src/cache_cf.cc

   1 /*
   2  * $Id$
   3  *
   4  * DEBUG: section 03    Configuration File Parsing
   5  * AUTHOR: Harvest Derived
   6  *
   7  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   8  * ----------------------------------------------------------
   9  *
  10  *  Squid is the result of efforts by numerous individuals from
  11  *  the Internet community; see the CONTRIBUTORS file for full
  12  *  details.   Many organizations have provided support for Squid's
  13  *  development; see the SPONSORS file for full details.  Squid is
  14  *  Copyrighted (C) 2001 by the Regents of the University of
  15  *  California; see the COPYRIGHT file for full details.  Squid
  16  *  incorporates software developed and/or copyrighted by other
  17  *  sources; see the CREDITS file for full details.
  18  *
  19  *  This program is free software; you can redistribute it and/or modify
  20  *  it under the terms of the GNU General Public License as published by
  21  *  the Free Software Foundation; either version 2 of the License, or
  22  *  (at your option) any later version.
  23  *
  24  *  This program is distributed in the hope that it will be useful,
  25  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  *  GNU General Public License for more details.
  28  *
  29  *  You should have received a copy of the GNU General Public License
  30  *  along with this program; if not, write to the Free Software
  31  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  32  *
  33  */
  34
  35 #include "squid.h"
  36 #include "acl/Acl.h"
  37 #include "acl/Gadgets.h"
  38 #include "acl/MethodData.h"
  39 #include "anyp/PortCfg.h"
  40 #include "base/RunnersRegistry.h"
  41 #include "ConfigParser.h"
  42 #include "CpuAffinityMap.h"
  43 #include "DiskIO/DiskIOModule.h"
  44 #include "eui/Config.h"
  45 #include "format/Format.h"
  46 #include "globals.h"
  47 #include "HttpRequestMethod.h"
  48 #include "ident/Config.h"
  49 #include "ip/Intercept.h"
  50 #include "ip/QosConfig.h"
  51 #include "ip/tools.h"
  52 #include "ipc/Kids.h"
  53 #include "log/Config.h"
  54 #include "MemBuf.h"
  55 #include "mgr/Registration.h"
  56 #include "Parsing.h"
  57 #include "protos.h"
  58 #include "rfc1738.h"
  59 #include "Store.h"
  60 #include "StoreFileSystem.h"
  61 #include "structs.h"
  62 #include "SwapDir.h"
  63 #include "wordlist.h"
  64 #if USE_ADAPTATION
  65 #include "adaptation/Config.h"
  66 #endif
  67 #if ICAP_CLIENT
  68 #include "adaptation/icap/Config.h"
  69 #endif
  70 #if USE_ECAP
  71 #include "adaptation/ecap/Config.h"
  72 #endif
  73 #if USE_SSL
  74 #include "ssl/support.h"
  75 #include "ssl/Config.h"
  76 #endif
  77 #if USE_AUTH
  78 #include "auth/Config.h"
  79 #include "auth/Scheme.h"
  80 #endif
  81 #if USE_SQUID_ESI
  82 #include "esi/Parser.h"
  83 #endif
  84 #if SQUID_SNMP
  85 #include "snmp.h"
  86 #endif
  87
  88 #if HAVE_GLOB_H
  89 #include <glob.h>
  90 #endif
  91
  92 #if HAVE_LIMITS_H
  93 #include <limits>
  94 #endif
  95
  96 #if HAVE_LIST
  97 #include <list>
  98 #endif
  99 #if HAVE_SYS_TYPES_H
 100 #include <sys/types.h>
 101 #endif
 102 #if HAVE_PWD_H
 103 #include <pwd.h>
 104 #endif
 105 #if HAVE_GRP_H
 106 #include <grp.h>
 107 #endif
 108 #if HAVE_SYS_STAT_H
 109 #include <sys/stat.h>
 110 #endif
 111
 112 #if USE_SSL
 113 #include "ssl/gadgets.h"
 114 #endif
 115
 116 #if USE_ADAPTATION
 117 static void parse_adaptation_service_set_type();
 118 static void parse_adaptation_service_chain_type();
 119 static void parse_adaptation_access_type();
 120 static void parse_adaptation_meta_type(Adaptation::Config::MetaHeaders *);
 121 static void dump_adaptation_meta_type(StoreEntry *, const char *, Adaptation::Config::MetaHeaders &);
 122 static void free_adaptation_meta_type(Adaptation::Config::MetaHeaders *);
 123 #endif
 124
 125 #if ICAP_CLIENT
 126 static void parse_icap_service_type(Adaptation::Icap::Config *);
 127 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 128 static void free_icap_service_type(Adaptation::Icap::Config *);
 129 static void parse_icap_class_type();
 130 static void parse_icap_access_type();
 131
 132 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 133 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 134 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 135 #endif
 136
 137 #if USE_ECAP
 138 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 139 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 140 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 141 #endif
 142
 143 CBDATA_TYPE(peer);
 144
 145 static const char *const T_MILLISECOND_STR = "millisecond";
 146 static const char *const T_SECOND_STR = "second";
 147 static const char *const T_MINUTE_STR = "minute";
 148 static const char *const T_HOUR_STR = "hour";
 149 static const char *const T_DAY_STR = "day";
 150 static const char *const T_WEEK_STR = "week";
 151 static const char *const T_FORTNIGHT_STR = "fortnight";
 152 static const char *const T_MONTH_STR = "month";
 153 static const char *const T_YEAR_STR = "year";
 154 static const char *const T_DECADE_STR = "decade";
 155
 156 static const char *const B_BYTES_STR = "bytes";
 157 static const char *const B_KBYTES_STR = "KB";
 158 static const char *const B_MBYTES_STR = "MB";
 159 static const char *const B_GBYTES_STR = "GB";
 160
 161 static const char *const list_sep = ", \t\n\r";
 162
 163 static void parse_access_log(customlog ** customlog_definitions);
 164 static int check_null_access_log(customlog *customlog_definitions);
 165 static void dump_access_log(StoreEntry * entry, const char *name, customlog * definitions);
 166 static void free_access_log(customlog ** definitions);
 167
 168 static void update_maxobjsize(void);
 169 static void configDoConfigure(void);
 170 static void parse_refreshpattern(refresh_t **);
 171 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 172 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec);
 173 static void parse_u_short(unsigned short * var);
 174 static void parse_string(char **);
 175 static void default_all(void);
 176 static void defaults_if_none(void);
 177 static void defaults_postscriptum(void);
 178 static int parse_line(char *);
 179 static void parse_obsolete(const char *);
 180 static void parseBytesLine(size_t * bptr, const char *units);
 181 #if USE_SSL
 182 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 183 #endif
 184 #if !USE_DNSHELPER
 185 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 186 #endif
 187 static size_t parseBytesUnits(const char *unit);
 188 static void free_all(void);
 189 void requirePathnameExists(const char *name, const char *path);
 190 static OBJH dump_config;
 191 #if USE_HTTP_VIOLATIONS
 192 static void free_HeaderManglers(HeaderManglers **pm);
 193 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 194 static void parse_http_header_access(HeaderManglers **manglers);
 195 #define free_http_header_access free_HeaderManglers
 196 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 197 static void parse_http_header_replace(HeaderManglers **manglers);
 198 #define free_http_header_replace free_HeaderManglers
 199 #endif
 200 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 201 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 202 static void free_HeaderWithAclList(HeaderWithAclList **header);
 203 static void parse_denyinfo(acl_deny_info_list ** var);
 204 static void dump_denyinfo(StoreEntry * entry, const char *name, acl_deny_info_list * var);
 205 static void free_denyinfo(acl_deny_info_list ** var);
 206
 207 #if USE_WCCPv2
 208 static void parse_IpAddress_list(Ip::Address_list **);
 209 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 210 static void free_IpAddress_list(Ip::Address_list **);
 211 #if CURRENTLY_UNUSED
 212 static int check_null_IpAddress_list(const Ip::Address_list *);
 213 #endif /* CURRENTLY_UNUSED */
 214 #endif /* USE_WCCPv2 */
 215
 216 static void parsePortCfg(AnyP::PortCfg **, const char *protocol);
 217 #define parse_PortCfg(l) parsePortCfg((l), token)
 218 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfg *);
 219 static void free_PortCfg(AnyP::PortCfg **);
 220
 221 #if USE_SSL
 222 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 223 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 224 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 225 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 226 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 227 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 228 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 229 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 230 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 231 #endif /* USE_SSL */
 232
 233 static void parse_b_size_t(size_t * var);
 234 static void parse_b_int64_t(int64_t * var);
 235
 236 static bool parseNamedIntList(const char *data, const String &name, Vector<int> &list);
 237
 238 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 239 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 240 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 241
 242 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 243
 244 /*
 245  * LegacyParser is a parser for legacy code that uses the global
 246  * approach.  This is static so that it is only exposed to cache_cf.
 247  * Other modules needing access to a ConfigParser should have it
 248  * provided to them in their parserFOO methods.
 249  */
 250 static ConfigParser LegacyParser = ConfigParser();
 251
 252 void
 253 self_destruct(void)
 254 {
 255     LegacyParser.destruct();
 256 }
 257
 258 static void
 259 update_maxobjsize(void)
 260 {
 261     int i;
 262     int64_t ms = -1;
 263
 264     for (i = 0; i < Config.cacheSwap.n_configured; ++i) {
 265         assert (Config.cacheSwap.swapDirs[i].getRaw());
 266
 267         if (dynamic_cast<SwapDir *>(Config.cacheSwap.swapDirs[i].getRaw())->
 268                 max_objsize > ms)
 269             ms = dynamic_cast<SwapDir *>(Config.cacheSwap.swapDirs[i].getRaw())->max_objsize;
 270     }
 271     store_maxobjsize = ms;
 272 }
 273
 274 static void
 275 SetConfigFilename(char const *file_name, bool is_pipe)
 276 {
 277     cfg_filename = file_name;
 278
 279     char const *token;
 280
 281     if (is_pipe)
 282         cfg_filename = file_name + 1;
 283     else if ((token = strrchr(cfg_filename, '/')))
 284         cfg_filename = token + 1;
 285 }
 286
 287 static const char*
 288 skip_ws(const char* s)
 289 {
 290     while (xisspace(*s))
 291         ++s;
 292
 293     return s;
 294 }
 295
 296 static int
 297 parseManyConfigFiles(char* files, int depth)
 298 {
 299     int error_count = 0;
 300     char* saveptr = NULL;
 301 #if HAVE_GLOB
 302     char *path;
 303     glob_t globbuf;
 304     int i;
 305     memset(&globbuf, 0, sizeof(globbuf));
 306     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 307         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 308             fatalf("Unable to find configuration file: %s: %s",
 309                    path, xstrerror());
 310         }
 311     }
 312     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 313         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 314     }
 315     globfree(&globbuf);
 316 #else
 317     char* file = strwordtok(files, &saveptr);
 318     while (file != NULL) {
 319         error_count += parseOneConfigFile(file, depth);
 320         file = strwordtok(NULL, &saveptr);
 321     }
 322 #endif /* HAVE_GLOB */
 323     return error_count;
 324 }
 325
 326 static void
 327 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 328 {
 329     assert(str != NULL);
 330     assert(newSubstr != NULL);
 331
 332     unsigned newSubstrLen = strlen(newSubstr);
 333     if (newSubstrLen > substrLen)
 334         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 335
 336     // move tail part including zero
 337     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 338     // copy new substring in place
 339     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 340
 341     len = strlen(str);
 342 }
 343
 344 static void
 345 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 346 {
 347     assert(line != NULL);
 348     assert(macroName != NULL);
 349     assert(substStr != NULL);
 350     unsigned macroNameLen = strlen(macroName);
 351     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 352         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 353 }
 354
 355 static void
 356 ProcessMacros(char*& line, int& len)
 357 {
 358     SubstituteMacro(line, len, "${process_name}", TheKidName);
 359     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 360 }
 361
 362 static void
 363 trim_trailing_ws(char* str)
 364 {
 365     assert(str != NULL);
 366     unsigned i = strlen(str);
 367     while ((i > 0) && xisspace(str[i - 1]))
 368         --i;
 369     str[i] = '\0';
 370 }
 371
 372 static const char*
 373 FindStatement(const char* line, const char* statement)
 374 {
 375     assert(line != NULL);
 376     assert(statement != NULL);
 377
 378     const char* str = skip_ws(line);
 379     unsigned len = strlen(statement);
 380     if (strncmp(str, statement, len) == 0) {
 381         str += len;
 382         if (*str == '\0')
 383             return str;
 384         else if (xisspace(*str))
 385             return skip_ws(str);
 386     }
 387
 388     return NULL;
 389 }
 390
 391 static bool
 392 StrToInt(const char* str, long& number)
 393 {
 394     assert(str != NULL);
 395
 396     char* end;
 397     number = strtol(str, &end, 0);
 398
 399     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 400 }
 401
 402 static bool
 403 EvalBoolExpr(const char* expr)
 404 {
 405     assert(expr != NULL);
 406     if (strcmp(expr, "true") == 0) {
 407         return true;
 408     } else if (strcmp(expr, "false") == 0) {
 409         return false;
 410     } else if (const char* equation = strchr(expr, '=')) {
 411         const char* rvalue = skip_ws(equation + 1);
 412         char* lvalue = (char*)xmalloc(equation - expr + 1);
 413         xstrncpy(lvalue, expr, equation - expr + 1);
 414         trim_trailing_ws(lvalue);
 415
 416         long number1;
 417         if (!StrToInt(lvalue, number1))
 418             fatalf("String is not a integer number: '%s'\n", lvalue);
 419         long number2;
 420         if (!StrToInt(rvalue, number2))
 421             fatalf("String is not a integer number: '%s'\n", rvalue);
 422
 423         xfree(lvalue);
 424         return number1 == number2;
 425     }
 426     fatalf("Unable to evaluate expression '%s'\n", expr);
 427     return false; // this place cannot be reached
 428 }
 429
 430 static int
 431 parseOneConfigFile(const char *file_name, unsigned int depth)
 432 {
 433     FILE *fp = NULL;
 434     const char *orig_cfg_filename = cfg_filename;
 435     const int orig_config_lineno = config_lineno;
 436     char *token = NULL;
 437     char *tmp_line = NULL;
 438     int tmp_line_len = 0;
 439     int err_count = 0;
 440     int is_pipe = 0;
 441
 442     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 443     if (depth > 16) {
 444         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 445         return 1;
 446     }
 447
 448     if (file_name[0] == '!' || file_name[0] == '|') {
 449         fp = popen(file_name + 1, "r");
 450         is_pipe = 1;
 451     } else {
 452         fp = fopen(file_name, "r");
 453     }
 454
 455     if (fp == NULL)
 456         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerror());
 457
 458 #if _SQUID_WINDOWS_
 459     setmode(fileno(fp), O_TEXT);
 460 #endif
 461
 462     SetConfigFilename(file_name, bool(is_pipe));
 463
 464     memset(config_input_line, '\0', BUFSIZ);
 465
 466     config_lineno = 0;
 467
 468     Vector<bool> if_states;
 469     while (fgets(config_input_line, BUFSIZ, fp)) {
 470         ++config_lineno;
 471
 472         if ((token = strchr(config_input_line, '\n')))
 473             *token = '\0';
 474
 475         if ((token = strchr(config_input_line, '\r')))
 476             *token = '\0';
 477
 478         // strip any prefix whitespace off the line.
 479         const char *p = skip_ws(config_input_line);
 480         if (config_input_line != p)
 481             memmove(config_input_line, p, strlen(p)+1);
 482
 483         if (strncmp(config_input_line, "#line ", 6) == 0) {
 484             static char new_file_name[1024];
 485             static char *file;
 486             static char new_lineno;
 487             token = config_input_line + 6;
 488             new_lineno = strtol(token, &file, 0) - 1;
 489
 490             if (file == token)
 491                 continue;       /* Not a valid #line directive, may be a comment */
 492
 493             while (*file && xisspace((unsigned char) *file))
 494                 ++file;
 495
 496             if (*file) {
 497                 if (*file != '"')
 498                     continue;   /* Not a valid #line directive, may be a comment */
 499
 500                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 501
 502                 if ((token = strchr(new_file_name, '"')))
 503                     *token = '\0';
 504
 505                 cfg_filename = new_file_name;
 506             }
 507
 508             config_lineno = new_lineno;
 509         }
 510
 511         if (config_input_line[0] == '#')
 512             continue;
 513
 514         if (config_input_line[0] == '\0')
 515             continue;
 516
 517         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 518
 519         size_t append_len = strlen(append);
 520
 521         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 522
 523         strcpy(tmp_line + tmp_line_len, append);
 524
 525         tmp_line_len += append_len;
 526
 527         if (tmp_line[tmp_line_len-1] == '\\') {
 528             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 529             tmp_line[--tmp_line_len] = '\0';
 530             continue;
 531         }
 532
 533         trim_trailing_ws(tmp_line);
 534         ProcessMacros(tmp_line, tmp_line_len);
 535         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 536
 537         if (const char* expr = FindStatement(tmp_line, "if")) {
 538             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 539         } else if (FindStatement(tmp_line, "endif")) {
 540             if (!if_states.empty())
 541                 if_states.pop_back(); // remove last if-statement meaning
 542             else
 543                 fatalf("'endif' without 'if'\n");
 544         } else if (FindStatement(tmp_line, "else")) {
 545             if (!if_states.empty())
 546                 if_states.back() = !if_states.back();
 547             else
 548                 fatalf("'else' without 'if'\n");
 549         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 550             /* Handle includes here */
 551             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 552                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 553             } else if (!parse_line(tmp_line)) {
 554                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 555                 ++err_count;
 556             }
 557         }
 558
 559         safe_free(tmp_line);
 560         tmp_line_len = 0;
 561
 562     }
 563     if (!if_states.empty())
 564         fatalf("if-statement without 'endif'\n");
 565
 566     if (is_pipe) {
 567         int ret = pclose(fp);
 568
 569         if (ret != 0)
 570             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 571     } else {
 572         fclose(fp);
 573     }
 574
 575     cfg_filename = orig_cfg_filename;
 576     config_lineno = orig_config_lineno;
 577
 578     return err_count;
 579 }
 580
 581 int
 582 parseConfigFile(const char *file_name)
 583 {
 584     int err_count = 0;
 585
 586     debugs(5, 4, HERE);
 587
 588     configFreeMemory();
 589
 590     ACLMethodData::ThePurgeCount = 0;
 591     default_all();
 592
 593     err_count = parseOneConfigFile(file_name, 0);
 594
 595     defaults_if_none();
 596
 597     defaults_postscriptum();
 598
 599     /*
 600      * We must call configDoConfigure() before leave_suid() because
 601      * configDoConfigure() is where we turn username strings into
 602      * uid values.
