X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_spanningtree%2Ftreesocket1.cpp;h=5809fb6b82c50750738e972ae25eaae63d5b31bc;hb=ed31c3ee4a7b5f59465457ba353642d46d86a8b2;hp=1ca72eee510b9208366a7b12b6f4ede6781fb254;hpb=a17174ec0aeeffc1236d0ddbcf6a63f56205acea;p=user%2Fhenk%2Fcode%2Finspircd.git

diff --git a/src/modules/m_spanningtree/treesocket1.cpp b/src/modules/m_spanningtree/treesocket1.cpp
index 1ca72eee5..5809fb6b8 100644
--- a/src/modules/m_spanningtree/treesocket1.cpp
+++ b/src/modules/m_spanningtree/treesocket1.cpp
@@ -1,3 +1,17 @@
+/*       +------------------------------------+
+ *       | Inspire Internet Relay Chat Daemon |
+ *       +------------------------------------+
+ *
+ *  InspIRCd: (C) 2002-2007 InspIRCd Development Team
+ * See: http://www.inspircd.org/wiki/index.php/Credits
+ *
+ * This program is free but copyrighted software; see
+ *            the file COPYING for details.
+ *
+ * ---------------------------------------------------
+ */
+
+#include "inspircd.h"
 #include "configreader.h"
 #include "users.h"
 #include "channels.h"
@@ -5,10 +19,10 @@
 #include "commands/cmd_whois.h"
 #include "commands/cmd_stats.h"
 #include "socket.h"
-#include "inspircd.h"
 #include "wildcard.h"
 #include "xline.h"
 #include "transport.h"
+#include "m_hash.h"
 #include "socketengine.h"
 
 #include "m_spanningtree/main.h"
@@ -19,6 +33,9 @@
 #include "m_spanningtree/resolvers.h"
 #include "m_spanningtree/handshaketimer.h"
 
+/* $ModDep: m_spanningtree/timesynctimer.h m_spanningtree/resolvers.h m_spanningtree/main.h m_spanningtree/utils.h m_spanningtree/treeserver.h m_spanningtree/link.h m_spanningtree/treesocket.h m_hash.h */
+
+
 /** Because most of the I/O gubbins are encapsulated within
  * InspSocket, we just call the superclass constructor for
  * most of the action, and append a few of our own values
@@ -29,14 +46,18 @@ TreeSocket::TreeSocket(SpanningTreeUtilities* Util, InspIRCd* SI, std::string ho
 {
 	myhost = host;
 	this->LinkState = LISTENER;
+	theirchallenge.clear();
+	ourchallenge.clear();
 	if (listening && Hook)
 		InspSocketHookRequest(this, (Module*)Utils->Creator, Hook).Send();
 }
 
-TreeSocket::TreeSocket(SpanningTreeUtilities* Util, InspIRCd* SI, std::string host, int port, bool listening, unsigned long maxtime, std::string ServerName, Module* HookMod)
-	: InspSocket(SI, host, port, listening, maxtime), Utils(Util), Hook(HookMod)
+TreeSocket::TreeSocket(SpanningTreeUtilities* Util, InspIRCd* SI, std::string host, int port, bool listening, unsigned long maxtime, const std::string &ServerName, const std::string &bindto, Module* HookMod)
+	: InspSocket(SI, host, port, listening, maxtime, bindto), Utils(Util), Hook(HookMod)
 {
 	myhost = ServerName;
+	theirchallenge.clear();
+	ourchallenge.clear();
 	this->LinkState = CONNECTING;
 	if (Hook)
 		InspSocketHookRequest(this, (Module*)Utils->Creator, Hook).Send();
@@ -50,21 +71,16 @@ TreeSocket::TreeSocket(SpanningTreeUtilities* Util, InspIRCd* SI, int newfd, cha
 	: InspSocket(SI, newfd, ip), Utils(Util), Hook(HookMod)
 {
 	this->LinkState = WAIT_AUTH_1;
+	theirchallenge.clear();
+	ourchallenge.clear();
+	sentcapab = false;
 	/* If we have a transport module hooked to the parent, hook the same module to this
 	 * socket, and set a timer waiting for handshake before we send CAPAB etc.
 	 */
 	if (Hook)
-	{
 		InspSocketHookRequest(this, (Module*)Utils->Creator, Hook).Send();
-		Instance->Timers->AddTimer(new HandshakeTimer(Instance, this, &(Utils->LinkBlocks[0]), this->Utils));
-	}
-	else
-	{
-		/* Otherwise, theres no lower layer transport in plain TCP/IP,
-		 * so just send the capabilities right now.
-		 */
-		this->SendCapabilities();
-	}
+
+	Instance->Timers->AddTimer(new HandshakeTimer(Instance, this, &(Utils->LinkBlocks[0]), this->Utils, 1));
 }
 
 ServerState TreeSocket::GetLinkState()
@@ -81,6 +97,72 @@ TreeSocket::~TreeSocket()
 {
 	if (Hook)
 		InspSocketUnhookRequest(this, (Module*)Utils->Creator, Hook).Send();
+
+	Utils->DelBurstingServer(this);
+}
+
+const std::string& TreeSocket::GetOurChallenge()
+{
+	return this->ourchallenge;
+}
+
+void TreeSocket::SetOurChallenge(const std::string &c)
+{
+	this->ourchallenge = c;
+}
+
+const std::string& TreeSocket::GetTheirChallenge()
+{
+	return this->theirchallenge;
+}
+
+void TreeSocket::SetTheirChallenge(const std::string &c)
+{
+	this->theirchallenge = c;
+}
+
+std::string TreeSocket::MakePass(const std::string &password, const std::string &challenge)
+{
+	/* This is a simple (maybe a bit hacky?) HMAC algorithm, thanks to jilles for
+	 * suggesting the use of HMAC to secure the password against various attacks.
+	 *
+	 * Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
+	 *       HMAC challenge/response.
+	 */
+	Module* sha256 = Instance->FindModule("m_sha256.so");
+	if (Utils->ChallengeResponse && sha256 && !challenge.empty())
+	{
+		/* XXX: This is how HMAC is supposed to be done:
+		 *
+		 * sha256( (pass xor 0x5c) + sha256((pass xor 0x36) + m) )
+		 *
+		 * Note that we are encoding the hex hash, not the binary
+		 * output of the hash which is slightly different to standard.
+		 *
+		 * Don't ask me why its always 0x5c and 0x36... it just is.
+		 */
+		std::string hmac1, hmac2;
+
+		for (size_t n = 0; n < password.length(); n++)
+		{
+			hmac1 += static_cast<char>(password[n] ^ 0x5C);
+			hmac2 += static_cast<char>(password[n] ^ 0x36);
+		}
+
+		hmac2 += challenge;
+		HashResetRequest(Utils->Creator, sha256).Send();
+		hmac2 = HashSumRequest(Utils->Creator, sha256, hmac2).Send();
+
+		HashResetRequest(Utils->Creator, sha256).Send();
+		std::string hmac = hmac1 + hmac2;
+		hmac = HashSumRequest(Utils->Creator, sha256, hmac).Send();
+
+		return "HMAC-SHA256:"+ hmac;
+	}
+	else if (!challenge.empty() && !sha256)
+		Instance->Log(DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
+
+	return password;
 }
 
 /** When an outbound connection finishes connecting, we receive
@@ -98,19 +180,22 @@ bool TreeSocket::OnConnected()
 		{
 			if (x->Name == this->myhost)
 			{
-				this->Instance->SNO->WriteToSnoMask('l',"Connection to \2"+myhost+"\2["+(x->HiddenFromStats ? "<hidden>" : this->GetIP())+"] started.");
+				Utils->Creator->RemoteMessage(NULL,"Connection to \2%s\2[%s] started.", myhost.c_str(), (x->HiddenFromStats ? "<hidden>" : this->GetIP().c_str()));
 				if (Hook)
 				{
 					InspSocketHookRequest(this, (Module*)Utils->Creator, Hook).Send();
-					this->Instance->SNO->WriteToSnoMask('l',"Connection to \2"+myhost+"\2["+(x->HiddenFromStats ? "<hidden>" : this->GetIP())+"] using transport \2"+x->Hook+"\2");
+					Utils->Creator->RemoteMessage(NULL,"Connection to \2%s\2[%s] using transport \2%s\2", myhost.c_str(), (x->HiddenFromStats ? "<hidden>" : this->GetIP().c_str()),
+							x->Hook.c_str());
 				}
-				else
-					this->SendCapabilities();
+				this->OutboundPass = x->SendPass;
+				sentcapab = false;
+
 				/* found who we're supposed to be connecting to, send the neccessary gubbins. */
-				if (Hook)
-					Instance->Timers->AddTimer(new HandshakeTimer(Instance, this, &(*x), this->Utils));
+				if (this->GetHook())
+					Instance->Timers->AddTimer(new HandshakeTimer(Instance, this, &(*x), this->Utils, 1));
 				else
-					this->WriteLine(std::string("SERVER ")+this->Instance->Config->ServerName+" "+x->SendPass+" 0 :"+this->Instance->Config->ServerDesc);
+					this->SendCapabilities();
+
 				return true;
 			}
 		}
@@ -120,22 +205,41 @@ bool TreeSocket::OnConnected()
 	 * If that happens the connection hangs here until it's closed. Unlikely
 	 * and rather harmless.
 	 */
-	this->Instance->SNO->WriteToSnoMask('l',"Connection to \2"+myhost+"\2 lost link tag(!)");
+	this->Utils->Creator->RemoteMessage(NULL,"Connection to \2%s\2 lost link tag(!)", myhost.c_str());
 	return true;
 }
 
