src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclNameList.h"
  15 #include "acl/AclSizeLimit.h"
  16 #include "acl/Address.h"
  17 #include "acl/Gadgets.h"
  18 #include "acl/MethodData.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "AuthReg.h"
  23 #include "base/RunnersRegistry.h"
  24 #include "cache_cf.h"
  25 #include "CachePeer.h"
  26 #include "ConfigParser.h"
  27 #include "CpuAffinityMap.h"
  28 #include "DiskIO/DiskIOModule.h"
  29 #include "eui/Config.h"
  30 #include "ExternalACL.h"
  31 #include "format/Format.h"
  32 #include "ftp/Elements.h"
  33 #include "globals.h"
  34 #include "HttpHeaderTools.h"
  35 #include "icmp/IcmpConfig.h"
  36 #include "ident/Config.h"
  37 #include "ip/Intercept.h"
  38 #include "ip/QosConfig.h"
  39 #include "ip/tools.h"
  40 #include "ipc/Kids.h"
  41 #include "log/Config.h"
  42 #include "log/CustomLog.h"
  43 #include "MemBuf.h"
  44 #include "mgr/ActionPasswordList.h"
  45 #include "mgr/Registration.h"
  46 #include "neighbors.h"
  47 #include "NeighborTypeDomainList.h"
  48 #include "Parsing.h"
  49 #include "pconn.h"
  50 #include "PeerDigest.h"
  51 #include "PeerPoolMgr.h"
  52 #include "redirect.h"
  53 #include "RefreshPattern.h"
  54 #include "rfc1738.h"
  55 #include "SBufList.h"
  56 #include "SquidConfig.h"
  57 #include "SquidString.h"
  58 #include "ssl/ProxyCerts.h"
  59 #include "Store.h"
  60 #include "StoreFileSystem.h"
  61 #include "SwapDir.h"
  62 #include "tools.h"
  63 #include "util.h"
  64 #include "wordlist.h"
  65 /* wccp2 has its own conditional definitions */
  66 #include "wccp2.h"
  67 #if USE_ADAPTATION
  68 #include "adaptation/Config.h"
  69 #endif
  70 #if ICAP_CLIENT
  71 #include "adaptation/icap/Config.h"
  72 #endif
  73 #if USE_ECAP
  74 #include "adaptation/ecap/Config.h"
  75 #endif
  76 #if USE_OPENSSL
  77 #include "ssl/Config.h"
  78 #include "ssl/support.h"
  79 #endif
  80 #if USE_AUTH
  81 #include "auth/Config.h"
  82 #include "auth/Scheme.h"
  83 #endif
  84 #if USE_SQUID_ESI
  85 #include "esi/Parser.h"
  86 #endif
  87 #if SQUID_SNMP
  88 #include "snmp.h"
  89 #endif
  90
  91 #if HAVE_GLOB_H
  92 #include <glob.h>
  93 #endif
  94 #include <limits>
  95 #include <list>
  96 #if HAVE_PWD_H
  97 #include <pwd.h>
  98 #endif
  99 #if HAVE_GRP_H
 100 #include <grp.h>
 101 #endif
 102 #if HAVE_SYS_STAT_H
 103 #include <sys/stat.h>
 104 #endif
 105
 106 #if USE_OPENSSL
 107 #include "ssl/gadgets.h"
 108 #endif
 109
 110 #if USE_ADAPTATION
 111 static void parse_adaptation_service_set_type();
 112 static void parse_adaptation_service_chain_type();
 113 static void parse_adaptation_access_type();
 114 #endif
 115
 116 #if ICAP_CLIENT
 117 static void parse_icap_service_type(Adaptation::Icap::Config *);
 118 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 119 static void free_icap_service_type(Adaptation::Icap::Config *);
 120 static void parse_icap_class_type();
 121 static void parse_icap_access_type();
 122
 123 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 124 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 125 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 126 #endif
 127
 128 #if USE_ECAP
 129 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 130 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 131 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 132 #endif
 133
 134 static peer_t parseNeighborType(const char *s);
 135
 136 static const char *const T_MILLISECOND_STR = "millisecond";
 137 static const char *const T_SECOND_STR = "second";
 138 static const char *const T_MINUTE_STR = "minute";
 139 static const char *const T_HOUR_STR = "hour";
 140 static const char *const T_DAY_STR = "day";
 141 static const char *const T_WEEK_STR = "week";
 142 static const char *const T_FORTNIGHT_STR = "fortnight";
 143 static const char *const T_MONTH_STR = "month";
 144 static const char *const T_YEAR_STR = "year";
 145 static const char *const T_DECADE_STR = "decade";
 146
 147 static const char *const B_BYTES_STR = "bytes";
 148 static const char *const B_KBYTES_STR = "KB";
 149 static const char *const B_MBYTES_STR = "MB";
 150 static const char *const B_GBYTES_STR = "GB";
 151
 152 static const char *const list_sep = ", \t\n\r";
 153
 154 static void parse_access_log(CustomLog ** customlog_definitions);
 155 static int check_null_access_log(CustomLog *customlog_definitions);
 156 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 157 static void free_access_log(CustomLog ** definitions);
 158 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 159
 160 static void configDoConfigure(void);
 161 static void parse_refreshpattern(RefreshPattern **);
 162 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 163 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 164 static void parse_u_short(unsigned short * var);
 165 static void parse_string(char **);
 166 static void default_all(void);
 167 static void defaults_if_none(void);
 168 static void defaults_postscriptum(void);
 169 static int parse_line(char *);
 170 static void parse_obsolete(const char *);
 171 static void parseBytesLine(size_t * bptr, const char *units);
 172 #if USE_OPENSSL
 173 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 174 #endif
 175 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 176 static size_t parseBytesUnits(const char *unit);
 177 static void free_all(void);
 178 void requirePathnameExists(const char *name, const char *path);
 179 static OBJH dump_config;
 180 #if USE_HTTP_VIOLATIONS
 181 static void free_HeaderManglers(HeaderManglers **pm);
 182 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 183 static void parse_http_header_access(HeaderManglers **manglers);
 184 #define free_http_header_access free_HeaderManglers
 185 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 186 static void parse_http_header_replace(HeaderManglers **manglers);
 187 #define free_http_header_replace free_HeaderManglers
 188 #endif
 189 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 190 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 191 static void free_HeaderWithAclList(HeaderWithAclList **header);
 192 static void parse_note(Notes *);
 193 static void dump_note(StoreEntry *, const char *, Notes &);
 194 static void free_note(Notes *);
 195 static void parse_denyinfo(AclDenyInfoList ** var);
 196 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 197 static void free_denyinfo(AclDenyInfoList ** var);
 198
 199 #if USE_WCCPv2
 200 static void parse_IpAddress_list(Ip::Address_list **);
 201 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 202 static void free_IpAddress_list(Ip::Address_list **);
 203 #if CURRENTLY_UNUSED
 204 static int check_null_IpAddress_list(const Ip::Address_list *);
 205 #endif /* CURRENTLY_UNUSED */
 206 #endif /* USE_WCCPv2 */
 207
 208 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 209 #define parse_PortCfg(l) parsePortCfg((l), token)
 210 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 211 #define free_PortCfg(h)  *(h)=NULL
 212
 213 #if USE_OPENSSL
 214 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 215 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 216 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 217 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 218 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 219 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 220 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 221 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 222 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 223 #endif /* USE_OPENSSL */
 224
 225 static void parse_ftp_epsv(acl_access **ftp_epsv);
 226 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 227 static void free_ftp_epsv(acl_access **ftp_epsv);
 228
 229 static void parse_b_size_t(size_t * var);
 230 static void parse_b_int64_t(int64_t * var);
 231
 232 static bool parseNamedIntList(const char *data, const String &name, std::vector<int> &list);
 233
 234 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 235 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 236 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 237
 238 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 239 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 240 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 241
 242 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 243
 244 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 245 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 246 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 247 static void parse_on_unsupported_protocol(acl_access **access);
 248 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 249 static void free_on_unsupported_protocol(acl_access **access);
 250
 251 /*
 252  * LegacyParser is a parser for legacy code that uses the global
 253  * approach.  This is static so that it is only exposed to cache_cf.
 254  * Other modules needing access to a ConfigParser should have it
 255  * provided to them in their parserFOO methods.
 256  */
 257 static ConfigParser LegacyParser = ConfigParser();
 258
 259 void
 260 self_destruct(void)
 261 {
 262     LegacyParser.destruct();
 263 }
 264
 265 static void
 266 SetConfigFilename(char const *file_name, bool is_pipe)
 267 {
 268     if (is_pipe)
 269         cfg_filename = file_name + 1;
 270     else
 271         cfg_filename = file_name;
 272 }
 273
 274 static const char*
 275 skip_ws(const char* s)
 276 {
 277     while (xisspace(*s))
 278         ++s;
 279
 280     return s;
 281 }
 282
 283 static int
 284 parseManyConfigFiles(char* files, int depth)
 285 {
 286     int error_count = 0;
 287     char* saveptr = NULL;
 288 #if HAVE_GLOB
 289     char *path;
 290     glob_t globbuf;
 291     int i;
 292     memset(&globbuf, 0, sizeof(globbuf));
 293     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 294         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 295             fatalf("Unable to find configuration file: %s: %s",
 296                    path, xstrerror());
 297         }
 298     }
 299     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 300         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 301     }
 302     globfree(&globbuf);
 303 #else
 304     char* file = strwordtok(files, &saveptr);
 305     while (file != NULL) {
 306         error_count += parseOneConfigFile(file, depth);
 307         file = strwordtok(NULL, &saveptr);
 308     }
 309 #endif /* HAVE_GLOB */
 310     return error_count;
 311 }
 312
 313 static void
 314 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 315 {
 316     assert(str != NULL);
 317     assert(newSubstr != NULL);
 318
 319     unsigned newSubstrLen = strlen(newSubstr);
 320     if (newSubstrLen > substrLen)
 321         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 322
 323     // move tail part including zero
 324     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 325     // copy new substring in place
 326     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 327
 328     len = strlen(str);
 329 }
 330
 331 static void
 332 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 333 {
 334     assert(line != NULL);
 335     assert(macroName != NULL);
 336     assert(substStr != NULL);
 337     unsigned macroNameLen = strlen(macroName);
 338     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 339         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 340 }
 341
 342 static void
 343 ProcessMacros(char*& line, int& len)
 344 {
 345     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 346     SubstituteMacro(line, len, "${process_name}", TheKidName);
 347     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 348 }
 349
 350 static void
 351 trim_trailing_ws(char* str)
 352 {
 353     assert(str != NULL);
 354     unsigned i = strlen(str);
 355     while ((i > 0) && xisspace(str[i - 1]))
 356         --i;
 357     str[i] = '\0';
 358 }
 359
 360 static const char*
 361 FindStatement(const char* line, const char* statement)
 362 {
 363     assert(line != NULL);
 364     assert(statement != NULL);
 365
 366     const char* str = skip_ws(line);
 367     unsigned len = strlen(statement);
 368     if (strncmp(str, statement, len) == 0) {
 369         str += len;
 370         if (*str == '\0')
 371             return str;
 372         else if (xisspace(*str))
 373             return skip_ws(str);
 374     }
 375
 376     return NULL;
 377 }
 378
 379 static bool
 380 StrToInt(const char* str, long& number)
 381 {
 382     assert(str != NULL);
 383
 384     char* end;
 385     number = strtol(str, &end, 0);
 386
 387     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 388 }
 389
 390 static bool
 391 EvalBoolExpr(const char* expr)
 392 {
 393     assert(expr != NULL);
 394     if (strcmp(expr, "true") == 0) {
 395         return true;
 396     } else if (strcmp(expr, "false") == 0) {
 397         return false;
 398     } else if (const char* equation = strchr(expr, '=')) {
 399         const char* rvalue = skip_ws(equation + 1);
 400         char* lvalue = (char*)xmalloc(equation - expr + 1);
 401         xstrncpy(lvalue, expr, equation - expr + 1);
 402         trim_trailing_ws(lvalue);
 403
 404         long number1;
 405         if (!StrToInt(lvalue, number1))
 406             fatalf("String is not a integer number: '%s'\n", lvalue);
 407         long number2;
 408         if (!StrToInt(rvalue, number2))
 409             fatalf("String is not a integer number: '%s'\n", rvalue);
 410
 411         xfree(lvalue);
 412         return number1 == number2;
 413     }
 414     fatalf("Unable to evaluate expression '%s'\n", expr);
 415     return false; // this place cannot be reached
 416 }
 417
 418 static int
 419 parseOneConfigFile(const char *file_name, unsigned int depth)
 420 {
 421     FILE *fp = NULL;
 422     const char *orig_cfg_filename = cfg_filename;
 423     const int orig_config_lineno = config_lineno;
 424     char *token = NULL;
 425     char *tmp_line = NULL;
 426     int tmp_line_len = 0;
 427     int err_count = 0;
 428     int is_pipe = 0;
 429
 430     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 431     if (depth > 16) {
 432         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 433         return 1;
 434     }
 435
 436     if (file_name[0] == '!' || file_name[0] == '|') {
 437         fp = popen(file_name + 1, "r");
 438         is_pipe = 1;
 439     } else {
 440         fp = fopen(file_name, "r");
 441     }
 442
 443     if (fp == NULL)
 444         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerror());
 445
 446 #if _SQUID_WINDOWS_
 447     setmode(fileno(fp), O_TEXT);
 448 #endif
 449
 450     SetConfigFilename(file_name, bool(is_pipe));
 451
 452     memset(config_input_line, '\0', BUFSIZ);
 453
 454     config_lineno = 0;
 455
 456     std::vector<bool> if_states;
 457     while (fgets(config_input_line, BUFSIZ, fp)) {
 458         ++config_lineno;
 459
 460         if ((token = strchr(config_input_line, '\n')))
 461             *token = '\0';
 462
 463         if ((token = strchr(config_input_line, '\r')))
 464             *token = '\0';
 465
 466         // strip any prefix whitespace off the line.
 467         const char *p = skip_ws(config_input_line);
 468         if (config_input_line != p)
 469             memmove(config_input_line, p, strlen(p)+1);
 470
 471         if (strncmp(config_input_line, "#line ", 6) == 0) {
 472             static char new_file_name[1024];
 473             static char *file;
 474             static char new_lineno;
 475             token = config_input_line + 6;
 476             new_lineno = strtol(token, &file, 0) - 1;
 477
 478             if (file == token)
 479                 continue;   /* Not a valid #line directive, may be a comment */
 480
 481             while (*file && xisspace((unsigned char) *file))
 482                 ++file;
 483
 484             if (*file) {
 485                 if (*file != '"')
 486                     continue;   /* Not a valid #line directive, may be a comment */
 487
 488                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 489
 490                 if ((token = strchr(new_file_name, '"')))
 491                     *token = '\0';
 492
 493                 SetConfigFilename(new_file_name, false);
 494             }
 495
 496             config_lineno = new_lineno;
 497         }
 498
 499         if (config_input_line[0] == '#')
 500             continue;
 501
 502         if (config_input_line[0] == '\0')
 503             continue;
 504
 505         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 506
 507         size_t append_len = strlen(append);
 508
 509         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 510
 511         strcpy(tmp_line + tmp_line_len, append);
 512
 513         tmp_line_len += append_len;
 514
 515         if (tmp_line[tmp_line_len-1] == '\\') {
 516             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 517             tmp_line[--tmp_line_len] = '\0';
 518             continue;
 519         }
 520
 521         trim_trailing_ws(tmp_line);
 522         ProcessMacros(tmp_line, tmp_line_len);
 523         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 524
 525         if (const char* expr = FindStatement(tmp_line, "if")) {
 526             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 527         } else if (FindStatement(tmp_line, "endif")) {
 528             if (!if_states.empty())
 529                 if_states.pop_back(); // remove last if-statement meaning
 530             else
 531                 fatalf("'endif' without 'if'\n");
 532         } else if (FindStatement(tmp_line, "else")) {
 533             if (!if_states.empty())
 534                 if_states.back() = !if_states.back();
 535             else
 536                 fatalf("'else' without 'if'\n");
 537         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 538             /* Handle includes here */
 539             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 540                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 541             } else if (!parse_line(tmp_line)) {
 542                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 543                 ++err_count;
 544             }
 545         }
 546
 547         safe_free(tmp_line);
 548         tmp_line_len = 0;
 549
 550     }
 551     if (!if_states.empty())
 552         fatalf("if-statement without 'endif'\n");
 553
 554     if (is_pipe) {
 555         int ret = pclose(fp);
 556
 557         if (ret != 0)
 558             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 559     } else {
 560         fclose(fp);
 561     }
 562
 563     SetConfigFilename(orig_cfg_filename, false);
 564     config_lineno = orig_config_lineno;
 565
 566     xfree(tmp_line);
 567     return err_count;
 568 }
 569
 570 int
 571 parseConfigFile(const char *file_name)
 572 {
 573     int err_count = 0;
 574
 575     debugs(5, 4, HERE);
 576
 577     configFreeMemory();
 578
 579     ACLMethodData::ThePurgeCount = 0;
 580     default_all();
 581
 582     err_count = parseOneConfigFile(file_name, 0);
 583
 584     defaults_if_none();
 585
 586     defaults_postscriptum();
 587
 588     /*
 589      * We must call configDoConfigure() before leave_suid() because
 590      * configDoConfigure() is where we turn username strings into
 591      * uid values.
