From 8fe7b1bc410d2c6eb91c46b26f178d4697641cc0 Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Sun, 5 Jun 2022 08:42:05 +0200
Subject: [PATCH] Fix wrong security-group example in release notes for auto
 oper up. This should be: security-group Syzop { certfp "1234etc."; } As this
 is wrong: security-group Syzop { mask { certfp "1234etc."; } }

Reported by Han`.

This also makes us throw a config error on the wrong case.
---
 doc/RELEASE-NOTES.md |  2 +-
 src/securitygroup.c  | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/doc/RELEASE-NOTES.md b/doc/RELEASE-NOTES.md
index 61033b73d..0baddd1ab 100644
--- a/doc/RELEASE-NOTES.md
+++ b/doc/RELEASE-NOTES.md
@@ -72,7 +72,7 @@ on set::modes-on-join. Also update various example.*conf files.
   [certificate fingerprint](https://www.unrealircd.org/docs/Certificate_fingerprint)
   authentication for example:
   ```
-  security-group Syzop { mask { certfp "1234etc."; } }
+  security-group Syzop { certfp "1234etc."; }
   oper Syzop {
       auto-login yes;
       mask { security-group Syzop; }
diff --git a/src/securitygroup.c b/src/securitygroup.c
index ccd33b804..6986761f2 100644
--- a/src/securitygroup.c
+++ b/src/securitygroup.c
@@ -162,6 +162,8 @@ int unreal_mask_match_string(const char *name, ConfigItem_mask *mask)
 #define CheckNullX(x) if ((!(x)->value) || (!(*((x)->value)))) { config_error("%s:%i: missing parameter", (x)->file->filename, (x)->line_number); *errors = *errors + 1; return 0; }
 int test_match_item(ConfigFile *conf, ConfigEntry *cep, int *errors)
 {
+	ConfigEntry *cepp;
+
 	if (!strcmp(cep->name, "webirc") || !strcmp(cep->name, "exclude-webirc"))
 	{
 		CheckNullX(cep);
@@ -206,6 +208,19 @@ int test_match_item(ConfigFile *conf, ConfigEntry *cep, int *errors)
 	} else
 	if (!strcmp(cep->name, "mask") || !strcmp(cep->name, "include-mask") || !strcmp(cep->name, "exclude-mask"))
 	{
+		for (cepp = cep->items; cepp; cepp = cepp->next)
+		{
+			if (!strcmp(cepp->name, "mask"))
+				continue;
+			if (cepp->items || cepp->value)
+			{
+				config_error("%s:%i: security-group::mask should contain hostmasks only. "
+				             "Perhaps you meant to use it in security-group { %s ... } directly?",
+				             cepp->file->filename, cepp->line_number,
+				             cepp->name);
+				*errors = *errors + 1;
+			}
+		}
 	} else
 	if (!strcmp(cep->name, "ip"))
 	{