src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclNameList.h"
  15 #include "acl/AclSizeLimit.h"
  16 #include "acl/Address.h"
  17 #include "acl/Gadgets.h"
  18 #include "acl/MethodData.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "AuthReg.h"
  23 #include "base/RunnersRegistry.h"
  24 #include "cache_cf.h"
  25 #include "CachePeer.h"
  26 #include "ConfigParser.h"
  27 #include "CpuAffinityMap.h"
  28 #include "DiskIO/DiskIOModule.h"
  29 #include "eui/Config.h"
  30 #include "ExternalACL.h"
  31 #include "format/Format.h"
  32 #include "ftp/Elements.h"
  33 #include "globals.h"
  34 #include "HttpHeaderTools.h"
  35 #include "icmp/IcmpConfig.h"
  36 #include "ident/Config.h"
  37 #include "ip/Intercept.h"
  38 #include "ip/QosConfig.h"
  39 #include "ip/tools.h"
  40 #include "ipc/Kids.h"
  41 #include "log/Config.h"
  42 #include "log/CustomLog.h"
  43 #include "MemBuf.h"
  44 #include "mgr/ActionPasswordList.h"
  45 #include "mgr/Registration.h"
  46 #include "neighbors.h"
  47 #include "NeighborTypeDomainList.h"
  48 #include "Parsing.h"
  49 #include "pconn.h"
  50 #include "PeerDigest.h"
  51 #include "PeerPoolMgr.h"
  52 #include "redirect.h"
  53 #include "RefreshPattern.h"
  54 #include "rfc1738.h"
  55 #include "sbuf/List.h"
  56 #include "SquidConfig.h"
  57 #include "SquidString.h"
  58 #include "ssl/ProxyCerts.h"
  59 #include "Store.h"
  60 #include "store/Disk.h"
  61 #include "store/Disks.h"
  62 #include "StoreFileSystem.h"
  63 #include "tools.h"
  64 #include "util.h"
  65 #include "wordlist.h"
  66 /* wccp2 has its own conditional definitions */
  67 #include "wccp2.h"
  68 #if USE_ADAPTATION
  69 #include "adaptation/Config.h"
  70 #endif
  71 #if ICAP_CLIENT
  72 #include "adaptation/icap/Config.h"
  73 #endif
  74 #if USE_ECAP
  75 #include "adaptation/ecap/Config.h"
  76 #endif
  77 #if USE_OPENSSL
  78 #include "ssl/Config.h"
  79 #include "ssl/support.h"
  80 #endif
  81 #if USE_AUTH
  82 #include "auth/Config.h"
  83 #include "auth/Scheme.h"
  84 #endif
  85 #if USE_SQUID_ESI
  86 #include "esi/Parser.h"
  87 #endif
  88 #if SQUID_SNMP
  89 #include "snmp.h"
  90 #endif
  91
  92 #if HAVE_GLOB_H
  93 #include <glob.h>
  94 #endif
  95 #include <limits>
  96 #include <list>
  97 #if HAVE_PWD_H
  98 #include <pwd.h>
  99 #endif
 100 #if HAVE_GRP_H
 101 #include <grp.h>
 102 #endif
 103 #if HAVE_SYS_STAT_H
 104 #include <sys/stat.h>
 105 #endif
 106
 107 #if USE_OPENSSL
 108 #include "ssl/gadgets.h"
 109 #endif
 110
 111 #if USE_ADAPTATION
 112 static void parse_adaptation_service_set_type();
 113 static void parse_adaptation_service_chain_type();
 114 static void parse_adaptation_access_type();
 115 #endif
 116
 117 #if ICAP_CLIENT
 118 static void parse_icap_service_type(Adaptation::Icap::Config *);
 119 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 120 static void free_icap_service_type(Adaptation::Icap::Config *);
 121 static void parse_icap_class_type();
 122 static void parse_icap_access_type();
 123
 124 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 125 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 126 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 127 #endif
 128
 129 #if USE_ECAP
 130 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 131 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 132 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 133 #endif
 134
 135 static peer_t parseNeighborType(const char *s);
 136
 137 static const char *const T_MILLISECOND_STR = "millisecond";
 138 static const char *const T_SECOND_STR = "second";
 139 static const char *const T_MINUTE_STR = "minute";
 140 static const char *const T_HOUR_STR = "hour";
 141 static const char *const T_DAY_STR = "day";
 142 static const char *const T_WEEK_STR = "week";
 143 static const char *const T_FORTNIGHT_STR = "fortnight";
 144 static const char *const T_MONTH_STR = "month";
 145 static const char *const T_YEAR_STR = "year";
 146 static const char *const T_DECADE_STR = "decade";
 147
 148 static const char *const B_BYTES_STR = "bytes";
 149 static const char *const B_KBYTES_STR = "KB";
 150 static const char *const B_MBYTES_STR = "MB";
 151 static const char *const B_GBYTES_STR = "GB";
 152
 153 static const char *const list_sep = ", \t\n\r";
 154
 155 static void parse_access_log(CustomLog ** customlog_definitions);
 156 static int check_null_access_log(CustomLog *customlog_definitions);
 157 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 158 static void free_access_log(CustomLog ** definitions);
 159 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 160
 161 static void configDoConfigure(void);
 162 static void parse_refreshpattern(RefreshPattern **);
 163 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 164 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 165 static void parse_u_short(unsigned short * var);
 166 static void parse_string(char **);
 167 static void default_all(void);
 168 static void defaults_if_none(void);
 169 static void defaults_postscriptum(void);
 170 static int parse_line(char *);
 171 static void parse_obsolete(const char *);
 172 static void parseBytesLine(size_t * bptr, const char *units);
 173 #if USE_OPENSSL
 174 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 175 #endif
 176 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 177 static size_t parseBytesUnits(const char *unit);
 178 static void free_all(void);
 179 void requirePathnameExists(const char *name, const char *path);
 180 static OBJH dump_config;
 181 #if USE_HTTP_VIOLATIONS
 182 static void free_HeaderManglers(HeaderManglers **pm);
 183 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 184 static void parse_http_header_access(HeaderManglers **manglers);
 185 #define free_http_header_access free_HeaderManglers
 186 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 187 static void parse_http_header_replace(HeaderManglers **manglers);
 188 #define free_http_header_replace free_HeaderManglers
 189 #endif
 190 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 191 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 192 static void free_HeaderWithAclList(HeaderWithAclList **header);
 193 static void parse_note(Notes *);
 194 static void dump_note(StoreEntry *, const char *, Notes &);
 195 static void free_note(Notes *);
 196 static void parse_denyinfo(AclDenyInfoList ** var);
 197 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 198 static void free_denyinfo(AclDenyInfoList ** var);
 199
 200 #if USE_WCCPv2
 201 static void parse_IpAddress_list(Ip::Address_list **);
 202 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 203 static void free_IpAddress_list(Ip::Address_list **);
 204 #if CURRENTLY_UNUSED
 205 static int check_null_IpAddress_list(const Ip::Address_list *);
 206 #endif /* CURRENTLY_UNUSED */
 207 #endif /* USE_WCCPv2 */
 208
 209 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 210 #define parse_PortCfg(l) parsePortCfg((l), token)
 211 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 212 #define free_PortCfg(h)  *(h)=NULL
 213
 214 #if USE_OPENSSL
 215 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 216 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 217 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 218 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 219 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 220 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 221 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 222 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 223 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 224 #endif /* USE_OPENSSL */
 225
 226 static void parse_ftp_epsv(acl_access **ftp_epsv);
 227 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 228 static void free_ftp_epsv(acl_access **ftp_epsv);
 229
 230 static void parse_b_size_t(size_t * var);
 231 static void parse_b_int64_t(int64_t * var);
 232
 233 static bool parseNamedIntList(const char *data, const String &name, std::vector<int> &list);
 234
 235 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 236 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 237 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 238
 239 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 240 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 241 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 242
 243 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 244
 245 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 246 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 247 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 248 static void parse_on_unsupported_protocol(acl_access **access);
 249 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 250 static void free_on_unsupported_protocol(acl_access **access);
 251
 252 /*
 253  * LegacyParser is a parser for legacy code that uses the global
 254  * approach.  This is static so that it is only exposed to cache_cf.
 255  * Other modules needing access to a ConfigParser should have it
 256  * provided to them in their parserFOO methods.
 257  */
 258 static ConfigParser LegacyParser = ConfigParser();
 259
 260 void
 261 self_destruct(void)
 262 {
 263     LegacyParser.destruct();
 264 }
 265
 266 static void
 267 SetConfigFilename(char const *file_name, bool is_pipe)
 268 {
 269     if (is_pipe)
 270         cfg_filename = file_name + 1;
 271     else
 272         cfg_filename = file_name;
 273 }
 274
 275 static const char*
 276 skip_ws(const char* s)
 277 {
 278     while (xisspace(*s))
 279         ++s;
 280
 281     return s;
 282 }
 283
 284 static int
 285 parseManyConfigFiles(char* files, int depth)
 286 {
 287     int error_count = 0;
 288     char* saveptr = NULL;
 289 #if HAVE_GLOB
 290     char *path;
 291     glob_t globbuf;
 292     int i;
 293     memset(&globbuf, 0, sizeof(globbuf));
 294     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 295         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 296             int xerrno = errno;
 297             fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
 298         }
 299     }
 300     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 301         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 302     }
 303     globfree(&globbuf);
 304 #else
 305     char* file = strwordtok(files, &saveptr);
 306     while (file != NULL) {
 307         error_count += parseOneConfigFile(file, depth);
 308         file = strwordtok(NULL, &saveptr);
 309     }
 310 #endif /* HAVE_GLOB */
 311     return error_count;
 312 }
 313
 314 static void
 315 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 316 {
 317     assert(str != NULL);
 318     assert(newSubstr != NULL);
 319
 320     unsigned newSubstrLen = strlen(newSubstr);
 321     if (newSubstrLen > substrLen)
 322         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 323
 324     // move tail part including zero
 325     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 326     // copy new substring in place
 327     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 328
 329     len = strlen(str);
 330 }
 331
 332 static void
 333 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 334 {
 335     assert(line != NULL);
 336     assert(macroName != NULL);
 337     assert(substStr != NULL);
 338     unsigned macroNameLen = strlen(macroName);
 339     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 340         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 341 }
 342
 343 static void
 344 ProcessMacros(char*& line, int& len)
 345 {
 346     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 347     SubstituteMacro(line, len, "${process_name}", TheKidName);
 348     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 349 }
 350
 351 static void
 352 trim_trailing_ws(char* str)
 353 {
 354     assert(str != NULL);
 355     unsigned i = strlen(str);
 356     while ((i > 0) && xisspace(str[i - 1]))
 357         --i;
 358     str[i] = '\0';
 359 }
 360
 361 static const char*
 362 FindStatement(const char* line, const char* statement)
 363 {
 364     assert(line != NULL);
 365     assert(statement != NULL);
 366
 367     const char* str = skip_ws(line);
 368     unsigned len = strlen(statement);
 369     if (strncmp(str, statement, len) == 0) {
 370         str += len;
 371         if (*str == '\0')
 372             return str;
 373         else if (xisspace(*str))
 374             return skip_ws(str);
 375     }
 376
 377     return NULL;
 378 }
 379
 380 static bool
 381 StrToInt(const char* str, long& number)
 382 {
 383     assert(str != NULL);
 384
 385     char* end;
 386     number = strtol(str, &end, 0);
 387
 388     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 389 }
 390
 391 static bool
 392 EvalBoolExpr(const char* expr)
 393 {
 394     assert(expr != NULL);
 395     if (strcmp(expr, "true") == 0) {
 396         return true;
 397     } else if (strcmp(expr, "false") == 0) {
 398         return false;
 399     } else if (const char* equation = strchr(expr, '=')) {
 400         const char* rvalue = skip_ws(equation + 1);
 401         char* lvalue = (char*)xmalloc(equation - expr + 1);
 402         xstrncpy(lvalue, expr, equation - expr + 1);
 403         trim_trailing_ws(lvalue);
 404
 405         long number1;
 406         if (!StrToInt(lvalue, number1))
 407             fatalf("String is not a integer number: '%s'\n", lvalue);
 408         long number2;
 409         if (!StrToInt(rvalue, number2))
 410             fatalf("String is not a integer number: '%s'\n", rvalue);
 411
 412         xfree(lvalue);
 413         return number1 == number2;
 414     }
 415     fatalf("Unable to evaluate expression '%s'\n", expr);
 416     return false; // this place cannot be reached
 417 }
 418
 419 static int
 420 parseOneConfigFile(const char *file_name, unsigned int depth)
 421 {
 422     FILE *fp = NULL;
 423     const char *orig_cfg_filename = cfg_filename;
 424     const int orig_config_lineno = config_lineno;
 425     char *token = NULL;
 426     char *tmp_line = NULL;
 427     int tmp_line_len = 0;
 428     int err_count = 0;
 429     int is_pipe = 0;
 430
 431     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 432     if (depth > 16) {
 433         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 434         return 1;
 435     }
 436
 437     if (file_name[0] == '!' || file_name[0] == '|') {
 438         fp = popen(file_name + 1, "r");
 439         is_pipe = 1;
 440     } else {
 441         fp = fopen(file_name, "r");
 442     }
 443
 444     if (!fp) {
 445         int xerrno = errno;
 446         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
 447     }
 448
 449 #if _SQUID_WINDOWS_
 450     setmode(fileno(fp), O_TEXT);
 451 #endif
 452
 453     SetConfigFilename(file_name, bool(is_pipe));
 454
 455     memset(config_input_line, '\0', BUFSIZ);
 456
 457     config_lineno = 0;
 458
 459     std::vector<bool> if_states;
 460     while (fgets(config_input_line, BUFSIZ, fp)) {
 461         ++config_lineno;
 462
 463         if ((token = strchr(config_input_line, '\n')))
 464             *token = '\0';
 465
 466         if ((token = strchr(config_input_line, '\r')))
 467             *token = '\0';
 468
 469         // strip any prefix whitespace off the line.
 470         const char *p = skip_ws(config_input_line);
 471         if (config_input_line != p)
 472             memmove(config_input_line, p, strlen(p)+1);
 473
 474         if (strncmp(config_input_line, "#line ", 6) == 0) {
 475             static char new_file_name[1024];
 476             static char *file;
 477             static char new_lineno;
 478             token = config_input_line + 6;
 479             new_lineno = strtol(token, &file, 0) - 1;
 480
 481             if (file == token)
 482                 continue;   /* Not a valid #line directive, may be a comment */
 483
 484             while (*file && xisspace((unsigned char) *file))
 485                 ++file;
 486
 487             if (*file) {
 488                 if (*file != '"')
 489                     continue;   /* Not a valid #line directive, may be a comment */
 490
 491                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 492
 493                 if ((token = strchr(new_file_name, '"')))
 494                     *token = '\0';
 495
 496                 SetConfigFilename(new_file_name, false);
 497             }
 498
 499             config_lineno = new_lineno;
 500         }
 501
 502         if (config_input_line[0] == '#')
 503             continue;
 504
 505         if (config_input_line[0] == '\0')
 506             continue;
 507
 508         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 509
 510         size_t append_len = strlen(append);
 511
 512         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 513
 514         strcpy(tmp_line + tmp_line_len, append);
 515
 516         tmp_line_len += append_len;
 517
 518         if (tmp_line[tmp_line_len-1] == '\\') {
 519             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 520             tmp_line[--tmp_line_len] = '\0';
 521             continue;
 522         }
 523
 524         trim_trailing_ws(tmp_line);
 525         ProcessMacros(tmp_line, tmp_line_len);
 526         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 527
 528         if (const char* expr = FindStatement(tmp_line, "if")) {
 529             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 530         } else if (FindStatement(tmp_line, "endif")) {
 531             if (!if_states.empty())
 532                 if_states.pop_back(); // remove last if-statement meaning
 533             else
 534                 fatalf("'endif' without 'if'\n");
 535         } else if (FindStatement(tmp_line, "else")) {
 536             if (!if_states.empty())
 537                 if_states.back() = !if_states.back();
 538             else
 539                 fatalf("'else' without 'if'\n");
 540         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 541             /* Handle includes here */
 542             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 543                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 544             } else if (!parse_line(tmp_line)) {
 545                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 546                 ++err_count;
 547             }
 548         }
 549
 550         safe_free(tmp_line);
 551         tmp_line_len = 0;
 552
 553     }
 554     if (!if_states.empty())
 555         fatalf("if-statement without 'endif'\n");
 556
 557     if (is_pipe) {
 558         int ret = pclose(fp);
 559
 560         if (ret != 0)
 561             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 562     } else {
 563         fclose(fp);
 564     }
 565
 566     SetConfigFilename(orig_cfg_filename, false);
 567     config_lineno = orig_config_lineno;
 568
 569     xfree(tmp_line);
 570     return err_count;
 571 }
 572
 573 int
 574 parseConfigFile(const char *file_name)
 575 {
 576     int err_count = 0;
 577
 578     debugs(5, 4, HERE);
 579
 580     configFreeMemory();
 581
 582     ACLMethodData::ThePurgeCount = 0;
 583     default_all();
 584
 585     err_count = parseOneConfigFile(file_name, 0);
 586
 587     defaults_if_none();
 588
 589     defaults_postscriptum();
 590
 591     /*
 592      * We must call configDoConfigure() before leave_suid() because
 593      * configDoConfigure() is where we turn username strings into
 594      * uid values.
