Create IOHook interface (extracted from Module)

12 files changed, 798 insertions, 722 deletions

diff --git a/include/inspsocket.h b/include/inspsocket.h
index ccc2301ed..720489b77 100644
--- a/include/inspsocket.h
+++ b/include/inspsocket.h
@@ -25,6 +25,8 @@
 
 #include "timer.h"
 
+class IOHook;
+
 /**
  * States which a socket may be in
  */
@@ -101,8 +103,9 @@ class CoreExport SocketTimeout : public Timer
  */
 class CoreExport StreamSocket : public EventHandler
 {
-	/** Module that handles raw I/O for this socket, or NULL */
-	reference<Module> IOHook;
+	/** The IOHook that handles raw I/O for this socket, or NULL */
+	IOHook* iohook;
+
 	/** Private send queue. Note that individual strings may be shared
 	 */
 	std::deque<std::string> sendq;
@@ -113,10 +116,10 @@ class CoreExport StreamSocket : public EventHandler
  protected:
 	std::string recvq;
  public:
-	StreamSocket() : sendq_len(0) {}
-	inline Module* GetIOHook();
-	inline void AddIOHook(Module* m);
-	inline void DelIOHook();
+	StreamSocket() : iohook(NULL), sendq_len(0) {}
+	IOHook* GetIOHook() const;
+	void AddIOHook(IOHook* hook);
+	void DelIOHook();
 	/** Handle event from socket engine.
 	 * This will call OnDataReady if there is *new* data in recvq
 	 */
@@ -228,8 +231,6 @@ class CoreExport BufferedSocket : public StreamSocket
 	BufferedSocketError BeginConnect(const std::string &ipaddr, int aport, unsigned long maxtime, const std::string &connectbindip);
 };
 
-#include "modules.h"
-
-inline Module* StreamSocket::GetIOHook() { return IOHook; }
-inline void StreamSocket::AddIOHook(Module* m) { IOHook = m; }
-inline void StreamSocket::DelIOHook() { IOHook = NULL; }
+inline IOHook* StreamSocket::GetIOHook() const { return iohook; }
+inline void StreamSocket::AddIOHook(IOHook* hook) { iohook = hook; }
+inline void StreamSocket::DelIOHook() { iohook = NULL; }
diff --git a/include/iohook.h b/include/iohook.h
new file mode 100644
index 000000000..87403681d
--- /dev/null
+++ b/include/iohook.h
@@ -0,0 +1,71 @@
+/*
+ * InspIRCd -- Internet Relay Chat Daemon
+ *
+ *   Copyright (C) 2013 Attila Molnar <attilamolnar@hush.com>
+ *
+ * This file is part of InspIRCd.  InspIRCd is free software: you can
+ * redistribute it and/or modify it under the terms of the GNU General Public
+ * License as published by the Free Software Foundation, version 2.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#pragma once
+
+class StreamSocket;
+
+class IOHook : public ServiceProvider
+{
+ public:
+	IOHook(Module* mod, const std::string& Name)
+		: ServiceProvider(mod, Name, SERVICE_IOHOOK) { }
+
+	/** Called immediately after any connection is accepted. This is intended for raw socket
+	 * processing (e.g. modules which wrap the tcp connection within another library) and provides
+	 * no information relating to a user record as the connection has not been assigned yet.
+	 * There are no return values from this call as all modules get an opportunity if required to
+	 * process the connection.
+	 * @param sock The socket in question
+	 * @param client The client IP address and port
+	 * @param server The server IP address and port
+	 */
+	virtual void OnStreamSocketAccept(StreamSocket* sock, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) = 0;
+
+	/**
+	 * Called when a hooked stream has data to write, or when the socket
+	 * engine returns it as writable
+	 * @param sock The socket in question
+	 * @param sendq Data to send to the socket
+	 * @return 1 if the sendq has been completely emptied, 0 if there is
+	 *  still data to send, and -1 if there was an error
+	 */
+	virtual int OnStreamSocketWrite(StreamSocket* sock, std::string& sendq) = 0;
+
+	/** Called immediately before any socket is closed. When this event is called, shutdown()
+	 * has not yet been called on the socket.
+	 * @param sock The socket in question
+	 */
+	virtual void OnStreamSocketClose(StreamSocket* sock) = 0;
+
+	/** Called immediately upon connection of an outbound BufferedSocket which has been hooked
+	 * by a module.
+	 * @param sock The socket in question
+	 */
+	virtual void OnStreamSocketConnect(StreamSocket* sock) = 0;
+
+	/**
+	 * Called when the stream socket has data to read
+	 * @param sock The socket that is ready
+	 * @param recvq The receive queue that new data should be appended to
+	 * @return 1 if new data has been read, 0 if no new data is ready (but the
+	 *  socket is still connected), -1 if there was an error or close
+	 */
+	virtual int OnStreamSocketRead(StreamSocket* sock, std::string& recvq) = 0;
+};
diff --git a/include/modules.h b/include/modules.h
index 959025367..d04582901 100644
--- a/include/modules.h
+++ b/include/modules.h
@@ -1169,48 +1169,6 @@ class CoreExport Module : public classbase, public usecountbase
 	 */
 	virtual ModResult OnAcceptConnection(int fd, ListenSocket* sock, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server);
 
-	/** Called immediately after any connection is accepted. This is intended for raw socket
-	 * processing (e.g. modules which wrap the tcp connection within another library) and provides
-	 * no information relating to a user record as the connection has not been assigned yet.
-	 * There are no return values from this call as all modules get an opportunity if required to
-	 * process the connection.
-	 * @param sock The socket in question
-	 * @param client The client IP address and port
-	 * @param server The server IP address and port
-	 */
-	virtual void OnStreamSocketAccept(StreamSocket* sock, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server);
-
-	/**
-	 * Called when a hooked stream has data to write, or when the socket
-	 * engine returns it as writable
-	 * @param sock The socket in question
-	 * @param sendq Data to send to the socket
-	 * @return 1 if the sendq has been completely emptied, 0 if there is
-	 *  still data to send, and -1 if there was an error
-	 */
-	virtual int OnStreamSocketWrite(StreamSocket* sock, std::string& sendq);
-
-	/** Called immediately before any socket is closed. When this event is called, shutdown()
-	 * has not yet been called on the socket.
-	 * @param sock The socket in question
-	 */
-	virtual void OnStreamSocketClose(StreamSocket* sock);
-
-	/** Called immediately upon connection of an outbound BufferedSocket which has been hooked
-	 * by a module.
-	 * @param sock The socket in question
-	 */
-	virtual void OnStreamSocketConnect(StreamSocket* sock);
-
-	/**
-	 * Called when the stream socket has data to read
-	 * @param sock The socket that is ready
-	 * @param recvq The receive queue that new data should be appended to
-	 * @return 1 if new data has been read, 0 if no new data is ready (but the
-	 *  socket is still connected), -1 if there was an error or close
-	 */
-	virtual int OnStreamSocketRead(StreamSocket* sock, std::string& recvq);
-
 	/** Called whenever a user sets away or returns from being away.
 	 * The away message is available as a parameter, but should not be modified.
 	 * At this stage, it has already been copied into the user record.
diff --git a/include/modules/ssl.h b/include/modules/ssl.h
index a79dcc9ef..a45121537 100644
--- a/include/modules/ssl.h
+++ b/include/modules/ssl.h
@@ -22,6 +22,7 @@
 
 #include <map>
 #include <string>
+#include "iohook.h"
 
 /** ssl_cert is a class which abstracts SSL certificate
  * and key information.
@@ -138,7 +139,7 @@ struct SocketCertificateRequest : public Request
 	ssl_cert* cert;
 
 	SocketCertificateRequest(StreamSocket* ss, Module* Me)
-		: Request(Me, ss->GetIOHook(), "GET_SSL_CERT"), sock(ss), cert(NULL)
+		: Request(Me, (ss->GetIOHook() ? (Module*)ss->GetIOHook()->creator : NULL), "GET_SSL_CERT"), sock(ss), cert(NULL)
 	{
 		Send();
 	}
diff --git a/src/inspsocket.cpp b/src/inspsocket.cpp
index 3a8a58b5f..ec528571b 100644
--- a/src/inspsocket.cpp
+++ b/src/inspsocket.cpp
@@ -26,6 +26,7 @@
 #include "socket.h"
 #include "inspstring.h"
 #include "socketengine.h"
+#include "iohook.h"
 
 #ifndef DISABLE_WRITEV
 #include <sys/uio.h>
@@ -122,18 +123,18 @@ void StreamSocket::Close()
 	{
 		// final chance, dump as much of the sendq as we can
 		DoWrite();
-		if (IOHook)
+		if (GetIOHook())
 		{
 			try
 			{
-				IOHook->OnStreamSocketClose(this);
+				GetIOHook()->OnStreamSocketClose(this);
 			}
 			catch (CoreException& modexcept)
 			{
 				ServerInstance->Logs->Log("SOCKET", LOG_DEFAULT, "%s threw an exception: %s",
 					modexcept.GetSource(), modexcept.GetReason());
 			}
-			IOHook = NULL;
+			DelIOHook();
 		}
 		ServerInstance->SE->Shutdown(this, 2);
 		ServerInstance->SE->DelFd(this);
@@ -161,12 +162,12 @@ bool StreamSocket::GetNextLine(std::string& line, char delim)
 
 void StreamSocket::DoRead()
 {
-	if (IOHook)
+	if (GetIOHook())
 	{
 		int rv = -1;
 		try
 		{
-			rv = IOHook->OnStreamSocketRead(this, recvq);
+			rv = GetIOHook()->OnStreamSocketRead(this, recvq);
 		}
 		catch (CoreException& modexcept)
 		{
@@ -230,7 +231,7 @@ void StreamSocket::DoWrite()
 	}
 