 603      */
 604     configDoConfigure();
 605
 606     if (!Config.chroot_dir) {
 607         leave_suid();
 608         setUmask(Config.umask);
 609         _db_init(Debug::cache_log, Debug::debugOptions);
 610         enter_suid();
 611     }
 612
 613     if (opt_send_signal == -1) {
 614         Mgr::RegisterAction("config",
 615                             "Current Squid Configuration",
 616                             dump_config,
 617                             1, 1);
 618     }
 619
 620     return err_count;
 621 }
 622
 623 static void
 624 configDoConfigure(void)
 625 {
 626     memset(&Config2, '\0', sizeof(SquidConfig2));
 627     /* init memory as early as possible */
 628     memConfigure();
 629     /* Sanity checks */
 630
 631     if (Config.cacheSwap.swapDirs == NULL) {
 632         /* Memory-only cache probably in effect. */
 633         /* turn off the cache rebuild delays... */
 634         StoreController::store_dirs_rebuilding = 0;
 635     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 636         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 637             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 638             if (sd->needsDiskStrand())
 639                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 640         }
 641     }
 642
 643     if (Debug::rotateNumber < 0) {
 644         Debug::rotateNumber = Config.Log.rotateNumber;
 645     }
 646
 647 #if SIZEOF_OFF_T <= 4
 648     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 649         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 650         Config.Store.maxObjectSize = 0x7FFF0000;
 651     }
 652 #endif
 653     if (0 == Store::Root().maxSize())
 654         /* people might want a zero-sized cache on purpose */
 655         (void) 0;
 656     else if (Store::Root().maxSize() < Config.memMaxSize)
 657         /* This is bogus. folk with NULL caches will want this */
 658         debugs(3, DBG_CRITICAL, "WARNING cache_mem is larger than total disk cache space!");
 659
 660     if (Config.Announce.period > 0) {
 661         Config.onoff.announce = 1;
 662     } else if (Config.Announce.period < 1) {
 663         Config.Announce.period = 86400 * 365;   /* one year */
 664         Config.onoff.announce = 0;
 665     }
 666
 667     if (Config.onoff.httpd_suppress_version_string)
 668         visible_appname_string = (char *)appname_string;
 669     else
 670         visible_appname_string = (char const *)APP_FULLNAME;
 671
 672 #if USE_DNSHELPER
 673     if (Config.dnsChildren.n_max < 1)
 674         fatal("No DNS helpers allocated");
 675 #endif
 676
 677     if (Config.Program.redirect) {
 678         if (Config.redirectChildren.n_max < 1) {
 679             Config.redirectChildren.n_max = 0;
 680             wordlistDestroy(&Config.Program.redirect);
 681         }
 682     }
 683
 684     if (Config.appendDomain)
 685         if (*Config.appendDomain != '.')
 686             fatal("append_domain must begin with a '.'");
 687
 688     if (Config.errHtmlText == NULL)
 689         Config.errHtmlText = xstrdup(null_string);
 690
 691 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 692     if (Config.max_filedescriptors > 0) {
 693         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 694     }
 695 #elif USE_SELECT || USE_SELECT_WIN32
 696     if (Config.max_filedescriptors > FD_SETSIZE) {
 697         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 698     }
 699 #endif
 700
 701     storeConfigure();
 702
 703     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 704              uniqueHostname(),
 705              visible_appname_string);
 706
 707     /*
 708      * the extra space is for loop detection in client_side.c -- we search
 709      * for substrings in the Via header.
 710      */
 711     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 712              uniqueHostname(),
 713              visible_appname_string);
 714
 715     /* Use visible_hostname as default surrogate_id */
 716     if (!Config.Accel.surrogate_id) {
 717         const char *t = getMyHostname();
 718         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 719     }
 720
 721     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 722         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 723
 724     if (Config.appendDomain)
 725         Config.appendDomainLen = strlen(Config.appendDomain);
 726     else
 727         Config.appendDomainLen = 0;
 728
 729     if (Config.connect_retries > 10) {
 730         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 731         Config.connect_retries = 10;
 732     }
 733
 734     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 735 #if USE_DNSHELPER
 736     requirePathnameExists("cache_dns_program", Config.Program.dnsserver);
 737 #endif
 738 #if USE_UNLINKD
 739
 740     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 741 #endif
 742     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 743     if (Config.Program.redirect)
 744         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 745
 746     requirePathnameExists("Icon Directory", Config.icons.directory);
 747
 748     if (Config.errorDirectory)
 749         requirePathnameExists("Error Directory", Config.errorDirectory);
 750
 751 #if USE_HTTP_VIOLATIONS
 752
 753     {
 754         const refresh_t *R;
 755
 756         for (R = Config.Refresh; R; R = R->next) {
 757             if (!R->flags.override_expire)
 758                 continue;
 759
 760             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 761
 762             break;
 763         }
 764
 765         for (R = Config.Refresh; R; R = R->next) {
 766             if (!R->flags.override_lastmod)
 767                 continue;
 768
 769             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 770
 771             break;
 772         }
 773
 774         for (R = Config.Refresh; R; R = R->next) {
 775             if (!R->flags.reload_into_ims)
 776                 continue;
 777
 778             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 779
 780             break;
 781         }
 782
 783         for (R = Config.Refresh; R; R = R->next) {
 784             if (!R->flags.ignore_reload)
 785                 continue;
 786
 787             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 788
 789             break;
 790         }
 791
 792         for (R = Config.Refresh; R; R = R->next) {
 793             if (!R->flags.ignore_no_cache)
 794                 continue;
 795
 796             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-cache' in 'refresh_pattern' violates HTTP");
 797
 798             break;
 799         }
 800
 801         for (R = Config.Refresh; R; R = R->next) {
 802             if (!R->flags.ignore_no_store)
 803                 continue;
 804
 805             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 806
 807             break;
 808         }
 809
 810         for (R = Config.Refresh; R; R = R->next) {
 811             if (!R->flags.ignore_must_revalidate)
 812                 continue;
 813             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-must-revalidate' in 'refresh_pattern' violates HTTP");
 814             break;
 815         }
 816
 817         for (R = Config.Refresh; R; R = R->next) {
 818             if (!R->flags.ignore_private)
 819                 continue;
 820
 821             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 822
 823             break;
 824         }
 825
 826         for (R = Config.Refresh; R; R = R->next) {
 827             if (!R->flags.ignore_auth)
 828                 continue;
 829
 830             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-auth' in 'refresh_pattern' violates HTTP");
 831
 832             break;
 833         }
 834
 835     }
 836 #endif
 837 #if !USE_HTTP_VIOLATIONS
 838     Config.onoff.via = 1;
 839 #else
 840
 841     if (!Config.onoff.via)
 842         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 843
 844 #endif
 845
 846     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 847     // TODO: replace with a dedicated "purge" ACL option?
 848     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 849
 850     Config2.onoff.mangle_request_headers = (Config.request_header_access != NULL);
 851
 852     if (geteuid() == 0) {
 853         if (NULL != Config.effectiveUser) {
 854
 855             struct passwd *pwd = getpwnam(Config.effectiveUser);
 856
 857             if (NULL == pwd) {
 858                 /*
 859                  * Andres Kroonmaa <andre@online.ee>:
 860                  * Some getpwnam() implementations (Solaris?) require
 861                  * an available FD < 256 for opening a FILE* to the
 862                  * passwd file.
 863                  * DW:
 864                  * This should be safe at startup, but might still fail
 865                  * during reconfigure.
 866                  */
 867                 fatalf("getpwnam failed to find userid for effective user '%s'",
 868                        Config.effectiveUser);
 869                 return;
 870             }
 871
 872             Config2.effectiveUserID = pwd->pw_uid;
 873
 874             Config2.effectiveGroupID = pwd->pw_gid;
 875
 876 #if HAVE_PUTENV
 877
 878             if (pwd->pw_dir && *pwd->pw_dir) {
 879                 int len;
 880                 char *env_str = (char *)xcalloc((len = strlen(pwd->pw_dir) + 6), 1);
 881                 snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 882                 putenv(env_str);
 883             }
 884
 885 #endif
 886
 887         }
 888     } else {
 889         Config2.effectiveUserID = geteuid();
 890         Config2.effectiveGroupID = getegid();
 891     }
 892
 893     if (NULL != Config.effectiveGroup) {
 894
 895         struct group *grp = getgrnam(Config.effectiveGroup);
 896
 897         if (NULL == grp) {
 898             fatalf("getgrnam failed to find groupid for effective group '%s'",
 899                    Config.effectiveGroup);
 900             return;
 901         }
 902
 903         Config2.effectiveGroupID = grp->gr_gid;
 904     }
 905
 906     HttpRequestMethod::Configure(Config);
 907 #if USE_SSL
 908
 909     debugs(3, DBG_IMPORTANT, "Initializing https proxy context");
 910
 911     Config.ssl_client.sslContext = sslCreateClientContext(Config.ssl_client.cert, Config.ssl_client.key, Config.ssl_client.version, Config.ssl_client.cipher, Config.ssl_client.options, Config.ssl_client.flags, Config.ssl_client.cafile, Config.ssl_client.capath, Config.ssl_client.crlfile);
 912
 913     for (peer *p = Config.peers; p != NULL; p = p->next) {
 914         if (p->use_ssl) {
 915             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " SSL context");
 916             p->sslContext = sslCreateClientContext(p->sslcert, p->sslkey, p->sslversion, p->sslcipher, p->ssloptions, p->sslflags, p->sslcafile, p->sslcapath, p->sslcrlfile);
 917         }
 918     }
 919
 920     for (AnyP::PortCfg *s = Config.Sockaddr.http; s != NULL; s = s->next) {
 921         if (!s->sslBump)
 922             continue;
 923
 924         debugs(3, DBG_IMPORTANT, "Initializing http_port " << s->s << " SSL context");
 925         s->configureSslServerContext();
 926     }
 927
 928     for (AnyP::PortCfg *s = Config.Sockaddr.https; s != NULL; s = s->next) {
 929         debugs(3, DBG_IMPORTANT, "Initializing https_port " << s->s << " SSL context");
 930         s->configureSslServerContext();
 931     }
 932
 933 #endif
 934
 935     // prevent infinite fetch loops in the request parser
 936     // due to buffer full but not enough data recived to finish parse
 937     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 938         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 939                " Change client_request_buffer_max or request_header_max_size limits.",
 940                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 941     }
 942
 943 #if USE_AUTH
 944     /*
 945      * disable client side request pipelining. There is a race with
 946      * Negotiate and NTLM when the client sends a second request on an
 947      * connection before the authenticate challenge is sent. With
 948      * pipelining OFF, the client may fail to authenticate, but squid's
 949      * state will be preserved.
 950      */
 951     if (Config.onoff.pipeline_prefetch) {
 952         Auth::Config *nego = Auth::Config::Find("Negotiate");
 953         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 954         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 955             debugs(3, DBG_IMPORTANT, "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced OFF.");
 956             Config.onoff.pipeline_prefetch = 0;
 957         }
 958     }
 959 #endif
 960 }
 961
 962 /** Parse a line containing an obsolete directive.
 963  * To upgrade it where possible instead of just "Bungled config" for
 964  * directives which cannot be marked as simply aliases of the some name.
 965  * For example if the parameter order and content has changed.
 966  * Or if the directive has been completely removed.
 967  */
 968 void
 969 parse_obsolete(const char *name)
 970 {
 971     // Directives which have been radically changed rather than removed
 972     if (!strcmp(name, "url_rewrite_concurrency")) {
 973         int cval;
 974         parse_int(&cval);
 975         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 976         Config.redirectChildren.concurrency = cval;
 977     }
 978 }
 979
 980 /* Parse a time specification from the config file.  Store the
 981  * result in 'tptr', after converting it to 'units' */
 982 static void
 983 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec)
 984 {
 985     char *token;
 986     double d;
 987     time_msec_t m;
 988     time_msec_t u;
 989
 990     if ((u = parseTimeUnits(units, allowMsec)) == 0)
 991         self_destruct();
 992
 993     if ((token = strtok(NULL, w_space)) == NULL)
 994         self_destruct();
 995
 996     d = xatof(token);
 997
 998     m = u;                      /* default to 'units' if none specified */
 999
1000     if (0 == d)
1001         (void) 0;
1002     else if ((token = strtok(NULL, w_space)) == NULL)
1003         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1004                config_input_line << "', assuming " <<
1005                d << " " << units  );
1006     else if ((m = parseTimeUnits(token, allowMsec)) == 0)
1007         self_destruct();
1008
1009     *tptr = static_cast<time_msec_t>(m * d);
1010 }
1011
1012 static uint64_t
1013 parseTimeUnits(const char *unit, bool allowMsec)
1014 {
1015     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1016         return 1;
1017
1018     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1019         return 1000;
1020
1021     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1022         return 60 * 1000;
1023
1024     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1025         return 3600 * 1000;
1026
1027     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1028         return 86400 * 1000;
1029
1030     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1031         return 86400 * 7 * 1000;
1032
1033     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1034         return 86400 * 14 * 1000;
1035
1036     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1037         return static_cast<uint64_t>(86400) * 30 * 1000;
1038
1039     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1040         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1041
1042     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1043         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1044
1045     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1046
1047     return 0;
1048 }
1049
1050 static void
1051 parseBytesLine64(int64_t * bptr, const char *units)
1052 {
1053     char *token;
1054     double d;
1055     int64_t m;
1056     int64_t u;
1057
1058     if ((u = parseBytesUnits(units)) == 0) {
1059         self_destruct();
1060         return;
1061     }
1062
1063     if ((token = strtok(NULL, w_space)) == NULL) {
1064         self_destruct();
1065         return;
1066     }
1067
1068     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1069         *bptr = -1;
1070         return;
1071     }
1072
1073     d = xatof(token);
1074
1075     m = u;                      /* default to 'units' if none specified */
1076
1077     if (0.0 == d)
1078         (void) 0;
1079     else if ((token = strtok(NULL, w_space)) == NULL)
1080         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1081                config_input_line << "', assuming " <<
1082                d << " " <<  units  );
1083     else if ((m = parseBytesUnits(token)) == 0) {
1084         self_destruct();
1085         return;
1086     }
1087
1088     *bptr = static_cast<int64_t>(m * d / u);
1089
1090     if (static_cast<double>(*bptr) * 2 != m * d / u * 2)
1091         self_destruct();
1092 }
1093
1094 static void
1095 parseBytesLine(size_t * bptr, const char *units)
1096 {
1097     char *token;
1098     double d;
1099     int m;
1100     int u;
1101
1102     if ((u = parseBytesUnits(units)) == 0) {
1103         self_destruct();
1104         return;
1105     }
1106
1107     if ((token = strtok(NULL, w_space)) == NULL) {
1108         self_destruct();
1109         return;
1110     }
1111
1112     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1113         *bptr = static_cast<size_t>(-1);
1114         return;
1115     }
1116
1117     d = xatof(token);
1118
1119     m = u;                      /* default to 'units' if none specified */
1120
1121     if (0.0 == d)
1122         (void) 0;
1123     else if ((token = strtok(NULL, w_space)) == NULL)
1124         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1125                config_input_line << "', assuming " <<
1126                d << " " <<  units  );
1127     else if ((m = parseBytesUnits(token)) == 0) {
1128         self_destruct();
1129         return;
1130     }
1131
1132     *bptr = static_cast<size_t>(m * d / u);
1133
1134     if (static_cast<double>(*bptr) * 2 != m * d / u * 2)
1135         self_destruct();
1136 }
1137
1138 #if !USE_DNSHELPER
1139 static void
1140 parseBytesLineSigned(ssize_t * bptr, const char *units)
1141 {
1142     char *token;
1143     double d;
1144     int m;
1145     int u;
1146
1147     if ((u = parseBytesUnits(units)) == 0) {
1148         self_destruct();
1149         return;
1150     }
1151
1152     if ((token = strtok(NULL, w_space)) == NULL) {
1153         self_destruct();
1154         return;
1155     }
1156
1157     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1158         *bptr = -1;
1159         return;
1160     }
1161
1162     d = xatof(token);
1163
1164     m = u;                      /* default to 'units' if none specified */
1165
1166     if (0.0 == d)
1167         (void) 0;
1168     else if ((token = strtok(NULL, w_space)) == NULL)
1169         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1170                config_input_line << "', assuming " <<
1171                d << " " <<  units  );
1172     else if ((m = parseBytesUnits(token)) == 0) {
1173         self_destruct();
1174         return;
1175     }
1176
1177     *bptr = static_cast<size_t>(m * d / u);
1178
1179     if (static_cast<double>(*bptr) * 2 != m * d / u * 2)
1180         self_destruct();
1181 }
1182 #endif
1183
1184 #if USE_SSL
1185 /**
1186  * Parse bytes from a string.
