Added -Wshorten-64-to-32 and fixed all warnings.

53 files changed, 196 insertions, 180 deletions

diff --git a/src/modules/extra/m_argon2.cpp b/src/modules/extra/m_argon2.cpp
index 198944ddf..8393878d4 100644
--- a/src/modules/extra/m_argon2.cpp
+++ b/src/modules/extra/m_argon2.cpp
@@ -72,22 +72,22 @@ class ProviderConfig
 		auto tag = ServerInstance->Config->ConfValue(tagname);
 
 		uint32_t def_iterations = def ? def->iterations : 3;
-		this->iterations = tag->getUInt("iterations", def_iterations, 1);
+		this->iterations = static_cast<uint32_t>(tag->getUInt("iterations", def_iterations, 1, UINT32_MAX));
 
 		uint32_t def_lanes = def ? def->lanes : 1;
-		this->lanes = tag->getUInt("lanes", def_lanes, ARGON2_MIN_LANES, ARGON2_MAX_LANES);
+		this->lanes = static_cast<uint32_t>(tag->getUInt("lanes", def_lanes, ARGON2_MIN_LANES, ARGON2_MAX_LANES));
 
 		uint32_t def_memory = def ? def->memory : 131072; // 128 MiB
-		this->memory = tag->getUInt("memory", def_memory, ARGON2_MIN_MEMORY, ARGON2_MAX_MEMORY);
+		this->memory = static_cast<uint32_t>(tag->getUInt("memory", def_memory, ARGON2_MIN_MEMORY, ARGON2_MAX_MEMORY));
 
 		uint32_t def_outlen = def ? def->outlen : 32;
-		this->outlen = tag->getUInt("length", def_outlen, ARGON2_MIN_OUTLEN, ARGON2_MAX_OUTLEN);
+		this->outlen = static_cast<uint32_t>(tag->getUInt("length", def_outlen, ARGON2_MIN_OUTLEN, ARGON2_MAX_OUTLEN));
 
 		uint32_t def_saltlen = def ? def->saltlen : 16;
-		this->saltlen = tag->getUInt("saltlength", def_saltlen, ARGON2_MIN_SALT_LENGTH, ARGON2_MAX_SALT_LENGTH);
+		this->saltlen = static_cast<uint32_t>(tag->getUInt("saltlength", def_saltlen, ARGON2_MIN_SALT_LENGTH, ARGON2_MAX_SALT_LENGTH));
 
 		uint32_t def_threads = def ? def->threads : 1;
-		this->threads = tag->getUInt("threads", def_threads, ARGON2_MIN_THREADS, ARGON2_MAX_THREADS);
+		this->threads = static_cast<uint32_t>(tag->getUInt("threads", def_threads, ARGON2_MIN_THREADS, ARGON2_MAX_THREADS));
 
 		uint32_t def_version = def ? def->version : 13;
 		this->version = SanitizeArgon2Version(tag->getUInt("version", def_version));
diff --git a/src/modules/extra/m_ldap.cpp b/src/modules/extra/m_ldap.cpp
index eaaf2a8ce..49e4fbf2b 100644
--- a/src/modules/extra/m_ldap.cpp
+++ b/src/modules/extra/m_ldap.cpp
@@ -587,7 +587,7 @@ class ModuleLDAP : public Module
 			s->process_mutex.lock();
 			s->LockQueue();
 
-			for (unsigned int i = s->queries.size(); i > 0; --i)
+			for (size_t i = s->queries.size(); i > 0; --i)
 			{
 				LDAPRequest* req = s->queries[i - 1];
 				LDAPInterface* li = req->inter;
@@ -599,7 +599,7 @@ class ModuleLDAP : public Module
 				}
 			}
 
-			for (unsigned int i = s->results.size(); i > 0; --i)
+			for (size_t i = s->results.size(); i > 0; --i)
 			{
 				LDAPRequest* req = s->results[i - 1];
 				LDAPInterface* li = req->inter;
diff --git a/src/modules/extra/m_mysql.cpp b/src/modules/extra/m_mysql.cpp
index 7fedadc05..8cba8b3c0 100644
--- a/src/modules/extra/m_mysql.cpp
+++ b/src/modules/extra/m_mysql.cpp
@@ -166,12 +166,12 @@ class MySQLresult : public SQL::Result
 	std::vector<std::string> colnames;
 	std::vector<SQL::Row> fieldlists;
 
-	MySQLresult(MYSQL_RES* res, int affected_rows)
+	MySQLresult(MYSQL_RES* res, unsigned long affected_rows)
 		: err(SQL::SUCCESS)
 	{
 		if (affected_rows >= 1)
 		{
-			rows = affected_rows;
+			rows = int(affected_rows);
 			fieldlists.resize(rows);
 		}
 		unsigned int field_count = 0;
@@ -181,7 +181,7 @@ class MySQLresult : public SQL::Result
 			int n = 0;
 			while ((row = mysql_fetch_row(res)))
 			{
-				if (fieldlists.size() < (unsigned int)rows+1)
+				if (fieldlists.size() < (size_t)rows+1)
 				{
 					fieldlists.resize(fieldlists.size()+1);
 				}
@@ -317,7 +317,7 @@ class SQLConnection : public SQL::Provider
 		connection = mysql_init(connection);
 
 		// Set the connection timeout.
-		unsigned int timeout = config->getDuration("timeout", 5, 1, 30);
+		unsigned int timeout = static_cast<unsigned int>(config->getDuration("timeout", 5, 1, 30));
 		mysql_options(connection, MYSQL_OPT_CONNECT_TIMEOUT, &timeout);
 
 		// Attempt to connect to the database.
@@ -325,7 +325,7 @@ class SQLConnection : public SQL::Provider
 		const std::string user = config->getString("user");
 		const std::string pass = config->getString("pass");
 		const std::string dbname = config->getString("name");
-		unsigned int port = config->getUInt("port", 3306, 1, 65535);
+		unsigned int port = static_cast<unsigned int>(config->getUInt("port", 3306, 1, 65535));
 		if (!mysql_real_connect(connection, host.c_str(), user.c_str(), pass.c_str(), dbname.c_str(), port, NULL, CLIENT_IGNORE_SIGPIPE))
 		{
 			ServerInstance->Logs.Log(MODNAME, LOG_DEFAULT, "Unable to connect to the %s MySQL server: %s",
@@ -517,7 +517,7 @@ void ModuleSQL::OnUnloadModule(Module* mod)
 {
 	SQL::Error err(SQL::BAD_DBID);
 	Dispatcher->LockQueue();
-	unsigned int i = qq.size();
+	size_t i = qq.size();
 	while (i > 0)
 	{
 		i--;
diff --git a/src/modules/extra/m_regex_pcre.cpp b/src/modules/extra/m_regex_pcre.cpp
index f2e71d92b..4f5ff0ca5 100644
--- a/src/modules/extra/m_regex_pcre.cpp
+++ b/src/modules/extra/m_regex_pcre.cpp
@@ -70,7 +70,8 @@ class PCREPattern final
 
 	bool IsMatch(const std::string& text) override
 	{
-		return pcre_exec(regex, NULL, text.c_str(), text.length(), 0, 0, NULL, 0) >= 0;
+		// This cast is potentially unsafe but it's what pcre_exec expects.
+		return pcre_exec(regex, NULL, text.c_str(), int(text.length()), 0, 0, NULL, 0) >= 0;
 	}
 };
 
diff --git a/src/modules/extra/m_sqlite3.cpp b/src/modules/extra/m_sqlite3.cpp
index 260364ca8..316306302 100644
--- a/src/modules/extra/m_sqlite3.cpp
+++ b/src/modules/extra/m_sqlite3.cpp
@@ -126,7 +126,7 @@ class SQLConn : public SQL::Provider
 	{
 		SQLite3Result res;
 		sqlite3_stmt *stmt;
-		int err = sqlite3_prepare_v2(conn, q.c_str(), q.length(), &stmt, NULL);
+		int err = sqlite3_prepare_v2(conn, q.c_str(), static_cast<int>(q.length()), &stmt, NULL);
 		if (err != SQLITE_OK)
 		{
 			SQL::Error error(SQL::QSEND_FAIL, sqlite3_errmsg(conn));
diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index 52003b675..a31c5d374 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -229,7 +229,7 @@ namespace GnuTLS
 		}
 
 		gnutls_x509_crt_t* raw() { return &certs[0]; }
-		unsigned int size() const { return certs.size(); }
+		size_t size() const { return certs.size(); }
 	};
 
 	class X509CRL
@@ -388,7 +388,7 @@ namespace GnuTLS
 			, certs(certstr)
 		{
 			// Throwing is ok here, the destructor of Credentials is called in that case
-			int ret = gnutls_certificate_set_x509_key(cred, certs.raw(), certs.size(), key.get());
+			int ret = gnutls_certificate_set_x509_key(cred, certs.raw(), static_cast<int>(certs.size()), key.get());
 			ThrowOnError(ret, "Unable to set cert/key pair");
 
 			gnutls_certificate_set_retrieve_function(cred, cert_callback);
@@ -402,7 +402,7 @@ namespace GnuTLS
 			// Do nothing if certlist is NULL
 			if (certlist.get())
 			{
-				int ret = gnutls_certificate_set_x509_trust(cred, certlist->raw(), certlist->size());
+				int ret = gnutls_certificate_set_x509_trust(cred, certlist->raw(), static_cast<int>(certlist->size()));
 				ThrowOnError(ret, "gnutls_certificate_set_x509_trust() failed");
 
 				if (CRL.get())
@@ -419,7 +419,7 @@ namespace GnuTLS
 
 	class DataReader
 	{
-		int retval;
+		ssize_t retval;
 #ifdef INSPIRCD_GNUTLS_HAS_RECV_PACKET
 		gnutls_packet_t packet;
 
