unrealircd/src/securitygroup.c

/*
 * Mask & security-group routines.
 * (C) Copyright 2015-.. Syzop and the UnrealIRCd team
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 */

#include "unrealircd.h"

/* Global variables */
SecurityGroup *securitygroups = NULL;

/** Free all masks in the mask list */
void unreal_delete_masks(ConfigItem_mask *m)
{
	ConfigItem_mask *m_next;

	for (; m; m = m_next)
	{
		m_next = m->next;

		safe_free(m->mask);

		safe_free(m);
	}
}

/** Internal function to add one individual mask to the list */
static void unreal_add_mask(ConfigItem_mask **head, ConfigEntry *ce)
{
	ConfigItem_mask *m = safe_alloc(sizeof(ConfigItem_mask));

	/* Since we allow both mask "xyz"; and mask { abc; def; };... */
	if (ce->value)
		safe_strdup(m->mask, ce->value);
	else
		safe_strdup(m->mask, ce->name);

	add_ListItem((ListStruct *)m, (ListStruct **)head);
}

/** Add mask entries from config */
void unreal_add_masks(ConfigItem_mask **head, ConfigEntry *ce)
{
	if (ce->items)
	{
		ConfigEntry *cep;
		for (cep = ce->items; cep; cep = cep->next)
			unreal_add_mask(head, cep);
	} else
	{
		unreal_add_mask(head, ce);
	}
}

/** Check if a client matches any of the masks in the mask list.
 * The following rules apply:
 * - If you have only negating entries, like '!abc' and '!def', then
 *   we assume an implicit * rule first, since that is clearly what
 *   the user wants.
 * - If you have a mix, like '*.com', '!irc1*', '!irc2*' then the
 *   implicit * is dropped and we assume you only want to match *.com,
 *   with the exception of irc1*.com and irc2*.com.
 * - If you only have normal entries without ! then things are
 *   as they always are.
 * @param client	The client to run the mask match against
 * @param mask		The mask entry from the config file
 * @returns 1 on match, 0 on non-match.
 */
int unreal_mask_match(Client *client, ConfigItem_mask *mask)
{
	int retval = 1;
	ConfigItem_mask *m;

	if (!mask)
		return 0; /* Empty mask block is no match */

	/* First check normal matches (without ! prefix) */
	for (m = mask; m; m = m->next)
	{
		if (m->mask[0] != '!')
		{
			retval = 0; /* no implicit * */
			if (match_user(m->mask, client, MATCH_CHECK_REAL|MATCH_CHECK_EXTENDED))
			{
				retval = 1;
				break;
			}
		}
	}

	if (retval)
	{
		/* We matched. Check for exceptions (with ! prefix) */
		for (m = mask; m; m = m->next)
		{
			if ((m->mask[0] == '!') && match_user(m->mask+1, client, MATCH_CHECK_REAL|MATCH_CHECK_EXTENDED))
				return 0;
		}
	}

	return retval;
}

/** Check if a string matches any of the masks in the mask list.
 * The following rules apply:
 * - If you have only negating entries, like '!abc' and '!def', then
 *   we assume an implicit * rule first, since that is clearly what
 *   the user wants.
 * - If you have a mix, like '*.com', '!irc1*', '!irc2*' then the
 *   implicit * is dropped and we assume you only want to match *.com,
 *   with the exception of irc1*.com and irc2*.com.
 * - If you only have normal entries without ! then things are
 *   as they always are.
 * @param name	The name to run the mask matching on
 * @param mask	The mask entry from the config file
 * @returns 1 on match, 0 on non-match.
 */
int unreal_mask_match_string(const char *name, ConfigItem_mask *mask)
{
	int retval = 1;
	ConfigItem_mask *m;

	if (!mask)
		return 0; /* Empty mask block is no match */

	/* First check normal matches (without ! prefix) */
	for (m = mask; m; m = m->next)
	{
		if (m->mask[0] != '!')
		{
			retval = 0; /* no implicit * */
			if (match_simple(m->mask, name))
			{
				retval = 1;
				break;
			}
		}
	}

