src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclNameList.h"
  15 #include "acl/AclSizeLimit.h"
  16 #include "acl/Address.h"
  17 #include "acl/Gadgets.h"
  18 #include "acl/MethodData.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "AuthReg.h"
  23 #include "base/RunnersRegistry.h"
  24 #include "cache_cf.h"
  25 #include "CachePeer.h"
  26 #include "ConfigParser.h"
  27 #include "CpuAffinityMap.h"
  28 #include "DiskIO/DiskIOModule.h"
  29 #include "eui/Config.h"
  30 #include "ExternalACL.h"
  31 #include "format/Format.h"
  32 #include "ftp/Elements.h"
  33 #include "globals.h"
  34 #include "HttpHeaderTools.h"
  35 #include "icmp/IcmpConfig.h"
  36 #include "ident/Config.h"
  37 #include "ip/Intercept.h"
  38 #include "ip/QosConfig.h"
  39 #include "ip/tools.h"
  40 #include "ipc/Kids.h"
  41 #include "log/Config.h"
  42 #include "log/CustomLog.h"
  43 #include "MemBuf.h"
  44 #include "mgr/ActionPasswordList.h"
  45 #include "mgr/Registration.h"
  46 #include "neighbors.h"
  47 #include "NeighborTypeDomainList.h"
  48 #include "Parsing.h"
  49 #include "pconn.h"
  50 #include "PeerDigest.h"
  51 #include "PeerPoolMgr.h"
  52 #include "redirect.h"
  53 #include "RefreshPattern.h"
  54 #include "rfc1738.h"
  55 #include "sbuf/List.h"
  56 #include "SquidConfig.h"
  57 #include "SquidString.h"
  58 #include "ssl/ProxyCerts.h"
  59 #include "Store.h"
  60 #include "store/Disk.h"
  61 #include "store/Disks.h"
  62 #include "StoreFileSystem.h"
  63 #include "tools.h"
  64 #include "util.h"
  65 #include "wordlist.h"
  66 /* wccp2 has its own conditional definitions */
  67 #include "wccp2.h"
  68 #if USE_ADAPTATION
  69 #include "adaptation/Config.h"
  70 #endif
  71 #if ICAP_CLIENT
  72 #include "adaptation/icap/Config.h"
  73 #endif
  74 #if USE_ECAP
  75 #include "adaptation/ecap/Config.h"
  76 #endif
  77 #if USE_OPENSSL
  78 #include "ssl/Config.h"
  79 #include "ssl/support.h"
  80 #endif
  81 #if USE_AUTH
  82 #include "auth/Config.h"
  83 #include "auth/Scheme.h"
  84 #endif
  85 #if USE_SQUID_ESI
  86 #include "esi/Parser.h"
  87 #endif
  88 #if SQUID_SNMP
  89 #include "snmp.h"
  90 #endif
  91
  92 #if HAVE_GLOB_H
  93 #include <glob.h>
  94 #endif
  95 #include <limits>
  96 #include <list>
  97 #if HAVE_PWD_H
  98 #include <pwd.h>
  99 #endif
 100 #if HAVE_GRP_H
 101 #include <grp.h>
 102 #endif
 103 #if HAVE_SYS_STAT_H
 104 #include <sys/stat.h>
 105 #endif
 106
 107 #if USE_OPENSSL
 108 #include "ssl/gadgets.h"
 109 #endif
 110
 111 #if USE_ADAPTATION
 112 static void parse_adaptation_service_set_type();
 113 static void parse_adaptation_service_chain_type();
 114 static void parse_adaptation_access_type();
 115 #endif
 116
 117 #if ICAP_CLIENT
 118 static void parse_icap_service_type(Adaptation::Icap::Config *);
 119 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 120 static void free_icap_service_type(Adaptation::Icap::Config *);
 121 static void parse_icap_class_type();
 122 static void parse_icap_access_type();
 123
 124 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 125 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 126 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 127 #endif
 128
 129 #if USE_ECAP
 130 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 131 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 132 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 133 #endif
 134
 135 static peer_t parseNeighborType(const char *s);
 136
 137 static const char *const T_MILLISECOND_STR = "millisecond";
 138 static const char *const T_SECOND_STR = "second";
 139 static const char *const T_MINUTE_STR = "minute";
 140 static const char *const T_HOUR_STR = "hour";
 141 static const char *const T_DAY_STR = "day";
 142 static const char *const T_WEEK_STR = "week";
 143 static const char *const T_FORTNIGHT_STR = "fortnight";
 144 static const char *const T_MONTH_STR = "month";
 145 static const char *const T_YEAR_STR = "year";
 146 static const char *const T_DECADE_STR = "decade";
 147
 148 static const char *const B_BYTES_STR = "bytes";
 149 static const char *const B_KBYTES_STR = "KB";
 150 static const char *const B_MBYTES_STR = "MB";
 151 static const char *const B_GBYTES_STR = "GB";
 152
 153 static const char *const list_sep = ", \t\n\r";
 154
 155 static void parse_access_log(CustomLog ** customlog_definitions);
 156 static int check_null_access_log(CustomLog *customlog_definitions);
 157 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 158 static void free_access_log(CustomLog ** definitions);
