diff --git a/include/authd.h b/include/authd.h
index 276d6fa8..03405958 100644
--- a/include/authd.h
+++ b/include/authd.h
@@ -26,11 +26,34 @@
 #ifndef CHARYBDIS_AUTHD_H
 #define CHARYBDIS_AUTHD_H
 
+#include "stdinc.h"
+#include "rb_dictionary.h"
+#include "client.h"
+
+struct blacklist_stats
+{
+	uint8_t iptype;
+	unsigned int hits;
+};
+
 extern rb_helper *authd_helper;
 
+extern rb_dictionary *bl_stats;
+
 void init_authd(void);
+void configure_authd(void);
 void restart_authd(void);
 void rehash_authd(void);
 void check_authd(void);
 
+void authd_initiate_client(struct Client *);
+void authd_decide_client(struct Client *client_p, const char *ident, const char *host, bool accept, char cause, const char *data, const char *reason);
+void authd_abort_client(struct Client *);
+const char *get_provider_string(char cause);
+
+void add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlink_list *filters);
+void del_blacklist(const char *host);
+void del_blacklist_all(void);
+void set_authd_timeout(const char *key, int timeout);
+
 #endif
diff --git a/include/blacklist.h b/include/blacklist.h
deleted file mode 100644
index 7c8fc23e..00000000
--- a/include/blacklist.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- *  charybdis: A slightly useful ircd.
- *  blacklist.h: Manages DNS blacklist entries and lookups
- *
- *  Copyright (C) 2006 charybdis development team
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
- *  USA
- */
-
-#ifndef _BLACKLIST_H_
-#define _BLACKLIST_H_
-
-#include "stdinc.h"
-
-#define BLACKLIST_FILTER_ALL 1
-#define BLACKLIST_FILTER_LAST 2
-
-/* A configured DNSBL */
-struct Blacklist {
-	unsigned int status;	/* If CONF_ILLEGAL, delete when no clients */
-	int refcount;
-	int ipv4;	/* Does this blacklist support IPv4 lookups? */
-	int ipv6;	/* Does this blacklist support IPv6 lookups? */
-	char host[IRCD_RES_HOSTLEN + 1];
-	rb_dlink_list filters;	/* Filters for queries */
-	char reject_reason[BUFSIZE];
-	unsigned int hits;
-	time_t lastwarning;
-};
-
-/* A lookup in progress for a particular DNSBL for a particular client */
-struct BlacklistClient {
-	struct Blacklist *blacklist;
-	struct Client *client_p;
-	uint16_t dns_id;
-	rb_dlink_node node;
-};
-
-/* A blacklist filter */
-struct BlacklistFilter {
-	int type;		/* Type of filter */
-	char filterstr[HOSTIPLEN]; /* The filter itself */
-	rb_dlink_node node;
-};
-
-/* public interfaces */
-struct Blacklist *new_blacklist(char *host, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters);
-void lookup_blacklists(struct Client *client_p);
-void abort_blacklist_queries(struct Client *client_p);
-void unref_blacklist(struct Blacklist *blptr);
-void destroy_blacklists(void);
-
-extern rb_dlink_list blacklist_list;
-
-#endif
diff --git a/include/client.h b/include/client.h
index b9a612bf..ee2c5969 100644
--- a/include/client.h
+++ b/include/client.h
@@ -63,7 +63,6 @@ struct Client;
 struct User;
 struct Server;
 struct LocalUser;
-struct AuthRequest;
 struct PreClient;
 struct ListClient;
 struct scache_entry;
@@ -190,6 +189,7 @@ struct LocalUser
 	/* Send and receive linebuf queues .. */
 	buf_head_t buf_sendq;
 	buf_head_t buf_recvq;
+
 	/*
 	 * we want to use unsigned int here so the sizes have a better chance of
 	 * staying the same on 64 bit machines. The current trend is to use
@@ -199,13 +199,15 @@ struct LocalUser
 	 * performed on these, it's not safe to allow them to become negative,
 	 * which is possible for long running server connections. Unsigned values
 	 * generally overflow gracefully. --Bleep
+	 *
+	 * We have modern conveniences. Let's use uint32_t. --Elizafox
 	 */
-	unsigned int sendM;	/* Statistics: protocol messages send */
-	unsigned int sendK;	/* Statistics: total k-bytes send */
-	unsigned int receiveM;	/* Statistics: protocol messages received */
-	unsigned int receiveK;	/* Statistics: total k-bytes received */
-	unsigned short sendB;	/* counters to count upto 1-k lots of bytes */
-	unsigned short receiveB;	/* sent and received. */
+	uint32_t sendM;		/* Statistics: protocol messages send */
+	uint32_t sendK;		/* Statistics: total k-bytes send */
+	uint32_t receiveM;	/* Statistics: protocol messages received */
+	uint32_t receiveK;	/* Statistics: total k-bytes received */
+	uint16_t sendB;		/* counters to count upto 1-k lots of bytes */
+	uint16_t receiveB;	/* sent and received. */
 	struct Listener *listener;	/* listener accepted from */
 	struct ConfItem *att_conf;	/* attached conf */
 	struct server_conf *att_sconf;
@@ -251,7 +253,6 @@ struct LocalUser
 	int sent_parsed;	/* how many messages we've parsed in this second */
 	time_t last_knock;	/* time of last knock */
 	unsigned long random_ping;
-	struct AuthRequest *auth_request;
 
 	/* target change stuff */
 	/* targets we're aware of (fnv32(use_id(target_p))):
@@ -291,8 +292,12 @@ struct PreClient
 	char spoofuser[USERLEN + 1];
 	char spoofhost[HOSTLEN + 1];
 
-	rb_dlink_list dnsbl_queries; /* list of struct BlacklistClient * */
-	struct Blacklist *dnsbl_listed; /* first dnsbl where it's listed */
+	uint32_t authd_cid;		/* authd id */
+	time_t authd_timeout;		/* When to terminate authd query */
+	bool authd_accepted;		/* did authd accept us? */
+	char authd_cause;		/* rejection cause */
+	char *authd_data;		/* reason data */
+	char *authd_reason;		/* reason we were rejected */
 
 	struct rb_sockaddr_storage lip; /* address of our side of the connection */
 };
@@ -574,8 +579,6 @@ extern int exit_client(struct Client *, struct Client *, struct Client *, const
 
 extern void error_exit_client(struct Client *, int);
 
-
-
 extern void count_local_client_memory(size_t * count, size_t * memory);
 extern void count_remote_client_memory(size_t * count, size_t * memory);
 
@@ -594,7 +597,6 @@ extern int show_ip(struct Client *source_p, struct Client *target_p);
 extern int show_ip_conf(struct ConfItem *aconf, struct Client *source_p);
 extern int show_ip_whowas(struct Whowas *whowas, struct Client *source_p);
 
-extern void initUser(void);
 extern void free_user(struct User *, struct Client *);
 extern struct User *make_user(struct Client *);
 extern struct Server *make_server(struct Client *);
diff --git a/include/s_auth.h b/include/s_auth.h
deleted file mode 100644
index bbc20b7f..00000000
--- a/include/s_auth.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- *  ircd-ratbox: A slightly useful ircd.
- *  s_auth.h: A header for the ident functions.
- *
- *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
- *  Copyright (C) 1996-2002 Hybrid Development Team
- *  Copyright (C) 2002-2004 ircd-ratbox development team
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
- *  USA
- */
-
-#ifndef INCLUDED_s_auth_h
-#define INCLUDED_s_auth_h
-
-struct Client;
-
-extern void start_auth(struct Client *);
-extern void init_auth(void);
-extern void delete_auth_queries(struct Client *);
-
-#endif /* INCLUDED_s_auth_h */
diff --git a/ircd/Makefile.am b/ircd/Makefile.am
index 20370488..b1f6011d 100644
--- a/ircd/Makefile.am
+++ b/ircd/Makefile.am
@@ -21,7 +21,6 @@ endif
 libircd_la_SOURCES =                  \
   authd.c			\
   bandbi.c                      \
-  blacklist.c                   \
   cache.c                       \
   capability.c			\
   channel.c                     \
@@ -53,7 +52,6 @@ libircd_la_SOURCES =                  \
   ratelimit.c			\
   reject.c                      \
   restart.c                     \
-  s_auth.c                      \
   s_conf.c                      \
   s_newconf.c                   \
   s_serv.c                      \
diff --git a/ircd/authd.c b/ircd/authd.c
index 8b453393..cfbbb52f 100644
--- a/ircd/authd.c
+++ b/ircd/authd.c
@@ -22,20 +22,23 @@
  *  USA
  */
 
-#include <stdinc.h>
-#include <rb_lib.h>
-#include <client.h>
-#include <ircd_defs.h>
-#include <parse.h>
-#include <authd.h>
-#include <match.h>
-#include <logger.h>
-#include <s_conf.h>
-#include <client.h>
-#include <send.h>
-#include <numeric.h>
-#include <msg.h>
-#include <dns.h>
+#include "stdinc.h"
+#include "rb_lib.h"
+#include "client.h"
+#include "ircd_defs.h"
+#include "parse.h"
+#include "authd.h"
+#include "match.h"
+#include "logger.h"
+#include "s_conf.h"
+#include "s_stats.h"
+#include "client.h"
+#include "packet.h"
+#include "hash.h"
+#include "send.h"
+#include "numeric.h"
+#include "msg.h"
+#include "dns.h"
 
 static int start_authd(void);
 static void parse_authd_reply(rb_helper * helper);
@@ -44,6 +47,11 @@ static void restart_authd_cb(rb_helper * helper);
 rb_helper *authd_helper;
 static char *authd_path;
 
