebircPassword") == 0) {
 		Handle_OPTIONS(File, Line, Var, Arg);
 		return "[Options]";
 	}
 	if (strcasecmp(Var, "ConnectRetry") == 0
 	    || strcasecmp(Var, "IdleTimeout") == 0
 	    || strcasecmp(Var, "MaxConnections") == 0
 	    || strcasecmp(Var, "MaxConnectionsIP") == 0
 	    || strcasecmp(Var, "MaxJoins") == 0
 	    || strcasecmp(Var, "MaxNickLength") == 0
 	    || strcasecmp(Var, "PingTimeout") == 0
 	    || strcasecmp(Var, "PongTimeout") == 0) {
 		Handle_LIMITS(File, Line, Var, Arg);
 		return "[Limits]";
 	}
 #ifdef SSL_SUPPORT
 	if (strcasecmp(Var, "SSLCertFile") == 0
 	    || strcasecmp(Var, "SSLDHFile") == 0
 	    || strcasecmp(Var, "SSLKeyFile") == 0
 	    || strcasecmp(Var, "SSLKeyFilePassword") == 0
 	    || strcasecmp(Var, "SSLPorts") == 0) {
 		Handle_SSL(File, Line, Var + 3, Arg);
 		return "[SSL]";
 	}
 #endif
 	return NULL;
 }
 /**
 * Strip "no" prefix of a string.
 *
 * TODO: This function and support for "NoXXX" should be removed starting
 * with ngIRCd release 19! (One release after marking it "deprecated").
 *
 * @param str	Pointer to input string starting with "no".
 * @returns	New pointer to string without "no" prefix.
 */
 static const char *
 NoNo(const char *str)
 {
 	assert(strncasecmp("no", str, 2) == 0 && str[2]);
 	return str + 2;
 }
 /**
 * Invert "boolean" string.
 *
 * TODO: This function and support for "NoXXX" should be removed starting
 * with ngIRCd release 19! (One release after marking it "deprecated").
 *
 * @param arg	"Boolean" input string.
 * @returns	Pointer to inverted "boolean string".
 */
 static const char *
 InvertArg(const char *arg)
 {
 	return yesno_to_str(!Check_ArgIsTrue(arg));
 }
 /**
 * Handle variable in [Global] configuration section.
@@ -1408,7 +1304,6 @@ Handle_GLOBAL(const char *File, int Line, char *Var, char *Arg )
 	struct passwd *pwd;
 	struct group *grp;
 	size_t len;
 	const char *section;
 	char *ptr;
 	assert(File != NULL);
@@ -1548,36 +1443,6 @@ Handle_GLOBAL(const char *File, int Line, char *Var, char *Arg )
 		return;
 	}
 	if (CheckLegacyNoOption(Var, Arg)) {
 		/* TODO: This function and support for "NoXXX" could be
 		 * be removed starting with ngIRCd release 19 (one release
 		 * after marking it "deprecated"). */
 		Config_Error(LOG_WARNING,
 			     "%s, line %d (section \"Global\"): \"No\"-Prefix is deprecated, use \"%s = %s\" in [Options] section!",
 			     File, Line, NoNo(Var), InvertArg(Arg));
 		if (strcasecmp(Var, "NoIdent") == 0)
 			WarnIdent(File, Line);
 		else if (strcasecmp(Var, "NoPam") == 0)
 			WarnPAM(File, Line);
 		return;
 	}
 	if ((section = CheckLegacyGlobalOption(File, Line, Var, Arg))) {
 		/** TODO: This function and support for these options in the
 		 * [Global] section could be removed starting with ngIRCd
 		 * release 19 (one release after marking it "deprecated"). */
 		if (strncasecmp(Var, "SSL", 3) == 0) {
 			Config_Error(LOG_WARNING,
 				     "%s, line %d (section \"Global\"): \"%s\" is deprecated here, move it to %s and rename to \"%s\"!",
 				     File, Line, Var, section,
 				     Var + 3);
 		} else {
 			Config_Error(LOG_WARNING,
 				     "%s, line %d (section \"Global\"): \"%s\" is deprecated here, move it to %s!",
 				     File, Line, Var, section);
 		}
 		return;
 	}
 	Config_Error_Section(File, Line, Var, "Global");
 }
@@ -1640,6 +1505,12 @@ Handle_LIMITS(const char *File, int Line, char *Var, char *Arg)
 			Config_Error_NaN(File, Line, Var);
 		return;
 	}
 	if (strcasecmp(Var, "MaxPenaltyTime") == 0) {
 		Conf_MaxPenaltyTime = atol(Arg);
 		if (Conf_MaxPenaltyTime < -1)
 			Conf_MaxPenaltyTime = -1;	/* "unlimited" */
 		return;
 	}
 	if (strcasecmp(Var, "PingTimeout") == 0) {
 		Conf_PingTimeout = atoi(Arg);
 		if (Conf_PingTimeout < 5) {
@@ -1796,18 +1667,6 @@ Handle_OPTIONS(const char *File, int Line, char *Var, char *Arg)
 		Conf_MorePrivacy = Check_ArgIsTrue(Arg);
 		return;
 	}
 	if (strcasecmp(Var, "NoticeAuth") == 0) {
 		/*
 		 * TODO: This section and support for "NoticeAuth" variable
 		 * could be removed starting with ngIRCd release 24 (one
 		 * release after marking it "deprecated") ...
 		 */
 		Config_Error(LOG_WARNING,
 			     "%s, line %d (section \"Options\"): \"%s\" is deprecated, please use \"NoticeBeforeRegistration\"!",
 			     File, Line, Var);
 		Conf_NoticeBeforeRegistration = Check_ArgIsTrue(Arg);
 		return;
 	}
 	if (strcasecmp(Var, "NoticeBeforeRegistration") == 0) {
 		Conf_NoticeBeforeRegistration = Check_ArgIsTrue(Arg);
 		return;
@@ -1833,20 +1692,10 @@ Handle_OPTIONS(const char *File, int Line, char *Var, char *Arg)
 		Conf_PAMIsOptional = Check_ArgIsTrue(Arg);
 		return;
 	}
-	if (strcasecmp(Var, "PredefChannelsOnly") == 0) {
+	if (strcasecmp(Var, "PAMServiceName") == 0) {
-		/*
+		len = strlcpy(Conf_PAMServiceName, Arg, sizeof(Conf_PAMServiceName));
-		 * TODO: This section and support for "PredefChannelsOnly"
+		if (len >= sizeof(Conf_PAMServiceName))
-		 * could be removed starting with ngIRCd release 22 (one
+			Config_Error_TooLong(File, Line, Var);
 		 * release after marking it "deprecated") ...
 		 */
 		Config_Error(LOG_WARNING,
 			     "%s, line %d (section \"Options\"): \"%s\" is deprecated, please use \"AllowedChannelTypes\"!",
 			     File, Line, Var);
 		if (Check_ArgIsTrue(Arg))
 			Conf_AllowedChannelTypes[0] = '\0';
 		else
 			strlcpy(Conf_AllowedChannelTypes, CHANTYPES,
 				sizeof(Conf_AllowedChannelTypes));
 		return;
 	}
 #ifndef STRICT_RFC
@@ -2138,8 +1987,12 @@ Handle_CHANNEL(const char *File, int Line, char *Var, char *Arg)
 	}
 	if (strcasecmp(Var, "Modes") == 0) {
 		/* Initial modes */
-		len = strlcpy(chan->modes, Arg, sizeof(chan->modes));
+		if(chan->modes_num >= sizeof(chan->modes)) {
-		if (len >= sizeof(chan->modes))
+			Config_Error(LOG_ERR, "Too many Modes, option ignored.");
 			return;
 		}
 		chan->modes[chan->modes_num++] = strndup(Arg, COMMAND_LEN);
 		if(strlen(Arg) >= COMMAND_LEN)
 			Config_Error_TooLong(File, Line, Var);
 		return;
 	}
@@ -2155,6 +2008,9 @@ Handle_CHANNEL(const char *File, int Line, char *Var, char *Arg)
 		len = strlcpy(chan->key, Arg, sizeof(chan->key));
 		if (len >= sizeof(chan->key))
 			Config_Error_TooLong(File, Line, Var);
 		Config_Error(LOG_WARNING,
 			     "%s, line %d (section \"Channel\"): \"%s\" is deprecated here, use \"Modes = +k <key>\"!",
 			     File, Line, Var);
 		return;
 	}
 	if( strcasecmp( Var, "MaxUsers" ) == 0 ) {
@@ -2162,6 +2018,9 @@ Handle_CHANNEL(const char *File, int Line, char *Var, char *Arg)
 		chan->maxusers = (unsigned long) atol(Arg);
 		if (!chan->maxusers && strcmp(Arg, "0"))
 			Config_Error_NaN(File, Line, Var);
 		Config_Error(LOG_WARNING,
 			     "%s, line %d (section \"Channel\"): \"%s\" is deprecated here, use \"Modes = +l <limit>\"!",
 			     File, Line, Var);
 		return;
 	}
 	if (strcasecmp(Var, "KeyFile") == 0) {
@@ -2217,7 +2076,8 @@ Validate_Config(bool Configtest, bool Rehash)
 		break;
 	} while (*(++ptr));
-	if (!Conf_ServerName[0]) {
+	if (!Conf_ServerName[0] || !strchr(Conf_ServerName, '.'))
 	{
 		/* No server name configured! */
 		config_valid = false;
 		Config_Error(LOG_ALERT,
@@ -2231,20 +2091,6 @@ Validate_Config(bool Configtest, bool Rehash)
 		}
 	}
 	if (Conf_ServerName[0] && !strchr(Conf_ServerName, '.')) {
 		/* No dot in server name! */
 		config_valid = false;
 		Config_Error(LOG_ALERT,
 			     "Invalid server name configured in \"%s\" (section 'Global': 'Name'): Dot missing!",
 			     NGIRCd_ConfFile);
 		if (!Configtest) {
 			Config_Error(LOG_ALERT,
 				     "%s exiting due to fatal errors!",
 				     PACKAGE_NAME);
 			exit(1);
 		}
 	}
 #ifdef STRICT_RFC
 	if (!Conf_ServerAdminMail[0]) {
 		/* No administrative contact configured! */
@@ -2274,6 +2120,11 @@ Validate_Config(bool Configtest, bool Rehash)
 			     "This server uses PAM, \"Password\" in [Global] section will be ignored!");
 #endif
 	if (Conf_MaxPenaltyTime != -1)
 		Config_Error(LOG_WARNING,
 			     "Maximum penalty increase ('MaxPenaltyTime') is set to %ld, this is not recommended!",
 			     Conf_MaxPenaltyTime);
 #ifdef DEBUG
 	servers = servers_once = 0;
 	for (i = 0; i < MAX_SERVERS; i++) {
--- a/src/ngircd/conf.h
+++ b/src/ngircd/conf.h
@@ -29,7 +29,7 @@
 /**
 * Configured IRC operator.
- * Please note the the name of the IRC operaor and his nick have nothing to
+ * Please note that the name of the IRC operaor and his nick have nothing to
 * do with each other! The IRC operator is only identified by the name and
 * password configured in this structure.
 */
@@ -83,11 +83,12 @@ struct SSLOptions {
 /** Pre-defined channels */
 struct Conf_Channel {
 	char name[CHANNEL_NAME_LEN];	/**< Name of the channel */
-	char modes[CHANNEL_MODE_LEN];	/**< Initial channel modes */
+	char *modes[512];		/**< Initial channel modes to evaluate */
 	char key[CLIENT_PASS_LEN];      /**< Channel key ("password", mode "k" ) */
 	char topic[COMMAND_LEN];	/**< Initial topic */
 	char keyfile[512];		/**< Path and name of channel key file */
 	unsigned long maxusers;		/**< User limit for this channel, mode "l" */
 	unsigned int modes_num;		/**< Number of channel modes to evaluate */
 };
@@ -203,6 +204,9 @@ GLOBAL bool Conf_PAM;
 /** Don't require all clients to send a password an to be PAM authenticated */
 GLOBAL bool Conf_PAMIsOptional;
 /** The service name to use for PAM */
 GLOBAL char Conf_PAMServiceName[MAX_PAM_SERVICE_NAME_LEN];
 /** Disable all CTCP commands except for /me ? */
 GLOBAL bool Conf_ScrubCTCP;
@@ -236,6 +240,9 @@ GLOBAL unsigned int Conf_MaxNickLength;
 /** Maximum number of channels returned to /list */
 GLOBAL int Conf_MaxListSize;
 /** Maximium seconds to add per "penalty". -1 = unlimited. */
 GLOBAL time_t Conf_MaxPenaltyTime;
 #ifndef STRICT_RFC
 /** Require "AUTH PING-PONG" on login */
--- a/src/ngircd/conn-func.c
+++ b/src/ngircd/conn-func.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -26,6 +26,7 @@
 #endif
 #include "conn.h"
 #include "conf.h"
 #include "conn-func.h"
 /**
@@ -50,7 +51,7 @@ GLOBAL void
 Conn_UpdatePing(CONN_ID Idx)
 {
 	assert(Idx > NONE);
-	My_Connections[Idx].lastping = time(NULL);
+	My_Connections[Idx].lastping = My_Connections[Idx].lastdata = time(NULL);
 }
 /*
@@ -85,7 +86,7 @@ Conn_LastPing( CONN_ID Idx )
 * is read. This function only increases the penalty, it is not possible to
 * decrease the penalty time.
 *
- * @param Idex Connection index.
+ * @param Idx Connection index.
 * @param Seconds Seconds to add.
