src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclNameList.h"
  15 #include "acl/AclSizeLimit.h"
  16 #include "acl/Address.h"
  17 #include "acl/Gadgets.h"
  18 #include "acl/MethodData.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "AuthReg.h"
  23 #include "base/RunnersRegistry.h"
  24 #include "cache_cf.h"
  25 #include "CachePeer.h"
  26 #include "ConfigParser.h"
  27 #include "CpuAffinityMap.h"
  28 #include "DiskIO/DiskIOModule.h"
  29 #include "eui/Config.h"
  30 #include "ExternalACL.h"
  31 #include "format/Format.h"
  32 #include "ftp/Elements.h"
  33 #include "globals.h"
  34 #include "HttpHeaderTools.h"
  35 #include "icmp/IcmpConfig.h"
  36 #include "ident/Config.h"
  37 #include "ip/Intercept.h"
  38 #include "ip/QosConfig.h"
  39 #include "ip/tools.h"
  40 #include "ipc/Kids.h"
  41 #include "log/Config.h"
  42 #include "log/CustomLog.h"
  43 #include "MemBuf.h"
  44 #include "mgr/ActionPasswordList.h"
  45 #include "mgr/Registration.h"
  46 #include "neighbors.h"
  47 #include "NeighborTypeDomainList.h"
  48 #include "Parsing.h"
  49 #include "pconn.h"
  50 #include "PeerDigest.h"
  51 #include "PeerPoolMgr.h"
  52 #include "redirect.h"
  53 #include "RefreshPattern.h"
  54 #include "rfc1738.h"
  55 #include "SBufList.h"
  56 #include "SquidConfig.h"
  57 #include "SquidString.h"
  58 #include "ssl/ProxyCerts.h"
  59 #include "Store.h"
  60 #include "StoreFileSystem.h"
  61 #include "SwapDir.h"
  62 #include "tools.h"
  63 #include "util.h"
  64 #include "wordlist.h"
  65 /* wccp2 has its own conditional definitions */
  66 #include "wccp2.h"
  67 #if USE_ADAPTATION
  68 #include "adaptation/Config.h"
  69 #endif
  70 #if ICAP_CLIENT
  71 #include "adaptation/icap/Config.h"
  72 #endif
  73 #if USE_ECAP
  74 #include "adaptation/ecap/Config.h"
  75 #endif
  76 #if USE_OPENSSL
  77 #include "ssl/Config.h"
  78 #include "ssl/support.h"
  79 #endif
  80 #if USE_AUTH
  81 #include "auth/Config.h"
  82 #include "auth/Scheme.h"
  83 #endif
  84 #if USE_SQUID_ESI
  85 #include "esi/Parser.h"
  86 #endif
  87 #if SQUID_SNMP
  88 #include "snmp.h"
  89 #endif
  90
  91 #if HAVE_GLOB_H
  92 #include <glob.h>
  93 #endif
  94 #include <limits>
  95 #include <list>
  96 #if HAVE_PWD_H
  97 #include <pwd.h>
  98 #endif
  99 #if HAVE_GRP_H
 100 #include <grp.h>
 101 #endif
 102 #if HAVE_SYS_STAT_H
 103 #include <sys/stat.h>
 104 #endif
 105
 106 #if USE_OPENSSL
 107 #include "ssl/gadgets.h"
 108 #endif
 109
 110 #if USE_ADAPTATION
 111 static void parse_adaptation_service_set_type();
 112 static void parse_adaptation_service_chain_type();
 113 static void parse_adaptation_access_type();
 114 #endif
 115
 116 #if ICAP_CLIENT
 117 static void parse_icap_service_type(Adaptation::Icap::Config *);
 118 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 119 static void free_icap_service_type(Adaptation::Icap::Config *);
 120 static void parse_icap_class_type();
 121 static void parse_icap_access_type();
 122
 123 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 124 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 125 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 126 #endif
 127
 128 #if USE_ECAP
 129 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 130 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 131 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 132 #endif
 133
 134 static peer_t parseNeighborType(const char *s);
 135
 136 static const char *const T_MILLISECOND_STR = "millisecond";
 137 static const char *const T_SECOND_STR = "second";
 138 static const char *const T_MINUTE_STR = "minute";
 139 static const char *const T_HOUR_STR = "hour";
 140 static const char *const T_DAY_STR = "day";
 141 static const char *const T_WEEK_STR = "week";
 142 static const char *const T_FORTNIGHT_STR = "fortnight";
 143 static const char *const T_MONTH_STR = "month";
 144 static const char *const T_YEAR_STR = "year";
 145 static const char *const T_DECADE_STR = "decade";
 146
 147 static const char *const B_BYTES_STR = "bytes";
 148 static const char *const B_KBYTES_STR = "KB";
 149 static const char *const B_MBYTES_STR = "MB";
 150 static const char *const B_GBYTES_STR = "GB";
 151
 152 static const char *const list_sep = ", \t\n\r";
 153
 154 static void parse_access_log(CustomLog ** customlog_definitions);
 155 static int check_null_access_log(CustomLog *customlog_definitions);
 156 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 157 static void free_access_log(CustomLog ** definitions);
 158 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 159
 160 static void configDoConfigure(void);
 161 static void parse_refreshpattern(RefreshPattern **);
 162 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 163 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 164 static void parse_u_short(unsigned short * var);
 165 static void parse_string(char **);
 166 static void default_all(void);
 167 static void defaults_if_none(void);
 168 static void defaults_postscriptum(void);
 169 static int parse_line(char *);
 170 static void parse_obsolete(const char *);
 171 static void parseBytesLine(size_t * bptr, const char *units);
 172 #if USE_OPENSSL
 173 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 174 #endif
 175 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 176 static size_t parseBytesUnits(const char *unit);
 177 static void free_all(void);
 178 void requirePathnameExists(const char *name, const char *path);
 179 static OBJH dump_config;
 180 #if USE_HTTP_VIOLATIONS
 181 static void free_HeaderManglers(HeaderManglers **pm);
 182 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 183 static void parse_http_header_access(HeaderManglers **manglers);
 184 #define free_http_header_access free_HeaderManglers
 185 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 186 static void parse_http_header_replace(HeaderManglers **manglers);
 187 #define free_http_header_replace free_HeaderManglers
 188 #endif
 189 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 190 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 191 static void free_HeaderWithAclList(HeaderWithAclList **header);
 192 static void parse_note(Notes *);
 193 static void dump_note(StoreEntry *, const char *, Notes &);
 194 static void free_note(Notes *);
 195 static void parse_denyinfo(AclDenyInfoList ** var);
 196 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 197 static void free_denyinfo(AclDenyInfoList ** var);
 198
 199 #if USE_WCCPv2
 200 static void parse_IpAddress_list(Ip::Address_list **);
 201 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 202 static void free_IpAddress_list(Ip::Address_list **);
 203 #if CURRENTLY_UNUSED
 204 static int check_null_IpAddress_list(const Ip::Address_list *);
 205 #endif /* CURRENTLY_UNUSED */
 206 #endif /* USE_WCCPv2 */
 207
 208 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 209 #define parse_PortCfg(l) parsePortCfg((l), token)
 210 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 211 #define free_PortCfg(h)  *(h)=NULL
 212
 213 #if USE_OPENSSL
 214 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 215 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 216 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 217 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 218 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 219 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 220 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 221 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 222 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 223 #endif /* USE_OPENSSL */
 224
 225 static void parse_ftp_epsv(acl_access **ftp_epsv);
 226 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 227 static void free_ftp_epsv(acl_access **ftp_epsv);
 228
 229 static void parse_b_size_t(size_t * var);
 230 static void parse_b_int64_t(int64_t * var);
 231
 232 static bool parseNamedIntList(const char *data, const String &name, std::vector<int> &list);
 233
 234 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 235 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 236 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 237
 238 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 239 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 240 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 241
 242 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 243
 244 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 245 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 246 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 247 static void parse_on_unsupported_protocol(acl_access **access);
 248 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 249 static void free_on_unsupported_protocol(acl_access **access);
 250
 251 /*
 252  * LegacyParser is a parser for legacy code that uses the global
 253  * approach.  This is static so that it is only exposed to cache_cf.
 254  * Other modules needing access to a ConfigParser should have it
 255  * provided to them in their parserFOO methods.
 256  */
 257 static ConfigParser LegacyParser = ConfigParser();
 258
 259 void
 260 self_destruct(void)
 261 {
 262     LegacyParser.destruct();
 263 }
 264
 265 static void
 266 SetConfigFilename(char const *file_name, bool is_pipe)
 267 {
 268     if (is_pipe)
 269         cfg_filename = file_name + 1;
 270     else
 271         cfg_filename = file_name;
 272 }
 273
 274 static const char*
 275 skip_ws(const char* s)
 276 {
 277     while (xisspace(*s))
 278         ++s;
 279
 280     return s;
 281 }
 282
 283 static int
 284 parseManyConfigFiles(char* files, int depth)
 285 {
 286     int error_count = 0;
 287     char* saveptr = NULL;
 288 #if HAVE_GLOB
 289     char *path;
 290     glob_t globbuf;
 291     int i;
 292     memset(&globbuf, 0, sizeof(globbuf));
 293     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 294         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 295             fatalf("Unable to find configuration file: %s: %s",
 296                    path, xstrerror());
 297         }
 298     }
 299     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 300         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 301     }
 302     globfree(&globbuf);
 303 #else
 304     char* file = strwordtok(files, &saveptr);
 305     while (file != NULL) {
 306         error_count += parseOneConfigFile(file, depth);
 307         file = strwordtok(NULL, &saveptr);
 308     }
 309 #endif /* HAVE_GLOB */
 310     return error_count;
 311 }
 312
 313 static void
 314 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 315 {
 316     assert(str != NULL);
 317     assert(newSubstr != NULL);
 318
 319     unsigned newSubstrLen = strlen(newSubstr);
 320     if (newSubstrLen > substrLen)
 321         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 322
 323     // move tail part including zero
 324     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 325     // copy new substring in place
 326     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 327
 328     len = strlen(str);
 329 }
 330
 331 static void
 332 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 333 {
 334     assert(line != NULL);
 335     assert(macroName != NULL);
 336     assert(substStr != NULL);
 337     unsigned macroNameLen = strlen(macroName);
 338     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 339         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 340 }
 341
 342 static void
 343 ProcessMacros(char*& line, int& len)
 344 {
 345     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 346     SubstituteMacro(line, len, "${process_name}", TheKidName);
 347     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 348 }
 349
 350 static void
 351 trim_trailing_ws(char* str)
 352 {
 353     assert(str != NULL);
 354     unsigned i = strlen(str);
 355     while ((i > 0) && xisspace(str[i - 1]))
 356         --i;
 357     str[i] = '\0';
 358 }
 359
 360 static const char*
 361 FindStatement(const char* line, const char* statement)
 362 {
 363     assert(line != NULL);
 364     assert(statement != NULL);
 365
 366     const char* str = skip_ws(line);
 367     unsigned len = strlen(statement);
 368     if (strncmp(str, statement, len) == 0) {
 369         str += len;
 370         if (*str == '\0')
 371             return str;
 372         else if (xisspace(*str))
 373             return skip_ws(str);
 374     }
 375
 376     return NULL;
 377 }
 378
 379 static bool
 380 StrToInt(const char* str, long& number)
 381 {
 382     assert(str != NULL);
 383
 384     char* end;
 385     number = strtol(str, &end, 0);
 386
 387     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 388 }
 389
 390 static bool
 391 EvalBoolExpr(const char* expr)
 392 {
 393     assert(expr != NULL);
 394     if (strcmp(expr, "true") == 0) {
 395         return true;
 396     } else if (strcmp(expr, "false") == 0) {
 397         return false;
 398     } else if (const char* equation = strchr(expr, '=')) {
 399         const char* rvalue = skip_ws(equation + 1);
 400         char* lvalue = (char*)xmalloc(equation - expr + 1);
 401         xstrncpy(lvalue, expr, equation - expr + 1);
 402         trim_trailing_ws(lvalue);
 403
 404         long number1;
 405         if (!StrToInt(lvalue, number1))
 406             fatalf("String is not a integer number: '%s'\n", lvalue);
 407         long number2;
 408         if (!StrToInt(rvalue, number2))
 409             fatalf("String is not a integer number: '%s'\n", rvalue);
 410
 411         xfree(lvalue);
 412         return number1 == number2;
 413     }
 414     fatalf("Unable to evaluate expression '%s'\n", expr);
 415     return false; // this place cannot be reached
 416 }
 417
 418 static int
 419 parseOneConfigFile(const char *file_name, unsigned int depth)
 420 {
 421     FILE *fp = NULL;
 422     const char *orig_cfg_filename = cfg_filename;
 423     const int orig_config_lineno = config_lineno;
 424     char *token = NULL;
 425     char *tmp_line = NULL;
 426     int tmp_line_len = 0;
 427     int err_count = 0;
 428     int is_pipe = 0;
 429
 430     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 431     if (depth > 16) {
 432         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 433         return 1;
 434     }
 435
 436     if (file_name[0] == '!' || file_name[0] == '|') {
 437         fp = popen(file_name + 1, "r");
 438         is_pipe = 1;
 439     } else {
 440         fp = fopen(file_name, "r");
 441     }
 442
 443     if (fp == NULL)
 444         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerror());
 445
 446 #if _SQUID_WINDOWS_
 447     setmode(fileno(fp), O_TEXT);
 448 #endif
 449
 450     SetConfigFilename(file_name, bool(is_pipe));
 451
 452     memset(config_input_line, '\0', BUFSIZ);
 453
 454     config_lineno = 0;
 455
 456     std::vector<bool> if_states;
 457     while (fgets(config_input_line, BUFSIZ, fp)) {
 458         ++config_lineno;
 459
 460         if ((token = strchr(config_input_line, '\n')))
 461             *token = '\0';
 462
 463         if ((token = strchr(config_input_line, '\r')))
 464             *token = '\0';
 465
 466         // strip any prefix whitespace off the line.
 467         const char *p = skip_ws(config_input_line);
 468         if (config_input_line != p)
 469             memmove(config_input_line, p, strlen(p)+1);
 470
 471         if (strncmp(config_input_line, "#line ", 6) == 0) {
 472             static char new_file_name[1024];
 473             static char *file;
 474             static char new_lineno;
 475             token = config_input_line + 6;
 476             new_lineno = strtol(token, &file, 0) - 1;
 477
 478             if (file == token)
 479                 continue;   /* Not a valid #line directive, may be a comment */
 480
 481             while (*file && xisspace((unsigned char) *file))
 482                 ++file;
 483
 484             if (*file) {
 485                 if (*file != '"')
 486                     continue;   /* Not a valid #line directive, may be a comment */
 487
 488                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 489
 490                 if ((token = strchr(new_file_name, '"')))
 491                     *token = '\0';
 492
 493                 SetConfigFilename(new_file_name, false);
 494             }
 495
 496             config_lineno = new_lineno;
 497         }
 498
 499         if (config_input_line[0] == '#')
 500             continue;
 501
 502         if (config_input_line[0] == '\0')
 503             continue;
 504
 505         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 506
 507         size_t append_len = strlen(append);
 508
 509         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 510
 511         strcpy(tmp_line + tmp_line_len, append);
 512
 513         tmp_line_len += append_len;
 514
 515         if (tmp_line[tmp_line_len-1] == '\\') {
 516             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 517             tmp_line[--tmp_line_len] = '\0';
 518             continue;
 519         }
 520
 521         trim_trailing_ws(tmp_line);
 522         ProcessMacros(tmp_line, tmp_line_len);
 523         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 524
 525         if (const char* expr = FindStatement(tmp_line, "if")) {
 526             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 527         } else if (FindStatement(tmp_line, "endif")) {
 528             if (!if_states.empty())
 529                 if_states.pop_back(); // remove last if-statement meaning
 530             else
 531                 fatalf("'endif' without 'if'\n");
 532         } else if (FindStatement(tmp_line, "else")) {
 533             if (!if_states.empty())
 534                 if_states.back() = !if_states.back();
 535             else
 536                 fatalf("'else' without 'if'\n");
 537         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 538             /* Handle includes here */
 539             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 540                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 541             } else if (!parse_line(tmp_line)) {
 542                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 543                 ++err_count;
 544             }
 545         }
 546
 547         safe_free(tmp_line);
 548         tmp_line_len = 0;
 549
 550     }
 551     if (!if_states.empty())
 552         fatalf("if-statement without 'endif'\n");
 553
 554     if (is_pipe) {
 555         int ret = pclose(fp);
 556
 557         if (ret != 0)
 558             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 559     } else {
 560         fclose(fp);
 561     }
 562
 563     SetConfigFilename(orig_cfg_filename, false);
 564     config_lineno = orig_config_lineno;
 565
 566     xfree(tmp_line);
 567     return err_count;
 568 }
 569
 570 int
 571 parseConfigFile(const char *file_name)
 572 {
 573     int err_count = 0;
 574
 575     debugs(5, 4, HERE);
 576
 577     configFreeMemory();
 578
 579     ACLMethodData::ThePurgeCount = 0;
 580     default_all();
 581
 582     err_count = parseOneConfigFile(file_name, 0);
 583
 584     defaults_if_none();
 585
 586     defaults_postscriptum();
 587
 588     /*
 589      * We must call configDoConfigure() before leave_suid() because
 590      * configDoConfigure() is where we turn username strings into
 591      * uid values.