+uint32_t cid = 1;
+static rb_dictionary *cid_clients;
+
+rb_dictionary *bl_stats;
+
 static int
 start_authd(void)
 {
@@ -77,6 +85,12 @@ start_authd(void)
 		authd_path = rb_strdup(fullpath);
 	}
 
+	if(cid_clients == NULL)
+		cid_clients = rb_dictionary_create("authd cid to uid mapping", rb_uint32cmp);
+
+	if(bl_stats == NULL)
+		bl_stats = rb_dictionary_create("blacklist statistics", strcasecmp);
+
 	authd_helper = rb_helper_start("authd", authd_path, parse_authd_reply, restart_authd_cb);
 
 	if(authd_helper == NULL)
@@ -98,6 +112,9 @@ parse_authd_reply(rb_helper * helper)
 	int parc;
 	char dnsBuf[READBUF_SIZE];
 	char *parv[MAXPARA + 1];
+	long lcid;
+	char *id;
+	struct Client *client_p;
 
 	while((len = rb_helper_read(helper, dnsBuf, sizeof(dnsBuf))) > 0)
 	{
@@ -105,7 +122,75 @@ parse_authd_reply(rb_helper * helper)
 
 		switch (*parv[0])
 		{
-		case 'E':
+		case 'A':	/* Accepted a client */
+			if(parc != 4)
+			{
+				iwarn("authd sent a result with wrong number of arguments: got %d", parc);
+				restart_authd();
+				return;
+			}
+
+			if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX)
+			{
+				iwarn("authd sent us back a bad client ID");
+				restart_authd();
+				return;
+			}
+
+			/* cid to uid (retrieve and delete) */
+			if((id = rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL)
+			{
+				iwarn("authd sent us back an unknown client ID");
+				restart_authd();
+				return;
+			}
+
+			if((client_p = find_id(id)) == NULL)
+			{
+				/* Client vanished... */
+				rb_free(id);
+				return;
+			}
+
+			rb_free(id);
+
+			authd_decide_client(client_p, parv[2], parv[3], true, '\0', NULL, NULL);
+			break;
+		case 'R':	/* Reject client */
+			if(parc != 7)
+			{
+				iwarn("authd sent us a result with wrong number of arguments: got %d", parc);
+				restart_authd();
+				return;
+			}
+
+			if((lcid = strtol(parv[1], NULL, 16)) > UINT32_MAX)
+			{
+				iwarn("authd sent us back a bad client ID");
+				restart_authd();
+				return;
+			}
+
+			/* cid to uid (retrieve and delete) */
+			if((id = rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER((uint32_t)lcid))) == NULL)
+			{
+				iwarn("authd sent us back an unknown client ID");
+				restart_authd();
+				return;
+			}
+
+			if((client_p = find_id(id)) == NULL)
+			{
+				/* Client vanished... */
+				rb_free(id);
+				return;
+			}
+
+			rb_free(id);
+
+			authd_decide_client(client_p, parv[3], parv[4], false, toupper(*parv[2]), parv[5], parv[6]);
+			return;
+		case 'E':	/* DNS Result */
 			if(parc != 5)
 			{
 				ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc);
@@ -114,7 +199,7 @@ parse_authd_reply(rb_helper * helper)
 			}
 			dns_results_callback(parv[1], parv[2], parv[3], parv[4]);
 			break;
-		case 'W':
+		case 'W':	/* Oper warning */
 			if(parc != 3)
 			{
 				ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc);
@@ -124,7 +209,7 @@ parse_authd_reply(rb_helper * helper)
 
 			switch(*parv[2])
 			{
-			case 'D':	/* debug */
+			case 'D':	/* Debug */
 				sendto_realops_snomask(SNO_DEBUG, L_ALL, "authd debug: %s", parv[3]);
 				break;
 			case 'I':	/* Info */
@@ -147,9 +232,9 @@ parse_authd_reply(rb_helper * helper)
 
 			/* NOTREACHED */
 			break;
-		case 'X':
-		case 'Y':
-		case 'Z':
+		case 'X':	/* Stats error */
+		case 'Y':	/* Stats reply */
+		case 'Z':	/* End of stats reply */
 			if(parc < 3)
 			{
 				ilog(L_MAIN, "authd sent a result with wrong number of arguments: got %d", parc);
@@ -190,6 +275,15 @@ init_authd(void)
 	}
 }
 
+void
+configure_authd(void)
+{
+	/* These will do for now */
+	set_authd_timeout("ident_timeout", GlobalSetOptions.ident_timeout);
+	set_authd_timeout("rdns_timeout", ConfigFileEntry.connect_timeout);
+	set_authd_timeout("blacklist_timeout", ConfigFileEntry.connect_timeout);
+}
+
 static void
 restart_authd_cb(rb_helper * helper)
 {
@@ -213,6 +307,7 @@ void
 rehash_authd(void)
 {
 	rb_helper_write(authd_helper, "R");
+	configure_authd();
 }
 