 #ifndef DISABLE_WRITEV
-	if (IOHook)
+	if (GetIOHook())
 #endif
 	{
 		int rv = -1;
@@ -256,9 +257,9 @@ void StreamSocket::DoWrite()
 				}
 				std::string& front = sendq.front();
 				int itemlen = front.length();
-				if (IOHook)
+				if (GetIOHook())
 				{
-					rv = IOHook->OnStreamSocketWrite(this, front);
+					rv = GetIOHook()->OnStreamSocketWrite(this, front);
 					if (rv > 0)
 					{
 						// consumed the entire string, and is ready for more
diff --git a/src/modules.cpp b/src/modules.cpp
index acd80323d..f683f6b6c 100644
--- a/src/modules.cpp
+++ b/src/modules.cpp
@@ -136,11 +136,6 @@ void		Module::OnRequest(Request&) { }
 ModResult	Module::OnPassCompare(Extensible* ex, const std::string &password, const std::string &input, const std::string& hashtype) { return MOD_RES_PASSTHRU; }
 void		Module::OnGlobalOper(User*) { }
 void		Module::OnPostConnect(User*) { }
-void		Module::OnStreamSocketAccept(StreamSocket*, irc::sockets::sockaddrs*, irc::sockets::sockaddrs*) { }
-int		Module::OnStreamSocketWrite(StreamSocket*, std::string&) { return -1; }
-void		Module::OnStreamSocketClose(StreamSocket*) { }
-void		Module::OnStreamSocketConnect(StreamSocket*) { }
-int		Module::OnStreamSocketRead(StreamSocket*, std::string&) { return -1; }
 void		Module::OnUserMessage(User*, void*, int, const std::string&, char, const CUList&, MessageType) { }
 void 		Module::OnRemoteKill(User*, User*, const std::string&, const std::string&) { }
 void		Module::OnUserInvite(User*, User*, Channel*, time_t) { }
diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index f9fddd5a1..e051b34e7 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -100,77 +100,186 @@ public:
 	issl_session() : socket(NULL), sess(NULL) {}
 };
 
-class CommandStartTLS : public SplitCommand
+class GnuTLSIOHook : public IOHook
 {
- public:
-	bool enabled;
-	CommandStartTLS (Module* mod) : SplitCommand(mod, "STARTTLS")
+ private:
+	void InitSession(StreamSocket* user, bool me_server)
 	{
-		enabled = true;
-		works_before_reg = true;
+		issl_session* session = &sessions[user->GetFd()];
+
+		gnutls_init(&session->sess, me_server ? GNUTLS_SERVER : GNUTLS_CLIENT);
+		session->socket = user;
+
+		#ifdef GNUTLS_NEW_PRIO_API
+		gnutls_priority_set(session->sess, priority);
+		#endif
+		gnutls_credentials_set(session->sess, GNUTLS_CRD_CERTIFICATE, x509_cred);
+		gnutls_dh_set_prime_bits(session->sess, dh_bits);
+		gnutls_transport_set_ptr(session->sess, reinterpret_cast<gnutls_transport_ptr_t>(session));
+		gnutls_transport_set_push_function(session->sess, gnutls_push_wrapper);
+		gnutls_transport_set_pull_function(session->sess, gnutls_pull_wrapper);
+
+		if (me_server)
+			gnutls_certificate_server_set_request(session->sess, GNUTLS_CERT_REQUEST); // Request client certificate if any.
+
+		Handshake(session, user);
 	}
 
-	CmdResult HandleLocal(const std::vector<std::string> &parameters, LocalUser *user)
+	void CloseSession(issl_session* session)
 	{
-		if (!enabled)
+		if (session->sess)
 		{
-			user->WriteNumeric(691, "%s :STARTTLS is not enabled", user->nick.c_str());
-			return CMD_FAILURE;
+			gnutls_bye(session->sess, GNUTLS_SHUT_WR);
+			gnutls_deinit(session->sess);
 		}
+		session->socket = NULL;
+		session->sess = NULL;
+		session->cert = NULL;
+		session->status = ISSL_NONE;
+	}
 
-		if (user->registered == REG_ALL)
-		{
-			user->WriteNumeric(691, "%s :STARTTLS is not permitted after client registration is complete", user->nick.c_str());
-		}
-		else
+	bool Handshake(issl_session* session, StreamSocket* user)
+	{
+		int ret = gnutls_handshake(session->sess);
+
+		if (ret < 0)
 		{
-			if (!user->eh.GetIOHook())
+			if(ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
 			{
-				user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str());
-				/* We need to flush the write buffer prior to adding the IOHook,
-				 * otherwise we'll be sending this line inside the SSL session - which
-				 * won't start its handshake until the client gets this line. Currently,
-				 * we assume the write will not block here; this is usually safe, as
-				 * STARTTLS is sent very early on in the registration phase, where the
-				 * user hasn't built up much sendq. Handling a blocked write here would
-				 * be very annoying.
-				 */
-				user->eh.DoWrite();
-				user->eh.AddIOHook(creator);
-				creator->OnStreamSocketAccept(&user->eh, NULL, NULL);
+				// Handshake needs resuming later, read() or write() would have blocked.
+
+				if(gnutls_record_get_direction(session->sess) == 0)
+				{
+					// gnutls_handshake() wants to read() again.
+					session->status = ISSL_HANDSHAKING_READ;
+					ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
+				}
+				else
+				{
+					// gnutls_handshake() wants to write() again.
+					session->status = ISSL_HANDSHAKING_WRITE;
+					ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
+				}
 			}
 			else
-				user->WriteNumeric(691, "%s :STARTTLS failure", user->nick.c_str());
+			{
+				user->SetError("Handshake Failed - " + std::string(gnutls_strerror(ret)));
+				CloseSession(session);
+				session->status = ISSL_CLOSING;
+			}
+
+			return false;
 		}
+		else
+		{
+			// Change the seesion state
+			session->status = ISSL_HANDSHAKEN;
 
-		return CMD_FAILURE;
+			VerifyCertificate(session,user);
+
+			// Finish writing, if any left
+			ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
+
+			return true;
+		}
 	}
-};
 
-class ModuleSSLGnuTLS : public Module
-{
-	issl_session* sessions;
+	void VerifyCertificate(issl_session* session, StreamSocket* user)
+	{
+		if (!session->sess || !user)
+			return;
 
-	gnutls_certificate_credentials_t x509_cred;
-	gnutls_dh_params_t dh_params;
-	gnutls_digest_algorithm_t hash;
-	#ifdef GNUTLS_NEW_PRIO_API
-	gnutls_priority_t priority;
-	#endif
+		unsigned int status;
+		const gnutls_datum_t* cert_list;
+		int ret;
+		unsigned int cert_list_size;
+		gnutls_x509_crt_t cert;
+		char str[512];
+		unsigned char digest[512];
+		size_t digest_size = sizeof(digest);
+		size_t name_size = sizeof(str);
+		ssl_cert* certinfo = new ssl_cert;
+		session->cert = certinfo;
 
-	std::string sslports;
-	int dh_bits;
+		/* This verification function uses the trusted CAs in the credentials
+		 * structure. So you must have installed one or more CA certificates.
+		 */
+		ret = gnutls_certificate_verify_peers2(session->sess, &status);
 
-	bool cred_alloc;
-	bool dh_alloc;
+		if (ret < 0)
+		{
+			certinfo->error = std::string(gnutls_strerror(ret));
+			return;
+		}
 
-	RandGen randhandler;
-	CommandStartTLS starttls;
+		certinfo->invalid = (status & GNUTLS_CERT_INVALID);
+		certinfo->unknownsigner = (status & GNUTLS_CERT_SIGNER_NOT_FOUND);
+		certinfo->revoked = (status & GNUTLS_CERT_REVOKED);
+		certinfo->trusted = !(status & GNUTLS_CERT_SIGNER_NOT_CA);
 
-	GenericCap capHandler;
-	ServiceProvider iohook;
+		/* Up to here the process is the same for X.509 certificates and
+		 * OpenPGP keys. From now on X.509 certificates are assumed. This can
+		 * be easily extended to work with openpgp keys as well.
+		 */
+		if (gnutls_certificate_type_get(session->sess) != GNUTLS_CRT_X509)
+		{
+			certinfo->error = "No X509 keys sent";
+			return;
+		}
+
+		ret = gnutls_x509_crt_init(&cert);
+		if (ret < 0)
+		{
+			certinfo->error = gnutls_strerror(ret);
+			return;
+		}
+
+		cert_list_size = 0;
+		cert_list = gnutls_certificate_get_peers(session->sess, &cert_list_size);
+		if (cert_list == NULL)
+		{
+			certinfo->error = "No certificate was found";
+			goto info_done_dealloc;
+		}
+
+		/* This is not a real world example, since we only check the first
+		 * certificate in the given chain.
+		 */
+
+		ret = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
+		if (ret < 0)
+		{
+			certinfo->error = gnutls_strerror(ret);
+			goto info_done_dealloc;
+		}
+
+		gnutls_x509_crt_get_dn(cert, str, &name_size);
+		certinfo->dn = str;
+
+		gnutls_x509_crt_get_issuer_dn(cert, str, &name_size);
+		certinfo->issuer = str;
+
+		if ((ret = gnutls_x509_crt_get_fingerprint(cert, hash, digest, &digest_size)) < 0)
+		{
+			certinfo->error = gnutls_strerror(ret);
+		}
+		else
+		{
+			certinfo->fingerprint = BinToHex(digest, digest_size);
+		}
 
