src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2021 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclSizeLimit.h"
  15 #include "acl/Address.h"
  16 #include "acl/Gadgets.h"
  17 #include "acl/MethodData.h"
  18 #include "acl/Tree.h"
  19 #include "anyp/PortCfg.h"
  20 #include "anyp/UriScheme.h"
  21 #include "auth/Config.h"
  22 #include "auth/Scheme.h"
  23 #include "AuthReg.h"
  24 #include "base/PackableStream.h"
  25 #include "base/RunnersRegistry.h"
  26 #include "cache_cf.h"
  27 #include "CachePeer.h"
  28 #include "ConfigOption.h"
  29 #include "ConfigParser.h"
  30 #include "CpuAffinityMap.h"
  31 #include "DiskIO/DiskIOModule.h"
  32 #include "eui/Config.h"
  33 #include "ExternalACL.h"
  34 #include "format/Format.h"
  35 #include "ftp/Elements.h"
  36 #include "globals.h"
  37 #include "HttpHeaderTools.h"
  38 #include "HttpUpgradeProtocolAccess.h"
  39 #include "icmp/IcmpConfig.h"
  40 #include "ident/Config.h"
  41 #include "ip/Intercept.h"
  42 #include "ip/NfMarkConfig.h"
  43 #include "ip/QosConfig.h"
  44 #include "ip/tools.h"
  45 #include "ipc/Kids.h"
  46 #include "log/Config.h"
  47 #include "log/CustomLog.h"
  48 #include "MemBuf.h"
  49 #include "MessageDelayPools.h"
  50 #include "mgr/ActionPasswordList.h"
  51 #include "mgr/Registration.h"
  52 #include "neighbors.h"
  53 #include "NeighborTypeDomainList.h"
  54 #include "Parsing.h"
  55 #include "pconn.h"
  56 #include "PeerDigest.h"
  57 #include "PeerPoolMgr.h"
  58 #include "redirect.h"
  59 #include "RefreshPattern.h"
  60 #include "rfc1738.h"
  61 #include "sbuf/List.h"
  62 #include "sbuf/Stream.h"
  63 #include "SquidConfig.h"
  64 #include "SquidString.h"
  65 #include "ssl/ProxyCerts.h"
  66 #include "Store.h"
  67 #include "store/Disks.h"
  68 #include "tools.h"
  69 #include "util.h"
  70 #include "wordlist.h"
  71 /* wccp2 has its own conditional definitions */
  72 #include "wccp2.h"
  73 #if USE_ADAPTATION
  74 #include "adaptation/Config.h"
  75 #endif
  76 #if ICAP_CLIENT
  77 #include "adaptation/icap/Config.h"
  78 #endif
  79 #if USE_ECAP
  80 #include "adaptation/ecap/Config.h"
  81 #endif
  82 #if USE_OPENSSL
  83 #include "ssl/Config.h"
  84 #include "ssl/support.h"
  85 #endif
  86 #if USE_SQUID_ESI
  87 #include "esi/Parser.h"
  88 #endif
  89 #if SQUID_SNMP
  90 #include "snmp.h"
  91 #endif
  92
  93 #if HAVE_GLOB_H
  94 #include <glob.h>
  95 #endif
  96 #include <chrono>
  97 #include <limits>
  98 #include <list>
  99 #if HAVE_PWD_H
 100 #include <pwd.h>
 101 #endif
 102 #if HAVE_GRP_H
 103 #include <grp.h>
 104 #endif
 105 #if HAVE_SYS_SOCKET_H
 106 #include <sys/socket.h>
 107 #endif
 108 #if HAVE_SYS_STAT_H
 109 #include <sys/stat.h>
 110 #endif
 111
 112 #if USE_OPENSSL
 113 #include "ssl/gadgets.h"
 114 #endif
 115
 116 #if USE_ADAPTATION
 117 static void parse_adaptation_service_set_type();
 118 static void parse_adaptation_service_chain_type();
 119 static void parse_adaptation_access_type();
 120 #endif
 121
 122 #if ICAP_CLIENT
 123 static void parse_icap_service_type(Adaptation::Icap::Config *);
 124 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 125 static void free_icap_service_type(Adaptation::Icap::Config *);
 126 static void parse_icap_class_type();
 127 static void parse_icap_access_type();
 128
 129 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 130 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 131 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 132 #endif
 133
 134 #if USE_ECAP
 135 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 136 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 137 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 138 #endif
 139
 140 static peer_t parseNeighborType(const char *s);
 141
 142 static const char *const T_NANOSECOND_STR = "nanosecond";
 143 static const char *const T_MICROSECOND_STR = "microsecond";
 144 static const char *const T_MILLISECOND_STR = "millisecond";
 145 static const char *const T_SECOND_STR = "second";
 146 static const char *const T_MINUTE_STR = "minute";
 147 static const char *const T_HOUR_STR = "hour";
 148 static const char *const T_DAY_STR = "day";
 149 static const char *const T_WEEK_STR = "week";
 150 static const char *const T_FORTNIGHT_STR = "fortnight";
 151 static const char *const T_MONTH_STR = "month";
 152 static const char *const T_YEAR_STR = "year";
 153 static const char *const T_DECADE_STR = "decade";
 154
 155 static const char *const B_BYTES_STR = "bytes";
 156 static const char *const B_KBYTES_STR = "KB";
 157 static const char *const B_MBYTES_STR = "MB";
 158 static const char *const B_GBYTES_STR = "GB";
 159
 160 static const char *const list_sep = ", \t\n\r";
 161
 162 // std::chrono::years requires C++20. Do our own rough calculation for now.
 163 static const double HoursPerYear = 24*365.2522;
 164
 165 static void parse_access_log(CustomLog ** customlog_definitions);
 166 static int check_null_access_log(CustomLog *customlog_definitions);
 167 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 168 static void free_access_log(CustomLog ** definitions);
 169
 170 static void configDoConfigure(void);
 171 static void parse_refreshpattern(RefreshPattern **);
 172 static void parse_u_short(unsigned short * var);
 173 static void parse_string(char **);
 174 static void default_all(void);
 175 static void defaults_if_none(void);
 176 static void defaults_postscriptum(void);
 177 static int parse_line(char *);
 178 static void parse_obsolete(const char *);
 179 static void parseBytesLine(size_t * bptr, const char *units);
 180 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 181 static size_t parseBytesUnits(const char *unit);
 182 static void free_all(void);
 183 void requirePathnameExists(const char *name, const char *path);
 184 static OBJH dump_config;
 185 #if USE_HTTP_VIOLATIONS
 186 static void free_HeaderManglers(HeaderManglers **pm);
 187 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 188 static void parse_http_header_access(HeaderManglers **manglers);
 189 #define free_http_header_access free_HeaderManglers
 190 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 191 static void parse_http_header_replace(HeaderManglers **manglers);
 192 #define free_http_header_replace free_HeaderManglers
 193 #endif
 194 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 195 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 196 static void free_HeaderWithAclList(HeaderWithAclList **header);
 197 static void parse_note(Notes *);
 198 static void dump_note(StoreEntry *, const char *, Notes &);
 199 static void free_note(Notes *);
 200 static void parse_denyinfo(AclDenyInfoList ** var);
 201 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 202 static void free_denyinfo(AclDenyInfoList ** var);
 203
 204 #if USE_WCCPv2
 205 static void parse_IpAddress_list(Ip::Address_list **);
 206 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 207 static void free_IpAddress_list(Ip::Address_list **);
 208 #if CURRENTLY_UNUSED
 209 static int check_null_IpAddress_list(const Ip::Address_list *);
 210 #endif /* CURRENTLY_UNUSED */
 211 #endif /* USE_WCCPv2 */
 212
 213 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 214 #define parse_PortCfg(l) parsePortCfg((l), token)
 215 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 216 #define free_PortCfg(h)  *(h)=NULL
 217
 218 #if USE_OPENSSL
 219 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 220 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 221 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 222 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 223 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 224 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 225 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 226 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 227 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 228 #endif /* USE_OPENSSL */
 229
 230 static void parse_ftp_epsv(acl_access **ftp_epsv);
 231 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 232 static void free_ftp_epsv(acl_access **ftp_epsv);
 233
 234 static void parse_b_size_t(size_t * var);
 235 static void parse_b_int64_t(int64_t * var);
 236
 237 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 238 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 239 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 240
 241 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 242 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 243 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 244
 245 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 246
 247 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 248 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 249 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 250 static void parse_on_unsupported_protocol(acl_access **access);
 251 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 252 static void free_on_unsupported_protocol(acl_access **access);
 253 static void ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl = nullptr);
 254 static void parse_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards);
 255 static void dump_http_upgrade_request_protocols(StoreEntry *entry, const char *name, HttpUpgradeProtocolAccess *protoGuards);
 256 static void free_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards);
 257
 258 /*
 259  * LegacyParser is a parser for legacy code that uses the global
 260  * approach.  This is static so that it is only exposed to cache_cf.
 261  * Other modules needing access to a ConfigParser should have it
 262  * provided to them in their parserFOO methods.
 263  */
 264 static ConfigParser LegacyParser = ConfigParser();
 265
 266 void
 267 self_destruct(void)
 268 {
 269     LegacyParser.destruct();
 270 }
 271
 272 static void
 273 SetConfigFilename(char const *file_name, bool is_pipe)
 274 {
 275     if (is_pipe)
 276         cfg_filename = file_name + 1;
 277     else
 278         cfg_filename = file_name;
 279 }
 280
 281 static const char*
 282 skip_ws(const char* s)
 283 {
 284     while (xisspace(*s))
 285         ++s;
 286
 287     return s;
 288 }
 289
 290 static int
 291 parseManyConfigFiles(char* files, int depth)
 292 {
 293     int error_count = 0;
 294     char* saveptr = NULL;
 295 #if HAVE_GLOB
 296     char *path;
 297     glob_t globbuf;
 298     int i;
 299     memset(&globbuf, 0, sizeof(globbuf));
 300     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 301         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 302             int xerrno = errno;
 303             fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
 304         }
 305     }
 306     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 307         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 308     }
 309     globfree(&globbuf);
 310 #else
 311     char* file = strwordtok(files, &saveptr);
 312     while (file != NULL) {
 313         error_count += parseOneConfigFile(file, depth);
 314         file = strwordtok(NULL, &saveptr);
 315     }
 316 #endif /* HAVE_GLOB */
 317     return error_count;
 318 }
 319
 320 static void
 321 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 322 {
 323     assert(str != NULL);
 324     assert(newSubstr != NULL);
 325
 326     unsigned newSubstrLen = strlen(newSubstr);
 327     if (newSubstrLen > substrLen)
 328         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 329
 330     // move tail part including zero
 331     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 332     // copy new substring in place
 333     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 334
 335     len = strlen(str);
 336 }
 337
 338 static void
 339 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 340 {
 341     assert(line != NULL);
 342     assert(macroName != NULL);
 343     assert(substStr != NULL);
 344     unsigned macroNameLen = strlen(macroName);
 345     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 346         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 347 }
 348
 349 static void
 350 ProcessMacros(char*& line, int& len)
 351 {
 352     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 353     SubstituteMacro(line, len, "${process_name}", TheKidName.c_str());
 354     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 355 }
 356
 357 static void
 358 trim_trailing_ws(char* str)
 359 {
 360     assert(str != NULL);
 361     unsigned i = strlen(str);
 362     while ((i > 0) && xisspace(str[i - 1]))
 363         --i;
 364     str[i] = '\0';
 365 }
 366
 367 static const char*
 368 FindStatement(const char* line, const char* statement)
 369 {
 370     assert(line != NULL);
 371     assert(statement != NULL);
 372
 373     const char* str = skip_ws(line);
 374     unsigned len = strlen(statement);
 375     if (strncmp(str, statement, len) == 0) {
 376         str += len;
 377         if (*str == '\0')
 378             return str;
 379         else if (xisspace(*str))
 380             return skip_ws(str);
 381     }
 382
 383     return NULL;
 384 }
 385
 386 static bool
 387 StrToInt(const char* str, long& number)
 388 {
 389     assert(str != NULL);
 390
 391     char* end;
 392     number = strtol(str, &end, 0);
 393
 394     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 395 }
 396
 397 static bool
 398 EvalBoolExpr(const char* expr)
 399 {
 400     assert(expr != NULL);
 401     if (strcmp(expr, "true") == 0) {
 402         return true;
 403     } else if (strcmp(expr, "false") == 0) {
 404         return false;
 405     } else if (const char* equation = strchr(expr, '=')) {
 406         const char* rvalue = skip_ws(equation + 1);
 407         char* lvalue = (char*)xmalloc(equation - expr + 1);
 408         xstrncpy(lvalue, expr, equation - expr + 1);
 409         trim_trailing_ws(lvalue);
 410
 411         long number1;
 412         if (!StrToInt(lvalue, number1))
 413             fatalf("String is not a integer number: '%s'\n", lvalue);
 414         long number2;
 415         if (!StrToInt(rvalue, number2))
 416             fatalf("String is not a integer number: '%s'\n", rvalue);
 417
 418         xfree(lvalue);
 419         return number1 == number2;
 420     }
 421     fatalf("Unable to evaluate expression '%s'\n", expr);
 422     return false; // this place cannot be reached
 423 }
 424
 425 static int
 426 parseOneConfigFile(const char *file_name, unsigned int depth)
 427 {
 428     FILE *fp = NULL;
 429     const char *orig_cfg_filename = cfg_filename;
 430     const int orig_config_lineno = config_lineno;
 431     char *token = NULL;
 432     char *tmp_line = NULL;
 433     int tmp_line_len = 0;
 434     int err_count = 0;
 435     int is_pipe = 0;
 436
 437     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 438     if (depth > 16) {
 439         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 440         return 1;
 441     }
 442
 443     if (file_name[0] == '!' || file_name[0] == '|') {
 444         fp = popen(file_name + 1, "r");
 445         is_pipe = 1;
 446     } else {
 447         fp = fopen(file_name, "r");
 448     }
 449
 450     if (!fp) {
 451         int xerrno = errno;
 452         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
 453     }
 454
 455 #if _SQUID_WINDOWS_
 456     setmode(fileno(fp), O_TEXT);
 457 #endif
 458
 459     SetConfigFilename(file_name, bool(is_pipe));
 460
 461     memset(config_input_line, '\0', BUFSIZ);
 462
 463     config_lineno = 0;
 464
 465     std::vector<bool> if_states;
 466     while (fgets(config_input_line, BUFSIZ, fp)) {
 467         ++config_lineno;
 468
 469         if ((token = strchr(config_input_line, '\n')))
 470             *token = '\0';
 471
 472         if ((token = strchr(config_input_line, '\r')))
 473             *token = '\0';
 474
 475         // strip any prefix whitespace off the line.
 476         const char *p = skip_ws(config_input_line);
 477         if (config_input_line != p)
 478             memmove(config_input_line, p, strlen(p)+1);
 479
 480         if (strncmp(config_input_line, "#line ", 6) == 0) {
 481             static char new_file_name[1024];
 482             static char *file;
 483             static char new_lineno;
 484             token = config_input_line + 6;
 485             new_lineno = strtol(token, &file, 0) - 1;
 486
 487             if (file == token)
 488                 continue;   /* Not a valid #line directive, may be a comment */
 489
 490             while (*file && xisspace((unsigned char) *file))
 491                 ++file;
 492
 493             if (*file) {
 494                 if (*file != '"')
 495                     continue;   /* Not a valid #line directive, may be a comment */
 496
 497                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 498
 499                 if ((token = strchr(new_file_name, '"')))
 500                     *token = '\0';
 501
 502                 SetConfigFilename(new_file_name, false);
 503             }
 504
 505             config_lineno = new_lineno;
 506         }
 507
 508         if (config_input_line[0] == '#')
 509             continue;
 510
 511         if (config_input_line[0] == '\0')
 512             continue;
 513
 514         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 515
 516         size_t append_len = strlen(append);
 517
 518         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 519
 520         strcpy(tmp_line + tmp_line_len, append);
 521
 522         tmp_line_len += append_len;
 523
 524         if (tmp_line[tmp_line_len-1] == '\\') {
 525             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 526             tmp_line[--tmp_line_len] = '\0';
 527             continue;
 528         }
 529
 530         trim_trailing_ws(tmp_line);
 531         ProcessMacros(tmp_line, tmp_line_len);
 532         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 533
 534         if (const char* expr = FindStatement(tmp_line, "if")) {
 535             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 536         } else if (FindStatement(tmp_line, "endif")) {
 537             if (!if_states.empty())
 538                 if_states.pop_back(); // remove last if-statement meaning
 539             else
 540                 fatalf("'endif' without 'if'\n");
 541         } else if (FindStatement(tmp_line, "else")) {
 542             if (!if_states.empty())
 543                 if_states.back() = !if_states.back();
 544             else
 545                 fatalf("'else' without 'if'\n");
 546         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 547             /* Handle includes here */
 548             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 549                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 550             } else {
 551                 try {
 552                     if (!parse_line(tmp_line)) {
 553                         debugs(3, DBG_CRITICAL, ConfigParser::CurrentLocation() << ": unrecognized: '" << tmp_line << "'");
 554                         ++err_count;
 555                     }
 556                 } catch (...) {
 557                     // fatal for now
 558                     debugs(3, DBG_CRITICAL, "configuration error: " << CurrentException);
 559                     self_destruct();
 560                 }
 561             }
 562         }
 563
 564         safe_free(tmp_line);
 565         tmp_line_len = 0;
 566
 567     }
 568     if (!if_states.empty())
 569         fatalf("if-statement without 'endif'\n");
 570
 571     if (is_pipe) {
 572         int ret = pclose(fp);
 573
 574         if (ret != 0)
 575             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 576     } else {
 577         fclose(fp);
 578     }
 579
 580     SetConfigFilename(orig_cfg_filename, false);
 581     config_lineno = orig_config_lineno;
 582
 583     xfree(tmp_line);
 584     return err_count;
 585 }
 586
 587 static
 588 int
 589 parseConfigFileOrThrow(const char *file_name)
 590 {
 591     int err_count = 0;
 592
 593     debugs(5, 4, HERE);
 594
 595     configFreeMemory();
 596
 597     ACLMethodData::ThePurgeCount = 0;
 598     default_all();
 599
 600     err_count = parseOneConfigFile(file_name, 0);
 601
 602     defaults_if_none();
 603
 604     defaults_postscriptum();
 605
 606     /*
 607      * We must call configDoConfigure() before leave_suid() because
 608      * configDoConfigure() is where we turn username strings into
 609      * uid values.