 void TreeSocket::OnError(InspSocketError e)
 {
-	/* We don't handle this method, because all our
-	 * dirty work is done in OnClose() (see below)
-	 * which is still called on error conditions too.
-	 */
-	if (e == I_ERR_CONNECT)
+	Link* MyLink;
+
+	if (this->LinkState == LISTENER)
+		return;
+
+	switch (e)
 	{
-		this->Instance->SNO->WriteToSnoMask('l',"Connection failed: Connection to \002"+myhost+"\002 refused");
-		Link* MyLink = Utils->FindLink(myhost);
-		if (MyLink)
-			Utils->DoFailOver(MyLink);
+		case I_ERR_CONNECT:
+			Utils->Creator->RemoteMessage(NULL,"Connection failed: Connection to \002%s\002 refused", myhost.c_str());
+			MyLink = Utils->FindLink(myhost);
+			if (MyLink)
+				Utils->DoFailOver(MyLink);
+		break;
+		case I_ERR_SOCKET:
+			Utils->Creator->RemoteMessage(NULL,"Connection failed: Could not create socket");
+		break;
+		case I_ERR_BIND:
+			Utils->Creator->RemoteMessage(NULL,"Connection failed: Error binding socket to address or port");
+		break;
+		case I_ERR_WRITE:
+			Utils->Creator->RemoteMessage(NULL,"Connection failed: I/O error on connection");
+		break;
+		case I_ERR_NOMOREFDS:
+			Utils->Creator->RemoteMessage(NULL,"Connection failed: Operating system is out of file descriptors!");
+		break;
+		default:
+			if ((errno) && (errno != EINPROGRESS) && (errno != EAGAIN))
+				Utils->Creator->RemoteMessage(NULL,"Connection to \002%s\002 failed with OS error: %s", myhost.c_str(), strerror(errno));
+		break;
 	}
 }
 
@@ -176,7 +280,7 @@ void TreeSocket::SendServers(TreeServer* Current, TreeServer* s, int hops)
 std::string TreeSocket::MyCapabilities()
 {
 	std::vector<std::string> modlist;
-	std::string capabilities = "";
+	std::string capabilities;
 	for (int i = 0; i <= this->Instance->GetModuleCount(); i++)
 	{
 		if (this->Instance->modules[i]->GetVersion().Flags & VF_COMMON)
@@ -192,15 +296,52 @@ std::string TreeSocket::MyCapabilities()
 	return capabilities;
 }
 
+std::string TreeSocket::RandString(unsigned int length)
+{
+	char* randombuf = new char[length+1];
+	std::string out;
+#ifdef WINDOWS
+	int fd = -1;
+#else
+	int fd = open("/dev/urandom", O_RDONLY, 0);
+#endif
+
+	if (fd >= 0)
+	{
+#ifndef WINDOWS
+		read(fd, randombuf, length);
+		close(fd);
+#endif
+	}
+	else
+	{
+		for (unsigned int i = 0; i < length; i++)
+			randombuf[i] = rand();
+	}
+
+	for (unsigned int i = 0; i < length; i++)
+	{
+		char randchar = static_cast<char>((randombuf[i] & 0x7F) | 0x21);
+		out += (randchar == '=' ? '_' : randchar);
+	}
+
+	delete[] randombuf;
+	return out;
+}
+
 void TreeSocket::SendCapabilities()
 {
+	if (sentcapab)
+		return;
+
+	sentcapab = true;
 	irc::commasepstream modulelist(MyCapabilities());
 	this->WriteLine("CAPAB START");
 
 	/* Send module names, split at 509 length */
-	std::string item = "*";
+	std::string item;
 	std::string line = "CAPAB MODULES ";
-	while ((item = modulelist.GetToken()) != "")
+	while (modulelist.GetToken(item))
 	{
 		if (line.length() + item.length() + 1 > 509)
 		{
@@ -224,7 +365,15 @@ void TreeSocket::SendCapabilities()
 #ifdef SUPPORT_IP6LINKS
 	ip6support = 1;
 #endif
-	this->WriteLine("CAPAB CAPABILITIES :NICKMAX="+ConvToStr(NICKMAX)+" HALFOP="+ConvToStr(this->Instance->Config->AllowHalfop)+" CHANMAX="+ConvToStr(CHANMAX)+" MAXMODES="+ConvToStr(MAXMODES)+" IDENTMAX="+ConvToStr(IDENTMAX)+" MAXQUIT="+ConvToStr(MAXQUIT)+" MAXTOPIC="+ConvToStr(MAXTOPIC)+" MAXKICK="+ConvToStr(MAXKICK)+" MAXGECOS="+ConvToStr(MAXGECOS)+" MAXAWAY="+ConvToStr(MAXAWAY)+" IP6NATIVE="+ConvToStr(ip6)+" IP6SUPPORT="+ConvToStr(ip6support)+" PROTOCOL="+ConvToStr(ProtocolVersion));
+	std::string extra;
+	/* Do we have sha256 available? If so, we send a challenge */
+	if (Utils->ChallengeResponse && (Instance->FindModule("m_sha256.so")))
+	{
+		this->SetOurChallenge(RandString(20));
+		extra = " CHALLENGE=" + this->GetOurChallenge();
+	}
+
+	this->WriteLine("CAPAB CAPABILITIES :NICKMAX="+ConvToStr(NICKMAX)+" HALFOP="+ConvToStr(this->Instance->Config->AllowHalfop)+" CHANMAX="+ConvToStr(CHANMAX)+" MAXMODES="+ConvToStr(MAXMODES)+" IDENTMAX="+ConvToStr(IDENTMAX)+" MAXQUIT="+ConvToStr(MAXQUIT)+" MAXTOPIC="+ConvToStr(MAXTOPIC)+" MAXKICK="+ConvToStr(MAXKICK)+" MAXGECOS="+ConvToStr(MAXGECOS)+" MAXAWAY="+ConvToStr(MAXAWAY)+" IP6NATIVE="+ConvToStr(ip6)+" IP6SUPPORT="+ConvToStr(ip6support)+" PROTOCOL="+ConvToStr(ProtocolVersion)+extra+" PREFIX="+Instance->Modes->BuildPrefixes()+" CHANMODES="+Instance->Modes->ChanModes());
 
 	this->WriteLine("CAPAB END");
 }
@@ -233,8 +382,9 @@ void TreeSocket::SendCapabilities()
 bool TreeSocket::HasItem(const std::string &list, const std::string &item)
 {
 	irc::commasepstream seplist(list);
-	std::string item2 = "*";
-	while ((item2 = seplist.GetToken()) != "")
+	std::string item2;
+
+	while (seplist.GetToken(item2))
 	{
 		if (item2 == item)
 			return true;
@@ -246,9 +396,9 @@ bool TreeSocket::HasItem(const std::string &list, const std::string &item)
 std::string TreeSocket::ListDifference(const std::string &one, const std::string &two)
 {
 	irc::commasepstream list_one(one);
-	std::string item = "*";
-	std::string result = "";
-	while ((item = list_one.GetToken()) != "")
+	std::string item;
+	std::string result;
+	while (list_one.GetToken(item))
 	{
 		if (!HasItem(two, item))
 		{
@@ -259,21 +409,30 @@ std::string TreeSocket::ListDifference(const std::string &one, const std::string
 	return result;
 }
 
