According to the International Committee of the Red Cross (ICRC), they are considered non-combatants until mobilized, but this isn't exactly "hardcoded" or explicit in any convention, but rather based on "expert consensus":
While in some countries, entire segments of the population between certain ages may be drafted into the armed forces in the event of armed conflict, only those persons who are actually drafted, i.e., who are actually incorporated into the armed forces, can be considered combatants. Potential mobilization does not render the person concerned a combatant liable to attack.
[footnote:] This conclusion is based on discussions during the second consultation with academic and governmental experts in the framework of this study in May 1999 and the general agreement among the experts to this effect. The experts also considered that it may be necessary to consider the legislation of a State in determining when reservists actually become members of the armed forces.
As I see some have answered my answer with more liberal suggestions as to whom can't be legally targeted, I hate to disappoint on that, but
In 1993, Bosnian-Serb soldiers fired mortar rounds at Bosnian soldiers playing soccer on an improvised neighborhood field, killing and injuring civilian spectators nearby. The International Criminal Tribunal for the Former Yugoslavia found the Bosnian-Serb commanders guilty of harming civilians, but found no legal violation in the targeting of the sporting soldiers.
[...] Hence, although in the ordinary meaning, “combatant” is a person who fights, in the legal sense, “combatant” is anyone who has a right to fight under international law, and this right is accorded to all members of the armed forces, other than medical personnel and chaplains. Another exceptional category is soldiers assigned exclusively to
civil defense tasks. All three—medics, chaplains, and civil defense forces—must wear a distinctive emblem to identify them as such. Other than
these categories, all soldiers are targetable unless they become hors de
combat, and it is irrelevant if they are conscripted or volunteers, serving on the frontline or in the rear, engaging in combat, combat-support, or noncombat activities.
[...] The rules about hors de combat all share one underlying principle: Once
soldiers are incapacitated—through surrender, capture, or injury—they no
longer pose a threat.
Playing soccer or similar unarmed/leisurely activities thus don't count as hors de combat.
All soldiers who are not injured or captured are
presumed to be “seeking to kill,” and therefore the deliberate targeting of
all enemy combatants—regardless of their role on the battlefield, whether
they are off duty, asleep in the barracks, bathing in the lake, or retreating—
is permissible. There is no duty to warn enemy combatants prior to an
attack, to try to capture enemy combatants as POWs instead of killing them
(a duty that existed under the medieval codes of knightly conduct in respect to other knights) (Stacey 1994, 30), to injure them instead of killing
them, or in any other way minimize combatant casualties.
[...] The striking feature of the mainstream literature is its general acceptance (albeit at times, with some moral discomfort) of the near-absolute
license to kill all combatants and of the law’s view of combatants as nothing more than instruments of war.
Granted, some more progressive scholars (like the very author of that paper for that last quote) think those decisions/rules are too permissive in whom can be targeted [and have proposed other rules], but AFAIK no army [or court] has adopted more restrictive rules.
BTW, this is far more tangential, but may also be interesting in the opposite direction, of whom Israel considers they can target in a group like Hamas:
In 2005, the Israeli High Court of Justice (HCJ), when reviewing the
government’s policy of targeted killings of terrorists in Gaza and the West Bank, classified terrorists as civilians taking direct part in hostilities. It ordered that terrorists be targeted only when there was sufficient intelligence to show that the individual targeted was directly, substantially, and continuously involved in terrorism—a standard that would have been unnecessary had members of paramilitary groups been labeled “combatants.” Still, when interpreting the limitation “for such time,” the HCJ rejected the possibility of a “revolving door” allowing a terrorist to act as a terrorist by day and a civilian by night, substantially weakening the temporal constraint. In effect,
the Court allowed the government to target terrorists any time, any place, as long as the “guilt” of the terrorist has been established. In other words, the functional test of the nature of the target made the distinction in labeling the individual a “civilian” or a “combatant” less meaningful.
If you'd rather read another expert's take on this issue:
‘Civilians’ are all persons who are not members of the armed forces. Armed forces include
not only the regular armed forces, but also certain militias and armed resistance movements. The
definition is rather complicated and not all elements are universally accepted as customary law. In
this context, I shall only point at the issues of wearing a distinctive sign and carrying arms openly,
which for non-parties to the 1977 Additional Protocol I is a requirement for recognition as a
combatant, that is a person who can lawfully participate directly in hostilities.
‘Civilians’ includes also the civilian population. The presence of some individual members
of the armed forces within the civilian population does not deprive the civilian population of its
civilian character. This could, for instance, be soldiers on leave visiting their families.
Civilians may be attacked if they take direct part in hostilities. The exact meaning of “taking
direct part in hostilities” is disputed, but the core of the notion is universally accepted. You may,
for instance, attack the person who is shooting at you with a machine gun. You may also attack
the person who is carrying ammunition to the machine gunner. But you may not attack the person
who participates indirectly, such as the machine gunner’s wife who is cooking food for him.
The role of the cook is, however, one of the disputed issues. Some hold that the cook is a
lawful target if he or she is a member of an organized armed group, while others, in particular the
ICRC, hold that it is only those members of the group that have a continuous combat function that
can lawfully be attacked. Another problem is the so-called “revolving door” controversy. Can you
be a protected civilian farmer by day and a targetable fighter by night, or will repeated direct
participation in hostilities make you a lawful target until you have clearly abandoned such
activities?
The International Committee of the Red Cross issued in 2009 an interpretive guidance to the
concept of direct participation in hostilities. This was made after six years of expert consultations;
the problem is only that the experts were not able to agree on certain issues like those explained
above. The interpretive guidance is, therefore, the position of the ICRC and does not reflect a
consensus among experts. That said, one can safely assume that if a person is involved in activity
that is direct participation in hostilities according to the ICRC view, it is lawful to attack that
person. But it cannot be inferred that an attack of a person that does not fulfil the ICRC criteria for
direct participation is unlawful and therefore a war crime. In such cases, the situation has to be
studied carefully before any conclusion is drawn.
So, according to one reading of this expert's saying, soldiers on leave might not be legitimate targets either. YMMV. Or he might just be saying that the typical mixture of soldiers on leave with the undisputable civilians keeps the mixture civilian in character.
