X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=blobdiff_plain;f=src%2Fngircd%2Fconn.c;h=94c6c4a8b1683fa75ca3fd4f6daaf98884d29dfd;hp=46a3ecc2caefe0c1dc5fe41754357aadc08db128;hb=HEAD;hpb=be97fa8ab1c47a17f6d4c17c69de89d084dc1402

diff --git a/src/ngircd/conn.c b/src/ngircd/conn.c
index 46a3ecc2..68a901d0 100644
--- a/src/ngircd/conn.c
+++ b/src/ngircd/conn.c
@@ -1,6 +1,6 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2012 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2024 Alexander Barton (alex@barton.de) and Contributors.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -9,20 +9,19 @@
  * Please read the file COPYING, README and AUTHORS for more information.
  */
 
-#undef DEBUG_BUFFER
-
 #define CONN_MODULE
+#define CONN_MODULE_GLOBAL_INIT
 
 #include "portab.h"
-#include "conf-ssl.h"
-#include "io.h"
 
 /**
  * @file
  * Connection management
  */
 
-#include "imp.h"
+/* Additionan debug messages related to buffer handling: 0=off / 1=on */
+#define DEBUG_BUFFER 0
+
 #include <assert.h>
 #ifdef PROTOTYPES
 # include <stdarg.h>
@@ -34,8 +33,9 @@
 #include <unistd.h>
 #include <errno.h>
 #include <string.h>
+#include <strings.h>
 #include <sys/socket.h>
-#include <sys/time.h>
+#include <sys/stat.h>
 #include <sys/types.h>
 #include <time.h>
 #include <netinet/in.h>
@@ -47,48 +47,41 @@
 # include <netinet/ip.h>
 #endif
 
-#ifdef HAVE_STDINT_H
-# include <stdint.h>			/* e.g. for Mac OS X */
-#endif
-
 #ifdef TCPWRAP
 # include <tcpd.h>			/* for TCP Wrappers */
 #endif
 
-#include "array.h"
-#include "defines.h"
-
-#include "exp.h"
 #include "conn.h"
 
-#include "imp.h"
 #include "ngircd.h"
-#include "array.h"
-#include "client.h"
 #include "class.h"
-#include "conf.h"
+#ifdef ICONV
+# include "conn-encoding.h"
+#endif
 #include "conn-ssl.h"
 #include "conn-zip.h"
 #include "conn-func.h"
+#include "io.h"
 #include "log.h"
 #include "ng_ipaddr.h"
 #include "parse.h"
 #include "resolve.h"
-#include "tool.h"
+#include "sighandlers.h"
 
-#include "exp.h"
+#define SERVER_WAIT (NONE - 1)		/** "Wait for outgoing connection" flag */
 
+#define MAX_COMMANDS 3			/** Max. commands per loop for users */
+#define MAX_COMMANDS_SERVER_MIN 10	/** Min. commands per loop for servers */
+#define MAX_COMMANDS_SERVICE 10		/** Max. commands per loop for services */
 
-#define SERVER_WAIT (NONE - 1)
-
-#define MAX_COMMANDS 3
-#define MAX_COMMANDS_SERVER_MIN 10
-#define MAX_COMMANDS_SERVICE 10
+#define SD_LISTEN_FDS_START 3		/** systemd(8) socket activation offset */
 
+#define THROTTLE_CMDS 1			/** Throttling: max commands reached */
+#define THROTTLE_BPS 2			/** Throttling: max bps reached */
 
 static bool Handle_Write PARAMS(( CONN_ID Idx ));
 static bool Conn_Write PARAMS(( CONN_ID Idx, char *Data, size_t Len ));
-static int New_Connection PARAMS(( int Sock ));
+static int New_Connection PARAMS(( int Sock, bool IsSSL ));
 static CONN_ID Socket2Index PARAMS(( int Sock ));
 static void Read_Request PARAMS(( CONN_ID Idx ));
 static unsigned int Handle_Buffer PARAMS(( CONN_ID Idx ));
@@ -100,7 +93,8 @@ static void New_Server PARAMS(( int Server, ng_ipaddr_t *dest ));
 static void Simple_Message PARAMS(( int Sock, const char *Msg ));
 static int NewListener PARAMS(( const char *listen_addr, UINT16 Port ));
 static void Account_Connection PARAMS((void));
-
+static void Throttle_Connection PARAMS((const CONN_ID Idx, CLIENT *Client,
+					const int Reason, unsigned int Value));
 
 static array My_Listeners;
 static array My_ConnArray;
@@ -115,6 +109,9 @@ static void server_login PARAMS((CONN_ID idx));
 
 #ifdef SSL_SUPPORT
 extern struct SSLOptions Conf_SSLOptions;
+static bool SSL_WantRead PARAMS((const CONNECTION *c));
+static bool SSL_WantWrite PARAMS((const CONNECTION *c));
+static void cb_listen_ssl PARAMS((int sock, short irrelevant));
 static void cb_connserver_login_ssl PARAMS((int sock, short what));
 static void cb_clientserver_ssl PARAMS((int sock, short what));
 #endif
@@ -122,43 +119,56 @@ static void cb_Read_Resolver_Result PARAMS((int sock, UNUSED short what));
 static void cb_Connect_to_Server PARAMS((int sock, UNUSED short what));
 static void cb_clientserver PARAMS((int sock, short what));
 
+time_t idle_t = 0;
 
 /**
- * IO callback for listening sockets: handle new connections. This callback
- * gets called when a new non-SSL connection should be accepted.
+ * Get number of sockets available from systemd(8).
  *
- * @param sock		Socket descriptor.
- * @param irrelevant	(ignored IO specification)
+ * ngIRCd needs to implement its own sd_listen_fds(3) function and can't
+ * use the one provided by systemd itself, because the sockets will be
+ * used in a forked child process with a new PID, and this would trigger
+ * an error in the standard implementation.
+ *
+ * @return Number of sockets available, -1 if sockets have already been
+ *         initialized, or 0 when no sockets have been passed.
  */
-static void
-cb_listen(int sock, short irrelevant)
+static int
+my_sd_listen_fds(void)
 {
-	(void) irrelevant;
-	(void) New_Connection(sock);
-}
+	const char *e;
+	int count;
+
+	/* Check if LISTEN_PID exists; but we ignore the result, because
+	 * normally ngircd forks a child before checking this, and therefore
+	 * the PID set in the environment is always wrong ... */
+	e = getenv("LISTEN_PID");
+	if (!e || !*e)
+		return 0;
 
+	e = getenv("LISTEN_FDS");
+	if (!e || !*e)
+		return -1;
+	count = atoi(e);
+#ifdef HAVE_UNSETENV
+	unsetenv("LISTEN_FDS");
+#endif
+
+	return count;
+}
 
-#ifdef SSL_SUPPORT
 /**
- * IO callback for listening SSL sockets: handle new connections. This callback
- * gets called when a new SSL-enabled connection should be accepted.
+ * IO callback for listening sockets: handle new connections. This callback
+ * gets called when a new non-SSL connection should be accepted.
  *
  * @param sock		Socket descriptor.
  * @param irrelevant	(ignored IO specification)
  */
 static void
-cb_listen_ssl(int sock, short irrelevant)
+cb_listen(int sock, short irrelevant)
 {
-	int fd;
-
 	(void) irrelevant;
-	fd = New_Connection(sock);
-	if (fd < 0)
-		return;
-	io_event_setcb(My_Connections[fd].sock, cb_clientserver_ssl);
+	(void) New_Connection(sock, false);
 }
-#endif
-
 
 /**
  * IO callback for new outgoing non-SSL server connections.
@@ -174,7 +184,6 @@ cb_connserver(int sock, UNUSED short what)
 	CONN_ID idx = Socket2Index( sock );
 
 	if (idx <= NONE) {
-		LogDebug("cb_connserver wants to write on unknown socket?!");
 		io_close(sock);
 		return;
 	}
@@ -187,7 +196,7 @@ cb_connserver(int sock, UNUSED short what)
 	if (server < 0) {
 		Log(LOG_ERR, "Connection on socket %d to \"%s\" aborted!",
 		    sock, My_Connections[idx].host);
-		Conn_Close(idx, "Connection aborted!", NULL, false);
+		Conn_Close(idx, "Connection aborted", NULL, false);
 		return;
 	}
 
@@ -208,7 +217,7 @@ cb_connserver(int sock, UNUSED short what)
 			    My_Connections[idx].host, Conf_Server[server].port,
  			    idx, strerror(err));
 
-		Conn_Close(idx, "Can't connect!", NULL, false);
+		Conn_Close(idx, "Can't connect", NULL, false);
 
 		if (ng_ipaddr_af(&Conf_Server[server].dst_addr[0])) {
 			/* more addresses to try... */
@@ -238,7 +247,6 @@ cb_connserver(int sock, UNUSED short what)
 	server_login(idx);
 }
 
-
 /**
  * Login to a remote server.
  *
@@ -256,47 +264,12 @@ server_login(CONN_ID idx)
 	io_event_add( My_Connections[idx].sock, IO_WANTREAD|IO_WANTWRITE);
 
 	/* Send PASS and SERVER command to peer */
-	Conn_WriteStr( idx, "PASS %s %s", Conf_Server[Conf_GetServer( idx )].pwd_out, NGIRCd_ProtoID );
-	Conn_WriteStr( idx, "SERVER %s :%s", Conf_ServerName, Conf_ServerInfo );
+	Conn_WriteStr(idx, "PASS %s %s",
+		      Conf_Server[Conf_GetServer( idx )].pwd_out, NGIRCd_ProtoID);
+	Conn_WriteStr(idx, "SERVER %s :%s",
+		      Conf_ServerName, Conf_ServerInfo);
 }
 
-
-#ifdef SSL_SUPPORT
-/**
- * IO callback for new outgoing SSL-enabled server connections.
- *
- * @param sock		Socket descriptor.
- * @param unused	(ignored IO specification)
- */
-static void
-cb_connserver_login_ssl(int sock, short unused)
-{
-	CONN_ID idx = Socket2Index(sock);
-
-	assert(idx >= 0);
-	if (idx < 0) {
-		io_close(sock);
-		return;
-	}
-	(void) unused;
-	switch (ConnSSL_Connect( &My_Connections[idx])) {
-	case 1: break;
-	case 0: LogDebug("ConnSSL_Connect: not ready");
-		return;
-	case -1:
-		Log(LOG_ERR, "SSL connection on socket %d failed!", sock);
-		Conn_Close(idx, "Can't connect!", NULL, false);
-		return;
-	}
-
-	Log( LOG_INFO, "SSL connection %d with \"%s:%d\" established.", idx,
-			My_Connections[idx].host, Conf_Server[Conf_GetServer( idx )].port );
-
-	server_login(idx);
-}
-#endif
-
-
 /**
  * IO callback for established non-SSL client and server connections.
  *
@@ -308,12 +281,11 @@ cb_clientserver(int sock, short what)
 {
 	CONN_ID idx = Socket2Index(sock);
 
