Merge branch 'insp3' into master.

8 files changed, 77 insertions, 33 deletions

diff --git a/src/inspircd.cpp b/src/inspircd.cpp
index 2f4db6d4d..a33ec4bc3 100644
--- a/src/inspircd.cpp
+++ b/src/inspircd.cpp
@@ -322,7 +322,7 @@ namespace
 
 				default:
 					// An unknown option was specified.
-					std::cout << con_red << "Error:" <<  con_reset << " unknown option '" << argv[optind - 1] << "'." << std::endl
+					std::cout << con_red << "Error:" <<  con_reset << " unknown option '" << argv[optind] << "'." << std::endl
 						<< con_bright << "Usage: " << con_reset << argv[0] << " [--config <file>] [--debug] [--nofork] [--nolog]" << std::endl
 						<< std::string(strlen(argv[0]) + 8, ' ') << "[--nopid] [--runasroot] [--version]" << std::endl;
 					ServerInstance->Exit(EXIT_STATUS_ARGV);
diff --git a/src/modules/m_cgiirc.cpp b/src/modules/m_cgiirc.cpp
index 9a7de76c0..5cc3d4ce6 100644
--- a/src/modules/m_cgiirc.cpp
+++ b/src/modules/m_cgiirc.cpp
@@ -344,11 +344,22 @@ class ModuleCgiIRC
 		// cannot match this connect class.
 		const std::string* gateway = cmd.gateway.get(user);
 		if (!gateway)
+		{
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires a connection via a WebIRC gateway",
+					myclass->GetName().c_str());
 			return MOD_RES_DENY;
+		}
 
 		// If the gateway matches the <connect:webirc> constraint then
 		// allow the check to continue. Otherwise, reject it.
-		return InspIRCd::Match(*gateway, webirc) ? MOD_RES_PASSTHRU : MOD_RES_DENY;
+		if (!InspIRCd::Match(*gateway, webirc))
+		{
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as the WebIRC gateway name (%s) does not match %s",
+					myclass->GetName().c_str(), gateway->c_str(), webirc.c_str());
+			return MOD_RES_DENY;
+		}
+
+		return MOD_RES_PASSTHRU;
 	}
 
 	ModResult OnUserRegister(LocalUser* user) override
diff --git a/src/modules/m_dnsbl.cpp b/src/modules/m_dnsbl.cpp
index 57243e66b..ca8c6f10b 100644
--- a/src/modules/m_dnsbl.cpp
+++ b/src/modules/m_dnsbl.cpp
@@ -419,12 +419,20 @@ class ModuleDNSBL : public Module, public Stats::EventListener
 
 		std::string* match = nameExt.get(user);
 		if (!match)
+		{
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires a DNSBL mark",
+					myclass->GetName().c_str());
 			return MOD_RES_DENY;
+		}
 
-		if (InspIRCd::Match(*match, dnsbl))
-			return MOD_RES_PASSTHRU;
+		if (!InspIRCd::Match(*match, dnsbl))
+		{
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as the DNSBL mark (%s) does not match %s",
+					myclass->GetName().c_str(), match->c_str(), dnsbl.c_str());
+			return MOD_RES_DENY;
+		}
 
-		return MOD_RES_DENY;
+		return MOD_RES_PASSTHRU;
 	}
 
 	ModResult OnCheckReady(LocalUser *user) override
diff --git a/src/modules/m_geoclass.cpp b/src/modules/m_geoclass.cpp
index 6d172440b..8076e3a09 100644
--- a/src/modules/m_geoclass.cpp
+++ b/src/modules/m_geoclass.cpp
@@ -64,6 +64,8 @@ class ModuleGeoClass
 
 		// A list of country codes were specified but the user didn't match
 		// any of them.
+		ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as the origin country (%s) is not any of %s",
+			myclass->GetName().c_str(), code.c_str(), country.c_str());
 		return MOD_RES_DENY;
 	}
 
diff --git a/src/modules/m_ident.cpp b/src/modules/m_ident.cpp
index 7710d9dfa..16dcc0145 100644
--- a/src/modules/m_ident.cpp
+++ b/src/modules/m_ident.cpp
@@ -406,7 +406,11 @@ class ModuleIdent : public Module
 	ModResult OnSetConnectClass(LocalUser* user, std::shared_ptr<ConnectClass> myclass) override
 	{
 		if (myclass->config->getBool("requireident") && state.get(user) != IDENT_FOUND)
+		{
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires an identd response",
+				myclass->GetName().c_str());
 			return MOD_RES_DENY;
+		}
 		return MOD_RES_PASSTHRU;
 	}
 
diff --git a/src/modules/m_services_account.cpp b/src/modules/m_services_account.cpp
index e105d67f5..278786aef 100644
--- a/src/modules/m_services_account.cpp
+++ b/src/modules/m_services_account.cpp
@@ -319,7 +319,11 @@ class ModuleServicesAccount
 	ModResult OnSetConnectClass(LocalUser* user, std::shared_ptr<ConnectClass> myclass) override
 	{
 		if (myclass->config->getBool("requireaccount") && !accountname.get(user))
+		{
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires the user to be logged into an account",
+				myclass->GetName().c_str());
 			return MOD_RES_DENY;
+		}
 		return MOD_RES_PASSTHRU;
 	}
 };
diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index 566f9f786..1b175bb72 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -313,21 +313,25 @@ class ModuleSSLInfo
 	ModResult OnSetConnectClass(LocalUser* user, std::shared_ptr<ConnectClass> myclass) override
 	{
 		ssl_cert* cert = cmd.sslapi.GetCertificate(user);
-		bool ok = true;
+		const char* error = NULL;
 		const std::string requiressl = myclass->config->getString("requiressl");
 		if (stdalgo::string::equalsci(requiressl, "trusted"))
 		{
-			ok = (cert && cert->IsCAVerified());
-			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Class requires a trusted TLS (SSL) client certificate. Client %s one.", (ok ? "has" : "does not have"));
+			if (!cert || !cert->IsCAVerified())
+				error = "a trusted TLS (SSL) client certificate";
 		}
 		else if (myclass->config->getBool("requiressl"))
 		{
-			ok = (cert != NULL);
-			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Class requires a secure connection. Client %s on a secure connection.", (ok ? "is" : "is not"));
+			if (!cert)
+				error = "a TLS (SSL) connection";
 		}
 