 * @see Conn_ResetPenalty
 */
@@ -97,6 +98,14 @@ Conn_SetPenalty(CONN_ID Idx, time_t Seconds)
 	assert(Idx > NONE);
 	assert(Seconds >= 0);
 	/* Limit new penalty to maximum configured, when less than 10 seconds. *
 	   The latter is used to limit brute force attacks, therefore we don't *
 	   want to limit that! */
 	if (Conf_MaxPenaltyTime >= 0
 	    && Seconds > Conf_MaxPenaltyTime
 	    && Seconds < 10)
 		Seconds = Conf_MaxPenaltyTime;
 	t = time(NULL);
 	if (My_Connections[Idx].delaytime < t)
 		My_Connections[Idx].delaytime = t;
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -42,6 +42,7 @@ extern struct SSLOptions Conf_SSLOptions;
 #ifdef HAVE_LIBSSL
 #include <openssl/err.h>
 #include <openssl/rand.h>
 #include <openssl/dh.h>
 static SSL_CTX * ssl_ctx;
 static DH *dh_params;
@@ -61,9 +62,17 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c ));
 #define MAX_HASH_SIZE	64	/* from gnutls-int.h */
-static gnutls_certificate_credentials_t x509_cred;
+typedef struct {
 	int refcnt;
 	gnutls_certificate_credentials_t x509_cred;
 	gnutls_dh_params_t dh_params;
 } x509_cred_slot;
 static array x509_creds = INIT_ARRAY;
 static size_t x509_cred_idx;
 static gnutls_dh_params_t dh_params;
-static gnutls_priority_t priorities_cache;
+static gnutls_priority_t priorities_cache = NULL;
 static bool ConnSSL_LoadServerKey_gnutls PARAMS(( void ));
 #endif
@@ -265,6 +274,21 @@ void ConnSSL_Free(CONNECTION *c)
 		gnutls_bye(sess, GNUTLS_SHUT_RDWR);
 		gnutls_deinit(sess);
 	}
 	x509_cred_slot *slot = array_get(&x509_creds, sizeof(x509_cred_slot), c->ssl_state.x509_cred_idx);
 	assert(slot != NULL);
 	assert(slot->refcnt > 0);
 	assert(slot->x509_cred != NULL);
 	slot->refcnt--;
 	if ((c->ssl_state.x509_cred_idx != x509_cred_idx) && (slot->refcnt <= 0)) {
 		Log(LOG_INFO, "Discarding X509 certificate credentials from slot %zd.",
 		    c->ssl_state.x509_cred_idx);
 		gnutls_certificate_free_keys(slot->x509_cred);
 		gnutls_certificate_free_credentials(slot->x509_cred);
 		slot->x509_cred = NULL;
 		gnutls_dh_params_deinit(slot->dh_params);
 		slot->dh_params = NULL;
 		slot->refcnt = 0;
 	}
 #endif
 	assert(Conn_OPTION_ISSET(c, CONN_SSL));
 	/* can't just set bitmask to 0 -- there are other, non-ssl related flags, e.g. CONN_ZIP. */
@@ -283,10 +307,12 @@ ConnSSL_InitLibrary( void )
 #ifdef HAVE_LIBSSL
 	SSL_CTX *newctx;
 #if OPENSSL_API_COMPAT < 0x10100000L
 	if (!ssl_ctx) {
 		SSL_library_init();
 		SSL_load_error_strings();
 	}
 #endif
 	if (!RAND_status()) {
 		Log(LOG_ERR, "OpenSSL PRNG not seeded: /dev/urandom missing?");
@@ -308,8 +334,18 @@ ConnSSL_InitLibrary( void )
 		return false;
 	}
-	if (!ConnSSL_LoadServerKey_openssl(newctx))
+	if (!ConnSSL_LoadServerKey_openssl(newctx)) {
 		/* Failed to read new key but an old ssl context
 		 * already exists -> reuse old context */
 		if (ssl_ctx) {
 		        SSL_CTX_free(newctx);
 	                Log(LOG_WARNING,
 			"Re-Initializing of SSL failed, using old keys!");
 			return true;
 		}
 		/* No preexisting old context -> error. */
 		goto out;
 	}
 	if (SSL_CTX_set_cipher_list(newctx, Conf_SSLOptions.CipherList) == 0) {
 		Log(LOG_ERR, "Failed to apply OpenSSL cipher list \"%s\"!",
@@ -324,7 +360,7 @@ ConnSSL_InitLibrary( void )
 			   Verify_openssl);
 	SSL_CTX_free(ssl_ctx);
 	ssl_ctx = newctx;
-	Log(LOG_INFO, "%s initialized.", SSLeay_version(SSLEAY_VERSION));
+	Log(LOG_INFO, "%s initialized.", OpenSSL_version(OPENSSL_VERSION));
 	return true;
 out:
 	SSL_CTX_free(newctx);
@@ -335,22 +371,21 @@ out:
 	int err;
 	static bool initialized;
-	if (initialized) {
+	if (!initialized) {
-		/* TODO: cannot reload gnutls keys: can't simply free x509
+		err = gnutls_global_init();
-		 * context -- it may still be in use */
+		if (err) {
-		return false;
+			Log(LOG_ERR, "Failed to initialize GnuTLS: %s",
-	}
+			    gnutls_strerror(err));
-
+			goto out;
-	err = gnutls_global_init();
+		}
 	if (err) {
 		Log(LOG_ERR, "Failed to initialize GnuTLS: %s",
 		    gnutls_strerror(err));
 		goto out;
 	}
 	if (!ConnSSL_LoadServerKey_gnutls())
 		goto out;
 	if (priorities_cache != NULL) {
 		gnutls_priority_deinit(priorities_cache);
 	}
 	if (gnutls_priority_init(&priorities_cache, Conf_SSLOptions.CipherList,
 				 NULL) != GNUTLS_E_SUCCESS) {
 		Log(LOG_ERR,
@@ -376,6 +411,9 @@ ConnSSL_LoadServerKey_gnutls(void)
 	int err;
 	const char *cert_file;
 	x509_cred_slot *slot = NULL;
 	gnutls_certificate_credentials_t x509_cred;
 	err = gnutls_certificate_allocate_credentials(&x509_cred);
 	if (err < 0) {
 		Log(LOG_ERR, "Failed to allocate certificate credentials: %s",
@@ -406,6 +444,43 @@ ConnSSL_LoadServerKey_gnutls(void)
 		    gnutls_strerror(err));
 		return false;
 	}
 	/* Free currently active x509 context (if any) unless it is still in use */
 	slot = array_get(&x509_creds, sizeof(x509_cred_slot), x509_cred_idx);
 	if ((slot != NULL) && (slot->refcnt <= 0) && (slot->x509_cred != NULL)) {
 		Log(LOG_INFO, "Discarding X509 certificate credentials from slot %zd.", x509_cred_idx);
 		gnutls_certificate_free_keys(slot->x509_cred);
 		gnutls_certificate_free_credentials(slot->x509_cred);
 		slot->x509_cred = NULL;
 		gnutls_dh_params_deinit(slot->dh_params);
 		slot->dh_params = NULL;
 		slot->refcnt = 0;
 	}
 	/* Find free slot */
 	x509_cred_idx = (size_t) -1;
 	size_t i;
 	for (slot = array_start(&x509_creds), i = 0;
 	     i < array_length(&x509_creds, sizeof(x509_cred_slot));
 	     slot++, i++) {
 		if (slot->refcnt <= 0) {
 			x509_cred_idx = i;
 			break;
 		}
 	}
 	/* ... allocate new slot otherwise. */
 	if (x509_cred_idx == (size_t) -1) {
 		x509_cred_idx = array_length(&x509_creds, sizeof(x509_cred_slot));
 		slot = array_alloc(&x509_creds, sizeof(x509_cred_slot), x509_cred_idx);
 		if (slot == NULL) {
 			Log(LOG_ERR, "Failed to allocate new slot for certificate credentials");
 			return false;
 		}
 	}
 	Log(LOG_INFO, "Storing new X509 certificate credentials in slot %zd.", x509_cred_idx);
 	slot->x509_cred = x509_cred;
 	slot->refcnt = 0;
 	return true;
 }
 #endif
@@ -507,8 +582,13 @@ ConnSSL_Init_SSL(CONNECTION *c)
 				 (gnutls_transport_ptr_t) (long) c->sock);
 	gnutls_certificate_server_set_request(c->ssl_state.gnutls_session,
 					      GNUTLS_CERT_REQUEST);
 	Log(LOG_INFO, "Using X509 credentials from slot %zd", x509_cred_idx);
 	c->ssl_state.x509_cred_idx = x509_cred_idx;
 	x509_cred_slot *slot = array_get(&x509_creds, sizeof(x509_cred_slot), x509_cred_idx);
 	slot->refcnt++;
 	ret = gnutls_credentials_set(c->ssl_state.gnutls_session,
-				     GNUTLS_CRD_CERTIFICATE, x509_cred);
+				     GNUTLS_CRD_CERTIFICATE, slot->x509_cred);
 	if (ret != 0) {
 		Log(LOG_ERR, "Failed to set SSL credentials: %s",
 		    gnutls_strerror(ret));
--- a/src/ngircd/conn.c
+++ b/src/ngircd/conn.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2019 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -10,6 +10,7 @@
 */
 #define CONN_MODULE
 #define CONN_MODULE_GLOBAL_INIT
 #include "portab.h"
@@ -182,7 +183,6 @@ cb_connserver(int sock, UNUSED short what)
 	CONN_ID idx = Socket2Index( sock );
 	if (idx <= NONE) {
 		LogDebug("cb_connserver wants to write on unknown socket?!");
 		io_close(sock);
 		return;
 	}
@@ -280,12 +280,11 @@ cb_clientserver(int sock, short what)
 {
 	CONN_ID idx = Socket2Index(sock);
-	assert(idx >= 0);
+	if (idx <= NONE) {
 	if (idx < 0) {
 		io_close(sock);
 		return;
 	}
 #ifdef SSL_SUPPORT
 	if (what & IO_WANTREAD
 	    || (Conn_OPTION_ISSET(&My_Connections[idx], CONN_SSL_WANT_WRITE))) {
@@ -307,32 +306,20 @@ cb_clientserver(int sock, short what)
 GLOBAL void
 Conn_Init( void )
 {
-	CONN_ID i;
+	int size;
-	Pool_Size = CONNECTION_POOL;
+	/* Initialize the "connection pool".
-	if ((Conf_MaxConnections > 0) &&
+	 * FIXME: My_Connetions/Pool_Size is needed by other parts of the
-		(Pool_Size > Conf_MaxConnections))
+	 * code; remove them! */
-			Pool_Size = Conf_MaxConnections;
+	Pool_Size = 0;
-
+	size = Conf_MaxConnections > 0 ? Conf_MaxConnections : CONNECTION_POOL;
-	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)Pool_Size)) {
+	if (Socket2Index(size) <= NONE) {
-		Log(LOG_EMERG, "Can't allocate memory! [Conn_Init]");
+		Log(LOG_EMERG, "Failed to initialize connection pool!");
 		exit(1);
 	}
-	/* FIXME: My_Connetions/Pool_Size is needed by other parts of the
+	/* Initialize "listener" array. */
 	 * code; remove them! */
 	My_Connections = (CONNECTION*) array_start(&My_ConnArray);
 	LogDebug("Allocated connection pool for %d items (%ld bytes).",
 		array_length(&My_ConnArray, sizeof(CONNECTION)),
 		array_bytes(&My_ConnArray));
 	assert(array_length(&My_ConnArray, sizeof(CONNECTION)) >= (size_t)Pool_Size);
 	array_free( &My_Listeners );
 	for (i = 0; i < Pool_Size; i++)
 		Init_Conn_Struct(i);
 } /* Conn_Init */
 /**
@@ -570,8 +557,8 @@ InitSinaddrListenAddr(ng_ipaddr_t *addr, const char *listen_addrstr, UINT16 Port
 	if (!ret) {
 		assert(listen_addrstr);
 		Log(LOG_CRIT,
-		    "Can't bind to [%s]:%u: can't convert ip address \"%s\"!",
+		    "Can't listen on [%s]:%u: Failed to parse IP address!",
-		    listen_addrstr, Port, listen_addrstr);
+		    listen_addrstr, Port);
 	}
 	return ret;
 }
@@ -673,9 +660,14 @@ Conn_Handler(void)
 	size_t wdatalen;
 	struct timeval tv;
 	time_t t;
 	bool command_available;
 	Log(LOG_NOTICE, "Server \"%s\" (on \"%s\") ready.",
 	    Client_ID(Client_ThisServer()), Client_Hostname(Client_ThisServer()));
 	while (!NGIRCd_SignalQuit && !NGIRCd_SignalRestart) {
 		t = time(NULL);
 		command_available = false;
 		/* Check configured servers and established links */
 		Check_Servers();
@@ -744,16 +736,31 @@ Conn_Handler(void)
 				continue;
 			}
 			if (array_bytes(&My_Connections[i].rbuf) >= COMMAND_LEN) {
 				/* There is still more data in the read buffer
 				 * than a single valid command can get long:
 				 * so either there is a complete command, or
 				 * invalid data. Therefore don't try to read in
 				 * even more data from the network but wait for
 				 * this command(s) to be handled first! */
 				io_event_del(My_Connections[i].sock,
 					     IO_WANTREAD);
 				command_available = true;
 				continue;
 			}
 			io_event_add(My_Connections[i].sock, IO_WANTREAD);
 		}
-		/* Set the timeout for reading from the network to 1 second,
+		/* Don't wait for data when there is still at least one command
-		 * which is the granularity with witch we handle "penalty
+		 * available in a read buffer which can be handled immediately;
-		 * times" for example.
+		 * set the timeout for reading from the network to 1 second
 		 * otherwise, which is the granularity with witch we handle
 		 * "penalty times" for example.
 		 * Note: tv_sec/usec are undefined(!) after io_dispatch()
 		 * returns, so we have to set it before each call to it! */
 		tv.tv_usec = 0;
-		tv.tv_sec = 1;
+		tv.tv_sec = command_available ? 0 : 1;
 		/* Wait for activity ... */
 		i = io_dispatch(&tv);
@@ -1095,9 +1102,9 @@ Conn_Close(CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClien
 		 * the calculation of in_p and out_p: in_z_k and out_z_k
 		 * are non-zero, that's guaranteed by the protocol until
 		 * compression can be enabled. */
-		if (! in_z_k)
+		if (in_z_k <= 0)
 			in_z_k = in_k;
-		if (! out_z_k)
+		if (out_z_k <= 0)
 			out_z_k = out_k;
 		in_p = (int)(( in_k * 100 ) / in_z_k );
 		out_p = (int)(( out_k * 100 ) / out_z_k );
@@ -1282,6 +1289,9 @@ Handle_Write( CONN_ID Idx )
 		if (errno == EAGAIN || errno == EINTR)
 			return true;
 		/* Log write errors but do not close the connection yet.
 		 * Calling Conn_Close() now could result in too many recursive calls.
 		 */
 		if (!Conn_OPTION_ISSET(&My_Connections[Idx], CONN_ISCLOSING))
 			Log(LOG_ERR,
 			    "Write error on connection %d (socket %d): %s!",
@@ -1289,7 +1299,7 @@ Handle_Write( CONN_ID Idx )
 		else
 			LogDebug("Recursive write error on connection %d (socket %d): %s!",
 				 Idx, My_Connections[Idx].sock, strerror(errno));
-		Conn_Close(Idx, "Write error", NULL, false);
+
 		return false;
 	}
@@ -1378,8 +1388,8 @@ New_Connection(int Sock, UNUSED bool IsSSL)
 	/* Check global connection limit */
 	if ((Conf_MaxConnections > 0) &&
 	    (NumConnections >= (size_t) Conf_MaxConnections)) {
-		Log(LOG_ALERT, "Can't accept connection: limit (%d) reached!",
+		Log(LOG_ALERT, "Can't accept new connection on socket %d: Limit (%d) reached!",
-		    Conf_MaxConnections);
+		    Sock, Conf_MaxConnections);
 		Simple_Message(new_sock, "ERROR :Connection limit reached");
 		close(new_sock);
 		return -1;
@@ -1398,23 +1408,10 @@ New_Connection(int Sock, UNUSED bool IsSSL)
 		return -1;
 	}
-	if (new_sock >= Pool_Size) {
+	if (Socket2Index(new_sock) <= NONE) {
-		if (!array_alloc(&My_ConnArray, sizeof(CONNECTION),
+		Simple_Message(new_sock, "ERROR: Internal error");
-				 (size_t) new_sock)) {
+		close(new_sock);
-			Log(LOG_EMERG,
+		return -1;
 			    "Can't allocate memory! [New_Connection]");
 			Simple_Message(new_sock, "ERROR: Internal error");
 			close(new_sock);
 			return -1;
 		}
 		LogDebug("Bumped connection pool to %ld items (internal: %ld items, %ld bytes)",
 			 new_sock, array_length(&My_ConnArray,
 			 sizeof(CONNECTION)), array_bytes(&My_ConnArray));
 		/* Adjust pointer to new block */
 		My_Connections = array_start(&My_ConnArray);
 		while (Pool_Size <= new_sock)
 			Init_Conn_Struct(Pool_Size++);
 	}
 	/* register callback */
@@ -1523,24 +1520,38 @@ Account_Connection(void)
 } /* Account_Connection */
 /**
- * Translate socket handle into connection index.