1187  * Similar to the parseBytesLine function but parses the string value instead of
1188  * the current token value.
1189  */
1190 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1191 {
1192     int u;
1193     if ((u = parseBytesUnits(units)) == 0) {
1194         self_destruct();
1195         return;
1196     }
1197
1198     // Find number from string beginning.
1199     char const * number_begin = value;
1200     char const * number_end = value;
1201
1202     while ((*number_end >= '0' && *number_end <= '9')) {
1203         ++number_end;
1204     }
1205
1206     String number;
1207     number.limitInit(number_begin, number_end - number_begin);
1208
1209     int d = xatoi(number.termedBuf());
1210     int m;
1211     if ((m = parseBytesUnits(number_end)) == 0) {
1212         self_destruct();
1213         return;
1214     }
1215
1216     *bptr = static_cast<size_t>(m * d / u);
1217     if (static_cast<double>(*bptr) * 2 != m * d / u * 2)
1218         self_destruct();
1219 }
1220 #endif
1221
1222 static size_t
1223 parseBytesUnits(const char *unit)
1224 {
1225     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1226         return 1;
1227
1228     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1229         return 1 << 10;
1230
1231     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1232         return 1 << 20;
1233
1234     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1235         return 1 << 30;
1236
1237     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1238
1239     return 0;
1240 }
1241
1242 /*****************************************************************************
1243  * Max
1244  *****************************************************************************/
1245
1246 static void
1247 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1248 {
1249     wordlist *w;
1250     wordlist *v;
1251
1252     while (ae != NULL) {
1253         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1254         storeAppendPrintf(entry, "%s %s %s ",
1255                           name,
1256                           ae->name,
1257                           ae->typeString());
1258         v = w = ae->dump();
1259
1260         while (v != NULL) {
1261             debugs(3, 3, "dump_acl: " << name << " " << ae->name << " " << v->key);
1262             storeAppendPrintf(entry, "%s ", v->key);
1263             v = v->next;
1264         }
1265
1266         storeAppendPrintf(entry, "\n");
1267         wordlistDestroy(&w);
1268         ae = ae->next;
1269     }
1270 }
1271
1272 static void
1273 parse_acl(ACL ** ae)
1274 {
1275     ACL::ParseAclLine(LegacyParser, ae);
1276 }
1277
1278 static void
1279 free_acl(ACL ** ae)
1280 {
1281     aclDestroyAcls(ae);
1282 }
1283
1284 void
1285 dump_acl_list(StoreEntry * entry, ACLList * head)
1286 {
1287     ACLList *l;
1288
1289     for (l = head; l; l = l->next) {
1290         storeAppendPrintf(entry, " %s%s",
1291                           l->op ? null_string : "!",
1292                           l->_acl->name);
1293     }
1294 }
1295
1296 void
1297 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1298 {
1299     acl_access *l;
1300
1301     for (l = head; l; l = l->next) {
1302         storeAppendPrintf(entry, "%s %s",
1303                           name,
1304                           l->allow ? "Allow" : "Deny");
1305         dump_acl_list(entry, l->aclList);
1306         storeAppendPrintf(entry, "\n");
1307     }
1308 }
1309
1310 static void
1311 parse_acl_access(acl_access ** head)
1312 {
1313     aclParseAccessLine(LegacyParser, head);
1314 }
1315
1316 static void
1317 free_acl_access(acl_access ** head)
1318 {
1319     aclDestroyAccessList(head);
1320 }
1321
1322 static void
1323 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1324 {
1325     char buf[MAX_IPSTRLEN];
1326     storeAppendPrintf(entry, "%s %s\n", name, addr.NtoA(buf,MAX_IPSTRLEN) );
1327 }
1328
1329 static void
1330 parse_address(Ip::Address *addr)
1331 {
1332     char *token = strtok(NULL, w_space);
1333
1334     if (!token) {
1335         self_destruct();
1336         return;
1337     }
1338
1339     if (!strcmp(token,"any_addr"))
1340         addr->SetAnyAddr();
1341     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1342         addr->SetNoAddr();
1343     else if ( (*addr = token) ) // try parse numeric/IPA
1344         (void) 0;
1345     else
1346         addr->GetHostByName(token); // dont use ipcache
1347 }
1348
1349 static void
1350 free_address(Ip::Address *addr)
1351 {
1352     addr->SetEmpty();
1353 }
1354
1355 CBDATA_TYPE(acl_address);
1356
1357 static void
1358 dump_acl_address(StoreEntry * entry, const char *name, acl_address * head)
1359 {
1360     char buf[MAX_IPSTRLEN];
1361     acl_address *l;
1362
1363     for (l = head; l; l = l->next) {
1364         if (!l->addr.IsAnyAddr())
1365             storeAppendPrintf(entry, "%s %s", name, l->addr.NtoA(buf,MAX_IPSTRLEN));
1366         else
1367             storeAppendPrintf(entry, "%s autoselect", name);
1368
1369         dump_acl_list(entry, l->aclList);
1370
1371         storeAppendPrintf(entry, "\n");
1372     }
1373 }
1374
1375 static void
1376 freed_acl_address(void *data)
1377 {
1378     acl_address *l = static_cast<acl_address *>(data);
1379     aclDestroyAclList(&l->aclList);
1380 }
1381
1382 static void
1383 parse_acl_address(acl_address ** head)
1384 {
1385     acl_address *l;
1386     acl_address **tail = head;  /* sane name below */
1387     CBDATA_INIT_TYPE_FREECB(acl_address, freed_acl_address);
1388     l = cbdataAlloc(acl_address);
1389     parse_address(&l->addr);
1390     aclParseAclList(LegacyParser, &l->aclList);
1391
1392     while (*tail)
1393         tail = &(*tail)->next;
1394
1395     *tail = l;
1396 }
1397
1398 static void
1399 free_acl_address(acl_address ** head)
1400 {
1401     while (*head) {
1402         acl_address *l = *head;
1403         *head = l->next;
1404         cbdataFree(l);
1405     }
1406 }
1407
1408 CBDATA_TYPE(acl_tos);
1409
1410 static void
1411 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1412 {
1413     acl_tos *l;
1414
1415     for (l = head; l; l = l->next) {
1416         if (l->tos > 0)
1417             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1418         else
1419             storeAppendPrintf(entry, "%s none", name);
1420
1421         dump_acl_list(entry, l->aclList);
1422
1423         storeAppendPrintf(entry, "\n");
1424     }
1425 }
1426
1427 static void
1428 freed_acl_tos(void *data)
1429 {
1430     acl_tos *l = static_cast<acl_tos *>(data);
1431     aclDestroyAclList(&l->aclList);
1432 }
1433
1434 static void
1435 parse_acl_tos(acl_tos ** head)
1436 {
1437     acl_tos *l;
1438     acl_tos **tail = head;      /* sane name below */
1439     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1440     char *token = strtok(NULL, w_space);
1441
1442     if (!token) {
1443         self_destruct();
1444         return;
1445     }
1446
1447     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1448         self_destruct();
1449         return;
1450     }
1451
1452     CBDATA_INIT_TYPE_FREECB(acl_tos, freed_acl_tos);
1453
1454     l = cbdataAlloc(acl_tos);
1455
1456     l->tos = (tos_t)tos;
1457
1458     aclParseAclList(LegacyParser, &l->aclList);
1459
1460     while (*tail)
1461         tail = &(*tail)->next;
1462
1463     *tail = l;
1464 }
1465
1466 static void
1467 free_acl_tos(acl_tos ** head)
1468 {
1469     while (*head) {
1470         acl_tos *l = *head;
1471         *head = l->next;
1472         l->next = NULL;
1473         cbdataFree(l);
1474     }
1475 }
1476
1477 #if SO_MARK && USE_LIBCAP
1478
1479 CBDATA_TYPE(acl_nfmark);
1480
1481 static void
1482 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1483 {
1484     acl_nfmark *l;
1485
1486     for (l = head; l; l = l->next) {
1487         if (l->nfmark > 0)
1488             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1489         else
1490             storeAppendPrintf(entry, "%s none", name);
1491
1492         dump_acl_list(entry, l->aclList);
1493
1494         storeAppendPrintf(entry, "\n");
1495     }
1496 }
1497
1498 static void
1499 freed_acl_nfmark(void *data)
1500 {
1501     acl_nfmark *l = static_cast<acl_nfmark *>(data);
1502     aclDestroyAclList(&l->aclList);
1503 }
1504
1505 static void
1506 parse_acl_nfmark(acl_nfmark ** head)
1507 {
1508     acl_nfmark *l;
1509     acl_nfmark **tail = head;   /* sane name below */
1510     nfmark_t mark;
1511     char *token = strtok(NULL, w_space);
1512
1513     if (!token) {
1514         self_destruct();
1515         return;
1516     }
1517
1518     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1519         self_destruct();
1520         return;
1521     }
1522
1523     CBDATA_INIT_TYPE_FREECB(acl_nfmark, freed_acl_nfmark);
1524
1525     l = cbdataAlloc(acl_nfmark);
1526
1527     l->nfmark = mark;
1528
1529     aclParseAclList(LegacyParser, &l->aclList);
1530
1531     while (*tail)
1532         tail = &(*tail)->next;
1533
1534     *tail = l;
1535 }
1536
1537 static void
1538 free_acl_nfmark(acl_nfmark ** head)
1539 {
1540     while (*head) {
1541         acl_nfmark *l = *head;
1542         *head = l->next;
1543         l->next = NULL;
1544         cbdataFree(l);
1545     }
1546 }
1547 #endif /* SO_MARK */
1548
1549 CBDATA_TYPE(acl_size_t);
1550
1551 static void
1552 dump_acl_b_size_t(StoreEntry * entry, const char *name, acl_size_t * head)
1553 {
1554     acl_size_t *l;
1555
1556     for (l = head; l; l = l->next) {
1557         if (l->size != -1)
1558             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1559         else
1560             storeAppendPrintf(entry, "%s none", name);
1561
1562         dump_acl_list(entry, l->aclList);
1563
1564         storeAppendPrintf(entry, "\n");
1565     }
1566 }
1567
1568 static void
1569 freed_acl_b_size_t(void *data)
1570 {
1571     acl_size_t *l = static_cast<acl_size_t *>(data);
1572     aclDestroyAclList(&l->aclList);
1573 }
1574
1575 static void
1576 parse_acl_b_size_t(acl_size_t ** head)
1577 {
1578     acl_size_t *l;
1579     acl_size_t **tail = head;   /* sane name below */
1580
1581     CBDATA_INIT_TYPE_FREECB(acl_size_t, freed_acl_b_size_t);
1582
1583     l = cbdataAlloc(acl_size_t);
1584
1585     parse_b_int64_t(&l->size);
1586
1587     aclParseAclList(LegacyParser, &l->aclList);
1588
1589     while (*tail)
1590         tail = &(*tail)->next;
1591
1592     *tail = l;
1593 }
1594
1595 static void
1596 free_acl_b_size_t(acl_size_t ** head)
1597 {
1598     while (*head) {
1599         acl_size_t *l = *head;
1600         *head = l->next;
1601         l->next = NULL;
1602         cbdataFree(l);
1603     }
1604 }
1605
1606 #if USE_DELAY_POOLS
1607
1608 #include "DelayPools.h"
1609 #include "DelayConfig.h"
1610 /* do nothing - free_delay_pool_count is the magic free function.
1611  * this is why delay_pool_count isn't just marked TYPE: u_short
1612  */
1613 #define free_delay_pool_class(X)
1614 #define free_delay_pool_access(X)
1615 #define free_delay_pool_rates(X)
1616 #define dump_delay_pool_class(X, Y, Z)
1617 #define dump_delay_pool_access(X, Y, Z)
1618 #define dump_delay_pool_rates(X, Y, Z)
1619
1620 static void
1621 free_delay_pool_count(DelayConfig * cfg)
1622 {
1623     cfg->freePoolCount();
1624 }
1625
1626 static void
1627 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1628 {
1629     cfg.dumpPoolCount (entry, name);
1630 }
1631
1632 static void
1633 parse_delay_pool_count(DelayConfig * cfg)
1634 {
1635     cfg->parsePoolCount();
1636 }
1637
1638 static void
1639 parse_delay_pool_class(DelayConfig * cfg)
1640 {
1641     cfg->parsePoolClass();
1642 }
1643
1644 static void
1645 parse_delay_pool_rates(DelayConfig * cfg)
1646 {
1647     cfg->parsePoolRates();
1648 }
1649
1650 static void
1651 parse_delay_pool_access(DelayConfig * cfg)
1652 {
1653     cfg->parsePoolAccess(LegacyParser);
1654 }
1655
1656 #endif
1657
1658 #if USE_DELAY_POOLS
1659 #include "ClientDelayConfig.h"
1660 /* do nothing - free_client_delay_pool_count is the magic free function.
1661  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1662  */
1663
1664 #define free_client_delay_pool_access(X)
1665 #define free_client_delay_pool_rates(X)
1666 #define dump_client_delay_pool_access(X, Y, Z)
1667 #define dump_client_delay_pool_rates(X, Y, Z)
1668
1669 static void
1670 free_client_delay_pool_count(ClientDelayConfig * cfg)
1671 {
1672     cfg->freePoolCount();
1673 }
1674
1675 static void
1676 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1677 {
1678     cfg.dumpPoolCount (entry, name);
1679 }
1680
1681 static void
1682 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1683 {
1684     cfg->parsePoolCount();
1685 }
1686
1687 static void
1688 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1689 {
1690     cfg->parsePoolRates();
1691 }
1692
1693 static void
1694 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1695 {
1696     cfg->parsePoolAccess(LegacyParser);
1697 }
1698 #endif
1699
1700 #if USE_HTTP_VIOLATIONS
1701 static void
1702 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1703 {
1704     if (manglers)
1705         manglers->dumpAccess(entry, name);
1706 }
1707
1708 static void
1709 parse_http_header_access(HeaderManglers **pm)
1710 {
1711     char *t = NULL;
1712
1713     if ((t = strtok(NULL, w_space)) == NULL) {
1714         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1715         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1716         return;
1717     }
1718
1719     if (!*pm)
1720         *pm = new HeaderManglers;
1721     HeaderManglers *manglers = *pm;
1722     header_mangler *mangler = manglers->track(t);
1723     assert(mangler);
1724     parse_acl_access(&mangler->access_list);
1725 }
1726
1727 static void
1728 free_HeaderManglers(HeaderManglers **pm)
1729 {
1730     // we delete the entire http_header_* mangler configuration at once
1731     if (const HeaderManglers *manglers = *pm) {
1732         delete manglers;
1733         *pm = NULL;
1734     }
1735 }
1736
1737 static void
1738 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1739 {
1740     if (manglers)
1741         manglers->dumpReplacement(entry, name);
1742 }
1743
1744 static void
1745 parse_http_header_replace(HeaderManglers **pm)
1746 {
1747     char *t = NULL;
1748
1749     if ((t = strtok(NULL, w_space)) == NULL) {
1750         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1751         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1752         return;
1753     }
1754
1755     const char *value = t + strlen(t) + 1;
1756
1757     if (!*pm)
1758         *pm = new HeaderManglers;
1759     HeaderManglers *manglers = *pm;
1760     manglers->setReplacement(t, value);
1761 }
1762
1763 #endif
1764
1765 static void
1766 dump_cachedir(StoreEntry * entry, const char *name, SquidConfig::_cacheSwap swap)
1767 {
1768     SwapDir *s;
1769     int i;
1770     assert (entry);
1771
1772     for (i = 0; i < swap.n_configured; ++i) {
1773         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1774         if (!s) continue;
1775         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1776         s->dump(*entry);
1777         storeAppendPrintf(entry, "\n");
1778     }
1779 }
1780
1781 static int
1782 check_null_string(char *s)
1783 {
1784     return s == NULL;
1785 }
1786
1787 #if USE_AUTH
1788 static void
1789 parse_authparam(Auth::ConfigVector * config)
1790 {
1791     char *type_str;
1792     char *param_str;
1793
1794     if ((type_str = strtok(NULL, w_space)) == NULL)
1795         self_destruct();
1796
1797     if ((param_str = strtok(NULL, w_space)) == NULL)
1798         self_destruct();
1799
1800     /* find a configuration for the scheme in the currently parsed configs... */
1801     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1802
1803     if (schemeCfg == NULL) {
1804         /* Create a configuration based on the scheme info */
1805         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1806
1807         if (theScheme == NULL) {
1808             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1809             self_destruct();
1810         }
1811
1812         config->push_back(theScheme->createConfig());
1813         schemeCfg = Auth::Config::Find(type_str);
1814         if (schemeCfg == NULL) {
1815             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1816             self_destruct();
1817         }
1818     }
1819
1820     schemeCfg->parse(schemeCfg, config->size(), param_str);
1821 }
1822
1823 static void
1824 free_authparam(Auth::ConfigVector * cfg)
1825 {
1826     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1827     cfg->clean();
1828
1829     /* remove our pointers to the probably-dead sub-configs */
1830     while (cfg->size()) {
1831         cfg->pop_back();
1832     }
1833
1834     /* on reconfigure initialize new auth schemes for the new config. */
1835     if (reconfiguring) {
1836         Auth::Init();
1837     }
1838 }
1839
1840 static void
1841 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1842 {
1843     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1844         (*i)->dump(entry, name, (*i));
1845 }
1846 #endif /* USE_AUTH */
1847
1848 /* TODO: just return the object, the # is irrelevant */
1849 static int
1850 find_fstype(char *type)
1851 {
1852     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1853         if (strcasecmp(type, StoreFileSystem::FileSystems().items[i]->type()) == 0)
1854             return (int)i;
1855
1856     return (-1);
1857 }
1858
1859 static void
1860 parse_cachedir(SquidConfig::_cacheSwap * swap)
1861 {
1862     char *type_str;
1863     char *path_str;
1864     RefCount<SwapDir> sd;
1865     int i;
1866     int fs;
1867
1868     if ((type_str = strtok(NULL, w_space)) == NULL)
1869         self_destruct();
1870
1871     if ((path_str = strtok(NULL, w_space)) == NULL)
1872         self_destruct();
1873
1874     fs = find_fstype(type_str);
1875
1876     if (fs < 0)
1877         self_destruct();
1878
1879     /* reconfigure existing dir */
1880
1881     for (i = 0; i < swap->n_configured; ++i) {
1882         assert (swap->swapDirs[i].getRaw());
1883
1884         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1885             /* this is specific to on-fs Stores. The right
1886              * way to handle this is probably to have a mapping
1887              * from paths to stores, and have on-fs stores
1888              * register with that, and lookip in that in their
1889              * own setup logic. RBC 20041225. TODO.