 592      */
 593     configDoConfigure();
 594
 595     if (!Config.chroot_dir) {
 596         leave_suid();
 597         setUmask(Config.umask);
 598         _db_init(Debug::cache_log, Debug::debugOptions);
 599         enter_suid();
 600     }
 601
 602     if (opt_send_signal == -1) {
 603         Mgr::RegisterAction("config",
 604                             "Current Squid Configuration",
 605                             dump_config,
 606                             1, 1);
 607     }
 608
 609     return err_count;
 610 }
 611
 612 static void
 613 configDoConfigure(void)
 614 {
 615     memset(&Config2, '\0', sizeof(SquidConfig2));
 616     /* init memory as early as possible */
 617     memConfigure();
 618     /* Sanity checks */
 619
 620     Config.cacheSwap.n_strands = 0; // no diskers by default
 621     if (Config.cacheSwap.swapDirs == NULL) {
 622         /* Memory-only cache probably in effect. */
 623         /* turn off the cache rebuild delays... */
 624         StoreController::store_dirs_rebuilding = 0;
 625     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 626         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 627             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 628             if (sd->needsDiskStrand())
 629                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 630         }
 631     }
 632
 633     if (Debug::rotateNumber < 0) {
 634         Debug::rotateNumber = Config.Log.rotateNumber;
 635     }
 636
 637 #if SIZEOF_OFF_T <= 4
 638     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 639         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 640         Config.Store.maxObjectSize = 0x7FFF0000;
 641     }
 642 #endif
 643
 644     if (Config.Announce.period > 0) {
 645         Config.onoff.announce = 1;
 646     } else {
 647         Config.Announce.period = 86400 * 365;   /* one year */
 648         Config.onoff.announce = 0;
 649     }
 650
 651     if (Config.onoff.httpd_suppress_version_string)
 652         visible_appname_string = (char *)appname_string;
 653     else
 654         visible_appname_string = (char const *)APP_FULLNAME;
 655
 656     if (Config.Program.redirect) {
 657         if (Config.redirectChildren.n_max < 1) {
 658             Config.redirectChildren.n_max = 0;
 659             wordlistDestroy(&Config.Program.redirect);
 660         }
 661     }
 662
 663     if (Config.Program.store_id) {
 664         if (Config.storeIdChildren.n_max < 1) {
 665             Config.storeIdChildren.n_max = 0;
 666             wordlistDestroy(&Config.Program.store_id);
 667         }
 668     }
 669
 670     if (Config.appendDomain)
 671         if (*Config.appendDomain != '.')
 672             fatal("append_domain must begin with a '.'");
 673
 674     if (Config.errHtmlText == NULL)
 675         Config.errHtmlText = xstrdup(null_string);
 676
 677 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 678     if (Config.max_filedescriptors > 0) {
 679         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 680     }
 681 #elif USE_SELECT || USE_SELECT_WIN32
 682     if (Config.max_filedescriptors > FD_SETSIZE) {
 683         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 684     }
 685 #endif
 686
 687     storeConfigure();
 688
 689     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 690              uniqueHostname(),
 691              visible_appname_string);
 692
 693     /*
 694      * the extra space is for loop detection in client_side.c -- we search
 695      * for substrings in the Via header.
 696      */
 697     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 698              uniqueHostname(),
 699              visible_appname_string);
 700
 701     /* Use visible_hostname as default surrogate_id */
 702     if (!Config.Accel.surrogate_id) {
 703         const char *t = getMyHostname();
 704         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 705     }
 706
 707     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 708         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 709
 710     if (Config.appendDomain)
 711         Config.appendDomainLen = strlen(Config.appendDomain);
 712     else
 713         Config.appendDomainLen = 0;
 714
 715     if (Config.connect_retries > 10) {
 716         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 717         Config.connect_retries = 10;
 718     }
 719
 720     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 721 #if USE_UNLINKD
 722
 723     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 724 #endif
 725     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 726     if (Config.Program.redirect)
 727         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 728
 729     if (Config.Program.store_id)
 730         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 731
 732     requirePathnameExists("Icon Directory", Config.icons.directory);
 733
 734     if (Config.errorDirectory)
 735         requirePathnameExists("Error Directory", Config.errorDirectory);
 736
 737 #if USE_HTTP_VIOLATIONS
 738
 739     {
 740         const RefreshPattern *R;
 741
 742         for (R = Config.Refresh; R; R = R->next) {
 743             if (!R->flags.override_expire)
 744                 continue;
 745
 746             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 747
 748             break;
 749         }
 750
 751         for (R = Config.Refresh; R; R = R->next) {
 752             if (!R->flags.override_lastmod)
 753                 continue;
 754
 755             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 756
 757             break;
 758         }
 759
 760         for (R = Config.Refresh; R; R = R->next) {
 761             if (!R->flags.reload_into_ims)
 762                 continue;
 763
 764             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 765
 766             break;
 767         }
 768
 769         for (R = Config.Refresh; R; R = R->next) {
 770             if (!R->flags.ignore_reload)
 771                 continue;
 772
 773             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 774
 775             break;
 776         }
 777
 778         for (R = Config.Refresh; R; R = R->next) {
 779             if (!R->flags.ignore_no_store)
 780                 continue;
 781
 782             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 783
 784             break;
 785         }
 786
 787         for (R = Config.Refresh; R; R = R->next) {
 788             if (!R->flags.ignore_private)
 789                 continue;
 790
 791             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 792
 793             break;
 794         }
 795     }
 796 #endif
 797 #if !USE_HTTP_VIOLATIONS
 798     Config.onoff.via = 1;
 799 #else
 800
 801     if (!Config.onoff.via)
 802         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 803
 804 #endif
 805
 806     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 807     // TODO: replace with a dedicated "purge" ACL option?
 808     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 809
 810     Config2.onoff.mangle_request_headers = (Config.request_header_access != NULL);
 811
 812     if (geteuid() == 0) {
 813         if (NULL != Config.effectiveUser) {
 814
 815             struct passwd *pwd = getpwnam(Config.effectiveUser);
 816
 817             if (NULL == pwd) {
 818                 /*
 819                  * Andres Kroonmaa <andre@online.ee>:
 820                  * Some getpwnam() implementations (Solaris?) require
 821                  * an available FD < 256 for opening a FILE* to the
 822                  * passwd file.
 823                  * DW:
 824                  * This should be safe at startup, but might still fail
 825                  * during reconfigure.
 826                  */
 827                 fatalf("getpwnam failed to find userid for effective user '%s'",
 828                        Config.effectiveUser);
 829                 return;
 830             }
 831
 832             Config2.effectiveUserID = pwd->pw_uid;
 833
 834             Config2.effectiveGroupID = pwd->pw_gid;
 835
 836 #if HAVE_PUTENV
 837             if (pwd->pw_dir && *pwd->pw_dir) {
 838                 // putenv() leaks by design; avoid leaks when nothing changes
 839                 static SBuf lastDir;
 840                 if (lastDir.isEmpty() || !lastDir.cmp(pwd->pw_dir)) {
 841                     lastDir = pwd->pw_dir;
 842                     int len = strlen(pwd->pw_dir) + 6;
 843                     char *env_str = (char *)xcalloc(len, 1);
 844                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 845                     putenv(env_str);
 846                 }
 847             }
 848 #endif
 849         }
 850     } else {
 851         Config2.effectiveUserID = geteuid();
 852         Config2.effectiveGroupID = getegid();
 853     }
 854
 855     if (NULL != Config.effectiveGroup) {
 856
 857         struct group *grp = getgrnam(Config.effectiveGroup);
 858
 859         if (NULL == grp) {
 860             fatalf("getgrnam failed to find groupid for effective group '%s'",
 861                    Config.effectiveGroup);
 862             return;
 863         }
 864
 865         Config2.effectiveGroupID = grp->gr_gid;
 866     }
 867
 868     if (Security::ProxyOutgoingConfig.encryptTransport) {
 869         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 870         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 871         if (!Config.ssl_client.sslContext) {
 872 #if USE_OPENSSL
 873             fatal("ERROR: Could not initialize https:// proxy context");
 874 #else
 875             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 876 #endif
 877         }
 878     }
 879
 880     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 881
 882         // default value for ssldomain= is the peer host/IP
 883         if (p->secure.sslDomain.isEmpty())
 884             p->secure.sslDomain = p->host;
 885
 886         if (p->secure.encryptTransport) {
 887             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 888             p->sslContext = p->secure.createClientContext(true);
 889             if (!p->sslContext) {
 890                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 891                 self_destruct();
 892             }
 893         }
 894     }
 895
 896 #if USE_OPENSSL
 897     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 898         if (!s->secure.encryptTransport)
 899             continue;
 900         debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS context");
 901         s->configureSslServerContext();
 902     }
 903 #endif
 904
 905     // prevent infinite fetch loops in the request parser
 906     // due to buffer full but not enough data recived to finish parse
 907     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 908         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 909                " Change client_request_buffer_max or request_header_max_size limits.",
 910                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 911     }
 912
 913     /*
 914      * Disable client side request pipelining if client_persistent_connections OFF.
 915      * Waste of resources queueing any pipelined requests when the first will close the connection.
 916      */
 917     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 918         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 919                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 920         Config.pipeline_max_prefetch = 0;
 921     }
 922
 923 #if USE_AUTH
 924     /*
 925      * disable client side request pipelining. There is a race with
 926      * Negotiate and NTLM when the client sends a second request on an
 927      * connection before the authenticate challenge is sent. With
 928      * pipelining OFF, the client may fail to authenticate, but squid's
 929      * state will be preserved.
 930      */
 931     if (Config.pipeline_max_prefetch > 0) {
 932         Auth::Config *nego = Auth::Config::Find("Negotiate");
 933         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 934         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 935             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 936             Config.pipeline_max_prefetch = 0;
 937         }
 938     }
 939 #endif
 940 }
 941
 942 /** Parse a line containing an obsolete directive.
 943  * To upgrade it where possible instead of just "Bungled config" for
 944  * directives which cannot be marked as simply aliases of the some name.
 945  * For example if the parameter order and content has changed.
 946  * Or if the directive has been completely removed.
 947  */
 948 void
 949 parse_obsolete(const char *name)
 950 {
 951     // Directives which have been radically changed rather than removed
 952     if (!strcmp(name, "url_rewrite_concurrency")) {
 953         int cval;
 954         parse_int(&cval);
 955         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 956         Config.redirectChildren.concurrency = cval;
 957     }
 958
 959     if (!strcmp(name, "log_access"))
 960         self_destruct();
 961
 962     if (!strcmp(name, "log_icap"))
 963         self_destruct();
 964
 965     if (!strcmp(name, "ignore_ims_on_miss")) {
 966         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 967         // than the 2.7 directive. We need to parse and invert the configured value.
 968         int temp = 0;
 969         parse_onoff(&temp);
 970         Config.onoff.cache_miss_revalidate = !temp;
 971     }
 972
 973     if (!strncmp(name, "sslproxy_", 9)) {
 974         // the replacement directive tls_outgoing_options uses options instead of whole-line input
 975         SBuf tmp;
 976         if (!strcmp(name, "sslproxy_cafile"))
 977             tmp.append("cafile=");
 978         else if (!strcmp(name, "sslproxy_capath"))
 979             tmp.append("capath=");
 980         else if (!strcmp(name, "sslproxy_cipher"))
 981             tmp.append("cipher=");
 982         else if (!strcmp(name, "sslproxy_client_certificate"))
 983             tmp.append("cert=");
 984         else if (!strcmp(name, "sslproxy_client_key"))
 985             tmp.append("key=");
 986         else if (!strcmp(name, "sslproxy_flags"))
 987             tmp.append("flags=");
 988         else if (!strcmp(name, "sslproxy_options"))
 989             tmp.append("options=");
 990         else if (!strcmp(name, "sslproxy_version"))
 991             tmp.append("version=");
 992         else {
 993             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
 994             self_destruct();
 995         }
 996
 997         // add the value as unquoted-string because the old values did not support whitespace
 998         const char *token = ConfigParser::NextQuotedOrToEol();
 999         tmp.append(token, strlen(token));
1000         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1001     }
1002 }
1003
1004 /* Parse a time specification from the config file.  Store the
1005  * result in 'tptr', after converting it to 'units' */
1006 static void
1007 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
1008 {
1009     time_msec_t u;
1010     if ((u = parseTimeUnits(units, allowMsec)) == 0)
1011         self_destruct();
1012
1013     char *token;
1014     if ((token = ConfigParser::NextToken()) == NULL)
1015         self_destruct();
1016
1017     double d = xatof(token);
1018
1019     time_msec_t m = u; /* default to 'units' if none specified */
1020
1021     if (d) {
1022         if ((token = ConfigParser::PeekAtToken()) && (m = parseTimeUnits(token, allowMsec))) {
1023             (void)ConfigParser::NextToken();
1024
1025         } else if (!expectMoreArguments) {
1026             self_destruct();
1027
1028         } else {
1029             token = NULL; // show default units if dying below
1030             debugs(3, DBG_CRITICAL, "WARNING: No units on '" << config_input_line << "', assuming " << d << " " << units);
1031         }
1032     } else
1033         token = NULL; // show default units if dying below.
1034
1035     *tptr = static_cast<time_msec_t>(m * d);
1036
1037     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1038         debugs(3, DBG_CRITICAL, "FATAL: Invalid value '" <<
1039                d << " " << (token ? token : units) << ": integer overflow (time_msec_t).");
1040         self_destruct();
1041     }
1042 }
1043
1044 static uint64_t
1045 parseTimeUnits(const char *unit, bool allowMsec)
1046 {
1047     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1048         return 1;
1049
1050     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1051         return 1000;
1052
1053     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1054         return 60 * 1000;
1055
1056     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1057         return 3600 * 1000;
1058
1059     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1060         return 86400 * 1000;
1061
1062     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1063         return 86400 * 7 * 1000;
1064
1065     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1066         return 86400 * 14 * 1000;
1067
1068     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1069         return static_cast<uint64_t>(86400) * 30 * 1000;
1070
1071     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1072         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1073
1074     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1075         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1076
1077     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1078
1079     return 0;
1080 }
1081
1082 static void
1083 parseBytesLine64(int64_t * bptr, const char *units)
1084 {
1085     char *token;
1086     double d;
1087     int64_t m;
1088     int64_t u;
1089
1090     if ((u = parseBytesUnits(units)) == 0) {
1091         self_destruct();
1092         return;
1093     }
1094
1095     if ((token = ConfigParser::NextToken()) == NULL) {
1096         self_destruct();
1097         return;
1098     }
1099
1100     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1101         *bptr = -1;
1102         return;
1103     }
1104
1105     d = xatof(token);
1106
1107     m = u;          /* default to 'units' if none specified */
1108
1109     if (0.0 == d)
1110         (void) 0;
1111     else if ((token = ConfigParser::NextToken()) == NULL)
1112         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1113                config_input_line << "', assuming " <<
1114                d << " " <<  units  );
1115     else if ((m = parseBytesUnits(token)) == 0) {
1116         self_destruct();
1117         return;
1118     }
1119
1120     *bptr = static_cast<int64_t>(m * d / u);
1121
1122     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1123         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1124                d << " " << token << ": integer overflow (int64_t).");
1125         self_destruct();
1126     }
1127 }
1128
1129 static void
1130 parseBytesLine(size_t * bptr, const char *units)
1131 {
1132     char *token;
1133     double d;
1134     int m;
1135     int u;
1136
1137     if ((u = parseBytesUnits(units)) == 0) {
1138         self_destruct();
1139         return;
1140     }
1141
1142     if ((token = ConfigParser::NextToken()) == NULL) {
1143         self_destruct();
1144         return;
1145     }
1146
1147     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1148         *bptr = static_cast<size_t>(-1);
1149         return;
1150     }
1151
1152     d = xatof(token);
1153
1154     m = u;          /* default to 'units' if none specified */
1155
1156     if (0.0 == d)
1157         (void) 0;
1158     else if ((token = ConfigParser::NextToken()) == NULL)
1159         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1160                config_input_line << "', assuming " <<
1161                d << " " <<  units  );
1162     else if ((m = parseBytesUnits(token)) == 0) {
1163         self_destruct();
1164         return;
1165     }
1166
1167     *bptr = static_cast<size_t>(m * d / u);
1168
1169     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1170         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1171                d << " " << token << ": integer overflow (size_t).");
1172         self_destruct();
1173     }
1174 }
1175
1176 static void
1177 parseBytesLineSigned(ssize_t * bptr, const char *units)
1178 {
1179     char *token;
1180     double d;
1181     int m;
1182     int u;
1183
1184     if ((u = parseBytesUnits(units)) == 0) {
1185         self_destruct();
1186         return;
1187     }
1188
1189     if ((token = ConfigParser::NextToken()) == NULL) {
1190         self_destruct();
1191         return;
1192     }
1193
1194     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1195         *bptr = -1;
1196         return;
1197     }
1198
1199     d = xatof(token);
1200
1201     m = u;          /* default to 'units' if none specified */
1202
1203     if (0.0 == d)
1204         (void) 0;
1205     else if ((token = ConfigParser::NextToken()) == NULL)
1206         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1207                config_input_line << "', assuming " <<
1208                d << " " <<  units  );
1209     else if ((m = parseBytesUnits(token)) == 0) {
1210         self_destruct();
1211         return;
1212     }
1213
1214     *bptr = static_cast<ssize_t>(m * d / u);
1215
1216     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1217         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1218                d << " " << token << ": integer overflow (ssize_t).");
1219         self_destruct();
1220     }
1221 }
1222
1223 /**
1224  * Parse bytes from a string.