 595      */
 596     configDoConfigure();
 597
 598     if (!Config.chroot_dir) {
 599         leave_suid();
 600         setUmask(Config.umask);
 601         _db_init(Debug::cache_log, Debug::debugOptions);
 602         enter_suid();
 603     }
 604
 605     if (opt_send_signal == -1) {
 606         Mgr::RegisterAction("config",
 607                             "Current Squid Configuration",
 608                             dump_config,
 609                             1, 1);
 610     }
 611
 612     return err_count;
 613 }
 614
 615 static void
 616 configDoConfigure(void)
 617 {
 618     memset(&Config2, '\0', sizeof(SquidConfig2));
 619     /* init memory as early as possible */
 620     memConfigure();
 621     /* Sanity checks */
 622
 623     Config.cacheSwap.n_strands = 0; // no diskers by default
 624     if (Config.cacheSwap.swapDirs == NULL) {
 625         /* Memory-only cache probably in effect. */
 626         /* turn off the cache rebuild delays... */
 627         StoreController::store_dirs_rebuilding = 0;
 628     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 629         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 630             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 631             if (sd->needsDiskStrand())
 632                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 633         }
 634     }
 635
 636     if (Debug::rotateNumber < 0) {
 637         Debug::rotateNumber = Config.Log.rotateNumber;
 638     }
 639
 640 #if SIZEOF_OFF_T <= 4
 641     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 642         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 643         Config.Store.maxObjectSize = 0x7FFF0000;
 644     }
 645 #endif
 646
 647     if (Config.Announce.period > 0) {
 648         Config.onoff.announce = 1;
 649     } else {
 650         Config.Announce.period = 86400 * 365;   /* one year */
 651         Config.onoff.announce = 0;
 652     }
 653
 654     if (Config.onoff.httpd_suppress_version_string)
 655         visible_appname_string = (char *)appname_string;
 656     else
 657         visible_appname_string = (char const *)APP_FULLNAME;
 658
 659     if (Config.Program.redirect) {
 660         if (Config.redirectChildren.n_max < 1) {
 661             Config.redirectChildren.n_max = 0;
 662             wordlistDestroy(&Config.Program.redirect);
 663         }
 664     }
 665
 666     if (Config.Program.store_id) {
 667         if (Config.storeIdChildren.n_max < 1) {
 668             Config.storeIdChildren.n_max = 0;
 669             wordlistDestroy(&Config.Program.store_id);
 670         }
 671     }
 672
 673     if (Config.appendDomain)
 674         if (*Config.appendDomain != '.')
 675             fatal("append_domain must begin with a '.'");
 676
 677     if (Config.errHtmlText == NULL)
 678         Config.errHtmlText = xstrdup(null_string);
 679
 680 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 681     if (Config.max_filedescriptors > 0) {
 682         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 683     }
 684 #elif USE_SELECT || USE_SELECT_WIN32
 685     if (Config.max_filedescriptors > FD_SETSIZE) {
 686         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 687     }
 688 #endif
 689
 690     storeConfigure();
 691
 692     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 693              uniqueHostname(),
 694              visible_appname_string);
 695
 696     /*
 697      * the extra space is for loop detection in client_side.c -- we search
 698      * for substrings in the Via header.
 699      */
 700     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 701              uniqueHostname(),
 702              visible_appname_string);
 703
 704     /* Use visible_hostname as default surrogate_id */
 705     if (!Config.Accel.surrogate_id) {
 706         const char *t = getMyHostname();
 707         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 708     }
 709
 710     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 711         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 712
 713     if (Config.appendDomain)
 714         Config.appendDomainLen = strlen(Config.appendDomain);
 715     else
 716         Config.appendDomainLen = 0;
 717
 718     if (Config.connect_retries > 10) {
 719         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 720         Config.connect_retries = 10;
 721     }
 722
 723     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 724 #if USE_UNLINKD
 725
 726     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 727 #endif
 728     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 729     if (Config.Program.redirect)
 730         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 731
 732     if (Config.Program.store_id)
 733         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 734
 735     requirePathnameExists("Icon Directory", Config.icons.directory);
 736
 737     if (Config.errorDirectory)
 738         requirePathnameExists("Error Directory", Config.errorDirectory);
 739
 740 #if USE_HTTP_VIOLATIONS
 741
 742     {
 743         const RefreshPattern *R;
 744
 745         for (R = Config.Refresh; R; R = R->next) {
 746             if (!R->flags.override_expire)
 747                 continue;
 748
 749             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 750
 751             break;
 752         }
 753
 754         for (R = Config.Refresh; R; R = R->next) {
 755             if (!R->flags.override_lastmod)
 756                 continue;
 757
 758             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 759
 760             break;
 761         }
 762
 763         for (R = Config.Refresh; R; R = R->next) {
 764             if (!R->flags.reload_into_ims)
 765                 continue;
 766
 767             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 768
 769             break;
 770         }
 771
 772         for (R = Config.Refresh; R; R = R->next) {
 773             if (!R->flags.ignore_reload)
 774                 continue;
 775
 776             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 777
 778             break;
 779         }
 780
 781         for (R = Config.Refresh; R; R = R->next) {
 782             if (!R->flags.ignore_no_store)
 783                 continue;
 784
 785             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 786
 787             break;
 788         }
 789
 790         for (R = Config.Refresh; R; R = R->next) {
 791             if (!R->flags.ignore_private)
 792                 continue;
 793
 794             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 795
 796             break;
 797         }
 798     }
 799 #endif
 800 #if !USE_HTTP_VIOLATIONS
 801     Config.onoff.via = 1;
 802 #else
 803
 804     if (!Config.onoff.via)
 805         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 806
 807 #endif
 808
 809     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 810     // TODO: replace with a dedicated "purge" ACL option?
 811     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 812
 813     if (geteuid() == 0) {
 814         if (NULL != Config.effectiveUser) {
 815
 816             struct passwd *pwd = getpwnam(Config.effectiveUser);
 817
 818             if (NULL == pwd) {
 819                 /*
 820                  * Andres Kroonmaa <andre@online.ee>:
 821                  * Some getpwnam() implementations (Solaris?) require
 822                  * an available FD < 256 for opening a FILE* to the
 823                  * passwd file.
 824                  * DW:
 825                  * This should be safe at startup, but might still fail
 826                  * during reconfigure.
 827                  */
 828                 fatalf("getpwnam failed to find userid for effective user '%s'",
 829                        Config.effectiveUser);
 830                 return;
 831             }
 832
 833             Config2.effectiveUserID = pwd->pw_uid;
 834
 835             Config2.effectiveGroupID = pwd->pw_gid;
 836
 837 #if HAVE_PUTENV
 838             if (pwd->pw_dir && *pwd->pw_dir) {
 839                 // putenv() leaks by design; avoid leaks when nothing changes
 840                 static SBuf lastDir;
 841                 if (lastDir.isEmpty() || !lastDir.cmp(pwd->pw_dir)) {
 842                     lastDir = pwd->pw_dir;
 843                     int len = strlen(pwd->pw_dir) + 6;
 844                     char *env_str = (char *)xcalloc(len, 1);
 845                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 846                     putenv(env_str);
 847                 }
 848             }
 849 #endif
 850         }
 851     } else {
 852         Config2.effectiveUserID = geteuid();
 853         Config2.effectiveGroupID = getegid();
 854     }
 855
 856     if (NULL != Config.effectiveGroup) {
 857
 858         struct group *grp = getgrnam(Config.effectiveGroup);
 859
 860         if (NULL == grp) {
 861             fatalf("getgrnam failed to find groupid for effective group '%s'",
 862                    Config.effectiveGroup);
 863             return;
 864         }
 865
 866         Config2.effectiveGroupID = grp->gr_gid;
 867     }
 868
 869 #if USE_OPENSSL
 870     if (Config.ssl_client.foreignIntermediateCertsPath)
 871         Ssl::loadSquidUntrusted(Config.ssl_client.foreignIntermediateCertsPath);
 872 #endif
 873
 874     if (Security::ProxyOutgoingConfig.encryptTransport) {
 875         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 876         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 877         if (!Config.ssl_client.sslContext) {
 878 #if USE_OPENSSL
 879             fatal("ERROR: Could not initialize https:// proxy context");
 880 #else
 881             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 882 #endif
 883         }
 884 #if USE_OPENSSL
 885         Ssl::useSquidUntrusted(Config.ssl_client.sslContext);
 886 #endif
 887     }
 888
 889     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 890
 891         // default value for ssldomain= is the peer host/IP
 892         if (p->secure.sslDomain.isEmpty())
 893             p->secure.sslDomain = p->host;
 894
 895         if (p->secure.encryptTransport) {
 896             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 897             p->sslContext = p->secure.createClientContext(true);
 898             if (!p->sslContext) {
 899                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 900                 self_destruct();
 901             }
 902         }
 903     }
 904
 905 #if USE_OPENSSL
 906     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 907         if (!s->secure.encryptTransport)
 908             continue;
 909         debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS context");
 910         s->configureSslServerContext();
 911     }
 912 #endif
 913
 914     // prevent infinite fetch loops in the request parser
 915     // due to buffer full but not enough data recived to finish parse
 916     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 917         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 918                " Change client_request_buffer_max or request_header_max_size limits.",
 919                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 920     }
 921
 922     /*
 923      * Disable client side request pipelining if client_persistent_connections OFF.
 924      * Waste of resources queueing any pipelined requests when the first will close the connection.
 925      */
 926     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 927         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 928                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 929         Config.pipeline_max_prefetch = 0;
 930     }
 931
 932 #if USE_AUTH
 933     /*
 934      * disable client side request pipelining. There is a race with
 935      * Negotiate and NTLM when the client sends a second request on an
 936      * connection before the authenticate challenge is sent. With
 937      * pipelining OFF, the client may fail to authenticate, but squid's
 938      * state will be preserved.
 939      */
 940     if (Config.pipeline_max_prefetch > 0) {
 941         Auth::Config *nego = Auth::Config::Find("Negotiate");
 942         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 943         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 944             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 945             Config.pipeline_max_prefetch = 0;
 946         }
 947     }
 948 #endif
 949 }
 950
 951 /** Parse a line containing an obsolete directive.
 952  * To upgrade it where possible instead of just "Bungled config" for
 953  * directives which cannot be marked as simply aliases of the some name.
 954  * For example if the parameter order and content has changed.
 955  * Or if the directive has been completely removed.
 956  */
 957 void
 958 parse_obsolete(const char *name)
 959 {
 960     // Directives which have been radically changed rather than removed
 961     if (!strcmp(name, "url_rewrite_concurrency")) {
 962         int cval;
 963         parse_int(&cval);
 964         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 965         Config.redirectChildren.concurrency = cval;
 966     }
 967
 968     if (!strcmp(name, "log_access"))
 969         self_destruct();
 970
 971     if (!strcmp(name, "log_icap"))
 972         self_destruct();
 973
 974     if (!strcmp(name, "ignore_ims_on_miss")) {
 975         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 976         // than the 2.7 directive. We need to parse and invert the configured value.
 977         int temp = 0;
 978         parse_onoff(&temp);
 979         Config.onoff.cache_miss_revalidate = !temp;
 980     }
 981
 982     if (!strncmp(name, "sslproxy_", 9)) {
 983         // the replacement directive tls_outgoing_options uses options instead of whole-line input
 984         SBuf tmp;
 985         if (!strcmp(name, "sslproxy_cafile"))
 986             tmp.append("cafile=");
 987         else if (!strcmp(name, "sslproxy_capath"))
 988             tmp.append("capath=");
 989         else if (!strcmp(name, "sslproxy_cipher"))
 990             tmp.append("cipher=");
 991         else if (!strcmp(name, "sslproxy_client_certificate"))
 992             tmp.append("cert=");
 993         else if (!strcmp(name, "sslproxy_client_key"))
 994             tmp.append("key=");
 995         else if (!strcmp(name, "sslproxy_flags"))
 996             tmp.append("flags=");
 997         else if (!strcmp(name, "sslproxy_options"))
 998             tmp.append("options=");
 999         else if (!strcmp(name, "sslproxy_version"))
1000             tmp.append("version=");
1001         else {
1002             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1003             self_destruct();
1004         }
1005
1006         // add the value as unquoted-string because the old values did not support whitespace
1007         const char *token = ConfigParser::NextQuotedOrToEol();
1008         tmp.append(token, strlen(token));
1009         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1010     }
1011 }
1012
1013 /* Parse a time specification from the config file.  Store the
1014  * result in 'tptr', after converting it to 'units' */
1015 static void
1016 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
1017 {
1018     time_msec_t u;
1019     if ((u = parseTimeUnits(units, allowMsec)) == 0)
1020         self_destruct();
1021
1022     char *token;
1023     if ((token = ConfigParser::NextToken()) == NULL)
1024         self_destruct();
1025
1026     double d = xatof(token);
1027
1028     time_msec_t m = u; /* default to 'units' if none specified */
1029
1030     if (d) {
1031         if ((token = ConfigParser::PeekAtToken()) && (m = parseTimeUnits(token, allowMsec))) {
1032             (void)ConfigParser::NextToken();
1033
1034         } else if (!expectMoreArguments) {
1035             self_destruct();
1036
1037         } else {
1038             token = NULL; // show default units if dying below
1039             debugs(3, DBG_CRITICAL, "WARNING: No units on '" << config_input_line << "', assuming " << d << " " << units);
1040         }
1041     } else
1042         token = NULL; // show default units if dying below.
1043
1044     *tptr = static_cast<time_msec_t>(m * d);
1045
1046     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1047         debugs(3, DBG_CRITICAL, "FATAL: Invalid value '" <<
1048                d << " " << (token ? token : units) << ": integer overflow (time_msec_t).");
1049         self_destruct();
1050     }
1051 }
1052
1053 static uint64_t
1054 parseTimeUnits(const char *unit, bool allowMsec)
1055 {
1056     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1057         return 1;
1058
1059     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1060         return 1000;
1061
1062     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1063         return 60 * 1000;
1064
1065     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1066         return 3600 * 1000;
1067
1068     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1069         return 86400 * 1000;
1070
1071     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1072         return 86400 * 7 * 1000;
1073
1074     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1075         return 86400 * 14 * 1000;
1076
1077     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1078         return static_cast<uint64_t>(86400) * 30 * 1000;
1079
1080     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1081         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1082
1083     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1084         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1085
1086     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1087
1088     return 0;
1089 }
1090
1091 static void
1092 parseBytesLine64(int64_t * bptr, const char *units)
1093 {
1094     char *token;
1095     double d;
1096     int64_t m;
1097     int64_t u;
1098
1099     if ((u = parseBytesUnits(units)) == 0) {
1100         self_destruct();
1101         return;
1102     }
1103
1104     if ((token = ConfigParser::NextToken()) == NULL) {
1105         self_destruct();
1106         return;
1107     }
1108
1109     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1110         *bptr = -1;
1111         return;
1112     }
1113
1114     d = xatof(token);
1115
1116     m = u;          /* default to 'units' if none specified */
1117
1118     if (0.0 == d)
1119         (void) 0;
1120     else if ((token = ConfigParser::NextToken()) == NULL)
1121         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1122                config_input_line << "', assuming " <<
1123                d << " " <<  units  );
1124     else if ((m = parseBytesUnits(token)) == 0) {
1125         self_destruct();
1126         return;
1127     }
1128
1129     *bptr = static_cast<int64_t>(m * d / u);
1130
1131     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1132         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1133                d << " " << token << ": integer overflow (int64_t).");
1134         self_destruct();
1135     }
1136 }
1137
1138 static void
1139 parseBytesLine(size_t * bptr, const char *units)
1140 {
1141     char *token;
1142     double d;
1143     int m;
1144     int u;
1145
1146     if ((u = parseBytesUnits(units)) == 0) {
1147         self_destruct();
1148         return;
1149     }
1150
1151     if ((token = ConfigParser::NextToken()) == NULL) {
1152         self_destruct();
1153         return;
1154     }
1155
1156     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1157         *bptr = static_cast<size_t>(-1);
1158         return;
1159     }
1160
1161     d = xatof(token);
1162
1163     m = u;          /* default to 'units' if none specified */
1164
1165     if (0.0 == d)
1166         (void) 0;
1167     else if ((token = ConfigParser::NextToken()) == NULL)
1168         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1169                config_input_line << "', assuming " <<
1170                d << " " <<  units  );
1171     else if ((m = parseBytesUnits(token)) == 0) {
1172         self_destruct();
1173         return;
1174     }
1175
1176     *bptr = static_cast<size_t>(m * d / u);
1177
1178     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1179         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1180                d << " " << token << ": integer overflow (size_t).");
1181         self_destruct();
1182     }
1183 }
1184
1185 static void
1186 parseBytesLineSigned(ssize_t * bptr, const char *units)
1187 {
1188     char *token;
1189     double d;
1190     int m;
1191     int u;
1192
1193     if ((u = parseBytesUnits(units)) == 0) {
1194         self_destruct();
1195         return;
1196     }
1197
1198     if ((token = ConfigParser::NextToken()) == NULL) {
1199         self_destruct();
1200         return;
1201     }
1202
1203     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1204         *bptr = -1;
1205         return;
1206     }
1207
1208     d = xatof(token);
1209
1210     m = u;          /* default to 'units' if none specified */
1211
1212     if (0.0 == d)
1213         (void) 0;
1214     else if ((token = ConfigParser::NextToken()) == NULL)
1215         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1216                config_input_line << "', assuming " <<
1217                d << " " <<  units  );
1218     else if ((m = parseBytesUnits(token)) == 0) {
1219         self_destruct();
1220         return;
1221     }
1222
1223     *bptr = static_cast<ssize_t>(m * d / u);
1224
1225     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1226         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1227                d << " " << token << ": integer overflow (ssize_t).");
1228         self_destruct();
1229     }
1230 }
1231
1232 /**
1233  * Parse bytes from a string.