-	inline static const char* UnknownIfNULL(const char* str)
+		/* Beware here we do not check for errors.
+		 */
+		if ((gnutls_x509_crt_get_expiration_time(cert) < ServerInstance->Time()) || (gnutls_x509_crt_get_activation_time(cert) > ServerInstance->Time()))
+		{
+			certinfo->error = "Not activated, or expired certificate";
+		}
+
+info_done_dealloc:
+		gnutls_x509_crt_deinit(cert);
+	}
+
+	static const char* UnknownIfNULL(const char* str)
 	{
 		return str ? str : "UNKNOWN";
 	}
@@ -240,19 +349,257 @@ class ModuleSSLGnuTLS : public Module
 	}
 
  public:
+ 	issl_session* sessions;
+	gnutls_certificate_credentials_t x509_cred;
+
+	gnutls_digest_algorithm_t hash;
+	#ifdef GNUTLS_NEW_PRIO_API
+	gnutls_priority_t priority;
+	#endif
+	int dh_bits;
+
+	GnuTLSIOHook(Module* parent)
+		: IOHook(parent, "ssl/gnutls")
+	{
+		sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
+	}
+
+	~GnuTLSIOHook()
+	{
+		delete[] sessions;
+	}
+
+	void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) CXX11_OVERRIDE
+	{
+		issl_session* session = &sessions[user->GetFd()];
+
+		/* For STARTTLS: Don't try and init a session on a socket that already has a session */
+		if (session->sess)
+			return;
+
+		InitSession(user, true);
+	}
+
+	void OnStreamSocketConnect(StreamSocket* user) CXX11_OVERRIDE
+	{
+		InitSession(user, false);
+	}
+
+	void OnStreamSocketClose(StreamSocket* user) CXX11_OVERRIDE
+	{
+		CloseSession(&sessions[user->GetFd()]);
+	}
+
+	int OnStreamSocketRead(StreamSocket* user, std::string& recvq) CXX11_OVERRIDE
+	{
+		issl_session* session = &sessions[user->GetFd()];
+
+		if (!session->sess)
+		{
+			CloseSession(session);
+			user->SetError("No SSL session");
+			return -1;
+		}
+
+		if (session->status == ISSL_HANDSHAKING_READ || session->status == ISSL_HANDSHAKING_WRITE)
+		{
+			// The handshake isn't finished, try to finish it.
+
+			if(!Handshake(session, user))
+			{
+				if (session->status != ISSL_CLOSING)
+					return 0;
+				return -1;
+			}
+		}
+
+		// If we resumed the handshake then session->status will be ISSL_HANDSHAKEN.
+
+		if (session->status == ISSL_HANDSHAKEN)
+		{
+			char* buffer = ServerInstance->GetReadBuffer();
+			size_t bufsiz = ServerInstance->Config->NetBufferSize;
+			int ret = gnutls_record_recv(session->sess, buffer, bufsiz);
+			if (ret > 0)
+			{
+				recvq.append(buffer, ret);
+				return 1;
+			}
+			else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
+			{
+				return 0;
+			}
+			else if (ret == 0)
+			{
+				user->SetError("Connection closed");
+				CloseSession(session);
+				return -1;
+			}
+			else
+			{
+				user->SetError(gnutls_strerror(ret));
+				CloseSession(session);
+				return -1;
+			}
+		}
+		else if (session->status == ISSL_CLOSING)
+			return -1;
+
+		return 0;
+	}
+
+	int OnStreamSocketWrite(StreamSocket* user, std::string& sendq) CXX11_OVERRIDE
+	{
+		issl_session* session = &sessions[user->GetFd()];
+
+		if (!session->sess)
+		{
+			CloseSession(session);
+			user->SetError("No SSL session");
+			return -1;
+		}
+
+		if (session->status == ISSL_HANDSHAKING_WRITE || session->status == ISSL_HANDSHAKING_READ)
+		{
+			// The handshake isn't finished, try to finish it.
+			Handshake(session, user);
+			if (session->status != ISSL_CLOSING)
+				return 0;
+			return -1;
+		}
+
+		int ret = 0;
+
+		if (session->status == ISSL_HANDSHAKEN)
+		{
+			ret = gnutls_record_send(session->sess, sendq.data(), sendq.length());
+
+			if (ret == (int)sendq.length())
+			{
+				ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_WRITE);
+				return 1;
+			}
+			else if (ret > 0)
+			{
+				sendq = sendq.substr(ret);
+				ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
+				return 0;
+			}
+			else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED || ret == 0)
+			{
+				ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
+				return 0;
+			}
+			else // (ret < 0)
+			{
+				user->SetError(gnutls_strerror(ret));
+				CloseSession(session);
+				return -1;
+			}
+		}
+
+		return 0;
+	}
+
+	void TellCiphersAndFingerprint(LocalUser* user)
+	{
+		const gnutls_session_t& sess = sessions[user->eh.GetFd()].sess;
+		if (sess)
+		{
+			std::string text = "*** You are connected using SSL cipher '";
+
+			text += UnknownIfNULL(gnutls_kx_get_name(gnutls_kx_get(sess)));
+			text.append("-").append(UnknownIfNULL(gnutls_cipher_get_name(gnutls_cipher_get(sess)))).append("-");
+			text.append(UnknownIfNULL(gnutls_mac_get_name(gnutls_mac_get(sess)))).append("'");
+
+			ssl_cert* cert = sessions[user->eh.GetFd()].cert;
+			if (!cert->fingerprint.empty())
+				text += " and your SSL fingerprint is " + cert->fingerprint;
+
+			user->WriteNotice(text);
+		}
+	}
+};
+
+class CommandStartTLS : public SplitCommand
+{
+	IOHook& hook;
+
+ public:
+	bool enabled;
+	CommandStartTLS(Module* mod, IOHook& Hook)
+		: SplitCommand(mod, "STARTTLS")
+		, hook(Hook)
+	{
+		enabled = true;
+		works_before_reg = true;
+	}
+
+	CmdResult HandleLocal(const std::vector<std::string> &parameters, LocalUser *user)
+	{
+		if (!enabled)
+		{
+			user->WriteNumeric(691, "%s :STARTTLS is not enabled", user->nick.c_str());
+			return CMD_FAILURE;
+		}
+
+		if (user->registered == REG_ALL)
+		{
+			user->WriteNumeric(691, "%s :STARTTLS is not permitted after client registration is complete", user->nick.c_str());
+		}
+		else
+		{
+			if (!user->eh.GetIOHook())
+			{
+				user->WriteNumeric(670, "%s :STARTTLS successful, go ahead with TLS handshake", user->nick.c_str());
+				/* We need to flush the write buffer prior to adding the IOHook,
+				 * otherwise we'll be sending this line inside the SSL session - which
+				 * won't start its handshake until the client gets this line. Currently,
+				 * we assume the write will not block here; this is usually safe, as
+				 * STARTTLS is sent very early on in the registration phase, where the
+				 * user hasn't built up much sendq. Handling a blocked write here would
+				 * be very annoying.
+				 */
+				user->eh.DoWrite();
+				user->eh.AddIOHook(&hook);
+				hook.OnStreamSocketAccept(&user->eh, NULL, NULL);
+			}
+			else
+				user->WriteNumeric(691, "%s :STARTTLS failure", user->nick.c_str());
+		}
+
+		return CMD_FAILURE;
+	}
+};
+
+class ModuleSSLGnuTLS : public Module
+{
+	GnuTLSIOHook iohook;
+
+	gnutls_dh_params_t dh_params;
+
+	std::string sslports;
+
+	bool cred_alloc;
+	bool dh_alloc;
+
+	RandGen randhandler;
+	CommandStartTLS starttls;
+
+	GenericCap capHandler;
+
+ public:
 	ModuleSSLGnuTLS()
-		: starttls(this), capHandler(this, "tls"), iohook(this, "ssl/gnutls", SERVICE_IOHOOK)
+		: iohook(this), starttls(this, iohook), capHandler(this, "tls")
 	{
 		gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
 
-		sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
-
 		gnutls_global_init(); // This must be called once in the program
 		gnutls_x509_privkey_init(&x509_key);
 
 		#ifdef GNUTLS_NEW_PRIO_API
 		// Init this here so it's always initialized, avoids an extra boolean
-		gnutls_priority_init(&priority, "NORMAL", NULL);
+		gnutls_priority_init(&iohook.priority, "NORMAL", NULL);
 		#endif
 
 		cred_alloc = false;
@@ -267,7 +614,7 @@ class ModuleSSLGnuTLS : public Module
 		ServerInstance->GenRandom = &randhandler;
 