+void TreeSocket::SendError(const std::string &errormessage)
+{
+	/* Display the error locally as well as sending it remotely */
+	this->WriteLine("ERROR :"+errormessage);
+	Utils->Creator->RemoteMessage(NULL, "Sent \2ERROR\2 to %s: %s", (this->InboundServerName.empty() ? "<unknown>" : this->InboundServerName.c_str()), errormessage.c_str());
+	/* One last attempt to make sure the error reaches its target */
+	this->FlushWriteBuffer();
+}
+
 bool TreeSocket::Capab(const std::deque<std::string> &params)
 {
 	if (params.size() < 1)
 	{
-		this->WriteLine("ERROR :Invalid number of parameters for CAPAB - Mismatched version");
+		this->SendError("Invalid number of parameters for CAPAB - Mismatched version");
 		return false;
 	}
 	if (params[0] == "START")
 	{
-		this->ModuleList = "";
+		this->ModuleList.clear();
 		this->CapKeys.clear();
 	}
 	else if (params[0] == "END")
 	{
-		std::string reason = "";
+		std::string reason;
 		int ip6support = 0;
 #ifdef SUPPORT_IP6LINKS
 		ip6support = 1;
@@ -297,44 +456,66 @@ bool TreeSocket::Capab(const std::deque<std::string> &params)
 			else
 				reason = "Modules loaded on these servers are not correctly matched, these modules are not loaded on " + diff;
 		}
+
+		cap_validation valid_capab[] = { 
+			{"Maximum nickname lengths differ or remote nickname length not specified", "NICKMAX", NICKMAX},
+			{"Maximum ident lengths differ or remote ident length not specified", "IDENTMAX", IDENTMAX},
+			{"Maximum channel lengths differ or remote channel length not specified", "CHANMAX", CHANMAX},
+			{"Maximum modes per line differ or remote modes per line not specified", "MAXMODES", MAXMODES},
+			{"Maximum quit lengths differ or remote quit length not specified", "MAXQUIT", MAXQUIT},
+			{"Maximum topic lengths differ or remote topic length not specified", "MAXTOPIC", MAXTOPIC},
+			{"Maximum kick lengths differ or remote kick length not specified", "MAXKICK", MAXKICK},
+			{"Maximum GECOS (fullname) lengths differ or remote GECOS length not specified", "MAXGECOS", MAXGECOS},
+			{"Maximum awaymessage lengths differ or remote awaymessage length not specified", "MAXAWAY", MAXAWAY},
+			{"", "", 0}
+		};
+
 		if (((this->CapKeys.find("IP6SUPPORT") == this->CapKeys.end()) && (ip6support)) || ((this->CapKeys.find("IP6SUPPORT") != this->CapKeys.end()) && (this->CapKeys.find("IP6SUPPORT")->second != ConvToStr(ip6support))))
 			reason = "We don't both support linking to IPV6 servers";
 		if (((this->CapKeys.find("IP6NATIVE") != this->CapKeys.end()) && (this->CapKeys.find("IP6NATIVE")->second == "1")) && (!ip6support))
 			reason = "The remote server is IPV6 native, and we don't support linking to IPV6 servers";
-		if (((this->CapKeys.find("NICKMAX") == this->CapKeys.end()) || ((this->CapKeys.find("NICKMAX") != this->CapKeys.end()) && (this->CapKeys.find("NICKMAX")->second != ConvToStr(NICKMAX)))))
-			reason = "Maximum nickname lengths differ or remote nickname length not specified";
 		if (((this->CapKeys.find("PROTOCOL") == this->CapKeys.end()) || ((this->CapKeys.find("PROTOCOL") != this->CapKeys.end()) && (this->CapKeys.find("PROTOCOL")->second != ConvToStr(ProtocolVersion)))))
 		{
 			if (this->CapKeys.find("PROTOCOL") != this->CapKeys.end())
-			{
 				reason = "Mismatched protocol versions "+this->CapKeys.find("PROTOCOL")->second+" and "+ConvToStr(ProtocolVersion);
-			}
 			else
-			{
 				reason = "Protocol version not specified";
-			}
 		}
+
+		if(this->CapKeys.find("PREFIX") != this->CapKeys.end() && this->CapKeys.find("PREFIX")->second != this->Instance->Modes->BuildPrefixes())
+			reason = "One or more of the prefixes on the remote server are invalid on this server.";
+
 		if (((this->CapKeys.find("HALFOP") == this->CapKeys.end()) && (Instance->Config->AllowHalfop)) || ((this->CapKeys.find("HALFOP") != this->CapKeys.end()) && (this->CapKeys.find("HALFOP")->second != ConvToStr(Instance->Config->AllowHalfop))))
 			reason = "We don't both have halfop support enabled/disabled identically";
-		if (((this->CapKeys.find("IDENTMAX") == this->CapKeys.end()) || ((this->CapKeys.find("IDENTMAX") != this->CapKeys.end()) && (this->CapKeys.find("IDENTMAX")->second != ConvToStr(IDENTMAX)))))
-			reason = "Maximum ident lengths differ or remote ident length not specified";
-		if (((this->CapKeys.find("CHANMAX") == this->CapKeys.end()) || ((this->CapKeys.find("CHANMAX") != this->CapKeys.end()) && (this->CapKeys.find("CHANMAX")->second != ConvToStr(CHANMAX)))))
-			reason = "Maximum channel lengths differ or remote channel length not specified";
-		if (((this->CapKeys.find("MAXMODES") == this->CapKeys.end()) || ((this->CapKeys.find("MAXMODES") != this->CapKeys.end()) && (this->CapKeys.find("MAXMODES")->second != ConvToStr(MAXMODES)))))
-			reason = "Maximum modes per line differ or remote modes per line not specified";
-		if (((this->CapKeys.find("MAXQUIT") == this->CapKeys.end()) || ((this->CapKeys.find("MAXQUIT") != this->CapKeys.end()) && (this->CapKeys.find("MAXQUIT")->second != ConvToStr(MAXQUIT)))))
-			reason = "Maximum quit lengths differ or remote quit length not specified";
-		if (((this->CapKeys.find("MAXTOPIC") == this->CapKeys.end()) || ((this->CapKeys.find("MAXTOPIC") != this->CapKeys.end()) && (this->CapKeys.find("MAXTOPIC")->second != ConvToStr(MAXTOPIC)))))
-			reason = "Maximum topic lengths differ or remote topic length not specified";
-		if (((this->CapKeys.find("MAXKICK") == this->CapKeys.end()) || ((this->CapKeys.find("MAXKICK") != this->CapKeys.end()) && (this->CapKeys.find("MAXKICK")->second != ConvToStr(MAXKICK)))))
-			reason = "Maximum kick lengths differ or remote kick length not specified";
-		if (((this->CapKeys.find("MAXGECOS") == this->CapKeys.end()) || ((this->CapKeys.find("MAXGECOS") != this->CapKeys.end()) && (this->CapKeys.find("MAXGECOS")->second != ConvToStr(MAXGECOS)))))
-			reason = "Maximum GECOS (fullname) lengths differ or remote GECOS length not specified";
-		if (((this->CapKeys.find("MAXAWAY") == this->CapKeys.end()) || ((this->CapKeys.find("MAXAWAY") != this->CapKeys.end()) && (this->CapKeys.find("MAXAWAY")->second != ConvToStr(MAXAWAY)))))
-			reason = "Maximum awaymessage lengths differ or remote awaymessage length not specified";
+
+		for (int x = 0; valid_capab[x].size; ++x)
+		{
+			if (((this->CapKeys.find(valid_capab[x].key) == this->CapKeys.end()) ||	((this->CapKeys.find(valid_capab[x].key) != this->CapKeys.end()) &&
+						 (this->CapKeys.find(valid_capab[x].key)->second != ConvToStr(valid_capab[x].size)))))
+				reason = valid_capab[x].reason;
+		}
+	
+		/* Challenge response, store their challenge for our password */
+		std::map<std::string,std::string>::iterator n = this->CapKeys.find("CHALLENGE");
+		if (Utils->ChallengeResponse && (n != this->CapKeys.end()) && (Instance->FindModule("m_sha256.so")))
+		{
+			/* Challenge-response is on now */
+			this->SetTheirChallenge(n->second);
+			if (!this->GetTheirChallenge().empty() && (this->LinkState == CONNECTING))
+			{
+				this->WriteLine(std::string("SERVER ")+this->Instance->Config->ServerName+" "+this->MakePass(OutboundPass, this->GetTheirChallenge())+" 0 :"+this->Instance->Config->ServerDesc);
+			}
+		}
+		else
+		{
+			/* They didnt specify a challenge or we don't have m_sha256.so, we use plaintext */
+			if (this->LinkState == CONNECTING)
+				this->WriteLine(std::string("SERVER ")+this->Instance->Config->ServerName+" "+OutboundPass+" 0 :"+this->Instance->Config->ServerDesc);
+		}
+
 		if (reason.length())
 		{
-			this->WriteLine("ERROR :CAPAB negotiation failed: "+reason);
+			this->SendError("CAPAB negotiation failed: "+reason);
 			return false;
 		}
 	}
@@ -354,8 +535,9 @@ bool TreeSocket::Capab(const std::deque<std::string> &params)
 	else if ((params[0] == "CAPABILITIES") && (params.size() == 2))
 	{
 		irc::tokenstream capabs(params[1]);
-		std::string item = "*";
-		while ((item = capabs.GetToken()) != "")
+		std::string item;
+		bool more = true;
+		while ((more = capabs.GetToken(item)))
 		{
 			/* Process each key/value pair */
 			std::string::size_type equals = item.rfind('=');
@@ -409,11 +591,11 @@ void TreeSocket::Squit(TreeServer* Current, const std::string &reason)
 		Utils->DoOneToAllButSender(Current->GetParent()->GetName(),"SQUIT",params,Current->GetName());
 		if (Current->GetParent() == Utils->TreeRoot)
 		{
-			this->Instance->WriteOpers("Server \002"+Current->GetName()+"\002 split: "+reason);
+			this->Instance->SNO->WriteToSnoMask('l',"Server \002"+Current->GetName()+"\002 split: "+reason);
 		}
 		else
 		{
-			this->Instance->WriteOpers("Server \002"+Current->GetName()+"\002 split from server \002"+Current->GetParent()->GetName()+"\002 with reason: "+reason);
+			this->Instance->SNO->WriteToSnoMask('l',"Server \002"+Current->GetName()+"\002 split from server \002"+Current->GetParent()->GetName()+"\002 with reason: "+reason);
 		}
 		num_lost_servers = 0;
 		num_lost_users = 0;
@@ -422,12 +604,10 @@ void TreeSocket::Squit(TreeServer* Current, const std::string &reason)
 		Current->Tidy();
 		Current->GetParent()->DelChild(Current);
 		DELETE(Current);
-		this->Instance->WriteOpers("Netsplit complete, lost \002%d\002 users on \002%d\002 servers.", num_lost_users, num_lost_servers);
+		this->Instance->SNO->WriteToSnoMask('l',"Netsplit complete, lost \002%d\002 users on \002%d\002 servers.", num_lost_users, num_lost_servers);
 	}
 	else
-	{
 		Instance->Log(DEFAULT,"Squit from unknown server");
-	}
 }
 