-	assert(idx >= 0);
-
-	if (idx < 0) {
+	if (idx <= NONE) {
 		io_close(sock);
 		return;
 	}
+
 #ifdef SSL_SUPPORT
 	if (what & IO_WANTREAD
 	    || (Conn_OPTION_ISSET(&My_Connections[idx], CONN_SSL_WANT_WRITE))) {
@@ -329,82 +301,28 @@ cb_clientserver(int sock, short what)
 		Handle_Write(idx);
 }
 
-
-#ifdef SSL_SUPPORT
-/**
- * IO callback for established SSL-enabled client and server connections.
- *
- * @param sock	Socket descriptor.
- * @param what	IO specification (IO_WANTREAD/IO_WANTWRITE/...).
- */
-static void
-cb_clientserver_ssl(int sock, short what)
-{
-	CONN_ID idx = Socket2Index(sock);
-
-	assert(idx >= 0);
-
-	if (idx < 0) {
-		io_close(sock);
-		return;
-	}
-
-	switch (ConnSSL_Accept(&My_Connections[idx])) {
-	case 1:
-		break;	/* OK */
-	case 0:
-		return;	/* EAGAIN: callback will be invoked again by IO layer */
-	default:
-		Conn_Close(idx, "SSL accept error, closing socket", "SSL accept error", false);
-		return;
-	}
-	if (what & IO_WANTREAD)
-		Read_Request(idx);
-
-	if (what & IO_WANTWRITE)
-		Handle_Write(idx);
-
-	io_event_setcb(sock, cb_clientserver);	/* SSL handshake completed */
-}
-#endif
-
-
 /**
- * Initialize connecion module.
+ * Initialize connection module.
  */
 GLOBAL void
 Conn_Init( void )
 {
-	CONN_ID i;
+	int size;
 
-	/* Speicher fuer Verbindungs-Pool anfordern */
-	Pool_Size = CONNECTION_POOL;
-	if ((Conf_MaxConnections > 0) &&
-		(Pool_Size > Conf_MaxConnections))
-			Pool_Size = Conf_MaxConnections;
-
-	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)Pool_Size)) {
-		Log(LOG_EMERG, "Can't allocate memory! [Conn_Init]");
+	/* Initialize the "connection pool".
+	 * FIXME: My_Connetions/Pool_Size is needed by other parts of the
+	 * code; remove them! */
+	Pool_Size = 0;
+	size = Conf_MaxConnections > 0 ? Conf_MaxConnections : CONNECTION_POOL;
+	if (Socket2Index(size) <= NONE) {
+		Log(LOG_EMERG, "Failed to initialize connection pool!");
 		exit(1);
 	}
 
-	/* FIXME: My_Connetions/Pool_Size is needed by other parts of the
-	 * code; remove them! */
-	My_Connections = (CONNECTION*) array_start(&My_ConnArray);
-
-	LogDebug("Allocated connection pool for %d items (%ld bytes).",
-		array_length(&My_ConnArray, sizeof(CONNECTION)),
-		array_bytes(&My_ConnArray));
-
-	assert(array_length(&My_ConnArray, sizeof(CONNECTION)) >= (size_t)Pool_Size);
-	
+	/* Initialize "listener" array. */
 	array_free( &My_Listeners );
-
-	for (i = 0; i < Pool_Size; i++)
-		Init_Conn_Struct(i);
 } /* Conn_Init */
 
-
 /**
  * Clean up connection module.
  */
@@ -429,7 +347,6 @@ Conn_Exit( void )
 	io_library_shutdown();
 } /* Conn_Exit */
 
-
 /**
  * Close all sockets (file descriptors) of open connections.
  * This is useful in forked child processes, for example, to make sure that
@@ -447,7 +364,6 @@ Conn_CloseAllSockets(int ExceptOf)
 	}
 }
 
-
 /**
  * Initialize listening ports.
  *
@@ -457,7 +373,7 @@ Conn_CloseAllSockets(int ExceptOf)
  * @returns		Number of listening sockets created.
  */
 static unsigned int
-ports_initlisteners(array *a, const char *listen_addr, void (*func)(int,short))
+Init_Listeners(array *a, const char *listen_addr, void (*func)(int,short))
 {
 	unsigned int created = 0;
 	size_t len;
@@ -473,8 +389,9 @@ ports_initlisteners(array *a, const char *listen_addr, void (*func)(int,short))
 			continue;
 		}
 		if (!io_event_create( fd, IO_WANTREAD, func )) {
-			Log( LOG_ERR, "io_event_create(): Could not add listening fd %d (port %u): %s!",
-						fd, (unsigned int) *port, strerror(errno));
+			Log(LOG_ERR,
+			    "io_event_create(): Can't add fd %d (port %u): %s!",
+			    fd, (unsigned int) *port, strerror(errno));
 			close(fd);
 			port++;
 			continue;
@@ -485,7 +402,6 @@ ports_initlisteners(array *a, const char *listen_addr, void (*func)(int,short))
 	return created;
 }
 
-
 /**
  * Initialize all listening sockets.
  *
@@ -496,14 +412,88 @@ Conn_InitListeners( void )
 {
 	/* Initialize ports on which the server should accept connections */
 	unsigned int created = 0;
-	char *copy, *listen_addr;
+	char *af_str, *copy, *listen_addr;
+	int count, fd, i, addr_len;
+	ng_ipaddr_t addr;
 
 	assert(Conf_ListenAddress);
 
+	count = my_sd_listen_fds();
+	if (count < 0) {
+		Log(LOG_INFO,
+		    "Not re-initializing listening sockets of systemd(8) ...");
+		return 0;
+	}
+	if (count > 0) {
+		/* systemd(8) passed sockets to us, so don't try to initialize
+		 * listening sockets on our own but use the passed ones */
+		LogDebug("Initializing %d systemd sockets ...", count);
+		for (i = 0; i < count; i++) {
+			fd = SD_LISTEN_FDS_START + i;
+			addr_len = (int)sizeof(addr);
+			getsockname(fd, (struct sockaddr *)&addr,
+				    (socklen_t*)&addr_len);
+#ifdef WANT_IPV6
+			if (addr.sin4.sin_family != AF_INET
+			    && addr.sin4.sin_family != AF_INET6)
+#else
+			if (addr.sin4.sin_family != AF_INET)
+#endif
+			{
+				/* Socket is of unsupported type! For example,
+				 * systemd passed in an IPv6 socket but ngIRCd
+				 * isn't compiled with IPv6 support. */
+				switch (addr.sin4.sin_family)
+				{
+					case AF_UNSPEC: af_str = "AF_UNSPEC"; break;
+					case AF_UNIX: af_str = "AF_UNIX"; break;
+					case AF_INET: af_str = "AF_INET"; break;
+#ifdef AF_INET6
+					case AF_INET6: af_str = "AF_INET6"; break;
+#endif
+#ifdef AF_NETLINK
+					case AF_NETLINK: af_str = "AF_NETLINK"; break;
+#endif
+					default: af_str = "unknown"; break;
+				}
+				Log(LOG_CRIT,
+				    "Socket %d is of unsupported type \"%s\" (%d), have to ignore it!",
+				    fd, af_str, addr.sin4.sin_family);
+				close(fd);
+				continue;
+			}
+
+			Init_Socket(fd);
+			if (!io_event_create(fd, IO_WANTREAD, cb_listen)) {
+				Log(LOG_ERR,
+				    "io_event_create(): Can't add fd %d: %s!",
+				    fd, strerror(errno));
+				continue;
+			}
+			Log(LOG_INFO,
+			    "Initialized socket %d from systemd(8): %s:%d.", fd,
+			    ng_ipaddr_tostr(&addr), ng_ipaddr_getport(&addr));
+			created++;
+		}
+		return created;
+	}
+
+	/* not using systemd socket activation, initialize listening sockets: */
+
+#ifdef SSL_SUPPORT
+	if (!Conf_SSLOptions.KeyFile &&
+	    array_length(&Conf_SSLOptions.ListenPorts, sizeof (UINT16))) {
+		Log(LOG_ERR,
+		    "Ignoring SSL-enabled listening ports: No key file set!");
+		array_free(&Conf_SSLOptions.ListenPorts);
+	}
+#endif
+
 	/* can't use Conf_ListenAddress directly, see below */
 	copy = strdup(Conf_ListenAddress);
 	if (!copy) {
-		Log(LOG_CRIT, "Cannot copy %s: %s", Conf_ListenAddress, strerror(errno));
+		Log(LOG_CRIT, "Cannot copy %s: %s", Conf_ListenAddress,
+		    strerror(errno));
 		return 0;
 	}
 	listen_addr = strtok(copy, ",");
@@ -511,9 +501,11 @@ Conn_InitListeners( void )
 	while (listen_addr) {
 		ngt_TrimStr(listen_addr);
 		if (*listen_addr) {
-			created += ports_initlisteners(&Conf_ListenPorts, listen_addr, cb_listen);
+			created += Init_Listeners(&Conf_ListenPorts,
+						  listen_addr, cb_listen);
 #ifdef SSL_SUPPORT
-			created += ports_initlisteners(&Conf_SSLOptions.ListenPorts, listen_addr, cb_listen_ssl);
+			created += Init_Listeners(&Conf_SSLOptions.ListenPorts,
+						  listen_addr, cb_listen_ssl);
 #endif
 		}
 
@@ -529,7 +521,6 @@ Conn_InitListeners( void )
 	return created;
 } /* Conn_InitListeners */
 
-
 /**
  * Shut down all listening sockets.
  */
@@ -540,7 +531,12 @@ Conn_ExitListeners( void )
 	int *fd;
 	size_t arraylen;
 
+	/* Get number of listening sockets to shut down. There can be none
+	 * if ngIRCd has been "socket activated" by systemd. */
 	arraylen = array_length(&My_Listeners, sizeof (int));
+	if (arraylen < 1)
+		return;
+
 	Log(LOG_INFO,
 	    "Shutting down all listening sockets (%d total) ...", arraylen);
 	fd = array_start(&My_Listeners);
@@ -554,7 +550,6 @@ Conn_ExitListeners( void )
 	array_free(&My_Listeners);
 } /* Conn_ExitListeners */
 
-
 /**
  * Bind a socket to a specific (source) address.
  *
@@ -571,17 +566,17 @@ InitSinaddrListenAddr(ng_ipaddr_t *addr, const char *listen_addrstr, UINT16 Port
 	ret = ng_ipaddr_init(addr, listen_addrstr, Port);
 	if (!ret) {
 		assert(listen_addrstr);
-		Log(LOG_CRIT, "Can't bind to [%s]:%u: can't convert ip address \"%s\"",
-						listen_addrstr, Port, listen_addrstr);
+		Log(LOG_CRIT,
+		    "Can't listen on [%s]:%u: Failed to parse IP address!",
+		    listen_addrstr, Port);
 	}
 	return ret;
 }
 
-
 /**
  * Set a socket to "IPv6 only". If the given socket doesn't belong to the
  * AF_INET6 family, or the operating system doesn't support this functionality,
- * this function retruns silently.
+ * this function returns silently.
  *
  * @param af	Address family of the socket.
  * @param sock	Socket handle.
@@ -603,11 +598,10 @@ set_v6_only(int af, int sock)
 #endif
 }
 