 592      */
 593     configDoConfigure();
 594
 595     if (!Config.chroot_dir) {
 596         leave_suid();
 597         setUmask(Config.umask);
 598         _db_init(Debug::cache_log, Debug::debugOptions);
 599         enter_suid();
 600     }
 601
 602     if (opt_send_signal == -1) {
 603         Mgr::RegisterAction("config",
 604                             "Current Squid Configuration",
 605                             dump_config,
 606                             1, 1);
 607     }
 608
 609     return err_count;
 610 }
 611
 612 static void
 613 configDoConfigure(void)
 614 {
 615     memset(&Config2, '\0', sizeof(SquidConfig2));
 616     /* init memory as early as possible */
 617     memConfigure();
 618     /* Sanity checks */
 619
 620     Config.cacheSwap.n_strands = 0; // no diskers by default
 621     if (Config.cacheSwap.swapDirs == NULL) {
 622         /* Memory-only cache probably in effect. */
 623         /* turn off the cache rebuild delays... */
 624         StoreController::store_dirs_rebuilding = 0;
 625     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 626         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 627             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 628             if (sd->needsDiskStrand())
 629                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 630         }
 631     }
 632
 633     if (Debug::rotateNumber < 0) {
 634         Debug::rotateNumber = Config.Log.rotateNumber;
 635     }
 636
 637 #if SIZEOF_OFF_T <= 4
 638     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 639         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 640         Config.Store.maxObjectSize = 0x7FFF0000;
 641     }
 642 #endif
 643
 644     if (Config.Announce.period > 0) {
 645         Config.onoff.announce = 1;
 646     } else {
 647         Config.Announce.period = 86400 * 365;   /* one year */
 648         Config.onoff.announce = 0;
 649     }
 650
 651     if (Config.onoff.httpd_suppress_version_string)
 652         visible_appname_string = (char *)appname_string;
 653     else
 654         visible_appname_string = (char const *)APP_FULLNAME;
 655
 656     if (Config.Program.redirect) {
 657         if (Config.redirectChildren.n_max < 1) {
 658             Config.redirectChildren.n_max = 0;
 659             wordlistDestroy(&Config.Program.redirect);
 660         }
 661     }
 662
 663     if (Config.Program.store_id) {
 664         if (Config.storeIdChildren.n_max < 1) {
 665             Config.storeIdChildren.n_max = 0;
 666             wordlistDestroy(&Config.Program.store_id);
 667         }
 668     }
 669
 670     if (Config.appendDomain)
 671         if (*Config.appendDomain != '.')
 672             fatal("append_domain must begin with a '.'");
 673
 674     if (Config.errHtmlText == NULL)
 675         Config.errHtmlText = xstrdup(null_string);
 676
 677 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 678     if (Config.max_filedescriptors > 0) {
 679         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 680     }
 681 #elif USE_SELECT || USE_SELECT_WIN32
 682     if (Config.max_filedescriptors > FD_SETSIZE) {
 683         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 684     }
 685 #endif
 686
 687     storeConfigure();
 688
 689     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 690              uniqueHostname(),
 691              visible_appname_string);
 692
 693     /*
 694      * the extra space is for loop detection in client_side.c -- we search
 695      * for substrings in the Via header.
 696      */
 697     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 698              uniqueHostname(),
 699              visible_appname_string);
 700
 701     /* Use visible_hostname as default surrogate_id */
 702     if (!Config.Accel.surrogate_id) {
 703         const char *t = getMyHostname();
 704         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 705     }
 706
 707     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 708         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 709
 710     if (Config.appendDomain)
 711         Config.appendDomainLen = strlen(Config.appendDomain);
 712     else
 713         Config.appendDomainLen = 0;
 714
 715     if (Config.connect_retries > 10) {
 716         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 717         Config.connect_retries = 10;
 718     }
 719
 720     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 721 #if USE_UNLINKD
 722
 723     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 724 #endif
 725     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 726     if (Config.Program.redirect)
 727         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 728
 729     if (Config.Program.store_id)
 730         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 731
 732     requirePathnameExists("Icon Directory", Config.icons.directory);
 733
 734     if (Config.errorDirectory)
 735         requirePathnameExists("Error Directory", Config.errorDirectory);
 736
 737 #if USE_HTTP_VIOLATIONS
 738
 739     {
 740         const RefreshPattern *R;
 741
 742         for (R = Config.Refresh; R; R = R->next) {
 743             if (!R->flags.override_expire)
 744                 continue;
 745
 746             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 747
 748             break;
 749         }
 750
 751         for (R = Config.Refresh; R; R = R->next) {
 752             if (!R->flags.override_lastmod)
 753                 continue;
 754
 755             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 756
 757             break;
 758         }
 759
 760         for (R = Config.Refresh; R; R = R->next) {
 761             if (!R->flags.reload_into_ims)
 762                 continue;
 763
 764             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 765
 766             break;
 767         }
 768
 769         for (R = Config.Refresh; R; R = R->next) {
 770             if (!R->flags.ignore_reload)
 771                 continue;
 772
 773             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 774
 775             break;
 776         }
 777
 778         for (R = Config.Refresh; R; R = R->next) {
 779             if (!R->flags.ignore_no_store)
 780                 continue;
 781
 782             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 783
 784             break;
 785         }
 786
 787         for (R = Config.Refresh; R; R = R->next) {
 788             if (!R->flags.ignore_private)
 789                 continue;
 790
 791             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 792
 793             break;
 794         }
 795     }
 796 #endif
 797 #if !USE_HTTP_VIOLATIONS
 798     Config.onoff.via = 1;
 799 #else
 800
 801     if (!Config.onoff.via)
 802         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 803
 804 #endif
 805
 806     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 807     // TODO: replace with a dedicated "purge" ACL option?
 808     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 809
 810     Config2.onoff.mangle_request_headers = (Config.request_header_access != NULL);
 811
 812     if (geteuid() == 0) {
 813         if (NULL != Config.effectiveUser) {
 814
 815             struct passwd *pwd = getpwnam(Config.effectiveUser);
 816
 817             if (NULL == pwd) {
 818                 /*
 819                  * Andres Kroonmaa <andre@online.ee>:
 820                  * Some getpwnam() implementations (Solaris?) require
 821                  * an available FD < 256 for opening a FILE* to the
 822                  * passwd file.
 823                  * DW:
 824                  * This should be safe at startup, but might still fail
 825                  * during reconfigure.
 826                  */
 827                 fatalf("getpwnam failed to find userid for effective user '%s'",
 828                        Config.effectiveUser);
 829                 return;
 830             }
 831
 832             Config2.effectiveUserID = pwd->pw_uid;
 833
 834             Config2.effectiveGroupID = pwd->pw_gid;
 835
 836 #if HAVE_PUTENV
 837             if (pwd->pw_dir && *pwd->pw_dir) {
 838                 // putenv() leaks by design; avoid leaks when nothing changes
 839                 static SBuf lastDir;
 840                 if (lastDir.isEmpty() || !lastDir.cmp(pwd->pw_dir)) {
 841                     lastDir = pwd->pw_dir;
 842                     int len = strlen(pwd->pw_dir) + 6;
 843                     char *env_str = (char *)xcalloc(len, 1);
 844                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 845                     putenv(env_str);
 846                 }
 847             }
 848 #endif
 849         }
 850     } else {
 851         Config2.effectiveUserID = geteuid();
 852         Config2.effectiveGroupID = getegid();
 853     }
 854
 855     if (NULL != Config.effectiveGroup) {
 856
 857         struct group *grp = getgrnam(Config.effectiveGroup);
 858
 859         if (NULL == grp) {
 860             fatalf("getgrnam failed to find groupid for effective group '%s'",
 861                    Config.effectiveGroup);
 862             return;
 863         }
 864
 865         Config2.effectiveGroupID = grp->gr_gid;
 866     }
 867
 868     if (Security::ProxyOutgoingConfig.encryptTransport) {
 869         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 870         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 871         if (!Config.ssl_client.sslContext) {
 872             debugs(3, DBG_CRITICAL, "ERROR: Could not initialize https:// proxy context");
 873             self_destruct();
 874         }
 875     }
 876
 877     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 878
 879         // default value for ssldomain= is the peer host/IP
 880         if (p->secure.sslDomain.isEmpty())
 881             p->secure.sslDomain = p->host;
 882
 883         if (p->secure.encryptTransport) {
 884             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 885             p->sslContext = p->secure.createClientContext(true);
 886             if (!p->sslContext) {
 887                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 888                 self_destruct();
 889             }
 890         }
 891     }
 892
 893 #if USE_OPENSSL
 894     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 895         if (!s->flags.tunnelSslBumping)
 896             continue;
 897
 898         debugs(3, DBG_IMPORTANT, "Initializing http_port " << s->s << " SSL context");
 899         s->configureSslServerContext();
 900     }
 901
 902     for (AnyP::PortCfgPointer s = HttpsPortList; s != NULL; s = s->next) {
 903         debugs(3, DBG_IMPORTANT, "Initializing https_port " << s->s << " SSL context");
 904         s->configureSslServerContext();
 905     }
 906
 907 #endif
 908
 909     // prevent infinite fetch loops in the request parser
 910     // due to buffer full but not enough data recived to finish parse
 911     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 912         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 913                " Change client_request_buffer_max or request_header_max_size limits.",
 914                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 915     }
 916
 917     /*
 918      * Disable client side request pipelining if client_persistent_connections OFF.
 919      * Waste of resources queueing any pipelined requests when the first will close the connection.
 920      */
 921     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 922         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 923                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 924         Config.pipeline_max_prefetch = 0;
 925     }
 926
 927 #if USE_AUTH
 928     /*
 929      * disable client side request pipelining. There is a race with
 930      * Negotiate and NTLM when the client sends a second request on an
 931      * connection before the authenticate challenge is sent. With
 932      * pipelining OFF, the client may fail to authenticate, but squid's
 933      * state will be preserved.
 934      */
 935     if (Config.pipeline_max_prefetch > 0) {
 936         Auth::Config *nego = Auth::Config::Find("Negotiate");
 937         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 938         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 939             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 940             Config.pipeline_max_prefetch = 0;
 941         }
 942     }
 943 #endif
 944 }
 945
 946 /** Parse a line containing an obsolete directive.
 947  * To upgrade it where possible instead of just "Bungled config" for
 948  * directives which cannot be marked as simply aliases of the some name.
 949  * For example if the parameter order and content has changed.
 950  * Or if the directive has been completely removed.
 951  */
 952 void
 953 parse_obsolete(const char *name)
 954 {
 955     // Directives which have been radically changed rather than removed
 956     if (!strcmp(name, "url_rewrite_concurrency")) {
 957         int cval;
 958         parse_int(&cval);
 959         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 960         Config.redirectChildren.concurrency = cval;
 961     }
 962
 963     if (!strcmp(name, "log_access"))
 964         self_destruct();
 965
 966     if (!strcmp(name, "log_icap"))
 967         self_destruct();
 968
 969     if (!strcmp(name, "ignore_ims_on_miss")) {
 970         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 971         // than the 2.7 directive. We need to parse and invert the configured value.
 972         int temp = 0;
 973         parse_onoff(&temp);
 974         Config.onoff.cache_miss_revalidate = !temp;
 975     }
 976
 977     if (!strncmp(name, "sslproxy_", 9)) {
 978         // the replacement directive tls_outgoing_options uses options instead of whole-line input
 979         SBuf tmp;
 980         if (!strcmp(name, "sslproxy_cafile"))
 981             tmp.append("cafile=");
 982         else if (!strcmp(name, "sslproxy_capath"))
 983             tmp.append("capath=");
 984         else if (!strcmp(name, "sslproxy_cipher"))
 985             tmp.append("cipher=");
 986         else if (!strcmp(name, "sslproxy_client_certificate"))
 987             tmp.append("cert=");
 988         else if (!strcmp(name, "sslproxy_client_key"))
 989             tmp.append("key=");
 990         else if (!strcmp(name, "sslproxy_flags"))
 991             tmp.append("flags=");
 992         else if (!strcmp(name, "sslproxy_options"))
 993             tmp.append("options=");
 994         else if (!strcmp(name, "sslproxy_version"))
 995             tmp.append("version=");
 996         else {
 997             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
 998             self_destruct();
 999         }
1000
1001         // add the value as unquoted-string because the old values did not support whitespace
1002         const char *token = ConfigParser::NextQuotedOrToEol();
1003         tmp.append(token, strlen(token));
1004         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1005     }
1006 }
1007
1008 /* Parse a time specification from the config file.  Store the
1009  * result in 'tptr', after converting it to 'units' */
1010 static void
1011 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
1012 {
1013     time_msec_t u;
1014     if ((u = parseTimeUnits(units, allowMsec)) == 0)
1015         self_destruct();
1016
1017     char *token;
1018     if ((token = ConfigParser::NextToken()) == NULL)
1019         self_destruct();
1020
1021     double d = xatof(token);
1022
1023     time_msec_t m = u; /* default to 'units' if none specified */
1024
1025     if (d) {
1026         if ((token = ConfigParser::PeekAtToken()) && (m = parseTimeUnits(token, allowMsec))) {
1027             (void)ConfigParser::NextToken();
1028
1029         } else if (!expectMoreArguments) {
1030             self_destruct();
1031
1032         } else {
1033             token = NULL; // show default units if dying below
1034             debugs(3, DBG_CRITICAL, "WARNING: No units on '" << config_input_line << "', assuming " << d << " " << units);
1035         }
1036     } else
1037         token = NULL; // show default units if dying below.
1038
1039     *tptr = static_cast<time_msec_t>(m * d);
1040
1041     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1042         debugs(3, DBG_CRITICAL, "FATAL: Invalid value '" <<
1043                d << " " << (token ? token : units) << ": integer overflow (time_msec_t).");
1044         self_destruct();
1045     }
1046 }
1047
1048 static uint64_t
1049 parseTimeUnits(const char *unit, bool allowMsec)
1050 {
1051     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1052         return 1;
1053
1054     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1055         return 1000;
1056
1057     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1058         return 60 * 1000;
1059
1060     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1061         return 3600 * 1000;
1062
1063     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1064         return 86400 * 1000;
1065
1066     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1067         return 86400 * 7 * 1000;
1068
1069     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1070         return 86400 * 14 * 1000;
1071
1072     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1073         return static_cast<uint64_t>(86400) * 30 * 1000;
1074
1075     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1076         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1077
1078     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1079         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1080
1081     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1082
1083     return 0;
1084 }
1085
1086 static void
1087 parseBytesLine64(int64_t * bptr, const char *units)
1088 {
1089     char *token;
1090     double d;
1091     int64_t m;
1092     int64_t u;
1093
1094     if ((u = parseBytesUnits(units)) == 0) {
1095         self_destruct();
1096         return;
1097     }
1098
1099     if ((token = ConfigParser::NextToken()) == NULL) {
1100         self_destruct();
1101         return;
1102     }
1103
1104     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1105         *bptr = -1;
1106         return;
1107     }
1108
1109     d = xatof(token);
1110
1111     m = u;          /* default to 'units' if none specified */
1112
1113     if (0.0 == d)
1114         (void) 0;
1115     else if ((token = ConfigParser::NextToken()) == NULL)
1116         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1117                config_input_line << "', assuming " <<
1118                d << " " <<  units  );
1119     else if ((m = parseBytesUnits(token)) == 0) {
1120         self_destruct();
1121         return;
1122     }
1123
1124     *bptr = static_cast<int64_t>(m * d / u);
1125
1126     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1127         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1128                d << " " << token << ": integer overflow (int64_t).");
1129         self_destruct();
1130     }
1131 }
1132
1133 static void
1134 parseBytesLine(size_t * bptr, const char *units)
1135 {
1136     char *token;
1137     double d;
1138     int m;
1139     int u;
1140
1141     if ((u = parseBytesUnits(units)) == 0) {
1142         self_destruct();
1143         return;
1144     }
1145
1146     if ((token = ConfigParser::NextToken()) == NULL) {
1147         self_destruct();
1148         return;
1149     }
1150
1151     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1152         *bptr = static_cast<size_t>(-1);
1153         return;
1154     }
1155
1156     d = xatof(token);
1157
1158     m = u;          /* default to 'units' if none specified */
1159
1160     if (0.0 == d)
1161         (void) 0;
1162     else if ((token = ConfigParser::NextToken()) == NULL)
1163         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1164                config_input_line << "', assuming " <<
1165                d << " " <<  units  );
1166     else if ((m = parseBytesUnits(token)) == 0) {
1167         self_destruct();
1168         return;
1169     }
1170
1171     *bptr = static_cast<size_t>(m * d / u);
1172
1173     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1174         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1175                d << " " << token << ": integer overflow (size_t).");
1176         self_destruct();
1177     }
1178 }
1179
1180 static void
1181 parseBytesLineSigned(ssize_t * bptr, const char *units)
1182 {
1183     char *token;
1184     double d;
1185     int m;
1186     int u;
1187
1188     if ((u = parseBytesUnits(units)) == 0) {
1189         self_destruct();
1190         return;
1191     }
1192
1193     if ((token = ConfigParser::NextToken()) == NULL) {
1194         self_destruct();
1195         return;
1196     }
1197
1198     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1199         *bptr = -1;
1200         return;
1201     }
1202
1203     d = xatof(token);
1204
1205     m = u;          /* default to 'units' if none specified */
1206
1207     if (0.0 == d)
1208         (void) 0;
1209     else if ((token = ConfigParser::NextToken()) == NULL)
1210         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1211                config_input_line << "', assuming " <<
1212                d << " " <<  units  );
1213     else if ((m = parseBytesUnits(token)) == 0) {
1214         self_destruct();
1215         return;
1216     }
1217
1218     *bptr = static_cast<ssize_t>(m * d / u);
1219
1220     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1221         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1222                d << " " << token << ": integer overflow (ssize_t).");
1223         self_destruct();
1224     }
1225 }
1226
1227 /**
1228  * Parse bytes from a string.