	if (retval)
	{
		/* We matched. Check for exceptions (with ! prefix) */
		for (m = mask; m; m = m->next)
		{
			if ((m->mask[0] == '!') && match_simple(m->mask+1, name))
				return 0;
		}
	}

	return retval;
}

#define CheckNullX(x) if ((!(x)->value) || (!(*((x)->value)))) { config_error("%s:%i: missing parameter", (x)->file->filename, (x)->line_number); *errors = *errors + 1; return 0; }
int test_match_item(ConfigFile *conf, ConfigEntry *cep, int *errors)
{
	ConfigEntry *cepp;

	if (!strcmp(cep->name, "webirc") || !strcmp(cep->name, "exclude-webirc"))
	{
		CheckNullX(cep);
	} else
	if (!strcmp(cep->name, "websocket") || !strcmp(cep->name, "exclude-websocket"))
	{
		CheckNullX(cep);
	} else
	if (!strcmp(cep->name, "identified") || !strcmp(cep->name, "exclude-identified"))
	{
		CheckNullX(cep);
	} else
	if (!strcmp(cep->name, "tls") || !strcmp(cep->name, "exclude-tls"))
	{
		CheckNullX(cep);
	} else
	if (!strcmp(cep->name, "reputation-score") || !strcmp(cep->name, "exclude-reputation-score"))
	{
		const char *str = cep->value;
		int v;
		CheckNullX(cep);
		if (*str == '<')
			str++;
		v = atoi(str);
		if ((v < 1) || (v > 10000))
		{
			config_error("%s:%i: %s needs to be a value of 1-10000",
				cep->file->filename, cep->line_number, cep->name);
			*errors = *errors + 1;
		}
	} else
	if (!strcmp(cep->name, "connect-time") || !strcmp(cep->name, "exclude-connect-time"))
	{
		const char *str = cep->value;
		long v;
		CheckNullX(cep);
		if (*str == '<')
			str++;
		v = config_checkval(str, CFG_TIME);
		if (v < 1)
		{
			config_error("%s:%i: %s needs to be a time value (and more than 0 seconds)",
				cep->file->filename, cep->line_number, cep->name);
			*errors = *errors + 1;
		}
	} else
	if (!strcmp(cep->name, "mask") || !strcmp(cep->name, "include-mask") || !strcmp(cep->name, "exclude-mask"))
	{
		for (cepp = cep->items; cepp; cepp = cepp->next)
		{
			if (!strcmp(cepp->name, "mask"))
				continue;
			if (cepp->items || cepp->value)
			{
				config_error("%s:%i: security-group::mask should contain hostmasks only. "
				             "Perhaps you meant to use it in security-group { %s ... } directly?",
				             cepp->file->filename, cepp->line_number,
				             cepp->name);
				*errors = *errors + 1;
			}
		}
	} else
	if (!strcmp(cep->name, "ip"))
	{
	} else
	if (!strcmp(cep->name, "security-group") || !strcmp(cep->name, "exclude-security-group"))
	{
	} else
	{
		/* Let's see if an extended server ban exists for this item... */
		Extban *extban;
		if (!strncmp(cep->name, "exclude-", 8))
			extban = findmod_by_bantype_raw(cep->name+8, strlen(cep->name+8));
		else
			extban = findmod_by_bantype_raw(cep->name, strlen(cep->name));
		if (extban && (extban->options & EXTBOPT_TKL) && (extban->is_banned_events & BANCHK_TKL))
		{
			test_extended_list(extban, cep, errors);
			return 1; /* Yup, handled */
		}
		return 0; /* Unhandled: unknown item for us */
	}
	return 1; /* Handled, but there could be errors */
}

int test_match_block(ConfigFile *conf, ConfigEntry *ce, int *errors_out)
{
	int errors = 0;
	ConfigEntry *cep;