 610      */
 611     configDoConfigure();
 612
 613     if (opt_send_signal == -1) {
 614         Mgr::RegisterAction("config",
 615                             "Current Squid Configuration",
 616                             dump_config,
 617                             1, 1);
 618     }
 619
 620     return err_count;
 621 }
 622
 623 // TODO: Refactor main.cc to centrally handle (and report) all exceptions.
 624 int
 625 parseConfigFile(const char *file_name)
 626 {
 627     try {
 628         return parseConfigFileOrThrow(file_name);
 629     }
 630     catch (const std::exception &ex) {
 631         debugs(3, DBG_CRITICAL, "FATAL: bad configuration: " << ex.what());
 632         self_destruct();
 633         return 1; // not reached
 634     }
 635 }
 636
 637 /*
 638  * The templated functions below are essentially ConfigParser methods. They are
 639  * not implemented as such because our generated code calling them is the only
 640  * code that can instantiate implementations for each T -- we cannot place these
 641  * definitions into ConfigParser.cc unless cf_parser.cci is moved there.
 642  */
 643
 644 // TODO: When adding Ts incompatible with this trivial API and implementation,
 645 // replace both with a ConfigParser-maintained table of seen directives.
 646 /// whether we have seen (and, hence, configured) the given directive
 647 template <typename T>
 648 static bool
 649 SawDirective(const T &raw)
 650 {
 651     return bool(raw);
 652 }
 653
 654 /// Sets the given raw SquidConfig data member.
 655 /// Extracts and interprets parser's configuration tokens.
 656 template <typename T>
 657 static void
 658 ParseDirective(T &raw, ConfigParser &parser)
 659 {
 660     if (SawDirective(raw))
 661         parser.rejectDuplicateDirective();
 662
 663     // TODO: parser.openDirective(directiveName);
 664     Must(!raw);
 665     raw = Configuration::Component<T>::Parse(parser);
 666     Must(raw);
 667     parser.closeDirective();
 668 }
 669
 670 /// reports raw SquidConfig data member configuration using squid.conf syntax
 671 /// \param name the name of the configuration directive being dumped
 672 template <typename T>
 673 static void
 674 DumpDirective(const T &raw, StoreEntry *entry, const char *name)
 675 {
 676     if (!SawDirective(raw))
 677         return; // not configured
 678
 679     entry->append(name, strlen(name));
 680     SBufStream os;
 681     Configuration::Component<T>::Print(os, raw);
 682     const auto buf = os.buf();
 683     if (buf.length()) {
 684         entry->append(" ", 1);
 685         entry->append(buf.rawContent(), buf.length());
 686     }
 687     entry->append("\n", 1);
 688 }
 689
 690 /// frees any resources associated with the given raw SquidConfig data member
 691 template <typename T>
 692 static void
 693 FreeDirective(T &raw)
 694 {
 695     Configuration::Component<T>::Free(raw);
 696
 697     // While the implementation may change, there is no way to avoid zeroing.
 698     // Even migration to a proper SquidConfig class would not help: While
 699     // ordinary destructors do not need to zero data members, a SquidConfig
 700     // destructor would have to zero to protect any SquidConfig::x destruction
 701     // code from accidentally dereferencing an already destroyed Config.y.
 702     static_assert(std::is_trivial<T>::value, "SquidConfig member is trivial");
 703     memset(&raw, 0, sizeof(raw));
 704 }
 705
 706 static void
 707 configDoConfigure(void)
 708 {
 709     Config2.clear();
 710     /* init memory as early as possible */
 711     memConfigure();
 712     /* Sanity checks */
 713
 714     if (Debug::rotateNumber < 0) {
 715         Debug::rotateNumber = Config.Log.rotateNumber;
 716     }
 717
 718 #if SIZEOF_OFF_T <= 4
 719     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 720         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 721         Config.Store.maxObjectSize = 0x7FFF0000;
 722     }
 723 #endif
 724
 725     if (Config.Announce.period > 0) {
 726         Config.onoff.announce = 1;
 727     } else {
 728         Config.Announce.period = 86400 * 365;   /* one year */
 729         Config.onoff.announce = 0;
 730     }
 731
 732     if (Config.onoff.httpd_suppress_version_string)
 733         visible_appname_string = (char *)appname_string;
 734     else
 735         visible_appname_string = (char const *)APP_FULLNAME;
 736
 737     if (Config.Program.redirect) {
 738         if (Config.redirectChildren.n_max < 1) {
 739             Config.redirectChildren.n_max = 0;
 740             wordlistDestroy(&Config.Program.redirect);
 741         }
 742     }
 743
 744     if (Config.Program.store_id) {
 745         if (Config.storeIdChildren.n_max < 1) {
 746             Config.storeIdChildren.n_max = 0;
 747             wordlistDestroy(&Config.Program.store_id);
 748         }
 749     }
 750
 751     if (Config.appendDomain)
 752         if (*Config.appendDomain != '.')
 753             fatal("append_domain must begin with a '.'");
 754
 755     if (Config.errHtmlText == NULL)
 756         Config.errHtmlText = xstrdup(null_string);
 757
 758 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 759     if (Config.max_filedescriptors > 0) {
 760         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 761     }
 762 #elif USE_SELECT || USE_SELECT_WIN32
 763     if (Config.max_filedescriptors > FD_SETSIZE) {
 764         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 765     }
 766 #endif
 767
 768     storeConfigure();
 769
 770     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 771              uniqueHostname(),
 772              visible_appname_string);
 773
 774     /*
 775      * the extra space is for loop detection in client_side.c -- we search
 776      * for substrings in the Via header.
 777      */
 778     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 779              uniqueHostname(),
 780              visible_appname_string);
 781
 782     /* Use visible_hostname as default surrogate_id */
 783     if (!Config.Accel.surrogate_id) {
 784         const char *t = getMyHostname();
 785         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 786     }
 787
 788     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 789         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 790
 791     if (Config.appendDomain)
 792         Config.appendDomainLen = strlen(Config.appendDomain);
 793     else
 794         Config.appendDomainLen = 0;
 795
 796     if (Config.connect_retries > 10) {
 797         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 798         Config.connect_retries = 10;
 799     }
 800
 801     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 802 #if USE_UNLINKD
 803
 804     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 805 #endif
 806     bool logDaemonUsed = false;
 807     for (const auto *log = Config.Log.accesslogs; !logDaemonUsed && log; log = log->next)
 808         logDaemonUsed = log->usesDaemon();
 809 #if ICAP_CLIENT
 810     for (const auto *log = Config.Log.icaplogs; !logDaemonUsed && log; log = log->next)
 811         logDaemonUsed = log->usesDaemon();
 812 #endif
 813     if (logDaemonUsed)
 814         requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 815
 816     if (Config.Program.redirect)
 817         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 818
 819     if (Config.Program.store_id)
 820         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 821
 822     requirePathnameExists("Icon Directory", Config.icons.directory);
 823
 824     if (Config.errorDirectory)
 825         requirePathnameExists("Error Directory", Config.errorDirectory);
 826
 827 #if USE_HTTP_VIOLATIONS
 828
 829     {
 830         const RefreshPattern *R;
 831
 832         for (R = Config.Refresh; R; R = R->next) {
 833             if (!R->flags.override_expire)
 834                 continue;
 835
 836             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 837
 838             break;
 839         }
 840
 841         for (R = Config.Refresh; R; R = R->next) {
 842             if (!R->flags.override_lastmod)
 843                 continue;
 844
 845             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 846
 847             break;
 848         }
 849
 850         for (R = Config.Refresh; R; R = R->next) {
 851             if (!R->flags.reload_into_ims)
 852                 continue;
 853
 854             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 855
 856             break;
 857         }
 858
 859         for (R = Config.Refresh; R; R = R->next) {
 860             if (!R->flags.ignore_reload)
 861                 continue;
 862
 863             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 864
 865             break;
 866         }
 867
 868         for (R = Config.Refresh; R; R = R->next) {
 869             if (!R->flags.ignore_no_store)
 870                 continue;
 871
 872             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 873
 874             break;
 875         }
 876
 877         for (R = Config.Refresh; R; R = R->next) {
 878             if (!R->flags.ignore_private)
 879                 continue;
 880
 881             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 882
 883             break;
 884         }
 885     }
 886 #endif
 887 #if !USE_HTTP_VIOLATIONS
 888     Config.onoff.via = 1;
 889 #else
 890
 891     if (!Config.onoff.via)
 892         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 893
 894 #endif
 895
 896     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 897     // TODO: replace with a dedicated "purge" ACL option?
 898     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 899
 900     if (geteuid() == 0) {
 901         if (NULL != Config.effectiveUser) {
 902
 903             struct passwd *pwd = getpwnam(Config.effectiveUser);
 904
 905             if (NULL == pwd) {
 906                 /*
 907                  * Andres Kroonmaa <andre@online.ee>:
 908                  * Some getpwnam() implementations (Solaris?) require
 909                  * an available FD < 256 for opening a FILE* to the
 910                  * passwd file.
 911                  * DW:
 912                  * This should be safe at startup, but might still fail
 913                  * during reconfigure.
 914                  */
 915                 fatalf("getpwnam failed to find userid for effective user '%s'",
 916                        Config.effectiveUser);
 917                 return;
 918             }
 919
 920             Config2.effectiveUserID = pwd->pw_uid;
 921
 922             Config2.effectiveGroupID = pwd->pw_gid;
 923
 924 #if HAVE_PUTENV
 925             if (pwd->pw_dir && *pwd->pw_dir) {
 926                 // putenv() leaks by design; avoid leaks when nothing changes
 927                 static SBuf lastDir;
 928                 if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
 929                     lastDir = pwd->pw_dir;
 930                     int len = strlen(pwd->pw_dir) + 6;
 931                     char *env_str = (char *)xcalloc(len, 1);
 932                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 933                     putenv(env_str);
 934                 }
 935             }
 936 #endif
 937         }
 938     } else {
 939         Config2.effectiveUserID = geteuid();
 940         Config2.effectiveGroupID = getegid();
 941     }
 942
 943     if (NULL != Config.effectiveGroup) {
 944
 945         struct group *grp = getgrnam(Config.effectiveGroup);
 946
 947         if (NULL == grp) {
 948             fatalf("getgrnam failed to find groupid for effective group '%s'",
 949                    Config.effectiveGroup);
 950             return;
 951         }
 952
 953         Config2.effectiveGroupID = grp->gr_gid;
 954     }
 955
 956 #if USE_OPENSSL
 957     if (Config.ssl_client.foreignIntermediateCertsPath)
 958         Ssl::loadSquidUntrusted(Config.ssl_client.foreignIntermediateCertsPath);
 959 #endif
 960
 961     if (Security::ProxyOutgoingConfig.encryptTransport) {
 962         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 963         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 964         if (!Config.ssl_client.sslContext) {
 965 #if USE_OPENSSL
 966             fatal("ERROR: Could not initialize https:// proxy context");
 967 #else
 968             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 969 #endif
 970         }
 971 #if USE_OPENSSL
 972         Ssl::useSquidUntrusted(Config.ssl_client.sslContext.get());
 973 #endif
 974     }
 975
 976     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 977
 978         // default value for ssldomain= is the peer host/IP
 979         if (p->secure.sslDomain.isEmpty())
 980             p->secure.sslDomain = p->host;
 981
 982         if (p->secure.encryptTransport) {
 983             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 984             p->sslContext = p->secure.createClientContext(true);
 985             if (!p->sslContext) {
 986                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 987                 self_destruct();
 988                 return;
 989             }
 990         }
 991     }
 992
 993     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 994         if (!s->secure.encryptTransport)
 995             continue;
 996         debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS contexts");
 997         s->secure.initServerContexts(*s);
 998     }
 999
1000     // prevent infinite fetch loops in the request parser
1001     // due to buffer full but not enough data received to finish parse
1002     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
1003         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
1004                " Change client_request_buffer_max or request_header_max_size limits.",
1005                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
1006     }
1007
1008     /*
1009      * Disable client side request pipelining if client_persistent_connections OFF.
1010      * Waste of resources queueing any pipelined requests when the first will close the connection.
1011      */
1012     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
1013         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
1014                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
1015         Config.pipeline_max_prefetch = 0;
1016     }
1017
1018 #if USE_AUTH
1019     /*
1020      * disable client side request pipelining. There is a race with
1021      * Negotiate and NTLM when the client sends a second request on an
1022      * connection before the authenticate challenge is sent. With
1023      * pipelining OFF, the client may fail to authenticate, but squid's
1024      * state will be preserved.
1025      */
1026     if (Config.pipeline_max_prefetch > 0) {
1027         Auth::SchemeConfig *nego = Auth::SchemeConfig::Find("Negotiate");
1028         Auth::SchemeConfig *ntlm = Auth::SchemeConfig::Find("NTLM");
1029         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
1030             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
1031             Config.pipeline_max_prefetch = 0;
1032         }
1033     }
1034
1035     for (auto &authSchemes : Auth::TheConfig.schemeLists) {
1036         authSchemes.expand();
1037         if (authSchemes.authConfigs.empty()) {
1038             debugs(3, DBG_CRITICAL, "auth_schemes: at least one scheme name is required; got: " << authSchemes.rawSchemes);
1039             self_destruct();
1040         }
1041     }
1042 #endif
1043 }
1044
1045 /** Parse a line containing an obsolete directive.
1046  * To upgrade it where possible instead of just "Bungled config" for
1047  * directives which cannot be marked as simply aliases of the some name.
1048  * For example if the parameter order and content has changed.
1049  * Or if the directive has been completely removed.
1050  */
1051 void
1052 parse_obsolete(const char *name)
1053 {
1054     // Directives which have been radically changed rather than removed
1055     if (!strcmp(name, "url_rewrite_concurrency")) {
1056         int cval;
1057         parse_int(&cval);
1058         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
1059         Config.redirectChildren.concurrency = cval;
1060     }
1061
1062     if (!strcmp(name, "log_access")) {
1063         self_destruct();
1064         return;
1065     }
1066
1067     if (!strcmp(name, "log_icap")) {
1068         self_destruct();
1069         return;
1070     }
1071
1072     if (!strcmp(name, "ignore_ims_on_miss")) {
1073         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
1074         // than the 2.7 directive. We need to parse and invert the configured value.
1075         int temp = 0;
1076         parse_onoff(&temp);
1077         Config.onoff.cache_miss_revalidate = !temp;
1078     }
1079
1080     if (!strncmp(name, "sslproxy_", 9)) {
1081         // the replacement directive tls_outgoing_options uses options instead of whole-line input
1082         SBuf tmp;
1083         if (!strcmp(name, "sslproxy_cafile"))
1084             tmp.append("cafile=");
1085         else if (!strcmp(name, "sslproxy_capath"))
1086             tmp.append("capath=");
1087         else if (!strcmp(name, "sslproxy_cipher"))
1088             tmp.append("cipher=");
1089         else if (!strcmp(name, "sslproxy_client_certificate"))
1090             tmp.append("cert=");
1091         else if (!strcmp(name, "sslproxy_client_key"))
1092             tmp.append("key=");
1093         else if (!strcmp(name, "sslproxy_flags"))
1094             tmp.append("flags=");
1095         else if (!strcmp(name, "sslproxy_options"))
1096             tmp.append("options=");
1097         else if (!strcmp(name, "sslproxy_version"))
1098             tmp.append("version=");
1099         else {
1100             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1101             self_destruct();
1102             return;
1103         }
1104
1105         // add the value as unquoted-string because the old values did not support whitespace
1106         const char *token = ConfigParser::NextQuotedOrToEol();
1107         tmp.append(token, strlen(token));
1108         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1109     }
1110 }
1111
1112 template <class MinimalUnit>
1113 static const char *
1114 TimeUnitToString()
1115 {
1116     const auto minUnit = MinimalUnit(1);
1117     if(minUnit == std::chrono::nanoseconds(1))
1118         return T_NANOSECOND_STR;
1119     else if (minUnit == std::chrono::microseconds(1))
1120         return T_MICROSECOND_STR;
1121     else if (minUnit == std::chrono::milliseconds(1))
1122         return T_MILLISECOND_STR;
1123     else {
1124         assert(minUnit >= std::chrono::seconds(1));
1125         return T_SECOND_STR;
1126     }
1127 }
1128
1129 /// Assigns 'ns' the number of nanoseconds corresponding to 'unitName'.
1130 /// \param MinimalUnit is a chrono duration type specifying the minimal
1131 /// allowed time unit.
1132 /// \returns true if unitName is correct and its time unit is not less
1133 /// than MinimalUnit.
