]> arthur.barton.de Git - ngircd-alex.git/blobdiff - src/ngircd/conf.c
Convert CONN_ID and Conf_MaxConnections to "int" datatype
[ngircd-alex.git] / src / ngircd / conf.c
index 326b433af62d49b512ba3fd42986b5d7c9381a3a..034281c06a86ac7c42bc3edb6adffcaa3fb0d0ae 100644 (file)
@@ -1,6 +1,6 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2011 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2012 Alexander Barton (alex@barton.de) and Contributors.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -55,16 +55,15 @@ static bool Use_Log = true, Using_MotdFile = true;
 static CONF_SERVER New_Server;
 static int New_Server_Idx;
 
-static size_t Conf_Oper_Count;
-static size_t Conf_Channel_Count;
 static char Conf_MotdFile[FNAME_LEN];
 
 static void Set_Defaults PARAMS(( bool InitServers ));
-static bool Read_Config PARAMS(( bool ngircd_starting ));
+static bool Read_Config PARAMS(( bool TestOnly, bool IsStarting ));
 static bool Validate_Config PARAMS(( bool TestOnly, bool Rehash ));
 
 static void Handle_GLOBAL PARAMS(( int Line, char *Var, char *Arg ));
-static void Handle_FEATURES PARAMS(( int Line, char *Var, char *Arg ));
+static void Handle_LIMITS PARAMS(( int Line, char *Var, char *Arg ));
+static void Handle_OPTIONS PARAMS(( int Line, char *Var, char *Arg ));
 static void Handle_OPERATOR PARAMS(( int Line, char *Var, char *Arg ));
 static void Handle_SERVER PARAMS(( int Line, char *Var, char *Arg ));
 static void Handle_CHANNEL PARAMS(( int Line, char *Var, char *Arg ));
@@ -88,6 +87,8 @@ static void Init_Server_Struct PARAMS(( CONF_SERVER *Server ));
 
 #ifdef SSL_SUPPORT
 
+static void Handle_SSL PARAMS(( int Line, char *Var, char *Ark ));
+
 struct SSLOptions Conf_SSLOptions;
 
 /**
@@ -108,56 +109,27 @@ ConfSSL_Init(void)
 }
 
 /**
- * Output SSL configuration variable containing a file name.
- * And make sure that the given file is readable.
+ * Make sure that a configured file is readable.
+ *
+ * Currently, this function is only used for SSL-related options ...
  *
- * @returns true when the file is readable.
+ * @param Var Configuration variable
+ * @param Filename Configured filename
  */
-static bool
-ssl_print_configvar(const char *name, const char *file)
+static void
+CheckFileReadable(const char *Var, const char *Filename)
 {
        FILE *fp;
 
-       if (!file) {
-               printf("  %s =\n", name);
-               return true;
-       }
+       if (!Filename)
+               return;
 
-       fp = fopen(file, "r");
+       fp = fopen(Filename, "r");
        if (fp)
                fclose(fp);
        else
-               fprintf(stderr, "ERROR: %s \"%s\": %s\n",
-                       name, file, strerror(errno));
-
-       printf("  %s = %s\n", name, file);
-       return fp != NULL;
-}
-
-/**
- * Output SSL-related configuration variables.
- *
- * @returns true when all SSL-related configuration variables are valid.
- */
-static bool
-ConfSSL_Puts(void)
-{
-       bool ret;
-
-       ret = ssl_print_configvar("SSLKeyFile", Conf_SSLOptions.KeyFile);
-
-       if (!ssl_print_configvar("SSLCertFile", Conf_SSLOptions.CertFile))
-               ret = false;
-
-       if (!ssl_print_configvar("SSLDHFile", Conf_SSLOptions.DHFile))
-               ret = false;
-
-       if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
-               puts("  SSLKeyFilePassword = <secret>");
-
-       array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
-
-       return ret;
+               Config_Error(LOG_ERR, "Can't read \"%s\" (\"%s\"): %s",
+                            Filename, Var, strerror(errno));
 }
 
 #endif
@@ -234,7 +206,7 @@ ports_parse(array *a, int Line, char *Arg)
 GLOBAL void
 Conf_Init( void )
 {
-       Read_Config( true );
+       Read_Config(false, true);
        Validate_Config(false, false);
 }
 
@@ -246,7 +218,7 @@ Conf_Init( void )
 GLOBAL bool
 Conf_Rehash( void )
 {
-       if (!Read_Config(false))
+       if (!Read_Config(false, false))
                return false;
        Validate_Config(false, true);
 
@@ -291,18 +263,18 @@ static void
 opers_puts(void)
 {
        struct Conf_Oper *op;
-       size_t len;
+       size_t count, i;
 
-       len = array_length(&Conf_Opers, sizeof(*op));
+       count = array_length(&Conf_Opers, sizeof(*op));
        op = array_start(&Conf_Opers);
-       while (len--) {
-               assert(op->name[0]);
+       for (i = 0; i < count; i++, op++) {
+               if (!op->name[0])
+                       continue;
 
                puts("[OPERATOR]");
                printf("  Name = %s\n", op->name);
                printf("  Password = %s\n", op->pwd);
                printf("  Mask = %s\n\n", op->mask ? op->mask : "");
-               op++;
        }
 }
 
@@ -327,29 +299,25 @@ Conf_Test( void )
 
        Use_Log = false;
 
-       if (! Read_Config(true))
+       if (!Read_Config(true, true))
                return 1;
 
        config_valid = Validate_Config(true, false);
 
        /* Valid tty? */
-       if( isatty( fileno( stdin )) && isatty( fileno( stdout ))) {
-               puts( "OK, press enter to see a dump of your service configuration ..." );
-               getchar( );
-       } else {
-               puts( "Ok, dump of your server configuration follows:\n" );
-       }
+       if(isatty(fileno(stdin)) && isatty(fileno(stdout))) {
+               puts("OK, press enter to see a dump of your server configuration ...");
+               getchar();
+       } else
+               puts("Ok, dump of your server configuration follows:\n");
 