 void
@@ -221,3 +316,202 @@ check_authd(void)
 	if(authd_helper == NULL)
 		restart_authd();
 }
+
+static inline uint32_t
+generate_cid(void)
+{
+	if(++cid == 0)
+		cid = 1;
+
+	return cid;
+}
+
+/* Basically when this is called we begin handing off the client to authd for
+ * processing. authd "owns" the client until processing is finished, or we
+ * timeout from authd. authd will make a decision whether or not to accept the
+ * client, but it's up to other parts of the code (for now) to decide if we're
+ * gonna accept the client and ignore authd's suggestion.
+ *
+ * --Elizafox
+ */
+void
+authd_initiate_client(struct Client *client_p)
+{
+	char client_ipaddr[HOSTIPLEN+1];
+	char listen_ipaddr[HOSTIPLEN+1];
+	uint16_t client_port, listen_port;
+	uint32_t authd_cid;
+
+	if(client_p->preClient == NULL || client_p->preClient->authd_cid == 0)
+		return;
+
+	authd_cid = client_p->preClient->authd_cid = generate_cid();
+
+	/* Collisions are extremely unlikely, so disregard the possibility */
+	rb_dictionary_add(cid_clients, RB_UINT_TO_POINTER(authd_cid), rb_strdup(client_p->id));
+
+	/* Retrieve listener and client IP's */
+	rb_inet_ntop_sock((struct sockaddr *)&client_p->preClient->lip, listen_ipaddr, sizeof(listen_ipaddr));
+	rb_inet_ntop_sock((struct sockaddr *)&client_p->localClient->ip, client_ipaddr, sizeof(client_ipaddr));
+
+	/* Retrieve listener and client ports */
+#ifdef RB_IPV6
+	if(GET_SS_FAMILY(&client_p->preClient->lip) == AF_INET6)
+		listen_port = ntohs(((struct sockaddr_in6 *)&client_p->preClient->lip)->sin6_port);
+	else
+#endif
+		listen_port = ntohs(((struct sockaddr_in *)&client_p->preClient->lip)->sin_port);
+
+#ifdef RB_IPV6
+	if(GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6)
+		client_port = ntohs(((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_port);
+	else
+#endif
+		client_port = ntohs(((struct sockaddr_in *)&client_p->localClient->ip)->sin_port);
+
+	/* FIXME timeout should be configurable */
+	client_p->preClient->authd_timeout = rb_current_time() + 45;
+
+	rb_helper_write(authd_helper, "C %x %s %hu %s %hu", authd_cid, listen_ipaddr, listen_port, client_ipaddr, client_port);
+}
+
+/* When this is called we have a decision on client acceptance.
+ *
+ * After this point authd no longer "owns" the client.
+ */
+void
+authd_decide_client(struct Client *client_p, const char *ident, const char *host, bool accept, char cause, const char *data, const char *reason)
+{
+	if(client_p->preClient == NULL || client_p->preClient->authd_cid == 0)
+		return;
+
+	if(*ident != '*')
+	{
+		rb_strlcpy(client_p->username, ident, sizeof(client_p->username));
+		ServerStats.is_abad++; /* s_auth used to do this, stay compatible */
+	}
+	else
+		ServerStats.is_asuc++;
+
+	if(*host != '*')
+		rb_strlcpy(client_p->host, host, sizeof(client_p->host));
+
+	client_p->preClient->authd_accepted = accept;
+	client_p->preClient->authd_cause = cause;
+	client_p->preClient->authd_data = (data == NULL ? NULL : rb_strdup(data));
+	client_p->preClient->authd_reason = (reason == NULL ? NULL : rb_strdup(reason));
+
+	rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid));
+
+	client_p->preClient->authd_cid = 0;
+
+	/*
+	 * When a client has auth'ed, we want to start reading what it sends
+	 * us. This is what read_packet() does.
+	 *     -- adrian
+	 *
+	 * Above comment was originally in s_auth.c, but moved here with below code.
+	 * --Elizafox
+	 */
+	rb_dlinkAddTail(client_p, &client_p->node, &global_client_list);
+	read_packet(client_p->localClient->F, client_p);
+}
+
+void
+authd_abort_client(struct Client *client_p)
+{
+	if(client_p->preClient == NULL)
+		return;
+
+	if(client_p->preClient->authd_cid == 0)
+		return;
+
+	rb_dictionary_delete(cid_clients, RB_UINT_TO_POINTER(client_p->preClient->authd_cid));
+
+	rb_helper_write(authd_helper, "E %x", client_p->preClient->authd_cid);
+	client_p->preClient->authd_cid = 0;
+}
+
+/* Turn a cause char (who rejected us) into the name of the provider */
+const char *
+get_provider_string(char cause)
+{
+	switch(cause)
+	{
+	case 'B':
+		return "Blacklist";
+	case 'D':
+		return "rDNS";
+	case 'I':
+		return "Ident";
+	default:
+		return "Unknown";
+	}
+}
+
+/* Send a new blacklist to authd */
+void
+add_blacklist(const char *host, const char *reason, uint8_t iptype, rb_dlink_list *filters)
+{
+	rb_dlink_node *ptr;
+	struct blacklist_stats *stats = rb_malloc(sizeof(struct blacklist_stats));
+	char filterbuf[BUFSIZE];
+	size_t s = 0;
+
+	/* Build a list of comma-separated values for authd.
+	 * We don't check for validity - do it elsewhere.
+	 */
+	RB_DLINK_FOREACH(ptr, filters->head)
+	{
+		char *filter = ptr->data;
+		size_t filterlen = strlen(filter) + 1;
+
+		if(s + filterlen > sizeof(filterbuf))
+			break;
+
+		snprintf(&filterbuf[s], sizeof(filterbuf) - s, "%s,", filter);
+
+		s += filterlen;
+	}
+
+	if(s)
+		filterbuf[s - 1] = '\0';
+
+	stats->iptype = iptype;
+	stats->hits = 0;
+	rb_dictionary_add(bl_stats, host, stats);
+
+	rb_helper_write(authd_helper, "O rbl %s %hhu %s :%s", host, iptype, filterbuf, reason);
+}
+
+/* Delete a blacklist */
+void
+del_blacklist(const char *host)
+{
+	rb_dictionary_delete(bl_stats, host);
+
+	rb_helper_write(authd_helper, "O rbl_del %s", host);
+}
+
+/* Delete all the blacklists */
+void
+del_blacklist_all(void)
+{
+	struct blacklist_stats *stats;
+	rb_dictionary_iter iter;
+
+	RB_DICTIONARY_FOREACH(stats, &iter, bl_stats)
+	{
+		rb_free(stats);
+		rb_dictionary_delete(bl_stats, iter.cur->key);
+	}
+
+	rb_helper_write(authd_helper, "O rbl_del_all");
+}
+
+/* Adjust an authd timeout value */
+void
+set_authd_timeout(const char *key, int timeout)
+{
+	rb_helper_write(authd_helper, "O %s %d", key, timeout);
+}
diff --git a/ircd/blacklist.c b/ircd/blacklist.c
deleted file mode 100644
index 47438438..00000000
--- a/ircd/blacklist.c
+++ /dev/null
@@ -1,306 +0,0 @@
-/*
- * charybdis: A slightly useful ircd.
- * blacklist.c: Manages DNS blacklist entries and lookups
- *
- * Copyright (C) 2006-2011 charybdis development team
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- * 1. Redistributions of source code must retain the above copyright notice,
- *    this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "stdinc.h"
-#include "client.h"
-#include "dns.h"
-#include "numeric.h"
-#include "reject.h"
-#include "s_conf.h"
-#include "s_user.h"
-#include "blacklist.h"
-#include "send.h"
-
-rb_dlink_list blacklist_list = { NULL, NULL, 0 };
-
-/* private interfaces */
-static struct Blacklist *find_blacklist(char *name)
-{
-	rb_dlink_node *nptr;
-
-	RB_DLINK_FOREACH(nptr, blacklist_list.head)
-	{
-		struct Blacklist *blptr = (struct Blacklist *) nptr->data;
-
-		if (!irccmp(blptr->host, name))
-			return blptr;
-	}
-
-	return NULL;
-}
-
-static inline int blacklist_check_reply(struct BlacklistClient *blcptr, const char *ipaddr)
-{
-	struct Blacklist *blptr = blcptr->blacklist;
-	const char *lastoctet;
-	rb_dlink_node *ptr;
-
-	/* No filters and entry found - thus positive match */
-	if (!rb_dlink_list_length(&blptr->filters))
-		return 1;
-
-	/* Below will prolly have to change too if the above changes */
-	if ((lastoctet = strrchr(ipaddr, '.')) == NULL || *(++lastoctet) == '\0')
-		goto blwarn;
-
-	RB_DLINK_FOREACH(ptr, blcptr->blacklist->filters.head)
-	{
-		struct BlacklistFilter *filter = ptr->data;
-		const char *cmpstr;
-
-		if (filter->type == BLACKLIST_FILTER_ALL)
-			cmpstr = ipaddr;
-		else if (filter->type == BLACKLIST_FILTER_LAST)
-			cmpstr = lastoctet;
-		else
-		{
-			sendto_realops_snomask(SNO_GENERAL, L_ALL,
-					"blacklist_check_reply(): Unknown filtertype (BUG!)");
-			continue;
-		}
-
-		if (strcmp(cmpstr, filter->filterstr) == 0)
-			/* Match! */
-			return 1;
-	}
-
-	return 0;
-blwarn:
-	if (blcptr->blacklist->lastwarning + 3600 < rb_current_time())
-	{
-		sendto_realops_snomask(SNO_GENERAL, L_ALL,
-				"Garbage reply from blacklist %s",
-				blcptr->blacklist->host);
-		blcptr->blacklist->lastwarning = rb_current_time();
-	}
-	return 0;
-}
-
-static void blacklist_dns_callback(const char *result, int status, int aftype, void *vptr)
-{
-	struct BlacklistClient *blcptr = (struct BlacklistClient *) vptr;
-	bool listed = false;
-
-	if (blcptr == NULL || blcptr->client_p == NULL)
-		return;
-
-	if (blcptr->client_p->preClient == NULL)
-	{
-		sendto_realops_snomask(SNO_GENERAL, L_ALL,
-				"blacklist_dns_callback(): blcptr->client_p->preClient (%s) is NULL", get_client_name(blcptr->client_p, HIDE_IP));
-		rb_free(blcptr);
-		return;
-	}
-
-	if (result != NULL && status)
-	{
-		if (blacklist_check_reply(blcptr, result))
-			listed = true;
-	}
-
-	/* they have a blacklist entry for this client */
-	if (listed && blcptr->client_p->preClient->dnsbl_listed == NULL)
-	{
-		blcptr->client_p->preClient->dnsbl_listed = blcptr->blacklist;
-		/* reference to blacklist moves from blcptr to client_p->preClient... */
-	}
-	else
-		unref_blacklist(blcptr->blacklist);
-
-	rb_dlinkDelete(&blcptr->node, &blcptr->client_p->preClient->dnsbl_queries);
-
-	/* yes, it can probably happen... */
-	if (rb_dlink_list_length(&blcptr->client_p->preClient->dnsbl_queries) == 0 && blcptr->client_p->flags & FLAGS_SENTUSER && !EmptyString(blcptr->client_p->name))
-		register_local_user(blcptr->client_p, blcptr->client_p);
-
-	rb_free(blcptr);
-}
-
-static void initiate_blacklist_dnsquery(struct Blacklist *blptr, struct Client *client_p)
-{
-	struct BlacklistClient *blcptr = rb_malloc(sizeof(struct BlacklistClient));
-	char buf[IRCD_RES_HOSTLEN + 1];
-	uint8_t *ip;
-
-	blcptr->blacklist = blptr;
-	blcptr->client_p = client_p;
-
-	/* IPv4 */
-	if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET) && blptr->ipv4)
-	{
-		ip = (uint8_t *)&((struct sockaddr_in *)&client_p->localClient->ip)->sin_addr.s_addr;
-
-		/* becomes 2.0.0.127.torbl.ahbl.org or whatever */
-		snprintf(buf, sizeof buf, "%d.%d.%d.%d.%s",
-			    (unsigned int) ip[3],
-			    (unsigned int) ip[2],
-			    (unsigned int) ip[1],
-			    (unsigned int) ip[0],
-			    blptr->host);
-	}
-#ifdef RB_IPV6
-	/* IPv6 */
-	else if ((GET_SS_FAMILY(&client_p->localClient->ip) == AF_INET6) && blptr->ipv6)
-	{
-		/* Split up for rDNS lookup
-		 * ex: ip[0] = 0x00, ip[1] = 0x00... ip[16] = 0x01 for localhost
-		 * Giving us:
-		 * 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.foobl.invalid
-		 * or something like that.
-		 */
-		ip = (uint8_t *)&((struct sockaddr_in6 *)&client_p->localClient->ip)->sin6_addr.s6_addr;
-		char *bufptr = buf;
-		int i;
-
-		/* Going backwards */
-		for (i = 15; i >= 0; i--, bufptr += 4)
-		{
-			/* Get upper and lower nibbles */
-			uint8_t hi = (ip[i] >> 4) & 0x0F;
-			uint8_t lo = ip[i] & 0x0F;
-
-			/* One part... 4 chars + terminator */
-			snprintf(bufptr, 5, "%1x.%1x.",
-				    (unsigned int) lo, /* Remember, backwards */
-				    (unsigned int) hi);
-		}
-
-		/* Tack host on */
-		strcpy(bufptr, blptr->host);
-	}
-#endif
-	/* This shouldn't happen... */
-	else
-		return;
-
-	blcptr->dns_id = lookup_hostname(buf, AF_INET, blacklist_dns_callback, blcptr);
-
-	rb_dlinkAdd(blcptr, &blcptr->node, &client_p->preClient->dnsbl_queries);
-	blptr->refcount++;
-}
-
-/* public interfaces */
-struct Blacklist *new_blacklist(char *name, char *reject_reason, int ipv4, int ipv6, rb_dlink_list *filters)
-{
-	struct Blacklist *blptr;
-
-	if (name == NULL || reject_reason == NULL)
-		return NULL;
-
-	blptr = find_blacklist(name);
-	if (blptr == NULL)
-	{
-		blptr = rb_malloc(sizeof(struct Blacklist));
-		rb_dlinkAddAlloc(blptr, &blacklist_list);
-	}
-	else
-		blptr->status &= ~CONF_ILLEGAL;
-
-	rb_strlcpy(blptr->host, name, IRCD_RES_HOSTLEN + 1);
-	rb_strlcpy(blptr->reject_reason, reject_reason, BUFSIZE);
-	blptr->ipv4 = ipv4;
-	blptr->ipv6 = ipv6;
-
-	rb_dlinkMoveList(filters, &blptr->filters);
-
-	blptr->lastwarning = 0;
-
-	return blptr;
-}
-
-void unref_blacklist(struct Blacklist *blptr)
-{
-	rb_dlink_node *ptr, *next_ptr;
-
-	blptr->refcount--;
-	if (blptr->status & CONF_ILLEGAL && blptr->refcount <= 0)
-	{
-		RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blptr->filters.head)
-		{
-			rb_dlinkDelete(ptr, &blptr->filters);
-			rb_free(ptr);
-		}
-
-		rb_dlinkFindDestroy(blptr, &blacklist_list);
-		rb_free(blptr);
-	}
-}
-
-void lookup_blacklists(struct Client *client_p)
-{
-	rb_dlink_node *nptr;
-
-	RB_DLINK_FOREACH(nptr, blacklist_list.head)
-	{
-		struct Blacklist *blptr = (struct Blacklist *) nptr->data;
-
-		if (!(blptr->status & CONF_ILLEGAL))
-			initiate_blacklist_dnsquery(blptr, client_p);
-	}
-}
-
-void abort_blacklist_queries(struct Client *client_p)
-{
-	rb_dlink_node *ptr, *next_ptr;
-	struct BlacklistClient *blcptr;
-
-	if (client_p->preClient == NULL)
-		return;
-	RB_DLINK_FOREACH_SAFE(ptr, next_ptr, client_p->preClient->dnsbl_queries.head)
-	{
-		blcptr = ptr->data;
-		rb_dlinkDelete(&blcptr->node, &client_p->preClient->dnsbl_queries);
-		unref_blacklist(blcptr->blacklist);
-		cancel_lookup(blcptr->dns_id);
-		rb_free(blcptr);
-	}
-}
-
-void destroy_blacklists(void)
-{
-	rb_dlink_node *ptr, *next_ptr;
-	struct Blacklist *blptr;
-
-	RB_DLINK_FOREACH_SAFE(ptr, next_ptr, blacklist_list.head)
-	{
-		blptr = ptr->data;
-		blptr->hits = 0; /* keep it simple and consistent */
-		if (blptr->refcount > 0)
-			blptr->status |= CONF_ILLEGAL;
-		else
-		{
-			rb_free(ptr->data);
-			rb_dlinkDestroy(ptr, &blacklist_list);
-		}
-	}
-}
diff --git a/ircd/client.c b/ircd/client.c
index 268f61b2..86ca8fcc 100644
--- a/ircd/client.c
+++ b/ircd/client.c
@@ -32,7 +32,7 @@
 #include "ircd.h"
 #include "numeric.h"
 #include "packet.h"
-#include "s_auth.h"
+#include "authd.h"
 #include "s_conf.h"
 #include "s_newconf.h"
 #include "logger.h"
@@ -47,7 +47,6 @@
 #include "hook.h"
 #include "msg.h"
 #include "monitor.h"
-#include "blacklist.h"
 #include "reject.h"
 #include "scache.h"
 #include "rb_dictionary.h"
@@ -253,17 +252,15 @@ make_client(struct Client *from)
 void
 free_pre_client(struct Client *client_p)
 {
-	struct Blacklist *blptr;
-
 	s_assert(NULL != client_p);
 