1229  * Similar to the parseBytesLine function but parses the string value instead of
1230  * the current token value.
1231  */
1232 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1233 {
1234     int u;
1235     if ((u = parseBytesUnits(units)) == 0) {
1236         self_destruct();
1237         return;
1238     }
1239
1240     // Find number from string beginning.
1241     char const * number_begin = value;
1242     char const * number_end = value;
1243
1244     while ((*number_end >= '0' && *number_end <= '9')) {
1245         ++number_end;
1246     }
1247
1248     String number;
1249     number.limitInit(number_begin, number_end - number_begin);
1250
1251     int d = xatoi(number.termedBuf());
1252     int m;
1253     if ((m = parseBytesUnits(number_end)) == 0) {
1254         self_destruct();
1255         return;
1256     }
1257
1258     *bptr = static_cast<size_t>(m * d / u);
1259     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1260         self_destruct();
1261 }
1262
1263 static size_t
1264 parseBytesUnits(const char *unit)
1265 {
1266     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1267         return 1;
1268
1269     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1270         return 1 << 10;
1271
1272     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1273         return 1 << 20;
1274
1275     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1276         return 1 << 30;
1277
1278     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1279
1280     return 0;
1281 }
1282
1283 static void
1284 dump_SBufList(StoreEntry * entry, const SBufList &words)
1285 {
1286     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1287         entry->append(i->rawContent(), i->length());
1288         entry->append(" ",1);
1289     }
1290     entry->append("\n",1);
1291 }
1292
1293 static void
1294 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1295 {
1296     while (ae != NULL) {
1297         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1298         storeAppendPrintf(entry, "%s %s %s %s ",
1299                           name,
1300                           ae->name,
1301                           ae->typeString(),
1302                           ae->flags.flagsStr());
1303         dump_SBufList(entry, ae->dump());
1304         ae = ae->next;
1305     }
1306 }
1307
1308 static void
1309 parse_acl(ACL ** ae)
1310 {
1311     ACL::ParseAclLine(LegacyParser, ae);
1312 }
1313
1314 static void
1315 free_acl(ACL ** ae)
1316 {
1317     aclDestroyAcls(ae);
1318 }
1319
1320 void
1321 dump_acl_list(StoreEntry * entry, ACLList * head)
1322 {
1323     dump_SBufList(entry, head->dump());
1324 }
1325
1326 void
1327 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1328 {
1329     if (head)
1330         dump_SBufList(entry, head->treeDump(name,NULL));
1331 }
1332
1333 static void
1334 parse_acl_access(acl_access ** head)
1335 {
1336     aclParseAccessLine(cfg_directive, LegacyParser, head);
1337 }
1338
1339 static void
1340 free_acl_access(acl_access ** head)
1341 {
1342     aclDestroyAccessList(head);
1343 }
1344
1345 static void
1346 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1347 {
1348     char buf[MAX_IPSTRLEN];
1349     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1350 }
1351
1352 static void
1353 parse_address(Ip::Address *addr)
1354 {
1355     char *token = ConfigParser::NextToken();
1356
1357     if (!token) {
1358         self_destruct();
1359         return;
1360     }
1361
1362     if (!strcmp(token,"any_addr"))
1363         addr->setAnyAddr();
1364     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1365         addr->setNoAddr();
1366     else if ( (*addr = token) ) // try parse numeric/IPA
1367         (void) 0;
1368     else if (addr->GetHostByName(token)) // dont use ipcache
1369         (void) 0;
1370     else { // not an IP and not a hostname
1371         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1372         self_destruct();
1373     }
1374 }
1375
1376 static void
1377 free_address(Ip::Address *addr)
1378 {
1379     addr->setEmpty();
1380 }
1381
1382 static void
1383 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1384 {
1385     char buf[MAX_IPSTRLEN];
1386
1387     for (Acl::Address *l = head; l; l = l->next) {
1388         if (!l->addr.isAnyAddr())
1389             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1390         else
1391             storeAppendPrintf(entry, "%s autoselect", name);
1392
1393         dump_acl_list(entry, l->aclList);
1394
1395         storeAppendPrintf(entry, "\n");
1396     }
1397 }
1398
1399 static void
1400 parse_acl_address(Acl::Address ** head)
1401 {
1402     Acl::Address *l = new Acl::Address;
1403     parse_address(&l->addr);
1404     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1405
1406     Acl::Address **tail = head;
1407     while (*tail)
1408         tail = &(*tail)->next;
1409
1410     *tail = l;
1411 }
1412
1413 static void
1414 free_acl_address(Acl::Address ** head)
1415 {
1416     delete *head;
1417     *head = NULL;
1418 }
1419
1420 static void
1421 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1422 {
1423     acl_tos *l;
1424
1425     for (l = head; l; l = l->next) {
1426         if (l->tos > 0)
1427             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1428         else
1429             storeAppendPrintf(entry, "%s none", name);
1430
1431         dump_acl_list(entry, l->aclList);
1432
1433         storeAppendPrintf(entry, "\n");
1434     }
1435 }
1436
1437 static void
1438 parse_acl_tos(acl_tos ** head)
1439 {
1440     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1441     char *token = ConfigParser::NextToken();
1442
1443     if (!token) {
1444         self_destruct();
1445         return;
1446     }
1447
1448     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1449         self_destruct();
1450         return;
1451     }
1452
1453     const unsigned int chTos = tos & 0xFC;
1454     if (chTos != tos) {
1455         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1456         tos = chTos;
1457     }
1458
1459     acl_tos *l = new acl_tos;
1460
1461     l->tos = (tos_t)tos;
1462
1463     aclParseAclList(LegacyParser, &l->aclList, token);
1464
1465     acl_tos **tail = head;  /* sane name below */
1466     while (*tail)
1467         tail = &(*tail)->next;
1468
1469     *tail = l;
1470 }
1471
1472 static void
1473 free_acl_tos(acl_tos ** head)
1474 {
1475     delete *head;
1476     head = NULL;
1477 }
1478
1479 #if SO_MARK && USE_LIBCAP
1480
1481 static void
1482 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1483 {
1484     for (acl_nfmark *l = head; l; l = l->next) {
1485         if (l->nfmark > 0)
1486             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1487         else
1488             storeAppendPrintf(entry, "%s none", name);
1489
1490         dump_acl_list(entry, l->aclList);
1491
1492         storeAppendPrintf(entry, "\n");
1493     }
1494 }
1495
1496 static void
1497 parse_acl_nfmark(acl_nfmark ** head)
1498 {
1499     nfmark_t mark;
1500     char *token = ConfigParser::NextToken();
1501
1502     if (!token) {
1503         self_destruct();
1504         return;
1505     }
1506
1507     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1508         self_destruct();
1509         return;
1510     }
1511
1512     acl_nfmark *l = new acl_nfmark;
1513
1514     l->nfmark = mark;
1515
1516     aclParseAclList(LegacyParser, &l->aclList, token);
1517
1518     acl_nfmark **tail = head;   /* sane name below */
1519     while (*tail)
1520         tail = &(*tail)->next;
1521
1522     *tail = l;
1523 }
1524
1525 static void
1526 free_acl_nfmark(acl_nfmark ** head)
1527 {
1528     delete *head;
1529     head = NULL;
1530 }
1531 #endif /* SO_MARK */
1532
1533 static void
1534 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1535 {
1536     for (AclSizeLimit *l = head; l; l = l->next) {
1537         if (l->size != -1)
1538             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1539         else
1540             storeAppendPrintf(entry, "%s none", name);
1541
1542         dump_acl_list(entry, l->aclList);
1543
1544         storeAppendPrintf(entry, "\n");
1545     }
1546 }
1547
1548 static void
1549 parse_acl_b_size_t(AclSizeLimit ** head)
1550 {
1551     AclSizeLimit *l = new AclSizeLimit;
1552
1553     parse_b_int64_t(&l->size);
1554
1555     aclParseAclList(LegacyParser, &l->aclList, l->size);
1556
1557     AclSizeLimit **tail = head; /* sane name below */
1558     while (*tail)
1559         tail = &(*tail)->next;
1560
1561     *tail = l;
1562 }
1563
1564 static void
1565 free_acl_b_size_t(AclSizeLimit ** head)
1566 {
1567     delete *head;
1568     *head = NULL;
1569 }
1570
1571 #if USE_DELAY_POOLS
1572
1573 #include "DelayConfig.h"
1574 #include "DelayPools.h"
1575 /* do nothing - free_delay_pool_count is the magic free function.
1576  * this is why delay_pool_count isn't just marked TYPE: u_short
1577  */
1578 #define free_delay_pool_class(X)
1579 #define free_delay_pool_access(X)
1580 #define free_delay_pool_rates(X)
1581 #define dump_delay_pool_class(X, Y, Z)
1582 #define dump_delay_pool_access(X, Y, Z)
1583 #define dump_delay_pool_rates(X, Y, Z)
1584
1585 static void
1586 free_delay_pool_count(DelayConfig * cfg)
1587 {
1588     cfg->freePoolCount();
1589 }
1590
1591 static void
1592 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1593 {
1594     cfg.dumpPoolCount (entry, name);
1595 }
1596
1597 static void
1598 parse_delay_pool_count(DelayConfig * cfg)
1599 {
1600     cfg->parsePoolCount();
1601 }
1602
1603 static void
1604 parse_delay_pool_class(DelayConfig * cfg)
1605 {
1606     cfg->parsePoolClass();
1607 }
1608
1609 static void
1610 parse_delay_pool_rates(DelayConfig * cfg)
1611 {
1612     cfg->parsePoolRates();
1613 }
1614
1615 static void
1616 parse_delay_pool_access(DelayConfig * cfg)
1617 {
1618     cfg->parsePoolAccess(LegacyParser);
1619 }
1620
1621 #endif
1622
1623 #if USE_DELAY_POOLS
1624 #include "ClientDelayConfig.h"
1625 /* do nothing - free_client_delay_pool_count is the magic free function.
1626  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1627  */
1628
1629 #define free_client_delay_pool_access(X)
1630 #define free_client_delay_pool_rates(X)
1631 #define dump_client_delay_pool_access(X, Y, Z)
1632 #define dump_client_delay_pool_rates(X, Y, Z)
1633
1634 static void
1635 free_client_delay_pool_count(ClientDelayConfig * cfg)
1636 {
1637     cfg->freePoolCount();
1638 }
1639
1640 static void
1641 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1642 {
1643     cfg.dumpPoolCount (entry, name);
1644 }
1645
1646 static void
1647 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1648 {
1649     cfg->parsePoolCount();
1650 }
1651
1652 static void
1653 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1654 {
1655     cfg->parsePoolRates();
1656 }
1657
1658 static void
1659 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1660 {
1661     cfg->parsePoolAccess(LegacyParser);
1662 }
1663 #endif
1664
1665 #if USE_HTTP_VIOLATIONS
1666 static void
1667 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1668 {
1669     if (manglers)
1670         manglers->dumpAccess(entry, name);
1671 }
1672
1673 static void
1674 parse_http_header_access(HeaderManglers **pm)
1675 {
1676     char *t = NULL;
1677
1678     if ((t = ConfigParser::NextToken()) == NULL) {
1679         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1680         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1681         return;
1682     }
1683
1684     if (!*pm)
1685         *pm = new HeaderManglers;
1686     HeaderManglers *manglers = *pm;
1687     headerMangler *mangler = manglers->track(t);
1688     assert(mangler);
1689
1690     std::string directive = "http_header_access ";
1691     directive += t;
1692     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1693 }
1694
1695 static void
1696 free_HeaderManglers(HeaderManglers **pm)
1697 {
1698     // we delete the entire http_header_* mangler configuration at once
1699     if (const HeaderManglers *manglers = *pm) {
1700         delete manglers;
1701         *pm = NULL;
1702     }
1703 }
1704
1705 static void
1706 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1707 {
1708     if (manglers)
1709         manglers->dumpReplacement(entry, name);
1710 }
1711
1712 static void
1713 parse_http_header_replace(HeaderManglers **pm)
1714 {
1715     char *t = NULL;
1716
1717     if ((t = ConfigParser::NextToken()) == NULL) {
1718         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1719         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1720         return;
1721     }
1722
1723     const char *value = ConfigParser::NextQuotedOrToEol();
1724
1725     if (!*pm)
1726         *pm = new HeaderManglers;
1727     HeaderManglers *manglers = *pm;
1728     manglers->setReplacement(t, value);
1729 }
1730
1731 #endif
1732
1733 static void
1734 dump_cachedir(StoreEntry * entry, const char *name, SquidConfig::_cacheSwap swap)
1735 {
1736     SwapDir *s;
1737     int i;
1738     assert (entry);
1739
1740     for (i = 0; i < swap.n_configured; ++i) {
1741         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1742         if (!s) continue;
1743         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1744         s->dump(*entry);
1745         storeAppendPrintf(entry, "\n");
1746     }
1747 }
1748
1749 static int
1750 check_null_string(char *s)
1751 {
1752     return s == NULL;
1753 }
1754
1755 #if USE_AUTH
1756 static void
1757 parse_authparam(Auth::ConfigVector * config)
1758 {
1759     char *type_str;
1760     char *param_str;
1761
1762     if ((type_str = ConfigParser::NextToken()) == NULL)
1763         self_destruct();
1764
1765     if ((param_str = ConfigParser::NextToken()) == NULL)
1766         self_destruct();
1767
1768     /* find a configuration for the scheme in the currently parsed configs... */
1769     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1770
1771     if (schemeCfg == NULL) {
1772         /* Create a configuration based on the scheme info */
1773         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1774
1775         if (theScheme == NULL) {
1776             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1777             self_destruct();
1778         }
1779
1780         config->push_back(theScheme->createConfig());
1781         schemeCfg = Auth::Config::Find(type_str);
1782         if (schemeCfg == NULL) {
1783             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1784             self_destruct();
1785         }
1786     }
1787
1788     schemeCfg->parse(schemeCfg, config->size(), param_str);
1789 }
1790
1791 static void
1792 free_authparam(Auth::ConfigVector * cfg)
1793 {
1794     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1795     cfg->clear();
1796
1797     /* on reconfigure initialize new auth schemes for the new config. */
1798     if (reconfiguring) {
1799         Auth::Init();
1800     }
1801 }
1802
1803 static void
1804 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1805 {
1806     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1807         (*i)->dump(entry, name, (*i));
1808 }
1809 #endif /* USE_AUTH */
1810
1811 /* TODO: just return the object, the # is irrelevant */
1812 static int
1813 find_fstype(char *type)
1814 {
1815     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1816         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1817             return (int)i;
1818
1819     return (-1);
1820 }
1821
1822 static void
1823 parse_cachedir(SquidConfig::_cacheSwap * swap)
1824 {
1825     char *type_str;
1826     char *path_str;
1827     RefCount<SwapDir> sd;
1828     int i;
1829     int fs;
1830
1831     if ((type_str = ConfigParser::NextToken()) == NULL)
1832         self_destruct();
1833
1834     if ((path_str = ConfigParser::NextToken()) == NULL)
1835         self_destruct();
1836
1837     fs = find_fstype(type_str);
1838
1839     if (fs < 0) {
1840         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1841         return;
1842     }
1843
1844     /* reconfigure existing dir */
1845
1846     for (i = 0; i < swap->n_configured; ++i) {
1847         assert (swap->swapDirs[i].getRaw());
1848
1849         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1850             /* this is specific to on-fs Stores. The right
1851              * way to handle this is probably to have a mapping
1852              * from paths to stores, and have on-fs stores
1853              * register with that, and lookip in that in their
1854              * own setup logic. RBC 20041225. TODO.