 		// Void return, guess we assume success
-		gnutls_certificate_set_dh_params(x509_cred, dh_params);
+		gnutls_certificate_set_dh_params(iohook.x509_cred, dh_params);
 		Implementation eventlist[] = { I_On005Numeric, I_OnRehash, I_OnModuleRehash, I_OnUserConnect,
 			I_OnEvent, I_OnHookIO };
 		ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
@@ -333,7 +680,7 @@ class ModuleSSLGnuTLS : public Module
 		crlfile	= Conf->getString("crlfile", CONFIG_PATH "/crl.pem");
 		certfile = Conf->getString("certfile", CONFIG_PATH "/cert.pem");
 		keyfile	= Conf->getString("keyfile", CONFIG_PATH "/key.pem");
-		dh_bits	= Conf->getInt("dhbits");
+		int dh_bits = Conf->getInt("dhbits");
 		std::string hashname = Conf->getString("hash", "md5");
 
 		// The GnuTLS manual states that the gnutls_set_default_priority()
@@ -346,10 +693,12 @@ class ModuleSSLGnuTLS : public Module
 		if((dh_bits != 768) && (dh_bits != 1024) && (dh_bits != 2048) && (dh_bits != 3072) && (dh_bits != 4096))
 			dh_bits = 1024;
 
+		iohook.dh_bits = dh_bits;
+
 		if (hashname == "md5")
-			hash = GNUTLS_DIG_MD5;
+			iohook.hash = GNUTLS_DIG_MD5;
 		else if (hashname == "sha1")
-			hash = GNUTLS_DIG_SHA1;
+			iohook.hash = GNUTLS_DIG_SHA1;
 		else
 			throw ModuleException("Unknown hash type " + hashname);
 
@@ -366,22 +715,22 @@ class ModuleSSLGnuTLS : public Module
 		if (cred_alloc)
 		{
 			// Deallocate the old credentials
-			gnutls_certificate_free_credentials(x509_cred);
+			gnutls_certificate_free_credentials(iohook.x509_cred);
 
 			for(unsigned int i=0; i < x509_certs.size(); i++)
 				gnutls_x509_crt_deinit(x509_certs[i]);
 			x509_certs.clear();
 		}
 
-		ret = gnutls_certificate_allocate_credentials(&x509_cred);
+		ret = gnutls_certificate_allocate_credentials(&iohook.x509_cred);
 		cred_alloc = (ret >= 0);
 		if (!cred_alloc)
 			ServerInstance->Logs->Log("m_ssl_gnutls", LOG_DEBUG, "m_ssl_gnutls.so: Failed to allocate certificate credentials: %s", gnutls_strerror(ret));
 
-		if((ret =gnutls_certificate_set_x509_trust_file(x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
+		if((ret =gnutls_certificate_set_x509_trust_file(iohook.x509_cred, cafile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
 			ServerInstance->Logs->Log("m_ssl_gnutls", LOG_DEBUG, "m_ssl_gnutls.so: Failed to set X.509 trust file '%s': %s", cafile.c_str(), gnutls_strerror(ret));
 
-		if((ret = gnutls_certificate_set_x509_crl_file (x509_cred, crlfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
+		if((ret = gnutls_certificate_set_x509_crl_file (iohook.x509_cred, crlfile.c_str(), GNUTLS_X509_FMT_PEM)) < 0)
 			ServerInstance->Logs->Log("m_ssl_gnutls", LOG_DEBUG, "m_ssl_gnutls.so: Failed to set X.509 CRL file '%s': %s", crlfile.c_str(), gnutls_strerror(ret));
 
 		FileReader reader;
@@ -416,23 +765,23 @@ class ModuleSSLGnuTLS : public Module
 		if((ret = gnutls_x509_privkey_import(x509_key, &key_datum, GNUTLS_X509_FMT_PEM)) < 0)
 			throw ModuleException("Unable to load GnuTLS server private key (" + keyfile + "): " + std::string(gnutls_strerror(ret)));
 
-		if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_certs[0], certcount, x509_key)) < 0)
+		if((ret = gnutls_certificate_set_x509_key(iohook.x509_cred, &x509_certs[0], certcount, x509_key)) < 0)
 			throw ModuleException("Unable to set GnuTLS cert/key pair: " + std::string(gnutls_strerror(ret)));
 
 		#ifdef GNUTLS_NEW_PRIO_API
 		// It's safe to call this every time as we cannot have this uninitialized, see constructor and below.
-		gnutls_priority_deinit(priority);
+		gnutls_priority_deinit(iohook.priority);
 
 		// Try to set the priorities for ciphers, kex methods etc. to the user supplied string
 		// If the user did not supply anything then the string is already set to "NORMAL"
 		const char* priocstr = priorities.c_str();
 		const char* prioerror;
 
-		if ((ret = gnutls_priority_init(&priority, priocstr, &prioerror)) < 0)
+		if ((ret = gnutls_priority_init(&iohook.priority, priocstr, &prioerror)) < 0)
 		{
 			// gnutls did not understand the user supplied string, log and fall back to the default priorities
 			ServerInstance->Logs->Log("m_ssl_gnutls", LOG_DEFAULT, "m_ssl_gnutls.so: Failed to set priorities to \"%s\": %s Syntax error at position %u, falling back to default (NORMAL)", priorities.c_str(), gnutls_strerror(ret), (unsigned int) (prioerror - priocstr));
-			gnutls_priority_init(&priority, "NORMAL", NULL);
+			gnutls_priority_init(&iohook.priority, "NORMAL", NULL);
 		}
 
 		#else
@@ -441,9 +790,9 @@ class ModuleSSLGnuTLS : public Module
 		#endif
 
 		#if(GNUTLS_VERSION_MAJOR < 2 || ( GNUTLS_VERSION_MAJOR == 2 && GNUTLS_VERSION_MINOR < 12 ) )
-		gnutls_certificate_client_set_retrieve_function (x509_cred, cert_callback);
+		gnutls_certificate_client_set_retrieve_function (iohook.x509_cred, cert_callback);
 		#else
-		gnutls_certificate_set_retrieve_function (x509_cred, cert_callback);
+		gnutls_certificate_set_retrieve_function (iohook.x509_cred, cert_callback);
 		#endif
 		ret = gnutls_dh_params_init(&dh_params);
 		dh_alloc = (ret >= 0);
@@ -486,8 +835,8 @@ class ModuleSSLGnuTLS : public Module
 
 		int ret;
 
-		if((ret = gnutls_dh_params_generate2(dh_params, dh_bits)) < 0)
-			ServerInstance->Logs->Log("m_ssl_gnutls", LOG_DEFAULT, "m_ssl_gnutls.so: Failed to generate DH parameters (%d bits): %s", dh_bits, gnutls_strerror(ret));
+		if((ret = gnutls_dh_params_generate2(dh_params, iohook.dh_bits)) < 0)
+			ServerInstance->Logs->Log("m_ssl_gnutls", LOG_DEFAULT, "m_ssl_gnutls.so: Failed to generate DH parameters (%d bits): %s", iohook.dh_bits, gnutls_strerror(ret));
 	}
 
 	~ModuleSSLGnuTLS()
@@ -497,16 +846,15 @@ class ModuleSSLGnuTLS : public Module
 
 		gnutls_x509_privkey_deinit(x509_key);
 		#ifdef GNUTLS_NEW_PRIO_API
-		gnutls_priority_deinit(priority);
+		gnutls_priority_deinit(iohook.priority);
 		#endif
 
 		if (dh_alloc)
 			gnutls_dh_params_deinit(dh_params);
 		if (cred_alloc)
-			gnutls_certificate_free_credentials(x509_cred);
+			gnutls_certificate_free_credentials(iohook.x509_cred);
 
 		gnutls_global_deinit();
-		delete[] sessions;
 		ServerInstance->GenRandom = &ServerInstance->HandleGenRandom;
 	}
 
@@ -516,7 +864,7 @@ class ModuleSSLGnuTLS : public Module
 		{
 			LocalUser* user = IS_LOCAL(static_cast<User*>(item));
 
-			if (user && user->eh.GetIOHook() == this)
+			if (user && user->eh.GetIOHook() == &iohook)
 			{
 				// User is using SSL, they're a local user, and they're using one of *our* SSL ports.
 				// Potentially there could be multiple SSL modules loaded at once on different ports.
@@ -543,7 +891,7 @@ class ModuleSSLGnuTLS : public Module
 		if (!user->GetIOHook() && lsb->bind_tag->getString("ssl") == "gnutls")
 		{
 			/* Hook the user with our module */
-			user->AddIOHook(this);
+			user->AddIOHook(&iohook);
 		}
 	}
 