1890              */
1891
1892             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1893
1894             if (strcmp(sd->type(), StoreFileSystem::FileSystems().items[fs]->type()) != 0) {
1895                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1896                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1897                 return;
1898             }
1899
1900             sd->reconfigure();
1901
1902             update_maxobjsize();
1903
1904             return;
1905         }
1906     }
1907
1908     /* new cache_dir */
1909     if (swap->n_configured > 63) {
1910         /* 7 bits, signed */
1911         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1912         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1913         self_destruct();
1914         return;
1915     }
1916
1917     allocate_new_swapdir(swap);
1918
1919     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().items[fs]->createSwapDir();
1920
1921     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1922
1923     /* parse the FS parameters and options */
1924     sd->parse(swap->n_configured, path_str);
1925
1926     ++swap->n_configured;
1927
1928     /* Update the max object size */
1929     update_maxobjsize();
1930 }
1931
1932 static const char *
1933 peer_type_str(const peer_t type)
1934 {
1935     const char * result;
1936
1937     switch (type) {
1938
1939     case PEER_PARENT:
1940         result = "parent";
1941         break;
1942
1943     case PEER_SIBLING:
1944         result = "sibling";
1945         break;
1946
1947     case PEER_MULTICAST:
1948         result = "multicast";
1949         break;
1950
1951     default:
1952         result = "unknown";
1953         break;
1954     }
1955
1956     return result;
1957 }
1958
1959 static void
1960 dump_peer(StoreEntry * entry, const char *name, peer * p)
1961 {
1962     domain_ping *d;
1963     domain_type *t;
1964     LOCAL_ARRAY(char, xname, 128);
1965
1966     while (p != NULL) {
1967         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1968                           name,
1969                           p->host,
1970                           neighborTypeStr(p),
1971                           p->http_port,
1972                           p->icp.port,
1973                           p->name);
1974         dump_peer_options(entry, p);
1975
1976         for (d = p->peer_domain; d; d = d->next) {
1977             storeAppendPrintf(entry, "cache_peer_domain %s %s%s\n",
1978                               p->host,
1979                               d->do_ping ? null_string : "!",
1980                               d->domain);
1981         }
1982
1983         if (p->access) {
1984             snprintf(xname, 128, "cache_peer_access %s", p->name);
1985             dump_acl_access(entry, xname, p->access);
1986         }
1987
1988         for (t = p->typelist; t; t = t->next) {
1989             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1990                               p->host,
1991                               peer_type_str(t->type),
1992                               t->domain);
1993         }
1994
1995         p = p->next;
1996     }
1997 }
1998
1999 /**
2000  * utility function to prevent getservbyname() being called with a numeric value
2001  * on Windows at least it returns garage results.
2002  */
2003 static bool
2004 isUnsignedNumeric(const char *str, size_t len)
2005 {
2006     if (len < 1) return false;
2007
2008     for (; len >0 && *str; ++str, --len) {
2009         if (! isdigit(*str))
2010             return false;
2011     }
2012     return true;
2013 }
2014
2015 /**
2016  \param proto   'tcp' or 'udp' for protocol
2017  \returns       Port the named service is supposed to be listening on.
2018  */
2019 static unsigned short
2020 GetService(const char *proto)
2021 {
2022     struct servent *port = NULL;
2023     /** Parses a port number or service name from the squid.conf */
2024     char *token = strtok(NULL, w_space);
2025     if (token == NULL) {
2026         self_destruct();
2027         return 0; /* NEVER REACHED */
2028     }
2029     /** Returns either the service port number from /etc/services */
2030     if ( !isUnsignedNumeric(token, strlen(token)) )
2031         port = getservbyname(token, proto);
2032     if (port != NULL) {
2033         return ntohs((unsigned short)port->s_port);
2034     }
2035     /** Or a numeric translation of the config text. */
2036     return xatos(token);
2037 }
2038
2039 /**
2040  \returns       Port the named TCP service is supposed to be listening on.
2041  \copydoc GetService(const char *proto)
2042  */
2043 inline unsigned short
2044 GetTcpService(void)
2045 {
2046     return GetService("tcp");
2047 }
2048
2049 /**
2050  \returns       Port the named UDP service is supposed to be listening on.
2051  \copydoc GetService(const char *proto)
2052  */
2053 inline unsigned short
2054 GetUdpService(void)
2055 {
2056     return GetService("udp");
2057 }
2058
2059 static void
2060 parse_peer(peer ** head)
2061 {
2062     char *token = NULL;
2063     peer *p;
2064     CBDATA_INIT_TYPE_FREECB(peer, peerDestroy);
2065     p = cbdataAlloc(peer);
2066     p->http_port = CACHE_HTTP_PORT;
2067     p->icp.port = CACHE_ICP_PORT;
2068     p->weight = 1;
2069     p->basetime = 0;
2070     p->stats.logged_state = PEER_ALIVE;
2071
2072     if ((token = strtok(NULL, w_space)) == NULL)
2073         self_destruct();
2074
2075     p->host = xstrdup(token);
2076
2077     p->name = xstrdup(token);
2078
2079     if ((token = strtok(NULL, w_space)) == NULL)
2080         self_destruct();
2081
2082     p->type = parseNeighborType(token);
2083
2084     if (p->type == PEER_MULTICAST) {
2085         p->options.no_digest = 1;
2086         p->options.no_netdb_exchange = 1;
2087     }
2088
2089     p->http_port = GetTcpService();
2090
2091     if (!p->http_port)
2092         self_destruct();
2093
2094     p->icp.port = GetUdpService();
2095     p->connection_auth = 2;    /* auto */
2096
2097     while ((token = strtok(NULL, w_space))) {
2098         if (!strcasecmp(token, "proxy-only")) {
2099             p->options.proxy_only = 1;
2100         } else if (!strcasecmp(token, "no-query")) {
2101             p->options.no_query = 1;
2102         } else if (!strcasecmp(token, "background-ping")) {
2103             p->options.background_ping = 1;
2104         } else if (!strcasecmp(token, "no-digest")) {
2105             p->options.no_digest = 1;
2106         } else if (!strcasecmp(token, "no-tproxy")) {
2107             p->options.no_tproxy = 1;
2108         } else if (!strcasecmp(token, "multicast-responder")) {
2109             p->options.mcast_responder = 1;
2110 #if PEER_MULTICAST_SIBLINGS
2111         } else if (!strcasecmp(token, "multicast-siblings")) {
2112             p->options.mcast_siblings = 1;
2113 #endif
2114         } else if (!strncasecmp(token, "weight=", 7)) {
2115             p->weight = xatoi(token + 7);
2116         } else if (!strncasecmp(token, "basetime=", 9)) {
2117             p->basetime = xatoi(token + 9);
2118         } else if (!strcasecmp(token, "closest-only")) {
2119             p->options.closest_only = 1;
2120         } else if (!strncasecmp(token, "ttl=", 4)) {
2121             p->mcast.ttl = xatoi(token + 4);
2122
2123             if (p->mcast.ttl < 0)
2124                 p->mcast.ttl = 0;
2125
2126             if (p->mcast.ttl > 128)
2127                 p->mcast.ttl = 128;
2128         } else if (!strcasecmp(token, "default")) {
2129             p->options.default_parent = 1;
2130         } else if (!strcasecmp(token, "round-robin")) {
2131             p->options.roundrobin = 1;
2132         } else if (!strcasecmp(token, "weighted-round-robin")) {
2133             p->options.weighted_roundrobin = 1;
2134 #if USE_HTCP
2135         } else if (!strcasecmp(token, "htcp")) {
2136             p->options.htcp = 1;
2137         } else if (!strncasecmp(token, "htcp=", 5) || !strncasecmp(token, "htcp-", 5)) {
2138             /* Note: The htcp- form is deprecated, replaced by htcp= */
2139             p->options.htcp = 1;
2140             char *tmp = xstrdup(token+5);
2141             char *mode, *nextmode;
2142             for (mode = nextmode = tmp; mode; mode = nextmode) {
2143                 nextmode = strchr(mode, ',');
2144                 if (nextmode) {
2145                     *nextmode = '\0';
2146                     ++nextmode;
2147                 }
2148                 if (!strcasecmp(mode, "no-clr")) {
2149                     if (p->options.htcp_only_clr)
2150                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2151                     p->options.htcp_no_clr = 1;
2152                 } else if (!strcasecmp(mode, "no-purge-clr")) {
2153                     p->options.htcp_no_purge_clr = 1;
2154                 } else if (!strcasecmp(mode, "only-clr")) {
2155                     if (p->options.htcp_no_clr)
2156                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2157                     p->options.htcp_only_clr = 1;
2158                 } else if (!strcasecmp(mode, "forward-clr")) {
2159                     p->options.htcp_forward_clr = 1;
2160                 } else if (!strcasecmp(mode, "oldsquid")) {
2161                     p->options.htcp_oldsquid = 1;
2162                 } else {
2163                     fatalf("invalid HTCP mode '%s'", mode);
2164                 }
2165             }
2166             safe_free(tmp);
2167 #endif
2168         } else if (!strcasecmp(token, "no-netdb-exchange")) {
2169             p->options.no_netdb_exchange = 1;
2170
2171         } else if (!strcasecmp(token, "carp")) {
2172             if (p->type != PEER_PARENT)
2173                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2174
2175             p->options.carp = 1;
2176         } else if (!strncasecmp(token, "carp-key=", 9)) {
2177             if (p->options.carp != 1)
2178                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2179             p->options.carp_key.set=1;
2180             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2181             for (; key; key = nextkey) {
2182                 nextkey=strchr(key,',');
2183                 if (nextkey) ++nextkey; // skip the comma, any
2184                 if (0==strncasecmp(key,"scheme",6)) {
2185                     p->options.carp_key.scheme=1;
2186                 } else if (0==strncasecmp(key,"host",4)) {
2187                     p->options.carp_key.host=1;
2188                 } else if (0==strncasecmp(key,"port",4)) {
2189                     p->options.carp_key.port=1;
2190                 } else if (0==strncasecmp(key,"path",4)) {
2191                     p->options.carp_key.path=1;
2192                 } else if (0==strncasecmp(key,"params",6)) {
2193                     p->options.carp_key.params=1;
2194                 } else {
2195                     fatalf("invalid carp-key '%s'",key);
2196                 }
2197             }
2198         } else if (!strcasecmp(token, "userhash")) {
2199 #if USE_AUTH
2200             if (p->type != PEER_PARENT)
2201                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2202
2203             p->options.userhash = 1;
2204 #else
2205             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2206 #endif
2207         } else if (!strcasecmp(token, "sourcehash")) {
2208             if (p->type != PEER_PARENT)
2209                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2210
2211             p->options.sourcehash = 1;
2212
2213         } else if (!strcasecmp(token, "no-delay")) {
2214 #if USE_DELAY_POOLS
2215             p->options.no_delay = 1;
2216 #else
2217             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2218 #endif
2219         } else if (!strncasecmp(token, "login=", 6)) {
2220             p->login = xstrdup(token + 6);
2221             rfc1738_unescape(p->login);
2222         } else if (!strncasecmp(token, "connect-timeout=", 16)) {
2223             p->connect_timeout = xatoi(token + 16);
2224         } else if (!strncasecmp(token, "connect-fail-limit=", 19)) {
2225             p->connect_fail_limit = xatoi(token + 19);
2226 #if USE_CACHE_DIGESTS
2227         } else if (!strncasecmp(token, "digest-url=", 11)) {
2228             p->digest_url = xstrdup(token + 11);
2229 #endif
2230
2231         } else if (!strcasecmp(token, "allow-miss")) {
2232             p->options.allow_miss = 1;
2233         } else if (!strncasecmp(token, "max-conn=", 9)) {
2234             p->max_conn = xatoi(token + 9);
2235         } else if (!strcasecmp(token, "originserver")) {
2236             p->options.originserver = 1;
2237         } else if (!strncasecmp(token, "name=", 5)) {
2238             safe_free(p->name);
2239
2240             if (token[5])
2241                 p->name = xstrdup(token + 5);
2242         } else if (!strncasecmp(token, "forceddomain=", 13)) {
2243             safe_free(p->domain);
2244
2245             if (token[13])
2246                 p->domain = xstrdup(token + 13);
2247
2248 #if USE_SSL
2249
2250         } else if (strcmp(token, "ssl") == 0) {
2251             p->use_ssl = 1;
2252         } else if (strncmp(token, "sslcert=", 8) == 0) {
2253             safe_free(p->sslcert);
2254             p->sslcert = xstrdup(token + 8);
2255         } else if (strncmp(token, "sslkey=", 7) == 0) {
2256             safe_free(p->sslkey);
2257             p->sslkey = xstrdup(token + 7);
2258         } else if (strncmp(token, "sslversion=", 11) == 0) {
2259             p->sslversion = atoi(token + 11);
2260         } else if (strncmp(token, "ssloptions=", 11) == 0) {
2261             safe_free(p->ssloptions);
2262             p->ssloptions = xstrdup(token + 11);
2263         } else if (strncmp(token, "sslcipher=", 10) == 0) {
2264             safe_free(p->sslcipher);
2265             p->sslcipher = xstrdup(token + 10);
2266         } else if (strncmp(token, "sslcafile=", 10) == 0) {
2267             safe_free(p->sslcafile);
2268             p->sslcafile = xstrdup(token + 10);
2269         } else if (strncmp(token, "sslcapath=", 10) == 0) {
2270             safe_free(p->sslcapath);
2271             p->sslcapath = xstrdup(token + 10);
2272         } else if (strncmp(token, "sslcrlfile=", 11) == 0) {
2273             safe_free(p->sslcrlfile);
2274             p->sslcapath = xstrdup(token + 10);
2275         } else if (strncmp(token, "sslflags=", 9) == 0) {
2276             safe_free(p->sslflags);
2277             p->sslflags = xstrdup(token + 9);
2278         } else if (strncmp(token, "ssldomain=", 10) == 0) {
2279             safe_free(p->ssldomain);
2280             p->ssldomain = xstrdup(token + 10);
2281 #endif
2282
2283         } else if (strcmp(token, "front-end-https") == 0) {
2284             p->front_end_https = 1;
2285         } else if (strcmp(token, "front-end-https=on") == 0) {
2286             p->front_end_https = 1;
2287         } else if (strcmp(token, "front-end-https=auto") == 0) {
2288             p->front_end_https = 2;
2289         } else if (strcmp(token, "connection-auth=off") == 0) {
2290             p->connection_auth = 0;
2291         } else if (strcmp(token, "connection-auth") == 0) {
2292             p->connection_auth = 1;
2293         } else if (strcmp(token, "connection-auth=on") == 0) {
2294             p->connection_auth = 1;
2295         } else if (strcmp(token, "connection-auth=auto") == 0) {
2296             p->connection_auth = 2;
2297         } else {
2298             debugs(3, DBG_CRITICAL, "parse_peer: token='" << token << "'");
2299             self_destruct();
2300         }
2301     }
2302
2303     if (peerFindByName(p->name))
2304         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2305
2306     if (p->weight < 1)
2307         p->weight = 1;
2308
2309     if (p->connect_fail_limit < 1)
2310         p->connect_fail_limit = 10;
2311
2312     p->icp.version = ICP_VERSION_CURRENT;
2313
2314     p->testing_now = false;
2315
2316 #if USE_CACHE_DIGESTS
2317
2318     if (!p->options.no_digest) {
2319         /* XXX This looks odd.. who has the original pointer
2320          * then?