1855              */
1856
1857             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1858
1859             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1860                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1861                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1862                 return;
1863             }
1864
1865             sd->reconfigure();
1866             return;
1867         }
1868     }
1869
1870     /* new cache_dir */
1871     if (swap->n_configured > 63) {
1872         /* 7 bits, signed */
1873         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1874         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1875         self_destruct();
1876         return;
1877     }
1878
1879     allocate_new_swapdir(swap);
1880
1881     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1882
1883     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1884
1885     /* parse the FS parameters and options */
1886     sd->parse(swap->n_configured, path_str);
1887
1888     ++swap->n_configured;
1889 }
1890
1891 static const char *
1892 peer_type_str(const peer_t type)
1893 {
1894     const char * result;
1895
1896     switch (type) {
1897
1898     case PEER_PARENT:
1899         result = "parent";
1900         break;
1901
1902     case PEER_SIBLING:
1903         result = "sibling";
1904         break;
1905
1906     case PEER_MULTICAST:
1907         result = "multicast";
1908         break;
1909
1910     default:
1911         result = "unknown";
1912         break;
1913     }
1914
1915     return result;
1916 }
1917
1918 static void
1919 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1920 {
1921     NeighborTypeDomainList *t;
1922     LOCAL_ARRAY(char, xname, 128);
1923
1924     while (p != NULL) {
1925         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1926                           name,
1927                           p->host,
1928                           neighborTypeStr(p),
1929                           p->http_port,
1930                           p->icp.port,
1931                           p->name);
1932         dump_peer_options(entry, p);
1933
1934         if (p->access) {
1935             snprintf(xname, 128, "cache_peer_access %s", p->name);
1936             dump_acl_access(entry, xname, p->access);
1937         }
1938
1939         for (t = p->typelist; t; t = t->next) {
1940             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1941                               p->host,
1942                               peer_type_str(t->type),
1943                               t->domain);
1944         }
1945
1946         p = p->next;
1947     }
1948 }
1949
1950 /**
1951  * utility function to prevent getservbyname() being called with a numeric value
1952  * on Windows at least it returns garage results.
1953  */
1954 static bool
1955 isUnsignedNumeric(const char *str, size_t len)
1956 {
1957     if (len < 1) return false;
1958
1959     for (; len >0 && *str; ++str, --len) {
1960         if (! isdigit(*str))
1961             return false;
1962     }
1963     return true;
1964 }
1965
1966 /**
1967  \param proto   'tcp' or 'udp' for protocol
1968  \returns       Port the named service is supposed to be listening on.
1969  */
1970 static unsigned short
1971 GetService(const char *proto)
1972 {
1973     struct servent *port = NULL;
1974     /** Parses a port number or service name from the squid.conf */
1975     char *token = ConfigParser::NextToken();
1976     if (token == NULL) {
1977         self_destruct();
1978         return 0; /* NEVER REACHED */
1979     }
1980     /** Returns either the service port number from /etc/services */
1981     if ( !isUnsignedNumeric(token, strlen(token)) )
1982         port = getservbyname(token, proto);
1983     if (port != NULL) {
1984         return ntohs((unsigned short)port->s_port);
1985     }
1986     /** Or a numeric translation of the config text. */
1987     return xatos(token);
1988 }
1989
1990 /**
1991  \returns       Port the named TCP service is supposed to be listening on.
1992  \copydoc GetService(const char *proto)
1993  */
1994 inline unsigned short
1995 GetTcpService(void)
1996 {
1997     return GetService("tcp");
1998 }
1999
2000 /**
2001  \returns       Port the named UDP service is supposed to be listening on.
2002  \copydoc GetService(const char *proto)
2003  */
2004 inline unsigned short
2005 GetUdpService(void)
2006 {
2007     return GetService("udp");
2008 }
2009
2010 static void
2011 parse_peer(CachePeer ** head)
2012 {
2013     char *token = NULL;
2014     CachePeer *p = new CachePeer;
2015
2016     if ((token = ConfigParser::NextToken()) == NULL)
2017         self_destruct();
2018
2019     p->host = xstrdup(token);
2020
2021     p->name = xstrdup(token);
2022
2023     if ((token = ConfigParser::NextToken()) == NULL)
2024         self_destruct();
2025
2026     p->type = parseNeighborType(token);
2027
2028     if (p->type == PEER_MULTICAST) {
2029         p->options.no_digest = true;
2030         p->options.no_netdb_exchange = true;
2031     }
2032
2033     p->http_port = GetTcpService();
2034
2035     if (!p->http_port)
2036         self_destruct();
2037
2038     p->icp.port = GetUdpService();
2039
2040     while ((token = ConfigParser::NextToken())) {
2041         if (!strcmp(token, "proxy-only")) {
2042             p->options.proxy_only = true;
2043         } else if (!strcmp(token, "no-query")) {
2044             p->options.no_query = true;
2045         } else if (!strcmp(token, "background-ping")) {
2046             p->options.background_ping = true;
2047         } else if (!strcmp(token, "no-digest")) {
2048             p->options.no_digest = true;
2049         } else if (!strcmp(token, "no-tproxy")) {
2050             p->options.no_tproxy = true;
2051         } else if (!strcmp(token, "multicast-responder")) {
2052             p->options.mcast_responder = true;
2053 #if PEER_MULTICAST_SIBLINGS
2054         } else if (!strcmp(token, "multicast-siblings")) {
2055             p->options.mcast_siblings = true;
2056 #endif
2057         } else if (!strncmp(token, "weight=", 7)) {
2058             p->weight = xatoi(token + 7);
2059         } else if (!strncmp(token, "basetime=", 9)) {
2060             p->basetime = xatoi(token + 9);
2061         } else if (!strcmp(token, "closest-only")) {
2062             p->options.closest_only = true;
2063         } else if (!strncmp(token, "ttl=", 4)) {
2064             p->mcast.ttl = xatoi(token + 4);
2065
2066             if (p->mcast.ttl < 0)
2067                 p->mcast.ttl = 0;
2068
2069             if (p->mcast.ttl > 128)
2070                 p->mcast.ttl = 128;
2071         } else if (!strcmp(token, "default")) {
2072             p->options.default_parent = true;
2073         } else if (!strcmp(token, "round-robin")) {
2074             p->options.roundrobin = true;
2075         } else if (!strcmp(token, "weighted-round-robin")) {
2076             p->options.weighted_roundrobin = true;
2077 #if USE_HTCP
2078         } else if (!strcmp(token, "htcp")) {
2079             p->options.htcp = true;
2080         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2081             /* Note: The htcp- form is deprecated, replaced by htcp= */
2082             p->options.htcp = true;
2083             char *tmp = xstrdup(token+5);
2084             char *mode, *nextmode;
2085             for (mode = nextmode = tmp; mode; mode = nextmode) {
2086                 nextmode = strchr(mode, ',');
2087                 if (nextmode) {
2088                     *nextmode = '\0';
2089                     ++nextmode;
2090                 }
2091                 if (!strcmp(mode, "no-clr")) {
2092                     if (p->options.htcp_only_clr)
2093                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2094                     p->options.htcp_no_clr = true;
2095                 } else if (!strcmp(mode, "no-purge-clr")) {
2096                     p->options.htcp_no_purge_clr = true;
2097                 } else if (!strcmp(mode, "only-clr")) {
2098                     if (p->options.htcp_no_clr)
2099                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2100                     p->options.htcp_only_clr = true;
2101                 } else if (!strcmp(mode, "forward-clr")) {
2102                     p->options.htcp_forward_clr = true;
2103                 } else if (!strcmp(mode, "oldsquid")) {
2104                     p->options.htcp_oldsquid = true;
2105                 } else {
2106                     fatalf("invalid HTCP mode '%s'", mode);
2107                 }
2108             }
2109             safe_free(tmp);
2110 #endif
2111         } else if (!strcmp(token, "no-netdb-exchange")) {
2112             p->options.no_netdb_exchange = true;
2113
2114         } else if (!strcmp(token, "carp")) {
2115             if (p->type != PEER_PARENT)
2116                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2117
2118             p->options.carp = true;
2119         } else if (!strncmp(token, "carp-key=", 9)) {
2120             if (p->options.carp != true)
2121                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2122             p->options.carp_key.set = true;
2123             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2124             for (; key; key = nextkey) {
2125                 nextkey=strchr(key,',');
2126                 if (nextkey) ++nextkey; // skip the comma, any
2127                 if (0==strncmp(key,"scheme",6)) {
2128                     p->options.carp_key.scheme = true;
2129                 } else if (0==strncmp(key,"host",4)) {
2130                     p->options.carp_key.host = true;
2131                 } else if (0==strncmp(key,"port",4)) {
2132                     p->options.carp_key.port = true;
2133                 } else if (0==strncmp(key,"path",4)) {
2134                     p->options.carp_key.path = true;
2135                 } else if (0==strncmp(key,"params",6)) {
2136                     p->options.carp_key.params = true;
2137                 } else {
2138                     fatalf("invalid carp-key '%s'",key);
2139                 }
2140             }
2141         } else if (!strcmp(token, "userhash")) {
2142 #if USE_AUTH
2143             if (p->type != PEER_PARENT)
2144                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2145
2146             p->options.userhash = true;
2147 #else
2148             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2149 #endif
2150         } else if (!strcmp(token, "sourcehash")) {
2151             if (p->type != PEER_PARENT)
2152                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2153
2154             p->options.sourcehash = true;
2155
2156         } else if (!strcmp(token, "no-delay")) {
2157 #if USE_DELAY_POOLS
2158             p->options.no_delay = true;
2159 #else
2160             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2161 #endif
2162         } else if (!strncmp(token, "login=", 6)) {
2163             p->login = xstrdup(token + 6);
2164             rfc1738_unescape(p->login);
2165         } else if (!strncmp(token, "connect-timeout=", 16)) {
2166             p->connect_timeout = xatoi(token + 16);
2167         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2168             p->connect_fail_limit = xatoi(token + 19);
2169 #if USE_CACHE_DIGESTS
2170         } else if (!strncmp(token, "digest-url=", 11)) {
2171             p->digest_url = xstrdup(token + 11);
2172 #endif
2173
2174         } else if (!strcmp(token, "allow-miss")) {
2175             p->options.allow_miss = true;
2176         } else if (!strncmp(token, "max-conn=", 9)) {
2177             p->max_conn = xatoi(token + 9);
2178         } else if (!strncmp(token, "standby=", 8)) {
2179             p->standby.limit = xatoi(token + 8);
2180         } else if (!strcmp(token, "originserver")) {
2181             p->options.originserver = true;
2182         } else if (!strncmp(token, "name=", 5)) {
2183             safe_free(p->name);
2184
2185             if (token[5])
2186                 p->name = xstrdup(token + 5);
2187         } else if (!strncmp(token, "forceddomain=", 13)) {
2188             safe_free(p->domain);
2189             if (token[13])
2190                 p->domain = xstrdup(token + 13);
2191
2192         } else if (strncmp(token, "ssl", 3) == 0) {
2193 #if !USE_OPENSSL
2194             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2195 #else
2196             p->secure.encryptTransport = true;
2197             p->secure.parse(token+3);
2198 #endif
2199         } else if (strncmp(token, "tls-", 4) == 0) {
2200             p->secure.encryptTransport = true;
2201             p->secure.parse(token+4);
2202         } else if (strcmp(token, "front-end-https") == 0) {
2203             p->front_end_https = 1;
2204         } else if (strcmp(token, "front-end-https=on") == 0) {
2205             p->front_end_https = 1;
2206         } else if (strcmp(token, "front-end-https=auto") == 0) {
2207             p->front_end_https = 2;
2208         } else if (strcmp(token, "connection-auth=off") == 0) {
2209             p->connection_auth = 0;
2210         } else if (strcmp(token, "connection-auth") == 0) {
2211             p->connection_auth = 1;
2212         } else if (strcmp(token, "connection-auth=on") == 0) {
2213             p->connection_auth = 1;
2214         } else if (strcmp(token, "connection-auth=auto") == 0) {
2215             p->connection_auth = 2;
2216         } else if (token[0] == '#') {
2217             // start of a text comment. stop reading this line.
2218             break;
2219         } else {
2220             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2221         }
2222     }
2223
2224     if (peerFindByName(p->name))
2225         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2226
2227     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2228         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2229
2230     if (p->weight < 1)
2231         p->weight = 1;
2232
2233     if (p->connect_fail_limit < 1)
2234         p->connect_fail_limit = 10;
2235
2236 #if USE_CACHE_DIGESTS
2237
2238     if (!p->options.no_digest) {
2239         /* XXX This looks odd.. who has the original pointer
2240          * then?
2241          */
2242         PeerDigest *pd = peerDigestCreate(p);
2243         p->digest = cbdataReference(pd);
2244     }
2245
2246 #endif
2247
2248     p->index =  ++Config.npeers;
2249
2250     while (*head != NULL)
2251         head = &(*head)->next;
2252
2253     *head = p;
2254
2255     peerClearRRStart();
2256 }
2257
2258 static void
2259 free_peer(CachePeer ** P)
2260 {
2261     delete *P;
2262     *P = NULL;
2263     Config.npeers = 0;
2264 }
2265
2266 static void
2267 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2268 {
2269     wordlist *w;
2270
2271     while (list != NULL) {
2272         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2273             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2274         else
2275             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2276
2277         for (w = list->actions; w != NULL; w = w->next) {
2278             storeAppendPrintf(entry, " %s", w->key);
2279         }
2280
2281         storeAppendPrintf(entry, "\n");
2282         list = list->next;
2283     }
2284 }
2285
2286 static void
2287 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2288 {
2289     char *passwd = NULL;
2290     wordlist *actions = NULL;
2291     Mgr::ActionPasswordList *p;
2292     Mgr::ActionPasswordList **P;
2293     parse_string(&passwd);
2294     parse_wordlist(&actions);
2295     p = new Mgr::ActionPasswordList;
2296     p->passwd = passwd;
2297     p->actions = actions;
2298
2299     for (P = head; *P; P = &(*P)->next) {
2300         /*
2301          * See if any of the actions from this line already have a
2302          * password from previous lines.  The password checking
2303          * routines in cache_manager.c take the the password from
2304          * the first Mgr::ActionPasswordList that contains the
2305          * requested action.  Thus, we should warn users who might
2306          * think they can have two passwords for the same action.