+ * Translate socket handle into connection index (for historical reasons, it is
 * a 1:1 mapping today) and enlarge the "connection pool" accordingly.
 *
 * @param Sock	Socket handle.
- * @returns	Connecion index or NONE, if no connection could be found.
+ * @returns	Connecion index or NONE when the pool is too small.
 */
 static CONN_ID
 Socket2Index( int Sock )
 {
-	assert( Sock >= 0 );
+	assert(Sock > 0);
 	assert(Pool_Size >= 0);
-	if( Sock >= Pool_Size || My_Connections[Sock].sock != Sock ) {
+	if (Sock < Pool_Size)
-		/* the Connection was already closed again, likely due to
+		return Sock;
-		 * an error. */
+
-		LogDebug("Socket2Index: can't get connection for socket %d!", Sock);
+	/* Try to allocate more memory ... */
 	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)Sock)) {
 		Log(LOG_EMERG,
 		    "Can't allocate memory to enlarge connection pool!");
 		return NONE;
 	}
 	LogDebug("Enlarged connection pool for %ld sockets (%ld items, %ld bytes)",
 		 Sock, array_length(&My_ConnArray, sizeof(CONNECTION)),
 		 array_bytes(&My_ConnArray));
 	/* Adjust pointer to new block, update size and initialize new items. */
 	My_Connections = array_start(&My_ConnArray);
 	while (Pool_Size <= Sock)
 		Init_Conn_Struct(Pool_Size++);
 	return Sock;
-} /* Socket2Index */
+}
 /**
 * Read data from the network to the read buffer. If an error occurs,
@@ -1549,16 +1560,21 @@ Socket2Index( int Sock )
 * @param Idx	Connection index.
 */
 static void
-Read_Request( CONN_ID Idx )
+Read_Request(CONN_ID Idx)
 {
 	ssize_t len;
 	static const unsigned int maxbps = COMMAND_LEN / 2;
 	char readbuf[READBUFFER_LEN];
 	time_t t;
 	CLIENT *c;
 	assert( Idx > NONE );
 	assert( My_Connections[Idx].sock > NONE );
 	assert(Idx > NONE);
 	assert(My_Connections[Idx].sock > NONE);
 	/* Check if the read buffer is "full". Basically this shouldn't happen
 	 * here, because as long as there possibly are commands in the read
 	 * buffer (buffer usage > COMMAND_LEN), the socket shouldn't be
 	 * scheduled for reading in Conn_Handler() at all ... */
 #ifdef ZLIB
 	if ((array_bytes(&My_Connections[Idx].rbuf) >= READBUFFER_LEN) ||
 		(array_bytes(&My_Connections[Idx].zip.rbuf) >= READBUFFER_LEN))
@@ -1566,7 +1582,6 @@ Read_Request( CONN_ID Idx )
 	if (array_bytes(&My_Connections[Idx].rbuf) >= READBUFFER_LEN)
 #endif
 	{
 		/* Read buffer is full */
 		Log(LOG_ERR,
 		    "Receive buffer space exhausted (connection %d): %d/%d bytes",
 		    Idx, array_bytes(&My_Connections[Idx].rbuf), READBUFFER_LEN);
@@ -1574,12 +1589,14 @@ Read_Request( CONN_ID Idx )
 		return;
 	}
 	/* Now read new data from the network, up to READBUFFER_LEN bytes ... */
 #ifdef SSL_SUPPORT
 	if (Conn_OPTION_ISSET(&My_Connections[Idx], CONN_SSL))
-		len = ConnSSL_Read( &My_Connections[Idx], readbuf, sizeof(readbuf));
+		len = ConnSSL_Read(&My_Connections[Idx], readbuf, sizeof(readbuf));
 	else
 #endif
-	len = read(My_Connections[Idx].sock, readbuf, sizeof(readbuf));
+		len = read(My_Connections[Idx].sock, readbuf, sizeof(readbuf));
 	if (len == 0) {
 		LogDebug("Client \"%s:%u\" is closing connection %d ...",
 			 My_Connections[Idx].host,
@@ -1589,13 +1606,20 @@ Read_Request( CONN_ID Idx )
 	}
 	if (len < 0) {
-		if( errno == EAGAIN ) return;
+		if (errno == EAGAIN)
 			return;
 		Log(LOG_ERR, "Read error on connection %d (socket %d): %s!",
 		    Idx, My_Connections[Idx].sock, strerror(errno));
 		Conn_Close(Idx, "Read error", "Client closed connection",
 			   false);
 		return;
 	}
 	/* Now append the newly received data to the connection buffer.
 	 * NOTE: This can lead to connection read buffers being bigger(!) than
 	 * READBUFFER_LEN bytes, as we add up to READBUFFER_LEN new bytes to a
 	 * buffer possibly being "almost" READBUFFER_LEN bytes already! */
 #ifdef ZLIB
 	if (Conn_OPTION_ISSET(&My_Connections[Idx], CONN_ZIP)) {
 		if (!array_catb(&My_Connections[Idx].zip.rbuf, readbuf,
@@ -1931,8 +1955,11 @@ Check_Servers(void)
 		Conf_Server[i].lasttry = time_now;
 		Conf_Server[i].conn_id = SERVER_WAIT;
 		assert(Proc_GetPipeFd(&Conf_Server[i].res_stat) < 0);
-		Resolve_Name(&Conf_Server[i].res_stat, Conf_Server[i].host,
+
-			     cb_Connect_to_Server);
+		/* Start resolver subprocess ... */
 		if (!Resolve_Name(&Conf_Server[i].res_stat, Conf_Server[i].host,
 				  cb_Connect_to_Server))
 			Conf_Server[i].conn_id = NONE;
 	}
 } /* Check_Servers */
@@ -2007,10 +2034,7 @@ New_Server( int Server , ng_ipaddr_t *dest)
 		return;
 	}
-	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)new_sock)) {
+	if (Socket2Index(new_sock) <= NONE) {
 		Log(LOG_ALERT,
 		    "Cannot allocate memory for server connection (socket %d)",
 		    new_sock);
 		close( new_sock );
 		Conf_Server[Server].conn_id = NONE;
 		return;
@@ -2024,8 +2048,6 @@ New_Server( int Server , ng_ipaddr_t *dest)
 		return;
 	}
 	My_Connections = array_start(&My_ConnArray);
 	assert(My_Connections[new_sock].sock <= 0);
 	Init_Conn_Struct(new_sock);
@@ -2417,7 +2439,7 @@ Conn_GetFromProc(int fd)
 * @param Reason The reason, see THROTTLE_xxx constants.
 * @param Idx The connection index.
 * @param Client The client of this connection.
- * @param Seconds The time to delay this connection.
+ * @param Value The time to delay this connection.
 */
 static void
 Throttle_Connection(const CONN_ID Idx, CLIENT *Client, const int Reason,
@@ -2472,9 +2494,7 @@ cb_clientserver_ssl(int sock, UNUSED short what)
 {
 	CONN_ID idx = Socket2Index(sock);
-	assert(idx >= 0);
+	if (idx <= NONE) {
 	if (idx < 0) {
 		io_close(sock);
 		return;
 	}
@@ -2524,12 +2544,13 @@ cb_connserver_login_ssl(int sock, short unused)
 {
 	CONN_ID idx = Socket2Index(sock);
-	assert(idx >= 0);
+	(void) unused;
-	if (idx < 0) {
+
 	if (idx <= NONE) {
 		io_close(sock);
 		return;
 	}
-	(void) unused;
+
 	switch (ConnSSL_Connect( &My_Connections[idx])) {
 		case 1: break;
 		case 0: LogDebug("ConnSSL_Connect: not ready");
--- a/src/ngircd/conn.h
+++ b/src/ngircd/conn.h
@@ -105,9 +105,17 @@ typedef struct _Connection
 #endif
 } CONNECTION;
-GLOBAL CONNECTION *My_Connections;
+
-GLOBAL CONN_ID Pool_Size;
+#ifdef CONN_MODULE_GLOBAL_INIT
-GLOBAL long WCounter;
+CONNECTION *My_Connections;
 CONN_ID Pool_Size;
 long WCounter;
 #else
 extern CONNECTION *My_Connections;
 extern CONN_ID Pool_Size;
 extern long WCounter;
 #endif
 #define CONNECTION2ID(x) (long)(x - My_Connections)
--- a/src/ngircd/defines.h
+++ b/src/ngircd/defines.h
@@ -61,6 +61,9 @@
 /** Size of default connection pool. */
 #define CONNECTION_POOL 100
 /** Size of buffer for PAM service name. */
 #define MAX_PAM_SERVICE_NAME_LEN 64
 /* Hard-coded (default) options */
@@ -127,7 +130,7 @@
 #define CLIENT_MODE_LEN 21
 /** Max. length of server info texts (including NULL). */
-#define CLIENT_INFO_LEN 64
+#define CLIENT_INFO_LEN 128
 /** Max. length of away messages (including NULL). */
 #define CLIENT_AWAY_LEN 128
@@ -206,6 +209,9 @@
 /** Max. number of channel modes with arguments per MODE command. */
 #define MAX_HNDL_MODES_ARG 5
 /** Max. number of targets per PRIVMSG/NOTICE/... command. */
 #define MAX_HNDL_TARGETS 25
 /** Max. number of WHO replies. */
 #define MAX_RPL_WHO 25
--- a/src/ngircd/irc-channel.c
+++ b/src/ngircd/irc-channel.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -497,7 +497,7 @@ IRC_TOPIC( CLIENT *Client, REQUEST *Req )
 		topic_power = true;
 	if (Req->argc == 1) {
-		/* Request actual topic */
+		/* Request current topic */
 		topic = Channel_Topic(chan);
 		if (*topic) {
 			r = IRC_WriteStrClient(from, RPL_TOPIC_MSG,
@@ -532,8 +532,6 @@ IRC_TOPIC( CLIENT *Client, REQUEST *Req )
 						  Channel_Name(chan));
 	}
 	/* Set new topic */
 	Channel_SetTopic(chan, from, Req->argv[1]);
 	LogDebug("%s \"%s\" set topic on \"%s\": %s",
 		 Client_TypeText(from), Client_Mask(from), Channel_Name(chan),
 		 Req->argv[1][0] ? Req->argv[1] : "<none>");
@@ -545,9 +543,17 @@ IRC_TOPIC( CLIENT *Client, REQUEST *Req )
 	if (!Channel_IsLocal(chan))
 		IRC_WriteStrServersPrefix(Client, from, "TOPIC %s :%s",
 					  Req->argv[0], Req->argv[1]);
 	IRC_WriteStrChannelPrefix(Client, chan, from, false, "TOPIC %s :%s",
 				  Req->argv[0], Req->argv[1]);
 	/* Infrom local clients, but only when the topic really changed. */
 	if (strcmp(Req->argv[1], Channel_Topic(chan)) != 0)
 		IRC_WriteStrChannelPrefix(Client, chan, from, false,
 					    "TOPIC %s :%s", Req->argv[0],
 					    Req->argv[1]);
 	/* Update topic, setter, and timestamp. */
 	Channel_SetTopic(chan, from, Req->argv[1]);
 	/* Send confirmation when the local client is a user. */
 	if (Client_Type(Client) == CLIENT_USER)
 		return IRC_WriteStrClientPrefix(Client, Client, "TOPIC %s :%s",
 						Req->argv[0], Req->argv[1]);
--- a/src/ngircd/irc-info.c
+++ b/src/ngircd/irc-info.c
@@ -894,16 +894,16 @@ IRC_STATS( CLIENT *Client, REQUEST *Req )
 			list = Class_GetList(CLASS_GLINE);
 		else
 			list = Class_GetList(CLASS_KLINE);
-			list_item = Lists_GetFirst(list);
+		list_item = Lists_GetFirst(list);
-			while (list_item) {
+		while (list_item) {
-				if (!IRC_WriteStrClient(from, RPL_STATSXLINE_MSG,
+			if (!IRC_WriteStrClient(from, RPL_STATSXLINE_MSG,
 						Client_ID(from), query,
 						Lists_GetMask(list_item),
 						Lists_GetValidity(list_item),
 						Lists_GetReason(list_item)))
-					return DISCONNECTED;
+				return DISCONNECTED;
-				list_item = Lists_GetNext(list_item);
+			list_item = Lists_GetNext(list_item);
-			}
+		}
 		break;
 	case 'L':	/* Link status (servers and user links) */
 		if (!Op_Check(from, Req))
@@ -1565,7 +1565,8 @@ IRC_Send_ISUPPORT(CLIENT * Client)
 						   Conf_Network))
 		return DISCONNECTED;
 	if (!IRC_WriteStrClient(Client, RPL_ISUPPORT1_MSG, Client_ID(Client),
-				CHANTYPES, CHANTYPES, Conf_MaxJoins))
+				Conf_AllowedChannelTypes, Conf_AllowedChannelTypes,
 				Conf_MaxJoins))
 		return DISCONNECTED;
 	return IRC_WriteStrClient(Client, RPL_ISUPPORT2_MSG, Client_ID(Client),
 				  CHANNEL_NAME_LEN - 1, Conf_MaxNickLength - 1,
--- a/src/ngircd/irc-login.c
+++ b/src/ngircd/irc-login.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -89,7 +89,7 @@ IRC_PASS( CLIENT *Client, REQUEST *Req )
 	/* Protocol version */
 	if (Req->argc >= 2 && strlen(Req->argv[1]) >= 4) {
-		int c2, c4;
+		char c2, c4;
 		c2 = Req->argv[1][2];
 		c4 = Req->argv[1][4];
--- a/src/ngircd/irc-oper.c
+++ b/src/ngircd/irc-oper.c
@@ -47,7 +47,7 @@
 static bool
 Bad_OperPass(CLIENT *Client, char *errtoken, char *errmsg)
 {
-	Log(LOG_WARNING, "Got invalid OPER from \"%s\": \"%s\" -- %s!",
+	Log(LOG_ERR|LOG_snotice, "Got invalid OPER from \"%s\": \"%s\" -- %s!",
 	    Client_Mask(Client), errtoken, errmsg);
 	/* Increase penalty to slow down possible brute force attacks */
 	IRC_SetPenalty(Client, 10);
@@ -398,7 +398,16 @@ IRC_xLINE(CLIENT *Client, REQUEST *Req)
 		return IRC_WriteErrClient(Client, ERR_NEEDMOREPARAMS_MSG,
 					  Client_ID(Client), Req->command);
-	from = Op_Check(Client, Req);
+	if (!Conf_AllowRemoteOper && Client_Type(Client) == CLIENT_SERVER) {
 		/* Explicitely forbid remote servers to modify "x-lines" when
 		 * the "AllowRemoteOper" configuration option isn't set, even
 		 * when the command seems to originate from the remote server
 		 * itself: this prevents GLINE's to become set during server
 		 * handshake in this case (what wouldn't be possible during
 		 * regular runtime when a remote IRC Op sends the command). */
 		from = NULL;
 	} else
 		from = Op_Check(Client, Req);
 	if (!from)
 		return Op_NoPrivileges(Client, Req);
@@ -438,10 +447,11 @@ IRC_xLINE(CLIENT *Client, REQUEST *Req)
 		if (Class_AddMask(class, Req->argv[0],
 				  timeout,
 				  Req->argv[2])) {
-			Log(LOG_NOTICE|LOG_snotice,
+			if (Client_Type(from) != CLIENT_SERVER)
-			    "\"%s\" added \"%s\" to %c-Line list: \"%s\" (%ld seconds).",
+				Log(LOG_NOTICE|LOG_snotice,
-			    Client_Mask(from), Req->argv[0], class_c,
+				    "\"%s\" added \"%s\" to %c-Line list: \"%s\" (%ld seconds).",
-			    Req->argv[2], atol(Req->argv[1]));
+				    Client_Mask(from), Req->argv[0], class_c,
 				    Req->argv[2], atol(Req->argv[1]));
 			if (class == CLASS_GLINE) {
 				/* Inform other servers */
 				IRC_WriteStrServersPrefix(Client, from,
--- a/src/ngircd/irc-server.c
+++ b/src/ngircd/irc-server.c
@@ -31,6 +31,7 @@
 #include "parse.h"
 #include "numeric.h"
 #include "ngircd.h"