-
 /**
  * Initialize new listening port.
  *
- * @param listen_addr	Local address to bind the socet to (can be 0.0.0.0).
+ * @param listen_addr	Local address to bind the socket to (can be 0.0.0.0).
  * @param Port		Port number on which the new socket should be listening.
  * @returns		file descriptor of the socket or -1 on failure.
  */
@@ -623,8 +617,9 @@ NewListener(const char *listen_addr, UINT16 Port)
 
 	af = ng_ipaddr_af(&addr);
 	sock = socket(af, SOCK_STREAM, 0);
-	if( sock < 0 ) {
-		Log(LOG_CRIT, "Can't create socket (af %d) : %s!", af, strerror(errno));
+	if (sock < 0) {
+		Log(LOG_CRIT, "Can't create socket (af %d) : %s!", af,
+		    strerror(errno));
 		return -1;
 	}
 
@@ -634,22 +629,23 @@ NewListener(const char *listen_addr, UINT16 Port)
 		return -1;
 
 	if (bind(sock, (struct sockaddr *)&addr, ng_ipaddr_salen(&addr)) != 0) {
-		Log(LOG_CRIT, "Can't bind socket to address %s:%d - %s",
-			ng_ipaddr_tostr(&addr), Port, strerror(errno));
+		Log(LOG_CRIT, "Can't bind socket to address %s:%d - %s!",
+		    ng_ipaddr_tostr(&addr), Port, strerror(errno));
 		close(sock);
 		return -1;
 	}
 
-	if( listen( sock, 10 ) != 0 ) {
-		Log( LOG_CRIT, "Can't listen on socket: %s!", strerror( errno ));
-		close( sock );
+	if (listen(sock, 10) != 0) {
+		Log(LOG_CRIT, "Can't listen on socket: %s!", strerror(errno));
+		close(sock);
 		return -1;
 	}
 
 	/* keep fd in list so we can close it when ngircd restarts/shuts down */
-	if (!array_catb( &My_Listeners,(char*) &sock, sizeof(int) )) {
-		Log( LOG_CRIT, "Can't add socket to My_Listeners array: %s!", strerror( errno ));
-		close( sock );
+	if (!array_catb(&My_Listeners, (char *)&sock, sizeof(int))) {
+		Log(LOG_CRIT, "Can't add socket to My_Listeners array: %s!",
+		    strerror(errno));
+		close(sock);
 		return -1;
 	}
 
@@ -658,67 +654,6 @@ NewListener(const char *listen_addr, UINT16 Port)
 	return sock;
 } /* NewListener */
 
-
-#ifdef SSL_SUPPORT
-
-/**
- * Check if SSL library needs to read SSL-protocol related data.
- *
- * SSL/TLS connections require extra treatment:
- * When either CONN_SSL_WANT_WRITE or CONN_SSL_WANT_READ is set, we
- * need to take care of that first, before checking read/write buffers.
- * For instance, while we might have data in our write buffer, the
- * TLS/SSL protocol might need to read internal data first for TLS/SSL
- * writes to succeed.
- *
- * If this function returns true, such a condition is met and we have
- * to reverse the condition (check for read even if we've data to write,
- * do not check for read but writeability even if write-buffer is empty).
- *
- * @param c	Connection to check.
- * @returns	true if SSL-library has to read protocol data.
- */
-static bool
-SSL_WantRead(const CONNECTION *c)
-{
-	if (Conn_OPTION_ISSET(c, CONN_SSL_WANT_READ)) {
-		io_event_add(c->sock, IO_WANTREAD);
-		return true;
-	}
-	return false;
-}
-
-/**
- * Check if SSL library needs to write SSL-protocol related data.
- *
- * Please see description of SSL_WantRead() for full description!
- *
- * @param c	Connection to check.
- * @returns	true if SSL-library has to write protocol data.
- */
-static bool
-SSL_WantWrite(const CONNECTION *c)
-{
-	if (Conn_OPTION_ISSET(c, CONN_SSL_WANT_WRITE)) {
-		io_event_add(c->sock, IO_WANTWRITE);
-		return true;
-	}
-	return false;
-}
-
-#else
-
-static inline bool
-SSL_WantRead(UNUSED const CONNECTION *c)
-{ return false; }
-
-static inline bool
-SSL_WantWrite(UNUSED const CONNECTION *c)
-{ return false; }
-
-#endif
-
-
 /**
  * "Main Loop": Loop until shutdown or restart is signalled.
  *
@@ -732,12 +667,19 @@ GLOBAL void
 Conn_Handler(void)
 {
 	int i;
-	unsigned int wdatalen, bytes_processed;
+	size_t wdatalen;
 	struct timeval tv;
-	time_t t;
+	time_t t, notify_t = 0;
+	bool command_available;
+	char status[200];
+
+	Log(LOG_NOTICE, "Server \"%s\" (on \"%s\") ready.",
+	    Client_ID(Client_ThisServer()), Client_Hostname(Client_ThisServer()));
+	Signal_NotifySvcMgr("READY=1\n");
 
 	while (!NGIRCd_SignalQuit && !NGIRCd_SignalRestart) {
 		t = time(NULL);
+		command_available = false;
 
 		/* Check configured servers and established links */
 		Check_Servers();
@@ -749,20 +691,9 @@ Conn_Handler(void)
 		/* Look for non-empty read buffers ... */
 		for (i = 0; i < Pool_Size; i++) {
 			if ((My_Connections[i].sock > NONE)
-			    && (array_bytes(&My_Connections[i].rbuf) > 0)
-			    && (My_Connections[i].delaytime <= t)) {
+			    && (array_bytes(&My_Connections[i].rbuf) > 0)) {
 				/* ... and try to handle the received data */
-				bytes_processed = Handle_Buffer(i);
-				/* if we processed data, and there might be
-				 * more commands in the input buffer, do not
-				 * try to read any more data now */
-				if (bytes_processed &&
-				    array_bytes(&My_Connections[i].rbuf) > 2) {
-					LogDebug
-					    ("Throttling connection %d: command limit reached!",
-					     i);
-					Conn_SetPenalty(i, 1);
-				}
+				Handle_Buffer(i);
 			}
 		}
 
@@ -771,7 +702,7 @@ Conn_Handler(void)
 			if (My_Connections[i].sock <= NONE)
 				continue;
 
-			wdatalen = (unsigned int)array_bytes(&My_Connections[i].wbuf);
+			wdatalen = array_bytes(&My_Connections[i].wbuf);
 #ifdef ZLIB
 			if (wdatalen > 0 ||
 			    array_bytes(&My_Connections[i].zip.wbuf) > 0)
@@ -779,8 +710,10 @@ Conn_Handler(void)
 			if (wdatalen > 0)
 #endif
 			{
+#ifdef SSL_SUPPORT
 				if (SSL_WantRead(&My_Connections[i]))
 					continue;
+#endif
 				io_event_add(My_Connections[i].sock,
 					     IO_WANTWRITE);
 			}
@@ -792,7 +725,9 @@ Conn_Handler(void)
 				continue;
 #ifdef SSL_SUPPORT
 			if (SSL_WantWrite(&My_Connections[i]))
-				continue; /* TLS/SSL layer needs to write data; deal with this first */
+				/* TLS/SSL layer needs to write data; deal
+				 * with this first! */
+				continue;
 #endif
 			if (Proc_InProgress(&My_Connections[i].proc_stat)) {
 				/* Wait for completion of forked subprocess
@@ -813,16 +748,31 @@ Conn_Handler(void)
 				continue;
 			}
 
+			if (array_bytes(&My_Connections[i].rbuf) >= COMMAND_LEN) {
+				/* There is still more data in the read buffer
+				 * than a single valid command can get long:
+				 * so either there is a complete command, or
+				 * invalid data. Therefore don't try to read in
+				 * even more data from the network but wait for
+				 * this command(s) to be handled first! */
+				io_event_del(My_Connections[i].sock,
+					     IO_WANTREAD);
+				command_available = true;
+				continue;
+			}
+
 			io_event_add(My_Connections[i].sock, IO_WANTREAD);
 		}
 
-		/* Set the timeout for reading from the network to 1 second,
-		 * which is the granularity with witch we handle "penalty
-		 * times" for example.
+		/* Don't wait for data when there is still at least one command
+		 * available in a read buffer which can be handled immediately;
+		 * set the timeout for reading from the network to 1 second
+		 * otherwise, which is the granularity with witch we handle
+		 * "penalty times" for example.
 		 * Note: tv_sec/usec are undefined(!) after io_dispatch()
-		 * returns, so we have to set it beforce each call to it! */
+		 * returns, so we have to set it before each call to it! */
 		tv.tv_usec = 0;
-		tv.tv_sec = 1;
+		tv.tv_sec = command_available ? 0 : 1;
 
 		/* Wait for activity ... */
 		i = io_dispatch(&tv);
@@ -833,15 +783,37 @@ Conn_Handler(void)
 			    PACKAGE_NAME);
 			exit(1);
 		}
+
+		t = time(NULL);
+		if (Conf_IdleTimeout > 0 && NumConnectionsAccepted > 0
+		    && idle_t > 0 && t - idle_t >= Conf_IdleTimeout) {
+			/* Should ngIRCd timeout when idle? */
+			LogDebug("Server idle timeout reached: %d second%s. Initiating shutdown ...",
+				 Conf_IdleTimeout,
+				 Conf_IdleTimeout == 1 ? "" : "s");
+			NGIRCd_SignalQuit = true;
+		} else if (Signal_NotifySvcMgr_Possible() && t - notify_t > 3) {
+			/* Send the current status to the service manager. */
+			snprintf(status, sizeof(status),
+				 "WATCHDOG=1\nSTATUS=%ld connection%s established (%ld user%s, %ld server%s), %ld maximum. %ld accepted in total.\n",
+				 (long)NumConnections, NumConnections == 1 ? "" : "s",
+				 Client_MyUserCount(), Client_MyUserCount() == 1 ? "" : "s",
+				 Client_MyServerCount(), Client_MyServerCount() == 1 ? "" : "s",
+				 (long)NumConnectionsMax, (long)NumConnectionsAccepted);
+			Signal_NotifySvcMgr(status);
+			notify_t = t;
+		}
 	}
 
-	if (NGIRCd_SignalQuit)
+	if (NGIRCd_SignalQuit) {
 		Log(LOG_NOTICE | LOG_snotice, "Server going down NOW!");
-	else if (NGIRCd_SignalRestart)
+		Signal_NotifySvcMgr("STOPPING=1\n");
+	} else if (NGIRCd_SignalRestart) {
 		Log(LOG_NOTICE | LOG_snotice, "Server restarting NOW!");
+		Signal_NotifySvcMgr("RELOADING=1\n");
+	}
 } /* Conn_Handler */
 