1225  * Similar to the parseBytesLine function but parses the string value instead of
1226  * the current token value.
1227  */
1228 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1229 {
1230     int u;
1231     if ((u = parseBytesUnits(units)) == 0) {
1232         self_destruct();
1233         return;
1234     }
1235
1236     // Find number from string beginning.
1237     char const * number_begin = value;
1238     char const * number_end = value;
1239
1240     while ((*number_end >= '0' && *number_end <= '9')) {
1241         ++number_end;
1242     }
1243
1244     String number;
1245     number.limitInit(number_begin, number_end - number_begin);
1246
1247     int d = xatoi(number.termedBuf());
1248     int m;
1249     if ((m = parseBytesUnits(number_end)) == 0) {
1250         self_destruct();
1251         return;
1252     }
1253
1254     *bptr = static_cast<size_t>(m * d / u);
1255     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1256         self_destruct();
1257 }
1258
1259 static size_t
1260 parseBytesUnits(const char *unit)
1261 {
1262     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1263         return 1;
1264
1265     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1266         return 1 << 10;
1267
1268     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1269         return 1 << 20;
1270
1271     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1272         return 1 << 30;
1273
1274     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1275
1276     return 0;
1277 }
1278
1279 static void
1280 dump_SBufList(StoreEntry * entry, const SBufList &words)
1281 {
1282     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1283         entry->append(i->rawContent(), i->length());
1284         entry->append(" ",1);
1285     }
1286     entry->append("\n",1);
1287 }
1288
1289 static void
1290 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1291 {
1292     while (ae != NULL) {
1293         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1294         storeAppendPrintf(entry, "%s %s %s %s ",
1295                           name,
1296                           ae->name,
1297                           ae->typeString(),
1298                           ae->flags.flagsStr());
1299         dump_SBufList(entry, ae->dump());
1300         ae = ae->next;
1301     }
1302 }
1303
1304 static void
1305 parse_acl(ACL ** ae)
1306 {
1307     ACL::ParseAclLine(LegacyParser, ae);
1308 }
1309
1310 static void
1311 free_acl(ACL ** ae)
1312 {
1313     aclDestroyAcls(ae);
1314 }
1315
1316 void
1317 dump_acl_list(StoreEntry * entry, ACLList * head)
1318 {
1319     dump_SBufList(entry, head->dump());
1320 }
1321
1322 void
1323 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1324 {
1325     if (head)
1326         dump_SBufList(entry, head->treeDump(name,NULL));
1327 }
1328
1329 static void
1330 parse_acl_access(acl_access ** head)
1331 {
1332     aclParseAccessLine(cfg_directive, LegacyParser, head);
1333 }
1334
1335 static void
1336 free_acl_access(acl_access ** head)
1337 {
1338     aclDestroyAccessList(head);
1339 }
1340
1341 static void
1342 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1343 {
1344     char buf[MAX_IPSTRLEN];
1345     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1346 }
1347
1348 static void
1349 parse_address(Ip::Address *addr)
1350 {
1351     char *token = ConfigParser::NextToken();
1352
1353     if (!token) {
1354         self_destruct();
1355         return;
1356     }
1357
1358     if (!strcmp(token,"any_addr"))
1359         addr->setAnyAddr();
1360     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1361         addr->setNoAddr();
1362     else if ( (*addr = token) ) // try parse numeric/IPA
1363         (void) 0;
1364     else if (addr->GetHostByName(token)) // dont use ipcache
1365         (void) 0;
1366     else { // not an IP and not a hostname
1367         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1368         self_destruct();
1369     }
1370 }
1371
1372 static void
1373 free_address(Ip::Address *addr)
1374 {
1375     addr->setEmpty();
1376 }
1377
1378 static void
1379 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1380 {
1381     char buf[MAX_IPSTRLEN];
1382
1383     for (Acl::Address *l = head; l; l = l->next) {
1384         if (!l->addr.isAnyAddr())
1385             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1386         else
1387             storeAppendPrintf(entry, "%s autoselect", name);
1388
1389         dump_acl_list(entry, l->aclList);
1390
1391         storeAppendPrintf(entry, "\n");
1392     }
1393 }
1394
1395 static void
1396 parse_acl_address(Acl::Address ** head)
1397 {
1398     Acl::Address *l = new Acl::Address;
1399     parse_address(&l->addr);
1400     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1401
1402     Acl::Address **tail = head;
1403     while (*tail)
1404         tail = &(*tail)->next;
1405
1406     *tail = l;
1407 }
1408
1409 static void
1410 free_acl_address(Acl::Address ** head)
1411 {
1412     delete *head;
1413     *head = NULL;
1414 }
1415
1416 static void
1417 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1418 {
1419     acl_tos *l;
1420
1421     for (l = head; l; l = l->next) {
1422         if (l->tos > 0)
1423             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1424         else
1425             storeAppendPrintf(entry, "%s none", name);
1426
1427         dump_acl_list(entry, l->aclList);
1428
1429         storeAppendPrintf(entry, "\n");
1430     }
1431 }
1432
1433 static void
1434 parse_acl_tos(acl_tos ** head)
1435 {
1436     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1437     char *token = ConfigParser::NextToken();
1438
1439     if (!token) {
1440         self_destruct();
1441         return;
1442     }
1443
1444     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1445         self_destruct();
1446         return;
1447     }
1448
1449     const unsigned int chTos = tos & 0xFC;
1450     if (chTos != tos) {
1451         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1452         tos = chTos;
1453     }
1454
1455     acl_tos *l = new acl_tos;
1456
1457     l->tos = (tos_t)tos;
1458
1459     aclParseAclList(LegacyParser, &l->aclList, token);
1460
1461     acl_tos **tail = head;  /* sane name below */
1462     while (*tail)
1463         tail = &(*tail)->next;
1464
1465     *tail = l;
1466 }
1467
1468 static void
1469 free_acl_tos(acl_tos ** head)
1470 {
1471     delete *head;
1472     head = NULL;
1473 }
1474
1475 #if SO_MARK && USE_LIBCAP
1476
1477 static void
1478 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1479 {
1480     for (acl_nfmark *l = head; l; l = l->next) {
1481         if (l->nfmark > 0)
1482             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1483         else
1484             storeAppendPrintf(entry, "%s none", name);
1485
1486         dump_acl_list(entry, l->aclList);
1487
1488         storeAppendPrintf(entry, "\n");
1489     }
1490 }
1491
1492 static void
1493 parse_acl_nfmark(acl_nfmark ** head)
1494 {
1495     nfmark_t mark;
1496     char *token = ConfigParser::NextToken();
1497
1498     if (!token) {
1499         self_destruct();
1500         return;
1501     }
1502
1503     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1504         self_destruct();
1505         return;
1506     }
1507
1508     acl_nfmark *l = new acl_nfmark;
1509
1510     l->nfmark = mark;
1511
1512     aclParseAclList(LegacyParser, &l->aclList, token);
1513
1514     acl_nfmark **tail = head;   /* sane name below */
1515     while (*tail)
1516         tail = &(*tail)->next;
1517
1518     *tail = l;
1519 }
1520
1521 static void
1522 free_acl_nfmark(acl_nfmark ** head)
1523 {
1524     delete *head;
1525     head = NULL;
1526 }
1527 #endif /* SO_MARK */
1528
1529 static void
1530 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1531 {
1532     for (AclSizeLimit *l = head; l; l = l->next) {
1533         if (l->size != -1)
1534             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1535         else
1536             storeAppendPrintf(entry, "%s none", name);
1537
1538         dump_acl_list(entry, l->aclList);
1539
1540         storeAppendPrintf(entry, "\n");
1541     }
1542 }
1543
1544 static void
1545 parse_acl_b_size_t(AclSizeLimit ** head)
1546 {
1547     AclSizeLimit *l = new AclSizeLimit;
1548
1549     parse_b_int64_t(&l->size);
1550
1551     aclParseAclList(LegacyParser, &l->aclList, l->size);
1552
1553     AclSizeLimit **tail = head; /* sane name below */
1554     while (*tail)
1555         tail = &(*tail)->next;
1556
1557     *tail = l;
1558 }
1559
1560 static void
1561 free_acl_b_size_t(AclSizeLimit ** head)
1562 {
1563     delete *head;
1564     *head = NULL;
1565 }
1566
1567 #if USE_DELAY_POOLS
1568
1569 #include "DelayConfig.h"
1570 #include "DelayPools.h"
1571 /* do nothing - free_delay_pool_count is the magic free function.
1572  * this is why delay_pool_count isn't just marked TYPE: u_short
1573  */
1574 #define free_delay_pool_class(X)
1575 #define free_delay_pool_access(X)
1576 #define free_delay_pool_rates(X)
1577 #define dump_delay_pool_class(X, Y, Z)
1578 #define dump_delay_pool_access(X, Y, Z)
1579 #define dump_delay_pool_rates(X, Y, Z)
1580
1581 static void
1582 free_delay_pool_count(DelayConfig * cfg)
1583 {
1584     cfg->freePoolCount();
1585 }
1586
1587 static void
1588 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1589 {
1590     cfg.dumpPoolCount (entry, name);
1591 }
1592
1593 static void
1594 parse_delay_pool_count(DelayConfig * cfg)
1595 {
1596     cfg->parsePoolCount();
1597 }
1598
1599 static void
1600 parse_delay_pool_class(DelayConfig * cfg)
1601 {
1602     cfg->parsePoolClass();
1603 }
1604
1605 static void
1606 parse_delay_pool_rates(DelayConfig * cfg)
1607 {
1608     cfg->parsePoolRates();
1609 }
1610
1611 static void
1612 parse_delay_pool_access(DelayConfig * cfg)
1613 {
1614     cfg->parsePoolAccess(LegacyParser);
1615 }
1616
1617 #endif
1618
1619 #if USE_DELAY_POOLS
1620 #include "ClientDelayConfig.h"
1621 /* do nothing - free_client_delay_pool_count is the magic free function.
1622  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1623  */
1624
1625 #define free_client_delay_pool_access(X)
1626 #define free_client_delay_pool_rates(X)
1627 #define dump_client_delay_pool_access(X, Y, Z)
1628 #define dump_client_delay_pool_rates(X, Y, Z)
1629
1630 static void
1631 free_client_delay_pool_count(ClientDelayConfig * cfg)
1632 {
1633     cfg->freePoolCount();
1634 }
1635
1636 static void
1637 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1638 {
1639     cfg.dumpPoolCount (entry, name);
1640 }
1641
1642 static void
1643 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1644 {
1645     cfg->parsePoolCount();
1646 }
1647
1648 static void
1649 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1650 {
1651     cfg->parsePoolRates();
1652 }
1653
1654 static void
1655 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1656 {
1657     cfg->parsePoolAccess(LegacyParser);
1658 }
1659 #endif
1660
1661 #if USE_HTTP_VIOLATIONS
1662 static void
1663 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1664 {
1665     if (manglers)
1666         manglers->dumpAccess(entry, name);
1667 }
1668
1669 static void
1670 parse_http_header_access(HeaderManglers **pm)
1671 {
1672     char *t = NULL;
1673
1674     if ((t = ConfigParser::NextToken()) == NULL) {
1675         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1676         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1677         return;
1678     }
1679
1680     if (!*pm)
1681         *pm = new HeaderManglers;
1682     HeaderManglers *manglers = *pm;
1683     headerMangler *mangler = manglers->track(t);
1684     assert(mangler);
1685
1686     std::string directive = "http_header_access ";
1687     directive += t;
1688     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1689 }
1690
1691 static void
1692 free_HeaderManglers(HeaderManglers **pm)
1693 {
1694     // we delete the entire http_header_* mangler configuration at once
1695     if (const HeaderManglers *manglers = *pm) {
1696         delete manglers;
1697         *pm = NULL;
1698     }
1699 }
1700
1701 static void
1702 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1703 {
1704     if (manglers)
1705         manglers->dumpReplacement(entry, name);
1706 }
1707
1708 static void
1709 parse_http_header_replace(HeaderManglers **pm)
1710 {
1711     char *t = NULL;
1712
1713     if ((t = ConfigParser::NextToken()) == NULL) {
1714         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1715         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1716         return;
1717     }
1718
1719     const char *value = ConfigParser::NextQuotedOrToEol();
1720
1721     if (!*pm)
1722         *pm = new HeaderManglers;
1723     HeaderManglers *manglers = *pm;
1724     manglers->setReplacement(t, value);
1725 }
1726
1727 #endif
1728
1729 static void
1730 dump_cachedir(StoreEntry * entry, const char *name, SquidConfig::_cacheSwap swap)
1731 {
1732     SwapDir *s;
1733     int i;
1734     assert (entry);
1735
1736     for (i = 0; i < swap.n_configured; ++i) {
1737         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1738         if (!s) continue;
1739         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1740         s->dump(*entry);
1741         storeAppendPrintf(entry, "\n");
1742     }
1743 }
1744
1745 static int
1746 check_null_string(char *s)
1747 {
1748     return s == NULL;
1749 }
1750
1751 #if USE_AUTH
1752 static void
1753 parse_authparam(Auth::ConfigVector * config)
1754 {
1755     char *type_str;
1756     char *param_str;
1757
1758     if ((type_str = ConfigParser::NextToken()) == NULL)
1759         self_destruct();
1760
1761     if ((param_str = ConfigParser::NextToken()) == NULL)
1762         self_destruct();
1763
1764     /* find a configuration for the scheme in the currently parsed configs... */
1765     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1766
1767     if (schemeCfg == NULL) {
1768         /* Create a configuration based on the scheme info */
1769         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1770
1771         if (theScheme == NULL) {
1772             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1773             self_destruct();
1774         }
1775
1776         config->push_back(theScheme->createConfig());
1777         schemeCfg = Auth::Config::Find(type_str);
1778         if (schemeCfg == NULL) {
1779             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1780             self_destruct();
1781         }
1782     }
1783
1784     schemeCfg->parse(schemeCfg, config->size(), param_str);
1785 }
1786
1787 static void
1788 free_authparam(Auth::ConfigVector * cfg)
1789 {
1790     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1791     cfg->clear();
1792
1793     /* on reconfigure initialize new auth schemes for the new config. */
1794     if (reconfiguring) {
1795         Auth::Init();
1796     }
1797 }
1798
1799 static void
1800 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1801 {
1802     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1803         (*i)->dump(entry, name, (*i));
1804 }
1805 #endif /* USE_AUTH */
1806
1807 /* TODO: just return the object, the # is irrelevant */
1808 static int
1809 find_fstype(char *type)
1810 {
1811     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1812         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1813             return (int)i;
1814
1815     return (-1);
1816 }
1817
1818 static void
1819 parse_cachedir(SquidConfig::_cacheSwap * swap)
1820 {
1821     char *type_str;
1822     char *path_str;
1823     RefCount<SwapDir> sd;
1824     int i;
1825     int fs;
1826
1827     if ((type_str = ConfigParser::NextToken()) == NULL)
1828         self_destruct();
1829
1830     if ((path_str = ConfigParser::NextToken()) == NULL)
1831         self_destruct();
1832
1833     fs = find_fstype(type_str);
1834
1835     if (fs < 0) {
1836         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1837         return;
1838     }
1839
1840     /* reconfigure existing dir */
1841
1842     for (i = 0; i < swap->n_configured; ++i) {
1843         assert (swap->swapDirs[i].getRaw());
1844
1845         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1846             /* this is specific to on-fs Stores. The right
1847              * way to handle this is probably to have a mapping
1848              * from paths to stores, and have on-fs stores
1849              * register with that, and lookip in that in their
1850              * own setup logic. RBC 20041225. TODO.