 #include "irc.h"
 #include "irc-info.h"
 #include "irc-write.h"
 #include "op.h"
@@ -245,66 +246,96 @@ IRC_NJOIN( CLIENT *Client, REQUEST *Req )
 	CHANNEL *chan;
 	CLIENT *c;
-	assert( Client != NULL );
+	assert(Client != NULL);
-	assert( Req != NULL );
+	assert(Req != NULL);
-	strlcpy( nick_in, Req->argv[1], sizeof( nick_in ));
+	strlcpy(nick_in, Req->argv[1], sizeof(nick_in));
-	strcpy( nick_out, "" );
+	strcpy(nick_out, "");
 	channame = Req->argv[0];
-	ptr = strtok( nick_in, "," );
+
-	while( ptr )
+	ptr = strtok(nick_in, ",");
-	{
+	while (ptr) {
 		is_owner = is_chanadmin = is_op = is_halfop = is_voiced = false;
 		/* cut off prefixes */
-		while(( *ptr == '~') || ( *ptr == '&' ) || ( *ptr == '@' ) ||
+		while ((*ptr == '~') || (*ptr == '&') || (*ptr == '@') ||
-			( *ptr == '%') || ( *ptr == '+' ))
+		       (*ptr == '%') || (*ptr == '+')) {
-		{
+			if (*ptr == '~')
-			if( *ptr == '~' ) is_owner = true;
+				is_owner = true;
-			if( *ptr == '&' ) is_chanadmin = true;
+			if (*ptr == '&')
-			if( *ptr == '@' ) is_op = true;
+				is_chanadmin = true;
-			if( *ptr == 'h' ) is_halfop = true;
+			if (*ptr == '@')
-			if( *ptr == '+' ) is_voiced = true;
+				is_op = true;
 			if (*ptr == '%')
 				is_halfop = true;
 			if (*ptr == '+')
 				is_voiced = true;
 			ptr++;
 		}
-		c = Client_Search( ptr );
+		c = Client_Search(ptr);
-		if( c )
+		if (!c) {
-		{
+			/* Client not found? */
-			Channel_Join( c, channame );
+			Log(LOG_ERR,
-			chan = Channel_Search( channame );
+			    "Got NJOIN for unknown nick \"%s\" for channel \"%s\"!",
-			assert( chan != NULL );
+			    ptr, channame);
-
+			goto skip_njoin;
 			if( is_owner ) Channel_UserModeAdd( chan, c, 'q' );
 			if( is_chanadmin ) Channel_UserModeAdd( chan, c, 'a' );
 			if( is_op ) Channel_UserModeAdd( chan, c, 'o' );
 			if( is_halfop ) Channel_UserModeAdd( chan, c, 'h' );
 			if( is_voiced ) Channel_UserModeAdd( chan, c, 'v' );
 			/* announce to channel... */
 			IRC_WriteStrChannelPrefix( Client, chan, c, false, "JOIN :%s", channame );
 			/* set Channel-User-Modes */
 			strlcpy( modes, Channel_UserModes( chan, c ), sizeof( modes ));
 			if( modes[0] )
 			{
 				/* send modes to channel */
 				IRC_WriteStrChannelPrefix( Client, chan, Client, false, "MODE %s +%s %s", channame, modes, Client_ID( c ));
 			}
 			if( nick_out[0] != '\0' ) strlcat( nick_out, ",", sizeof( nick_out ));
 			if( is_owner ) strlcat( nick_out, "~", sizeof( nick_out ));
 			if( is_chanadmin ) strlcat( nick_out, "&", sizeof( nick_out ));
 			if( is_op ) strlcat( nick_out, "@", sizeof( nick_out ));
 			if( is_halfop ) strlcat( nick_out, "%", sizeof( nick_out ));
 			if( is_voiced ) strlcat( nick_out, "+", sizeof( nick_out ));
 			strlcat( nick_out, ptr, sizeof( nick_out ));
 		}
 		else Log( LOG_ERR, "Got NJOIN for unknown nick \"%s\" for channel \"%s\"!", ptr, channame );
-		/* search for next Nick */
+		if (!Channel_Join(c, channame)) {
-		ptr = strtok( NULL, "," );
+			/* Failed to join channel. Ooops!? */
 			Log(LOG_ALERT,
 			    "Failed to join client \"%s\" to channel \"%s\" (NJOIN): killing it!",
 			    ptr, channame);
 			IRC_KillClient(NULL, NULL, ptr, "Internal NJOIN error!");
 			Log(LOG_DEBUG, "... done.");
 			goto skip_njoin;
 		}
 		chan = Channel_Search(channame);
 		assert(chan != NULL);
 		if (is_owner)
 			Channel_UserModeAdd(chan, c, 'q');
 		if (is_chanadmin)
 			Channel_UserModeAdd(chan, c, 'a');
 		if (is_op)
 			Channel_UserModeAdd(chan, c, 'o');
 		if (is_halfop)
 			Channel_UserModeAdd(chan, c, 'h');
 		if (is_voiced)
 			Channel_UserModeAdd(chan, c, 'v');
 		/* Announce client to the channel */
 		IRC_WriteStrChannelPrefix(Client, chan, c, false,
 					  "JOIN :%s", channame);
 		/* Announce "channel user modes" to the channel, if any */
 		strlcpy(modes, Channel_UserModes(chan, c), sizeof(modes));
 		if (modes[0])
 			IRC_WriteStrChannelPrefix(Client, chan, Client, false,
 						  "MODE %s +%s %s", channame,
 						  modes, Client_ID(c));
 		/* Build nick list for forwarding command */
 		if (nick_out[0] != '\0')
 			strlcat(nick_out, ",", sizeof(nick_out));
 		if (is_owner)
 			strlcat(nick_out, "~", sizeof(nick_out));
 		if (is_chanadmin)
 			strlcat(nick_out, "&", sizeof(nick_out));
 		if (is_op)
 			strlcat(nick_out, "@", sizeof(nick_out));
 		if (is_halfop)
 			strlcat(nick_out, "%", sizeof(nick_out));
 		if (is_voiced)
 			strlcat(nick_out, "+", sizeof(nick_out));
 		strlcat(nick_out, ptr, sizeof(nick_out));
 	      skip_njoin:
 		/* Get next nick, if any ... */
 		ptr = strtok(NULL, ",");
 	}
 	/* forward to other servers */
--- a/src/ngircd/irc-write.c
+++ b/src/ngircd/irc-write.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -380,11 +380,10 @@ va_dcl
 * Send a message to all the servers in the network using a specific prefix
 * and matching a "client flag" using a callback function.
 *
- * @param Client The sending client, excluded while forwarding the message.
+ * @param ExceptOf The sending client, excluded while forwarding the message.
 * @param Prefix The prefix to use.
 * @param Flag Client flag that must be set on the target.
 * @param callback Callback function.
 * @param Format Format string.
 */
 GLOBAL void
 IRC_WriteStrServersPrefixFlag_CB(CLIENT *ExceptOf, CLIENT *Prefix, char Flag,
@@ -521,12 +520,12 @@ va_dcl
 			if (Client_HasMode(to, 'w'))
 				IRC_WriteStrClientPrefix(to, From,
 							 "WALLOPS :%s", msg);
-				break;
+			break;
 		case CLIENT_SERVER:
 			if (to != Client)
 				IRC_WriteStrClientPrefix(to, From,
 							 "WALLOPS :%s", msg);
-				break;
+			break;
 		}
 	}
 } /* IRC_SendWallops */
--- a/src/ngircd/irc.c
+++ b/src/ngircd/irc.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -85,6 +85,8 @@ IRC_CheckListTooBig(CLIENT *From, const int Count, const int Limit,
 GLOBAL bool
 IRC_ERROR(CLIENT *Client, REQUEST *Req)
 {
 	char *msg;
 	assert( Client != NULL );
 	assert( Req != NULL );
@@ -99,12 +101,20 @@ IRC_ERROR(CLIENT *Client, REQUEST *Req)
 		return CONNECTED;
 	}
-	if (Req->argc < 1)
+	if (Req->argc < 1) {
 		msg = "Got ERROR command";
 		Log(LOG_NOTICE, "Got ERROR from \"%s\"!",
 		    Client_Mask(Client));
-	else
+	} else {
 		msg = Req->argv[0];
 		Log(LOG_NOTICE, "Got ERROR from \"%s\": \"%s\"!",
-		    Client_Mask(Client), Req->argv[0]);
+		    Client_Mask(Client), msg);
 	}
 	if (Client_Conn(Client) != NONE) {
 		Conn_Close(Client_Conn(Client), NULL, msg, false);
 		return DISCONNECTED;
 	}
 	return CONNECTED;
 } /* IRC_ERROR */
@@ -339,9 +349,12 @@ GLOBAL bool
 IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reason)
 {
 	const char *msg;
-	CONN_ID my_conn, conn;
+	CONN_ID my_conn = NONE, conn;
 	CLIENT *c;
 	assert(Nick != NULL);
 	assert(Reason != NULL);
 	/* Do we know such a client in the network? */
 	c = Client_Search(Nick);
 	if (!c) {
@@ -349,12 +362,8 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
 		return CONNECTED;
 	}
-	/* Inform other servers */
+	if (Client_Type(c) != CLIENT_USER && Client_Type(c) != CLIENT_GOTNICK
-	IRC_WriteStrServersPrefix(From ? Client : NULL,
+	    && Client_Type(c) != CLIENT_SERVICE) {
 				  From ? From : Client_ThisServer(),
 				  "KILL %s :%s", Nick, Reason);
 	if (Client_Type(c) != CLIENT_USER && Client_Type(c) != CLIENT_GOTNICK) {
 		/* Target of this KILL is not a regular user, this is
 		 * invalid! So we ignore this case if we received a
 		 * regular KILL from the network and try to kill the
@@ -375,8 +384,15 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
 		    Client_Type(c), Nick);
 	}
 	/* Inform other servers */
 	IRC_WriteStrServersPrefix(From ? Client : NULL,
 				  From ? From : Client_ThisServer(),
 				  "KILL %s :%s", Nick, Reason);
 	/* Save ID of this connection */
-	my_conn = Client_Conn(Client);
+	if (Client)
 		my_conn = Client_Conn(Client);
 	/* Kill the client NOW:
 	 *  - Close the local connection (if there is one),
@@ -399,7 +415,7 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
 * Send help for a given topic to the client.
 *
 * @param Client The client requesting help.
- * @param Topoc The help topic requested.
+ * @param Topic The help topic requested.
 * @return CONNECTED or DISCONNECTED.
 */
 static bool
@@ -467,11 +483,8 @@ Help(CLIENT *Client, const char *Topic)
 * @return Pointer to static (global) string buffer.
 */
 static char *
-#ifdef ZLIB
+#if defined(SSL_SUPPORT) || defined(ZLIB)
 Option_String(CONN_ID Idx)
 #else
 Option_String(UNUSED CONN_ID Idx)
 #endif
 {
 	static char option_txt[8];
 	UINT16 options;
@@ -489,11 +502,27 @@ Option_String(UNUSED CONN_ID Idx)
 	if(options & CONN_ZIP)		/* zlib compression enabled */
 		strlcat(option_txt, "z", sizeof(option_txt));
 #endif
 	LogDebug(" *** %d: %d = %s", Idx, options, option_txt);
 	return option_txt;
 #else
 Option_String(UNUSED CONN_ID Idx)
 {
 	return "";
 #endif
 } /* Option_String */
 /**
 * Send a message to target(s).
 *
 * This function is used by IRC_{PRIVMSG|NOTICE|SQUERY} to actualy
 * send the message(s).
 *
 * @param Client The client from which this command has been received.
 * @param Req Request structure with prefix and all parameters.
 * @param ForceType Required type of the destination of the message(s).
 * @param SendErrors Whether to report errors back to the client or not.
 * @return CONNECTED or DISCONNECTED.
 */
 static bool
 Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 {
@@ -501,8 +530,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 	CL2CHAN *cl2chan;
 	CHANNEL *chan;
 	char *currentTarget = Req->argv[0];
-	char *lastCurrentTarget = NULL;
+	char *strtok_last = NULL;
 	char *message = NULL;
 	char *targets[MAX_HNDL_TARGETS];
 	int i, target_nr = 0;
 	assert(Client != NULL);
 	assert(Req != NULL);
@@ -542,10 +573,19 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 		message = Req->argv[1];
 	/* handle msgtarget = msgto *("," msgto) */
-	currentTarget = strtok_r(currentTarget, ",", &lastCurrentTarget);
+	currentTarget = strtok_r(currentTarget, ",", &strtok_last);
 	ngt_UpperStr(Req->command);
 	/* Please note that "currentTarget" is NULL when the target contains
 	 * the separator character only, e. g. "," or ",,,," etc.! */
 	while (currentTarget) {
 		/* Make sure that there hasn't been such a target already: */
 		targets[target_nr++] = currentTarget;
 		for(i = 0; i < target_nr - 1; i++) {
 			if (strcasecmp(currentTarget, targets[i]) == 0)
 				goto send_next_target;
 		}
 		/* Check for and handle valid <msgto> of form:
 		 * RFC 2812 2.3.1:
 		 *   msgto =  channel / ( user [ "%" host ] "@" servername )
@@ -654,7 +694,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 				goto send_next_target;
 			}
-			if (Client_HasMode(cl, 'C')) {
+			if (Client_HasMode(cl, 'C') &&
 			    !Client_HasMode(from, 'o') &&
 			    !(Client_Type(from) == CLIENT_SERVER) &&
 			    !(Client_Type(from) == CLIENT_SERVICE)) {
 				cl2chan = Channel_FirstChannelOf(cl);
 				while (cl2chan) {
 					chan = Channel_GetChannel(cl2chan);
@@ -689,14 +732,14 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 				return DISCONNECTED;
 		} else if (ForceType != CLIENT_SERVICE
 			   && (chan = Channel_Search(currentTarget))) {
 			/* Target is a channel */
 			if (!Channel_Write(chan, from, Client, Req->command,
 					   SendErrors, message))
 					return DISCONNECTED;
 		} else if (ForceType != CLIENT_SERVICE
 			/* $#: server/target mask, RFC 2812, sec. 3.3.1 */
 			   && strchr("$#", currentTarget[0])
 			   && strchr(currentTarget, '.')) {
-			/* targetmask */
+			/* $#: server/host mask, RFC 2812, sec. 3.3.1 */
 			if (!Send_Message_Mask(from, Req->command, currentTarget,
 					       message, SendErrors))
 				return DISCONNECTED;
@@ -709,14 +752,35 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 		}
 	send_next_target:
-		currentTarget = strtok_r(NULL, ",", &lastCurrentTarget);
+		currentTarget = strtok_r(NULL, ",", &strtok_last);
-		if (currentTarget)
+		if (!currentTarget)
-			Conn_SetPenalty(Client_Conn(Client), 1);
+			break;
 		Conn_SetPenalty(Client_Conn(Client), 1);
 		if (target_nr >= MAX_HNDL_TARGETS) {
 			/* Too many targets given! */
 			return IRC_WriteErrClient(Client,
 						  ERR_TOOMANYTARGETS_MSG,
 						  currentTarget);
 		}
 	}
 	return CONNECTED;
 } /* Send_Message */
 /**
 * Send a message to "target mask" target(s).