2321          */
2322         PeerDigest *pd = peerDigestCreate(p);
2323         p->digest = cbdataReference(pd);
2324     }
2325
2326 #endif
2327
2328     p->index =  ++Config.npeers;
2329
2330     while (*head != NULL)
2331         head = &(*head)->next;
2332
2333     *head = p;
2334
2335     peerClearRRStart();
2336 }
2337
2338 static void
2339 free_peer(peer ** P)
2340 {
2341     peer *p;
2342
2343     while ((p = *P) != NULL) {
2344         *P = p->next;
2345 #if USE_CACHE_DIGESTS
2346
2347         cbdataReferenceDone(p->digest);
2348 #endif
2349
2350         cbdataFree(p);
2351     }
2352
2353     Config.npeers = 0;
2354 }
2355
2356 static void
2357 dump_cachemgrpasswd(StoreEntry * entry, const char *name, cachemgr_passwd * list)
2358 {
2359     wordlist *w;
2360
2361     while (list != NULL) {
2362         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2363             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2364         else
2365             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2366
2367         for (w = list->actions; w != NULL; w = w->next) {
2368             storeAppendPrintf(entry, " %s", w->key);
2369         }
2370
2371         storeAppendPrintf(entry, "\n");
2372         list = list->next;
2373     }
2374 }
2375
2376 static void
2377 parse_cachemgrpasswd(cachemgr_passwd ** head)
2378 {
2379     char *passwd = NULL;
2380     wordlist *actions = NULL;
2381     cachemgr_passwd *p;
2382     cachemgr_passwd **P;
2383     parse_string(&passwd);
2384     parse_wordlist(&actions);
2385     p = static_cast<cachemgr_passwd *>(xcalloc(1, sizeof(cachemgr_passwd)));
2386     p->passwd = passwd;
2387     p->actions = actions;
2388
2389     for (P = head; *P; P = &(*P)->next) {
2390         /*
2391          * See if any of the actions from this line already have a
2392          * password from previous lines.  The password checking
2393          * routines in cache_manager.c take the the password from
2394          * the first cachemgr_passwd struct that contains the
2395          * requested action.  Thus, we should warn users who might
2396          * think they can have two passwords for the same action.
2397          */
2398         wordlist *w;
2399         wordlist *u;
2400
2401         for (w = (*P)->actions; w; w = w->next) {
2402             for (u = actions; u; u = u->next) {
2403                 if (strcmp(w->key, u->key))
2404                     continue;
2405
2406                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2407             }
2408         }
2409     }
2410
2411     *P = p;
2412 }
2413
2414 static void
2415 free_cachemgrpasswd(cachemgr_passwd ** head)
2416 {
2417     cachemgr_passwd *p;
2418
2419     while ((p = *head) != NULL) {
2420         *head = p->next;
2421         xfree(p->passwd);
2422         wordlistDestroy(&p->actions);
2423         xfree(p);
2424     }
2425 }
2426
2427 static void
2428 dump_denyinfo(StoreEntry * entry, const char *name, acl_deny_info_list * var)
2429 {
2430     acl_name_list *a;
2431
2432     while (var != NULL) {
2433         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2434
2435         for (a = var->acl_list; a != NULL; a = a->next)
2436             storeAppendPrintf(entry, " %s", a->name);
2437
2438         storeAppendPrintf(entry, "\n");
2439
2440         var = var->next;
2441     }
2442 }
2443
2444 static void
2445 parse_denyinfo(acl_deny_info_list ** var)
2446 {
2447     aclParseDenyInfoLine(var);
2448 }
2449
2450 void
2451 free_denyinfo(acl_deny_info_list ** list)
2452 {
2453     acl_deny_info_list *a = NULL;
2454     acl_deny_info_list *a_next = NULL;
2455     acl_name_list *l = NULL;
2456     acl_name_list *l_next = NULL;
2457
2458     for (a = *list; a; a = a_next) {
2459         for (l = a->acl_list; l; l = l_next) {
2460             l_next = l->next;
2461             memFree(l, MEM_ACL_NAME_LIST);
2462             l = NULL;
2463         }
2464
2465         a_next = a->next;
2466         memFree(a, MEM_ACL_DENY_INFO_LIST);
2467         a = NULL;
2468     }
2469
2470     *list = NULL;
2471 }
2472
2473 static void
2474 parse_peer_access(void)
2475 {
2476     char *host = NULL;
2477     peer *p;
2478
2479     if (!(host = strtok(NULL, w_space)))
2480         self_destruct();
2481
2482     if ((p = peerFindByName(host)) == NULL) {
2483         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2484         return;
2485     }
2486
2487     aclParseAccessLine(LegacyParser, &p->access);
2488 }
2489
2490 static void
2491 parse_hostdomain(void)
2492 {
2493     char *host = NULL;
2494     char *domain = NULL;
2495
2496     if (!(host = strtok(NULL, w_space)))
2497         self_destruct();
2498
2499     while ((domain = strtok(NULL, list_sep))) {
2500         domain_ping *l = NULL;
2501         domain_ping **L = NULL;
2502         peer *p;
2503
2504         if ((p = peerFindByName(host)) == NULL) {
2505             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2506             continue;
2507         }
2508
2509         l = static_cast<domain_ping *>(xcalloc(1, sizeof(domain_ping)));
2510         l->do_ping = 1;
2511
2512         if (*domain == '!') {   /* check for !.edu */
2513             l->do_ping = 0;
2514             ++domain;
2515         }
2516
2517         l->domain = xstrdup(domain);
2518
2519         for (L = &(p->peer_domain); *L; L = &((*L)->next));
2520         *L = l;
2521     }
2522 }
2523
2524 static void
2525 parse_hostdomaintype(void)
2526 {
2527     char *host = NULL;
2528     char *type = NULL;
2529     char *domain = NULL;
2530
2531     if (!(host = strtok(NULL, w_space)))
2532         self_destruct();
2533
2534     if (!(type = strtok(NULL, w_space)))
2535         self_destruct();
2536
2537     while ((domain = strtok(NULL, list_sep))) {
2538         domain_type *l = NULL;
2539         domain_type **L = NULL;
2540         peer *p;
2541
2542         if ((p = peerFindByName(host)) == NULL) {
2543             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2544             return;
2545         }
2546
2547         l = static_cast<domain_type *>(xcalloc(1, sizeof(domain_type)));
2548         l->type = parseNeighborType(type);
2549         l->domain = xstrdup(domain);
2550
2551         for (L = &(p->typelist); *L; L = &((*L)->next));
2552         *L = l;
2553     }
2554 }
2555
2556 static void
2557 dump_int(StoreEntry * entry, const char *name, int var)
2558 {
2559     storeAppendPrintf(entry, "%s %d\n", name, var);
2560 }
2561
2562 void
2563 parse_int(int *var)
2564 {
2565     int i;
2566     i = GetInteger();
2567     *var = i;
2568 }
2569
2570 static void
2571 free_int(int *var)
2572 {
2573     *var = 0;
2574 }
2575
2576 static void
2577 dump_onoff(StoreEntry * entry, const char *name, int var)
2578 {
2579     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2580 }
2581
2582 void
2583 parse_onoff(int *var)
2584 {
2585     char *token = strtok(NULL, w_space);
2586
2587     if (token == NULL)
2588         self_destruct();
2589
2590     if (!strcasecmp(token, "on") || !strcasecmp(token, "enable"))
2591         *var = 1;
2592     else
2593         *var = 0;
2594 }
2595
2596 #define free_onoff free_int
2597
2598 static void
2599 dump_tristate(StoreEntry * entry, const char *name, int var)
2600 {
2601     const char *state;
2602
2603     if (var > 0)
2604         state = "on";
2605     else if (var < 0)
2606         state = "warn";
2607     else
2608         state = "off";
2609
2610     storeAppendPrintf(entry, "%s %s\n", name, state);
2611 }
2612
2613 static void
2614 parse_tristate(int *var)
2615 {
2616     char *token = strtok(NULL, w_space);
2617
2618     if (token == NULL)
2619         self_destruct();
2620
2621     if (!strcasecmp(token, "on") || !strcasecmp(token, "enable"))
2622         *var = 1;
2623     else if (!strcasecmp(token, "warn"))
2624         *var = -1;
2625     else
2626         *var = 0;
2627 }
2628
2629 #define free_tristate free_int
2630
2631 static void
2632 dump_refreshpattern(StoreEntry * entry, const char *name, refresh_t * head)
2633 {
2634     while (head != NULL) {
2635         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2636                           name,
2637                           head->flags.icase ? " -i" : null_string,
2638                           head->pattern,
2639                           (int) head->min / 60,
2640                           (int) (100.0 * head->pct + 0.5),
2641                           (int) head->max / 60);
2642
2643         if (head->max_stale >= 0)
2644             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2645
2646         if (head->flags.refresh_ims)
2647             storeAppendPrintf(entry, " refresh-ims");
2648
2649         if (head->flags.store_stale)
2650             storeAppendPrintf(entry, " store-stale");
2651
2652 #if USE_HTTP_VIOLATIONS
2653
2654         if (head->flags.override_expire)
2655             storeAppendPrintf(entry, " override-expire");
2656
2657         if (head->flags.override_lastmod)
2658             storeAppendPrintf(entry, " override-lastmod");
2659
2660         if (head->flags.reload_into_ims)
2661             storeAppendPrintf(entry, " reload-into-ims");
2662
2663         if (head->flags.ignore_reload)
2664             storeAppendPrintf(entry, " ignore-reload");
2665
2666         if (head->flags.ignore_no_cache)
2667             storeAppendPrintf(entry, " ignore-no-cache");
2668
2669         if (head->flags.ignore_no_store)
2670             storeAppendPrintf(entry, " ignore-no-store");
2671
2672         if (head->flags.ignore_must_revalidate)
2673             storeAppendPrintf(entry, " ignore-must-revalidate");
2674
2675         if (head->flags.ignore_private)
2676             storeAppendPrintf(entry, " ignore-private");
2677
2678         if (head->flags.ignore_auth)
2679             storeAppendPrintf(entry, " ignore-auth");
2680
2681 #endif
2682
2683         storeAppendPrintf(entry, "\n");
2684
2685         head = head->next;
2686     }
2687 }
2688
2689 static void
2690 parse_refreshpattern(refresh_t ** head)
2691 {
2692     char *token;
2693     char *pattern;
2694     time_t min = 0;
2695     double pct = 0.0;
2696     time_t max = 0;
2697     int refresh_ims = 0;
2698     int store_stale = 0;
2699     int max_stale = -1;
2700
2701 #if USE_HTTP_VIOLATIONS
2702
2703     int override_expire = 0;
2704     int override_lastmod = 0;
2705     int reload_into_ims = 0;
2706     int ignore_reload = 0;
2707     int ignore_no_cache = 0;
2708     int ignore_no_store = 0;
2709     int ignore_must_revalidate = 0;
2710     int ignore_private = 0;
2711     int ignore_auth = 0;
2712 #endif
2713
2714     int i;
2715     refresh_t *t;
2716     regex_t comp;
2717     int errcode;
2718     int flags = REG_EXTENDED | REG_NOSUB;
2719
2720     if ((token = strtok(NULL, w_space)) == NULL) {
2721         self_destruct();
2722         return;
2723     }
2724
2725     if (strcmp(token, "-i") == 0) {
2726         flags |= REG_ICASE;
2727         token = strtok(NULL, w_space);
2728     } else if (strcmp(token, "+i") == 0) {
2729         flags &= ~REG_ICASE;
2730         token = strtok(NULL, w_space);
2731     }
2732
2733     if (token == NULL) {
2734         self_destruct();
2735         return;
2736     }
2737
2738     pattern = xstrdup(token);
2739
2740     i = GetInteger();           /* token: min */
2741
2742     /* catch negative and insanely huge values close to 32-bit wrap */
2743     if (i < 0) {
2744         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2745         i = 0;
2746     }
2747     if (i > 60*24*365) {
2748         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2749         i = 60*24*365;
2750     }
2751
2752     min = (time_t) (i * 60);    /* convert minutes to seconds */
2753
2754     i = GetInteger();           /* token: pct */
2755
2756     pct = (double) i / 100.0;
2757
2758     i = GetInteger();           /* token: max */
2759
2760     /* catch negative and insanely huge values close to 32-bit wrap */
2761     if (i < 0) {
2762         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2763         i = 0;
2764     }
2765     if (i > 60*24*365) {
2766         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2767         i = 60*24*365;
2768     }
2769
2770     max = (time_t) (i * 60);    /* convert minutes to seconds */
2771
2772     /* Options */
2773     while ((token = strtok(NULL, w_space)) != NULL) {
2774         if (!strcmp(token, "refresh-ims")) {
2775             refresh_ims = 1;
2776         } else if (!strcmp(token, "store-stale")) {
2777             store_stale = 1;
2778         } else if (!strncmp(token, "max-stale=", 10)) {
2779             max_stale = atoi(token + 10);
2780 #if USE_HTTP_VIOLATIONS
2781
2782         } else if (!strcmp(token, "override-expire"))
2783             override_expire = 1;
2784         else if (!strcmp(token, "override-lastmod"))
2785             override_lastmod = 1;
2786         else if (!strcmp(token, "ignore-no-cache"))
2787             ignore_no_cache = 1;
2788         else if (!strcmp(token, "ignore-no-store"))
2789             ignore_no_store = 1;
2790         else if (!strcmp(token, "ignore-must-revalidate"))
2791             ignore_must_revalidate = 1;
2792         else if (!strcmp(token, "ignore-private"))
2793             ignore_private = 1;
2794         else if (!strcmp(token, "ignore-auth"))
2795             ignore_auth = 1;
2796         else if (!strcmp(token, "reload-into-ims")) {
2797             reload_into_ims = 1;
2798             refresh_nocache_hack = 1;
2799             /* tell client_side.c that this is used */
2800         } else if (!strcmp(token, "ignore-reload")) {
2801             ignore_reload = 1;
2802             refresh_nocache_hack = 1;
2803             /* tell client_side.c that this is used */
2804 #endif
2805
2806         } else
2807             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2808     }
2809
2810     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2811         char errbuf[256];
2812         regerror(errcode, &comp, errbuf, sizeof errbuf);
2813         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2814         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2815         return;
2816     }
2817
2818     pct = pct < 0.0 ? 0.0 : pct;
2819     max = max < 0 ? 0 : max;
2820     t = static_cast<refresh_t *>(xcalloc(1, sizeof(refresh_t)));
2821     t->pattern = (char *) xstrdup(pattern);
2822     t->compiled_pattern = comp;
2823     t->min = min;
2824     t->pct = pct;
2825     t->max = max;
2826
2827     if (flags & REG_ICASE)
2828         t->flags.icase = 1;
2829
2830     if (refresh_ims)
2831         t->flags.refresh_ims = 1;
2832
2833     if (store_stale)
2834         t->flags.store_stale = 1;
2835
2836     t->max_stale = max_stale;
2837
2838 #if USE_HTTP_VIOLATIONS
2839
2840     if (override_expire)
2841         t->flags.override_expire = 1;
2842
2843     if (override_lastmod)
2844         t->flags.override_lastmod = 1;
2845
2846     if (reload_into_ims)
2847         t->flags.reload_into_ims = 1;
2848
2849     if (ignore_reload)
2850         t->flags.ignore_reload = 1;
2851
2852     if (ignore_no_cache)
2853         t->flags.ignore_no_cache = 1;
2854
2855     if (ignore_no_store)
2856         t->flags.ignore_no_store = 1;
2857
2858     if (ignore_must_revalidate)
2859         t->flags.ignore_must_revalidate = 1;
2860
2861     if (ignore_private)
2862         t->flags.ignore_private = 1;
2863
2864     if (ignore_auth)
2865         t->flags.ignore_auth = 1;
2866
2867 #endif
2868
2869     t->next = NULL;
2870
2871     while (*head)
2872         head = &(*head)->next;
2873
2874     *head = t;
2875
2876     safe_free(pattern);
2877 }
2878
2879 static void
2880 free_refreshpattern(refresh_t ** head)
2881 {
2882     refresh_t *t;
2883
2884     while ((t = *head) != NULL) {
2885         *head = t->next;
2886         safe_free(t->pattern);
2887         regfree(&t->compiled_pattern);
2888         safe_free(t);
2889     }
2890
2891 #if USE_HTTP_VIOLATIONS
2892     refresh_nocache_hack = 0;
2893
2894 #endif
2895 }
2896
2897 static void
2898 dump_string(StoreEntry * entry, const char *name, char *var)
2899 {
2900     if (var != NULL)
2901         storeAppendPrintf(entry, "%s %s\n", name, var);
2902 }
2903
2904 static void
2905 parse_string(char **var)
2906 {
2907     char *token = strtok(NULL, w_space);
2908     safe_free(*var);
2909
2910     if (token == NULL)
2911         self_destruct();
2912
2913     *var = xstrdup(token);
2914 }
2915
2916 void
2917 ConfigParser::ParseString(char **var)
2918 {
2919     parse_string(var);
2920 }
2921
2922 void
2923 ConfigParser::ParseString(String *var)
2924 {
2925     char *token = strtok(NULL, w_space);
2926
2927     if (token == NULL)
2928         self_destruct();
2929
2930     var->reset(token);
2931 }
2932
2933 static void
2934 free_string(char **var)
2935 {
2936     safe_free(*var);
2937 }
2938
2939 void
2940 parse_eol(char *volatile *var)
2941 {
2942     if (!var) {
2943         self_destruct();
2944         return;
2945     }
2946
2947     unsigned char *token = (unsigned char *) strtok(NULL, null_string);
2948     safe_free(*var);
2949
2950     if (!token) {
2951         self_destruct();
2952         return;
2953     }
2954
2955     while (*token && xisspace(*token))
2956         ++token;
2957
2958     if (!*token) {
2959         self_destruct();
2960         return;
2961     }
2962
2963     *var = xstrdup((char *) token);
2964 }
2965
2966 #define dump_eol dump_string
2967 #define free_eol free_string
2968
2969 static void
2970 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2971 {
2972     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2973 }
2974
2975 void
2976 parse_time_t(time_t * var)
2977 {
2978     time_msec_t tval;
2979     parseTimeLine(&tval, T_SECOND_STR, false);
2980     *var = static_cast<time_t>(tval/1000);
2981 }
2982
2983 static void
2984 free_time_t(time_t * var)
2985 {
2986     *var = 0;
2987 }
2988
2989 #if !USE_DNSHELPER
2990 static void
2991 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2992 {
