diff -urdb doc/example.conf ircu2.10.11.06/doc/example.conf
--- doc/example.conf	Wed Jan 28 22:28:05 2004
+++ doc/example.conf	Wed Jan 28 23:20:26 2004
@@ -365,6 +365,30 @@
 # Y:10:90:0:100:160000
 
 
+# [S:lines]
+# Opers may wish to hide their IP mask and hostname, even if they are on
+# a bnc. This can prevent the risk of opers or their providers getting
+# dos'd or whatever the case may be.
+#
+# When a client connects, his or her IP is compared to the incoming_IP in 
+# each of the S:lines in the conf. If it finds an exact match (NOT a mask 
+# match, but a simple comparison), it will substitute the client's ip with 
+# modified_IP and the client's real hostname with modified_hostname (as 
+# shown below).
+#
+# Syntax:
+# S:<incoming_IP>:<modified_IP>:<modifed_hostname>
+#
+# Example:
+# S:193.178.138.13:192.168.128.1:undernet.org
+#
+# If a user connects to the server with the IP 193.178.138.13, it is
+# automatically changed to 192.168.128.1 and the user's host is set to
+# undernet.org.
+#
+# If no modified_IP is provided, only the host is modified.
+
+
 # [P:lines]
 # When your server gets more full, you will notice delays when trying to
 # connect to your server's primary listening port. It is possible via the
diff -urdb include/client.h ircu2.10.11.06/include/client.h
--- include/client.h	Wed Jan 28 22:28:05 2004
+++ include/client.h	Wed Jan 28 23:20:26 2004
@@ -127,6 +127,7 @@
     FLAG_GOTID,                     /* successful ident lookup achieved */
     FLAG_DOID,                      /* I-lines say must use ident return */
     FLAG_NONL,                      /* No \n in buffer */
+    FLAG_SLINE,                     /* User is S-lined */
     FLAG_TS8,                       /* Why do you want to know? */
     FLAG_MAP,                       /* Show server on the map */
     FLAG_JUNCTION,                  /* Junction causing the net.burst */
@@ -429,6 +430,7 @@
 #define IsAccount(x)            HasFlag(x, FLAG_ACCOUNT)
 #define IsHiddenHost(x)		HasFlag(x, FLAG_HIDDENHOST)
 #define HasHiddenHost(x)	(IsAccount(x) && IsHiddenHost(x))
+#define HasSLine(x)             HasFlag(x, FLAG_SLINE)
 
 #define IsPrivileged(x)         (IsAnOper(x) || IsServer(x))
 
@@ -451,6 +453,7 @@
 #define SetService(x)           SetFlag(x, FLAG_SERVICE)
 #define SetAccount(x)           SetFlag(x, FLAG_ACCOUNT)
 #define SetHiddenHost(x)	SetFlag(x, FLAG_HIDDENHOST)
+#define SetSLined(x)            SetFlag(x, FLAG_SLINE)
 
 #define ClearAccess(x)          ClrFlag(x, FLAG_CHKACCESS)
 #define ClearBurst(x)           ClrFlag(x, FLAG_BURST)
diff -urdb include/s_conf.h ircu2.10.11.06/include/s_conf.h
--- include/s_conf.h	Wed Jan 28 22:28:05 2004
+++ include/s_conf.h	Wed Jan 28 23:20:26 2004
@@ -33,6 +33,7 @@
 
 #define CONF_ILLEGAL            0x80000000
 #define CONF_MATCH              0x40000000
+#define CONF_SPOOF              0x20000000
 #define CONF_CLIENT             0x0002
 #define CONF_SERVER             0x0004
 #define CONF_LOCOP              0x0010
diff -urdb ircd/s_auth.c ircu2.10.11.06/ircd/s_auth.c
--- ircd/s_auth.c	Wed Jan 28 22:28:05 2004
+++ ircd/s_auth.c	Wed Jan 28 23:20:26 2004
@@ -46,6 +46,7 @@
 #include "querycmds.h"
 #include "res.h"
 #include "s_bsd.h"
+#include "s_conf.h"
 #include "s_debug.h"
 #include "s_misc.h"
 #include "send.h"
@@ -82,6 +83,7 @@
   { "NOTICE AUTH :*** No ident response\r\n",              36 },
   { "NOTICE AUTH :*** Your forward and reverse DNS do not match, " \
     "ignoring hostname.\r\n",                              80 },
+  { "NOTICE AUTH :*** Using S-line privilege\r\n",         41 },
   { "NOTICE AUTH :*** Invalid hostname\r\n",               35 }
 };
 
@@ -94,6 +96,7 @@
   REPORT_FIN_ID,
   REPORT_FAIL_ID,
   REPORT_IP_MISMATCH,
+  REPORT_USING_SLINE,
   REPORT_INVAL_DNS
 } ReportType;
 