-       puts( "[GLOBAL]" );
+       puts("[GLOBAL]");
        printf("  Name = %s\n", Conf_ServerName);
-       printf("  Info = %s\n", Conf_ServerInfo);
-#ifndef PAM
-       printf("  Password = %s\n", Conf_ServerPwd);
-#endif
-       printf("  WebircPassword = %s\n", Conf_WebircPwd);
        printf("  AdminInfo1 = %s\n", Conf_ServerAdmin1);
        printf("  AdminInfo2 = %s\n", Conf_ServerAdmin2);
        printf("  AdminEMail = %s\n", Conf_ServerAdminMail);
+       printf("  Info = %s\n", Conf_ServerInfo);
+       printf("  Listen = %s\n", Conf_ListenAddress);
        if (Using_MotdFile) {
                printf("  MotdFile = %s\n", Conf_MotdFile);
                printf("  MotdPhrase =\n");
@@ -358,59 +326,86 @@ Conf_Test( void )
                printf("  MotdPhrase = %s\n", array_bytes(&Conf_Motd)
                       ? (const char*) array_start(&Conf_Motd) : "");
        }
-       printf("  ChrootDir = %s\n", Conf_Chroot);
+#ifndef PAM
+       printf("  Password = %s\n", Conf_ServerPwd);
+#endif
        printf("  PidFile = %s\n", Conf_PidFile);
-       printf("  Listen = %s\n", Conf_ListenAddress);
-       fputs("  Ports = ", stdout);
+       printf("  Ports = ");
        ports_puts(&Conf_ListenPorts);
-#ifdef SSL_SUPPORT
-       fputs("  SSLPorts = ", stdout);
-       ports_puts(&Conf_SSLOptions.ListenPorts);
-       if (!ConfSSL_Puts())
-               config_valid = false;
-#endif
-
-       pwd = getpwuid(Conf_UID);
-       if (pwd)
-               printf("  ServerUID = %s\n", pwd->pw_name);
-       else
-               printf("  ServerUID = %ld\n", (long)Conf_UID);
        grp = getgrgid(Conf_GID);
        if (grp)
                printf("  ServerGID = %s\n", grp->gr_name);
        else
                printf("  ServerGID = %ld\n", (long)Conf_GID);
-#ifdef SYSLOG
-       printf("  SyslogFacility = %s\n",
-              ngt_SyslogFacilityName(Conf_SyslogFacility));
-#endif
+       pwd = getpwuid(Conf_UID);
+       if (pwd)
+               printf("  ServerUID = %s\n", pwd->pw_name);
+       else
+               printf("  ServerUID = %ld\n", (long)Conf_UID);
+       puts("");
+
+       puts("[LIMITS]");
+       printf("  ConnectRetry = %d\n", Conf_ConnectRetry);
+       printf("  MaxConnections = %d\n", Conf_MaxConnections);
+       printf("  MaxConnectionsIP = %d\n", Conf_MaxConnectionsIP);
+       printf("  MaxJoins = %d\n", Conf_MaxJoins > 0 ? Conf_MaxJoins : -1);
+       printf("  MaxNickLength = %u\n", Conf_MaxNickLength - 1);
        printf("  PingTimeout = %d\n", Conf_PingTimeout);
        printf("  PongTimeout = %d\n", Conf_PongTimeout);
-       printf("  ConnectRetry = %d\n", Conf_ConnectRetry);
-       printf("  OperCanUseMode = %s\n", yesno_to_str(Conf_OperCanMode));
-       printf("  OperServerMode = %s\n", yesno_to_str(Conf_OperServerMode));
+       puts("");
+
+       puts("[OPTIONS]");
        printf("  AllowRemoteOper = %s\n", yesno_to_str(Conf_AllowRemoteOper));
-       printf("  PredefChannelsOnly = %s\n", yesno_to_str(Conf_PredefChannelsOnly));
+       printf("  ChrootDir = %s\n", Conf_Chroot);
+       printf("  CloakHost = %s\n", Conf_CloakHost);
+       printf("  CloakHostModeX = %s\n", Conf_CloakHostModeX);
+       printf("  CloakHostSalt = %s\n", Conf_CloakHostSalt);
+       printf("  CloakUserToNick = %s\n", yesno_to_str(Conf_CloakUserToNick));
 #ifdef WANT_IPV6
        printf("  ConnectIPv4 = %s\n", yesno_to_str(Conf_ConnectIPv6));
        printf("  ConnectIPv6 = %s\n", yesno_to_str(Conf_ConnectIPv4));
 #endif
-       printf("  MaxConnections = %ld\n", Conf_MaxConnections);
-       printf("  MaxConnectionsIP = %d\n", Conf_MaxConnectionsIP);
-       printf("  MaxJoins = %d\n", Conf_MaxJoins > 0 ? Conf_MaxJoins : -1);
-       printf("  MaxNickLength = %u\n", Conf_MaxNickLength - 1);
+       printf("  DNS = %s\n", yesno_to_str(Conf_DNS));
+#ifdef IDENT
+       printf("  Ident = %s\n", yesno_to_str(Conf_Ident));
+#endif
+       printf("  MorePrivacy = %s\n", yesno_to_str(Conf_MorePrivacy));
        printf("  NoticeAuth = %s\n", yesno_to_str(Conf_NoticeAuth));
-       printf("  CloakHost = %s\n", Conf_CloakHost);
-       printf("  CloakUserToNick = %s\n", yesno_to_str(Conf_CloakUserToNick));
+       printf("  OperCanUseMode = %s\n", yesno_to_str(Conf_OperCanMode));
+       printf("  OperServerMode = %s\n", yesno_to_str(Conf_OperServerMode));
+#ifdef PAM
+       printf("  PAM = %s\n", yesno_to_str(Conf_PAM));
+       printf("  PAMIsOptional = %s\n", yesno_to_str(Conf_PAMIsOptional));
+#endif
+       printf("  PredefChannelsOnly = %s\n", yesno_to_str(Conf_PredefChannelsOnly));
 #ifndef STRICT_RFC
        printf("  RequireAuthPing = %s\n", yesno_to_str(Conf_AuthPing));
 #endif
+       printf("  ScrubCTCP = %s\n", yesno_to_str(Conf_ScrubCTCP));
+#ifdef SYSLOG
+       printf("  SyslogFacility = %s\n",
+              ngt_SyslogFacilityName(Conf_SyslogFacility));
+#endif
+       printf("  WebircPassword = %s\n", Conf_WebircPwd);
+       puts("");
 
-       printf("\n[FEATURES]\n");
-       printf("  DNS = %s\n", yesno_to_str(Conf_DNS));
-       printf("  Ident = %s\n", yesno_to_str(Conf_Ident));
-       printf("  PAM = %s\n", yesno_to_str(Conf_PAM));
+#ifdef SSL_SUPPORT
+       puts("[SSL]");
+       printf("  CertFile = %s\n", Conf_SSLOptions.CertFile
+                                       ? Conf_SSLOptions.CertFile : "");
+       printf("  DHFile = %s\n", Conf_SSLOptions.DHFile
+                                       ? Conf_SSLOptions.DHFile : "");
+       printf("  KeyFile = %s\n", Conf_SSLOptions.KeyFile
+                                       ? Conf_SSLOptions.KeyFile : "");
+       if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
+               puts("  KeyFilePassword = <secret>");
+       else
+               puts("  KeyFilePassword = ");
+       array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
+       printf("  Ports = ");
+       ports_puts(&Conf_SSLOptions.ListenPorts);
        puts("");
+#endif
 
        opers_puts();
 
@@ -499,6 +494,14 @@ Conf_SetServer( int ConfServer, CONN_ID Idx )
        assert( ConfServer > NONE );
        assert( Idx > NONE );
 
+       if (Conf_Server[ConfServer].conn_id > NONE &&
+           Conf_Server[ConfServer].conn_id != Idx) {
+               Log(LOG_ALERT,
+                       "Trying to update connection index for already registered server \"%s\": %d/%d - ignored.",
+                       Conf_Server[ConfServer].name,
+                       Conf_Server[ConfServer].conn_id, Idx);
+               return;
+       }
        Conf_Server[ConfServer].conn_id = Idx;
 }
 
@@ -633,30 +636,41 @@ Conf_AddServer(const char *Name, UINT16 Port, const char *Host,
 }
 
 /**
- * Check if the given nick name is an service.
+ * Check if the given nick name is reserved for services on a particular server.
  *
+ * @param ConfServer The server index to check.
+ * @param Nick The nick name to check.
  * @returns true if the given nick name belongs to an "IRC service".
  */
 GLOBAL bool
-Conf_IsService(int ConfServer, const char *Nick)
+Conf_NickIsService(int ConfServer, const char *Nick)
 {
-       return MatchCaseInsensitive(Conf_Server[ConfServer].svs_mask, Nick);
-} /* Conf_IsService */
+       assert (ConfServer >= 0);
+       assert (ConfServer < MAX_SERVERS);
 
+       return MatchCaseInsensitiveList(Conf_Server[ConfServer].svs_mask,
+                                       Nick, ",");
+}
 
-static void
-Set_Defaults_Optional(void)
+/**
+ * Check if the given nick name is blocked for "normal client" use.
+ *
+ * @param ConfServer The server index or NONE to check all configured servers.
+ * @param Nick The nick name to check.
+ * @returns true if the given nick name belongs to an "IRC service".
+ */
+GLOBAL bool
+Conf_NickIsBlocked(const char *Nick)
 {
-#ifdef IDENTAUTH
-       Conf_Ident = true;
-#else
-       Conf_Ident = false;
-#endif
-#ifdef PAM
-       Conf_PAM = true;
-#else
-       Conf_PAM = false;
-#endif
+       int i;
+
+       for(i = 0; i < MAX_SERVERS; i++) {
+               if (!Conf_Server[i].name[0])
+                       continue;
+               if (Conf_NickIsService(i, Nick))
+                       return true;
+       }
+       return false;
 }
 
 /**
@@ -666,52 +680,68 @@ static void
 Set_Defaults(bool InitServers)
 {
        int i;
+       char random[RANDOM_SALT_LEN + 1];
 