2993     if (var % 1000)
2994         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2995     else
2996         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2997 }
2998
2999 void
3000 parse_time_msec(time_msec_t * var)
3001 {
3002     parseTimeLine(var, T_SECOND_STR, true);
3003 }
3004
3005 static void
3006 free_time_msec(time_msec_t * var)
3007 {
3008     *var = 0;
3009 }
3010 #endif
3011
3012 #if UNUSED_CODE
3013 static void
3014 dump_size_t(StoreEntry * entry, const char *name, size_t var)
3015 {
3016     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
3017 }
3018 #endif
3019
3020 static void
3021 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3022 {
3023     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3024 }
3025
3026 #if !USE_DNSHELPER
3027 static void
3028 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3029 {
3030     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3031 }
3032 #endif
3033
3034 #if UNUSED_CODE
3035 static void
3036 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
3037 {
3038     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
3039 }
3040 #endif
3041
3042 static void
3043 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3044 {
3045     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3046 }
3047
3048 static void
3049 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3050 {
3051     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3052 }
3053
3054 #if UNUSED_CODE
3055 static void
3056 parse_size_t(size_t * var)
3057 {
3058     int i;
3059     i = GetInteger();
3060     *var = (size_t) i;
3061 }
3062 #endif
3063
3064 static void
3065 parse_b_size_t(size_t * var)
3066 {
3067     parseBytesLine(var, B_BYTES_STR);
3068 }
3069
3070 #if !USE_DNSHELPER
3071 static void
3072 parse_b_ssize_t(ssize_t * var)
3073 {
3074     parseBytesLineSigned(var, B_BYTES_STR);
3075 }
3076 #endif
3077
3078 #if UNUSED_CODE
3079 static void
3080 parse_kb_size_t(size_t * var)
3081 {
3082     parseBytesLine(var, B_KBYTES_STR);
3083 }
3084 #endif
3085
3086 static void
3087 parse_b_int64_t(int64_t * var)
3088 {
3089     parseBytesLine64(var, B_BYTES_STR);
3090 }
3091
3092 static void
3093 parse_kb_int64_t(int64_t * var)
3094 {
3095     parseBytesLine64(var, B_KBYTES_STR);
3096 }
3097
3098 static void
3099 free_size_t(size_t * var)
3100 {
3101     *var = 0;
3102 }
3103
3104 #if !USE_DNSHELPER
3105 static void
3106 free_ssize_t(ssize_t * var)
3107 {
3108     *var = 0;
3109 }
3110 #endif
3111
3112 static void
3113 free_b_int64_t(int64_t * var)
3114 {
3115     *var = 0;
3116 }
3117
3118 #define free_b_size_t free_size_t
3119 #define free_b_ssize_t free_ssize_t
3120 #define free_kb_size_t free_size_t
3121 #define free_mb_size_t free_size_t
3122 #define free_gb_size_t free_size_t
3123 #define free_kb_int64_t free_b_int64_t
3124
3125 static void
3126 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3127 {
3128     storeAppendPrintf(entry, "%s %d\n", name, var);
3129 }
3130
3131 static void
3132 free_u_short(unsigned short * u)
3133 {
3134     *u = 0;
3135 }
3136
3137 static void
3138 parse_u_short(unsigned short * var)
3139 {
3140     ConfigParser::ParseUShort(var);
3141 }
3142
3143 void
3144 ConfigParser::ParseUShort(unsigned short *var)
3145 {
3146     *var = GetShort();
3147 }
3148
3149 void
3150 ConfigParser::ParseBool(bool *var)
3151 {
3152     int i = GetInteger();
3153
3154     if (0 == i)
3155         *var = false;
3156     else if (1 == i)
3157         *var = true;
3158     else
3159         self_destruct();
3160 }
3161
3162 static void
3163 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3164 {
3165     while (list != NULL) {
3166         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3167         list = list->next;
3168     }
3169 }
3170
3171 void
3172 ConfigParser::ParseWordList(wordlist ** list)
3173 {
3174     parse_wordlist(list);
3175 }
3176
3177 void
3178 parse_wordlist(wordlist ** list)
3179 {
3180     char *token;
3181     char *t = strtok(NULL, "");
3182
3183     while ((token = strwordtok(NULL, &t)))
3184         wordlistAdd(list, token);
3185 }
3186
3187 #if 0 /* now unused */
3188 static int
3189 check_null_wordlist(wordlist * w)
3190 {
3191     return w == NULL;
3192 }
3193 #endif
3194
3195 static int
3196 check_null_acl_access(acl_access * a)
3197 {
3198     return a == NULL;
3199 }
3200
3201 #define free_wordlist wordlistDestroy
3202
3203 #define free_uri_whitespace free_int
3204
3205 static void
3206 parse_uri_whitespace(int *var)
3207 {
3208     char *token = strtok(NULL, w_space);
3209
3210     if (token == NULL)
3211         self_destruct();
3212
3213     if (!strcasecmp(token, "strip"))
3214         *var = URI_WHITESPACE_STRIP;
3215     else if (!strcasecmp(token, "deny"))
3216         *var = URI_WHITESPACE_DENY;
3217     else if (!strcasecmp(token, "allow"))
3218         *var = URI_WHITESPACE_ALLOW;
3219     else if (!strcasecmp(token, "encode"))
3220         *var = URI_WHITESPACE_ENCODE;
3221     else if (!strcasecmp(token, "chop"))
3222         *var = URI_WHITESPACE_CHOP;
3223     else
3224         self_destruct();
3225 }
3226
3227 static void
3228 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3229 {
3230     const char *s;
3231
3232     if (var == URI_WHITESPACE_ALLOW)
3233         s = "allow";
3234     else if (var == URI_WHITESPACE_ENCODE)
3235         s = "encode";
3236     else if (var == URI_WHITESPACE_CHOP)
3237         s = "chop";
3238     else if (var == URI_WHITESPACE_DENY)
3239         s = "deny";
3240     else
3241         s = "strip";
3242
3243     storeAppendPrintf(entry, "%s %s\n", name, s);
3244 }
3245
3246 static void
3247 free_removalpolicy(RemovalPolicySettings ** settings)
3248 {
3249     if (!*settings)
3250         return;
3251
3252     free_string(&(*settings)->type);
3253
3254     free_wordlist(&(*settings)->args);
3255
3256     delete *settings;
3257
3258     *settings = NULL;
3259 }
3260
3261 static void
3262 parse_removalpolicy(RemovalPolicySettings ** settings)
3263 {
3264     if (*settings)
3265         free_removalpolicy(settings);
3266
3267     *settings = new RemovalPolicySettings;
3268
3269     parse_string(&(*settings)->type);
3270
3271     parse_wordlist(&(*settings)->args);
3272 }
3273
3274 static void
3275 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3276 {
3277     wordlist *args;
3278     storeAppendPrintf(entry, "%s %s", name, settings->type);
3279     args = settings->args;
3280
3281     while (args) {
3282         storeAppendPrintf(entry, " %s", args->key);
3283         args = args->next;
3284     }
3285
3286     storeAppendPrintf(entry, "\n");
3287 }
3288
3289 void
3290 YesNoNone::configure(bool beSet)
3291 {
3292     option = beSet ? +1 : -1;
3293 }
3294
3295 YesNoNone::operator void*() const
3296 {
3297     assert(option != 0); // must call configure() first
3298     return option > 0 ? (void*)this : NULL;
3299 }
3300
3301 inline void
3302 free_YesNoNone(YesNoNone *)
3303 {
3304     // do nothing: no explicit cleanup is required
3305 }
3306
3307 static void
3308 parse_YesNoNone(YesNoNone *option)
3309 {
3310     int value = 0;
3311     parse_onoff(&value);
3312     option->configure(value > 0);
3313 }
3314
3315 static void
3316 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3317 {
3318     if (option.configured())
3319         dump_onoff(entry, name, option ? 1 : 0);
3320 }
3321
3322 static void
3323 free_memcachemode(SquidConfig * config)
3324 {
3325     return;
3326 }
3327
3328 static void
3329 parse_memcachemode(SquidConfig * config)
3330 {
3331     char *token = strtok(NULL, w_space);
3332     if (!token)
3333         self_destruct();
3334
3335     if (strcmp(token, "always") == 0) {
3336         Config.onoff.memory_cache_first = 1;
3337         Config.onoff.memory_cache_disk = 1;
3338     } else if (strcmp(token, "disk") == 0) {
3339         Config.onoff.memory_cache_first = 0;
3340         Config.onoff.memory_cache_disk = 1;
3341     } else if (strncmp(token, "net", 3) == 0) {
3342         Config.onoff.memory_cache_first = 1;
3343         Config.onoff.memory_cache_disk = 0;
3344     } else if (strcmp(token, "never") == 0) {
3345         Config.onoff.memory_cache_first = 0;
3346         Config.onoff.memory_cache_disk = 0;
3347     } else
3348         self_destruct();
3349 }
3350
3351 static void
3352 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &config)
3353 {
3354     storeAppendPrintf(entry, "%s ", name);
3355     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3356         storeAppendPrintf(entry, "always");
3357     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3358         storeAppendPrintf(entry, "disk");
3359     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3360         storeAppendPrintf(entry, "network");
3361     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3362         storeAppendPrintf(entry, "none");
3363     storeAppendPrintf(entry, "\n");
3364 }
3365
3366 #include "cf_parser.cci"
3367
3368 peer_t
3369 parseNeighborType(const char *s)
3370 {
3371     if (!strcasecmp(s, "parent"))
3372         return PEER_PARENT;
3373
3374     if (!strcasecmp(s, "neighbor"))
3375         return PEER_SIBLING;
3376
3377     if (!strcasecmp(s, "neighbour"))
3378         return PEER_SIBLING;
3379
3380     if (!strcasecmp(s, "sibling"))
3381         return PEER_SIBLING;
3382
3383     if (!strcasecmp(s, "multicast"))
3384         return PEER_MULTICAST;
3385
3386     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3387
3388     return PEER_SIBLING;
3389 }
3390
3391 #if USE_WCCPv2
3392 static void
3393 parse_IpAddress_list(Ip::Address_list ** head)
3394 {
3395     char *token;
3396     Ip::Address_list *s;
3397     Ip::Address ipa;
3398
3399     while ((token = strtok(NULL, w_space))) {
3400         if (GetHostWithPort(token, &ipa)) {
3401
3402             while (*head)
3403                 head = &(*head)->next;
3404
3405             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3406             s->s = ipa;
3407
3408             *head = s;
3409         } else
3410             self_destruct();
3411     }
3412 }
3413
3414 static void
3415 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3416 {
3417     char ntoabuf[MAX_IPSTRLEN];
3418
3419     while (s) {
3420         storeAppendPrintf(e, "%s %s\n",
3421                           n,
3422                           s->s.NtoA(ntoabuf,MAX_IPSTRLEN));
3423         s = s->next;
3424     }
3425 }
3426
3427 static void
3428 free_IpAddress_list(Ip::Address_list ** head)
3429 {
3430     if (*head) delete *head;
3431     *head = NULL;
3432 }
3433
3434 #if CURRENTLY_UNUSED
3435 /* This code was previously used by http_port. Left as it really should
3436  * be used by icp_port and htcp_port
3437  */
3438 static int
3439 check_null_IpAddress_list(const Ip::Address_list * s)
3440 {
3441     return NULL == s;
3442 }
3443
3444 #endif /* CURRENTLY_UNUSED */
3445 #endif /* USE_WCCPv2 */
3446
3447 static void
3448 parsePortSpecification(AnyP::PortCfg * s, char *token)
3449 {
3450     char *host = NULL;
3451     unsigned short port = 0;
3452     char *t = NULL;
3453     char *junk = NULL;
3454
3455     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3456     s->name = xstrdup(token);
3457     s->connection_auth_disabled = false;
3458
3459     if (*token == '[') {
3460         /* [ipv6]:port */
3461         host = token + 1;
3462         t = strchr(host, ']');
3463         if (!t) {
3464             debugs(3, DBG_CRITICAL, s->protocol << "_port: missing ']' on IPv6 address: " << token);
3465             self_destruct();
3466         }
3467         *t = '\0';
3468         ++t;
3469         if (*t != ':') {
3470             debugs(3, DBG_CRITICAL, s->protocol << "_port: missing Port in: " << token);
3471             self_destruct();
3472         }
3473         if (!Ip::EnableIpv6) {
3474             debugs(3, DBG_CRITICAL, "FATAL: " << s->protocol << "_port: IPv6 is not available.");
3475             self_destruct();
3476         }
3477         port = xatos(t + 1);
3478     } else if ((t = strchr(token, ':'))) {
3479         /* host:port */
3480         /* ipv4:port */
3481         host = token;
3482         *t = '\0';
3483         port = xatos(t + 1);
3484
3485     } else if ((port = strtol(token, &junk, 10)), !*junk) {
3486         /* port */
3487         debugs(3, 3, s->protocol << "_port: found Listen on Port: " << port);
3488     } else {
3489         debugs(3, DBG_CRITICAL, s->protocol << "_port: missing Port: " << token);
3490         self_destruct();
3491     }
3492
3493     if (port == 0 && host != NULL) {
3494         debugs(3, DBG_CRITICAL, s->protocol << "_port: Port cannot be 0: " << token);
3495         self_destruct();
3496     }
3497
3498     if (NULL == host) {
3499         s->s.SetAnyAddr();
3500         s->s.SetPort(port);
3501         if (!Ip::EnableIpv6)
3502             s->s.SetIPv4();
3503         debugs(3, 3, s->protocol << "_port: found Listen on wildcard address: *:" << s->s.GetPort() );
3504     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3505         s->s.SetPort(port);
3506         if (!Ip::EnableIpv6)
3507             s->s.SetIPv4();
3508         debugs(3, 3, s->protocol << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3509     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3510         /* dont use ipcache */
3511         s->defaultsite = xstrdup(host);
3512         s->s.SetPort(port);
3513         if (!Ip::EnableIpv6)
3514             s->s.SetIPv4();
3515         debugs(3, 3, s->protocol << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3516     } else {
3517         debugs(3, DBG_CRITICAL, s->protocol << "_port: failed to resolve Host/IP: " << host);
3518         self_destruct();
3519     }
3520 }
3521
3522 static void
3523 parse_port_option(AnyP::PortCfg * s, char *token)
3524 {
3525     /* modes first */
3526
3527     if (strcmp(token, "accel") == 0) {
3528         if (s->intercepted || s->spoof_client_ip) {
3529             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: Accelerator mode requires its own port. It cannot be shared with other modes.");
3530             self_destruct();
3531         }
3532         s->accel = s->vhost = 1;
3533     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3534         if (s->accel || s->spoof_client_ip) {
3535             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: Intercept mode requires its own interception port. It cannot be shared with other modes.");
3536             self_destruct();
3537         }
3538         s->intercepted = 1;
3539         Ip::Interceptor.StartInterception();
3540         /* Log information regarding the port modes under interception. */
3541         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3542         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3543
3544         /* INET6: until transparent REDIRECT works on IPv6 SOCKET, force wildcard to IPv4 */
3545         if (Ip::EnableIpv6)
3546             debugs(3, DBG_IMPORTANT, "Disabling IPv6 on port " << s->s << " (interception enabled)");
3547         if ( !s->s.SetIPv4() ) {
3548             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: IPv6 addresses cannot NAT intercept (protocol does not provide NAT)" << s->s );
3549             self_destruct();
3550         }
3551     } else if (strcmp(token, "tproxy") == 0) {
3552         if (s->intercepted || s->accel) {
3553             debugs(3,DBG_CRITICAL, "FATAL: http(s)_port: TPROXY option requires its own interception port. It cannot be shared with other modes.");
3554             self_destruct();
3555         }
3556         s->spoof_client_ip = 1;
3557         Ip::Interceptor.StartTransparency();
3558         /* Log information regarding the port modes under transparency. */
3559         debugs(3, DBG_IMPORTANT, "Starting IP Spoofing on port " << s->s);
3560         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (IP spoofing enabled)");
3561
3562         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3563             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: TPROXY support in the system does not work.");
3564             self_destruct();
3565         }
3566
3567     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3568         if (!s->accel) {
3569             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: defaultsite option requires Acceleration mode flag.");
3570             self_destruct();
3571         }
3572         safe_free(s->defaultsite);
3573         s->defaultsite = xstrdup(token + 12);
3574     } else if (strcmp(token, "vhost") == 0) {
3575         if (!s->accel) {
3576             debugs(3, DBG_CRITICAL, "WARNING: http(s)_port: vhost option is deprecated. Use 'accel' mode flag instead.");
3577         }
3578         s->accel = s->vhost = 1;
3579     } else if (strcmp(token, "no-vhost") == 0) {
3580         if (!s->accel) {
3581             debugs(3, DBG_IMPORTANT, "ERROR: http(s)_port: no-vhost option requires Acceleration mode flag.");
3582         }
3583         s->vhost = 0;
3584     } else if (strcmp(token, "vport") == 0) {
3585         if (!s->accel) {
3586             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: vport option requires Acceleration mode flag.");
3587             self_destruct();
3588         }
3589         s->vport = -1;
3590     } else if (strncmp(token, "vport=", 6) == 0) {
3591         if (!s->accel) {
3592             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: vport option requires Acceleration mode flag.");
3593             self_destruct();
3594         }
3595         s->vport = xatos(token + 6);
3596     } else if (strncmp(token, "protocol=", 9) == 0) {
3597         if (!s->accel) {
3598             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: protocol option requires Acceleration mode flag.");
3599             self_destruct();
3600         }
3601         s->protocol = xstrdup(token + 9);
3602     } else if (strcmp(token, "allow-direct") == 0) {
3603         if (!s->accel) {