 	if(client_p->preClient == NULL)
 		return;
 
-	blptr = client_p->preClient->dnsbl_listed;
-	if (blptr != NULL)
-		unref_blacklist(blptr);
-	s_assert(rb_dlink_list_length(&client_p->preClient->dnsbl_queries) == 0);
+	s_assert(client_p->preClient->authd_cid == 0);
+
+	rb_free(client_p->preClient->authd_data);
+	rb_free(client_p->preClient->authd_reason);
 
 	rb_bh_free(pclient_heap, client_p->preClient);
 	client_p->preClient = NULL;
@@ -454,9 +451,8 @@ check_unknowns_list(rb_dlink_list * list)
 		if(IsDead(client_p) || IsClosing(client_p))
 			continue;
 
-		/* still has DNSbls to validate against */
-		if(client_p->preClient != NULL &&
-				rb_dlink_list_length(&client_p->preClient->dnsbl_queries) > 0)
+		/* Still querying with authd */
+		if(client_p->preClient != NULL && client_p->preClient->authd_cid != 0)
 			continue;
 
 		/*
@@ -1355,8 +1351,7 @@ static int
 exit_unknown_client(struct Client *client_p, struct Client *source_p, struct Client *from,
 		  const char *comment)
 {
-	delete_auth_queries(source_p);
-	abort_blacklist_queries(source_p);
+	authd_abort_client(client_p);
 	rb_dlinkDelete(&source_p->localClient->tnode, &unknown_list);
 
 	if(!IsIOError(source_p))
diff --git a/ircd/ircd.c b/ircd/ircd.c
index 8a16ffa4..5c576fc8 100644
--- a/ircd/ircd.c
+++ b/ircd/ircd.c
@@ -39,7 +39,6 @@
 #include "numeric.h"
 #include "parse.h"
 #include "restart.h"
-#include "s_auth.h"
 #include "s_conf.h"
 #include "logger.h"
 #include "s_serv.h"		/* try_connections */
@@ -782,7 +781,6 @@ charybdis_main(int argc, char *argv[])
 	load_all_modules(1);
 	load_core_modules(1);
 
-	init_auth();		/* Initialise the auth code */
 	init_authd();		/* Start up authd. */
 	init_dns();		/* Start up DNS query system */
 
@@ -847,6 +845,8 @@ charybdis_main(int argc, char *argv[])
 		return 0;	/* Why? We want the launcher to exit out. */
 	}
 
+	configure_authd();
+
 	me.from = &me;
 	me.servptr = &me;
 	SetMe(&me);
diff --git a/ircd/listener.c b/ircd/listener.c
index aeff94e9..6038a2d8 100644
--- a/ircd/listener.c
+++ b/ircd/listener.c
@@ -34,7 +34,7 @@
 #include "s_newconf.h"
 #include "s_stats.h"
 #include "send.h"
-#include "s_auth.h"
+#include "authd.h"
 #include "reject.h"
 #include "s_conf.h"
 #include "hostmask.h"
@@ -509,7 +509,7 @@ add_connection(struct Listener *listener, rb_fde_t *F, struct sockaddr *sai, str
 
 	++listener->ref_count;
 
-	start_auth(new_client);
+	authd_initiate_client(new_client);
 }
 
 static const char *toofast = "ERROR :Reconnecting too fast, throttled.\r\n";
diff --git a/ircd/newconf.c b/ircd/newconf.c
index 7a726db3..347f0f25 100644
--- a/ircd/newconf.c
+++ b/ircd/newconf.c
@@ -24,7 +24,6 @@
 #include "cache.h"
 #include "ircd.h"
 #include "snomask.h"
-#include "blacklist.h"
 #include "sslproc.h"
 #include "privilege.h"
 #include "chmode.h"
@@ -55,8 +54,7 @@ static struct alias_entry *yy_alias = NULL;
 
 static char *yy_blacklist_host = NULL;
 static char *yy_blacklist_reason = NULL;
-static int yy_blacklist_ipv4 = 1;
-static int yy_blacklist_ipv6 = 0;
+static uint8_t yy_blacklist_iptype = 0;
 static rb_dlink_list yy_blacklist_filters;
 
 static char *yy_privset_extends = NULL;
@@ -1841,6 +1839,9 @@ conf_set_channel_autochanmodes(void *data)
 /* XXX for below */
 static void conf_set_blacklist_reason(void *data);
 
+#define IPTYPE_IPV4 1
+#define IPTYPE_IPV6 2
+
 static void
 conf_set_blacklist_host(void *data)
 {
@@ -1854,8 +1855,7 @@ conf_set_blacklist_host(void *data)
 		return;
 	}
 
-	yy_blacklist_ipv4 = 1;
-	yy_blacklist_ipv6 = 0;
+	yy_blacklist_iptype |= IPTYPE_IPV4;
 	yy_blacklist_host = rb_strdup(data);
 }
 
@@ -1865,25 +1865,24 @@ conf_set_blacklist_type(void *data)
 	conf_parm_t *args = data;
 
 	/* Don't assume we have either if we got here */
-	yy_blacklist_ipv4 = 0;
-	yy_blacklist_ipv6 = 0;
+	yy_blacklist_iptype = 0;
 
 	for (; args; args = args->next)
 	{
 		if (!strcasecmp(args->v.string, "ipv4"))
-			yy_blacklist_ipv4 = 1;
+			yy_blacklist_iptype |= IPTYPE_IPV4;
 		else if (!strcasecmp(args->v.string, "ipv6"))
-			yy_blacklist_ipv6 = 1;
+			yy_blacklist_iptype |= IPTYPE_IPV6;
 		else
 			conf_report_error("blacklist::type has unknown address family %s",
 					  args->v.string);
 	}
 
 	/* If we have neither, just default to IPv4 */
-	if (!yy_blacklist_ipv4 && !yy_blacklist_ipv6)
+	if (!yy_blacklist_iptype)
 	{
 		conf_report_error("blacklist::type has neither IPv4 nor IPv6 (defaulting to IPv4)");
-		yy_blacklist_ipv4 = 1;
+		yy_blacklist_iptype = IPTYPE_IPV4;
 	}
 }
 