@@ -459,7 +459,7 @@ namespace GnuTLS
 		}
 #endif
 
-		int ret() const { return retval; }
+		ssize_t ret() const { return retval; }
 	};
 
 	class Profile
@@ -551,7 +551,7 @@ namespace GnuTLS
 				, keystr(ReadFile(tag->getString("keyfile", "key.pem", 1)))
 				, dh(DHParams::Import(ReadFile(tag->getString("dhfile", "dhparams.pem", 1))))
 				, priostr(GetPrioStr(profilename, tag))
-				, mindh(tag->getUInt("mindhbits", 1024))
+				, mindh(static_cast<unsigned int>(tag->getUInt("mindhbits", 1024, 0, UINT32_MAX)))
 				, hashstr(tag->getString("hash", "sha256", 1))
 				, requestclientcert(tag->getBool("requestclientcert", true))
 			{
@@ -568,9 +568,9 @@ namespace GnuTLS
 
 #ifdef INSPIRCD_GNUTLS_HAS_CORK
 				// If cork support is available outrecsize represents the (rough) max amount of data we give GnuTLS while corked
-				outrecsize = tag->getUInt("outrecsize", 2048, 512);
+				outrecsize = static_cast<unsigned int>(tag->getUInt("outrecsize", 2048, 512, UINT32_MAX));
 #else
-				outrecsize = tag->getUInt("outrecsize", 2048, 512, 16384);
+				outrecsize = static_cast<unsigned int>(tag->getUInt("outrecsize", 2048, 512, 16384));
 #endif
 			}
 		};
@@ -853,7 +853,7 @@ info_done_dealloc:
 			return -1;
 		}
 
-		int rv = SocketEngine::Recv(sock, reinterpret_cast<char *>(buffer), size, 0);
+		ssize_t rv = SocketEngine::Recv(sock, reinterpret_cast<char *>(buffer), size, 0);
 
 #ifdef _WIN32
 		if (rv < 0)
@@ -867,7 +867,7 @@ info_done_dealloc:
 		}
 #endif
 
-		if (rv < (int)size)
+		if (rv < 0 || size_t(rv) < size)
 			SocketEngine::ChangeEventMask(sock, FD_READ_WILL_BLOCK);
 		return rv;
 	}
@@ -889,14 +889,14 @@ info_done_dealloc:
 		}
 
 		// Cast the giovec_t to iovec not to IOVector so the correct function is called on Windows
-		int ret = SocketEngine::WriteV(sock, reinterpret_cast<const iovec*>(iov), iovcnt);
+		ssize_t ret = SocketEngine::WriteV(sock, reinterpret_cast<const iovec*>(iov), iovcnt);
 #ifdef _WIN32
 		// See the function above for more info about the usage of gnutls_transport_set_errno() on Windows
 		if (ret < 0)
 			gnutls_transport_set_errno(session->sess, SocketEngine::IgnoreError() ? EAGAIN : errno);
 #endif
 
-		int size = 0;
+		ssize_t size = 0;
 		for (int i = 0; i < iovcnt; i++)
 			size += iov[i].iov_len;
 
@@ -934,7 +934,7 @@ info_done_dealloc:
 		// If we resumed the handshake then this->status will be ISSL_HANDSHAKEN.
 		{
 			GnuTLS::DataReader reader(sess);
-			int ret = reader.ret();
+			ssize_t ret = reader.ret();
 			if (ret > 0)
 			{
 				reader.appendto(recvq);
@@ -955,14 +955,14 @@ info_done_dealloc:
 			}
 			else
 			{
-				user->SetError(gnutls_strerror(ret));
+				user->SetError(gnutls_strerror(int(ret)));
 				CloseSession();
 				return -1;
 			}
 		}
 	}
 
-	int OnStreamSocketWrite(StreamSocket* user, StreamSocket::SendQueue& sendq) override
+	ssize_t OnStreamSocketWrite(StreamSocket* user, StreamSocket::SendQueue& sendq) override
 	{
 		// Finish handshake if needed
 		int prepret = PrepareIO(user);
@@ -975,7 +975,7 @@ info_done_dealloc:
 		while (true)
 		{
 			// If there is something in the GnuTLS buffer try to send() it
-			int ret = FlushBuffer(user);
+			ssize_t ret = FlushBuffer(user);
 			if (ret <= 0)
 				return ret; // Couldn't flush entire buffer, retry later (or close on error)
 
@@ -1066,7 +1066,7 @@ int GnuTLS::X509Credentials::cert_callback(gnutls_session_t sess, const gnutls_d
 	StreamSocket* sock = reinterpret_cast<StreamSocket*>(gnutls_transport_get_ptr(sess));
 	GnuTLS::X509Credentials& cred = static_cast<GnuTLSIOHook*>(sock->GetModHook(thismod))->GetProfile().GetX509Credentials();
 
-	st->ncerts = cred.certs.size();
+	st->ncerts = static_cast<unsigned int>(cred.certs.size());
 	st->cert.x509 = cred.certs.raw();
 	st->key.x509 = cred.key.get();
 	st->deinit_all = 0;
diff --git a/src/modules/extra/m_ssl_mbedtls.cpp b/src/modules/extra/m_ssl_mbedtls.cpp
index 7b8313f90..89ffed0f9 100644
--- a/src/modules/extra/m_ssl_mbedtls.cpp
+++ b/src/modules/extra/m_ssl_mbedtls.cpp
@@ -412,12 +412,12 @@ namespace mbedTLS
 				, dhstr(ReadFile(tag->getString("dhfile", "dhparams.pem", 1)))
 				, ciphersuitestr(tag->getString("ciphersuites"))
 				, curvestr(tag->getString("curves"))
-				, mindh(tag->getUInt("mindhbits", 2048))
+				, mindh(static_cast<unsigned int>(tag->getUInt("mindhbits", 2048, 0, UINT32_MAX)))
 				, hashstr(tag->getString("hash", "sha256", 1))
 				, castr(tag->getString("cafile"))
-				, minver(tag->getUInt("minver", 0))
-				, maxver(tag->getUInt("maxver", 0))
-				, outrecsize(tag->getUInt("outrecsize", 2048, 512, 16384))
+				, minver(static_cast<int>(tag->getUInt("minver", 0, 0, INT32_MAX)))
+				, maxver(static_cast<int>(tag->getUInt("maxver", 0, 0, INT32_MAX)))
+				, outrecsize(static_cast<unsigned int>(tag->getUInt("outrecsize", 2048, 512, 16384)))
 				, requestclientcert(tag->getBool("requestclientcert", true))
 			{
 				if (!castr.empty())
@@ -636,14 +636,16 @@ class mbedTLSIOHook : public SSLIOHook
 		if (sock->GetEventMask() & FD_READ_WILL_BLOCK)
 			return MBEDTLS_ERR_SSL_WANT_READ;
 
-		const int ret = SocketEngine::Recv(sock, reinterpret_cast<char*>(buffer), size, 0);
-		if (ret < (int)size)
+		const ssize_t ret = SocketEngine::Recv(sock, reinterpret_cast<char*>(buffer), size, 0);
+		if (ret < 0 || size_t(ret) < size)
 		{
 			SocketEngine::ChangeEventMask(sock, FD_READ_WILL_BLOCK);
 			if ((ret == -1) && (SocketEngine::IgnoreError()))
 				return MBEDTLS_ERR_SSL_WANT_READ;
 		}
-		return ret;
+
+		// This cast isn't entirely safe but the interface is given by mbedtls.
+		return int(ret);
 	}
 
 	static int Push(void* userptr, const unsigned char* buffer, size_t size)
@@ -652,14 +654,16 @@ class mbedTLSIOHook : public SSLIOHook
 		if (sock->GetEventMask() & FD_WRITE_WILL_BLOCK)
 			return MBEDTLS_ERR_SSL_WANT_WRITE;
 
-		const int ret = SocketEngine::Send(sock, buffer, size, 0);
-		if (ret < (int)size)
+		const ssize_t ret = SocketEngine::Send(sock, buffer, size, 0);
+		if (ret < 0 || size_t(ret) < size)
 		{
 			SocketEngine::ChangeEventMask(sock, FD_WRITE_WILL_BLOCK);
 			if ((ret == -1) && (SocketEngine::IgnoreError()))
 				return MBEDTLS_ERR_SSL_WANT_WRITE;
 		}
-		return ret;
+
+		// This cast isn't entirely safe but the interface is given by mbedtls.
+		return int(ret);
 	}
 
  public:
@@ -728,7 +732,7 @@ class mbedTLSIOHook : public SSLIOHook
 		}
 	}
 
-	int OnStreamSocketWrite(StreamSocket* sock, StreamSocket::SendQueue& sendq) override
+	ssize_t OnStreamSocketWrite(StreamSocket* sock, StreamSocket::SendQueue& sendq) override
 	{
 		// Finish handshake if needed
 		int prepret = PrepareIO(sock);
diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 066337e7a..dcdaf497f 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -216,7 +216,7 @@ namespace OpenSSL
 				crlfile.empty() ? NULL : crlfile.c_str(),
 				crlpath.empty() ? NULL : crlpath.c_str()))
 			{
-				int err = ERR_get_error();
+				unsigned long err = ERR_get_error();
 				throw ModuleException("Unable to load CRL file '" + crlfile + "' or CRL path '" + crlpath + "': '" + (err ? ERR_error_string(err, NULL) : "unknown") + "'");
 			}
 
@@ -344,7 +344,7 @@ namespace OpenSSL
 			, ctx(SSL_CTX_new(SSLv23_server_method()))
 			, clictx(SSL_CTX_new(SSLv23_client_method()))
 			, allowrenego(tag->getBool("renegotiation")) // Disallow by default
-			, outrecsize(tag->getUInt("outrecsize", 2048, 512, 16384))
+			, outrecsize(static_cast<unsigned int>(tag->getUInt("outrecsize", 2048, 512, 16384)))
 		{
 			if ((!ctx.SetDH(dh)) || (!clictx.SetDH(dh)))
 				throw Exception("Couldn't set DH parameters");
@@ -440,6 +440,8 @@ namespace OpenSSL
 			return 0;
 		}
 