1851              */
1852
1853             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1854
1855             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1856                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1857                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1858                 return;
1859             }
1860
1861             sd->reconfigure();
1862             return;
1863         }
1864     }
1865
1866     /* new cache_dir */
1867     if (swap->n_configured > 63) {
1868         /* 7 bits, signed */
1869         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1870         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1871         self_destruct();
1872         return;
1873     }
1874
1875     allocate_new_swapdir(swap);
1876
1877     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1878
1879     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1880
1881     /* parse the FS parameters and options */
1882     sd->parse(swap->n_configured, path_str);
1883
1884     ++swap->n_configured;
1885 }
1886
1887 static const char *
1888 peer_type_str(const peer_t type)
1889 {
1890     const char * result;
1891
1892     switch (type) {
1893
1894     case PEER_PARENT:
1895         result = "parent";
1896         break;
1897
1898     case PEER_SIBLING:
1899         result = "sibling";
1900         break;
1901
1902     case PEER_MULTICAST:
1903         result = "multicast";
1904         break;
1905
1906     default:
1907         result = "unknown";
1908         break;
1909     }
1910
1911     return result;
1912 }
1913
1914 static void
1915 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1916 {
1917     NeighborTypeDomainList *t;
1918     LOCAL_ARRAY(char, xname, 128);
1919
1920     while (p != NULL) {
1921         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1922                           name,
1923                           p->host,
1924                           neighborTypeStr(p),
1925                           p->http_port,
1926                           p->icp.port,
1927                           p->name);
1928         dump_peer_options(entry, p);
1929
1930         if (p->access) {
1931             snprintf(xname, 128, "cache_peer_access %s", p->name);
1932             dump_acl_access(entry, xname, p->access);
1933         }
1934
1935         for (t = p->typelist; t; t = t->next) {
1936             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1937                               p->host,
1938                               peer_type_str(t->type),
1939                               t->domain);
1940         }
1941
1942         p = p->next;
1943     }
1944 }
1945
1946 /**
1947  * utility function to prevent getservbyname() being called with a numeric value
1948  * on Windows at least it returns garage results.
1949  */
1950 static bool
1951 isUnsignedNumeric(const char *str, size_t len)
1952 {
1953     if (len < 1) return false;
1954
1955     for (; len >0 && *str; ++str, --len) {
1956         if (! isdigit(*str))
1957             return false;
1958     }
1959     return true;
1960 }
1961
1962 /**
1963  \param proto   'tcp' or 'udp' for protocol
1964  \returns       Port the named service is supposed to be listening on.
1965  */
1966 static unsigned short
1967 GetService(const char *proto)
1968 {
1969     struct servent *port = NULL;
1970     /** Parses a port number or service name from the squid.conf */
1971     char *token = ConfigParser::NextToken();
1972     if (token == NULL) {
1973         self_destruct();
1974         return 0; /* NEVER REACHED */
1975     }
1976     /** Returns either the service port number from /etc/services */
1977     if ( !isUnsignedNumeric(token, strlen(token)) )
1978         port = getservbyname(token, proto);
1979     if (port != NULL) {
1980         return ntohs((unsigned short)port->s_port);
1981     }
1982     /** Or a numeric translation of the config text. */
1983     return xatos(token);
1984 }
1985
1986 /**
1987  \returns       Port the named TCP service is supposed to be listening on.
1988  \copydoc GetService(const char *proto)
1989  */
1990 inline unsigned short
1991 GetTcpService(void)
1992 {
1993     return GetService("tcp");
1994 }
1995
1996 /**
1997  \returns       Port the named UDP service is supposed to be listening on.
1998  \copydoc GetService(const char *proto)
1999  */
2000 inline unsigned short
2001 GetUdpService(void)
2002 {
2003     return GetService("udp");
2004 }
2005
2006 static void
2007 parse_peer(CachePeer ** head)
2008 {
2009     char *token = NULL;
2010     CachePeer *p = new CachePeer;
2011
2012     if ((token = ConfigParser::NextToken()) == NULL)
2013         self_destruct();
2014
2015     p->host = xstrdup(token);
2016
2017     p->name = xstrdup(token);
2018
2019     if ((token = ConfigParser::NextToken()) == NULL)
2020         self_destruct();
2021
2022     p->type = parseNeighborType(token);
2023
2024     if (p->type == PEER_MULTICAST) {
2025         p->options.no_digest = true;
2026         p->options.no_netdb_exchange = true;
2027     }
2028
2029     p->http_port = GetTcpService();
2030
2031     if (!p->http_port)
2032         self_destruct();
2033
2034     p->icp.port = GetUdpService();
2035
2036     while ((token = ConfigParser::NextToken())) {
2037         if (!strcmp(token, "proxy-only")) {
2038             p->options.proxy_only = true;
2039         } else if (!strcmp(token, "no-query")) {
2040             p->options.no_query = true;
2041         } else if (!strcmp(token, "background-ping")) {
2042             p->options.background_ping = true;
2043         } else if (!strcmp(token, "no-digest")) {
2044             p->options.no_digest = true;
2045         } else if (!strcmp(token, "no-tproxy")) {
2046             p->options.no_tproxy = true;
2047         } else if (!strcmp(token, "multicast-responder")) {
2048             p->options.mcast_responder = true;
2049 #if PEER_MULTICAST_SIBLINGS
2050         } else if (!strcmp(token, "multicast-siblings")) {
2051             p->options.mcast_siblings = true;
2052 #endif
2053         } else if (!strncmp(token, "weight=", 7)) {
2054             p->weight = xatoi(token + 7);
2055         } else if (!strncmp(token, "basetime=", 9)) {
2056             p->basetime = xatoi(token + 9);
2057         } else if (!strcmp(token, "closest-only")) {
2058             p->options.closest_only = true;
2059         } else if (!strncmp(token, "ttl=", 4)) {
2060             p->mcast.ttl = xatoi(token + 4);
2061
2062             if (p->mcast.ttl < 0)
2063                 p->mcast.ttl = 0;
2064
2065             if (p->mcast.ttl > 128)
2066                 p->mcast.ttl = 128;
2067         } else if (!strcmp(token, "default")) {
2068             p->options.default_parent = true;
2069         } else if (!strcmp(token, "round-robin")) {
2070             p->options.roundrobin = true;
2071         } else if (!strcmp(token, "weighted-round-robin")) {
2072             p->options.weighted_roundrobin = true;
2073 #if USE_HTCP
2074         } else if (!strcmp(token, "htcp")) {
2075             p->options.htcp = true;
2076         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2077             /* Note: The htcp- form is deprecated, replaced by htcp= */
2078             p->options.htcp = true;
2079             char *tmp = xstrdup(token+5);
2080             char *mode, *nextmode;
2081             for (mode = nextmode = tmp; mode; mode = nextmode) {
2082                 nextmode = strchr(mode, ',');
2083                 if (nextmode) {
2084                     *nextmode = '\0';
2085                     ++nextmode;
2086                 }
2087                 if (!strcmp(mode, "no-clr")) {
2088                     if (p->options.htcp_only_clr)
2089                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2090                     p->options.htcp_no_clr = true;
2091                 } else if (!strcmp(mode, "no-purge-clr")) {
2092                     p->options.htcp_no_purge_clr = true;
2093                 } else if (!strcmp(mode, "only-clr")) {
2094                     if (p->options.htcp_no_clr)
2095                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2096                     p->options.htcp_only_clr = true;
2097                 } else if (!strcmp(mode, "forward-clr")) {
2098                     p->options.htcp_forward_clr = true;
2099                 } else if (!strcmp(mode, "oldsquid")) {
2100                     p->options.htcp_oldsquid = true;
2101                 } else {
2102                     fatalf("invalid HTCP mode '%s'", mode);
2103                 }
2104             }
2105             safe_free(tmp);
2106 #endif
2107         } else if (!strcmp(token, "no-netdb-exchange")) {
2108             p->options.no_netdb_exchange = true;
2109
2110         } else if (!strcmp(token, "carp")) {
2111             if (p->type != PEER_PARENT)
2112                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2113
2114             p->options.carp = true;
2115         } else if (!strncmp(token, "carp-key=", 9)) {
2116             if (p->options.carp != true)
2117                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2118             p->options.carp_key.set = true;
2119             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2120             for (; key; key = nextkey) {
2121                 nextkey=strchr(key,',');
2122                 if (nextkey) ++nextkey; // skip the comma, any
2123                 if (0==strncmp(key,"scheme",6)) {
2124                     p->options.carp_key.scheme = true;
2125                 } else if (0==strncmp(key,"host",4)) {
2126                     p->options.carp_key.host = true;
2127                 } else if (0==strncmp(key,"port",4)) {
2128                     p->options.carp_key.port = true;
2129                 } else if (0==strncmp(key,"path",4)) {
2130                     p->options.carp_key.path = true;
2131                 } else if (0==strncmp(key,"params",6)) {
2132                     p->options.carp_key.params = true;
2133                 } else {
2134                     fatalf("invalid carp-key '%s'",key);
2135                 }
2136             }
2137         } else if (!strcmp(token, "userhash")) {
2138 #if USE_AUTH
2139             if (p->type != PEER_PARENT)
2140                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2141
2142             p->options.userhash = true;
2143 #else
2144             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2145 #endif
2146         } else if (!strcmp(token, "sourcehash")) {
2147             if (p->type != PEER_PARENT)
2148                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2149
2150             p->options.sourcehash = true;
2151
2152         } else if (!strcmp(token, "no-delay")) {
2153 #if USE_DELAY_POOLS
2154             p->options.no_delay = true;
2155 #else
2156             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2157 #endif
2158         } else if (!strncmp(token, "login=", 6)) {
2159             p->login = xstrdup(token + 6);
2160             rfc1738_unescape(p->login);
2161         } else if (!strncmp(token, "connect-timeout=", 16)) {
2162             p->connect_timeout = xatoi(token + 16);
2163         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2164             p->connect_fail_limit = xatoi(token + 19);
2165 #if USE_CACHE_DIGESTS
2166         } else if (!strncmp(token, "digest-url=", 11)) {
2167             p->digest_url = xstrdup(token + 11);
2168 #endif
2169
2170         } else if (!strcmp(token, "allow-miss")) {
2171             p->options.allow_miss = true;
2172         } else if (!strncmp(token, "max-conn=", 9)) {
2173             p->max_conn = xatoi(token + 9);
2174         } else if (!strncmp(token, "standby=", 8)) {
2175             p->standby.limit = xatoi(token + 8);
2176         } else if (!strcmp(token, "originserver")) {
2177             p->options.originserver = true;
2178         } else if (!strncmp(token, "name=", 5)) {
2179             safe_free(p->name);
2180
2181             if (token[5])
2182                 p->name = xstrdup(token + 5);
2183         } else if (!strncmp(token, "forceddomain=", 13)) {
2184             safe_free(p->domain);
2185             if (token[13])
2186                 p->domain = xstrdup(token + 13);
2187
2188         } else if (strncmp(token, "ssl", 3) == 0) {
2189 #if !USE_OPENSSL
2190             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2191 #else
2192             p->secure.parse(token+3);
2193 #endif
2194         } else if (strncmp(token, "tls-", 4) == 0) {
2195             p->secure.parse(token+4);
2196         } else if (strcmp(token, "front-end-https") == 0) {
2197             p->front_end_https = 1;
2198         } else if (strcmp(token, "front-end-https=on") == 0) {
2199             p->front_end_https = 1;
2200         } else if (strcmp(token, "front-end-https=auto") == 0) {
2201             p->front_end_https = 2;
2202         } else if (strcmp(token, "connection-auth=off") == 0) {
2203             p->connection_auth = 0;
2204         } else if (strcmp(token, "connection-auth") == 0) {
2205             p->connection_auth = 1;
2206         } else if (strcmp(token, "connection-auth=on") == 0) {
2207             p->connection_auth = 1;
2208         } else if (strcmp(token, "connection-auth=auto") == 0) {
2209             p->connection_auth = 2;
2210         } else if (token[0] == '#') {
2211             // start of a text comment. stop reading this line.
2212             break;
2213         } else {
2214             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2215         }
2216     }
2217
2218     if (peerFindByName(p->name))
2219         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2220
2221     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2222         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2223
2224     if (p->weight < 1)
2225         p->weight = 1;
2226
2227     if (p->connect_fail_limit < 1)
2228         p->connect_fail_limit = 10;
2229
2230 #if USE_CACHE_DIGESTS
2231
2232     if (!p->options.no_digest) {
2233         /* XXX This looks odd.. who has the original pointer
2234          * then?
2235          */
2236         PeerDigest *pd = peerDigestCreate(p);
2237         p->digest = cbdataReference(pd);
2238     }
2239
2240 #endif
2241
2242     p->index =  ++Config.npeers;
2243
2244     while (*head != NULL)
2245         head = &(*head)->next;
2246
2247     *head = p;
2248
2249     peerClearRRStart();
2250 }
2251
2252 static void
2253 free_peer(CachePeer ** P)
2254 {
2255     delete *P;
2256     *P = NULL;
2257     Config.npeers = 0;
2258 }
2259
2260 static void
2261 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2262 {
2263     wordlist *w;
2264
2265     while (list != NULL) {
2266         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2267             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2268         else
2269             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2270
2271         for (w = list->actions; w != NULL; w = w->next) {
2272             storeAppendPrintf(entry, " %s", w->key);
2273         }
2274
2275         storeAppendPrintf(entry, "\n");
2276         list = list->next;
2277     }
2278 }
2279
2280 static void
2281 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2282 {
2283     char *passwd = NULL;
2284     wordlist *actions = NULL;
2285     Mgr::ActionPasswordList *p;
2286     Mgr::ActionPasswordList **P;
2287     parse_string(&passwd);
2288     parse_wordlist(&actions);
2289     p = new Mgr::ActionPasswordList;
2290     p->passwd = passwd;
2291     p->actions = actions;
2292
2293     for (P = head; *P; P = &(*P)->next) {
2294         /*
2295          * See if any of the actions from this line already have a
2296          * password from previous lines.  The password checking
2297          * routines in cache_manager.c take the the password from
2298          * the first Mgr::ActionPasswordList that contains the
2299          * requested action.  Thus, we should warn users who might
2300          * think they can have two passwords for the same action.