@@ -1891,13 +1890,13 @@ static void
 conf_set_blacklist_matches(void *data)
 {
 	conf_parm_t *args = data;
+	enum filter_t { FILTER_NONE, FILTER_ALL, FILTER_LAST };
 
 	for (; args; args = args->next)
 	{
-		struct BlacklistFilter *filter;
 		char *str = args->v.string;
 		char *p;
-		int type = BLACKLIST_FILTER_LAST;
+		enum filter_t type = FILTER_LAST;
 
 		if (CF_TYPE(args->type) != CF_QSTRING)
 		{
@@ -1922,17 +1921,17 @@ conf_set_blacklist_matches(void *data)
 		{
 			/* Check for validity */
 			if (*p == '.')
-				type = BLACKLIST_FILTER_ALL;
-			else if (!isalnum((unsigned char)*p))
+				type = FILTER_ALL;
+			else if (!isdigit((unsigned char)*p))
 			{
 				conf_report_error("blacklist::matches has invalid IP match entry %s",
 						str);
-				type = 0;
+				type = FILTER_NONE;
 				break;
 			}
 		}
 
-		if (type == BLACKLIST_FILTER_ALL)
+		if (type == FILTER_ALL)
 		{
 			/* Basic IP sanity check */
 			struct rb_sockaddr_storage tmp;
@@ -1943,7 +1942,7 @@ conf_set_blacklist_matches(void *data)
 				continue;
 			}
 		}
-		else if (type == BLACKLIST_FILTER_LAST)
+		else if (type == FILTER_LAST)
 		{
 			/* Verify it's the correct length */
 			if (strlen(str) > 3)
@@ -1958,11 +1957,7 @@ conf_set_blacklist_matches(void *data)
 			continue; /* Invalid entry */
 		}
 
-		filter = rb_malloc(sizeof(struct BlacklistFilter));
-		filter->type = type;
-		rb_strlcpy(filter->filterstr, str, sizeof(filter->filterstr));
-
-		rb_dlinkAdd(filter, &filter->node, &yy_blacklist_filters);
+		rb_dlinkAddAlloc(rb_strdup(str), &yy_blacklist_filters);
 	}
 }
 
@@ -1974,7 +1969,7 @@ conf_set_blacklist_reason(void *data)
 	if (yy_blacklist_host && data)
 	{
 		yy_blacklist_reason = rb_strdup(data);
-		if (yy_blacklist_ipv6)
+		if (yy_blacklist_iptype & IPTYPE_IPV4)
 		{
 			/* Make sure things fit (64 = alnum count + dots) */
 			if ((64 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
@@ -1985,7 +1980,7 @@ conf_set_blacklist_reason(void *data)
 			}
 		}
 		/* Avoid doing redundant check, IPv6 is bigger than IPv4 --Elizabeth */
-		if (yy_blacklist_ipv4 && !yy_blacklist_ipv6)
+		if ((yy_blacklist_iptype & IPTYPE_IPV4) && !(yy_blacklist_iptype & IPTYPE_IPV6))
 		{
 			/* Make sure things fit (16 = number of nums + dots) */
 			if ((16 + strlen(yy_blacklist_host)) > IRCD_RES_HOSTLEN)
@@ -1996,30 +1991,23 @@ conf_set_blacklist_reason(void *data)
 			}
 		}
 
-		new_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_ipv4, yy_blacklist_ipv6,
-				&yy_blacklist_filters);
+		add_blacklist(yy_blacklist_host, yy_blacklist_reason, yy_blacklist_iptype, &yy_blacklist_filters);
 	}
 
 cleanup_bl:
-	if (data == NULL)
+	RB_DLINK_FOREACH_SAFE(ptr, nptr, yy_blacklist_filters.head)
 	{
-		RB_DLINK_FOREACH_SAFE(ptr, nptr, yy_blacklist_filters.head)
-		{
-			rb_dlinkDelete(ptr, &yy_blacklist_filters);
-			rb_free(ptr);
-		}
-	}
-	else
-	{
-		yy_blacklist_filters = (rb_dlink_list){ NULL, NULL, 0 };
+		rb_free(ptr->data);
+		rb_dlinkDestroy(ptr, &yy_blacklist_filters);
 	}
 
+	yy_blacklist_filters = (rb_dlink_list){ NULL, NULL, 0 };
+
 	rb_free(yy_blacklist_host);
 	rb_free(yy_blacklist_reason);
 	yy_blacklist_host = NULL;
 	yy_blacklist_reason = NULL;
-	yy_blacklist_ipv4 = 1;
-	yy_blacklist_ipv6 = 0;
+	yy_blacklist_iptype = 0;
 }
 