2307          */
2308         wordlist *w;
2309         wordlist *u;
2310
2311         for (w = (*P)->actions; w; w = w->next) {
2312             for (u = actions; u; u = u->next) {
2313                 if (strcmp(w->key, u->key))
2314                     continue;
2315
2316                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2317             }
2318         }
2319     }
2320
2321     *P = p;
2322 }
2323
2324 static void
2325 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2326 {
2327     Mgr::ActionPasswordList *p;
2328
2329     while ((p = *head) != NULL) {
2330         *head = p->next;
2331         xfree(p->passwd);
2332         wordlistDestroy(&p->actions);
2333         xfree(p);
2334     }
2335 }
2336
2337 static void
2338 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2339 {
2340     AclNameList *a;
2341
2342     while (var != NULL) {
2343         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2344
2345         for (a = var->acl_list; a != NULL; a = a->next)
2346             storeAppendPrintf(entry, " %s", a->name);
2347
2348         storeAppendPrintf(entry, "\n");
2349
2350         var = var->next;
2351     }
2352 }
2353
2354 static void
2355 parse_denyinfo(AclDenyInfoList ** var)
2356 {
2357     aclParseDenyInfoLine(var);
2358 }
2359
2360 void
2361 free_denyinfo(AclDenyInfoList ** list)
2362 {
2363     AclDenyInfoList *a = NULL;
2364     AclDenyInfoList *a_next = NULL;
2365     AclNameList *l = NULL;
2366     AclNameList *l_next = NULL;
2367
2368     for (a = *list; a; a = a_next) {
2369         for (l = a->acl_list; l; l = l_next) {
2370             l_next = l->next;
2371             memFree(l, MEM_ACL_NAME_LIST);
2372             l = NULL;
2373         }
2374
2375         a_next = a->next;
2376         memFree(a, MEM_ACL_DENY_INFO_LIST);
2377         a = NULL;
2378     }
2379
2380     *list = NULL;
2381 }
2382
2383 static void
2384 parse_peer_access(void)
2385 {
2386     char *host = NULL;
2387     CachePeer *p;
2388
2389     if (!(host = ConfigParser::NextToken()))
2390         self_destruct();
2391
2392     if ((p = peerFindByName(host)) == NULL) {
2393         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2394         return;
2395     }
2396
2397     std::string directive = "peer_access ";
2398     directive += host;
2399     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2400 }
2401
2402 static void
2403 parse_hostdomaintype(void)
2404 {
2405     char *host = NULL;
2406     char *type = NULL;
2407     char *domain = NULL;
2408
2409     if (!(host = ConfigParser::NextToken()))
2410         self_destruct();
2411
2412     if (!(type = ConfigParser::NextToken()))
2413         self_destruct();
2414
2415     while ((domain = ConfigParser::NextToken())) {
2416         NeighborTypeDomainList *l = NULL;
2417         NeighborTypeDomainList **L = NULL;
2418         CachePeer *p;
2419
2420         if ((p = peerFindByName(host)) == NULL) {
2421             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2422             return;
2423         }
2424
2425         l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2426         l->type = parseNeighborType(type);
2427         l->domain = xstrdup(domain);
2428
2429         for (L = &(p->typelist); *L; L = &((*L)->next));
2430         *L = l;
2431     }
2432 }
2433
2434 static void
2435 dump_int(StoreEntry * entry, const char *name, int var)
2436 {
2437     storeAppendPrintf(entry, "%s %d\n", name, var);
2438 }
2439
2440 void
2441 parse_int(int *var)
2442 {
2443     int i;
2444     i = GetInteger();
2445     *var = i;
2446 }
2447
2448 static void
2449 free_int(int *var)
2450 {
2451     *var = 0;
2452 }
2453
2454 static void
2455 dump_onoff(StoreEntry * entry, const char *name, int var)
2456 {
2457     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2458 }
2459
2460 void
2461 parse_onoff(int *var)
2462 {
2463     char *token = ConfigParser::NextToken();
2464
2465     if (token == NULL)
2466         self_destruct();
2467
2468     if (!strcmp(token, "on")) {
2469         *var = 1;
2470     } else if (!strcmp(token, "enable")) {
2471         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2472         *var = 1;
2473     } else if (!strcmp(token, "off")) {
2474         *var = 0;
2475     } else if (!strcmp(token, "disable")) {
2476         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2477         *var = 0;
2478     } else {
2479         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2480         self_destruct();
2481     }
2482 }
2483
2484 #define free_onoff free_int
2485
2486 static void
2487 dump_tristate(StoreEntry * entry, const char *name, int var)
2488 {
2489     const char *state;
2490
2491     if (var > 0)
2492         state = "on";
2493     else if (var < 0)
2494         state = "warn";
2495     else
2496         state = "off";
2497
2498     storeAppendPrintf(entry, "%s %s\n", name, state);
2499 }
2500
2501 static void
2502 parse_tristate(int *var)
2503 {
2504     char *token = ConfigParser::NextToken();
2505
2506     if (token == NULL)
2507         self_destruct();
2508
2509     if (!strcmp(token, "on")) {
2510         *var = 1;
2511     } else if (!strcmp(token, "enable")) {
2512         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2513         *var = 1;
2514     } else if (!strcmp(token, "warn")) {
2515         *var = -1;
2516     } else if (!strcmp(token, "off")) {
2517         *var = 0;
2518     } else if (!strcmp(token, "disable")) {
2519         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2520         *var = 0;
2521     } else {
2522         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2523         self_destruct();
2524     }
2525 }
2526
2527 #define free_tristate free_int
2528
2529 void
2530 parse_pipelinePrefetch(int *var)
2531 {
2532     char *token = ConfigParser::PeekAtToken();
2533
2534     if (token == NULL)
2535         self_destruct();
2536
2537     if (!strcmp(token, "on")) {
2538         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2539         *var = 1;
2540         //pop the token
2541         (void)ConfigParser::NextToken();
2542     } else if (!strcmp(token, "off")) {
2543         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2544         *var = 0;
2545         //pop the token
2546         (void)ConfigParser::NextToken();
2547     } else
2548         parse_int(var);
2549 }
2550
2551 #define free_pipelinePrefetch free_int
2552 #define dump_pipelinePrefetch dump_int
2553
2554 static void
2555 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2556 {
2557     while (head != NULL) {
2558         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2559                           name,
2560                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2561                           head->pattern.c_str(),
2562                           (int) head->min / 60,
2563                           (int) (100.0 * head->pct + 0.5),
2564                           (int) head->max / 60);
2565
2566         if (head->max_stale >= 0)
2567             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2568
2569         if (head->flags.refresh_ims)
2570             storeAppendPrintf(entry, " refresh-ims");
2571
2572         if (head->flags.store_stale)
2573             storeAppendPrintf(entry, " store-stale");
2574
2575 #if USE_HTTP_VIOLATIONS
2576
2577         if (head->flags.override_expire)
2578             storeAppendPrintf(entry, " override-expire");
2579
2580         if (head->flags.override_lastmod)
2581             storeAppendPrintf(entry, " override-lastmod");
2582
2583         if (head->flags.reload_into_ims)
2584             storeAppendPrintf(entry, " reload-into-ims");
2585
2586         if (head->flags.ignore_reload)
2587             storeAppendPrintf(entry, " ignore-reload");
2588
2589         if (head->flags.ignore_no_store)
2590             storeAppendPrintf(entry, " ignore-no-store");
2591
2592         if (head->flags.ignore_private)
2593             storeAppendPrintf(entry, " ignore-private");
2594 #endif
2595
2596         storeAppendPrintf(entry, "\n");
2597
2598         head = head->next;
2599     }
2600 }
2601
2602 static void
2603 parse_refreshpattern(RefreshPattern ** head)
2604 {
2605     char *token;
2606     char *pattern;
2607     time_t min = 0;
2608     double pct = 0.0;
2609     time_t max = 0;
2610     int refresh_ims = 0;
2611     int store_stale = 0;
2612     int max_stale = -1;
2613
2614 #if USE_HTTP_VIOLATIONS
2615
2616     int override_expire = 0;
2617     int override_lastmod = 0;
2618     int reload_into_ims = 0;
2619     int ignore_reload = 0;
2620     int ignore_no_store = 0;
2621     int ignore_private = 0;
2622 #endif
2623
2624     int i;
2625     RefreshPattern *t;
2626     regex_t comp;
2627     int errcode;
2628     int flags = REG_EXTENDED | REG_NOSUB;
2629
2630     if ((token = ConfigParser::RegexPattern()) != NULL) {
2631
2632         if (strcmp(token, "-i") == 0) {
2633             flags |= REG_ICASE;
2634             token = ConfigParser::RegexPattern();
2635         } else if (strcmp(token, "+i") == 0) {
2636             flags &= ~REG_ICASE;
2637             token = ConfigParser::RegexPattern();
2638         }
2639
2640     }
2641
2642     if (token == NULL) {
2643         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2644         self_destruct();
2645         return;
2646     }
2647
2648     pattern = xstrdup(token);
2649
2650     i = GetInteger();       /* token: min */
2651
2652     /* catch negative and insanely huge values close to 32-bit wrap */
2653     if (i < 0) {
2654         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2655         i = 0;
2656     }
2657     if (i > 60*24*365) {
2658         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2659         i = 60*24*365;
2660     }
2661
2662     min = (time_t) (i * 60);    /* convert minutes to seconds */
2663
2664     i = GetPercentage();    /* token: pct */
2665
2666     pct = (double) i / 100.0;
2667
2668     i = GetInteger();       /* token: max */
2669
2670     /* catch negative and insanely huge values close to 32-bit wrap */
2671     if (i < 0) {
2672         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2673         i = 0;
2674     }
2675     if (i > 60*24*365) {
2676         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2677         i = 60*24*365;
2678     }
2679
2680     max = (time_t) (i * 60);    /* convert minutes to seconds */
2681
2682     /* Options */
2683     while ((token = ConfigParser::NextToken()) != NULL) {
2684         if (!strcmp(token, "refresh-ims")) {
2685             refresh_ims = 1;
2686         } else if (!strcmp(token, "store-stale")) {
2687             store_stale = 1;
2688         } else if (!strncmp(token, "max-stale=", 10)) {
2689             max_stale = xatoi(token + 10);
2690
2691 #if USE_HTTP_VIOLATIONS
2692
2693         } else if (!strcmp(token, "override-expire"))
2694             override_expire = 1;
2695         else if (!strcmp(token, "override-lastmod"))
2696             override_lastmod = 1;
2697         else if (!strcmp(token, "ignore-no-store"))
2698             ignore_no_store = 1;
2699         else if (!strcmp(token, "ignore-private"))
2700             ignore_private = 1;
2701         else if (!strcmp(token, "reload-into-ims")) {
2702             reload_into_ims = 1;
2703             refresh_nocache_hack = 1;
2704             /* tell client_side.c that this is used */
2705         } else if (!strcmp(token, "ignore-reload")) {
2706             ignore_reload = 1;
2707             refresh_nocache_hack = 1;
2708             /* tell client_side.c that this is used */
2709 #endif
2710
2711         } else if (!strcmp(token, "ignore-no-cache") ||
2712                    !strcmp(token, "ignore-must-revalidate") ||
2713                    !strcmp(token, "ignore-auth")
2714                   ) {
2715             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2716         } else
2717             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2718     }
2719
2720     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2721         char errbuf[256];
2722         regerror(errcode, &comp, errbuf, sizeof errbuf);
2723         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2724         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2725         xfree(pattern);
2726         return;
2727     }
2728
2729     pct = pct < 0.0 ? 0.0 : pct;
2730     max = max < 0 ? 0 : max;
2731     t = new RefreshPattern(pattern, flags);
2732     t->pattern.regex = comp;
2733     t->min = min;
2734     t->pct = pct;
2735     t->max = max;
2736
2737     if (refresh_ims)
2738         t->flags.refresh_ims = true;
2739
2740     if (store_stale)
2741         t->flags.store_stale = true;
2742
2743     t->max_stale = max_stale;
2744
2745 #if USE_HTTP_VIOLATIONS
2746
2747     if (override_expire)
2748         t->flags.override_expire = true;
2749
2750     if (override_lastmod)
2751         t->flags.override_lastmod = true;
2752
2753     if (reload_into_ims)
2754         t->flags.reload_into_ims = true;
2755
2756     if (ignore_reload)
2757         t->flags.ignore_reload = true;
2758
2759     if (ignore_no_store)
2760         t->flags.ignore_no_store = true;
2761
2762     if (ignore_private)
2763         t->flags.ignore_private = true;
2764 #endif
2765
2766     t->next = NULL;
2767
2768     while (*head)
2769         head = &(*head)->next;
2770
2771     *head = t;
2772
2773     xfree(pattern);
2774 }
2775
2776 static void
2777 free_refreshpattern(RefreshPattern ** head)
2778 {
2779     delete *head;
2780     *head = nullptr;
2781
2782 #if USE_HTTP_VIOLATIONS
2783     refresh_nocache_hack = 0;
2784
2785 #endif
2786 }
2787
2788 static void
2789 dump_string(StoreEntry * entry, const char *name, char *var)
2790 {
2791     if (var != NULL)
2792         storeAppendPrintf(entry, "%s %s\n", name, var);
2793 }
2794
2795 static void
2796 parse_string(char **var)
2797 {
2798     char *token = ConfigParser::NextToken();
2799     safe_free(*var);
2800
2801     if (token == NULL)
2802         self_destruct();
2803
2804     *var = xstrdup(token);
2805 }
2806
2807 static void
2808 free_string(char **var)
2809 {
2810     safe_free(*var);
2811 }
2812
2813 void
2814 parse_eol(char *volatile *var)
2815 {
2816     if (!var) {
2817         self_destruct();
2818         return;
2819     }
2820
2821     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2822     safe_free(*var);
2823
2824     if (!token) {
2825         self_destruct();
2826         return;
2827     }
2828
2829     while (*token && xisspace(*token))
2830         ++token;
2831
2832     if (!*token) {
2833         self_destruct();
2834         return;
2835     }
2836
2837     *var = xstrdup((char *) token);
2838 }
2839
2840 #define dump_eol dump_string
2841 #define free_eol free_string
2842
2843 static void
2844 parse_TokenOrQuotedString(char **var)
2845 {
2846     char *token = ConfigParser::NextQuotedToken();
2847     safe_free(*var);
2848
2849     if (token == NULL)
2850         self_destruct();
2851
2852     *var = xstrdup(token);
2853 }
2854
2855 #define dump_TokenOrQuotedString dump_string
2856 #define free_TokenOrQuotedString free_string
2857
2858 static void
2859 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2860 {
2861     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2862 }
2863
2864 void
2865 parse_time_t(time_t * var)
2866 {
2867     time_msec_t tval;
2868     parseTimeLine(&tval, T_SECOND_STR, false);
2869     *var = static_cast<time_t>(tval/1000);
2870 }
2871
2872 static void
2873 free_time_t(time_t * var)
2874 {
2875     *var = 0;
2876 }
2877
2878 static void
2879 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2880 {
2881     if (var % 1000)
2882         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2883     else
2884         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2885 }
2886
2887 void
2888 parse_time_msec(time_msec_t * var)
2889 {
2890     parseTimeLine(var, T_SECOND_STR, true);
2891 }
2892
2893 static void
2894 free_time_msec(time_msec_t * var)
2895 {
2896     *var = 0;
2897 }
2898
2899 #if UNUSED_CODE
2900 static void
2901 dump_size_t(StoreEntry * entry, const char *name, size_t var)
2902 {
2903     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
2904 }
2905 #endif
2906
2907 static void
2908 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
2909 {
2910     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2911 }
2912
2913 static void
2914 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
2915 {
2916     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2917 }
2918
2919 #if UNUSED_CODE
2920 static void
2921 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
2922 {
2923     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
2924 }
2925 #endif
2926
2927 static void
2928 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
2929 {
2930     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
2931 }
2932
2933 static void
2934 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
2935 {
2936     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
2937 }
2938
2939 #if UNUSED_CODE
2940 static void
2941 parse_size_t(size_t * var)
2942 {
2943     int i;
2944     i = GetInteger();
2945     *var = (size_t) i;
2946 }
2947 #endif
2948
2949 static void
2950 parse_b_size_t(size_t * var)
2951 {
2952     parseBytesLine(var, B_BYTES_STR);
2953 }
2954
2955 static void
2956 parse_b_ssize_t(ssize_t * var)
2957 {
2958     parseBytesLineSigned(var, B_BYTES_STR);
2959 }
2960
2961 #if UNUSED_CODE
2962 static void
2963 parse_kb_size_t(size_t * var)
2964 {
2965     parseBytesLine(var, B_KBYTES_STR);
2966 }
2967 #endif
2968
2969 static void
2970 parse_b_int64_t(int64_t * var)
2971 {
2972     parseBytesLine64(var, B_BYTES_STR);
2973 }
2974
2975 static void
2976 parse_kb_int64_t(int64_t * var)
2977 {
2978     parseBytesLine64(var, B_KBYTES_STR);
2979 }
2980
2981 static void
2982 free_size_t(size_t * var)
2983 {
2984     *var = 0;
2985 }
2986
2987 static void
2988 free_ssize_t(ssize_t * var)
2989 {
2990     *var = 0;
2991 }
2992
2993 static void
2994 free_b_int64_t(int64_t * var)
2995 {
2996     *var = 0;
2997 }
2998
2999 #define free_b_size_t free_size_t
3000 #define free_b_ssize_t free_ssize_t
3001 #define free_kb_size_t free_size_t
3002 #define free_mb_size_t free_size_t
3003 #define free_gb_size_t free_size_t
3004 #define free_kb_int64_t free_b_int64_t
3005
3006 static void
3007 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3008 {
3009     storeAppendPrintf(entry, "%s %d\n", name, var);
3010 }
3011
3012 static void
3013 free_u_short(unsigned short * u)
3014 {
3015     *u = 0;
3016 }
3017
3018 static void
3019 parse_u_short(unsigned short * var)
3020 {
3021     ConfigParser::ParseUShort(var);
3022 }
3023
3024 void
3025 ConfigParser::ParseUShort(unsigned short *var)
3026 {
3027     *var = GetShort();
3028 }
3029
3030 void
3031 ConfigParser::ParseBool(bool *var)
3032 {
3033     int i = GetInteger();
3034
3035     if (0 == i)
3036         *var = false;
3037     else if (1 == i)
3038         *var = true;
3039     else
3040         self_destruct();
3041 }
3042
3043 static void
3044 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3045 {
3046     while (list != NULL) {
3047         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3048         list = list->next;
3049     }
3050 }
3051
3052 void
3053 ConfigParser::ParseWordList(wordlist ** list)
3054 {
3055     parse_wordlist(list);
3056 }
3057
3058 void
3059 parse_wordlist(wordlist ** list)
3060 {
3061     char *token;
3062     while ((token = ConfigParser::NextQuotedToken()))
3063         wordlistAdd(list, token);
3064 }
3065
3066 #if 0 /* now unused */
3067 static int
3068 check_null_wordlist(wordlist * w)
3069 {
3070     return w == NULL;
3071 }
3072 #endif
3073
3074 static int
3075 check_null_acl_access(acl_access * a)
3076 {
3077     return a == NULL;
3078 }
3079
3080 #define free_wordlist wordlistDestroy
3081
3082 #define free_uri_whitespace free_int
3083
3084 static void
3085 parse_uri_whitespace(int *var)
3086 {
3087     char *token = ConfigParser::NextToken();
3088
3089     if (token == NULL)
3090         self_destruct();
3091
3092     if (!strcmp(token, "strip"))
3093         *var = URI_WHITESPACE_STRIP;
3094     else if (!strcmp(token, "deny"))
3095         *var = URI_WHITESPACE_DENY;
3096     else if (!strcmp(token, "allow"))
3097         *var = URI_WHITESPACE_ALLOW;
3098     else if (!strcmp(token, "encode"))
3099         *var = URI_WHITESPACE_ENCODE;
3100     else if (!strcmp(token, "chop"))
3101         *var = URI_WHITESPACE_CHOP;
3102     else {
3103         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3104         self_destruct();
3105     }
3106 }
3107
3108 static void
3109 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3110 {
3111     const char *s;
3112
3113     if (var == URI_WHITESPACE_ALLOW)
3114         s = "allow";
3115     else if (var == URI_WHITESPACE_ENCODE)
3116         s = "encode";
3117     else if (var == URI_WHITESPACE_CHOP)
3118         s = "chop";
3119     else if (var == URI_WHITESPACE_DENY)
3120         s = "deny";
3121     else
3122         s = "strip";
3123
3124     storeAppendPrintf(entry, "%s %s\n", name, s);
3125 }
3126
3127 static void