1234  * Similar to the parseBytesLine function but parses the string value instead of
1235  * the current token value.
1236  */
1237 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1238 {
1239     int u;
1240     if ((u = parseBytesUnits(units)) == 0) {
1241         self_destruct();
1242         return;
1243     }
1244
1245     // Find number from string beginning.
1246     char const * number_begin = value;
1247     char const * number_end = value;
1248
1249     while ((*number_end >= '0' && *number_end <= '9')) {
1250         ++number_end;
1251     }
1252
1253     String number;
1254     number.limitInit(number_begin, number_end - number_begin);
1255
1256     int d = xatoi(number.termedBuf());
1257     int m;
1258     if ((m = parseBytesUnits(number_end)) == 0) {
1259         self_destruct();
1260         return;
1261     }
1262
1263     *bptr = static_cast<size_t>(m * d / u);
1264     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1265         self_destruct();
1266 }
1267
1268 static size_t
1269 parseBytesUnits(const char *unit)
1270 {
1271     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1272         return 1;
1273
1274     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1275         return 1 << 10;
1276
1277     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1278         return 1 << 20;
1279
1280     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1281         return 1 << 30;
1282
1283     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1284
1285     return 0;
1286 }
1287
1288 static void
1289 dump_SBufList(StoreEntry * entry, const SBufList &words)
1290 {
1291     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1292         entry->append(i->rawContent(), i->length());
1293         entry->append(" ",1);
1294     }
1295     entry->append("\n",1);
1296 }
1297
1298 static void
1299 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1300 {
1301     while (ae != NULL) {
1302         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1303         storeAppendPrintf(entry, "%s %s %s %s ",
1304                           name,
1305                           ae->name,
1306                           ae->typeString(),
1307                           ae->flags.flagsStr());
1308         dump_SBufList(entry, ae->dump());
1309         ae = ae->next;
1310     }
1311 }
1312
1313 static void
1314 parse_acl(ACL ** ae)
1315 {
1316     ACL::ParseAclLine(LegacyParser, ae);
1317 }
1318
1319 static void
1320 free_acl(ACL ** ae)
1321 {
1322     aclDestroyAcls(ae);
1323 }
1324
1325 void
1326 dump_acl_list(StoreEntry * entry, ACLList * head)
1327 {
1328     dump_SBufList(entry, head->dump());
1329 }
1330
1331 void
1332 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1333 {
1334     if (head)
1335         dump_SBufList(entry, head->treeDump(name,NULL));
1336 }
1337
1338 static void
1339 parse_acl_access(acl_access ** head)
1340 {
1341     aclParseAccessLine(cfg_directive, LegacyParser, head);
1342 }
1343
1344 static void
1345 free_acl_access(acl_access ** head)
1346 {
1347     aclDestroyAccessList(head);
1348 }
1349
1350 static void
1351 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1352 {
1353     char buf[MAX_IPSTRLEN];
1354     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1355 }
1356
1357 static void
1358 parse_address(Ip::Address *addr)
1359 {
1360     char *token = ConfigParser::NextToken();
1361
1362     if (!token) {
1363         self_destruct();
1364         return;
1365     }
1366
1367     if (!strcmp(token,"any_addr"))
1368         addr->setAnyAddr();
1369     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1370         addr->setNoAddr();
1371     else if ( (*addr = token) ) // try parse numeric/IPA
1372         (void) 0;
1373     else if (addr->GetHostByName(token)) // dont use ipcache
1374         (void) 0;
1375     else { // not an IP and not a hostname
1376         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1377         self_destruct();
1378     }
1379 }
1380
1381 static void
1382 free_address(Ip::Address *addr)
1383 {
1384     addr->setEmpty();
1385 }
1386
1387 static void
1388 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1389 {
1390     char buf[MAX_IPSTRLEN];
1391
1392     for (Acl::Address *l = head; l; l = l->next) {
1393         if (!l->addr.isAnyAddr())
1394             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1395         else
1396             storeAppendPrintf(entry, "%s autoselect", name);
1397
1398         dump_acl_list(entry, l->aclList);
1399
1400         storeAppendPrintf(entry, "\n");
1401     }
1402 }
1403
1404 static void
1405 parse_acl_address(Acl::Address ** head)
1406 {
1407     Acl::Address *l = new Acl::Address;
1408     parse_address(&l->addr);
1409     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1410
1411     Acl::Address **tail = head;
1412     while (*tail)
1413         tail = &(*tail)->next;
1414
1415     *tail = l;
1416 }
1417
1418 static void
1419 free_acl_address(Acl::Address ** head)
1420 {
1421     delete *head;
1422     *head = NULL;
1423 }
1424
1425 static void
1426 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1427 {
1428     acl_tos *l;
1429
1430     for (l = head; l; l = l->next) {
1431         if (l->tos > 0)
1432             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1433         else
1434             storeAppendPrintf(entry, "%s none", name);
1435
1436         dump_acl_list(entry, l->aclList);
1437
1438         storeAppendPrintf(entry, "\n");
1439     }
1440 }
1441
1442 static void
1443 parse_acl_tos(acl_tos ** head)
1444 {
1445     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1446     char *token = ConfigParser::NextToken();
1447
1448     if (!token) {
1449         self_destruct();
1450         return;
1451     }
1452
1453     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1454         self_destruct();
1455         return;
1456     }
1457
1458     const unsigned int chTos = tos & 0xFC;
1459     if (chTos != tos) {
1460         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1461         tos = chTos;
1462     }
1463
1464     acl_tos *l = new acl_tos;
1465
1466     l->tos = (tos_t)tos;
1467
1468     aclParseAclList(LegacyParser, &l->aclList, token);
1469
1470     acl_tos **tail = head;  /* sane name below */
1471     while (*tail)
1472         tail = &(*tail)->next;
1473
1474     *tail = l;
1475 }
1476
1477 static void
1478 free_acl_tos(acl_tos ** head)
1479 {
1480     delete *head;
1481     head = NULL;
1482 }
1483
1484 #if SO_MARK && USE_LIBCAP
1485
1486 static void
1487 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1488 {
1489     for (acl_nfmark *l = head; l; l = l->next) {
1490         if (l->nfmark > 0)
1491             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1492         else
1493             storeAppendPrintf(entry, "%s none", name);
1494
1495         dump_acl_list(entry, l->aclList);
1496
1497         storeAppendPrintf(entry, "\n");
1498     }
1499 }
1500
1501 static void
1502 parse_acl_nfmark(acl_nfmark ** head)
1503 {
1504     nfmark_t mark;
1505     char *token = ConfigParser::NextToken();
1506
1507     if (!token) {
1508         self_destruct();
1509         return;
1510     }
1511
1512     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1513         self_destruct();
1514         return;
1515     }
1516
1517     acl_nfmark *l = new acl_nfmark;
1518
1519     l->nfmark = mark;
1520
1521     aclParseAclList(LegacyParser, &l->aclList, token);
1522
1523     acl_nfmark **tail = head;   /* sane name below */
1524     while (*tail)
1525         tail = &(*tail)->next;
1526
1527     *tail = l;
1528 }
1529
1530 static void
1531 free_acl_nfmark(acl_nfmark ** head)
1532 {
1533     delete *head;
1534     head = NULL;
1535 }
1536 #endif /* SO_MARK */
1537
1538 static void
1539 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1540 {
1541     for (AclSizeLimit *l = head; l; l = l->next) {
1542         if (l->size != -1)
1543             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1544         else
1545             storeAppendPrintf(entry, "%s none", name);
1546
1547         dump_acl_list(entry, l->aclList);
1548
1549         storeAppendPrintf(entry, "\n");
1550     }
1551 }
1552
1553 static void
1554 parse_acl_b_size_t(AclSizeLimit ** head)
1555 {
1556     AclSizeLimit *l = new AclSizeLimit;
1557
1558     parse_b_int64_t(&l->size);
1559
1560     aclParseAclList(LegacyParser, &l->aclList, l->size);
1561
1562     AclSizeLimit **tail = head; /* sane name below */
1563     while (*tail)
1564         tail = &(*tail)->next;
1565
1566     *tail = l;
1567 }
1568
1569 static void
1570 free_acl_b_size_t(AclSizeLimit ** head)
1571 {
1572     delete *head;
1573     *head = NULL;
1574 }
1575
1576 #if USE_DELAY_POOLS
1577
1578 #include "DelayConfig.h"
1579 #include "DelayPools.h"
1580 /* do nothing - free_delay_pool_count is the magic free function.
1581  * this is why delay_pool_count isn't just marked TYPE: u_short
1582  */
1583 #define free_delay_pool_class(X)
1584 #define free_delay_pool_access(X)
1585 #define free_delay_pool_rates(X)
1586 #define dump_delay_pool_class(X, Y, Z)
1587 #define dump_delay_pool_access(X, Y, Z)
1588 #define dump_delay_pool_rates(X, Y, Z)
1589
1590 static void
1591 free_delay_pool_count(DelayConfig * cfg)
1592 {
1593     cfg->freePoolCount();
1594 }
1595
1596 static void
1597 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1598 {
1599     cfg.dumpPoolCount (entry, name);
1600 }
1601
1602 static void
1603 parse_delay_pool_count(DelayConfig * cfg)
1604 {
1605     cfg->parsePoolCount();
1606 }
1607
1608 static void
1609 parse_delay_pool_class(DelayConfig * cfg)
1610 {
1611     cfg->parsePoolClass();
1612 }
1613
1614 static void
1615 parse_delay_pool_rates(DelayConfig * cfg)
1616 {
1617     cfg->parsePoolRates();
1618 }
1619
1620 static void
1621 parse_delay_pool_access(DelayConfig * cfg)
1622 {
1623     cfg->parsePoolAccess(LegacyParser);
1624 }
1625
1626 #endif
1627
1628 #if USE_DELAY_POOLS
1629 #include "ClientDelayConfig.h"
1630 /* do nothing - free_client_delay_pool_count is the magic free function.
1631  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1632  */
1633
1634 #define free_client_delay_pool_access(X)
1635 #define free_client_delay_pool_rates(X)
1636 #define dump_client_delay_pool_access(X, Y, Z)
1637 #define dump_client_delay_pool_rates(X, Y, Z)
1638
1639 static void
1640 free_client_delay_pool_count(ClientDelayConfig * cfg)
1641 {
1642     cfg->freePoolCount();
1643 }
1644
1645 static void
1646 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1647 {
1648     cfg.dumpPoolCount (entry, name);
1649 }
1650
1651 static void
1652 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1653 {
1654     cfg->parsePoolCount();
1655 }
1656
1657 static void
1658 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1659 {
1660     cfg->parsePoolRates();
1661 }
1662
1663 static void
1664 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1665 {
1666     cfg->parsePoolAccess(LegacyParser);
1667 }
1668 #endif
1669
1670 #if USE_HTTP_VIOLATIONS
1671 static void
1672 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1673 {
1674     if (manglers)
1675         manglers->dumpAccess(entry, name);
1676 }
1677
1678 static void
1679 parse_http_header_access(HeaderManglers **pm)
1680 {
1681     char *t = NULL;
1682
1683     if ((t = ConfigParser::NextToken()) == NULL) {
1684         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1685         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1686         return;
1687     }
1688
1689     if (!*pm)
1690         *pm = new HeaderManglers;
1691     HeaderManglers *manglers = *pm;
1692     headerMangler *mangler = manglers->track(t);
1693     assert(mangler);
1694
1695     std::string directive = "http_header_access ";
1696     directive += t;
1697     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1698 }
1699
1700 static void
1701 free_HeaderManglers(HeaderManglers **pm)
1702 {
1703     // we delete the entire http_header_* mangler configuration at once
1704     if (const HeaderManglers *manglers = *pm) {
1705         delete manglers;
1706         *pm = NULL;
1707     }
1708 }
1709
1710 static void
1711 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1712 {
1713     if (manglers)
1714         manglers->dumpReplacement(entry, name);
1715 }
1716
1717 static void
1718 parse_http_header_replace(HeaderManglers **pm)
1719 {
1720     char *t = NULL;
1721
1722     if ((t = ConfigParser::NextToken()) == NULL) {
1723         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1724         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1725         return;
1726     }
1727
1728     const char *value = ConfigParser::NextQuotedOrToEol();
1729
1730     if (!*pm)
1731         *pm = new HeaderManglers;
1732     HeaderManglers *manglers = *pm;
1733     manglers->setReplacement(t, value);
1734 }
1735
1736 #endif
1737
1738 static void
1739 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1740 {
1741     SwapDir *s;
1742     int i;
1743     assert (entry);
1744
1745     for (i = 0; i < swap.n_configured; ++i) {
1746         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1747         if (!s) continue;
1748         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1749         s->dump(*entry);
1750         storeAppendPrintf(entry, "\n");
1751     }
1752 }
1753
1754 static int
1755 check_null_string(char *s)
1756 {
1757     return s == NULL;
1758 }
1759
1760 #if USE_AUTH
1761 static void
1762 parse_authparam(Auth::ConfigVector * config)
1763 {
1764     char *type_str;
1765     char *param_str;
1766
1767     if ((type_str = ConfigParser::NextToken()) == NULL)
1768         self_destruct();
1769
1770     if ((param_str = ConfigParser::NextToken()) == NULL)
1771         self_destruct();
1772
1773     /* find a configuration for the scheme in the currently parsed configs... */
1774     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1775
1776     if (schemeCfg == NULL) {
1777         /* Create a configuration based on the scheme info */
1778         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1779
1780         if (theScheme == NULL) {
1781             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1782             self_destruct();
1783         }
1784
1785         config->push_back(theScheme->createConfig());
1786         schemeCfg = Auth::Config::Find(type_str);
1787         if (schemeCfg == NULL) {
1788             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1789             self_destruct();
1790         }
1791     }
1792
1793     schemeCfg->parse(schemeCfg, config->size(), param_str);
1794 }
1795
1796 static void
1797 free_authparam(Auth::ConfigVector * cfg)
1798 {
1799     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1800     cfg->clear();
1801
1802     /* on reconfigure initialize new auth schemes for the new config. */
1803     if (reconfiguring) {
1804         Auth::Init();
1805     }
1806 }
1807
1808 static void
1809 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1810 {
1811     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1812         (*i)->dump(entry, name, (*i));
1813 }
1814 #endif /* USE_AUTH */
1815
1816 /* TODO: just return the object, the # is irrelevant */
1817 static int
1818 find_fstype(char *type)
1819 {
1820     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1821         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1822             return (int)i;
1823
1824     return (-1);
1825 }
1826
1827 static void
1828 parse_cachedir(Store::DiskConfig *swap)
1829 {
1830     char *type_str;
1831     char *path_str;
1832     RefCount<SwapDir> sd;
1833     int i;
1834     int fs;
1835
1836     if ((type_str = ConfigParser::NextToken()) == NULL)
1837         self_destruct();
1838
1839     if ((path_str = ConfigParser::NextToken()) == NULL)
1840         self_destruct();
1841
1842     fs = find_fstype(type_str);
1843
1844     if (fs < 0) {
1845         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1846         return;
1847     }
1848
1849     /* reconfigure existing dir */
1850
1851     for (i = 0; i < swap->n_configured; ++i) {
1852         assert (swap->swapDirs[i].getRaw());
1853
1854         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1855             /* this is specific to on-fs Stores. The right
1856              * way to handle this is probably to have a mapping
1857              * from paths to stores, and have on-fs stores
1858              * register with that, and lookip in that in their
1859              * own setup logic. RBC 20041225. TODO.