 /* public functions */
diff --git a/ircd/s_auth.c b/ircd/s_auth.c
deleted file mode 100644
index c30b9e14..00000000
--- a/ircd/s_auth.c
+++ /dev/null
@@ -1,607 +0,0 @@
-/*
- *  ircd-ratbox: A slightly useful ircd.
- *  s_auth.c: Functions for querying a users ident.
- *
- *  Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
- *  Copyright (C) 1996-2002 Hybrid Development Team
- *  Copyright (C) 2002-2005 ircd-ratbox development team
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
- *  USA
- *
- */
-
-/*
- * Changes:
- *   July 6, 1999 - Rewrote most of the code here. When a client connects
- *     to the server and passes initial socket validation checks, it
- *     is owned by this module (auth) which returns it to the rest of the
- *     server when dns and auth queries are finished. Until the client is
- *     released, the server does not know it exists and does not process
- *     any messages from it.
- *     --Bleep  Thomas Helvey <tomh@inxpress.net>
- */
-#include "stdinc.h"
-#include "defaults.h"
-#include "s_auth.h"
-#include "s_conf.h"
-#include "client.h"
-#include "match.h"
-#include "ircd.h"
-#include "numeric.h"
-#include "packet.h"
-#include "dns.h"
-#include "logger.h"
-#include "s_stats.h"
-#include "send.h"
-#include "hook.h"
-#include "blacklist.h"
-#include "s_assert.h"
-
-struct AuthRequest
-{
-	rb_dlink_node node;
-	struct Client *client;	/* pointer to client struct for request */
-	uint16_t dns_id;	/* DNS Query */
-	unsigned int flags;	/* current state of request */
-	rb_fde_t *F;		/* file descriptor for auth queries */
-	time_t timeout;		/* time when query expires */
-	uint16_t lport;
-	uint16_t rport;
-};
-
-/*
- * flag values for AuthRequest
- * NAMESPACE: AM_xxx - Authentication Module
- */
-#define AM_AUTH_CONNECTING   (1 << 0)
-#define AM_AUTH_PENDING      (1 << 1)
-#define AM_DNS_PENDING       (1 << 2)
-
-#define SetDNSPending(x)     ((x)->flags |= AM_DNS_PENDING)
-#define ClearDNSPending(x)   ((x)->flags &= ~AM_DNS_PENDING)
-#define IsDNSPending(x)      ((x)->flags &  AM_DNS_PENDING)
-
-#define SetAuthConnect(x)    ((x)->flags |= AM_AUTH_CONNECTING)
-#define ClearAuthConnect(x)  ((x)->flags &= ~AM_AUTH_CONNECTING)
-#define IsAuthConnect(x)     ((x)->flags &  AM_AUTH_CONNECTING)
-
-#define SetAuthPending(x)    ((x)->flags |= AM_AUTH_PENDING)
-#define ClearAuthPending(x)  ((x)->flags &= AM_AUTH_PENDING)
-#define IsAuthPending(x)     ((x)->flags &  AM_AUTH_PENDING)
-
-#define ClearAuth(x)         ((x)->flags &= ~(AM_AUTH_PENDING | AM_AUTH_CONNECTING))
-#define IsDoingAuth(x)       ((x)->flags &  (AM_AUTH_PENDING | AM_AUTH_CONNECTING))
-
-/*
- * a bit different approach
- * this replaces the original sendheader macros
- */
-
-static const char *HeaderMessages[] =
-{
-	":*** Looking up your hostname...",
-	":*** Found your hostname",
-	":*** Couldn't look up your hostname",
-	":*** Checking Ident",
-	":*** Got Ident response",
-	":*** No Ident response",
-	":*** Your hostname is too long, ignoring hostname",
-	":*** Your forward and reverse DNS do not match, ignoring hostname",
-	":*** Cannot verify hostname validity, ignoring hostname",
-};
-
-typedef enum
-{
-	REPORT_DO_DNS,
-	REPORT_FIN_DNS,
-	REPORT_FAIL_DNS,
-	REPORT_DO_ID,
-	REPORT_FIN_ID,
-	REPORT_FAIL_ID,
-	REPORT_HOST_TOOLONG,
-	REPORT_HOST_MISMATCH,
-	REPORT_HOST_UNKNOWN
-}
-ReportType;
-
-#define sendheader(c, r) sendto_one_notice(c, "%s", HeaderMessages[(r)])
-
-static rb_dlink_list auth_poll_list;
-static rb_bh *auth_heap;
-static EVH timeout_auth_queries_event;
-
-static PF read_auth_reply;
-static CNCB auth_connect_callback;
-
-/*
- * init_auth()
- *
- * Initialise the auth code
- */
-void
-init_auth(void)
-{
-	/* This hook takes a struct Client for its argument */
-	memset(&auth_poll_list, 0, sizeof(auth_poll_list));
-	rb_event_addish("timeout_auth_queries_event", timeout_auth_queries_event, NULL, 1);
-	auth_heap = rb_bh_create(sizeof(struct AuthRequest), LCLIENT_HEAP_SIZE, "auth_heap");
-}
-
-/*
- * make_auth_request - allocate a new auth request
- */
-static struct AuthRequest *
-make_auth_request(struct Client *client)
-{
-	struct AuthRequest *request = rb_bh_alloc(auth_heap);
-	client->localClient->auth_request = request;
-	request->F = NULL;
-	request->client = client;
-	request->timeout = rb_current_time() + ConfigFileEntry.connect_timeout;
-	return request;
-}
-
-/*
- * free_auth_request - cleanup auth request allocations
- */
-static void
-free_auth_request(struct AuthRequest *request)
-{
-	rb_bh_free(auth_heap, request);
-}
-
-/*
- * release_auth_client - release auth client from auth system
- * this adds the client into the local client lists so it can be read by
- * the main io processing loop
- */
-static void
-release_auth_client(struct AuthRequest *auth)
-{
-	struct Client *client = auth->client;
-
-	if(IsDNSPending(auth) || IsDoingAuth(auth))
-		return;
-
-	client->localClient->auth_request = NULL;
-	rb_dlinkDelete(&auth->node, &auth_poll_list);
-	free_auth_request(auth);
-
-	/*
-	 * When a client has auth'ed, we want to start reading what it sends
-	 * us. This is what read_packet() does.
-	 *     -- adrian
-	 */
-	rb_dlinkAddTail(client, &client->node, &global_client_list);
-	read_packet(client->localClient->F, client);
-}
-
-/*
- * auth_dns_callback - called when resolver query finishes
- * if the query resulted in a successful search, hp will contain
- * a non-null pointer, otherwise hp will be null.
- * set the client on it's way to a connection completion, regardless
- * of success of failure
- */
-static void
-auth_dns_callback(const char *result, int status, int aftype, void *vptr)
-{
-        struct AuthRequest *auth = (struct AuthRequest *) vptr;
-        ClearDNSPending(auth);
-
-	/* XXX: this shouldn't happen, but it does. -nenolod */
-	if(auth->client->localClient == NULL)
-	{
-		sendto_realops_snomask(SNO_GENERAL, L_ALL,
-			"auth_dns_callback(): auth->client->localClient (%s) is NULL", get_client_name(auth->client, HIDE_IP));
-
-		rb_dlinkDelete(&auth->node, &auth_poll_list);
-		free_auth_request(auth);
-
-		/* and they will silently drop through and all will hopefully be ok... -nenolod */
-		return;
-	}
-
-        if(result != NULL && status)
-        {
-		int good = 1;
-
-		if(good && strlen(result) <= HOSTLEN)
-		{
-			rb_strlcpy(auth->client->host, result, sizeof(auth->client->host));
-                        sendheader(auth->client, REPORT_FIN_DNS);
-                }
-                else if (strlen(result) > HOSTLEN)
-                        sendheader(auth->client, REPORT_HOST_TOOLONG);
-        }
-	else
-                sendheader(auth->client, REPORT_FAIL_DNS);
-
-        release_auth_client(auth);
-}
-
-/*
- * authsenderr - handle auth send errors
- */
-static void
-auth_error(struct AuthRequest *auth)
-{
-	++ServerStats.is_abad;
-
-	rb_close(auth->F);
-	auth->F = NULL;
-
-	ClearAuth(auth);
-	sendheader(auth->client, REPORT_FAIL_ID);
-
-	release_auth_client(auth);
-}
-
-/*
- * start_auth_query - Flag the client to show that an attempt to
- * contact the ident server on
- * the client's host.  The connect and subsequently the socket are all put
- * into 'non-blocking' mode.  Should the connect or any later phase of the
- * identifing process fail, it is aborted and the user is given a username
- * of "unknown".
- */
-static int
-start_auth_query(struct AuthRequest *auth)
-{
-	struct rb_sockaddr_storage localaddr, destaddr;
-	rb_fde_t *F;
-	int family;
-
-	if(IsAnyDead(auth->client))
-		return 0;
-
-	family = GET_SS_FAMILY(&auth->client->localClient->ip);
-	if((F = rb_socket(family, SOCK_STREAM, 0, "ident")) == NULL)
-	{
-		ilog_error("creating auth stream socket");
-		++ServerStats.is_abad;
-		return 0;
-	}
-
-	/*
-	 * TBD: this is a pointless arbitrary limit .. we either have a socket or not. -nenolod
-	 */
-	if((maxconnections - 10) < rb_get_fd(F))
-	{
-		sendto_realops_snomask(SNO_GENERAL, L_ALL,
-				     "Can't allocate fd for auth on %s",
-				     get_client_name(auth->client, SHOW_IP));
-		rb_close(F);
-		return 0;
-	}
-
-	sendheader(auth->client, REPORT_DO_ID);
-
-	/*
-	 * get the local address of the client and bind to that to
-	 * make the auth request.  This used to be done only for
-	 * ifdef VIRTUAL_HOST, but needs to be done for all clients
-	 * since the ident request must originate from that same address--
-	 * and machines with multiple IP addresses are common now
-	 */
-	localaddr = auth->client->preClient->lip;
-
-	/* XXX mangle_mapped_sockaddr((struct sockaddr *)&localaddr); */
-#ifdef RB_IPV6
-	if(GET_SS_FAMILY(&localaddr) == AF_INET6)
-	{
-		auth->lport = ntohs(((struct sockaddr_in6 *)&localaddr)->sin6_port);
-		((struct sockaddr_in6 *)&localaddr)->sin6_port = 0;
-	}
-	else
-#endif
-	{
-		auth->lport = ntohs(((struct sockaddr_in *)&localaddr)->sin_port);
-		((struct sockaddr_in *)&localaddr)->sin_port = 0;
-	}
-
-	destaddr = auth->client->localClient->ip;
-#ifdef RB_IPV6
-	if(GET_SS_FAMILY(&localaddr) == AF_INET6)
-	{
-		auth->rport = ntohs(((struct sockaddr_in6 *)&destaddr)->sin6_port);
-		((struct sockaddr_in6 *)&destaddr)->sin6_port = htons(113);
-	}
-	else
-#endif
-	{
-		auth->rport = ntohs(((struct sockaddr_in *)&destaddr)->sin_port);
-		((struct sockaddr_in *)&destaddr)->sin_port = htons(113);
-	}
-
-	auth->F = F;
-	SetAuthConnect(auth);
-
-	rb_connect_tcp(F, (struct sockaddr *)&destaddr,
-			 (struct sockaddr *) &localaddr, GET_SS_LEN(&localaddr),
-			 auth_connect_callback, auth,
-			 GlobalSetOptions.ident_timeout);
-	return 1;		/* We suceed here for now */
-}
-
-/*
- * GetValidIdent - parse ident query reply from identd server
- *
- * Inputs        - pointer to ident buf
- * Output        - NULL if no valid ident found, otherwise pointer to name
- * Side effects  -
- */
-static char *
-GetValidIdent(char *buf)
-{
-	int remp = 0;
-	int locp = 0;
-	char *colon1Ptr;
-	char *colon2Ptr;
-	char *colon3Ptr;
-	char *commaPtr;
-	char *remotePortString;
-
-	/* All this to get rid of a sscanf() fun. */
-	remotePortString = buf;
-
-	colon1Ptr = strchr(remotePortString, ':');
-	if(!colon1Ptr)
-		return 0;
-
-	*colon1Ptr = '\0';
-	colon1Ptr++;
-	colon2Ptr = strchr(colon1Ptr, ':');
-	if(!colon2Ptr)
-		return 0;
-
-	*colon2Ptr = '\0';
-	colon2Ptr++;
-	commaPtr = strchr(remotePortString, ',');
-
-	if(!commaPtr)
-		return 0;
-
-	*commaPtr = '\0';
-	commaPtr++;
-
-	remp = atoi(remotePortString);
-	if(!remp)
-		return 0;
-
-	locp = atoi(commaPtr);
-	if(!locp)
-		return 0;
-
-	/* look for USERID bordered by first pair of colons */
-	if(!strstr(colon1Ptr, "USERID"))
-		return 0;
-
-	colon3Ptr = strchr(colon2Ptr, ':');
-	if(!colon3Ptr)
-		return 0;
-
-	*colon3Ptr = '\0';
-	colon3Ptr++;
-	return (colon3Ptr);
-}
-
-/*
- * start_auth - starts auth (identd) and dns queries for a client
- */
-void
-start_auth(struct Client *client)
-{
-	struct AuthRequest *auth = 0;
-	s_assert(0 != client);
-	if(client == NULL)
-		return;
-
-	auth = make_auth_request(client);
-
-	sendheader(client, REPORT_DO_DNS);
-
-	/* No DNS cache now, remember? -- adrian */
-	auth->dns_id = lookup_ip(client->sockhost, GET_SS_FAMILY(&client->localClient->ip), auth_dns_callback, auth);
-
-	SetDNSPending(auth);
-
-	if(ConfigFileEntry.disable_auth == 0)
-		start_auth_query(auth);
-
-	rb_dlinkAdd(auth, &auth->node, &auth_poll_list);
-}
-
-/*
- * timeout_auth_queries - timeout resolver and identd requests
- * allow clients through if requests failed
- */
-static void
-timeout_auth_queries_event(void *notused)
-{
-	rb_dlink_node *ptr;
-	rb_dlink_node *next_ptr;
-	struct AuthRequest *auth;
-
-	RB_DLINK_FOREACH_SAFE(ptr, next_ptr, auth_poll_list.head)
-	{
-		auth = ptr->data;
-
-		if(auth->timeout < rb_current_time())
-		{
-			if(auth->F != NULL)
-				rb_close(auth->F);
-
-			if(IsDoingAuth(auth))
-			{
-				ClearAuth(auth);
-				++ServerStats.is_abad;
-				sendheader(auth->client, REPORT_FAIL_ID);
-				auth->client->localClient->auth_request = NULL;
-			}
-			if(IsDNSPending(auth))
-			{
-				ClearDNSPending(auth);
-				cancel_lookup(auth->dns_id);
-				sendheader(auth->client, REPORT_FAIL_DNS);
-			}
-
-			auth->client->localClient->lasttime = rb_current_time();
-			release_auth_client(auth);
-		}
-	}
-}
-
-/*
- * auth_connect_callback() - deal with the result of rb_connect_tcp()
- *
- * If the connection failed, we simply close the auth fd and report
- * a failure. If the connection suceeded send the ident server a query
- * giving "theirport , ourport". The write is only attempted *once* so
- * it is deemed to be a fail if the entire write doesn't write all the
- * data given.  This shouldnt be a problem since the socket should have
- * a write buffer far greater than this message to store it in should
- * problems arise. -avalon
- */
-static void
-auth_connect_callback(rb_fde_t *F, int error, void *data)
-{
-	struct AuthRequest *auth = data;
-	char authbuf[32];
-	int authlen;
-
-	/* Check the error */
-	if(error != RB_OK)
-	{
-		/* We had an error during connection :( */
-		auth_error(auth);
-		return;
-	}
-
-	snprintf(authbuf, sizeof(authbuf), "%u , %u\r\n",
-		   auth->rport, auth->lport);
-	authlen = strlen(authbuf);
-
-	if(rb_write(auth->F, authbuf, authlen) != authlen)
-	{
-		auth_error(auth);
-		return;
-	}
-	ClearAuthConnect(auth);
-	SetAuthPending(auth);
-	read_auth_reply(auth->F, auth);
-}
-
-
-/*
- * read_auth_reply - read the reply (if any) from the ident server
- * we connected to.
- * We only give it one shot, if the reply isn't good the first time
- * fail the authentication entirely. --Bleep
- */
-#define AUTH_BUFSIZ 128
-
-static void
-read_auth_reply(rb_fde_t *F, void *data)
-{
-	struct AuthRequest *auth = data;
-	char *s = NULL;
-	char *t = NULL;
-	int len;
-	int count;
-	char buf[AUTH_BUFSIZ + 1];	/* buffer to read auth reply into */
-
-	len = rb_read(F, buf, AUTH_BUFSIZ);
-
-	if(len < 0 && rb_ignore_errno(errno))
-	{
-		rb_setselect(F, RB_SELECT_READ, read_auth_reply, auth);
-		return;
-	}
-
-	if(len > 0)
-	{
-		buf[len] = '\0';
-
-		if((s = GetValidIdent(buf)))
-		{
-			t = auth->client->username;
-
-			while (*s == '~' || *s == '^')
-				s++;
-
-			for (count = USERLEN; *s && count; s++)
-			{
-				if(*s == '@')
-				{
-					break;
-				}
-				if(!IsSpace(*s) && *s != ':' && *s != '[')
-				{
-					*t++ = *s;
-					count--;
-				}
-			}
-			*t = '\0';
-		}
-	}
-
-	rb_close(auth->F);
-	auth->F = NULL;
-	ClearAuth(auth);
-
-	if(s == NULL)
-	{
-		++ServerStats.is_abad;
-		strcpy(auth->client->username, "unknown");
-		sendheader(auth->client, REPORT_FAIL_ID);
-	}
-	else
-	{
-		sendheader(auth->client, REPORT_FIN_ID);
-		++ServerStats.is_asuc;
-		SetGotId(auth->client);
-	}
-
-	release_auth_client(auth);
-}
-
-
-
-/*
- * delete_auth_queries()
- */
-void
-delete_auth_queries(struct Client *target_p)
-{
-	struct AuthRequest *auth;
-
-	if(target_p == NULL || target_p->localClient == NULL ||
-	   target_p->localClient->auth_request == NULL)
-		return;
-
-	auth = target_p->localClient->auth_request;
-	target_p->localClient->auth_request = NULL;
-
-	if(IsDNSPending(auth))
-		cancel_lookup(auth->dns_id);
-
-	if(auth->F != NULL)
-		rb_close(auth->F);
-
-	rb_dlinkDelete(&auth->node, &auth_poll_list);
-	free_auth_request(auth);
-}
diff --git a/ircd/s_conf.c b/ircd/s_conf.c
index 87520538..18db1736 100644
--- a/ircd/s_conf.c
+++ b/ircd/s_conf.c
@@ -43,7 +43,6 @@
 #include "send.h"
 #include "reject.h"
 #include "cache.h"
-#include "blacklist.h"
 #include "privilege.h"
 #include "sslproc.h"
 #include "bandbi.h"
@@ -1526,7 +1525,7 @@ clear_out_old_conf(void)
 		alias_dict = NULL;
 	}
 
