diff --git a/.travis.yml b/.travis.yml
index eb5d0d43..df5cfa31 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,25 +18,25 @@ matrix:
       compiler: gcc-7
       addons:
         apt:
-          packages: ['gcc-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
+          packages: ['gcc-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
 
     - os: linux
       compiler: gcc-8
       addons:
         apt:
-          packages: ['gcc-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
+          packages: ['gcc-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
 
     - os: linux
       compiler: clang-7
       addons:
         apt:
-          packages: ['clang-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
+          packages: ['clang-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
 
     - os: linux
       compiler: clang-8
       addons:
         apt:
-          packages: ['clang-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
+          packages: ['clang-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
 
     - os: osx
       osx_image: xcode7.3
diff --git a/configure.ac b/configure.ac
index d62e5c42..1281422c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -320,6 +320,28 @@ dnl End OpenSSL detection
 dnl Specialized functions and libraries
 dnl ===================================
 
+AC_ARG_ENABLE(hyperscan,
+AC_HELP_STRING([--disable-hyperscan],[Disable hyperscan support]),
+[hyperscan=$enableval],[hyperscan=yes])
+
+AS_IF([test "$hyperscan" = yes], [
+	save_CPPFLAGS="$CPPFLAGS"
+	save_LIBS="$LIBS"
+	PKG_CHECK_MODULES([HS], [libhs >= 4], [], [hyperscan=no])
+	CPPFLAGS="$CPPFLAGS $HS_CFLAGS"
+	LIBS="$LIBS $HS_LIBS"
+	AC_CHECK_HEADER([hs_common.h], [], [hyperscan=no])
+	AC_CHECK_FUNC([hs_scan], [], [hyperscan=no])
+])
+
+AS_IF([test "$hyperscan" = no], [
+	CPPFLAGS="$save_CPPFLAGS"
+	LIBS="$save_LIBS"
+])
+
+AM_CONDITIONAL([HAVE_HYPERSCAN], [test "$hyperscan" = "yes"])
+
+
 AC_ARG_WITH(zlib-path,
 AC_HELP_STRING([--with-zlib-path=DIR],[Path to libz.so for ziplinks support.]),
 [LIBS="$LIBS -L$withval"],)
diff --git a/extensions/Makefile.am b/extensions/Makefile.am
index 702ecb0e..ab10383f 100644
--- a/extensions/Makefile.am
+++ b/extensions/Makefile.am
@@ -77,3 +77,7 @@ extension_LTLIBRARIES =		\
   spy_trace_notice.la		\
   drain.la			\
   example_module.la
+
+if HAVE_HYPERSCAN
+    extension_LTLIBRARIES += filter.la
+endif
diff --git a/extensions/filter.c b/extensions/filter.c
new file mode 100644
index 00000000..36c3e288
--- /dev/null
+++ b/extensions/filter.c
@@ -0,0 +1,467 @@
+/*
+ *  ircd-ratbox: A slightly useful ircd.
+ *  filter.c: Drop messages we don't like
+ *
+ *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
+ *  Copyright (C) 1996-2002 Hybrid Development Team
+ *  Copyright (C) 2002-2005 ircd-ratbox development team
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
+ *  USA
+ *
+ *  $Id$
+ */
+
+#include "stdinc.h"
+#include "channel.h"
+#include "client.h"
+#include "chmode.h"
+#include "match.h"
+#include "ircd.h"
+#include "numeric.h"
+#include "send.h"
+#include "s_newconf.h"
+#include "s_serv.h"
+#include "s_user.h"
+#include "msg.h"
+#include "parse.h"
+#include "modules.h"
+#include "operhash.h"
+#include "inline/stringops.h"
+#include "msgbuf.h"
+
+#include <hs_common.h>
+#include <hs_runtime.h>
+
+#define FILTER_NICK     0
+#define FILTER_USER     0
+#define FILTER_HOST     0
+
+#define FILTER_EXIT_MSG "Connection closed"
+
+static const char filter_desc[] = "Filter messages using a precompiled Hyperscan database";
+
+static void filter_msg_user(void *data);
+static void filter_msg_channel(void *data);
+static void on_client_exit(void *data);
+
+static void mo_setfilter(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