-		if (!ok)
+		if (error)
+		{
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires %s",
+				myclass->GetName().c_str(), error);
 			return MOD_RES_DENY;
+		}
 
 		return MOD_RES_PASSTHRU;
 	}
diff --git a/src/users.cpp b/src/users.cpp
index b867e598d..9b15aa7d2 100644
--- a/src/users.cpp
+++ b/src/users.cpp
@@ -1093,17 +1093,18 @@ bool User::ChangeIdent(const std::string& newident)
  */
 void LocalUser::SetClass(const std::string &explicit_name)
 {
-	std::shared_ptr<ConnectClass> found;
-
-	ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Setting connect class for UID %s", this->uuid.c_str());
+	ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Setting connect class for %s (%s) ...",
+		this->uuid.c_str(), this->GetFullRealHost().c_str());
 
+	std::shared_ptr<ConnectClass> found;
 	if (!explicit_name.empty())
 	{
 		for (const auto& c : ServerInstance->Config->Classes)
 		{
 			if (explicit_name == c->name)
 			{
-				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Explicitly set to %s", explicit_name.c_str());
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Connect class explicitly set to %s",
+					explicit_name.c_str());
 				found = c;
 			}
 		}
@@ -1112,31 +1113,43 @@ void LocalUser::SetClass(const std::string &explicit_name)
 	{
 		for (const auto& c : ServerInstance->Config->Classes)
 		{
-			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Checking %s", c->GetName().c_str());
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Checking the %s connect class ...",
+					c->GetName().c_str());
 
 			ModResult MOD_RESULT;
 			FIRST_MOD_RESULT(OnSetConnectClass, MOD_RESULT, (this,c));
 			if (MOD_RESULT == MOD_RES_DENY)
 				continue;
+
 			if (MOD_RESULT == MOD_RES_ALLOW)
 			{
-				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Class forced by module to %s", c->GetName().c_str());
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class was explicitly chosen by a module",
+					c->GetName().c_str());
 				found = c;
 				break;
 			}
 
 			if (c->type == CC_NAMED)
+			{
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as neither <connect:allow> nor <connect:deny> are set",
+						c->GetName().c_str());
 				continue;
+			}
 
 			bool regdone = (registered != REG_NONE);
 			if (c->config->getBool("registered", regdone) != regdone)
+			{
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it requires that the user is %s",
+						c->GetName().c_str(), regdone ? "not fully connected" : "fully connected");
 				continue;
+			}
 
 			/* check if host matches.. */
 			if (!InspIRCd::MatchCIDR(this->GetIPString(), c->GetHost(), NULL) &&
 				!InspIRCd::MatchCIDR(this->GetRealHost(), c->GetHost(), NULL))
 			{
-				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "No host match (for %s)", c->GetHost().c_str());
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as neither the host (%s) nor the IP (%s) matches %s",
+					c->GetName().c_str(), this->GetRealHost().c_str(), this->GetIPString().c_str(), c->GetHost().c_str());
 				continue;
 			}
 
@@ -1147,31 +1160,29 @@ void LocalUser::SetClass(const std::string &explicit_name)
 			if (c->limit && (c.use_count() >= static_cast<long>(c->limit)))
 			{
 				// HACK: using use_count() is awful and should be removed before v4 is released.
-				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "OOPS: Connect class limit (%lu) hit, denying", c->limit);
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as it has reached its user limit (%lu)",
+						c->GetName().c_str(), c->limit);
 				continue;
 			}
 
-			/* if it requires a port ... */
-			if (!c->ports.empty())
+			/* if it requires a port and our port doesn't match, fail */
+			if (!c->ports.empty() && !c->ports.count(this->server_sa.port()))
 			{
-				/* and our port doesn't match, fail. */
-				if (!c->ports.count(this->server_sa.port()))
-				{
-					ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Requires a different port, skipping");
-					continue;
-				}
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as the connection port (%d) is not any of %s",
+					c->GetName().c_str(), this->server_sa.port(), stdalgo::string::join(c->ports).c_str());
+				continue;
 			}
 
-			if (regdone && !c->password.empty())
+			if (regdone && !c->password.empty() && !ServerInstance->PassCompare(this, c->password, password, c->passwordhash))
 			{
-				if (!ServerInstance->PassCompare(this, c->password, password, c->passwordhash))
-				{
-					ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "Bad password, skipping");
-					continue;
-				}
+				ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is not suitable as requires a password and %s",
+					c->GetName().c_str(), password.empty() ? "one was not provided" : "the provided password was incorrect");
+				continue;
 			}
 
 			/* we stop at the first class that meets ALL critera. */
+			ServerInstance->Logs.Log("CONNECTCLASS", LOG_DEBUG, "The %s connect class is suitable for %s (%s)",
+				c->GetName().c_str(), this->uuid.c_str(), this->GetFullRealHost().c_str());
 			found = c;
 			break;
 		}