src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclAddress.h"
  14 #include "acl/AclDenyInfoList.h"
  15 #include "acl/AclNameList.h"
  16 #include "acl/AclSizeLimit.h"
  17 #include "acl/Gadgets.h"
  18 #include "acl/MethodData.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "AuthReg.h"
  23 #include "base/RunnersRegistry.h"
  24 #include "cache_cf.h"
  25 #include "CachePeer.h"
  26 #include "CachePeerDomainList.h"
  27 #include "ConfigParser.h"
  28 #include "CpuAffinityMap.h"
  29 #include "DiskIO/DiskIOModule.h"
  30 #include "eui/Config.h"
  31 #include "ExternalACL.h"
  32 #include "format/Format.h"
  33 #include "ftp/Elements.h"
  34 #include "globals.h"
  35 #include "HttpHeaderTools.h"
  36 #include "ident/Config.h"
  37 #include "ip/Intercept.h"
  38 #include "ip/QosConfig.h"
  39 #include "ip/tools.h"
  40 #include "ipc/Kids.h"
  41 #include "log/Config.h"
  42 #include "log/CustomLog.h"
  43 #include "MemBuf.h"
  44 #include "mgr/ActionPasswordList.h"
  45 #include "mgr/Registration.h"
  46 #include "neighbors.h"
  47 #include "NeighborTypeDomainList.h"
  48 #include "Parsing.h"
  49 #include "pconn.h"
  50 #include "PeerDigest.h"
  51 #include "PeerPoolMgr.h"
  52 #include "redirect.h"
  53 #include "RefreshPattern.h"
  54 #include "rfc1738.h"
  55 #include "SBufList.h"
  56 #include "SquidConfig.h"
  57 #include "SquidString.h"
  58 #include "ssl/ProxyCerts.h"
  59 #include "Store.h"
  60 #include "StoreFileSystem.h"
  61 #include "SwapDir.h"
  62 #include "tools.h"
  63 #include "util.h"
  64 #include "wordlist.h"
  65 /* wccp2 has its own conditional definitions */
  66 #include "wccp2.h"
  67 #if USE_ADAPTATION
  68 #include "adaptation/Config.h"
  69 #endif
  70 #if ICAP_CLIENT
  71 #include "adaptation/icap/Config.h"
  72 #endif
  73 #if USE_ECAP
  74 #include "adaptation/ecap/Config.h"
  75 #endif
  76 #if USE_OPENSSL
  77 #include "ssl/Config.h"
  78 #include "ssl/support.h"
  79 #endif
  80 #if USE_AUTH
  81 #include "auth/Config.h"
  82 #include "auth/Scheme.h"
  83 #endif
  84 #if USE_SQUID_ESI
  85 #include "esi/Parser.h"
  86 #endif
  87 #if SQUID_SNMP
  88 #include "snmp.h"
  89 #endif
  90
  91 #if HAVE_GLOB_H
  92 #include <glob.h>
  93 #endif
  94 #include <limits>
  95 #include <list>
  96 #if HAVE_PWD_H
  97 #include <pwd.h>
  98 #endif
  99 #if HAVE_GRP_H
 100 #include <grp.h>
 101 #endif
 102 #if HAVE_SYS_STAT_H
 103 #include <sys/stat.h>
 104 #endif
 105
 106 #if USE_OPENSSL
 107 #include "ssl/gadgets.h"
 108 #endif
 109
 110 #if USE_ADAPTATION
 111 static void parse_adaptation_service_set_type();
 112 static void parse_adaptation_service_chain_type();
 113 static void parse_adaptation_access_type();
 114 #endif
 115
 116 #if ICAP_CLIENT
 117 static void parse_icap_service_type(Adaptation::Icap::Config *);
 118 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 119 static void free_icap_service_type(Adaptation::Icap::Config *);
 120 static void parse_icap_class_type();
 121 static void parse_icap_access_type();
 122
 123 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 124 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 125 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 126 #endif
 127
 128 #if USE_ECAP
 129 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 130 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 131 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 132 #endif
 133
 134 static peer_t parseNeighborType(const char *s);
 135
 136 CBDATA_TYPE(CachePeer);
 137
 138 static const char *const T_MILLISECOND_STR = "millisecond";
 139 static const char *const T_SECOND_STR = "second";
 140 static const char *const T_MINUTE_STR = "minute";
 141 static const char *const T_HOUR_STR = "hour";
 142 static const char *const T_DAY_STR = "day";
 143 static const char *const T_WEEK_STR = "week";
 144 static const char *const T_FORTNIGHT_STR = "fortnight";
 145 static const char *const T_MONTH_STR = "month";
 146 static const char *const T_YEAR_STR = "year";
 147 static const char *const T_DECADE_STR = "decade";
 148
 149 static const char *const B_BYTES_STR = "bytes";
 150 static const char *const B_KBYTES_STR = "KB";
 151 static const char *const B_MBYTES_STR = "MB";
 152 static const char *const B_GBYTES_STR = "GB";
 153
 154 static const char *const list_sep = ", \t\n\r";
 155
 156 static void parse_access_log(CustomLog ** customlog_definitions);
 157 static int check_null_access_log(CustomLog *customlog_definitions);
 158 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 159 static void free_access_log(CustomLog ** definitions);
 160 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 161
 162 static void configDoConfigure(void);
 163 static void parse_refreshpattern(RefreshPattern **);
 164 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 165 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 166 static void parse_u_short(unsigned short * var);
 167 static void parse_string(char **);
 168 static void default_all(void);
 169 static void defaults_if_none(void);
 170 static void defaults_postscriptum(void);
 171 static int parse_line(char *);
 172 static void parse_obsolete(const char *);
 173 static void parseBytesLine(size_t * bptr, const char *units);
 174 #if USE_OPENSSL
 175 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 176 #endif
 177 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 178 static size_t parseBytesUnits(const char *unit);
 179 static void free_all(void);
 180 void requirePathnameExists(const char *name, const char *path);
 181 static OBJH dump_config;
 182 #if USE_HTTP_VIOLATIONS
 183 static void free_HeaderManglers(HeaderManglers **pm);
 184 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 185 static void parse_http_header_access(HeaderManglers **manglers);
 186 #define free_http_header_access free_HeaderManglers
 187 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 188 static void parse_http_header_replace(HeaderManglers **manglers);
 189 #define free_http_header_replace free_HeaderManglers
 190 #endif
 191 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 192 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 193 static void free_HeaderWithAclList(HeaderWithAclList **header);
 194 static void parse_note(Notes *);
 195 static void dump_note(StoreEntry *, const char *, Notes &);
 196 static void free_note(Notes *);
 197 static void parse_denyinfo(AclDenyInfoList ** var);
 198 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 199 static void free_denyinfo(AclDenyInfoList ** var);
 200
 201 #if USE_WCCPv2
 202 static void parse_IpAddress_list(Ip::Address_list **);
 203 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 204 static void free_IpAddress_list(Ip::Address_list **);
 205 #if CURRENTLY_UNUSED
 206 static int check_null_IpAddress_list(const Ip::Address_list *);
 207 #endif /* CURRENTLY_UNUSED */
 208 #endif /* USE_WCCPv2 */
 209
 210 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 211 #define parse_PortCfg(l) parsePortCfg((l), token)
 212 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 213 #define free_PortCfg(h)  *(h)=NULL
 214
 215 #if USE_OPENSSL
 216 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 217 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 218 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 219 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 220 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 221 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 222 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 223 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 224 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 225 #endif /* USE_OPENSSL */
 226
 227 static void parse_ftp_epsv(acl_access **ftp_epsv);
 228 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 229 static void free_ftp_epsv(acl_access **ftp_epsv);
 230
 231 static void parse_b_size_t(size_t * var);
 232 static void parse_b_int64_t(int64_t * var);
 233
 234 static bool parseNamedIntList(const char *data, const String &name, std::vector<int> &list);
 235
 236 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 237 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 238 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 239
 240 static void parse_url_rewrite_timeout(SquidConfig *);
 241 static void dump_url_rewrite_timeout(StoreEntry *, const char *, SquidConfig &);
 242 static void free_url_rewrite_timeout(SquidConfig *);
 243
 244 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 245
 246 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 247 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 248 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 249
 250 /*
 251  * LegacyParser is a parser for legacy code that uses the global
 252  * approach.  This is static so that it is only exposed to cache_cf.
 253  * Other modules needing access to a ConfigParser should have it
 254  * provided to them in their parserFOO methods.
 255  */
 256 static ConfigParser LegacyParser = ConfigParser();
 257
 258 void
 259 self_destruct(void)
 260 {
 261     LegacyParser.destruct();
 262 }
 263
 264 static void
 265 SetConfigFilename(char const *file_name, bool is_pipe)
 266 {
 267     if (is_pipe)
 268         cfg_filename = file_name + 1;
 269     else
 270         cfg_filename = file_name;
 271 }
 272
 273 static const char*
 274 skip_ws(const char* s)
 275 {
 276     while (xisspace(*s))
 277         ++s;
 278
 279     return s;
 280 }
 281
 282 static int
 283 parseManyConfigFiles(char* files, int depth)
 284 {
 285     int error_count = 0;
 286     char* saveptr = NULL;
 287 #if HAVE_GLOB
 288     char *path;
 289     glob_t globbuf;
 290     int i;
 291     memset(&globbuf, 0, sizeof(globbuf));
 292     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 293         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 294             fatalf("Unable to find configuration file: %s: %s",
 295                    path, xstrerror());
 296         }
 297     }
 298     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 299         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 300     }
 301     globfree(&globbuf);
 302 #else
 303     char* file = strwordtok(files, &saveptr);
 304     while (file != NULL) {
 305         error_count += parseOneConfigFile(file, depth);
 306         file = strwordtok(NULL, &saveptr);
 307     }
 308 #endif /* HAVE_GLOB */
 309     return error_count;
 310 }
 311
 312 static void
 313 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 314 {
 315     assert(str != NULL);
 316     assert(newSubstr != NULL);
 317
 318     unsigned newSubstrLen = strlen(newSubstr);
 319     if (newSubstrLen > substrLen)
 320         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 321
 322     // move tail part including zero
 323     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 324     // copy new substring in place
 325     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 326
 327     len = strlen(str);
 328 }
 329
 330 static void
 331 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 332 {
 333     assert(line != NULL);
 334     assert(macroName != NULL);
 335     assert(substStr != NULL);
 336     unsigned macroNameLen = strlen(macroName);
 337     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 338         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 339 }
 340
 341 static void
 342 ProcessMacros(char*& line, int& len)
 343 {
 344     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 345     SubstituteMacro(line, len, "${process_name}", TheKidName);
 346     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 347 }
 348
 349 static void
 350 trim_trailing_ws(char* str)
 351 {
 352     assert(str != NULL);
 353     unsigned i = strlen(str);
 354     while ((i > 0) && xisspace(str[i - 1]))
 355         --i;
 356     str[i] = '\0';
 357 }
 358
 359 static const char*
 360 FindStatement(const char* line, const char* statement)
 361 {
 362     assert(line != NULL);
 363     assert(statement != NULL);
 364
 365     const char* str = skip_ws(line);
 366     unsigned len = strlen(statement);
 367     if (strncmp(str, statement, len) == 0) {
 368         str += len;
 369         if (*str == '\0')
 370             return str;
 371         else if (xisspace(*str))
 372             return skip_ws(str);
 373     }
 374
 375     return NULL;
 376 }
 377
 378 static bool
 379 StrToInt(const char* str, long& number)
 380 {
 381     assert(str != NULL);
 382
 383     char* end;
 384     number = strtol(str, &end, 0);
 385
 386     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 387 }
 388
 389 static bool
 390 EvalBoolExpr(const char* expr)
 391 {
 392     assert(expr != NULL);
 393     if (strcmp(expr, "true") == 0) {
 394         return true;
 395     } else if (strcmp(expr, "false") == 0) {
 396         return false;
 397     } else if (const char* equation = strchr(expr, '=')) {
 398         const char* rvalue = skip_ws(equation + 1);
 399         char* lvalue = (char*)xmalloc(equation - expr + 1);
 400         xstrncpy(lvalue, expr, equation - expr + 1);
 401         trim_trailing_ws(lvalue);
 402
 403         long number1;
 404         if (!StrToInt(lvalue, number1))
 405             fatalf("String is not a integer number: '%s'\n", lvalue);
 406         long number2;
 407         if (!StrToInt(rvalue, number2))
 408             fatalf("String is not a integer number: '%s'\n", rvalue);
 409
 410         xfree(lvalue);
 411         return number1 == number2;
 412     }
 413     fatalf("Unable to evaluate expression '%s'\n", expr);
 414     return false; // this place cannot be reached
 415 }
 416
 417 static int
 418 parseOneConfigFile(const char *file_name, unsigned int depth)
 419 {
 420     FILE *fp = NULL;
 421     const char *orig_cfg_filename = cfg_filename;
 422     const int orig_config_lineno = config_lineno;
 423     char *token = NULL;
 424     char *tmp_line = NULL;
 425     int tmp_line_len = 0;
 426     int err_count = 0;
 427     int is_pipe = 0;
 428
 429     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 430     if (depth > 16) {
 431         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 432         return 1;
 433     }
 434
 435     if (file_name[0] == '!' || file_name[0] == '|') {
 436         fp = popen(file_name + 1, "r");
 437         is_pipe = 1;
 438     } else {
 439         fp = fopen(file_name, "r");
 440     }
 441
 442     if (fp == NULL)
 443         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerror());
 444
 445 #if _SQUID_WINDOWS_
 446     setmode(fileno(fp), O_TEXT);
 447 #endif
 448
 449     SetConfigFilename(file_name, bool(is_pipe));
 450
 451     memset(config_input_line, '\0', BUFSIZ);
 452
 453     config_lineno = 0;
 454
 455     std::vector<bool> if_states;
 456     while (fgets(config_input_line, BUFSIZ, fp)) {
 457         ++config_lineno;
 458
 459         if ((token = strchr(config_input_line, '\n')))
 460             *token = '\0';
 461
 462         if ((token = strchr(config_input_line, '\r')))
 463             *token = '\0';
 464
 465         // strip any prefix whitespace off the line.
 466         const char *p = skip_ws(config_input_line);
 467         if (config_input_line != p)
 468             memmove(config_input_line, p, strlen(p)+1);
 469
 470         if (strncmp(config_input_line, "#line ", 6) == 0) {
 471             static char new_file_name[1024];
 472             static char *file;
 473             static char new_lineno;
 474             token = config_input_line + 6;
 475             new_lineno = strtol(token, &file, 0) - 1;
 476
 477             if (file == token)
 478                 continue;   /* Not a valid #line directive, may be a comment */
 479
 480             while (*file && xisspace((unsigned char) *file))
 481                 ++file;
 482
 483             if (*file) {
 484                 if (*file != '"')
 485                     continue;   /* Not a valid #line directive, may be a comment */
 486
 487                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 488
 489                 if ((token = strchr(new_file_name, '"')))
 490                     *token = '\0';
 491
 492                 SetConfigFilename(new_file_name, false);
 493             }
 494
 495             config_lineno = new_lineno;
 496         }
 497
 498         if (config_input_line[0] == '#')
 499             continue;
 500
 501         if (config_input_line[0] == '\0')
 502             continue;
 503
 504         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 505
 506         size_t append_len = strlen(append);
 507
 508         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 509
 510         strcpy(tmp_line + tmp_line_len, append);
 511
 512         tmp_line_len += append_len;
 513
 514         if (tmp_line[tmp_line_len-1] == '\\') {
 515             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 516             tmp_line[--tmp_line_len] = '\0';
 517             continue;
 518         }
 519
 520         trim_trailing_ws(tmp_line);
 521         ProcessMacros(tmp_line, tmp_line_len);
 522         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 523
 524         if (const char* expr = FindStatement(tmp_line, "if")) {
 525             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 526         } else if (FindStatement(tmp_line, "endif")) {
 527             if (!if_states.empty())
 528                 if_states.pop_back(); // remove last if-statement meaning
 529             else
 530                 fatalf("'endif' without 'if'\n");
 531         } else if (FindStatement(tmp_line, "else")) {
 532             if (!if_states.empty())
 533                 if_states.back() = !if_states.back();
 534             else
 535                 fatalf("'else' without 'if'\n");
 536         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 537             /* Handle includes here */
 538             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 539                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 540             } else if (!parse_line(tmp_line)) {
 541                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 542                 ++err_count;
 543             }
 544         }
 545
 546         safe_free(tmp_line);
 547         tmp_line_len = 0;
 548
 549     }
 550     if (!if_states.empty())
 551         fatalf("if-statement without 'endif'\n");
 552
 553     if (is_pipe) {
 554         int ret = pclose(fp);
 555
 556         if (ret != 0)
 557             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 558     } else {
 559         fclose(fp);
 560     }
 561
 562     SetConfigFilename(orig_cfg_filename, false);
 563     config_lineno = orig_config_lineno;
 564
 565     xfree(tmp_line);
 566     return err_count;
 567 }
 568
 569 int
 570 parseConfigFile(const char *file_name)
 571 {
 572     int err_count = 0;
 573
 574     debugs(5, 4, HERE);
 575
 576     configFreeMemory();
 577
 578     ACLMethodData::ThePurgeCount = 0;
 579     default_all();
 580
 581     err_count = parseOneConfigFile(file_name, 0);
 582
 583     defaults_if_none();
 584
 585     defaults_postscriptum();
 586
 587     /*
 588      * We must call configDoConfigure() before leave_suid() because
 589      * configDoConfigure() is where we turn username strings into
 590      * uid values.