+static void me_setfilter(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
+
+static char *filter_data = NULL;
+static size_t filter_data_len = 0;
+static hs_database_t *filter_db;
+static hs_scratch_t *filter_scratch;
+
+static int filter_enable = 1;
+
+static const char *cmdname[MESSAGE_TYPE_COUNT] = {
+	[MESSAGE_TYPE_PRIVMSG] = "PRIVMSG",
+	[MESSAGE_TYPE_NOTICE] = "NOTICE",
+};
+
+enum filter_state {
+	FILTER_EMPTY,
+	FILTER_FILLING,
+	FILTER_LOADED
+};
+
+#define ACT_DROP  (1 << 0)
+#define ACT_KILL  (1 << 1)
+#define ACT_ALARM (1 << 2)
+
+static enum filter_state state = FILTER_EMPTY;
+static char check_str[21] = "";
+
+static unsigned filter_chmode, filter_umode;
+
+mapi_hfn_list_av1 filter_hfnlist[] = {
+	{ "privmsg_user", (hookfn) filter_msg_user },
+	{ "privmsg_channel", (hookfn) filter_msg_channel },
+	{ "client_exit", (hookfn) on_client_exit },
+	{ NULL, NULL }
+};
+
+
+struct Message setfilter_msgtab = {
+	"SETFILTER", 0, 0, 0, 0,
+	{mg_unreg, mg_not_oper, mg_ignore, mg_ignore, {me_setfilter, 2}, {mo_setfilter, 2}}
+};
+
+static int
+modinit(void)
+{
+	filter_umode = user_modes['u'] = find_umode_slot();
+	construct_umodebuf();
+	filter_chmode = cflag_add('u', chm_simple);
+	return 0;
+}
+
+static void
+moddeinit(void)
+{
+	if (filter_umode) {
+		user_modes['u'] = 0;
+		construct_umodebuf();
+	}
+	if (filter_chmode)
+		cflag_orphan('u');
+	if (filter_scratch)
+		hs_free_scratch(filter_scratch);
+	if (filter_db)
+		hs_free_database(filter_db);
+	if (filter_data)
+		rb_free(filter_data);
+}
+
+
+mapi_clist_av1 filter_clist[] = { &setfilter_msgtab, NULL };
+
+DECLARE_MODULE_AV2(filter, modinit, moddeinit, filter_clist, NULL, filter_hfnlist, NULL, "0.4", filter_desc);
+
+static int
+setfilter(const char *check, const char *data, const char **error)
+{
+	if (error) *error = "unknown";
+
+	if (!strcasecmp(data, "disable")) {
+		filter_enable = 0;
+		sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
+			"Filtering disabled.");
+		return 0;
+	}
+	if (!strcasecmp(data, "enable")) {
+		filter_enable = 1;
+		sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
+			"Filtering enabled.");
+		return 0;
+	}
+
+	if (strlen(check) > sizeof check_str - 1) {
+		if (error) *error = "check string too long";
+		return -1;
+	}
+
+	if (!strcasecmp(data, "new")) {
+		if (state == FILTER_FILLING) {
+			rb_free(filter_data);
+			filter_data = 0;
+			filter_data_len = 0;
+		}
+		state = FILTER_FILLING;
+		strcpy(check_str, check);
+		return 0;
+	}
+
+	if (!strcasecmp(data, "drop")) {
+		if (!filter_db) {
+			if (error) *error = "no database to drop";
+			return -1;
+		}
+		hs_free_database(filter_db);
+		filter_db = 0;
+		return 0;
+	}
+
+	if (!strcasecmp(data, "abort")) {
+		if (state != FILTER_FILLING) {
+			if (error) *error = "not filling";
+			return -1;
+		}
+		state = filter_db ? FILTER_LOADED : FILTER_EMPTY;
+		rb_free(filter_data);
+		filter_data = 0;
+		filter_data_len = 0;
+		return 0;
+	}
+
+	if (strcmp(check, check_str) != 0) {
+		if (error) *error = "check strings don't match";
+		return -1;
+	}
+
+	if (!strcasecmp(data, "apply")) {
+		if (state != FILTER_FILLING) {
+			if (error) *error = "not loading anything";
+			return -1;
+		}
+		hs_database_t *db;
+		hs_error_t r = hs_deserialize_database(filter_data, filter_data_len, &db);
+		if (r != HS_SUCCESS) {
+			if (error) *error = "couldn't deserialize db";
+			return -1;
+		}
+		r = hs_alloc_scratch(db, &filter_scratch);
+		if (r != HS_SUCCESS) {
+			if (error) *error = "couldn't allocate scratch";
+			hs_free_database(db);
+			return -1;
+		}
+		if (filter_db) {
+			hs_free_database(filter_db);
+		}
+		state = FILTER_LOADED;
+		filter_db = db;
+		sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
+			"New filters loaded.");
