diff -Naur ircd-hybrid-6b119/autoconf/configure.in ircd-hybrid-SSL/autoconf/configure.in
--- ircd-hybrid-6b119/autoconf/configure.in	Mon Aug  9 23:32:14 1999
+++ ircd-hybrid-SSL/autoconf/configure.in	Mon Sep 25 03:45:58 2000
@@ -24,6 +24,8 @@
 AC_CHECK_FUNC(res_mkquery,, AC_CHECK_LIB(resolv, res_mkquery))
 AC_CHECK_LIB(socket, socket)
 AC_CHECK_FUNC(crypt,, AC_CHECK_LIB(descrypt, crypt,,AC_CHECK_LIB(crypt, crypt,,)))
+AC_CHECK_LIB(ssl,SSL_accept,[AC_DEFINE(HAVE_SSL)
+      LIBS="$LIBS -lssl -lcrypto"],,-lcrypto)
 
 dnl Checks for header files.
 AC_HEADER_STDC
diff -Naur ircd-hybrid-6b119/include/client.h ircd-hybrid-SSL/include/client.h
--- ircd-hybrid-6b119/include/client.h	Sat Sep  4 16:21:07 1999
+++ ircd-hybrid-SSL/include/client.h	Mon Sep 25 03:45:58 2000
@@ -254,6 +254,15 @@
    */
   char              passwd[PASSWDLEN + 1];
   int               caps;       /* capabilities bit-field */
+
+  /* SSL support */
+#ifdef HAVE_SSL
+  int	 use_ssl;
+  int	 ssl_hshake_done;
+  struct SSL*     ssl;   /* SSL instance */
+  struct X509*    client_cert;  /* SSL client's certificate */
+#endif
+
 };
 
 /*
diff -Naur ircd-hybrid-6b119/include/s_bsd.h ircd-hybrid-SSL/include/s_bsd.h
--- ircd-hybrid-6b119/include/s_bsd.h	Sat Sep  4 16:21:09 1999
+++ ircd-hybrid-SSL/include/s_bsd.h	Mon Sep 25 03:45:58 2000
@@ -50,6 +50,7 @@
 extern int   read_message (time_t timeout, unsigned char mask);
 extern void  report_error(const char* message, const char* who, int error);
 extern int   set_non_blocking(int fd);
+extern int   set_blocking(int fd);
 extern int   set_sock_buffers(int fd, int size);
 extern int   send_queued(struct Client* client);
 extern int   deliver_it(struct Client* client, const char* buf, int len);
diff -Naur ircd-hybrid-6b119/include/setup.h.in ircd-hybrid-SSL/include/setup.h.in
--- ircd-hybrid-6b119/include/setup.h.in	Mon Aug  9 23:32:15 1999
+++ ircd-hybrid-SSL/include/setup.h.in	Mon Sep 25 03:45:58 2000
@@ -64,3 +64,6 @@
 
 /* Define if you have the socket library (-lsocket).  */
 #undef HAVE_LIBSOCKET
+
+/* Define if you have openssl library (-lssl -lcrypto). */
+#undef HAVE_SSL
diff -Naur ircd-hybrid-6b119/include/ssl.h ircd-hybrid-SSL/include/ssl.h
--- ircd-hybrid-6b119/include/ssl.h	Wed Dec 31 19:00:00 1969
+++ ircd-hybrid-SSL/include/ssl.h	Mon Sep 25 03:45:58 2000
@@ -0,0 +1,26 @@
+#ifndef __struct_ssl__
+#define __struct_ssl__
+
+#ifdef HAVE_SSL
+
+#include <openssl/rsa.h>       /* SSL stuff */
+#include <openssl/crypto.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#include "client.h"
+
+/* Make these what you want for cert & key files */
+#define CERTF  "server.crt"
+#define KEYF  "server.key"
+
+
+extern   SSL_CTX* ctx;
+extern   SSL_METHOD *meth;
+extern   void init_ssl();
+extern   int ssl_handshake(struct Client *);   /* Handshake the accpeted con.*/
+extern   int ssl_client_handshake(struct Client *); /* and the initiated con.*/
+
+#endif
+#endif
diff -Naur ircd-hybrid-6b119/src/client.c ircd-hybrid-SSL/src/client.c
--- ircd-hybrid-6b119/src/client.c	Sun Oct 17 23:31:16 1999
+++ ircd-hybrid-SSL/src/client.c	Mon Sep 25 03:45:58 2000
@@ -126,6 +126,10 @@
       cptr->from  = cptr; /* 'from' of local client is self! */
       cptr->since = cptr->lasttime = cptr->firsttime = CurrentTime;
 