 591      */
 592     configDoConfigure();
 593
 594     if (!Config.chroot_dir) {
 595         leave_suid();
 596         setUmask(Config.umask);
 597         _db_init(Debug::cache_log, Debug::debugOptions);
 598         enter_suid();
 599     }
 600
 601     if (opt_send_signal == -1) {
 602         Mgr::RegisterAction("config",
 603                             "Current Squid Configuration",
 604                             dump_config,
 605                             1, 1);
 606     }
 607
 608     return err_count;
 609 }
 610
 611 static void
 612 configDoConfigure(void)
 613 {
 614     memset(&Config2, '\0', sizeof(SquidConfig2));
 615     /* init memory as early as possible */
 616     memConfigure();
 617     /* Sanity checks */
 618
 619     Config.cacheSwap.n_strands = 0; // no diskers by default
 620     if (Config.cacheSwap.swapDirs == NULL) {
 621         /* Memory-only cache probably in effect. */
 622         /* turn off the cache rebuild delays... */
 623         StoreController::store_dirs_rebuilding = 0;
 624     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 625         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 626             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 627             if (sd->needsDiskStrand())
 628                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 629         }
 630     }
 631
 632     if (Debug::rotateNumber < 0) {
 633         Debug::rotateNumber = Config.Log.rotateNumber;
 634     }
 635
 636 #if SIZEOF_OFF_T <= 4
 637     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 638         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 639         Config.Store.maxObjectSize = 0x7FFF0000;
 640     }
 641 #endif
 642
 643     if (Config.Announce.period > 0) {
 644         Config.onoff.announce = 1;
 645     } else {
 646         Config.Announce.period = 86400 * 365;   /* one year */
 647         Config.onoff.announce = 0;
 648     }
 649
 650     if (Config.onoff.httpd_suppress_version_string)
 651         visible_appname_string = (char *)appname_string;
 652     else
 653         visible_appname_string = (char const *)APP_FULLNAME;
 654
 655     if (Config.Program.redirect) {
 656         if (Config.redirectChildren.n_max < 1) {
 657             Config.redirectChildren.n_max = 0;
 658             wordlistDestroy(&Config.Program.redirect);
 659         }
 660     }
 661
 662     if (Config.Program.store_id) {
 663         if (Config.storeIdChildren.n_max < 1) {
 664             Config.storeIdChildren.n_max = 0;
 665             wordlistDestroy(&Config.Program.store_id);
 666         }
 667     }
 668
 669     if (Config.appendDomain)
 670         if (*Config.appendDomain != '.')
 671             fatal("append_domain must begin with a '.'");
 672
 673     if (Config.errHtmlText == NULL)
 674         Config.errHtmlText = xstrdup(null_string);
 675
 676 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 677     if (Config.max_filedescriptors > 0) {
 678         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 679     }
 680 #elif USE_SELECT || USE_SELECT_WIN32
 681     if (Config.max_filedescriptors > FD_SETSIZE) {
 682         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 683     }
 684 #endif
 685
 686     storeConfigure();
 687
 688     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 689              uniqueHostname(),
 690              visible_appname_string);
 691
 692     /*
 693      * the extra space is for loop detection in client_side.c -- we search
 694      * for substrings in the Via header.
 695      */
 696     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 697              uniqueHostname(),
 698              visible_appname_string);
 699
 700     /* Use visible_hostname as default surrogate_id */
 701     if (!Config.Accel.surrogate_id) {
 702         const char *t = getMyHostname();
 703         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 704     }
 705
 706     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 707         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 708
 709     if (Config.appendDomain)
 710         Config.appendDomainLen = strlen(Config.appendDomain);
 711     else
 712         Config.appendDomainLen = 0;
 713
 714     if (Config.connect_retries > 10) {
 715         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 716         Config.connect_retries = 10;
 717     }
 718
 719     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 720 #if USE_UNLINKD
 721
 722     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 723 #endif
 724     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 725     if (Config.Program.redirect)
 726         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 727
 728     if (Config.Program.store_id)
 729         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 730
 731     requirePathnameExists("Icon Directory", Config.icons.directory);
 732
 733     if (Config.errorDirectory)
 734         requirePathnameExists("Error Directory", Config.errorDirectory);
 735
 736 #if USE_HTTP_VIOLATIONS
 737
 738     {
 739         const RefreshPattern *R;
 740
 741         for (R = Config.Refresh; R; R = R->next) {
 742             if (!R->flags.override_expire)
 743                 continue;
 744
 745             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 746
 747             break;
 748         }
 749
 750         for (R = Config.Refresh; R; R = R->next) {
 751             if (!R->flags.override_lastmod)
 752                 continue;
 753
 754             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 755
 756             break;
 757         }
 758
 759         for (R = Config.Refresh; R; R = R->next) {
 760             if (!R->flags.reload_into_ims)
 761                 continue;
 762
 763             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 764
 765             break;
 766         }
 767
 768         for (R = Config.Refresh; R; R = R->next) {
 769             if (!R->flags.ignore_reload)
 770                 continue;
 771
 772             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 773
 774             break;
 775         }
 776
 777         for (R = Config.Refresh; R; R = R->next) {
 778             if (!R->flags.ignore_no_store)
 779                 continue;
 780
 781             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 782
 783             break;
 784         }
 785
 786         for (R = Config.Refresh; R; R = R->next) {
 787             if (!R->flags.ignore_must_revalidate)
 788                 continue;
 789             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-must-revalidate' in 'refresh_pattern' violates HTTP");
 790             break;
 791         }
 792
 793         for (R = Config.Refresh; R; R = R->next) {
 794             if (!R->flags.ignore_private)
 795                 continue;
 796
 797             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 798
 799             break;
 800         }
 801
 802         for (R = Config.Refresh; R; R = R->next) {
 803             if (!R->flags.ignore_auth)
 804                 continue;
 805
 806             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-auth' in 'refresh_pattern' violates HTTP");
 807
 808             break;
 809         }
 810
 811     }
 812 #endif
 813 #if !USE_HTTP_VIOLATIONS
 814     Config.onoff.via = 1;
 815 #else
 816
 817     if (!Config.onoff.via)
 818         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 819
 820 #endif
 821
 822     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 823     // TODO: replace with a dedicated "purge" ACL option?
 824     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 825
 826     Config2.onoff.mangle_request_headers = (Config.request_header_access != NULL);
 827
 828     if (geteuid() == 0) {
 829         if (NULL != Config.effectiveUser) {
 830
 831             struct passwd *pwd = getpwnam(Config.effectiveUser);
 832
 833             if (NULL == pwd) {
 834                 /*
 835                  * Andres Kroonmaa <andre@online.ee>:
 836                  * Some getpwnam() implementations (Solaris?) require
 837                  * an available FD < 256 for opening a FILE* to the
 838                  * passwd file.
 839                  * DW:
 840                  * This should be safe at startup, but might still fail
 841                  * during reconfigure.
 842                  */
 843                 fatalf("getpwnam failed to find userid for effective user '%s'",
 844                        Config.effectiveUser);
 845                 return;
 846             }
 847
 848             Config2.effectiveUserID = pwd->pw_uid;
 849
 850             Config2.effectiveGroupID = pwd->pw_gid;
 851
 852 #if HAVE_PUTENV
 853             if (pwd->pw_dir && *pwd->pw_dir) {
 854                 // putenv() leaks by design; avoid leaks when nothing changes
 855                 static SBuf lastDir;
 856                 if (lastDir.isEmpty() || !lastDir.cmp(pwd->pw_dir)) {
 857                     lastDir = pwd->pw_dir;
 858                     int len = strlen(pwd->pw_dir) + 6;
 859                     char *env_str = (char *)xcalloc(len, 1);
 860                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 861                     putenv(env_str);
 862                 }
 863             }
 864 #endif
 865         }
 866     } else {
 867         Config2.effectiveUserID = geteuid();
 868         Config2.effectiveGroupID = getegid();
 869     }
 870
 871     if (NULL != Config.effectiveGroup) {
 872
 873         struct group *grp = getgrnam(Config.effectiveGroup);
 874
 875         if (NULL == grp) {
 876             fatalf("getgrnam failed to find groupid for effective group '%s'",
 877                    Config.effectiveGroup);
 878             return;
 879         }
 880
 881         Config2.effectiveGroupID = grp->gr_gid;
 882     }
 883
 884 #if USE_OPENSSL
 885
 886     debugs(3, DBG_IMPORTANT, "Initializing https proxy context");
 887
 888     Config.ssl_client.sslContext = sslCreateClientContext(Config.ssl_client.cert, Config.ssl_client.key, Config.ssl_client.version, Config.ssl_client.cipher, Config.ssl_client.options, Config.ssl_client.flags, Config.ssl_client.cafile, Config.ssl_client.capath, Config.ssl_client.crlfile);
 889
 890     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 891         if (p->use_ssl) {
 892             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " SSL context");
 893             p->sslContext = sslCreateClientContext(p->sslcert, p->sslkey, p->sslversion, p->sslcipher, p->ssloptions, p->sslflags, p->sslcafile, p->sslcapath, p->sslcrlfile);
 894         }
 895     }
 896
 897     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 898         if (!s->flags.tunnelSslBumping)
 899             continue;
 900
 901         debugs(3, DBG_IMPORTANT, "Initializing http_port " << s->s << " SSL context");
 902         s->configureSslServerContext();
 903     }
 904
 905     for (AnyP::PortCfgPointer s = HttpsPortList; s != NULL; s = s->next) {
 906         debugs(3, DBG_IMPORTANT, "Initializing https_port " << s->s << " SSL context");
 907         s->configureSslServerContext();
 908     }
 909
 910 #endif
 911
 912     // prevent infinite fetch loops in the request parser
 913     // due to buffer full but not enough data recived to finish parse
 914     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 915         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 916                " Change client_request_buffer_max or request_header_max_size limits.",
 917                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 918     }
 919
 920     /*
 921      * Disable client side request pipelining if client_persistent_connections OFF.
 922      * Waste of resources queueing any pipelined requests when the first will close the connection.
 923      */
 924     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 925         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 926                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 927         Config.pipeline_max_prefetch = 0;
 928     }
 929
 930 #if USE_AUTH
 931     /*
 932      * disable client side request pipelining. There is a race with
 933      * Negotiate and NTLM when the client sends a second request on an
 934      * connection before the authenticate challenge is sent. With
 935      * pipelining OFF, the client may fail to authenticate, but squid's
 936      * state will be preserved.
 937      */
 938     if (Config.pipeline_max_prefetch > 0) {
 939         Auth::Config *nego = Auth::Config::Find("Negotiate");
 940         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 941         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 942             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 943             Config.pipeline_max_prefetch = 0;
 944         }
 945     }
 946 #endif
 947 }
 948
 949 /** Parse a line containing an obsolete directive.
 950  * To upgrade it where possible instead of just "Bungled config" for
 951  * directives which cannot be marked as simply aliases of the some name.
 952  * For example if the parameter order and content has changed.
 953  * Or if the directive has been completely removed.
 954  */
 955 void
 956 parse_obsolete(const char *name)
 957 {
 958     // Directives which have been radically changed rather than removed
 959     if (!strcmp(name, "url_rewrite_concurrency")) {
 960         int cval;
 961         parse_int(&cval);
 962         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 963         Config.redirectChildren.concurrency = cval;
 964     }
 965
 966     if (!strcmp(name, "log_access"))
 967         self_destruct();
 968
 969     if (!strcmp(name, "log_icap"))
 970         self_destruct();
 971
 972     if (!strcmp(name, "ignore_ims_on_miss")) {
 973         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 974         // than the 2.7 directive. We need to parse and invert the configured value.
 975         int temp = 0;
 976         parse_onoff(&temp);
 977         Config.onoff.cache_miss_revalidate = !temp;
 978     }
 979 }
 980
 981 /* Parse a time specification from the config file.  Store the
 982  * result in 'tptr', after converting it to 'units' */
 983 static void
 984 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
 985 {
 986     char *token;
 987     double d;
 988     time_msec_t m;
 989     time_msec_t u;
 990
 991     if ((u = parseTimeUnits(units, allowMsec)) == 0)
 992         self_destruct();
 993
 994     if ((token = ConfigParser::NextToken()) == NULL)
 995         self_destruct();
 996
 997     d = xatof(token);
 998
 999     m = u;          /* default to 'units' if none specified */
1000
1001     bool hasUnits = false;
1002     if (0 == d)
1003         (void) 0;
1004     else if ((token = ConfigParser::PeekAtToken()) == NULL)
1005         (void) 0;
1006     else if ((m = parseTimeUnits(token, allowMsec)) == 0) {
1007         if (!expectMoreArguments)
1008             self_destruct();
1009     } else { //pop the token
1010         (void)ConfigParser::NextToken();
1011         hasUnits = true;
1012     }
1013     if (!hasUnits)
1014         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1015                config_input_line << "', assuming " <<
1016                d << " " << units  );
1017
1018     *tptr = static_cast<time_msec_t>(m * d);
1019
1020     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1021         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1022                d << " " << token << ": integer overflow (time_msec_t).");
1023         self_destruct();
1024     }
1025 }
1026
1027 static uint64_t
1028 parseTimeUnits(const char *unit, bool allowMsec)
1029 {
1030     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1031         return 1;
1032
1033     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1034         return 1000;
1035
1036     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1037         return 60 * 1000;
1038
1039     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1040         return 3600 * 1000;
1041
1042     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1043         return 86400 * 1000;
1044
1045     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1046         return 86400 * 7 * 1000;
1047
1048     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1049         return 86400 * 14 * 1000;
1050
1051     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1052         return static_cast<uint64_t>(86400) * 30 * 1000;
1053
1054     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1055         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1056
1057     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1058         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1059
1060     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1061
1062     return 0;
1063 }
1064
1065 static void
1066 parseBytesLine64(int64_t * bptr, const char *units)
1067 {
1068     char *token;
1069     double d;
1070     int64_t m;
1071     int64_t u;
1072
1073     if ((u = parseBytesUnits(units)) == 0) {
1074         self_destruct();
1075         return;
1076     }
1077
1078     if ((token = ConfigParser::NextToken()) == NULL) {
1079         self_destruct();
1080         return;
1081     }
1082
1083     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1084         *bptr = -1;
1085         return;
1086     }
1087
1088     d = xatof(token);
1089
1090     m = u;          /* default to 'units' if none specified */
1091
1092     if (0.0 == d)
1093         (void) 0;
1094     else if ((token = ConfigParser::NextToken()) == NULL)
1095         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1096                config_input_line << "', assuming " <<
1097                d << " " <<  units  );
1098     else if ((m = parseBytesUnits(token)) == 0) {
1099         self_destruct();
1100         return;
1101     }
1102
1103     *bptr = static_cast<int64_t>(m * d / u);
1104
1105     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1106         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1107                d << " " << token << ": integer overflow (int64_t).");
1108         self_destruct();
1109     }
1110 }
1111
1112 static void
1113 parseBytesLine(size_t * bptr, const char *units)
1114 {
1115     char *token;
1116     double d;
1117     int m;
1118     int u;
1119
1120     if ((u = parseBytesUnits(units)) == 0) {
1121         self_destruct();
1122         return;
1123     }
1124
1125     if ((token = ConfigParser::NextToken()) == NULL) {
1126         self_destruct();
1127         return;
1128     }
1129
1130     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1131         *bptr = static_cast<size_t>(-1);
1132         return;
1133     }
1134
1135     d = xatof(token);
1136
1137     m = u;          /* default to 'units' if none specified */
1138
1139     if (0.0 == d)
1140         (void) 0;
1141     else if ((token = ConfigParser::NextToken()) == NULL)
1142         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1143                config_input_line << "', assuming " <<
1144                d << " " <<  units  );
1145     else if ((m = parseBytesUnits(token)) == 0) {
1146         self_destruct();
1147         return;
1148     }
1149
1150     *bptr = static_cast<size_t>(m * d / u);
1151
1152     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1153         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1154                d << " " << token << ": integer overflow (size_t).");
1155         self_destruct();
1156     }
1157 }
1158
1159 static void
1160 parseBytesLineSigned(ssize_t * bptr, const char *units)
1161 {
1162     char *token;
1163     double d;
1164     int m;
1165     int u;
1166
1167     if ((u = parseBytesUnits(units)) == 0) {
1168         self_destruct();
1169         return;
1170     }
1171
1172     if ((token = ConfigParser::NextToken()) == NULL) {
1173         self_destruct();
1174         return;
1175     }
1176
1177     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1178         *bptr = -1;
1179         return;
1180     }
1181
1182     d = xatof(token);
1183
1184     m = u;          /* default to 'units' if none specified */
1185
1186     if (0.0 == d)
1187         (void) 0;
1188     else if ((token = ConfigParser::NextToken()) == NULL)
1189         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1190                config_input_line << "', assuming " <<
1191                d << " " <<  units  );
1192     else if ((m = parseBytesUnits(token)) == 0) {
1193         self_destruct();
1194         return;
1195     }
1196
1197     *bptr = static_cast<ssize_t>(m * d / u);
1198
1199     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1200         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1201                d << " " << token << ": integer overflow (ssize_t).");
1202         self_destruct();
1203     }
1204 }
1205
1206 /**
1207  * Parse bytes from a string.
1208  * Similar to the parseBytesLine function but parses the string value instead of
1209  * the current token value.
1210  */
1211 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1212 {
1213     int u;
1214     if ((u = parseBytesUnits(units)) == 0) {
1215         self_destruct();
1216         return;
1217     }
1218
1219     // Find number from string beginning.