+		rb_free(filter_data);
+		filter_data = 0;
+		filter_data_len = 0;
+		return 0;
+	}
+
+	if (*data != '+') {
+		if (error) *error = "unknown command or data doesn't start with +";
+		return -1;
+	}
+
+	data += 1;
+
+	if (state == FILTER_FILLING) {
+		int dl;
+		unsigned char *d = rb_base64_decode((unsigned char *)data, strlen(data), &dl);
+		if (!d) {
+			if (error) *error = "invalid data";
+			return -1;
+		}
+		if (filter_data_len + dl > 10000000ul) {
+			if (error) *error = "data over size limit";
+			rb_free(d);
+			return -1;
+		}
+		filter_data = rb_realloc(filter_data, filter_data_len + dl);
+		memcpy(filter_data + filter_data_len, d, dl);
+		rb_free(d);
+		filter_data_len += dl;
+	} else {
+		if (error) *error = "send \"new\" first";
+		return -1;
+	}
+	return 0;
+}
+
+/* /SETFILTER [server-mask] <check> { NEW | APPLY | <data> }
+ * <check> must be the same for the entirety of a new...data...apply run,
+ *   and exists just to ensure runs don't mix
+ * NEW prepares a buffer to receive a hyperscan database
+ * <data> is base64 encoded chunks of hyperscan database, which are decoded
+ *   and appended to the buffer
+ * APPLY deserialises the buffer and sets the resulting hyperscan database
+ *   as the one to use for filtering */
+static void
+mo_setfilter(struct MsgBuf *msgbuf, struct Client *client_p, struct Client *source_p, int parc, const char **parv)
+{
+	int for_me = 0;
+	const char *check;
+	const char *data;
+	if (!IsOperAdmin(source_p)) {
+		sendto_one(source_p, form_str(ERR_NOPRIVS), me.name, source_p->name, "admin");
+		return;
+	}
+	if (parc == 4) {
+		check = parv[2];
+		data = parv[3];
+		if(match(parv[1], me.name)) {
+			for_me = 1;
+		}
+		sendto_match_servs(source_p, parv[1],
+			CAP_ENCAP, NOCAPS,
+			"ENCAP %s SETFILTER %s :%s", parv[1], check, data);
+	} else if (parc == 3) {
+		check = parv[1];
+		data = parv[2];
+		for_me = 1;
+	} else {
+		sendto_one_notice(source_p, ":SETFILTER needs 2 or 3 params, have %d", parc - 1);
+		return;
+	}
+	if (for_me) {
+		const char *error;
+		int r = setfilter(check, data, &error);
+		if (r) {
+			sendto_one_notice(source_p, ":SETFILTER failed: %s", error);
+		} else {
+			sendto_one_notice(source_p, ":SETFILTER ok");
+		}
+	}
+}
+
+static void
+me_setfilter(struct MsgBuf *msgbuf, struct Client *client_p, struct Client *source_p, int parc, const char **parv)
+{
+	if(!IsPerson(source_p))
+		return;
+
+	const char *error;
+	int r = setfilter(parv[1], parv[2], &error);
+	if (r) {
+		sendto_one_notice(source_p, ":SETFILTER failed: %s", error);
+	}
+
+	return;
+}
+
+/* will be called for every match
+ * hyperscan provides us one piece of information about the expression
+ * matched, an integer ID. we're co-opting the lowest 3 bits of this
+ * as a flag set. conveniently, this means all we really need to do
+ * here is or the IDs together. */
+int match_callback(unsigned id,
+                   unsigned long long from,
+                   unsigned long long to,
+                   unsigned flags,
+                   void *context_)
+{
+	unsigned *context = context_;
+	*context |= id;
+	return 0;
+}
+
+static char check_buffer[2000];
+static char clean_buffer[BUFSIZE];
+
+unsigned match_message(const char *prefix,
+                       struct Client *source,
+                       const char *command,
+                       const char *target,
+                       const char *msg)
+{
+	unsigned state = 0;
+	if (!filter_enable)
+		return 0;
+	if (!filter_db)
+		return 0;
+	snprintf(check_buffer, sizeof check_buffer, "%s:%s!%s@%s#%c %s %s :%s",
+	         prefix,
+#if FILTER_NICK
+	         source->name,
+#else
+	         "*",
+#endif
+#if FILTER_USER
+	         source->username,
+#else
+	         "*",
+#endif
+#if FILTER_HOST
+	         source->host,