-
 /**
  * Write a text string into the socket of a connection.
  *
@@ -849,7 +821,7 @@ Conn_Handler(void)
  * the result is a valid IRC message (oversized messages are shortened, for
  * example). Then it calls the Conn_Write() function to do the actual sending.
  *
- * @param Idx		Index fo the connection.
+ * @param Idx		Index of the connection.
  * @param Format	Format string, see printf().
  * @returns		true on success, false otherwise.
  */
@@ -857,7 +829,7 @@ Conn_Handler(void)
 GLOBAL bool
 Conn_WriteStr(CONN_ID Idx, const char *Format, ...)
 #else
-GLOBAL bool 
+GLOBAL bool
 Conn_WriteStr(Idx, Format, va_alist)
 CONN_ID Idx;
 const char *Format;
@@ -865,9 +837,13 @@ va_dcl
 #endif
 {
 	char buffer[COMMAND_LEN];
+#ifdef ICONV
+	char *ptr, *message;
+#endif
 	size_t len;
 	bool ok;
 	va_list ap;
+	int r;
 
 	assert( Idx > NONE );
 	assert( Format != NULL );
@@ -877,7 +853,8 @@ va_dcl
 #else
 	va_start( ap );
 #endif
-	if (vsnprintf( buffer, COMMAND_LEN - 2, Format, ap ) >= COMMAND_LEN - 2 ) {
+	r = vsnprintf(buffer, COMMAND_LEN - 2, Format, ap);
+	if (r >= COMMAND_LEN - 2 || r == -1) {
 		/*
 		 * The string that should be written to the socket is longer
 		 * than the allowed size of COMMAND_LEN bytes (including both
@@ -885,7 +862,7 @@ va_dcl
 		 * IRC_WriteXXX() functions when the prefix of this server had
 		 * to be added to an already "quite long" command line which
 		 * has been received from a regular IRC client, for example.
-		 * 
+		 *
 		 * We are not allowed to send such "oversized" messages to
 		 * other servers and clients, see RFC 2812 2.3 and 2813 3.3
 		 * ("these messages SHALL NOT exceed 512 characters in length,
@@ -893,11 +870,18 @@ va_dcl
 		 *
 		 * So we have a big problem here: we should send more bytes
 		 * to the network than we are allowed to and we don't know
-		 * the originator (any more). The "old" behaviour of blaming
+		 * the originator (any more). The "old" behavior of blaming
 		 * the receiver ("next hop") is a bad idea (it could be just
 		 * an other server only routing the message!), so the only
 		 * option left is to shorten the string and to hope that the
 		 * result is still somewhat useful ...
+		 *
+		 * Note:
+		 * C99 states that vsnprintf() "returns the number of characters
+		 * that would have been printed if the n were unlimited"; but
+		 * according to the Linux manual page "glibc until 2.0.6 would
+		 * return -1 when the output was truncated" -- so we have to
+		 * handle both cases ...
 		 *                                                   -alex-
 		 */
 
@@ -905,9 +889,19 @@ va_dcl
 			CUT_TXTSUFFIX);
 	}
 
+#ifdef ICONV
+	ptr = strchr(buffer + 1, ':');
+	if (ptr) {
+		ptr++;
+		message = Conn_EncodingTo(Idx, ptr);
+		if (message != ptr)
+			strlcpy(ptr, message, sizeof(buffer) - (ptr - buffer));
+	}
+#endif
+
 #ifdef SNIFFER
 	if (NGIRCd_Sniffer)
-		Log(LOG_DEBUG, " -> connection %d: '%s'.", Idx, buffer);
+		LogDebug("-> connection %d: '%s'.", Idx, buffer);
 #endif
 
 	len = strlcat( buffer, "\r\n", sizeof( buffer ));
@@ -932,6 +926,10 @@ GLOBAL void
 Conn_SetPassword( CONN_ID Idx, const char *Pwd )
 {
 	assert( Idx > NONE );
+
+	if (My_Connections[Idx].pwd)
+		free(My_Connections[Idx].pwd);
+
 	My_Connections[Idx].pwd = strdup(Pwd);
 	if (My_Connections[Idx].pwd == NULL) {
 		Log(LOG_EMERG, "Can't allocate memory! [Conn_SetPassword]");
@@ -1022,7 +1020,6 @@ Conn_Write( CONN_ID Idx, char *Data, size_t Len )
 	return true;
 } /* Conn_Write */
 
-
 /**
  * Shut down a connection.
  *
@@ -1035,7 +1032,7 @@ Conn_Write( CONN_ID Idx, char *Data, size_t Len )
  *			connection statistics before disconnecting it.
  */
 GLOBAL void
-Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClient )
+Conn_Close(CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClient)
 {
 	/* Close connection. Open pipes of asynchronous resolver
 	 * sub-processes are closed down. */
@@ -1053,8 +1050,8 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie
 	/* Is this link already shutting down? */
 	if( Conn_OPTION_ISSET( &My_Connections[Idx], CONN_ISCLOSING )) {
 		/* Conn_Close() has been called recursively for this link;
-		 * probabe reason: Handle_Write() failed  -- see below. */
-		LogDebug("Recursive request to close connection: %d", Idx );
+		 * probable reason: Handle_Write() failed -- see below. */
+		LogDebug("Recursive request to close connection %d!", Idx );
 		return;
 	}
 
@@ -1064,7 +1061,7 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie
 	Conn_OPTION_ADD( &My_Connections[Idx], CONN_ISCLOSING );
 
 	port = ng_ipaddr_getport(&My_Connections[Idx].addr);
-	Log(LOG_INFO, "Shutting down connection %d (%s) with %s:%d ...", Idx,
+	Log(LOG_INFO, "Shutting down connection %d (%s) with \"%s:%d\" ...", Idx,
 	    LogMsg ? LogMsg : FwdMsg, My_Connections[Idx].host, port);
 
 	/* Search client, if any */
@@ -1084,8 +1081,10 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie
 		}
 #endif
 		/* Send ERROR to client (see RFC 2812, section 3.1.7) */
-		if (FwdMsg)
-			Conn_WriteStr(Idx, "ERROR :%s", FwdMsg);
+		if (c)
+			Conn_WriteStr(Idx, "ERROR :Closing connection: %s[%s@%s] (%s)",
+				      Client_ID(c), Client_User(c), Client_Hostname(c),
+				      FwdMsg ? FwdMsg : "\"\"");
 		else
 			Conn_WriteStr(Idx, "ERROR :Closing connection");
 	}
@@ -1100,7 +1099,7 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie
 	c = Conn_GetClient( Idx );
 #ifdef SSL_SUPPORT
 	if ( Conn_OPTION_ISSET( &My_Connections[Idx], CONN_SSL )) {
-		Log(LOG_INFO, "SSL connection %d shutting down ...", Idx);
+		LogDebug("SSL connection %d shutting down ...", Idx);
 		ConnSSL_Free(&My_Connections[Idx]);
 	}
 #endif
@@ -1131,14 +1130,14 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie
 		 * the calculation of in_p and out_p: in_z_k and out_z_k
 		 * are non-zero, that's guaranteed by the protocol until
 		 * compression can be enabled. */
-		if (! in_z_k)
+		if (in_z_k <= 0)
 			in_z_k = in_k;
-		if (! out_z_k)
+		if (out_z_k <= 0)
 			out_z_k = out_k;
 		in_p = (int)(( in_k * 100 ) / in_z_k );
 		out_p = (int)(( out_k * 100 ) / out_z_k );
 		Log(LOG_INFO,
-		    "Connection %d with %s:%d closed (in: %.1fk/%.1fk/%d%%, out: %.1fk/%.1fk/%d%%).",
+		    "Connection %d with \"%s:%d\" closed (in: %.1fk/%.1fk/%d%%, out: %.1fk/%.1fk/%d%%).",
 		    Idx, My_Connections[Idx].host, port,
 		    in_k, in_z_k, in_p, out_k, out_z_k, out_p);
 	}
@@ -1146,7 +1145,7 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie
 #endif
 	{
 		Log(LOG_INFO,
-		    "Connection %d with %s:%d closed (in: %.1fk, out: %.1fk).",
+		    "Connection %d with \"%s:%d\" closed (in: %.1fk, out: %.1fk).",
 		    Idx, My_Connections[Idx].host, port,
 		    in_k, out_k);
 	}
@@ -1177,8 +1176,9 @@ Conn_Close( CONN_ID Idx, const char *LogMsg, const char *FwdMsg, bool InformClie
 		NumConnections--;
 	LogDebug("Shutdown of connection %d completed, %ld connection%s left.",
 		 Idx, NumConnections, NumConnections != 1 ? "s" : "");
-} /* Conn_Close */
 
+	idle_t = NumConnections > 0 ? 0 : time(NULL);
+} /* Conn_Close */
 
 /**
  * Get current number of connections.
@@ -1191,7 +1191,6 @@ Conn_Count(void)
 	return NumConnections;
 } /* Conn_Count */
 
-
 /**
  * Get number of maximum simultaneous connections.
  *
@@ -1203,9 +1202,8 @@ Conn_CountMax(void)
 	return NumConnectionsMax;
 } /* Conn_CountMax */
 
-
 /**
- * Get number of connections accepted since the daemon startet.
+ * Get number of connections accepted since the daemon started.
  *
  * @returns	Number of connections accepted.
  */
@@ -1215,7 +1213,6 @@ Conn_CountAccepted(void)
 	return NumConnectionsAccepted;
 } /* Conn_CountAccepted */
 
-
 /**
  * Synchronize established connections and configured server structures
  * after a configuration update and store the correct connection IDs, if any.
@@ -1247,7 +1244,6 @@ Conn_SyncServerStruct(void)
 	}
 } /* SyncServerStruct */
 
-
 /**
  * Get IP address string of a connection.
  *
@@ -1261,7 +1257,6 @@ Conn_GetIPAInfo(CONN_ID Idx)
 	return ng_ipaddr_tostr(&My_Connections[Idx].addr);
 }
 
-
 /**
  * Send out data of write buffer; connect new sockets.
  *
@@ -1301,7 +1296,7 @@ Handle_Write( CONN_ID Idx )
 		return true;
 	}
 
-#ifdef DEBUG_BUFFER
+#if DEBUG_BUFFER
 	LogDebug
 	    ("Handle_Write() called for connection %d, %ld bytes pending ...",
 	     Idx, wdatalen);
@@ -1309,7 +1304,9 @@ Handle_Write( CONN_ID Idx )
 
 #ifdef SSL_SUPPORT
 	if ( Conn_OPTION_ISSET( &My_Connections[Idx], CONN_SSL )) {
-		len = ConnSSL_Write(&My_Connections[Idx], array_start(&My_Connections[Idx].wbuf), wdatalen);
+		len = ConnSSL_Write(&My_Connections[Idx],
+				    array_start(&My_Connections[Idx].wbuf),
+				    wdatalen);
 	} else
 #endif
 	{
@@ -1320,9 +1317,15 @@ Handle_Write( CONN_ID Idx )
 		if (errno == EAGAIN || errno == EINTR)
 			return true;
 
-		Log(LOG_ERR, "Write error on connection %d (socket %d): %s!",
-		    Idx, My_Connections[Idx].sock, strerror(errno));
-		Conn_Close(Idx, "Write error!", NULL, false);
+		if (!Conn_OPTION_ISSET(&My_Connections[Idx], CONN_ISCLOSING)) {
+			Log(LOG_ERR,
+			    "Write error on connection %d (socket %d): %s!",
+			    Idx, My_Connections[Idx].sock, strerror(errno));
+			Conn_Close(Idx, "Write error", NULL, false);
+		} else
+			LogDebug("Recursive write error on connection %d (socket %d): %s!",
+				 Idx, My_Connections[Idx].sock, strerror(errno));
+
 		return false;
 	}
 