@@ -553,339 +901,16 @@ class ModuleSSLGnuTLS : public Module
 		{
 			SocketCertificateRequest& req = static_cast<SocketCertificateRequest&>(request);
 			int fd = req.sock->GetFd();
-			issl_session* session = &sessions[fd];
+			issl_session* session = &iohook.sessions[fd];
 
 			req.cert = session->cert;
 		}
 	}
 
-	void InitSession(StreamSocket* user, bool me_server)
-	{
-		issl_session* session = &sessions[user->GetFd()];
-
-		gnutls_init(&session->sess, me_server ? GNUTLS_SERVER : GNUTLS_CLIENT);
-		session->socket = user;
-
-		#ifdef GNUTLS_NEW_PRIO_API
-		gnutls_priority_set(session->sess, priority);
-		#endif
-		gnutls_credentials_set(session->sess, GNUTLS_CRD_CERTIFICATE, x509_cred);
-		gnutls_dh_set_prime_bits(session->sess, dh_bits);
-		gnutls_transport_set_ptr(session->sess, reinterpret_cast<gnutls_transport_ptr_t>(session));
-		gnutls_transport_set_push_function(session->sess, gnutls_push_wrapper);
-		gnutls_transport_set_pull_function(session->sess, gnutls_pull_wrapper);
-
-		if (me_server)
-			gnutls_certificate_server_set_request(session->sess, GNUTLS_CERT_REQUEST); // Request client certificate if any.
-
-		Handshake(session, user);
-	}
-
-	void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) CXX11_OVERRIDE
-	{
-		issl_session* session = &sessions[user->GetFd()];
-
-		/* For STARTTLS: Don't try and init a session on a socket that already has a session */
-		if (session->sess)
-			return;
-
-		InitSession(user, true);
-	}
-
-	void OnStreamSocketConnect(StreamSocket* user) CXX11_OVERRIDE
-	{
-		InitSession(user, false);
-	}
-
-	void OnStreamSocketClose(StreamSocket* user) CXX11_OVERRIDE
-	{
-		CloseSession(&sessions[user->GetFd()]);
-	}
-
-	int OnStreamSocketRead(StreamSocket* user, std::string& recvq) CXX11_OVERRIDE
-	{
-		issl_session* session = &sessions[user->GetFd()];
-
-		if (!session->sess)
-		{
-			CloseSession(session);
-			user->SetError("No SSL session");
-			return -1;
-		}
-
-		if (session->status == ISSL_HANDSHAKING_READ || session->status == ISSL_HANDSHAKING_WRITE)
-		{
-			// The handshake isn't finished, try to finish it.
-
-			if(!Handshake(session, user))
-			{
-				if (session->status != ISSL_CLOSING)
-					return 0;
-				return -1;
-			}
-		}
-
-		// If we resumed the handshake then session->status will be ISSL_HANDSHAKEN.
-
-		if (session->status == ISSL_HANDSHAKEN)
-		{
-			char* buffer = ServerInstance->GetReadBuffer();
-			size_t bufsiz = ServerInstance->Config->NetBufferSize;
-			int ret = gnutls_record_recv(session->sess, buffer, bufsiz);
-			if (ret > 0)
-			{
-				recvq.append(buffer, ret);
-				return 1;
-			}
-			else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
-			{
-				return 0;
-			}
-			else if (ret == 0)
-			{
-				user->SetError("Connection closed");
-				CloseSession(session);
-				return -1;
-			}
-			else
-			{
-				user->SetError(gnutls_strerror(ret));
-				CloseSession(session);
-				return -1;
-			}
-		}
-		else if (session->status == ISSL_CLOSING)
-			return -1;
-
-		return 0;
-	}
-
-	int OnStreamSocketWrite(StreamSocket* user, std::string& sendq) CXX11_OVERRIDE
-	{
-		issl_session* session = &sessions[user->GetFd()];
-
-		if (!session->sess)
-		{
-			CloseSession(session);
-			user->SetError("No SSL session");
-			return -1;
-		}
-
-		if (session->status == ISSL_HANDSHAKING_WRITE || session->status == ISSL_HANDSHAKING_READ)
-		{
-			// The handshake isn't finished, try to finish it.
-			Handshake(session, user);
-			if (session->status != ISSL_CLOSING)
-				return 0;
-			return -1;
-		}
-
-		int ret = 0;
-
-		if (session->status == ISSL_HANDSHAKEN)
-		{
-			ret = gnutls_record_send(session->sess, sendq.data(), sendq.length());
-
-			if (ret == (int)sendq.length())
-			{
-				ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_WRITE);
-				return 1;
-			}
-			else if (ret > 0)
-			{
-				sendq = sendq.substr(ret);
-				ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
-				return 0;
-			}
-			else if (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED || ret == 0)
-			{
-				ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
-				return 0;
-			}
-			else // (ret < 0)
-			{
-				user->SetError(gnutls_strerror(ret));
-				CloseSession(session);
-				return -1;
-			}
-		}
-
-		return 0;
-	}
-
-	bool Handshake(issl_session* session, StreamSocket* user)
-	{
-		int ret = gnutls_handshake(session->sess);
-
-		if (ret < 0)
-		{
-			if(ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
-			{
-				// Handshake needs resuming later, read() or write() would have blocked.
-
-				if(gnutls_record_get_direction(session->sess) == 0)
-				{
-					// gnutls_handshake() wants to read() again.
-					session->status = ISSL_HANDSHAKING_READ;
-					ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
-				}
-				else
-				{
-					// gnutls_handshake() wants to write() again.
-					session->status = ISSL_HANDSHAKING_WRITE;
-					ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
-				}
-			}
-			else
-			{
-				user->SetError("Handshake Failed - " + std::string(gnutls_strerror(ret)));
-				CloseSession(session);
-				session->status = ISSL_CLOSING;
-			}
-
-			return false;
-		}
-		else
-		{
-			// Change the seesion state
-			session->status = ISSL_HANDSHAKEN;
-
-			VerifyCertificate(session,user);
-
-			// Finish writing, if any left
-			ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
-
-			return true;
-		}
-	}
-
 	void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
 	{
-		if (user->eh.GetIOHook() == this)
-		{
-			if (sessions[user->eh.GetFd()].sess)
-			{
-				const gnutls_session_t& sess = sessions[user->eh.GetFd()].sess;
-				std::string cipher = UnknownIfNULL(gnutls_kx_get_name(gnutls_kx_get(sess)));
-				cipher.append("-").append(UnknownIfNULL(gnutls_cipher_get_name(gnutls_cipher_get(sess)))).append("-");
-				cipher.append(UnknownIfNULL(gnutls_mac_get_name(gnutls_mac_get(sess))));
-
-				ssl_cert* cert = sessions[user->eh.GetFd()].cert;
-				if (cert->fingerprint.empty())
-					user->WriteNotice("*** You are connected using SSL cipher '" + cipher + "'");
-				else
-					user->WriteNotice("*** You are connected using SSL cipher '" + cipher +
-						"' and your SSL fingerprint is " + cert->fingerprint);
-			}
-		}
-	}
-
-	void CloseSession(issl_session* session)
-	{
-		if (session->sess)
-		{
-			gnutls_bye(session->sess, GNUTLS_SHUT_WR);
-			gnutls_deinit(session->sess);
-		}
-		session->socket = NULL;
-		session->sess = NULL;
-		session->cert = NULL;
-		session->status = ISSL_NONE;
-	}
-
-	void VerifyCertificate(issl_session* session, StreamSocket* user)
-	{
-		if (!session->sess || !user)
-			return;
-
-		unsigned int status;
-		const gnutls_datum_t* cert_list;
-		int ret;
-		unsigned int cert_list_size;
-		gnutls_x509_crt_t cert;
-		char name[512];
-		unsigned char digest[512];
-		size_t digest_size = sizeof(digest);
-		size_t name_size = sizeof(name);
-		ssl_cert* certinfo = new ssl_cert;
-		session->cert = certinfo;
-
-		/* This verification function uses the trusted CAs in the credentials
-		 * structure. So you must have installed one or more CA certificates.
-		 */
-		ret = gnutls_certificate_verify_peers2(session->sess, &status);
-
-		if (ret < 0)
-		{
-			certinfo->error = std::string(gnutls_strerror(ret));
-			return;
-		}
-
-		certinfo->invalid = (status & GNUTLS_CERT_INVALID);
-		certinfo->unknownsigner = (status & GNUTLS_CERT_SIGNER_NOT_FOUND);
-		certinfo->revoked = (status & GNUTLS_CERT_REVOKED);
-		certinfo->trusted = !(status & GNUTLS_CERT_SIGNER_NOT_CA);
-
-		/* Up to here the process is the same for X.509 certificates and
-		 * OpenPGP keys. From now on X.509 certificates are assumed. This can
-		 * be easily extended to work with openpgp keys as well.
-		 */
-		if (gnutls_certificate_type_get(session->sess) != GNUTLS_CRT_X509)
-		{
-			certinfo->error = "No X509 keys sent";
-			return;
-		}
-
-		ret = gnutls_x509_crt_init(&cert);
-		if (ret < 0)
-		{
-			certinfo->error = gnutls_strerror(ret);
-			return;
-		}
-
-		cert_list_size = 0;
-		cert_list = gnutls_certificate_get_peers(session->sess, &cert_list_size);
-		if (cert_list == NULL)
-		{
-			certinfo->error = "No certificate was found";
-			goto info_done_dealloc;
-		}
-
-		/* This is not a real world example, since we only check the first
-		 * certificate in the given chain.
-		 */
-
-		ret = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
-		if (ret < 0)
-		{
-			certinfo->error = gnutls_strerror(ret);
-			goto info_done_dealloc;
-		}
-
-		gnutls_x509_crt_get_dn(cert, name, &name_size);
-		certinfo->dn = name;
-
-		gnutls_x509_crt_get_issuer_dn(cert, name, &name_size);
-		certinfo->issuer = name;
-
-		if ((ret = gnutls_x509_crt_get_fingerprint(cert, hash, digest, &digest_size)) < 0)
-		{
-			certinfo->error = gnutls_strerror(ret);
-		}
-		else
-		{
-			certinfo->fingerprint = BinToHex(digest, digest_size);
-		}
-
-		/* Beware here we do not check for errors.
-		 */
-		if ((gnutls_x509_crt_get_expiration_time(cert) < ServerInstance->Time()) || (gnutls_x509_crt_get_activation_time(cert) > ServerInstance->Time()))
-		{
-			certinfo->error = "Not activated, or expired certificate";
-		}
-
-info_done_dealloc:
-		gnutls_x509_crt_deinit(cert);
+		if (user->eh.GetIOHook() == &iohook)
+			iohook.TellCiphersAndFingerprint(user);
 	}
 
 	void OnEvent(Event& ev) CXX11_OVERRIDE
diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 1fa6763ce..0c7362e6e 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -31,6 +31,7 @@
 #endif
 