+		// These signatures are required by the BIO_meth_set_write|read interface
+		// even though they lead to shortening issues.
 		static int read(BIO* bio, char* buf, int len);
 		static int write(BIO* bio, const char* buf, int len);
 
@@ -671,7 +673,8 @@ class OpenSSLIOHook : public SSLIOHook
 		{
 			ERR_clear_error();
 			char* buffer = ServerInstance->GetReadBuffer();
-			size_t bufsiz = ServerInstance->Config->NetBufferSize;
+			// This cast may be unsafe but an int is expected by SSL_read.
+			int bufsiz = static_cast<int>(ServerInstance->Config->NetBufferSize);
 			int ret = SSL_read(sess, buffer, bufsiz);
 
 			if (!CheckRenego(user))
@@ -720,7 +723,7 @@ class OpenSSLIOHook : public SSLIOHook
 		}
 	}
 
-	int OnStreamSocketWrite(StreamSocket* user, StreamSocket::SendQueue& sendq) override
+	ssize_t OnStreamSocketWrite(StreamSocket* user, StreamSocket::SendQueue& sendq) override
 	{
 		// Finish handshake if needed
 		int prepret = PrepareIO(user);
@@ -735,7 +738,7 @@ class OpenSSLIOHook : public SSLIOHook
 			ERR_clear_error();
 			FlattenSendQueue(sendq, GetProfile().GetOutgoingRecordSize());
 			const StreamSocket::SendQueue::Element& buffer = sendq.front();
-			int ret = SSL_write(sess, buffer.data(), buffer.size());
+			int ret = SSL_write(sess, buffer.data(), static_cast<int>(buffer.size()));
 
 			if (!CheckRenego(user))
 				return -1;
@@ -823,7 +826,7 @@ static int OpenSSL::BIOMethod::write(BIO* bio, const char* buffer, int size)
 		return -1;
 	}
 
-	int ret = SocketEngine::Send(sock, buffer, size, 0);
+	ssize_t ret = SocketEngine::Send(sock, buffer, size, 0);
 	if ((ret < size) && ((ret > 0) || (SocketEngine::IgnoreError())))
 	{
 		// Blocked, set retry flag for OpenSSL
@@ -831,7 +834,7 @@ static int OpenSSL::BIOMethod::write(BIO* bio, const char* buffer, int size)
 		BIO_set_retry_write(bio);
 	}
 
-	return ret;
+	return static_cast<int>(ret);
 }
 
 static int OpenSSL::BIOMethod::read(BIO* bio, char* buffer, int size)
@@ -846,7 +849,7 @@ static int OpenSSL::BIOMethod::read(BIO* bio, char* buffer, int size)
 		return -1;
 	}
 
-	int ret = SocketEngine::Recv(sock, buffer, size, 0);
+	ssize_t ret = SocketEngine::Recv(sock, buffer, size, 0);
 	if ((ret < size) && ((ret > 0) || (SocketEngine::IgnoreError())))
 	{
 		// Blocked, set retry flag for OpenSSL
@@ -854,7 +857,7 @@ static int OpenSSL::BIOMethod::read(BIO* bio, char* buffer, int size)
 		BIO_set_retry_read(bio);
 	}
 
-	return ret;
+	return static_cast<int>(ret);
 }
 
 class OpenSSLIOHookProvider : public SSLIOHookProvider
diff --git a/src/modules/m_banredirect.cpp b/src/modules/m_banredirect.cpp
index 91a2a5ce2..248b98aef 100644
--- a/src/modules/m_banredirect.cpp
+++ b/src/modules/m_banredirect.cpp
@@ -85,11 +85,11 @@ class BanRedirect : public ModeWatcher
 				return true;
 
 			ListModeBase* banlm = static_cast<ListModeBase*>(*ban);
-			unsigned int maxbans = banlm->GetLimit(channel);
+			unsigned long maxbans = banlm->GetLimit(channel);
 			ListModeBase::ModeList* list = banlm->GetList(channel);
 			if (list && change.adding && maxbans <= list->size())
 			{
-				source->WriteNumeric(ERR_BANLISTFULL, channel->name, banlm->GetModeChar(), InspIRCd::Format("Channel ban list for %s is full (maximum entries for this channel is %u)", channel->name.c_str(), maxbans));
+				source->WriteNumeric(ERR_BANLISTFULL, channel->name, banlm->GetModeChar(), InspIRCd::Format("Channel ban list for %s is full (maximum entries for this channel is %lu)", channel->name.c_str(), maxbans));
 				return false;
 			}
 
diff --git a/src/modules/m_bcrypt.cpp b/src/modules/m_bcrypt.cpp
index 9f3c9f7d5..34bc6e71d 100644
--- a/src/modules/m_bcrypt.cpp
+++ b/src/modules/m_bcrypt.cpp
@@ -42,7 +42,7 @@ class BCryptProvider : public HashProvider
 	}
 
  public:
-	unsigned int rounds = 10;
+	unsigned long rounds = 10;
 
 	std::string Generate(const std::string& data, const std::string& salt)
 	{
diff --git a/src/modules/m_blockamsg.cpp b/src/modules/m_blockamsg.cpp
index f76f211bc..e71c5c80d 100644
--- a/src/modules/m_blockamsg.cpp
+++ b/src/modules/m_blockamsg.cpp
@@ -50,7 +50,7 @@ class BlockedMessage
 
 class ModuleBlockAmsg : public Module
 {
-	unsigned int ForgetDelay;
+	unsigned long ForgetDelay;
 	BlockAction action;
 	SimpleExtItem<BlockedMessage> blockamsg;
 
@@ -109,7 +109,11 @@ class ModuleBlockAmsg : public Module
 			// OR
 			// The number of target channels is equal to the number of channels the sender is on..a little suspicious.
 			// Check it's more than 1 too, or else users on one channel would have fun.
-			if ((m && (m->message == parameters[1]) && (!irc::equals(m->target, parameters[0])) && ForgetDelay && (m->sent >= ServerInstance->Time()-ForgetDelay)) || ((targets > 1) && (targets == user->chans.size())))
+			if ((m && (m->message == parameters[1]) &&
+					(!irc::equals(m->target, parameters[0])) &&
+					ForgetDelay &&
+					(m->sent >= ServerInstance->Time()-(long)ForgetDelay)) ||
+				((targets > 1) && (targets == user->chans.size())))
 			{
 				// Block it...
 				if (action == IBLOCK_KILLOPERS || action == IBLOCK_NOTICEOPERS)
diff --git a/src/modules/m_callerid.cpp b/src/modules/m_callerid.cpp
index 0c568ecd0..591be8acb 100644
--- a/src/modules/m_callerid.cpp
+++ b/src/modules/m_callerid.cpp
@@ -178,7 +178,7 @@ class CommandAccept : public Command
 
 public:
 	CallerIDExtInfo extInfo;
-	unsigned int maxaccepts;
+	unsigned long maxaccepts;
 	CommandAccept(Module* Creator) : Command(Creator, "ACCEPT", 1),
 		extInfo(Creator)
 	{
@@ -279,7 +279,7 @@ public:
 		callerid_data* dat = extInfo.Get(user, true);
 		if (dat->accepting.size() >= maxaccepts)
 		{
-			user->WriteNumeric(ERR_ACCEPTFULL, InspIRCd::Format("Accept list is full (limit is %d)", maxaccepts));
+			user->WriteNumeric(ERR_ACCEPTFULL, InspIRCd::Format("Accept list is full (limit is %lu)", maxaccepts));
 			return false;
 		}
 		if (!dat->accepting.insert(whotoadd).second)
@@ -361,7 +361,7 @@ class ModuleCallerID
 
 	// Configuration variables:
 	bool tracknick; // Allow ACCEPT entries to update with nick changes.
-	unsigned int notify_cooldown; // Seconds between notifications.
+	unsigned long notify_cooldown; // Seconds between notifications.
 
 	/** Removes a user from all accept lists
 	 * @param who The user to remove from accepts
@@ -419,7 +419,7 @@ public:
 			time_t now = ServerInstance->Time();
 			/* +g and *not* accepted */
 			user->WriteNumeric(ERR_TARGUMODEG, dest->nick, "is in +g mode (server-side ignore).");
-			if (now > (dat->lastnotify + notify_cooldown))
+			if (now > (dat->lastnotify + long(notify_cooldown)))
 			{
 				user->WriteNumeric(RPL_TARGNOTIFY, dest->nick, "has been informed that you messaged them.");
 				dest->WriteRemoteNumeric(RPL_UMODEGMSG, user->nick, InspIRCd::Format("%s@%s", user->ident.c_str(), user->GetDisplayedHost().c_str()), InspIRCd::Format("is messaging you, and you have user mode +g set. Use /ACCEPT +%s to allow.",
diff --git a/src/modules/m_chanhistory.cpp b/src/modules/m_chanhistory.cpp
index 4254710d7..427636e2c 100644
--- a/src/modules/m_chanhistory.cpp
+++ b/src/modules/m_chanhistory.cpp
@@ -53,10 +53,10 @@ struct HistoryItem
 struct HistoryList
 {
 	std::deque<HistoryItem> lines;
-	unsigned int maxlen;
-	unsigned int maxtime;
+	unsigned long maxlen;
+	unsigned long maxtime;
 
-	HistoryList(unsigned int len, unsigned int time)
+	HistoryList(unsigned long len, unsigned long time)
 		: maxlen(len)
 		, maxtime(time)
 	{
@@ -78,7 +78,7 @@ struct HistoryList
 class HistoryMode : public ParamMode<HistoryMode, SimpleExtItem<HistoryList> >
 {
  public:
-	unsigned int maxlines;
+	unsigned long maxlines;
 	HistoryMode(Module* Creator)
 		: ParamMode<HistoryMode, SimpleExtItem<HistoryList> >(Creator, "history", 'H')
 	{
@@ -101,7 +101,7 @@ class HistoryMode : public ParamMode<HistoryMode, SimpleExtItem<HistoryList> >
 			return MODEACTION_DENY;
 		}
 