2301          */
2302         wordlist *w;
2303         wordlist *u;
2304
2305         for (w = (*P)->actions; w; w = w->next) {
2306             for (u = actions; u; u = u->next) {
2307                 if (strcmp(w->key, u->key))
2308                     continue;
2309
2310                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2311             }
2312         }
2313     }
2314
2315     *P = p;
2316 }
2317
2318 static void
2319 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2320 {
2321     Mgr::ActionPasswordList *p;
2322
2323     while ((p = *head) != NULL) {
2324         *head = p->next;
2325         xfree(p->passwd);
2326         wordlistDestroy(&p->actions);
2327         xfree(p);
2328     }
2329 }
2330
2331 static void
2332 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2333 {
2334     AclNameList *a;
2335
2336     while (var != NULL) {
2337         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2338
2339         for (a = var->acl_list; a != NULL; a = a->next)
2340             storeAppendPrintf(entry, " %s", a->name);
2341
2342         storeAppendPrintf(entry, "\n");
2343
2344         var = var->next;
2345     }
2346 }
2347
2348 static void
2349 parse_denyinfo(AclDenyInfoList ** var)
2350 {
2351     aclParseDenyInfoLine(var);
2352 }
2353
2354 void
2355 free_denyinfo(AclDenyInfoList ** list)
2356 {
2357     AclDenyInfoList *a = NULL;
2358     AclDenyInfoList *a_next = NULL;
2359     AclNameList *l = NULL;
2360     AclNameList *l_next = NULL;
2361
2362     for (a = *list; a; a = a_next) {
2363         for (l = a->acl_list; l; l = l_next) {
2364             l_next = l->next;
2365             memFree(l, MEM_ACL_NAME_LIST);
2366             l = NULL;
2367         }
2368
2369         a_next = a->next;
2370         memFree(a, MEM_ACL_DENY_INFO_LIST);
2371         a = NULL;
2372     }
2373
2374     *list = NULL;
2375 }
2376
2377 static void
2378 parse_peer_access(void)
2379 {
2380     char *host = NULL;
2381     CachePeer *p;
2382
2383     if (!(host = ConfigParser::NextToken()))
2384         self_destruct();
2385
2386     if ((p = peerFindByName(host)) == NULL) {
2387         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2388         return;
2389     }
2390
2391     std::string directive = "peer_access ";
2392     directive += host;
2393     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2394 }
2395
2396 static void
2397 parse_hostdomaintype(void)
2398 {
2399     char *host = NULL;
2400     char *type = NULL;
2401     char *domain = NULL;
2402
2403     if (!(host = ConfigParser::NextToken()))
2404         self_destruct();
2405
2406     if (!(type = ConfigParser::NextToken()))
2407         self_destruct();
2408
2409     while ((domain = ConfigParser::NextToken())) {
2410         NeighborTypeDomainList *l = NULL;
2411         NeighborTypeDomainList **L = NULL;
2412         CachePeer *p;
2413
2414         if ((p = peerFindByName(host)) == NULL) {
2415             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2416             return;
2417         }
2418
2419         l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2420         l->type = parseNeighborType(type);
2421         l->domain = xstrdup(domain);
2422
2423         for (L = &(p->typelist); *L; L = &((*L)->next));
2424         *L = l;
2425     }
2426 }
2427
2428 static void
2429 dump_int(StoreEntry * entry, const char *name, int var)
2430 {
2431     storeAppendPrintf(entry, "%s %d\n", name, var);
2432 }
2433
2434 void
2435 parse_int(int *var)
2436 {
2437     int i;
2438     i = GetInteger();
2439     *var = i;
2440 }
2441
2442 static void
2443 free_int(int *var)
2444 {
2445     *var = 0;
2446 }
2447
2448 static void
2449 dump_onoff(StoreEntry * entry, const char *name, int var)
2450 {
2451     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2452 }
2453
2454 void
2455 parse_onoff(int *var)
2456 {
2457     char *token = ConfigParser::NextToken();
2458
2459     if (token == NULL)
2460         self_destruct();
2461
2462     if (!strcmp(token, "on")) {
2463         *var = 1;
2464     } else if (!strcmp(token, "enable")) {
2465         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2466         *var = 1;
2467     } else if (!strcmp(token, "off")) {
2468         *var = 0;
2469     } else if (!strcmp(token, "disable")) {
2470         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2471         *var = 0;
2472     } else {
2473         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2474         self_destruct();
2475     }
2476 }
2477
2478 #define free_onoff free_int
2479
2480 static void
2481 dump_tristate(StoreEntry * entry, const char *name, int var)
2482 {
2483     const char *state;
2484
2485     if (var > 0)
2486         state = "on";
2487     else if (var < 0)
2488         state = "warn";
2489     else
2490         state = "off";
2491
2492     storeAppendPrintf(entry, "%s %s\n", name, state);
2493 }
2494
2495 static void
2496 parse_tristate(int *var)
2497 {
2498     char *token = ConfigParser::NextToken();
2499
2500     if (token == NULL)
2501         self_destruct();
2502
2503     if (!strcmp(token, "on")) {
2504         *var = 1;
2505     } else if (!strcmp(token, "enable")) {
2506         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2507         *var = 1;
2508     } else if (!strcmp(token, "warn")) {
2509         *var = -1;
2510     } else if (!strcmp(token, "off")) {
2511         *var = 0;
2512     } else if (!strcmp(token, "disable")) {
2513         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2514         *var = 0;
2515     } else {
2516         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2517         self_destruct();
2518     }
2519 }
2520
2521 #define free_tristate free_int
2522
2523 void
2524 parse_pipelinePrefetch(int *var)
2525 {
2526     char *token = ConfigParser::PeekAtToken();
2527
2528     if (token == NULL)
2529         self_destruct();
2530
2531     if (!strcmp(token, "on")) {
2532         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2533         *var = 1;
2534         //pop the token
2535         (void)ConfigParser::NextToken();
2536     } else if (!strcmp(token, "off")) {
2537         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2538         *var = 0;
2539         //pop the token
2540         (void)ConfigParser::NextToken();
2541     } else
2542         parse_int(var);
2543 }
2544
2545 #define free_pipelinePrefetch free_int
2546 #define dump_pipelinePrefetch dump_int
2547
2548 static void
2549 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2550 {
2551     while (head != NULL) {
2552         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2553                           name,
2554                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2555                           head->pattern.c_str(),
2556                           (int) head->min / 60,
2557                           (int) (100.0 * head->pct + 0.5),
2558                           (int) head->max / 60);
2559
2560         if (head->max_stale >= 0)
2561             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2562
2563         if (head->flags.refresh_ims)
2564             storeAppendPrintf(entry, " refresh-ims");
2565
2566         if (head->flags.store_stale)
2567             storeAppendPrintf(entry, " store-stale");
2568
2569 #if USE_HTTP_VIOLATIONS
2570
2571         if (head->flags.override_expire)
2572             storeAppendPrintf(entry, " override-expire");
2573
2574         if (head->flags.override_lastmod)
2575             storeAppendPrintf(entry, " override-lastmod");
2576
2577         if (head->flags.reload_into_ims)
2578             storeAppendPrintf(entry, " reload-into-ims");
2579
2580         if (head->flags.ignore_reload)
2581             storeAppendPrintf(entry, " ignore-reload");
2582
2583         if (head->flags.ignore_no_store)
2584             storeAppendPrintf(entry, " ignore-no-store");
2585
2586         if (head->flags.ignore_private)
2587             storeAppendPrintf(entry, " ignore-private");
2588 #endif
2589
2590         storeAppendPrintf(entry, "\n");
2591
2592         head = head->next;
2593     }
2594 }
2595
2596 static void
2597 parse_refreshpattern(RefreshPattern ** head)
2598 {
2599     char *token;
2600     char *pattern;
2601     time_t min = 0;
2602     double pct = 0.0;
2603     time_t max = 0;
2604     int refresh_ims = 0;
2605     int store_stale = 0;
2606     int max_stale = -1;
2607
2608 #if USE_HTTP_VIOLATIONS
2609
2610     int override_expire = 0;
2611     int override_lastmod = 0;
2612     int reload_into_ims = 0;
2613     int ignore_reload = 0;
2614     int ignore_no_store = 0;
2615     int ignore_private = 0;
2616 #endif
2617
2618     int i;
2619     RefreshPattern *t;
2620     regex_t comp;
2621     int errcode;
2622     int flags = REG_EXTENDED | REG_NOSUB;
2623
2624     if ((token = ConfigParser::RegexPattern()) != NULL) {
2625
2626         if (strcmp(token, "-i") == 0) {
2627             flags |= REG_ICASE;
2628             token = ConfigParser::RegexPattern();
2629         } else if (strcmp(token, "+i") == 0) {
2630             flags &= ~REG_ICASE;
2631             token = ConfigParser::RegexPattern();
2632         }
2633
2634     }
2635
2636     if (token == NULL) {
2637         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2638         self_destruct();
2639         return;
2640     }
2641
2642     pattern = xstrdup(token);
2643
2644     i = GetInteger();       /* token: min */
2645
2646     /* catch negative and insanely huge values close to 32-bit wrap */
2647     if (i < 0) {
2648         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2649         i = 0;
2650     }
2651     if (i > 60*24*365) {
2652         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2653         i = 60*24*365;
2654     }
2655
2656     min = (time_t) (i * 60);    /* convert minutes to seconds */
2657
2658     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2659
2660     i = GetInteger();       /* token: max */
2661
2662     /* catch negative and insanely huge values close to 32-bit wrap */
2663     if (i < 0) {
2664         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2665         i = 0;
2666     }
2667     if (i > 60*24*365) {
2668         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2669         i = 60*24*365;
2670     }
2671
2672     max = (time_t) (i * 60);    /* convert minutes to seconds */
2673
2674     /* Options */
2675     while ((token = ConfigParser::NextToken()) != NULL) {
2676         if (!strcmp(token, "refresh-ims")) {
2677             refresh_ims = 1;
2678         } else if (!strcmp(token, "store-stale")) {
2679             store_stale = 1;
2680         } else if (!strncmp(token, "max-stale=", 10)) {
2681             max_stale = xatoi(token + 10);
2682
2683 #if USE_HTTP_VIOLATIONS
2684
2685         } else if (!strcmp(token, "override-expire"))
2686             override_expire = 1;
2687         else if (!strcmp(token, "override-lastmod"))
2688             override_lastmod = 1;
2689         else if (!strcmp(token, "ignore-no-store"))
2690             ignore_no_store = 1;
2691         else if (!strcmp(token, "ignore-private"))
2692             ignore_private = 1;
2693         else if (!strcmp(token, "reload-into-ims")) {
2694             reload_into_ims = 1;
2695             refresh_nocache_hack = 1;
2696             /* tell client_side.c that this is used */
2697         } else if (!strcmp(token, "ignore-reload")) {
2698             ignore_reload = 1;
2699             refresh_nocache_hack = 1;
2700             /* tell client_side.c that this is used */
2701 #endif
2702
2703         } else if (!strcmp(token, "ignore-no-cache") ||
2704                    !strcmp(token, "ignore-must-revalidate") ||
2705                    !strcmp(token, "ignore-auth")
2706                   ) {
2707             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2708         } else
2709             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2710     }
2711
2712     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2713         char errbuf[256];
2714         regerror(errcode, &comp, errbuf, sizeof errbuf);
2715         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2716         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2717         xfree(pattern);
2718         return;
2719     }
2720
2721     pct = pct < 0.0 ? 0.0 : pct;
2722     max = max < 0 ? 0 : max;
2723     t = new RefreshPattern(pattern, flags);
2724     t->pattern.regex = comp;
2725     t->min = min;
2726     t->pct = pct;
2727     t->max = max;
2728
2729     if (refresh_ims)
2730         t->flags.refresh_ims = true;
2731
2732     if (store_stale)
2733         t->flags.store_stale = true;
2734
2735     t->max_stale = max_stale;
2736
2737 #if USE_HTTP_VIOLATIONS
2738
2739     if (override_expire)
2740         t->flags.override_expire = true;
2741
2742     if (override_lastmod)
2743         t->flags.override_lastmod = true;
2744
2745     if (reload_into_ims)
2746         t->flags.reload_into_ims = true;
2747
2748     if (ignore_reload)
2749         t->flags.ignore_reload = true;
2750
2751     if (ignore_no_store)
2752         t->flags.ignore_no_store = true;
2753
2754     if (ignore_private)
2755         t->flags.ignore_private = true;
2756 #endif
2757
2758     t->next = NULL;
2759
2760     while (*head)
2761         head = &(*head)->next;
2762
2763     *head = t;
2764
2765     xfree(pattern);
2766 }
2767
2768 static void
2769 free_refreshpattern(RefreshPattern ** head)
2770 {
2771     delete *head;
2772     *head = nullptr;
2773
2774 #if USE_HTTP_VIOLATIONS
2775     refresh_nocache_hack = 0;
2776
2777 #endif
2778 }
2779
2780 static void
2781 dump_string(StoreEntry * entry, const char *name, char *var)
2782 {
2783     if (var != NULL)
2784         storeAppendPrintf(entry, "%s %s\n", name, var);
2785 }
2786
2787 static void
2788 parse_string(char **var)
2789 {
2790     char *token = ConfigParser::NextToken();
2791     safe_free(*var);
2792
2793     if (token == NULL)
2794         self_destruct();
2795
2796     *var = xstrdup(token);
2797 }
2798
2799 static void
2800 free_string(char **var)
2801 {
2802     safe_free(*var);
2803 }
2804
2805 void
2806 parse_eol(char *volatile *var)
2807 {
2808     if (!var) {
2809         self_destruct();
2810         return;
2811     }
2812
2813     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2814     safe_free(*var);
2815
2816     if (!token) {
2817         self_destruct();
2818         return;
2819     }
2820
2821     while (*token && xisspace(*token))
2822         ++token;
2823
2824     if (!*token) {
2825         self_destruct();
2826         return;
2827     }
2828
2829     *var = xstrdup((char *) token);
2830 }
2831
2832 #define dump_eol dump_string
2833 #define free_eol free_string
2834
2835 static void
2836 parse_TokenOrQuotedString(char **var)
2837 {
2838     char *token = ConfigParser::NextQuotedToken();
2839     safe_free(*var);
2840
2841     if (token == NULL)
2842         self_destruct();
2843
2844     *var = xstrdup(token);
2845 }
2846
2847 #define dump_TokenOrQuotedString dump_string
2848 #define free_TokenOrQuotedString free_string
2849
2850 static void
2851 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2852 {
2853     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2854 }
2855
2856 void
2857 parse_time_t(time_t * var)
2858 {
2859     time_msec_t tval;
2860     parseTimeLine(&tval, T_SECOND_STR, false);
2861     *var = static_cast<time_t>(tval/1000);
2862 }
2863
2864 static void
2865 free_time_t(time_t * var)
2866 {
2867     *var = 0;
2868 }
2869
2870 static void
2871 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2872 {
2873     if (var % 1000)
2874         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2875     else
2876         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2877 }
2878
2879 void
2880 parse_time_msec(time_msec_t * var)
2881 {
2882     parseTimeLine(var, T_SECOND_STR, true);
2883 }
2884
2885 static void
2886 free_time_msec(time_msec_t * var)
2887 {
2888     *var = 0;
2889 }
2890
2891 #if UNUSED_CODE
2892 static void
2893 dump_size_t(StoreEntry * entry, const char *name, size_t var)
2894 {
2895     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
2896 }
2897 #endif
2898
2899 static void
2900 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
2901 {
2902     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2903 }
2904
2905 static void
2906 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
2907 {
2908     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2909 }
2910
2911 #if UNUSED_CODE
2912 static void
2913 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
2914 {
2915     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
2916 }
2917 #endif
2918
2919 static void
2920 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
2921 {
2922     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
2923 }
2924
2925 static void
2926 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
2927 {
2928     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
2929 }
2930
2931 #if UNUSED_CODE
2932 static void
2933 parse_size_t(size_t * var)
2934 {
2935     int i;
2936     i = GetInteger();
2937     *var = (size_t) i;
2938 }
2939 #endif
2940
2941 static void
2942 parse_b_size_t(size_t * var)
2943 {
2944     parseBytesLine(var, B_BYTES_STR);
2945 }
2946
2947 static void
2948 parse_b_ssize_t(ssize_t * var)
2949 {
2950     parseBytesLineSigned(var, B_BYTES_STR);
2951 }
2952
2953 #if UNUSED_CODE
2954 static void
2955 parse_kb_size_t(size_t * var)
2956 {
2957     parseBytesLine(var, B_KBYTES_STR);
2958 }
2959 #endif
2960
2961 static void
2962 parse_b_int64_t(int64_t * var)
2963 {
2964     parseBytesLine64(var, B_BYTES_STR);
2965 }
2966
2967 static void
2968 parse_kb_int64_t(int64_t * var)
2969 {
2970     parseBytesLine64(var, B_KBYTES_STR);
2971 }
2972
2973 static void
2974 free_size_t(size_t * var)
2975 {
2976     *var = 0;
2977 }
2978
2979 static void
2980 free_ssize_t(ssize_t * var)
2981 {
2982     *var = 0;
2983 }
2984
2985 static void
2986 free_b_int64_t(int64_t * var)
2987 {
2988     *var = 0;
2989 }
2990
2991 #define free_b_size_t free_size_t
2992 #define free_b_ssize_t free_ssize_t
2993 #define free_kb_size_t free_size_t
2994 #define free_mb_size_t free_size_t
2995 #define free_gb_size_t free_size_t
2996 #define free_kb_int64_t free_b_int64_t
2997
2998 static void
2999 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3000 {
3001     storeAppendPrintf(entry, "%s %d\n", name, var);
3002 }
3003
3004 static void
3005 free_u_short(unsigned short * u)
3006 {
3007     *u = 0;
3008 }
3009
3010 static void
3011 parse_u_short(unsigned short * var)
3012 {
3013     ConfigParser::ParseUShort(var);
3014 }
3015
3016 void
3017 ConfigParser::ParseUShort(unsigned short *var)
3018 {
3019     *var = GetShort();
3020 }
3021
3022 void
3023 ConfigParser::ParseBool(bool *var)
3024 {
3025     int i = GetInteger();
3026
3027     if (0 == i)
3028         *var = false;
3029     else if (1 == i)
3030         *var = true;
3031     else
3032         self_destruct();
3033 }
3034
3035 static void
3036 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3037 {
3038     while (list != NULL) {
3039         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3040         list = list->next;
3041     }
3042 }
3043
3044 void
3045 ConfigParser::ParseWordList(wordlist ** list)
3046 {
3047     parse_wordlist(list);
3048 }
3049
3050 void
3051 parse_wordlist(wordlist ** list)
3052 {
3053     char *token;
3054     while ((token = ConfigParser::NextQuotedToken()))
3055         wordlistAdd(list, token);
3056 }
3057
3058 #if 0 /* now unused */
3059 static int
3060 check_null_wordlist(wordlist * w)
3061 {
3062     return w == NULL;
3063 }
3064 #endif
3065
3066 static int
3067 check_null_acl_access(acl_access * a)
3068 {
3069     return a == NULL;
3070 }
3071
3072 #define free_wordlist wordlistDestroy
3073
3074 #define free_uri_whitespace free_int
3075
3076 static void
3077 parse_uri_whitespace(int *var)
3078 {
3079     char *token = ConfigParser::NextToken();
3080
3081     if (token == NULL)
3082         self_destruct();
3083
3084     if (!strcmp(token, "strip"))
3085         *var = URI_WHITESPACE_STRIP;
3086     else if (!strcmp(token, "deny"))
3087         *var = URI_WHITESPACE_DENY;
3088     else if (!strcmp(token, "allow"))
3089         *var = URI_WHITESPACE_ALLOW;
3090     else if (!strcmp(token, "encode"))
3091         *var = URI_WHITESPACE_ENCODE;
3092     else if (!strcmp(token, "chop"))
3093         *var = URI_WHITESPACE_CHOP;
3094     else {
3095         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3096         self_destruct();
3097     }
3098 }
3099
3100 static void
3101 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3102 {
3103     const char *s;
3104
3105     if (var == URI_WHITESPACE_ALLOW)
3106         s = "allow";
3107     else if (var == URI_WHITESPACE_ENCODE)
3108         s = "encode";
3109     else if (var == URI_WHITESPACE_CHOP)
3110         s = "chop";
3111     else if (var == URI_WHITESPACE_DENY)
3112         s = "deny";
3113     else
3114         s = "strip";
3115
3116     storeAppendPrintf(entry, "%s %s\n", name, s);
3117 }
3118
3119 static void
3120 free_removalpolicy(RemovalPolicySettings ** settings)
3121 {
3122     if (!*settings)
3123         return;
3124
3125     free_string(&(*settings)->type);
3126