3128 free_removalpolicy(RemovalPolicySettings ** settings)
3129 {
3130     if (!*settings)
3131         return;
3132
3133     free_string(&(*settings)->type);
3134
3135     free_wordlist(&(*settings)->args);
3136
3137     delete *settings;
3138
3139     *settings = NULL;
3140 }
3141
3142 static void
3143 parse_removalpolicy(RemovalPolicySettings ** settings)
3144 {
3145     if (*settings)
3146         free_removalpolicy(settings);
3147
3148     *settings = new RemovalPolicySettings;
3149
3150     parse_string(&(*settings)->type);
3151
3152     parse_wordlist(&(*settings)->args);
3153 }
3154
3155 static void
3156 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3157 {
3158     wordlist *args;
3159     storeAppendPrintf(entry, "%s %s", name, settings->type);
3160     args = settings->args;
3161
3162     while (args) {
3163         storeAppendPrintf(entry, " %s", args->key);
3164         args = args->next;
3165     }
3166
3167     storeAppendPrintf(entry, "\n");
3168 }
3169
3170 inline void
3171 free_YesNoNone(YesNoNone *)
3172 {}
3173
3174 static void
3175 parse_YesNoNone(YesNoNone *option)
3176 {
3177     int value = 0;
3178     parse_onoff(&value);
3179     option->configure(value > 0);
3180 }
3181
3182 static void
3183 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3184 {
3185     if (option.configured())
3186         dump_onoff(entry, name, option ? 1 : 0);
3187 }
3188
3189 static void
3190 free_memcachemode(SquidConfig *)
3191 {}
3192
3193 static void
3194 parse_memcachemode(SquidConfig *)
3195 {
3196     char *token = ConfigParser::NextToken();
3197     if (!token)
3198         self_destruct();
3199
3200     if (strcmp(token, "always") == 0) {
3201         Config.onoff.memory_cache_first = 1;
3202         Config.onoff.memory_cache_disk = 1;
3203     } else if (strcmp(token, "disk") == 0) {
3204         Config.onoff.memory_cache_first = 0;
3205         Config.onoff.memory_cache_disk = 1;
3206     } else if (strncmp(token, "net", 3) == 0) {
3207         Config.onoff.memory_cache_first = 1;
3208         Config.onoff.memory_cache_disk = 0;
3209     } else if (strcmp(token, "never") == 0) {
3210         Config.onoff.memory_cache_first = 0;
3211         Config.onoff.memory_cache_disk = 0;
3212     } else {
3213         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3214         self_destruct();
3215     }
3216 }
3217
3218 static void
3219 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3220 {
3221     storeAppendPrintf(entry, "%s ", name);
3222     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3223         storeAppendPrintf(entry, "always");
3224     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3225         storeAppendPrintf(entry, "disk");
3226     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3227         storeAppendPrintf(entry, "network");
3228     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3229         storeAppendPrintf(entry, "none");
3230     storeAppendPrintf(entry, "\n");
3231 }
3232
3233 #include "cf_parser.cci"
3234
3235 peer_t
3236 parseNeighborType(const char *s)
3237 {
3238     if (!strcmp(s, "parent"))
3239         return PEER_PARENT;
3240
3241     if (!strcmp(s, "neighbor"))
3242         return PEER_SIBLING;
3243
3244     if (!strcmp(s, "neighbour"))
3245         return PEER_SIBLING;
3246
3247     if (!strcmp(s, "sibling"))
3248         return PEER_SIBLING;
3249
3250     if (!strcmp(s, "multicast"))
3251         return PEER_MULTICAST;
3252
3253     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3254
3255     return PEER_SIBLING;
3256 }
3257
3258 #if USE_WCCPv2
3259 static void
3260 parse_IpAddress_list(Ip::Address_list ** head)
3261 {
3262     char *token;
3263     Ip::Address_list *s;
3264     Ip::Address ipa;
3265
3266     while ((token = ConfigParser::NextToken())) {
3267         if (GetHostWithPort(token, &ipa)) {
3268
3269             while (*head)
3270                 head = &(*head)->next;
3271
3272             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3273             s->s = ipa;
3274
3275             *head = s;
3276         } else
3277             self_destruct();
3278     }
3279 }
3280
3281 static void
3282 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3283 {
3284     char ntoabuf[MAX_IPSTRLEN];
3285
3286     while (s) {
3287         storeAppendPrintf(e, "%s %s\n",
3288                           n,
3289                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3290         s = s->next;
3291     }
3292 }
3293
3294 static void
3295 free_IpAddress_list(Ip::Address_list ** head)
3296 {
3297     if (*head) delete *head;
3298     *head = NULL;
3299 }
3300
3301 #if CURRENTLY_UNUSED
3302 /* This code was previously used by http_port. Left as it really should
3303  * be used by icp_port and htcp_port
3304  */
3305 static int
3306 check_null_IpAddress_list(const Ip::Address_list * s)
3307 {
3308     return NULL == s;
3309 }
3310
3311 #endif /* CURRENTLY_UNUSED */
3312 #endif /* USE_WCCPv2 */
3313
3314 static void
3315 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3316 {
3317     char *host = NULL;
3318     unsigned short port = 0;
3319     char *t = NULL;
3320     char *junk = NULL;
3321
3322     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3323     s->name = xstrdup(token);
3324     s->connection_auth_disabled = false;
3325
3326     const char *portType = AnyP::UriScheme(s->transport.protocol).c_str();
3327
3328     if (*token == '[') {
3329         /* [ipv6]:port */
3330         host = token + 1;
3331         t = strchr(host, ']');
3332         if (!t) {
3333             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3334             self_destruct();
3335         }
3336         *t = '\0';
3337         ++t;
3338         if (*t != ':') {
3339             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3340             self_destruct();
3341         }
3342         if (!Ip::EnableIpv6) {
3343             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3344             self_destruct();
3345         }
3346         port = xatos(t + 1);
3347     } else if ((t = strchr(token, ':'))) {
3348         /* host:port */
3349         /* ipv4:port */
3350         host = token;
3351         *t = '\0';
3352         port = xatos(t + 1);
3353
3354     } else if (strtol(token, &junk, 10) && !*junk) {
3355         port = xatos(token);
3356         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3357     } else {
3358         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3359         self_destruct();
3360     }
3361
3362     if (port == 0 && host != NULL) {
3363         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3364         self_destruct();
3365     }
3366
3367     if (NULL == host) {
3368         s->s.setAnyAddr();
3369         s->s.port(port);
3370         if (!Ip::EnableIpv6)
3371             s->s.setIPv4();
3372         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3373     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3374         s->s.port(port);
3375         if (!Ip::EnableIpv6)
3376             s->s.setIPv4();
3377         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3378     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3379         /* dont use ipcache */
3380         s->defaultsite = xstrdup(host);
3381         s->s.port(port);
3382         if (!Ip::EnableIpv6)
3383             s->s.setIPv4();
3384         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3385     } else {
3386         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3387         self_destruct();
3388     }
3389 }
3390
3391 /// parses the protocol= option of the *_port directive, returning parsed value
3392 /// unsupported option values result in a fatal error message
3393 /// upper case values required; caller may convert for backward compatibility
3394 static AnyP::ProtocolVersion
3395 parsePortProtocol(const SBuf &value)
3396 {
3397     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3398     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3399     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3400         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3401
3402     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3403         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3404
3405     if (value.cmp("FTP") == 0)
3406         return Ftp::ProtocolVersion();
3407
3408     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3409     return AnyP::ProtocolVersion(); // not reached
3410 }
3411
3412 static void
3413 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3414 {
3415     /* modes first */
3416
3417     if (strcmp(token, "accel") == 0) {
3418         if (s->flags.isIntercepted()) {
3419             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3420             self_destruct();
3421         }
3422         s->flags.accelSurrogate = true;
3423         s->vhost = true;
3424     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3425         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3426             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3427             self_destruct();
3428         }
3429         s->flags.natIntercept = true;
3430         Ip::Interceptor.StartInterception();
3431         /* Log information regarding the port modes under interception. */
3432         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3433         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3434     } else if (strcmp(token, "tproxy") == 0) {
3435         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3436             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3437             self_destruct();
3438         }
3439         s->flags.tproxyIntercept = true;
3440         Ip::Interceptor.StartTransparency();
3441         /* Log information regarding the port modes under transparency. */
3442         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3443
3444         if (s->flags.proxySurrogate) {
3445             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3446         }
3447
3448         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3449             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3450             self_destruct();
3451         }
3452
3453     } else if (strcmp(token, "require-proxy-header") == 0) {
3454         s->flags.proxySurrogate = true;
3455         if (s->flags.tproxyIntercept) {
3456             // receiving is still permitted, so we do not unset the TPROXY flag
3457             // spoofing access control override takes care of the spoof disable later
3458             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3459         }
3460
3461     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3462         if (!s->flags.accelSurrogate) {
3463             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3464             self_destruct();
3465         }
3466         safe_free(s->defaultsite);
3467         s->defaultsite = xstrdup(token + 12);
3468     } else if (strcmp(token, "vhost") == 0) {
3469         if (!s->flags.accelSurrogate) {
3470             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3471         }
3472         s->flags.accelSurrogate = true;
3473         s->vhost = true;
3474     } else if (strcmp(token, "no-vhost") == 0) {
3475         if (!s->flags.accelSurrogate) {
3476             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3477         }
3478         s->vhost = false;
3479     } else if (strcmp(token, "vport") == 0) {
3480         if (!s->flags.accelSurrogate) {
3481             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3482             self_destruct();
3483         }
3484         s->vport = -1;
3485     } else if (strncmp(token, "vport=", 6) == 0) {
3486         if (!s->flags.accelSurrogate) {
3487             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3488             self_destruct();
3489         }
3490         s->vport = xatos(token + 6);
3491     } else if (strncmp(token, "protocol=", 9) == 0) {
3492         if (!s->flags.accelSurrogate) {
3493             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3494             self_destruct();
3495         }
3496         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3497     } else if (strcmp(token, "allow-direct") == 0) {
3498         if (!s->flags.accelSurrogate) {
3499             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3500             self_destruct();
3501         }
3502         s->allow_direct = true;
3503     } else if (strcmp(token, "act-as-origin") == 0) {
3504         if (!s->flags.accelSurrogate) {
3505             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3506         } else
3507             s->actAsOrigin = true;
3508     } else if (strcmp(token, "ignore-cc") == 0) {
3509 #if !USE_HTTP_VIOLATIONS
3510         if (!s->flags.accelSurrogate) {
3511             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3512             self_destruct();
3513         }
3514 #endif
3515         s->ignore_cc = true;
3516     } else if (strncmp(token, "name=", 5) == 0) {
3517         safe_free(s->name);
3518         s->name = xstrdup(token + 5);
3519     } else if (strcmp(token, "no-connection-auth") == 0) {
3520         s->connection_auth_disabled = true;
3521     } else if (strcmp(token, "connection-auth=off") == 0) {
3522         s->connection_auth_disabled = true;
3523     } else if (strcmp(token, "connection-auth") == 0) {
3524         s->connection_auth_disabled = false;
3525     } else if (strcmp(token, "connection-auth=on") == 0) {
3526         s->connection_auth_disabled = false;
3527     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3528         if (!strcmp(token + 23, "off"))
3529             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3530         else if (!strcmp(token + 23, "transparent"))
3531             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3532         else if (!strcmp(token + 23, "always"))
3533             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3534         else
3535             self_destruct();
3536     } else if (strcmp(token, "ipv4") == 0) {
3537         if ( !s->s.setIPv4() ) {
3538             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3539             self_destruct();
3540         }
3541     } else if (strcmp(token, "tcpkeepalive") == 0) {
3542         s->tcp_keepalive.enabled = true;
3543     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3544         char *t = token + 13;
3545         s->tcp_keepalive.enabled = true;
3546         s->tcp_keepalive.idle = xatoui(t,',');
3547         t = strchr(t, ',');
3548         if (t) {
3549             ++t;
3550             s->tcp_keepalive.interval = xatoui(t,',');
3551             t = strchr(t, ',');
3552         }
3553         if (t) {
3554             ++t;
3555             s->tcp_keepalive.timeout = xatoui(t);
3556         }
3557 #if USE_OPENSSL
3558     } else if (strcmp(token, "sslBump") == 0) {
3559         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3560                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3561         s->flags.tunnelSslBumping = true;
3562     } else if (strcmp(token, "ssl-bump") == 0) {
3563         s->flags.tunnelSslBumping = true;
3564     } else if (strncmp(token, "cert=", 5) == 0) {
3565         s->secure.parse(token);
3566     } else if (strncmp(token, "key=", 4) == 0) {
3567         s->secure.parse(token);
3568     } else if (strncmp(token, "version=", 8) == 0) {
3569         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3570                "in " << cfg_directive << ". Use 'options=' instead.");
3571         s->secure.parse(token);
3572     } else if (strncmp(token, "options=", 8) == 0) {
3573         s->secure.parse(token);
3574     } else if (strncmp(token, "cipher=", 7) == 0) {
3575         s->secure.parse(token);
3576     } else if (strncmp(token, "clientca=", 9) == 0) {
3577         safe_free(s->clientca);
3578         s->clientca = xstrdup(token + 9);
3579     } else if (strncmp(token, "cafile=", 7) == 0) {
3580         s->secure.parse(token);
3581     } else if (strncmp(token, "capath=", 7) == 0) {
3582         s->secure.parse(token);
3583     } else if (strncmp(token, "crlfile=", 8) == 0) {
3584         s->secure.parse(token);
3585     } else if (strncmp(token, "dhparams=", 9) == 0) {
3586         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3587                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3588         safe_free(s->dhfile);
3589         s->dhfile = xstrdup(token + 9);
3590     } else if (strncmp(token, "tls-dh=", 7) == 0) {
3591         safe_free(s->tls_dh);
3592         s->tls_dh = xstrdup(token + 7);
3593     } else if (strncmp(token, "sslflags=", 9) == 0) {
3594         s->secure.parse(token+3);
3595     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3596         safe_free(s->sslContextSessionId);
3597         s->sslContextSessionId = xstrdup(token + 11);
3598     } else if (strcmp(token, "generate-host-certificates") == 0) {
3599         s->generateHostCertificates = true;
3600     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3601         s->generateHostCertificates = true;
3602     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3603         s->generateHostCertificates = false;
3604     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3605         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3606 #endif
3607     } else if (strncmp(token, "tls-", 4) == 0) {
3608         s->secure.parse(token+4);
3609     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3610         s->ftp_track_dirs = true;
3611     } else {
3612         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3613         self_destruct();
3614     }
3615 }
3616
3617 void
3618 add_http_port(char *portspec)
3619 {
3620     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3621     s->transport = parsePortProtocol(SBuf("HTTP"));
3622     parsePortSpecification(s, portspec);
3623     // we may need to merge better if the above returns a list with clones
3624     assert(s->next == NULL);
3625     s->next = HttpPortList;
3626     HttpPortList = s;
3627 }
3628
3629 static void
3630 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3631 {
3632     SBuf protoName;
3633     if (strcmp(optionName, "http_port") == 0 ||
3634             strcmp(optionName, "ascii_port") == 0)
3635         protoName = "HTTP";
3636     else if (strcmp(optionName, "https_port") == 0)
3637         protoName = "HTTPS";
3638     else if (strcmp(optionName, "ftp_port") == 0)
3639         protoName = "FTP";
3640     if (protoName.isEmpty()) {
3641         self_destruct();
3642         return;
3643     }
3644
3645     char *token = ConfigParser::NextToken();
3646
3647     if (!token) {
3648         self_destruct();
3649         return;
3650     }
3651
3652     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3653     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3654     parsePortSpecification(s, token);
3655
3656     /* parse options ... */
3657     while ((token = ConfigParser::NextToken())) {
3658         parse_port_option(s, token);
3659     }
3660
3661     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3662         s->secure.encryptTransport = true;
3663 #if USE_OPENSSL
3664         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3665         const bool hijacked = s->flags.isIntercepted();
3666         if (s->flags.tunnelSslBumping && !hijacked) {
3667             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3668             self_destruct();
3669         }
3670         if (hijacked && !s->flags.tunnelSslBumping) {
3671             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3672             self_destruct();
3673         }
3674 #endif
3675         if (s->flags.proxySurrogate) {
3676             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3677             self_destruct();
3678         }
3679     } else if (protoName.cmp("FTP") == 0) {
3680         /* ftp_port does not support ssl-bump */
3681         if (s->flags.tunnelSslBumping) {
3682             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3683             self_destruct();
3684         }
3685         if (s->flags.proxySurrogate) {
3686             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3687             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3688             self_destruct();
3689         }
3690     }
3691
3692     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3693         // clone the port options from *s to *(s->next)
3694         s->next = s->clone();
3695         s->next->s.setIPv4();
3696         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).c_str() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3697     }
3698
3699     while (*head != NULL)
3700         head = &((*head)->next);
3701
3702     *head = s;
3703 }
3704
3705 static void
3706 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3707 {
3708     char buf[MAX_IPSTRLEN];
3709
3710     storeAppendPrintf(e, "%s %s",
3711                       n,
3712                       s->s.toUrl(buf,MAX_IPSTRLEN));
3713
3714     // MODES and specific sub-options.