+#ifdef HAVE_SSL
+	  cptr->use_ssl = 1;
+	  cptr->ssl_hshake_done = 0;
+#endif
 #ifdef NULL_POINTER_NOT_ZERO
 #ifdef FLUD
       cptr->fluders   = NULL;
diff -Naur ircd-hybrid-6b119/src/ircd.c ircd-hybrid-SSL/src/ircd.c
--- ircd-hybrid-6b119/src/ircd.c	Tue Dec 28 22:28:48 1999
+++ ircd-hybrid-SSL/src/ircd.c	Mon Sep 25 03:45:58 2000
@@ -24,6 +24,9 @@
 #include "class.h"
 #include "client.h"
 #include "common.h"
+#ifdef HAVE_SSL
+#include "ssl.h"
+#endif
 #include "dline_conf.h"
 #include "fdlist.h"
 #include "hash.h"
@@ -51,6 +54,7 @@
 #include "send.h"
 #include "struct.h"
 #include "whowas.h"
+#include "ssl.h"
 
 #include <stdlib.h>
 #include <string.h>
@@ -813,6 +817,10 @@
   dbuf_init();  /* set up some dbuf stuff to control paging */
   init_hash();
 
+#ifdef HAVE_SSL
+  init_ssl();
+#endif
+
   clear_scache_hash_table();    /* server cache name table */
   clear_ip_hash_table();        /* client host ip hash table */
   clear_Dline_table();          /* d line tree */
diff -Naur ircd-hybrid-6b119/src/s_auth.c ircd-hybrid-SSL/src/s_auth.c
--- ircd-hybrid-6b119/src/s_auth.c	Sat Oct  9 23:43:02 1999
+++ ircd-hybrid-SSL/src/s_auth.c	Mon Sep 25 03:45:59 2000
@@ -40,6 +40,7 @@
 #include "s_stats.h"
 #include "send.h"
 #include "struct.h"
+#include "ssl.h"
 
 #include <netdb.h>               /* struct hostent */
 #include <string.h>
@@ -83,8 +84,13 @@
   REPORT_IP_MISMATCH
 } ReportType;
 
+#ifdef HAVE_SSL
+#define sendheader(c, r) \
+   SSL_write((SSL*)(c)->ssl, HeaderMessages[(r)].message, HeaderMessages[(r)].length)
+#else
 #define sendheader(c, r) \
    send((c)->fd, HeaderMessages[(r)].message, HeaderMessages[(r)].length, 0)
+#endif
 
 struct AuthRequest* AuthPollList = 0; /* GLOBAL - auth queries pending io */
 
diff -Naur ircd-hybrid-6b119/src/s_bsd.c ircd-hybrid-SSL/src/s_bsd.c
--- ircd-hybrid-6b119/src/s_bsd.c	Thu Oct 14 02:14:43 1999
+++ ircd-hybrid-SSL/src/s_bsd.c	Mon Sep 25 03:45:59 2000
@@ -23,6 +23,9 @@
 #include "class.h"
 #include "client.h"
 #include "common.h"
+#ifdef HAVE_SSL
+#include "ssl.h"
+#endif
 #include "config.h"
 #include "fdlist.h"
 #include "irc_string.h"
@@ -252,6 +255,51 @@
   return 1;
 }
 