 159 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 160
 161 static void configDoConfigure(void);
 162 static void parse_refreshpattern(RefreshPattern **);
 163 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 164 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 165 static void parse_u_short(unsigned short * var);
 166 static void parse_string(char **);
 167 static void default_all(void);
 168 static void defaults_if_none(void);
 169 static void defaults_postscriptum(void);
 170 static int parse_line(char *);
 171 static void parse_obsolete(const char *);
 172 static void parseBytesLine(size_t * bptr, const char *units);
 173 #if USE_OPENSSL
 174 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 175 #endif
 176 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 177 static size_t parseBytesUnits(const char *unit);
 178 static void free_all(void);
 179 void requirePathnameExists(const char *name, const char *path);
 180 static OBJH dump_config;
 181 #if USE_HTTP_VIOLATIONS
 182 static void free_HeaderManglers(HeaderManglers **pm);
 183 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 184 static void parse_http_header_access(HeaderManglers **manglers);
 185 #define free_http_header_access free_HeaderManglers
 186 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 187 static void parse_http_header_replace(HeaderManglers **manglers);
 188 #define free_http_header_replace free_HeaderManglers
 189 #endif
 190 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 191 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 192 static void free_HeaderWithAclList(HeaderWithAclList **header);
 193 static void parse_note(Notes *);
 194 static void dump_note(StoreEntry *, const char *, Notes &);
 195 static void free_note(Notes *);
 196 static void parse_denyinfo(AclDenyInfoList ** var);
 197 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 198 static void free_denyinfo(AclDenyInfoList ** var);
 199
 200 #if USE_WCCPv2
 201 static void parse_IpAddress_list(Ip::Address_list **);
 202 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 203 static void free_IpAddress_list(Ip::Address_list **);
 204 #if CURRENTLY_UNUSED
 205 static int check_null_IpAddress_list(const Ip::Address_list *);
 206 #endif /* CURRENTLY_UNUSED */
 207 #endif /* USE_WCCPv2 */
 208
 209 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 210 #define parse_PortCfg(l) parsePortCfg((l), token)
 211 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 212 #define free_PortCfg(h)  *(h)=NULL
 213
 214 #if USE_OPENSSL
 215 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 216 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 217 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 218 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 219 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 220 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 221 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 222 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 223 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 224 #endif /* USE_OPENSSL */
 225
 226 static void parse_ftp_epsv(acl_access **ftp_epsv);
 227 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 228 static void free_ftp_epsv(acl_access **ftp_epsv);
 229
 230 static void parse_b_size_t(size_t * var);
 231 static void parse_b_int64_t(int64_t * var);
 232
 233 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 234 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 235 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 236
 237 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 238 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 239 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 240
 241 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 242
 243 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 244 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 245 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 246 static void parse_on_unsupported_protocol(acl_access **access);
 247 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 248 static void free_on_unsupported_protocol(acl_access **access);
 249
 250 /*
 251  * LegacyParser is a parser for legacy code that uses the global
 252  * approach.  This is static so that it is only exposed to cache_cf.
 253  * Other modules needing access to a ConfigParser should have it
 254  * provided to them in their parserFOO methods.