3715     if (s->flags.natIntercept)
3716         storeAppendPrintf(e, " intercept");
3717
3718     else if (s->flags.tproxyIntercept)
3719         storeAppendPrintf(e, " tproxy");
3720
3721     else if (s->flags.proxySurrogate)
3722         storeAppendPrintf(e, " require-proxy-header");
3723
3724     else if (s->flags.accelSurrogate) {
3725         storeAppendPrintf(e, " accel");
3726
3727         if (s->vhost)
3728             storeAppendPrintf(e, " vhost");
3729
3730         if (s->vport < 0)
3731             storeAppendPrintf(e, " vport");
3732         else if (s->vport > 0)
3733             storeAppendPrintf(e, " vport=%d", s->vport);
3734
3735         if (s->defaultsite)
3736             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3737
3738         // TODO: compare against prefix of 'n' instead of assuming http_port
3739         if (s->transport.protocol != AnyP::PROTO_HTTP)
3740             storeAppendPrintf(e, " protocol=%s", AnyP::UriScheme(s->transport.protocol).c_str());
3741
3742         if (s->allow_direct)
3743             storeAppendPrintf(e, " allow-direct");
3744
3745         if (s->ignore_cc)
3746             storeAppendPrintf(e, " ignore-cc");
3747
3748     }
3749
3750     // Generic independent options
3751
3752     if (s->name)
3753         storeAppendPrintf(e, " name=%s", s->name);
3754
3755 #if USE_HTTP_VIOLATIONS
3756     if (!s->flags.accelSurrogate && s->ignore_cc)
3757         storeAppendPrintf(e, " ignore-cc");
3758 #endif
3759
3760     if (s->connection_auth_disabled)
3761         storeAppendPrintf(e, " connection-auth=off");
3762     else
3763         storeAppendPrintf(e, " connection-auth=on");
3764
3765     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3766         const char *pmtu;
3767
3768         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3769             pmtu = "always";
3770         else
3771             pmtu = "transparent";
3772
3773         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3774     }
3775
3776     if (s->s.isAnyAddr() && !s->s.isIPv6())
3777         storeAppendPrintf(e, " ipv4");
3778
3779     if (s->tcp_keepalive.enabled) {
3780         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3781             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3782         } else {
3783             storeAppendPrintf(e, " tcpkeepalive");
3784         }
3785     }
3786
3787 #if USE_OPENSSL
3788     if (s->flags.tunnelSslBumping)
3789         storeAppendPrintf(e, " ssl-bump");
3790 #endif
3791
3792     s->secure.dumpCfg(e, "tls-");
3793
3794 #if USE_OPENSSL
3795     if (s->dhfile)
3796         storeAppendPrintf(e, " dhparams=%s", s->dhfile);
3797
3798     if (s->tls_dh)
3799         storeAppendPrintf(e, " tls-dh=%s", s->tls_dh);
3800
3801     if (s->sslContextSessionId)
3802         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3803
3804     if (s->generateHostCertificates)
3805         storeAppendPrintf(e, " generate-host-certificates");
3806
3807     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3808         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3809 #endif
3810 }
3811
3812 static void
3813 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3814 {
3815     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3816         dump_generic_port(e, n, p);
3817         storeAppendPrintf(e, "\n");
3818     }
3819 }
3820
3821 void
3822 configFreeMemory(void)
3823 {
3824     free_all();
3825 #if USE_OPENSSL
3826     SSL_CTX_free(Config.ssl_client.sslContext);
3827 #endif
3828 }
3829
3830 void
3831 requirePathnameExists(const char *name, const char *path)
3832 {
3833
3834     struct stat sb;
3835     char pathbuf[BUFSIZ];
3836     assert(path != NULL);
3837
3838     if (Config.chroot_dir && (geteuid() == 0)) {
3839         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3840         path = pathbuf;
3841     }
3842
3843     if (stat(path, &sb) < 0) {
3844         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL ":"") << "ERROR: " << name << " " << path << ": " << xstrerror());
3845         // keep going to find more issues if we are only checking the config file with "-k parse"
3846         if (opt_parse_cfg_only)
3847             return;
3848         // this is fatal if it is found during startup or reconfigure
3849         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3850             fatalf("%s %s: %s", name, path, xstrerror());
3851     }
3852 }
3853
3854 #include "AccessLogEntry.h"
3855
3856 /**
3857  * We support several access_log configuration styles:
3858  *
3859  * #1: Deprecated ancient style without an explicit logging module:
3860  * access_log /var/log/access.log
3861  *
3862  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3863  * access_log none [acl ...]
3864  *
3865  * #3: Configurable logging module without named options:
3866  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3867  * If no explicit logformat name is given, the first ACL name, if any,
3868  * should not be an existing logformat name or it will be treated as such.
3869  * access_log module:place [logformat_name] [acl ...]
3870  *
3871  * #4: Configurable logging module with name=value options such as logformat=x:
3872  * The first ACL name may not contain '='.
3873  * access_log module:place [option ...] [acl ...]
3874  *
3875  */
3876 static void
3877 parse_access_log(CustomLog ** logs)
3878 {
3879     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
3880
3881     // default buffer size and fatal settings
3882     cl->bufferSize = 8*MAX_URL;
3883     cl->fatal = true;
3884
3885     /* determine configuration style */
3886
3887     const char *filename = ConfigParser::NextToken();
3888     if (!filename) {
3889         self_destruct();
3890         return;
3891     }
3892
3893     if (strcmp(filename, "none") == 0) {
3894         cl->type = Log::Format::CLF_NONE;
3895         aclParseAclList(LegacyParser, &cl->aclList, filename);
3896         while (*logs)
3897             logs = &(*logs)->next;
3898         *logs = cl;
3899         return;
3900     }
3901
3902     cl->filename = xstrdup(filename);
3903     cl->type = Log::Format::CLF_UNKNOWN;
3904     cl->rotateCount = -1; // default: use global logfile_rotate setting.
3905
3906     const char *token = ConfigParser::PeekAtToken();
3907     if (!token) { // style #1
3908         // no options to deal with
3909     } else if (!strchr(token, '=')) { // style #3
3910         // if logformat name is recognized,
3911         // pop the previewed token; Else it must be an ACL name
3912         if (setLogformat(cl, token, false))
3913             (void)ConfigParser::NextToken();
3914     } else { // style #4
3915         do {
3916             if (strncasecmp(token, "on-error=", 9) == 0) {
3917                 if (strncasecmp(token+9, "die", 3) == 0) {
3918                     cl->fatal = true;
3919                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
3920                     cl->fatal = false;
3921                 } else {
3922                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
3923                            token << "' expected 'drop' or 'die'");
3924                     self_destruct();
3925                 }
3926             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
3927                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
3928             } else if (strncasecmp(token, "rotate=", 7) == 0) {
3929                 cl->rotateCount = xatoi(token + 7);
3930             } else if (strncasecmp(token, "logformat=", 10) == 0) {
3931                 setLogformat(cl, token+10, true);
3932             } else if (!strchr(token, '=')) {
3933                 // Do not pop the token; it must be an ACL name
3934                 break; // done with name=value options, now to ACLs
3935             } else {
3936                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
3937                 self_destruct();
3938             }
3939             // Pop the token, it was a valid "name=value" option
3940             (void)ConfigParser::NextToken();
3941             // Get next with preview ConfigParser::NextToken call.
3942         } while ((token = ConfigParser::PeekAtToken()) != NULL);
3943     }
3944
3945     // set format if it has not been specified explicitly
3946     if (cl->type == Log::Format::CLF_UNKNOWN)
3947         setLogformat(cl, "squid", true);
3948
3949     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
3950
3951     while (*logs)
3952         logs = &(*logs)->next;
3953
3954     *logs = cl;
3955 }
3956
3957 /// sets CustomLog::type and, if needed, CustomLog::lf
3958 /// returns false iff there is no named log format
3959 static bool
3960 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
3961 {
3962     assert(cl);
3963     assert(logdef_name);
3964
3965     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
3966
3967     if (cl->type != Log::Format::CLF_UNKNOWN) {
3968         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
3969                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
3970         self_destruct();
3971         return false;
3972     }
3973
3974     /* look for the definition pointer corresponding to this name */
3975     Format::Format *lf = Log::TheConfig.logformats;
3976
3977     while (lf != NULL) {
3978         debugs(3, 9, "Comparing against '" << lf->name << "'");
3979
3980         if (strcmp(lf->name, logdef_name) == 0)
3981             break;
3982
3983         lf = lf->next;
3984     }
3985
3986     if (lf != NULL) {
3987         cl->type = Log::Format::CLF_CUSTOM;
3988         cl->logFormat = lf;
3989     } else if (strcmp(logdef_name, "auto") == 0) {
3990         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
3991         cl->type = Log::Format::CLF_SQUID;
3992     } else if (strcmp(logdef_name, "squid") == 0) {
3993         cl->type = Log::Format::CLF_SQUID;
3994     } else if (strcmp(logdef_name, "common") == 0) {
3995         cl->type = Log::Format::CLF_COMMON;
3996     } else if (strcmp(logdef_name, "combined") == 0) {
3997         cl->type = Log::Format::CLF_COMBINED;
3998 #if ICAP_CLIENT
3999     } else if (strcmp(logdef_name, "icap_squid") == 0) {
4000         cl->type = Log::Format::CLF_ICAP_SQUID;
4001 #endif
4002     } else if (strcmp(logdef_name, "useragent") == 0) {
4003         cl->type = Log::Format::CLF_USERAGENT;
4004     } else if (strcmp(logdef_name, "referrer") == 0) {
4005         cl->type = Log::Format::CLF_REFERER;
4006     } else if (dieWhenMissing) {
4007         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4008         self_destruct();
4009         return false;
4010     } else {
4011         return false;
4012     }
4013
4014     return true;
4015 }
4016
4017 static int
4018 check_null_access_log(CustomLog *customlog_definitions)
4019 {
4020     return customlog_definitions == NULL;
4021 }
4022
4023 static void
4024 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4025 {
4026     CustomLog *log;
4027
4028     for (log = logs; log; log = log->next) {
4029         storeAppendPrintf(entry, "%s ", name);
4030
4031         switch (log->type) {
4032
4033         case Log::Format::CLF_CUSTOM:
4034             storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4035             break;
4036
4037         case Log::Format::CLF_NONE:
4038             storeAppendPrintf(entry, "logformat=none");
4039             break;
4040
4041         case Log::Format::CLF_SQUID:
4042             storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4043             break;
4044
4045         case Log::Format::CLF_COMBINED:
4046             storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4047             break;
4048
4049         case Log::Format::CLF_COMMON:
4050             storeAppendPrintf(entry, "%s logformat=common", log->filename);
4051             break;
4052
4053 #if ICAP_CLIENT
4054         case Log::Format::CLF_ICAP_SQUID:
4055             storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4056             break;
4057 #endif
4058         case Log::Format::CLF_USERAGENT:
4059             storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4060             break;
4061
4062         case Log::Format::CLF_REFERER:
4063             storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4064             break;
4065
4066         case Log::Format::CLF_UNKNOWN:
4067             break;
4068         }
4069
4070         // default is on-error=die
4071         if (!log->fatal)
4072             storeAppendPrintf(entry, " on-error=drop");
4073
4074         // default: 64KB
4075         if (log->bufferSize != 64*1024)
4076             storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4077
4078         if (log->rotateCount >= 0)
4079             storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4080
4081         if (log->aclList)
4082             dump_acl_list(entry, log->aclList);
4083
4084         storeAppendPrintf(entry, "\n");
4085     }
4086 }
4087
4088 static void
4089 free_access_log(CustomLog ** definitions)
4090 {
4091     while (*definitions) {
4092         CustomLog *log = *definitions;
4093         *definitions = log->next;
4094
4095         log->logFormat = NULL;
4096         log->type = Log::Format::CLF_UNKNOWN;
4097
4098         if (log->aclList)
4099             aclDestroyAclList(&log->aclList);
4100
4101         safe_free(log->filename);
4102
4103         xfree(log);
4104     }
4105 }
4106
4107 /// parses list of integers form name=N1,N2,N3,...