+       /* Global */
        strcpy(Conf_ServerName, "");
-       snprintf(Conf_ServerInfo, sizeof Conf_ServerInfo, "%s %s",
-                PACKAGE_NAME, PACKAGE_VERSION);
-       strcpy(Conf_ServerPwd, "");
-
        strcpy(Conf_ServerAdmin1, "");
        strcpy(Conf_ServerAdmin2, "");
        strcpy(Conf_ServerAdminMail, "");
-
+       snprintf(Conf_ServerInfo, sizeof Conf_ServerInfo, "%s %s",
+                PACKAGE_NAME, PACKAGE_VERSION);
+       free(Conf_ListenAddress);
+       Conf_ListenAddress = NULL;
+       array_free(&Conf_Motd);
        strlcpy(Conf_MotdFile, SYSCONFDIR, sizeof(Conf_MotdFile));
        strlcat(Conf_MotdFile, MOTD_FILE, sizeof(Conf_MotdFile));
-
-       Conf_UID = Conf_GID = 0;
-       strlcpy(Conf_Chroot, CHROOT_DIR, sizeof(Conf_Chroot));
+       strcpy(Conf_ServerPwd, "");
        strlcpy(Conf_PidFile, PID_FILE, sizeof(Conf_PidFile));
+       Conf_UID = Conf_GID = 0;
 
-       free(Conf_ListenAddress);
-       Conf_ListenAddress = NULL;
-
-       Conf_PingTimeout = 120;
-       Conf_PongTimeout = 20;
+       /* Limits */
        Conf_ConnectRetry = 60;
-       Conf_DNS = true;
-       Conf_NoticeAuth = false;
-
-       Conf_Oper_Count = 0;
-       Conf_Channel_Count = 0;
-
-       Conf_OperCanMode = false;
-       Conf_OperServerMode = false;
-       Conf_AllowRemoteOper = false;
-       Conf_PredefChannelsOnly = false;
-
-       Conf_ConnectIPv4 = true;
-       Conf_ConnectIPv6 = true;
-
        Conf_MaxConnections = 0;
        Conf_MaxConnectionsIP = 5;
        Conf_MaxJoins = 10;
        Conf_MaxNickLength = CLIENT_NICK_LEN_DEFAULT;
+       Conf_PingTimeout = 120;
+       Conf_PongTimeout = 20;
 
+       /* Options */
+       Conf_AllowRemoteOper = false;
+#ifndef STRICT_RFC
+       Conf_AuthPing = false;
+#endif
+       strlcpy(Conf_Chroot, CHROOT_DIR, sizeof(Conf_Chroot));
        strcpy(Conf_CloakHost, "");
+       strcpy(Conf_CloakHostModeX, "");
+       strcpy(Conf_CloakHostSalt, ngt_RandomStr(random, RANDOM_SALT_LEN));
        Conf_CloakUserToNick = false;
-
+       Conf_ConnectIPv4 = true;
+#ifdef WANT_IPV6
+       Conf_ConnectIPv6 = true;
+#else
+       Conf_ConnectIPv6 = false;
+#endif
+       Conf_DNS = true;
+#ifdef IDENTAUTH
+       Conf_Ident = true;
+#else
+       Conf_Ident = false;
+#endif
+       Conf_MorePrivacy = false;
+       Conf_NoticeAuth = false;
+       Conf_OperCanMode = false;
+       Conf_OperServerMode = false;
+#ifdef PAM
+       Conf_PAM = true;
+#else
+       Conf_PAM = false;
+#endif
+       Conf_PAMIsOptional = false;
+       Conf_PredefChannelsOnly = false;
 #ifdef SYSLOG
+       Conf_ScrubCTCP = false;
 #ifdef LOG_LOCAL5
        Conf_SyslogFacility = LOG_LOCAL5;
 #else
@@ -719,20 +749,11 @@ Set_Defaults(bool InitServers)
 #endif
 #endif
 
-#ifndef STRICT_RFC
-       Conf_AuthPing = false;
-#endif
-
-       Set_Defaults_Optional();
-
        /* Initialize server configuration structures */
        if (InitServers) {
                for (i = 0; i < MAX_SERVERS;
                     Init_Server_Struct(&Conf_Server[i++]));
        }
-
-       /* Free MOTD; this is important when reloading the configuration */
-       array_free(&Conf_Motd);
 }
 
 /**
@@ -797,11 +818,12 @@ Read_Motd(const char *filename)
  *                             successfully; false otherwise.
  */
 static bool
-Read_Config( bool ngircd_starting )
+Read_Config(bool TestOnly, bool IsStarting)
 {
        char section[LINE_LEN], str[LINE_LEN], *var, *arg, *ptr;
        const UINT16 defaultport = 6667;
        int line, i, n;
+       size_t count;
        FILE *fd;
 
        /* Open configuration file */
@@ -810,16 +832,19 @@ Read_Config( bool ngircd_starting )
                /* No configuration file found! */
                Config_Error( LOG_ALERT, "Can't read configuration \"%s\": %s",
                                        NGIRCd_ConfFile, strerror( errno ));
-               if (!ngircd_starting)
+               if (!IsStarting)
                        return false;
                Config_Error( LOG_ALERT, "%s exiting due to fatal errors!", PACKAGE_NAME );
                exit( 1 );
        }
 
        opers_free();
-       Set_Defaults( ngircd_starting );
+       Set_Defaults(IsStarting);
 
-       Config_Error( LOG_INFO, "Reading configuration from \"%s\" ...", NGIRCd_ConfFile );
+       if (TestOnly)
+               Config_Error(LOG_INFO,
+                            "Reading configuration from \"%s\" ...",
+                            NGIRCd_ConfFile );
 
        /* Clean up server configuration structure: mark all already
         * configured servers as "once" so that they are deleted
@@ -872,8 +897,13 @@ Read_Config( bool ngircd_starting )
                /* Is this the beginning of a new section? */
                if(( str[0] == '[' ) && ( str[strlen( str ) - 1] == ']' )) {
                        strlcpy( section, str, sizeof( section ));
-                       if (strcasecmp( section, "[GLOBAL]" ) == 0 ||
-                           strcasecmp( section, "[FEATURES]") == 0)
+                       if (strcasecmp(section, "[GLOBAL]") == 0
+                           || strcasecmp(section, "[LIMITS]") == 0
+                           || strcasecmp(section, "[OPTIONS]") == 0
+#ifdef SSL_SUPPORT
+                           || strcasecmp(section, "[SSL]") == 0
+#endif
+                           )
                                continue;
 
                        if( strcasecmp( section, "[SERVER]" ) == 0 ) {
@@ -900,16 +930,36 @@ Read_Config( bool ngircd_starting )
                                else New_Server_Idx = i;
                                continue;
                        }
+
                        if (strcasecmp(section, "[CHANNEL]") == 0) {
-                               Conf_Channel_Count++;
+                               count = array_length(&Conf_Channels,
+                                                    sizeof(struct Conf_Channel));
+                               if (!array_alloc(&Conf_Channels,
+                                                sizeof(struct Conf_Channel),
+                                                count)) {
+                                       Config_Error(LOG_ERR,
+                                                    "Could not allocate memory for new operator (line %d)",
+                                                    line);
+                               }
                                continue;
                        }
+
                        if (strcasecmp(section, "[OPERATOR]") == 0) {
-                               Conf_Oper_Count++;
+                               count = array_length(&Conf_Opers,
+                                                    sizeof(struct Conf_Oper));
+                               if (!array_alloc(&Conf_Opers,
+                                                sizeof(struct Conf_Oper),
+                                                count)) {
+                                       Config_Error(LOG_ERR,
+                                                    "Could not allocate memory for new channel (line &d)",
+                                                    line);
+                               }
                                continue;
                        }
 
-                       Config_Error( LOG_ERR, "%s, line %d: Unknown section \"%s\"!", NGIRCd_ConfFile, line, section );
+                       Config_Error(LOG_ERR,
+                                    "%s, line %d: Unknown section \"%s\"!",
+                                    NGIRCd_ConfFile, line, section);
                        section[0] = 0x1;
                }
                if( section[0] == 0x1 ) continue;
@@ -924,12 +974,26 @@ Read_Config( bool ngircd_starting )
                var = str; ngt_TrimStr( var );
                arg = ptr + 1; ngt_TrimStr( arg );
 