1860              */
1861
1862             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1863
1864             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1865                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1866                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1867                 return;
1868             }
1869
1870             sd->reconfigure();
1871             return;
1872         }
1873     }
1874
1875     /* new cache_dir */
1876     if (swap->n_configured > 63) {
1877         /* 7 bits, signed */
1878         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1879         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1880         self_destruct();
1881         return;
1882     }
1883
1884     allocate_new_swapdir(swap);
1885
1886     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1887
1888     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1889
1890     /* parse the FS parameters and options */
1891     sd->parse(swap->n_configured, path_str);
1892
1893     ++swap->n_configured;
1894 }
1895
1896 static const char *
1897 peer_type_str(const peer_t type)
1898 {
1899     const char * result;
1900
1901     switch (type) {
1902
1903     case PEER_PARENT:
1904         result = "parent";
1905         break;
1906
1907     case PEER_SIBLING:
1908         result = "sibling";
1909         break;
1910
1911     case PEER_MULTICAST:
1912         result = "multicast";
1913         break;
1914
1915     default:
1916         result = "unknown";
1917         break;
1918     }
1919
1920     return result;
1921 }
1922
1923 static void
1924 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1925 {
1926     NeighborTypeDomainList *t;
1927     LOCAL_ARRAY(char, xname, 128);
1928
1929     while (p != NULL) {
1930         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1931                           name,
1932                           p->host,
1933                           neighborTypeStr(p),
1934                           p->http_port,
1935                           p->icp.port,
1936                           p->name);
1937         dump_peer_options(entry, p);
1938
1939         if (p->access) {
1940             snprintf(xname, 128, "cache_peer_access %s", p->name);
1941             dump_acl_access(entry, xname, p->access);
1942         }
1943
1944         for (t = p->typelist; t; t = t->next) {
1945             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1946                               p->host,
1947                               peer_type_str(t->type),
1948                               t->domain);
1949         }
1950
1951         p = p->next;
1952     }
1953 }
1954
1955 /**
1956  * utility function to prevent getservbyname() being called with a numeric value
1957  * on Windows at least it returns garage results.
1958  */
1959 static bool
1960 isUnsignedNumeric(const char *str, size_t len)
1961 {
1962     if (len < 1) return false;
1963
1964     for (; len >0 && *str; ++str, --len) {
1965         if (! isdigit(*str))
1966             return false;
1967     }
1968     return true;
1969 }
1970
1971 /**
1972  \param proto   'tcp' or 'udp' for protocol
1973  \returns       Port the named service is supposed to be listening on.
1974  */
1975 static unsigned short
1976 GetService(const char *proto)
1977 {
1978     struct servent *port = NULL;
1979     /** Parses a port number or service name from the squid.conf */
1980     char *token = ConfigParser::NextToken();
1981     if (token == NULL) {
1982         self_destruct();
1983         return 0; /* NEVER REACHED */
1984     }
1985     /** Returns either the service port number from /etc/services */
1986     if ( !isUnsignedNumeric(token, strlen(token)) )
1987         port = getservbyname(token, proto);
1988     if (port != NULL) {
1989         return ntohs((unsigned short)port->s_port);
1990     }
1991     /** Or a numeric translation of the config text. */
1992     return xatos(token);
1993 }
1994
1995 /**
1996  \returns       Port the named TCP service is supposed to be listening on.
1997  \copydoc GetService(const char *proto)
1998  */
1999 inline unsigned short
2000 GetTcpService(void)
2001 {
2002     return GetService("tcp");
2003 }
2004
2005 /**
2006  \returns       Port the named UDP service is supposed to be listening on.
2007  \copydoc GetService(const char *proto)
2008  */
2009 inline unsigned short
2010 GetUdpService(void)
2011 {
2012     return GetService("udp");
2013 }
2014
2015 static void
2016 parse_peer(CachePeer ** head)
2017 {
2018     char *token = NULL;
2019     CachePeer *p = new CachePeer;
2020
2021     if ((token = ConfigParser::NextToken()) == NULL)
2022         self_destruct();
2023
2024     p->host = xstrdup(token);
2025
2026     p->name = xstrdup(token);
2027
2028     if ((token = ConfigParser::NextToken()) == NULL)
2029         self_destruct();
2030
2031     p->type = parseNeighborType(token);
2032
2033     if (p->type == PEER_MULTICAST) {
2034         p->options.no_digest = true;
2035         p->options.no_netdb_exchange = true;
2036     }
2037
2038     p->http_port = GetTcpService();
2039
2040     if (!p->http_port)
2041         self_destruct();
2042
2043     p->icp.port = GetUdpService();
2044
2045     while ((token = ConfigParser::NextToken())) {
2046         if (!strcmp(token, "proxy-only")) {
2047             p->options.proxy_only = true;
2048         } else if (!strcmp(token, "no-query")) {
2049             p->options.no_query = true;
2050         } else if (!strcmp(token, "background-ping")) {
2051             p->options.background_ping = true;
2052         } else if (!strcmp(token, "no-digest")) {
2053             p->options.no_digest = true;
2054         } else if (!strcmp(token, "no-tproxy")) {
2055             p->options.no_tproxy = true;
2056         } else if (!strcmp(token, "multicast-responder")) {
2057             p->options.mcast_responder = true;
2058 #if PEER_MULTICAST_SIBLINGS
2059         } else if (!strcmp(token, "multicast-siblings")) {
2060             p->options.mcast_siblings = true;
2061 #endif
2062         } else if (!strncmp(token, "weight=", 7)) {
2063             p->weight = xatoi(token + 7);
2064         } else if (!strncmp(token, "basetime=", 9)) {
2065             p->basetime = xatoi(token + 9);
2066         } else if (!strcmp(token, "closest-only")) {
2067             p->options.closest_only = true;
2068         } else if (!strncmp(token, "ttl=", 4)) {
2069             p->mcast.ttl = xatoi(token + 4);
2070
2071             if (p->mcast.ttl < 0)
2072                 p->mcast.ttl = 0;
2073
2074             if (p->mcast.ttl > 128)
2075                 p->mcast.ttl = 128;
2076         } else if (!strcmp(token, "default")) {
2077             p->options.default_parent = true;
2078         } else if (!strcmp(token, "round-robin")) {
2079             p->options.roundrobin = true;
2080         } else if (!strcmp(token, "weighted-round-robin")) {
2081             p->options.weighted_roundrobin = true;
2082 #if USE_HTCP
2083         } else if (!strcmp(token, "htcp")) {
2084             p->options.htcp = true;
2085         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2086             /* Note: The htcp- form is deprecated, replaced by htcp= */
2087             p->options.htcp = true;
2088             char *tmp = xstrdup(token+5);
2089             char *mode, *nextmode;
2090             for (mode = nextmode = tmp; mode; mode = nextmode) {
2091                 nextmode = strchr(mode, ',');
2092                 if (nextmode) {
2093                     *nextmode = '\0';
2094                     ++nextmode;
2095                 }
2096                 if (!strcmp(mode, "no-clr")) {
2097                     if (p->options.htcp_only_clr)
2098                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2099                     p->options.htcp_no_clr = true;
2100                 } else if (!strcmp(mode, "no-purge-clr")) {
2101                     p->options.htcp_no_purge_clr = true;
2102                 } else if (!strcmp(mode, "only-clr")) {
2103                     if (p->options.htcp_no_clr)
2104                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2105                     p->options.htcp_only_clr = true;
2106                 } else if (!strcmp(mode, "forward-clr")) {
2107                     p->options.htcp_forward_clr = true;
2108                 } else if (!strcmp(mode, "oldsquid")) {
2109                     p->options.htcp_oldsquid = true;
2110                 } else {
2111                     fatalf("invalid HTCP mode '%s'", mode);
2112                 }
2113             }
2114             safe_free(tmp);
2115 #endif
2116         } else if (!strcmp(token, "no-netdb-exchange")) {
2117             p->options.no_netdb_exchange = true;
2118
2119         } else if (!strcmp(token, "carp")) {
2120             if (p->type != PEER_PARENT)
2121                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2122
2123             p->options.carp = true;
2124         } else if (!strncmp(token, "carp-key=", 9)) {
2125             if (p->options.carp != true)
2126                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2127             p->options.carp_key.set = true;
2128             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2129             for (; key; key = nextkey) {
2130                 nextkey=strchr(key,',');
2131                 if (nextkey) ++nextkey; // skip the comma, any
2132                 if (0==strncmp(key,"scheme",6)) {
2133                     p->options.carp_key.scheme = true;
2134                 } else if (0==strncmp(key,"host",4)) {
2135                     p->options.carp_key.host = true;
2136                 } else if (0==strncmp(key,"port",4)) {
2137                     p->options.carp_key.port = true;
2138                 } else if (0==strncmp(key,"path",4)) {
2139                     p->options.carp_key.path = true;
2140                 } else if (0==strncmp(key,"params",6)) {
2141                     p->options.carp_key.params = true;
2142                 } else {
2143                     fatalf("invalid carp-key '%s'",key);
2144                 }
2145             }
2146         } else if (!strcmp(token, "userhash")) {
2147 #if USE_AUTH
2148             if (p->type != PEER_PARENT)
2149                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2150
2151             p->options.userhash = true;
2152 #else
2153             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2154 #endif
2155         } else if (!strcmp(token, "sourcehash")) {
2156             if (p->type != PEER_PARENT)
2157                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2158
2159             p->options.sourcehash = true;
2160
2161         } else if (!strcmp(token, "no-delay")) {
2162 #if USE_DELAY_POOLS
2163             p->options.no_delay = true;
2164 #else
2165             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2166 #endif
2167         } else if (!strncmp(token, "login=", 6)) {
2168             p->login = xstrdup(token + 6);
2169             rfc1738_unescape(p->login);
2170         } else if (!strcmp(token, "auth-no-keytab")) {
2171             p->options.auth_no_keytab = 1;
2172         } else if (!strncmp(token, "connect-timeout=", 16)) {
2173             p->connect_timeout = xatoi(token + 16);
2174         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2175             p->connect_fail_limit = xatoi(token + 19);
2176 #if USE_CACHE_DIGESTS
2177         } else if (!strncmp(token, "digest-url=", 11)) {
2178             p->digest_url = xstrdup(token + 11);
2179 #endif
2180
2181         } else if (!strcmp(token, "allow-miss")) {
2182             p->options.allow_miss = true;
2183         } else if (!strncmp(token, "max-conn=", 9)) {
2184             p->max_conn = xatoi(token + 9);
2185         } else if (!strncmp(token, "standby=", 8)) {
2186             p->standby.limit = xatoi(token + 8);
2187         } else if (!strcmp(token, "originserver")) {
2188             p->options.originserver = true;
2189         } else if (!strncmp(token, "name=", 5)) {
2190             safe_free(p->name);
2191
2192             if (token[5])
2193                 p->name = xstrdup(token + 5);
2194         } else if (!strncmp(token, "forceddomain=", 13)) {
2195             safe_free(p->domain);
2196             if (token[13])
2197                 p->domain = xstrdup(token + 13);
2198
2199         } else if (strncmp(token, "ssl", 3) == 0) {
2200 #if !USE_OPENSSL
2201             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2202 #else
2203             p->secure.parse(token+3);
2204 #endif
2205         } else if (strncmp(token, "tls-", 4) == 0) {
2206             p->secure.parse(token+4);
2207         } else if (strncmp(token, "tls", 3) == 0) {
2208             p->secure.parse(token+3);
2209         } else if (strcmp(token, "front-end-https") == 0) {
2210             p->front_end_https = 1;
2211         } else if (strcmp(token, "front-end-https=on") == 0) {
2212             p->front_end_https = 1;
2213         } else if (strcmp(token, "front-end-https=auto") == 0) {
2214             p->front_end_https = 2;
2215         } else if (strcmp(token, "connection-auth=off") == 0) {
2216             p->connection_auth = 0;
2217         } else if (strcmp(token, "connection-auth") == 0) {
2218             p->connection_auth = 1;
2219         } else if (strcmp(token, "connection-auth=on") == 0) {
2220             p->connection_auth = 1;
2221         } else if (strcmp(token, "connection-auth=auto") == 0) {
2222             p->connection_auth = 2;
2223         } else if (token[0] == '#') {
2224             // start of a text comment. stop reading this line.
2225             break;
2226         } else {
2227             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2228         }
2229     }
2230
2231     if (peerFindByName(p->name))
2232         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2233
2234     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2235         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2236
2237     if (p->weight < 1)
2238         p->weight = 1;
2239
2240     if (p->connect_fail_limit < 1)
2241         p->connect_fail_limit = 10;
2242
2243 #if USE_CACHE_DIGESTS
2244
2245     if (!p->options.no_digest) {
2246         /* XXX This looks odd.. who has the original pointer
2247          * then?
2248          */
2249         PeerDigest *pd = peerDigestCreate(p);
2250         p->digest = cbdataReference(pd);
2251     }
2252
2253 #endif
2254
2255     p->index =  ++Config.npeers;
2256
2257     while (*head != NULL)
2258         head = &(*head)->next;
2259
2260     *head = p;
2261
2262     peerClearRRStart();
2263 }
2264
2265 static void
2266 free_peer(CachePeer ** P)
2267 {
2268     delete *P;
2269     *P = NULL;
2270     Config.npeers = 0;
2271 }
2272
2273 static void
2274 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2275 {
2276     wordlist *w;
2277
2278     while (list != NULL) {
2279         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2280             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2281         else
2282             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2283
2284         for (w = list->actions; w != NULL; w = w->next) {
2285             storeAppendPrintf(entry, " %s", w->key);
2286         }
2287
2288         storeAppendPrintf(entry, "\n");
2289         list = list->next;
2290     }
2291 }
2292
2293 static void
2294 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2295 {
2296     char *passwd = NULL;
2297     wordlist *actions = NULL;
2298     Mgr::ActionPasswordList *p;
2299     Mgr::ActionPasswordList **P;
2300     parse_string(&passwd);
2301     parse_wordlist(&actions);
2302     p = new Mgr::ActionPasswordList;
2303     p->passwd = passwd;
2304     p->actions = actions;
2305
2306     for (P = head; *P; P = &(*P)->next) {
2307         /*
2308          * See if any of the actions from this line already have a
2309          * password from previous lines.  The password checking
2310          * routines in cache_manager.c take the the password from
2311          * the first Mgr::ActionPasswordList that contains the
2312          * requested action.  Thus, we should warn users who might
2313          * think they can have two passwords for the same action.