4108 static bool
4109 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4110 {
4111     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4112         data += name.size();
4113         if (*data == '=') {
4114             while (true) {
4115                 ++data;
4116                 int value = 0;
4117                 if (!StringToInt(data, value, &data, 10))
4118                     break;
4119                 list.push_back(value);
4120                 if (*data == '\0' || *data != ',')
4121                     break;
4122             }
4123         }
4124     }
4125     return data && *data == '\0';
4126 }
4127
4128 static void
4129 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4130 {
4131 #if !HAVE_CPU_AFFINITY
4132     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4133            "support, do not set 'cpu_affinity_map'");
4134     self_destruct();
4135 #endif /* HAVE_CPU_AFFINITY */
4136
4137     if (!*cpuAffinityMap)
4138         *cpuAffinityMap = new CpuAffinityMap;
4139
4140     const char *const pToken = ConfigParser::NextToken();
4141     const char *const cToken = ConfigParser::NextToken();
4142     std::vector<int> processes, cores;
4143     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4144         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4145                "in 'cpu_affinity_map'");
4146         self_destruct();
4147     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4148         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4149                "'cpu_affinity_map'");
4150         self_destruct();
4151     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4152         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4153                "process_numbers and cores lists differ in length or " <<
4154                "contain numbers <= 0");
4155         self_destruct();
4156     }
4157 }
4158
4159 static void
4160 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4161 {
4162     if (cpuAffinityMap) {
4163         storeAppendPrintf(entry, "%s process_numbers=", name);
4164         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4165             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4166                               cpuAffinityMap->processes()[i]);
4167         }
4168         storeAppendPrintf(entry, " cores=");
4169         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4170             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4171                               cpuAffinityMap->cores()[i]);
4172         }
4173         storeAppendPrintf(entry, "\n");
4174     }
4175 }
4176
4177 static void
4178 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4179 {
4180     delete *cpuAffinityMap;
4181     *cpuAffinityMap = NULL;
4182 }
4183
4184 #if USE_ADAPTATION
4185
4186 static void
4187 parse_adaptation_service_set_type()
4188 {
4189     Adaptation::Config::ParseServiceSet();
4190 }
4191
4192 static void
4193 parse_adaptation_service_chain_type()
4194 {
4195     Adaptation::Config::ParseServiceChain();
4196 }
4197
4198 static void
4199 parse_adaptation_access_type()
4200 {
4201     Adaptation::Config::ParseAccess(LegacyParser);
4202 }
4203 #endif /* USE_ADAPTATION */
4204
4205 #if ICAP_CLIENT
4206
4207 static void
4208 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4209 {
4210     cfg->parseService();
4211 }
4212
4213 static void
4214 free_icap_service_type(Adaptation::Icap::Config * cfg)
4215 {
4216     cfg->freeService();
4217 }
4218
4219 static void
4220 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4221 {
4222     cfg.dumpService(entry, name);
4223 }
4224
4225 static void
4226 parse_icap_class_type()
4227 {
4228     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4229            "Use 'adaptation_service_set' instead");
4230     Adaptation::Config::ParseServiceSet();
4231 }
4232
4233 static void
4234 parse_icap_access_type()
4235 {
4236     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4237            "Use 'adaptation_access' instead");
4238     Adaptation::Config::ParseAccess(LegacyParser);
4239 }
4240
4241 #endif
4242
4243 #if USE_ECAP
4244
4245 static void
4246 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4247 {
4248     cfg->parseService();
4249 }
4250
4251 static void
4252 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4253 {
4254     cfg->freeService();
4255 }
4256
4257 static void
4258 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4259 {
4260     cfg.dumpService(entry, name);
4261 }
4262
4263 #endif /* USE_ECAP */
4264
4265 #if ICAP_CLIENT
4266 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4267 {
4268     char *token;
4269     time_t d;
4270     time_t m;
4271     cfg->service_failure_limit = GetInteger();
4272
4273     if ((token = ConfigParser::NextToken()) == NULL)
4274         return;
4275
4276     if (strcmp(token,"in") != 0) {
4277         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4278         self_destruct();
4279     }
4280
4281     if ((token = ConfigParser::NextToken()) == NULL) {
4282         self_destruct();
4283     }
4284
4285     d = static_cast<time_t> (xatoi(token));
4286
4287     m = static_cast<time_t> (1);
4288
4289     if (0 == d)
4290         (void) 0;
4291     else if ((token = ConfigParser::NextToken()) == NULL) {
4292         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4293         self_destruct();
4294     } else if ((m = parseTimeUnits(token, false)) == 0)
4295         self_destruct();
4296
4297     cfg->oldest_service_failure = (m * d);
4298 }
4299
4300 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4301 {
4302     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4303     if (cfg.oldest_service_failure > 0) {
4304         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4305     }
4306     storeAppendPrintf(entry, "\n");
4307 }
4308
4309 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4310 {
4311     cfg->oldest_service_failure = 0;
4312     cfg->service_failure_limit = 0;
4313 }
4314 #endif
4315
4316 #if USE_OPENSSL
4317 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4318 {
4319     char *al;
4320     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4321     if ((al = ConfigParser::NextToken()) == NULL) {
4322         self_destruct();
4323         return;
4324     }
4325
4326     const char *param;
4327     if ( char *s = strchr(al, '{')) {
4328         *s = '\0'; // terminate the al string
4329         ++s;
4330         param = s;
4331         s = strchr(s, '}');
4332         if (!s) {
4333             self_destruct();
4334             return;
4335         }
4336         *s = '\0';
4337     } else
4338         param = NULL;
4339
4340     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4341         ca->alg = Ssl::algSetValidAfter;
4342         ca->param = xstrdup("on");
4343     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4344         ca->alg = Ssl::algSetValidBefore;
4345         ca->param = xstrdup("on");
4346     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4347         ca->alg = Ssl::algSetCommonName;
4348         if (param) {
4349             if (strlen(param) > 64) {
4350                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4351                 self_destruct();
4352                 return;
4353             }
4354             ca->param = xstrdup(param);
4355         }
4356     } else {
4357         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4358         self_destruct();
4359         return;
4360     }
4361
4362     aclParseAclList(LegacyParser, &ca->aclList, al);
4363
4364     while (*cert_adapt)
4365         cert_adapt = &(*cert_adapt)->next;
4366
4367     *cert_adapt = ca;
4368 }
4369
4370 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4371 {
4372     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4373         storeAppendPrintf(entry, "%s ", name);
4374         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4375         if (ca->aclList)
4376             dump_acl_list(entry, ca->aclList);
4377         storeAppendPrintf(entry, "\n");
4378     }
4379 }
4380
4381 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4382 {
4383     while (*cert_adapt) {
4384         sslproxy_cert_adapt *ca = *cert_adapt;
4385         *cert_adapt = ca->next;
4386         safe_free(ca->param);
4387
4388         if (ca->aclList)
4389             aclDestroyAclList(&ca->aclList);
4390
4391         safe_free(ca);
4392     }
4393 }
4394
4395 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4396 {
4397     char *al;
4398     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4399     if ((al = ConfigParser::NextToken()) == NULL) {
4400         self_destruct();
4401         return;
4402     }
4403
4404     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4405         cs->alg = Ssl::algSignTrusted;
4406     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4407         cs->alg = Ssl::algSignUntrusted;
4408     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4409         cs->alg = Ssl::algSignSelf;
4410     else {
4411         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4412         self_destruct();
4413         return;
4414     }
4415
4416     aclParseAclList(LegacyParser, &cs->aclList, al);
4417
4418     while (*cert_sign)
4419         cert_sign = &(*cert_sign)->next;
4420
4421     *cert_sign = cs;
4422 }
4423
4424 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4425 {
4426     sslproxy_cert_sign *cs;
4427     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4428         storeAppendPrintf(entry, "%s ", name);
4429         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4430         if (cs->aclList)
4431             dump_acl_list(entry, cs->aclList);
4432         storeAppendPrintf(entry, "\n");
4433     }
4434 }
4435
4436 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4437 {
4438     while (*cert_sign) {
4439         sslproxy_cert_sign *cs = *cert_sign;
4440         *cert_sign = cs->next;
4441
4442         if (cs->aclList)
4443             aclDestroyAclList(&cs->aclList);
4444
4445         safe_free(cs);
4446     }
4447 }
4448
4449 class sslBumpCfgRr: public ::RegisteredRunner
4450 {
4451 public:
4452     static Ssl::BumpMode lastDeprecatedRule;
4453     /* RegisteredRunner API */
4454     virtual void finalizeConfig();
4455 };
4456
4457 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4458
4459 RunnerRegistrationEntry(sslBumpCfgRr);
4460
4461 void
4462 sslBumpCfgRr::finalizeConfig()
4463 {
4464     if (lastDeprecatedRule != Ssl::bumpEnd) {
4465         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4466         static char buf[1024];
4467         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4468             strcpy(buf, "ssl_bump deny all");
4469             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4470                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4471                    "must not use implicit rules. Update your ssl_bump rules.");
4472         } else {
4473             strcpy(buf, "ssl_bump allow all");
4474             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4475                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4476                    "inferior to the newer server-first bumping mode. New ssl_bump"
4477                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4478         }
4479         parse_line(buf);
4480     }
4481 }
4482
4483 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4484 {
4485     typedef const char *BumpCfgStyle;
4486     BumpCfgStyle bcsNone = NULL;
4487     BumpCfgStyle bcsNew = "new client/server-first/none";
4488     BumpCfgStyle bcsOld = "deprecated allow/deny";
4489     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4490     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4491     char *bm;
4492     if ((bm = ConfigParser::NextToken()) == NULL) {
4493         self_destruct();
4494         return;
4495     }
4496
4497     // if this is the first rule proccessed
4498     if (*ssl_bump == NULL) {
4499         bumpCfgStyleLast = bcsNone;
4500         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4501     }
4502
4503     allow_t action = allow_t(ACCESS_ALLOWED);
4504
4505     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4506         action.kind = Ssl::bumpClientFirst;
4507         bumpCfgStyleNow = bcsNew;
4508     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4509         action.kind = Ssl::bumpServerFirst;
4510         bumpCfgStyleNow = bcsNew;
4511     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4512         action.kind = Ssl::bumpPeek;
4513         bumpCfgStyleNow = bcsNew;
4514     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4515         action.kind = Ssl::bumpStare;
4516         bumpCfgStyleNow = bcsNew;
4517     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4518         action.kind = Ssl::bumpSplice;
4519         bumpCfgStyleNow = bcsNew;
4520     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4521         action.kind = Ssl::bumpBump;
4522         bumpCfgStyleNow = bcsNew;
4523     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4524         action.kind = Ssl::bumpTerminate;
4525         bumpCfgStyleNow = bcsNew;
4526     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4527         action.kind = Ssl::bumpNone;
4528         bumpCfgStyleNow = bcsNew;
4529     } else if (strcmp(bm, "allow") == 0) {
4530         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4531                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4532                "is usually inferior to the newer server-first "
4533                "bumping mode. Update your ssl_bump rules.");
4534         action.kind = Ssl::bumpClientFirst;
4535         bumpCfgStyleNow = bcsOld;
4536         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4537     } else if (strcmp(bm, "deny") == 0) {
4538         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4539                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4540                "your ssl_bump rules.");
4541         action.kind = Ssl::bumpNone;
4542         bumpCfgStyleNow = bcsOld;
4543         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4544     } else {
4545         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4546         self_destruct();
4547         return;
4548     }
4549
4550     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4551         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4552                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4553         self_destruct();
4554         return;
4555     }
4556
4557     bumpCfgStyleLast = bumpCfgStyleNow;
4558
4559     Acl::AndNode *rule = new Acl::AndNode;
4560     rule->context("(ssl_bump rule)", config_input_line);
4561     rule->lineParse();
4562     // empty rule OK
4563
4564     assert(ssl_bump);
4565     if (!*ssl_bump) {
4566         *ssl_bump = new Acl::Tree;
4567         (*ssl_bump)->context("(ssl_bump rules)", config_input_line);
4568     }
4569
4570     (*ssl_bump)->add(rule, action);
4571 }
4572
4573 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4574 {
4575     if (ssl_bump)
4576         dump_SBufList(entry, ssl_bump->treeDump(name, Ssl::BumpModeStr));
4577 }
4578
4579 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4580 {
4581     free_acl_access(ssl_bump);
4582 }
4583
4584 #endif
4585
4586 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4587 {
4588     if (!headers)
4589         return;
4590
4591     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4592         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4593         if (hwa->aclList)
4594             dump_acl_list(entry, hwa->aclList);
4595         storeAppendPrintf(entry, "\n");
4596     }
4597 }
4598
4599 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4600 {
4601     char *fn;
4602     if (!*headers) {
4603         *headers = new HeaderWithAclList;
4604     }
4605     if ((fn = ConfigParser::NextToken()) == NULL) {
4606         self_destruct();
4607         return;
4608     }
4609     HeaderWithAcl hwa;
4610     hwa.fieldName = fn;
4611     hwa.fieldId = HeaderLookupTable.lookup(SBuf(fn));
4612     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4613         hwa.fieldId = Http::HdrType::OTHER;
4614
4615     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4616     ConfigParser::EnableMacros();
4617     String buf = ConfigParser::NextQuotedToken();
4618     ConfigParser::DisableMacros();
4619     hwa.fieldValue = buf.termedBuf();
4620     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4621     if (hwa.quoted) {
4622         if (!nlf->parse(hwa.fieldValue.c_str())) {
4623             self_destruct();
4624             return;
4625         }
4626         hwa.valueFormat = nlf;
4627     } else
4628         delete nlf;
4629     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4630     (*headers)->push_back(hwa);
4631 }
4632
4633 static void free_HeaderWithAclList(HeaderWithAclList **header)
4634 {
4635     if (!(*header))
4636         return;
4637
4638     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4639         if (hwa->aclList)
4640             aclDestroyAclList(&hwa->aclList);
4641
4642         if (hwa->valueFormat) {
4643             delete hwa->valueFormat;
4644             hwa->valueFormat = NULL;
4645         }
4646     }
4647     delete *header;
4648     *header = NULL;
4649 }
4650
4651 static void parse_note(Notes *notes)
4652 {
4653     assert(notes);
4654     notes->parse(LegacyParser);
4655 }
4656
4657 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4658 {
4659     notes.dump(entry, name);
4660 }
4661
4662 static void free_note(Notes *notes)
4663 {
4664     notes->clean();
4665 }
4666
4667 static bool FtpEspvDeprecated = false;
4668 static void parse_ftp_epsv(acl_access **ftp_epsv)
4669 {
4670     allow_t ftpEpsvDeprecatedAction;
4671     bool ftpEpsvIsDeprecatedRule = false;
4672
4673     char *t = ConfigParser::PeekAtToken();
4674     if (!t) {
4675         self_destruct();
4676         return;
4677     }
4678
4679     if (!strcmp(t, "off")) {
4680         (void)ConfigParser::NextToken();
4681         ftpEpsvIsDeprecatedRule = true;
4682         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4683     } else if (!strcmp(t, "on")) {
4684         (void)ConfigParser::NextToken();
4685         ftpEpsvIsDeprecatedRule = true;
4686         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4687     }
4688
4689     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4690     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4691     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4692     // then abort
4693     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4694             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4695         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4696         self_destruct();
4697     }
4698
4699     if (ftpEpsvIsDeprecatedRule) {
4700         // overwrite previous ftp_epsv lines
4701         delete *ftp_epsv;
4702         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4703             Acl::AndNode *ftpEpsvRule = new Acl::AndNode;
4704             ftpEpsvRule->context("(ftp_epsv rule)", config_input_line);
4705             ACL *a = ACL::FindByName("all");
4706             if (!a) {
4707                 self_destruct();
4708                 return;
4709             }
4710             ftpEpsvRule->add(a);
4711             *ftp_epsv = new Acl::Tree;
4712             (*ftp_epsv)->context("(ftp_epsv rules)", config_input_line);
4713             (*ftp_epsv)->add(ftpEpsvRule, ftpEpsvDeprecatedAction);
4714         } else
4715             *ftp_epsv = NULL;
4716         FtpEspvDeprecated = true;
4717     } else {
4718         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4719     }
4720 }
4721
4722 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4723 {
4724     if (ftp_epsv)
4725         dump_SBufList(entry, ftp_epsv->treeDump(name, NULL));
4726 }
4727
4728 static void free_ftp_epsv(acl_access **ftp_epsv)
4729 {
4730     free_acl_access(ftp_epsv);
4731     FtpEspvDeprecated = false;
4732 }
4733
4734 static void
4735 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4736 {
4737     time_msec_t tval;
4738     parseTimeLine(&tval, T_SECOND_STR, false, true);
4739     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4740
4741     char *key, *value;
4742     while(ConfigParser::NextKvPair(key, value)) {
4743         if (strcasecmp(key, "on_timeout") == 0) {
4744             if (strcasecmp(value, "bypass") == 0)
4745                 config->action = toutActBypass;
4746             else if (strcasecmp(value, "fail") == 0)
4747                 config->action = toutActFail;
4748             else if (strcasecmp(value, "retry") == 0)
4749                 config->action = toutActRetry;
4750             else if (strcasecmp(value, "use_configured_response") == 0) {
4751                 config->action = toutActUseConfiguredResponse;
4752             } else {
4753                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4754                 self_destruct();
4755             }
4756         } else if (strcasecmp(key, "response") == 0) {
4757             config->response = xstrdup(value);
4758         } else {
4759             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4760             self_destruct();
4761         }
4762     }
4763
4764     if (config->action == toutActUseConfiguredResponse && !config->response) {
4765         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4766         self_destruct();
4767     }
4768
4769     if (config->action != toutActUseConfiguredResponse && config->response) {
4770         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4771         self_destruct();
4772     }
4773 }
4774
4775 static void
4776 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4777 {
4778     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4779     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4780
4781     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4782     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4783
4784     if (config.response)
4785         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4786
4787     storeAppendPrintf(entry, "\n");
4788 }
4789
4790 static void
4791 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4792 {
4793     Config.Timeout.urlRewrite = 0;
4794     config->action = 0;
4795     safe_free(config->response);
4796 }
4797
4798 static void
4799 parse_configuration_includes_quoted_values(bool *)
4800 {
4801     int val = 0;
4802     parse_onoff(&val);
4803
4804     // If quoted values is set to on then enable new strict mode parsing
4805     if (val) {
4806         ConfigParser::RecognizeQuotedValues = true;
4807         ConfigParser::StrictMode = true;
4808     } else {
4809         ConfigParser::RecognizeQuotedValues = false;
4810         ConfigParser::StrictMode = false;
4811     }
4812 }
4813
4814 static void
4815 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4816 {
4817     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4818     dump_onoff(entry, name, val);
4819 }
4820
4821 static void
4822 free_configuration_includes_quoted_values(bool *)
4823 {
4824     ConfigParser::RecognizeQuotedValues = false;
4825     ConfigParser::StrictMode = false;
4826 }
4827
4828 static void
4829 parse_on_unsupported_protocol(acl_access **access)
4830 {
4831     char *tm;
4832     if ((tm = ConfigParser::NextToken()) == NULL) {
4833         self_destruct();
4834         return;
4835     }
4836
4837     allow_t action = allow_t(ACCESS_ALLOWED);
4838     if (strcmp(tm, "tunnel") == 0)
4839         action.kind = 1;
4840     else if (strcmp(tm, "respond") == 0)
4841         action.kind = 2;
4842     else {
4843         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4844         self_destruct();
4845         return;
4846     }
4847
4848     Acl::AndNode *rule = new Acl::AndNode;
4849     rule->context("(on_unsupported_protocol rule)", config_input_line);
4850     rule->lineParse();
4851     // empty rule OK
4852
4853     assert(access);
4854     if (!*access) {
4855         *access = new Acl::Tree;
4856         (*access)->context("(on_unsupported_protocol rules)", config_input_line);
4857     }
4858
4859     (*access)->add(rule, action);
4860 }
4861
4862 static void
4863 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4864 {
4865     const char *on_error_tunnel_mode_str[] = {
4866         "none",
4867         "tunnel",
4868         "respond",
4869         NULL
4870     };
4871     if (access) {
4872         SBufList lines = access->treeDump(name, on_error_tunnel_mode_str);
4873         dump_SBufList(entry, lines);
4874     }
4875 }
4876
4877 static void
4878 free_on_unsupported_protocol(acl_access **access)
4879 {
4880     free_acl_access(access);
4881 }
4882