@@ -1332,7 +1335,6 @@ Handle_Write( CONN_ID Idx )
 	return true;
 } /* Handle_Write */
 
-
 /**
  * Count established connections to a specific IP address.
  *
@@ -1353,22 +1355,22 @@ Count_Connections(ng_ipaddr_t *a)
 	return cnt;
 } /* Count_Connections */
 
-
 /**
  * Initialize new client connection on a listening socket.
  *
  * @param Sock	Listening socket descriptor.
+ * @param IsSSL	true if this socket expects SSL-encrypted data.
  * @returns	Accepted socket descriptor or -1 on error.
  */
 static int
-New_Connection(int Sock)
+New_Connection(int Sock, UNUSED bool IsSSL)
 {
 #ifdef TCPWRAP
 	struct request_info req;
 #endif
 	ng_ipaddr_t new_addr;
 	char ip_str[NG_INET_ADDRSTRLEN];
-	int new_sock, new_sock_len, identsock;
+	int new_sock, new_sock_len;
 	CLIENT *c;
 	long cnt;
 
@@ -1380,13 +1382,14 @@ New_Connection(int Sock)
 	new_sock = accept(Sock, (struct sockaddr *)&new_addr,
 			  (socklen_t *)&new_sock_len);
 	if (new_sock < 0) {
-		Log(LOG_CRIT, "Can't accept connection: %s!", strerror(errno));
+		Log(LOG_CRIT, "Can't accept connection on socket %d: %s!",
+		    Sock, strerror(errno));
 		return -1;
 	}
 	NumConnectionsAccepted++;
 
 	if (!ng_ipaddr_tostr_r(&new_addr, ip_str)) {
-		Log(LOG_CRIT, "fd %d: Can't convert IP address!", new_sock);
+		Log(LOG_CRIT, "Can't convert peer IP address of socket %d!", new_sock);
 		Simple_Message(new_sock, "ERROR :Internal Server Error");
 		close(new_sock);
 		return -1;
@@ -1399,7 +1402,8 @@ New_Connection(int Sock)
 	fromhost(&req);
 	if (!hosts_access(&req)) {
 		Log(deny_severity,
-		    "Refused connection from %s (by TCP Wrappers)!", ip_str);
+		    "Refused connection from %s on socket %d (by TCP Wrappers)!",
+		    ip_str, Sock);
 		Simple_Message(new_sock, "ERROR :Connection refused");
 		close(new_sock);
 		return -1;
@@ -1412,8 +1416,8 @@ New_Connection(int Sock)
 	/* Check global connection limit */
 	if ((Conf_MaxConnections > 0) &&
 	    (NumConnections >= (size_t) Conf_MaxConnections)) {
-		Log(LOG_ALERT, "Can't accept connection: limit (%d) reached!",
-		    Conf_MaxConnections);
+		Log(LOG_ALERT, "Can't accept new connection on socket %d: Limit (%d) reached!",
+		    Sock, Conf_MaxConnections);
 		Simple_Message(new_sock, "ERROR :Connection limit reached");
 		close(new_sock);
 		return -1;
@@ -1424,31 +1428,18 @@ New_Connection(int Sock)
 	if ((Conf_MaxConnectionsIP > 0) && (cnt >= Conf_MaxConnectionsIP)) {
 		/* Access denied, too many connections from this IP address! */
 		Log(LOG_ERR,
-		    "Refused connection from %s: too may connections (%ld) from this IP address!",
-		    ip_str, cnt);
+		    "Refused connection from %s on socket %d: too may connections (%ld) from this IP address!",
+		    ip_str, Sock, cnt);
 		Simple_Message(new_sock,
 			       "ERROR :Connection refused, too many connections from your IP address");
 		close(new_sock);
 		return -1;
 	}
 
-	if (new_sock >= Pool_Size) {
-		if (!array_alloc(&My_ConnArray, sizeof(CONNECTION),
-				 (size_t) new_sock)) {
-			Log(LOG_EMERG,
-			    "Can't allocate memory! [New_Connection]");
-			Simple_Message(new_sock, "ERROR: Internal error");
-			close(new_sock);
-			return -1;
-		}
-		LogDebug("Bumped connection pool to %ld items (internal: %ld items, %ld bytes)",
-			 new_sock, array_length(&My_ConnArray,
-			 sizeof(CONNECTION)), array_bytes(&My_ConnArray));
-
-		/* Adjust pointer to new block */
-		My_Connections = array_start(&My_ConnArray);
-		while (Pool_Size <= new_sock)
-			Init_Conn_Struct(Pool_Size++);
+	if (Socket2Index(new_sock) <= NONE) {
+		Simple_Message(new_sock, "ERROR: Internal error");
+		close(new_sock);
+		return -1;
 	}
 
 	/* register callback */
@@ -1485,34 +1476,67 @@ New_Connection(int Sock)
 
 	Client_SetHostname(c, My_Connections[new_sock].host);
 
-	Log(LOG_INFO, "Accepted connection %d from %s:%d on socket %d.",
+	Log(LOG_INFO, "Accepted connection %d from \"%s:%d\" on socket %d.",
 	    new_sock, My_Connections[new_sock].host,
 	    ng_ipaddr_getport(&new_addr), Sock);
+	Account_Connection();
+
+#ifdef SSL_SUPPORT
+	/* Delay connection initialization until SSL handshake is finished */
+	if (!IsSSL)
+#endif
+		Conn_StartLogin(new_sock);
+
+	return new_sock;
+} /* New_Connection */
+
+/**
+ * Finish connection initialization, start resolver subprocess.
+ *
+ * @param Idx Connection index.
+ */
+GLOBAL void
+Conn_StartLogin(CONN_ID Idx)
+{
+	int ident_sock = -1;
+
+	assert(Idx >= 0);
 
-	identsock = new_sock;
 #ifdef IDENTAUTH
-	if (!Conf_Ident)
-		identsock = -1;
+	/* Should we make an IDENT request? */
+	if (Conf_Ident)
+		ident_sock = My_Connections[Idx].sock;
 #endif
-	if (Conf_DNS) {
-		if (Conf_NoticeAuth) {
+
+	if (Conf_NoticeBeforeRegistration) {
+		/* Send "NOTICE *" messages to the client */
 #ifdef IDENTAUTH
-			if (Conf_Ident)
-				(void)Conn_WriteStr(new_sock,
-					"NOTICE AUTH :*** Looking up your hostname and checking ident");
+		if (Conf_Ident) {
+			if (Conf_DNS)
+				(void)Conn_WriteStr(Idx,
+					"NOTICE * :*** Looking up your hostname and checking ident");
 			else
+				(void)Conn_WriteStr(Idx,
+					"NOTICE * :*** Checking ident");
+		} else
 #endif
-				(void)Conn_WriteStr(new_sock,
-					"NOTICE AUTH :*** Looking up your hostname");
-		}
-		Resolve_Addr(&My_Connections[new_sock].proc_stat, &new_addr,
-			     identsock, cb_Read_Resolver_Result);
+		if(Conf_DNS)
+			(void)Conn_WriteStr(Idx,
+				"NOTICE * :*** Looking up your hostname");
+		else
+			(void)Conn_WriteStr(Idx,
+				"NOTICE * :*** Processing your connection");
+		/* Send buffered data to the client, but break on errors
+		 * because Handle_Write() would have closed the connection
+		 * again in this case! */
+		if (!Handle_Write(Idx))
+			return;
 	}
 
-	Account_Connection();
-	return new_sock;
-} /* New_Connection */
-
+	Resolve_Addr_Ident(&My_Connections[Idx].proc_stat,
+			   &My_Connections[Idx].addr,
+			   ident_sock, cb_Read_Resolver_Result);
+}
 
 /**
  * Update global connection counters.
@@ -1521,51 +1545,69 @@ static void
 Account_Connection(void)
 {
 	NumConnections++;
+	idle_t = 0;
 	if (NumConnections > NumConnectionsMax)
 		NumConnectionsMax = NumConnections;
 	LogDebug("Total number of connections now %lu (max %lu).",
 		 NumConnections, NumConnectionsMax);
 } /* Account_Connection */
 
-
 /**
- * Translate socket handle into connection index.
+ * Translate socket handle into connection index (for historical reasons, it is
+ * a 1:1 mapping today) and enlarge the "connection pool" accordingly.
  *
  * @param Sock	Socket handle.
- * @returns	Connecion index or NONE, if no connection could be found.
+ * @returns	Connection index or NONE when the pool is too small.
  */
 static CONN_ID
 Socket2Index( int Sock )
 {
-	assert( Sock >= 0 );
+	assert(Sock > 0);
+	assert(Pool_Size >= 0);
+
+	if (Sock < Pool_Size)
+		return Sock;
 
-	if( Sock >= Pool_Size || My_Connections[Sock].sock != Sock ) {
-		/* the Connection was already closed again, likely due to
-		 * an error. */
-		LogDebug("Socket2Index: can't get connection for socket %d!", Sock);
+	/* Try to allocate more memory ... */
+	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)Sock)) {
+		Log(LOG_EMERG,
+		    "Can't allocate memory to enlarge connection pool!");
 		return NONE;
 	}
-	return Sock;
-} /* Socket2Index */
+	LogDebug("Enlarged connection pool for %ld sockets (%ld items, %ld bytes)",
+		 Sock, array_length(&My_ConnArray, sizeof(CONNECTION)),
+		 array_bytes(&My_ConnArray));
+
+	/* Adjust pointer to new block, update size and initialize new items. */
+	My_Connections = array_start(&My_ConnArray);
+	while (Pool_Size <= Sock)
+		Init_Conn_Struct(Pool_Size++);
 
+	return Sock;
+}
 
 /**
- * Read data from the network to the read buffer. If an error occures,
+ * Read data from the network to the read buffer. If an error occurs,
  * the socket of this connection will be shut down.
  *
  * @param Idx	Connection index.
  */
 static void
-Read_Request( CONN_ID Idx )
+Read_Request(CONN_ID Idx)
 {
 	ssize_t len;
 	static const unsigned int maxbps = COMMAND_LEN / 2;
 	char readbuf[READBUFFER_LEN];
 	time_t t;
 	CLIENT *c;
-	assert( Idx > NONE );
-	assert( My_Connections[Idx].sock > NONE );
 