2314          */
2315         wordlist *w;
2316         wordlist *u;
2317
2318         for (w = (*P)->actions; w; w = w->next) {
2319             for (u = actions; u; u = u->next) {
2320                 if (strcmp(w->key, u->key))
2321                     continue;
2322
2323                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2324             }
2325         }
2326     }
2327
2328     *P = p;
2329 }
2330
2331 static void
2332 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2333 {
2334     Mgr::ActionPasswordList *p;
2335
2336     while ((p = *head) != NULL) {
2337         *head = p->next;
2338         xfree(p->passwd);
2339         wordlistDestroy(&p->actions);
2340         xfree(p);
2341     }
2342 }
2343
2344 static void
2345 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2346 {
2347     AclNameList *a;
2348
2349     while (var != NULL) {
2350         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2351
2352         for (a = var->acl_list; a != NULL; a = a->next)
2353             storeAppendPrintf(entry, " %s", a->name);
2354
2355         storeAppendPrintf(entry, "\n");
2356
2357         var = var->next;
2358     }
2359 }
2360
2361 static void
2362 parse_denyinfo(AclDenyInfoList ** var)
2363 {
2364     aclParseDenyInfoLine(var);
2365 }
2366
2367 void
2368 free_denyinfo(AclDenyInfoList ** list)
2369 {
2370     AclDenyInfoList *a = NULL;
2371     AclDenyInfoList *a_next = NULL;
2372     AclNameList *l = NULL;
2373     AclNameList *l_next = NULL;
2374
2375     for (a = *list; a; a = a_next) {
2376         for (l = a->acl_list; l; l = l_next) {
2377             l_next = l->next;
2378             memFree(l, MEM_ACL_NAME_LIST);
2379             l = NULL;
2380         }
2381
2382         a_next = a->next;
2383         memFree(a, MEM_ACL_DENY_INFO_LIST);
2384         a = NULL;
2385     }
2386
2387     *list = NULL;
2388 }
2389
2390 static void
2391 parse_peer_access(void)
2392 {
2393     char *host = NULL;
2394     CachePeer *p;
2395
2396     if (!(host = ConfigParser::NextToken()))
2397         self_destruct();
2398
2399     if ((p = peerFindByName(host)) == NULL) {
2400         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2401         return;
2402     }
2403
2404     std::string directive = "peer_access ";
2405     directive += host;
2406     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2407 }
2408
2409 static void
2410 parse_hostdomaintype(void)
2411 {
2412     char *host = NULL;
2413     char *type = NULL;
2414     char *domain = NULL;
2415
2416     if (!(host = ConfigParser::NextToken()))
2417         self_destruct();
2418
2419     if (!(type = ConfigParser::NextToken()))
2420         self_destruct();
2421
2422     while ((domain = ConfigParser::NextToken())) {
2423         NeighborTypeDomainList *l = NULL;
2424         NeighborTypeDomainList **L = NULL;
2425         CachePeer *p;
2426
2427         if ((p = peerFindByName(host)) == NULL) {
2428             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2429             return;
2430         }
2431
2432         l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2433         l->type = parseNeighborType(type);
2434         l->domain = xstrdup(domain);
2435
2436         for (L = &(p->typelist); *L; L = &((*L)->next));
2437         *L = l;
2438     }
2439 }
2440
2441 static void
2442 dump_int(StoreEntry * entry, const char *name, int var)
2443 {
2444     storeAppendPrintf(entry, "%s %d\n", name, var);
2445 }
2446
2447 void
2448 parse_int(int *var)
2449 {
2450     int i;
2451     i = GetInteger();
2452     *var = i;
2453 }
2454
2455 static void
2456 free_int(int *var)
2457 {
2458     *var = 0;
2459 }
2460
2461 static void
2462 dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2463 {
2464     storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2465 }
2466
2467 void
2468 parse_int64_t(int64_t *var)
2469 {
2470     int64_t i;
2471     i = GetInteger64();
2472     *var = i;
2473 }
2474
2475 static void
2476 free_int64_t(int64_t *var)
2477 {
2478     *var = 0;
2479 }
2480
2481 static void
2482 dump_onoff(StoreEntry * entry, const char *name, int var)
2483 {
2484     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2485 }
2486
2487 void
2488 parse_onoff(int *var)
2489 {
2490     char *token = ConfigParser::NextToken();
2491
2492     if (token == NULL)
2493         self_destruct();
2494
2495     if (!strcmp(token, "on")) {
2496         *var = 1;
2497     } else if (!strcmp(token, "enable")) {
2498         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2499         *var = 1;
2500     } else if (!strcmp(token, "off")) {
2501         *var = 0;
2502     } else if (!strcmp(token, "disable")) {
2503         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2504         *var = 0;
2505     } else {
2506         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2507         self_destruct();
2508     }
2509 }
2510
2511 #define free_onoff free_int
2512
2513 static void
2514 dump_tristate(StoreEntry * entry, const char *name, int var)
2515 {
2516     const char *state;
2517
2518     if (var > 0)
2519         state = "on";
2520     else if (var < 0)
2521         state = "warn";
2522     else
2523         state = "off";
2524
2525     storeAppendPrintf(entry, "%s %s\n", name, state);
2526 }
2527
2528 static void
2529 parse_tristate(int *var)
2530 {
2531     char *token = ConfigParser::NextToken();
2532
2533     if (token == NULL)
2534         self_destruct();
2535
2536     if (!strcmp(token, "on")) {
2537         *var = 1;
2538     } else if (!strcmp(token, "enable")) {
2539         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2540         *var = 1;
2541     } else if (!strcmp(token, "warn")) {
2542         *var = -1;
2543     } else if (!strcmp(token, "off")) {
2544         *var = 0;
2545     } else if (!strcmp(token, "disable")) {
2546         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2547         *var = 0;
2548     } else {
2549         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2550         self_destruct();
2551     }
2552 }
2553
2554 #define free_tristate free_int
2555
2556 void
2557 parse_pipelinePrefetch(int *var)
2558 {
2559     char *token = ConfigParser::PeekAtToken();
2560
2561     if (token == NULL)
2562         self_destruct();
2563
2564     if (!strcmp(token, "on")) {
2565         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2566         *var = 1;
2567         //pop the token
2568         (void)ConfigParser::NextToken();
2569     } else if (!strcmp(token, "off")) {
2570         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2571         *var = 0;
2572         //pop the token
2573         (void)ConfigParser::NextToken();
2574     } else
2575         parse_int(var);
2576 }
2577
2578 #define free_pipelinePrefetch free_int
2579 #define dump_pipelinePrefetch dump_int
2580
2581 static void
2582 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2583 {
2584     while (head != NULL) {
2585         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2586                           name,
2587                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2588                           head->pattern.c_str(),
2589                           (int) head->min / 60,
2590                           (int) (100.0 * head->pct + 0.5),
2591                           (int) head->max / 60);
2592
2593         if (head->max_stale >= 0)
2594             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2595
2596         if (head->flags.refresh_ims)
2597             storeAppendPrintf(entry, " refresh-ims");
2598
2599         if (head->flags.store_stale)
2600             storeAppendPrintf(entry, " store-stale");
2601
2602 #if USE_HTTP_VIOLATIONS
2603
2604         if (head->flags.override_expire)
2605             storeAppendPrintf(entry, " override-expire");
2606
2607         if (head->flags.override_lastmod)
2608             storeAppendPrintf(entry, " override-lastmod");
2609
2610         if (head->flags.reload_into_ims)
2611             storeAppendPrintf(entry, " reload-into-ims");
2612
2613         if (head->flags.ignore_reload)
2614             storeAppendPrintf(entry, " ignore-reload");
2615
2616         if (head->flags.ignore_no_store)
2617             storeAppendPrintf(entry, " ignore-no-store");
2618
2619         if (head->flags.ignore_private)
2620             storeAppendPrintf(entry, " ignore-private");
2621 #endif
2622
2623         storeAppendPrintf(entry, "\n");
2624
2625         head = head->next;
2626     }
2627 }
2628
2629 static void
2630 parse_refreshpattern(RefreshPattern ** head)
2631 {
2632     char *token;
2633     char *pattern;
2634     time_t min = 0;
2635     double pct = 0.0;
2636     time_t max = 0;
2637     int refresh_ims = 0;
2638     int store_stale = 0;
2639     int max_stale = -1;
2640
2641 #if USE_HTTP_VIOLATIONS
2642
2643     int override_expire = 0;
2644     int override_lastmod = 0;
2645     int reload_into_ims = 0;
2646     int ignore_reload = 0;
2647     int ignore_no_store = 0;
2648     int ignore_private = 0;
2649 #endif
2650
2651     int i;
2652     RefreshPattern *t;
2653     regex_t comp;
2654     int errcode;
2655     int flags = REG_EXTENDED | REG_NOSUB;
2656
2657     if ((token = ConfigParser::RegexPattern()) != NULL) {
2658
2659         if (strcmp(token, "-i") == 0) {
2660             flags |= REG_ICASE;
2661             token = ConfigParser::RegexPattern();
2662         } else if (strcmp(token, "+i") == 0) {
2663             flags &= ~REG_ICASE;
2664             token = ConfigParser::RegexPattern();
2665         }
2666
2667     }
2668
2669     if (token == NULL) {
2670         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2671         self_destruct();
2672         return;
2673     }
2674
2675     pattern = xstrdup(token);
2676
2677     i = GetInteger();       /* token: min */
2678
2679     /* catch negative and insanely huge values close to 32-bit wrap */
2680     if (i < 0) {
2681         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2682         i = 0;
2683     }
2684     if (i > 60*24*365) {
2685         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2686         i = 60*24*365;
2687     }
2688
2689     min = (time_t) (i * 60);    /* convert minutes to seconds */
2690
2691     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2692
2693     i = GetInteger();       /* token: max */
2694
2695     /* catch negative and insanely huge values close to 32-bit wrap */
2696     if (i < 0) {
2697         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2698         i = 0;
2699     }
2700     if (i > 60*24*365) {
2701         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2702         i = 60*24*365;
2703     }
2704
2705     max = (time_t) (i * 60);    /* convert minutes to seconds */
2706
2707     /* Options */
2708     while ((token = ConfigParser::NextToken()) != NULL) {
2709         if (!strcmp(token, "refresh-ims")) {
2710             refresh_ims = 1;
2711         } else if (!strcmp(token, "store-stale")) {
2712             store_stale = 1;
2713         } else if (!strncmp(token, "max-stale=", 10)) {
2714             max_stale = xatoi(token + 10);
2715
2716 #if USE_HTTP_VIOLATIONS
2717
2718         } else if (!strcmp(token, "override-expire"))
2719             override_expire = 1;
2720         else if (!strcmp(token, "override-lastmod"))
2721             override_lastmod = 1;
2722         else if (!strcmp(token, "ignore-no-store"))
2723             ignore_no_store = 1;
2724         else if (!strcmp(token, "ignore-private"))
2725             ignore_private = 1;
2726         else if (!strcmp(token, "reload-into-ims")) {
2727             reload_into_ims = 1;
2728             refresh_nocache_hack = 1;
2729             /* tell client_side.c that this is used */
2730         } else if (!strcmp(token, "ignore-reload")) {
2731             ignore_reload = 1;
2732             refresh_nocache_hack = 1;
2733             /* tell client_side.c that this is used */
2734 #endif
2735
2736         } else if (!strcmp(token, "ignore-no-cache") ||
2737                    !strcmp(token, "ignore-must-revalidate") ||
2738                    !strcmp(token, "ignore-auth")
2739                   ) {
2740             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2741         } else
2742             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2743     }
2744
2745     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2746         char errbuf[256];
2747         regerror(errcode, &comp, errbuf, sizeof errbuf);
2748         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2749         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2750         xfree(pattern);
2751         return;
2752     }
2753
2754     pct = pct < 0.0 ? 0.0 : pct;
2755     max = max < 0 ? 0 : max;
2756     t = new RefreshPattern(pattern, flags);
2757     t->pattern.regex = comp;
2758     t->min = min;
2759     t->pct = pct;
2760     t->max = max;
2761
2762     if (refresh_ims)
2763         t->flags.refresh_ims = true;
2764
2765     if (store_stale)
2766         t->flags.store_stale = true;
2767
2768     t->max_stale = max_stale;
2769
2770 #if USE_HTTP_VIOLATIONS
2771
2772     if (override_expire)
2773         t->flags.override_expire = true;
2774
2775     if (override_lastmod)
2776         t->flags.override_lastmod = true;
2777
2778     if (reload_into_ims)
2779         t->flags.reload_into_ims = true;
2780
2781     if (ignore_reload)
2782         t->flags.ignore_reload = true;
2783
2784     if (ignore_no_store)
2785         t->flags.ignore_no_store = true;
2786
2787     if (ignore_private)
2788         t->flags.ignore_private = true;
2789 #endif
2790
2791     t->next = NULL;
2792
2793     while (*head)
2794         head = &(*head)->next;
2795
2796     *head = t;
2797
2798     xfree(pattern);
2799 }
2800
2801 static void
2802 free_refreshpattern(RefreshPattern ** head)
2803 {
2804     delete *head;
2805     *head = nullptr;
2806
2807 #if USE_HTTP_VIOLATIONS
2808     refresh_nocache_hack = 0;
2809
2810 #endif
2811 }
2812
2813 static void
2814 dump_string(StoreEntry * entry, const char *name, char *var)
2815 {
2816     if (var != NULL)
2817         storeAppendPrintf(entry, "%s %s\n", name, var);
2818 }
2819
2820 static void
2821 parse_string(char **var)
2822 {
2823     char *token = ConfigParser::NextToken();
2824     safe_free(*var);
2825
2826     if (token == NULL)
2827         self_destruct();
2828
2829     *var = xstrdup(token);
2830 }
2831
2832 static void
2833 free_string(char **var)
2834 {
2835     safe_free(*var);
2836 }
2837
2838 void
2839 parse_eol(char *volatile *var)
2840 {
2841     if (!var) {
2842         self_destruct();
2843         return;
2844     }
2845
2846     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2847     safe_free(*var);
2848
2849     if (!token) {
2850         self_destruct();
2851         return;
2852     }
2853
2854     while (*token && xisspace(*token))
2855         ++token;
2856
2857     if (!*token) {
2858         self_destruct();
2859         return;
2860     }
2861
2862     *var = xstrdup((char *) token);
2863 }
2864
2865 #define dump_eol dump_string
2866 #define free_eol free_string
2867
2868 static void
2869 parse_TokenOrQuotedString(char **var)
2870 {
2871     char *token = ConfigParser::NextQuotedToken();
2872     safe_free(*var);
2873
2874     if (token == NULL)
2875         self_destruct();
2876
2877     *var = xstrdup(token);
2878 }
2879
2880 #define dump_TokenOrQuotedString dump_string
2881 #define free_TokenOrQuotedString free_string
2882
2883 static void
2884 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2885 {
2886     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2887 }
2888
2889 void
2890 parse_time_t(time_t * var)
2891 {
2892     time_msec_t tval;
2893     parseTimeLine(&tval, T_SECOND_STR, false);
2894     *var = static_cast<time_t>(tval/1000);
2895 }
2896
2897 static void
2898 free_time_t(time_t * var)
2899 {
2900     *var = 0;
2901 }
2902
2903 static void
2904 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2905 {
2906     if (var % 1000)
2907         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2908     else
2909         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2910 }
2911
2912 void
2913 parse_time_msec(time_msec_t * var)
2914 {
2915     parseTimeLine(var, T_SECOND_STR, true);
2916 }
2917
2918 static void
2919 free_time_msec(time_msec_t * var)
2920 {
2921     *var = 0;
2922 }
2923
2924 #if UNUSED_CODE
2925 static void
2926 dump_size_t(StoreEntry * entry, const char *name, size_t var)
2927 {
2928     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
2929 }
2930 #endif
2931
2932 static void
2933 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
2934 {
2935     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2936 }
2937
2938 static void
2939 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
2940 {
2941     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2942 }
2943
2944 #if UNUSED_CODE
2945 static void
2946 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
2947 {
2948     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
2949 }
2950 #endif
2951
2952 static void
2953 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
2954 {
2955     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
2956 }
2957
2958 static void
2959 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
2960 {
2961     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
2962 }
2963
2964 #if UNUSED_CODE
2965 static void
2966 parse_size_t(size_t * var)
2967 {
2968     int i;
2969     i = GetInteger();
2970     *var = (size_t) i;
2971 }
2972 #endif
2973
2974 static void
2975 parse_b_size_t(size_t * var)
2976 {
2977     parseBytesLine(var, B_BYTES_STR);
2978 }
2979
2980 static void
2981 parse_b_ssize_t(ssize_t * var)
2982 {
2983     parseBytesLineSigned(var, B_BYTES_STR);
2984 }
2985
2986 #if UNUSED_CODE
2987 static void
2988 parse_kb_size_t(size_t * var)
2989 {
2990     parseBytesLine(var, B_KBYTES_STR);
2991 }
2992 #endif
2993
2994 static void
2995 parse_b_int64_t(int64_t * var)
2996 {
2997     parseBytesLine64(var, B_BYTES_STR);
2998 }
2999
3000 static void
3001 parse_kb_int64_t(int64_t * var)
3002 {
3003     parseBytesLine64(var, B_KBYTES_STR);
3004 }
3005
3006 static void
3007 free_size_t(size_t * var)
3008 {
3009     *var = 0;
3010 }
3011
3012 static void
3013 free_ssize_t(ssize_t * var)
3014 {
3015     *var = 0;
3016 }
3017
3018 static void
3019 free_b_int64_t(int64_t * var)
3020 {
3021     *var = 0;
3022 }
3023
3024 #define free_b_size_t free_size_t
3025 #define free_b_ssize_t free_ssize_t
3026 #define free_kb_size_t free_size_t
3027 #define free_mb_size_t free_size_t
3028 #define free_gb_size_t free_size_t
3029 #define free_kb_int64_t free_b_int64_t
3030
3031 static void
3032 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3033 {
3034     storeAppendPrintf(entry, "%s %d\n", name, var);
3035 }
3036
3037 static void
3038 free_u_short(unsigned short * u)
3039 {
3040     *u = 0;
3041 }
3042
3043 static void
3044 parse_u_short(unsigned short * var)
3045 {
3046     ConfigParser::ParseUShort(var);
3047 }
3048
3049 void
3050 ConfigParser::ParseUShort(unsigned short *var)
3051 {
3052     *var = GetShort();
3053 }
3054
3055 void
3056 ConfigParser::ParseBool(bool *var)
3057 {
3058     int i = GetInteger();
3059
3060     if (0 == i)
3061         *var = false;
3062     else if (1 == i)
3063         *var = true;
3064     else
3065         self_destruct();
3066 }
3067
3068 static void
3069 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3070 {
3071     while (list != NULL) {
3072         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3073         list = list->next;
3074     }
3075 }
3076
3077 void
3078 ConfigParser::ParseWordList(wordlist ** list)
3079 {
3080     parse_wordlist(list);
3081 }
3082
3083 void
3084 parse_wordlist(wordlist ** list)
3085 {
3086     char *token;
3087     while ((token = ConfigParser::NextQuotedToken()))
3088         wordlistAdd(list, token);
3089 }
3090
3091 #if 0 /* now unused */
3092 static int
3093 check_null_wordlist(wordlist * w)
3094 {
3095     return w == NULL;
3096 }
3097 #endif
3098
3099 static int
3100 check_null_acl_access(acl_access * a)
3101 {
3102     return a == NULL;
3103 }
3104
3105 #define free_wordlist wordlistDestroy
3106
3107 #define free_uri_whitespace free_int
3108
3109 static void
3110 parse_uri_whitespace(int *var)
3111 {
3112     char *token = ConfigParser::NextToken();
3113
3114     if (token == NULL)
3115         self_destruct();
3116
3117     if (!strcmp(token, "strip"))
3118         *var = URI_WHITESPACE_STRIP;
3119     else if (!strcmp(token, "deny"))
3120         *var = URI_WHITESPACE_DENY;
3121     else if (!strcmp(token, "allow"))
3122         *var = URI_WHITESPACE_ALLOW;
3123     else if (!strcmp(token, "encode"))
3124         *var = URI_WHITESPACE_ENCODE;
3125     else if (!strcmp(token, "chop"))
3126         *var = URI_WHITESPACE_CHOP;
3127     else {
3128         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3129         self_destruct();
3130     }
3131 }
3132
3133 static void
3134 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3135 {
3136     const char *s;
3137
3138     if (var == URI_WHITESPACE_ALLOW)
3139         s = "allow";
3140     else if (var == URI_WHITESPACE_ENCODE)
3141         s = "encode";
3142     else if (var == URI_WHITESPACE_CHOP)
3143         s = "chop";
3144     else if (var == URI_WHITESPACE_DENY)
3145         s = "deny";
3146     else
3147         s = "strip";
3148
3149     storeAppendPrintf(entry, "%s %s\n", name, s);
3150 }
3151