 #include "inspircd.h"
+#include "iohook.h"
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include "modules/ssl.h"
@@ -100,231 +101,142 @@ static int OnVerify(int preverify_ok, X509_STORE_CTX *ctx)
 	return 1;
 }
 
-class ModuleSSLOpenSSL : public Module
+class OpenSSLIOHook : public IOHook
 {
-	issl_session* sessions;
-
-	SSL_CTX* ctx;
-	SSL_CTX* clictx;
-
-	std::string sslports;
-	bool use_sha;
-
-	ServiceProvider iohook;
- public:
-
-	ModuleSSLOpenSSL() : iohook(this, "ssl/openssl", SERVICE_IOHOOK)
+ private:
+	bool Handshake(StreamSocket* user, issl_session* session)
 	{
-		sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
+		int ret;
 
-		/* Global SSL library initialization*/
-		SSL_library_init();
-		SSL_load_error_strings();
+		if (session->outbound)
+			ret = SSL_connect(session->sess);
+		else
+			ret = SSL_accept(session->sess);
 
-		/* Build our SSL contexts:
-		 * NOTE: OpenSSL makes us have two contexts, one for servers and one for clients. ICK.
-		 */
-		ctx = SSL_CTX_new( SSLv23_server_method() );
-		clictx = SSL_CTX_new( SSLv23_client_method() );
+		if (ret < 0)
+		{
+			int err = SSL_get_error(session->sess, ret);
 
-		SSL_CTX_set_mode(ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
-		SSL_CTX_set_mode(clictx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+			if (err == SSL_ERROR_WANT_READ)
+			{
+				ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
+				session->status = ISSL_HANDSHAKING;
+				return true;
+			}
+			else if (err == SSL_ERROR_WANT_WRITE)
+			{
+				ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
+				session->status = ISSL_HANDSHAKING;
+				return true;
+			}
+			else
+			{
+				CloseSession(session);
+			}
 
-		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
-		SSL_CTX_set_verify(clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
-	}
+			return false;
+		}
+		else if (ret > 0)
+		{
+			// Handshake complete.
+			VerifyCertificate(session, user);
 
-	void init() CXX11_OVERRIDE
-	{
-		// Needs the flag as it ignores a plain /rehash
-		OnModuleRehash(NULL,"ssl");
-		Implementation eventlist[] = { I_On005Numeric, I_OnRehash, I_OnModuleRehash, I_OnHookIO, I_OnUserConnect };
-		ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
-		ServerInstance->Modules->AddService(iohook);
-	}
+			session->status = ISSL_OPEN;
 
-	void OnHookIO(StreamSocket* user, ListenSocket* lsb) CXX11_OVERRIDE
-	{
-		if (!user->GetIOHook() && lsb->bind_tag->getString("ssl") == "openssl")
+			ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
+
+			return true;
+		}
+		else if (ret == 0)
 		{
-			/* Hook the user with our module */
-			user->AddIOHook(this);
+			CloseSession(session);
+			return true;
 		}
+
+		return true;
 	}
 
-	void OnRehash(User* user) CXX11_OVERRIDE
+	void CloseSession(issl_session* session)
 	{
-		sslports.clear();
-
-		ConfigTag* Conf = ServerInstance->Config->ConfValue("openssl");
-
-		if (Conf->getBool("showports", true))
+		if (session->sess)
 		{
-			sslports = Conf->getString("advertisedports");
-			if (!sslports.empty())
-				return;
-
-			for (size_t i = 0; i < ServerInstance->ports.size(); i++)
-			{
-				ListenSocket* port = ServerInstance->ports[i];
-				if (port->bind_tag->getString("ssl") != "openssl")
-					continue;
-
-				const std::string& portid = port->bind_desc;
-				ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Enabling SSL for port %s", portid.c_str());
-
-				if (port->bind_tag->getString("type", "clients") == "clients" && port->bind_addr != "127.0.0.1")
-				{
-					/*
-					 * Found an SSL port for clients that is not bound to 127.0.0.1 and handled by us, display
-					 * the IP:port in ISUPPORT.
-					 *
-					 * We used to advertise all ports seperated by a ';' char that matched the above criteria,
-					 * but this resulted in too long ISUPPORT lines if there were lots of ports to be displayed.
-					 * To solve this by default we now only display the first IP:port found and let the user
-					 * configure the exact value for the 005 token, if necessary.
-					 */
-					sslports = portid;
-					break;
-				}
-			}
+			SSL_shutdown(session->sess);
+			SSL_free(session->sess);
 		}
+
+		session->sess = NULL;
+		session->status = ISSL_NONE;
+		errno = EIO;
 	}
 
-	void OnModuleRehash(User* user, const std::string &param) CXX11_OVERRIDE
+	void VerifyCertificate(issl_session* session, StreamSocket* user)
 	{
-		if (param != "ssl")
+		if (!session->sess || !user)
 			return;
 
-		std::string keyfile;
-		std::string certfile;
-		std::string cafile;
-		std::string dhfile;
-		OnRehash(user);
-
-		ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
-
-		cafile	 = conf->getString("cafile", CONFIG_PATH "/ca.pem");
-		certfile = conf->getString("certfile", CONFIG_PATH "/cert.pem");
-		keyfile	 = conf->getString("keyfile", CONFIG_PATH "/key.pem");
-		dhfile	 = conf->getString("dhfile", CONFIG_PATH "/dhparams.pem");
-		std::string hash = conf->getString("hash", "md5");
-		if (hash != "sha1" && hash != "md5")
-			throw ModuleException("Unknown hash type " + hash);
-		use_sha = (hash == "sha1");
+		X509* cert;
+		ssl_cert* certinfo = new ssl_cert;
+		session->cert = certinfo;
+		unsigned int n;
+		unsigned char md[EVP_MAX_MD_SIZE];
+		const EVP_MD *digest = use_sha ? EVP_sha1() : EVP_md5();
 
-		std::string ciphers = conf->getString("ciphers", "");
+		cert = SSL_get_peer_certificate((SSL*)session->sess);
 
-		if (!ciphers.empty())
+		if (!cert)
 		{
-			if ((!SSL_CTX_set_cipher_list(ctx, ciphers.c_str())) || (!SSL_CTX_set_cipher_list(clictx, ciphers.c_str())))
-			{
-				ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Can't set cipher list to %s.", ciphers.c_str());
-				ERR_print_errors_cb(error_callback, this);
-			}
+			certinfo->error = "Could not get peer certificate: "+std::string(get_error());
+			return;
 		}
 
-		/* Load our keys and certificates
-		 * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
-		 */
-		if ((!SSL_CTX_use_certificate_chain_file(ctx, certfile.c_str())) || (!SSL_CTX_use_certificate_chain_file(clictx, certfile.c_str())))
-		{
-			ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Can't read certificate file %s. %s", certfile.c_str(), strerror(errno));
-			ERR_print_errors_cb(error_callback, this);
-		}
+		certinfo->invalid = (SSL_get_verify_result(session->sess) != X509_V_OK);
 
-		if (((!SSL_CTX_use_PrivateKey_file(ctx, keyfile.c_str(), SSL_FILETYPE_PEM))) || (!SSL_CTX_use_PrivateKey_file(clictx, keyfile.c_str(), SSL_FILETYPE_PEM)))
+		if (SelfSigned)
 		{
-			ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Can't read key file %s. %s", keyfile.c_str(), strerror(errno));
-			ERR_print_errors_cb(error_callback, this);
+			certinfo->unknownsigner = false;
+			certinfo->trusted = true;
 		}
-
-		/* Load the CAs we trust*/
-		if (((!SSL_CTX_load_verify_locations(ctx, cafile.c_str(), 0))) || (!SSL_CTX_load_verify_locations(clictx, cafile.c_str(), 0)))
+		else
 		{
-			ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Can't read CA list from %s. This is only a problem if you want to verify client certificates, otherwise it's safe to ignore this message. Error: %s", cafile.c_str(), strerror(errno));
-			ERR_print_errors_cb(error_callback, this);
+			certinfo->unknownsigner = true;
+			certinfo->trusted = false;
 		}
 