+	assert(Idx > NONE);
+	assert(My_Connections[Idx].sock > NONE);
+
+	/* Check if the read buffer is "full". Basically this shouldn't happen
+	 * here, because as long as there possibly are commands in the read
+	 * buffer (buffer usage > COMMAND_LEN), the socket shouldn't be
+	 * scheduled for reading in Conn_Handler() at all ... */
 #ifdef ZLIB
 	if ((array_bytes(&My_Connections[Idx].rbuf) >= READBUFFER_LEN) ||
 		(array_bytes(&My_Connections[Idx].zip.rbuf) >= READBUFFER_LEN))
@@ -1573,39 +1615,44 @@ Read_Request( CONN_ID Idx )
 	if (array_bytes(&My_Connections[Idx].rbuf) >= READBUFFER_LEN)
 #endif
 	{
-		/* Read buffer is full */
 		Log(LOG_ERR,
-		    "Receive buffer space exhausted (connection %d): %d bytes",
-		    Idx, array_bytes(&My_Connections[Idx].rbuf));
+		    "Receive buffer space exhausted (connection %d): %d/%d bytes",
+		    Idx, array_bytes(&My_Connections[Idx].rbuf), READBUFFER_LEN);
 		Conn_Close(Idx, "Receive buffer space exhausted", NULL, false);
 		return;
 	}
 
+	/* Now read new data from the network, up to READBUFFER_LEN bytes ... */
 #ifdef SSL_SUPPORT
 	if (Conn_OPTION_ISSET(&My_Connections[Idx], CONN_SSL))
-		len = ConnSSL_Read( &My_Connections[Idx], readbuf, sizeof(readbuf));
+		len = ConnSSL_Read(&My_Connections[Idx], readbuf, sizeof(readbuf));
 	else
 #endif
-	len = read(My_Connections[Idx].sock, readbuf, sizeof(readbuf));
+		len = read(My_Connections[Idx].sock, readbuf, sizeof(readbuf));
+
 	if (len == 0) {
-		Log(LOG_INFO, "%s:%u (%s) is closing the connection ...",
-				My_Connections[Idx].host,
-				(unsigned int) ng_ipaddr_getport(&My_Connections[Idx].addr),
-				ng_ipaddr_tostr(&My_Connections[Idx].addr));
-		Conn_Close(Idx,
-			   "Socket closed!", "Client closed connection",
-			   false);
+		LogDebug("Client \"%s:%u\" is closing connection %d ...",
+			 My_Connections[Idx].host,
+			 ng_ipaddr_getport(&My_Connections[Idx].addr), Idx);
+		Conn_Close(Idx, NULL, "Client closed connection", false);
 		return;
 	}
 
 	if (len < 0) {
-		if( errno == EAGAIN ) return;
+		if (errno == EAGAIN)
+			return;
+
 		Log(LOG_ERR, "Read error on connection %d (socket %d): %s!",
 		    Idx, My_Connections[Idx].sock, strerror(errno));
-		Conn_Close(Idx, "Read error!", "Client closed connection",
+		Conn_Close(Idx, "Read error", "Client closed connection",
 			   false);
 		return;
 	}
+
+	/* Now append the newly received data to the connection buffer.
+	 * NOTE: This can lead to connection read buffers being bigger(!) than
+	 * READBUFFER_LEN bytes, as we add up to READBUFFER_LEN new bytes to a
+	 * buffer possibly being "almost" READBUFFER_LEN bytes already! */
 #ifdef ZLIB
 	if (Conn_OPTION_ISSET(&My_Connections[Idx], CONN_ZIP)) {
 		if (!array_catb(&My_Connections[Idx].zip.rbuf, readbuf,
@@ -1624,12 +1671,15 @@ Read_Request( CONN_ID Idx )
 			Log(LOG_ERR,
 			    "Could not append received data to input buffer (connection %d): %d bytes!",
 			    Idx, len);
-			Conn_Close(Idx, "Receive buffer space exhausted", NULL, false );
+			Conn_Close(Idx, "Receive buffer space exhausted", NULL,
+				   false );
 		}
 	}
 
 	/* Update connection statistics */
 	My_Connections[Idx].bytes_in += len;
+
+	/* Handle read buffer */
 	My_Connections[Idx].bps += Handle_Buffer(Idx);
 
 	/* Make sure that there is still a valid client registered */
@@ -1655,17 +1705,10 @@ Read_Request( CONN_ID Idx )
 	}
 
 	/* Look at the data in the (read-) buffer of this connection */
-	if (Client_Type(c) != CLIENT_SERVER
-	    && Client_Type(c) != CLIENT_UNKNOWNSERVER
-	    && Client_Type(c) != CLIENT_SERVICE
-	    && My_Connections[Idx].bps >= maxbps) {
-		LogDebug("Throttling connection %d: BPS exceeded! (%u >= %u)",
-			 Idx, My_Connections[Idx].bps, maxbps);
-		Conn_SetPenalty(Idx, 1);
-	}
+	if (My_Connections[Idx].bps >= maxbps)
+		Throttle_Connection(Idx, c, THROTTLE_BPS, maxbps);
 } /* Read_Request */
 
-
 /**
  * Handle all data in the connection read-buffer.
  *
@@ -1702,12 +1745,17 @@ Handle_Buffer(CONN_ID Idx)
 		maxcmd = (int)(Client_UserCount() / 5)
 		       + MAX_COMMANDS_SERVER_MIN;
 		/* Allow servers to handle even more commands while peering
-		 * to speed up server login and network synchronisation. */
+		 * to speed up server login and network synchronization. */
 		if (Conn_LastPing(Idx) == 0)
 			maxcmd *= 5;
 		break;
 	    case CLIENT_SERVICE:
-		maxcmd = MAX_COMMANDS_SERVICE; break;
+		maxcmd = MAX_COMMANDS_SERVICE;
+		break;
+	    case CLIENT_USER:
+		if (Client_HasMode(c, 'F'))
+			maxcmd = MAX_COMMANDS_SERVICE;
+		break;
 	}
 
 	for (i=0; i < maxcmd; i++) {
@@ -1749,7 +1797,7 @@ Handle_Buffer(CONN_ID Idx)
 		ptr2 = strchr(array_start(&My_Connections[Idx].rbuf), '\n');
 		if (ptr) {
 			/* Check if there is a single CR or LF _before_ the
-			 * corerct CR+LF line terminator:  */
+			 * correct CR+LF line terminator:  */
 			first_eol = ptr1 < ptr2 ? ptr1 : ptr2;
 			if (first_eol < ptr) {
 				/* Single CR or LF before CR+LF found */
@@ -1804,10 +1852,6 @@ Handle_Buffer(CONN_ID Idx)
 			return 0; /* error -> connection has been closed */
 
 		array_moveleft(&My_Connections[Idx].rbuf, 1, len);
-#ifdef DEBUG_BUFFER
-		LogDebug("Connection %d: %d bytes left in read buffer.",
-			 Idx, array_bytes(&My_Connections[Idx].rbuf));
-#endif
 #ifdef ZLIB
 		if ((!old_z) && (My_Connections[Idx].options & CONN_ZIP) &&
 		    (array_bytes(&My_Connections[Idx].rbuf) > 0)) {
@@ -1830,10 +1874,20 @@ Handle_Buffer(CONN_ID Idx)
 		}
 #endif
 	}
+#if DEBUG_BUFFER
+	LogDebug("Connection %d: Processed %ld commands (max=%ld), %ld bytes. %ld bytes left in read buffer.",
+		 Idx, i, maxcmd, len_processed,
+		 array_bytes(&My_Connections[Idx].rbuf));
+#endif
+
+	/* If data has been processed but there is still data in the read
+	 * buffer, the command limit triggered. Enforce the penalty time: */
+	if (len_processed && array_bytes(&My_Connections[Idx].rbuf) > 2)
+		Throttle_Connection(Idx, c, THROTTLE_CMDS, maxcmd);
+
 	return len_processed;
 } /* Handle_Buffer */
 
-
 /**
  * Check whether established connections are still alive or not.
  * If not, play PING-PONG first; and if that doesn't help either,
@@ -1845,6 +1899,9 @@ Check_Connections(void)
 	CLIENT *c;
 	CONN_ID i;
 	char msg[64];
+	time_t time_now;
+
+	time_now = time(NULL);
 
 	for (i = 0; i < Pool_Size; i++) {
 		if (My_Connections[i].sock < 0)
@@ -1859,19 +1916,19 @@ Check_Connections(void)
 			    My_Connections[i].lastdata) {
 				/* We already sent a ping */
 				if (My_Connections[i].lastping <
-				    time(NULL) - Conf_PongTimeout) {
+				    time_now - Conf_PongTimeout) {
 					/* Timeout */
-					LogDebug
-					    ("Connection %d: Ping timeout: %d seconds.",
-					     i, Conf_PongTimeout);
-					snprintf(msg, sizeof(msg), "Ping timeout: %d seconds", Conf_PongTimeout);
+					snprintf(msg, sizeof(msg),
+						 "Ping timeout: %d seconds",
+						 Conf_PongTimeout);
+					LogDebug("Connection %d: %s.", i, msg);
 					Conn_Close(i, NULL, msg, true);
 				}
 			} else if (My_Connections[i].lastdata <
-				   time(NULL) - Conf_PingTimeout) {
+				   time_now - Conf_PingTimeout) {
 				/* We need to send a PING ... */
 				LogDebug("Connection %d: sending PING ...", i);
-				Conn_UpdatePing(i);
+				Conn_UpdatePing(i, time_now);
 				Conn_WriteStr(i, "PING :%s",
 					      Client_ID(Client_ThisServer()));
 			}
@@ -1882,7 +1939,7 @@ Check_Connections(void)
 			 * still not registered. */
 
 			if (My_Connections[i].lastdata <
-			    time(NULL) - Conf_PongTimeout) {
+			    time_now - Conf_PongTimeout) {
 				LogDebug
 				    ("Unregistered connection %d timed out ...",
 				     i);
@@ -1892,7 +1949,6 @@ Check_Connections(void)
 	}
 } /* Check_Connections */
 
-
 /**
  * Check if further server links should be established.
  */
@@ -1908,7 +1964,7 @@ Check_Servers(void)
 	for (i = 0; i < MAX_SERVERS; i++) {
 		if (Conf_Server[i].conn_id != NONE)
 			continue;	/* Already establishing or connected */
-		if (!Conf_Server[i].host[0] || !Conf_Server[i].port > 0)
+		if (!Conf_Server[i].host[0] || Conf_Server[i].port <= 0)
 			continue;	/* No host and/or port configured */
 		if (Conf_Server[i].flags & CONF_SFLAG_DISABLED)
 			continue;	/* Disabled configuration entry */
@@ -1935,12 +1991,14 @@ Check_Servers(void)
 		Conf_Server[i].lasttry = time_now;
 		Conf_Server[i].conn_id = SERVER_WAIT;
 		assert(Proc_GetPipeFd(&Conf_Server[i].res_stat) < 0);
-		Resolve_Name(&Conf_Server[i].res_stat, Conf_Server[i].host,
-			     cb_Connect_to_Server);
+
+		/* Start resolver subprocess ... */
+		if (!Resolve_Name(&Conf_Server[i].res_stat, Conf_Server[i].host,
+				  cb_Connect_to_Server))
+			Conf_Server[i].conn_id = NONE;
 	}
 } /* Check_Servers */
 
-
 /**
  * Establish a new outgoing server connection.
  *
@@ -1967,6 +2025,7 @@ New_Server( int Server , ng_ipaddr_t *dest)
 
 	if (!ng_ipaddr_tostr_r(dest, ip_str)) {
 		Log(LOG_WARNING, "New_Server: Could not convert IP to string");
+		Conf_Server[Server].conn_id = NONE;
 		return;
 	}
 