-               if( strcasecmp( section, "[GLOBAL]" ) == 0 ) Handle_GLOBAL( line, var, arg );
-               else if( strcasecmp( section, "[FEATURES]" ) == 0 ) Handle_FEATURES( line, var, arg );
-               else if( strcasecmp( section, "[OPERATOR]" ) == 0 ) Handle_OPERATOR( line, var, arg );
-               else if( strcasecmp( section, "[SERVER]" ) == 0 ) Handle_SERVER( line, var, arg );
-               else if( strcasecmp( section, "[CHANNEL]" ) == 0 ) Handle_CHANNEL( line, var, arg );
-               else Config_Error( LOG_ERR, "%s, line %d: Variable \"%s\" outside section!", NGIRCd_ConfFile, line, var );
+               if(strcasecmp(section, "[GLOBAL]") == 0)
+                       Handle_GLOBAL(line, var, arg);
+               else if(strcasecmp(section, "[LIMITS]") == 0)
+                       Handle_LIMITS(line, var, arg);
+               else if(strcasecmp(section, "[OPTIONS]") == 0)
+                       Handle_OPTIONS(line, var, arg);
+#ifdef SSL_SUPPORT
+               else if(strcasecmp(section, "[SSL]") == 0)
+                       Handle_SSL(line, var, arg);
+#endif
+               else if(strcasecmp(section, "[OPERATOR]") == 0)
+                       Handle_OPERATOR(line, var, arg);
+               else if(strcasecmp(section, "[SERVER]") == 0)
+                       Handle_SERVER(line, var, arg);
+               else if(strcasecmp(section, "[CHANNEL]") == 0)
+                       Handle_CHANNEL(line, var, arg);
+               else
+                       Config_Error(LOG_ERR,
+                                    "%s, line %d: Variable \"%s\" outside section!",
+                                    NGIRCd_ConfFile, line, var);
        }
 
        /* Close configuration file */
@@ -963,21 +1027,33 @@ Read_Config( bool ngircd_starting )
        /* No MOTD phrase configured? (re)try motd file. */
        if (array_bytes(&Conf_Motd) == 0)
                Read_Motd(Conf_MotdFile);
+
+#ifdef SSL_SUPPORT
+       /* Make sure that all SSL-related files are readable */
+       CheckFileReadable("CertFile", Conf_SSLOptions.CertFile);
+       CheckFileReadable("DHFile", Conf_SSLOptions.DHFile);
+       CheckFileReadable("KeyFile", Conf_SSLOptions.KeyFile);
+#endif
+
        return true;
 }
 
 /**
- * Check whether an string argument is true or false.
+ * Check whether a string argument is "true" or "false".
  *
  * @param Arg  Input string.
- * @returns    true if string has been parsed as "yes"/"true"/"on".
+ * @returns    true if the input string has been parsed as "yes", "true"
+ *             (case insensitive) or a non-zero integer value.
  */
 static bool
-Check_ArgIsTrue( const char *Arg )
+Check_ArgIsTrue(const char *Arg)
 {
-       if( strcasecmp( Arg, "yes" ) == 0 ) return true;
-       if( strcasecmp( Arg, "true" ) == 0 ) return true;
-       if( atoi( Arg ) != 0 ) return true;
+       if (strcasecmp(Arg, "yes") == 0)
+               return true;
+       if (strcasecmp(Arg, "true") == 0)
+               return true;
+       if (atoi(Arg) != 0)
+               return true;
 
        return false;
 }
@@ -1020,8 +1096,24 @@ WarnIdent(int UNUSED Line)
        if (Conf_Ident) {
                /* user has enabled ident lookups explicitly, but ... */
                Config_Error(LOG_WARNING,
-                       "%s: line %d: %s=True, but ngircd was built without support",
-                       NGIRCd_ConfFile, Line, "Ident");
+                       "%s: line %d: \"Ident = yes\", but ngircd was built without IDENT support!",
+                       NGIRCd_ConfFile, Line);
+       }
+#endif
+}
+
+/**
+ * Output a warning messages if IPv6 is configured but not compiled in.
+ */
+static void
+WarnIPv6(int UNUSED Line)
+{
+#ifndef WANT_IPV6
+       if (Conf_ConnectIPv6) {
+               /* user has enabled IPv6 explicitly, but ... */
+               Config_Error(LOG_WARNING,
+                       "%s: line %d: \"ConnectIPv6 = yes\", but ngircd was built without IPv6 support!",
+                       NGIRCd_ConfFile, Line);
        }
 #endif
 }
@@ -1035,8 +1127,8 @@ WarnPAM(int UNUSED Line)
 #ifndef PAM
        if (Conf_PAM) {
                Config_Error(LOG_WARNING,
-                       "%s: line %d: %s=True, but ngircd was built without support",
-                       NGIRCd_ConfFile, Line, "PAM");
+                       "%s: line %d: \"PAM = yes\", but ngircd was built without PAM support!",
+                       NGIRCd_ConfFile, Line);
        }
 #endif
 }
@@ -1044,8 +1136,8 @@ WarnPAM(int UNUSED Line)
 /**
  * Handle legacy "NoXXX" options in [GLOBAL] section.
  *
- * TODO: This function and support for "NoXXX" should be removed starting
- * with ngIRCd release 19! (One release after marking it "deprecated").
+ * TODO: This function and support for "NoXXX" could be removed starting
+ * with ngIRCd release 19 (one release after marking it "deprecated").
  *
  * @param Var  Variable name.
  * @param Arg  Argument string.
@@ -1054,7 +1146,7 @@ WarnPAM(int UNUSED Line)
 static bool
 CheckLegacyNoOption(const char *Var, const char *Arg)
 {
-       if( strcasecmp( Var, "NoDNS" ) == 0 ) {
+       if(strcasecmp(Var, "NoDNS") == 0) {
                Conf_DNS = !Check_ArgIsTrue( Arg );
                return true;
        }
@@ -1069,6 +1161,56 @@ CheckLegacyNoOption(const char *Var, const char *Arg)
        return false;
 }
 
+/**
+ * Handle deprecated legacy options in [GLOBAL] section.
+ *
+ * TODO: This function and support for these options in the [Global] section
+ * could be removed starting with ngIRCd release 19 (one release after
+ * marking it "deprecated").
+ *
+ * @param Var  Variable name.
+ * @param Arg  Argument string.
+ * @returns    true if a legacy option has been processed; false otherwise.
+ */
+static const char*
+CheckLegacyGlobalOption(int Line, char *Var, char *Arg)
+{
+       if (strcasecmp(Var, "AllowRemoteOper") == 0
+           || strcasecmp(Var, "ChrootDir") == 0
+           || strcasecmp(Var, "ConnectIPv4") == 0
+           || strcasecmp(Var, "ConnectIPv6") == 0
+           || strcasecmp(Var, "OperCanUseMode") == 0
+           || strcasecmp(Var, "OperServerMode") == 0
+           || strcasecmp(Var, "PredefChannelsOnly") == 0
+           || strcasecmp(Var, "SyslogFacility") == 0
+           || strcasecmp(Var, "WebircPassword") == 0) {
+               Handle_OPTIONS(Line, Var, Arg);
+               return "[Options]";
+       }
+       if (strcasecmp(Var, "ConnectRetry") == 0
+           || strcasecmp(Var, "MaxConnections") == 0
+           || strcasecmp(Var, "MaxConnectionsIP") == 0
+           || strcasecmp(Var, "MaxJoins") == 0
+           || strcasecmp(Var, "MaxNickLength") == 0
+           || strcasecmp(Var, "PingTimeout") == 0
+           || strcasecmp(Var, "PongTimeout") == 0) {
+               Handle_LIMITS(Line, Var, Arg);
+               return "[Limits]";
+       }
+#ifdef SSL_SUPPORT
+       if (strcasecmp(Var, "SSLCertFile") == 0
+           || strcasecmp(Var, "SSLDHFile") == 0
+           || strcasecmp(Var, "SSLKeyFile") == 0
+           || strcasecmp(Var, "SSLKeyFilePassword") == 0
+           || strcasecmp(Var, "SSLPorts") == 0) {
+               Handle_SSL(Line, Var + 3, Arg);
+               return "[SSL]";
+       }
+#endif
+
+       return NULL;
+}
+
 /**
  * Strip "no" prefix of a string.
  *
@@ -1113,290 +1255,333 @@ Handle_GLOBAL( int Line, char *Var, char *Arg )
        struct passwd *pwd;
        struct group *grp;
        size_t len;
+       const char *section;
 