3152 static void
3153 free_removalpolicy(RemovalPolicySettings ** settings)
3154 {
3155     if (!*settings)
3156         return;
3157
3158     free_string(&(*settings)->type);
3159
3160     free_wordlist(&(*settings)->args);
3161
3162     delete *settings;
3163
3164     *settings = NULL;
3165 }
3166
3167 static void
3168 parse_removalpolicy(RemovalPolicySettings ** settings)
3169 {
3170     if (*settings)
3171         free_removalpolicy(settings);
3172
3173     *settings = new RemovalPolicySettings;
3174
3175     parse_string(&(*settings)->type);
3176
3177     parse_wordlist(&(*settings)->args);
3178 }
3179
3180 static void
3181 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3182 {
3183     wordlist *args;
3184     storeAppendPrintf(entry, "%s %s", name, settings->type);
3185     args = settings->args;
3186
3187     while (args) {
3188         storeAppendPrintf(entry, " %s", args->key);
3189         args = args->next;
3190     }
3191
3192     storeAppendPrintf(entry, "\n");
3193 }
3194
3195 inline void
3196 free_YesNoNone(YesNoNone *)
3197 {}
3198
3199 static void
3200 parse_YesNoNone(YesNoNone *option)
3201 {
3202     int value = 0;
3203     parse_onoff(&value);
3204     option->configure(value > 0);
3205 }
3206
3207 static void
3208 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3209 {
3210     if (option.configured())
3211         dump_onoff(entry, name, option ? 1 : 0);
3212 }
3213
3214 static void
3215 free_memcachemode(SquidConfig *)
3216 {}
3217
3218 static void
3219 parse_memcachemode(SquidConfig *)
3220 {
3221     char *token = ConfigParser::NextToken();
3222     if (!token)
3223         self_destruct();
3224
3225     if (strcmp(token, "always") == 0) {
3226         Config.onoff.memory_cache_first = 1;
3227         Config.onoff.memory_cache_disk = 1;
3228     } else if (strcmp(token, "disk") == 0) {
3229         Config.onoff.memory_cache_first = 0;
3230         Config.onoff.memory_cache_disk = 1;
3231     } else if (strncmp(token, "net", 3) == 0) {
3232         Config.onoff.memory_cache_first = 1;
3233         Config.onoff.memory_cache_disk = 0;
3234     } else if (strcmp(token, "never") == 0) {
3235         Config.onoff.memory_cache_first = 0;
3236         Config.onoff.memory_cache_disk = 0;
3237     } else {
3238         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3239         self_destruct();
3240     }
3241 }
3242
3243 static void
3244 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3245 {
3246     storeAppendPrintf(entry, "%s ", name);
3247     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3248         storeAppendPrintf(entry, "always");
3249     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3250         storeAppendPrintf(entry, "disk");
3251     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3252         storeAppendPrintf(entry, "network");
3253     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3254         storeAppendPrintf(entry, "none");
3255     storeAppendPrintf(entry, "\n");
3256 }
3257
3258 #include "cf_parser.cci"
3259
3260 peer_t
3261 parseNeighborType(const char *s)
3262 {
3263     if (!strcmp(s, "parent"))
3264         return PEER_PARENT;
3265
3266     if (!strcmp(s, "neighbor"))
3267         return PEER_SIBLING;
3268
3269     if (!strcmp(s, "neighbour"))
3270         return PEER_SIBLING;
3271
3272     if (!strcmp(s, "sibling"))
3273         return PEER_SIBLING;
3274
3275     if (!strcmp(s, "multicast"))
3276         return PEER_MULTICAST;
3277
3278     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3279
3280     return PEER_SIBLING;
3281 }
3282
3283 #if USE_WCCPv2
3284 static void
3285 parse_IpAddress_list(Ip::Address_list ** head)
3286 {
3287     char *token;
3288     Ip::Address_list *s;
3289     Ip::Address ipa;
3290
3291     while ((token = ConfigParser::NextToken())) {
3292         if (GetHostWithPort(token, &ipa)) {
3293
3294             while (*head)
3295                 head = &(*head)->next;
3296
3297             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3298             s->s = ipa;
3299
3300             *head = s;
3301         } else
3302             self_destruct();
3303     }
3304 }
3305
3306 static void
3307 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3308 {
3309     char ntoabuf[MAX_IPSTRLEN];
3310
3311     while (s) {
3312         storeAppendPrintf(e, "%s %s\n",
3313                           n,
3314                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3315         s = s->next;
3316     }
3317 }
3318
3319 static void
3320 free_IpAddress_list(Ip::Address_list ** head)
3321 {
3322     if (*head) delete *head;
3323     *head = NULL;
3324 }
3325
3326 #if CURRENTLY_UNUSED
3327 /* This code was previously used by http_port. Left as it really should
3328  * be used by icp_port and htcp_port
3329  */
3330 static int
3331 check_null_IpAddress_list(const Ip::Address_list * s)
3332 {
3333     return NULL == s;
3334 }
3335
3336 #endif /* CURRENTLY_UNUSED */
3337 #endif /* USE_WCCPv2 */
3338
3339 static void
3340 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3341 {
3342     char *host = NULL;
3343     unsigned short port = 0;
3344     char *t = NULL;
3345     char *junk = NULL;
3346
3347     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3348     s->name = xstrdup(token);
3349     s->connection_auth_disabled = false;
3350
3351     const char *portType = AnyP::UriScheme(s->transport.protocol).c_str();
3352
3353     if (*token == '[') {
3354         /* [ipv6]:port */
3355         host = token + 1;
3356         t = strchr(host, ']');
3357         if (!t) {
3358             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3359             self_destruct();
3360         }
3361         *t = '\0';
3362         ++t;
3363         if (*t != ':') {
3364             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3365             self_destruct();
3366         }
3367         if (!Ip::EnableIpv6) {
3368             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3369             self_destruct();
3370         }
3371         port = xatos(t + 1);
3372     } else if ((t = strchr(token, ':'))) {
3373         /* host:port */
3374         /* ipv4:port */
3375         host = token;
3376         *t = '\0';
3377         port = xatos(t + 1);
3378
3379     } else if (strtol(token, &junk, 10) && !*junk) {
3380         port = xatos(token);
3381         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3382     } else {
3383         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3384         self_destruct();
3385     }
3386
3387     if (port == 0 && host != NULL) {
3388         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3389         self_destruct();
3390     }
3391
3392     if (NULL == host) {
3393         s->s.setAnyAddr();
3394         s->s.port(port);
3395         if (!Ip::EnableIpv6)
3396             s->s.setIPv4();
3397         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3398     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3399         s->s.port(port);
3400         if (!Ip::EnableIpv6)
3401             s->s.setIPv4();
3402         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3403     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3404         /* dont use ipcache */
3405         s->defaultsite = xstrdup(host);
3406         s->s.port(port);
3407         if (!Ip::EnableIpv6)
3408             s->s.setIPv4();
3409         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3410     } else {
3411         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3412         self_destruct();
3413     }
3414 }
3415
3416 /// parses the protocol= option of the *_port directive, returning parsed value
3417 /// unsupported option values result in a fatal error message
3418 /// upper case values required; caller may convert for backward compatibility
3419 static AnyP::ProtocolVersion
3420 parsePortProtocol(const SBuf &value)
3421 {
3422     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3423     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3424     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3425         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3426
3427     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3428         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3429
3430     if (value.cmp("FTP") == 0)
3431         return Ftp::ProtocolVersion();
3432
3433     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3434     return AnyP::ProtocolVersion(); // not reached
3435 }
3436
3437 static void
3438 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3439 {
3440     /* modes first */
3441
3442     if (strcmp(token, "accel") == 0) {
3443         if (s->flags.isIntercepted()) {
3444             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3445             self_destruct();
3446         }
3447         s->flags.accelSurrogate = true;
3448         s->vhost = true;
3449     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3450         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3451             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3452             self_destruct();
3453         }
3454         s->flags.natIntercept = true;
3455         Ip::Interceptor.StartInterception();
3456         /* Log information regarding the port modes under interception. */
3457         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3458         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3459     } else if (strcmp(token, "tproxy") == 0) {
3460         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3461             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3462             self_destruct();
3463         }
3464         s->flags.tproxyIntercept = true;
3465         Ip::Interceptor.StartTransparency();
3466         /* Log information regarding the port modes under transparency. */
3467         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3468
3469         if (s->flags.proxySurrogate) {
3470             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3471         }
3472
3473         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3474             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3475             self_destruct();
3476         }
3477
3478     } else if (strcmp(token, "require-proxy-header") == 0) {
3479         s->flags.proxySurrogate = true;
3480         if (s->flags.tproxyIntercept) {
3481             // receiving is still permitted, so we do not unset the TPROXY flag
3482             // spoofing access control override takes care of the spoof disable later
3483             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3484         }
3485
3486     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3487         if (!s->flags.accelSurrogate) {
3488             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3489             self_destruct();
3490         }
3491         safe_free(s->defaultsite);
3492         s->defaultsite = xstrdup(token + 12);
3493     } else if (strcmp(token, "vhost") == 0) {
3494         if (!s->flags.accelSurrogate) {
3495             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3496         }
3497         s->flags.accelSurrogate = true;
3498         s->vhost = true;
3499     } else if (strcmp(token, "no-vhost") == 0) {
3500         if (!s->flags.accelSurrogate) {
3501             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3502         }
3503         s->vhost = false;
3504     } else if (strcmp(token, "vport") == 0) {
3505         if (!s->flags.accelSurrogate) {
3506             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3507             self_destruct();
3508         }
3509         s->vport = -1;
3510     } else if (strncmp(token, "vport=", 6) == 0) {
3511         if (!s->flags.accelSurrogate) {
3512             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3513             self_destruct();
3514         }
3515         s->vport = xatos(token + 6);
3516     } else if (strncmp(token, "protocol=", 9) == 0) {
3517         if (!s->flags.accelSurrogate) {
3518             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3519             self_destruct();
3520         }
3521         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3522     } else if (strcmp(token, "allow-direct") == 0) {
3523         if (!s->flags.accelSurrogate) {
3524             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3525             self_destruct();
3526         }
3527         s->allow_direct = true;
3528     } else if (strcmp(token, "act-as-origin") == 0) {
3529         if (!s->flags.accelSurrogate) {
3530             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3531         } else
3532             s->actAsOrigin = true;
3533     } else if (strcmp(token, "ignore-cc") == 0) {
3534 #if !USE_HTTP_VIOLATIONS
3535         if (!s->flags.accelSurrogate) {
3536             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3537             self_destruct();
3538         }
3539 #endif
3540         s->ignore_cc = true;
3541     } else if (strncmp(token, "name=", 5) == 0) {
3542         safe_free(s->name);
3543         s->name = xstrdup(token + 5);
3544     } else if (strcmp(token, "no-connection-auth") == 0) {
3545         s->connection_auth_disabled = true;
3546     } else if (strcmp(token, "connection-auth=off") == 0) {
3547         s->connection_auth_disabled = true;
3548     } else if (strcmp(token, "connection-auth") == 0) {
3549         s->connection_auth_disabled = false;
3550     } else if (strcmp(token, "connection-auth=on") == 0) {
3551         s->connection_auth_disabled = false;
3552     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3553         if (!strcmp(token + 23, "off"))
3554             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3555         else if (!strcmp(token + 23, "transparent"))
3556             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3557         else if (!strcmp(token + 23, "always"))
3558             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3559         else
3560             self_destruct();
3561     } else if (strcmp(token, "ipv4") == 0) {
3562         if ( !s->s.setIPv4() ) {
3563             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3564             self_destruct();
3565         }
3566     } else if (strcmp(token, "tcpkeepalive") == 0) {
3567         s->tcp_keepalive.enabled = true;
3568     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3569         char *t = token + 13;
3570         s->tcp_keepalive.enabled = true;
3571         s->tcp_keepalive.idle = xatoui(t,',');
3572         t = strchr(t, ',');
3573         if (t) {
3574             ++t;
3575             s->tcp_keepalive.interval = xatoui(t,',');
3576             t = strchr(t, ',');
3577         }
3578         if (t) {
3579             ++t;
3580             s->tcp_keepalive.timeout = xatoui(t);
3581         }
3582 #if USE_OPENSSL
3583     } else if (strcmp(token, "sslBump") == 0) {
3584         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3585                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3586         s->flags.tunnelSslBumping = true;
3587     } else if (strcmp(token, "ssl-bump") == 0) {
3588         s->flags.tunnelSslBumping = true;
3589     } else if (strncmp(token, "cert=", 5) == 0) {
3590         s->secure.parse(token);
3591     } else if (strncmp(token, "key=", 4) == 0) {
3592         s->secure.parse(token);
3593     } else if (strncmp(token, "version=", 8) == 0) {
3594         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3595                "in " << cfg_directive << ". Use 'options=' instead.");
3596         s->secure.parse(token);
3597     } else if (strncmp(token, "options=", 8) == 0) {
3598         s->secure.parse(token);
3599     } else if (strncmp(token, "cipher=", 7) == 0) {
3600         s->secure.parse(token);
3601     } else if (strncmp(token, "clientca=", 9) == 0) {
3602         safe_free(s->clientca);
3603         s->clientca = xstrdup(token + 9);
3604     } else if (strncmp(token, "cafile=", 7) == 0) {
3605         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3606                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3607         s->secure.parse(token);
3608     } else if (strncmp(token, "capath=", 7) == 0) {
3609         s->secure.parse(token);
3610     } else if (strncmp(token, "crlfile=", 8) == 0) {
3611         s->secure.parse(token);
3612     } else if (strncmp(token, "dhparams=", 9) == 0) {
3613         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3614                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3615         s->secure.parse(token);
3616     } else if (strncmp(token, "sslflags=", 9) == 0) {
3617         // NP: deprecation warnings output by secure.parse() when relevant
3618         s->secure.parse(token+3);
3619     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3620         safe_free(s->sslContextSessionId);
3621         s->sslContextSessionId = xstrdup(token + 11);
3622     } else if (strcmp(token, "generate-host-certificates") == 0) {
3623         s->generateHostCertificates = true;
3624     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3625         s->generateHostCertificates = true;
3626     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3627         s->generateHostCertificates = false;
3628     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3629         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3630 #endif
3631     } else if (strncmp(token, "tls-", 4) == 0) {
3632         s->secure.parse(token+4);
3633     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3634         s->ftp_track_dirs = true;
3635     } else {
3636         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3637         self_destruct();
3638     }
3639 }
3640
3641 void
3642 add_http_port(char *portspec)
3643 {
3644     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3645     s->transport = parsePortProtocol(SBuf("HTTP"));
3646     parsePortSpecification(s, portspec);
3647     // we may need to merge better if the above returns a list with clones
3648     assert(s->next == NULL);
3649     s->next = HttpPortList;
3650     HttpPortList = s;
3651 }
3652
3653 static void
3654 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3655 {
3656     SBuf protoName;
3657     if (strcmp(optionName, "http_port") == 0 ||
3658             strcmp(optionName, "ascii_port") == 0)
3659         protoName = "HTTP";
3660     else if (strcmp(optionName, "https_port") == 0)
3661         protoName = "HTTPS";
3662     else if (strcmp(optionName, "ftp_port") == 0)
3663         protoName = "FTP";
3664     if (protoName.isEmpty()) {
3665         self_destruct();
3666         return;
3667     }
3668
3669     char *token = ConfigParser::NextToken();
3670
3671     if (!token) {
3672         self_destruct();
3673         return;
3674     }
3675
3676     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3677     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3678     parsePortSpecification(s, token);
3679
3680     /* parse options ... */
3681     while ((token = ConfigParser::NextToken())) {
3682         parse_port_option(s, token);
3683     }
3684
3685 #if USE_OPENSSL
3686     // if clientca has been defined but not cafile, then use it to verify
3687     // but if cafile has been defined, only use that to verify
3688     if (s->clientca && !s->secure.caFiles.size())
3689         s->secure.caFiles.emplace_back(SBuf(s->clientca));
3690 #endif
3691
3692     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3693         s->secure.encryptTransport = true;
3694 #if USE_OPENSSL
3695         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3696         const bool hijacked = s->flags.isIntercepted();
3697         if (s->flags.tunnelSslBumping && !hijacked) {
3698             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3699             self_destruct();
3700         }
3701         if (hijacked && !s->flags.tunnelSslBumping) {
3702             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3703             self_destruct();
3704         }
3705 #endif
3706         if (s->flags.proxySurrogate) {
3707             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3708             self_destruct();
3709         }
3710     } else if (protoName.cmp("FTP") == 0) {
3711         /* ftp_port does not support ssl-bump */
3712         if (s->flags.tunnelSslBumping) {
3713             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3714             self_destruct();
3715         }
3716         if (s->flags.proxySurrogate) {
3717             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3718             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3719             self_destruct();
3720         }
3721     }
3722
3723     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3724         // clone the port options from *s to *(s->next)
3725         s->next = s->clone();
3726         s->next->s.setIPv4();
3727         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).c_str() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3728     }
3729
3730     while (*head != NULL)
3731         head = &((*head)->next);
3732
3733     *head = s;
3734 }
3735
3736 static void
3737 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3738 {
3739     char buf[MAX_IPSTRLEN];
3740
3741     storeAppendPrintf(e, "%s %s",
3742                       n,
3743                       s->s.toUrl(buf,MAX_IPSTRLEN));
3744
3745     // MODES and specific sub-options.