 255  */
 256 static ConfigParser LegacyParser = ConfigParser();
 257
 258 void
 259 self_destruct(void)
 260 {
 261     LegacyParser.destruct();
 262 }
 263
 264 static void
 265 SetConfigFilename(char const *file_name, bool is_pipe)
 266 {
 267     if (is_pipe)
 268         cfg_filename = file_name + 1;
 269     else
 270         cfg_filename = file_name;
 271 }
 272
 273 static const char*
 274 skip_ws(const char* s)
 275 {
 276     while (xisspace(*s))
 277         ++s;
 278
 279     return s;
 280 }
 281
 282 static int
 283 parseManyConfigFiles(char* files, int depth)
 284 {
 285     int error_count = 0;
 286     char* saveptr = NULL;
 287 #if HAVE_GLOB
 288     char *path;
 289     glob_t globbuf;
 290     int i;
 291     memset(&globbuf, 0, sizeof(globbuf));
 292     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 293         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 294             int xerrno = errno;
 295             fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
 296         }
 297     }
 298     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 299         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 300     }
 301     globfree(&globbuf);
 302 #else
 303     char* file = strwordtok(files, &saveptr);
 304     while (file != NULL) {
 305         error_count += parseOneConfigFile(file, depth);
 306         file = strwordtok(NULL, &saveptr);
 307     }
 308 #endif /* HAVE_GLOB */
 309     return error_count;
 310 }
 311
 312 static void
 313 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 314 {
 315     assert(str != NULL);
 316     assert(newSubstr != NULL);
 317
 318     unsigned newSubstrLen = strlen(newSubstr);
 319     if (newSubstrLen > substrLen)
 320         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 321
 322     // move tail part including zero
 323     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 324     // copy new substring in place
 325     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 326
 327     len = strlen(str);
 328 }
 329
 330 static void
 331 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 332 {
 333     assert(line != NULL);
 334     assert(macroName != NULL);
 335     assert(substStr != NULL);
 336     unsigned macroNameLen = strlen(macroName);
 337     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 338         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 339 }
 340
 341 static void
 342 ProcessMacros(char*& line, int& len)
 343 {
 344     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 345     SubstituteMacro(line, len, "${process_name}", TheKidName);
 346     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 347 }
 348
 349 static void
 350 trim_trailing_ws(char* str)
 351 {
 352     assert(str != NULL);
 353     unsigned i = strlen(str);
 354     while ((i > 0) && xisspace(str[i - 1]))
 355         --i;
 356     str[i] = '\0';
 357 }
 358
 359 static const char*
 360 FindStatement(const char* line, const char* statement)
 361 {
 362     assert(line != NULL);
 363     assert(statement != NULL);
 364
 365     const char* str = skip_ws(line);
 366     unsigned len = strlen(statement);
 367     if (strncmp(str, statement, len) == 0) {
 368         str += len;
 369         if (*str == '\0')
 370             return str;
 371         else if (xisspace(*str))
 372             return skip_ws(str);
 373     }
 374
 375     return NULL;
 376 }
 377
 378 static bool
 379 StrToInt(const char* str, long& number)
 380 {
 381     assert(str != NULL);
 382
 383     char* end;
 384     number = strtol(str, &end, 0);
 385
 386     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 387 }
 388
 389 static bool
 390 EvalBoolExpr(const char* expr)
 391 {
 392     assert(expr != NULL);
 393     if (strcmp(expr, "true") == 0) {
 394         return true;
 395     } else if (strcmp(expr, "false") == 0) {
 396         return false;
 397     } else if (const char* equation = strchr(expr, '=')) {
 398         const char* rvalue = skip_ws(equation + 1);
 399         char* lvalue = (char*)xmalloc(equation - expr + 1);
 400         xstrncpy(lvalue, expr, equation - expr + 1);
 401         trim_trailing_ws(lvalue);
 402
 403         long number1;
 404         if (!StrToInt(lvalue, number1))
 405             fatalf("String is not a integer number: '%s'\n", lvalue);
 406         long number2;
 407         if (!StrToInt(rvalue, number2))
 408             fatalf("String is not a integer number: '%s'\n", rvalue);
 409
 410         xfree(lvalue);
 411         return number1 == number2;
 412     }
 413     fatalf("Unable to evaluate expression '%s'\n", expr);
 414     return false; // this place cannot be reached
 415 }
 416
 417 static int
 418 parseOneConfigFile(const char *file_name, unsigned int depth)
 419 {
 420     FILE *fp = NULL;
 421     const char *orig_cfg_filename = cfg_filename;
 422     const int orig_config_lineno = config_lineno;
 423     char *token = NULL;
 424     char *tmp_line = NULL;
 425     int tmp_line_len = 0;
 426     int err_count = 0;
 427     int is_pipe = 0;
 428
 429     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 430     if (depth > 16) {
 431         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 432         return 1;
 433     }
 434
 435     if (file_name[0] == '!' || file_name[0] == '|') {
 436         fp = popen(file_name + 1, "r");
 437         is_pipe = 1;
 438     } else {
 439         fp = fopen(file_name, "r");
 440     }
 441
 442     if (!fp) {
 443         int xerrno = errno;
 444         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
 445     }
 446
 447 #if _SQUID_WINDOWS_
 448     setmode(fileno(fp), O_TEXT);
 449 #endif
 450
 451     SetConfigFilename(file_name, bool(is_pipe));
 452
 453     memset(config_input_line, '\0', BUFSIZ);
 454
 455     config_lineno = 0;
 456
 457     std::vector<bool> if_states;
 458     while (fgets(config_input_line, BUFSIZ, fp)) {
 459         ++config_lineno;
 460
 461         if ((token = strchr(config_input_line, '\n')))
 462             *token = '\0';
 463
 464         if ((token = strchr(config_input_line, '\r')))
 465             *token = '\0';
 466
 467         // strip any prefix whitespace off the line.