1220     char const * number_begin = value;
1221     char const * number_end = value;
1222
1223     while ((*number_end >= '0' && *number_end <= '9')) {
1224         ++number_end;
1225     }
1226
1227     String number;
1228     number.limitInit(number_begin, number_end - number_begin);
1229
1230     int d = xatoi(number.termedBuf());
1231     int m;
1232     if ((m = parseBytesUnits(number_end)) == 0) {
1233         self_destruct();
1234         return;
1235     }
1236
1237     *bptr = static_cast<size_t>(m * d / u);
1238     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1239         self_destruct();
1240 }
1241
1242 static size_t
1243 parseBytesUnits(const char *unit)
1244 {
1245     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1246         return 1;
1247
1248     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1249         return 1 << 10;
1250
1251     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1252         return 1 << 20;
1253
1254     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1255         return 1 << 30;
1256
1257     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1258
1259     return 0;
1260 }
1261
1262 static void
1263 dump_SBufList(StoreEntry * entry, const SBufList &words)
1264 {
1265     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1266         entry->append(i->rawContent(), i->length());
1267         entry->append(" ",1);
1268     }
1269 }
1270
1271 static void
1272 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1273 {
1274     while (ae != NULL) {
1275         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1276         storeAppendPrintf(entry, "%s %s %s %s ",
1277                           name,
1278                           ae->name,
1279                           ae->typeString(),
1280                           ae->flags.flagsStr());
1281         dump_SBufList(entry, ae->dump());
1282         ae = ae->next;
1283     }
1284 }
1285
1286 static void
1287 parse_acl(ACL ** ae)
1288 {
1289     ACL::ParseAclLine(LegacyParser, ae);
1290 }
1291
1292 static void
1293 free_acl(ACL ** ae)
1294 {
1295     aclDestroyAcls(ae);
1296 }
1297
1298 void
1299 dump_acl_list(StoreEntry * entry, ACLList * head)
1300 {
1301     dump_SBufList(entry, head->dump());
1302 }
1303
1304 void
1305 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1306 {
1307     if (head)
1308         dump_SBufList(entry, head->treeDump(name,NULL));
1309 }
1310
1311 static void
1312 parse_acl_access(acl_access ** head)
1313 {
1314     aclParseAccessLine(cfg_directive, LegacyParser, head);
1315 }
1316
1317 static void
1318 free_acl_access(acl_access ** head)
1319 {
1320     aclDestroyAccessList(head);
1321 }
1322
1323 static void
1324 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1325 {
1326     char buf[MAX_IPSTRLEN];
1327     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1328 }
1329
1330 static void
1331 parse_address(Ip::Address *addr)
1332 {
1333     char *token = ConfigParser::NextToken();
1334
1335     if (!token) {
1336         self_destruct();
1337         return;
1338     }
1339
1340     if (!strcmp(token,"any_addr"))
1341         addr->setAnyAddr();
1342     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1343         addr->setNoAddr();
1344     else if ( (*addr = token) ) // try parse numeric/IPA
1345         (void) 0;
1346     else if (addr->GetHostByName(token)) // dont use ipcache
1347         (void) 0;
1348     else { // not an IP and not a hostname
1349         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1350         self_destruct();
1351     }
1352 }
1353
1354 static void
1355 free_address(Ip::Address *addr)
1356 {
1357     addr->setEmpty();
1358 }
1359
1360 CBDATA_TYPE(AclAddress);
1361
1362 static void
1363 dump_acl_address(StoreEntry * entry, const char *name, AclAddress * head)
1364 {
1365     char buf[MAX_IPSTRLEN];
1366     AclAddress *l;
1367
1368     for (l = head; l; l = l->next) {
1369         if (!l->addr.isAnyAddr())
1370             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1371         else
1372             storeAppendPrintf(entry, "%s autoselect", name);
1373
1374         dump_acl_list(entry, l->aclList);
1375
1376         storeAppendPrintf(entry, "\n");
1377     }
1378 }
1379
1380 static void
1381 freed_acl_address(void *data)
1382 {
1383     AclAddress *l = static_cast<AclAddress *>(data);
1384     aclDestroyAclList(&l->aclList);
1385 }
1386
1387 static void
1388 parse_acl_address(AclAddress ** head)
1389 {
1390     AclAddress *l;
1391     AclAddress **tail = head;   /* sane name below */
1392     CBDATA_INIT_TYPE_FREECB(AclAddress, freed_acl_address);
1393     l = cbdataAlloc(AclAddress);
1394     parse_address(&l->addr);
1395     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1396
1397     while (*tail)
1398         tail = &(*tail)->next;
1399
1400     *tail = l;
1401 }
1402
1403 static void
1404 free_acl_address(AclAddress ** head)
1405 {
1406     while (*head) {
1407         AclAddress *l = *head;
1408         *head = l->next;
1409         cbdataFree(l);
1410     }
1411 }
1412
1413 CBDATA_TYPE(acl_tos);
1414
1415 static void
1416 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1417 {
1418     acl_tos *l;
1419
1420     for (l = head; l; l = l->next) {
1421         if (l->tos > 0)
1422             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1423         else
1424             storeAppendPrintf(entry, "%s none", name);
1425
1426         dump_acl_list(entry, l->aclList);
1427
1428         storeAppendPrintf(entry, "\n");
1429     }
1430 }
1431
1432 static void
1433 freed_acl_tos(void *data)
1434 {
1435     acl_tos *l = static_cast<acl_tos *>(data);
1436     aclDestroyAclList(&l->aclList);
1437 }
1438
1439 static void
1440 parse_acl_tos(acl_tos ** head)
1441 {
1442     acl_tos *l;
1443     acl_tos **tail = head;  /* sane name below */
1444     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1445     char *token = ConfigParser::NextToken();
1446
1447     if (!token) {
1448         self_destruct();
1449         return;
1450     }
1451
1452     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1453         self_destruct();
1454         return;
1455     }
1456
1457     const unsigned int chTos = tos & 0xFC;
1458     if (chTos != tos) {
1459         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1460         tos = chTos;
1461     }
1462
1463     CBDATA_INIT_TYPE_FREECB(acl_tos, freed_acl_tos);
1464
1465     l = cbdataAlloc(acl_tos);
1466
1467     l->tos = (tos_t)tos;
1468
1469     aclParseAclList(LegacyParser, &l->aclList, token);
1470
1471     while (*tail)
1472         tail = &(*tail)->next;
1473
1474     *tail = l;
1475 }
1476
1477 static void
1478 free_acl_tos(acl_tos ** head)
1479 {
1480     while (*head) {
1481         acl_tos *l = *head;
1482         *head = l->next;
1483         l->next = NULL;
1484         cbdataFree(l);
1485     }
1486 }
1487
1488 #if SO_MARK && USE_LIBCAP
1489
1490 CBDATA_TYPE(acl_nfmark);
1491
1492 static void
1493 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1494 {
1495     acl_nfmark *l;
1496
1497     for (l = head; l; l = l->next) {
1498         if (l->nfmark > 0)
1499             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1500         else
1501             storeAppendPrintf(entry, "%s none", name);
1502
1503         dump_acl_list(entry, l->aclList);
1504
1505         storeAppendPrintf(entry, "\n");
1506     }
1507 }
1508
1509 static void
1510 freed_acl_nfmark(void *data)
1511 {
1512     acl_nfmark *l = static_cast<acl_nfmark *>(data);
1513     aclDestroyAclList(&l->aclList);
1514 }
1515
1516 static void
1517 parse_acl_nfmark(acl_nfmark ** head)
1518 {
1519     acl_nfmark *l;
1520     acl_nfmark **tail = head;   /* sane name below */
1521     nfmark_t mark;
1522     char *token = ConfigParser::NextToken();
1523
1524     if (!token) {
1525         self_destruct();
1526         return;
1527     }
1528
1529     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1530         self_destruct();
1531         return;
1532     }
1533
1534     CBDATA_INIT_TYPE_FREECB(acl_nfmark, freed_acl_nfmark);
1535
1536     l = cbdataAlloc(acl_nfmark);
1537
1538     l->nfmark = mark;
1539
1540     aclParseAclList(LegacyParser, &l->aclList, token);
1541
1542     while (*tail)
1543         tail = &(*tail)->next;
1544
1545     *tail = l;
1546 }
1547
1548 static void
1549 free_acl_nfmark(acl_nfmark ** head)
1550 {
1551     while (*head) {
1552         acl_nfmark *l = *head;
1553         *head = l->next;
1554         l->next = NULL;
1555         cbdataFree(l);
1556     }
1557 }
1558 #endif /* SO_MARK */
1559
1560 CBDATA_TYPE(AclSizeLimit);
1561
1562 static void
1563 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1564 {
1565     AclSizeLimit *l;
1566
1567     for (l = head; l; l = l->next) {
1568         if (l->size != -1)
1569             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1570         else
1571             storeAppendPrintf(entry, "%s none", name);
1572
1573         dump_acl_list(entry, l->aclList);
1574
1575         storeAppendPrintf(entry, "\n");
1576     }
1577 }
1578
1579 static void
1580 freed_acl_b_size_t(void *data)
1581 {
1582     AclSizeLimit *l = static_cast<AclSizeLimit *>(data);
1583     aclDestroyAclList(&l->aclList);
1584 }
1585
1586 static void
1587 parse_acl_b_size_t(AclSizeLimit ** head)
1588 {
1589     AclSizeLimit *l;
1590     AclSizeLimit **tail = head; /* sane name below */
1591
1592     CBDATA_INIT_TYPE_FREECB(AclSizeLimit, freed_acl_b_size_t);
1593
1594     l = cbdataAlloc(AclSizeLimit);
1595
1596     parse_b_int64_t(&l->size);
1597
1598     aclParseAclList(LegacyParser, &l->aclList, l->size);
1599
1600     while (*tail)
1601         tail = &(*tail)->next;
1602
1603     *tail = l;
1604 }
1605
1606 static void
1607 free_acl_b_size_t(AclSizeLimit ** head)
1608 {
1609     while (*head) {
1610         AclSizeLimit *l = *head;
1611         *head = l->next;
1612         l->next = NULL;
1613         cbdataFree(l);
1614     }
1615 }
1616
1617 #if USE_DELAY_POOLS
1618
1619 #include "DelayConfig.h"
1620 #include "DelayPools.h"
1621 /* do nothing - free_delay_pool_count is the magic free function.
1622  * this is why delay_pool_count isn't just marked TYPE: u_short
1623  */
1624 #define free_delay_pool_class(X)
1625 #define free_delay_pool_access(X)
1626 #define free_delay_pool_rates(X)
1627 #define dump_delay_pool_class(X, Y, Z)
1628 #define dump_delay_pool_access(X, Y, Z)
1629 #define dump_delay_pool_rates(X, Y, Z)
1630
1631 static void
1632 free_delay_pool_count(DelayConfig * cfg)
1633 {
1634     cfg->freePoolCount();
1635 }
1636
1637 static void
1638 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1639 {
1640     cfg.dumpPoolCount (entry, name);
1641 }
1642
1643 static void
1644 parse_delay_pool_count(DelayConfig * cfg)
1645 {
1646     cfg->parsePoolCount();
1647 }
1648
1649 static void
1650 parse_delay_pool_class(DelayConfig * cfg)
1651 {
1652     cfg->parsePoolClass();
1653 }
1654
1655 static void
1656 parse_delay_pool_rates(DelayConfig * cfg)
1657 {
1658     cfg->parsePoolRates();
1659 }
1660
1661 static void
1662 parse_delay_pool_access(DelayConfig * cfg)
1663 {
1664     cfg->parsePoolAccess(LegacyParser);
1665 }
1666
1667 #endif
1668
1669 #if USE_DELAY_POOLS
1670 #include "ClientDelayConfig.h"
1671 /* do nothing - free_client_delay_pool_count is the magic free function.
1672  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1673  */
1674
1675 #define free_client_delay_pool_access(X)
1676 #define free_client_delay_pool_rates(X)
1677 #define dump_client_delay_pool_access(X, Y, Z)
1678 #define dump_client_delay_pool_rates(X, Y, Z)
1679
1680 static void
1681 free_client_delay_pool_count(ClientDelayConfig * cfg)
1682 {
1683     cfg->freePoolCount();
1684 }
1685
1686 static void
1687 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1688 {
1689     cfg.dumpPoolCount (entry, name);
1690 }
1691
1692 static void
1693 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1694 {
1695     cfg->parsePoolCount();
1696 }
1697
1698 static void
1699 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1700 {
1701     cfg->parsePoolRates();
1702 }
1703
1704 static void
1705 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1706 {
1707     cfg->parsePoolAccess(LegacyParser);
1708 }
1709 #endif
1710
1711 #if USE_HTTP_VIOLATIONS
1712 static void
1713 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1714 {
1715     if (manglers)
1716         manglers->dumpAccess(entry, name);
1717 }
1718
1719 static void
1720 parse_http_header_access(HeaderManglers **pm)
1721 {
1722     char *t = NULL;
1723
1724     if ((t = ConfigParser::NextToken()) == NULL) {
1725         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1726         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1727         return;
1728     }
1729
1730     if (!*pm)
1731         *pm = new HeaderManglers;
1732     HeaderManglers *manglers = *pm;
1733     headerMangler *mangler = manglers->track(t);
1734     assert(mangler);
1735
1736     std::string directive = "http_header_access ";
1737     directive += t;
1738     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1739 }
1740
1741 static void
1742 free_HeaderManglers(HeaderManglers **pm)
1743 {
1744     // we delete the entire http_header_* mangler configuration at once
1745     if (const HeaderManglers *manglers = *pm) {
1746         delete manglers;
1747         *pm = NULL;
1748     }
1749 }
1750
1751 static void
1752 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1753 {
1754     if (manglers)
1755         manglers->dumpReplacement(entry, name);
1756 }
1757
1758 static void
1759 parse_http_header_replace(HeaderManglers **pm)
1760 {
1761     char *t = NULL;
1762
1763     if ((t = ConfigParser::NextToken()) == NULL) {
1764         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1765         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1766         return;
1767     }
1768
1769     const char *value = ConfigParser::NextQuotedOrToEol();
1770
1771     if (!*pm)
1772         *pm = new HeaderManglers;
1773     HeaderManglers *manglers = *pm;
1774     manglers->setReplacement(t, value);
1775 }
1776
1777 #endif
1778
1779 static void
1780 dump_cachedir(StoreEntry * entry, const char *name, SquidConfig::_cacheSwap swap)
1781 {
1782     SwapDir *s;
1783     int i;
1784     assert (entry);
1785
1786     for (i = 0; i < swap.n_configured; ++i) {
1787         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1788         if (!s) continue;
1789         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1790         s->dump(*entry);
1791         storeAppendPrintf(entry, "\n");
1792     }
1793 }
1794
1795 static int
1796 check_null_string(char *s)
1797 {
1798     return s == NULL;
1799 }
1800
1801 #if USE_AUTH
1802 static void
1803 parse_authparam(Auth::ConfigVector * config)
1804 {
1805     char *type_str;
1806     char *param_str;
1807
1808     if ((type_str = ConfigParser::NextToken()) == NULL)
1809         self_destruct();
1810
1811     if ((param_str = ConfigParser::NextToken()) == NULL)
1812         self_destruct();
1813
1814     /* find a configuration for the scheme in the currently parsed configs... */
1815     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1816
1817     if (schemeCfg == NULL) {
1818         /* Create a configuration based on the scheme info */
1819         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1820
1821         if (theScheme == NULL) {
1822             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1823             self_destruct();
1824         }
1825
1826         config->push_back(theScheme->createConfig());
1827         schemeCfg = Auth::Config::Find(type_str);
1828         if (schemeCfg == NULL) {
1829             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1830             self_destruct();
1831         }
1832     }
1833
1834     schemeCfg->parse(schemeCfg, config->size(), param_str);
1835 }
1836
1837 static void
1838 free_authparam(Auth::ConfigVector * cfg)
1839 {
1840     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1841     cfg->clear();
1842
1843     /* on reconfigure initialize new auth schemes for the new config. */
1844     if (reconfiguring) {
1845         Auth::Init();
1846     }
1847 }
1848
1849 static void
1850 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1851 {
1852     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1853         (*i)->dump(entry, name, (*i));
1854 }
1855 #endif /* USE_AUTH */
1856
1857 /* TODO: just return the object, the # is irrelevant */
1858 static int
1859 find_fstype(char *type)
1860 {
1861     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1862         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1863             return (int)i;
1864
1865     return (-1);
1866 }
1867
1868 static void
1869 parse_cachedir(SquidConfig::_cacheSwap * swap)
1870 {
1871     char *type_str;
1872     char *path_str;
1873     RefCount<SwapDir> sd;
1874     int i;
1875     int fs;
1876
1877     if ((type_str = ConfigParser::NextToken()) == NULL)
1878         self_destruct();
1879
1880     if ((path_str = ConfigParser::NextToken()) == NULL)
1881         self_destruct();
1882
1883     fs = find_fstype(type_str);
1884
1885     if (fs < 0) {
1886         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1887         return;
1888     }
1889
1890     /* reconfigure existing dir */
1891
1892     for (i = 0; i < swap->n_configured; ++i) {
1893         assert (swap->swapDirs[i].getRaw());
1894
1895         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1896             /* this is specific to on-fs Stores. The right
1897              * way to handle this is probably to have a mapping
1898              * from paths to stores, and have on-fs stores
1899              * register with that, and lookip in that in their
1900              * own setup logic. RBC 20041225. TODO.