1134 template <class MinimalUnit>
1135 static bool
1136 parseTimeUnit(const char *unitName, std::chrono::nanoseconds &ns)
1137 {
1138     if (!unitName)
1139         throw TexcHere("missing time unit");
1140
1141     if (!strncasecmp(unitName, T_NANOSECOND_STR, strlen(T_NANOSECOND_STR)))
1142         ns = std::chrono::nanoseconds(1);
1143     else if (!strncasecmp(unitName, T_MICROSECOND_STR, strlen(T_MICROSECOND_STR)))
1144         ns = std::chrono::microseconds(1);
1145     else if (!strncasecmp(unitName, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1146         ns = std::chrono::milliseconds(1);
1147     else if (!strncasecmp(unitName, T_SECOND_STR, strlen(T_SECOND_STR)))
1148         ns = std::chrono::seconds(1);
1149     else if (!strncasecmp(unitName, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1150         ns = std::chrono::minutes(1);
1151     else if (!strncasecmp(unitName, T_HOUR_STR, strlen(T_HOUR_STR)))
1152         ns = std::chrono::hours(1);
1153     else if (!strncasecmp(unitName, T_DAY_STR, strlen(T_DAY_STR)))
1154         ns = std::chrono::hours(24);
1155     else if (!strncasecmp(unitName, T_WEEK_STR, strlen(T_WEEK_STR)))
1156         ns = std::chrono::hours(24 * 7);
1157     else if (!strncasecmp(unitName, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1158         ns = std::chrono::hours(24 * 14);
1159     else if (!strncasecmp(unitName, T_MONTH_STR, strlen(T_MONTH_STR)))
1160         ns = std::chrono::hours(24 * 30);
1161     else if (!strncasecmp(unitName, T_YEAR_STR, strlen(T_YEAR_STR)))
1162         ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear));
1163     else if (!strncasecmp(unitName, T_DECADE_STR, strlen(T_DECADE_STR)))
1164         ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear * 10));
1165     else
1166         return false;
1167
1168     if (ns < MinimalUnit(1)) {
1169         throw TexcHere(ToSBuf("time unit '", unitName, "' is too small to be used in this context, the minimal unit is ",
1170                               TimeUnitToString<MinimalUnit>()));
1171     }
1172
1173     return true;
1174 }
1175
1176 static std::chrono::nanoseconds
1177 ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
1178 {
1179     if (value < 0.0)
1180         throw TexcHere("time must have a positive value");
1181
1182     if (value > (static_cast<double>(std::chrono::nanoseconds::max().count()) / unit.count())) {
1183         const auto maxYears = std::chrono::duration_cast<std::chrono::hours>(std::chrono::nanoseconds::max()).count()/HoursPerYear;
1184         throw TexcHere(ToSBuf("time values cannot exceed ", maxYears, " years"));
1185     }
1186
1187     return std::chrono::duration_cast<std::chrono::nanoseconds>(unit * value);
1188 }
1189
1190 template <class TimeUnit>
1191 static TimeUnit
1192 FromNanoseconds(const std::chrono::nanoseconds &ns, const double parsedValue)
1193 {
1194     const auto result = std::chrono::duration_cast<TimeUnit>(ns);
1195     if (!result.count()) {
1196         throw TexcHere(ToSBuf("time value '", parsedValue,
1197                               "' is too small to be used in this context, the minimal value is 1 ",
1198                               TimeUnitToString<TimeUnit>()));
1199     }
1200     return result;
1201 }
1202
1203 /// Parses a time specification from the config file and
1204 /// returns the time as a chrono duration object of 'TimeUnit' type.
1205 template <class TimeUnit>
1206 static TimeUnit
1207 parseTimeLine()
1208 {
1209     const auto valueToken = ConfigParser::NextToken();
1210     if (!valueToken)
1211         throw TexcHere("cannot read a time value");
1212
1213     const auto parsedValue = xatof(valueToken);
1214
1215     if (parsedValue == 0)
1216         return TimeUnit::zero();
1217
1218     std::chrono::nanoseconds parsedUnitDuration;
1219
1220     const auto token = ConfigParser::PeekAtToken();
1221
1222     if (!parseTimeUnit<TimeUnit>(token, parsedUnitDuration))
1223         throw TexcHere(ToSBuf("unknown time unit '", token, "'"));
1224
1225     (void)ConfigParser::NextToken();
1226
1227     const auto nanoseconds = ToNanoSeconds(parsedValue, parsedUnitDuration);
1228
1229     // validate precisions (time-units-small only)
1230     if (TimeUnit(1) <= std::chrono::microseconds(1)) {
1231         if (0 < nanoseconds.count() && nanoseconds.count() < 3) {
1232             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), ConfigParser::CurrentLocation() << ": WARNING: " <<
1233                    "Squid time measurement precision is likely to be far worse than " <<
1234                    "the nanosecond-level precision implied by the configured value: " << parsedValue << ' ' << token);
1235         }
1236     }
1237
1238     return FromNanoseconds<TimeUnit>(nanoseconds, parsedValue);
1239 }
1240
1241 static void
1242 parseBytesLine64(int64_t * bptr, const char *units)
1243 {
1244     char *token;
1245     double d;
1246     int64_t m;
1247     int64_t u;
1248
1249     if ((u = parseBytesUnits(units)) == 0) {
1250         self_destruct();
1251         return;
1252     }
1253
1254     if ((token = ConfigParser::NextToken()) == NULL) {
1255         self_destruct();
1256         return;
1257     }
1258
1259     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1260         *bptr = -1;
1261         return;
1262     }
1263
1264     d = xatof(token);
1265
1266     m = u;          /* default to 'units' if none specified */
1267
1268     if (0.0 == d)
1269         (void) 0;
1270     else if ((token = ConfigParser::NextToken()) == NULL)
1271         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1272                config_input_line << "', assuming " <<
1273                d << " " <<  units  );
1274     else if ((m = parseBytesUnits(token)) == 0) {
1275         self_destruct();
1276         return;
1277     }
1278
1279     *bptr = static_cast<int64_t>(m * d / u);
1280
1281     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1282         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1283                d << " " << token << ": integer overflow (int64_t).");
1284         self_destruct();
1285     }
1286 }
1287
1288 static void
1289 parseBytesLine(size_t * bptr, const char *units)
1290 {
1291     char *token;
1292     double d;
1293     int m;
1294     int u;
1295
1296     if ((u = parseBytesUnits(units)) == 0) {
1297         self_destruct();
1298         return;
1299     }
1300
1301     if ((token = ConfigParser::NextToken()) == NULL) {
1302         self_destruct();
1303         return;
1304     }
1305
1306     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1307         *bptr = static_cast<size_t>(-1);
1308         return;
1309     }
1310
1311     d = xatof(token);
1312
1313     m = u;          /* default to 'units' if none specified */
1314
1315     if (0.0 == d)
1316         (void) 0;
1317     else if ((token = ConfigParser::NextToken()) == NULL)
1318         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1319                config_input_line << "', assuming " <<
1320                d << " " <<  units  );
1321     else if ((m = parseBytesUnits(token)) == 0) {
1322         self_destruct();
1323         return;
1324     }
1325
1326     *bptr = static_cast<size_t>(m * d / u);
1327
1328     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1329         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1330                d << " " << token << ": integer overflow (size_t).");
1331         self_destruct();
1332     }
1333 }
1334
1335 static void
1336 parseBytesLineSigned(ssize_t * bptr, const char *units)
1337 {
1338     char *token;
1339     double d;
1340     int m;
1341     int u;
1342
1343     if ((u = parseBytesUnits(units)) == 0) {
1344         self_destruct();
1345         return;
1346     }
1347
1348     if ((token = ConfigParser::NextToken()) == NULL) {
1349         self_destruct();
1350         return;
1351     }
1352
1353     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1354         *bptr = -1;
1355         return;
1356     }
1357
1358     d = xatof(token);
1359
1360     m = u;          /* default to 'units' if none specified */
1361
1362     if (0.0 == d)
1363         (void) 0;
1364     else if ((token = ConfigParser::NextToken()) == NULL)
1365         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1366                config_input_line << "', assuming " <<
1367                d << " " <<  units  );
1368     else if ((m = parseBytesUnits(token)) == 0) {
1369         self_destruct();
1370         return;
1371     }
1372
1373     *bptr = static_cast<ssize_t>(m * d / u);
1374
1375     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1376         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1377                d << " " << token << ": integer overflow (ssize_t).");
1378         self_destruct();
1379     }
1380 }
1381
1382 /**
1383  * Parse bytes from a string.
1384  * Similar to the parseBytesLine function but parses the string value instead of
1385  * the current token value.
1386  */
1387 void
1388 parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1389 {
1390     int u;
1391     if ((u = parseBytesUnits(units)) == 0) {
1392         self_destruct();
1393         return;
1394     }
1395
1396     // Find number from string beginning.
1397     char const * number_begin = value;
1398     char const * number_end = value;
1399
1400     while ((*number_end >= '0' && *number_end <= '9')) {
1401         ++number_end;
1402     }
1403
1404     String number;
1405     number.assign(number_begin, number_end - number_begin);
1406
1407     int d = xatoi(number.termedBuf());
1408     int m;
1409     if ((m = parseBytesUnits(number_end)) == 0) {
1410         self_destruct();
1411         return;
1412     }
1413
1414     *bptr = static_cast<size_t>(m * d / u);
1415     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1416         self_destruct();
1417 }
1418
1419 static size_t
1420 parseBytesUnits(const char *unit)
1421 {
1422     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1423         return 1;
1424
1425     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1426         return 1 << 10;
1427
1428     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1429         return 1 << 20;
1430
1431     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1432         return 1 << 30;
1433
1434     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1435
1436     return 0;
1437 }
1438
1439 static void
1440 parse_SBufList(SBufList * list)
1441 {
1442     while (char *token = ConfigParser::NextQuotedToken())
1443         list->push_back(SBuf(token));
1444 }
1445
1446 // just dump a list, no directive name
1447 static void
1448 dump_SBufList(StoreEntry * entry, const SBufList &words)
1449 {
1450     for (const auto &i : words) {
1451         entry->append(i.rawContent(), i.length());
1452         entry->append(" ",1);
1453     }
1454     entry->append("\n",1);
1455 }
1456
1457 // dump a SBufList type directive with name
1458 static void
1459 dump_SBufList(StoreEntry * entry, const char *name, SBufList &list)
1460 {
1461     if (!list.empty()) {
1462         entry->append(name, strlen(name));
1463         entry->append(" ", 1);
1464         dump_SBufList(entry, list);
1465     }
1466 }
1467
1468 static void
1469 free_SBufList(SBufList *list)
1470 {
1471     if (list)
1472         list->clear();
1473 }
1474
1475 static void
1476 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1477 {
1478     while (ae != NULL) {
1479         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1480         storeAppendPrintf(entry, "%s %s %s ",
1481                           name,
1482                           ae->name,
1483                           ae->typeString());
1484         SBufList tail;
1485         tail.splice(tail.end(), ae->dumpOptions());
1486         tail.splice(tail.end(), ae->dump()); // ACL parameters
1487         dump_SBufList(entry, tail);
1488         ae = ae->next;
1489     }
1490 }
1491
1492 static void
1493 parse_acl(ACL ** ae)
1494 {
1495     ACL::ParseAclLine(LegacyParser, ae);
1496 }
1497
1498 static void
1499 free_acl(ACL ** ae)
1500 {
1501     aclDestroyAcls(ae);
1502 }
1503
1504 void
1505 dump_acl_list(StoreEntry * entry, ACLList * head)
1506 {
1507     // XXX: Should dump ACL names like "foo !bar" but dumps parsing context like
1508     // "(clientside_tos 0x11 line)".
1509     dump_SBufList(entry, head->dump());
1510 }
1511
1512 void
1513 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1514 {
1515     if (head)
1516         dump_SBufList(entry, head->treeDump(name, &Acl::AllowOrDeny));
1517 }
1518
1519 static void
1520 parse_acl_access(acl_access ** head)
1521 {
1522     aclParseAccessLine(cfg_directive, LegacyParser, head);
1523 }
1524
1525 static void
1526 free_acl_access(acl_access ** head)
1527 {
1528     aclDestroyAccessList(head);
1529 }
1530
1531 static void
1532 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1533 {
1534     char buf[MAX_IPSTRLEN];
1535     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1536 }
1537
1538 static void
1539 parse_address(Ip::Address *addr)
1540 {
1541     char *token = ConfigParser::NextToken();
1542
1543     if (!token) {
1544         self_destruct();
1545         return;
1546     }
1547
1548     if (!strcmp(token,"any_addr"))
1549         addr->setAnyAddr();
1550     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1551         addr->setNoAddr();
1552     else if ( (*addr = token) ) // try parse numeric/IPA
1553         (void) 0;
1554     else if (addr->GetHostByName(token)) // do not use ipcache
1555         (void) 0;
1556     else { // not an IP and not a hostname
1557         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1558         self_destruct();
1559     }
1560 }
1561
1562 static void
1563 free_address(Ip::Address *addr)
1564 {
1565     addr->setEmpty();
1566 }
1567
1568 static void
1569 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1570 {
1571     char buf[MAX_IPSTRLEN];
1572
1573     for (Acl::Address *l = head; l; l = l->next) {
1574         if (!l->addr.isAnyAddr())
1575             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1576         else
1577             storeAppendPrintf(entry, "%s autoselect", name);
1578
1579         dump_acl_list(entry, l->aclList);
1580
1581         storeAppendPrintf(entry, "\n");
1582     }
1583 }
1584
1585 static void
1586 parse_acl_address(Acl::Address ** head)
1587 {
1588     Acl::Address *l = new Acl::Address;
1589     parse_address(&l->addr);
1590     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1591
1592     Acl::Address **tail = head;
1593     while (*tail)
1594         tail = &(*tail)->next;
1595
1596     *tail = l;
1597 }
1598
1599 static void
1600 free_acl_address(Acl::Address ** head)
1601 {
1602     delete *head;
1603     *head = NULL;
1604 }
1605
1606 static void
1607 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1608 {
1609     acl_tos *l;
1610
1611     for (l = head; l; l = l->next) {
1612         if (l->tos > 0)
1613             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1614         else
1615             storeAppendPrintf(entry, "%s none", name);
1616
1617         dump_acl_list(entry, l->aclList);
1618
1619         storeAppendPrintf(entry, "\n");
1620     }
1621 }
1622
1623 static void
1624 parse_acl_tos(acl_tos ** head)
1625 {
1626     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1627     char *token = ConfigParser::NextToken();
1628
1629     if (!token) {
1630         self_destruct();
1631         return;
1632     }
1633
1634     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1635         self_destruct();
1636         return;
1637     }
1638
1639     const unsigned int chTos = tos & 0xFC;
1640     if (chTos != tos) {
1641         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1642         tos = chTos;
1643     }
1644
1645     acl_tos *l = new acl_tos;
1646
1647     l->tos = (tos_t)tos;
1648
1649     aclParseAclList(LegacyParser, &l->aclList, token);
1650
1651     acl_tos **tail = head;  /* sane name below */
1652     while (*tail)
1653         tail = &(*tail)->next;
1654
1655     *tail = l;
1656 }
1657
1658 static void
1659 free_acl_tos(acl_tos ** head)
1660 {
1661     delete *head;
1662     *head = NULL;
1663 }
1664
1665 #if SO_MARK && USE_LIBCAP
1666
1667 static void
1668 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1669 {
1670     for (acl_nfmark *l = head; l; l = l->next) {
1671         storeAppendPrintf(entry, "%s %s", name, ToSBuf(l->markConfig).c_str());
1672
1673         dump_acl_list(entry, l->aclList);
1674
1675         storeAppendPrintf(entry, "\n");
1676     }
1677 }
1678
1679 static void
1680 parse_acl_nfmark(acl_nfmark ** head)
1681 {
1682     SBuf token(ConfigParser::NextToken());
1683     const auto mc = Ip::NfMarkConfig::Parse(token);
1684
1685     // Packet marking directives should not allow to use masks.
1686     const auto pkt_dirs = {"mark_client_packet", "clientside_mark", "tcp_outgoing_mark"};
1687     if (mc.hasMask() && std::find(pkt_dirs.begin(), pkt_dirs.end(), cfg_directive) != pkt_dirs.end())
1688         throw TexcHere(ToSBuf("'", cfg_directive, "' does not support masked marks"));
1689
1690     acl_nfmark *l = new acl_nfmark;
1691     l->markConfig = mc;
1692
1693     aclParseAclList(LegacyParser, &l->aclList, token.c_str());
1694
1695     acl_nfmark **tail = head;   /* sane name below */
1696     while (*tail)
1697         tail = &(*tail)->next;
1698
1699     *tail = l;
1700 }
1701
1702 static void
1703 free_acl_nfmark(acl_nfmark ** head)
1704 {
1705     delete *head;
1706     *head = NULL;
1707 }
1708 #endif /* SO_MARK */
1709
1710 static void
1711 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1712 {
1713     for (AclSizeLimit *l = head; l; l = l->next) {
1714         if (l->size != -1)
1715             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1716         else
1717             storeAppendPrintf(entry, "%s none", name);
1718
1719         dump_acl_list(entry, l->aclList);
1720
1721         storeAppendPrintf(entry, "\n");
1722     }
1723 }
1724
1725 static void
1726 parse_acl_b_size_t(AclSizeLimit ** head)
1727 {
1728     AclSizeLimit *l = new AclSizeLimit;
1729
1730     parse_b_int64_t(&l->size);
1731
1732     aclParseAclList(LegacyParser, &l->aclList, l->size);
1733
1734     AclSizeLimit **tail = head; /* sane name below */
1735     while (*tail)
1736         tail = &(*tail)->next;
1737
1738     *tail = l;
1739 }
1740
1741 static void
1742 free_acl_b_size_t(AclSizeLimit ** head)
1743 {
1744     delete *head;
1745     *head = NULL;
1746 }
1747
1748 #if USE_DELAY_POOLS
1749
1750 #include "DelayConfig.h"
1751 #include "DelayPools.h"
1752 /* do nothing - free_delay_pool_count is the magic free function.