-		unsigned int len = ConvToNum<unsigned int>(parameter.substr(0, colon));
+		unsigned long len = ConvToNum<unsigned long>(parameter.substr(0, colon));
 		unsigned long time;
 		if (!InspIRCd::Duration(duration, time) || len == 0 || (len > maxlines && IS_LOCAL(source)))
 		{
diff --git a/src/modules/m_channames.cpp b/src/modules/m_channames.cpp
index 71c5efbb8..eb1acc53e 100644
--- a/src/modules/m_channames.cpp
+++ b/src/modules/m_channames.cpp
@@ -116,12 +116,12 @@ class ModuleChannelNames : public Module
 		allowedmap.set();
 
 		irc::portparser denyrange(denyToken, false);
-		int denyno = -1;
+		long denyno = -1;
 		while (0 != (denyno = denyrange.GetToken()))
 			allowedmap[denyno & 0xFF] = false;
 
 		irc::portparser allowrange(allowToken, false);
-		int allowno = -1;
+		long allowno = -1;
 		while (0 != (allowno = allowrange.GetToken()))
 			allowedmap[allowno & 0xFF] = true;
 
diff --git a/src/modules/m_cloaking.cpp b/src/modules/m_cloaking.cpp
index 88858bfb3..31936bcec 100644
--- a/src/modules/m_cloaking.cpp
+++ b/src/modules/m_cloaking.cpp
@@ -486,7 +486,7 @@ class ModuleCloaking : public Module
 			const std::string suffix = tag->getString("suffix", ".IP");
 			if (stdalgo::string::equalsci(mode, "half"))
 			{
-				unsigned int domainparts = tag->getUInt("domainparts", 3, 1, 10);
+				unsigned int domainparts = static_cast<unsigned int>(tag->getUInt("domainparts", 3, 1, 10));
 				newcloaks.emplace_back(MODE_HALF_CLOAK, key, prefix, suffix, ignorecase, domainparts);
 			}
 			else if (stdalgo::string::equalsci(mode, "full"))
diff --git a/src/modules/m_codepage.cpp b/src/modules/m_codepage.cpp
index a2df8cf7e..74b8f138e 100644
--- a/src/modules/m_codepage.cpp
+++ b/src/modules/m_codepage.cpp
@@ -270,7 +270,8 @@ class ModuleCodepage final
 			bool front = tag->getBool("front", false);
 			for (unsigned long pos = begin; pos <= end; ++pos)
 			{
-				switch (newcodepage->AllowCharacter(pos, front))
+				// This cast could be unsafe but it's not obvious how to make it safe.
+				switch (newcodepage->AllowCharacter(static_cast<uint32_t>(pos), front))
 				{
 					case Codepage::ACR_OKAY:
 						ServerInstance->Logs.Log(MODNAME, LOG_DEBUG, "Marked %lu (%.4s) as allowed (front: %s)",
diff --git a/src/modules/m_conn_join.cpp b/src/modules/m_conn_join.cpp
index a40f70327..7370cc568 100644
--- a/src/modules/m_conn_join.cpp
+++ b/src/modules/m_conn_join.cpp
@@ -82,7 +82,7 @@ class ModuleConnJoin : public Module
 	{
 		auto tag = ServerInstance->Config->ConfValue("autojoin");
 		defchans = tag->getString("channel");
-		defdelay = tag->getDuration("delay", 0, 0, 60*15);
+		defdelay = static_cast<unsigned int>(tag->getDuration("delay", 0, 0, 60*15));
 	}
 
 	void Prioritize() override
@@ -97,7 +97,7 @@ class ModuleConnJoin : public Module
 			return;
 
 		std::string chanlist = localuser->GetClass()->config->getString("autojoin");
-		unsigned int chandelay = localuser->GetClass()->config->getDuration("autojoindelay", 0, 0, 60*15);
+		unsigned int chandelay = static_cast<unsigned int>(localuser->GetClass()->config->getDuration("autojoindelay", 0, 0, 60*15));
 
 		if (chanlist.empty())
 		{
diff --git a/src/modules/m_connectban.cpp b/src/modules/m_connectban.cpp
index 95c077eef..846de9e80 100644
--- a/src/modules/m_connectban.cpp
+++ b/src/modules/m_connectban.cpp
@@ -34,8 +34,8 @@ class ModuleConnectBan
 {
 	typedef std::map<irc::sockets::cidr_mask, unsigned int> ConnectMap;
 	ConnectMap connects;
-	unsigned int threshold;
-	unsigned int banduration;
+	unsigned long threshold;
+	unsigned long banduration;
 	unsigned int ipv4_cidr;
 	unsigned int ipv6_cidr;
 	std::string banmessage;
@@ -88,8 +88,8 @@ class ModuleConnectBan
 	{
 		auto tag = ServerInstance->Config->ConfValue("connectban");
 
-		ipv4_cidr = tag->getUInt("ipv4cidr", 32, 1, 32);
-		ipv6_cidr = tag->getUInt("ipv6cidr", 128, 1, 128);
+		ipv4_cidr = static_cast<unsigned int>(tag->getUInt("ipv4cidr", 32, 1, 32));
+		ipv6_cidr = static_cast<unsigned int>(tag->getUInt("ipv6cidr", 128, 1, 128));
 		threshold = tag->getUInt("threshold", 10, 1);
 		banduration = tag->getDuration("duration", 10*60, 1);
 		banmessage = tag->getString("banmessage", "Your IP range has been attempting to connect too many times in too short a duration. Wait a while, and you will be able to connect.");
@@ -134,7 +134,7 @@ class ModuleConnectBan
 				std::string maskstr = mask.str();
 				ServerInstance->SNO.WriteGlobalSno('x', "Z-line added by module m_connectban on %s to expire in %s (on %s): Connect flooding",
 					maskstr.c_str(), InspIRCd::DurationString(zl->duration).c_str(), InspIRCd::TimeString(zl->expiry).c_str());
-				ServerInstance->SNO.WriteGlobalSno('a', "Connect flooding from IP range %s (%d)", maskstr.c_str(), threshold);
+				ServerInstance->SNO.WriteGlobalSno('a', "Connect flooding from IP range %s (%lu)", maskstr.c_str(), threshold);
 				connects.erase(i);
 			}
 		}
diff --git a/src/modules/m_connflood.cpp b/src/modules/m_connflood.cpp
index 23aa178ea..0cb944e04 100644
--- a/src/modules/m_connflood.cpp
+++ b/src/modules/m_connflood.cpp
@@ -28,11 +28,11 @@
 class ModuleConnFlood : public Module
 {
  private:
-	unsigned int seconds;
-	unsigned int timeout;
-	unsigned int boot_wait;
-	unsigned int conns = 0;
-	unsigned int maxconns;
+	unsigned long seconds;
+	unsigned long timeout;
+	unsigned long boot_wait;
+	unsigned long conns = 0;
+	unsigned long maxconns;
 	bool throttled = false;
 	time_t first;
 	std::string quitmsg;
@@ -76,7 +76,7 @@ class ModuleConnFlood : public Module
 
 		time_t next = ServerInstance->Time();
 
-		if ((ServerInstance->startup_time + boot_wait) > next)
+		if (time_t(ServerInstance->startup_time + boot_wait) > next)
 			return MOD_RES_PASSTHRU;
 
 		/* time difference between first and latest connection */
@@ -87,7 +87,7 @@ class ModuleConnFlood : public Module
 
 		if (throttled)
 		{
-			if (tdiff > seconds + timeout)
+			if (tdiff > time_t(seconds + timeout))
 			{
 				/* expire throttle */
 				throttled = false;
@@ -99,7 +99,7 @@ class ModuleConnFlood : public Module
 			return MOD_RES_DENY;
 		}
 
-		if (tdiff <= seconds)
+		if (tdiff <= time_t(seconds))
 		{
 			if (conns >= maxconns)
 			{
diff --git a/src/modules/m_customprefix.cpp b/src/modules/m_customprefix.cpp
index aa71fd3c1..487b71060 100644
--- a/src/modules/m_customprefix.cpp
+++ b/src/modules/m_customprefix.cpp
@@ -31,9 +31,9 @@ class CustomPrefixMode : public PrefixMode
 		: PrefixMode(parent, Name, Letter, 0, Prefix)
 		, tag(Tag)
 	{
-		unsigned long rank = tag->getUInt("rank", 0, 0, UINT_MAX);
-		unsigned long setrank = tag->getUInt("ranktoset", prefixrank, rank, UINT_MAX);
-		unsigned long unsetrank = tag->getUInt("ranktounset", setrank, setrank, UINT_MAX);
+		unsigned int rank = static_cast<unsigned int>(tag->getUInt("rank", 0, 0, UINT_MAX));
+		unsigned int setrank = static_cast<unsigned int>(tag->getUInt("ranktoset", prefixrank, rank, UINT_MAX));
+		unsigned int unsetrank = static_cast<unsigned int>(tag->getUInt("ranktounset", setrank, setrank, UINT_MAX));
 		bool depriv = tag->getBool("depriv", true);
 		this->Update(rank, setrank, unsetrank, depriv);
 
@@ -71,9 +71,9 @@ class ModuleCustomPrefix : public Module
 				if (!pm)
 					throw ModuleException("<customprefix:change> specified for a non-prefix mode at " + tag->source.str());
 