1901              */
1902
1903             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1904
1905             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1906                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1907                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1908                 return;
1909             }
1910
1911             sd->reconfigure();
1912             return;
1913         }
1914     }
1915
1916     /* new cache_dir */
1917     if (swap->n_configured > 63) {
1918         /* 7 bits, signed */
1919         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1920         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1921         self_destruct();
1922         return;
1923     }
1924
1925     allocate_new_swapdir(swap);
1926
1927     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1928
1929     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1930
1931     /* parse the FS parameters and options */
1932     sd->parse(swap->n_configured, path_str);
1933
1934     ++swap->n_configured;
1935 }
1936
1937 static const char *
1938 peer_type_str(const peer_t type)
1939 {
1940     const char * result;
1941
1942     switch (type) {
1943
1944     case PEER_PARENT:
1945         result = "parent";
1946         break;
1947
1948     case PEER_SIBLING:
1949         result = "sibling";
1950         break;
1951
1952     case PEER_MULTICAST:
1953         result = "multicast";
1954         break;
1955
1956     default:
1957         result = "unknown";
1958         break;
1959     }
1960
1961     return result;
1962 }
1963
1964 static void
1965 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1966 {
1967     CachePeerDomainList *d;
1968     NeighborTypeDomainList *t;
1969     LOCAL_ARRAY(char, xname, 128);
1970
1971     while (p != NULL) {
1972         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1973                           name,
1974                           p->host,
1975                           neighborTypeStr(p),
1976                           p->http_port,
1977                           p->icp.port,
1978                           p->name);
1979         dump_peer_options(entry, p);
1980
1981         for (d = p->peer_domain; d; d = d->next) {
1982             storeAppendPrintf(entry, "cache_peer_domain %s %s%s\n",
1983                               p->host,
1984                               d->do_ping ? null_string : "!",
1985                               d->domain);
1986         }
1987
1988         if (p->access) {
1989             snprintf(xname, 128, "cache_peer_access %s", p->name);
1990             dump_acl_access(entry, xname, p->access);
1991         }
1992
1993         for (t = p->typelist; t; t = t->next) {
1994             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1995                               p->host,
1996                               peer_type_str(t->type),
1997                               t->domain);
1998         }
1999
2000         p = p->next;
2001     }
2002 }
2003
2004 /**
2005  * utility function to prevent getservbyname() being called with a numeric value
2006  * on Windows at least it returns garage results.
2007  */
2008 static bool
2009 isUnsignedNumeric(const char *str, size_t len)
2010 {
2011     if (len < 1) return false;
2012
2013     for (; len >0 && *str; ++str, --len) {
2014         if (! isdigit(*str))
2015             return false;
2016     }
2017     return true;
2018 }
2019
2020 /**
2021  \param proto   'tcp' or 'udp' for protocol
2022  \returns       Port the named service is supposed to be listening on.
2023  */
2024 static unsigned short
2025 GetService(const char *proto)
2026 {
2027     struct servent *port = NULL;
2028     /** Parses a port number or service name from the squid.conf */
2029     char *token = ConfigParser::NextToken();
2030     if (token == NULL) {
2031         self_destruct();
2032         return 0; /* NEVER REACHED */
2033     }
2034     /** Returns either the service port number from /etc/services */
2035     if ( !isUnsignedNumeric(token, strlen(token)) )
2036         port = getservbyname(token, proto);
2037     if (port != NULL) {
2038         return ntohs((unsigned short)port->s_port);
2039     }
2040     /** Or a numeric translation of the config text. */
2041     return xatos(token);
2042 }
2043
2044 /**
2045  \returns       Port the named TCP service is supposed to be listening on.
2046  \copydoc GetService(const char *proto)
2047  */
2048 inline unsigned short
2049 GetTcpService(void)
2050 {
2051     return GetService("tcp");
2052 }
2053
2054 /**
2055  \returns       Port the named UDP service is supposed to be listening on.
2056  \copydoc GetService(const char *proto)
2057  */
2058 inline unsigned short
2059 GetUdpService(void)
2060 {
2061     return GetService("udp");
2062 }
2063
2064 static void
2065 parse_peer(CachePeer ** head)
2066 {
2067     char *token = NULL;
2068     CachePeer *p;
2069     CBDATA_INIT_TYPE_FREECB(CachePeer, peerDestroy);
2070     p = cbdataAlloc(CachePeer);
2071     p->http_port = CACHE_HTTP_PORT;
2072     p->icp.port = CACHE_ICP_PORT;
2073     p->weight = 1;
2074     p->basetime = 0;
2075     p->stats.logged_state = PEER_ALIVE;
2076
2077     if ((token = ConfigParser::NextToken()) == NULL)
2078         self_destruct();
2079
2080     p->host = xstrdup(token);
2081
2082     p->name = xstrdup(token);
2083
2084     if ((token = ConfigParser::NextToken()) == NULL)
2085         self_destruct();
2086
2087     p->type = parseNeighborType(token);
2088
2089     if (p->type == PEER_MULTICAST) {
2090         p->options.no_digest = true;
2091         p->options.no_netdb_exchange = true;
2092     }
2093
2094     p->http_port = GetTcpService();
2095
2096     if (!p->http_port)
2097         self_destruct();
2098
2099     p->icp.port = GetUdpService();
2100     p->connection_auth = 2;    /* auto */
2101
2102     while ((token = ConfigParser::NextToken())) {
2103         if (!strcmp(token, "proxy-only")) {
2104             p->options.proxy_only = true;
2105         } else if (!strcmp(token, "no-query")) {
2106             p->options.no_query = true;
2107         } else if (!strcmp(token, "background-ping")) {
2108             p->options.background_ping = true;
2109         } else if (!strcmp(token, "no-digest")) {
2110             p->options.no_digest = true;
2111         } else if (!strcmp(token, "no-tproxy")) {
2112             p->options.no_tproxy = true;
2113         } else if (!strcmp(token, "multicast-responder")) {
2114             p->options.mcast_responder = true;
2115 #if PEER_MULTICAST_SIBLINGS
2116         } else if (!strcmp(token, "multicast-siblings")) {
2117             p->options.mcast_siblings = true;
2118 #endif
2119         } else if (!strncmp(token, "weight=", 7)) {
2120             p->weight = xatoi(token + 7);
2121         } else if (!strncmp(token, "basetime=", 9)) {
2122             p->basetime = xatoi(token + 9);
2123         } else if (!strcmp(token, "closest-only")) {
2124             p->options.closest_only = true;
2125         } else if (!strncmp(token, "ttl=", 4)) {
2126             p->mcast.ttl = xatoi(token + 4);
2127
2128             if (p->mcast.ttl < 0)
2129                 p->mcast.ttl = 0;
2130
2131             if (p->mcast.ttl > 128)
2132                 p->mcast.ttl = 128;
2133         } else if (!strcmp(token, "default")) {
2134             p->options.default_parent = true;
2135         } else if (!strcmp(token, "round-robin")) {
2136             p->options.roundrobin = true;
2137         } else if (!strcmp(token, "weighted-round-robin")) {
2138             p->options.weighted_roundrobin = true;
2139 #if USE_HTCP
2140         } else if (!strcmp(token, "htcp")) {
2141             p->options.htcp = true;
2142         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2143             /* Note: The htcp- form is deprecated, replaced by htcp= */
2144             p->options.htcp = true;
2145             char *tmp = xstrdup(token+5);
2146             char *mode, *nextmode;
2147             for (mode = nextmode = tmp; mode; mode = nextmode) {
2148                 nextmode = strchr(mode, ',');
2149                 if (nextmode) {
2150                     *nextmode = '\0';
2151                     ++nextmode;
2152                 }
2153                 if (!strcmp(mode, "no-clr")) {
2154                     if (p->options.htcp_only_clr)
2155                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2156                     p->options.htcp_no_clr = true;
2157                 } else if (!strcmp(mode, "no-purge-clr")) {
2158                     p->options.htcp_no_purge_clr = true;
2159                 } else if (!strcmp(mode, "only-clr")) {
2160                     if (p->options.htcp_no_clr)
2161                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2162                     p->options.htcp_only_clr = true;
2163                 } else if (!strcmp(mode, "forward-clr")) {
2164                     p->options.htcp_forward_clr = true;
2165                 } else if (!strcmp(mode, "oldsquid")) {
2166                     p->options.htcp_oldsquid = true;
2167                 } else {
2168                     fatalf("invalid HTCP mode '%s'", mode);
2169                 }
2170             }
2171             safe_free(tmp);
2172 #endif
2173         } else if (!strcmp(token, "no-netdb-exchange")) {
2174             p->options.no_netdb_exchange = true;
2175
2176         } else if (!strcmp(token, "carp")) {
2177             if (p->type != PEER_PARENT)
2178                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2179
2180             p->options.carp = true;
2181         } else if (!strncmp(token, "carp-key=", 9)) {
2182             if (p->options.carp != true)
2183                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2184             p->options.carp_key.set = true;
2185             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2186             for (; key; key = nextkey) {
2187                 nextkey=strchr(key,',');
2188                 if (nextkey) ++nextkey; // skip the comma, any
2189                 if (0==strncmp(key,"scheme",6)) {
2190                     p->options.carp_key.scheme = true;
2191                 } else if (0==strncmp(key,"host",4)) {
2192                     p->options.carp_key.host = true;
2193                 } else if (0==strncmp(key,"port",4)) {
2194                     p->options.carp_key.port = true;
2195                 } else if (0==strncmp(key,"path",4)) {
2196                     p->options.carp_key.path = true;
2197                 } else if (0==strncmp(key,"params",6)) {
2198                     p->options.carp_key.params = true;
2199                 } else {
2200                     fatalf("invalid carp-key '%s'",key);
2201                 }
2202             }
2203         } else if (!strcmp(token, "userhash")) {
2204 #if USE_AUTH
2205             if (p->type != PEER_PARENT)
2206                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2207
2208             p->options.userhash = true;
2209 #else
2210             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2211 #endif
2212         } else if (!strcmp(token, "sourcehash")) {
2213             if (p->type != PEER_PARENT)
2214                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2215
2216             p->options.sourcehash = true;
2217
2218         } else if (!strcmp(token, "no-delay")) {
2219 #if USE_DELAY_POOLS
2220             p->options.no_delay = true;
2221 #else
2222             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2223 #endif
2224         } else if (!strncmp(token, "login=", 6)) {
2225             p->login = xstrdup(token + 6);
2226             rfc1738_unescape(p->login);
2227         } else if (!strncmp(token, "connect-timeout=", 16)) {
2228             p->connect_timeout = xatoi(token + 16);
2229         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2230             p->connect_fail_limit = xatoi(token + 19);
2231 #if USE_CACHE_DIGESTS
2232         } else if (!strncmp(token, "digest-url=", 11)) {
2233             p->digest_url = xstrdup(token + 11);
2234 #endif
2235
2236         } else if (!strcmp(token, "allow-miss")) {
2237             p->options.allow_miss = true;
2238         } else if (!strncmp(token, "max-conn=", 9)) {
2239             p->max_conn = xatoi(token + 9);
2240         } else if (!strncmp(token, "standby=", 8)) {
2241             p->standby.limit = xatoi(token + 8);
2242         } else if (!strcmp(token, "originserver")) {
2243             p->options.originserver = true;
2244         } else if (!strncmp(token, "name=", 5)) {
2245             safe_free(p->name);
2246
2247             if (token[5])
2248                 p->name = xstrdup(token + 5);
2249         } else if (!strncmp(token, "forceddomain=", 13)) {
2250             safe_free(p->domain);
2251
2252             if (token[13])
2253                 p->domain = xstrdup(token + 13);
2254
2255 #if USE_OPENSSL
2256
2257         } else if (strcmp(token, "ssl") == 0) {
2258             p->use_ssl = 1;
2259         } else if (strncmp(token, "sslcert=", 8) == 0) {
2260             safe_free(p->sslcert);
2261             p->sslcert = xstrdup(token + 8);
2262         } else if (strncmp(token, "sslkey=", 7) == 0) {
2263             safe_free(p->sslkey);
2264             p->sslkey = xstrdup(token + 7);
2265         } else if (strncmp(token, "sslversion=", 11) == 0) {
2266             p->sslversion = xatoi(token + 11);
2267         } else if (strncmp(token, "ssloptions=", 11) == 0) {
2268             safe_free(p->ssloptions);
2269             p->ssloptions = xstrdup(token + 11);
2270         } else if (strncmp(token, "sslcipher=", 10) == 0) {
2271             safe_free(p->sslcipher);
2272             p->sslcipher = xstrdup(token + 10);
2273         } else if (strncmp(token, "sslcafile=", 10) == 0) {
2274             safe_free(p->sslcafile);
2275             p->sslcafile = xstrdup(token + 10);
2276         } else if (strncmp(token, "sslcapath=", 10) == 0) {
2277             safe_free(p->sslcapath);
2278             p->sslcapath = xstrdup(token + 10);
2279         } else if (strncmp(token, "sslcrlfile=", 11) == 0) {
2280             safe_free(p->sslcrlfile);
2281             p->sslcrlfile = xstrdup(token + 11);
2282         } else if (strncmp(token, "sslflags=", 9) == 0) {
2283             safe_free(p->sslflags);
2284             p->sslflags = xstrdup(token + 9);
2285         } else if (strncmp(token, "ssldomain=", 10) == 0) {
2286             safe_free(p->ssldomain);
2287             p->ssldomain = xstrdup(token + 10);
2288 #endif
2289
2290         } else if (strcmp(token, "front-end-https") == 0) {
2291             p->front_end_https = 1;
2292         } else if (strcmp(token, "front-end-https=on") == 0) {
2293             p->front_end_https = 1;
2294         } else if (strcmp(token, "front-end-https=auto") == 0) {
2295             p->front_end_https = 2;
2296         } else if (strcmp(token, "connection-auth=off") == 0) {
2297             p->connection_auth = 0;
2298         } else if (strcmp(token, "connection-auth") == 0) {
2299             p->connection_auth = 1;
2300         } else if (strcmp(token, "connection-auth=on") == 0) {
2301             p->connection_auth = 1;
2302         } else if (strcmp(token, "connection-auth=auto") == 0) {
2303             p->connection_auth = 2;
2304         } else if (token[0] == '#') {
2305             // start of a text comment. stop reading this line.
2306             break;
2307         } else {
2308             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2309         }
2310     }
2311
2312     if (peerFindByName(p->name))
2313         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2314
2315     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2316         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2317
2318     if (p->weight < 1)
2319         p->weight = 1;
2320
2321     if (p->connect_fail_limit < 1)
2322         p->connect_fail_limit = 10;
2323
2324     p->icp.version = ICP_VERSION_CURRENT;
2325
2326     p->testing_now = false;
2327
2328 #if USE_CACHE_DIGESTS
2329
2330     if (!p->options.no_digest) {
2331         /* XXX This looks odd.. who has the original pointer
2332          * then?
2333          */
2334         PeerDigest *pd = peerDigestCreate(p);
2335         p->digest = cbdataReference(pd);
2336     }
2337
2338 #endif
2339
2340     p->index =  ++Config.npeers;
2341
2342     while (*head != NULL)
2343         head = &(*head)->next;
2344
2345     *head = p;
2346
2347     peerClearRRStart();
2348 }
2349
2350 static void
2351 free_peer(CachePeer ** P)
2352 {
2353     CachePeer *p;
2354
2355     while ((p = *P) != NULL) {
2356         *P = p->next;
2357 #if USE_CACHE_DIGESTS
2358
2359         cbdataReferenceDone(p->digest);
2360 #endif
2361
2362         // the mgr job will notice that its owner is gone and stop
2363         PeerPoolMgr::Checkpoint(p->standby.mgr, "peer gone");
2364         delete p->standby.pool;
2365         cbdataFree(p);
2366     }
2367
2368     Config.npeers = 0;
2369 }
2370
2371 static void
2372 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2373 {
2374     wordlist *w;
2375
2376     while (list != NULL) {
2377         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2378             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2379         else
2380             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2381
2382         for (w = list->actions; w != NULL; w = w->next) {
2383             storeAppendPrintf(entry, " %s", w->key);
2384         }
2385
2386         storeAppendPrintf(entry, "\n");
2387         list = list->next;
2388     }
2389 }
2390
2391 static void
2392 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2393 {
2394     char *passwd = NULL;
2395     wordlist *actions = NULL;
2396     Mgr::ActionPasswordList *p;
2397     Mgr::ActionPasswordList **P;
2398     parse_string(&passwd);
2399     parse_wordlist(&actions);
2400     p = new Mgr::ActionPasswordList;
2401     p->passwd = passwd;
2402     p->actions = actions;
2403
2404     for (P = head; *P; P = &(*P)->next) {
2405         /*
2406          * See if any of the actions from this line already have a
2407          * password from previous lines.  The password checking
2408          * routines in cache_manager.c take the the password from
2409          * the first Mgr::ActionPasswordList that contains the
2410          * requested action.  Thus, we should warn users who might
2411          * think they can have two passwords for the same action.