1753  * this is why delay_pool_count isn't just marked TYPE: u_short
1754  */
1755 #define free_delay_pool_class(X)
1756 #define free_delay_pool_access(X)
1757 #define free_delay_pool_rates(X)
1758 #define dump_delay_pool_class(X, Y, Z)
1759 #define dump_delay_pool_access(X, Y, Z)
1760 #define dump_delay_pool_rates(X, Y, Z)
1761
1762 static void
1763 free_delay_pool_count(DelayConfig * cfg)
1764 {
1765     cfg->freePoolCount();
1766 }
1767
1768 static void
1769 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1770 {
1771     cfg.dumpPoolCount (entry, name);
1772 }
1773
1774 static void
1775 parse_delay_pool_count(DelayConfig * cfg)
1776 {
1777     cfg->parsePoolCount();
1778 }
1779
1780 static void
1781 parse_delay_pool_class(DelayConfig * cfg)
1782 {
1783     cfg->parsePoolClass();
1784 }
1785
1786 static void
1787 parse_delay_pool_rates(DelayConfig * cfg)
1788 {
1789     cfg->parsePoolRates();
1790 }
1791
1792 static void
1793 parse_delay_pool_access(DelayConfig * cfg)
1794 {
1795     cfg->parsePoolAccess(LegacyParser);
1796 }
1797
1798 #endif
1799
1800 #if USE_DELAY_POOLS
1801 #include "ClientDelayConfig.h"
1802 /* do nothing - free_client_delay_pool_count is the magic free function.
1803  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1804  */
1805
1806 #define free_client_delay_pool_access(X)
1807 #define free_client_delay_pool_rates(X)
1808 #define dump_client_delay_pool_access(X, Y, Z)
1809 #define dump_client_delay_pool_rates(X, Y, Z)
1810
1811 static void
1812 free_client_delay_pool_count(ClientDelayConfig * cfg)
1813 {
1814     cfg->freePools();
1815 }
1816
1817 static void
1818 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1819 {
1820     cfg.dumpPoolCount (entry, name);
1821 }
1822
1823 static void
1824 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1825 {
1826     cfg->parsePoolCount();
1827 }
1828
1829 static void
1830 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1831 {
1832     cfg->parsePoolRates();
1833 }
1834
1835 static void
1836 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1837 {
1838     cfg->parsePoolAccess(LegacyParser);
1839 }
1840 #endif
1841
1842 #if USE_HTTP_VIOLATIONS
1843 static void
1844 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1845 {
1846     if (manglers)
1847         manglers->dumpAccess(entry, name);
1848 }
1849
1850 static void
1851 parse_http_header_access(HeaderManglers **pm)
1852 {
1853     char *t = NULL;
1854
1855     if ((t = ConfigParser::NextToken()) == NULL) {
1856         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1857         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1858         return;
1859     }
1860
1861     if (!*pm)
1862         *pm = new HeaderManglers;
1863     HeaderManglers *manglers = *pm;
1864     headerMangler *mangler = manglers->track(t);
1865     assert(mangler);
1866
1867     std::string directive = "http_header_access ";
1868     directive += t;
1869     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1870 }
1871
1872 static void
1873 free_HeaderManglers(HeaderManglers **pm)
1874 {
1875     // we delete the entire http_header_* mangler configuration at once
1876     if (const HeaderManglers *manglers = *pm) {
1877         delete manglers;
1878         *pm = NULL;
1879     }
1880 }
1881
1882 static void
1883 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1884 {
1885     if (manglers)
1886         manglers->dumpReplacement(entry, name);
1887 }
1888
1889 static void
1890 parse_http_header_replace(HeaderManglers **pm)
1891 {
1892     char *t = NULL;
1893
1894     if ((t = ConfigParser::NextToken()) == NULL) {
1895         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1896         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1897         return;
1898     }
1899
1900     const char *value = ConfigParser::NextQuotedOrToEol();
1901
1902     if (!*pm)
1903         *pm = new HeaderManglers;
1904     HeaderManglers *manglers = *pm;
1905     manglers->setReplacement(t, value);
1906 }
1907
1908 #endif
1909
1910 static void
1911 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1912 {
1913     Store::Disks::Dump(swap, *entry, name);
1914 }
1915
1916 static int
1917 check_null_string(char *s)
1918 {
1919     return s == NULL;
1920 }
1921
1922 #if USE_AUTH
1923 static void
1924 parse_authparam(Auth::ConfigVector * config)
1925 {
1926     char *type_str = ConfigParser::NextToken();
1927     if (!type_str) {
1928         self_destruct();
1929         return;
1930     }
1931
1932     char *param_str = ConfigParser::NextToken();
1933     if (!param_str) {
1934         self_destruct();
1935         return;
1936     }
1937
1938     /* find a configuration for the scheme in the currently parsed configs... */
1939     Auth::SchemeConfig *schemeCfg = Auth::SchemeConfig::Find(type_str);
1940
1941     if (schemeCfg == NULL) {
1942         /* Create a configuration based on the scheme info */
1943         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1944
1945         if (theScheme == NULL) {
1946             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1947             self_destruct();
1948             return;
1949         }
1950
1951         config->push_back(theScheme->createConfig());
1952         schemeCfg = Auth::SchemeConfig::Find(type_str);
1953         if (schemeCfg == NULL) {
1954             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1955             self_destruct();
1956             return;
1957         }
1958     }
1959
1960     schemeCfg->parse(schemeCfg, config->size(), param_str);
1961 }
1962
1963 static void
1964 free_authparam(Auth::ConfigVector * cfg)
1965 {
1966     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1967     cfg->clear();
1968
1969     /* on reconfigure initialize new auth schemes for the new config. */
1970     if (reconfiguring) {
1971         Auth::Init();
1972     }
1973 }
1974
1975 static void
1976 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1977 {
1978     for (auto *scheme : cfg)
1979         scheme->dump(entry, name, scheme);
1980 }
1981
1982 static void
1983 parse_AuthSchemes(acl_access **authSchemes)
1984 {
1985     const char *tok = ConfigParser::NextQuotedToken();
1986     if (!tok) {
1987         debugs(29, DBG_CRITICAL, "FATAL: auth_schemes missing the parameter");
1988         self_destruct();
1989         return;
1990     }
1991     Auth::TheConfig.schemeLists.emplace_back(tok, ConfigParser::LastTokenWasQuoted());
1992     const auto action = Acl::Answer(ACCESS_ALLOWED, Auth::TheConfig.schemeLists.size() - 1);
1993     ParseAclWithAction(authSchemes, action, "auth_schemes");
1994 }
1995
1996 static void
1997 free_AuthSchemes(acl_access **authSchemes)
1998 {
1999     Auth::TheConfig.schemeLists.clear();
2000     free_acl_access(authSchemes);
2001 }
2002
2003 static void
2004 dump_AuthSchemes(StoreEntry *entry, const char *name, acl_access *authSchemes)
2005 {
2006     if (authSchemes)
2007         dump_SBufList(entry, authSchemes->treeDump(name, [](const Acl::Answer &action) {
2008         return Auth::TheConfig.schemeLists.at(action.kind).rawSchemes;
2009     }));
2010 }
2011
2012 #endif /* USE_AUTH */
2013
2014 static void
2015 ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl)
2016 {
2017     assert(access);
2018     SBuf name;
2019     if (!*access) {
2020         *access = new Acl::Tree;
2021         name.Printf("(%s rules)", desc);
2022         (*access)->context(name.c_str(), config_input_line);
2023     }
2024     Acl::AndNode *rule = new Acl::AndNode;
2025     name.Printf("(%s rule)", desc);
2026     rule->context(name.c_str(), config_input_line);
2027     if (acl)
2028         rule->add(acl);
2029     else
2030         rule->lineParse();
2031     (*access)->add(rule, action);
2032 }
2033
2034 static void
2035 parse_cachedir(Store::DiskConfig *swap)
2036 {
2037     assert(swap);
2038     Store::Disks::Parse(*swap);
2039 }
2040
2041 static const char *
2042 peer_type_str(const peer_t type)
2043 {
2044     const char * result;
2045
2046     switch (type) {
2047
2048     case PEER_PARENT:
2049         result = "parent";
2050         break;
2051
2052     case PEER_SIBLING:
2053         result = "sibling";
2054         break;
2055
2056     case PEER_MULTICAST:
2057         result = "multicast";
2058         break;
2059
2060     default:
2061         result = "unknown";
2062         break;
2063     }
2064
2065     return result;
2066 }
2067
2068 static void
2069 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
2070 {
2071     NeighborTypeDomainList *t;
2072     LOCAL_ARRAY(char, xname, 128);
2073
2074     while (p != NULL) {
2075         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
2076                           name,
2077                           p->host,
2078                           neighborTypeStr(p),
2079                           p->http_port,
2080                           p->icp.port,
2081                           p->name);
2082         dump_peer_options(entry, p);
2083
2084         if (p->access) {
2085             snprintf(xname, 128, "cache_peer_access %s", p->name);
2086             dump_acl_access(entry, xname, p->access);
2087         }
2088
2089         for (t = p->typelist; t; t = t->next) {
2090             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
2091                               p->host,
2092                               peer_type_str(t->type),
2093                               t->domain);
2094         }
2095
2096         p = p->next;
2097     }
2098 }
2099
2100 /**
2101  * utility function to prevent getservbyname() being called with a numeric value
2102  * on Windows at least it returns garage results.
2103  */
2104 static bool
2105 isUnsignedNumeric(const char *str, size_t len)
2106 {
2107     if (len < 1) return false;
2108
2109     for (; len >0 && *str; ++str, --len) {
2110         if (! isdigit(*str))
2111             return false;
2112     }
2113     return true;
2114 }
2115
2116 /**
2117  \param proto   'tcp' or 'udp' for protocol
2118  \returns       Port the named service is supposed to be listening on.
2119  */
2120 static unsigned short
2121 GetService(const char *proto)
2122 {
2123     struct servent *port = NULL;
2124     /** Parses a port number or service name from the squid.conf */
2125     char *token = ConfigParser::NextToken();
2126     if (token == NULL) {
2127         self_destruct();
2128         return 0; /* NEVER REACHED */
2129     }
2130     /** Returns either the service port number from /etc/services */
2131     if ( !isUnsignedNumeric(token, strlen(token)) )
2132         port = getservbyname(token, proto);
2133     if (port != NULL) {
2134         return ntohs((unsigned short)port->s_port);
2135     }
2136     /** Or a numeric translation of the config text. */
2137     return xatos(token);
2138 }
2139
2140 /**
2141  \returns       Port the named TCP service is supposed to be listening on.
2142  \copydoc GetService(const char *proto)
2143  */
2144 inline unsigned short
2145 GetTcpService(void)
2146 {
2147     return GetService("tcp");
2148 }
2149
2150 /**
2151  \returns       Port the named UDP service is supposed to be listening on.
2152  \copydoc GetService(const char *proto)
2153  */
2154 inline unsigned short
2155 GetUdpService(void)
2156 {
2157     return GetService("udp");
2158 }
2159
2160 static void
2161 parse_peer(CachePeer ** head)
2162 {
2163     char *host_str = ConfigParser::NextToken();
2164     if (!host_str) {
2165         self_destruct();
2166         return;
2167     }
2168
2169     char *token = ConfigParser::NextToken();
2170     if (!token) {
2171         self_destruct();
2172         return;
2173     }
2174
2175     CachePeer *p = new CachePeer;
2176     p->host = xstrdup(host_str);
2177     Tolower(p->host);
2178     p->name = xstrdup(host_str);
2179     p->type = parseNeighborType(token);
2180
2181     if (p->type == PEER_MULTICAST) {
2182         p->options.no_digest = true;
2183         p->options.no_netdb_exchange = true;
2184     }
2185
2186     p->http_port = GetTcpService();
2187
2188     if (!p->http_port) {
2189         delete p;
2190         self_destruct();
2191         return;
2192     }
2193
2194     p->icp.port = GetUdpService();
2195
2196     while ((token = ConfigParser::NextToken())) {
2197         if (!strcmp(token, "proxy-only")) {
2198             p->options.proxy_only = true;
2199         } else if (!strcmp(token, "no-query")) {
2200             p->options.no_query = true;
2201         } else if (!strcmp(token, "background-ping")) {
2202             p->options.background_ping = true;
2203         } else if (!strcmp(token, "no-digest")) {
2204             p->options.no_digest = true;
2205         } else if (!strcmp(token, "no-tproxy")) {
2206             p->options.no_tproxy = true;
2207         } else if (!strcmp(token, "multicast-responder")) {
2208             p->options.mcast_responder = true;
2209 #if PEER_MULTICAST_SIBLINGS
2210         } else if (!strcmp(token, "multicast-siblings")) {
2211             p->options.mcast_siblings = true;
2212 #endif
2213         } else if (!strncmp(token, "weight=", 7)) {
2214             p->weight = xatoi(token + 7);
2215         } else if (!strncmp(token, "basetime=", 9)) {
2216             p->basetime = xatoi(token + 9);
2217         } else if (!strcmp(token, "closest-only")) {
2218             p->options.closest_only = true;
2219         } else if (!strncmp(token, "ttl=", 4)) {
2220             p->mcast.ttl = xatoi(token + 4);
2221
2222             if (p->mcast.ttl < 0)
2223                 p->mcast.ttl = 0;
2224
2225             if (p->mcast.ttl > 128)
2226                 p->mcast.ttl = 128;
2227         } else if (!strcmp(token, "default")) {
2228             p->options.default_parent = true;
2229         } else if (!strcmp(token, "round-robin")) {
2230             p->options.roundrobin = true;
2231         } else if (!strcmp(token, "weighted-round-robin")) {
2232             p->options.weighted_roundrobin = true;
2233 #if USE_HTCP
2234         } else if (!strcmp(token, "htcp")) {
2235             p->options.htcp = true;
2236         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2237             /* Note: The htcp- form is deprecated, replaced by htcp= */
2238             p->options.htcp = true;
2239             char *tmp = xstrdup(token+5);
2240             char *mode, *nextmode;
2241             for (mode = nextmode = tmp; mode; mode = nextmode) {
2242                 nextmode = strchr(mode, ',');
2243                 if (nextmode) {
2244                     *nextmode = '\0';
2245                     ++nextmode;
2246                 }
2247                 if (!strcmp(mode, "no-clr")) {
2248                     if (p->options.htcp_only_clr)
2249                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2250                     p->options.htcp_no_clr = true;
2251                 } else if (!strcmp(mode, "no-purge-clr")) {
2252                     p->options.htcp_no_purge_clr = true;
2253                 } else if (!strcmp(mode, "only-clr")) {
2254                     if (p->options.htcp_no_clr)
2255                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2256                     p->options.htcp_only_clr = true;
2257                 } else if (!strcmp(mode, "forward-clr")) {
2258                     p->options.htcp_forward_clr = true;
2259                 } else if (!strcmp(mode, "oldsquid")) {
2260                     p->options.htcp_oldsquid = true;
2261                 } else {
2262                     fatalf("invalid HTCP mode '%s'", mode);
2263                 }
2264             }
2265             safe_free(tmp);
2266 #endif
2267         } else if (!strcmp(token, "no-netdb-exchange")) {
2268             p->options.no_netdb_exchange = true;
2269
2270         } else if (!strcmp(token, "carp")) {
2271             if (p->type != PEER_PARENT)
2272                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2273
2274             p->options.carp = true;
2275         } else if (!strncmp(token, "carp-key=", 9)) {
2276             if (p->options.carp != true)
2277                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2278             p->options.carp_key.set = true;
2279             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2280             for (; key; key = nextkey) {
2281                 nextkey=strchr(key,',');
2282                 if (nextkey) ++nextkey; // skip the comma, any
2283                 if (0==strncmp(key,"scheme",6)) {
2284                     p->options.carp_key.scheme = true;
2285                 } else if (0==strncmp(key,"host",4)) {
2286                     p->options.carp_key.host = true;
2287                 } else if (0==strncmp(key,"port",4)) {
2288                     p->options.carp_key.port = true;
2289                 } else if (0==strncmp(key,"path",4)) {
2290                     p->options.carp_key.path = true;
2291                 } else if (0==strncmp(key,"params",6)) {
2292                     p->options.carp_key.params = true;
2293                 } else {
2294                     fatalf("invalid carp-key '%s'",key);
2295                 }
2296             }
2297         } else if (!strcmp(token, "userhash")) {
2298 #if USE_AUTH
2299             if (p->type != PEER_PARENT)
2300                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2301
2302             p->options.userhash = true;
2303 #else
2304             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2305 #endif
2306         } else if (!strcmp(token, "sourcehash")) {
2307             if (p->type != PEER_PARENT)
2308                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2309
2310             p->options.sourcehash = true;
2311
2312         } else if (!strcmp(token, "no-delay")) {
2313 #if USE_DELAY_POOLS
2314             p->options.no_delay = true;
2315 #else
2316             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2317 #endif
2318         } else if (!strncmp(token, "login=", 6)) {
2319             p->login = xstrdup(token + 6);
2320             rfc1738_unescape(p->login);
2321         } else if (!strcmp(token, "auth-no-keytab")) {
2322             p->options.auth_no_keytab = 1;
2323         } else if (!strncmp(token, "connect-timeout=", 16)) {
2324             p->connect_timeout_raw = xatoi(token + 16);
2325         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2326             p->connect_fail_limit = xatoi(token + 19);
2327 #if USE_CACHE_DIGESTS
2328         } else if (!strncmp(token, "digest-url=", 11)) {
2329             p->digest_url = xstrdup(token + 11);
2330 #endif
2331
2332         } else if (!strcmp(token, "allow-miss")) {
2333             p->options.allow_miss = true;
2334         } else if (!strncmp(token, "max-conn=", 9)) {
2335             p->max_conn = xatoi(token + 9);
2336         } else if (!strncmp(token, "standby=", 8)) {
2337             p->standby.limit = xatoi(token + 8);
2338         } else if (!strcmp(token, "originserver")) {
2339             p->options.originserver = true;
2340         } else if (!strncmp(token, "name=", 5)) {
2341             safe_free(p->name);
2342
2343             if (token[5])
2344                 p->name = xstrdup(token + 5);
2345         } else if (!strncmp(token, "forceddomain=", 13)) {
2346             safe_free(p->domain);
2347             if (token[13])
2348                 p->domain = xstrdup(token + 13);
2349
2350         } else if (strncmp(token, "ssl", 3) == 0) {
2351 #if !USE_OPENSSL
2352             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2353 #else
2354             p->secure.parse(token+3);
2355 #endif
2356         } else if (strncmp(token, "tls-", 4) == 0) {
2357             p->secure.parse(token+4);
2358         } else if (strncmp(token, "tls", 3) == 0) {
2359             p->secure.parse(token+3);
2360         } else if (strcmp(token, "front-end-https") == 0) {
2361             p->front_end_https = 1;
2362         } else if (strcmp(token, "front-end-https=on") == 0) {
2363             p->front_end_https = 1;
2364         } else if (strcmp(token, "front-end-https=auto") == 0) {
2365             p->front_end_https = 2;
2366         } else if (strcmp(token, "connection-auth=off") == 0) {
2367             p->connection_auth = 0;
2368         } else if (strcmp(token, "connection-auth") == 0) {
2369             p->connection_auth = 1;
2370         } else if (strcmp(token, "connection-auth=on") == 0) {
2371             p->connection_auth = 1;
2372         } else if (strcmp(token, "connection-auth=auto") == 0) {
2373             p->connection_auth = 2;
2374         } else if (token[0] == '#') {
2375             // start of a text comment. stop reading this line.