-				unsigned long rank = tag->getUInt("rank", pm->GetPrefixRank(), 0, UINT_MAX);
-				unsigned long setrank = tag->getUInt("ranktoset", pm->GetLevelRequired(true), rank, UINT_MAX);
-				unsigned long unsetrank = tag->getUInt("ranktounset", pm->GetLevelRequired(false), setrank, UINT_MAX);
+				unsigned int rank = static_cast<unsigned int>(tag->getUInt("rank", pm->GetPrefixRank(), 0, UINT_MAX));
+				unsigned int setrank = static_cast<unsigned int>(tag->getUInt("ranktoset", pm->GetLevelRequired(true), rank, UINT_MAX));
+				unsigned int unsetrank = static_cast<unsigned int>(tag->getUInt("ranktounset", pm->GetLevelRequired(false), setrank, UINT_MAX));
 				bool depriv = tag->getBool("depriv", pm->CanSelfRemove());
 				pm->Update(rank, setrank, unsetrank, depriv);
 
diff --git a/src/modules/m_dccallow.cpp b/src/modules/m_dccallow.cpp
index 36d86fa1d..3b7119cca 100644
--- a/src/modules/m_dccallow.cpp
+++ b/src/modules/m_dccallow.cpp
@@ -108,7 +108,7 @@ bannedfilelist bfl;
 class DCCAllowExt : public SimpleExtItem<dccallowlist>
 {
  public:
-	unsigned int maxentries;
+	unsigned long maxentries;
 
 	DCCAllowExt(Module* Creator)
 		: SimpleExtItem<dccallowlist>(Creator, "dccallow", ExtensionItem::EXT_USER)
diff --git a/src/modules/m_delaymsg.cpp b/src/modules/m_delaymsg.cpp
index d05235af5..5314aee7b 100644
--- a/src/modules/m_delaymsg.cpp
+++ b/src/modules/m_delaymsg.cpp
@@ -126,13 +126,13 @@ ModResult ModuleDelayMsg::HandleMessage(User* user, const MessageTarget& target,
 	if (ts == 0)
 		return MOD_RES_PASSTHRU;
 
-	int len = djm.ext.Get(channel);
+	intptr_t len = djm.ext.Get(channel);
 
 	if ((ts + len) > ServerInstance->Time())
 	{
 		if (channel->GetPrefixValue(user) < VOICE_VALUE)
 		{
-			const std::string message = InspIRCd::Format("You cannot send messages to this channel until you have been a member for %d seconds.", len);
+			const std::string message = InspIRCd::Format("You cannot send messages to this channel until you have been a member for %ld seconds.", len);
 			user->WriteNumeric(Numerics::CannotSendTo(channel, message));
 			return MOD_RES_DENY;
 		}
diff --git a/src/modules/m_dnsbl.cpp b/src/modules/m_dnsbl.cpp
index 76ca47bb4..f61998981 100644
--- a/src/modules/m_dnsbl.cpp
+++ b/src/modules/m_dnsbl.cpp
@@ -126,7 +126,7 @@ public:
 		{
 			type = Type::BITMASK;
 
-			bitmask = tag->getUInt("bitmask", 0, 0, UINT_MAX);
+			bitmask = static_cast<unsigned int>(tag->getUInt("bitmask", 0, 0, UINT_MAX));
 			records = 0;
 		}
 		else if (stdalgo::string::equalsci(typestr, "record"))
@@ -149,7 +149,7 @@ public:
 		}
 
 		reason = tag->getString("reason", "Your IP (%ip%) has been blacklisted by a DNSBL.", 1, ServerInstance->Config->Limits.MaxLine);
-		timeout = tag->getDuration("timeout", 0, 1, 60);
+		timeout = static_cast<unsigned int>(tag->getDuration("timeout", 0, 1, 60));
 		markident = tag->getString("ident");
 		markhost = tag->getString("host");
 		xlineduration = tag->getDuration("duration", 60*60, 1);
@@ -187,7 +187,7 @@ class DNSBLResolver : public DNS::Request
 			return;
 		}
 
-		int i = countExt.Get(them);
+		intptr_t i = countExt.Get(them);
 		if (i)
 			countExt.Set(them, i - 1);
 
@@ -358,7 +358,7 @@ class DNSBLResolver : public DNS::Request
 		if (!them || them->client_sa != theirsa)
 			return;
 
-		int i = countExt.Get(them);
+		intptr_t i = countExt.Get(them);
 		if (i)
 			countExt.Set(them, i - 1);
 
diff --git a/src/modules/m_gateway.cpp b/src/modules/m_gateway.cpp
index dbf2d9b4c..25489f14e 100644
--- a/src/modules/m_gateway.cpp
+++ b/src/modules/m_gateway.cpp
@@ -197,8 +197,12 @@ class CommandHexIP : public SplitCommand
 		if (errno)
 			return false;
 
+		// If the converted IP address is > 32 bits then it's not valid so bail.
+		if (address > UINT32_MAX)
+			return false;
+
 		out.in4.sin_family = AF_INET;
-		out.in4.sin_addr.s_addr = htonl(address);
+		out.in4.sin_addr.s_addr = htonl(uint32_t(address));
 		return true;
 	}
 };
diff --git a/src/modules/m_haproxy.cpp b/src/modules/m_haproxy.cpp
index 96c11a515..b300a15d6 100644
--- a/src/modules/m_haproxy.cpp
+++ b/src/modules/m_haproxy.cpp
@@ -384,7 +384,7 @@ class HAProxyHook : public IOHookMiddle
 		sock->AddIOHook(this);
 	}
 
-	int OnStreamSocketWrite(StreamSocket* sock, StreamSocket::SendQueue& uppersendq) override
+	ssize_t OnStreamSocketWrite(StreamSocket* sock, StreamSocket::SendQueue& uppersendq) override
 	{
 		// We don't need to implement this.
 		GetSendQ().moveall(uppersendq);
diff --git a/src/modules/m_hidelist.cpp b/src/modules/m_hidelist.cpp
index 643035205..aa70787be 100644
--- a/src/modules/m_hidelist.cpp
+++ b/src/modules/m_hidelist.cpp
@@ -68,7 +68,7 @@ class ModuleHideList : public Module
 				throw ModuleException("Empty <hidelist:mode> at " + tag->source.str());
 			// If rank is set to 0 everyone inside the channel can view the list,
 			// but non-members may not
-			unsigned int rank = tag->getUInt("rank", HALFOP_VALUE);
+			unsigned long rank = tag->getUInt("rank", HALFOP_VALUE);
 			newconfigs.push_back(std::make_pair(modename, rank));
 		}
 
diff --git a/src/modules/m_hidemode.cpp b/src/modules/m_hidemode.cpp
index 5799459c8..ef53d99c8 100644
--- a/src/modules/m_hidemode.cpp
+++ b/src/modules/m_hidemode.cpp
@@ -48,11 +48,11 @@ class Settings
 			if (modename.empty())
 				throw ModuleException("<hidemode:mode> is empty at " + tag->source.str());
 
-			unsigned int rank = tag->getUInt("rank", 0);
+			unsigned long rank = tag->getUInt("rank", 0);
 			if (!rank)
 				throw ModuleException("<hidemode:rank> must be greater than 0 at " + tag->source.str());
 
-			ServerInstance->Logs.Log(MODNAME, LOG_DEBUG, "Hiding the %s mode from users below rank %u", modename.c_str(), rank);
+			ServerInstance->Logs.Log(MODNAME, LOG_DEBUG, "Hiding the %s mode from users below rank %lu", modename.c_str(), rank);
 			newranks.emplace(modename, rank);
 		}
 		rankstosee.swap(newranks);
diff --git a/src/modules/m_hostchange.cpp b/src/modules/m_hostchange.cpp
index 4af7b6d18..86c00d592 100644
--- a/src/modules/m_hostchange.cpp
+++ b/src/modules/m_hostchange.cpp
@@ -46,12 +46,12 @@ class HostRule
 	HostChangeAction action;
 	std::string host;
 	std::string mask;
-	insp::flat_set<int> ports;
+	insp::flat_set<long> ports;
 	std::string prefix;
 	std::string suffix;
 
  public:
-	HostRule(const std::string& Mask, const std::string& Host, const insp::flat_set<int>& Ports)
+	HostRule(const std::string& Mask, const std::string& Host, const insp::flat_set<long>& Ports)
 		: action(HCA_SET)
 		, host(Host)
 		, mask(Mask)
@@ -59,7 +59,7 @@ class HostRule
 	{
 	}
 
-	HostRule(HostChangeAction Action, const std::string& Mask, const insp::flat_set<int>& Ports, const std::string& Prefix, const std::string& Suffix)
+	HostRule(HostChangeAction Action, const std::string& Mask, const insp::flat_set<long>& Ports, const std::string& Prefix, const std::string& Suffix)
 		: action(Action)
 		, mask(Mask)
 		, ports(Ports)
@@ -138,12 +138,12 @@ private:
 			if (mask.empty())
 				throw ModuleException("<hostchange:mask> is a mandatory field, at " + tag->source.str());
 
-			insp::flat_set<int> ports;
+			insp::flat_set<long> ports;
 			const std::string portlist = tag->getString("ports");
 			if (!portlist.empty())
 			{
 				irc::portparser portrange(portlist, false);
-				while (int port = portrange.GetToken())
+				while (long port = portrange.GetToken())
 					ports.insert(port);
 			}
 
diff --git a/src/modules/m_httpd.cpp b/src/modules/m_httpd.cpp
index 64c8065f6..1c513848b 100644
--- a/src/modules/m_httpd.cpp
+++ b/src/modules/m_httpd.cpp
@@ -202,7 +202,7 @@ class HttpServerSocket : public BufferedSocket, public Timer, public insp::intru
 	}
 
  public:
-	HttpServerSocket(int newfd, const std::string& IP, ListenSocket* via, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server, unsigned int timeoutsec)
+	HttpServerSocket(int newfd, const std::string& IP, ListenSocket* via, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server, unsigned long timeoutsec)
 		: BufferedSocket(newfd)
 		, Timer(timeoutsec)
 		, ip(IP)
@@ -404,7 +404,7 @@ class ModuleHttpServer : public Module
 {
  private:
 	HTTPdAPIImpl APIImpl;
-	unsigned int timeoutsec;
+	unsigned long timeoutsec;
 	Events::ModuleEventProvider acleventprov;
 	Events::ModuleEventProvider reqeventprov;
 
diff --git a/src/modules/m_ident.cpp b/src/modules/m_ident.cpp
index 0cb029bb0..6e09646a5 100644
--- a/src/modules/m_ident.cpp
+++ b/src/modules/m_ident.cpp
@@ -204,7 +204,7 @@ class IdentRequestSocket : public EventHandler
 		 * extremely short - there is *no* sane reason it'd be in more than one packet
 		 */
 		char ibuf[256];
-		int recvresult = SocketEngine::Recv(this, ibuf, sizeof(ibuf)-1, 0);
+		ssize_t recvresult = SocketEngine::Recv(this, ibuf, sizeof(ibuf)-1, 0);
 