+#ifdef HAVE_SSL
+
+/*
+ * set_blocking - Set the client connection into non-blocking mode. 
+ * If your system doesn't support this, you're screwed, ircd will run like
+ * crap.
+ * returns true (1) if successful, false (0) otherwise
+ */
+int set_blocking(int fd)
+{
+  /*
+   * NOTE: consult ALL your relevant manual pages *BEFORE* changing
+   * these ioctl's.  There are quite a few variations on them,
+   * as can be seen by the PCS one.  They are *NOT* all the same.
+   * Heed this well. - Avalon.
+   */
+  /* This portion of code might also apply to NeXT.  -LynX */
+#ifdef NBLOCK_SYSV
+  int res = 0;
+
+  if (ioctl(fd, FIONBIO, &res) == -1)
+    return 0;
+
+#else /* !NBLOCK_SYSV */
+  int nonb = 0;
+  int res;
+
+#ifdef NBLOCK_POSIX
+  nonb |= O_NONBLOCK;
+#endif
+#ifdef NBLOCK_BSD
+  nonb |= O_NDELAY;
+#endif
+
+  res = fcntl(fd, F_GETFL, 0);
+  if (!(res&nonb)) return 0;
+  if (-1 == res || fcntl(fd, F_SETFL, res ^ nonb) == -1)
+    return 0;
+#endif /* !NBLOCK_SYSV */
+  return 1;
+}
+
+
+#endif
+
 /*
  * deliver_it
  *      Attempt to send a sequence of bytes to the connection.
@@ -275,7 +323,12 @@
 {
   int   retval;
 
-  retval = send(cptr->fd, str, len, 0);
+#ifdef HAVE_SSL
+  retval = SSL_write((SSL *)cptr->ssl, str, len);
+#else
+  retval = send(cptr->fd, str, len,0);
+#endif
+
   /*
   ** Convert WOULDBLOCK to a return of "0 bytes moved". This
   ** should occur only if socket was non-blocking. Note, that
@@ -370,6 +423,10 @@
   
   SetHandshake(cptr);
 
+#ifdef HAVE_SSL
+  if (!ssl_client_handshake(cptr)) return 0;
+#endif
+
   if (!EmptyString(c_conf->passwd))
     sendto_one(cptr, "PASS %s :TS", c_conf->passwd);
   
@@ -762,10 +819,23 @@
   new_client->listener  = listener;
   ++listener->ref_count;
 
+#ifdef HAVE_SSL
+  ssl_handshake(new_client);
+/*
+  if (!ssl_handshake(new_client)) {
+    ServerStats->is_ref++;
+    close(fd);
+    free(new_client);
+    return;
+  }
+*/
+#endif
+
   if (!set_non_blocking(new_client->fd))
     report_error(NONB_ERROR_MSG, get_client_name(new_client, TRUE), errno);
   if (!disable_sock_options(new_client->fd))
     report_error(OPT_ERROR_MSG, get_client_name(new_client, TRUE), errno);
+
   start_auth(new_client);
 }
 