 /** FMODE command - server mode with timestamp checks */
@@ -498,283 +678,34 @@ bool TreeSocket::ForceMode(const std::string &source, std::deque<std::string> &p
 			return true;
 	}
 
-	/* TS is equal: Merge the mode changes, use voooodoooooo on modes
-	 * with parameters.
-	 */
-	if (TS == ourTS)
+	if (!TS)
 	{
-		ModeHandler* mh = NULL;
-		unsigned long paramptr = 3;
-		std::string to_bounce = "";
-		std::string to_keep = "";
-		std::vector<std::string> params_to_keep;
-		std::string params_to_bounce = "";
-		bool adding = true;
-		char cur_change = 1;
-		char old_change = 0;
-		char old_bounce_change = 0;
-		/* Merge modes, basically do special stuff to mode with params */
-		for (std::string::iterator x = params[2].begin(); x != params[2].end(); x++)
-		{
-			switch (*x)
-			{
-				case '-':
-					adding = false;
-				break;
-				case '+':
-					adding = true;
-				break;
-				default:
-					if (adding)
-					{
-						/* We only care about whats being set,
-						 * not whats being unset
-						 */
-						mh = this->Instance->Modes->FindMode(*x, chan ? MODETYPE_CHANNEL : MODETYPE_USER);
-						if ((mh) && (mh->GetNumParams(adding) > 0) && (!mh->IsListMode()))
-						{
-							/* We only want to do special things to
-							 * modes with parameters, we are going to rewrite
-							 * those parameters
-							 */
-							ModePair ret;
-							adding ? cur_change = '+' : cur_change = '-';
-							ret = mh->ModeSet(smode ? NULL : who, dst, chan, params[paramptr]);
-							/* The mode is set here, check which we should keep */
-							if (ret.first)
-							{
-								bool which_to_keep = mh->CheckTimeStamp(TS, ourTS, params[paramptr], ret.second, chan);
-								if (which_to_keep == true)
-								{
-									/* Keep ours, bounce theirs:
-									 * Send back ours to them and
-									 * drop their mode changs
-									 */
-									adding ? cur_change = '+' : cur_change = '-';
-									if (cur_change != old_bounce_change)
-										to_bounce += cur_change;
-									to_bounce += *x;
-									old_bounce_change = cur_change;
-									if ((mh->GetNumParams(adding) > 0) && (paramptr < params.size()))
-										params_to_bounce.append(" ").append(ret.second);
-								}
-								else
-								{
-									/* Keep theirs: Accept their mode change,
-									 * do nothing else
-									 */
-									adding ? cur_change = '+' : cur_change = '-';
-									if (cur_change != old_change)
-										to_keep += cur_change;
-									to_keep += *x;
-									old_change = cur_change;
-									if ((mh->GetNumParams(adding) > 0) && (paramptr < params.size()))
-										params_to_keep.push_back(params[paramptr]);
-								}
-							}
-							else
-							{
-								/* Mode isnt set here, we want it */
-								adding ? cur_change = '+' : cur_change = '-';
-								if (cur_change != old_change)
-									to_keep += cur_change;
-								to_keep += *x;
-								old_change = cur_change;
-								if ((mh->GetNumParams(adding) > 0) && (paramptr < params.size()))
-									params_to_keep.push_back(params[paramptr]);
-							}
-							paramptr++;
-						}
-						else
-						{
-							mh = this->Instance->Modes->FindMode(*x, chan ? MODETYPE_CHANNEL : MODETYPE_USER);
-							if (mh)
-							{
-								adding ? cur_change = '+' : cur_change = '-';
-
-								/* Just keep this, safe to merge with no checks
-								 * it has no parameters
-								 */
-
-								if (cur_change != old_change)
-									to_keep += cur_change;
-								to_keep += *x;
-								old_change = cur_change;
-
-								if ((mh->GetNumParams(adding) > 0) && (paramptr < params.size()))
-								{
-									params_to_keep.push_back(params[paramptr++]);
-								}
-							}
-						}
-					}
-					else
-					{
-						mh = this->Instance->Modes->FindMode(*x, chan ? MODETYPE_CHANNEL : MODETYPE_USER);
-						if (mh)
-						{
-							/* Taking a mode away */
-							adding ? cur_change = '+' : cur_change = '-';
-							if (cur_change != old_change)
-								to_keep += cur_change;
-							to_keep += *x;
-							old_change = cur_change;
-							if ((mh->GetNumParams(adding) > 0) && (paramptr < params.size()))
-								params_to_keep.push_back(params[paramptr++]);
-						}
-					}
-				break;
-			}
-		}
-		if (to_bounce.length())
-		{
-			std::deque<std::string> newparams;
-			newparams.push_back(params[0]);
-			newparams.push_back(ConvToStr(ourTS));
-			newparams.push_back(to_bounce+params_to_bounce);
-			Utils->DoOneToOne(this->Instance->Config->ServerName,"FMODE",newparams,sourceserv);
-		}
-		if (to_keep.length())
-		{
-			unsigned int n = 2;
-			unsigned int q = 0;
-			modelist[0] = params[0].c_str();
-			modelist[1] = to_keep.c_str();
-			if (params_to_keep.size() > 0)
-			{
-				for (q = 0; (q < params_to_keep.size()) && (q < 64); q++)
-				{
-					modelist[n++] = params_to_keep[q].c_str();
-				}
-			}
-			if (smode)
-			{
-				this->Instance->SendMode(modelist, n, who);
-			}
-			else
-			{
-				this->Instance->CallCommandHandler("MODE", modelist, n, who);
-			}
-			/* HOT POTATO! PASS IT ON! */
-			Utils->DoOneToAllButSender(source,"FMODE",params,sourceserv);
-		}
+		Instance->Log(DEFAULT,"*** BUG? *** TS of 0 sent to FMODE. Are some services authors smoking craq, or is it 1970 again?. Dropped.");
+		Instance->SNO->WriteToSnoMask('d', "WARNING: The server %s is sending FMODE with a TS of zero. Total craq. Mode was dropped.", sourceserv.c_str());
+		return true;
 	}
-	else
-	/* U-lined servers always win regardless of their TS */
-	if ((TS > ourTS) && (!this->Instance->ULine(source.c_str())))
-	{
-		/* Bounce the mode back to its sender.* We use our lower TS, so the other end
-		 * SHOULD accept it, if its clock is right.
-		 *
-		 * NOTE: We should check that we arent bouncing anything thats already set at this end.
-		 * If we are, bounce +ourmode to 'reinforce' it. This prevents desyncs.
-		 * e.g. They send +l 50, we have +l 10 set. rather than bounce -l 50, we bounce +l 10.
-		 *
-		 * Thanks to jilles for pointing out this one-hell-of-an-issue before i even finished
-		 * writing the code. It took me a while to come up with this solution.
-		 *
-		 * XXX: BE SURE YOU UNDERSTAND THIS CODE FULLY BEFORE YOU MESS WITH IT.
-		 */
-		std::deque<std::string> newparams;      /* New parameter list we send back */
-		newparams.push_back(params[0]);	 /* Target, user or channel */
-		newparams.push_back(ConvToStr(ourTS));  /* Timestamp value of the target */
-		newparams.push_back("");		/* This contains the mode string. For now
-							 * it's empty, we fill it below.
-							 */
-		/* Intelligent mode bouncing. Don't just invert, reinforce any modes which are already
-		 * set to avoid a desync here.
-		 */
-		std::string modebounce = "";
-		bool adding = true;
-		unsigned int t = 3;
-		ModeHandler* mh = NULL;
-		char cur_change = 1;
-		char old_change = 0;
-		for (std::string::iterator x = params[2].begin(); x != params[2].end(); x++)
-		{
-			/* Iterate over all mode chars in the sent set */
-			switch (*x)
-			{
-				/* Adding or subtracting modes? */
-				case '-':
-					adding = false;
-				break;
-				case '+':
-					adding = true;
-				break;
-				default:
-					/* Find the mode handler for this mode */
-					mh = this->Instance->Modes->FindMode(*x, chan ? MODETYPE_CHANNEL : MODETYPE_USER);
-					/* Got a mode handler?
-					 * This also prevents us bouncing modes we have no handler for.
-					 */
-					if (mh)
-					{
-						ModePair ret;
-						std::string p = "";
-						/* Does the mode require a parameter right now?
-						 * If it does, fetch it if we can
-						 */
-						if ((mh->GetNumParams(adding) > 0) && (t < params.size()))
-							p = params[t++];
-						/* Call the ModeSet method to determine if its set with the
-						 * given parameter here or not.
-						 */
-						ret = mh->ModeSet(smode ? NULL : who, dst, chan, p);
-						/* XXX: Really. Dont ask.
-						 * Determine from if its set combined with what the current
-						 * 'state' is (adding or not) as to wether we should 'invert'
-						 * or 'reinforce' the mode change
-						 */
-						(!ret.first ? (adding ? cur_change = '-' : cur_change = '+') : (!adding ? cur_change = '-' : cur_change = '+'));
-						/* Quickly determine if we have 'flipped' from + to -,
-						 * or - to +, to prevent unneccessary +/- chars in the
-						 * output string that waste bandwidth
-						 */
-						if (cur_change != old_change)
-							modebounce += cur_change;
-						old_change = cur_change;
-						/* Add the mode character to the output string */
-						modebounce += mh->GetModeChar();
-						/* We got a parameter back from ModeHandler::ModeSet,
-						 * are we supposed to be sending one out right now?
-						 */
-						if (ret.second.length())
-						{
-							if (mh->GetNumParams(cur_change == '+') > 0)
-								/* Yes we're supposed to be sending out
-								 * the parameter. Make sure it goes
-								 */
-								newparams.push_back(ret.second);
-						}
-					}
-				break;
-			}
-		}
 