-       assert( Line > 0 );
-       assert( Var != NULL );
-       assert( Arg != NULL );
+       assert(Line > 0);
+       assert(Var != NULL);
+       assert(Arg != NULL);
 
-       if( strcasecmp( Var, "Name" ) == 0 ) {
-               /* Server name */
-               len = strlcpy( Conf_ServerName, Arg, sizeof( Conf_ServerName ));
-               if (len >= sizeof( Conf_ServerName ))
-                       Config_Error_TooLong( Line, Var );
-               return;
-       }
-       if( strcasecmp( Var, "CloakHost" ) == 0 ) {
-               /* Client hostname */
-               len = strlcpy( Conf_CloakHost, Arg, sizeof( Conf_CloakHost ));
-               if (len >= sizeof( Conf_CloakHost ))
-                       Config_Error_TooLong( Line, Var );
-               return;
-       }
-       if( strcasecmp( Var, "CloakUserToNick" ) == 0 ) {
-               /* Use client nick name as user name */
-               Conf_CloakUserToNick = Check_ArgIsTrue( Arg );
-               return;
-       }
-       if( strcasecmp( Var, "Info" ) == 0 ) {
-               /* Info text of server */
-               len = strlcpy( Conf_ServerInfo, Arg, sizeof( Conf_ServerInfo ));
-               if (len >= sizeof( Conf_ServerInfo ))
-                       Config_Error_TooLong ( Line, Var );
-               return;
-       }
-       if( strcasecmp( Var, "Password" ) == 0 ) {
-               /* Global server password */
-               len = strlcpy( Conf_ServerPwd, Arg, sizeof( Conf_ServerPwd ));
-               if (len >= sizeof( Conf_ServerPwd ))
-                       Config_Error_TooLong( Line, Var );
+       if (strcasecmp(Var, "Name") == 0) {
+               len = strlcpy(Conf_ServerName, Arg, sizeof(Conf_ServerName));
+               if (len >= sizeof(Conf_ServerName))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if (strcasecmp(Var, "WebircPassword") == 0) {
-               /* Password required for WEBIRC command */
-               len = strlcpy(Conf_WebircPwd, Arg, sizeof(Conf_WebircPwd));
-               if (len >= sizeof(Conf_WebircPwd))
+       if (strcasecmp(Var, "AdminInfo1") == 0) {
+               len = strlcpy(Conf_ServerAdmin1, Arg, sizeof(Conf_ServerAdmin1));
+               if (len >= sizeof(Conf_ServerAdmin1))
                        Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "AdminInfo1" ) == 0 ) {
-               /* Administrative info #1 */
-               len = strlcpy( Conf_ServerAdmin1, Arg, sizeof( Conf_ServerAdmin1 ));
-               if (len >= sizeof( Conf_ServerAdmin1 ))
-                       Config_Error_TooLong ( Line, Var );
+       if (strcasecmp(Var, "AdminInfo2") == 0) {
+               len = strlcpy(Conf_ServerAdmin2, Arg, sizeof(Conf_ServerAdmin2));
+               if (len >= sizeof(Conf_ServerAdmin2))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "AdminInfo2" ) == 0 ) {
-               /* Administrative info #2 */
-               len = strlcpy( Conf_ServerAdmin2, Arg, sizeof( Conf_ServerAdmin2 ));
-               if (len >= sizeof( Conf_ServerAdmin2 ))
-                       Config_Error_TooLong ( Line, Var );
+       if (strcasecmp(Var, "AdminEMail") == 0) {
+               len = strlcpy(Conf_ServerAdminMail, Arg,
+                       sizeof(Conf_ServerAdminMail));
+               if (len >= sizeof(Conf_ServerAdminMail))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "AdminEMail" ) == 0 ) {
-               /* Administrative email contact */
-               len = strlcpy( Conf_ServerAdminMail, Arg, sizeof( Conf_ServerAdminMail ));
-               if (len >= sizeof( Conf_ServerAdminMail ))
-                       Config_Error_TooLong( Line, Var );
+       if (strcasecmp(Var, "Info") == 0) {
+               len = strlcpy(Conf_ServerInfo, Arg, sizeof(Conf_ServerInfo));
+               if (len >= sizeof(Conf_ServerInfo))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-
-       if( strcasecmp( Var, "Ports" ) == 0 ) {
-               ports_parse(&Conf_ListenPorts, Line, Arg);
+       if (strcasecmp(Var, "Listen") == 0) {
+               if (Conf_ListenAddress) {
+                       Config_Error(LOG_ERR,
+                                    "Multiple Listen= options, ignoring: %s",
+                                    Arg);
+                       return;
+               }
+               Conf_ListenAddress = strdup_warn(Arg);
+               /* If allocation fails, we're in trouble: we cannot ignore the
+                * error -- otherwise ngircd would listen on all interfaces. */
+               if (!Conf_ListenAddress) {
+                       Config_Error(LOG_ALERT,
+                                    "%s exiting due to fatal errors!",
+                                    PACKAGE_NAME);
+                       exit(1);
+               }
                return;
        }
-       if( strcasecmp( Var, "MotdFile" ) == 0 ) {
-               len = strlcpy( Conf_MotdFile, Arg, sizeof( Conf_MotdFile ));
-               if (len >= sizeof( Conf_MotdFile ))
-                       Config_Error_TooLong( Line, Var );
+       if (strcasecmp(Var, "MotdFile") == 0) {
+               len = strlcpy(Conf_MotdFile, Arg, sizeof(Conf_MotdFile));
+               if (len >= sizeof(Conf_MotdFile))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "MotdPhrase" ) == 0 ) {
-               /* "Message of the day" phrase (instead of file) */
+       if (strcasecmp(Var, "MotdPhrase") == 0) {
                len = strlen(Arg);
                if (len == 0)
                        return;
                if (len >= LINE_LEN) {
-                       Config_Error_TooLong( Line, Var );
+                       Config_Error_TooLong(Line, Var);
                        return;
                }
                if (!array_copyb(&Conf_Motd, Arg, len + 1))
-                       Config_Error(LOG_WARNING, "%s, line %d: Could not append MotdPhrase: %s",
-                                                       NGIRCd_ConfFile, Line, strerror(errno));
+                       Config_Error(LOG_WARNING,
+                                    "%s, line %d: Could not append MotdPhrase: %s",
+                                    NGIRCd_ConfFile, Line, strerror(errno));
                Using_MotdFile = false;
                return;
        }
-       if( strcasecmp( Var, "ChrootDir" ) == 0 ) {
-               /* directory for chroot() */
-               len = strlcpy( Conf_Chroot, Arg, sizeof( Conf_Chroot ));
-               if (len >= sizeof( Conf_Chroot ))
-                       Config_Error_TooLong( Line, Var );
+       if(strcasecmp(Var, "Password") == 0) {
+               len = strlcpy(Conf_ServerPwd, Arg, sizeof(Conf_ServerPwd));
+               if (len >= sizeof(Conf_ServerPwd))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if ( strcasecmp( Var, "PidFile" ) == 0 ) {
-               /* name of pidfile */
-               len = strlcpy( Conf_PidFile, Arg, sizeof( Conf_PidFile ));
-               if (len >= sizeof( Conf_PidFile ))
-                       Config_Error_TooLong( Line, Var );
+       if (strcasecmp(Var, "PidFile") == 0) {
+               len = strlcpy(Conf_PidFile, Arg, sizeof(Conf_PidFile));
+               if (len >= sizeof(Conf_PidFile))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "ServerUID" ) == 0 ) {
-               /* UID the daemon should switch to */
-               pwd = getpwnam( Arg );
-               if( pwd ) Conf_UID = pwd->pw_uid;
-               else {
-                       Conf_UID = (unsigned int)atoi( Arg );
-                       if (!Conf_UID && strcmp(Arg, "0"))
-                               Config_Error_NaN(Line, Var);
-               }
+       if (strcasecmp(Var, "Ports") == 0) {
+               ports_parse(&Conf_ListenPorts, Line, Arg);
                return;
        }
-       if( strcasecmp( Var, "ServerGID" ) == 0 ) {
-               /* GID the daemon should use */
-               grp = getgrnam( Arg );
-               if( grp ) Conf_GID = grp->gr_gid;
+       if (strcasecmp(Var, "ServerGID") == 0) {