3127     free_wordlist(&(*settings)->args);
3128
3129     delete *settings;
3130
3131     *settings = NULL;
3132 }
3133
3134 static void
3135 parse_removalpolicy(RemovalPolicySettings ** settings)
3136 {
3137     if (*settings)
3138         free_removalpolicy(settings);
3139
3140     *settings = new RemovalPolicySettings;
3141
3142     parse_string(&(*settings)->type);
3143
3144     parse_wordlist(&(*settings)->args);
3145 }
3146
3147 static void
3148 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3149 {
3150     wordlist *args;
3151     storeAppendPrintf(entry, "%s %s", name, settings->type);
3152     args = settings->args;
3153
3154     while (args) {
3155         storeAppendPrintf(entry, " %s", args->key);
3156         args = args->next;
3157     }
3158
3159     storeAppendPrintf(entry, "\n");
3160 }
3161
3162 inline void
3163 free_YesNoNone(YesNoNone *)
3164 {}
3165
3166 static void
3167 parse_YesNoNone(YesNoNone *option)
3168 {
3169     int value = 0;
3170     parse_onoff(&value);
3171     option->configure(value > 0);
3172 }
3173
3174 static void
3175 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3176 {
3177     if (option.configured())
3178         dump_onoff(entry, name, option ? 1 : 0);
3179 }
3180
3181 static void
3182 free_memcachemode(SquidConfig *)
3183 {}
3184
3185 static void
3186 parse_memcachemode(SquidConfig *)
3187 {
3188     char *token = ConfigParser::NextToken();
3189     if (!token)
3190         self_destruct();
3191
3192     if (strcmp(token, "always") == 0) {
3193         Config.onoff.memory_cache_first = 1;
3194         Config.onoff.memory_cache_disk = 1;
3195     } else if (strcmp(token, "disk") == 0) {
3196         Config.onoff.memory_cache_first = 0;
3197         Config.onoff.memory_cache_disk = 1;
3198     } else if (strncmp(token, "net", 3) == 0) {
3199         Config.onoff.memory_cache_first = 1;
3200         Config.onoff.memory_cache_disk = 0;
3201     } else if (strcmp(token, "never") == 0) {
3202         Config.onoff.memory_cache_first = 0;
3203         Config.onoff.memory_cache_disk = 0;
3204     } else {
3205         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3206         self_destruct();
3207     }
3208 }
3209
3210 static void
3211 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3212 {
3213     storeAppendPrintf(entry, "%s ", name);
3214     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3215         storeAppendPrintf(entry, "always");
3216     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3217         storeAppendPrintf(entry, "disk");
3218     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3219         storeAppendPrintf(entry, "network");
3220     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3221         storeAppendPrintf(entry, "none");
3222     storeAppendPrintf(entry, "\n");
3223 }
3224
3225 #include "cf_parser.cci"
3226
3227 peer_t
3228 parseNeighborType(const char *s)
3229 {
3230     if (!strcmp(s, "parent"))
3231         return PEER_PARENT;
3232
3233     if (!strcmp(s, "neighbor"))
3234         return PEER_SIBLING;
3235
3236     if (!strcmp(s, "neighbour"))
3237         return PEER_SIBLING;
3238
3239     if (!strcmp(s, "sibling"))
3240         return PEER_SIBLING;
3241
3242     if (!strcmp(s, "multicast"))
3243         return PEER_MULTICAST;
3244
3245     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3246
3247     return PEER_SIBLING;
3248 }
3249
3250 #if USE_WCCPv2
3251 static void
3252 parse_IpAddress_list(Ip::Address_list ** head)
3253 {
3254     char *token;
3255     Ip::Address_list *s;
3256     Ip::Address ipa;
3257
3258     while ((token = ConfigParser::NextToken())) {
3259         if (GetHostWithPort(token, &ipa)) {
3260
3261             while (*head)
3262                 head = &(*head)->next;
3263
3264             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3265             s->s = ipa;
3266
3267             *head = s;
3268         } else
3269             self_destruct();
3270     }
3271 }
3272
3273 static void
3274 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3275 {
3276     char ntoabuf[MAX_IPSTRLEN];
3277
3278     while (s) {
3279         storeAppendPrintf(e, "%s %s\n",
3280                           n,
3281                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3282         s = s->next;
3283     }
3284 }
3285
3286 static void
3287 free_IpAddress_list(Ip::Address_list ** head)
3288 {
3289     if (*head) delete *head;
3290     *head = NULL;
3291 }
3292
3293 #if CURRENTLY_UNUSED
3294 /* This code was previously used by http_port. Left as it really should
3295  * be used by icp_port and htcp_port
3296  */
3297 static int
3298 check_null_IpAddress_list(const Ip::Address_list * s)
3299 {
3300     return NULL == s;
3301 }
3302
3303 #endif /* CURRENTLY_UNUSED */
3304 #endif /* USE_WCCPv2 */
3305
3306 static void
3307 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3308 {
3309     char *host = NULL;
3310     unsigned short port = 0;
3311     char *t = NULL;
3312     char *junk = NULL;
3313
3314     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3315     s->name = xstrdup(token);
3316     s->connection_auth_disabled = false;
3317
3318     const char *portType = AnyP::UriScheme(s->transport.protocol).c_str();
3319
3320     if (*token == '[') {
3321         /* [ipv6]:port */
3322         host = token + 1;
3323         t = strchr(host, ']');
3324         if (!t) {
3325             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3326             self_destruct();
3327         }
3328         *t = '\0';
3329         ++t;
3330         if (*t != ':') {
3331             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3332             self_destruct();
3333         }
3334         if (!Ip::EnableIpv6) {
3335             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3336             self_destruct();
3337         }
3338         port = xatos(t + 1);
3339     } else if ((t = strchr(token, ':'))) {
3340         /* host:port */
3341         /* ipv4:port */
3342         host = token;
3343         *t = '\0';
3344         port = xatos(t + 1);
3345
3346     } else if (strtol(token, &junk, 10) && !*junk) {
3347         port = xatos(token);
3348         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3349     } else {
3350         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3351         self_destruct();
3352     }
3353
3354     if (port == 0 && host != NULL) {
3355         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3356         self_destruct();
3357     }
3358
3359     if (NULL == host) {
3360         s->s.setAnyAddr();
3361         s->s.port(port);
3362         if (!Ip::EnableIpv6)
3363             s->s.setIPv4();
3364         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3365     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3366         s->s.port(port);
3367         if (!Ip::EnableIpv6)
3368             s->s.setIPv4();
3369         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3370     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3371         /* dont use ipcache */
3372         s->defaultsite = xstrdup(host);
3373         s->s.port(port);
3374         if (!Ip::EnableIpv6)
3375             s->s.setIPv4();
3376         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3377     } else {
3378         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3379         self_destruct();
3380     }
3381 }
3382
3383 /// parses the protocol= option of the *_port directive, returning parsed value
3384 /// unsupported option values result in a fatal error message
3385 /// upper case values required; caller may convert for backward compatibility
3386 static AnyP::ProtocolVersion
3387 parsePortProtocol(const SBuf &value)
3388 {
3389     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3390     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3391     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3392         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3393
3394     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3395         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3396
3397     if (value.cmp("FTP") == 0)
3398         return Ftp::ProtocolVersion();
3399
3400     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3401     return AnyP::ProtocolVersion(); // not reached
3402 }
3403
3404 static void
3405 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3406 {
3407     /* modes first */
3408
3409     if (strcmp(token, "accel") == 0) {
3410         if (s->flags.isIntercepted()) {
3411             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3412             self_destruct();
3413         }
3414         s->flags.accelSurrogate = true;
3415         s->vhost = true;
3416     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3417         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3418             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3419             self_destruct();
3420         }
3421         s->flags.natIntercept = true;
3422         Ip::Interceptor.StartInterception();
3423         /* Log information regarding the port modes under interception. */
3424         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3425         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3426     } else if (strcmp(token, "tproxy") == 0) {
3427         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3428             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3429             self_destruct();
3430         }
3431         s->flags.tproxyIntercept = true;
3432         Ip::Interceptor.StartTransparency();
3433         /* Log information regarding the port modes under transparency. */
3434         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3435
3436         if (s->flags.proxySurrogate) {
3437             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3438         }
3439
3440         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3441             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3442             self_destruct();
3443         }
3444
3445     } else if (strcmp(token, "require-proxy-header") == 0) {
3446         s->flags.proxySurrogate = true;
3447         if (s->flags.tproxyIntercept) {
3448             // receiving is still permitted, so we do not unset the TPROXY flag
3449             // spoofing access control override takes care of the spoof disable later
3450             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3451         }
3452
3453     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3454         if (!s->flags.accelSurrogate) {
3455             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3456             self_destruct();
3457         }
3458         safe_free(s->defaultsite);
3459         s->defaultsite = xstrdup(token + 12);
3460     } else if (strcmp(token, "vhost") == 0) {
3461         if (!s->flags.accelSurrogate) {
3462             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3463         }
3464         s->flags.accelSurrogate = true;
3465         s->vhost = true;
3466     } else if (strcmp(token, "no-vhost") == 0) {
3467         if (!s->flags.accelSurrogate) {
3468             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3469         }
3470         s->vhost = false;
3471     } else if (strcmp(token, "vport") == 0) {
3472         if (!s->flags.accelSurrogate) {
3473             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3474             self_destruct();
3475         }
3476         s->vport = -1;
3477     } else if (strncmp(token, "vport=", 6) == 0) {
3478         if (!s->flags.accelSurrogate) {
3479             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3480             self_destruct();
3481         }
3482         s->vport = xatos(token + 6);
3483     } else if (strncmp(token, "protocol=", 9) == 0) {
3484         if (!s->flags.accelSurrogate) {
3485             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3486             self_destruct();
3487         }
3488         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3489     } else if (strcmp(token, "allow-direct") == 0) {
3490         if (!s->flags.accelSurrogate) {
3491             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3492             self_destruct();
3493         }
3494         s->allow_direct = true;
3495     } else if (strcmp(token, "act-as-origin") == 0) {
3496         if (!s->flags.accelSurrogate) {
3497             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3498         } else
3499             s->actAsOrigin = true;
3500     } else if (strcmp(token, "ignore-cc") == 0) {
3501 #if !USE_HTTP_VIOLATIONS
3502         if (!s->flags.accelSurrogate) {
3503             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3504             self_destruct();
3505         }
3506 #endif
3507         s->ignore_cc = true;
3508     } else if (strncmp(token, "name=", 5) == 0) {
3509         safe_free(s->name);
3510         s->name = xstrdup(token + 5);
3511     } else if (strcmp(token, "no-connection-auth") == 0) {
3512         s->connection_auth_disabled = true;
3513     } else if (strcmp(token, "connection-auth=off") == 0) {
3514         s->connection_auth_disabled = true;
3515     } else if (strcmp(token, "connection-auth") == 0) {
3516         s->connection_auth_disabled = false;
3517     } else if (strcmp(token, "connection-auth=on") == 0) {
3518         s->connection_auth_disabled = false;
3519     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3520         if (!strcmp(token + 23, "off"))
3521             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3522         else if (!strcmp(token + 23, "transparent"))
3523             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3524         else if (!strcmp(token + 23, "always"))
3525             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3526         else
3527             self_destruct();
3528     } else if (strcmp(token, "ipv4") == 0) {
3529         if ( !s->s.setIPv4() ) {
3530             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3531             self_destruct();
3532         }
3533     } else if (strcmp(token, "tcpkeepalive") == 0) {
3534         s->tcp_keepalive.enabled = true;
3535     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3536         char *t = token + 13;
3537         s->tcp_keepalive.enabled = true;
3538         s->tcp_keepalive.idle = xatoui(t,',');
3539         t = strchr(t, ',');
3540         if (t) {
3541             ++t;
3542             s->tcp_keepalive.interval = xatoui(t,',');
3543             t = strchr(t, ',');
3544         }
3545         if (t) {
3546             ++t;
3547             s->tcp_keepalive.timeout = xatoui(t);
3548         }
3549 #if USE_OPENSSL
3550     } else if (strcmp(token, "sslBump") == 0) {
3551         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3552                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3553         s->flags.tunnelSslBumping = true;
3554     } else if (strcmp(token, "ssl-bump") == 0) {
3555         s->flags.tunnelSslBumping = true;
3556     } else if (strncmp(token, "cert=", 5) == 0) {
3557         s->secure.parse(token);
3558     } else if (strncmp(token, "key=", 4) == 0) {
3559         s->secure.parse(token);
3560     } else if (strncmp(token, "version=", 8) == 0) {
3561         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3562                "in " << cfg_directive << ". Use 'options=' instead.");
3563         s->secure.parse(token);
3564     } else if (strncmp(token, "options=", 8) == 0) {
3565         s->secure.parse(token);
3566     } else if (strncmp(token, "cipher=", 7) == 0) {
3567         s->secure.parse(token);
3568     } else if (strncmp(token, "clientca=", 9) == 0) {
3569         safe_free(s->clientca);
3570         s->clientca = xstrdup(token + 9);
3571     } else if (strncmp(token, "cafile=", 7) == 0) {
3572         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3573                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3574         s->secure.parse(token);
3575     } else if (strncmp(token, "capath=", 7) == 0) {
3576         s->secure.parse(token);
3577     } else if (strncmp(token, "crlfile=", 8) == 0) {
3578         s->secure.parse(token);
3579     } else if (strncmp(token, "dhparams=", 9) == 0) {
3580         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3581                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3582         s->secure.parse(token);
3583     } else if (strncmp(token, "sslflags=", 9) == 0) {
3584         // NP: deprecation warnings output by secure.parse() when relevant
3585         s->secure.parse(token+3);
3586     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3587         safe_free(s->sslContextSessionId);
3588         s->sslContextSessionId = xstrdup(token + 11);
3589     } else if (strcmp(token, "generate-host-certificates") == 0) {
3590         s->generateHostCertificates = true;
3591     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3592         s->generateHostCertificates = true;
3593     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3594         s->generateHostCertificates = false;
3595     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3596         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3597 #endif
3598     } else if (strncmp(token, "tls-", 4) == 0) {
3599         s->secure.parse(token+4);
3600     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3601         s->ftp_track_dirs = true;
3602     } else {
3603         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3604         self_destruct();
3605     }
3606 }
3607
3608 void
3609 add_http_port(char *portspec)
3610 {
3611     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3612     s->transport = parsePortProtocol(SBuf("HTTP"));
3613     parsePortSpecification(s, portspec);
3614     // we may need to merge better if the above returns a list with clones
3615     assert(s->next == NULL);
3616     s->next = HttpPortList;
3617     HttpPortList = s;
3618 }
3619
3620 static void
3621 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3622 {
3623     SBuf protoName;
3624     if (strcmp(optionName, "http_port") == 0 ||
3625             strcmp(optionName, "ascii_port") == 0)
3626         protoName = "HTTP";
3627     else if (strcmp(optionName, "https_port") == 0)
3628         protoName = "HTTPS";
3629     else if (strcmp(optionName, "ftp_port") == 0)
3630         protoName = "FTP";
3631     if (protoName.isEmpty()) {
3632         self_destruct();
3633         return;
3634     }
3635
3636     char *token = ConfigParser::NextToken();
3637
3638     if (!token) {
3639         self_destruct();
3640         return;
3641     }
3642
3643     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3644     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3645     parsePortSpecification(s, token);
3646
3647     /* parse options ... */
3648     while ((token = ConfigParser::NextToken())) {
3649         parse_port_option(s, token);
3650     }
3651
3652 #if USE_OPENSSL
3653     // if clientca has been defined but not cafile, then use it to verify
3654     // but if cafile has been defined, only use that to verify
3655     if (s->clientca && !s->secure.caFiles.size())
3656         s->secure.caFiles.emplace_back(SBuf(s->clientca));
3657 #endif
3658
3659     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3660         s->secure.encryptTransport = true;
3661 #if USE_OPENSSL
3662         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3663         const bool hijacked = s->flags.isIntercepted();
3664         if (s->flags.tunnelSslBumping && !hijacked) {
3665             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3666             self_destruct();
3667         }
3668         if (hijacked && !s->flags.tunnelSslBumping) {
3669             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3670             self_destruct();
3671         }
3672 #endif
3673         if (s->flags.proxySurrogate) {
3674             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3675             self_destruct();
3676         }
3677     } else if (protoName.cmp("FTP") == 0) {
3678         /* ftp_port does not support ssl-bump */
3679         if (s->flags.tunnelSslBumping) {
3680             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3681             self_destruct();
3682         }
3683         if (s->flags.proxySurrogate) {
3684             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3685             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3686             self_destruct();
3687         }
3688     }
3689
3690     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3691         // clone the port options from *s to *(s->next)
3692         s->next = s->clone();
3693         s->next->s.setIPv4();
3694         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).c_str() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3695     }
3696
3697     while (*head != NULL)
3698         head = &((*head)->next);
3699
3700     *head = s;
3701 }
3702
3703 static void
3704 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3705 {
3706     char buf[MAX_IPSTRLEN];
3707
3708     storeAppendPrintf(e, "%s %s",
3709                       n,
3710                       s->s.toUrl(buf,MAX_IPSTRLEN));
3711
3712     // MODES and specific sub-options.