3746     if (s->flags.natIntercept)
3747         storeAppendPrintf(e, " intercept");
3748
3749     else if (s->flags.tproxyIntercept)
3750         storeAppendPrintf(e, " tproxy");
3751
3752     else if (s->flags.proxySurrogate)
3753         storeAppendPrintf(e, " require-proxy-header");
3754
3755     else if (s->flags.accelSurrogate) {
3756         storeAppendPrintf(e, " accel");
3757
3758         if (s->vhost)
3759             storeAppendPrintf(e, " vhost");
3760
3761         if (s->vport < 0)
3762             storeAppendPrintf(e, " vport");
3763         else if (s->vport > 0)
3764             storeAppendPrintf(e, " vport=%d", s->vport);
3765
3766         if (s->defaultsite)
3767             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3768
3769         // TODO: compare against prefix of 'n' instead of assuming http_port
3770         if (s->transport.protocol != AnyP::PROTO_HTTP)
3771             storeAppendPrintf(e, " protocol=%s", AnyP::UriScheme(s->transport.protocol).c_str());
3772
3773         if (s->allow_direct)
3774             storeAppendPrintf(e, " allow-direct");
3775
3776         if (s->ignore_cc)
3777             storeAppendPrintf(e, " ignore-cc");
3778
3779     }
3780
3781     // Generic independent options
3782
3783     if (s->name)
3784         storeAppendPrintf(e, " name=%s", s->name);
3785
3786 #if USE_HTTP_VIOLATIONS
3787     if (!s->flags.accelSurrogate && s->ignore_cc)
3788         storeAppendPrintf(e, " ignore-cc");
3789 #endif
3790
3791     if (s->connection_auth_disabled)
3792         storeAppendPrintf(e, " connection-auth=off");
3793     else
3794         storeAppendPrintf(e, " connection-auth=on");
3795
3796     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3797         const char *pmtu;
3798
3799         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3800             pmtu = "always";
3801         else
3802             pmtu = "transparent";
3803
3804         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3805     }
3806
3807     if (s->s.isAnyAddr() && !s->s.isIPv6())
3808         storeAppendPrintf(e, " ipv4");
3809
3810     if (s->tcp_keepalive.enabled) {
3811         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3812             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3813         } else {
3814             storeAppendPrintf(e, " tcpkeepalive");
3815         }
3816     }
3817
3818 #if USE_OPENSSL
3819     if (s->flags.tunnelSslBumping)
3820         storeAppendPrintf(e, " ssl-bump");
3821 #endif
3822
3823     s->secure.dumpCfg(e, "tls-");
3824
3825 #if USE_OPENSSL
3826     if (s->sslContextSessionId)
3827         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3828
3829     if (s->generateHostCertificates)
3830         storeAppendPrintf(e, " generate-host-certificates");
3831
3832     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3833         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3834 #endif
3835 }
3836
3837 static void
3838 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3839 {
3840     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3841         dump_generic_port(e, n, p);
3842         storeAppendPrintf(e, "\n");
3843     }
3844 }
3845
3846 void
3847 configFreeMemory(void)
3848 {
3849     free_all();
3850 #if USE_OPENSSL
3851     SSL_CTX_free(Config.ssl_client.sslContext);
3852     Ssl::unloadSquidUntrusted();
3853 #endif
3854 }
3855
3856 void
3857 requirePathnameExists(const char *name, const char *path)
3858 {
3859
3860     struct stat sb;
3861     char pathbuf[BUFSIZ];
3862     assert(path != NULL);
3863
3864     if (Config.chroot_dir && (geteuid() == 0)) {
3865         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3866         path = pathbuf;
3867     }
3868
3869     if (stat(path, &sb) < 0) {
3870         int xerrno = errno;
3871         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
3872         // keep going to find more issues if we are only checking the config file with "-k parse"
3873         if (opt_parse_cfg_only)
3874             return;
3875         // this is fatal if it is found during startup or reconfigure
3876         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3877             fatalf("%s %s: %s", name, path, xstrerr(xerrno));
3878     }
3879 }
3880
3881 #include "AccessLogEntry.h"
3882
3883 /**
3884  * We support several access_log configuration styles:
3885  *
3886  * #1: Deprecated ancient style without an explicit logging module:
3887  * access_log /var/log/access.log
3888  *
3889  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3890  * access_log none [acl ...]
3891  *
3892  * #3: Configurable logging module without named options:
3893  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3894  * If no explicit logformat name is given, the first ACL name, if any,
3895  * should not be an existing logformat name or it will be treated as such.
3896  * access_log module:place [logformat_name] [acl ...]
3897  *
3898  * #4: Configurable logging module with name=value options such as logformat=x:
3899  * The first ACL name may not contain '='.
3900  * access_log module:place [option ...] [acl ...]
3901  *
3902  */
3903 static void
3904 parse_access_log(CustomLog ** logs)
3905 {
3906     const char *filename = ConfigParser::NextToken();
3907     if (!filename) {
3908         self_destruct();
3909         return;
3910     }
3911
3912     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
3913
3914     cl->filename = xstrdup(filename);
3915     // default buffer size and fatal settings
3916     cl->bufferSize = 8*MAX_URL;
3917     cl->fatal = true;
3918
3919     if (strcmp(filename, "none") == 0) {
3920         cl->type = Log::Format::CLF_NONE;
3921         aclParseAclList(LegacyParser, &cl->aclList, filename);
3922         while (*logs)
3923             logs = &(*logs)->next;
3924         *logs = cl;
3925         return;
3926     }
3927
3928     cl->type = Log::Format::CLF_UNKNOWN;
3929     cl->rotateCount = -1; // default: use global logfile_rotate setting.
3930
3931     const char *token = ConfigParser::PeekAtToken();
3932     if (!token) { // style #1
3933         // no options to deal with
3934     } else if (!strchr(token, '=')) { // style #3
3935         // if logformat name is recognized,
3936         // pop the previewed token; Else it must be an ACL name
3937         if (setLogformat(cl, token, false))
3938             (void)ConfigParser::NextToken();
3939     } else { // style #4
3940         do {
3941             if (strncasecmp(token, "on-error=", 9) == 0) {
3942                 if (strncasecmp(token+9, "die", 3) == 0) {
3943                     cl->fatal = true;
3944                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
3945                     cl->fatal = false;
3946                 } else {
3947                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
3948                            token << "' expected 'drop' or 'die'");
3949                     xfree(cl->filename);
3950                     xfree(cl);
3951                     self_destruct();
3952                     return;
3953                 }
3954             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
3955                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
3956             } else if (strncasecmp(token, "rotate=", 7) == 0) {
3957                 cl->rotateCount = xatoi(token + 7);
3958             } else if (strncasecmp(token, "logformat=", 10) == 0) {
3959                 setLogformat(cl, token+10, true);
3960             } else if (!strchr(token, '=')) {
3961                 // Do not pop the token; it must be an ACL name
3962                 break; // done with name=value options, now to ACLs
3963             } else {
3964                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
3965                 xfree(cl->filename);
3966                 xfree(cl);
3967                 self_destruct();
3968                 return;
3969             }
3970             // Pop the token, it was a valid "name=value" option
3971             (void)ConfigParser::NextToken();
3972             // Get next with preview ConfigParser::NextToken call.
3973         } while ((token = ConfigParser::PeekAtToken()) != NULL);
3974     }
3975
3976     // set format if it has not been specified explicitly
3977     if (cl->type == Log::Format::CLF_UNKNOWN)
3978         setLogformat(cl, "squid", true);
3979
3980     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
3981
3982     while (*logs)
3983         logs = &(*logs)->next;
3984
3985     *logs = cl;
3986 }
3987
3988 /// sets CustomLog::type and, if needed, CustomLog::lf
3989 /// returns false iff there is no named log format
3990 static bool
3991 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
3992 {
3993     assert(cl);
3994     assert(logdef_name);
3995
3996     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
3997
3998     if (cl->type != Log::Format::CLF_UNKNOWN) {
3999         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
4000                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
4001         self_destruct();
4002         return false;
4003     }
4004
4005     /* look for the definition pointer corresponding to this name */
4006     Format::Format *lf = Log::TheConfig.logformats;
4007
4008     while (lf != NULL) {
4009         debugs(3, 9, "Comparing against '" << lf->name << "'");
4010
4011         if (strcmp(lf->name, logdef_name) == 0)
4012             break;
4013
4014         lf = lf->next;
4015     }
4016
4017     if (lf != NULL) {
4018         cl->type = Log::Format::CLF_CUSTOM;
4019         cl->logFormat = lf;
4020     } else if (strcmp(logdef_name, "auto") == 0) {
4021         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
4022         cl->type = Log::Format::CLF_SQUID;
4023     } else if (strcmp(logdef_name, "squid") == 0) {
4024         cl->type = Log::Format::CLF_SQUID;
4025     } else if (strcmp(logdef_name, "common") == 0) {
4026         cl->type = Log::Format::CLF_COMMON;
4027     } else if (strcmp(logdef_name, "combined") == 0) {
4028         cl->type = Log::Format::CLF_COMBINED;
4029 #if ICAP_CLIENT
4030     } else if (strcmp(logdef_name, "icap_squid") == 0) {
4031         cl->type = Log::Format::CLF_ICAP_SQUID;
4032 #endif
4033     } else if (strcmp(logdef_name, "useragent") == 0) {
4034         cl->type = Log::Format::CLF_USERAGENT;
4035     } else if (strcmp(logdef_name, "referrer") == 0) {
4036         cl->type = Log::Format::CLF_REFERER;
4037     } else if (dieWhenMissing) {
4038         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4039         self_destruct();
4040         return false;
4041     } else {
4042         return false;
4043     }
4044
4045     return true;
4046 }
4047
4048 static int
4049 check_null_access_log(CustomLog *customlog_definitions)
4050 {
4051     return customlog_definitions == NULL;
4052 }
4053
4054 static void
4055 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4056 {
4057     CustomLog *log;
4058
4059     for (log = logs; log; log = log->next) {
4060         storeAppendPrintf(entry, "%s ", name);
4061
4062         switch (log->type) {
4063
4064         case Log::Format::CLF_CUSTOM:
4065             storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4066             break;
4067
4068         case Log::Format::CLF_NONE:
4069             storeAppendPrintf(entry, "logformat=none");
4070             break;
4071
4072         case Log::Format::CLF_SQUID:
4073             storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4074             break;
4075
4076         case Log::Format::CLF_COMBINED:
4077             storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4078             break;
4079
4080         case Log::Format::CLF_COMMON:
4081             storeAppendPrintf(entry, "%s logformat=common", log->filename);
4082             break;
4083
4084 #if ICAP_CLIENT
4085         case Log::Format::CLF_ICAP_SQUID:
4086             storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4087             break;
4088 #endif
4089         case Log::Format::CLF_USERAGENT:
4090             storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4091             break;
4092
4093         case Log::Format::CLF_REFERER:
4094             storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4095             break;
4096
4097         case Log::Format::CLF_UNKNOWN:
4098             break;
4099         }
4100
4101         // default is on-error=die
4102         if (!log->fatal)
4103             storeAppendPrintf(entry, " on-error=drop");
4104
4105         // default: 64KB
4106         if (log->bufferSize != 64*1024)
4107             storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4108
4109         if (log->rotateCount >= 0)
4110             storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4111
4112         if (log->aclList)
4113             dump_acl_list(entry, log->aclList);
4114
4115         storeAppendPrintf(entry, "\n");
4116     }
4117 }
4118
4119 static void
4120 free_access_log(CustomLog ** definitions)
4121 {
4122     while (*definitions) {
4123         CustomLog *log = *definitions;
4124         *definitions = log->next;
4125
4126         log->logFormat = NULL;
4127         log->type = Log::Format::CLF_UNKNOWN;
4128
4129         if (log->aclList)
4130             aclDestroyAclList(&log->aclList);
4131
4132         safe_free(log->filename);
4133
4134         xfree(log);
4135     }
4136 }
4137
4138 /// parses list of integers form name=N1,N2,N3,...