-		/* Update the parameters for FMODE with the new 'bounced' string */
-		newparams[2] = modebounce;
-		/* Only send it back the way it came, no need to send it anywhere else */
-		Utils->DoOneToOne(this->Instance->Config->ServerName,"FMODE",newparams,sourceserv);
-	}
-	else
+	/* TS is equal or less: Merge the mode changes into ours and pass on.
+	 */
+	if (TS <= ourTS)
 	{
-		/* The server was ulined, but something iffy is up with the TS.
-		 * Sound the alarm bells!
-		 */
-		if ((this->Instance->ULine(sourceserv.c_str())) && (TS > ourTS))
+		if ((TS < ourTS) && (!dst))
+			Instance->Log(DEFAULT,"*** BUG *** Channel TS sent in FMODE to %s is %lu which is not equal to %lu!", params[0].c_str(), TS, ourTS);
+
+		if (smode)
 		{
-			this->Instance->WriteOpers("\2WARNING!\2 U-Lined server '%s' has bad TS for '%s' (accepted change): \2SYNC YOUR CLOCKS\2 to avoid this notice",sourceserv.c_str(),params[0].c_str());
+			this->Instance->SendMode(modelist, n, who);
 		}
-		/* Allow the mode, route it to either server or user command handling */
-		if (smode)
-			this->Instance->SendMode(modelist,n,who);
 		else
+		{
 			this->Instance->CallCommandHandler("MODE", modelist, n, who);
+		}
 		/* HOT POTATO! PASS IT ON! */
 		Utils->DoOneToAllButSender(source,"FMODE",params,sourceserv);
 	}
-	/* Are we supposed to free the userrec? */
+	/* If the TS is greater than ours, we drop the mode and dont pass it anywhere.
+	 */
+
 	if (smode)
 		DELETE(who);
 
@@ -795,7 +726,7 @@ bool TreeSocket::ForceTopic(const std::string &source, std::deque<std::string> &
 		{
 			std::string oldtopic = c->topic;
 			strlcpy(c->topic,params[3].c_str(),MAXTOPIC);
-			strlcpy(c->setby,params[2].c_str(),NICKMAX-1);
+			strlcpy(c->setby,params[2].c_str(),127);
 			c->topicset = ts;
 			/* if the topic text is the same as the current topic,
 			 * dont bother to send the TOPIC command out, just silently
@@ -806,7 +737,7 @@ bool TreeSocket::ForceTopic(const std::string &source, std::deque<std::string> &
 				userrec* user = this->Instance->FindNick(source);
 				if (!user)
 				{
-					c->WriteChannelWithServ(source.c_str(), "TOPIC %s :%s", c->name, c->topic);
+					c->WriteChannelWithServ(Instance->Config->ServerName, "TOPIC %s :%s", c->name, c->topic);
 				}
 				else
 				{
@@ -841,22 +772,12 @@ bool TreeSocket::ForceJoin(const std::string &source, std::deque<std::string> &p
 	 * and users, as in InspIRCd 1.0 and ircd2.8. The channels have not been
 	 * re-created during a split, this is safe to do.
 	 *
-	 *
-	 * If the timestamps are NOT equal, the losing side removes all privilage
-	 * modes from all of its users that currently exist in the channel, before
-	 * introducing new users into the channel which are listed in the FJOIN
-	 * command's parameters. This means, all modes +ohv, and privilages added
-	 * by modules, such as +qa. The losing side then LOWERS its timestamp value
-	 * of the channel to match that of the winning side, and the modes of the
-	 * users of the winning side are merged in with the losing side. The loser
-	 * then sends out a set of FMODE commands which 'confirm' that it just
-	 * removed all privilage modes from its existing users, which allows for
-	 * services packages to still work correctly without needing to know the
-	 * timestamping rules which InspIRCd follows. In TS6 servers this is always
-	 * a problem, and services packages must contain code which explicitly
-	 * behaves as TS6 does, removing ops from the losing side of a split where
-	 * neccessary within its internal records, as this state information is
-	 * not explicitly echoed out in that protocol.
+	 * If the timestamps are NOT equal, the losing side removes all of its
+	 * modes from the channel, before introducing new users into the channel
+	 * which are listed in the FJOIN command's parameters. The losing side then
+	 * LOWERS its timestamp value of the channel to match that of the winning
+	 * side, and the modes of the users of the winning side are merged in with
+	 * the losing side.
 	 *
 	 * The winning side on the other hand will ignore all user modes from the
 	 * losing side, so only its own modes get applied. Life is simple for those
@@ -873,304 +794,296 @@ bool TreeSocket::ForceJoin(const std::string &source, std::deque<std::string> &p
 	if (params.size() < 3)
 		return true;
 
-	char first[MAXBUF];	     /* The first parameter of the mode command */
-	char modestring[MAXBUF];	/* The mode sequence (2nd parameter) of the mode command */
-	char* mode_users[127];	  /* The values used by the mode command */
-	memset(&mode_users,0,sizeof(mode_users));       /* Initialize mode parameters */
-	mode_users[0] = first;	  /* Set this up to be our on-stack value */
-	mode_users[1] = modestring;     /* Same here as above */
-	strcpy(modestring,"+");	 /* Initialize the mode sequence to just '+' */
-	unsigned int modectr = 2;       /* Pointer to the third mode parameter (e.g. the one after the +-sequence) */
+	irc::modestacker modestack(true);				/* Modes to apply from the users in the user list */
+	userrec* who = NULL;		   				/* User we are currently checking */
+	std::string channel = params[0];				/* Channel name, as a string */
+	time_t TS = atoi(params[1].c_str());    			/* Timestamp given to us for remote side */
+	irc::tokenstream users(params[2]);				/* Users from the user list */
+	bool apply_other_sides_modes = true;				/* True if we are accepting the other side's modes */
+	chanrec* chan = this->Instance->FindChan(channel);		/* The channel we're sending joins to */
+	time_t ourTS = chan ? chan->age : Instance->Time(true)+600;	/* The TS of our side of the link */
+	bool created = !chan;						/* True if the channel doesnt exist here yet */
+	std::string item;						/* One item in the list of nicks */
 
-	userrec* who = NULL;		    /* User we are currently checking */
-	std::string channel = params[0];	/* Channel name, as a string */
-	time_t TS = atoi(params[1].c_str());    /* Timestamp given to us for remote side */
-	bool created = false;
+	params[2] = ":" + params[2];
+	Utils->DoOneToAllButSender(source,"FJOIN",params,source);
 
-	/* Try and find the channel */
-	chanrec* chan = this->Instance->FindChan(channel);
+        if (!TS)
+	{
+		Instance->Log(DEFAULT,"*** BUG? *** TS of 0 sent to FJOIN. Are some services authors smoking craq, or is it 1970 again?. Dropped.");
+		Instance->SNO->WriteToSnoMask('d', "WARNING: The server %s is sending FJOIN with a TS of zero. Total craq. Command was dropped.", source.c_str());
+		return true;
+	}
 