2376             break;
2377         } else {
2378             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2379         }
2380     }
2381
2382     if (peerFindByName(p->name))
2383         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2384
2385     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2386         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2387
2388     if (p->weight < 1)
2389         p->weight = 1;
2390
2391     if (p->connect_fail_limit < 1)
2392         p->connect_fail_limit = 10;
2393
2394 #if USE_CACHE_DIGESTS
2395     if (!p->options.no_digest)
2396         peerDigestCreate(p);
2397 #endif
2398
2399     if (p->secure.encryptTransport)
2400         p->secure.parseOptions();
2401
2402     p->index =  ++Config.npeers;
2403
2404     while (*head != NULL)
2405         head = &(*head)->next;
2406
2407     *head = p;
2408
2409     peerClearRRStart();
2410 }
2411
2412 static void
2413 free_peer(CachePeer ** P)
2414 {
2415     delete *P;
2416     *P = NULL;
2417     Config.npeers = 0;
2418 }
2419
2420 static void
2421 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2422 {
2423     while (list) {
2424         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2425             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2426         else
2427             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2428
2429         for (auto w : list->actions)
2430             entry->appendf(" " SQUIDSBUFPH, SQUIDSBUFPRINT(w));
2431
2432         storeAppendPrintf(entry, "\n");
2433         list = list->next;
2434     }
2435 }
2436
2437 static void
2438 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2439 {
2440     char *passwd = nullptr;
2441     parse_string(&passwd);
2442
2443     Mgr::ActionPasswordList *p = new Mgr::ActionPasswordList;
2444     p->passwd = passwd;
2445
2446     while (char *token = ConfigParser::NextQuotedToken())
2447         p->actions.push_back(SBuf(token));
2448
2449     Mgr::ActionPasswordList **P;
2450     for (P = head; *P; P = &(*P)->next) {
2451         /*
2452          * See if any of the actions from this line already have a
2453          * password from previous lines.  The password checking
2454          * routines in cache_manager.c take the the password from
2455          * the first Mgr::ActionPasswordList that contains the
2456          * requested action.  Thus, we should warn users who might
2457          * think they can have two passwords for the same action.
2458          */
2459         for (const auto &w : (*P)->actions) {
2460             for (const auto &u : p->actions) {
2461                 if (w != u)
2462                     continue;
2463
2464                 debugs(0, DBG_PARSE_NOTE(1), "ERROR: action '" << u << "' (line " << config_lineno << ") already has a password");
2465             }
2466         }
2467     }
2468
2469     *P = p;
2470 }
2471
2472 static void
2473 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2474 {
2475     delete *head;
2476     *head = nullptr;
2477 }
2478
2479 static void
2480 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2481 {
2482     while (var != NULL) {
2483         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2484
2485         for (const auto &aclName: var->acl_list)
2486             storeAppendPrintf(entry, " " SQUIDSBUFPH, SQUIDSBUFPRINT(aclName));
2487
2488         storeAppendPrintf(entry, "\n");
2489
2490         var = var->next;
2491     }
2492 }
2493
2494 static void
2495 parse_denyinfo(AclDenyInfoList ** var)
2496 {
2497     aclParseDenyInfoLine(var);
2498 }
2499
2500 void
2501 free_denyinfo(AclDenyInfoList ** list)
2502 {
2503     delete *list;
2504     *list = nullptr;
2505 }
2506
2507 static void
2508 parse_peer_access(void)
2509 {
2510     char *host = ConfigParser::NextToken();
2511     if (!host) {
2512         self_destruct();
2513         return;
2514     }
2515
2516     CachePeer *p = peerFindByName(host);
2517     if (!p) {
2518         debugs(15, DBG_CRITICAL, "ERROR: " << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2519         return;
2520     }
2521
2522     std::string directive = "peer_access ";
2523     directive += host;
2524     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2525 }
2526
2527 static void
2528 parse_hostdomaintype(void)
2529 {
2530     char *host = ConfigParser::NextToken();
2531     if (!host) {
2532         self_destruct();
2533         return;
2534     }
2535
2536     char *type = ConfigParser::NextToken();
2537     if (!type) {
2538         self_destruct();
2539         return;
2540     }
2541
2542     char *domain = nullptr;
2543     while ((domain = ConfigParser::NextToken())) {
2544         CachePeer *p = peerFindByName(host);
2545         if (!p) {
2546             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2547             return;
2548         }
2549
2550         auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2551         l->type = parseNeighborType(type);
2552         l->domain = xstrdup(domain);
2553
2554         NeighborTypeDomainList **L = nullptr;
2555         for (L = &(p->typelist); *L; L = &((*L)->next));
2556         *L = l;
2557     }
2558 }
2559
2560 static void
2561 dump_int(StoreEntry * entry, const char *name, int var)
2562 {
2563     storeAppendPrintf(entry, "%s %d\n", name, var);
2564 }
2565
2566 void
2567 parse_int(int *var)
2568 {
2569     int i;
2570     i = GetInteger();
2571     *var = i;
2572 }
2573
2574 static void
2575 free_int(int *var)
2576 {
2577     *var = 0;
2578 }
2579
2580 static void
2581 dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2582 {
2583     storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2584 }
2585
2586 void
2587 parse_int64_t(int64_t *var)
2588 {
2589     int64_t i;
2590     i = GetInteger64();
2591     *var = i;
2592 }
2593
2594 static void
2595 free_int64_t(int64_t *var)
2596 {
2597     *var = 0;
2598 }
2599
2600 static void
2601 dump_onoff(StoreEntry * entry, const char *name, int var)
2602 {
2603     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2604 }
2605
2606 void
2607 parse_onoff(int *var)
2608 {
2609     char *token = ConfigParser::NextToken();
2610     if (!token) {
2611         self_destruct();
2612         return;
2613     }
2614
2615     if (!strcmp(token, "on")) {
2616         *var = 1;
2617     } else if (!strcmp(token, "enable")) {
2618         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2619         *var = 1;
2620     } else if (!strcmp(token, "off")) {
2621         *var = 0;
2622     } else if (!strcmp(token, "disable")) {
2623         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2624         *var = 0;
2625     } else {
2626         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2627         self_destruct();
2628     }
2629 }
2630
2631 #define free_onoff free_int
2632
2633 static void
2634 dump_tristate(StoreEntry * entry, const char *name, int var)
2635 {
2636     const char *state;
2637
2638     if (var > 0)
2639         state = "on";
2640     else if (var < 0)
2641         state = "warn";
2642     else
2643         state = "off";
2644
2645     storeAppendPrintf(entry, "%s %s\n", name, state);
2646 }
2647
2648 static void
2649 parse_tristate(int *var)
2650 {
2651     char *token = ConfigParser::NextToken();
2652     if (!token) {
2653         self_destruct();
2654         return;
2655     }
2656
2657     if (!strcmp(token, "on")) {
2658         *var = 1;
2659     } else if (!strcmp(token, "enable")) {
2660         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2661         *var = 1;
2662     } else if (!strcmp(token, "warn")) {
2663         *var = -1;
2664     } else if (!strcmp(token, "off")) {
2665         *var = 0;
2666     } else if (!strcmp(token, "disable")) {
2667         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2668         *var = 0;
2669     } else {
2670         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2671         self_destruct();
2672     }
2673 }
2674
2675 #define free_tristate free_int
2676
2677 void
2678 parse_pipelinePrefetch(int *var)
2679 {
2680     char *token = ConfigParser::PeekAtToken();
2681     if (!token) {
2682         self_destruct();
2683         return;
2684     }
2685
2686     if (!strcmp(token, "on")) {
2687         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2688         *var = 1;
2689         //pop the token
2690         (void)ConfigParser::NextToken();
2691     } else if (!strcmp(token, "off")) {
2692         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2693         *var = 0;
2694         //pop the token
2695         (void)ConfigParser::NextToken();
2696     } else
2697         parse_int(var);
2698 }
2699
2700 #define free_pipelinePrefetch free_int
2701 #define dump_pipelinePrefetch dump_int
2702
2703 static void
2704 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2705 {
2706     while (head != NULL) {
2707         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2708                           name,
2709                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2710                           head->pattern.c_str(),
2711                           (int) head->min / 60,
2712                           (int) (100.0 * head->pct + 0.5),
2713                           (int) head->max / 60);
2714
2715         if (head->max_stale >= 0)
2716             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2717
2718         if (head->flags.refresh_ims)
2719             storeAppendPrintf(entry, " refresh-ims");
2720
2721         if (head->flags.store_stale)
2722             storeAppendPrintf(entry, " store-stale");
2723
2724 #if USE_HTTP_VIOLATIONS
2725
2726         if (head->flags.override_expire)
2727             storeAppendPrintf(entry, " override-expire");
2728
2729         if (head->flags.override_lastmod)
2730             storeAppendPrintf(entry, " override-lastmod");
2731
2732         if (head->flags.reload_into_ims)
2733             storeAppendPrintf(entry, " reload-into-ims");
2734
2735         if (head->flags.ignore_reload)
2736             storeAppendPrintf(entry, " ignore-reload");
2737
2738         if (head->flags.ignore_no_store)
2739             storeAppendPrintf(entry, " ignore-no-store");
2740
2741         if (head->flags.ignore_private)
2742             storeAppendPrintf(entry, " ignore-private");
2743 #endif
2744
2745         storeAppendPrintf(entry, "\n");
2746
2747         head = head->next;
2748     }
2749 }
2750
2751 static void
2752 parse_refreshpattern(RefreshPattern ** head)
2753 {
2754     char *token;
2755     char *pattern;
2756     time_t min = 0;
2757     double pct = 0.0;
2758     time_t max = 0;
2759     int refresh_ims = 0;
2760     int store_stale = 0;
2761     int max_stale = -1;
2762
2763 #if USE_HTTP_VIOLATIONS
2764
2765     int override_expire = 0;
2766     int override_lastmod = 0;
2767     int reload_into_ims = 0;
2768     int ignore_reload = 0;
2769     int ignore_no_store = 0;
2770     int ignore_private = 0;
2771 #endif
2772
2773     int i;
2774     RefreshPattern *t;
2775     regex_t comp;
2776     int errcode;
2777     int flags = REG_EXTENDED | REG_NOSUB;
2778
2779     if ((token = ConfigParser::RegexPattern()) != NULL) {
2780
2781         if (strcmp(token, "-i") == 0) {
2782             flags |= REG_ICASE;
2783             token = ConfigParser::RegexPattern();
2784         } else if (strcmp(token, "+i") == 0) {
2785             flags &= ~REG_ICASE;
2786             token = ConfigParser::RegexPattern();
2787         }
2788
2789     }
2790
2791     if (token == NULL) {
2792         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2793         self_destruct();
2794         return;
2795     }
2796
2797     pattern = xstrdup(token);
2798
2799     i = GetInteger();       /* token: min */
2800
2801     /* catch negative and insanely huge values close to 32-bit wrap */
2802     if (i < 0) {
2803         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2804         i = 0;
2805     }
2806     if (i > 60*24*365) {
2807         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2808         i = 60*24*365;
2809     }
2810
2811     min = (time_t) (i * 60);    /* convert minutes to seconds */
2812
2813     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2814
2815     i = GetInteger();       /* token: max */
2816
2817     /* catch negative and insanely huge values close to 32-bit wrap */
2818     if (i < 0) {
2819         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2820         i = 0;
2821     }
2822     if (i > 60*24*365) {
2823         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2824         i = 60*24*365;
2825     }
2826
2827     max = (time_t) (i * 60);    /* convert minutes to seconds */
2828
2829     /* Options */
2830     while ((token = ConfigParser::NextToken()) != NULL) {
2831         if (!strcmp(token, "refresh-ims")) {
2832             refresh_ims = 1;
2833         } else if (!strcmp(token, "store-stale")) {
2834             store_stale = 1;
2835         } else if (!strncmp(token, "max-stale=", 10)) {
2836             max_stale = xatoi(token + 10);
2837
2838 #if USE_HTTP_VIOLATIONS
2839
2840         } else if (!strcmp(token, "override-expire"))
2841             override_expire = 1;
2842         else if (!strcmp(token, "override-lastmod"))
2843             override_lastmod = 1;
2844         else if (!strcmp(token, "ignore-no-store"))
2845             ignore_no_store = 1;
2846         else if (!strcmp(token, "ignore-private"))
2847             ignore_private = 1;
2848         else if (!strcmp(token, "reload-into-ims")) {
2849             reload_into_ims = 1;
2850             refresh_nocache_hack = 1;
2851             /* tell client_side.c that this is used */
2852         } else if (!strcmp(token, "ignore-reload")) {
2853             ignore_reload = 1;
2854             refresh_nocache_hack = 1;
2855             /* tell client_side.c that this is used */
2856 #endif
2857
2858         } else if (!strcmp(token, "ignore-no-cache") ||
2859                    !strcmp(token, "ignore-must-revalidate") ||
2860                    !strcmp(token, "ignore-auth")
2861                   ) {
2862             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2863         } else
2864             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2865     }
2866
2867     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2868         char errbuf[256];
2869         regerror(errcode, &comp, errbuf, sizeof errbuf);
2870         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2871         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2872         xfree(pattern);
2873         return;
2874     }
2875
2876     pct = pct < 0.0 ? 0.0 : pct;
2877     max = max < 0 ? 0 : max;
2878     t = new RefreshPattern(pattern, flags);
2879     t->pattern.regex = comp;
2880     t->min = min;
2881     t->pct = pct;
2882     t->max = max;
2883
2884     if (refresh_ims)
2885         t->flags.refresh_ims = true;
2886
2887     if (store_stale)
2888         t->flags.store_stale = true;
2889
2890     t->max_stale = max_stale;
2891
2892 #if USE_HTTP_VIOLATIONS
2893
2894     if (override_expire)
2895         t->flags.override_expire = true;
2896
2897     if (override_lastmod)
2898         t->flags.override_lastmod = true;
2899
2900     if (reload_into_ims)
2901         t->flags.reload_into_ims = true;
2902
2903     if (ignore_reload)
2904         t->flags.ignore_reload = true;
2905
2906     if (ignore_no_store)
2907         t->flags.ignore_no_store = true;
2908
2909     if (ignore_private)
2910         t->flags.ignore_private = true;
2911 #endif
2912
2913     t->next = NULL;
2914
2915     while (*head)
2916         head = &(*head)->next;
2917
2918     *head = t;
2919
2920     xfree(pattern);
2921 }
2922
2923 static void
2924 free_refreshpattern(RefreshPattern ** head)
2925 {
2926     delete *head;
2927     *head = nullptr;
2928
2929 #if USE_HTTP_VIOLATIONS
2930     refresh_nocache_hack = 0;
2931
2932 #endif
2933 }
2934
2935 static void
2936 dump_string(StoreEntry * entry, const char *name, char *var)
2937 {
2938     if (var != NULL)
2939         storeAppendPrintf(entry, "%s %s\n", name, var);
2940 }
2941
2942 static void
2943 parse_string(char **var)
2944 {
2945     safe_free(*var);
2946
2947     char *token = ConfigParser::NextToken();
2948     if (!token) {
2949         self_destruct();
2950         return;
2951     }
2952
2953     *var = xstrdup(token);
2954 }
2955
2956 static void
2957 free_string(char **var)
2958 {
2959     safe_free(*var);
2960 }
2961
2962 void
2963 parse_eol(char *volatile *var)
2964 {
2965     if (!var) {
2966         self_destruct();
2967         return;
2968     }
2969
2970     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2971     safe_free(*var);
2972
2973     if (!token) {
2974         self_destruct();
2975         return;
2976     }
2977
2978     while (*token && xisspace(*token))
2979         ++token;
2980
2981     if (!*token) {
2982         self_destruct();
2983         return;
2984     }
2985
2986     *var = xstrdup((char *) token);
2987 }
2988
2989 #define dump_eol dump_string
2990 #define free_eol free_string
2991
2992 static void
2993 parse_TokenOrQuotedString(char **var)
2994 {
2995     safe_free(*var);
2996
2997     char *token = ConfigParser::NextQuotedToken();
2998     if (!token) {
2999         self_destruct();
3000         return;
3001     }
3002
3003     *var = xstrdup(token);
3004 }
3005
3006 #define dump_TokenOrQuotedString dump_string
3007 #define free_TokenOrQuotedString free_string
3008
3009 static void
3010 dump_time_t(StoreEntry * entry, const char *name, time_t var)
3011 {
3012     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
3013 }
3014
3015 void
3016 parse_time_t(time_t * var)
3017 {
3018     const auto maxTime = std::numeric_limits<time_t>::max();
3019     const auto seconds = parseTimeLine<std::chrono::seconds>();
3020     if (maxTime < seconds.count())