	/* (If there is only a ce->value, trust that it is OK) */

	/* Test ce->items... */
	for (cep = ce->items; cep; cep = cep->next)
	{
		/* Only complain about things with values,
		 * as valueless things like "10.0.0.0/8" are treated as a mask.
		 */
		if (!test_match_item(conf, cep, &errors) && cep->value)
		{
			config_error_unknown(cep->file->filename, cep->line_number,
				ce->name, cep->name);
			errors++;
			continue;
		}
	}

	*errors_out = *errors_out + errors;
	return errors ? 0 : 1;
}

#define tmbbw_is_wildcard(x)	(!strcmp(x, "*") || !strcmp(x, "*@*"))
int test_match_block_too_broad(ConfigFile *conf, ConfigEntry *ce)
{
	ConfigEntry *cep, *cepp;

	// match *;
	if (ce->value && tmbbw_is_wildcard(ce->value))
		return 1;

	for (cep = ce->items; cep; cep = cep->next)
	{
		// match { *; }
		if (!cep->value && tmbbw_is_wildcard(cep->name))
			return 1;
		if (!strcmp(cep->name, "mask") || !strcmp(cep->name, "include-mask") || !strcmp(cep->name, "ip"))
		{
			// match { mask *; }
			if (cep->value && tmbbw_is_wildcard(cep->value))
				return 1;
			// match { mask { *; } }
			for (cepp = cep->items; cepp; cepp = cepp->next)
				if (tmbbw_is_wildcard(cepp->name))
					return 1;
		}
	}

	return 0;
}

int _test_security_group(ConfigFile *conf, ConfigEntry *ce)
{
	int errors = 0;
	ConfigEntry *cep;

	/* First, check the name of the security group */
	if (!ce->value)
	{
		config_error("%s:%i: security-group block needs a name, eg: security-group web-users {",
			ce->file->filename, ce->line_number);
		errors++;
	} else {
		if (!strcasecmp(ce->value, "unknown-users"))
		{
			config_error("%s:%i: The 'unknown-users' group is a special group that is the "
			             "inverse of 'known-users', you cannot create or adjust it in the "
			             "config file, as it is created automatically by UnrealIRCd.",
			             ce->file->filename, ce->line_number);
			errors++;
			return errors;
		}
		if (!security_group_valid_name(ce->value))
		{
			config_error("%s:%i: security-group block name '%s' contains invalid characters or is too long. "
			             "Only letters, numbers, underscore and hyphen are allowed.",
			             ce->file->filename, ce->line_number, ce->value);
			errors++;
		}
	}

	for (cep = ce->items; cep; cep = cep->next)
	{
		if (!test_match_item(conf, cep, &errors))
		{
			config_error_unknown(cep->file->filename, cep->line_number,
				"security-group", cep->name);
			errors++;
			continue;
		}
	}

	return errors;
}

int conf_match_item(ConfigFile *conf, ConfigEntry *cep, SecurityGroup **block)
{
	int errors = 0; /* unused */
	SecurityGroup *s = *block;

	/* The following code is there so we don't create a security group
	 * unless there is actually a valid config item for it encountered.
	 * This so the security group '*s' can stay NULL if there are zero
	 * items, so we don't waste any CPU if it is unused.
	 */
	if (*block == NULL)
	{
		/* Yeah we call a TEST routine from a CONFIG RUN routine ;). */
		if (!test_match_item(conf, cep, &errors))
			return 0; /* not for us */
		/* If we are still here then we must create the security group */
		*block = s = safe_alloc(sizeof(SecurityGroup));
	}