-	/* Initialize channel name in the mode parameters */
-	strlcpy(mode_users[0],channel.c_str(),MAXBUF);
+	/* If our TS is less than theirs, we dont accept their modes */
+	if (ourTS < TS)
+		apply_other_sides_modes = false;
 
-	/* default TS is a high value, which if we dont have this
-	 * channel will let the other side apply their modes.
-	 */
-	time_t ourTS = Instance->Time(true)+600;
-	/* Does this channel exist? if it does, get its REAL timestamp */
-	if (chan)
-		ourTS = chan->age;
-	else
-		created = true; /* don't perform deops, and set TS to correct time after processing. */
-	/* In 1.1, if they have the newer channel, we immediately clear
-	 * all status modes from our users. We then accept their modes.
-	 * If WE have the newer channel its the other side's job to do this.
-	 * Note that this causes the losing server to send out confirming
-	 * FMODE lines.
-	 */
+	/* Our TS greater than theirs, clear all our modes from the channel, accept theirs. */
 	if (ourTS > TS)
 	{
 		std::deque<std::string> param_list;
-		/* Lower the TS here */
 		if (Utils->AnnounceTSChange && chan)
-			chan->WriteChannelWithServ(Instance->Config->ServerName,
-			"NOTICE %s :TS for %s changed from %lu to %lu", chan->name, chan->name, ourTS, TS);
+			chan->WriteChannelWithServ(Instance->Config->ServerName, "NOTICE %s :TS for %s changed from %lu to %lu", chan->name, chan->name, ourTS, TS);
 		ourTS = TS;
-		/* Zap all the privilage modes on our side, if the channel exists here */
 		if (!created)
 		{
-			param_list.push_back(channel);
-			/* Do this first! */
 			chan->age = TS;
+			param_list.push_back(channel);
 			this->RemoveStatus(Instance->Config->ServerName, param_list);
 		}
 	}
-	/* Put the final parameter of the FJOIN into a tokenstream ready to split it */
-	irc::tokenstream users(params[2]);
-	std::string item = "*";
-	/* do this first, so our mode reversals are correctly received by other servers
-	 * if there is a TS collision.
-	 */
-	params[2] = ":" + params[2];
-	Utils->DoOneToAllButSender(source,"FJOIN",params,source);
+
 	/* Now, process every 'prefixes,nick' pair */
-	while (item != "")
+	while (users.GetToken(item))
 	{
-		/* Find next user */
-		item = users.GetToken();
 		const char* usr = item.c_str();
-		/* Safety check just to make sure someones not sent us an FJOIN full of spaces
-		 * (is this even possible?) */
 		if (usr && *usr)
 		{
 			const char* permissions = usr;
-			int ntimes = 0;
-			char* nm = new char[MAXBUF];
-			char* tnm = nm;
-			/* Iterate through all the prefix values, convert them from prefixes
-			 * to mode letters, and append them to the mode sequence
-			 */
-			while ((*permissions) && (*permissions != ',') && (ntimes < MAXBUF))
+			/* Iterate through all the prefix values, convert them from prefixes to mode letters */
+			std::string modes;
+			while ((*permissions) && (*permissions != ','))
 			{
 				ModeHandler* mh = Instance->Modes->FindPrefix(*permissions);
 				if (mh)
-				{
-					/* This is a valid prefix */
-					ntimes++;
-					*tnm++ = mh->GetModeChar();
-				}
+					modes = modes + mh->GetModeChar();
 				else
 				{
-					/* Not a valid prefix...
-					 * danger bill bobbertson! (that's will robinsons older brother ;-) ...)
-					 */
-					this->Instance->WriteOpers("ERROR: We received a user with an unknown prefix '%c'. Closed connection to avoid a desync.",*permissions);
-					this->WriteLine(std::string("ERROR :Invalid prefix '")+(*permissions)+"' in FJOIN");
+					this->SendError(std::string("Invalid prefix '")+(*permissions)+"' in FJOIN");
 					return false;
 				}
 				usr++;
 				permissions++;
 			}
-			/* Null terminate modes */
-			*tnm = 0;
 			/* Advance past the comma, to the nick */
 			usr++;
+			
 			/* Check the user actually exists */
-			who = this->Instance->FindNick(usr);
+			who = this->Instance->FindUUID(usr);
 			if (who)
 			{
-				/* Did they get any modes? How many times? */
-				strlcat(modestring, nm, MAXBUF);
-				for (int k = 0; k < ntimes; k++)
-					mode_users[modectr++] = strdup(usr);
-				/* Free temporary buffer used for mode sequence */
-				delete[] nm;
-				/* Check that the user's 'direction' is correct
-				 * based on the server sending the FJOIN. We must
-				 * check each nickname in turn, because the origin of
-				 * the FJOIN may be different to the origin of the nicks
-				 * in the command itself.
-				 */
+				/* Check that the user's 'direction' is correct */
 				TreeServer* route_back_again = Utils->BestRouteTo(who->server);
 				if ((!route_back_again) || (route_back_again->GetSocket() != this))
-				{
-					/* Oh dear oh dear. */
 					continue;
-				}
-				/* Finally, we can actually place the user into the channel.
-				 * We're sure its right. Final answer, phone a friend.
-				 */
-				chanrec::JoinUser(this->Instance, who, channel.c_str(), true, "");
-				/* Have we already queued up MAXMODES modes with parameters
-				 * (+qaohv) ready to be sent to the server?
-				 */
-				if (modectr >= (MAXMODES-1))
-				{
-					/* Only actually give the users any status if we lost
-					 * the FJOIN or drew (equal timestamps).
-					 * It isn't actually possible for ourTS to be > TS here,
-					 * only possible to actually have ourTS == TS, or
-					 * ourTS < TS, because if we lost, we already lowered
-					 * our TS above before we entered this loop. We only
-					 * check >= as a safety measure, in case someone stuffed
-					 * up. If someone DID stuff up, it was most likely me.
-					 * Note: I do not like baseball bats in the face...
-					 */
-					if (ourTS >= TS)
-					{
-						this->Instance->SendMode((const char**)mode_users,modectr,who);
-
-						/* Something stuffed up, and for some reason, the timestamp is
-						 * NOT lowered right now and should be. Lower it. Usually this
-						 * code won't be executed, doubtless someone will remove it some
-						 * day soon.
-						 */
-						if (ourTS > TS)
-						{
-							Instance->Log(DEFAULT,"Channel TS for %s changed from %lu to %lu",chan->name,ourTS,TS);
-							chan->age = TS;
-							ourTS = TS;
-						}
-					}
-
-					/* Reset all this back to defaults, and
-					 * free any ram we have left allocated.
-					 */
-					strcpy(mode_users[1],"+");
-					for (unsigned int f = 2; f < modectr; f++)
-						free(mode_users[f]);
-					modectr = 2;
-				}
+
+				/* Add any permissions this user had to the mode stack */
+				for (std::string::iterator x = modes.begin(); x != modes.end(); ++x)
+					modestack.Push(*x, who->nick);
+
+				chanrec::JoinUser(this->Instance, who, channel.c_str(), true, "", TS);
 			}
 			else
 			{
-				/* Remember to free this */
-				delete[] nm;
-				/* If we got here, there's a nick in FJOIN which doesnt exist on this server.
-				 * We don't try to process the nickname here (that WOULD cause a segfault because
-				 * we'd be playing with null pointers) however, we DO pass the nickname on, just
-				 * in case somehow we're desynched, so that other users which might be able to see
-				 * the nickname get their fair chance to process it.
-				 */
-				Instance->Log(SPARSE,"Warning! Invalid user in FJOIN to channel %s IGNORED", channel.c_str());
+				Instance->Log(SPARSE,"Warning! Invalid user %s in FJOIN to channel %s IGNORED", usr, channel.c_str());
 				continue;
 			}
 		}
 	}
 
-	/* there werent enough modes built up to flush it during FJOIN,
-	 * or, there are a number left over. flush them out.
-	 */
-	if ((modectr > 2) && (who) && (chan))
+	/* Flush mode stacker if we lost the FJOIN or had equal TS */
+	if (apply_other_sides_modes)
 	{
-		if (ourTS >= TS)
+		std::deque<std::string> stackresult;
+		const char* mode_junk[MAXMODES+2];
+		userrec* n = new userrec(Instance);
+		n->SetFd(FD_MAGIC_NUMBER);
+		mode_junk[0] = channel.c_str();
+
+		while (modestack.GetStackedLine(stackresult))
 		{
-			/* Our channel is newer than theirs. Evil deeds must be afoot. */
-			this->Instance->SendMode((const char**)mode_users,modectr,who);
-			/* Yet again, we can't actually get a true value here, if everything else
-			 * is working as it should.
-			 */
-			if (ourTS > TS)
+			for (size_t j = 0; j < stackresult.size(); j++)
 			{
-				Instance->Log(DEFAULT,"Channel TS for %s changed from %lu to %lu",chan->name,ourTS,TS);
-				chan->age = TS;
-				ourTS = TS;
+				mode_junk[j+1] = stackresult[j].c_str();
 			}
+			Instance->SendMode(mode_junk, stackresult.size() + 1, n);
 		}
 