2412          */
2413         wordlist *w;
2414         wordlist *u;
2415
2416         for (w = (*P)->actions; w; w = w->next) {
2417             for (u = actions; u; u = u->next) {
2418                 if (strcmp(w->key, u->key))
2419                     continue;
2420
2421                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2422             }
2423         }
2424     }
2425
2426     *P = p;
2427 }
2428
2429 static void
2430 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2431 {
2432     Mgr::ActionPasswordList *p;
2433
2434     while ((p = *head) != NULL) {
2435         *head = p->next;
2436         xfree(p->passwd);
2437         wordlistDestroy(&p->actions);
2438         xfree(p);
2439     }
2440 }
2441
2442 static void
2443 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2444 {
2445     AclNameList *a;
2446
2447     while (var != NULL) {
2448         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2449
2450         for (a = var->acl_list; a != NULL; a = a->next)
2451             storeAppendPrintf(entry, " %s", a->name);
2452
2453         storeAppendPrintf(entry, "\n");
2454
2455         var = var->next;
2456     }
2457 }
2458
2459 static void
2460 parse_denyinfo(AclDenyInfoList ** var)
2461 {
2462     aclParseDenyInfoLine(var);
2463 }
2464
2465 void
2466 free_denyinfo(AclDenyInfoList ** list)
2467 {
2468     AclDenyInfoList *a = NULL;
2469     AclDenyInfoList *a_next = NULL;
2470     AclNameList *l = NULL;
2471     AclNameList *l_next = NULL;
2472
2473     for (a = *list; a; a = a_next) {
2474         for (l = a->acl_list; l; l = l_next) {
2475             l_next = l->next;
2476             memFree(l, MEM_ACL_NAME_LIST);
2477             l = NULL;
2478         }
2479
2480         a_next = a->next;
2481         memFree(a, MEM_ACL_DENY_INFO_LIST);
2482         a = NULL;
2483     }
2484
2485     *list = NULL;
2486 }
2487
2488 static void
2489 parse_peer_access(void)
2490 {
2491     char *host = NULL;
2492     CachePeer *p;
2493
2494     if (!(host = ConfigParser::NextToken()))
2495         self_destruct();
2496
2497     if ((p = peerFindByName(host)) == NULL) {
2498         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2499         return;
2500     }
2501
2502     std::string directive = "peer_access ";
2503     directive += host;
2504     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2505 }
2506
2507 static void
2508 parse_hostdomain(void)
2509 {
2510     char *host = NULL;
2511     char *domain = NULL;
2512
2513     if (!(host = ConfigParser::NextToken()))
2514         self_destruct();
2515
2516     while ((domain = ConfigParser::NextToken())) {
2517         CachePeerDomainList *l = NULL;
2518         CachePeerDomainList **L = NULL;
2519         CachePeer *p;
2520
2521         if ((p = peerFindByName(host)) == NULL) {
2522             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2523             continue;
2524         }
2525
2526         l = static_cast<CachePeerDomainList *>(xcalloc(1, sizeof(CachePeerDomainList)));
2527         l->do_ping = true;
2528
2529         if (*domain == '!') {   /* check for !.edu */
2530             l->do_ping = false;
2531             ++domain;
2532         }
2533
2534         l->domain = xstrdup(domain);
2535
2536         for (L = &(p->peer_domain); *L; L = &((*L)->next));
2537         *L = l;
2538     }
2539 }
2540
2541 static void
2542 parse_hostdomaintype(void)
2543 {
2544     char *host = NULL;
2545     char *type = NULL;
2546     char *domain = NULL;
2547
2548     if (!(host = ConfigParser::NextToken()))
2549         self_destruct();
2550
2551     if (!(type = ConfigParser::NextToken()))
2552         self_destruct();
2553
2554     while ((domain = ConfigParser::NextToken())) {
2555         NeighborTypeDomainList *l = NULL;
2556         NeighborTypeDomainList **L = NULL;
2557         CachePeer *p;
2558
2559         if ((p = peerFindByName(host)) == NULL) {
2560             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2561             return;
2562         }
2563
2564         l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2565         l->type = parseNeighborType(type);
2566         l->domain = xstrdup(domain);
2567
2568         for (L = &(p->typelist); *L; L = &((*L)->next));
2569         *L = l;
2570     }
2571 }
2572
2573 static void
2574 dump_int(StoreEntry * entry, const char *name, int var)
2575 {
2576     storeAppendPrintf(entry, "%s %d\n", name, var);
2577 }
2578
2579 void
2580 parse_int(int *var)
2581 {
2582     int i;
2583     i = GetInteger();
2584     *var = i;
2585 }
2586
2587 static void
2588 free_int(int *var)
2589 {
2590     *var = 0;
2591 }
2592
2593 static void
2594 dump_onoff(StoreEntry * entry, const char *name, int var)
2595 {
2596     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2597 }
2598
2599 void
2600 parse_onoff(int *var)
2601 {
2602     char *token = ConfigParser::NextToken();
2603
2604     if (token == NULL)
2605         self_destruct();
2606
2607     if (!strcmp(token, "on")) {
2608         *var = 1;
2609     } else if (!strcmp(token, "enable")) {
2610         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2611         *var = 1;
2612     } else if (!strcmp(token, "off")) {
2613         *var = 0;
2614     } else if (!strcmp(token, "disable")) {
2615         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2616         *var = 0;
2617     } else {
2618         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2619         self_destruct();
2620     }
2621 }
2622
2623 #define free_onoff free_int
2624
2625 static void
2626 dump_tristate(StoreEntry * entry, const char *name, int var)
2627 {
2628     const char *state;
2629
2630     if (var > 0)
2631         state = "on";
2632     else if (var < 0)
2633         state = "warn";
2634     else
2635         state = "off";
2636
2637     storeAppendPrintf(entry, "%s %s\n", name, state);
2638 }
2639
2640 static void
2641 parse_tristate(int *var)
2642 {
2643     char *token = ConfigParser::NextToken();
2644
2645     if (token == NULL)
2646         self_destruct();
2647
2648     if (!strcmp(token, "on")) {
2649         *var = 1;
2650     } else if (!strcmp(token, "enable")) {
2651         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2652         *var = 1;
2653     } else if (!strcmp(token, "warn")) {
2654         *var = -1;
2655     } else if (!strcmp(token, "off")) {
2656         *var = 0;
2657     } else if (!strcmp(token, "disable")) {
2658         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2659         *var = 0;
2660     } else {
2661         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2662         self_destruct();
2663     }
2664 }
2665
2666 #define free_tristate free_int
2667
2668 void
2669 parse_pipelinePrefetch(int *var)
2670 {
2671     char *token = ConfigParser::PeekAtToken();
2672
2673     if (token == NULL)
2674         self_destruct();
2675
2676     if (!strcmp(token, "on")) {
2677         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2678         *var = 1;
2679         //pop the token
2680         (void)ConfigParser::NextToken();
2681     } else if (!strcmp(token, "off")) {
2682         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2683         *var = 0;
2684         //pop the token
2685         (void)ConfigParser::NextToken();
2686     } else
2687         parse_int(var);
2688 }
2689
2690 #define free_pipelinePrefetch free_int
2691 #define dump_pipelinePrefetch dump_int
2692
2693 static void
2694 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2695 {
2696     while (head != NULL) {
2697         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2698                           name,
2699                           head->flags.icase ? " -i" : null_string,
2700                           head->pattern,
2701                           (int) head->min / 60,
2702                           (int) (100.0 * head->pct + 0.5),
2703                           (int) head->max / 60);
2704
2705         if (head->max_stale >= 0)
2706             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2707
2708         if (head->flags.refresh_ims)
2709             storeAppendPrintf(entry, " refresh-ims");
2710
2711         if (head->flags.store_stale)
2712             storeAppendPrintf(entry, " store-stale");
2713
2714 #if USE_HTTP_VIOLATIONS
2715
2716         if (head->flags.override_expire)
2717             storeAppendPrintf(entry, " override-expire");
2718
2719         if (head->flags.override_lastmod)
2720             storeAppendPrintf(entry, " override-lastmod");
2721
2722         if (head->flags.reload_into_ims)
2723             storeAppendPrintf(entry, " reload-into-ims");
2724
2725         if (head->flags.ignore_reload)
2726             storeAppendPrintf(entry, " ignore-reload");
2727
2728         if (head->flags.ignore_no_store)
2729             storeAppendPrintf(entry, " ignore-no-store");
2730
2731         if (head->flags.ignore_must_revalidate)
2732             storeAppendPrintf(entry, " ignore-must-revalidate");
2733
2734         if (head->flags.ignore_private)
2735             storeAppendPrintf(entry, " ignore-private");
2736
2737         if (head->flags.ignore_auth)
2738             storeAppendPrintf(entry, " ignore-auth");
2739
2740 #endif
2741
2742         storeAppendPrintf(entry, "\n");
2743
2744         head = head->next;
2745     }
2746 }
2747
2748 static void
2749 parse_refreshpattern(RefreshPattern ** head)
2750 {
2751     char *token;
2752     char *pattern;
2753     time_t min = 0;
2754     double pct = 0.0;
2755     time_t max = 0;
2756     int refresh_ims = 0;
2757     int store_stale = 0;
2758     int max_stale = -1;
2759
2760 #if USE_HTTP_VIOLATIONS
2761
2762     int override_expire = 0;
2763     int override_lastmod = 0;
2764     int reload_into_ims = 0;
2765     int ignore_reload = 0;
2766     int ignore_no_store = 0;
2767     int ignore_must_revalidate = 0;
2768     int ignore_private = 0;
2769     int ignore_auth = 0;
2770 #endif
2771
2772     int i;
2773     RefreshPattern *t;
2774     regex_t comp;
2775     int errcode;
2776     int flags = REG_EXTENDED | REG_NOSUB;
2777
2778     if ((token = ConfigParser::RegexPattern()) != NULL) {
2779
2780         if (strcmp(token, "-i") == 0) {
2781             flags |= REG_ICASE;
2782             token = ConfigParser::RegexPattern();
2783         } else if (strcmp(token, "+i") == 0) {
2784             flags &= ~REG_ICASE;
2785             token = ConfigParser::RegexPattern();
2786         }
2787
2788     }
2789
2790     if (token == NULL) {
2791         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2792         self_destruct();
2793         return;
2794     }
2795
2796     pattern = xstrdup(token);
2797
2798     i = GetInteger();       /* token: min */
2799
2800     /* catch negative and insanely huge values close to 32-bit wrap */
2801     if (i < 0) {
2802         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2803         i = 0;
2804     }
2805     if (i > 60*24*365) {
2806         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2807         i = 60*24*365;
2808     }
2809
2810     min = (time_t) (i * 60);    /* convert minutes to seconds */
2811
2812     i = GetPercentage();    /* token: pct */
2813
2814     pct = (double) i / 100.0;
2815
2816     i = GetInteger();       /* token: max */
2817
2818     /* catch negative and insanely huge values close to 32-bit wrap */
2819     if (i < 0) {
2820         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2821         i = 0;
2822     }
2823     if (i > 60*24*365) {
2824         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2825         i = 60*24*365;
2826     }
2827
2828     max = (time_t) (i * 60);    /* convert minutes to seconds */
2829
2830     /* Options */
2831     while ((token = ConfigParser::NextToken()) != NULL) {
2832         if (!strcmp(token, "refresh-ims")) {
2833             refresh_ims = 1;
2834         } else if (!strcmp(token, "store-stale")) {
2835             store_stale = 1;
2836         } else if (!strncmp(token, "max-stale=", 10)) {
2837             max_stale = xatoi(token + 10);
2838 #if USE_HTTP_VIOLATIONS
2839
2840         } else if (!strcmp(token, "override-expire"))
2841             override_expire = 1;
2842         else if (!strcmp(token, "override-lastmod"))
2843             override_lastmod = 1;
2844         else if (!strcmp(token, "ignore-no-store"))
2845             ignore_no_store = 1;
2846         else if (!strcmp(token, "ignore-must-revalidate"))
2847             ignore_must_revalidate = 1;
2848         else if (!strcmp(token, "ignore-private"))
2849             ignore_private = 1;
2850         else if (!strcmp(token, "ignore-auth"))
2851             ignore_auth = 1;
2852         else if (!strcmp(token, "reload-into-ims")) {
2853             reload_into_ims = 1;
2854             refresh_nocache_hack = 1;
2855             /* tell client_side.c that this is used */
2856         } else if (!strcmp(token, "ignore-reload")) {
2857             ignore_reload = 1;
2858             refresh_nocache_hack = 1;
2859             /* tell client_side.c that this is used */
2860 #endif
2861
2862         } else if (!strcmp(token, "ignore-no-cache")) {
2863             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.");
2864         } else
2865             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2866     }
2867
2868     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2869         char errbuf[256];
2870         regerror(errcode, &comp, errbuf, sizeof errbuf);
2871         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2872         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2873         xfree(pattern);
2874         return;
2875     }
2876
2877     pct = pct < 0.0 ? 0.0 : pct;
2878     max = max < 0 ? 0 : max;
2879     t = static_cast<RefreshPattern *>(xcalloc(1, sizeof(RefreshPattern)));
2880     t->pattern = (char *) xstrdup(pattern);
2881     t->compiled_pattern = comp;
2882     t->min = min;
2883     t->pct = pct;
2884     t->max = max;
2885
2886     if (flags & REG_ICASE)
2887         t->flags.icase = true;
2888
2889     if (refresh_ims)
2890         t->flags.refresh_ims = true;
2891
2892     if (store_stale)
2893         t->flags.store_stale = true;
2894
2895     t->max_stale = max_stale;
2896
2897 #if USE_HTTP_VIOLATIONS
2898
2899     if (override_expire)
2900         t->flags.override_expire = true;
2901
2902     if (override_lastmod)
2903         t->flags.override_lastmod = true;
2904
2905     if (reload_into_ims)
2906         t->flags.reload_into_ims = true;
2907
2908     if (ignore_reload)
2909         t->flags.ignore_reload = true;
2910
2911     if (ignore_no_store)
2912         t->flags.ignore_no_store = true;
2913
2914     if (ignore_must_revalidate)
2915         t->flags.ignore_must_revalidate = true;
2916
2917     if (ignore_private)
2918         t->flags.ignore_private = true;
2919
2920     if (ignore_auth)
2921         t->flags.ignore_auth = true;
2922
2923 #endif
2924
2925     t->next = NULL;
2926
2927     while (*head)
2928         head = &(*head)->next;
2929
2930     *head = t;
2931
2932     safe_free(pattern);
2933 }
2934
2935 static void
2936 free_refreshpattern(RefreshPattern ** head)
2937 {
2938     RefreshPattern *t;
2939
2940     while ((t = *head) != NULL) {
2941         *head = t->next;
2942         safe_free(t->pattern);
2943         regfree(&t->compiled_pattern);
2944         safe_free(t);
2945     }
2946
2947 #if USE_HTTP_VIOLATIONS
2948     refresh_nocache_hack = 0;
2949
2950 #endif
2951 }
2952
2953 static void
2954 dump_string(StoreEntry * entry, const char *name, char *var)
2955 {
2956     if (var != NULL)
2957         storeAppendPrintf(entry, "%s %s\n", name, var);
2958 }
2959
2960 static void
2961 parse_string(char **var)
2962 {
2963     char *token = ConfigParser::NextToken();
2964     safe_free(*var);
2965
2966     if (token == NULL)
2967         self_destruct();
2968
2969     *var = xstrdup(token);
2970 }
2971
2972 static void
2973 free_string(char **var)
2974 {
2975     safe_free(*var);
2976 }
2977
2978 void
2979 parse_eol(char *volatile *var)
2980 {
2981     if (!var) {
2982         self_destruct();
2983         return;
2984     }
2985
2986     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2987     safe_free(*var);
2988
2989     if (!token) {
2990         self_destruct();
2991         return;
2992     }
2993
2994     while (*token && xisspace(*token))
2995         ++token;
2996
2997     if (!*token) {
2998         self_destruct();
2999         return;
3000     }
3001
3002     *var = xstrdup((char *) token);
3003 }
3004
3005 #define dump_eol dump_string
3006 #define free_eol free_string
3007
3008 static void
3009 parse_TokenOrQuotedString(char **var)
3010 {
3011     char *token = ConfigParser::NextQuotedToken();
3012     safe_free(*var);
3013
3014     if (token == NULL)
3015         self_destruct();
3016
3017     *var = xstrdup(token);
3018 }
3019
3020 #define dump_TokenOrQuotedString dump_string
3021 #define free_TokenOrQuotedString free_string
3022
3023 static void
3024 dump_time_t(StoreEntry * entry, const char *name, time_t var)
3025 {
3026     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
3027 }
3028
3029 void
3030 parse_time_t(time_t * var)
3031 {
3032     time_msec_t tval;
3033     parseTimeLine(&tval, T_SECOND_STR, false);
3034     *var = static_cast<time_t>(tval/1000);
3035 }
3036
3037 static void
3038 free_time_t(time_t * var)
3039 {
3040     *var = 0;
3041 }
3042
3043 static void
3044 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
3045 {
3046     if (var % 1000)
3047         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
3048     else
3049         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
3050 }
3051
3052 void
3053 parse_time_msec(time_msec_t * var)
3054 {
3055     parseTimeLine(var, T_SECOND_STR, true);
3056 }
3057
3058 static void
3059 free_time_msec(time_msec_t * var)
3060 {
3061     *var = 0;
3062 }
3063
3064 #if UNUSED_CODE
3065 static void
3066 dump_size_t(StoreEntry * entry, const char *name, size_t var)
3067 {
3068     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
3069 }
3070 #endif
3071
3072 static void
3073 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3074 {
3075     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3076 }
3077
3078 static void
3079 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3080 {
3081     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3082 }
3083
3084 #if UNUSED_CODE
3085 static void
3086 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
3087 {
3088     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
3089 }
3090 #endif
3091
3092 static void
3093 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3094 {
3095     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3096 }
3097
3098 static void
3099 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3100 {
3101     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3102 }
3103
3104 #if UNUSED_CODE
3105 static void
3106 parse_size_t(size_t * var)
3107 {
3108     int i;
3109     i = GetInteger();
3110     *var = (size_t) i;
3111 }
3112 #endif
3113
3114 static void
3115 parse_b_size_t(size_t * var)
3116 {
3117     parseBytesLine(var, B_BYTES_STR);
3118 }
3119
3120 static void
3121 parse_b_ssize_t(ssize_t * var)
3122 {
3123     parseBytesLineSigned(var, B_BYTES_STR);
3124 }
3125
3126 #if UNUSED_CODE
3127 static void
3128 parse_kb_size_t(size_t * var)
3129 {
3130     parseBytesLine(var, B_KBYTES_STR);
3131 }
3132 #endif
3133
3134 static void
3135 parse_b_int64_t(int64_t * var)
3136 {
3137     parseBytesLine64(var, B_BYTES_STR);
3138 }
3139
3140 static void
3141 parse_kb_int64_t(int64_t * var)
3142 {
3143     parseBytesLine64(var, B_KBYTES_STR);
3144 }
3145
3146 static void
3147 free_size_t(size_t * var)
3148 {
3149     *var = 0;
3150 }
3151
3152 static void
3153 free_ssize_t(ssize_t * var)
3154 {
3155     *var = 0;
3156 }
3157
3158 static void
3159 free_b_int64_t(int64_t * var)
3160 {
3161     *var = 0;
3162 }
3163
3164 #define free_b_size_t free_size_t
3165 #define free_b_ssize_t free_ssize_t
3166 #define free_kb_size_t free_size_t
3167 #define free_mb_size_t free_size_t
3168 #define free_gb_size_t free_size_t
3169 #define free_kb_int64_t free_b_int64_t
3170
3171 static void
3172 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3173 {
3174     storeAppendPrintf(entry, "%s %d\n", name, var);
3175 }
3176
3177 static void
3178 free_u_short(unsigned short * u)
3179 {
3180     *u = 0;
3181 }
3182
3183 static void
3184 parse_u_short(unsigned short * var)
3185 {
3186     ConfigParser::ParseUShort(var);
3187 }
3188
3189 void
3190 ConfigParser::ParseUShort(unsigned short *var)
3191 {
3192     *var = GetShort();
3193 }
3194
3195 void
3196 ConfigParser::ParseBool(bool *var)
3197 {
3198     int i = GetInteger();
3199
3200     if (0 == i)
3201         *var = false;
3202     else if (1 == i)
3203         *var = true;
3204     else
3205         self_destruct();
3206 }
3207
3208 static void
3209 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3210 {
3211     while (list != NULL) {
3212         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3213         list = list->next;
3214     }
3215 }
3216
3217 void
3218 ConfigParser::ParseWordList(wordlist ** list)
3219 {
3220     parse_wordlist(list);
3221 }
3222
3223 void
3224 parse_wordlist(wordlist ** list)
3225 {
3226     char *token;
3227     while ((token = ConfigParser::NextQuotedToken()))
3228         wordlistAdd(list, token);
3229 }
3230
3231 #if 0 /* now unused */
3232 static int
3233 check_null_wordlist(wordlist * w)
3234 {
3235     return w == NULL;
3236 }
3237 #endif
3238
3239 static int
3240 check_null_acl_access(acl_access * a)
3241 {
3242     return a == NULL;
3243 }
3244
3245 #define free_wordlist wordlistDestroy
3246
3247 #define free_uri_whitespace free_int
3248
3249 static void
3250 parse_uri_whitespace(int *var)
3251 {
3252     char *token = ConfigParser::NextToken();
3253
3254     if (token == NULL)
3255         self_destruct();
3256
3257     if (!strcmp(token, "strip"))
3258         *var = URI_WHITESPACE_STRIP;
3259     else if (!strcmp(token, "deny"))
3260         *var = URI_WHITESPACE_DENY;