	if (!strcmp(cep->name, "webirc"))
		s->webirc = config_checkval(cep->value, CFG_YESNO);
	if (!strcmp(cep->name, "websocket"))
		s->websocket = config_checkval(cep->value, CFG_YESNO);
	else if (!strcmp(cep->name, "identified"))
		s->identified = config_checkval(cep->value, CFG_YESNO);
	else if (!strcmp(cep->name, "tls"))
		s->tls = config_checkval(cep->value, CFG_YESNO);
	else if (!strcmp(cep->name, "reputation-score"))
	{
		if (*cep->value == '<')
			s->reputation_score = 0 - atoi(cep->value+1);
		else
			s->reputation_score = atoi(cep->value);
	}
	else if (!strcmp(cep->name, "connect-time"))
	{
		if (*cep->value == '<')
			s->connect_time = 0 - config_checkval(cep->value+1, CFG_TIME);
		else
			s->connect_time = config_checkval(cep->value, CFG_TIME);
	}
	else if (!strcmp(cep->name, "mask") || !strcmp(cep->name, "include-mask"))
	{
		unreal_add_masks(&s->mask, cep);
	}
	else if (!strcmp(cep->name, "ip"))
	{
		unreal_add_names(&s->ip, cep);
	}
	else if (!strcmp(cep->name, "security-group"))
	{
		unreal_add_names(&s->security_group, cep);
	}
	else if (!strcmp(cep->name, "exclude-webirc"))
		s->exclude_webirc = config_checkval(cep->value, CFG_YESNO);
	else if (!strcmp(cep->name, "exclude-websocket"))
		s->exclude_websocket = config_checkval(cep->value, CFG_YESNO);
	else if (!strcmp(cep->name, "exclude-identified"))
		s->exclude_identified = config_checkval(cep->value, CFG_YESNO);
	else if (!strcmp(cep->name, "exclude-tls"))
		s->exclude_tls = config_checkval(cep->value, CFG_YESNO);
	else if (!strcmp(cep->name, "exclude-reputation-score"))
	{
		if (*cep->value == '<')
			s->exclude_reputation_score = 0 - atoi(cep->value+1);
		else
			s->exclude_reputation_score = atoi(cep->value);
	}
	else if (!strcmp(cep->name, "exclude-mask"))
	{
		unreal_add_masks(&s->exclude_mask, cep);
	}
	else if (!strcmp(cep->name, "exclude-security-group"))
	{
		unreal_add_names(&s->security_group, cep);
	}
	else
	{
		/* Let's see if an extended server ban exists for this item... this needs to be LAST! */
		Extban *extban;
		const char *name = cep->name;

		if (!strncmp(cep->name, "exclude-", 8))
		{
			/* Extended (exclusive) ? */
			name = cep->name + 8;
			if (findmod_by_bantype_raw(name, strlen(name)))
				unreal_add_name_values(&s->exclude_extended, name, cep);
			else
				return 0; /* Unhandled */
		} else {
			/* Extended (inclusive) */
			if (findmod_by_bantype_raw(name, strlen(name)))
				unreal_add_name_values(&s->extended, name, cep);
			else
				return 0; /* Unhandled */
		}
	}

	/* And update the printable list */
	if (cep->items)
	{
		ConfigEntry *cep2;
		for (cep2 = cep->items; cep2; cep2 = cep2->next)
			add_nvplist(&s->printable_list, s->printable_list_counter++, cep->name, cep2->name);
	} else {
		add_nvplist(&s->printable_list, s->printable_list_counter++, cep->name, cep->value);
	}

	return 1; /* Handled by us (guaranteed earlier) */
}

int conf_match_block(ConfigFile *conf, ConfigEntry *ce, SecurityGroup **block)
{
	ConfigEntry *cep;
	SecurityGroup *s = *block;

	if (*block == NULL)
		*block = s = safe_alloc(sizeof(SecurityGroup));

	/* Check for simple form: match *; / mask *; */
	if (ce->value)
	{
		unreal_add_masks(&s->mask, ce);
		add_nvplist(&s->printable_list, s->printable_list_counter++, "mask", ce->value);
	}

	/* Check for long form: match { .... } / mask { .... } */
	for (cep = ce->items; cep; cep = cep->next)
	{
		if (!conf_match_item(conf, cep, &s) && !cep->value && !cep->items)
		{
			/* Valueless? Then it must be a mask like 10.0.0.0/8 */
			unreal_add_masks(&s->mask, cep);
			add_nvplist(&s->printable_list, s->printable_list_counter++, "mask", cep->name);
		}
	}
	return 1;
}

int _conf_security_group(ConfigFile *conf, ConfigEntry *ce)
{
	ConfigEntry *cep;
	SecurityGroup *s = add_security_group(ce->value, 1);

	for (cep = ce->items; cep; cep = cep->next)
	{
		if (!strcmp(cep->name, "priority"))
		{
			s->priority = atoi(cep->value);
			DelListItem(s, securitygroups);
			AddListItemPrio(s, securitygroups, s->priority);
		} else
			conf_match_item(conf, cep, &s);
	}
	return 1;
}