-		/* Free anything we have left to free */
-		for (unsigned int f = 2; f < modectr; f++)
-			free(mode_users[f]);
+		delete n;
 	}
-	/* if we newly created the channel, set it's TS properly. */
-	if (created)
-	{
-		/* find created channel .. */
-		chan = this->Instance->FindChan(channel);
-		if (chan)
-			/* w00t said this shouldnt be needed but it is.
-			 * This isnt strictly true, as chan can be NULL
-			 * if a nick collision has occured and therefore
-			 * the channel was never created.
-			 */
-			chan->age = TS;
-	}
-	/* All done. That wasnt so bad was it, you can wipe
-	 * the sweat from your forehead now. :-)
-	 */
+
 	return true;
 }
 
-/** NICK command */
-bool TreeSocket::IntroduceClient(const std::string &source, std::deque<std::string> &params)
+bool TreeSocket::ParseUID(const std::string &source, std::deque<std::string> &params)
 {
-	if (params.size() < 8)
+	/** Do we have enough parameters:
+	 * UID uuid age nick host dhost ident +modestr ip.string :gecos
+	 */
+	if (params.size() != 9)
+	{
+		this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" KILL "+params[0]+" :Invalid client introduction ("+params[0]+"?)");
 		return true;
-	if (params.size() > 8)
+	}
+
+	time_t age = ConvToInt(params[1]);
+	const char* tempnick = params[2].c_str();
+	std::string empty;
+
+	/* XXX probably validate UID length too -- w00t */
+	cmd_validation valid[] = { {"Nickname", 2, NICKMAX}, {"Hostname", 3, 64}, {"Displayed hostname", 4, 64}, {"Ident", 5, IDENTMAX}, {"GECOS", 7, MAXGECOS}, {"", 0, 0} };
+
+	TreeServer* remoteserver = Utils->FindServer(source);
+
+	if (!remoteserver)
 	{
-		this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" KILL "+params[1]+" :Invalid client introduction ("+params[1]+"?)");
+		this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" KILL "+params[0]+" :Invalid client introduction (Unknown server "+source+")");
 		return true;
 	}
-	// NICK age nick host dhost ident +modes ip :gecos
-	//       0    1   2     3     4      5   6     7
-	time_t age = atoi(params[0].c_str());
 
-	const char* tempnick = params[1].c_str();
-	Instance->Log(DEBUG,"New remote client %s",tempnick);
+	userrec *u = this->Instance->FindUUID(params[0]);
 
+	if (u)
+	{
+		/* barf! */
+		userrec::QuitUser(this->Instance, u, "UID collision (?!)");
+		this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" KILL "+params[0]+" :Invalid client introduction (UID collision (?!))");
+		return true;
+	}
+
+	/* Check parameters for validity before introducing the client, discovered by dmb */
+	if (!age)
+	{
+		this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" KILL "+params[0]+" :Invalid client introduction (Invalid TS?)");
+		return true;
+	}
+
+	for (size_t x = 0; valid[x].length; ++x)
+	{
+		if (params[valid[x].param].length() > valid[x].length)
+		{
+			this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" KILL "+params[0]+" :Invalid client introduction (" + valid[x].item + " > " + ConvToStr(valid[x].length) + ")");
+			return true;
+		}
+	}
+
+
+	/* check for collision */
 	user_hash::iterator iter = this->Instance->clientlist->find(tempnick);
 
 	if (iter != this->Instance->clientlist->end())
 	{
-		// nick collision
-		this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" KILL "+tempnick+" :Nickname collision");
-		userrec::QuitUser(this->Instance, iter->second, "Nickname collision");
-		return true;
+		/*
+		 * Nick collision.
+		 *  Under old protocol rules, we would have had to kill both clients.
+		 *  Really, this sucks.
+		 * These days, we have UID. And, so what we do is, force nick change client(s)
+		 * involved according to timestamp rules.
+		 *
+		 * RULES:
+		 *  user@ip equal:
+		 *   Force nick change on OLDER timestamped client
+		 *  user@ip differ:
+		 *   Force nick change on NEWER timestamped client
+		 *  TS EQUAL:
+		 *   FNC both.
+		 *
+		 * Note that remote clients MUST be dealt with also to remove desyncs.
+		 *  XXX we don't do this yet.
+		 *
+		 * This stops abusive use of collisions, simplifies problems with loops, and so on.
+		 *   -- w00t
+		 */
+		Instance->Log(DEBUG,"*** Collision on %s", tempnick);
+
+		if (age == iter->second->signon)
+		{
+			/* TS equal, do both */
+			Instance->Log(DEBUG,"*** TS EQUAL, colliding both");
+			iter->second->ForceNickChange(iter->second->uuid);
+			this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" SVSNICK "+params[0]+" " + params[0]);
+			/* also, don't trample on the hash - use their UID as nick */
+			tempnick = params[0].c_str();
+		}
+		else
+		{
+			/* default to FNC newer (more likely that ident@ip will differ) */
+			bool bFNCNewer = true;
+
+			if (
+				strcmp(iter->second->ident, params[5].c_str()) == 0 &&
+				strcmp(iter->second->GetIPString(), params[7].c_str()) == 0
+			   )
+			{
+				/* ident@ip same, FNC older client */
+				bFNCNewer = false;
+			}
+
+			if (age > iter->second->signon) /* It will never be equal here */
+			{
+				if (bFNCNewer)
+				{
+					/* incoming client "lost" - for now, send SVSNICK to them .. XXX use SAVE*/
+					this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" SVSNICK "+params[0]+" " + params[0]);
+
+					/* also, don't trample on the hash - use their UID as nick */
+					tempnick = params[0].c_str();
+					Instance->Log(DEBUG,"*** INCOMING client lost, changed theirs");
+				}
+				else
+				{
+					/* we "lost", change us */
+					iter->second->ForceNickChange(iter->second->uuid);
+					Instance->Log(DEBUG,"*** OUR client lost, changing ours");
+				}
+			}
+		}
 	}
 
-	userrec* _new = new userrec(this->Instance);
+	/* IMPORTANT NOTE: For remote users, we pass the UUID in the constructor. This automatically
+	 * sets it up in the UUID hash for us.
+	 * TODO: Make this throw an exception maybe, on UUID collision?
+	 */
+	userrec* _new = new userrec(this->Instance, params[0]);
 	(*(this->Instance->clientlist))[tempnick] = _new;
 	_new->SetFd(FD_MAGIC_NUMBER);
-	strlcpy(_new->nick, tempnick,NICKMAX-1);
-	strlcpy(_new->host, params[2].c_str(),63);
-	strlcpy(_new->dhost, params[3].c_str(),63);
+	strlcpy(_new->nick, tempnick, NICKMAX - 1);
+	strlcpy(_new->host, params[3].c_str(),64);
+	strlcpy(_new->dhost, params[4].c_str(),64);
 	_new->server = this->Instance->FindServerNamePtr(source.c_str());
-	strlcpy(_new->ident, params[4].c_str(),IDENTMAX);
-	strlcpy(_new->fullname, params[7].c_str(),MAXGECOS);
+	strlcpy(_new->ident, params[5].c_str(),IDENTMAX);
+	strlcpy(_new->fullname, params[8].c_str(),MAXGECOS);
 	_new->registered = REG_ALL;
 	_new->signon = age;
 
-	/*
-	 * we need to remove the + from the modestring, so we can do our stuff
-	 */
-	std::string::size_type pos_after_plus = params[5].find_first_not_of('+');
+	/* we need to remove the + from the modestring, so we can do our stuff */
+	std::string::size_type pos_after_plus = params[6].find_first_not_of('+');
 	if (pos_after_plus != std::string::npos)
-	params[5] = params[5].substr(pos_after_plus);
+	params[6] = params[6].substr(pos_after_plus);
 
-	for (std::string::iterator v = params[5].begin(); v != params[5].end(); v++)
+	for (std::string::iterator v = params[6].begin(); v != params[6].end(); v++)
 	{
-		_new->modes[(*v)-65] = 1;
 		/* For each mode thats set, increase counter */
 		ModeHandler* mh = Instance->Modes->FindMode(*v, MODETYPE_USER);
+
 		if (mh)
+		{
+			mh->OnModeChange(_new, _new, NULL, empty, true);
+			_new->SetMode(*v, true);
 			mh->ChangeCount(1);
+		}
 	}
 
 	/* now we've done with modes processing, put the + back for remote servers */
-	params[5] = "+" + params[5];
+	params[6] = "+" + params[6];
 