+               grp = getgrnam(Arg);
+               if (grp)
+                       Conf_GID = grp->gr_gid;
                else {
                        Conf_GID = (unsigned int)atoi(Arg);
                        if (!Conf_GID && strcmp(Arg, "0"))
-                               Config_Error_NaN( Line, Var );
+                               Config_Error(LOG_WARNING,
+                                            "%s, line %d: Value of \"%s\" is not a valid group name or ID!",
+                                            NGIRCd_ConfFile, Line, Var);
                }
                return;
        }
-       if( strcasecmp( Var, "PingTimeout" ) == 0 ) {
-               /* PING timeout */
-               Conf_PingTimeout = atoi( Arg );
-               if( Conf_PingTimeout < 5 ) {
-                       Config_Error( LOG_WARNING, "%s, line %d: Value of \"PingTimeout\" too low!",
-                                                                       NGIRCd_ConfFile, Line );
-                       Conf_PingTimeout = 5;
+       if (strcasecmp(Var, "ServerUID") == 0) {
+               pwd = getpwnam(Arg);
+               if (pwd)
+                       Conf_UID = pwd->pw_uid;
+               else {
+                       Conf_UID = (unsigned int)atoi(Arg);
+                       if (!Conf_UID && strcmp(Arg, "0"))
+                               Config_Error(LOG_WARNING,
+                                            "%s, line %d: Value of \"%s\" is not a valid user name or ID!",
+                                            NGIRCd_ConfFile, Line, Var);
                }
                return;
        }
-       if( strcasecmp( Var, "PongTimeout" ) == 0 ) {
-               /* PONG timeout */
-               Conf_PongTimeout = atoi( Arg );
-               if( Conf_PongTimeout < 5 ) {
-                       Config_Error( LOG_WARNING, "%s, line %d: Value of \"PongTimeout\" too low!",
-                                                                       NGIRCd_ConfFile, Line );
-                       Conf_PongTimeout = 5;
+
+       if (CheckLegacyNoOption(Var, Arg)) {
+               /* TODO: This function and support for "NoXXX" could be
+                * be removed starting with ngIRCd release 19 (one release
+                * after marking it "deprecated"). */
+               Config_Error(LOG_WARNING,
+                            "%s, line %d (section \"Global\"): \"No\"-Prefix is deprecated, use \"%s = %s\" in [Options] section!",
+                            NGIRCd_ConfFile, Line, NoNo(Var), InvertArg(Arg));
+               if (strcasecmp(Var, "NoIdent") == 0)
+                       WarnIdent(Line);
+               else if (strcasecmp(Var, "NoPam") == 0)
+                       WarnPAM(Line);
+               return;
+       }
+       if ((section = CheckLegacyGlobalOption(Line, Var, Arg))) {
+               /** TODO: This function and support for these options in the
+                * [Global] section could be removed starting with ngIRCd
+                * release 19 (one release after marking it "deprecated"). */
+               if (strncasecmp(Var, "SSL", 3) == 0) {
+                       Config_Error(LOG_WARNING,
+                                    "%s, line %d (section \"Global\"): \"%s\" is deprecated here, move it to %s and rename to \"%s\"!",
+                                    NGIRCd_ConfFile, Line, Var, section,
+                                    Var + 3);
+               } else {
+                       Config_Error(LOG_WARNING,
+                                    "%s, line %d (section \"Global\"): \"%s\" is deprecated here, move it to %s!",
+                                    NGIRCd_ConfFile, Line, Var, section);
                }
                return;
        }
-       if( strcasecmp( Var, "ConnectRetry" ) == 0 ) {
-               /* Seconds between connection attempts to other servers */
-               Conf_ConnectRetry = atoi( Arg );
-               if( Conf_ConnectRetry < 5 ) {
-                       Config_Error( LOG_WARNING, "%s, line %d: Value of \"ConnectRetry\" too low!",
-                                                                       NGIRCd_ConfFile, Line );
+
+       Config_Error_Section(Line, Var, "Global");
+}
+
+/**
+ * Handle variable in [Limits] configuration section.
+ *
+ * @param Line Line numer in configuration file.
+ * @param Var  Variable name.
+ * @param Arg  Variable argument.
+ */
+static void
+Handle_LIMITS(int Line, char *Var, char *Arg)
+{
+       assert(Line > 0);
+       assert(Var != NULL);
+       assert(Arg != NULL);
+
+       if (strcasecmp(Var, "ConnectRetry") == 0) {
+               Conf_ConnectRetry = atoi(Arg);
+               if (Conf_ConnectRetry < 5) {
+                       Config_Error(LOG_WARNING,
+                                    "%s, line %d: Value of \"ConnectRetry\" too low!",
+                                    NGIRCd_ConfFile, Line);
                        Conf_ConnectRetry = 5;
                }
                return;
        }
-       if( strcasecmp( Var, "PredefChannelsOnly" ) == 0 ) {
-               /* Should we only allow pre-defined-channels? (i.e. users cannot create their own channels) */
-               Conf_PredefChannelsOnly = Check_ArgIsTrue( Arg );
+       if (strcasecmp(Var, "MaxConnections") == 0) {
+               Conf_MaxConnections = atoi(Arg);
+               if (!Conf_MaxConnections && strcmp(Arg, "0"))
+                       Config_Error_NaN(Line, Var);
                return;
        }
-
-       if (CheckLegacyNoOption(Var, Arg)) {
-               Config_Error(LOG_WARNING, "%s, line %d: \"No\"-Prefix has been removed, use \"%s = %s\" in [FEATURES] section instead",
-                                       NGIRCd_ConfFile, Line, NoNo(Var), InvertArg(Arg));
-               if (strcasecmp(Var, "NoIdent") == 0)
-                       WarnIdent(Line);
-               else if (strcasecmp(Var, "NoPam") == 0)
-                       WarnPAM(Line);
+       if (strcasecmp(Var, "MaxConnectionsIP") == 0) {
+               Conf_MaxConnectionsIP = atoi(Arg);
+               if (!Conf_MaxConnectionsIP && strcmp(Arg, "0"))
+                       Config_Error_NaN(Line, Var);
                return;
        }
-#ifdef WANT_IPV6
-       /* the default setting for all the WANT_IPV6 special options is 'true' */
-       if( strcasecmp( Var, "ConnectIPv6" ) == 0 ) {
-               /* connect to other hosts using ipv6, if they have an AAAA record? */
-               Conf_ConnectIPv6 = Check_ArgIsTrue( Arg );
+       if (strcasecmp(Var, "MaxJoins") == 0) {
+               Conf_MaxJoins = atoi(Arg);
+               if (!Conf_MaxJoins && strcmp(Arg, "0"))
+                       Config_Error_NaN(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "ConnectIPv4" ) == 0 ) {
-               /* connect to other hosts using ipv4.
-                * again, this can be used for ipv6-only setups */
-               Conf_ConnectIPv4 = Check_ArgIsTrue( Arg );
+       if (strcasecmp(Var, "MaxNickLength") == 0) {
+               Conf_MaxNickLength = Handle_MaxNickLength(Line, Arg);
                return;
        }
-#endif
-       if( strcasecmp( Var, "OperCanUseMode" ) == 0 ) {
-               /* Are IRC operators allowed to use MODE in channels they aren't Op in? */
-               Conf_OperCanMode = Check_ArgIsTrue( Arg );
+       if (strcasecmp(Var, "PingTimeout") == 0) {
+               Conf_PingTimeout = atoi(Arg);
+               if (Conf_PingTimeout < 5) {
+                       Config_Error(LOG_WARNING,
+                                    "%s, line %d: Value of \"PingTimeout\" too low!",
+                                    NGIRCd_ConfFile, Line);
+                       Conf_PingTimeout = 5;
+               }
                return;
        }
-       if( strcasecmp( Var, "OperServerMode" ) == 0 ) {
-               /* Mask IRC operator as if coming from the server? (ircd-irc2 compat hack) */
-               Conf_OperServerMode = Check_ArgIsTrue( Arg );