+#else
+	         "*",
+#endif
+	         source->user && source->user->suser[0] != '\0' ? '1' : '0',
+	         command, target,
+	         msg);
+	hs_error_t r = hs_scan(filter_db, check_buffer, strlen(check_buffer), 0, filter_scratch, match_callback, &state);
+	if (r != HS_SUCCESS && r != HS_SCAN_TERMINATED)
+		return 0;
+	return state;
+}
+
+void
+filter_msg_user(void *data_)
+{
+	hook_data_privmsg_user *data = data_;
+	struct Client *s = data->source_p;
+	/* we only need to filter once */
+	if (!MyClient(s)) {
+		return;
+	}
+	/* opers are immune to checking, for obvious reasons
+	 * anything sent to an oper is also immune, because that should make it
+	 * less impossible to deal with reports. */
+	if (IsOper(s) || IsOper(data->target_p)) {
+		return;
+	}
+	if (data->target_p->umodes & filter_umode) {
+		return;
+	}
+	char *text = strcpy(clean_buffer, data->text);
+	strip_colour(text);
+	strip_unprintable(text);
+	unsigned r = match_message("0", s, cmdname[data->msgtype], "0", data->text) |
+	             match_message("1", s, cmdname[data->msgtype], "0", text);
+	if (r & ACT_DROP) {
+		if (data->msgtype == MESSAGE_TYPE_PRIVMSG) {
+			sendto_one_numeric(s, ERR_CANNOTSENDTOCHAN,
+			                   form_str(ERR_CANNOTSENDTOCHAN),
+			                   data->target_p->name);
+		}
+		data->approved = 1;
+	}
+	if (r & ACT_ALARM) {
+		sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
+			"FILTER: %s!%s@%s [%s]",
+			s->name, s->username, s->host, s->sockhost);
+	}
+	if (r & ACT_KILL) {
+		data->approved = 1;
+		exit_client(NULL, s, s, FILTER_EXIT_MSG);
+	}
+}
+
+void
+filter_msg_channel(void *data_)
+{
+	hook_data_privmsg_channel *data = data_;
+	struct Client *s = data->source_p;
+	/* we only need to filter once */
+	if (!MyClient(s)) {
+		return;
+	}
+	/* just normal oper immunity for channels. i'd like to have a mode that
+	 * disables the filter per-channel, but that's for the future */
+	if (IsOper(s)) {
+		return;
+	}
+	if (data->chptr->mode.mode & filter_chmode) {
+		return;
+	}
+	char *text = strcpy(clean_buffer, data->text);
+	strip_colour(text);
+	strip_unprintable(text);
+	unsigned r = match_message("0", s, cmdname[data->msgtype], data->chptr->chname, data->text) |
+	             match_message("1", s, cmdname[data->msgtype], data->chptr->chname, text);
+	if (r & ACT_DROP) {
+		if (data->msgtype == MESSAGE_TYPE_PRIVMSG) {
+			sendto_one_numeric(s, ERR_CANNOTSENDTOCHAN,
+			                   form_str(ERR_CANNOTSENDTOCHAN),
+			                   data->chptr->chname);
+		}
+		data->approved = 1;
+	}
+	if (r & ACT_ALARM) {
+		sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
+			"FILTER: %s!%s@%s [%s]",
+			s->name, s->username, s->host, s->sockhost);
+	}
+	if (r & ACT_KILL) {
+		data->approved = 1;
+		exit_client(NULL, s, s, FILTER_EXIT_MSG);
+	}
+}
+
+void
+on_client_exit(void *data_)
+{
+	/* If we see a netsplit, abort the current FILTER_FILLING attempt */
+	hook_data_client_exit *data = data_;
+
+	if (!IsServer(data->target)) return;
+
+	if (state == FILTER_FILLING) {
+		state = filter_db ? FILTER_LOADED : FILTER_EMPTY;
+	}
+}
+
diff --git a/include/messages.h b/include/messages.h
index f772b392..d37bf327 100644
--- a/include/messages.h
+++ b/include/messages.h
@@ -143,7 +143,7 @@
 #define NUMERIC_STR_401      "%s :No such nick/channel"
 #define NUMERIC_STR_402      "%s :No such server"
 #define NUMERIC_STR_403      "%s :No such channel"
-#define NUMERIC_STR_404      "%s :Cannot send to channel"
+#define NUMERIC_STR_404      "%s :Cannot send to nick/channel"
 #define NUMERIC_STR_405      ":%s 405 %s %s :You have joined too many channels"
 #define NUMERIC_STR_406      ":%s :There was no such nickname"
 #define NUMERIC_STR_407      ":%s 407 %s %s :Too many recipients."