3604             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: allow-direct option requires Acceleration mode flag.");
3605             self_destruct();
3606         }
3607         s->allow_direct = 1;
3608     } else if (strcmp(token, "act-as-origin") == 0) {
3609         if (!s->accel) {
3610             debugs(3, DBG_IMPORTANT, "ERROR: http(s)_port: act-as-origin option requires Acceleration mode flag.");
3611         } else
3612             s->actAsOrigin = 1;
3613     } else if (strcmp(token, "ignore-cc") == 0) {
3614 #if !USE_HTTP_VIOLATIONS
3615         if (!s->accel) {
3616             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: ignore-cc option requires Scceleration mode flag.");
3617             self_destruct();
3618         }
3619 #endif
3620         s->ignore_cc = 1;
3621     } else if (strncmp(token, "name=", 5) == 0) {
3622         safe_free(s->name);
3623         s->name = xstrdup(token + 5);
3624     } else if (strcmp(token, "no-connection-auth") == 0) {
3625         s->connection_auth_disabled = true;
3626     } else if (strcmp(token, "connection-auth=off") == 0) {
3627         s->connection_auth_disabled = true;
3628     } else if (strcmp(token, "connection-auth") == 0) {
3629         s->connection_auth_disabled = false;
3630     } else if (strcmp(token, "connection-auth=on") == 0) {
3631         s->connection_auth_disabled = false;
3632     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3633         if (!strcasecmp(token + 23, "off"))
3634             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3635         else if (!strcasecmp(token + 23, "transparent"))
3636             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3637         else if (!strcasecmp(token + 23, "always"))
3638             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3639         else
3640             self_destruct();
3641     } else if (strcmp(token, "ipv4") == 0) {
3642         if ( !s->s.SetIPv4() ) {
3643             debugs(3, DBG_CRITICAL, "FATAL: http(s)_port: IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3644             self_destruct();
3645         }
3646     } else if (strcmp(token, "tcpkeepalive") == 0) {
3647         s->tcp_keepalive.enabled = 1;
3648     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3649         char *t = token + 13;
3650         s->tcp_keepalive.enabled = 1;
3651         s->tcp_keepalive.idle = atoi(t);
3652         t = strchr(t, ',');
3653         if (t) {
3654             ++t;
3655             s->tcp_keepalive.interval = atoi(t);
3656             t = strchr(t, ',');
3657         }
3658         if (t) {
3659             ++t;
3660             s->tcp_keepalive.timeout = atoi(t);
3661             t = strchr(t, ',');
3662         }
3663 #if USE_SSL
3664     } else if (strcasecmp(token, "sslBump") == 0) {
3665         debugs(3, DBG_CRITICAL, "WARNING: '" << token << "' is deprecated " <<
3666                "in http_port. Use 'ssl-bump' instead.");
3667         s->sslBump = 1; // accelerated when bumped, otherwise not
3668     } else if (strcmp(token, "ssl-bump") == 0) {
3669         s->sslBump = 1; // accelerated when bumped, otherwise not
3670     } else if (strncmp(token, "cert=", 5) == 0) {
3671         safe_free(s->cert);
3672         s->cert = xstrdup(token + 5);
3673     } else if (strncmp(token, "key=", 4) == 0) {
3674         safe_free(s->key);
3675         s->key = xstrdup(token + 4);
3676     } else if (strncmp(token, "version=", 8) == 0) {
3677         s->version = xatoi(token + 8);
3678         if (s->version < 1 || s->version > 4)
3679             self_destruct();
3680     } else if (strncmp(token, "options=", 8) == 0) {
3681         safe_free(s->options);
3682         s->options = xstrdup(token + 8);
3683     } else if (strncmp(token, "cipher=", 7) == 0) {
3684         safe_free(s->cipher);
3685         s->cipher = xstrdup(token + 7);
3686     } else if (strncmp(token, "clientca=", 9) == 0) {
3687         safe_free(s->clientca);
3688         s->clientca = xstrdup(token + 9);
3689     } else if (strncmp(token, "cafile=", 7) == 0) {
3690         safe_free(s->cafile);
3691         s->cafile = xstrdup(token + 7);
3692     } else if (strncmp(token, "capath=", 7) == 0) {
3693         safe_free(s->capath);
3694         s->capath = xstrdup(token + 7);
3695     } else if (strncmp(token, "crlfile=", 8) == 0) {
3696         safe_free(s->crlfile);
3697         s->crlfile = xstrdup(token + 8);
3698     } else if (strncmp(token, "dhparams=", 9) == 0) {
3699         safe_free(s->dhfile);
3700         s->dhfile = xstrdup(token + 9);
3701     } else if (strncmp(token, "sslflags=", 9) == 0) {
3702         safe_free(s->sslflags);
3703         s->sslflags = xstrdup(token + 9);
3704     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3705         safe_free(s->sslContextSessionId);
3706         s->sslContextSessionId = xstrdup(token + 11);
3707     } else if (strcmp(token, "generate-host-certificates") == 0) {
3708         s->generateHostCertificates = true;
3709     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3710         s->generateHostCertificates = true;
3711     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3712         s->generateHostCertificates = false;
3713     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3714         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3715 #endif
3716     } else {
3717         self_destruct();
3718     }
3719 }
3720
3721 void
3722 add_http_port(char *portspec)
3723 {
3724     AnyP::PortCfg *s = new AnyP::PortCfg("http_port");
3725     parsePortSpecification(s, portspec);
3726     // we may need to merge better if the above returns a list with clones
3727     assert(s->next == NULL);
3728     s->next = cbdataReference(Config.Sockaddr.http);
3729     cbdataReferenceDone(Config.Sockaddr.http);
3730     Config.Sockaddr.http = cbdataReference(s);
3731 }
3732
3733 static void
3734 parsePortCfg(AnyP::PortCfg ** head, const char *optionName)
3735 {
3736     const char *protocol = NULL;
3737     if (strcmp(optionName, "http_port") == 0 ||
3738             strcmp(optionName, "ascii_port") == 0)
3739         protocol = "http";
3740     else if (strcmp(optionName, "https_port") == 0)
3741         protocol = "https";
3742     if (!protocol) {
3743         self_destruct();
3744         return;
3745     }
3746
3747     char *token = strtok(NULL, w_space);
3748
3749     if (!token) {
3750         self_destruct();
3751         return;
3752     }
3753
3754     AnyP::PortCfg *s = new AnyP::PortCfg(protocol);
3755     parsePortSpecification(s, token);
3756
3757     /* parse options ... */
3758     while ((token = strtok(NULL, w_space))) {
3759         parse_port_option(s, token);
3760     }
3761
3762 #if USE_SSL
3763     if (strcasecmp(protocol, "https") == 0) {
3764         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3765         const bool hijacked = s->spoof_client_ip || s->intercepted;
3766         if (s->sslBump && !hijacked) {
3767             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3768             self_destruct();
3769         }
3770         if (hijacked && !s->sslBump) {
3771             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3772             self_destruct();
3773         }
3774     }
3775 #endif
3776
3777     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.IsAnyAddr()) {
3778         // clone the port options from *s to *(s->next)
3779         s->next = cbdataReference(s->clone());
3780         s->next->s.SetIPv4();
3781         debugs(3, 3, protocol << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3782     }
3783
3784     while (*head)
3785         head = &(*head)->next;
3786
3787     *head = cbdataReference(s);
3788 }
3789
3790 static void
3791 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfg * s)
3792 {
3793     char buf[MAX_IPSTRLEN];
3794
3795     storeAppendPrintf(e, "%s %s",
3796                       n,
3797                       s->s.ToURL(buf,MAX_IPSTRLEN));
3798
3799     // MODES and specific sub-options.
3800     if (s->intercepted)
3801         storeAppendPrintf(e, " intercept");
3802
3803     else if (s->spoof_client_ip)
3804         storeAppendPrintf(e, " tproxy");
3805
3806     else if (s->accel) {
3807         storeAppendPrintf(e, " accel");
3808
3809         if (s->vhost)
3810             storeAppendPrintf(e, " vhost");
3811
3812         if (s->vport < 0)
3813             storeAppendPrintf(e, " vport");
3814         else if (s->vport > 0)
3815             storeAppendPrintf(e, " vport=%d", s->vport);
3816
3817         if (s->defaultsite)
3818             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3819
3820         if (s->protocol && strcmp(s->protocol,"http") != 0)
3821             storeAppendPrintf(e, " protocol=%s", s->protocol);
3822
3823         if (s->allow_direct)
3824             storeAppendPrintf(e, " allow-direct");
3825
3826         if (s->ignore_cc)
3827             storeAppendPrintf(e, " ignore-cc");
3828
3829     }
3830
3831     // Generic independent options
3832
3833     if (s->name)
3834         storeAppendPrintf(e, " name=%s", s->name);
3835
3836 #if USE_HTTP_VIOLATIONS
3837     if (!s->accel && s->ignore_cc)
3838         storeAppendPrintf(e, " ignore-cc");
3839 #endif
3840
3841     if (s->connection_auth_disabled)
3842         storeAppendPrintf(e, " connection-auth=off");
3843     else
3844         storeAppendPrintf(e, " connection-auth=on");
3845
3846     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3847         const char *pmtu;
3848
3849         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3850             pmtu = "always";
3851         else
3852             pmtu = "transparent";
3853
3854         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3855     }
3856
3857     if (s->s.IsAnyAddr() && !s->s.IsIPv6())
3858         storeAppendPrintf(e, " ipv4");
3859
3860     if (s->tcp_keepalive.enabled) {
3861         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3862             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3863         } else {
3864             storeAppendPrintf(e, " tcpkeepalive");
3865         }
3866     }
3867
3868 #if USE_SSL
3869     if (s->sslBump)
3870         storeAppendPrintf(e, " ssl-bump");
3871
3872     if (s->cert)
3873         storeAppendPrintf(e, " cert=%s", s->cert);
3874
3875     if (s->key)
3876         storeAppendPrintf(e, " key=%s", s->key);
3877
3878     if (s->version)
3879         storeAppendPrintf(e, " version=%d", s->version);
3880
3881     if (s->options)
3882         storeAppendPrintf(e, " options=%s", s->options);
3883
3884     if (s->cipher)
3885         storeAppendPrintf(e, " cipher=%s", s->cipher);
3886
3887     if (s->cafile)
3888         storeAppendPrintf(e, " cafile=%s", s->cafile);
3889
3890     if (s->capath)
3891         storeAppendPrintf(e, " capath=%s", s->capath);
3892
3893     if (s->crlfile)
3894         storeAppendPrintf(e, " crlfile=%s", s->crlfile);
3895
3896     if (s->dhfile)
3897         storeAppendPrintf(e, " dhparams=%s", s->dhfile);
3898
3899     if (s->sslflags)
3900         storeAppendPrintf(e, " sslflags=%s", s->sslflags);
3901
3902     if (s->sslContextSessionId)
3903         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3904
3905     if (s->generateHostCertificates)
3906         storeAppendPrintf(e, " generate-host-certificates");
3907
3908     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3909         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3910 #endif
3911 }
3912
3913 static void
3914 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfg * s)
3915 {
3916     while (s) {
3917         dump_generic_port(e, n, s);
3918         storeAppendPrintf(e, "\n");
3919         s = s->next;
3920     }
3921 }
3922
3923 static void
3924 free_PortCfg(AnyP::PortCfg ** head)
3925 {
3926     AnyP::PortCfg *s;
3927
3928     while ((s = *head) != NULL) {
3929         *head = s->next;
3930         cbdataReferenceDone(s);
3931     }
3932 }
3933
3934 void
3935 configFreeMemory(void)
3936 {
3937     free_all();
3938 #if USE_SSL
3939     SSL_CTX_free(Config.ssl_client.sslContext);
3940 #endif
3941 }
3942
3943 void
3944 requirePathnameExists(const char *name, const char *path)
3945 {
3946
3947     struct stat sb;
3948     char pathbuf[BUFSIZ];
3949     assert(path != NULL);
3950
3951     if (Config.chroot_dir && (geteuid() == 0)) {
3952         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3953         path = pathbuf;
3954     }
3955
3956     if (stat(path, &sb) < 0) {
3957         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL ":"") << "ERROR: " << name << " " << path << ": " << xstrerror());
3958         // keep going to find more issues if we are only checking the config file with "-k parse"
3959         if (opt_parse_cfg_only)
3960             return;
3961         // this is fatal if it is found during startup or reconfigure
3962         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3963             fatalf("%s %s: %s", name, path, xstrerror());
3964     }
3965 }
3966
3967 char *
3968 strtokFile(void)
3969 {
3970     return ConfigParser::strtokFile();
3971 }
3972
3973 #include "AccessLogEntry.h"
3974
3975 static void
3976 parse_access_log(customlog ** logs)
3977 {
3978     const char *filename, *logdef_name;
3979
3980     customlog *cl = (customlog *)xcalloc(1, sizeof(*cl));
3981
3982     if ((filename = strtok(NULL, w_space)) == NULL) {
3983         self_destruct();
3984         return;
3985     }
3986
3987     if (strcmp(filename, "none") == 0) {
3988         cl->type = Log::Format::CLF_NONE;
3989         aclParseAclList(LegacyParser, &cl->aclList);
3990         while (*logs)
3991             logs = &(*logs)->next;
3992         *logs = cl;
3993         return;
3994     }
3995
3996     if ((logdef_name = strtok(NULL, w_space)) == NULL)
3997         logdef_name = "squid";
3998
3999     debugs(3, 9, "Log definition name '" << logdef_name << "' file '" << filename << "'");
4000
4001     cl->filename = xstrdup(filename);
4002
4003     /* look for the definition pointer corresponding to this name */
4004     Format::Format *lf = Log::TheConfig.logformats;
4005
4006     while (lf != NULL) {
4007         debugs(3, 9, "Comparing against '" << lf->name << "'");
4008
4009         if (strcmp(lf->name, logdef_name) == 0)
4010             break;
4011
4012         lf = lf->next;
4013     }
4014
4015     if (lf != NULL) {
4016         cl->type = Log::Format::CLF_CUSTOM;
4017         cl->logFormat = lf;
4018     } else if (strcmp(logdef_name, "auto") == 0) {
4019         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
4020         cl->type = Log::Format::CLF_SQUID;
4021     } else if (strcmp(logdef_name, "squid") == 0) {
4022         cl->type = Log::Format::CLF_SQUID;
4023     } else if (strcmp(logdef_name, "common") == 0) {
4024         cl->type = Log::Format::CLF_COMMON;
4025     } else if (strcmp(logdef_name, "combined") == 0) {
4026         cl->type = Log::Format::CLF_COMBINED;
4027 #if ICAP_CLIENT
4028     } else if (strcmp(logdef_name, "icap_squid") == 0) {
4029         cl->type = Log::Format::CLF_ICAP_SQUID;
4030 #endif
4031     } else if (strcmp(logdef_name, "useragent") == 0) {
4032         cl->type = Log::Format::CLF_USERAGENT;
4033     } else if (strcmp(logdef_name, "referrer") == 0) {
4034         cl->type = Log::Format::CLF_REFERER;
4035     } else {
4036         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4037         self_destruct();
4038         return;
4039     }
4040
4041     aclParseAclList(LegacyParser, &cl->aclList);
4042
4043     while (*logs)
4044         logs = &(*logs)->next;
4045
4046     *logs = cl;
4047 }
4048
4049 static int
4050 check_null_access_log(customlog *customlog_definitions)
4051 {
4052     return customlog_definitions == NULL;
4053 }
4054
4055 static void
4056 dump_access_log(StoreEntry * entry, const char *name, customlog * logs)
4057 {
4058     customlog *log;
4059
4060     for (log = logs; log; log = log->next) {
4061         storeAppendPrintf(entry, "%s ", name);
4062
4063         switch (log->type) {
4064
4065         case Log::Format::CLF_CUSTOM:
4066             storeAppendPrintf(entry, "%s %s", log->filename, log->logFormat->name);
4067             break;
4068
4069         case Log::Format::CLF_NONE:
4070             storeAppendPrintf(entry, "none");
4071             break;
4072
4073         case Log::Format::CLF_SQUID:
4074             storeAppendPrintf(entry, "%s squid", log->filename);
4075             break;
4076
4077         case Log::Format::CLF_COMBINED:
4078             storeAppendPrintf(entry, "%s combined", log->filename);
4079             break;
4080
4081         case Log::Format::CLF_COMMON:
4082             storeAppendPrintf(entry, "%s common", log->filename);
4083             break;
4084
4085 #if ICAP_CLIENT
4086         case Log::Format::CLF_ICAP_SQUID:
4087             storeAppendPrintf(entry, "%s icap_squid", log->filename);
4088             break;
4089 #endif
4090         case Log::Format::CLF_USERAGENT:
4091             storeAppendPrintf(entry, "%s useragent", log->filename);
4092             break;
4093
4094         case Log::Format::CLF_REFERER:
4095             storeAppendPrintf(entry, "%s referrer", log->filename);
4096             break;
4097
4098         case Log::Format::CLF_UNKNOWN:
4099             break;
4100         }
4101
4102         if (log->aclList)
4103             dump_acl_list(entry, log->aclList);
4104
4105         storeAppendPrintf(entry, "\n");
4106     }
4107 }
4108
4109 static void
4110 free_access_log(customlog ** definitions)
4111 {
4112     while (*definitions) {
4113         customlog *log = *definitions;
4114         *definitions = log->next;
4115
4116         log->logFormat = NULL;
4117         log->type = Log::Format::CLF_UNKNOWN;
4118
4119         if (log->aclList)
4120             aclDestroyAclList(&log->aclList);
4121
4122         safe_free(log->filename);
4123
4124         xfree(log);
4125     }
4126 }
4127
4128 /// parses list of integers form name=N1,N2,N3,...