3021         throw TexcHere(ToSBuf("directive supports time values up to ", maxTime, " but is given ", seconds.count(), " seconds"));
3022     *var = static_cast<time_t>(seconds.count());
3023 }
3024
3025 static void
3026 free_time_t(time_t * var)
3027 {
3028     *var = 0;
3029 }
3030
3031 static void
3032 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
3033 {
3034     if (var % 1000)
3035         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
3036     else
3037         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
3038 }
3039
3040 void
3041 parse_time_msec(time_msec_t * var)
3042 {
3043     *var = parseTimeLine<std::chrono::milliseconds>().count();
3044 }
3045
3046 static void
3047 free_time_msec(time_msec_t * var)
3048 {
3049     *var = 0;
3050 }
3051
3052 static void
3053 dump_time_nanoseconds(StoreEntry *entry, const char *name, const std::chrono::nanoseconds &var)
3054 {
3055     // std::chrono::nanoseconds::rep is unknown a priori so we cast to (and print) the largest supported integer
3056     storeAppendPrintf(entry, "%s %jd nanoseconds\n", name, static_cast<intmax_t>(var.count()));
3057 }
3058
3059 static void
3060 parse_time_nanoseconds(std::chrono::nanoseconds *var)
3061 {
3062     *var = parseTimeLine<std::chrono::nanoseconds>();
3063 }
3064
3065 static void
3066 free_time_nanoseconds(std::chrono::nanoseconds *var)
3067 {
3068     *var = std::chrono::nanoseconds::zero();
3069 }
3070
3071 static void
3072 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3073 {
3074     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3075 }
3076
3077 static void
3078 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3079 {
3080     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3081 }
3082
3083 static void
3084 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3085 {
3086     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3087 }
3088
3089 static void
3090 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3091 {
3092     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3093 }
3094
3095 static void
3096 parse_b_size_t(size_t * var)
3097 {
3098     parseBytesLine(var, B_BYTES_STR);
3099 }
3100
3101 static void
3102 parse_b_ssize_t(ssize_t * var)
3103 {
3104     parseBytesLineSigned(var, B_BYTES_STR);
3105 }
3106
3107 static void
3108 parse_b_int64_t(int64_t * var)
3109 {
3110     parseBytesLine64(var, B_BYTES_STR);
3111 }
3112
3113 static void
3114 parse_kb_int64_t(int64_t * var)
3115 {
3116     parseBytesLine64(var, B_KBYTES_STR);
3117 }
3118
3119 static void
3120 free_size_t(size_t * var)
3121 {
3122     *var = 0;
3123 }
3124
3125 static void
3126 free_ssize_t(ssize_t * var)
3127 {
3128     *var = 0;
3129 }
3130
3131 static void
3132 free_b_int64_t(int64_t * var)
3133 {
3134     *var = 0;
3135 }
3136
3137 #define free_b_size_t free_size_t
3138 #define free_b_ssize_t free_ssize_t
3139 #define free_kb_size_t free_size_t
3140 #define free_mb_size_t free_size_t
3141 #define free_gb_size_t free_size_t
3142 #define free_kb_int64_t free_b_int64_t
3143
3144 static void
3145 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3146 {
3147     storeAppendPrintf(entry, "%s %d\n", name, var);
3148 }
3149
3150 static void
3151 free_u_short(unsigned short * u)
3152 {
3153     *u = 0;
3154 }
3155
3156 static void
3157 parse_u_short(unsigned short * var)
3158 {
3159     ConfigParser::ParseUShort(var);
3160 }
3161
3162 void
3163 ConfigParser::ParseUShort(unsigned short *var)
3164 {
3165     *var = GetShort();
3166 }
3167
3168 void
3169 ConfigParser::ParseBool(bool *var)
3170 {
3171     int i = GetInteger();
3172
3173     if (0 == i)
3174         *var = false;
3175     else if (1 == i)
3176         *var = true;
3177     else
3178         self_destruct();
3179 }
3180
3181 static void
3182 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3183 {
3184     while (list != NULL) {
3185         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3186         list = list->next;
3187     }
3188 }
3189
3190 void
3191 ConfigParser::ParseWordList(wordlist ** list)
3192 {
3193     parse_wordlist(list);
3194 }
3195
3196 void
3197 parse_wordlist(wordlist ** list)
3198 {
3199     char *token;
3200     while ((token = ConfigParser::NextQuotedToken()))
3201         wordlistAdd(list, token);
3202 }
3203
3204 static int
3205 check_null_acl_access(acl_access * a)
3206 {
3207     return a == NULL;
3208 }
3209
3210 #define free_wordlist wordlistDestroy
3211
3212 #define free_uri_whitespace free_int
3213
3214 static void
3215 parse_uri_whitespace(int *var)
3216 {
3217     char *token = ConfigParser::NextToken();
3218     if (!token) {
3219         self_destruct();
3220         return;
3221     }
3222
3223     if (!strcmp(token, "strip"))
3224         *var = URI_WHITESPACE_STRIP;
3225     else if (!strcmp(token, "deny"))
3226         *var = URI_WHITESPACE_DENY;
3227     else if (!strcmp(token, "allow"))
3228         *var = URI_WHITESPACE_ALLOW;
3229     else if (!strcmp(token, "encode"))
3230         *var = URI_WHITESPACE_ENCODE;
3231     else if (!strcmp(token, "chop"))
3232         *var = URI_WHITESPACE_CHOP;
3233     else {
3234         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3235         self_destruct();
3236     }
3237 }
3238
3239 static void
3240 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3241 {
3242     const char *s;
3243
3244     if (var == URI_WHITESPACE_ALLOW)
3245         s = "allow";
3246     else if (var == URI_WHITESPACE_ENCODE)
3247         s = "encode";
3248     else if (var == URI_WHITESPACE_CHOP)
3249         s = "chop";
3250     else if (var == URI_WHITESPACE_DENY)
3251         s = "deny";
3252     else
3253         s = "strip";
3254
3255     storeAppendPrintf(entry, "%s %s\n", name, s);
3256 }
3257
3258 static void
3259 free_removalpolicy(RemovalPolicySettings ** settings)
3260 {
3261     if (!*settings)
3262         return;
3263
3264     free_string(&(*settings)->type);
3265
3266     free_wordlist(&(*settings)->args);
3267
3268     delete *settings;
3269
3270     *settings = NULL;
3271 }
3272
3273 static void
3274 parse_removalpolicy(RemovalPolicySettings ** settings)
3275 {
3276     if (*settings)
3277         free_removalpolicy(settings);
3278
3279     *settings = new RemovalPolicySettings;
3280
3281     parse_string(&(*settings)->type);
3282
3283     parse_wordlist(&(*settings)->args);
3284 }
3285
3286 static void
3287 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3288 {
3289     wordlist *args;
3290     storeAppendPrintf(entry, "%s %s", name, settings->type);
3291     args = settings->args;
3292
3293     while (args) {
3294         storeAppendPrintf(entry, " %s", args->key);
3295         args = args->next;
3296     }
3297
3298     storeAppendPrintf(entry, "\n");
3299 }
3300
3301 inline void
3302 free_YesNoNone(YesNoNone *)
3303 {}
3304
3305 static void
3306 parse_YesNoNone(YesNoNone *option)
3307 {
3308     int value = 0;
3309     parse_onoff(&value);
3310     option->configure(value > 0);
3311 }
3312
3313 static void
3314 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3315 {
3316     if (option.configured())
3317         dump_onoff(entry, name, option ? 1 : 0);
3318 }
3319
3320 static void
3321 free_memcachemode(SquidConfig *)
3322 {}
3323
3324 static void
3325 parse_memcachemode(SquidConfig *)
3326 {
3327     char *token = ConfigParser::NextToken();
3328     if (!token) {
3329         self_destruct();
3330         return;
3331     }
3332
3333     if (strcmp(token, "always") == 0) {
3334         Config.onoff.memory_cache_first = 1;
3335         Config.onoff.memory_cache_disk = 1;
3336     } else if (strcmp(token, "disk") == 0) {
3337         Config.onoff.memory_cache_first = 0;
3338         Config.onoff.memory_cache_disk = 1;
3339     } else if (strncmp(token, "net", 3) == 0) {
3340         Config.onoff.memory_cache_first = 1;
3341         Config.onoff.memory_cache_disk = 0;
3342     } else if (strcmp(token, "never") == 0) {
3343         Config.onoff.memory_cache_first = 0;
3344         Config.onoff.memory_cache_disk = 0;
3345     } else {
3346         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3347         self_destruct();
3348     }
3349 }
3350
3351 static void
3352 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3353 {
3354     storeAppendPrintf(entry, "%s ", name);
3355     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3356         storeAppendPrintf(entry, "always");
3357     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3358         storeAppendPrintf(entry, "disk");
3359     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3360         storeAppendPrintf(entry, "network");
3361     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3362         storeAppendPrintf(entry, "none");
3363     storeAppendPrintf(entry, "\n");
3364 }
3365
3366 #include "cf_parser.cci"
3367
3368 peer_t
3369 parseNeighborType(const char *s)
3370 {
3371     if (!strcmp(s, "parent"))
3372         return PEER_PARENT;
3373
3374     if (!strcmp(s, "neighbor"))
3375         return PEER_SIBLING;
3376
3377     if (!strcmp(s, "neighbour"))
3378         return PEER_SIBLING;
3379
3380     if (!strcmp(s, "sibling"))
3381         return PEER_SIBLING;
3382
3383     if (!strcmp(s, "multicast"))
3384         return PEER_MULTICAST;
3385
3386     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3387
3388     return PEER_SIBLING;
3389 }
3390
3391 #if USE_WCCPv2
3392 static void
3393 parse_IpAddress_list(Ip::Address_list ** head)
3394 {
3395     char *token;
3396     Ip::Address_list *s;
3397     Ip::Address ipa;
3398
3399     while ((token = ConfigParser::NextToken())) {
3400         if (GetHostWithPort(token, &ipa)) {
3401
3402             while (*head)
3403                 head = &(*head)->next;
3404
3405             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3406             s->s = ipa;
3407
3408             *head = s;
3409         } else {
3410             self_destruct();
3411             return;
3412         }
3413     }
3414 }
3415
3416 static void
3417 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3418 {
3419     char ntoabuf[MAX_IPSTRLEN];
3420
3421     while (s) {
3422         storeAppendPrintf(e, "%s %s\n",
3423                           n,
3424                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3425         s = s->next;
3426     }
3427 }
3428
3429 static void
3430 free_IpAddress_list(Ip::Address_list ** head)
3431 {
3432     if (*head) delete *head;
3433     *head = NULL;
3434 }
3435
3436 #if CURRENTLY_UNUSED
3437 /* This code was previously used by http_port. Left as it really should
3438  * be used by icp_port and htcp_port
3439  */
3440 static int
3441 check_null_IpAddress_list(const Ip::Address_list * s)
3442 {
3443     return NULL == s;
3444 }
3445
3446 #endif /* CURRENTLY_UNUSED */
3447 #endif /* USE_WCCPv2 */
3448
3449 static void
3450 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3451 {
3452     char *host = NULL;
3453     unsigned short port = 0;
3454     char *t = NULL;
3455     char *junk = NULL;
3456
3457     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3458     s->name = xstrdup(token);
3459     s->connection_auth_disabled = false;
3460
3461     const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3462
3463     if (*token == '[') {
3464         /* [ipv6]:port */
3465         host = token + 1;
3466         t = strchr(host, ']');
3467         if (!t) {
3468             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3469             self_destruct();
3470             return;
3471         }
3472         *t = '\0';
3473         ++t;
3474         if (*t != ':') {
3475             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3476             self_destruct();
3477             return;
3478         }
3479         if (!Ip::EnableIpv6) {
3480             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3481             self_destruct();
3482             return;
3483         }
3484         port = xatos(t + 1);
3485     } else if ((t = strchr(token, ':'))) {
3486         /* host:port */
3487         /* ipv4:port */
3488         host = token;
3489         *t = '\0';
3490         port = xatos(t + 1);
3491
3492     } else if (strtol(token, &junk, 10) && !*junk) {
3493         port = xatos(token);
3494         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3495     } else {
3496         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3497         self_destruct();
3498         return;
3499     }
3500
3501     if (port == 0 && host != NULL) {
3502         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3503         self_destruct();
3504         return;
3505     }
3506
3507     if (NULL == host) {
3508         s->s.setAnyAddr();
3509         s->s.port(port);
3510         if (!Ip::EnableIpv6)
3511             s->s.setIPv4();
3512         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3513     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3514         s->s.port(port);
3515         if (!Ip::EnableIpv6)
3516             s->s.setIPv4();
3517         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3518     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3519         /* do not use ipcache */
3520         s->defaultsite = xstrdup(host);
3521         s->s.port(port);
3522         if (!Ip::EnableIpv6)
3523             s->s.setIPv4();
3524         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3525     } else {
3526         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3527         self_destruct();
3528     }
3529 }
3530
3531 /// parses the protocol= option of the *_port directive, returning parsed value
3532 /// unsupported option values result in a fatal error message
3533 /// upper case values required; caller may convert for backward compatibility
3534 static AnyP::ProtocolVersion
3535 parsePortProtocol(const SBuf &value)
3536 {
3537     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3538     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3539     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3540         return Http::ProtocolVersion(1,1);
3541
3542     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3543         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3544
3545     if (value.cmp("FTP") == 0)
3546         return Ftp::ProtocolVersion();
3547
3548     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3549     return AnyP::ProtocolVersion(); // not reached
3550 }
3551
3552 static void
3553 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3554 {
3555     /* modes first */
3556
3557     if (strcmp(token, "accel") == 0) {
3558         if (s->flags.isIntercepted()) {
3559             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3560             self_destruct();
3561             return;
3562         }
3563         s->flags.accelSurrogate = true;
3564         s->vhost = true;
3565     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3566         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3567             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3568             self_destruct();
3569             return;
3570         }
3571         s->flags.natIntercept = true;
3572         Ip::Interceptor.StartInterception();
3573         /* Log information regarding the port modes under interception. */
3574         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3575         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3576     } else if (strcmp(token, "tproxy") == 0) {
3577         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3578             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3579             self_destruct();
3580             return;
3581         }
3582         s->flags.tproxyIntercept = true;
3583         Ip::Interceptor.StartTransparency();
3584         /* Log information regarding the port modes under transparency. */
3585         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3586
3587         if (s->flags.proxySurrogate) {
3588             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3589         }
3590
3591         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3592             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3593             self_destruct();
3594             return;
3595         }
3596
3597     } else if (strcmp(token, "require-proxy-header") == 0) {
3598         s->flags.proxySurrogate = true;
3599         if (s->flags.tproxyIntercept) {
3600             // receiving is still permitted, so we do not unset the TPROXY flag
3601             // spoofing access control override takes care of the spoof disable later
3602             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3603         }
3604
3605     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3606         if (!s->flags.accelSurrogate) {
3607             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3608             self_destruct();
3609             return;
3610         }
3611         safe_free(s->defaultsite);
3612         s->defaultsite = xstrdup(token + 12);
3613     } else if (strcmp(token, "vhost") == 0) {
3614         if (!s->flags.accelSurrogate) {
3615             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3616         }
3617         s->flags.accelSurrogate = true;
3618         s->vhost = true;
3619     } else if (strcmp(token, "no-vhost") == 0) {
3620         if (!s->flags.accelSurrogate) {
3621             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3622         }
3623         s->vhost = false;
3624     } else if (strcmp(token, "vport") == 0) {
3625         if (!s->flags.accelSurrogate) {
3626             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3627             self_destruct();
3628             return;
3629         }
3630         s->vport = -1;
3631     } else if (strncmp(token, "vport=", 6) == 0) {
3632         if (!s->flags.accelSurrogate) {