 *
 * See RFC 2812, sec. 3.3.1 for details.
 *
 * @param from The client from which this command has been received.
 * @param command The command to use (PRIVMSG, NOTICE, ...).
 * @param targetMask The "target mask" (will be verified by this function).
 * @param message The message to send.
 * @param SendErrors Whether to report errors back to the client or not.
 * @return CONNECTED or DISCONNECTED.
 */
 static bool
 Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
 		  char * message, bool SendErrors)
@@ -740,17 +804,15 @@ Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
 	 * dot (".") and no wildcards ("*", "?") following the last one.
 	 */
 	check_wildcards = strrchr(targetMask, '.');
-	assert(check_wildcards != NULL);
+	if (!check_wildcards || check_wildcards[strcspn(check_wildcards, "*?")]) {
 	if (check_wildcards &&
 		check_wildcards[strcspn(check_wildcards, "*?")])
 	{
 		if (!SendErrors)
 			return true;
-		return IRC_WriteErrClient(from, ERR_WILDTOPLEVEL, targetMask);
+		return IRC_WriteErrClient(from, ERR_WILDTOPLEVEL_MSG,
 					  targetMask);
 	}
 	/* #: hostmask, see RFC 2812, sec. 3.3.1 */
 	if (targetMask[0] == '#') {
 		/* #: hostmask, see RFC 2812, sec. 3.3.1 */
 		for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
 			if (Client_Type(cl) != CLIENT_USER)
 				continue;
@@ -761,7 +823,8 @@ Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
 					return false;
 		}
 	} else {
-		assert(targetMask[0] == '$'); /* $: server mask, see RFC 2812, sec. 3.3.1 */
+		/* $: server mask, see RFC 2812, sec. 3.3.1 */
 		assert(targetMask[0] == '$');
 		for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
 			if (Client_Type(cl) != CLIENT_USER)
 				continue;
--- a/src/ngircd/lists.c
+++ b/src/ngircd/lists.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -39,7 +39,7 @@ struct list_elem {
 /**
 * Get IRC mask stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return Pointer to IRC mask
 */
 GLOBAL const char *
@@ -52,7 +52,7 @@ Lists_GetMask(const struct list_elem *e)
 /**
 * Get optional "reason" text stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return Pointer to "reason" text or empty string ("").
 */
 GLOBAL const char *
@@ -65,7 +65,7 @@ Lists_GetReason(const struct list_elem *e)
 /**
 * Get "validity" value stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return Validity: 0=unlimited, >0 until this time stamp.
 */
 GLOBAL time_t
@@ -78,7 +78,7 @@ Lists_GetValidity(const struct list_elem *e)
 /**
 * Get "onlyonce" value stored in list element.
 *
- * @param list_elem List element.
+ * @param e List element.
 * @return True if the element was stored for single use, false otherwise.
 */
 GLOBAL bool
@@ -381,11 +381,11 @@ Lists_Expire(struct list_head *h, const char *ListName)
 		if (e->valid_until > 0 && e->valid_until < now) {
 			/* Entry is expired, delete it */
 			if (e->reason)
-				Log(LOG_INFO,
+				Log(LOG_NOTICE|LOG_snotice,
 				    "Deleted \"%s\" (\"%s\") from %s list (expired).",
 				    e->mask, e->reason, ListName);
 			else
-				Log(LOG_INFO,
+				Log(LOG_NOTICE|LOG_snotice,
 				    "Deleted \"%s\" from %s list (expired).",
 				    e->mask, ListName);
 			Lists_Unlink(h, last, e);
--- a/src/ngircd/log.c
+++ b/src/ngircd/log.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2019 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -80,6 +80,7 @@ Log_Init(bool Daemon_Mode)
 	openlog(PACKAGE, LOG_CONS|LOG_PID, 0);
 #endif
 #endif
 	Log(LOG_NOTICE, "%s starting ...", NGIRCd_Version);
 } /* Log_Init */
@@ -96,15 +97,13 @@ Log_ReInit(void)
 	closelog();
 	openlog(PACKAGE, LOG_CONS|LOG_PID, Conf_SyslogFacility);
 #endif
 	Log(LOG_NOTICE, "%s started.", NGIRCd_Version);
 	Log(LOG_INFO, "Using configuration file \"%s\" ...", NGIRCd_ConfFile);
 }
 GLOBAL void
 Log_Exit( void )
 {
-	Log(LOG_INFO, "%s done%s, served %lu connection%s.", PACKAGE_NAME,
+	Log(LOG_NOTICE, "%s done%s, served %lu connection%s.", PACKAGE_NAME,
 	    NGIRCd_SignalRestart ? " (restarting)" : "", Conn_CountAccepted(),
 	    Conn_CountAccepted() == 1 ? "" : "s");
 #ifdef SYSLOG
--- a/src/ngircd/match.c
+++ b/src/ngircd/match.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -77,7 +77,7 @@ MatchCaseInsensitive(const char *Pattern, const char *String)
 /**
 * Match string with pattern case-insensitive.
 *
- * @param pattern Pattern to match with
+ * @param Pattern Pattern to match with
 * @param String Input string, at most COMMAND_LEN-1 characters long
 * @param Separator Character separating the individual patterns in the list
 * @return true if pattern matches
--- a/src/ngircd/messages.h
+++ b/src/ngircd/messages.h
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2020 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -23,7 +23,7 @@
 #define RPL_MYINFO_MSG			"004 %s %s ngircd-%s %s %s"
 #define RPL_ISUPPORTNET_MSG		"005 %s NETWORK=%s :is my network name"
 #define RPL_ISUPPORT1_MSG		"005 %s RFC2812 IRCD=ngIRCd CHARSET=UTF-8 CASEMAPPING=ascii PREFIX=(qaohv)~&@%%+ CHANTYPES=%s CHANMODES=beI,k,l,imMnOPQRstVz CHANLIMIT=%s:%d :are supported on this server"
-#define RPL_ISUPPORT2_MSG		"005 %s CHANNELLEN=%d NICKLEN=%d TOPICLEN=%d AWAYLEN=%d KICKLEN=%d MODES=%d MAXLIST=beI:%d EXCEPTS=e INVEX=I PENALTY :are supported on this server"
+#define RPL_ISUPPORT2_MSG		"005 %s CHANNELLEN=%d NICKLEN=%d TOPICLEN=%d AWAYLEN=%d KICKLEN=%d MODES=%d MAXLIST=beI:%d EXCEPTS=e INVEX=I PENALTY FNC :are supported on this server"
 #define RPL_TRACELINK_MSG		"200 %s Link %s-%s %s %s V%s %ld %d %d"
 #define RPL_TRACEOPERATOR_MSG		"204 %s Oper 2 :%s"
@@ -110,11 +110,12 @@
 #define ERR_CANNOTSENDTOCHAN_MSG	"404 %s %s :Cannot send to channel"
 #define ERR_TOOMANYCHANNELS_MSG		"405 %s %s :You have joined too many channels"
 #define ERR_WASNOSUCHNICK_MSG		"406 %s %s :There was no such nickname"
 #define ERR_TOOMANYTARGETS_MSG		"407 %s :Too many recipients"
 #define ERR_NOORIGIN_MSG		"409 %s :No origin specified"
 #define ERR_INVALIDCAP_MSG		"410 %s %s :Invalid CAP subcommand"
 #define ERR_NORECIPIENT_MSG		"411 %s :No recipient given (%s)"
 #define ERR_NOTEXTTOSEND_MSG		"412 %s :No text to send"
-#define ERR_WILDTOPLEVEL		"414 %s :Wildcard in toplevel domain"
+#define ERR_WILDTOPLEVEL_MSG		"414 %s :Wildcard in toplevel domain"
 #define ERR_UNKNOWNCOMMAND_MSG		"421 %s %s :Unknown command"
 #define ERR_NOMOTD_MSG			"422 %s :MOTD file is missing"
 #define ERR_NONICKNAMEGIVEN_MSG		"431 %s :No nickname given"
--- a/src/ngircd/ngircd.c
+++ b/src/ngircd/ngircd.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2020 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -9,6 +9,7 @@
 * Please read the file COPYING, README and AUTHORS for more information.
 */
 #define GLOBAL_INIT
 #include "portab.h"
 /**
@@ -125,7 +126,7 @@ main(int argc, const char *argv[])
 			if (strcmp(argv[i], "--help") == 0) {
 				Show_Version();
 				puts(""); Show_Help( ); puts( "" );
-				exit(1);
+				exit(0);
 			}
 			if (strcmp(argv[i], "--nodaemon") == 0) {
 				NGIRCd_NoDaemon = true;
@@ -143,7 +144,7 @@ main(int argc, const char *argv[])
 #endif
 			if (strcmp(argv[i], "--version") == 0) {
 				Show_Version();
-				exit(1);
+				exit(0);
 			}
 		}
 		else if(argv[i][0] == '-' && argv[i][1] != '-') {
@@ -200,21 +201,23 @@ main(int argc, const char *argv[])
 				}
 				if (!ok) {
-					printf("%s: invalid option \"-%c\"!\n",
+					fprintf(stderr,
-					       PACKAGE_NAME, argv[i][n]);
+						"%s: invalid option \"-%c\"!\n",
-					printf("Try \"%s --help\" for more information.\n",
+						PACKAGE_NAME, argv[i][n]);
-					       PACKAGE_NAME);
+					fprintf(stderr,
-					exit(1);
+						"Try \"%s --help\" for more information.\n",
 						PACKAGE_NAME);
 					exit(2);
 				}
 			}
 		}
 		if (!ok) {
-			printf("%s: invalid option \"%s\"!\n",
+			fprintf(stderr, "%s: invalid option \"%s\"!\n",
-			       PACKAGE_NAME, argv[i]);
+				PACKAGE_NAME, argv[i]);
-			printf("Try \"%s --help\" for more information.\n",
+			fprintf(stderr, "Try \"%s --help\" for more information.\n",
-			       PACKAGE_NAME);
+				PACKAGE_NAME);
-			exit(1);
+			exit(2);
 		}
 	}
@@ -246,26 +249,18 @@ main(int argc, const char *argv[])
 		NGIRCd_SignalRestart = false;
 		NGIRCd_SignalQuit = false;
 		/* Initialize modules, part I */
 		Log_Init(!NGIRCd_NoDaemon);
 		Random_Init();
 		Conf_Init();
 		Log_ReInit();
-		/* Initialize the "main program": chroot environment, user and
+		/* Initialize the "main program":
-		 * group ID, ... */
+		 * chroot environment, user and group ID, ... */
 		if (!NGIRCd_Init(NGIRCd_NoDaemon)) {
 			Log(LOG_ALERT, "Fatal: Initialization failed, exiting!");
 			exit(1);
 		}
 		/* Initialize modules, part II: these functions are eventually
 		 * called with already dropped privileges ... */
 		Channel_Init();
 		Client_Init();
 		Conn_Init();
 		Class_Init();
 		if (!io_library_init(CONNECTION_POOL)) {
 			Log(LOG_ALERT,
 			    "Fatal: Could not initialize IO routines: %s",
@@ -280,6 +275,11 @@ main(int argc, const char *argv[])
 			exit(1);
 		}
 		Channel_Init();
 		Conn_Init();
 		Class_Init();
 		Client_Init();
 		/* Create protocol and server identification. The syntax
 		 * used by ngIRCd in PASS commands and the known "extended
 		 * flags" are described in doc/Protocol.txt. */
@@ -451,7 +451,7 @@ static void
 Show_Version( void )
 {
 	puts( NGIRCd_Version );
-	puts( "Copyright (c)2001-2014 Alexander Barton (<alex@barton.de>) and Contributors." );
+	puts( "Copyright (c)2001-2020 Alexander Barton (<alex@barton.de>) and Contributors." );
 	puts( "Homepage: <http://ngircd.barton.de/>\n" );
 	puts( "This is free software; see the source for copying conditions. There is NO" );
 	puts( "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." );
--- a/src/ngircd/numeric.c
+++ b/src/ngircd/numeric.c
@@ -176,6 +176,7 @@ Synchronize_Lists(CLIENT * Client)
 	CHANNEL *c;
 	struct list_head *head;
 	struct list_elem *elem;
 	time_t t;
 	assert(Client != NULL);
@@ -183,9 +184,10 @@ Synchronize_Lists(CLIENT * Client)
 	head = Class_GetList(CLASS_GLINE);
 	elem = Lists_GetFirst(head);
 	while (elem) {
 		t = Lists_GetValidity(elem) - time(NULL);
 		if (!IRC_WriteStrClient(Client, "GLINE %s %ld :%s",
 					Lists_GetMask(elem),
-					(long)(Lists_GetValidity(elem) - time(NULL)),
+					t > 0 ? (long)t : 0,
 					Lists_GetReason(elem)))
 			return DISCONNECTED;
 		elem = Lists_GetNext(elem);
--- a/src/ngircd/op.c
+++ b/src/ngircd/op.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -40,12 +40,14 @@ Op_NoPrivileges(CLIENT * Client, REQUEST * Req)
 		from = Client_Search(Req->prefix);
 	if (from) {
-		Log(LOG_NOTICE, "No privileges: client \"%s\" (%s), command \"%s\"!",
+		Log(LOG_ERR|LOG_snotice,
 		    "No privileges: client \"%s\" (%s), command \"%s\"!",
 		    Req->prefix, Client_Mask(Client), Req->command);
 		return IRC_WriteErrClient(from, ERR_NOPRIVILEGES_MSG,
 					  Client_ID(from));
 	} else {
-		Log(LOG_NOTICE, "No privileges: client \"%s\", command \"%s\"!",
+		Log(LOG_ERR|LOG_snotice,
 		    "No privileges: client \"%s\", command \"%s\"!",
 		    Client_Mask(Client), Req->command);
 		return IRC_WriteErrClient(Client, ERR_NOPRIVILEGES_MSG,
 					  Client_ID(Client));
@@ -56,7 +58,7 @@ Op_NoPrivileges(CLIENT * Client, REQUEST * Req)
 * Check that the originator of a request is an IRC operator and allowed
 * to administer this server.