@@ -830,7 +900,11 @@
 
   if (!(IsPerson(cptr) && DBufLength(&cptr->recvQ) > SBSD_MAX_CLIENT)) {
     errno = 0;
+#ifdef HAVE_SSL
+    length = SSL_read((SSL *)cptr->ssl, readBuf, READBUF_SIZE);
+#else
     length = recv(cptr->fd, readBuf, READBUF_SIZE, 0);
+#endif
     /*
      * If not ready, fake it so it isnt closed
      */
diff -Naur ircd-hybrid-6b119/src/ssl.c ircd-hybrid-SSL/src/ssl.c
--- ircd-hybrid-6b119/src/ssl.c	Wed Dec 31 19:00:00 1969
+++ ircd-hybrid-SSL/src/ssl.c	Mon Sep 25 03:45:59 2000
@@ -0,0 +1,149 @@
+#include "config.h"
+#ifdef HAVE_SSL
+
+#include "ssl.h"
+#include "common.h"
+#include "client.h"
+#include "s_log.h"
+#include "s_bsd.h"
+
+/* The SSL structures */
+SSL_CTX* ctx;
+SSL_METHOD* meth;
+
+void init_ssl() {
+    /* SSL preliminaries. We keep the certificate and key with the context. */
+
+  SSL_load_error_strings();
+  SSLeay_add_ssl_algorithms();
+  meth = SSLv23_server_method();
+  ctx = SSL_CTX_new (meth);
+       if (!ctx)
+         {
+               ERR_print_errors_fp (stderr);
+               exit (2);
+         }
+
+       if (SSL_CTX_use_certificate_file (ctx, CERTF, SSL_FILETYPE_PEM) <= 0)
+         {
+               ERR_print_errors_fp (stderr);
+               exit (3);
+         }
+       if (SSL_CTX_use_PrivateKey_file (ctx, KEYF, SSL_FILETYPE_PEM) <= 0)
+         {
+               ERR_print_errors_fp (stderr);
+               exit (4);
+         }
+
+       if (!SSL_CTX_check_private_key (ctx))
+         {
+               fprintf (stderr, "Private key does not match the certificate public key\n");
+               exit (5);
+         }
+
+}
+
+#define CHK_NULL(x) if ((x)==NULL) {\
+        log(L_NOTICE, "Lost connection to %s:Error in SSL", \
+                     get_client_name(cptr, TRUE)); \
+	return 0;\
+	}
+
+int ssl_handshake(struct Client *cptr) {
+
+  char *str;
+  int err;
+
+      cptr->ssl = (struct SSL*) SSL_new (ctx);
+      CHK_NULL (cptr->ssl);
+      SSL_set_fd ((SSL *)cptr->ssl, cptr->fd);
+      err = SSL_accept ((SSL *)cptr->ssl);
+      if ((err)==-1) {
+        log(L_NOTICE,"Lost connection to %s:Error in SSL_accept()", 
+                     get_client_name(cptr, TRUE));
+        return 0;
+      }
+
+      /* Get the cipher - opt */
+
+      log (L_DEBUG, "SSL connection using %s\n", SSL_get_cipher ((SSL *)cptr->ssl));
+
+      /* Get client's certificate (note: beware of dynamic
+       * allocation) - opt */
+
+      cptr->client_cert = (struct X509*)SSL_get_peer_certificate ((SSL *)cptr->ssl);
+
+      if (cptr->client_cert != NULL)
+      {
+        log (L_DEBUG,"Client certificate:\n");
+
+        str = X509_NAME_oneline (X509_get_subject_name ((X509*)cptr->client_cert), 0, 0);
+        CHK_NULL (str);
+        log (L_DEBUG, "\t subject: %s\n", str);
+        Free (str);
+
+        str = X509_NAME_oneline (X509_get_issuer_name ((X509*)cptr->client_cert), 0, 0);
+        CHK_NULL (str);
+        log (L_DEBUG, "\t issuer: %s\n", str);
+        Free (str);
+
+        /* We could do all sorts of certificate
+         * verification stuff here before
+         *        deallocating the certificate. */
+
+        X509_free ((X509*)cptr->client_cert);
+      }
+      else
+        log (L_DEBUG, "Client does not have certificate.\n");
+
+      return 0;
+
+}
+
+int ssl_client_handshake(struct Client *cptr) {
+
+  char *str;
+  int err;
+
+  cptr->ssl = (struct SSL*)SSL_new (ctx);                         CHK_NULL(cptr->ssl);    
+  SSL_set_fd ((SSL*)cptr->ssl, cptr->fd);
+  set_blocking(cptr->fd);
+  err = SSL_connect ((SSL*)cptr->ssl);                     
+  set_non_blocking(cptr->fd);
+  if ((err)==-1) {
+     log(L_NOTICE,"Could connect to %s:Error in SSL_connect()", 
+                  get_client_name(cptr, TRUE));
+     return 0;
+     }
+    
+  /* Following two steps are optional and not required for
+     data exchange to be successful. */
+  
+  /* Get the cipher - opt */
+  set_blocking(cptr->fd);
+  log (L_NOTICE,"SSL connection using %s\n", SSL_get_cipher ((SSL*)cptr->ssl));
+  
+  /* Get server's certificate (note: beware of dynamic allocation) - opt */
+
+  cptr->client_cert = (struct X509*)SSL_get_peer_certificate ((SSL *)cptr->ssl);
+  set_non_blocking(cptr->fd);
+  CHK_NULL(cptr->client_cert);
+  log (L_NOTICE,"Server certificate:\n");
+  
+  str = X509_NAME_oneline (X509_get_subject_name ((X509*)cptr->client_cert),0,0);
+  CHK_NULL(str);
+  log (L_NOTICE, "\t subject: %s\n", str);
+  Free (str);
+
+  str = X509_NAME_oneline (X509_get_issuer_name  ((X509*)cptr->client_cert),0,0);
+  CHK_NULL(str);
+  log (L_NOTICE, "\t issuer: %s\n", str);
+  Free (str);
+
+  /* We could do all sorts of certificate verification stuff here before
+     deallocating the certificate. */
+
+  X509_free ((X509*)cptr->client_cert);
+  return 1;
+}
+#endif