-	destroy_blacklists();
+	del_blacklist_all();
 
 	privilegeset_mark_all_illegal();
 
diff --git a/ircd/s_user.c b/ircd/s_user.c
index 86a8c7cd..8c8f6796 100644
--- a/ircd/s_user.c
+++ b/ircd/s_user.c
@@ -48,7 +48,6 @@
 #include "hook.h"
 #include "monitor.h"
 #include "snomask.h"
-#include "blacklist.h"
 #include "substitution.h"
 #include "chmode.h"
 #include "s_assert.h"
@@ -252,8 +251,8 @@ register_local_user(struct Client *client_p, struct Client *source_p)
 	if(source_p->flags & FLAGS_CLICAP)
 		return -1;
 
-	/* still has DNSbls to validate against */
-	if(rb_dlink_list_length(&source_p->preClient->dnsbl_queries) > 0)
+	/* Waiting on authd */
+	if(source_p->preClient->authd_cid)
 		return -1;
 
 	client_p->localClient->last = rb_current_time();
@@ -301,7 +300,6 @@ register_local_user(struct Client *client_p, struct Client *source_p)
 		rb_strlcpy(source_p->host, source_p->sockhost, sizeof(source_p->host));
  	}
 
-
 	aconf = source_p->localClient->att_conf;
 
 	if(aconf == NULL)
@@ -421,45 +419,83 @@ register_local_user(struct Client *client_p, struct Client *source_p)
 		return CLIENT_EXITED;
 	}
 
-	/* dnsbl check */
-	if (source_p->preClient->dnsbl_listed != NULL)
+	/* authd rejection check */
+	if(source_p->preClient->authd_accepted == false)
 	{
-		if (IsExemptKline(source_p) || IsConfExemptDNSBL(aconf))
-			sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s, but you are exempt",
-					source_p->sockhost, source_p->preClient->dnsbl_listed->host);
-		else
+		struct blacklist_stats *stats;
+		rb_dlink_list varlist = { NULL, NULL, 0 };
+		char *reason;
+
+		substitution_append_var(&varlist, "nick", source_p->name);
+		substitution_append_var(&varlist, "ip", source_p->sockhost);
+		substitution_append_var(&varlist, "host", source_p->host);
+		substitution_append_var(&varlist, "dnsbl-host", source_p->preClient->authd_data);
+		substitution_append_var(&varlist, "network-name", ServerInfo.network_name);
+		reason = substitution_parse(source_p->preClient->authd_reason, &varlist);
+
+		switch(source_p->preClient->authd_cause)
 		{
-			sendto_realops_snomask(SNO_REJ, L_NETWIDE,
-				"Listed on DNSBL %s: %s (%s@%s) [%s] [%s]",
-				source_p->preClient->dnsbl_listed->host,
-				source_p->name,
-				source_p->username, source_p->host,
-				IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost,
-				source_p->info);
+		case 'B':	/* Blacklists */
+			if((stats = rb_dictionary_retrieve(bl_stats, source_p->preClient->authd_data)) != NULL)
+				stats->hits++;
+			
+			if(IsExemptKline(source_p) || IsConfExemptDNSBL(aconf))
+			{
+				sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s, but you are exempt",
+						source_p->sockhost, source_p->preClient->authd_data);
+			}
+			else
+			{
+				sendto_realops_snomask(SNO_REJ, L_NETWIDE,
+					"Listed on DNSBL %s: %s (%s@%s) [%s] [%s]",
+					source_p->preClient->authd_data,
+					source_p->name,
+					source_p->username, source_p->host,
+					IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost,
+					source_p->info);
 
-			rb_dlink_list varlist = { NULL, NULL, 0 };
+				ServerStats.is_ref++;
 
-			substitution_append_var(&varlist, "nick", source_p->name);
-			substitution_append_var(&varlist, "ip", source_p->sockhost);
-			substitution_append_var(&varlist, "host", source_p->host);
-			substitution_append_var(&varlist, "dnsbl-host", source_p->preClient->dnsbl_listed->host);
-			substitution_append_var(&varlist, "network-name", ServerInfo.network_name);
+				sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP),
+						me.name, source_p->name, reason);
 
-			ServerStats.is_ref++;
+				sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s",
+						source_p->sockhost, source_p->preClient->authd_data);
+				add_reject(source_p, NULL, NULL);
+				exit_client(client_p, source_p, &me, "*** Banned (DNS blacklist)");
+				substitution_free(&varlist);
+				return CLIENT_EXITED;
+			}
+			break;
+		default:	/* Unknown, but handle the case properly */
+			if (IsExemptKline(source_p))
+			{
+				sendto_one_notice(source_p, ":*** You were rejected, but you are exempt (reason: %s)",
+						reason);
+			}
+			else
+			{
+				sendto_realops_snomask(SNO_REJ, L_NETWIDE,
+						"Rejected by authentication system (reason %s): %s (%s@%s) [%s] [%s]",
+						reason, source_p->name, source_p->username, source_p->host,
+						IsIPSpoof(source_p) ? "255.255.255.255" : source_p->sockhost,
+						source_p->info);
 
-			sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP),
-					me.name, source_p->name,
-					substitution_parse(source_p->preClient->dnsbl_listed->reject_reason, &varlist));
+				ServerStats.is_ref++;
 