 *
- * @param CLient Client from which the command has been received.
+ * @param Client Client from which the command has been received.
 * @param Req Request structure.
 * @return CLIENT structure of the client that initiated the command or
 *	   NULL if client is not allowed to execute operator commands.
--- a/src/ngircd/pam.c
+++ b/src/ngircd/pam.c
@@ -32,6 +32,7 @@
 #include "log.h"
 #include "conn.h"
 #include "client.h"
 #include "conf.h"
 #include "pam.h"
@@ -101,7 +102,7 @@ PAM_Authenticate(CLIENT *Client) {
 	conv.appdata_ptr = Conn_Password(Client_Conn(Client));
 	/* Initialize PAM */
-	retval = pam_start("ngircd", Client_OrigUser(Client), &conv, &pam);
+	retval = pam_start(Conf_PAMServiceName, Client_OrigUser(Client), &conv, &pam);
 	if (retval != PAM_SUCCESS) {
 		Log(LOG_ERR, "PAM: Failed to create authenticator! (%d)", retval);
 		return false;
--- a/src/ngircd/parse.c
+++ b/src/ngircd/parse.c
@@ -1,6 +1,6 @@
 /*
 * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -111,7 +111,7 @@ static COMMAND My_Commands[] =
 	_CMD("USERS", IRC_USERS, CLIENT_USER|CLIENT_SERVER, 0, -1, 0),
 	_CMD("VERSION", IRC_VERSION, CLIENT_USER|CLIENT_SERVER, 0, 1, 1),
 	_CMD("WALLOPS", IRC_WALLOPS, CLIENT_USER|CLIENT_SERVER, 1, 1, 0),
-	_CMD("WEBIRC", IRC_WEBIRC, CLIENT_UNKNOWN, 4, 4, 0),
+	_CMD("WEBIRC", IRC_WEBIRC, CLIENT_UNKNOWN, 4, 5, 0),
 	_CMD("WHO", IRC_WHO, CLIENT_USER, 0, 2, 1),
 	_CMD("WHOIS", IRC_WHOIS, CLIENT_USER|CLIENT_SERVER, 0, -1, 1),
 	_CMD("WHOWAS", IRC_WHOWAS, CLIENT_USER|CLIENT_SERVER, 0, -1, 0),
@@ -169,8 +169,8 @@ Parse_GetCommandStruct( void )
 *
 * @param Idx Index of the connection from which the command has been received.
 * @param Request NULL terminated line of text (the "command").
- * @return true on success (valid command or "regular" error), false if a
+ * @return CONNECTED on success (valid command or "regular" error), DISCONNECTED
- * 	fatal error occurred and the connection has been shut down.
+ *	if a fatal error occurred and the connection has been shut down.
 */
 GLOBAL bool
 Parse_Request( CONN_ID Idx, char *Request )
@@ -257,11 +257,14 @@ Parse_Request( CONN_ID Idx, char *Request )
 		}
 	}
-	if( ! Validate_Prefix( Idx, &req, &closed )) return ! closed;
+	if(!Validate_Prefix(Idx, &req, &closed))
-	if( ! Validate_Command( Idx, &req, &closed )) return ! closed;
+		return !closed;
-	if( ! Validate_Args( Idx, &req, &closed )) return ! closed;
+	if(!Validate_Command(Idx, &req, &closed))
 		return !closed;
 	if(!Validate_Args(Idx, &req, &closed))
 		return !closed;
-	return Handle_Request( Idx, &req );
+	return Handle_Request(Idx, &req);
 } /* Parse_Request */
@@ -490,7 +493,7 @@ static bool
 Handle_Request( CONN_ID Idx, REQUEST *Req )
 {
 	CLIENT *client;
-	bool result = true;
+	bool result = CONNECTED;
 	int client_type;
 	COMMAND *cmd;
@@ -546,6 +549,8 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
 			cmd->lcount++;
 		else
 			cmd->rcount++;
 		/* Return result of command (CONNECTED/DISCONNECTED). */
 		return result;
 	}
@@ -554,13 +559,13 @@ Handle_Request( CONN_ID Idx, REQUEST *Req )
 	    client_type != CLIENT_SERVICE )
 		return true;
 	/* Unknown command and registered connection: generate error: */
 	LogDebug("Connection %d: Unknown command \"%s\", %d %s,%s prefix.",
 			Client_Conn( client ), Req->command, Req->argc,
 			Req->argc == 1 ? "parameter" : "parameters",
 			Req->prefix ? "" : " no" );
-	if (Client_Type(client) != CLIENT_SERVER)
+	/* Unknown command and registered connection: generate error: */
 	if (client_type != CLIENT_SERVER)
 		result = IRC_WriteErrClient(client, ERR_UNKNOWNCOMMAND_MSG,
 				Client_ID(client), Req->command);
--- a/src/ngircd/resolve.c
+++ b/src/ngircd/resolve.c
@@ -108,9 +108,8 @@ Resolve_Name( PROC_STAT *s, const char *Host, void (*cbfunc)(int, short))
 	return false;
 } /* Resolve_Name */
-
+#if !defined(HAVE_WORKING_GETADDRINFO) || !defined(HAVE_GETNAMEINFO)
-#if !defined(HAVE_GETADDRINFO) || !defined(HAVE_GETNAMEINFO)
+#ifdef h_errno
 #if !defined(WANT_IPV6) && defined(h_errno)
 static char *
 Get_Error( int H_Error )
 {
@@ -233,7 +232,11 @@ ReverseLookup(const ng_ipaddr_t *IpAddr, char *resbuf, size_t reslen)
 * @return true if lookup successful, false if domain name not found
 */
 static bool
 #ifdef HAVE_WORKING_GETADDRINFO
 ForwardLookup(const char *hostname, array *IpAddr, int af)
 #else
 ForwardLookup(const char *hostname, array *IpAddr, UNUSED int af)
 #endif
 {
 	ng_ipaddr_t addr;
--- a/src/ngircd/sighandlers.c
+++ b/src/ngircd/sighandlers.c
@@ -119,7 +119,7 @@ Rehash(void)
 	if (strcmp(old_name, Conf_ServerName) != 0 ) {
 		strlcpy(Conf_ServerName, old_name, sizeof Conf_ServerName);
 		Log(LOG_ERR,
-		    "Can't change \"ServerName\" on runtime! Ignored new name.");
+		    "Can't change server name (\"Name\") on runtime! Ignored new name.");
 	}
 	if (old_nicklen != Conf_MaxNickLength) {
 		Conf_MaxNickLength = old_nicklen;
@@ -132,7 +132,7 @@ Rehash(void)
 	if (!ConnSSL_InitLibrary())
 		Log(LOG_WARNING,
-		    "Re-Initializing of SSL failed, using old keys!");
+		    "Re-Initializing of SSL failed!");
 	/* Start listening on sockets */
 	Conn_InitListeners( );
@@ -154,6 +154,14 @@ Rehash(void)
 static void
 Signal_Handler(int Signal)
 {
 	if (Signal != SIGCHLD) {
 #ifdef HAVE_STRSIGNAL
 		Log(LOG_INFO, "Got signal \"%s\" ...", strsignal(Signal));
 #else
 		Log(LOG_INFO, "Got signal %d ...", Signal);
 #endif
 	}
 	switch (Signal) {
 	case SIGTERM:
 	case SIGINT:
--- a/src/portab/Makefile.ng
+++ b/src/portab/Makefile.ng
@@ -15,7 +15,13 @@ EXTRA_DIST = Makefile.ng
 noinst_LIBRARIES = libngportab.a
-libngportab_a_SOURCES = strdup.c strndup.c strlcpy.c strtok_r.c vsnprintf.c waitpid.c
+libngportab_a_SOURCES = \
 	strdup.c \
 	strlcpy.c \
 	strndup.c \
 	strtok_r.c \
 	vsnprintf.c \
 	waitpid.c
 check_PROGRAMS = portabtest
--- a/src/portab/portab.h
+++ b/src/portab/portab.h
@@ -102,7 +102,11 @@ typedef unsigned char bool;
 #endif
 #undef GLOBAL
 #ifdef GLOBAL_INIT
 #define GLOBAL
 #else
 #define GLOBAL extern
 #endif
 /* SPLint */
@@ -175,6 +179,10 @@ extern int vsnprintf PARAMS(( char *str, size_t count, const char *fmt, va_list
 # define PACKAGE_VERSION VERSION
 #endif
 #ifndef SYSCONFDIR
 # define SYSCONFDIR "/etc"
 #endif
 #endif
 /* -eof- */
--- a/src/portab/portabtest.c
+++ b/src/portab/portabtest.c
@@ -104,9 +104,10 @@ Check_strlcat(void)
 static void
 Check_strtok_r(void)
 {
-	char *ptr, *last;
+	char *str, *ptr, *last;
 	ptr = strdup("12,abc");
 	str = ptr;
 	ptr = strtok_r(ptr, ",", &last);
 	if (!ptr)
@@ -123,6 +124,8 @@ Check_strtok_r(void)
 	ptr = strtok_r(NULL, ",", &last);
 	if (ptr)
 		Panic("strtok_r result #3");
 	free(str);
 }
 #ifdef PROTOTYPES
--- a/src/testsuite/Makefile.ng
+++ b/src/testsuite/Makefile.ng
@@ -21,14 +21,18 @@ EXTRA_DIST = \
 	join-test.e kick-test.e message-test.e misc-test.e mode-test.e \
 	opless-channel-test.e server-link-test.e who-test.e whois-test.e \
 	stress-A.e stress-B.e \
 	server-login-test.e \
 	start-server1 stop-server1 ngircd-test1.conf \
-	start-server2 stop-server2 ngircd-test2.conf
+	start-server2 stop-server2 ngircd-test2.conf \
 	start-server3 stop-server3 ngircd-test3.conf \
 	reload-server3 reload-server.sh prep-server3 cleanup-server3\
 	connect-ssl-cert1-test.e connect-ssl-cert2-test.e
 all:
 clean-local:
 	rm -rf logs tests *-test ngircd-test*.log procs.tmp tests-skipped.lst \
-	 T-ngircd1 ngircd-test1.motd T-ngircd2 ngircd-test2.motd
+	 T-ngircd1 ngircd-test1.motd T-ngircd2 ngircd-test2.motd T-ngircd3 ngircd-test3.motd
 maintainer-clean-local:
 	rm -f Makefile Makefile.in Makefile.am
@@ -38,6 +42,7 @@ check_SCRIPTS = ngircd-TEST-Binary tests.sh
 ngircd-TEST-Binary:
 	cp ../ngircd/ngircd T-ngircd1
 	cp ../ngircd/ngircd T-ngircd2
 	cp ../ngircd/ngircd T-ngircd3
 	[ -f getpid.sh ] || ln -s $(srcdir)/getpid.sh .