+       if (strcasecmp(Var, "PongTimeout") == 0) {
+               Conf_PongTimeout = atoi(Arg);
+               if (Conf_PongTimeout < 5) {
+                       Config_Error(LOG_WARNING,
+                                    "%s, line %d: Value of \"PongTimeout\" too low!",
+                                    NGIRCd_ConfFile, Line);
+                       Conf_PongTimeout = 5;
+               }
                return;
        }
-       if(strcasecmp(Var, "AllowRemoteOper") == 0) {
-               /* Are remote IRC operators allowed to control this server? */
+
+       Config_Error_Section(Line, Var, "Limits");
+}
+
+/**
+ * Handle variable in [Options] configuration section.
+ *
+ * @param Line Line numer in configuration file.
+ * @param Var  Variable name.
+ * @param Arg  Variable argument.
+ */
+static void
+Handle_OPTIONS(int Line, char *Var, char *Arg)
+{
+       size_t len;
+
+       assert(Line > 0);
+       assert(Var != NULL);
+       assert(Arg != NULL);
+
+       if (strcasecmp(Var, "AllowRemoteOper") == 0) {
                Conf_AllowRemoteOper = Check_ArgIsTrue(Arg);
                return;
        }
-       if( strcasecmp( Var, "MaxConnections" ) == 0 ) {
-               /* Maximum number of connections. 0 -> "no limit". */
-               Conf_MaxConnections = atol( Arg );
-               if (!Conf_MaxConnections && strcmp(Arg, "0"))
-                       Config_Error_NaN(Line, Var);
+       if (strcasecmp(Var, "ChrootDir") == 0) {
+               len = strlcpy(Conf_Chroot, Arg, sizeof(Conf_Chroot));
+               if (len >= sizeof(Conf_Chroot))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "MaxConnectionsIP" ) == 0 ) {
-               /* Maximum number of simultaneous connections from one IP. 0 -> "no limit" */
-               Conf_MaxConnectionsIP = atoi( Arg );
-               if (!Conf_MaxConnectionsIP && strcmp(Arg, "0"))
-                       Config_Error_NaN(Line, Var);
+       if (strcasecmp(Var, "CloakHost") == 0) {
+               len = strlcpy(Conf_CloakHost, Arg, sizeof(Conf_CloakHost));
+               if (len >= sizeof(Conf_CloakHost))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "MaxJoins" ) == 0 ) {
-               /* Maximum number of channels a user can join. 0 -> "no limit". */
-               Conf_MaxJoins = atoi( Arg );
-               if (!Conf_MaxJoins && strcmp(Arg, "0"))
-                       Config_Error_NaN(Line, Var);
+       if (strcasecmp(Var, "CloakHostModeX") == 0) {
+               len = strlcpy(Conf_CloakHostModeX, Arg, sizeof(Conf_CloakHostModeX));
+               if (len >= sizeof(Conf_CloakHostModeX))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-       if( strcasecmp( Var, "MaxNickLength" ) == 0 ) {
-               /* Maximum length of a nick name; must be same on all servers
-                * within the IRC network! */
-               Conf_MaxNickLength = Handle_MaxNickLength(Line, Arg);
+       if (strcasecmp(Var, "CloakHostSalt") == 0) {
+               len = strlcpy(Conf_CloakHostSalt, Arg, sizeof(Conf_CloakHostSalt));
+               if (len >= sizeof(Conf_CloakHostSalt))
+                       Config_Error_TooLong(Line, Var);
+               return;
+       }
+       if (strcasecmp(Var, "CloakUserToNick") == 0) {
+               Conf_CloakUserToNick = Check_ArgIsTrue(Arg);
+               return;
+       }
+       if (strcasecmp(Var, "ConnectIPv6") == 0) {
+               Conf_ConnectIPv6 = Check_ArgIsTrue(Arg);
+               WarnIPv6(Line);
+               return;
+       }
+       if (strcasecmp(Var, "ConnectIPv4") == 0) {
+               Conf_ConnectIPv4 = Check_ArgIsTrue(Arg);
+               return;
+       }
+       if (strcasecmp(Var, "DNS") == 0) {
+               Conf_DNS = Check_ArgIsTrue(Arg);
+               return;
+       }
+       if (strcasecmp(Var, "Ident") == 0) {
+               Conf_Ident = Check_ArgIsTrue(Arg);
+               WarnIdent(Line);
                return;
        }
-       if(strcasecmp(Var, "NoticeAuth") == 0) {
-               /* send NOTICE AUTH messages to clients on connect */
+       if (strcasecmp(Var, "MorePrivacy") == 0) {
+               Conf_MorePrivacy = Check_ArgIsTrue(Arg);
+               return;
+       }
+       if (strcasecmp(Var, "NoticeAuth") == 0) {
                Conf_NoticeAuth = Check_ArgIsTrue(Arg);
                return;
        }
-
-       if( strcasecmp( Var, "Listen" ) == 0 ) {
-               /* IP-Address to bind sockets */
-               if (Conf_ListenAddress) {
-                       Config_Error(LOG_ERR, "Multiple Listen= options, ignoring: %s", Arg);
-                       return;
-               }
-               Conf_ListenAddress = strdup_warn(Arg);
-               /*
-                * if allocation fails, we're in trouble:
-                * we cannot ignore the error -- otherwise ngircd
-                * would listen on all interfaces.
-                */
-               if (!Conf_ListenAddress) {
-                       Config_Error(LOG_ALERT, "%s exiting due to fatal errors!", PACKAGE_NAME);
-                       exit(1);
-               }
+       if (strcasecmp(Var, "OperCanUseMode") == 0) {
+               Conf_OperCanMode = Check_ArgIsTrue(Arg);
                return;
        }
-
-#ifdef SSL_SUPPORT
-       if( strcasecmp( Var, "SSLPorts" ) == 0 ) {
-               ports_parse(&Conf_SSLOptions.ListenPorts, Line, Arg);
+       if (strcasecmp(Var, "OperServerMode") == 0) {
+               Conf_OperServerMode = Check_ArgIsTrue(Arg);
                return;
        }
-
-       if( strcasecmp( Var, "SSLKeyFile" ) == 0 ) {
-               assert(Conf_SSLOptions.KeyFile == NULL );
-               Conf_SSLOptions.KeyFile = strdup_warn(Arg);
+       if (strcasecmp(Var, "PAM") == 0) {
+               Conf_PAM = Check_ArgIsTrue(Arg);
+               WarnPAM(Line);
                return;
        }
-       if( strcasecmp( Var, "SSLCertFile" ) == 0 ) {
-               assert(Conf_SSLOptions.CertFile == NULL );
-               Conf_SSLOptions.CertFile = strdup_warn(Arg);
+       if (strcasecmp(Var, "PAMIsOptional") == 0 ) {
+               Conf_PAMIsOptional = Check_ArgIsTrue(Arg);
                return;
        }
-
-       if( strcasecmp( Var, "SSLKeyFilePassword" ) == 0 ) {
-               assert(array_bytes(&Conf_SSLOptions.KeyFilePassword) == 0);
-               if (!array_copys(&Conf_SSLOptions.KeyFilePassword, Arg))
-                       Config_Error( LOG_ERR, "%s, line %d (section \"Global\"): Could not copy %s: %s!",
-                                                               NGIRCd_ConfFile, Line, Var, strerror(errno));
+       if (strcasecmp(Var, "PredefChannelsOnly") == 0) {
+               Conf_PredefChannelsOnly = Check_ArgIsTrue(Arg);
+               return;
+       }
+#ifndef STRICT_RFC
+       if (strcasecmp(Var, "RequireAuthPing") == 0) {
+               Conf_AuthPing = Check_ArgIsTrue(Arg);
                return;
        }
-       if( strcasecmp( Var, "SSLDHFile" ) == 0 ) {
-               assert(Conf_SSLOptions.DHFile == NULL);
-               Conf_SSLOptions.DHFile = strdup_warn( Arg );
-                return;
-        }
 #endif
+       if (strcasecmp(Var, "ScrubCTCP") == 0) {
+               Conf_ScrubCTCP = Check_ArgIsTrue(Arg);
+               return;
+       }
 #ifdef SYSLOG
        if (strcasecmp(Var, "SyslogFacility") == 0) {
                Conf_SyslogFacility = ngt_SyslogFacilityID(Arg,
@@ -1404,53 +1589,66 @@ Handle_GLOBAL( int Line, char *Var, char *Arg )
                return;
        }
 #endif
-#ifndef STRICT_RFC
-       if (strcasecmp(Var, "RequireAuthPing") == 0 ) {
-               /* Require new clients to do an "autheticatin PING-PONG" */
-               Conf_AuthPing = Check_ArgIsTrue(Arg);
+       if (strcasecmp(Var, "WebircPassword") == 0) {
+               len = strlcpy(Conf_WebircPwd, Arg, sizeof(Conf_WebircPwd));
+               if (len >= sizeof(Conf_WebircPwd))
+                       Config_Error_TooLong(Line, Var);
                return;
        }
-#endif
 