-		FILE* dhpfile = fopen(dhfile.c_str(), "r");
-		DH* ret;
+		certinfo->dn = X509_NAME_oneline(X509_get_subject_name(cert),0,0);
+		certinfo->issuer = X509_NAME_oneline(X509_get_issuer_name(cert),0,0);
 
-		if (dhpfile == NULL)
+		if (!X509_digest(cert, digest, md, &n))
 		{
-			ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so Couldn't open DH file %s: %s", dhfile.c_str(), strerror(errno));
-			throw ModuleException("Couldn't open DH file " + dhfile + ": " + strerror(errno));
+			certinfo->error = "Out of memory generating fingerprint";
 		}
 		else
 		{
-			ret = PEM_read_DHparams(dhpfile, NULL, NULL, NULL);
-			if ((SSL_CTX_set_tmp_dh(ctx, ret) < 0) || (SSL_CTX_set_tmp_dh(clictx, ret) < 0))
-			{
-				ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Couldn't set DH parameters %s. SSL errors follow:", dhfile.c_str());
-				ERR_print_errors_cb(error_callback, this);
-			}
+			certinfo->fingerprint = BinToHex(md, n);
 		}
 
-		fclose(dhpfile);
-	}
-
-	void On005Numeric(std::map<std::string, std::string>& tokens) CXX11_OVERRIDE
-	{
-		if (!sslports.empty())
-			tokens["SSL"] = sslports;
-	}
-
-	~ModuleSSLOpenSSL()
-	{
-		SSL_CTX_free(ctx);
-		SSL_CTX_free(clictx);
-		delete[] sessions;
-	}
-
-	void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
-	{
-		if (user->eh.GetIOHook() == this)
+		if ((ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(cert), ServerInstance->Time()) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_get_notBefore(cert), ServerInstance->Time()) == 0))
 		{
-			if (sessions[user->eh.GetFd()].sess)
-			{
-				if (!sessions[user->eh.GetFd()].cert->fingerprint.empty())
-					user->WriteNotice("*** You are connected using SSL cipher '" + std::string(SSL_get_cipher(sessions[user->eh.GetFd()].sess)) +
-						"' and your SSL fingerprint is " + sessions[user->eh.GetFd()].cert->fingerprint);
-				else
-					user->WriteNotice("*** You are connected using SSL cipher '" + std::string(SSL_get_cipher(sessions[user->eh.GetFd()].sess)) + "'");
-			}
+			certinfo->error = "Not activated, or expired certificate";
 		}
-	}
 
-	void OnCleanup(int target_type, void* item) CXX11_OVERRIDE
-	{
-		if (target_type == TYPE_USER)
-		{
-			LocalUser* user = IS_LOCAL((User*)item);
-
-			if (user && user->eh.GetIOHook() == this)
-			{
-				// User is using SSL, they're a local user, and they're using one of *our* SSL ports.
-				// Potentially there could be multiple SSL modules loaded at once on different ports.
-				ServerInstance->Users->QuitUser(user, "SSL module unloading");
-			}
-		}
+		X509_free(cert);
 	}
 
-	Version GetVersion() CXX11_OVERRIDE
+ public:
+	issl_session* sessions;
+	SSL_CTX* ctx;
+	SSL_CTX* clictx;
+	bool use_sha;
+
+	OpenSSLIOHook(Module* mod)
+		: IOHook(mod, "ssl/openssl")
 	{
-		return Version("Provides SSL support for clients", VF_VENDOR);
+		sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
 	}
 
-	void OnRequest(Request& request) CXX11_OVERRIDE
+	~OpenSSLIOHook()
 	{
-		if (strcmp("GET_SSL_CERT", request.id) == 0)
-		{
-			SocketCertificateRequest& req = static_cast<SocketCertificateRequest&>(request);
-			int fd = req.sock->GetFd();
-			issl_session* session = &sessions[fd];
-
-			req.cert = session->cert;
-		}
+		delete[] sessions;
 	}
 
 	void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) CXX11_OVERRIDE
@@ -528,122 +440,230 @@ class ModuleSSLOpenSSL : public Module
 		return 0;
 	}
 
-	bool Handshake(StreamSocket* user, issl_session* session)
+	void TellCiphersAndFingerprint(LocalUser* user)
 	{
-		int ret;
+		issl_session& s = sessions[user->eh.GetFd()];
+		if (s.sess)
+		{
+			std::string text = "*** You are connected using SSL cipher '" + std::string(SSL_get_cipher(s.sess)) + "'";
+			const std::string& fingerprint = s.cert->fingerprint;
+			if (!fingerprint.empty())
+				text += " and your SSL fingerprint is " + fingerprint;
 
-		if (session->outbound)
-			ret = SSL_connect(session->sess);
-		else
-			ret = SSL_accept(session->sess);
+			user->WriteNotice(text);
+		}
+	}
+};
 
-		if (ret < 0)
-		{
-			int err = SSL_get_error(session->sess, ret);
+class ModuleSSLOpenSSL : public Module
+{
+	std::string sslports;
+	OpenSSLIOHook iohook;
 
-			if (err == SSL_ERROR_WANT_READ)
-			{
-				ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
-				session->status = ISSL_HANDSHAKING;
-				return true;
-			}
-			else if (err == SSL_ERROR_WANT_WRITE)
-			{
-				ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
-				session->status = ISSL_HANDSHAKING;
-				return true;
-			}
-			else
-			{
-				CloseSession(session);
-			}
+ public:
+	ModuleSSLOpenSSL() : iohook(this)
+	{
+		/* Global SSL library initialization*/
+		SSL_library_init();
+		SSL_load_error_strings();
 
-			return false;
-		}
-		else if (ret > 0)
-		{
-			// Handshake complete.
-			VerifyCertificate(session, user);
+		/* Build our SSL contexts:
+		 * NOTE: OpenSSL makes us have two contexts, one for servers and one for clients. ICK.
+		 */
+		iohook.ctx = SSL_CTX_new( SSLv23_server_method() );
+		iohook.clictx = SSL_CTX_new( SSLv23_client_method() );
 
-			session->status = ISSL_OPEN;
+		SSL_CTX_set_mode(iohook.ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+		SSL_CTX_set_mode(iohook.clictx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 
-			ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
+		SSL_CTX_set_verify(iohook.ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
+		SSL_CTX_set_verify(iohook.clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
+	}
 
-			return true;
-		}
-		else if (ret == 0)
-		{
-			CloseSession(session);
-			return true;
-		}
+	~ModuleSSLOpenSSL()
+	{
+		SSL_CTX_free(iohook.ctx);
+		SSL_CTX_free(iohook.clictx);
+	}
 
-		return true;
+	void init() CXX11_OVERRIDE
+	{
+		// Needs the flag as it ignores a plain /rehash
+		OnModuleRehash(NULL,"ssl");
+		Implementation eventlist[] = { I_On005Numeric, I_OnRehash, I_OnModuleRehash, I_OnHookIO, I_OnUserConnect };
+		ServerInstance->Modules->Attach(eventlist, this, sizeof(eventlist)/sizeof(Implementation));
+		ServerInstance->Modules->AddService(iohook);
 	}
 
-	void CloseSession(issl_session* session)
+	void OnHookIO(StreamSocket* user, ListenSocket* lsb) CXX11_OVERRIDE
 	{
-		if (session->sess)
+		if (!user->GetIOHook() && lsb->bind_tag->getString("ssl") == "openssl")
 		{
-			SSL_shutdown(session->sess);
-			SSL_free(session->sess);
+			/* Hook the user with our module */
+			user->AddIOHook(&iohook);
 		}
+	}
 
-		session->sess = NULL;
-		session->status = ISSL_NONE;
-		errno = EIO;
+	void OnRehash(User* user) CXX11_OVERRIDE
+	{
+		sslports.clear();
+
+		ConfigTag* Conf = ServerInstance->Config->ConfValue("openssl");
+
+		if (Conf->getBool("showports", true))
+		{
+			sslports = Conf->getString("advertisedports");
+			if (!sslports.empty())
+				return;
+
+			for (size_t i = 0; i < ServerInstance->ports.size(); i++)
+			{
+				ListenSocket* port = ServerInstance->ports[i];
+				if (port->bind_tag->getString("ssl") != "openssl")
+					continue;
+
+				const std::string& portid = port->bind_desc;
+				ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Enabling SSL for port %s", portid.c_str());
+
+				if (port->bind_tag->getString("type", "clients") == "clients" && port->bind_addr != "127.0.0.1")
+				{
+					/*
+					 * Found an SSL port for clients that is not bound to 127.0.0.1 and handled by us, display
+					 * the IP:port in ISUPPORT.
+					 *
+					 * We used to advertise all ports seperated by a ';' char that matched the above criteria,
+					 * but this resulted in too long ISUPPORT lines if there were lots of ports to be displayed.
+					 * To solve this by default we now only display the first IP:port found and let the user
+					 * configure the exact value for the 005 token, if necessary.
+					 */
+					sslports = portid;
+					break;
+				}
+			}
+		}
 	}
 
-	void VerifyCertificate(issl_session* session, StreamSocket* user)
+	void OnModuleRehash(User* user, const std::string &param) CXX11_OVERRIDE
 	{
-		if (!session->sess || !user)
+		if (param != "ssl")
 			return;
 