 	rm -f tests-skipped.lst
@@ -45,6 +50,14 @@ connect-test: tests.sh
 	rm -f connect-test
 	ln -s $(srcdir)/tests.sh connect-test
 connect-ssl-cert1-test: tests.sh
 	rm -f connect-ssl-cert1-test
 	ln -s $(srcdir)/tests.sh connect-ssl-cert1-test
 connect-ssl-cert2-test: tests.sh
 	rm -f connect-ssl-cert2-test
 	ln -s $(srcdir)/tests.sh connect-ssl-cert2-test
 channel-test: tests.sh
 	rm -f channel-test
 	ln -s $(srcdir)/tests.sh channel-test
@@ -81,6 +94,10 @@ server-link-test: tests.sh
 	rm -f server-link-test
 	ln -s $(srcdir)/tests.sh server-link-test
 server-login-test: tests.sh
 	rm -f server-login-test
 	ln -s $(srcdir)/tests.sh server-login-test
 who-test: tests.sh
 	rm -f who-test
 	ln -s $(srcdir)/tests.sh who-test
@@ -103,8 +120,21 @@ TESTS = start-server1 \
 	who-test \
 	whois-test \
 	server-link-test \
 	server-login-test \
 	stop-server2 \
 	stress-server.sh \
 	stop-server1
 if HAVE_SSL
 TESTS += \
 	prep-server3 \
 	start-server3 \
 	connect-ssl-cert1-test \
 	switch-server3 \
 	reload-server3 \
 	connect-ssl-cert2-test \
 	cleanup-server3 \
 	stop-server3
 endif
 # -eof-
--- a/src/testsuite/cleanup-server3
+++ b/src/testsuite/cleanup-server3
@@ -0,0 +1,2 @@
 #!/bin/sh
 rm ssl/cert.pem ssl/key.pem ssl/dhparams.pem
--- a/src/testsuite/connect-ssl-cert1-test.e
+++ b/src/testsuite/connect-ssl-cert1-test.e
@@ -0,0 +1,21 @@
 # ngIRCd test suite
 # Server connect test
 spawn openssl s_client -quiet -connect 127.0.0.1:6790
 expect {
        timeout { exit 1 }
        "*CN = my.first.domain.tld"
 }
 sleep 2
 send "oper\r"
 expect {
 	timeout { exit 1 }
 	"451"
 }
 send "quit\r"
 expect {
 	timeout { exit 1 }
 	"Connection closed"
 }
--- a/src/testsuite/connect-ssl-cert2-test.e
+++ b/src/testsuite/connect-ssl-cert2-test.e
@@ -0,0 +1,22 @@
 # ngIRCd test suite
 # Server connect test
 spawn openssl s_client -quiet -connect 127.0.0.1:6790
 expect {
        timeout { exit 1 }
        "*CN = my.second.domain.tld"
 }
 sleep 2
 send "oper\r"
 expect {
 	timeout { exit 1 }
 	"451"
 }
 send "quit\r"
 expect {
 	timeout { exit 1 }
 	"Connection closed"
 }
--- a/src/testsuite/getpid.sh
+++ b/src/testsuite/getpid.sh
@@ -14,6 +14,8 @@ elif [ $UNAME = "A/UX" ]; then
  PS_FLAGS="-af"; PS_PIDCOL="2"; HEAD_FLAGS="-1"
 elif [ $UNAME = "GNU" ]; then
  PS_FLAGS="-ax"; PS_PIDCOL="2"; HEAD_FLAGS="-n 1"
 elif [ $UNAME = "Haiku" ]; then
  PS_FLAGS="-o Id -o Team"; PS_PIDCOL="1"; HEAD_FLAGS="-1"
 elif [ $UNAME = "Linux" ]; then
  PS_FLAGS="ax"; PS_PIDCOL="1"; HEAD_FLAGS="-n 1"
 elif [ $UNAME = "SunOS" ]; then
--- a/src/testsuite/join-test.e
+++ b/src/testsuite/join-test.e
@@ -61,6 +61,49 @@ expect {
       timeout { exit 1 }
       "405"
 }
 send "JOIN 0\r"
 send "JoIn #MultiMode\r"
 expect {
       timeout { exit 1 }
       "474 nick #MultiMode"
 }
 send "OPer TestOp 123\r"
 expect {
 	timeout { exit 1 }
 	"381"
 }
 send "Mode #MultiMode -b nick!~user\r"
 expect {
       timeout { exit 1 }
 	"MODE #MultiMode -b nick!~user@*"
 }
 send "jOiN #MULTIMODE\r"
 expect {
       timeout { exit 1 }
       "@* JOIN :#MULTIMODE"
 }
 expect {
       timeout { exit 1 }
       "366"
 }
 send "ModE #MULTImode\r"
 expect {
       timeout { exit 1 }
       "324 nick #MultiMode +Pnt"
 }
 send "mODe #multimode +b\r"
 expect {
       timeout { exit 1 }
       "367 nick #MultiMode banned!~ghost@example.com ngircd.test.server"
 }
 expect {
       timeout { exit 1 }
       "368 nick #MultiMode"
 }
 send "quit\r"
 expect {
--- a/src/testsuite/message-test.e
+++ b/src/testsuite/message-test.e
@@ -35,13 +35,24 @@ expect {
 send "privmsg nick,nick :test\r"
 expect {
 	timeout { exit 1 }
-	"@* PRIVMSG nick :test\r*@* PRIVMSG nick :test"
+	"@* PRIVMSG nick :test"
 }
 send "privmsg ,,,, :dummy\r"
 send "privmsg ,,,nick,,&server,,, :test\r"
 expect {
 	timeout { exit 1 }
 	"@* PRIVMSG nick :test"
 }
 expect {
 	timeout { exit 1 }
 	"404"
 }
 send "privmsg Nick,#testChannel,nick :test\r"
 expect {
 	timeout { exit 1 }
-	"@* PRIVMSG nick :test\r*401*@* PRIVMSG nick :test"
+	"@* PRIVMSG nick :test\r*401"
 }
 send "privmsg doesnotexist :test\r"
--- a/src/testsuite/ngircd-test1.conf
+++ b/src/testsuite/ngircd-test1.conf
@@ -12,6 +12,7 @@
 [Limits]
 	MaxConnectionsIP = 0
 	MaxJoins = 4
 	MaxPenaltyTime = 1
 [Options]
 	OperCanUseMode = yes
@@ -29,6 +30,11 @@
 	MyPassword = pwd1
 	PeerPassword = pwd2
 [Server]
 	Name = ngircd.test.server3
 	MyPassword = pwd1
 	PeerPassword = pwd3
 [Channel]
 	Name = InviteChannel
 	Modes = i
@@ -57,4 +63,10 @@
 	Name = +ModelessChannel
 	Topic = A modeless Channel
 [Channel]
 	Name = MultiMode
 	Modes = +n +b nick!~user
 	Modes = +t
 	Modes = +b banned!~ghost@example.com
 # -eof-
--- a/src/testsuite/ngircd-test2.conf
+++ b/src/testsuite/ngircd-test2.conf
@@ -12,6 +12,7 @@
 [Limits]
 	MaxConnectionsIP = 0
 	MaxJoins = 4
 	MaxPenaltyTime = 1
 [Options]
 	OperCanUseMode = yes
--- a/src/testsuite/ngircd-test3.conf
+++ b/src/testsuite/ngircd-test3.conf
@@ -0,0 +1,31 @@
 # ngIRCd test suite
 # configuration file for test server #1
 [Global]
 	Name = ngircd.test.server
 	Info = ngIRCd Test-Server 3
 	Listen = 127.0.0.1
 	Ports = 6789
 	MotdFile = ngircd-test3.motd
 	AdminEMail = admin@irc.server
 [SSL]
        CertFile = ssl/cert.pem
        KeyFile = ssl/key.pem
        DHFile = ssl/dhparams.pem
        Ports = 6790
 [Limits]
 	MaxConnectionsIP = 0
 	MaxJoins = 4
 	MaxPenaltyTime = 1
 [Options]
 	OperCanUseMode = yes
 	Ident = no
 	IncludeDir = /var/empty
 	DNS = no
 	PAM = no
 # -eof-
--- a/src/testsuite/prep-server3
+++ b/src/testsuite/prep-server3
@@ -0,0 +1,4 @@
 #!/bin/sh
 cp ssl/cert-my-first-domain-tld.pem ssl/cert.pem
 cp ssl/key-my-first-domain-tld.pem ssl/key.pem
 cp ssl/dhparams-my-first-domain-tld.pem ssl/dhparams.pem
--- a/src/testsuite/reload-server.sh
+++ b/src/testsuite/reload-server.sh
@@ -0,0 +1,31 @@
 #!/bin/sh
 # ngIRCd Test Suite
 [ -z "$srcdir" ] && srcdir=`dirname $0`
 # read in functions
 . ${srcdir}/functions.inc
 if [ -n "$1" ]; then
 	id="$1"; shift
 else
 	id="1"
 fi
 echo_n "reloading server ${id} ..."
 # reload (sighup) test-server ...
 pid=`./getpid.sh T-ngircd${id}`
 if [ -z "$pid" ]; then
  echo " failure: no running server found!?"
  exit 1
 fi
 kill -HUP $pid > /dev/null 2>&1; r=$?
 if [ $r -eq 0 ]; then
  echo " ok".
  exit 0
 fi
 echo " failure: server ${id} could not be restarted"
 exit 1
 # -eof-
--- a/src/testsuite/reload-server3
+++ b/src/testsuite/reload-server3
@@ -0,0 +1,7 @@
 #!/bin/sh
 # ngIRCd Test Suite
 [ -z "$srcdir" ] && srcdir=`dirname $0`
 ${srcdir}/reload-server.sh 3
 # -eof-
--- a/src/testsuite/server-login-test.e
+++ b/src/testsuite/server-login-test.e
@@ -0,0 +1,94 @@
 # ngIRCd test suite
 # server-server login test
 spawn telnet 127.0.0.1 6789
 expect {
 	timeout { exit 1 }
 	"Connected"
 }
 # Register server
 send "PASS pwd1 0210-IRC+ ngIRCd|testsuite0:CHLMSX P\r"
 send "SERVER ngircd.test.server3 :Testsuite Server Emulation\r"
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server PASS pwd3 0210-IRC+ ngIRCd|"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server SERVER ngircd.test.server 1 :"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server 005 "
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server 376 "
 }
 # End of handshake
 send ":ngircd.test.server3 376 ngircd.test.server :End of MOTD command\r"
 # Receive existing channels
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server CHANINFO +ModelessChannel +P :A modeless Channel"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server CHANINFO #SecretChannel +Ps :A secret Channel"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server CHANINFO #TopicChannel +Pt :the topic"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server CHANINFO #FullKeyed +Pkl Secret 0 :"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server CHANINFO #InviteChannel +Pi"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server PING :ngircd.test.server"
 }
 # Emulate network burst
 send ":ngircd.test.server3 NICK NickName 1 ~User localhost 1 + :Real Name\r"
 send ":ngircd.test.server3 NJOIN #Channel :@NickName\r"
 # End of burst
 send ":ngircd.test.server3 PONG :ngircd.test.server\r"
 # Test server-server link ...
 send ":ngircd.test.server3 VERSION\r"
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server 351 ngircd.test.server3 "
 }
 # Make sure our test client is still known in the network
 send ":ngircd.test.server3 WHOIS NickName\r"
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server 311 ngircd.test.server3 NickName ~User localhost * :Real Name"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server 319 ngircd.test.server3 NickName :@#Channel"
 }
 expect {
 	timeout { exit 1 }
 	":ngircd.test.server 318 ngircd.test.server3 NickName :"
 }
 # Logout
 send ":ngircd.test.server3 QUIT\r"
 expect {
 	timeout { exit 1 }
 	"ERROR :Closing connection"
 }
--- a/src/testsuite/ssl/cert-my-first-domain-tld.pem
+++ b/src/testsuite/ssl/cert-my-first-domain-tld.pem
@@ -0,0 +1,24 @@
 -----BEGIN CERTIFICATE-----
 MIIEDDCCAnSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAeMRwwGgYDVQQDExNteS5m
 aXJzdC5kb21haW4udGxkMB4XDTIwMDQyNDA4MjQyNVoXDTQ3MDkxMDA4MjQyNVow
 HjEcMBoGA1UEAxMTbXkuZmlyc3QuZG9tYWluLnRsZDCCAaIwDQYJKoZIhvcNAQEB
 BQADggGPADCCAYoCggGBAJ3HvAIDQxL/o7yoemMH5OZEXyFTQ/Q838UY0lXbWBb0
 Lsz9ft0UFtu/SSabHLLJHQME99IyleYiMwi0Y3oqDCVZp6eqeKS7MTRIot2D1m4T
 QsK13dAvZOaEYPsltdsFDCP75s07tDp9aYYsHDsNhHu8LxUachmb3747/v1E1TGZ
 T5BSnzGxEsQo1vzKKMpMbjct1d3zdQRB1o/r6BlaPykTAaB1DkM7GOOdtprhO/Sh
 PbfXL+BHgldPbxboul7NTt1r2CfqFmz4Pi4PbCruv0HVG8N8egN6Jb80UuwOiCcM
 BxY9uhCh6ZPoZ9ufmGALhkgD0rlt/sQfKQ0EImzx8cC/6zvSfJQ0WazLp/wCImkP
 QZwKm/U6RMHWtthHg4pJRsYF5rL2+YMqebTcG655+fgQm9EI+ZcAqWIbnogGA046
 oS1X7805ogBo7OPMlJ19NjxOc3yS9dXlk6hEe0AKSCCusy4lI4gcGd2gwmAtXp3i
 ZVkFBsUsmBe3x5sEAEVVyQIDAQABo1UwUzAMBgNVHRMBAf8EAjAAMBMGA1UdJQQM
 MAoGCCsGAQUFBwMBMA8GA1UdDwEB/wQFAwMHoAAwHQYDVR0OBBYEFFst+QAEUdCP
