Split server.private in 2 cvars; fix LAN game not listable

illwieckz discovered that the default value 3 of cvar server.private
on clients made it impossible to see the game in the LAN server
list. This mode 3 really makes no sense as it is allowing LAN clients
only, but not even allowing them to see the server.

server.private was mixing two things: whether the server reports
its status and whether it allows non-LAN addresses. Make it control only
the former and add sv_networkScope for whether non-LAN addresses are
allowed.

src/engine/server/server.h

@@ -237,6 +237,8 @@ struct serverStatic_t
 {
 	bool      initialized; // sv_init has completed
 
+	bool warnedNetworkScopeNotAdvertisable;
+
 	int           time; // will be strictly increasing across level changes
 
 	int           snapFlagServerBit; // ^= SNAPFLAG_SERVERCOUNT every SV_SpawnServer()
@@ -318,6 +320,8 @@ extern cvar_t *sv_dl_maxRate;
 //fretn
 extern cvar_t *sv_fullmsg;
 
+extern Cvar::Range<Cvar::Cvar<int>> sv_networkScope;
+
 //===========================================================
 
 //
@@ -423,7 +427,6 @@ enum class ServerPrivate
 	Public,      // Actively advertise, don't refuse anything
 	NoAdvertise, // Do not advertise but reply to all out of band messages
 	NoStatus,    // Do not advertise nor reply to status out of band messages but allow all connections
-	LanOnly,     // Block everything except for LAN connections
 };
 
 /*

src/engine/server/sv_client.cpp

@@ -49,11 +49,6 @@ static void SV_CloseDownload( client_t *cl );
 
 void SV_GetChallenge( const netadr_t& from )
 {
-	if ( SV_Private(ServerPrivate::LanOnly) && !Sys_IsLANAddress(from) )
-	{
-		return;
-	}
-
 	auto challenge = ChallengeManager::GenerateChallenge( from );
 	Net::OutOfBandPrint( netsrc_t::NS_SERVER, from, "challengeResponse %s", challenge );
 }
@@ -1029,7 +1024,7 @@ void SV_UserinfoChanged( client_t *cl )
 	// if the client is on the same subnet as the server and we aren't running an
 	// Internet server, assume that they don't need a rate choke
 	if ( Sys_IsLANAddress( cl->netchan.remoteAddress )
-		&& SV_Private(ServerPrivate::LanOnly)
+		&& sv_networkScope.Get() <= 1
 		&& sv_lanForceRate->integer == 1 )
 	{
 		cl->rate = 99999; // lans should not rate limit

src/engine/server/sv_main.cpp

@@ -83,6 +83,17 @@ cvar_t *sv_showAverageBPS; // NERVE - SMF - net debugging
 // fretn
 cvar_t *sv_fullmsg;
 
+Cvar::Range<Cvar::Cvar<int>> sv_networkScope(
+	"sv_networkScope",
+	"allowed source networks for incoming packets: 0 = loopback only, 1 = LAN, 2 = Internet",
+	Cvar::NONE,
+#ifdef BUILD_SERVER
+	2,
+#else
+	1,
+#endif
+	0, 2);
+
 // Network stuff other than communication with connected clients
 Log::Logger netLog("server.net", "", Log::Level::NOTICE);
 
@@ -100,7 +111,7 @@ bool ParseCvarValue(Str::StringRef value, ServerPrivate& result)
 	int intermediate = 0;
 	if ( Str::ParseInt(intermediate, value) &&
 		intermediate >= int(ServerPrivate::Public) &&
-		intermediate <= int(ServerPrivate::LanOnly) )
+		intermediate <= int(ServerPrivate::NoStatus) )
 	{
 		result = ServerPrivate(intermediate);
 		return true;
@@ -118,12 +129,12 @@ Cvar::Cvar<ServerPrivate> isPrivate(
 	"Controls how much the server advertises: "
 	"0 - Advertise everything, "
 	"1 - Don't advertise but reply to status queries, "
-	"2 - Don't reply to status queries but accept connections, "
-	"3 - Only accept LAN connections.",
+	"2 - Only accept direct connections. ",
+	Cvar::NONE,
 #if BUILD_GRAPHICAL_CLIENT || BUILD_TTY_CLIENT
-	Cvar::ROM, ServerPrivate::LanOnly
+	ServerPrivate::NoAdvertise
 #elif BUILD_SERVER
-	Cvar::NONE, ServerPrivate::Public
+	ServerPrivate::Public
 #else
 	#error
 #endif
@@ -360,6 +371,17 @@ void SV_MasterHeartbeat( const char *hbname )
 		SV_ResolveMasterServers( 0 );
 		return; // only dedicated servers send heartbeats
 	}
+	else if ( sv_networkScope.Get() < 2 )
+	{
+		if ( !svs.warnedNetworkScopeNotAdvertisable )
+		{
+			netLog.Warn( "Not sending master heartbeat because sv_networkScope is local" );
+			svs.warnedNetworkScopeNotAdvertisable = true;
+		}
+
+		SV_ResolveMasterServers( 0 );
+		return;
+	}
 
 	SV_ResolveMasterServers( netenabled );
 
@@ -1028,6 +1050,21 @@ static void SV_ConnectionlessPacket( const netadr_t& from, msg_t *msg )
 
 //============================================================================
 
+static bool SV_IsAllowedNetwork( const netadr_t& address )
+{
+	switch ( sv_networkScope.Get() )
+	{
+	case 0:
+		return address.type == netadrtype_t::NA_LOOPBACK;
+	case 1:
+		return Sys_IsLANAddress( address );
+	case 2:
+		return true;
+	}
+
+	ASSERT_UNREACHABLE();
+}
+
 /*
 =================
 SV_PacketEvent
@@ -1039,6 +1076,11 @@ void SV_PacketEvent( const netadr_t& from, msg_t *msg )
 	client_t *cl;
 	int      qport;
 
+	if ( !SV_IsAllowedNetwork( from ) )
+	{
+		return;
+	}
+
 	// check for connectionless packet (0xffffffff) first
 	if ( msg->cursize >= 4 && * ( int * ) msg->data == -1 )
 	{