3633             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3634             self_destruct();
3635             return;
3636         }
3637         s->vport = xatos(token + 6);
3638     } else if (strncmp(token, "protocol=", 9) == 0) {
3639         if (!s->flags.accelSurrogate) {
3640             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3641             self_destruct();
3642             return;
3643         }
3644         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3645     } else if (strcmp(token, "allow-direct") == 0) {
3646         if (!s->flags.accelSurrogate) {
3647             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3648             self_destruct();
3649             return;
3650         }
3651         s->allow_direct = true;
3652     } else if (strcmp(token, "act-as-origin") == 0) {
3653         if (!s->flags.accelSurrogate) {
3654             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3655         } else
3656             s->actAsOrigin = true;
3657     } else if (strcmp(token, "ignore-cc") == 0) {
3658 #if !USE_HTTP_VIOLATIONS
3659         if (!s->flags.accelSurrogate) {
3660             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3661             self_destruct();
3662             return;
3663         }
3664 #endif
3665         s->ignore_cc = true;
3666     } else if (strncmp(token, "name=", 5) == 0) {
3667         safe_free(s->name);
3668         s->name = xstrdup(token + 5);
3669     } else if (strcmp(token, "no-connection-auth") == 0) {
3670         s->connection_auth_disabled = true;
3671     } else if (strcmp(token, "connection-auth=off") == 0) {
3672         s->connection_auth_disabled = true;
3673     } else if (strcmp(token, "connection-auth") == 0) {
3674         s->connection_auth_disabled = false;
3675     } else if (strcmp(token, "connection-auth=on") == 0) {
3676         s->connection_auth_disabled = false;
3677     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3678         if (!strcmp(token + 23, "off"))
3679             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3680         else if (!strcmp(token + 23, "transparent"))
3681             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3682         else if (!strcmp(token + 23, "always"))
3683             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3684         else {
3685             self_destruct();
3686             return;
3687         }
3688     } else if (strcmp(token, "ipv4") == 0) {
3689         if ( !s->s.setIPv4() ) {
3690             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3691             self_destruct();
3692             return;
3693         }
3694     } else if (strcmp(token, "tcpkeepalive") == 0) {
3695         s->tcp_keepalive.enabled = true;
3696     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3697         char *t = token + 13;
3698         s->tcp_keepalive.enabled = true;
3699         s->tcp_keepalive.idle = xatoui(t,',');
3700         t = strchr(t, ',');
3701         if (t) {
3702             ++t;
3703             s->tcp_keepalive.interval = xatoui(t,',');
3704             t = strchr(t, ',');
3705         }
3706         if (t) {
3707             ++t;
3708             s->tcp_keepalive.timeout = xatoui(t);
3709         }
3710 #if USE_OPENSSL
3711     } else if (strcmp(token, "sslBump") == 0) {
3712         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3713                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3714         s->flags.tunnelSslBumping = true;
3715     } else if (strcmp(token, "ssl-bump") == 0) {
3716         s->flags.tunnelSslBumping = true;
3717     } else if (strncmp(token, "cert=", 5) == 0) {
3718         s->secure.parse(token);
3719     } else if (strncmp(token, "key=", 4) == 0) {
3720         s->secure.parse(token);
3721     } else if (strncmp(token, "version=", 8) == 0) {
3722         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3723                "in " << cfg_directive << ". Use 'options=' instead.");
3724         s->secure.parse(token);
3725     } else if (strncmp(token, "options=", 8) == 0) {
3726         s->secure.parse(token);
3727     } else if (strncmp(token, "cipher=", 7) == 0) {
3728         s->secure.parse(token);
3729     } else if (strncmp(token, "clientca=", 9) == 0) {
3730         s->secure.parse(token);
3731     } else if (strncmp(token, "cafile=", 7) == 0) {
3732         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3733                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3734         s->secure.parse(token);
3735     } else if (strncmp(token, "capath=", 7) == 0) {
3736         s->secure.parse(token);
3737     } else if (strncmp(token, "crlfile=", 8) == 0) {
3738         s->secure.parse(token);
3739     } else if (strncmp(token, "dhparams=", 9) == 0) {
3740         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3741                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3742         s->secure.parse(token);
3743     } else if (strncmp(token, "sslflags=", 9) == 0) {
3744         // NP: deprecation warnings output by secure.parse() when relevant
3745         s->secure.parse(token+3);
3746     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3747         // NP: deprecation warnings output by secure.parse() when relevant
3748         s->secure.parse(token+3);
3749     } else if (strncmp(token, "generate-host-certificates", 26) == 0) {
3750         s->secure.parse(token);
3751 #endif
3752     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3753         s->secure.parse(token);
3754     } else if (strncmp(token, "tls-", 4) == 0) {
3755         s->secure.parse(token+4);
3756     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3757         s->ftp_track_dirs = true;
3758     } else if (strcmp(token, "worker-queues") == 0) {
3759 #if !defined(SO_REUSEADDR)
3760 #error missing system #include that #defines SO_* constants
3761 #endif
3762 #if !defined(SO_REUSEPORT)
3763         throw TexcHere(ToSBuf(cfg_directive, ' ', token, " option requires building Squid where SO_REUSEPORT is supported by the TCP stack"));
3764 #endif
3765         s->workerQueues = true;
3766     } else {
3767         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3768         self_destruct();
3769     }
3770 }
3771
3772 void
3773 add_http_port(char *portspec)
3774 {
3775     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3776     s->transport = parsePortProtocol(SBuf("HTTP"));
3777     parsePortSpecification(s, portspec);
3778     // we may need to merge better if the above returns a list with clones
3779     assert(s->next == NULL);
3780     s->next = HttpPortList;
3781     HttpPortList = s;
3782 }
3783
3784 static void
3785 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3786 {
3787     SBuf protoName;
3788     if (strcmp(optionName, "http_port") == 0 ||
3789             strcmp(optionName, "ascii_port") == 0)
3790         protoName = "HTTP";
3791     else if (strcmp(optionName, "https_port") == 0)
3792         protoName = "HTTPS";
3793     else if (strcmp(optionName, "ftp_port") == 0)
3794         protoName = "FTP";
3795     if (protoName.isEmpty()) {
3796         self_destruct();
3797         return;
3798     }
3799
3800     char *token = ConfigParser::NextToken();
3801
3802     if (!token) {
3803         self_destruct();
3804         return;
3805     }
3806
3807     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3808     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3809     parsePortSpecification(s, token);
3810
3811     /* parse options ... */
3812     while ((token = ConfigParser::NextToken())) {
3813         parse_port_option(s, token);
3814     }
3815
3816     s->secure.syncCaFiles();
3817
3818     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3819         s->secure.encryptTransport = true;
3820 #if USE_OPENSSL
3821         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3822         const bool hijacked = s->flags.isIntercepted();
3823         if (s->flags.tunnelSslBumping && !hijacked) {
3824             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3825             self_destruct();
3826             return;
3827         }
3828         if (hijacked && !s->flags.tunnelSslBumping) {
3829             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3830             self_destruct();
3831             return;
3832         }
3833 #endif
3834         if (s->flags.proxySurrogate) {
3835             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3836             self_destruct();
3837             return;
3838         }
3839     } else if (protoName.cmp("FTP") == 0) {
3840         /* ftp_port does not support ssl-bump */
3841         if (s->flags.tunnelSslBumping) {
3842             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3843             self_destruct();
3844             return;
3845         }
3846         if (s->flags.proxySurrogate) {
3847             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3848             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3849             self_destruct();
3850             return;
3851         }
3852     }
3853
3854     if (s->secure.encryptTransport) {
3855         if (s->secure.certs.empty()) {
3856             debugs(3, DBG_CRITICAL, "FATAL: " << AnyP::UriScheme(s->transport.protocol) << "_port requires a cert= parameter");
3857             self_destruct();
3858             return;
3859         }
3860         s->secure.parseOptions();
3861     }
3862
3863     // *_port line should now be fully valid so we can clone it if necessary
3864     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3865         // clone the port options from *s to *(s->next)
3866         s->next = s->clone();
3867         s->next->s.setIPv4();
3868         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).image() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3869     }
3870
3871     while (*head != NULL)
3872         head = &((*head)->next);
3873
3874     *head = s;
3875 }
3876
3877 static void
3878 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3879 {
3880     char buf[MAX_IPSTRLEN];
3881
3882     storeAppendPrintf(e, "%s %s",
3883                       n,
3884                       s->s.toUrl(buf,MAX_IPSTRLEN));
3885
3886     // MODES and specific sub-options.
3887     if (s->flags.natIntercept)
3888         storeAppendPrintf(e, " intercept");
3889
3890     else if (s->flags.tproxyIntercept)
3891         storeAppendPrintf(e, " tproxy");
3892
3893     else if (s->flags.proxySurrogate)
3894         storeAppendPrintf(e, " require-proxy-header");
3895
3896     else if (s->flags.accelSurrogate) {
3897         storeAppendPrintf(e, " accel");
3898
3899         if (s->vhost)
3900             storeAppendPrintf(e, " vhost");
3901
3902         if (s->vport < 0)
3903             storeAppendPrintf(e, " vport");
3904         else if (s->vport > 0)
3905             storeAppendPrintf(e, " vport=%d", s->vport);
3906
3907         if (s->defaultsite)
3908             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3909
3910         // TODO: compare against prefix of 'n' instead of assuming http_port
3911         if (s->transport.protocol != AnyP::PROTO_HTTP)
3912             storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3913
3914         if (s->allow_direct)
3915             storeAppendPrintf(e, " allow-direct");
3916
3917         if (s->ignore_cc)
3918             storeAppendPrintf(e, " ignore-cc");
3919
3920     }
3921
3922     // Generic independent options
3923
3924     if (s->name)
3925         storeAppendPrintf(e, " name=%s", s->name);
3926
3927 #if USE_HTTP_VIOLATIONS
3928     if (!s->flags.accelSurrogate && s->ignore_cc)
3929         storeAppendPrintf(e, " ignore-cc");
3930 #endif
3931
3932     if (s->connection_auth_disabled)
3933         storeAppendPrintf(e, " connection-auth=off");
3934     else
3935         storeAppendPrintf(e, " connection-auth=on");
3936
3937     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3938         const char *pmtu;
3939
3940         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3941             pmtu = "always";
3942         else
3943             pmtu = "transparent";
3944
3945         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3946     }
3947
3948     if (s->s.isAnyAddr() && !s->s.isIPv6())
3949         storeAppendPrintf(e, " ipv4");
3950
3951     if (s->tcp_keepalive.enabled) {
3952         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3953             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3954         } else {
3955             storeAppendPrintf(e, " tcpkeepalive");
3956         }
3957     }
3958
3959 #if USE_OPENSSL
3960     if (s->flags.tunnelSslBumping)
3961         storeAppendPrintf(e, " ssl-bump");
3962 #endif
3963
3964     s->secure.dumpCfg(e, "tls-");
3965 }
3966
3967 static void
3968 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3969 {
3970     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3971         dump_generic_port(e, n, p);
3972         storeAppendPrintf(e, "\n");
3973     }
3974 }
3975
3976 void
3977 configFreeMemory(void)
3978 {
3979     free_all();
3980     Config.ssl_client.sslContext.reset();
3981 #if USE_OPENSSL
3982     Ssl::unloadSquidUntrusted();
3983 #endif
3984 }
3985
3986 void
3987 requirePathnameExists(const char *name, const char *path)
3988 {
3989
3990     struct stat sb;
3991     char pathbuf[BUFSIZ];
3992     assert(path != NULL);
3993
3994     if (Config.chroot_dir && (geteuid() == 0)) {
3995         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3996         path = pathbuf;
3997     }
3998
3999     if (stat(path, &sb) < 0) {
4000         int xerrno = errno;
4001         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
4002         // keep going to find more issues if we are only checking the config file with "-k parse"
4003         if (opt_parse_cfg_only)
4004             return;
4005         // this is fatal if it is found during startup or reconfigure
4006         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
4007             fatalf("%s %s: %s", name, path, xstrerr(xerrno));
4008     }
4009 }
4010
4011 #include "AccessLogEntry.h"
4012
4013 /**
4014  * We support several access_log configuration styles:
4015  *
4016  * #1: Deprecated ancient style without an explicit logging module:
4017  * access_log /var/log/access.log
4018  *
4019  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
4020  * access_log none [acl ...]
4021  *
4022  * #3: Configurable logging module without named options:
4023  * Logformat or the first ACL name, whichever comes first, may not contain '='.
4024  * If no explicit logformat name is given, the first ACL name, if any,
4025  * should not be an existing logformat name or it will be treated as such.
4026  * access_log module:place [logformat_name] [acl ...]
4027  *
4028  * #4: Configurable logging module with name=value options such as logformat=x:
4029  * The first ACL name may not contain '='.
4030  * Without any optional parts, directives using this style are indistinguishable
4031  * from directives using style #1 until we start requiring the "module:" prefix.
4032  * access_log module:place [option ...] [acl ...]
4033  *
4034  */
4035 static void
4036 parse_access_log(CustomLog ** logs)
4037 {
4038     const char *filename = ConfigParser::NextToken();
4039     if (!filename) {
4040         self_destruct();
4041         return;
4042     }
4043
4044     const auto cl = new CustomLog();
4045
4046     cl->filename = xstrdup(filename);
4047
4048     if (strcmp(filename, "none") == 0) {
4049         cl->type = Log::Format::CLF_NONE;
4050         aclParseAclList(LegacyParser, &cl->aclList, filename);
4051         while (*logs)
4052             logs = &(*logs)->next;
4053         *logs = cl;
4054         return;
4055     }
4056
4057     const char *token = ConfigParser::PeekAtToken();
4058     if (token && !strchr(token, '=')) { // style #3
4059         // TODO: Deprecate this style to avoid this dangerous guessing.
4060         if (Log::TheConfig.knownFormat(token)) {
4061             cl->setLogformat(token);
4062             (void)ConfigParser::NextToken(); // consume the token used above
4063         } else {
4064             // assume there is no explicit logformat name and use the default
4065             cl->setLogformat("squid");
4066         }
4067     } else { // style #1 or style #4
4068         // TODO: Drop deprecated style #1 support. We already warn about it, and
4069         // its exceptional treatment makes detecting "module" typos impractical!
4070         cl->parseOptions(LegacyParser, "squid");
4071     }
4072     assert(cl->type); // setLogformat() was called
4073
4074     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4075
4076     while (*logs)
4077         logs = &(*logs)->next;
4078
4079     *logs = cl;
4080 }
4081
4082 static int
4083 check_null_access_log(CustomLog *customlog_definitions)
4084 {
4085     return customlog_definitions == NULL;
4086 }
4087
4088 static void
4089 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4090 {
4091     assert(entry);
4092     for (auto log = logs; log; log = log->next) {
4093         {
4094             PackableStream os(*entry);
4095             os << name; // directive name
4096             os << ' ' << log->filename; // including "none"
4097             log->dumpOptions(os);
4098         }
4099
4100         if (log->aclList)
4101             dump_acl_list(entry, log->aclList);
4102
4103         storeAppendPrintf(entry, "\n");
4104     }
4105 }
4106
4107 static void
4108 free_access_log(CustomLog ** definitions)
4109 {
4110     while (*definitions) {
4111         CustomLog *log = *definitions;
4112         *definitions = log->next;
4113         delete log;
4114     }
4115 }
4116
4117 #if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4118 /// parses list of integers form name=N1,N2,N3,...