 V80/hmOEBKtjOMRLMA0GCSqGSIb3DQEBCwUAA4IBgQCOEIJgi0H1lc33dU8Na4//
 CI3rOOYwFnSiiUe8A5n38LsU2ZrwwJmn60JgNdAmrNkXTI8qNTuTU6XIOAqq32FY
 wdNqPt7wE7UDRMQeMDlLNo+lnuI1XrBxk9mEpfmyGeGqeIDIr5vlEWs4Snr73RC0
 iQBUD6qGdhZa/ABm342psSA4OxtjCn6mBBT/gSi8yCO0Po8yFvndGMe3kNQFwir4
 supxptzqFDCDOQOYSgUy2QT7wlFAqPdZWMSepdeoaBYrqBsvf9shWC0iChKJxnCp
 SVZpoPysxuVyQMKjjzTJcNDwydMyIny4Z9rt+kkvgn/JDxIQe1+jJ8dJR+VWQeNe
 we604uEsN0hWq1FkkMO8NQdbM4xipDciEanHunWvwFkXuIuc0aEpqIchU32O2wav
 ck8ytssLLQDGaJLHx6iOB2MCi8HbS8U9xfrg8JJIFnxmnkKdI6x2akzYm+nqDxqQ
 dGeoVJgegiamYlydkGskw04oGkD16H0LQwlzsDwgvP8=
 -----END CERTIFICATE-----
--- a/src/testsuite/ssl/cert-my-second-domain-tld.pem
+++ b/src/testsuite/ssl/cert-my-second-domain-tld.pem
@@ -0,0 +1,24 @@
 -----BEGIN CERTIFICATE-----
 MIIEDjCCAnagAwIBAgIBATANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDExRteS5z
 ZWNvbmQuZG9tYWluLnRsZDAeFw0yMDA0MjQwODIzNDBaFw00NzA5MTAwODIzNDBa
 MB8xHTAbBgNVBAMTFG15LnNlY29uZC5kb21haW4udGxkMIIBojANBgkqhkiG9w0B
 AQEFAAOCAY8AMIIBigKCAYEA4+442scsdqSf6O4UO/RskMzOX8BhDcSwrhGe97jd
 CuQKUqS6OT1UoHK0DdMkxHlOMhifPzKxoBQlI/02l14tV//xNArKj4a+BZzNS1mp
 3adjgTc3uRDQHmHVZUzH4VXhL2zZ1EXVaJULZVWJYAqMW8GOObs+Kwijo+zxBGRs
 96Re9sg3XMkCUN+ZMoCpqoU4R/QiJ5z7B4AXS9CVcvczQKiULn1otP+UQQ4ABHlN
 t8pZzR6P/WGy91PvGt5wWfpReGveP/Zl2tksVXXs0CQgteneblYVzj01MaobVW59
 /LGUpe0oQy2rtzQVX3DZkDoGwGh4lof2Af+xMjCbVL6oDbPPooXG8TJnDP3AVhMG
 KIb+EhBUIEJnd/z6ZXTWbv0KQOt4wiVBzuXVBf7xxn/aH4+3kyrnj7CsUHXM4++x
 KRZq7gaP7nRbN22rw+WCHnqvMfAGnS7/6AjKFUWxmNWxRXMX+ehsSbT/XQnQm88e
 oUBLzQc4JrNSPklVJ82Qp19tAgMBAAGjVTBTMAwGA1UdEwEB/wQCMAAwEwYDVR0l
 BAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAwegADAdBgNVHQ4EFgQUdnjZogYk
 7JK21Fj2NfYwrtJzK1EwDQYJKoZIhvcNAQELBQADggGBABDreWdgeyLMvqv1fO1f
 zbkSxUp57XoQsX3G/1nUfjT2Zujxwvu8D9N74R3I/BsxVTiI4RL2LZj33q+eq0KX
 LG/zBH2DEBheMmQtbMS6Ah+MTSlvG8SDlRRYPEVdYYtXOwskGNyIwcqNTr0j2Mrn
 Zlre0VJQc5r94seoVCjCseio26I9qf0LW2QsGfk4vSMJlhTRkcbBjKABG8xGXv61
 +Hd4OFA0e/gOzFZFwDxWEsks5d8w6kzyipdGcCezBhlDi/qNCAex1GVTdUsCbGNS
 9N2i1Cty01AJbrkfWwKCc/Xg/YV/9PVncoiwJSIILllmFvLPu0vRof8AX/4DxEkS
 YFnN2x+qyukW+DfSnC3YSqyKdKtvB0U0Xf4tcHQfX2kHS/PqOIR6F9trY45ZlXoA
 nQKf1vcsIJzHW1mi9SvyVgyp3HftPw5xIU15mHRHBfBEzkVNwZJxyCl6nd++4vMS
 DmzpJPCT/a8rl1Jj5yyQ5zJp06Z7FbPpkT9kiAB5+U/vKw==
 -----END CERTIFICATE-----
--- a/src/testsuite/ssl/dhparams-my-first-domain-tld.pem
+++ b/src/testsuite/ssl/dhparams-my-first-domain-tld.pem
@@ -0,0 +1,77 @@
 Recommended key length: 256 bits
 generator:
 	39:76:54:fb:49:4c:58:2c:f6:62:3a:81:d1:1e:ef:55
 	97:da:5a:9c:f8:11:e4:23:26:91:e2:d4:14:94:14:e1
 	d2:82:69:b6:f0:2e:af:08:cc:bc:21:0d:e5:a7:40:f9
 	8d:18:a2:52:6a:41:de:57:c7:17:0d:23:b9:36:3c:33
 	ef:ff:0b:85:b1:a9:59:65:49:46:36:3b:57:e4:b7:91
 	4b:6c:56:1a:47:44:d8:5b:8a:bd:93:93:41:81:01:9d
 	31:8d:3d:b8:a6:6c:7e:48:aa:86:b6:68:eb:66:0b:f3
 	42:58:c5:ef:65:75:9d:8d:0f:18:21:25:86:40:a6:fd
 	23:15:58:82:57:df:b6:0d:e5:c9:f1:85:ef:ec:ae:4a
 	b4:1b:70:ac:f5:c8:75:57:d6:4b:17:ca:f1:a1:45:13
 	c0:e7:2b:b9:26:92:c0:a1:c4:ba:87:4e:b7:37:2f:6c
 	02:51:86:95:2d:f3:c1:7e:c1:f7:00:52:00:0d:43:f2
 	aa:8d:af:f6:5a:4f:a8:65:a5:26:af:58:fa:5d:fb:77
 	42:e2:1e:19:f5:0f:8a:f2:9b:6b:9a:c0:2c:60:4f:45
 	da:9c:54:97:67:6a:e3:62:b9:c1:a0:3d:bf:cb:aa:22
 	23:3b:08:bc:29:6a:a5:91:5e:76:1b:60:1d:c2:02:85
 	2e:c6:85:20:5a:6e:0b:84:e3:e3:88:4e:c5:48:f3:c8
 	c1:71:b0:22:22:70:00:27:99:c6:dc:50:62:2d:be:55
 	65:af:60:d7:43:44:2f:97:72:a2:66:48:fa:ee:af:7a
 	81:cc:77:97:95:61:74:37:44:f2:b9:8e:9a:90:e4:45
 	89:69:66:fe:52:fe:82:d2:de:4c:11:64:a2:c3:6e:00
 	e4:a7:58:4f:e9:61:0d:d2:72:a1:fb:72:89:84:73:64
 	de:1a:2c:0f:7e:46:5f:73:f6:67:3f:14:86:1c:90:bf
 	49:d6:d1:3c:6a:6a:8b:42:29:22:02:47:c4:b9:bb:64
 prime:
 	90:cb:d2:ec:9f:0c:6c:69:f5:c0:46:e1:9c:fc:4d:3b
 	ff:65:40:32:66:d5:fa:e0:ee:88:7d:35:ad:5e:1a:37
 	07:db:c0:ed:a4:b2:94:ed:41:b4:be:be:35:e3:36:ff
 	04:c2:48:4d:f0:e9:d2:54:54:de:10:4b:1c:6b:0e:e6
 	8f:c1:8a:9f:9d:e2:f0:9e:35:52:b7:2a:29:5e:e1:95
 	c0:e0:6e:2b:a9:eb:00:fb:fe:90:d9:aa:02:2d:52:e5
 	09:fe:5a:e9:5e:73:e1:94:d1:a5:a1:f5:3b:97:e8:53
 	67:ea:86:a7:f2:70:5c:31:7f:ed:23:f1:ce:01:62:e5
 	0c:7b:7c:18:67:ec:42:35:e8:d1:3d:e1:74:f9:77:02
 	fb:8d:24:a7:bf:3a:38:36:cf:82:9e:90:b2:7c:c3:f3
 	d3:e4:f1:55:ca:4b:1e:5e:50:b9:3b:d8:6a:6c:c2:51
 	a9:a7:e2:86:02:ef:7b:c2:d1:80:e2:dd:e0:7c:e2:03
 	e5:b1:e9:5b:45:c7:56:bb:37:56:9a:4a:0e:7e:b6:f6
 	a5:95:ef:93:5f:f9:38:16:e3:73:b5:68:a7:98:15:a2
 	6c:ff:6b:2e:89:f7:9f:f8:a9:d7:ce:a4:9a:de:cb:42
 	90:40:7b:fe:6c:3a:e0:4c:42:fe:0c:af:4e:7f:37:be
 	fd:3b:31:17:f6:30:0d:52:a5:ca:19:c3:c6:a4:dc:48
 	ec:59:02:6e:5a:80:b8:09:7d:3d:9a:00:32:7a:d7:fe
 	84:38:12:22:7f:c6:97:88:91:05:7f:ba:74:2b:8c:36
 	a0:e4:d7:1c:22:2f:0b:6a:cb:a8:71:40:d2:b1:ed:9f
 	43:79:2f:a6:34:7d:c0:65:c4:04:fa:d4:5c:14:7c:4b
 	6f:cb:b2:f8:f0:91:05:33:b7:23:58:e8:4d:ff:3f:ef
 	a4:f3:17:78:9b:5b:f6:f1:49:82:12:de:5d:f7:1d:47
 	1e:08:7f:ee:2d:10:68:f8:a5:97:03:9d:32:d2:9c:b7
 -----BEGIN DH PARAMETERS-----
 MIIDDQKCAYEAkMvS7J8MbGn1wEbhnPxNO/9lQDJm1frg7oh9Na1eGjcH28DtpLKU
 7UG0vr414zb/BMJITfDp0lRU3hBLHGsO5o/Bip+d4vCeNVK3Kile4ZXA4G4rqesA
 +/6Q2aoCLVLlCf5a6V5z4ZTRpaH1O5foU2fqhqfycFwxf+0j8c4BYuUMe3wYZ+xC
 NejRPeF0+XcC+40kp786ODbPgp6QsnzD89Pk8VXKSx5eULk72GpswlGpp+KGAu97
 wtGA4t3gfOID5bHpW0XHVrs3VppKDn629qWV75Nf+TgW43O1aKeYFaJs/2suifef
 +KnXzqSa3stCkEB7/mw64ExC/gyvTn83vv07MRf2MA1SpcoZw8ak3EjsWQJuWoC4
 CX09mgAyetf+hDgSIn/Gl4iRBX+6dCuMNqDk1xwiLwtqy6hxQNKx7Z9DeS+mNH3A
 ZcQE+tRcFHxLb8uy+PCRBTO3I1joTf8/76TzF3ibW/bxSYIS3l33HUceCH/uLRBo
 +KWXA50y0py3AoIBgDl2VPtJTFgs9mI6gdEe71WX2lqc+BHkIyaR4tQUlBTh0oJp
 tvAurwjMvCEN5adA+Y0YolJqQd5XxxcNI7k2PDPv/wuFsalZZUlGNjtX5LeRS2xW
 GkdE2FuKvZOTQYEBnTGNPbimbH5Iqoa2aOtmC/NCWMXvZXWdjQ8YISWGQKb9IxVY
 glfftg3lyfGF7+yuSrQbcKz1yHVX1ksXyvGhRRPA5yu5JpLAocS6h063Ny9sAlGG
 lS3zwX7B9wBSAA1D8qqNr/ZaT6hlpSavWPpd+3dC4h4Z9Q+K8ptrmsAsYE9F2pxU
 l2dq42K5waA9v8uqIiM7CLwpaqWRXnYbYB3CAoUuxoUgWm4LhOPjiE7FSPPIwXGw
 IiJwACeZxtxQYi2+VWWvYNdDRC+XcqJmSPrur3qBzHeXlWF0N0TyuY6akORFiWlm
 /lL+gtLeTBFkosNuAOSnWE/pYQ3ScqH7comEc2TeGiwPfkZfc/ZnPxSGHJC/SdbR
 PGpqi0IpIgJHxLm7ZAICAQA=
 -----END DH PARAMETERS-----
--- a/src/testsuite/ssl/dhparams-my-second-domain-tld.pem
+++ b/src/testsuite/ssl/dhparams-my-second-domain-tld.pem
@@ -0,0 +1,77 @@
 Recommended key length: 256 bits
 generator:
 	da:16:f5:61:0c:09:de:cd:9b:be:b8:2b:c9:96:97:1b
 	fc:29:b2:a5:1b:ee:d3:36:bd:6c:73:7e:1c:2a:35:71
 	26:c6:54:b6:28:24:db:87:9d:fc:9e:26:28:e9:01:b8
 	85:f2:02:9b:6a:c3:f5:3a:85:ae:1d:8c:e9:e8:c4:41
 	3a:78:2f:9e:f0:2a:77:18:99:a6:91:2b:2b:8c:10:98
 	89:04:d9:03:5f:4f:77:d6:27:1d:5e:ee:a2:d0:b1:c8
 	a7:64:b4:7a:67:5f:aa:3f:02:b0:d2:f7:cd:4c:7a:9d
 	63:57:99:8c:89:17:3f:2d:2d:1d:f5:58:61:49:62:54
 	55:17:be:ea:43:03:44:d7:02:39:67:26:b3:7a:4f:00
 	a3:a1:3b:d9:f3:aa:7a:c5:00:46:86:92:e2:2e:d8:09
 	ee:ca:97:06:c5:33:e5:99:f3:4c:46:81:50:59:6b:60
 	fb:a3:24:2a:f8:8f:e0:fb:a5:c3:9a:7d:f7:f2:d7:30
 	e5:1b:fa:15:a0:ca:6d:f5:64:4f:20:a3:fb:f4:31:55
 	b5:58:c4:6f:06:7d:5d:36:16:03:31:73:57:6b:39:c6
 	10:21:d9:f0:eb:74:43:2e:b0:da:ee:96:86:6e:0c:b5
 	08:78:af:3d:9b:66:71:bc:05:63:9d:aa:a6:2e:bc:c9
 	c0:e4:a4:c6:60:e8:5d:d2:96:55:a3:72:4e:7a:ec:b2
 	a8:23:b9:3f:7c:33:5d:f0:5f:29:57:cd:8e:9a:fd:7b
 	b6:83:7f:56:ba:64:bd:a8:1c:83:7f:ee:04:f1:bb:1f
 	70:6d:08:46:a2:95:e6:6e:2a:54:44:d9:af:9d:22:a4
 	50:6d:88:65:de:05:89:99:75:7e:0c:12:d9:25:43:f7
 	da:b6:41:f8:60:68:f7:6a:f6:a4:8d:8b:93:82:87:56
 	c1:80:4d:e6:66:37:1e:22:5c:86:90:d1:8e:02:3a:18
 	34:84:6a:da:e5:4f:a5:4f:29:78:46:97:71:24:80:92
 prime:
 	f8:98:84:b9:b2:75:39:d5:da:14:fa:4a:03:96:57:78
 	95:4e:8c:ba:c3:89:de:36:2c:4a:2b:0a:31:08:09:89
 	bb:f6:00:a1:0b:64:02:52:1e:3f:23:67:df:2c:97:7a
 	7a:81:e0:b0:ae:00:bf:a6:8f:02:e1:62:d4:dc:9e:62
 	9a:27:f2:cf:4f:88:73:96:de:8a:61:1c:ac:3f:bb:f3
 	0d:be:5e:07:3b:6f:da:0c:10:03:b5:b2:5a:60:3e:c8
 	6f:aa:2c:3e:92:b9:ec:ee:08:29:90:c3:5e:8e:c1:a4
 	a7:1a:ab:87:f8:70:13:e8:b1:2f:b5:79:c1:bb:8f:21
 	76:b4:1f:ba:91:62:f9:d3:3a:d7:c8:23:00:3e:fe:a5
 	49:51:f8:eb:9f:46:e3:7d:1a:d3:54:a1:3a:d1:4b:05
 	ec:77:6e:80:dc:1b:22:e1:36:2a:a1:75:20:8c:48:bd
 	53:a6:24:c0:b2:47:36:51:0d:69:b3:cc:e6:fe:8c:34
 	0e:1f:16:03:af:81:b7:62:11:a8:82:06:c2:70:00:23
 	fe:0e:e0:fa:a1:e7:3d:cc:81:ae:76:f4:3e:66:84:df
 	3f:63:ba:4e:aa:21:1d:5c:a2:a2:55:0e:53:31:40:7d
 	7a:99:20:77:23:82:0c:a7:b3:1b:dd:13:fc:23:5f:6d
 	58:6c:a7:1f:f6:1a:7c:2a:57:31:c1:10:7b:f1:54:a9
 	8c:49:7f:17:14:5f:a4:69:16:11:6c:7d:1d:eb:d4:88
 	ab:6b:f8:8d:8b:be:0d:45:c7:7b:04:4f:a3:5f:f4:4f
 	83:12:0c:00:73:5d:57:02:0c:95:b6:ce:70:60:52:80
 	05:79:55:ed:99:e3:0c:23:dc:23:cd:9b:d3:a5:8e:4d
 	94:c8:61:2d:56:b1:15:19:ca:b2:2c:76:7c:89:04:44
 	18:5c:72:1e:03:9b:e0:dd:69:44:9f:68:0d:c4:2a:34
 	5e:bd:4f:6c:14:41:93:08:0d:4b:4d:de:97:41:9b:8d
 -----BEGIN DH PARAMETERS-----
 MIIDDgKCAYEA+JiEubJ1OdXaFPpKA5ZXeJVOjLrDid42LEorCjEICYm79gChC2QC
 Uh4/I2ffLJd6eoHgsK4Av6aPAuFi1NyeYpon8s9PiHOW3ophHKw/u/MNvl4HO2/a
 DBADtbJaYD7Ib6osPpK57O4IKZDDXo7BpKcaq4f4cBPosS+1ecG7jyF2tB+6kWL5
 0zrXyCMAPv6lSVH4659G430a01ShOtFLBex3boDcGyLhNiqhdSCMSL1TpiTAskc2
 UQ1ps8zm/ow0Dh8WA6+Bt2IRqIIGwnAAI/4O4Pqh5z3Mga529D5mhN8/Y7pOqiEd
 XKKiVQ5TMUB9epkgdyOCDKezG90T/CNfbVhspx/2GnwqVzHBEHvxVKmMSX8XFF+k
 aRYRbH0d69SIq2v4jYu+DUXHewRPo1/0T4MSDABzXVcCDJW2znBgUoAFeVXtmeMM
 I9wjzZvTpY5NlMhhLVaxFRnKsix2fIkERBhcch4Dm+DdaUSfaA3EKjRevU9sFEGT
 CA1LTd6XQZuNAoIBgQDaFvVhDAnezZu+uCvJlpcb/CmypRvu0za9bHN+HCo1cSbG
 VLYoJNuHnfyeJijpAbiF8gKbasP1OoWuHYzp6MRBOngvnvAqdxiZppErK4wQmIkE
 2QNfT3fWJx1e7qLQscinZLR6Z1+qPwKw0vfNTHqdY1eZjIkXPy0tHfVYYUliVFUX
 vupDA0TXAjlnJrN6TwCjoTvZ86p6xQBGhpLiLtgJ7sqXBsUz5ZnzTEaBUFlrYPuj
 JCr4j+D7pcOafffy1zDlG/oVoMpt9WRPIKP79DFVtVjEbwZ9XTYWAzFzV2s5xhAh
 2fDrdEMusNruloZuDLUIeK89m2ZxvAVjnaqmLrzJwOSkxmDoXdKWVaNyTnrssqgj
 uT98M13wXylXzY6a/Xu2g39WumS9qByDf+4E8bsfcG0IRqKV5m4qVETZr50ipFBt
 iGXeBYmZdX4MEtklQ/fatkH4YGj3avakjYuTgodWwYBN5mY3HiJchpDRjgI6GDSE
 atrlT6VPKXhGl3EkgJICAgEA
 -----END DH PARAMETERS-----
--- a/Show More
+++ b/Show More
		`@@ -0,0 +1,2 @@`
							`#!/bin/sh`
							`rm ssl/cert.pem ssl/key.pem ssl/dhparams.pem`