/** Check if the name of the security-group contains only valid characters.
 * @param name	The name of the group
 * @returns 1 if name is valid, 0 if not (eg: illegal characters)
 */
int security_group_valid_name(const char *name)
{
	const char *p;

	if (strlen(name) > SECURITYGROUPLEN)
		return 0; /* Too long */

	for (p = name; *p; p++)
	{
		if (!isalnum(*p) && !strchr("_-", *p))
			return 0; /* Character not allowed */
	}
	return 1;
}

/** Find a security-group.
 * @param name	The name of the security group
 * @returns A SecurityGroup struct, or NULL if not found.
 */
SecurityGroup *find_security_group(const char *name)
{
	SecurityGroup *s;
	for (s = securitygroups; s; s = s->next)
		if (!strcasecmp(name, s->name))
			return s;
	return NULL;
}

/** Checks if a security-group exists.
 * This function takes the 'unknown-users' magic group into account as well.
 * @param name	The name of the security group
 * @returns 1 if it exists, 0 if not
 */
int security_group_exists(const char *name)
{
	if (!strcmp(name, "unknown-users") || find_security_group(name))
		return 1;
	return 0;
}

/** Add a new security-group and add it to the list, but search for existing one first.
 * @param name	The name of the security group
 * @returns A SecurityGroup struct (already added to the 'securitygroups' linked list)
 */
SecurityGroup *add_security_group(const char *name, int priority)
{
	SecurityGroup *s = find_security_group(name);

	/* Existing? */
	if (s)
		return s;

	/* Otherwise, create a new entry */
	s = safe_alloc(sizeof(SecurityGroup));
	strlcpy(s->name, name, sizeof(s->name));
	s->priority = priority;
	AddListItemPrio(s, securitygroups, priority);
	return s;
}

/** Free a SecurityGroup struct */
void free_security_group(SecurityGroup *s)
{
	if (s == NULL)
		return;
	unreal_delete_masks(s->mask);
	unreal_delete_masks(s->exclude_mask);
	free_entire_name_list(s->security_group);
	free_entire_name_list(s->exclude_security_group);
	free_entire_name_list(s->ip);
	free_entire_name_list(s->exclude_ip);
	free_nvplist(s->extended);
	free_nvplist(s->exclude_extended);
	free_nvplist(s->printable_list);
	safe_free(s);
}

/** Initialize the default security-group blocks */
void set_security_group_defaults(void)
{
	SecurityGroup *s, *s_next;

	/* First free all security groups */
	for (s = securitygroups; s; s = s_next)
	{
		s_next = s->next;
		free_security_group(s);
	}
	securitygroups = NULL;

	/* Default group: webirc */
	s = add_security_group("webirc-users", 50);
	s->webirc = 1;

	/* Default group: websocket */
	s = add_security_group("websocket-users", 51);
	s->websocket = 1;

	/* Default group: known-users */
	s = add_security_group("known-users", 100);
	s->identified = 1;
	s->reputation_score = 25;
	s->webirc = 0;

	/* Default group: tls-and-known-users */
	s = add_security_group("tls-and-known-users", 200);
	s->identified = 1;
	s->reputation_score = 25;
	s->webirc = 0;
	s->tls = 1;