-			substitution_free(&varlist);
+				sendto_one(source_p, form_str(ERR_YOUREBANNEDCREEP),
+						me.name, source_p->name, reason);
 
-			sendto_one_notice(source_p, ":*** Your IP address %s is listed in %s",
-					source_p->sockhost, source_p->preClient->dnsbl_listed->host);
-			source_p->preClient->dnsbl_listed->hits++;
-			add_reject(source_p, NULL, NULL);
-			exit_client(client_p, source_p, &me, "*** Banned (DNS blacklist)");
-			return CLIENT_EXITED;
+				sendto_one_notice(source_p, ":*** Rejected by authentication system: %s",
+						reason);
+				add_reject(source_p, NULL, NULL);
+				exit_client(client_p, source_p, &me, "*** Banned (authentication system)");
+				substitution_free(&varlist);
+				return CLIENT_EXITED;
+			}
 		}
+
+		substitution_free(&varlist);
 	}
 
 	/* valid user name check */
diff --git a/modules/m_set.c b/modules/m_set.c
index e28b7002..2355ab10 100644
--- a/modules/m_set.c
+++ b/modules/m_set.c
@@ -202,6 +202,7 @@ quote_identtimeout(struct Client *source_p, const char *arg, int newval)
 				     "%s has changed IDENTTIMEOUT to %d",
 				     get_oper_name(source_p), newval);
 		GlobalSetOptions.ident_timeout = newval;
+		set_authd_timeout("ident_timeout", newval);
 	}
 	else
 		sendto_one_notice(source_p, ":IDENTTIMEOUT is currently %d",
diff --git a/modules/m_stats.c b/modules/m_stats.c
index 40082039..afaea433 100644
--- a/modules/m_stats.c
+++ b/modules/m_stats.c
@@ -37,7 +37,6 @@
 #include "s_serv.h"		/* hunt_server */
 #include "s_stats.h"
 #include "s_user.h"		/* show_opers */
-#include "blacklist.h"		/* dnsbl stuff */
 #include "parse.h"
 #include "modules.h"
 #include "hook.h"
@@ -141,51 +140,51 @@ static void stats_capability(struct Client *);
  */
 static struct stats_cmd stats_cmd_table[256] = {
 /*	letter	handler/handler_parv			parv	oper	admin	*/
-	['a'] = { { stats_dns_servers },			false,	true,	true,	},
-	['A'] = { { stats_dns_servers },			false,	true,	true,	},
-	['b'] = { { stats_delay },				false,	true,	true,	},
-	['B'] = { { stats_hash },				false,	true,	true,	},
+	['a'] = { { stats_dns_servers },		false,	true,	true,	},
+	['A'] = { { stats_dns_servers },		false,	true,	true,	},
+	['b'] = { { stats_delay },			false,	true,	true,	},
+	['B'] = { { stats_hash },			false,	true,	true,	},
 	['c'] = { { stats_connect },			false,	false,	false,	},
 	['C'] = { { stats_capability },			false,	true,	false,	},
-	['d'] = { { stats_tdeny },				false,	true,	false,	},
-	['D'] = { { stats_deny },				false,	true,	false,	},
-	['e'] = { { stats_exempt },				false,	true,	false,	},
-	['E'] = { { stats_events },				false,	true,	true,	},
-	['f'] = { { stats_comm },				false,	true,	true,	},
-	['F'] = { { stats_comm },				false,	true,	true,	},
-	['g'] = { { stats_prop_klines },			false,	true,	false,	},
+	['d'] = { { stats_tdeny },			false,	true,	false,	},
+	['D'] = { { stats_deny },			false,	true,	false,	},
+	['e'] = { { stats_exempt },			false,	true,	false,	},
+	['E'] = { { stats_events },			false,	true,	true,	},
+	['f'] = { { stats_comm },			false,	true,	true,	},
+	['F'] = { { stats_comm },			false,	true,	true,	},
+	['g'] = { { stats_prop_klines },		false,	true,	false,	},
 	['h'] = { { stats_hubleaf },			false,	false,	false,	},
 	['H'] = { { stats_hubleaf },			false,	false,	false,	},
-	['i'] = { { stats_auth },				false,	false,	false,	},
-	['I'] = { { stats_auth },				false,	false,	false,	},
+	['i'] = { { stats_auth },			false,	false,	false,	},
+	['I'] = { { stats_auth },			false,	false,	false,	},
 	['k'] = { { stats_tklines },			false,	false,	false,	},
-	['K'] = { { stats_klines },				false,	false,	false,	},
-	['l'] = { { .handler_parv = stats_ltrace },		true,	false,	false,	},
-	['L'] = { { .handler_parv = stats_ltrace },		true,	false,	false,	},
+	['K'] = { { stats_klines },			false,	false,	false,	},
+	['l'] = { { .handler_parv = stats_ltrace },	true,	false,	false,	},
+	['L'] = { { .handler_parv = stats_ltrace },	true,	false,	false,	},
 	['m'] = { { stats_messages },			false,	false,	false,	},
 	['M'] = { { stats_messages },			false,	false,	false,	},
-	['n'] = { { stats_dnsbl },				false,	false,	false,	},
-	['o'] = { { stats_oper },				false,	false,	false,	},
+	['n'] = { { stats_dnsbl },			false,	false,	false,	},
+	['o'] = { { stats_oper },			false,	false,	false,	},
 	['O'] = { { stats_privset },			false,	true,	false,	},
 	['p'] = { { stats_operedup },			false,	false,	false,	},
-	['P'] = { { stats_ports },				false,	false,	false,	},
-	['q'] = { { stats_tresv },				false,	true,	false,	},
-	['Q'] = { { stats_resv },				false,	true,	false,	},
-	['r'] = { { stats_usage },				false,	true,	false,	},
-	['R'] = { { stats_usage },				false,	true,	false,	},
-	['s'] = { { stats_ssld },				false,	true,	true,	},
-	['S'] = { { stats_ssld },				false,	true,	true,	},
-	['t'] = { { stats_tstats },				false,	true,	false,	},
-	['T'] = { { stats_tstats },				false,	true,	false,	},
-	['u'] = { { stats_uptime },				false,	false,	false,	},
-	['U'] = { { stats_shared },				false,	true,	false,	},
+	['P'] = { { stats_ports },			false,	false,	false,	},
+	['q'] = { { stats_tresv },			false,	true,	false,	},
+	['Q'] = { { stats_resv },			false,	true,	false,	},
+	['r'] = { { stats_usage },			false,	true,	false,	},
+	['R'] = { { stats_usage },			false,	true,	false,	},
+	['s'] = { { stats_ssld },			false,	true,	true,	},
+	['S'] = { { stats_ssld },			false,	true,	true,	},
+	['t'] = { { stats_tstats },			false,	true,	false,	},
+	['T'] = { { stats_tstats },			false,	true,	false,	},
+	['u'] = { { stats_uptime },			false,	false,	false,	},
+	['U'] = { { stats_shared },			false,	true,	false,	},
 	['v'] = { { stats_servers },			false,	false,	false,	},
 	['V'] = { { stats_servers },			false,	false,	false,	},
-	['x'] = { { stats_tgecos },				false,	true,	false,	},
-	['X'] = { { stats_gecos },				false,	true,	false,	},
-	['y'] = { { stats_class },				false,	false,	false,	},
-	['Y'] = { { stats_class },				false,	false,	false,	},
-	['z'] = { { stats_memory },				false,	true,	false,	},
+	['x'] = { { stats_tgecos },			false,	true,	false,	},
+	['X'] = { { stats_gecos },			false,	true,	false,	},
+	['y'] = { { stats_class },			false,	false,	false,	},
+	['Y'] = { { stats_class },			false,	false,	false,	},
+	['z'] = { { stats_memory },			false,	true,	false,	},
 	['Z'] = { { stats_ziplinks },			false,	true,	false,	},
 	['?'] = { { stats_servlinks },			false,	false,	false,	},
 };
@@ -758,19 +757,14 @@ stats_messages(struct Client *source_p)
 static void
 stats_dnsbl(struct Client *source_p)
 {
-	rb_dlink_node *ptr;
-	struct Blacklist *blptr;
+	rb_dictionary_iter iter;
+	struct blacklist_stats *stats;
 
-	RB_DLINK_FOREACH(ptr, blacklist_list.head)
+	RB_DICTIONARY_FOREACH(stats, &iter, bl_stats)
 	{
-		blptr = ptr->data;
-
 		/* use RPL_STATSDEBUG for now -- jilles */
-		sendto_one_numeric(source_p, RPL_STATSDEBUG, "n :%d %s %s (%d)",
-				blptr->hits,
-				blptr->host,
-				blptr->status & CONF_ILLEGAL ? "disabled" : "active",
-				blptr->refcount);
+		sendto_one_numeric(source_p, RPL_STATSDEBUG, "n :%d %s",
+				stats->hits, (const char *)iter.cur->key);
 	}
 }
 
diff --git a/modules/m_user.c b/modules/m_user.c
index cd8c7c13..d0360039 100644
--- a/modules/m_user.c
+++ b/modules/m_user.c
@@ -33,7 +33,6 @@
 #include "msg.h"
 #include "parse.h"
 #include "modules.h"
-#include "blacklist.h"
 #include "s_assert.h"
 
 static const char user_desc[] =
@@ -92,7 +91,6 @@ do_local_user(struct Client *client_p, struct Client *source_p,
 
 	make_user(source_p);
 
-	lookup_blacklists(source_p);
 	source_p->flags |= FLAGS_SENTUSER;
 
 	rb_strlcpy(source_p->info, realname, sizeof(source_p->info));