-       Config_Error_Section(Line, Var, "Global");
+       Config_Error_Section(Line, Var, "Options");
 }
 
+#ifdef SSL_SUPPORT
 
 /**
- * Handle variable in [Features] configuration section.
+ * Handle variable in [SSL] configuration section.
  *
  * @param Line Line numer in configuration file.
  * @param Var  Variable name.
  * @param Arg  Variable argument.
  */
 static void
-Handle_FEATURES(int Line, char *Var, char *Arg)
+Handle_SSL(int Line, char *Var, char *Arg)
 {
-       assert( Line > 0 );
-       assert( Var != NULL );
-       assert( Arg != NULL );
+       assert(Line > 0);
+       assert(Var != NULL);
+       assert(Arg != NULL);
 
-       if( strcasecmp( Var, "DNS" ) == 0 ) {
-               /* do reverse dns lookups when clients connect? */
-               Conf_DNS = Check_ArgIsTrue( Arg );
+       if (strcasecmp(Var, "CertFile") == 0) {
+               assert(Conf_SSLOptions.CertFile == NULL);
+               Conf_SSLOptions.CertFile = strdup_warn(Arg);
                return;
        }
-       if (strcasecmp(Var, "Ident") == 0) {
-               /* do IDENT lookups when clients connect? */
-               Conf_Ident = Check_ArgIsTrue(Arg);
-               WarnIdent(Line);
+       if (strcasecmp(Var, "DHFile") == 0) {
+               assert(Conf_SSLOptions.DHFile == NULL);
+               Conf_SSLOptions.DHFile = strdup_warn(Arg);
                return;
        }
-       if(strcasecmp(Var, "PAM") == 0) {
-               /* use PAM library to authenticate users */
-               Conf_PAM = Check_ArgIsTrue(Arg);
-               WarnPAM(Line);
+       if (strcasecmp(Var, "KeyFile") == 0) {
+               assert(Conf_SSLOptions.KeyFile == NULL);
+               Conf_SSLOptions.KeyFile = strdup_warn(Arg);
+               return;
+       }
+       if (strcasecmp(Var, "KeyFilePassword") == 0) {
+               assert(array_bytes(&Conf_SSLOptions.KeyFilePassword) == 0);
+               if (!array_copys(&Conf_SSLOptions.KeyFilePassword, Arg))
+                       Config_Error(LOG_ERR,
+                                    "%s, line %d (section \"SSL\"): Could not copy %s: %s!",
+                                    NGIRCd_ConfFile, Line, Var,
+                                    strerror(errno));
+               return;
+       }
+       if (strcasecmp(Var, "Ports") == 0) {
+               ports_parse(&Conf_SSLOptions.ListenPorts, Line, Arg);
                return;
        }
 
-       Config_Error_Section(Line, Var, "Options");
+       Config_Error_Section(Line, Var, "SSL");
 }
 
+#endif
+
 /**
  * Handle variable in [Operator] configuration section.
  *
@@ -1467,13 +1665,11 @@ Handle_OPERATOR( int Line, char *Var, char *Arg )
        assert( Line > 0 );
        assert( Var != NULL );
        assert( Arg != NULL );
-       assert( Conf_Oper_Count > 0 );
 
-       op = array_alloc(&Conf_Opers, sizeof(*op), Conf_Oper_Count - 1);
-       if (!op) {
-               Config_Error(LOG_ERR, "Could not allocate memory for operator (%d:%s = %s)", Line, Var, Arg);
+       op = array_get(&Conf_Opers, sizeof(*op),
+                        array_length(&Conf_Opers, sizeof(*op)) - 1);
+       if (!op)
                return;
-       }
 
        if (strcasecmp(Var, "Name") == 0) {
                /* Name of IRC operator */
@@ -1639,21 +1835,17 @@ static void
 Handle_CHANNEL(int Line, char *Var, char *Arg)
 {
        size_t len;
-       size_t chancount;
        struct Conf_Channel *chan;
 
        assert( Line > 0 );
        assert( Var != NULL );
        assert( Arg != NULL );
-       assert(Conf_Channel_Count > 0);
-
-       chancount = Conf_Channel_Count - 1;
 
-       chan = array_alloc(&Conf_Channels, sizeof(*chan), chancount);
-       if (!chan) {
-               Config_Error(LOG_ERR, "Could not allocate memory for predefined channel (%d:%s = %s)", Line, Var, Arg);
+       chan = array_get(&Conf_Channels, sizeof(*chan),
+                        array_length(&Conf_Channels, sizeof(*chan)) - 1);
+       if (!chan)
                return;
-       }
+
        if (strcasecmp(Var, "Name") == 0) {
                if (!Handle_Channelname(chan, Arg))
                        Config_Error_TooLong(Line, Var);
@@ -1787,7 +1979,7 @@ Validate_Config(bool Configtest, bool Rehash)
 #ifdef PAM
        if (Conf_ServerPwd[0])
                Config_Error(LOG_ERR,
-                            "This server uses PAM, \"Password\" will be ignored!");
+                            "This server uses PAM, \"Password\" in [Global] section will be ignored!");
 #endif
 
 #ifdef DEBUG
@@ -1800,8 +1992,10 @@ Validate_Config(bool Configtest, bool Rehash)
                }
        }
        Log(LOG_DEBUG,
-           "Configuration: Operators=%d, Servers=%d[%d], Channels=%d",
-           Conf_Oper_Count, servers, servers_once, Conf_Channel_Count);
+           "Configuration: Operators=%ld, Servers=%d[%d], Channels=%ld",
+           array_length(&Conf_Opers, sizeof(struct Conf_Oper)),
+           servers, servers_once,
+           array_length(&Conf_Channels, sizeof(struct Conf_Channel)));
 #endif
 
        return config_valid;
@@ -1878,8 +2072,13 @@ va_dcl
        vsnprintf( msg, MAX_LOG_MSG_LEN, Format, ap );
        va_end( ap );
 
-       if (Use_Log) Log( Level, "%s", msg );
-       else puts( msg );
+       if (!Use_Log) {
+               if (Level <= LOG_WARNING)
+                       printf(" - %s\n", msg);
+               else
+                       puts(msg);
+       } else
+               Log(Level, "%s", msg);
 }
 
 #ifdef DEBUG
@@ -1926,7 +2125,7 @@ Init_Server_Struct( CONF_SERVER *Server )
 
        Proc_InitStruct(&Server->res_stat);
        Server->conn_id = NONE;
-       memset(&Server->bind_addr, 0, sizeof(&Server->bind_addr));
+       memset(&Server->bind_addr, 0, sizeof(Server->bind_addr));
 }
 
 /* -eof- */