	/* Default group: tls-users */
	s = add_security_group("tls-users", 300);
	s->tls = 1;
}

int user_matches_extended_list(Client *client, NameValuePrioList *e)
{
	Extban *extban;
	BanContext b;

	for (; e; e = e->next)
	{
		extban = findmod_by_bantype_raw(e->name, strlen(e->name));
		if (!extban ||
		    !(extban->options & EXTBOPT_TKL) ||
		    !(extban->is_banned_events & BANCHK_TKL))
		{
			continue; /* extban not found or of incorrect type */
		}

		memset(&b, 0, sizeof(BanContext));
		b.client = client;
		b.banstr = e->value;
		b.ban_check_types = BANCHK_TKL;
		if (extban->is_banned(&b))
			return 1;
	}

	return 0;
}

int test_extended_list(Extban *extban, ConfigEntry *cep, int *errors)
{
	BanContext b;

	if (cep->value)
	{
		memset(&b, 0, sizeof(BanContext));
		b.banstr = cep->value;
		b.ban_check_types = BANCHK_TKL;
		b.what = MODE_ADD;
		if (!extban->conv_param(&b, extban))
		{
			config_error("%s:%i: %s has an invalid value",
			             cep->file->filename, cep->line_number, cep->name);
			*errors = *errors + 1;
			return 0;
		}
	}

	for (cep = cep->items; cep; cep = cep->next)
	{
		memset(&b, 0, sizeof(BanContext));
		b.banstr = cep->name;
		b.ban_check_types = BANCHK_TKL;
		b.what = MODE_ADD;
		if (!extban->conv_param(&b, extban))
		{
			config_error("%s:%i: %s has an invalid value",
			             cep->file->filename, cep->line_number, cep->name);
			*errors = *errors + 1;
			return 0;
		}
	}

	return 1;
}

/** Returns 1 if the user is allowed by any of the security groups in the named list.
 * This is only used by security-group::security-group and
 * security-group::exclude-security-group.
 * @param client	Client to check
 * @param l		The NameList
 * @returns 1 if any of the security groups match, 0 if none of them matched.
 */
int user_allowed_by_security_group_list(Client *client, NameList *l)
{
	for (; l; l = l->next)
		if (user_allowed_by_security_group_name(client, l->name))
			return 1;
	return 0;
}

/** Returns 1 if the user is OK as far as the security-group is concerned.
 * @param client	The client to check
 * @param s		The security-group to check against
 * @retval 1 if user is allowed by security-group, 0 if not.
 */
int user_allowed_by_security_group(Client *client, SecurityGroup *s)
{
	static int recursion_security_group = 0;

	/* Allow NULL securitygroup, makes it easier in the code elsewhere */
	if (!s)
		return 0;

	if (recursion_security_group > 8)
	{
		unreal_log(ULOG_WARNING, "main", "SECURITY_GROUP_LOOP_DETECTED", client,
		           "Loop detected while processing security-group '$security_group' -- "
		           "are you perhaps referencing a security-group from a security-group?",
		           log_data_string("security_group", s->name));
		return 0;
	}
	recursion_security_group++;

	/* DO NOT USE 'return' IN CODE BELOW!!!!!!!!!
	 * - use 'goto user_not_allowed' to reject
	 * - use 'goto user_allowed' to accept
	 */

	/* Process EXCLUSION criteria first... */
	if (s->exclude_identified && IsLoggedIn(client))
		goto user_not_allowed;
	if (s->exclude_webirc && moddata_client_get(client, "webirc"))
		goto user_not_allowed;
	if (s->exclude_websocket && moddata_client_get(client, "websocket"))
		goto user_not_allowed;
	if ((s->exclude_reputation_score > 0) && (GetReputation(client) >= s->exclude_reputation_score))
		goto user_not_allowed;
	if ((s->exclude_reputation_score < 0) && (GetReputation(client) < 0 - s->exclude_reputation_score))
		goto user_not_allowed;
	if (s->exclude_connect_time != 0)
	{
		long connect_time = get_connected_time(client);
		if ((s->exclude_connect_time > 0) && (connect_time >= s->exclude_connect_time))
			goto user_not_allowed;
		if ((s->exclude_connect_time < 0) && (connect_time < 0 - s->exclude_connect_time))
			goto user_not_allowed;
	}
	if (s->exclude_tls && (IsSecureConnect(client) || (MyConnect(client) && IsSecure(client))))
		goto user_not_allowed;
	if (s->exclude_mask && unreal_mask_match(client, s->exclude_mask))
		goto user_not_allowed;
	if (s->exclude_ip && unreal_match_iplist(client, s->exclude_ip))
		goto user_not_allowed;
	if (s->exclude_security_group && user_allowed_by_security_group_list(client, s->exclude_security_group))
		goto user_not_allowed;
	if (s->exclude_extended && user_matches_extended_list(client, s->exclude_extended))
		goto user_not_allowed;