 		/* Close (but don't delete from memory) our socket
 		 * and flag as done since the ident lookup has finished
@@ -274,7 +274,7 @@ class IdentRequestSocket : public EventHandler
 class ModuleIdent : public Module
 {
  private:
-	unsigned int timeout;
+	unsigned long timeout;
 	bool prefixunqueried;
 	SimpleExtItem<IdentRequestSocket, stdalgo::cull_delete> socket;
 	IntExtItem state;
diff --git a/src/modules/m_ircv3_batch.cpp b/src/modules/m_ircv3_batch.cpp
index eac86a705..7d9cb24ba 100644
--- a/src/modules/m_ircv3_batch.cpp
+++ b/src/modules/m_ircv3_batch.cpp
@@ -144,7 +144,8 @@ class IRCv3::Batch::ManagerImpl : public Manager
 		if (id >= MAX_BATCHES)
 			return;
 
-		batch.Setup(id);
+		// This cast is safe thanks to the clamping above.
+		batch.Setup(static_cast<unsigned int>(id));
 		// Set the manager field which Batch::IsRunning() checks and is also used by AddToBatch()
 		// to set the message tag
 		batch.manager = this;
diff --git a/src/modules/m_ircv3_sts.cpp b/src/modules/m_ircv3_sts.cpp
index 7a4dfdecd..8f2c6be5e 100644
--- a/src/modules/m_ircv3_sts.cpp
+++ b/src/modules/m_ircv3_sts.cpp
@@ -167,7 +167,7 @@ class ModuleIRCv3STS : public Module
 		if (host.empty())
 			throw ModuleException("<sts:host> must contain a hostname, at " + tag->source.str());
 
-		unsigned int port = tag->getUInt("port", 0, 0, UINT16_MAX);
+		unsigned int port = static_cast<unsigned int>(tag->getUInt("port", 0, 0, UINT16_MAX));
 		if (!HasValidSSLPort(port))
 			throw ModuleException("<sts:port> must be a TLS port, at " + tag->source.str());
 
diff --git a/src/modules/m_joinflood.cpp b/src/modules/m_joinflood.cpp
index 47f904620..5dfeb845f 100644
--- a/src/modules/m_joinflood.cpp
+++ b/src/modules/m_joinflood.cpp
@@ -155,7 +155,7 @@ class ModuleJoinFlood
 	void ReadConfig(ConfigStatus&) override
 	{
 		auto tag = ServerInstance->Config->ConfValue("joinflood");
-		duration = tag->getDuration("duration", 60, 10, 600);
+		duration = static_cast<unsigned int>(tag->getDuration("duration", 60, 10, 600));
 		bootwait = tag->getDuration("bootwait", 30);
 		splitwait = tag->getDuration("splitwait", 30);
 
diff --git a/src/modules/m_md5.cpp b/src/modules/m_md5.cpp
index 9e2ee7022..bc79a3089 100644
--- a/src/modules/m_md5.cpp
+++ b/src/modules/m_md5.cpp
@@ -76,14 +76,14 @@ class MD5Provider : public HashProvider
 		ctx->bytes[1] = 0;
 	}
 
-	void MD5Update(MD5Context *ctx, byte const *buf, int len)
+	void MD5Update(MD5Context *ctx, byte const *buf, size_t len)
 	{
 		word32 t;
 
 		/* Update byte count */
 
 		t = ctx->bytes[0];
-		if ((ctx->bytes[0] = t + len) < t)
+		if ((ctx->bytes[0] = word32(t + len)) < t)
 			ctx->bytes[1]++;	/* Carry from low to high */
 
 		t = 64 - (t & 0x3f);	/* Space available in ctx->in (at least 1) */
@@ -229,7 +229,7 @@ class MD5Provider : public HashProvider
 	}
 
 
-	void MyMD5(void *dest, void *orig, int len)
+	void MyMD5(void *dest, void *orig, size_t len)
 	{
 		MD5Context context;
 		MD5Init(&context);
diff --git a/src/modules/m_monitor.cpp b/src/modules/m_monitor.cpp
index 4fd656a13..1ac0b3c63 100644
--- a/src/modules/m_monitor.cpp
+++ b/src/modules/m_monitor.cpp
@@ -118,7 +118,7 @@ class IRCv3::Monitor::Manager
 		WR_INVALIDNICK
 	};
 
-	WatchResult Watch(LocalUser* user, const std::string& nick, unsigned int maxwatch)
+	WatchResult Watch(LocalUser* user, const std::string& nick, unsigned long maxwatch)
 	{
 		if (!ServerInstance->IsNick(nick))
 			return WR_INVALIDNICK;
@@ -301,7 +301,7 @@ class CommandMonitor : public SplitCommand
 	}
 
  public:
-	unsigned int maxmonitor;
+	unsigned long maxmonitor;
 
 	CommandMonitor(Module* mod, IRCv3::Monitor::Manager& managerref)
 		: SplitCommand(mod, "MONITOR", 1)
diff --git a/src/modules/m_nationalchars.cpp b/src/modules/m_nationalchars.cpp
index ee5086c6f..9bb3ea7e7 100644
--- a/src/modules/m_nationalchars.cpp
+++ b/src/modules/m_nationalchars.cpp
@@ -380,7 +380,7 @@ class ModuleNationalChars : public Module
 		std::string buf;
 		getline(ifs, buf);
 
-		unsigned int i = 0;
+		unsigned long i = 0;
 		int fail = 0;
 
 		buf.erase(buf.find_last_not_of("\n") + 1);
diff --git a/src/modules/m_nickflood.cpp b/src/modules/m_nickflood.cpp
index b12273172..83ff988dc 100644
--- a/src/modules/m_nickflood.cpp
+++ b/src/modules/m_nickflood.cpp
@@ -139,7 +139,7 @@ class ModuleNickFlood : public Module
 	void ReadConfig(ConfigStatus&) override
 	{
 		auto tag = ServerInstance->Config->ConfValue("nickflood");
-		duration = tag->getDuration("duration", 60, 10, 600);
+		duration = static_cast<unsigned int>(tag->getDuration("duration", 60, 10, 600));
 	}
 
 	ModResult OnUserPreNick(LocalUser* user, const std::string& newnick) override
diff --git a/src/modules/m_pbkdf2.cpp b/src/modules/m_pbkdf2.cpp
index c44f4b384..a7e781014 100644
--- a/src/modules/m_pbkdf2.cpp
+++ b/src/modules/m_pbkdf2.cpp
@@ -30,12 +30,12 @@
 class PBKDF2Hash
 {
  public:
-	unsigned int iterations;
-	unsigned int length;
+	unsigned long iterations;
+	size_t length;
 	std::string salt;
 	std::string hash;
 
-	PBKDF2Hash(unsigned int itr, unsigned int dkl, const std::string& slt, const std::string& hsh = "")
+	PBKDF2Hash(unsigned long itr, size_t dkl, const std::string& slt, const std::string& hsh = "")
 		: iterations(itr), length(dkl), salt(slt), hash(hsh)
 	{
 	}
@@ -76,10 +76,10 @@ class PBKDF2Provider : public HashProvider
 {
  public:
 	HashProvider* provider;
-	unsigned int iterations;
-	unsigned int dkey_length;
+	unsigned long iterations;
+	size_t dkey_length;
 
-	std::string PBKDF2(const std::string& pass, const std::string& salt, unsigned int itr = 0, unsigned int dkl = 0)
+	std::string PBKDF2(const std::string& pass, const std::string& salt, unsigned long itr = 0, size_t dkl = 0)
 	{
 		size_t blocks = std::ceil((double)dkl / provider->out_size);
 
diff --git a/src/modules/m_remove.cpp b/src/modules/m_remove.cpp
index 50d710f81..36976bcb7 100644
--- a/src/modules/m_remove.cpp
+++ b/src/modules/m_remove.cpp
@@ -45,7 +45,7 @@ class RemoveBase : public Command
 	ChanModeReference& nokicksmode;
 
  public:
-	unsigned int protectedrank;
+	unsigned long protectedrank;
 
 	RemoveBase(Module* Creator, bool& snk, ChanModeReference& nkm, const char* cmdn)
 		: Command(Creator, cmdn, 2, 3)
diff --git a/src/modules/m_repeat.cpp b/src/modules/m_repeat.cpp
index 0b305257f..af53fb6c2 100644
--- a/src/modules/m_repeat.cpp
+++ b/src/modules/m_repeat.cpp
@@ -85,18 +85,18 @@ class RepeatMode : public ParamMode<RepeatMode, SimpleExtItem<ChannelSettings> >
 
 	struct ModuleSettings
 	{
-		unsigned int MaxLines = 0;
-		unsigned int MaxSecs = 0;
-		unsigned int MaxBacklog = 0;
+		unsigned long MaxLines = 0;
+		unsigned long MaxSecs = 0;
+		unsigned long MaxBacklog = 0;
 		unsigned int MaxDiff = 0;
-		unsigned int MaxMessageSize = 0;
+		size_t MaxMessageSize = 0;
 		std::string KickMessage;
 