3261     else if (!strcmp(token, "allow"))
3262         *var = URI_WHITESPACE_ALLOW;
3263     else if (!strcmp(token, "encode"))
3264         *var = URI_WHITESPACE_ENCODE;
3265     else if (!strcmp(token, "chop"))
3266         *var = URI_WHITESPACE_CHOP;
3267     else {
3268         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3269         self_destruct();
3270     }
3271 }
3272
3273 static void
3274 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3275 {
3276     const char *s;
3277
3278     if (var == URI_WHITESPACE_ALLOW)
3279         s = "allow";
3280     else if (var == URI_WHITESPACE_ENCODE)
3281         s = "encode";
3282     else if (var == URI_WHITESPACE_CHOP)
3283         s = "chop";
3284     else if (var == URI_WHITESPACE_DENY)
3285         s = "deny";
3286     else
3287         s = "strip";
3288
3289     storeAppendPrintf(entry, "%s %s\n", name, s);
3290 }
3291
3292 static void
3293 free_removalpolicy(RemovalPolicySettings ** settings)
3294 {
3295     if (!*settings)
3296         return;
3297
3298     free_string(&(*settings)->type);
3299
3300     free_wordlist(&(*settings)->args);
3301
3302     delete *settings;
3303
3304     *settings = NULL;
3305 }
3306
3307 static void
3308 parse_removalpolicy(RemovalPolicySettings ** settings)
3309 {
3310     if (*settings)
3311         free_removalpolicy(settings);
3312
3313     *settings = new RemovalPolicySettings;
3314
3315     parse_string(&(*settings)->type);
3316
3317     parse_wordlist(&(*settings)->args);
3318 }
3319
3320 static void
3321 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3322 {
3323     wordlist *args;
3324     storeAppendPrintf(entry, "%s %s", name, settings->type);
3325     args = settings->args;
3326
3327     while (args) {
3328         storeAppendPrintf(entry, " %s", args->key);
3329         args = args->next;
3330     }
3331
3332     storeAppendPrintf(entry, "\n");
3333 }
3334
3335 inline void
3336 free_YesNoNone(YesNoNone *)
3337 {
3338     // do nothing: no explicit cleanup is required
3339 }
3340
3341 static void
3342 parse_YesNoNone(YesNoNone *option)
3343 {
3344     int value = 0;
3345     parse_onoff(&value);
3346     option->configure(value > 0);
3347 }
3348
3349 static void
3350 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3351 {
3352     if (option.configured())
3353         dump_onoff(entry, name, option ? 1 : 0);
3354 }
3355
3356 static void
3357 free_memcachemode(SquidConfig * config)
3358 {
3359     return;
3360 }
3361
3362 static void
3363 parse_memcachemode(SquidConfig * config)
3364 {
3365     char *token = ConfigParser::NextToken();
3366     if (!token)
3367         self_destruct();
3368
3369     if (strcmp(token, "always") == 0) {
3370         Config.onoff.memory_cache_first = 1;
3371         Config.onoff.memory_cache_disk = 1;
3372     } else if (strcmp(token, "disk") == 0) {
3373         Config.onoff.memory_cache_first = 0;
3374         Config.onoff.memory_cache_disk = 1;
3375     } else if (strncmp(token, "net", 3) == 0) {
3376         Config.onoff.memory_cache_first = 1;
3377         Config.onoff.memory_cache_disk = 0;
3378     } else if (strcmp(token, "never") == 0) {
3379         Config.onoff.memory_cache_first = 0;
3380         Config.onoff.memory_cache_disk = 0;
3381     } else {
3382         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3383         self_destruct();
3384     }
3385 }
3386
3387 static void
3388 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &config)
3389 {
3390     storeAppendPrintf(entry, "%s ", name);
3391     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3392         storeAppendPrintf(entry, "always");
3393     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3394         storeAppendPrintf(entry, "disk");
3395     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3396         storeAppendPrintf(entry, "network");
3397     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3398         storeAppendPrintf(entry, "none");
3399     storeAppendPrintf(entry, "\n");
3400 }
3401
3402 #include "cf_parser.cci"
3403
3404 peer_t
3405 parseNeighborType(const char *s)
3406 {
3407     if (!strcmp(s, "parent"))
3408         return PEER_PARENT;
3409
3410     if (!strcmp(s, "neighbor"))
3411         return PEER_SIBLING;
3412
3413     if (!strcmp(s, "neighbour"))
3414         return PEER_SIBLING;
3415
3416     if (!strcmp(s, "sibling"))
3417         return PEER_SIBLING;
3418
3419     if (!strcmp(s, "multicast"))
3420         return PEER_MULTICAST;
3421
3422     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3423
3424     return PEER_SIBLING;
3425 }
3426
3427 #if USE_WCCPv2
3428 static void
3429 parse_IpAddress_list(Ip::Address_list ** head)
3430 {
3431     char *token;
3432     Ip::Address_list *s;
3433     Ip::Address ipa;
3434
3435     while ((token = ConfigParser::NextToken())) {
3436         if (GetHostWithPort(token, &ipa)) {
3437
3438             while (*head)
3439                 head = &(*head)->next;
3440
3441             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3442             s->s = ipa;
3443
3444             *head = s;
3445         } else
3446             self_destruct();
3447     }
3448 }
3449
3450 static void
3451 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3452 {
3453     char ntoabuf[MAX_IPSTRLEN];
3454
3455     while (s) {
3456         storeAppendPrintf(e, "%s %s\n",
3457                           n,
3458                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3459         s = s->next;
3460     }
3461 }
3462
3463 static void
3464 free_IpAddress_list(Ip::Address_list ** head)
3465 {
3466     if (*head) delete *head;
3467     *head = NULL;
3468 }
3469
3470 #if CURRENTLY_UNUSED
3471 /* This code was previously used by http_port. Left as it really should
3472  * be used by icp_port and htcp_port
3473  */
3474 static int
3475 check_null_IpAddress_list(const Ip::Address_list * s)
3476 {
3477     return NULL == s;
3478 }
3479
3480 #endif /* CURRENTLY_UNUSED */
3481 #endif /* USE_WCCPv2 */
3482
3483 static void
3484 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3485 {
3486     char *host = NULL;
3487     unsigned short port = 0;
3488     char *t = NULL;
3489     char *junk = NULL;
3490
3491     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3492     s->name = xstrdup(token);
3493     s->connection_auth_disabled = false;
3494
3495     const char *portType = AnyP::UriScheme(s->transport.protocol).c_str();
3496
3497     if (*token == '[') {
3498         /* [ipv6]:port */
3499         host = token + 1;
3500         t = strchr(host, ']');
3501         if (!t) {
3502             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3503             self_destruct();
3504         }
3505         *t = '\0';
3506         ++t;
3507         if (*t != ':') {
3508             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3509             self_destruct();
3510         }
3511         if (!Ip::EnableIpv6) {
3512             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3513             self_destruct();
3514         }
3515         port = xatos(t + 1);
3516     } else if ((t = strchr(token, ':'))) {
3517         /* host:port */
3518         /* ipv4:port */
3519         host = token;
3520         *t = '\0';
3521         port = xatos(t + 1);
3522
3523     } else if (strtol(token, &junk, 10) && !*junk) {
3524         port = xatos(token);
3525         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3526     } else {
3527         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3528         self_destruct();
3529     }
3530
3531     if (port == 0 && host != NULL) {
3532         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3533         self_destruct();
3534     }
3535
3536     if (NULL == host) {
3537         s->s.setAnyAddr();
3538         s->s.port(port);
3539         if (!Ip::EnableIpv6)
3540             s->s.setIPv4();
3541         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3542     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3543         s->s.port(port);
3544         if (!Ip::EnableIpv6)
3545             s->s.setIPv4();
3546         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3547     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3548         /* dont use ipcache */
3549         s->defaultsite = xstrdup(host);
3550         s->s.port(port);
3551         if (!Ip::EnableIpv6)
3552             s->s.setIPv4();
3553         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3554     } else {
3555         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3556         self_destruct();
3557     }
3558 }
3559
3560 /// parses the protocol= option of the *_port directive, returning parsed value
3561 /// unsupported option values result in a fatal error message
3562 /// upper case values required; caller may convert for backward compatibility
3563 static AnyP::ProtocolVersion
3564 parsePortProtocol(const SBuf &value)
3565 {
3566     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3567     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3568     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3569         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3570
3571     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3572         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3573
3574     if (value.cmp("FTP") == 0)
3575         return Ftp::ProtocolVersion();
3576
3577     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3578     return AnyP::ProtocolVersion(); // not reached
3579 }
3580
3581 static void
3582 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3583 {
3584     /* modes first */
3585
3586     if (strcmp(token, "accel") == 0) {
3587         if (s->flags.isIntercepted()) {
3588             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3589             self_destruct();
3590         }
3591         s->flags.accelSurrogate = true;
3592         s->vhost = true;
3593     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3594         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3595             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3596             self_destruct();
3597         }
3598         s->flags.natIntercept = true;
3599         Ip::Interceptor.StartInterception();
3600         /* Log information regarding the port modes under interception. */
3601         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3602         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3603     } else if (strcmp(token, "tproxy") == 0) {
3604         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3605             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3606             self_destruct();
3607         }
3608         s->flags.tproxyIntercept = true;
3609         Ip::Interceptor.StartTransparency();
3610         /* Log information regarding the port modes under transparency. */
3611         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3612
3613         if (s->flags.proxySurrogate) {
3614             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3615         }
3616
3617         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3618             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3619             self_destruct();
3620         }
3621
3622     } else if (strcmp(token, "require-proxy-header") == 0) {
3623         s->flags.proxySurrogate = true;
3624         if (s->flags.tproxyIntercept) {
3625             // receiving is still permitted, so we do not unset the TPROXY flag
3626             // spoofing access control override takes care of the spoof disable later
3627             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3628         }
3629
3630     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3631         if (!s->flags.accelSurrogate) {
3632             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3633             self_destruct();
3634         }
3635         safe_free(s->defaultsite);
3636         s->defaultsite = xstrdup(token + 12);
3637     } else if (strcmp(token, "vhost") == 0) {
3638         if (!s->flags.accelSurrogate) {
3639             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3640         }
3641         s->flags.accelSurrogate = true;
3642         s->vhost = true;
3643     } else if (strcmp(token, "no-vhost") == 0) {
3644         if (!s->flags.accelSurrogate) {
3645             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3646         }
3647         s->vhost = false;
3648     } else if (strcmp(token, "vport") == 0) {
3649         if (!s->flags.accelSurrogate) {
3650             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3651             self_destruct();
3652         }
3653         s->vport = -1;
3654     } else if (strncmp(token, "vport=", 6) == 0) {
3655         if (!s->flags.accelSurrogate) {
3656             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3657             self_destruct();
3658         }
3659         s->vport = xatos(token + 6);
3660     } else if (strncmp(token, "protocol=", 9) == 0) {
3661         if (!s->flags.accelSurrogate) {
3662             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3663             self_destruct();
3664         }
3665         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3666     } else if (strcmp(token, "allow-direct") == 0) {
3667         if (!s->flags.accelSurrogate) {
3668             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3669             self_destruct();
3670         }
3671         s->allow_direct = true;
3672     } else if (strcmp(token, "act-as-origin") == 0) {
3673         if (!s->flags.accelSurrogate) {
3674             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3675         } else
3676             s->actAsOrigin = true;
3677     } else if (strcmp(token, "ignore-cc") == 0) {
3678 #if !USE_HTTP_VIOLATIONS
3679         if (!s->flags.accelSurrogate) {
3680             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3681             self_destruct();
3682         }
3683 #endif
3684         s->ignore_cc = true;
3685     } else if (strncmp(token, "name=", 5) == 0) {
3686         safe_free(s->name);
3687         s->name = xstrdup(token + 5);
3688     } else if (strcmp(token, "no-connection-auth") == 0) {
3689         s->connection_auth_disabled = true;
3690     } else if (strcmp(token, "connection-auth=off") == 0) {
3691         s->connection_auth_disabled = true;
3692     } else if (strcmp(token, "connection-auth") == 0) {
3693         s->connection_auth_disabled = false;
3694     } else if (strcmp(token, "connection-auth=on") == 0) {
3695         s->connection_auth_disabled = false;
3696     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3697         if (!strcmp(token + 23, "off"))
3698             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3699         else if (!strcmp(token + 23, "transparent"))
3700             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3701         else if (!strcmp(token + 23, "always"))
3702             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3703         else
3704             self_destruct();
3705     } else if (strcmp(token, "ipv4") == 0) {
3706         if ( !s->s.setIPv4() ) {
3707             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3708             self_destruct();
3709         }
3710     } else if (strcmp(token, "tcpkeepalive") == 0) {
3711         s->tcp_keepalive.enabled = true;
3712     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3713         char *t = token + 13;
3714         s->tcp_keepalive.enabled = true;
3715         s->tcp_keepalive.idle = xatoui(t,',');
3716         t = strchr(t, ',');
3717         if (t) {
3718             ++t;
3719             s->tcp_keepalive.interval = xatoui(t,',');
3720             t = strchr(t, ',');
3721         }
3722         if (t) {
3723             ++t;
3724             s->tcp_keepalive.timeout = xatoui(t);
3725         }
3726 #if USE_OPENSSL
3727     } else if (strcmp(token, "sslBump") == 0) {
3728         debugs(3, DBG_CRITICAL, "WARNING: '" << token << "' is deprecated " <<
3729                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3730         s->flags.tunnelSslBumping = true;
3731     } else if (strcmp(token, "ssl-bump") == 0) {
3732         s->flags.tunnelSslBumping = true;
3733     } else if (strncmp(token, "cert=", 5) == 0) {
3734         safe_free(s->cert);
3735         s->cert = xstrdup(token + 5);
3736     } else if (strncmp(token, "key=", 4) == 0) {
3737         safe_free(s->key);
3738         s->key = xstrdup(token + 4);
3739     } else if (strncmp(token, "version=", 8) == 0) {
3740         s->version = xatoi(token + 8);
3741         if (s->version < 1 || s->version > 4)
3742             self_destruct();
3743     } else if (strncmp(token, "options=", 8) == 0) {
3744         safe_free(s->options);
3745         s->options = xstrdup(token + 8);
3746     } else if (strncmp(token, "cipher=", 7) == 0) {
3747         safe_free(s->cipher);
3748         s->cipher = xstrdup(token + 7);
3749     } else if (strncmp(token, "clientca=", 9) == 0) {
3750         safe_free(s->clientca);
3751         s->clientca = xstrdup(token + 9);
3752     } else if (strncmp(token, "cafile=", 7) == 0) {
3753         safe_free(s->cafile);
3754         s->cafile = xstrdup(token + 7);
3755     } else if (strncmp(token, "capath=", 7) == 0) {
3756         safe_free(s->capath);
3757         s->capath = xstrdup(token + 7);
3758     } else if (strncmp(token, "crlfile=", 8) == 0) {
3759         safe_free(s->crlfile);
3760         s->crlfile = xstrdup(token + 8);
3761     } else if (strncmp(token, "dhparams=", 9) == 0) {
3762         safe_free(s->dhfile);
3763         s->dhfile = xstrdup(token + 9);
3764     } else if (strncmp(token, "sslflags=", 9) == 0) {
3765         safe_free(s->sslflags);
3766         s->sslflags = xstrdup(token + 9);
3767     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3768         safe_free(s->sslContextSessionId);
3769         s->sslContextSessionId = xstrdup(token + 11);
3770     } else if (strcmp(token, "generate-host-certificates") == 0) {
3771         s->generateHostCertificates = true;
3772     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3773         s->generateHostCertificates = true;
3774     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3775         s->generateHostCertificates = false;
3776     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3777         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3778 #endif
3779     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3780         s->ftp_track_dirs = true;
3781     } else {
3782         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3783         self_destruct();
3784     }
3785 }
3786
3787 void
3788 add_http_port(char *portspec)
3789 {
3790     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3791     s->transport = parsePortProtocol(SBuf("HTTP"));
3792     parsePortSpecification(s, portspec);
3793     // we may need to merge better if the above returns a list with clones
3794     assert(s->next == NULL);
3795     s->next = HttpPortList;
3796     HttpPortList = s;
3797 }
3798
3799 static void
3800 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3801 {
3802     SBuf protoName;
3803     if (strcmp(optionName, "http_port") == 0 ||
3804             strcmp(optionName, "ascii_port") == 0)
3805         protoName = "HTTP";
3806     else if (strcmp(optionName, "https_port") == 0)
3807         protoName = "HTTPS";
3808     else if (strcmp(optionName, "ftp_port") == 0)
3809         protoName = "FTP";
3810     if (protoName.isEmpty()) {
3811         self_destruct();
3812         return;
3813     }
3814
3815     char *token = ConfigParser::NextToken();
3816
3817     if (!token) {
3818         self_destruct();
3819         return;
3820     }
3821
3822     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3823     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3824     parsePortSpecification(s, token);
3825
3826     /* parse options ... */
3827     while ((token = ConfigParser::NextToken())) {
3828         parse_port_option(s, token);
3829     }
3830
3831     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3832 #if USE_OPENSSL
3833         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3834         const bool hijacked = s->flags.isIntercepted();
3835         if (s->flags.tunnelSslBumping && !hijacked) {
3836             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3837             self_destruct();
3838         }
3839         if (hijacked && !s->flags.tunnelSslBumping) {
3840             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3841             self_destruct();
3842         }
3843 #endif
3844         if (s->flags.proxySurrogate) {
3845             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3846             self_destruct();
3847         }
3848     } else if (protoName.cmp("FTP") == 0) {
3849         /* ftp_port does not support ssl-bump */
3850         if (s->flags.tunnelSslBumping) {
3851             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3852             self_destruct();
3853         }
3854         if (s->flags.proxySurrogate) {
3855             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3856             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3857             self_destruct();
3858         }
3859     }
3860
3861     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3862         // clone the port options from *s to *(s->next)
3863         s->next = s->clone();
3864         s->next->s.setIPv4();
3865         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).c_str() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3866     }
3867
3868     while (*head != NULL)
3869         head = &((*head)->next);
3870
3871     *head = s;
3872 }
3873
3874 static void
3875 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3876 {
3877     char buf[MAX_IPSTRLEN];
3878
3879     storeAppendPrintf(e, "%s %s",
3880                       n,
3881                       s->s.toUrl(buf,MAX_IPSTRLEN));
3882
3883     // MODES and specific sub-options.