-		X509* cert;
-		ssl_cert* certinfo = new ssl_cert;
-		session->cert = certinfo;
-		unsigned int n;
-		unsigned char md[EVP_MAX_MD_SIZE];
-		const EVP_MD *digest = use_sha ? EVP_sha1() : EVP_md5();
+		std::string keyfile;
+		std::string certfile;
+		std::string cafile;
+		std::string dhfile;
+		OnRehash(user);
 
-		cert = SSL_get_peer_certificate((SSL*)session->sess);
+		ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
 
-		if (!cert)
+		cafile	 = conf->getString("cafile", CONFIG_PATH "/ca.pem");
+		certfile = conf->getString("certfile", CONFIG_PATH "/cert.pem");
+		keyfile	 = conf->getString("keyfile", CONFIG_PATH "/key.pem");
+		dhfile	 = conf->getString("dhfile", CONFIG_PATH "/dhparams.pem");
+		std::string hash = conf->getString("hash", "md5");
+		if (hash != "sha1" && hash != "md5")
+			throw ModuleException("Unknown hash type " + hash);
+		iohook.use_sha = (hash == "sha1");
+
+		std::string ciphers = conf->getString("ciphers", "");
+
+		SSL_CTX* ctx = iohook.ctx;
+		SSL_CTX* clictx = iohook.clictx;
+
+		if (!ciphers.empty())
 		{
-			certinfo->error = "Could not get peer certificate: "+std::string(get_error());
-			return;
+			if ((!SSL_CTX_set_cipher_list(ctx, ciphers.c_str())) || (!SSL_CTX_set_cipher_list(clictx, ciphers.c_str())))
+			{
+				ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Can't set cipher list to %s.", ciphers.c_str());
+				ERR_print_errors_cb(error_callback, this);
+			}
 		}
 
-		certinfo->invalid = (SSL_get_verify_result(session->sess) != X509_V_OK);
+		/* Load our keys and certificates
+		 * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
+		 */
+		if ((!SSL_CTX_use_certificate_chain_file(ctx, certfile.c_str())) || (!SSL_CTX_use_certificate_chain_file(clictx, certfile.c_str())))
+		{
+			ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Can't read certificate file %s. %s", certfile.c_str(), strerror(errno));
+			ERR_print_errors_cb(error_callback, this);
+		}
 
-		if (SelfSigned)
+		if (((!SSL_CTX_use_PrivateKey_file(ctx, keyfile.c_str(), SSL_FILETYPE_PEM))) || (!SSL_CTX_use_PrivateKey_file(clictx, keyfile.c_str(), SSL_FILETYPE_PEM)))
 		{
-			certinfo->unknownsigner = false;
-			certinfo->trusted = true;
+			ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Can't read key file %s. %s", keyfile.c_str(), strerror(errno));
+			ERR_print_errors_cb(error_callback, this);
 		}
-		else
+
+		/* Load the CAs we trust*/
+		if (((!SSL_CTX_load_verify_locations(ctx, cafile.c_str(), 0))) || (!SSL_CTX_load_verify_locations(clictx, cafile.c_str(), 0)))
 		{
-			certinfo->unknownsigner = true;
-			certinfo->trusted = false;
+			ServerInstance->Logs->Log("m_ssl_openssl",LOG_DEFAULT, "m_ssl_openssl.so: Can't read CA list from %s. This is only a problem if you want to verify client certificates, otherwise it's safe to ignore this message. Error: %s", cafile.c_str(), strerror(errno));
+			ERR_print_errors_cb(error_callback, this);
 		}
 
-		certinfo->dn = X509_NAME_oneline(X509_get_subject_name(cert),0,0);
-		certinfo->issuer = X509_NAME_oneline(X509_get_issuer_name(cert),0,0);
+		FILE* dhpfile = fopen(dhfile.c_str(), "r");
+		DH* ret;
 
-		if (!X509_digest(cert, digest, md, &n))
+		if (dhpfile == NULL)
 		{
-			certinfo->error = "Out of memory generating fingerprint";
+			ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so Couldn't open DH file %s: %s", dhfile.c_str(), strerror(errno));
+			throw ModuleException("Couldn't open DH file " + dhfile + ": " + strerror(errno));
 		}
 		else
 		{
-			certinfo->fingerprint = BinToHex(md, n);
+			ret = PEM_read_DHparams(dhpfile, NULL, NULL, NULL);
+			if ((SSL_CTX_set_tmp_dh(ctx, ret) < 0) || (SSL_CTX_set_tmp_dh(clictx, ret) < 0))
+			{
+				ServerInstance->Logs->Log("m_ssl_openssl", LOG_DEFAULT, "m_ssl_openssl.so: Couldn't set DH parameters %s. SSL errors follow:", dhfile.c_str());
+				ERR_print_errors_cb(error_callback, this);
+			}
 		}
 
-		if ((ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(cert), ServerInstance->Time()) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_get_notBefore(cert), ServerInstance->Time()) == 0))
+		fclose(dhpfile);
+	}
+
+	void On005Numeric(std::map<std::string, std::string>& tokens) CXX11_OVERRIDE
+	{
+		if (!sslports.empty())
+			tokens["SSL"] = sslports;
+	}
+
+	void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
+	{
+		if (user->eh.GetIOHook() == &iohook)
+			iohook.TellCiphersAndFingerprint(user);
+	}
+
+	void OnCleanup(int target_type, void* item) CXX11_OVERRIDE
+	{
+		if (target_type == TYPE_USER)
 		{
-			certinfo->error = "Not activated, or expired certificate";
+			LocalUser* user = IS_LOCAL((User*)item);
+
+			if (user && user->eh.GetIOHook() == &iohook)
+			{
+				// User is using SSL, they're a local user, and they're using one of *our* SSL ports.
+				// Potentially there could be multiple SSL modules loaded at once on different ports.
+				ServerInstance->Users->QuitUser(user, "SSL module unloading");
+			}
 		}
+	}
 
-		X509_free(cert);
+	Version GetVersion() CXX11_OVERRIDE
+	{
+		return Version("Provides SSL support for clients", VF_VENDOR);
+	}
+
+	void OnRequest(Request& request) CXX11_OVERRIDE
+	{
+		if (strcmp("GET_SSL_CERT", request.id) == 0)
+		{
+			SocketCertificateRequest& req = static_cast<SocketCertificateRequest&>(request);
+			int fd = req.sock->GetFd();
+			issl_session* session = &iohook.sessions[fd];
+
+			req.cert = session->cert;
+		}
 	}
 };
 
diff --git a/src/modules/m_httpd.cpp b/src/modules/m_httpd.cpp
index cbee27958..9d437bd1c 100644
--- a/src/modules/m_httpd.cpp
+++ b/src/modules/m_httpd.cpp
@@ -23,6 +23,7 @@
 
 
 #include "inspircd.h"
+#include "iohook.h"
 #include "modules/httpd.h"
 
 /* $ModDesc: Provides HTTP serving facilities to modules */
diff --git a/src/modules/m_spanningtree/main.cpp b/src/modules/m_spanningtree/main.cpp
index aafda7eea..7c698a83e 100644
--- a/src/modules/m_spanningtree/main.cpp
+++ b/src/modules/m_spanningtree/main.cpp
@@ -26,6 +26,7 @@
 #include "inspircd.h"
 #include "socket.h"
 #include "xline.h"
+#include "iohook.h"
 
 #include "resolvers.h"
 #include "main.h"
@@ -740,7 +741,7 @@ void ModuleSpanningTree::OnUnloadModule(Module* mod)
 	{
 		TreeServer* srv = Utils->TreeRoot->GetChild(x);
 		TreeSocket* sock = srv->GetSocket();
-		if (sock && sock->GetIOHook() == mod)
+		if (sock && sock->GetIOHook() && sock->GetIOHook()->creator == mod)
 		{
 			sock->SendError("SSL module unloaded");
 			sock->Close();
diff --git a/src/modules/m_spanningtree/treesocket1.cpp b/src/modules/m_spanningtree/treesocket1.cpp
index dc81842b1..b7fadf342 100644
--- a/src/modules/m_spanningtree/treesocket1.cpp
+++ b/src/modules/m_spanningtree/treesocket1.cpp
@@ -21,6 +21,7 @@
 
 
 #include "inspircd.h"
+#include "iohook.h"
 
 #include "main.h"
 #include "modules/spanningtree.h"
@@ -55,7 +56,7 @@ TreeSocket::TreeSocket(SpanningTreeUtilities* Util, Link* link, Autoconnect* mya
 			SetError("Could not find hook '" + link->Hook + "' for connection to " + linkID);
 			return;
 		}
-		AddIOHook(prov->creator);
+		AddIOHook(static_cast<IOHook*>(prov));
 	}
 	DoConnect(ipaddr, link->Port, link->Timeout, link->Bind);
 	Utils->timeoutlist[this] = std::pair<std::string, int>(linkID, link->Timeout);
diff --git a/src/usermanager.cpp b/src/usermanager.cpp
index c7d9a61a1..8a05c811c 100644
--- a/src/usermanager.cpp
+++ b/src/usermanager.cpp
@@ -23,6 +23,7 @@
 #include "inspircd.h"
 #include "xline.h"
 #include "bancache.h"
+#include "iohook.h"
 
 UserManager::UserManager()
 	: clientlist(new user_hash)