 	};
 
-	std::vector<unsigned int> mx[2];
+	std::vector<size_t> mx[2];
 
-	bool CompareLines(const std::string& message, const std::string& historyline, unsigned int trigger)
+	bool CompareLines(const std::string& message, const std::string& historyline, unsigned long trigger)
 	{
 		if (message == historyline)
 			return true;
@@ -106,17 +106,17 @@ class RepeatMode : public ParamMode<RepeatMode, SimpleExtItem<ChannelSettings> >
 		return false;
 	}
 
-	unsigned int Levenshtein(const std::string& s1, const std::string& s2)
+	size_t Levenshtein(const std::string& s1, const std::string& s2)
 	{
-		unsigned int l1 = s1.size();
-		unsigned int l2 = s2.size();
+		size_t l1 = s1.size();
+		size_t l2 = s2.size();
 
-		for (unsigned int i = 0; i < l2; i++)
+		for (size_t i = 0; i < l2; i++)
 			mx[0][i] = i;
-		for (unsigned int i = 0; i < l1; i++)
+		for (size_t i = 0; i < l1; i++)
 		{
 			mx[1][0] = i + 1;
-			for (unsigned int j = 0; j < l2; j++)
+			for (size_t j = 0; j < l2; j++)
 				mx[1][j + 1] = std::min(std::min(mx[1][j] + 1, mx[0][j + 1] + 1), mx[0][j] + ((s1[i] == s2[j]) ? 0 : 1));
 
 			mx[0].swap(mx[1]);
@@ -186,7 +186,7 @@ class RepeatMode : public ParamMode<RepeatMode, SimpleExtItem<ChannelSettings> >
 			matches = rp->Counter;
 
 		RepeatItemList& items = rp->ItemList;
-		const unsigned int trigger = (message.size() * rs->Diff / 100);
+		const unsigned long trigger = (message.size() * rs->Diff / 100);
 		const time_t now = ServerInstance->Time();
 
 		std::transform(message.begin(), message.end(), message.begin(), ::tolower);
@@ -243,11 +243,9 @@ class RepeatMode : public ParamMode<RepeatMode, SimpleExtItem<ChannelSettings> >
 		ms.MaxBacklog = conf->getUInt("maxbacklog", 20);
 		ms.MaxSecs = conf->getDuration("maxtime", 0);
 
-		ms.MaxDiff = conf->getUInt("maxdistance", 50);
-		if (ms.MaxDiff > 100)
-			ms.MaxDiff = 100;
+		ms.MaxDiff = static_cast<unsigned int>(conf->getUInt("maxdistance", 50, 0, 100));
 
-		unsigned int newsize = conf->getUInt("size", 512);
+		unsigned long newsize = conf->getUInt("size", 512);
 		if (newsize > ServerInstance->Config->Limits.MaxLine)
 			newsize = ServerInstance->Config->Limits.MaxLine;
 		Resize(newsize);
@@ -317,14 +315,14 @@ class RepeatMode : public ParamMode<RepeatMode, SimpleExtItem<ChannelSettings> >
 		if (ms.MaxLines && settings.Lines > ms.MaxLines)
 		{
 			source->WriteNumeric(Numerics::InvalidModeParameter(channel, this, parameter, InspIRCd::Format(
-				"The line number you specified is too big. Maximum allowed is %u.", ms.MaxLines)));
+				"The line number you specified is too big. Maximum allowed is %lu.", ms.MaxLines)));
 			return false;
 		}
 
 		if (ms.MaxSecs && settings.Seconds > ms.MaxSecs)
 		{
 			source->WriteNumeric(Numerics::InvalidModeParameter(channel, this, parameter, InspIRCd::Format(
-				"The seconds you specified are too big. Maximum allowed is %u.", ms.MaxSecs)));
+				"The seconds you specified are too big. Maximum allowed is %lu.", ms.MaxSecs)));
 			return false;
 		}
 
@@ -346,7 +344,7 @@ class RepeatMode : public ParamMode<RepeatMode, SimpleExtItem<ChannelSettings> >
 					"The server administrator has disabled backlog matching."));
 			else
 				source->WriteNumeric(Numerics::InvalidModeParameter(channel, this, parameter, InspIRCd::Format(
-					"The backlog you specified is too big. Maximum allowed is %u.", ms.MaxBacklog)));
+					"The backlog you specified is too big. Maximum allowed is %lu.", ms.MaxBacklog)));
 			return false;
 		}
 
@@ -423,7 +421,7 @@ class RepeatModule : public Module
 		data["max-diff"] = ConvToStr(rm.ms.MaxDiff);
 		data["max-backlog"] = ConvToStr(rm.ms.MaxBacklog);
 
-		compatdata = InspIRCd::Format("%u:%u:%u:%u", rm.ms.MaxLines, rm.ms.MaxSecs,
+		compatdata = InspIRCd::Format("%lu:%lu:%u:%lu", rm.ms.MaxLines, rm.ms.MaxSecs,
 			rm.ms.MaxDiff, rm.ms.MaxBacklog);
 	}
 };
diff --git a/src/modules/m_securelist.cpp b/src/modules/m_securelist.cpp
index 07ba8ed7d..a475c9255 100644
--- a/src/modules/m_securelist.cpp
+++ b/src/modules/m_securelist.cpp
@@ -41,7 +41,7 @@ class ModuleSecureList final
 	std::string fakechanprefix;
 	std::string fakechantopic;
 	bool showmsg;
-	unsigned int waittime;
+	unsigned long waittime;
 
  public:
 	ModuleSecureList()
@@ -114,11 +114,11 @@ class ModuleSecureList final
 		for (unsigned long fakechan = 0; fakechan < fakechans; ++fakechan)
 		{
 			// Generate the fake channel name.
-			unsigned int chansuffixsize = ServerInstance->GenRandomInt(maxfakesuffix) + 1;
+			unsigned long chansuffixsize = ServerInstance->GenRandomInt(maxfakesuffix) + 1;
 			const std::string chansuffix = ServerInstance->GenRandomStr(chansuffixsize);
 
 			// Generate the fake channel size.
-			unsigned int chanusers = ServerInstance->GenRandomInt(ServerInstance->Users.GetUsers().size()) + 1;
+			unsigned long chanusers = ServerInstance->GenRandomInt(ServerInstance->Users.GetUsers().size()) + 1;
 
 			// Generate the fake channel topic.
 			std::string chantopic(fakechantopic);
diff --git a/src/modules/m_sha2.cpp b/src/modules/m_sha2.cpp
index e3ad8a6f7..72a6d5530 100644
--- a/src/modules/m_sha2.cpp
+++ b/src/modules/m_sha2.cpp
@@ -43,7 +43,7 @@ class HashSHA2 : public HashProvider
 	std::string GenerateRaw(const std::string& data) override
 	{
 		std::vector<char> bytes(out_size);
-		SHA(reinterpret_cast<const unsigned char*>(data.data()), data.size(), reinterpret_cast<unsigned char*>(&bytes[0]));
+		SHA(reinterpret_cast<const unsigned char*>(data.data()), static_cast<unsigned int>(data.size()), reinterpret_cast<unsigned char*>(&bytes[0]));
 		return std::string(&bytes[0], bytes.size());
 	}
 };
diff --git a/src/modules/m_showfile.cpp b/src/modules/m_showfile.cpp
index dff520a11..92bb67470 100644
--- a/src/modules/m_showfile.cpp
+++ b/src/modules/m_showfile.cpp
@@ -81,9 +81,9 @@ class CommandShowFile : public Command
 	{
 		introtext = tag->getString("introtext", "Showing " + name);
 		endtext = tag->getString("endtext", "End of " + name);
-		intronumeric = tag->getUInt("intronumeric", RPL_RULESTART, 0, 999);
-		textnumeric = tag->getUInt("numeric", RPL_RULES, 0, 999);
-		endnumeric = tag->getUInt("endnumeric", RPL_RULESEND, 0, 999);
+		intronumeric = static_cast<unsigned int>(tag->getUInt("intronumeric", RPL_RULESTART, 0, 999));
+		textnumeric = static_cast<unsigned int>(tag->getUInt("numeric", RPL_RULES, 0, 999));
+		endnumeric = static_cast<unsigned int>(tag->getUInt("endnumeric", RPL_RULESEND, 0, 999));
 		std::string smethod = tag->getString("method");
 
 		method = SF_NUMERIC;
diff --git a/src/modules/m_silence.cpp b/src/modules/m_silence.cpp
index 4941c1094..a8e1be44a 100644
--- a/src/modules/m_silence.cpp
+++ b/src/modules/m_silence.cpp
@@ -187,7 +187,7 @@ typedef insp::flat_set<SilenceEntry> SilenceList;
 class SilenceExtItem : public SimpleExtItem<SilenceList>
 {
  public:
-	unsigned int maxsilence;
+	unsigned long maxsilence;
 
 	SilenceExtItem(Module* Creator)
 		: SimpleExtItem<SilenceList>(Creator, "silence_list", ExtensionItem::EXT_USER)
diff --git a/src/modules/m_spanningtree/link.h b/src/modules/m_spanningtree/link.h
index 87fd2560f..7ca868fcf 100644
--- a/src/modules/m_spanningtree/link.h
+++ b/src/modules/m_spanningtree/link.h
@@ -39,7 +39,7 @@ class Link
 	std::vector<std::string> AllowMasks;
 	bool HiddenFromStats;
 	std::string Hook;
-	unsigned int Timeout;
+	unsigned long Timeout;
 	std::string Bind;
 	bool Hidden;
 	Link(std::shared_ptr<ConfigTag> Tag)
diff --git a/src/modules/m_spanningtree/override_map.cpp b/src/modules/m_spanningtree/override_map.cpp
index 6801a47fe..55d9674bd 100644
--- a/src/modules/m_spanningtree/override_map.cpp
+++ b/src/modules/m_spanningtree/override_map.cpp
@@ -55,7 +55,7 @@ static inline bool IsHidden(User* user, TreeServer* server)
 }
 