3884     if (s->flags.natIntercept)
3885         storeAppendPrintf(e, " intercept");
3886
3887     else if (s->flags.tproxyIntercept)
3888         storeAppendPrintf(e, " tproxy");
3889
3890     else if (s->flags.proxySurrogate)
3891         storeAppendPrintf(e, " require-proxy-header");
3892
3893     else if (s->flags.accelSurrogate) {
3894         storeAppendPrintf(e, " accel");
3895
3896         if (s->vhost)
3897             storeAppendPrintf(e, " vhost");
3898
3899         if (s->vport < 0)
3900             storeAppendPrintf(e, " vport");
3901         else if (s->vport > 0)
3902             storeAppendPrintf(e, " vport=%d", s->vport);
3903
3904         if (s->defaultsite)
3905             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3906
3907         // TODO: compare against prefix of 'n' instead of assuming http_port
3908         if (s->transport.protocol != AnyP::PROTO_HTTP)
3909             storeAppendPrintf(e, " protocol=%s", AnyP::UriScheme(s->transport.protocol).c_str());
3910
3911         if (s->allow_direct)
3912             storeAppendPrintf(e, " allow-direct");
3913
3914         if (s->ignore_cc)
3915             storeAppendPrintf(e, " ignore-cc");
3916
3917     }
3918
3919     // Generic independent options
3920
3921     if (s->name)
3922         storeAppendPrintf(e, " name=%s", s->name);
3923
3924 #if USE_HTTP_VIOLATIONS
3925     if (!s->flags.accelSurrogate && s->ignore_cc)
3926         storeAppendPrintf(e, " ignore-cc");
3927 #endif
3928
3929     if (s->connection_auth_disabled)
3930         storeAppendPrintf(e, " connection-auth=off");
3931     else
3932         storeAppendPrintf(e, " connection-auth=on");
3933
3934     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3935         const char *pmtu;
3936
3937         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3938             pmtu = "always";
3939         else
3940             pmtu = "transparent";
3941
3942         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3943     }
3944
3945     if (s->s.isAnyAddr() && !s->s.isIPv6())
3946         storeAppendPrintf(e, " ipv4");
3947
3948     if (s->tcp_keepalive.enabled) {
3949         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3950             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3951         } else {
3952             storeAppendPrintf(e, " tcpkeepalive");
3953         }
3954     }
3955
3956 #if USE_OPENSSL
3957     if (s->flags.tunnelSslBumping)
3958         storeAppendPrintf(e, " ssl-bump");
3959
3960     if (s->cert)
3961         storeAppendPrintf(e, " cert=%s", s->cert);
3962
3963     if (s->key)
3964         storeAppendPrintf(e, " key=%s", s->key);
3965
3966     if (s->version)
3967         storeAppendPrintf(e, " version=%d", s->version);
3968
3969     if (s->options)
3970         storeAppendPrintf(e, " options=%s", s->options);
3971
3972     if (s->cipher)
3973         storeAppendPrintf(e, " cipher=%s", s->cipher);
3974
3975     if (s->cafile)
3976         storeAppendPrintf(e, " cafile=%s", s->cafile);
3977
3978     if (s->capath)
3979         storeAppendPrintf(e, " capath=%s", s->capath);
3980
3981     if (s->crlfile)
3982         storeAppendPrintf(e, " crlfile=%s", s->crlfile);
3983
3984     if (s->dhfile)
3985         storeAppendPrintf(e, " dhparams=%s", s->dhfile);
3986
3987     if (s->sslflags)
3988         storeAppendPrintf(e, " sslflags=%s", s->sslflags);
3989
3990     if (s->sslContextSessionId)
3991         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3992
3993     if (s->generateHostCertificates)
3994         storeAppendPrintf(e, " generate-host-certificates");
3995
3996     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3997         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3998 #endif
3999 }
4000
4001 static void
4002 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
4003 {
4004     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
4005         dump_generic_port(e, n, p);
4006         storeAppendPrintf(e, "\n");
4007     }
4008 }
4009
4010 void
4011 configFreeMemory(void)
4012 {
4013     free_all();
4014 #if USE_OPENSSL
4015     SSL_CTX_free(Config.ssl_client.sslContext);
4016 #endif
4017 }
4018
4019 void
4020 requirePathnameExists(const char *name, const char *path)
4021 {
4022
4023     struct stat sb;
4024     char pathbuf[BUFSIZ];
4025     assert(path != NULL);
4026
4027     if (Config.chroot_dir && (geteuid() == 0)) {
4028         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
4029         path = pathbuf;
4030     }
4031
4032     if (stat(path, &sb) < 0) {
4033         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL ":"") << "ERROR: " << name << " " << path << ": " << xstrerror());
4034         // keep going to find more issues if we are only checking the config file with "-k parse"
4035         if (opt_parse_cfg_only)
4036             return;
4037         // this is fatal if it is found during startup or reconfigure
4038         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
4039             fatalf("%s %s: %s", name, path, xstrerror());
4040     }
4041 }
4042
4043 char *
4044 strtokFile(void)
4045 {
4046     return ConfigParser::strtokFile();
4047 }
4048
4049 #include "AccessLogEntry.h"
4050
4051 /**
4052  * We support several access_log configuration styles:
4053  *
4054  * #1: Deprecated ancient style without an explicit logging module:
4055  * access_log /var/log/access.log
4056  *
4057  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
4058  * access_log none [acl ...]
4059  *
4060  * #3: Configurable logging module without named options:
4061  * Logformat or the first ACL name, whichever comes first, may not contain '='.
4062  * If no explicit logformat name is given, the first ACL name, if any,
4063  * should not be an existing logformat name or it will be treated as such.
4064  * access_log module:place [logformat_name] [acl ...]
4065  *
4066  * #4: Configurable logging module with name=value options such as logformat=x:
4067  * The first ACL name may not contain '='.
4068  * access_log module:place [option ...] [acl ...]
4069  *
4070  */
4071 static void
4072 parse_access_log(CustomLog ** logs)
4073 {
4074     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
4075
4076     // default buffer size and fatal settings
4077     cl->bufferSize = 8*MAX_URL;
4078     cl->fatal = true;
4079
4080     /* determine configuration style */
4081
4082     const char *filename = ConfigParser::NextToken();
4083     if (!filename) {
4084         self_destruct();
4085         return;
4086     }
4087
4088     if (strcmp(filename, "none") == 0) {
4089         cl->type = Log::Format::CLF_NONE;
4090         aclParseAclList(LegacyParser, &cl->aclList, filename);
4091         while (*logs)
4092             logs = &(*logs)->next;
4093         *logs = cl;
4094         return;
4095     }
4096
4097     cl->filename = xstrdup(filename);
4098     cl->type = Log::Format::CLF_UNKNOWN;
4099
4100     const char *token = ConfigParser::PeekAtToken();
4101     if (!token) { // style #1
4102         // no options to deal with
4103     } else if (!strchr(token, '=')) { // style #3
4104         // if logformat name is recognized,
4105         // pop the previewed token; Else it must be an ACL name
4106         if (setLogformat(cl, token, false))
4107             (void)ConfigParser::NextToken();
4108     } else { // style #4
4109         do {
4110             if (strncasecmp(token, "on-error=", 9) == 0) {
4111                 if (strncasecmp(token+9, "die", 3) == 0) {
4112                     cl->fatal = true;
4113                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
4114                     cl->fatal = false;
4115                 } else {
4116                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
4117                            token << "' expected 'drop' or 'die'");
4118                     self_destruct();
4119                 }
4120             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
4121                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
4122             } else if (strncasecmp(token, "logformat=", 10) == 0) {
4123                 setLogformat(cl, token+10, true);
4124             } else if (!strchr(token, '=')) {
4125                 // Do not pop the token; it must be an ACL name
4126                 break; // done with name=value options, now to ACLs
4127             } else {
4128                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
4129                 self_destruct();
4130             }
4131             // Pop the token, it was a valid "name=value" option
4132             (void)ConfigParser::NextToken();
4133             // Get next with preview ConfigParser::NextToken call.
4134         } while ((token = ConfigParser::PeekAtToken()) != NULL);
4135     }
4136
4137     // set format if it has not been specified explicitly
4138     if (cl->type == Log::Format::CLF_UNKNOWN)
4139         setLogformat(cl, "squid", true);
4140
4141     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4142
4143     while (*logs)
4144         logs = &(*logs)->next;
4145
4146     *logs = cl;
4147 }
4148
4149 /// sets CustomLog::type and, if needed, CustomLog::lf
4150 /// returns false iff there is no named log format
4151 static bool
4152 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
4153 {
4154     assert(cl);
4155     assert(logdef_name);
4156
4157     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
4158
4159     if (cl->type != Log::Format::CLF_UNKNOWN) {
4160         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
4161                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
4162         self_destruct();
4163         return false;
4164     }
4165
4166     /* look for the definition pointer corresponding to this name */
4167     Format::Format *lf = Log::TheConfig.logformats;
4168
4169     while (lf != NULL) {
4170         debugs(3, 9, "Comparing against '" << lf->name << "'");
4171
4172         if (strcmp(lf->name, logdef_name) == 0)
4173             break;
4174
4175         lf = lf->next;
4176     }
4177
4178     if (lf != NULL) {
4179         cl->type = Log::Format::CLF_CUSTOM;
4180         cl->logFormat = lf;
4181     } else if (strcmp(logdef_name, "auto") == 0) {
4182         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
4183         cl->type = Log::Format::CLF_SQUID;
4184     } else if (strcmp(logdef_name, "squid") == 0) {
4185         cl->type = Log::Format::CLF_SQUID;
4186     } else if (strcmp(logdef_name, "common") == 0) {
4187         cl->type = Log::Format::CLF_COMMON;
4188     } else if (strcmp(logdef_name, "combined") == 0) {
4189         cl->type = Log::Format::CLF_COMBINED;
4190 #if ICAP_CLIENT
4191     } else if (strcmp(logdef_name, "icap_squid") == 0) {
4192         cl->type = Log::Format::CLF_ICAP_SQUID;
4193 #endif
4194     } else if (strcmp(logdef_name, "useragent") == 0) {
4195         cl->type = Log::Format::CLF_USERAGENT;
4196     } else if (strcmp(logdef_name, "referrer") == 0) {
4197         cl->type = Log::Format::CLF_REFERER;
4198     } else if (dieWhenMissing) {
4199         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4200         self_destruct();
4201         return false;
4202     } else {
4203         return false;
4204     }
4205
4206     return true;
4207 }
4208
4209 static int
4210 check_null_access_log(CustomLog *customlog_definitions)
4211 {
4212     return customlog_definitions == NULL;
4213 }
4214
4215 static void
4216 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4217 {
4218     CustomLog *log;
4219
4220     for (log = logs; log; log = log->next) {
4221         storeAppendPrintf(entry, "%s ", name);
4222
4223         switch (log->type) {
4224
4225         case Log::Format::CLF_CUSTOM:
4226             storeAppendPrintf(entry, "%s %s", log->filename, log->logFormat->name);
4227             break;
4228
4229         case Log::Format::CLF_NONE:
4230             storeAppendPrintf(entry, "none");
4231             break;
4232
4233         case Log::Format::CLF_SQUID:
4234             storeAppendPrintf(entry, "%s squid", log->filename);
4235             break;
4236
4237         case Log::Format::CLF_COMBINED:
4238             storeAppendPrintf(entry, "%s combined", log->filename);
4239             break;
4240
4241         case Log::Format::CLF_COMMON:
4242             storeAppendPrintf(entry, "%s common", log->filename);
4243             break;
4244
4245 #if ICAP_CLIENT
4246         case Log::Format::CLF_ICAP_SQUID:
4247             storeAppendPrintf(entry, "%s icap_squid", log->filename);
4248             break;
4249 #endif
4250         case Log::Format::CLF_USERAGENT:
4251             storeAppendPrintf(entry, "%s useragent", log->filename);
4252             break;
4253
4254         case Log::Format::CLF_REFERER:
4255             storeAppendPrintf(entry, "%s referrer", log->filename);
4256             break;
4257
4258         case Log::Format::CLF_UNKNOWN:
4259             break;
4260         }
4261
4262         if (log->aclList)
4263             dump_acl_list(entry, log->aclList);
4264
4265         storeAppendPrintf(entry, "\n");
4266     }
4267 }
4268
4269 static void
4270 free_access_log(CustomLog ** definitions)
4271 {
4272     while (*definitions) {
4273         CustomLog *log = *definitions;
4274         *definitions = log->next;
4275
4276         log->logFormat = NULL;
4277         log->type = Log::Format::CLF_UNKNOWN;
4278
4279         if (log->aclList)
4280             aclDestroyAclList(&log->aclList);
4281
4282         safe_free(log->filename);
4283
4284         xfree(log);
4285     }
4286 }
4287
4288 /// parses list of integers form name=N1,N2,N3,...