	/* Then process INCLUSION criteria... */
	if (s->identified && IsLoggedIn(client))
		goto user_allowed;
	if (s->webirc && moddata_client_get(client, "webirc"))
		goto user_allowed;
	if (s->websocket && moddata_client_get(client, "websocket"))
		goto user_allowed;
	if ((s->reputation_score > 0) && (GetReputation(client) >= s->reputation_score))
		goto user_allowed;
	if ((s->reputation_score < 0) && (GetReputation(client) < 0 - s->reputation_score))
		goto user_allowed;
	if (s->connect_time != 0)
	{
		long connect_time = get_connected_time(client);
		if ((s->connect_time > 0) && (connect_time >= s->connect_time))
			goto user_allowed;
		if ((s->connect_time < 0) && (connect_time < 0 - s->connect_time))
			goto user_allowed;
	}
	if (s->tls && (IsSecureConnect(client) || (MyConnect(client) && IsSecure(client))))
		goto user_allowed;
	if (s->mask && unreal_mask_match(client, s->mask))
		goto user_allowed;
	if (s->ip && unreal_match_iplist(client, s->ip))
		goto user_allowed;
	if (s->security_group && user_allowed_by_security_group_list(client, s->security_group))
		goto user_allowed;
	if (s->extended && user_matches_extended_list(client, s->extended))
		goto user_allowed;

user_not_allowed:
	recursion_security_group--;
	return 0;

user_allowed:
	recursion_security_group--;
	return 1;
}

/** Returns 1 if the user is OK as far as the security-group is concerned - "by name" version.
 * @param client	The client to check
 * @param secgroupname	The name of the security-group to check against
 * @retval 1 if user is allowed by security-group, 0 if not.
 */
int user_allowed_by_security_group_name(Client *client, const char *secgroupname)
{
	SecurityGroup *s;

	/* Handle the magical 'unknown-users' case. */
	if (!strcmp(secgroupname, "unknown-users"))
	{
		/* This is simply the inverse of 'known-users' */
		s = find_security_group("known-users");
		if (!s)
			return 0; /* that's weird!? pretty impossible. */
		return !user_allowed_by_security_group(client, s);
	}

	/* Find the group and evaluate it */
	s = find_security_group(secgroupname);
	if (!s)
		return 0; /* security group not found: no match */
	return user_allowed_by_security_group(client, s);
}

/** Get comma separated list of matching security groups for 'client'.
 * This is usually only used for displaying purposes.
 * @returns string like "unknown-users,tls-users" from a static buffer.
 */
const char *get_security_groups(Client *client)
{
	SecurityGroup *s;
	static char buf[512];

	*buf = '\0';

	/* We put known-users or unknown-users at the beginning.
	 * The latter is special and doesn't actually exist
	 * in the linked list, hence the special code here,
	 * and again later in the for loop to skip it.
	 */
	if (user_allowed_by_security_group_name(client, "known-users"))
		strlcat(buf, "known-users,", sizeof(buf));
	else
		strlcat(buf, "unknown-users,", sizeof(buf));

	for (s = securitygroups; s; s = s->next)
	{
		if (strcmp(s->name, "known-users") &&
		    user_allowed_by_security_group(client, s))
		{
			strlcat(buf, s->name, sizeof(buf));
			strlcat(buf, ",", sizeof(buf));
		}
	}

	if (*buf)
		buf[strlen(buf)-1] = '\0';
	return buf;
}