 // Calculate the map depth the servers go, and the longest server name
-static void GetDepthAndLen(TreeServer* current, unsigned int depth, unsigned int& max_depth, unsigned int& max_len, unsigned int& max_version)
+static void GetDepthAndLen(TreeServer* current, unsigned int depth, unsigned int& max_depth, size_t& max_len, size_t& max_version)
 {
 	if (depth > max_depth)
 		max_depth = depth;
@@ -70,7 +70,7 @@ static void GetDepthAndLen(TreeServer* current, unsigned int depth, unsigned int
 		GetDepthAndLen(child, depth + 1, max_depth, max_len, max_version);
 }
 
-static std::vector<std::string> GetMap(User* user, TreeServer* current, unsigned int max_len, unsigned int max_version_len, unsigned int depth)
+static std::vector<std::string> GetMap(User* user, TreeServer* current, size_t max_len, size_t max_version_len, unsigned int depth)
 {
 	float percent = 0;
 
@@ -98,7 +98,7 @@ static std::vector<std::string> GetMap(User* user, TreeServer* current, unsigned
 	// Pad with spaces until its at max len, max_len must always be >= my names length
 	buffer.append(max_len - current->GetName().length(), ' ');
 
-	buffer += InspIRCd::Format("%5d [%5.2f%%]", current->UserCount, percent);
+	buffer += InspIRCd::Format("%5zu [%5.2f%%]", current->UserCount, percent);
 
 	if (user->IsOper())
 	{
@@ -122,7 +122,7 @@ static std::vector<std::string> GetMap(User* user, TreeServer* current, unsigned
 			if (!IsHidden(user, *j))
 				last = false;
 
-		unsigned int next_len;
+		size_t next_len;
 
 		if (user->IsOper() || !Utils->FlatLinks)
 		{
@@ -196,11 +196,11 @@ CmdResult CommandMap::Handle(User* user, const Params& parameters)
 
 	// Max depth and max server name length
 	unsigned int max_depth = 0;
-	unsigned int max_len = 0;
-	unsigned int max_version = 0;
+	size_t max_len = 0;
+	size_t max_version = 0;
 	GetDepthAndLen(Utils->TreeRoot, 0, max_depth, max_len, max_version);
 
-	unsigned int max;
+	size_t max;
 	if (user->IsOper() || !Utils->FlatLinks)
 	{
 		// Each level of the map is indented by 2 characters, making the max possible line (max_depth * 2) + max_len
diff --git a/src/modules/m_spanningtree/pingtimer.cpp b/src/modules/m_spanningtree/pingtimer.cpp
index fce90bfa4..0187532bd 100644
--- a/src/modules/m_spanningtree/pingtimer.cpp
+++ b/src/modules/m_spanningtree/pingtimer.cpp
@@ -48,7 +48,7 @@ PingTimer::State PingTimer::TickInternal()
 	else if (state == PS_WARN)
 	{
 		// No pong arrived in PingWarnTime seconds, send a warning to opers
-		ServerInstance->SNO.WriteToSnoMask('l', "Server \002%s\002 has not responded to PING for %d seconds, high latency.", server->GetName().c_str(), GetInterval());
+		ServerInstance->SNO.WriteToSnoMask('l', "Server \002%s\002 has not responded to PING for %lu seconds, high latency.", server->GetName().c_str(), GetInterval());
 		return PS_TIMEOUT;
 	}
 	else // PS_TIMEOUT
diff --git a/src/modules/m_spanningtree/treeserver.cpp b/src/modules/m_spanningtree/treeserver.cpp
index f0e85828c..dfe7edb3d 100644
--- a/src/modules/m_spanningtree/treeserver.cpp
+++ b/src/modules/m_spanningtree/treeserver.cpp
@@ -185,9 +185,9 @@ void TreeServer::SQuitChild(TreeServer* server, const std::string& reason, bool
 	server->SQuitInternal(num_lost_servers, error);
 
 	const std::string quitreason = GetName() + " " + server->GetName();
-	unsigned int num_lost_users = QuitUsers(quitreason);
+	size_t num_lost_users = QuitUsers(quitreason);
 
-	ServerInstance->SNO.WriteToSnoMask(IsRoot() ? 'l' : 'L', "Netsplit complete, lost \002%u\002 user%s on \002%u\002 server%s.",
+	ServerInstance->SNO.WriteToSnoMask(IsRoot() ? 'l' : 'L', "Netsplit complete, lost \002%zu\002 user%s on \002%u\002 server%s.",
 		num_lost_users, num_lost_users != 1 ? "s" : "", num_lost_servers, num_lost_servers != 1 ? "s" : "");
 
 	// No-op if the socket is already closed (i.e. it called us)
@@ -214,12 +214,12 @@ void TreeServer::SQuitInternal(unsigned int& num_lost_servers, bool error)
 		Utils->Creator->linkeventprov.Call(&ServerProtocol::LinkEventListener::OnServerSplit, this, error);
 }
 
-unsigned int TreeServer::QuitUsers(const std::string& reason)
+size_t TreeServer::QuitUsers(const std::string& reason)
 {
 	std::string publicreason = Utils->HideSplits ? "*.net *.split" : reason;
 
 	const user_hash& users = ServerInstance->Users.GetUsers();
-	unsigned int original_size = users.size();
+	size_t original_size = users.size();
 	for (user_hash::const_iterator i = users.begin(); i != users.end(); )
 	{
 		User* user = i->second;
diff --git a/src/modules/m_spanningtree/treeserver.h b/src/modules/m_spanningtree/treeserver.h
index 8b09f3817..2ea983555 100644
--- a/src/modules/m_spanningtree/treeserver.h
+++ b/src/modules/m_spanningtree/treeserver.h
@@ -90,8 +90,8 @@ class TreeServer : public Server
 	FakeUser* const ServerUser;		/* User representing this server */
 	const time_t age;
 
-	unsigned int UserCount;			/* How many users are on this server? [note: doesn't care about +i] */
-	unsigned int OperCount = 0;			/* How many opers are on this server? */
+	size_t UserCount;			/* How many users are on this server? [note: doesn't care about +i] */
+	size_t OperCount = 0;			/* How many opers are on this server? */
 
 	/** We use this constructor only to create the 'root' item, Utils->TreeRoot, which
 	 * represents our own server. Therefore, it has no route, no parent, and
@@ -121,7 +121,7 @@ class TreeServer : public Server
 		GetParent()->SQuitChild(this, reason, error);
 	}
 
-	static unsigned int QuitUsers(const std::string& reason);
+	static size_t QuitUsers(const std::string& reason);
 
 	/** Get route.
 	 * The 'route' is defined as the locally-
diff --git a/src/modules/m_spanningtree/utils.cpp b/src/modules/m_spanningtree/utils.cpp
index 80fd26ed4..50735dc1f 100644
--- a/src/modules/m_spanningtree/utils.cpp
+++ b/src/modules/m_spanningtree/utils.cpp
@@ -258,7 +258,7 @@ void SpanningTreeUtilities::ReadConfiguration()
 
 		L->Name = tag->getString("name");
 		L->IPAddr = tag->getString("ipaddr");
-		L->Port = tag->getUInt("port", 0);
+		L->Port = static_cast<unsigned int>(tag->getUInt("port", 0, 0, UINT16_MAX));
 		L->SendPass = tag->getString("sendpass", tag->getString("password"));
 		L->RecvPass = tag->getString("recvpass", tag->getString("password"));
 		L->Fingerprint = tag->getString("fingerprint");
diff --git a/src/modules/m_spanningtree/utils.h b/src/modules/m_spanningtree/utils.h
index 8058a83c0..0181cade6 100644
--- a/src/modules/m_spanningtree/utils.h
+++ b/src/modules/m_spanningtree/utils.h
@@ -83,7 +83,7 @@ class SpanningTreeUtilities : public Cullable
 	/* Number of seconds that a server can go without ping
 	 * before opers are warned of high latency.
 	 */
-	unsigned int PingWarnTime;
+	unsigned long PingWarnTime;
 	/** This variable represents the root of the server tree
 	 */
 	TreeServer *TreeRoot = nullptr;
@@ -108,7 +108,7 @@ class SpanningTreeUtilities : public Cullable
 
 	/** Ping frequency of server to server links
 	 */
-	unsigned int PingFreq = 60;
+	unsigned long PingFreq = 60;
 
 	/** Initialise utility class
 	 */
diff --git a/src/modules/m_watch.cpp b/src/modules/m_watch.cpp
index 194f197e1..a4fc3c06a 100644
--- a/src/modules/m_watch.cpp
+++ b/src/modules/m_watch.cpp
@@ -122,7 +122,7 @@ class CommandWatch : public SplitCommand
 	}
 
  public:
-	unsigned int maxwatch;
+	unsigned long maxwatch;
 
 	CommandWatch(Module* mod, IRCv3::Monitor::Manager& managerref)
 		: SplitCommand(mod, "WATCH")
diff --git a/src/modules/m_websocket.cpp b/src/modules/m_websocket.cpp
index 20023875d..ba4621b87 100644
--- a/src/modules/m_websocket.cpp
+++ b/src/modules/m_websocket.cpp
@@ -423,7 +423,7 @@ class WebSocketHook : public IOHookMiddle
 		sock->AddIOHook(this);
 	}
 
-	int OnStreamSocketWrite(StreamSocket* sock, StreamSocket::SendQueue& uppersendq) override
+	ssize_t OnStreamSocketWrite(StreamSocket* sock, StreamSocket::SendQueue& uppersendq) override
 	{
 		StreamSocket::SendQueue& mysendq = GetSendQ();