4129 static bool
4130 parseNamedIntList(const char *data, const String &name, Vector<int> &list)
4131 {
4132     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4133         data += name.size();
4134         if (*data == '=') {
4135             while (true) {
4136                 ++data;
4137                 int value = 0;
4138                 if (!StringToInt(data, value, &data, 10))
4139                     break;
4140                 list.push_back(value);
4141                 if (*data == '\0' || *data != ',')
4142                     break;
4143             }
4144         }
4145     }
4146     return data && *data == '\0';
4147 }
4148
4149 static void
4150 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4151 {
4152 #if !HAVE_CPU_AFFINITY
4153     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4154            "support, do not set 'cpu_affinity_map'");
4155     self_destruct();
4156 #endif /* HAVE_CPU_AFFINITY */
4157
4158     if (!*cpuAffinityMap)
4159         *cpuAffinityMap = new CpuAffinityMap;
4160
4161     const char *const pToken = strtok(NULL, w_space);
4162     const char *const cToken = strtok(NULL, w_space);
4163     Vector<int> processes, cores;
4164     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4165         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4166                "in 'cpu_affinity_map'");
4167         self_destruct();
4168     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4169         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4170                "'cpu_affinity_map'");
4171         self_destruct();
4172     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4173         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4174                "process_numbers and cores lists differ in length or " <<
4175                "contain numbers <= 0");
4176         self_destruct();
4177     }
4178 }
4179
4180 static void
4181 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4182 {
4183     if (cpuAffinityMap) {
4184         storeAppendPrintf(entry, "%s process_numbers=", name);
4185         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4186             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4187                               cpuAffinityMap->processes()[i]);
4188         }
4189         storeAppendPrintf(entry, " cores=");
4190         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4191             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4192                               cpuAffinityMap->cores()[i]);
4193         }
4194         storeAppendPrintf(entry, "\n");
4195     }
4196 }
4197
4198 static void
4199 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4200 {
4201     delete *cpuAffinityMap;
4202     *cpuAffinityMap = NULL;
4203 }
4204
4205 #if USE_ADAPTATION
4206
4207 static void
4208 parse_adaptation_service_set_type()
4209 {
4210     Adaptation::Config::ParseServiceSet();
4211 }
4212
4213 static void
4214 parse_adaptation_service_chain_type()
4215 {
4216     Adaptation::Config::ParseServiceChain();
4217 }
4218
4219 static void
4220 parse_adaptation_access_type()
4221 {
4222     Adaptation::Config::ParseAccess(LegacyParser);
4223 }
4224
4225 static void
4226 parse_adaptation_meta_type(Adaptation::Config::MetaHeaders *)
4227 {
4228     Adaptation::Config::ParseMetaHeader(LegacyParser);
4229 }
4230
4231 static void
4232 dump_adaptation_meta_type(StoreEntry *entry, const char *name, Adaptation::Config::MetaHeaders &)
4233 {
4234     Adaptation::Config::DumpMetaHeader(entry, name);
4235 }
4236
4237 static void
4238 free_adaptation_meta_type(Adaptation::Config::MetaHeaders *)
4239 {
4240     // Nothing to do, it is released inside Adaptation::Config::freeService()
4241 }
4242 #endif /* USE_ADAPTATION */
4243
4244 #if ICAP_CLIENT
4245
4246 static void
4247 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4248 {
4249     cfg->parseService();
4250 }
4251
4252 static void
4253 free_icap_service_type(Adaptation::Icap::Config * cfg)
4254 {
4255     cfg->freeService();
4256 }
4257
4258 static void
4259 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4260 {
4261     cfg.dumpService(entry, name);
4262 }
4263
4264 static void
4265 parse_icap_class_type()
4266 {
4267     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4268            "Use 'adaptation_service_set' instead");
4269     Adaptation::Config::ParseServiceSet();
4270 }
4271
4272 static void
4273 parse_icap_access_type()
4274 {
4275     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4276            "Use 'adaptation_access' instead");
4277     Adaptation::Config::ParseAccess(LegacyParser);
4278 }
4279
4280 #endif
4281
4282 #if USE_ECAP
4283
4284 static void
4285 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4286 {
4287     cfg->parseService();
4288 }
4289
4290 static void
4291 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4292 {
4293     cfg->freeService();
4294 }
4295
4296 static void
4297 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4298 {
4299     cfg.dumpService(entry, name);
4300 }
4301
4302 #endif /* USE_ECAP */
4303
4304 #if ICAP_CLIENT
4305 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4306 {
4307     char *token;
4308     time_t d;
4309     time_t m;
4310     cfg->service_failure_limit = GetInteger();
4311
4312     if ((token = strtok(NULL, w_space)) == NULL)
4313         return;
4314
4315     if (strcmp(token,"in") != 0) {
4316         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4317         self_destruct();
4318     }
4319
4320     if ((token = strtok(NULL, w_space)) == NULL) {
4321         self_destruct();
4322     }
4323
4324     d = static_cast<time_t> (xatoi(token));
4325
4326     m = static_cast<time_t> (1);
4327
4328     if (0 == d)
4329         (void) 0;
4330     else if ((token = strtok(NULL, w_space)) == NULL) {
4331         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4332         self_destruct();
4333     } else if ((m = parseTimeUnits(token, false)) == 0)
4334         self_destruct();
4335
4336     cfg->oldest_service_failure = (m * d);
4337 }
4338
4339 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4340 {
4341     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4342     if (cfg.oldest_service_failure > 0) {
4343         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4344     }
4345     storeAppendPrintf(entry, "\n");
4346 }
4347
4348 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4349 {
4350     cfg->oldest_service_failure = 0;
4351     cfg->service_failure_limit = 0;
4352 }
4353 #endif
4354
4355 #if USE_SSL
4356 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4357 {
4358     char *al;
4359     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4360     if ((al = strtok(NULL, w_space)) == NULL) {
4361         self_destruct();
4362         return;
4363     }
4364
4365     const char *param;
4366     if ( char *s = strchr(al, '{')) {
4367         *s = '\0'; // terminate the al string
4368         ++s;
4369         param = s;
4370         s = strchr(s, '}');
4371         if (!s) {
4372             self_destruct();
4373             return;
4374         }
4375         *s = '\0';
4376     } else
4377         param = NULL;
4378
4379     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4380         ca->alg = Ssl::algSetValidAfter;
4381         ca->param = strdup("on");
4382     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4383         ca->alg = Ssl::algSetValidBefore;
4384         ca->param = strdup("on");
4385     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4386         ca->alg = Ssl::algSetCommonName;
4387         if (param) {
4388             if (strlen(param) > 64) {
4389                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4390                 self_destruct();
4391                 return;
4392             }
4393             ca->param = strdup(param);
4394         }
4395     } else {
4396         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4397         self_destruct();
4398         return;
4399     }
4400
4401     aclParseAclList(LegacyParser, &ca->aclList);
4402
4403     while (*cert_adapt)
4404         cert_adapt = &(*cert_adapt)->next;
4405
4406     *cert_adapt = ca;
4407 }
4408
4409 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4410 {
4411     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4412         storeAppendPrintf(entry, "%s ", name);
4413         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4414         if (ca->aclList)
4415             dump_acl_list(entry, ca->aclList);
4416         storeAppendPrintf(entry, "\n");
4417     }
4418 }
4419
4420 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4421 {
4422     while (*cert_adapt) {
4423         sslproxy_cert_adapt *ca = *cert_adapt;
4424         *cert_adapt = ca->next;
4425         safe_free(ca->param);
4426
4427         if (ca->aclList)
4428             aclDestroyAclList(&ca->aclList);
4429
4430         safe_free(ca);
4431     }
4432 }
4433
4434 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4435 {
4436     char *al;
4437     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4438     if ((al = strtok(NULL, w_space)) == NULL) {
4439         self_destruct();
4440         return;
4441     }
4442
4443     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4444         cs->alg = Ssl::algSignTrusted;
4445     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4446         cs->alg = Ssl::algSignUntrusted;
4447     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4448         cs->alg = Ssl::algSignSelf;
4449     else {
4450         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4451         self_destruct();
4452         return;
4453     }
4454
4455     aclParseAclList(LegacyParser, &cs->aclList);
4456
4457     while (*cert_sign)
4458         cert_sign = &(*cert_sign)->next;
4459
4460     *cert_sign = cs;
4461 }
4462
4463 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4464 {
4465     sslproxy_cert_sign *cs;
4466     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4467         storeAppendPrintf(entry, "%s ", name);
4468         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4469         if (cs->aclList)
4470             dump_acl_list(entry, cs->aclList);
4471         storeAppendPrintf(entry, "\n");
4472     }
4473 }
4474
4475 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4476 {
4477     while (*cert_sign) {
4478         sslproxy_cert_sign *cs = *cert_sign;
4479         *cert_sign = cs->next;
4480
4481         if (cs->aclList)
4482             aclDestroyAclList(&cs->aclList);
4483
4484         safe_free(cs);
4485     }
4486 }
4487
4488 class sslBumpCfgRr: public ::RegisteredRunner
4489 {
4490 public:
4491     static Ssl::BumpMode lastDeprecatedRule;
4492     /* RegisteredRunner API */
4493     virtual void run(const RunnerRegistry &);
4494 };
4495
4496 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4497
4498 RunnerRegistrationEntry(rrFinalizeConfig, sslBumpCfgRr);
4499
4500 void sslBumpCfgRr::run(const RunnerRegistry &r)
4501 {
4502     if (lastDeprecatedRule != Ssl::bumpEnd) {
4503         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4504         static char buf[1024];
4505         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4506             strcpy(buf, "ssl_bump deny all");
4507             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4508                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4509                    "must not use implicit rules. Update your ssl_bump rules.");
4510         } else {
4511             strcpy(buf, "ssl_bump allow all");
4512             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4513                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4514                    "inferior to the newer server-first bumping mode. New ssl_bump"
4515                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4516         }
4517         parse_line(buf);
4518     }
4519 }
4520
4521 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4522 {
4523     typedef const char *BumpCfgStyle;
4524     BumpCfgStyle bcsNone = NULL;
4525     BumpCfgStyle bcsNew = "new client/server-first/none";
4526     BumpCfgStyle bcsOld = "deprecated allow/deny";
4527     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4528     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4529     char *bm;
4530     if ((bm = strtok(NULL, w_space)) == NULL) {
4531         self_destruct();
4532         return;
4533     }
4534
4535     // if this is the first rule proccessed
4536     if (*ssl_bump == NULL) {
4537         bumpCfgStyleLast = bcsNone;
4538         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4539     }
4540
4541     acl_access *A = new acl_access;
4542     A->allow = allow_t(ACCESS_ALLOWED);
4543
4544     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4545         A->allow.kind = Ssl::bumpClientFirst;
4546         bumpCfgStyleNow = bcsNew;
4547     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4548         A->allow.kind = Ssl::bumpServerFirst;
4549         bumpCfgStyleNow = bcsNew;
4550     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4551         A->allow.kind = Ssl::bumpNone;
4552         bumpCfgStyleNow = bcsNew;
4553     } else if (strcmp(bm, "allow") == 0) {
4554         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4555                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4556                "is usually inferior to the newer server-first "
4557                "bumping mode. Update your ssl_bump rules.");
4558         A->allow.kind = Ssl::bumpClientFirst;
4559         bumpCfgStyleNow = bcsOld;
4560         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4561     } else if (strcmp(bm, "deny") == 0) {
4562         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4563                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4564                "your ssl_bump rules.");
4565         A->allow.kind = Ssl::bumpNone;
4566         bumpCfgStyleNow = bcsOld;
4567         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4568     } else {
4569         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4570         self_destruct();
4571         return;
4572     }
4573
4574     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4575         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4576                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4577         self_destruct();
4578         return;
4579     }
4580
4581     bumpCfgStyleLast = bumpCfgStyleNow;
4582
4583     aclParseAclList(LegacyParser, &A->aclList);
4584
4585     acl_access *B, **T;
4586     for (B = *ssl_bump, T = ssl_bump; B; T = &B->next, B = B->next);
4587     *T = A;
4588 }
4589
4590 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4591 {
4592     acl_access *sb;
4593     for (sb = ssl_bump; sb != NULL; sb = sb->next) {
4594         storeAppendPrintf(entry, "%s ", name);
4595         storeAppendPrintf(entry, "%s ", Ssl::bumpMode(sb->allow.kind));
4596         if (sb->aclList)
4597             dump_acl_list(entry, sb->aclList);
4598         storeAppendPrintf(entry, "\n");
4599     }
4600 }
4601
4602 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4603 {
4604     free_acl_access(ssl_bump);
4605 }
4606
4607 #endif
4608
4609 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4610 {
4611     if (!headers)
4612         return;
4613
4614     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4615         storeAppendPrintf(entry, "%s ", hwa->fieldName.c_str());
4616         storeAppendPrintf(entry, "%s ", hwa->fieldValue.c_str());
4617         if (hwa->aclList)
4618             dump_acl_list(entry, hwa->aclList);
4619         storeAppendPrintf(entry, "\n");
4620     }
4621 }
4622
4623 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4624 {
4625     char *fn;
4626     if (!*headers) {
4627         *headers = new HeaderWithAclList;
4628     }
4629     if ((fn = strtok(NULL, w_space)) == NULL) {
4630         self_destruct();
4631         return;
4632     }
4633     HeaderWithAcl hwa;
4634     hwa.fieldName = fn;
4635     hwa.fieldId = httpHeaderIdByNameDef(fn, strlen(fn));
4636     if (hwa.fieldId == HDR_BAD_HDR)
4637         hwa.fieldId = HDR_OTHER;
4638
4639     String buf;
4640     bool wasQuoted;
4641     ConfigParser::ParseQuotedString(&buf, &wasQuoted);
4642     hwa.fieldValue = buf.termedBuf();
4643     hwa.quoted = wasQuoted;
4644     if (hwa.quoted) {
4645         Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4646         if (!nlf->parse(hwa.fieldValue.c_str())) {
4647             self_destruct();
4648             return;
4649         }
4650         hwa.valueFormat = nlf;
4651     }
4652     aclParseAclList(LegacyParser, &hwa.aclList);
4653     (*headers)->push_back(hwa);
4654 }
4655
4656 static void free_HeaderWithAclList(HeaderWithAclList **header)
4657 {
4658     if (!(*header))
4659         return;
4660
4661     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4662         if (hwa->aclList)
4663             aclDestroyAclList(&hwa->aclList);
4664
4665         if (hwa->valueFormat) {
4666             delete hwa->valueFormat;
4667             hwa->valueFormat = NULL;
4668         }
4669     }
4670     delete *header;
4671     *header = NULL;
4672 }