 468         const char *p = skip_ws(config_input_line);
 469         if (config_input_line != p)
 470             memmove(config_input_line, p, strlen(p)+1);
 471
 472         if (strncmp(config_input_line, "#line ", 6) == 0) {
 473             static char new_file_name[1024];
 474             static char *file;
 475             static char new_lineno;
 476             token = config_input_line + 6;
 477             new_lineno = strtol(token, &file, 0) - 1;
 478
 479             if (file == token)
 480                 continue;   /* Not a valid #line directive, may be a comment */
 481
 482             while (*file && xisspace((unsigned char) *file))
 483                 ++file;
 484
 485             if (*file) {
 486                 if (*file != '"')
 487                     continue;   /* Not a valid #line directive, may be a comment */
 488
 489                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 490
 491                 if ((token = strchr(new_file_name, '"')))
 492                     *token = '\0';
 493
 494                 SetConfigFilename(new_file_name, false);
 495             }
 496
 497             config_lineno = new_lineno;
 498         }
 499
 500         if (config_input_line[0] == '#')
 501             continue;
 502
 503         if (config_input_line[0] == '\0')
 504             continue;
 505
 506         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 507
 508         size_t append_len = strlen(append);
 509
 510         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 511
 512         strcpy(tmp_line + tmp_line_len, append);
 513
 514         tmp_line_len += append_len;
 515
 516         if (tmp_line[tmp_line_len-1] == '\\') {
 517             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 518             tmp_line[--tmp_line_len] = '\0';
 519             continue;
 520         }
 521
 522         trim_trailing_ws(tmp_line);
 523         ProcessMacros(tmp_line, tmp_line_len);
 524         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 525
 526         if (const char* expr = FindStatement(tmp_line, "if")) {
 527             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 528         } else if (FindStatement(tmp_line, "endif")) {
 529             if (!if_states.empty())
 530                 if_states.pop_back(); // remove last if-statement meaning
 531             else
 532                 fatalf("'endif' without 'if'\n");
 533         } else if (FindStatement(tmp_line, "else")) {
 534             if (!if_states.empty())
 535                 if_states.back() = !if_states.back();
 536             else
 537                 fatalf("'else' without 'if'\n");
 538         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 539             /* Handle includes here */
 540             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 541                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 542             } else if (!parse_line(tmp_line)) {
 543                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 544                 ++err_count;
 545             }
 546         }
 547
 548         safe_free(tmp_line);
 549         tmp_line_len = 0;
 550
 551     }
 552     if (!if_states.empty())
 553         fatalf("if-statement without 'endif'\n");
 554
 555     if (is_pipe) {
 556         int ret = pclose(fp);
 557
 558         if (ret != 0)
 559             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 560     } else {
 561         fclose(fp);
 562     }
 563
 564     SetConfigFilename(orig_cfg_filename, false);
 565     config_lineno = orig_config_lineno;
 566
 567     xfree(tmp_line);
 568     return err_count;
 569 }
 570
 571 int
 572 parseConfigFile(const char *file_name)
 573 {
 574     int err_count = 0;
 575
 576     debugs(5, 4, HERE);
 577
 578     configFreeMemory();
 579
 580     ACLMethodData::ThePurgeCount = 0;
 581     default_all();
 582
 583     err_count = parseOneConfigFile(file_name, 0);
 584
 585     defaults_if_none();
 586
 587     defaults_postscriptum();
 588
 589     /*
 590      * We must call configDoConfigure() before leave_suid() because
 591      * configDoConfigure() is where we turn username strings into
 592      * uid values.