@@ -595,6 +598,13 @@
   struct AuthRequest* auth = 0;
 
   assert(0 != client);
+
+  if (conf_check_slines(client)) {
+    sendheader(client, REPORT_USING_SLINE);
+    SetSLined(client);
+    release_auth_client(client);
+    return;
+  }
 
   auth = make_auth_request(client);
   assert(0 != auth);
diff -urdb ircd/s_conf.c ircu2.10.11.06/ircd/s_conf.c
--- ircd/s_conf.c	Wed Jan 28 22:28:05 2004
+++ ircd/s_conf.c	Wed Jan 28 23:20:26 2004
@@ -1170,6 +1170,10 @@
       conf_add_quarantine(field_vector, field_count);
       aconf->status = CONF_ILLEGAL;
       break;
+    case 'S':
+    case 's':
+      aconf->status = CONF_SPOOF;
+      break;
     case 'T':                /* print out different motd's */
     case 't':                /* based on hostmask - CONF_TLINES */
       motd_add(field_vector[1], field_vector[2]);
@@ -1272,6 +1276,9 @@
     if ((aconf->status == CONF_UWORLD) && (aconf->passwd) && (*aconf->passwd))
       addNickJupes(aconf->passwd);
 
+    if (aconf->status & CONF_SPOOF)
+      lookup_confhost(aconf);
+
     collapse(aconf->host);
     collapse(aconf->name);
     Debug((DEBUG_NOTICE,
@@ -1647,6 +1654,70 @@
     c_conf->ipnum.s_addr = cli_ip(cptr).s_addr;
 
   Debug((DEBUG_DNS, "sv_cl: access ok: %s[%s]", cli_name(cptr), cli_sockhost(cptr)));
+  return 0;
+}
+
+/*
+ * conf_check_slines()
+ *
+ * Check S lines for the specified client, passed in cptr struct.
+ * If the client's IP is S-lined, process the substitution here.
+ * 1. cptr->cli_ip                    (cli_ip(cptr))
+ * 2. cptr->cli_connect->con_sock_ip  (cli_sock_ip(cptr))
+ * 3. cptr->cli_connect->sockhost     (cli_sockhost(cptr))
+ *
+ * If no substitued IP are specified, only change sockhost.
+ *
+ * Precondition
+ *  cptr != NULL
+ *
+ * Returns
+ *  0 = No S-line found
+ *  1 = S-line found and substitution done.
+ *
+ * -mbuna 9/2001
+ *
+ */
+
+int
+conf_check_slines(struct Client *cptr)
+{
+  struct ConfItem* aconf;
+  struct in_addr iptemp;
+  char* hostonly;
+
+  for (aconf = GlobalConfList; aconf; aconf = aconf->next) {
+    if (aconf->status != CONF_SPOOF)
+      continue;
+    if ((aconf->dns_pending)
+      || (INADDR_NONE == aconf->ipnum.s_addr)
+      || EmptyString(aconf->name))
+      continue;
+
+    if (cli_ip(cptr).s_addr == aconf->ipnum.s_addr) {
+
+                               /* Ignore user part if u@h. */
+      if ((hostonly = strchr(aconf->name, '@')))
+        hostonly++;
+      else
+        hostonly = aconf->name;
+
+      if(!*hostonly)
+        continue;
+
+      if (!EmptyString(aconf->passwd)) {
+        iptemp.s_addr = inet_addr(aconf->passwd);
+        if (INADDR_NONE == iptemp.s_addr)
+          continue;
+        cli_ip(cptr).s_addr = iptemp.s_addr;
+      }
+
+                               /* Perform a luxurious ircd_ntoa for sanity. */
+      ircd_strncpy(cli_sock_ip(cptr), ircd_ntoa((const char*) &cli_ip(cptr)), SOCKIPLEN);
+      ircd_strncpy(cli_sockhost(cptr), hostonly, HOSTLEN);
+      return 1;
+    }
+  }
   return 0;
 }
 
diff -urdb ircd/s_user.c ircu2.10.11.06/ircd/s_user.c
--- ircd/s_user.c	Wed Jan 28 22:28:05 2004
+++ ircd/s_user.c	Wed Jan 28 23:20:26 2004
@@ -422,7 +422,8 @@
 
     clean_user_id(user->username,
         HasFlag(sptr, FLAG_GOTID) ? cli_username(sptr) : username,
-        HasFlag(sptr, FLAG_DOID) && !HasFlag(sptr, FLAG_GOTID));
+        HasFlag(sptr, FLAG_DOID) && !HasFlag(sptr, FLAG_GOTID)
+        && !(HasSLine(sptr))); /* No tilde for S-lined users. */	
 
     if ((user->username[0] == '\0')
         || ((user->username[0] == '~') && (user->username[1] == '\000')))