4139 static bool
4140 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4141 {
4142     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4143         data += name.size();
4144         if (*data == '=') {
4145             while (true) {
4146                 ++data;
4147                 int value = 0;
4148                 if (!StringToInt(data, value, &data, 10))
4149                     break;
4150                 list.push_back(value);
4151                 if (*data == '\0' || *data != ',')
4152                     break;
4153             }
4154         }
4155     }
4156     return data && *data == '\0';
4157 }
4158
4159 static void
4160 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4161 {
4162 #if !HAVE_CPU_AFFINITY
4163     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4164            "support, do not set 'cpu_affinity_map'");
4165     self_destruct();
4166 #endif /* HAVE_CPU_AFFINITY */
4167
4168     if (!*cpuAffinityMap)
4169         *cpuAffinityMap = new CpuAffinityMap;
4170
4171     const char *const pToken = ConfigParser::NextToken();
4172     const char *const cToken = ConfigParser::NextToken();
4173     std::vector<int> processes, cores;
4174     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4175         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4176                "in 'cpu_affinity_map'");
4177         self_destruct();
4178     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4179         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4180                "'cpu_affinity_map'");
4181         self_destruct();
4182     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4183         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4184                "process_numbers and cores lists differ in length or " <<
4185                "contain numbers <= 0");
4186         self_destruct();
4187     }
4188 }
4189
4190 static void
4191 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4192 {
4193     if (cpuAffinityMap) {
4194         storeAppendPrintf(entry, "%s process_numbers=", name);
4195         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4196             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4197                               cpuAffinityMap->processes()[i]);
4198         }
4199         storeAppendPrintf(entry, " cores=");
4200         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4201             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4202                               cpuAffinityMap->cores()[i]);
4203         }
4204         storeAppendPrintf(entry, "\n");
4205     }
4206 }
4207
4208 static void
4209 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4210 {
4211     delete *cpuAffinityMap;
4212     *cpuAffinityMap = NULL;
4213 }
4214
4215 #if USE_ADAPTATION
4216
4217 static void
4218 parse_adaptation_service_set_type()
4219 {
4220     Adaptation::Config::ParseServiceSet();
4221 }
4222
4223 static void
4224 parse_adaptation_service_chain_type()
4225 {
4226     Adaptation::Config::ParseServiceChain();
4227 }
4228
4229 static void
4230 parse_adaptation_access_type()
4231 {
4232     Adaptation::Config::ParseAccess(LegacyParser);
4233 }
4234 #endif /* USE_ADAPTATION */
4235
4236 #if ICAP_CLIENT
4237
4238 static void
4239 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4240 {
4241     cfg->parseService();
4242 }
4243
4244 static void
4245 free_icap_service_type(Adaptation::Icap::Config * cfg)
4246 {
4247     cfg->freeService();
4248 }
4249
4250 static void
4251 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4252 {
4253     cfg.dumpService(entry, name);
4254 }
4255
4256 static void
4257 parse_icap_class_type()
4258 {
4259     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4260            "Use 'adaptation_service_set' instead");
4261     Adaptation::Config::ParseServiceSet();
4262 }
4263
4264 static void
4265 parse_icap_access_type()
4266 {
4267     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4268            "Use 'adaptation_access' instead");
4269     Adaptation::Config::ParseAccess(LegacyParser);
4270 }
4271
4272 #endif
4273
4274 #if USE_ECAP
4275
4276 static void
4277 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4278 {
4279     cfg->parseService();
4280 }
4281
4282 static void
4283 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4284 {
4285     cfg->freeService();
4286 }
4287
4288 static void
4289 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4290 {
4291     cfg.dumpService(entry, name);
4292 }
4293
4294 #endif /* USE_ECAP */
4295
4296 #if ICAP_CLIENT
4297 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4298 {
4299     char *token;
4300     time_t d;
4301     time_t m;
4302     cfg->service_failure_limit = GetInteger();
4303
4304     if ((token = ConfigParser::NextToken()) == NULL)
4305         return;
4306
4307     if (strcmp(token,"in") != 0) {
4308         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4309         self_destruct();
4310     }
4311
4312     if ((token = ConfigParser::NextToken()) == NULL) {
4313         self_destruct();
4314     }
4315
4316     d = static_cast<time_t> (xatoi(token));
4317
4318     m = static_cast<time_t> (1);
4319
4320     if (0 == d)
4321         (void) 0;
4322     else if ((token = ConfigParser::NextToken()) == NULL) {
4323         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4324         self_destruct();
4325     } else if ((m = parseTimeUnits(token, false)) == 0)
4326         self_destruct();
4327
4328     cfg->oldest_service_failure = (m * d);
4329 }
4330
4331 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4332 {
4333     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4334     if (cfg.oldest_service_failure > 0) {
4335         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4336     }
4337     storeAppendPrintf(entry, "\n");
4338 }
4339
4340 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4341 {
4342     cfg->oldest_service_failure = 0;
4343     cfg->service_failure_limit = 0;
4344 }
4345 #endif
4346
4347 #if USE_OPENSSL
4348 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4349 {
4350     char *al;
4351     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4352     if ((al = ConfigParser::NextToken()) == NULL) {
4353         xfree(ca);
4354         self_destruct();
4355         return;
4356     }
4357
4358     const char *param;
4359     if ( char *s = strchr(al, '{')) {
4360         *s = '\0'; // terminate the al string
4361         ++s;
4362         param = s;
4363         s = strchr(s, '}');
4364         if (!s) {
4365             xfree(ca);
4366             self_destruct();
4367             return;
4368         }
4369         *s = '\0';
4370     } else
4371         param = NULL;
4372
4373     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4374         ca->alg = Ssl::algSetValidAfter;
4375         ca->param = xstrdup("on");
4376     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4377         ca->alg = Ssl::algSetValidBefore;
4378         ca->param = xstrdup("on");
4379     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4380         ca->alg = Ssl::algSetCommonName;
4381         if (param) {
4382             if (strlen(param) > 64) {
4383                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4384                 xfree(ca);
4385                 self_destruct();
4386                 return;
4387             }
4388             ca->param = xstrdup(param);
4389         }
4390     } else {
4391         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4392         xfree(ca);
4393         self_destruct();
4394         return;
4395     }
4396
4397     aclParseAclList(LegacyParser, &ca->aclList, al);
4398
4399     while (*cert_adapt)
4400         cert_adapt = &(*cert_adapt)->next;
4401
4402     *cert_adapt = ca;
4403 }
4404
4405 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4406 {
4407     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4408         storeAppendPrintf(entry, "%s ", name);
4409         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4410         if (ca->aclList)
4411             dump_acl_list(entry, ca->aclList);
4412         storeAppendPrintf(entry, "\n");
4413     }
4414 }
4415
4416 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4417 {
4418     while (*cert_adapt) {
4419         sslproxy_cert_adapt *ca = *cert_adapt;
4420         *cert_adapt = ca->next;
4421         safe_free(ca->param);
4422
4423         if (ca->aclList)
4424             aclDestroyAclList(&ca->aclList);
4425
4426         safe_free(ca);
4427     }
4428 }
4429
4430 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4431 {
4432     char *al;
4433     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4434     if ((al = ConfigParser::NextToken()) == NULL) {
4435         xfree(cs);
4436         self_destruct();
4437         return;
4438     }
4439
4440     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4441         cs->alg = Ssl::algSignTrusted;
4442     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4443         cs->alg = Ssl::algSignUntrusted;
4444     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4445         cs->alg = Ssl::algSignSelf;
4446     else {
4447         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4448         xfree(cs);
4449         self_destruct();
4450         return;
4451     }
4452
4453     aclParseAclList(LegacyParser, &cs->aclList, al);
4454
4455     while (*cert_sign)
4456         cert_sign = &(*cert_sign)->next;
4457
4458     *cert_sign = cs;
4459 }
4460
4461 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4462 {
4463     sslproxy_cert_sign *cs;
4464     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4465         storeAppendPrintf(entry, "%s ", name);
4466         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4467         if (cs->aclList)
4468             dump_acl_list(entry, cs->aclList);
4469         storeAppendPrintf(entry, "\n");
4470     }
4471 }
4472
4473 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4474 {
4475     while (*cert_sign) {
4476         sslproxy_cert_sign *cs = *cert_sign;
4477         *cert_sign = cs->next;
4478
4479         if (cs->aclList)
4480             aclDestroyAclList(&cs->aclList);
4481
4482         safe_free(cs);
4483     }
4484 }
4485
4486 class sslBumpCfgRr: public ::RegisteredRunner
4487 {
4488 public:
4489     static Ssl::BumpMode lastDeprecatedRule;
4490     /* RegisteredRunner API */
4491     virtual void finalizeConfig();
4492 };
4493
4494 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4495
4496 RunnerRegistrationEntry(sslBumpCfgRr);
4497
4498 void
4499 sslBumpCfgRr::finalizeConfig()
4500 {
4501     if (lastDeprecatedRule != Ssl::bumpEnd) {
4502         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4503         static char buf[1024];
4504         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4505             strcpy(buf, "ssl_bump deny all");
4506             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4507                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4508                    "must not use implicit rules. Update your ssl_bump rules.");
4509         } else {
4510             strcpy(buf, "ssl_bump allow all");
4511             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4512                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4513                    "inferior to the newer server-first bumping mode. New ssl_bump"
4514                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4515         }
4516         parse_line(buf);
4517     }
4518 }
4519
4520 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4521 {
4522     typedef const char *BumpCfgStyle;
4523     BumpCfgStyle bcsNone = NULL;
4524     BumpCfgStyle bcsNew = "new client/server-first/none";
4525     BumpCfgStyle bcsOld = "deprecated allow/deny";
4526     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4527     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4528     char *bm;
4529     if ((bm = ConfigParser::NextToken()) == NULL) {
4530         self_destruct();
4531         return;
4532     }
4533
4534     // if this is the first rule proccessed
4535     if (*ssl_bump == NULL) {
4536         bumpCfgStyleLast = bcsNone;
4537         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4538     }
4539
4540     allow_t action = allow_t(ACCESS_ALLOWED);
4541
4542     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4543         action.kind = Ssl::bumpClientFirst;
4544         bumpCfgStyleNow = bcsNew;
4545     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4546         action.kind = Ssl::bumpServerFirst;
4547         bumpCfgStyleNow = bcsNew;
4548     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4549         action.kind = Ssl::bumpPeek;
4550         bumpCfgStyleNow = bcsNew;
4551     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4552         action.kind = Ssl::bumpStare;
4553         bumpCfgStyleNow = bcsNew;
4554     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4555         action.kind = Ssl::bumpSplice;
4556         bumpCfgStyleNow = bcsNew;
4557     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4558         action.kind = Ssl::bumpBump;
4559         bumpCfgStyleNow = bcsNew;
4560     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4561         action.kind = Ssl::bumpTerminate;
4562         bumpCfgStyleNow = bcsNew;
4563     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4564         action.kind = Ssl::bumpNone;
4565         bumpCfgStyleNow = bcsNew;
4566     } else if (strcmp(bm, "allow") == 0) {
4567         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4568                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4569                "is usually inferior to the newer server-first "
4570                "bumping mode. Update your ssl_bump rules.");
4571         action.kind = Ssl::bumpClientFirst;
4572         bumpCfgStyleNow = bcsOld;
4573         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4574     } else if (strcmp(bm, "deny") == 0) {
4575         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4576                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4577                "your ssl_bump rules.");
4578         action.kind = Ssl::bumpNone;
4579         bumpCfgStyleNow = bcsOld;
4580         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4581     } else {
4582         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4583         self_destruct();
4584         return;
4585     }
4586
4587     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4588         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4589                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4590         self_destruct();
4591         return;
4592     }
4593
4594     bumpCfgStyleLast = bumpCfgStyleNow;
4595
4596     Acl::AndNode *rule = new Acl::AndNode;
4597     rule->context("(ssl_bump rule)", config_input_line);
4598     rule->lineParse();
4599     // empty rule OK
4600
4601     assert(ssl_bump);
4602     if (!*ssl_bump) {
4603         *ssl_bump = new Acl::Tree;
4604         (*ssl_bump)->context("(ssl_bump rules)", config_input_line);
4605     }
4606
4607     (*ssl_bump)->add(rule, action);
4608 }
4609
4610 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4611 {
4612     if (ssl_bump)
4613         dump_SBufList(entry, ssl_bump->treeDump(name, Ssl::BumpModeStr));
4614 }
4615
4616 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4617 {
4618     free_acl_access(ssl_bump);
4619 }
4620
4621 #endif
4622
4623 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4624 {
4625     if (!headers)
4626         return;
4627
4628     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4629         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4630         if (hwa->aclList)
4631             dump_acl_list(entry, hwa->aclList);
4632         storeAppendPrintf(entry, "\n");
4633     }
4634 }
4635
4636 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4637 {
4638     char *fn;
4639     if (!*headers) {
4640         *headers = new HeaderWithAclList;
4641     }
4642     if ((fn = ConfigParser::NextToken()) == NULL) {
4643         self_destruct();
4644         return;
4645     }
4646     HeaderWithAcl hwa;
4647     hwa.fieldName = fn;
4648     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4649     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4650         hwa.fieldId = Http::HdrType::OTHER;
4651
4652     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4653     ConfigParser::EnableMacros();
4654     String buf = ConfigParser::NextQuotedToken();
4655     ConfigParser::DisableMacros();
4656     hwa.fieldValue = buf.termedBuf();
4657     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4658     if (hwa.quoted) {
4659         if (!nlf->parse(hwa.fieldValue.c_str())) {
4660             self_destruct();
4661             return;
4662         }
4663         hwa.valueFormat = nlf;
4664     } else
4665         delete nlf;
4666     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4667     (*headers)->push_back(hwa);
4668 }
4669
4670 static void free_HeaderWithAclList(HeaderWithAclList **header)
4671 {
4672     if (!(*header))
4673         return;
4674
4675     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4676         if (hwa->aclList)
4677             aclDestroyAclList(&hwa->aclList);
4678
4679         if (hwa->valueFormat) {
4680             delete hwa->valueFormat;
4681             hwa->valueFormat = NULL;
4682         }
4683     }
4684     delete *header;
4685     *header = NULL;
4686 }
4687
4688 static void parse_note(Notes *notes)
4689 {
4690     assert(notes);
4691     notes->parse(LegacyParser);
4692 }
4693
4694 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4695 {
4696     notes.dump(entry, name);
4697 }
4698
4699 static void free_note(Notes *notes)
4700 {
4701     notes->clean();
4702 }
4703
4704 static bool FtpEspvDeprecated = false;
4705 static void parse_ftp_epsv(acl_access **ftp_epsv)
4706 {
4707     allow_t ftpEpsvDeprecatedAction;
4708     bool ftpEpsvIsDeprecatedRule = false;
4709
4710     char *t = ConfigParser::PeekAtToken();
4711     if (!t) {
4712         self_destruct();
4713         return;
4714     }
4715
4716     if (!strcmp(t, "off")) {
4717         (void)ConfigParser::NextToken();
4718         ftpEpsvIsDeprecatedRule = true;
4719         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4720     } else if (!strcmp(t, "on")) {
4721         (void)ConfigParser::NextToken();
4722         ftpEpsvIsDeprecatedRule = true;
4723         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4724     }
4725
4726     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4727     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4728     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4729     // then abort
4730     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4731             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4732         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4733         self_destruct();
4734         return;
4735     }
4736
4737     if (ftpEpsvIsDeprecatedRule) {
4738         // overwrite previous ftp_epsv lines
4739         delete *ftp_epsv;
4740         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4741             Acl::AndNode *ftpEpsvRule = new Acl::AndNode;
4742             ftpEpsvRule->context("(ftp_epsv rule)", config_input_line);
4743             ACL *a = ACL::FindByName("all");
4744             if (!a) {
4745                 delete ftpEpsvRule;
4746                 self_destruct();
4747                 return;
4748             }
4749             ftpEpsvRule->add(a);
4750             *ftp_epsv = new Acl::Tree;
4751             (*ftp_epsv)->context("(ftp_epsv rules)", config_input_line);
4752             (*ftp_epsv)->add(ftpEpsvRule, ftpEpsvDeprecatedAction);
4753         } else
4754             *ftp_epsv = NULL;
4755         FtpEspvDeprecated = true;
4756     } else {
4757         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4758     }
4759 }
4760
4761 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4762 {
4763     if (ftp_epsv)
4764         dump_SBufList(entry, ftp_epsv->treeDump(name, NULL));
4765 }
4766
4767 static void free_ftp_epsv(acl_access **ftp_epsv)
4768 {
4769     free_acl_access(ftp_epsv);
4770     FtpEspvDeprecated = false;
4771 }
4772
4773 static void
4774 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4775 {
4776     time_msec_t tval;
4777     parseTimeLine(&tval, T_SECOND_STR, false, true);
4778     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4779
4780     char *key, *value;
4781     while(ConfigParser::NextKvPair(key, value)) {
4782         if (strcasecmp(key, "on_timeout") == 0) {
4783             if (strcasecmp(value, "bypass") == 0)
4784                 config->action = toutActBypass;
4785             else if (strcasecmp(value, "fail") == 0)
4786                 config->action = toutActFail;
4787             else if (strcasecmp(value, "retry") == 0)
4788                 config->action = toutActRetry;
4789             else if (strcasecmp(value, "use_configured_response") == 0) {
4790                 config->action = toutActUseConfiguredResponse;
4791             } else {
4792                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4793                 self_destruct();
4794             }
4795         } else if (strcasecmp(key, "response") == 0) {
4796             config->response = xstrdup(value);
4797         } else {
4798             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4799             self_destruct();
4800         }
4801     }
4802
4803     if (config->action == toutActUseConfiguredResponse && !config->response) {
4804         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4805         self_destruct();
4806     }
4807
4808     if (config->action != toutActUseConfiguredResponse && config->response) {
4809         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4810         self_destruct();
4811     }
4812 }
4813
4814 static void
4815 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4816 {
4817     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4818     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4819
4820     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4821     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4822
4823     if (config.response)
4824         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4825
4826     storeAppendPrintf(entry, "\n");
4827 }
4828
4829 static void
4830 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4831 {
4832     Config.Timeout.urlRewrite = 0;
4833     config->action = 0;
4834     safe_free(config->response);
4835 }
4836
4837 static void
4838 parse_configuration_includes_quoted_values(bool *)
4839 {
4840     int val = 0;
4841     parse_onoff(&val);
4842
4843     // If quoted values is set to on then enable new strict mode parsing
4844     if (val) {
4845         ConfigParser::RecognizeQuotedValues = true;
4846         ConfigParser::StrictMode = true;
4847     } else {
4848         ConfigParser::RecognizeQuotedValues = false;
4849         ConfigParser::StrictMode = false;
4850     }
4851 }
4852
4853 static void
4854 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4855 {
4856     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4857     dump_onoff(entry, name, val);
4858 }
4859
4860 static void
4861 free_configuration_includes_quoted_values(bool *)
4862 {
4863     ConfigParser::RecognizeQuotedValues = false;
4864     ConfigParser::StrictMode = false;
4865 }
4866
4867 static void
4868 parse_on_unsupported_protocol(acl_access **access)
4869 {
4870     char *tm;
4871     if ((tm = ConfigParser::NextToken()) == NULL) {
4872         self_destruct();
4873         return;
4874     }
4875
4876     allow_t action = allow_t(ACCESS_ALLOWED);
4877     if (strcmp(tm, "tunnel") == 0)
4878         action.kind = 1;
4879     else if (strcmp(tm, "respond") == 0)
4880         action.kind = 2;
4881     else {
4882         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4883         self_destruct();
4884         return;
4885     }
4886
4887     Acl::AndNode *rule = new Acl::AndNode;
4888     rule->context("(on_unsupported_protocol rule)", config_input_line);
4889     rule->lineParse();
4890     // empty rule OK
4891
4892     assert(access);
4893     if (!*access) {
4894         *access = new Acl::Tree;
4895         (*access)->context("(on_unsupported_protocol rules)", config_input_line);
4896     }
4897
4898     (*access)->add(rule, action);
4899 }
4900
4901 static void
4902 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4903 {
4904     const char *on_error_tunnel_mode_str[] = {
4905         "none",
4906         "tunnel",
4907         "respond",
4908         NULL
4909     };
4910     if (access) {
4911         SBufList lines = access->treeDump(name, on_error_tunnel_mode_str);
4912         dump_SBufList(entry, lines);
4913     }
4914 }
4915
4916 static void
4917 free_on_unsupported_protocol(acl_access **access)
4918 {
4919     free_acl_access(access);
4920 }
4921