3713     if (s->flags.natIntercept)
3714         storeAppendPrintf(e, " intercept");
3715
3716     else if (s->flags.tproxyIntercept)
3717         storeAppendPrintf(e, " tproxy");
3718
3719     else if (s->flags.proxySurrogate)
3720         storeAppendPrintf(e, " require-proxy-header");
3721
3722     else if (s->flags.accelSurrogate) {
3723         storeAppendPrintf(e, " accel");
3724
3725         if (s->vhost)
3726             storeAppendPrintf(e, " vhost");
3727
3728         if (s->vport < 0)
3729             storeAppendPrintf(e, " vport");
3730         else if (s->vport > 0)
3731             storeAppendPrintf(e, " vport=%d", s->vport);
3732
3733         if (s->defaultsite)
3734             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3735
3736         // TODO: compare against prefix of 'n' instead of assuming http_port
3737         if (s->transport.protocol != AnyP::PROTO_HTTP)
3738             storeAppendPrintf(e, " protocol=%s", AnyP::UriScheme(s->transport.protocol).c_str());
3739
3740         if (s->allow_direct)
3741             storeAppendPrintf(e, " allow-direct");
3742
3743         if (s->ignore_cc)
3744             storeAppendPrintf(e, " ignore-cc");
3745
3746     }
3747
3748     // Generic independent options
3749
3750     if (s->name)
3751         storeAppendPrintf(e, " name=%s", s->name);
3752
3753 #if USE_HTTP_VIOLATIONS
3754     if (!s->flags.accelSurrogate && s->ignore_cc)
3755         storeAppendPrintf(e, " ignore-cc");
3756 #endif
3757
3758     if (s->connection_auth_disabled)
3759         storeAppendPrintf(e, " connection-auth=off");
3760     else
3761         storeAppendPrintf(e, " connection-auth=on");
3762
3763     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3764         const char *pmtu;
3765
3766         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3767             pmtu = "always";
3768         else
3769             pmtu = "transparent";
3770
3771         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3772     }
3773
3774     if (s->s.isAnyAddr() && !s->s.isIPv6())
3775         storeAppendPrintf(e, " ipv4");
3776
3777     if (s->tcp_keepalive.enabled) {
3778         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3779             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3780         } else {
3781             storeAppendPrintf(e, " tcpkeepalive");
3782         }
3783     }
3784
3785 #if USE_OPENSSL
3786     if (s->flags.tunnelSslBumping)
3787         storeAppendPrintf(e, " ssl-bump");
3788 #endif
3789
3790     s->secure.dumpCfg(e, "tls-");
3791
3792 #if USE_OPENSSL
3793     if (s->sslContextSessionId)
3794         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3795
3796     if (s->generateHostCertificates)
3797         storeAppendPrintf(e, " generate-host-certificates");
3798
3799     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3800         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3801 #endif
3802 }
3803
3804 static void
3805 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3806 {
3807     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3808         dump_generic_port(e, n, p);
3809         storeAppendPrintf(e, "\n");
3810     }
3811 }
3812
3813 void
3814 configFreeMemory(void)
3815 {
3816     free_all();
3817 #if USE_OPENSSL
3818     SSL_CTX_free(Config.ssl_client.sslContext);
3819 #endif
3820 }
3821
3822 void
3823 requirePathnameExists(const char *name, const char *path)
3824 {
3825
3826     struct stat sb;
3827     char pathbuf[BUFSIZ];
3828     assert(path != NULL);
3829
3830     if (Config.chroot_dir && (geteuid() == 0)) {
3831         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3832         path = pathbuf;
3833     }
3834
3835     if (stat(path, &sb) < 0) {
3836         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerror());
3837         // keep going to find more issues if we are only checking the config file with "-k parse"
3838         if (opt_parse_cfg_only)
3839             return;
3840         // this is fatal if it is found during startup or reconfigure
3841         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3842             fatalf("%s %s: %s", name, path, xstrerror());
3843     }
3844 }
3845
3846 #include "AccessLogEntry.h"
3847
3848 /**
3849  * We support several access_log configuration styles:
3850  *
3851  * #1: Deprecated ancient style without an explicit logging module:
3852  * access_log /var/log/access.log
3853  *
3854  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3855  * access_log none [acl ...]
3856  *
3857  * #3: Configurable logging module without named options:
3858  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3859  * If no explicit logformat name is given, the first ACL name, if any,
3860  * should not be an existing logformat name or it will be treated as such.
3861  * access_log module:place [logformat_name] [acl ...]
3862  *
3863  * #4: Configurable logging module with name=value options such as logformat=x:
3864  * The first ACL name may not contain '='.
3865  * access_log module:place [option ...] [acl ...]
3866  *
3867  */
3868 static void
3869 parse_access_log(CustomLog ** logs)
3870 {
3871     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
3872
3873     // default buffer size and fatal settings
3874     cl->bufferSize = 8*MAX_URL;
3875     cl->fatal = true;
3876
3877     /* determine configuration style */
3878
3879     const char *filename = ConfigParser::NextToken();
3880     if (!filename) {
3881         self_destruct();
3882         return;
3883     }
3884
3885     if (strcmp(filename, "none") == 0) {
3886         cl->type = Log::Format::CLF_NONE;
3887         aclParseAclList(LegacyParser, &cl->aclList, filename);
3888         while (*logs)
3889             logs = &(*logs)->next;
3890         *logs = cl;
3891         return;
3892     }
3893
3894     cl->filename = xstrdup(filename);
3895     cl->type = Log::Format::CLF_UNKNOWN;
3896     cl->rotateCount = -1; // default: use global logfile_rotate setting.
3897
3898     const char *token = ConfigParser::PeekAtToken();
3899     if (!token) { // style #1
3900         // no options to deal with
3901     } else if (!strchr(token, '=')) { // style #3
3902         // if logformat name is recognized,
3903         // pop the previewed token; Else it must be an ACL name
3904         if (setLogformat(cl, token, false))
3905             (void)ConfigParser::NextToken();
3906     } else { // style #4
3907         do {
3908             if (strncasecmp(token, "on-error=", 9) == 0) {
3909                 if (strncasecmp(token+9, "die", 3) == 0) {
3910                     cl->fatal = true;
3911                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
3912                     cl->fatal = false;
3913                 } else {
3914                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
3915                            token << "' expected 'drop' or 'die'");
3916                     self_destruct();
3917                 }
3918             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
3919                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
3920             } else if (strncasecmp(token, "rotate=", 7) == 0) {
3921                 cl->rotateCount = xatoi(token + 7);
3922             } else if (strncasecmp(token, "logformat=", 10) == 0) {
3923                 setLogformat(cl, token+10, true);
3924             } else if (!strchr(token, '=')) {
3925                 // Do not pop the token; it must be an ACL name
3926                 break; // done with name=value options, now to ACLs
3927             } else {
3928                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
3929                 self_destruct();
3930             }
3931             // Pop the token, it was a valid "name=value" option
3932             (void)ConfigParser::NextToken();
3933             // Get next with preview ConfigParser::NextToken call.
3934         } while ((token = ConfigParser::PeekAtToken()) != NULL);
3935     }
3936
3937     // set format if it has not been specified explicitly
3938     if (cl->type == Log::Format::CLF_UNKNOWN)
3939         setLogformat(cl, "squid", true);
3940
3941     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
3942
3943     while (*logs)
3944         logs = &(*logs)->next;
3945
3946     *logs = cl;
3947 }
3948
3949 /// sets CustomLog::type and, if needed, CustomLog::lf
3950 /// returns false iff there is no named log format
3951 static bool
3952 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
3953 {
3954     assert(cl);
3955     assert(logdef_name);
3956
3957     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
3958
3959     if (cl->type != Log::Format::CLF_UNKNOWN) {
3960         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
3961                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
3962         self_destruct();
3963         return false;
3964     }
3965
3966     /* look for the definition pointer corresponding to this name */
3967     Format::Format *lf = Log::TheConfig.logformats;
3968
3969     while (lf != NULL) {
3970         debugs(3, 9, "Comparing against '" << lf->name << "'");
3971
3972         if (strcmp(lf->name, logdef_name) == 0)
3973             break;
3974
3975         lf = lf->next;
3976     }
3977
3978     if (lf != NULL) {
3979         cl->type = Log::Format::CLF_CUSTOM;
3980         cl->logFormat = lf;
3981     } else if (strcmp(logdef_name, "auto") == 0) {
3982         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
3983         cl->type = Log::Format::CLF_SQUID;
3984     } else if (strcmp(logdef_name, "squid") == 0) {
3985         cl->type = Log::Format::CLF_SQUID;
3986     } else if (strcmp(logdef_name, "common") == 0) {
3987         cl->type = Log::Format::CLF_COMMON;
3988     } else if (strcmp(logdef_name, "combined") == 0) {
3989         cl->type = Log::Format::CLF_COMBINED;
3990 #if ICAP_CLIENT
3991     } else if (strcmp(logdef_name, "icap_squid") == 0) {
3992         cl->type = Log::Format::CLF_ICAP_SQUID;
3993 #endif
3994     } else if (strcmp(logdef_name, "useragent") == 0) {
3995         cl->type = Log::Format::CLF_USERAGENT;
3996     } else if (strcmp(logdef_name, "referrer") == 0) {
3997         cl->type = Log::Format::CLF_REFERER;
3998     } else if (dieWhenMissing) {
3999         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4000         self_destruct();
4001         return false;
4002     } else {
4003         return false;
4004     }
4005
4006     return true;
4007 }
4008
4009 static int
4010 check_null_access_log(CustomLog *customlog_definitions)
4011 {
4012     return customlog_definitions == NULL;
4013 }
4014
4015 static void
4016 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4017 {
4018     CustomLog *log;
4019
4020     for (log = logs; log; log = log->next) {
4021         storeAppendPrintf(entry, "%s ", name);
4022
4023         switch (log->type) {
4024
4025         case Log::Format::CLF_CUSTOM:
4026             storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4027             break;
4028
4029         case Log::Format::CLF_NONE:
4030             storeAppendPrintf(entry, "logformat=none");
4031             break;
4032
4033         case Log::Format::CLF_SQUID:
4034             storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4035             break;
4036
4037         case Log::Format::CLF_COMBINED:
4038             storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4039             break;
4040
4041         case Log::Format::CLF_COMMON:
4042             storeAppendPrintf(entry, "%s logformat=common", log->filename);
4043             break;
4044
4045 #if ICAP_CLIENT
4046         case Log::Format::CLF_ICAP_SQUID:
4047             storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4048             break;
4049 #endif
4050         case Log::Format::CLF_USERAGENT:
4051             storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4052             break;
4053
4054         case Log::Format::CLF_REFERER:
4055             storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4056             break;
4057
4058         case Log::Format::CLF_UNKNOWN:
4059             break;
4060         }
4061
4062         // default is on-error=die
4063         if (!log->fatal)
4064             storeAppendPrintf(entry, " on-error=drop");
4065
4066         // default: 64KB
4067         if (log->bufferSize != 64*1024)
4068             storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4069
4070         if (log->rotateCount >= 0)
4071             storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4072
4073         if (log->aclList)
4074             dump_acl_list(entry, log->aclList);
4075
4076         storeAppendPrintf(entry, "\n");
4077     }
4078 }
4079
4080 static void
4081 free_access_log(CustomLog ** definitions)
4082 {
4083     while (*definitions) {
4084         CustomLog *log = *definitions;
4085         *definitions = log->next;
4086
4087         log->logFormat = NULL;
4088         log->type = Log::Format::CLF_UNKNOWN;
4089
4090         if (log->aclList)
4091             aclDestroyAclList(&log->aclList);
4092
4093         safe_free(log->filename);
4094
4095         xfree(log);
4096     }
4097 }
4098
4099 /// parses list of integers form name=N1,N2,N3,...