@@ -1981,45 +2040,50 @@ New_Server( int Server , ng_ipaddr_t *dest)
 	if (new_sock < 0) {
 		Log(LOG_CRIT, "Can't create socket (af %d): %s!",
 		    af_dest, strerror(errno));
+		Conf_Server[Server].conn_id = NONE;
 		return;
 	}
 
-	if (!Init_Socket(new_sock))
+	if (!Init_Socket(new_sock)) {
+		Conf_Server[Server].conn_id = NONE;
 		return;
+	}
 
 	/* is a bind address configured? */
 	res = ng_ipaddr_af(&Conf_Server[Server].bind_addr);
-	/* if yes, bind now. If it fails, warn and let connect() pick a source address */
+
+	/* if yes, bind now. If it fails, warn and let connect() pick a
+	 * source address */
 	if (res && bind(new_sock, (struct sockaddr *) &Conf_Server[Server].bind_addr,
 				ng_ipaddr_salen(&Conf_Server[Server].bind_addr)))
 	{
 		ng_ipaddr_tostr_r(&Conf_Server[Server].bind_addr, ip_str);
-		Log(LOG_WARNING, "Can't bind socket to %s: %s!", ip_str, strerror(errno));
+		Log(LOG_WARNING, "Can't bind socket to %s: %s!", ip_str,
+		    strerror(errno));
 	}
 	ng_ipaddr_setport(dest, Conf_Server[Server].port);
 	res = connect(new_sock, (struct sockaddr *) dest, ng_ipaddr_salen(dest));
 	if(( res != 0 ) && ( errno != EINPROGRESS )) {
 		Log( LOG_CRIT, "Can't connect socket: %s!", strerror( errno ));
 		close( new_sock );
+		Conf_Server[Server].conn_id = NONE;
 		return;
 	}
 
-	if (!array_alloc(&My_ConnArray, sizeof(CONNECTION), (size_t)new_sock)) {
-		Log(LOG_ALERT,
-		    "Cannot allocate memory for server connection (socket %d)",
-		    new_sock);
+	if (Socket2Index(new_sock) <= NONE) {
 		close( new_sock );
+		Conf_Server[Server].conn_id = NONE;
 		return;
 	}
 
 	if (!io_event_create( new_sock, IO_WANTWRITE, cb_connserver)) {
-		Log(LOG_ALERT, "io_event_create(): could not add fd %d", strerror(errno));
+		Log(LOG_ALERT, "io_event_create(): could not add fd %d",
+		    strerror(errno));
 		close(new_sock);
+		Conf_Server[Server].conn_id = NONE;
 		return;
 	}
 
-	My_Connections = array_start(&My_ConnArray);
-
 	assert(My_Connections[new_sock].sock <= 0);
 
 	Init_Conn_Struct(new_sock);
@@ -2029,6 +2093,7 @@ New_Server( int Server , ng_ipaddr_t *dest)
 	if (!c) {
 		Log( LOG_ALERT, "Can't establish connection: can't create client structure!" );
 		io_close(new_sock);
+		Conf_Server[Server].conn_id = NONE;
 		return;
 	}
 
@@ -2038,7 +2103,8 @@ New_Server( int Server , ng_ipaddr_t *dest)
 	Client_SetToken( c, TOKEN_OUTBOUND );
 
 	/* Register connection */
-	Conf_SetServer(Server, new_sock);
+	if (!Conf_SetServer(Server, new_sock))
+		return;
 	My_Connections[new_sock].sock = new_sock;
 	My_Connections[new_sock].addr = *dest;
 	My_Connections[new_sock].client = c;
@@ -2046,12 +2112,13 @@ New_Server( int Server , ng_ipaddr_t *dest)
 				sizeof(My_Connections[new_sock].host ));
 
 #ifdef SSL_SUPPORT
-	if (Conf_Server[Server].SSLConnect && !ConnSSL_PrepareConnect( &My_Connections[new_sock],
-								&Conf_Server[Server] ))
+	if (Conf_Server[Server].SSLConnect &&
+	    !ConnSSL_PrepareConnect(&My_Connections[new_sock], &Conf_Server[Server]))
 	{
 		Log(LOG_ALERT, "Could not initialize SSL for outgoing connection");
-		Conn_Close( new_sock, "Could not initialize SSL for outgoing connection", NULL, false );
-		Init_Conn_Struct( new_sock );
+		Conn_Close(new_sock, "Could not initialize SSL for outgoing connection",
+			   NULL, false);
+		Init_Conn_Struct(new_sock);
 		Conf_Server[Server].conn_id = NONE;
 		return;
 	}
@@ -2061,7 +2128,6 @@ New_Server( int Server , ng_ipaddr_t *dest)
 	Conn_OPTION_ADD( &My_Connections[new_sock], CONN_ISCONNECTING );
 } /* New_Server */
 
-
 /**
  * Initialize connection structure.
  *
@@ -2078,8 +2144,12 @@ Init_Conn_Struct(CONN_ID Idx)
 	My_Connections[Idx].lastdata = now;
 	My_Connections[Idx].lastprivmsg = now;
 	Proc_InitStruct(&My_Connections[Idx].proc_stat);
-} /* Init_Conn_Struct */
 
+#ifdef ICONV
+	My_Connections[Idx].iconv_from = (iconv_t)(-1);
+	My_Connections[Idx].iconv_to = (iconv_t)(-1);
+#endif
+} /* Init_Conn_Struct */
 
 /**
  * Initialize options of a new socket.
@@ -2096,16 +2166,18 @@ Init_Socket( int Sock )
 	int value;
 
 	if (!io_setnonblock(Sock)) {
-		Log( LOG_CRIT, "Can't enable non-blocking mode for socket: %s!", strerror( errno ));
-		close( Sock );
+		Log(LOG_CRIT, "Can't enable non-blocking mode for socket: %s!",
+		    strerror(errno));
+		close(Sock);
 		return false;
 	}
 
 	/* Don't block this port after socket shutdown */
 	value = 1;
-	if( setsockopt( Sock, SOL_SOCKET, SO_REUSEADDR, &value, (socklen_t)sizeof( value )) != 0 )
-	{
-		Log( LOG_ERR, "Can't set socket option SO_REUSEADDR: %s!", strerror( errno ));
+	if (setsockopt(Sock, SOL_SOCKET, SO_REUSEADDR, &value,
+		       (socklen_t)sizeof(value)) != 0) {
+		Log(LOG_ERR, "Can't set socket option SO_REUSEADDR: %s!",
+		    strerror(errno));
 		/* ignore this error */
 	}
 
@@ -2125,7 +2197,6 @@ Init_Socket( int Sock )
 	return true;
 } /* Init_Socket */
 
-
 /**
  * Read results of a resolver sub-process and try to initiate a new server
  * connection.
@@ -2136,15 +2207,16 @@ Init_Socket( int Sock )
 static void
 cb_Connect_to_Server(int fd, UNUSED short events)
 {
-	/* Read result of resolver sub-process from pipe and start connection */
 	int i;
 	size_t len;
-	ng_ipaddr_t dest_addrs[4];	/* we can handle at most 3; but we read up to
-					   four so we can log the 'more than we can handle'
-					   condition. First result is tried immediately, rest
-					   is saved for later if needed. */
 
-	LogDebug("Resolver: Got forward lookup callback on fd %d, events %d", fd, events);
+	/* we can handle at most 3 addresses; but we read up to 4 so we can
+	 * log the 'more than we can handle' condition. First result is tried
+	 * immediately, rest is saved for later if needed. */
+	ng_ipaddr_t dest_addrs[4];
+
+	LogDebug("Resolver: Got forward lookup callback on fd %d, events %d",
+		 fd, events);
 
 	for (i=0; i < MAX_SERVERS; i++) {
 		  if (Proc_GetPipeFd(&Conf_Server[i].res_stat) == fd )
@@ -2169,7 +2241,8 @@ cb_Connect_to_Server(int fd, UNUSED short events)
 
 	assert((len % sizeof(ng_ipaddr_t)) == 0);
 
-	LogDebug("Got result from resolver: %u structs (%u bytes).", len/sizeof(ng_ipaddr_t), len);
+	LogDebug("Got result from resolver: %u structs (%u bytes).",
+		 len/sizeof(ng_ipaddr_t), len);
 
 	memset(&Conf_Server[i].dst_addr, 0, sizeof(Conf_Server[i].dst_addr));
 	if (len > sizeof(ng_ipaddr_t)) {
@@ -2187,10 +2260,9 @@ cb_Connect_to_Server(int fd, UNUSED short events)
 	New_Server(i, dest_addrs);
 } /* cb_Read_Forward_Lookup */
 
-
 /**
  * Read results of a resolver sub-process from the pipe and update the
- * apropriate connection/client structure(s): hostname and/or IDENT user name.
+ * appropriate connection/client structure(s): hostname and/or IDENT user name.
  *
  * @param r_fd		File descriptor of the pipe to the sub-process.
  * @param events	(ignored IO specification)
@@ -2248,12 +2320,16 @@ cb_Read_Resolver_Result( int r_fd, UNUSED short events )
 	 * the resolver results, so we don't have to worry to override settings
 	 * from these commands here. */
 	if(Client_Type(c) == CLIENT_UNKNOWN) {
-		strlcpy(My_Connections[i].host, readbuf,
-			sizeof(My_Connections[i].host));
-		Client_SetHostname(c, readbuf);
-		if (Conf_NoticeAuth)
-			(void)Conn_WriteStr(i,
-					"NOTICE AUTH :*** Found your hostname");
+		if (readbuf[0]) {
+			/* We got a hostname */
+			strlcpy(My_Connections[i].host, readbuf,
+				sizeof(My_Connections[i].host));
+			Client_SetHostname(c, readbuf);
+			if (Conf_NoticeBeforeRegistration)
+				(void)Conn_WriteStr(i,
+					"NOTICE * :*** Found your hostname: %s",
+					My_Connections[i].host);
+		}
 #ifdef IDENTAUTH
 		++identptr;
 		if (*identptr) {
@@ -2276,26 +2352,35 @@ cb_Read_Resolver_Result( int r_fd, UNUSED short events )
 				    i, identptr);
 				Client_SetUser(c, identptr, true);
 			}
-			if (Conf_NoticeAuth) {
+			if (Conf_NoticeBeforeRegistration) {
 				(void)Conn_WriteStr(i,
-					"NOTICE AUTH :*** Got %sident response",
-					*ptr ? "invalid " : "");
+					"NOTICE * :*** Got %sident response%s%s",
+					*ptr ? "invalid " : "",
+					*ptr ? "" : ": ",
+					*ptr ? "" : identptr);
 			}
-		} else {
+		} else if(Conf_Ident) {
 			Log(LOG_INFO, "IDENT lookup for connection %d: no result.", i);
-			if (Conf_NoticeAuth && Conf_Ident)
+			if (Conf_NoticeBeforeRegistration)
 				(void)Conn_WriteStr(i,
-					"NOTICE AUTH :*** No ident response");
+					"NOTICE * :*** No ident response");
 		}
 #endif
+
+		if (Conf_NoticeBeforeRegistration) {
+			/* Send buffered data to the client, but break on
+			 * errors because Handle_Write() would have closed
+			 * the connection again in this case! */
+			if (!Handle_Write(i))
+				return;
+		}
+
 		Class_HandleServerBans(c);
 	}
-#ifdef DEBUG
-		else Log( LOG_DEBUG, "Resolver: discarding result for already registered connection %d.", i );
-#endif
+	else
+		LogDebug("Resolver: discarding result for already registered connection %d.", i);
 } /* cb_Read_Resolver_Result */
 