4289 static bool
4290 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4291 {
4292     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4293         data += name.size();
4294         if (*data == '=') {
4295             while (true) {
4296                 ++data;
4297                 int value = 0;
4298                 if (!StringToInt(data, value, &data, 10))
4299                     break;
4300                 list.push_back(value);
4301                 if (*data == '\0' || *data != ',')
4302                     break;
4303             }
4304         }
4305     }
4306     return data && *data == '\0';
4307 }
4308
4309 static void
4310 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4311 {
4312 #if !HAVE_CPU_AFFINITY
4313     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4314            "support, do not set 'cpu_affinity_map'");
4315     self_destruct();
4316 #endif /* HAVE_CPU_AFFINITY */
4317
4318     if (!*cpuAffinityMap)
4319         *cpuAffinityMap = new CpuAffinityMap;
4320
4321     const char *const pToken = ConfigParser::NextToken();
4322     const char *const cToken = ConfigParser::NextToken();
4323     std::vector<int> processes, cores;
4324     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4325         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4326                "in 'cpu_affinity_map'");
4327         self_destruct();
4328     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4329         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4330                "'cpu_affinity_map'");
4331         self_destruct();
4332     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4333         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4334                "process_numbers and cores lists differ in length or " <<
4335                "contain numbers <= 0");
4336         self_destruct();
4337     }
4338 }
4339
4340 static void
4341 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4342 {
4343     if (cpuAffinityMap) {
4344         storeAppendPrintf(entry, "%s process_numbers=", name);
4345         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4346             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4347                               cpuAffinityMap->processes()[i]);
4348         }
4349         storeAppendPrintf(entry, " cores=");
4350         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4351             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4352                               cpuAffinityMap->cores()[i]);
4353         }
4354         storeAppendPrintf(entry, "\n");
4355     }
4356 }
4357
4358 static void
4359 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4360 {
4361     delete *cpuAffinityMap;
4362     *cpuAffinityMap = NULL;
4363 }
4364
4365 #if USE_ADAPTATION
4366
4367 static void
4368 parse_adaptation_service_set_type()
4369 {
4370     Adaptation::Config::ParseServiceSet();
4371 }
4372
4373 static void
4374 parse_adaptation_service_chain_type()
4375 {
4376     Adaptation::Config::ParseServiceChain();
4377 }
4378
4379 static void
4380 parse_adaptation_access_type()
4381 {
4382     Adaptation::Config::ParseAccess(LegacyParser);
4383 }
4384 #endif /* USE_ADAPTATION */
4385
4386 #if ICAP_CLIENT
4387
4388 static void
4389 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4390 {
4391     cfg->parseService();
4392 }
4393
4394 static void
4395 free_icap_service_type(Adaptation::Icap::Config * cfg)
4396 {
4397     cfg->freeService();
4398 }
4399
4400 static void
4401 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4402 {
4403     cfg.dumpService(entry, name);
4404 }
4405
4406 static void
4407 parse_icap_class_type()
4408 {
4409     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4410            "Use 'adaptation_service_set' instead");
4411     Adaptation::Config::ParseServiceSet();
4412 }
4413
4414 static void
4415 parse_icap_access_type()
4416 {
4417     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4418            "Use 'adaptation_access' instead");
4419     Adaptation::Config::ParseAccess(LegacyParser);
4420 }
4421
4422 #endif
4423
4424 #if USE_ECAP
4425
4426 static void
4427 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4428 {
4429     cfg->parseService();
4430 }
4431
4432 static void
4433 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4434 {
4435     cfg->freeService();
4436 }
4437
4438 static void
4439 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4440 {
4441     cfg.dumpService(entry, name);
4442 }
4443
4444 #endif /* USE_ECAP */
4445
4446 #if ICAP_CLIENT
4447 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4448 {
4449     char *token;
4450     time_t d;
4451     time_t m;
4452     cfg->service_failure_limit = GetInteger();
4453
4454     if ((token = ConfigParser::NextToken()) == NULL)
4455         return;
4456
4457     if (strcmp(token,"in") != 0) {
4458         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4459         self_destruct();
4460     }
4461
4462     if ((token = ConfigParser::NextToken()) == NULL) {
4463         self_destruct();
4464     }
4465
4466     d = static_cast<time_t> (xatoi(token));
4467
4468     m = static_cast<time_t> (1);
4469
4470     if (0 == d)
4471         (void) 0;
4472     else if ((token = ConfigParser::NextToken()) == NULL) {
4473         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4474         self_destruct();
4475     } else if ((m = parseTimeUnits(token, false)) == 0)
4476         self_destruct();
4477
4478     cfg->oldest_service_failure = (m * d);
4479 }
4480
4481 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4482 {
4483     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4484     if (cfg.oldest_service_failure > 0) {
4485         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4486     }
4487     storeAppendPrintf(entry, "\n");
4488 }
4489
4490 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4491 {
4492     cfg->oldest_service_failure = 0;
4493     cfg->service_failure_limit = 0;
4494 }
4495 #endif
4496
4497 #if USE_OPENSSL
4498 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4499 {
4500     char *al;
4501     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4502     if ((al = ConfigParser::NextToken()) == NULL) {
4503         self_destruct();
4504         return;
4505     }
4506
4507     const char *param;
4508     if ( char *s = strchr(al, '{')) {
4509         *s = '\0'; // terminate the al string
4510         ++s;
4511         param = s;
4512         s = strchr(s, '}');
4513         if (!s) {
4514             self_destruct();
4515             return;
4516         }
4517         *s = '\0';
4518     } else
4519         param = NULL;
4520
4521     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4522         ca->alg = Ssl::algSetValidAfter;
4523         ca->param = xstrdup("on");
4524     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4525         ca->alg = Ssl::algSetValidBefore;
4526         ca->param = xstrdup("on");
4527     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4528         ca->alg = Ssl::algSetCommonName;
4529         if (param) {
4530             if (strlen(param) > 64) {
4531                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4532                 self_destruct();
4533                 return;
4534             }
4535             ca->param = xstrdup(param);
4536         }
4537     } else {
4538         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4539         self_destruct();
4540         return;
4541     }
4542
4543     aclParseAclList(LegacyParser, &ca->aclList, al);
4544
4545     while (*cert_adapt)
4546         cert_adapt = &(*cert_adapt)->next;
4547
4548     *cert_adapt = ca;
4549 }
4550
4551 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4552 {
4553     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4554         storeAppendPrintf(entry, "%s ", name);
4555         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4556         if (ca->aclList)
4557             dump_acl_list(entry, ca->aclList);
4558         storeAppendPrintf(entry, "\n");
4559     }
4560 }
4561
4562 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4563 {
4564     while (*cert_adapt) {
4565         sslproxy_cert_adapt *ca = *cert_adapt;
4566         *cert_adapt = ca->next;
4567         safe_free(ca->param);
4568
4569         if (ca->aclList)
4570             aclDestroyAclList(&ca->aclList);
4571
4572         safe_free(ca);
4573     }
4574 }
4575
4576 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4577 {
4578     char *al;
4579     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4580     if ((al = ConfigParser::NextToken()) == NULL) {
4581         self_destruct();
4582         return;
4583     }
4584
4585     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4586         cs->alg = Ssl::algSignTrusted;
4587     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4588         cs->alg = Ssl::algSignUntrusted;
4589     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4590         cs->alg = Ssl::algSignSelf;
4591     else {
4592         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4593         self_destruct();
4594         return;
4595     }
4596
4597     aclParseAclList(LegacyParser, &cs->aclList, al);
4598
4599     while (*cert_sign)
4600         cert_sign = &(*cert_sign)->next;
4601
4602     *cert_sign = cs;
4603 }
4604
4605 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4606 {
4607     sslproxy_cert_sign *cs;
4608     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4609         storeAppendPrintf(entry, "%s ", name);
4610         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4611         if (cs->aclList)
4612             dump_acl_list(entry, cs->aclList);
4613         storeAppendPrintf(entry, "\n");
4614     }
4615 }
4616
4617 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4618 {
4619     while (*cert_sign) {
4620         sslproxy_cert_sign *cs = *cert_sign;
4621         *cert_sign = cs->next;
4622
4623         if (cs->aclList)
4624             aclDestroyAclList(&cs->aclList);
4625
4626         safe_free(cs);
4627     }
4628 }
4629
4630 class sslBumpCfgRr: public ::RegisteredRunner
4631 {
4632 public:
4633     static Ssl::BumpMode lastDeprecatedRule;
4634     /* RegisteredRunner API */
4635     virtual void finalizeConfig();
4636 };
4637
4638 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4639
4640 RunnerRegistrationEntry(sslBumpCfgRr);
4641
4642 void
4643 sslBumpCfgRr::finalizeConfig()
4644 {
4645     if (lastDeprecatedRule != Ssl::bumpEnd) {
4646         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4647         static char buf[1024];
4648         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4649             strcpy(buf, "ssl_bump deny all");
4650             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4651                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4652                    "must not use implicit rules. Update your ssl_bump rules.");
4653         } else {
4654             strcpy(buf, "ssl_bump allow all");
4655             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4656                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4657                    "inferior to the newer server-first bumping mode. New ssl_bump"
4658                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4659         }
4660         parse_line(buf);
4661     }
4662 }
4663
4664 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4665 {
4666     typedef const char *BumpCfgStyle;
4667     BumpCfgStyle bcsNone = NULL;
4668     BumpCfgStyle bcsNew = "new client/server-first/none";
4669     BumpCfgStyle bcsOld = "deprecated allow/deny";
4670     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4671     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4672     char *bm;
4673     if ((bm = ConfigParser::NextToken()) == NULL) {
4674         self_destruct();
4675         return;
4676     }
4677
4678     // if this is the first rule proccessed
4679     if (*ssl_bump == NULL) {
4680         bumpCfgStyleLast = bcsNone;
4681         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4682     }
4683
4684     allow_t action = allow_t(ACCESS_ALLOWED);
4685
4686     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4687         action.kind = Ssl::bumpClientFirst;
4688         bumpCfgStyleNow = bcsNew;
4689     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4690         action.kind = Ssl::bumpServerFirst;
4691         bumpCfgStyleNow = bcsNew;
4692     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4693         action.kind = Ssl::bumpPeek;
4694         bumpCfgStyleNow = bcsNew;
4695     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4696         action.kind = Ssl::bumpStare;
4697         bumpCfgStyleNow = bcsNew;
4698     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4699         action.kind = Ssl::bumpSplice;
4700         bumpCfgStyleNow = bcsNew;
4701     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4702         action.kind = Ssl::bumpBump;
4703         bumpCfgStyleNow = bcsNew;
4704     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4705         action.kind = Ssl::bumpTerminate;
4706         bumpCfgStyleNow = bcsNew;
4707     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4708         action.kind = Ssl::bumpNone;
4709         bumpCfgStyleNow = bcsNew;
4710     } else if (strcmp(bm, "allow") == 0) {
4711         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4712                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4713                "is usually inferior to the newer server-first "
4714                "bumping mode. Update your ssl_bump rules.");
4715         action.kind = Ssl::bumpClientFirst;
4716         bumpCfgStyleNow = bcsOld;
4717         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4718     } else if (strcmp(bm, "deny") == 0) {
4719         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4720                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4721                "your ssl_bump rules.");
4722         action.kind = Ssl::bumpNone;
4723         bumpCfgStyleNow = bcsOld;
4724         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4725     } else {
4726         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4727         self_destruct();
4728         return;
4729     }
4730
4731     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4732         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4733                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4734         self_destruct();
4735         return;
4736     }
4737
4738     bumpCfgStyleLast = bumpCfgStyleNow;
4739
4740     Acl::AndNode *rule = new Acl::AndNode;
4741     rule->context("(ssl_bump rule)", config_input_line);
4742     rule->lineParse();
4743     // empty rule OK
4744
4745     assert(ssl_bump);
4746     if (!*ssl_bump) {
4747         *ssl_bump = new Acl::Tree;
4748         (*ssl_bump)->context("(ssl_bump rules)", config_input_line);
4749     }
4750
4751     (*ssl_bump)->add(rule, action);
4752 }
4753
4754 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4755 {
4756     if (ssl_bump)
4757         dump_SBufList(entry, ssl_bump->treeDump(name, Ssl::BumpModeStr));
4758 }
4759
4760 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4761 {
4762     free_acl_access(ssl_bump);
4763 }
4764
4765 #endif
4766
4767 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4768 {
4769     if (!headers)
4770         return;
4771
4772     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4773         storeAppendPrintf(entry, "%s ", hwa->fieldName.c_str());
4774         storeAppendPrintf(entry, "%s ", hwa->fieldValue.c_str());
4775         if (hwa->aclList)
4776             dump_acl_list(entry, hwa->aclList);
4777         storeAppendPrintf(entry, "\n");
4778     }
4779 }
4780
4781 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4782 {
4783     char *fn;
4784     if (!*headers) {
4785         *headers = new HeaderWithAclList;
4786     }
4787     if ((fn = ConfigParser::NextToken()) == NULL) {
4788         self_destruct();
4789         return;
4790     }
4791     HeaderWithAcl hwa;
4792     hwa.fieldName = fn;
4793     hwa.fieldId = httpHeaderIdByNameDef(fn, strlen(fn));
4794     if (hwa.fieldId == HDR_BAD_HDR)
4795         hwa.fieldId = HDR_OTHER;
4796
4797     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4798     ConfigParser::EnableMacros();
4799     String buf = ConfigParser::NextQuotedToken();
4800     ConfigParser::DisableMacros();
4801     hwa.fieldValue = buf.termedBuf();
4802     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4803     if (hwa.quoted) {
4804         if (!nlf->parse(hwa.fieldValue.c_str())) {
4805             self_destruct();
4806             return;
4807         }
4808         hwa.valueFormat = nlf;
4809     } else
4810         delete nlf;
4811     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4812     (*headers)->push_back(hwa);
4813 }
4814
4815 static void free_HeaderWithAclList(HeaderWithAclList **header)
4816 {
4817     if (!(*header))
4818         return;
4819
4820     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4821         if (hwa->aclList)
4822             aclDestroyAclList(&hwa->aclList);
4823
4824         if (hwa->valueFormat) {
4825             delete hwa->valueFormat;
4826             hwa->valueFormat = NULL;
4827         }
4828     }
4829     delete *header;
4830     *header = NULL;
4831 }
4832
4833 static void parse_note(Notes *notes)
4834 {
4835     assert(notes);
4836     notes->parse(LegacyParser);
4837 }
4838
4839 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4840 {
4841     notes.dump(entry, name);
4842 }
4843
4844 static void free_note(Notes *notes)
4845 {
4846     notes->clean();
4847 }
4848
4849 static bool FtpEspvDeprecated = false;
4850 static void parse_ftp_epsv(acl_access **ftp_epsv)
4851 {
4852     allow_t ftpEpsvDeprecatedAction;
4853     bool ftpEpsvIsDeprecatedRule = false;
4854
4855     char *t = ConfigParser::PeekAtToken();
4856     if (!t) {
4857         self_destruct();
4858         return;
4859     }
4860
4861     if (!strcmp(t, "off")) {
4862         (void)ConfigParser::NextToken();
4863         ftpEpsvIsDeprecatedRule = true;
4864         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4865     } else if (!strcmp(t, "on")) {
4866         (void)ConfigParser::NextToken();
4867         ftpEpsvIsDeprecatedRule = true;
4868         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4869     }
4870
4871     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4872     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4873     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4874     // then abort
4875     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4876             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4877         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4878         self_destruct();
4879     }
4880
4881     if (ftpEpsvIsDeprecatedRule) {
4882         // overwrite previous ftp_epsv lines
4883         delete *ftp_epsv;
4884         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4885             Acl::AndNode *ftpEpsvRule = new Acl::AndNode;
4886             ftpEpsvRule->context("(ftp_epsv rule)", config_input_line);
4887             ACL *a = ACL::FindByName("all");
4888             if (!a) {
4889                 self_destruct();
4890                 return;
4891             }
4892             ftpEpsvRule->add(a);
4893             *ftp_epsv = new Acl::Tree;
4894             (*ftp_epsv)->context("(ftp_epsv rules)", config_input_line);
4895             (*ftp_epsv)->add(ftpEpsvRule, ftpEpsvDeprecatedAction);
4896         } else
4897             *ftp_epsv = NULL;
4898         FtpEspvDeprecated = true;
4899     } else {
4900         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4901     }
4902 }
4903
4904 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4905 {
4906     if (ftp_epsv)
4907         dump_SBufList(entry, ftp_epsv->treeDump(name, NULL));
4908 }
4909
4910 static void free_ftp_epsv(acl_access **ftp_epsv)
4911 {
4912     free_acl_access(ftp_epsv);
4913     FtpEspvDeprecated = false;
4914 }
4915
4916 static void
4917 parse_url_rewrite_timeout(SquidConfig *config)
4918 {
4919     time_msec_t tval;
4920     parseTimeLine(&tval, T_SECOND_STR, false, true);
4921     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4922
4923     char *key, *value;
4924     while(ConfigParser::NextKvPair(key, value)) {
4925         if (strcasecmp(key, "on_timeout") == 0) {
4926             if (strcasecmp(value, "bypass") == 0)
4927                 Config.onUrlRewriteTimeout.action = toutActBypass;
4928             else if (strcasecmp(value, "fail") == 0)
4929                 Config.onUrlRewriteTimeout.action = toutActFail;
4930             else if (strcasecmp(value, "retry") == 0)
4931                 Config.onUrlRewriteTimeout.action = toutActRetry;
4932             else if (strcasecmp(value, "use_configured_response") == 0) {
4933                 Config.onUrlRewriteTimeout.action = toutActUseConfiguredResponse;
4934             } else {
4935                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4936                 self_destruct();
4937             }
4938         } else if (strcasecmp(key, "response") == 0) {
4939             Config.onUrlRewriteTimeout.response = xstrdup(value);
4940         } else {
4941             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4942             self_destruct();
4943         }
4944     }
4945
4946     if (Config.onUrlRewriteTimeout.action == toutActUseConfiguredResponse && !Config.onUrlRewriteTimeout.response) {
4947         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4948         self_destruct();
4949     }
4950
4951     if (Config.onUrlRewriteTimeout.action != toutActUseConfiguredResponse && Config.onUrlRewriteTimeout.response) {
4952         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4953         self_destruct();
4954     }
4955 }
4956
4957 static void
4958 dump_url_rewrite_timeout(StoreEntry *entry, const char *name, SquidConfig &config)
4959 {
4960     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4961     assert(Config.onUrlRewriteTimeout.action >= 0 && Config.onUrlRewriteTimeout.action <= toutActUseConfiguredResponse);
4962
4963     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4964     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[Config.onUrlRewriteTimeout.action]);
4965
4966     if (Config.onUrlRewriteTimeout.response)
4967         storeAppendPrintf(entry, " response=\"%s\"", Config.onUrlRewriteTimeout.response);
4968
4969     storeAppendPrintf(entry, "\n");
4970 }
4971
4972 static void
4973 free_url_rewrite_timeout(SquidConfig *config)
4974 {
4975     Config.Timeout.urlRewrite = 0;
4976     Config.onUrlRewriteTimeout.action = 0;
4977     xfree(Config.onUrlRewriteTimeout.response);
4978     Config.onUrlRewriteTimeout.response = NULL;
4979 }
4980
4981 static void
4982 parse_configuration_includes_quoted_values(bool *recognizeQuotedValues)
4983 {
4984     int val = 0;
4985     parse_onoff(&val);
4986
4987     // If quoted values is set to on then enable new strict mode parsing
4988     if (val) {
4989         ConfigParser::RecognizeQuotedValues = true;
4990         ConfigParser::StrictMode = true;
4991     } else {
4992         ConfigParser::RecognizeQuotedValues = false;
4993         ConfigParser::StrictMode = false;
4994     }
4995 }
4996
4997 static void
4998 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues)
4999 {
5000     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
5001     dump_onoff(entry, name, val);
5002 }
5003
5004 static void
5005 free_configuration_includes_quoted_values(bool *recognizeQuotedValues)
5006 {
5007     ConfigParser::RecognizeQuotedValues = false;
5008     ConfigParser::StrictMode = false;
5009 }
5010