4100 static bool
4101 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4102 {
4103     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4104         data += name.size();
4105         if (*data == '=') {
4106             while (true) {
4107                 ++data;
4108                 int value = 0;
4109                 if (!StringToInt(data, value, &data, 10))
4110                     break;
4111                 list.push_back(value);
4112                 if (*data == '\0' || *data != ',')
4113                     break;
4114             }
4115         }
4116     }
4117     return data && *data == '\0';
4118 }
4119
4120 static void
4121 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4122 {
4123 #if !HAVE_CPU_AFFINITY
4124     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4125            "support, do not set 'cpu_affinity_map'");
4126     self_destruct();
4127 #endif /* HAVE_CPU_AFFINITY */
4128
4129     if (!*cpuAffinityMap)
4130         *cpuAffinityMap = new CpuAffinityMap;
4131
4132     const char *const pToken = ConfigParser::NextToken();
4133     const char *const cToken = ConfigParser::NextToken();
4134     std::vector<int> processes, cores;
4135     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4136         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4137                "in 'cpu_affinity_map'");
4138         self_destruct();
4139     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4140         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4141                "'cpu_affinity_map'");
4142         self_destruct();
4143     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4144         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4145                "process_numbers and cores lists differ in length or " <<
4146                "contain numbers <= 0");
4147         self_destruct();
4148     }
4149 }
4150
4151 static void
4152 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4153 {
4154     if (cpuAffinityMap) {
4155         storeAppendPrintf(entry, "%s process_numbers=", name);
4156         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4157             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4158                               cpuAffinityMap->processes()[i]);
4159         }
4160         storeAppendPrintf(entry, " cores=");
4161         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4162             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4163                               cpuAffinityMap->cores()[i]);
4164         }
4165         storeAppendPrintf(entry, "\n");
4166     }
4167 }
4168
4169 static void
4170 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4171 {
4172     delete *cpuAffinityMap;
4173     *cpuAffinityMap = NULL;
4174 }
4175
4176 #if USE_ADAPTATION
4177
4178 static void
4179 parse_adaptation_service_set_type()
4180 {
4181     Adaptation::Config::ParseServiceSet();
4182 }
4183
4184 static void
4185 parse_adaptation_service_chain_type()
4186 {
4187     Adaptation::Config::ParseServiceChain();
4188 }
4189
4190 static void
4191 parse_adaptation_access_type()
4192 {
4193     Adaptation::Config::ParseAccess(LegacyParser);
4194 }
4195 #endif /* USE_ADAPTATION */
4196
4197 #if ICAP_CLIENT
4198
4199 static void
4200 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4201 {
4202     cfg->parseService();
4203 }
4204
4205 static void
4206 free_icap_service_type(Adaptation::Icap::Config * cfg)
4207 {
4208     cfg->freeService();
4209 }
4210
4211 static void
4212 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4213 {
4214     cfg.dumpService(entry, name);
4215 }
4216
4217 static void
4218 parse_icap_class_type()
4219 {
4220     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4221            "Use 'adaptation_service_set' instead");
4222     Adaptation::Config::ParseServiceSet();
4223 }
4224
4225 static void
4226 parse_icap_access_type()
4227 {
4228     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4229            "Use 'adaptation_access' instead");
4230     Adaptation::Config::ParseAccess(LegacyParser);
4231 }
4232
4233 #endif
4234
4235 #if USE_ECAP
4236
4237 static void
4238 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4239 {
4240     cfg->parseService();
4241 }
4242
4243 static void
4244 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4245 {
4246     cfg->freeService();
4247 }
4248
4249 static void
4250 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4251 {
4252     cfg.dumpService(entry, name);
4253 }
4254
4255 #endif /* USE_ECAP */
4256
4257 #if ICAP_CLIENT
4258 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4259 {
4260     char *token;
4261     time_t d;
4262     time_t m;
4263     cfg->service_failure_limit = GetInteger();
4264
4265     if ((token = ConfigParser::NextToken()) == NULL)
4266         return;
4267
4268     if (strcmp(token,"in") != 0) {
4269         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4270         self_destruct();
4271     }
4272
4273     if ((token = ConfigParser::NextToken()) == NULL) {
4274         self_destruct();
4275     }
4276
4277     d = static_cast<time_t> (xatoi(token));
4278
4279     m = static_cast<time_t> (1);
4280
4281     if (0 == d)
4282         (void) 0;
4283     else if ((token = ConfigParser::NextToken()) == NULL) {
4284         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4285         self_destruct();
4286     } else if ((m = parseTimeUnits(token, false)) == 0)
4287         self_destruct();
4288
4289     cfg->oldest_service_failure = (m * d);
4290 }
4291
4292 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4293 {
4294     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4295     if (cfg.oldest_service_failure > 0) {
4296         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4297     }
4298     storeAppendPrintf(entry, "\n");
4299 }
4300
4301 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4302 {
4303     cfg->oldest_service_failure = 0;
4304     cfg->service_failure_limit = 0;
4305 }
4306 #endif
4307
4308 #if USE_OPENSSL
4309 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4310 {
4311     char *al;
4312     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4313     if ((al = ConfigParser::NextToken()) == NULL) {
4314         self_destruct();
4315         return;
4316     }
4317
4318     const char *param;
4319     if ( char *s = strchr(al, '{')) {
4320         *s = '\0'; // terminate the al string
4321         ++s;
4322         param = s;
4323         s = strchr(s, '}');
4324         if (!s) {
4325             self_destruct();
4326             return;
4327         }
4328         *s = '\0';
4329     } else
4330         param = NULL;
4331
4332     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4333         ca->alg = Ssl::algSetValidAfter;
4334         ca->param = xstrdup("on");
4335     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4336         ca->alg = Ssl::algSetValidBefore;
4337         ca->param = xstrdup("on");
4338     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4339         ca->alg = Ssl::algSetCommonName;
4340         if (param) {
4341             if (strlen(param) > 64) {
4342                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4343                 self_destruct();
4344                 return;
4345             }
4346             ca->param = xstrdup(param);
4347         }
4348     } else {
4349         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4350         self_destruct();
4351         return;
4352     }
4353
4354     aclParseAclList(LegacyParser, &ca->aclList, al);
4355
4356     while (*cert_adapt)
4357         cert_adapt = &(*cert_adapt)->next;
4358
4359     *cert_adapt = ca;
4360 }
4361
4362 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4363 {
4364     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4365         storeAppendPrintf(entry, "%s ", name);
4366         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4367         if (ca->aclList)
4368             dump_acl_list(entry, ca->aclList);
4369         storeAppendPrintf(entry, "\n");
4370     }
4371 }
4372
4373 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4374 {
4375     while (*cert_adapt) {
4376         sslproxy_cert_adapt *ca = *cert_adapt;
4377         *cert_adapt = ca->next;
4378         safe_free(ca->param);
4379
4380         if (ca->aclList)
4381             aclDestroyAclList(&ca->aclList);
4382
4383         safe_free(ca);
4384     }
4385 }
4386
4387 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4388 {
4389     char *al;
4390     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4391     if ((al = ConfigParser::NextToken()) == NULL) {
4392         self_destruct();
4393         return;
4394     }
4395
4396     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4397         cs->alg = Ssl::algSignTrusted;
4398     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4399         cs->alg = Ssl::algSignUntrusted;
4400     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4401         cs->alg = Ssl::algSignSelf;
4402     else {
4403         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4404         self_destruct();
4405         return;
4406     }
4407
4408     aclParseAclList(LegacyParser, &cs->aclList, al);
4409
4410     while (*cert_sign)
4411         cert_sign = &(*cert_sign)->next;
4412
4413     *cert_sign = cs;
4414 }
4415
4416 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4417 {
4418     sslproxy_cert_sign *cs;
4419     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4420         storeAppendPrintf(entry, "%s ", name);
4421         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4422         if (cs->aclList)
4423             dump_acl_list(entry, cs->aclList);
4424         storeAppendPrintf(entry, "\n");
4425     }
4426 }
4427
4428 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4429 {
4430     while (*cert_sign) {
4431         sslproxy_cert_sign *cs = *cert_sign;
4432         *cert_sign = cs->next;
4433
4434         if (cs->aclList)
4435             aclDestroyAclList(&cs->aclList);
4436
4437         safe_free(cs);
4438     }
4439 }
4440
4441 class sslBumpCfgRr: public ::RegisteredRunner
4442 {
4443 public:
4444     static Ssl::BumpMode lastDeprecatedRule;
4445     /* RegisteredRunner API */
4446     virtual void finalizeConfig();
4447 };
4448
4449 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4450
4451 RunnerRegistrationEntry(sslBumpCfgRr);
4452
4453 void
4454 sslBumpCfgRr::finalizeConfig()
4455 {
4456     if (lastDeprecatedRule != Ssl::bumpEnd) {
4457         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4458         static char buf[1024];
4459         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4460             strcpy(buf, "ssl_bump deny all");
4461             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4462                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4463                    "must not use implicit rules. Update your ssl_bump rules.");
4464         } else {
4465             strcpy(buf, "ssl_bump allow all");
4466             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4467                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4468                    "inferior to the newer server-first bumping mode. New ssl_bump"
4469                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4470         }
4471         parse_line(buf);
4472     }
4473 }
4474
4475 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4476 {
4477     typedef const char *BumpCfgStyle;
4478     BumpCfgStyle bcsNone = NULL;
4479     BumpCfgStyle bcsNew = "new client/server-first/none";
4480     BumpCfgStyle bcsOld = "deprecated allow/deny";
4481     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4482     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4483     char *bm;
4484     if ((bm = ConfigParser::NextToken()) == NULL) {
4485         self_destruct();
4486         return;
4487     }
4488
4489     // if this is the first rule proccessed
4490     if (*ssl_bump == NULL) {
4491         bumpCfgStyleLast = bcsNone;
4492         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4493     }
4494
4495     allow_t action = allow_t(ACCESS_ALLOWED);
4496
4497     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4498         action.kind = Ssl::bumpClientFirst;
4499         bumpCfgStyleNow = bcsNew;
4500     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4501         action.kind = Ssl::bumpServerFirst;
4502         bumpCfgStyleNow = bcsNew;
4503     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4504         action.kind = Ssl::bumpPeek;
4505         bumpCfgStyleNow = bcsNew;
4506     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4507         action.kind = Ssl::bumpStare;
4508         bumpCfgStyleNow = bcsNew;
4509     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4510         action.kind = Ssl::bumpSplice;
4511         bumpCfgStyleNow = bcsNew;
4512     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4513         action.kind = Ssl::bumpBump;
4514         bumpCfgStyleNow = bcsNew;
4515     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4516         action.kind = Ssl::bumpTerminate;
4517         bumpCfgStyleNow = bcsNew;
4518     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4519         action.kind = Ssl::bumpNone;
4520         bumpCfgStyleNow = bcsNew;
4521     } else if (strcmp(bm, "allow") == 0) {
4522         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4523                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4524                "is usually inferior to the newer server-first "
4525                "bumping mode. Update your ssl_bump rules.");
4526         action.kind = Ssl::bumpClientFirst;
4527         bumpCfgStyleNow = bcsOld;
4528         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4529     } else if (strcmp(bm, "deny") == 0) {
4530         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4531                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4532                "your ssl_bump rules.");
4533         action.kind = Ssl::bumpNone;
4534         bumpCfgStyleNow = bcsOld;
4535         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4536     } else {
4537         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4538         self_destruct();
4539         return;
4540     }
4541
4542     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4543         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4544                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4545         self_destruct();
4546         return;
4547     }
4548
4549     bumpCfgStyleLast = bumpCfgStyleNow;
4550
4551     Acl::AndNode *rule = new Acl::AndNode;
4552     rule->context("(ssl_bump rule)", config_input_line);
4553     rule->lineParse();
4554     // empty rule OK
4555
4556     assert(ssl_bump);
4557     if (!*ssl_bump) {
4558         *ssl_bump = new Acl::Tree;
4559         (*ssl_bump)->context("(ssl_bump rules)", config_input_line);
4560     }
4561
4562     (*ssl_bump)->add(rule, action);
4563 }
4564
4565 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4566 {
4567     if (ssl_bump)
4568         dump_SBufList(entry, ssl_bump->treeDump(name, Ssl::BumpModeStr));
4569 }
4570
4571 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4572 {
4573     free_acl_access(ssl_bump);
4574 }
4575
4576 #endif
4577
4578 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4579 {
4580     if (!headers)
4581         return;
4582
4583     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4584         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4585         if (hwa->aclList)
4586             dump_acl_list(entry, hwa->aclList);
4587         storeAppendPrintf(entry, "\n");
4588     }
4589 }
4590
4591 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4592 {
4593     char *fn;
4594     if (!*headers) {
4595         *headers = new HeaderWithAclList;
4596     }
4597     if ((fn = ConfigParser::NextToken()) == NULL) {
4598         self_destruct();
4599         return;
4600     }
4601     HeaderWithAcl hwa;
4602     hwa.fieldName = fn;
4603     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4604     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4605         hwa.fieldId = Http::HdrType::OTHER;
4606
4607     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4608     ConfigParser::EnableMacros();
4609     String buf = ConfigParser::NextQuotedToken();
4610     ConfigParser::DisableMacros();
4611     hwa.fieldValue = buf.termedBuf();
4612     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4613     if (hwa.quoted) {
4614         if (!nlf->parse(hwa.fieldValue.c_str())) {
4615             self_destruct();
4616             return;
4617         }
4618         hwa.valueFormat = nlf;
4619     } else
4620         delete nlf;
4621     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4622     (*headers)->push_back(hwa);
4623 }
4624
4625 static void free_HeaderWithAclList(HeaderWithAclList **header)
4626 {
4627     if (!(*header))
4628         return;
4629
4630     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4631         if (hwa->aclList)
4632             aclDestroyAclList(&hwa->aclList);
4633
4634         if (hwa->valueFormat) {
4635             delete hwa->valueFormat;
4636             hwa->valueFormat = NULL;
4637         }
4638     }
4639     delete *header;
4640     *header = NULL;
4641 }
4642
4643 static void parse_note(Notes *notes)
4644 {
4645     assert(notes);
4646     notes->parse(LegacyParser);
4647 }
4648
4649 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4650 {
4651     notes.dump(entry, name);
4652 }
4653
4654 static void free_note(Notes *notes)
4655 {
4656     notes->clean();
4657 }
4658
4659 static bool FtpEspvDeprecated = false;
4660 static void parse_ftp_epsv(acl_access **ftp_epsv)
4661 {
4662     allow_t ftpEpsvDeprecatedAction;
4663     bool ftpEpsvIsDeprecatedRule = false;
4664
4665     char *t = ConfigParser::PeekAtToken();
4666     if (!t) {
4667         self_destruct();
4668         return;
4669     }
4670
4671     if (!strcmp(t, "off")) {
4672         (void)ConfigParser::NextToken();
4673         ftpEpsvIsDeprecatedRule = true;
4674         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4675     } else if (!strcmp(t, "on")) {
4676         (void)ConfigParser::NextToken();
4677         ftpEpsvIsDeprecatedRule = true;
4678         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4679     }
4680
4681     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4682     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4683     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4684     // then abort
4685     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4686             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4687         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4688         self_destruct();
4689     }
4690
4691     if (ftpEpsvIsDeprecatedRule) {
4692         // overwrite previous ftp_epsv lines
4693         delete *ftp_epsv;
4694         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4695             Acl::AndNode *ftpEpsvRule = new Acl::AndNode;
4696             ftpEpsvRule->context("(ftp_epsv rule)", config_input_line);
4697             ACL *a = ACL::FindByName("all");
4698             if (!a) {
4699                 self_destruct();
4700                 return;
4701             }
4702             ftpEpsvRule->add(a);
4703             *ftp_epsv = new Acl::Tree;
4704             (*ftp_epsv)->context("(ftp_epsv rules)", config_input_line);
4705             (*ftp_epsv)->add(ftpEpsvRule, ftpEpsvDeprecatedAction);
4706         } else
4707             *ftp_epsv = NULL;
4708         FtpEspvDeprecated = true;
4709     } else {
4710         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4711     }
4712 }
4713
4714 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4715 {
4716     if (ftp_epsv)
4717         dump_SBufList(entry, ftp_epsv->treeDump(name, NULL));
4718 }
4719
4720 static void free_ftp_epsv(acl_access **ftp_epsv)
4721 {
4722     free_acl_access(ftp_epsv);
4723     FtpEspvDeprecated = false;
4724 }
4725
4726 static void
4727 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4728 {
4729     time_msec_t tval;
4730     parseTimeLine(&tval, T_SECOND_STR, false, true);
4731     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4732
4733     char *key, *value;
4734     while(ConfigParser::NextKvPair(key, value)) {
4735         if (strcasecmp(key, "on_timeout") == 0) {
4736             if (strcasecmp(value, "bypass") == 0)
4737                 config->action = toutActBypass;
4738             else if (strcasecmp(value, "fail") == 0)
4739                 config->action = toutActFail;
4740             else if (strcasecmp(value, "retry") == 0)
4741                 config->action = toutActRetry;
4742             else if (strcasecmp(value, "use_configured_response") == 0) {
4743                 config->action = toutActUseConfiguredResponse;
4744             } else {
4745                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4746                 self_destruct();
4747             }
4748         } else if (strcasecmp(key, "response") == 0) {
4749             config->response = xstrdup(value);
4750         } else {
4751             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4752             self_destruct();
4753         }
4754     }
4755
4756     if (config->action == toutActUseConfiguredResponse && !config->response) {
4757         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4758         self_destruct();
4759     }
4760
4761     if (config->action != toutActUseConfiguredResponse && config->response) {
4762         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4763         self_destruct();
4764     }
4765 }
4766
4767 static void
4768 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4769 {
4770     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4771     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4772
4773     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4774     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4775
4776     if (config.response)
4777         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4778
4779     storeAppendPrintf(entry, "\n");
4780 }
4781
4782 static void
4783 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4784 {
4785     Config.Timeout.urlRewrite = 0;
4786     config->action = 0;
4787     safe_free(config->response);
4788 }
4789
4790 static void
4791 parse_configuration_includes_quoted_values(bool *)
4792 {
4793     int val = 0;
4794     parse_onoff(&val);
4795
4796     // If quoted values is set to on then enable new strict mode parsing
4797     if (val) {
4798         ConfigParser::RecognizeQuotedValues = true;
4799         ConfigParser::StrictMode = true;
4800     } else {
4801         ConfigParser::RecognizeQuotedValues = false;
4802         ConfigParser::StrictMode = false;
4803     }
4804 }
4805
4806 static void
4807 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4808 {
4809     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4810     dump_onoff(entry, name, val);
4811 }
4812
4813 static void
4814 free_configuration_includes_quoted_values(bool *)
4815 {
4816     ConfigParser::RecognizeQuotedValues = false;
4817     ConfigParser::StrictMode = false;
4818 }
4819
4820 static void
4821 parse_on_unsupported_protocol(acl_access **access)
4822 {
4823     char *tm;
4824     if ((tm = ConfigParser::NextToken()) == NULL) {
4825         self_destruct();
4826         return;
4827     }
4828
4829     allow_t action = allow_t(ACCESS_ALLOWED);
4830     if (strcmp(tm, "tunnel") == 0)
4831         action.kind = 1;
4832     else if (strcmp(tm, "respond") == 0)
4833         action.kind = 2;
4834     else {
4835         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4836         self_destruct();
4837         return;
4838     }
4839
4840     Acl::AndNode *rule = new Acl::AndNode;
4841     rule->context("(on_unsupported_protocol rule)", config_input_line);
4842     rule->lineParse();
4843     // empty rule OK
4844
4845     assert(access);
4846     if (!*access) {
4847         *access = new Acl::Tree;
4848         (*access)->context("(on_unsupported_protocol rules)", config_input_line);
4849     }
4850
4851     (*access)->add(rule, action);
4852 }
4853
4854 static void
4855 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4856 {
4857     const char *on_error_tunnel_mode_str[] = {
4858         "none",
4859         "tunnel",
4860         "respond",
4861         NULL
4862     };
4863     if (access) {
4864         SBufList lines = access->treeDump(name, on_error_tunnel_mode_str);
4865         dump_SBufList(entry, lines);
4866     }
4867 }
4868
4869 static void
4870 free_on_unsupported_protocol(acl_access **access)
4871 {
4872     free_acl_access(access);
4873 }
4874