 #ifdef SUPPORT_IP6LINKS
-	if (params[6].find_first_of(":") != std::string::npos)
-		_new->SetSockAddr(AF_INET6, params[6].c_str(), 0);
+	if (params[7].find_first_of(":") != std::string::npos)
+		_new->SetSockAddr(AF_INET6, params[7].c_str(), 0);
 	else
 #endif
-		_new->SetSockAddr(AF_INET, params[6].c_str(), 0);
+		_new->SetSockAddr(AF_INET, params[7].c_str(), 0);
 
 	Instance->AddGlobalClone(_new);
-	this->Instance->SNO->WriteToSnoMask('C',"Client connecting at %s: %s!%s@%s [%s]",_new->server,_new->nick,_new->ident,_new->host, _new->GetIPString());
 
-	params[7] = ":" + params[7];
-	Utils->DoOneToAllButSender(source,"NICK", params, source);
+	bool dosend = !(((this->Utils->quiet_bursts) && (this->bursting || Utils->FindRemoteBurstServer(remoteserver))) || (this->Instance->SilentULine(_new->server)));
+	
+	if (dosend)
+		this->Instance->SNO->WriteToSnoMask('C',"Client connecting at %s: %s!%s@%s [%s] [%s]",_new->server,_new->nick,_new->ident,_new->host, _new->GetIPString(), _new->fullname);
+
+	params[8] = ":" + params[8];
+	Utils->DoOneToAllButSender(source, "UID", params, source);
 
 	// Increment the Source Servers User Count..
 	TreeServer* SourceServer = Utils->FindServer(source);
@@ -1200,13 +1113,13 @@ void TreeSocket::SendFJoins(TreeServer* Current, chanrec* c)
 	char* ptr = list + dlen;
 
 	CUList *ulist = c->GetUsers();
-	std::string modes = "";
-	std::string params = "";
+	std::string modes;
+	std::string params;
 
 	for (CUList::iterator i = ulist->begin(); i != ulist->end(); i++)
 	{
 		// The first parameter gets a : before it
-		size_t ptrlen = snprintf(ptr, MAXBUF, " %s%s,%s", !numusers ? ":" : "", c->GetAllPrefixChars(i->second), i->second->nick);
+		size_t ptrlen = snprintf(ptr, MAXBUF, " %s%s,%s", !numusers ? ":" : "", c->GetAllPrefixChars(i->first), i->first->uuid);
 
 		curlen += ptrlen;
 		ptr += ptrlen;
@@ -1226,42 +1139,32 @@ void TreeSocket::SendFJoins(TreeServer* Current, chanrec* c)
 	if (numusers)
 		buffer.append(list).append("\r\n");
 
-	/* Sorry for the hax. Because newly created channels assume +nt,
-	 * if this channel doesnt have +nt, explicitly send -n and -t for the missing modes.
-	 */
-	bool inverted = false;
-	if (!c->IsModeSet('n'))
-	{
-		modes.append("-n");
-		inverted = true;
-	}
-	if (!c->IsModeSet('t'))
-	{
-		modes.append("-t");
-		inverted = true;
-	}
-	if (inverted)
-	{
-		modes.append("+");
-	}
+	buffer.append(":").append(this->Instance->Config->ServerName).append(" FMODE ").append(c->name).append(" ").append(ConvToStr(c->age)).append(" +").append(c->ChanModes(true)).append("\r\n");
 
+	int linesize = 1;
 	for (BanList::iterator b = c->bans.begin(); b != c->bans.end(); b++)
 	{
-		modes.append("b");
-		params.append(" ").append(b->data);
-		if (params.length() >= MAXMODES)
+		int size = strlen(b->data) + 2;
+		int currsize = linesize + size;
+		if (currsize <= 350)
+		{
+			modes.append("b");
+			params.append(" ").append(b->data);
+			linesize += size; 
+		}
+		if ((params.length() >= MAXMODES) || (currsize > 350))
 		{
 			/* Wrap at MAXMODES */
 			buffer.append(":").append(this->Instance->Config->ServerName).append(" FMODE ").append(c->name).append(" ").append(ConvToStr(c->age)).append(" +").append(modes).append(params).append("\r\n");
-			modes = "";
-			params = "";
+			modes.clear();
+			params.clear();
+			linesize = 1;
 		}
 	}
-	buffer.append(":").append(this->Instance->Config->ServerName).append(" FMODE ").append(c->name).append(" ").append(ConvToStr(c->age)).append(" +").append(c->ChanModes(true));
 
 	/* Only send these if there are any */
 	if (!modes.empty())
-		buffer.append("\r\n").append(":").append(this->Instance->Config->ServerName).append(" FMODE ").append(c->name).append(" ").append(ConvToStr(c->age)).append(" +").append(modes).append(params);
+		buffer.append(":").append(this->Instance->Config->ServerName).append(" FMODE ").append(c->name).append(" ").append(ConvToStr(c->age)).append(" +").append(modes).append(params);
 
 	this->WriteLine(buffer);
 }
@@ -1326,6 +1229,7 @@ void TreeSocket::SendChannelModes(TreeServer* Current)
 	std::deque<std::string> list;
 	std::string n = this->Instance->Config->ServerName;
 	const char* sn = n.c_str();
+	Instance->Log(DEBUG,"Sending channels and modes, %d to send", this->Instance->chanlist->size());
 	for (chan_hash::iterator c = this->Instance->chanlist->begin(); c != this->Instance->chanlist->end(); c++)
 	{
 		SendFJoins(Current, c->second);
@@ -1354,26 +1258,29 @@ void TreeSocket::SendUsers(TreeServer* Current)
 	{
 		if (u->second->registered == REG_ALL)
 		{
-			snprintf(data,MAXBUF,":%s NICK %lu %s %s %s %s +%s %s :%s",u->second->server,(unsigned long)u->second->age,u->second->nick,u->second->host,u->second->dhost,u->second->ident,u->second->FormatModes(),u->second->GetIPString(),u->second->fullname);
+			snprintf(data,MAXBUF,":%s UID %s %lu %s %s %s %s +%s %s :%s", u->second->server, u->second->uuid, (unsigned long)u->second->age,u->second->nick,u->second->host,u->second->dhost,u->second->ident,u->second->FormatModes(),u->second->GetIPString(),u->second->fullname);
 			this->WriteLine(data);
 			if (*u->second->oper)
 			{
-				snprintf(data,MAXBUF,":%s OPERTYPE %s", u->second->nick, u->second->oper);
+				snprintf(data,MAXBUF,":%s OPERTYPE %s", u->second->uuid, u->second->oper);
 				this->WriteLine(data);
 			}
 			if (*u->second->awaymsg)
 			{
-				snprintf(data,MAXBUF,":%s AWAY :%s", u->second->nick, u->second->awaymsg);
+				snprintf(data,MAXBUF,":%s AWAY :%s", u->second->uuid, u->second->awaymsg);
 				this->WriteLine(data);
 			}
-			FOREACH_MOD_I(this->Instance,I_OnSyncUser,OnSyncUser(u->second,(Module*)Utils->Creator,(void*)this));
-			list.clear();
-			u->second->GetExtList(list);
+		}
+	}
 
-			for (unsigned int j = 0; j < list.size(); j++)
-			{
-				FOREACH_MOD_I(this->Instance,I_OnSyncUserMetaData,OnSyncUserMetaData(u->second,(Module*)Utils->Creator,(void*)this,list[j]));
-			}
+	for (user_hash::iterator u = this->Instance->clientlist->begin(); u != this->Instance->clientlist->end(); u++)
+	{
+		FOREACH_MOD_I(this->Instance,I_OnSyncUser,OnSyncUser(u->second,(Module*)Utils->Creator,(void*)this));
+		list.clear();
+		u->second->GetExtList(list);
+		for (unsigned int j = 0; j < list.size(); j++)
+		{
+			FOREACH_MOD_I(this->Instance,I_OnSyncUserMetaData,OnSyncUserMetaData(u->second,(Module*)Utils->Creator,(void*)this,list[j]));
 		}
 	}
 }
@@ -1385,11 +1292,10 @@ void TreeSocket::SendUsers(TreeServer* Current)
  */
 void TreeSocket::DoBurst(TreeServer* s)
 {
+	std::string name = s->GetName();
 	std::string burst = "BURST "+ConvToStr(Instance->Time(true));
 	std::string endburst = "ENDBURST";
-	// Because by the end of the netburst, it  could be gone!
-	std::string name = s->GetName();
-	this->Instance->SNO->WriteToSnoMask('l',"Bursting to \2"+name+"\2.");
+	this->Instance->SNO->WriteToSnoMask('l',"Bursting to \2%s\2 (Authentication: %s).", name.c_str(), this->GetTheirChallenge().empty() ? "plaintext password" : "SHA256-HMAC challenge-response");
 	this->WriteLine(burst);
 	/* send our version string */
 	this->WriteLine(std::string(":")+this->Instance->Config->ServerName+" VERSION :"+this->Instance->GetVersionString());