4119 static bool
4120 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4121 {
4122     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4123         data += name.size();
4124         if (*data == '=') {
4125             while (true) {
4126                 ++data;
4127                 int value = 0;
4128                 if (!StringToInt(data, value, &data, 10))
4129                     break;
4130                 list.push_back(value);
4131                 if (*data == '\0' || *data != ',')
4132                     break;
4133             }
4134         }
4135     }
4136     return data && *data == '\0';
4137 }
4138 #endif
4139
4140 static void
4141 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4142 {
4143 #if !HAVE_CPU_AFFINITY
4144     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4145            "support, do not set 'cpu_affinity_map'");
4146     self_destruct();
4147
4148 #else /* HAVE_CPU_AFFINITY */
4149     if (!*cpuAffinityMap)
4150         *cpuAffinityMap = new CpuAffinityMap;
4151
4152     const char *const pToken = ConfigParser::NextToken();
4153     const char *const cToken = ConfigParser::NextToken();
4154     std::vector<int> processes, cores;
4155     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4156         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4157                "in 'cpu_affinity_map'");
4158         self_destruct();
4159     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4160         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4161                "'cpu_affinity_map'");
4162         self_destruct();
4163     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4164         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4165                "process_numbers and cores lists differ in length or " <<
4166                "contain numbers <= 0");
4167         self_destruct();
4168     }
4169 #endif
4170 }
4171
4172 static void
4173 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4174 {
4175     if (cpuAffinityMap) {
4176         storeAppendPrintf(entry, "%s process_numbers=", name);
4177         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4178             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4179                               cpuAffinityMap->processes()[i]);
4180         }
4181         storeAppendPrintf(entry, " cores=");
4182         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4183             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4184                               cpuAffinityMap->cores()[i]);
4185         }
4186         storeAppendPrintf(entry, "\n");
4187     }
4188 }
4189
4190 static void
4191 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4192 {
4193     delete *cpuAffinityMap;
4194     *cpuAffinityMap = NULL;
4195 }
4196
4197 #if USE_ADAPTATION
4198
4199 static void
4200 parse_adaptation_service_set_type()
4201 {
4202     Adaptation::Config::ParseServiceSet();
4203 }
4204
4205 static void
4206 parse_adaptation_service_chain_type()
4207 {
4208     Adaptation::Config::ParseServiceChain();
4209 }
4210
4211 static void
4212 parse_adaptation_access_type()
4213 {
4214     Adaptation::Config::ParseAccess(LegacyParser);
4215 }
4216 #endif /* USE_ADAPTATION */
4217
4218 #if ICAP_CLIENT
4219
4220 static void
4221 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4222 {
4223     cfg->parseService();
4224 }
4225
4226 static void
4227 free_icap_service_type(Adaptation::Icap::Config * cfg)
4228 {
4229     cfg->freeService();
4230 }
4231
4232 static void
4233 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4234 {
4235     cfg.dumpService(entry, name);
4236 }
4237
4238 static void
4239 parse_icap_class_type()
4240 {
4241     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is deprecated. " <<
4242            "Use 'adaptation_service_set' instead");
4243     Adaptation::Config::ParseServiceSet();
4244 }
4245
4246 static void
4247 parse_icap_access_type()
4248 {
4249     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is deprecated. " <<
4250            "Use 'adaptation_access' instead");
4251     Adaptation::Config::ParseAccess(LegacyParser);
4252 }
4253
4254 #endif
4255
4256 #if USE_ECAP
4257
4258 static void
4259 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4260 {
4261     cfg->parseService();
4262 }
4263
4264 static void
4265 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4266 {
4267     cfg->freeService();
4268 }
4269
4270 static void
4271 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4272 {
4273     cfg.dumpService(entry, name);
4274 }
4275
4276 #endif /* USE_ECAP */
4277
4278 #if ICAP_CLIENT
4279 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4280 {
4281     char *token;
4282     cfg->service_failure_limit = GetInteger();
4283
4284     if ((token = ConfigParser::NextToken()) == NULL)
4285         return;
4286
4287     if (strcmp(token,"in") != 0) {
4288         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4289         self_destruct();
4290         return;
4291     }
4292
4293     parse_time_t(&cfg->oldest_service_failure);
4294 }
4295
4296 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4297 {
4298     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4299     if (cfg.oldest_service_failure > 0) {
4300         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4301     }
4302     storeAppendPrintf(entry, "\n");
4303 }
4304
4305 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4306 {
4307     cfg->oldest_service_failure = 0;
4308     cfg->service_failure_limit = 0;
4309 }
4310 #endif
4311
4312 #if USE_OPENSSL
4313 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4314 {
4315     char *al;
4316     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4317     if ((al = ConfigParser::NextToken()) == NULL) {
4318         xfree(ca);
4319         self_destruct();
4320         return;
4321     }
4322
4323     const char *param;
4324     if ( char *s = strchr(al, '{')) {
4325         *s = '\0'; // terminate the al string
4326         ++s;
4327         param = s;
4328         s = strchr(s, '}');
4329         if (!s) {
4330             xfree(ca);
4331             self_destruct();
4332             return;
4333         }
4334         *s = '\0';
4335     } else
4336         param = NULL;
4337
4338     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4339         ca->alg = Ssl::algSetValidAfter;
4340         ca->param = xstrdup("on");
4341     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4342         ca->alg = Ssl::algSetValidBefore;
4343         ca->param = xstrdup("on");
4344     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4345         ca->alg = Ssl::algSetCommonName;
4346         if (param) {
4347             if (strlen(param) > 64) {
4348                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4349                 xfree(ca);
4350                 self_destruct();
4351                 return;
4352             }
4353             ca->param = xstrdup(param);
4354         }
4355     } else {
4356         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4357         xfree(ca);
4358         self_destruct();
4359         return;
4360     }
4361
4362     aclParseAclList(LegacyParser, &ca->aclList, al);
4363
4364     while (*cert_adapt)
4365         cert_adapt = &(*cert_adapt)->next;
4366
4367     *cert_adapt = ca;
4368 }
4369
4370 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4371 {
4372     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4373         storeAppendPrintf(entry, "%s ", name);
4374         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4375         if (ca->aclList)
4376             dump_acl_list(entry, ca->aclList);
4377         storeAppendPrintf(entry, "\n");
4378     }
4379 }
4380
4381 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4382 {
4383     while (*cert_adapt) {
4384         sslproxy_cert_adapt *ca = *cert_adapt;
4385         *cert_adapt = ca->next;
4386         safe_free(ca->param);
4387
4388         if (ca->aclList)
4389             aclDestroyAclList(&ca->aclList);
4390
4391         safe_free(ca);
4392     }
4393 }
4394
4395 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4396 {
4397     char *al;
4398     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4399     if ((al = ConfigParser::NextToken()) == NULL) {
4400         xfree(cs);
4401         self_destruct();
4402         return;
4403     }
4404
4405     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4406         cs->alg = Ssl::algSignTrusted;
4407     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4408         cs->alg = Ssl::algSignUntrusted;
4409     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4410         cs->alg = Ssl::algSignSelf;
4411     else {
4412         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4413         xfree(cs);
4414         self_destruct();
4415         return;
4416     }
4417
4418     aclParseAclList(LegacyParser, &cs->aclList, al);
4419
4420     while (*cert_sign)
4421         cert_sign = &(*cert_sign)->next;
4422
4423     *cert_sign = cs;
4424 }
4425
4426 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4427 {
4428     sslproxy_cert_sign *cs;
4429     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4430         storeAppendPrintf(entry, "%s ", name);
4431         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4432         if (cs->aclList)
4433             dump_acl_list(entry, cs->aclList);
4434         storeAppendPrintf(entry, "\n");
4435     }
4436 }
4437
4438 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4439 {
4440     while (*cert_sign) {
4441         sslproxy_cert_sign *cs = *cert_sign;
4442         *cert_sign = cs->next;
4443
4444         if (cs->aclList)
4445             aclDestroyAclList(&cs->aclList);
4446
4447         safe_free(cs);
4448     }
4449 }
4450
4451 class sslBumpCfgRr: public ::RegisteredRunner
4452 {
4453 public:
4454     static Ssl::BumpMode lastDeprecatedRule;
4455     /* RegisteredRunner API */
4456     virtual void finalizeConfig();
4457 };
4458
4459 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4460
4461 RunnerRegistrationEntry(sslBumpCfgRr);
4462
4463 void
4464 sslBumpCfgRr::finalizeConfig()
4465 {
4466     if (lastDeprecatedRule != Ssl::bumpEnd) {
4467         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4468         static char buf[1024];
4469         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4470             strcpy(buf, "ssl_bump deny all");
4471             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4472                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4473                    "must not use implicit rules. Update your ssl_bump rules.");
4474         } else {
4475             strcpy(buf, "ssl_bump allow all");
4476             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4477                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4478                    "inferior to the newer server-first bumping mode. New ssl_bump"
4479                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4480         }
4481         parse_line(buf);
4482     }
4483 }
4484
4485 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4486 {
4487     typedef const char *BumpCfgStyle;
4488     BumpCfgStyle bcsNone = NULL;
4489     BumpCfgStyle bcsNew = "new client/server-first/none";
4490     BumpCfgStyle bcsOld = "deprecated allow/deny";
4491     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4492     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4493     char *bm;
4494     if ((bm = ConfigParser::NextToken()) == NULL) {
4495         self_destruct();
4496         return;
4497     }
4498
4499     // if this is the first rule processed
4500     if (*ssl_bump == NULL) {
4501         bumpCfgStyleLast = bcsNone;
4502         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4503     }
4504
4505     auto action = Acl::Answer(ACCESS_ALLOWED);
4506
4507     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4508         action.kind = Ssl::bumpClientFirst;
4509         bumpCfgStyleNow = bcsNew;
4510     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4511         action.kind = Ssl::bumpServerFirst;
4512         bumpCfgStyleNow = bcsNew;
4513     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4514         action.kind = Ssl::bumpPeek;
4515         bumpCfgStyleNow = bcsNew;
4516     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4517         action.kind = Ssl::bumpStare;
4518         bumpCfgStyleNow = bcsNew;
4519     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4520         action.kind = Ssl::bumpSplice;
4521         bumpCfgStyleNow = bcsNew;
4522     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4523         action.kind = Ssl::bumpBump;
4524         bumpCfgStyleNow = bcsNew;
4525     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4526         action.kind = Ssl::bumpTerminate;
4527         bumpCfgStyleNow = bcsNew;
4528     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4529         action.kind = Ssl::bumpNone;
4530         bumpCfgStyleNow = bcsNew;
4531     } else if (strcmp(bm, "allow") == 0) {
4532         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4533                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4534                "is usually inferior to the newer server-first "
4535                "bumping mode. Update your ssl_bump rules.");
4536         action.kind = Ssl::bumpClientFirst;
4537         bumpCfgStyleNow = bcsOld;
4538         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4539     } else if (strcmp(bm, "deny") == 0) {
4540         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4541                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4542                "your ssl_bump rules.");
4543         action.kind = Ssl::bumpNone;
4544         bumpCfgStyleNow = bcsOld;
4545         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4546     } else {
4547         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4548         self_destruct();
4549         return;
4550     }
4551
4552     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4553         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4554                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4555         self_destruct();
4556         return;
4557     }
4558
4559     bumpCfgStyleLast = bumpCfgStyleNow;
4560
4561     // empty rule OK
4562     ParseAclWithAction(ssl_bump, action, "ssl_bump");
4563 }
4564
4565 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4566 {
4567     if (ssl_bump)
4568         dump_SBufList(entry, ssl_bump->treeDump(name, [](const Acl::Answer &action) {
4569         return Ssl::BumpModeStr.at(action.kind);
4570     }));
4571 }
4572
4573 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4574 {
4575     free_acl_access(ssl_bump);
4576 }
4577
4578 #endif
4579
4580 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4581 {
4582     if (!headers)
4583         return;
4584
4585     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4586         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4587         if (hwa->aclList)
4588             dump_acl_list(entry, hwa->aclList);
4589         storeAppendPrintf(entry, "\n");
4590     }
4591 }
4592
4593 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4594 {
4595     char *fn;
4596     if (!*headers) {
4597         *headers = new HeaderWithAclList;
4598     }
4599     if ((fn = ConfigParser::NextToken()) == NULL) {
4600         self_destruct();
4601         return;
4602     }
4603     HeaderWithAcl hwa;
4604     hwa.fieldName = fn;
4605     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4606     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4607         hwa.fieldId = Http::HdrType::OTHER;
4608
4609     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4610     ConfigParser::EnableMacros();
4611     String buf = ConfigParser::NextQuotedToken();
4612     ConfigParser::DisableMacros();
4613     hwa.fieldValue = buf.termedBuf();
4614     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4615     if (hwa.quoted) {
4616         if (!nlf->parse(hwa.fieldValue.c_str())) {
4617             self_destruct();
4618             return;
4619         }
4620         hwa.valueFormat = nlf;
4621     } else
4622         delete nlf;
4623     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4624     (*headers)->push_back(hwa);
4625 }
4626
4627 static void free_HeaderWithAclList(HeaderWithAclList **header)
4628 {
4629     if (!(*header))
4630         return;
4631
4632     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4633         if (hwa->aclList)
4634             aclDestroyAclList(&hwa->aclList);
4635
4636         if (hwa->valueFormat) {
4637             delete hwa->valueFormat;
4638             hwa->valueFormat = NULL;
4639         }
4640     }
4641     delete *header;
4642     *header = NULL;
4643 }
4644
4645 static void parse_note(Notes *notes)
4646 {
4647     assert(notes);
4648     notes->parse(LegacyParser);
4649 }
4650
4651 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4652 {
4653     notes.dump(entry, name);
4654 }
4655
4656 static void free_note(Notes *notes)
4657 {
4658     notes->clean();
4659 }
4660
4661 static bool FtpEspvDeprecated = false;
4662 static void parse_ftp_epsv(acl_access **ftp_epsv)
4663 {
4664     Acl::Answer ftpEpsvDeprecatedAction;
4665     bool ftpEpsvIsDeprecatedRule = false;
4666
4667     char *t = ConfigParser::PeekAtToken();
4668     if (!t) {
4669         self_destruct();
4670         return;
4671     }
4672
4673     if (!strcmp(t, "off")) {
4674         (void)ConfigParser::NextToken();
4675         ftpEpsvIsDeprecatedRule = true;
4676         ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_DENIED);
4677     } else if (!strcmp(t, "on")) {
4678         (void)ConfigParser::NextToken();
4679         ftpEpsvIsDeprecatedRule = true;
4680         ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_ALLOWED);
4681     }
4682
4683     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4684     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4685     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4686     // then abort
4687     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4688             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4689         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4690         self_destruct();
4691         return;
4692     }
4693
4694     if (ftpEpsvIsDeprecatedRule) {
4695         // overwrite previous ftp_epsv lines
4696         delete *ftp_epsv;
4697         *ftp_epsv = nullptr;
4698
4699         if (ftpEpsvDeprecatedAction == Acl::Answer(ACCESS_DENIED)) {
4700             if (ACL *a = ACL::FindByName("all"))
4701                 ParseAclWithAction(ftp_epsv, ftpEpsvDeprecatedAction, "ftp_epsv", a);
4702             else {
4703                 self_destruct();
4704                 return;
4705             }
4706         }
4707         FtpEspvDeprecated = true;
4708     } else {
4709         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4710     }
4711 }
4712
4713 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4714 {
4715     if (ftp_epsv)
4716         dump_SBufList(entry, ftp_epsv->treeDump(name, Acl::AllowOrDeny));
4717 }
4718
4719 static void free_ftp_epsv(acl_access **ftp_epsv)
4720 {
4721     free_acl_access(ftp_epsv);
4722     FtpEspvDeprecated = false;
4723 }
4724
4725 /// Like parseTimeLine() but does not require the timeunit to be specified.
4726 /// If missed, the default 'second' timeunit is assumed.
4727 static std::chrono::seconds
4728 ParseUrlRewriteTimeout()
4729 {
4730     const auto timeValueToken = ConfigParser::NextToken();
4731     if (!timeValueToken)
4732         throw TexcHere("cannot read a time value");
4733
4734     using Seconds = std::chrono::seconds;
4735
4736     const auto parsedTimeValue = xatof(timeValueToken);
4737
4738     if (parsedTimeValue == 0)
4739         return std::chrono::seconds::zero();
4740
4741     std::chrono::nanoseconds parsedUnitDuration;
4742
4743     const auto unitToken = ConfigParser::PeekAtToken();
4744     if (parseTimeUnit<Seconds>(unitToken, parsedUnitDuration))
4745         (void)ConfigParser::NextToken();
4746     else {
4747         const auto defaultParsed = parseTimeUnit<Seconds>(T_SECOND_STR, parsedUnitDuration);
4748         assert(defaultParsed);
4749         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), ConfigParser::CurrentLocation() <<
4750                ": WARNING: missing time unit, using deprecated default '" << T_SECOND_STR << "'");
4751     }
4752
4753     const auto nanoseconds = ToNanoSeconds(parsedTimeValue, parsedUnitDuration);
4754
4755     return FromNanoseconds<Seconds>(nanoseconds, parsedTimeValue);
4756 }
4757
4758 static void
4759 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4760 {
4761     // TODO: do not allow optional timeunit (as the documentation prescribes)
4762     // and use parseTimeLine() instead.
4763     Config.Timeout.urlRewrite = ParseUrlRewriteTimeout().count();
4764
4765     char *key, *value;
4766     while(ConfigParser::NextKvPair(key, value)) {
4767         if (strcasecmp(key, "on_timeout") == 0) {
4768             if (strcasecmp(value, "bypass") == 0)
4769                 config->action = toutActBypass;
4770             else if (strcasecmp(value, "fail") == 0)
4771                 config->action = toutActFail;
4772             else if (strcasecmp(value, "retry") == 0)
4773                 config->action = toutActRetry;
4774             else if (strcasecmp(value, "use_configured_response") == 0) {
4775                 config->action = toutActUseConfiguredResponse;
4776             } else {
4777                 debugs(3, DBG_CRITICAL, "FATAL: unsupported \"on_timeout\" action: " << value);
4778                 self_destruct();
4779                 return;
4780             }
4781         } else if (strcasecmp(key, "response") == 0) {
4782             config->response = xstrdup(value);
4783         } else {
4784             debugs(3, DBG_CRITICAL, "FATAL: unsupported option " << key);
4785             self_destruct();
4786             return;
4787         }
4788     }
4789
4790     if (config->action == toutActUseConfiguredResponse && !config->response) {
4791         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4792         self_destruct();
4793     }
4794
4795     if (config->action != toutActUseConfiguredResponse && config->response) {
4796         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the 'on_timeout=use_configured_response' option");
4797         self_destruct();
4798     }
4799 }
4800
4801 static void
4802 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4803 {
4804     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4805     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4806
4807     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4808     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4809
4810     if (config.response)
4811         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4812
4813     storeAppendPrintf(entry, "\n");
4814 }
4815
4816 static void
4817 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4818 {
4819     Config.Timeout.urlRewrite = 0;
4820     config->action = 0;
4821     safe_free(config->response);
4822 }
4823
4824 static void
4825 parse_configuration_includes_quoted_values(bool *)
4826 {
4827     int val = 0;
4828     parse_onoff(&val);
4829
4830     // If quoted values is set to on then enable new strict mode parsing
4831     if (val) {
4832         ConfigParser::RecognizeQuotedValues = true;
4833         ConfigParser::StrictMode = true;
4834     } else {
4835         ConfigParser::RecognizeQuotedValues = false;
4836         ConfigParser::StrictMode = false;
4837     }
4838 }
4839
4840 static void
4841 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4842 {
4843     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4844     dump_onoff(entry, name, val);
4845 }
4846
4847 static void
4848 free_configuration_includes_quoted_values(bool *)
4849 {
4850     ConfigParser::RecognizeQuotedValues = false;
4851     ConfigParser::StrictMode = false;
4852 }
4853
4854 static void
4855 parse_on_unsupported_protocol(acl_access **access)
4856 {
4857     char *tm;
4858     if ((tm = ConfigParser::NextToken()) == NULL) {
4859         self_destruct();
4860         return;
4861     }
4862
4863     auto action = Acl::Answer(ACCESS_ALLOWED);
4864     if (strcmp(tm, "tunnel") == 0)
4865         action.kind = 1;
4866     else if (strcmp(tm, "respond") == 0)
4867         action.kind = 2;
4868     else {
4869         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4870         self_destruct();
4871         return;
4872     }
4873
4874     // empty rule OK
4875     ParseAclWithAction(access, action, "on_unsupported_protocol");
4876 }
4877
4878 static void
4879 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4880 {
4881     static const std::vector<const char *> onErrorTunnelMode = {
4882         "none",
4883         "tunnel",
4884         "respond"
4885     };
4886     if (access) {
4887         SBufList lines = access->treeDump(name, [](const Acl::Answer &action) {
4888             return onErrorTunnelMode.at(action.kind);
4889         });
4890         dump_SBufList(entry, lines);
4891     }
4892 }
4893
4894 static void
4895 free_on_unsupported_protocol(acl_access **access)
4896 {
4897     free_acl_access(access);
4898 }
4899
4900 static void
4901 parse_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuardsPtr)
4902 {
4903     assert(protoGuardsPtr);
4904     auto &protoGuards = *protoGuardsPtr;
4905     if (!protoGuards)
4906         protoGuards = new HttpUpgradeProtocolAccess();
4907     protoGuards->configureGuard(LegacyParser);
4908 }
4909
4910 static void
4911 dump_http_upgrade_request_protocols(StoreEntry *entry, const char *rawName, HttpUpgradeProtocolAccess *protoGuards)
4912 {
4913     if (!protoGuards)
4914         return;
4915
4916     const SBuf name(rawName);
4917     protoGuards->forEach([entry,&name](const SBuf &proto, const acl_access *acls) {
4918         SBufList line;
4919         line.push_back(name);
4920         line.push_back(proto);
4921         const auto acld = acls->treeDump("", &Acl::AllowOrDeny);
4922         line.insert(line.end(), acld.begin(), acld.end());
4923         dump_SBufList(entry, line);
4924     });
4925 }
4926
4927 static void
4928 free_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuardsPtr)
4929 {
4930     assert(protoGuardsPtr);
4931     auto &protoGuards = *protoGuardsPtr;
4932     delete protoGuards;
4933     protoGuards = nullptr;
4934 }
4935