-
 /**
  * Write a "simple" (error) message to a socket.
  *
@@ -2329,7 +2414,6 @@ Simple_Message(int Sock, const char *Msg)
 	}
 } /* Simple_Error */
 
-
 /**
  * Get CLIENT structure that belongs to a local connection identified by its
  * index number. Each connection belongs to a client by definition, so it is
@@ -2339,7 +2423,7 @@ Simple_Message(int Sock, const char *Msg)
  * @returns	Pointer to CLIENT structure.
  */
 GLOBAL CLIENT *
-Conn_GetClient( CONN_ID Idx ) 
+Conn_GetClient( CONN_ID Idx )
 {
 	CONNECTION *c;
 
@@ -2366,7 +2450,6 @@ Conn_GetProcStat(CONN_ID Idx)
 	return &c->proc_stat;
 } /* Conn_GetProcStat */
 
-
 /**
  * Get CONN_ID from file descriptor associated to a subprocess structure.
  *
@@ -2387,6 +2470,35 @@ Conn_GetFromProc(int fd)
 	return NONE;
 } /* Conn_GetFromProc */
 
+/**
+ * Throttle a connection because of excessive usage.
+ *
+ * @param Reason The reason, see THROTTLE_xxx constants.
+ * @param Idx The connection index.
+ * @param Client The client of this connection.
+ * @param Value The time to delay this connection.
+ */
+static void
+Throttle_Connection(const CONN_ID Idx, CLIENT *Client, const int Reason,
+		    unsigned int Value)
+{
+	assert(Idx > NONE);
+	assert(Client != NULL);
+
+	/* Never throttle servers or services, only interrupt processing */
+	if (Client_Type(Client) == CLIENT_SERVER
+	    || Client_Type(Client) == CLIENT_UNKNOWNSERVER
+	    || Client_Type(Client) == CLIENT_SERVICE)
+		return;
+
+	/* Don't throttle clients with user mode 'F' set */
+	if (Client_HasMode(Client, 'F'))
+		return;
+
+	LogDebug("Throttling connection %d: code %d, value %d!", Idx,
+		 Reason, Value);
+	Conn_SetPenalty(Idx, 1);
+}
 
 #ifndef STRICT_RFC
 
@@ -2404,13 +2516,167 @@ Conn_SetAuthPing(CONN_ID Idx, long ID)
 	My_Connections[Idx].auth_ping = ID;
 } /* Conn_SetAuthPing */
 
-#endif
-
+#endif /* STRICT_RFC */
 
 #ifdef SSL_SUPPORT
 
 /**
- * Get information about used SSL chiper.
+ * IO callback for new SSL-enabled client and server connections.
+ *
+ * @param sock	Socket descriptor.
+ * @param what	IO specification (IO_WANTREAD/IO_WANTWRITE/...).
+ */
+static void
+cb_clientserver_ssl(int sock, UNUSED short what)
+{
+	CONN_ID idx = Socket2Index(sock);
+
+	if (idx <= NONE) {
+		io_close(sock);
+		return;
+	}
+
+	switch (ConnSSL_Accept(&My_Connections[idx])) {
+		case 1:
+			break;	/* OK */
+		case 0:
+			return;	/* EAGAIN: callback will be invoked again by IO layer */
+		default:
+			Conn_Close(idx,
+				   "SSL accept error, closing socket", "SSL accept error",
+				   false);
+			return;
+	}
+
+	io_event_setcb(sock, cb_clientserver);	/* SSL handshake completed */
+}
+
+/**
+ * IO callback for listening SSL sockets: handle new connections. This callback
+ * gets called when a new SSL-enabled connection should be accepted.
+ *
+ * @param sock		Socket descriptor.
+ * @param irrelevant	(ignored IO specification)
+ */
+static void
+cb_listen_ssl(int sock, short irrelevant)
+{
+	int fd;
+
+	(void) irrelevant;
+	fd = New_Connection(sock, true);
+	if (fd < 0)
+		return;
+	io_event_setcb(My_Connections[fd].sock, cb_clientserver_ssl);
+}
+
+/**
+ * IO callback for new outgoing SSL-enabled server connections.
+ *
+ * IMPORTANT: The SSL session has been validated before, but all errors have
+ * been ignored so far! The reason for this is that the generic SSL code has no
+ * idea if the new session actually belongs to a server, as this only becomes
+ * clear when the remote peer sends its PASS command (and we have to handle
+ * invalid client certificates!). Therefore, it is important to check the
+ * status of the SSL session first before continuing the server handshake here!
+ *
+ * @param sock		Socket descriptor.
+ * @param unused	(ignored IO specification)
+ */
+static void
+cb_connserver_login_ssl(int sock, short unused)
+{
+	CONN_ID idx = Socket2Index(sock);
+	int serveridx;
+
+	(void) unused;
+
+	if (idx <= NONE) {
+		io_close(sock);
+		return;
+	}
+
+	switch (ConnSSL_Connect( &My_Connections[idx])) {
+		case 1: break;
+		case 0: LogDebug("ConnSSL_Connect: not ready");
+			return;
+		case -1:
+			Log(LOG_ERR, "SSL connection on socket %d failed!", sock);
+			Conn_Close(idx, "Can't connect", NULL, false);
+			return;
+	}
+
+	serveridx = Conf_GetServer(idx);
+	assert(serveridx >= 0);
+
+	/* The SSL handshake is done, but validation results were ignored so
+	 * far, so let's see where we are: */
+	LogDebug("SSL handshake on socket %d done.", idx);
+	if (!Conn_OPTION_ISSET(&My_Connections[idx], CONN_SSL_PEERCERT_OK)) {
+		if (Conf_Server[serveridx].SSLVerify) {
+			Log(LOG_ERR,
+				"Peer certificate check failed for \"%s\" on connection %d!",
+				My_Connections[idx].host, idx);
+			Conn_Close(idx, "Valid certificate required",
+				   NULL, false);
+			return;
+		}
+		Log(LOG_WARNING,
+			"Peer certificate check failed for \"%s\" on connection %d, but \"SSLVerify\" is disabled. Continuing ...",
+			My_Connections[idx].host, idx);
+	}
+	LogDebug("Server certificate accepted, continuing server login ...");
+	server_login(idx);
+}
+
+
+/**
+ * Check if SSL library needs to read SSL-protocol related data.
+ *
+ * SSL/TLS connections require extra treatment:
+ * When either CONN_SSL_WANT_WRITE or CONN_SSL_WANT_READ is set, we
+ * need to take care of that first, before checking read/write buffers.
+ * For instance, while we might have data in our write buffer, the
+ * TLS/SSL protocol might need to read internal data first for TLS/SSL
+ * writes to succeed.
+ *
+ * If this function returns true, such a condition is met and we have
+ * to reverse the condition (check for read even if we've data to write,
+ * do not check for read but writeability even if write-buffer is empty).
+ *
+ * @param c	Connection to check.
+ * @returns	true if SSL-library has to read protocol data.
+ */
+static bool
+SSL_WantRead(const CONNECTION *c)
+{
+	if (Conn_OPTION_ISSET(c, CONN_SSL_WANT_READ)) {
+		io_event_add(c->sock, IO_WANTREAD);
+		return true;
+	}
+	return false;
+}
+
+/**
+ * Check if SSL library needs to write SSL-protocol related data.
+ *
+ * Please see description of SSL_WantRead() for full description!
+ *
+ * @param c	Connection to check.
+ * @returns	true if SSL-library has to write protocol data.
+ */
+static bool
+SSL_WantWrite(const CONNECTION *c)
+{
+	if (Conn_OPTION_ISSET(c, CONN_SSL_WANT_WRITE)) {
+		io_event_add(c->sock, IO_WANTWRITE);
+		return true;
+	}
+	return false;
+}
+
+/**
+ * Get information about used SSL cipher.
  *
  * @param Idx	Connection index number.
  * @param buf	Buffer for returned information text.
@@ -2426,7 +2692,6 @@ Conn_GetCipherInfo(CONN_ID Idx, char *buf, size_t len)
 	return ConnSSL_GetCipherInfo(&My_Connections[Idx], buf, len);
 }
 
-
 /**
  * Check if a connection is SSL-enabled or not.
  *
@@ -2442,10 +2707,46 @@ Conn_UsesSSL(CONN_ID Idx)
 	return Conn_OPTION_ISSET(&My_Connections[Idx], CONN_SSL);
 }
 
-#endif
+GLOBAL char *
+Conn_GetCertFp(CONN_ID Idx)
+{
+	if (Idx < 0)
+		return NULL;
+	assert(Idx < (int) array_length(&My_ConnArray, sizeof(CONNECTION)));
+	return ConnSSL_GetCertFp(&My_Connections[Idx]);
+}
 
+GLOBAL bool
+Conn_SetCertFp(CONN_ID Idx, const char *fingerprint)
+{
+	if (Idx < 0)
+		return false;
+	assert(Idx < (int) array_length(&My_ConnArray, sizeof(CONNECTION)));
+	return ConnSSL_SetCertFp(&My_Connections[Idx], fingerprint);
+}
+
+#else /* SSL_SUPPORT */
+
+GLOBAL bool
+Conn_UsesSSL(UNUSED CONN_ID Idx)
+{
+	return false;
+}
+
+GLOBAL char *
+Conn_GetCertFp(UNUSED CONN_ID Idx)
+{
+	return NULL;
+}
+
+GLOBAL bool
+Conn_SetCertFp(UNUSED CONN_ID Idx, UNUSED const char *fingerprint)
+{
+	return true;
+}
+
+#endif /* SSL_SUPPORT */
 
-#ifdef DEBUG
 
 /**
  * Dump internal state of the "connection module".
@@ -2455,11 +2756,11 @@ Conn_DebugDump(void)
 {
 	int i;
 
-	Log(LOG_DEBUG, "Connection status:");
+	LogDebug("Connection status:");
 	for (i = 0; i < Pool_Size; i++) {
 		if (My_Connections[i].sock == NONE)
 			continue;
-		Log(LOG_DEBUG,
+		LogDebug(
 		    " - %d: host=%s, lastdata=%ld, lastping=%ld, delaytime=%ld, flag=%d, options=%d, bps=%d, client=%s",
 		    My_Connections[i].sock, My_Connections[i].host,
 		    My_Connections[i].lastdata, My_Connections[i].lastping,
@@ -2469,7 +2770,5 @@ Conn_DebugDump(void)
 	}
 } /* Conn_DumpClients */
 
-#endif
-
 
 /* -eof- */