 593      */
 594     configDoConfigure();
 595
 596     if (!Config.chroot_dir) {
 597         leave_suid();
 598         setUmask(Config.umask);
 599         _db_init(Debug::cache_log, Debug::debugOptions);
 600         enter_suid();
 601     }
 602
 603     if (opt_send_signal == -1) {
 604         Mgr::RegisterAction("config",
 605                             "Current Squid Configuration",
 606                             dump_config,
 607                             1, 1);
 608     }
 609
 610     return err_count;
 611 }
 612
 613 static void
 614 configDoConfigure(void)
 615 {
 616     Config2.clear();
 617     /* init memory as early as possible */
 618     memConfigure();
 619     /* Sanity checks */
 620
 621     Config.cacheSwap.n_strands = 0; // no diskers by default
 622     if (Config.cacheSwap.swapDirs == NULL) {
 623         /* Memory-only cache probably in effect. */
 624         /* turn off the cache rebuild delays... */
 625         StoreController::store_dirs_rebuilding = 0;
 626     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 627         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 628             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 629             if (sd->needsDiskStrand())
 630                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 631         }
 632     }
 633
 634     if (Debug::rotateNumber < 0) {
 635         Debug::rotateNumber = Config.Log.rotateNumber;
 636     }
 637
 638 #if SIZEOF_OFF_T <= 4
 639     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 640         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 641         Config.Store.maxObjectSize = 0x7FFF0000;
 642     }
 643 #endif
 644
 645     if (Config.Announce.period > 0) {
 646         Config.onoff.announce = 1;
 647     } else {
 648         Config.Announce.period = 86400 * 365;   /* one year */
 649         Config.onoff.announce = 0;
 650     }
 651
 652     if (Config.onoff.httpd_suppress_version_string)
 653         visible_appname_string = (char *)appname_string;
 654     else
 655         visible_appname_string = (char const *)APP_FULLNAME;
 656
 657     if (Config.Program.redirect) {
 658         if (Config.redirectChildren.n_max < 1) {
 659             Config.redirectChildren.n_max = 0;
 660             wordlistDestroy(&Config.Program.redirect);
 661         }
 662     }
 663
 664     if (Config.Program.store_id) {
 665         if (Config.storeIdChildren.n_max < 1) {
 666             Config.storeIdChildren.n_max = 0;
 667             wordlistDestroy(&Config.Program.store_id);
 668         }
 669     }
 670
 671     if (Config.appendDomain)
 672         if (*Config.appendDomain != '.')
 673             fatal("append_domain must begin with a '.'");
 674
 675     if (Config.errHtmlText == NULL)
 676         Config.errHtmlText = xstrdup(null_string);
 677
 678 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 679     if (Config.max_filedescriptors > 0) {
 680         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 681     }
 682 #elif USE_SELECT || USE_SELECT_WIN32
 683     if (Config.max_filedescriptors > FD_SETSIZE) {
 684         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 685     }
 686 #endif
 687
 688     storeConfigure();
 689
 690     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 691              uniqueHostname(),
 692              visible_appname_string);
 693
 694     /*
 695      * the extra space is for loop detection in client_side.c -- we search
 696      * for substrings in the Via header.
 697      */
 698     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 699              uniqueHostname(),
 700              visible_appname_string);
 701
 702     /* Use visible_hostname as default surrogate_id */
 703     if (!Config.Accel.surrogate_id) {
 704         const char *t = getMyHostname();
 705         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 706     }
 707
 708     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 709         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 710
 711     if (Config.appendDomain)
 712         Config.appendDomainLen = strlen(Config.appendDomain);
 713     else
 714         Config.appendDomainLen = 0;
 715
 716     if (Config.connect_retries > 10) {
 717         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 718         Config.connect_retries = 10;
 719     }
 720
 721     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 722 #if USE_UNLINKD
 723
 724     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 725 #endif
 726     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 727     if (Config.Program.redirect)
 728         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 729
 730     if (Config.Program.store_id)
 731         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 732
 733     requirePathnameExists("Icon Directory", Config.icons.directory);
 734
 735     if (Config.errorDirectory)
 736         requirePathnameExists("Error Directory", Config.errorDirectory);
 737
 738 #if USE_HTTP_VIOLATIONS
 739
 740     {
 741         const RefreshPattern *R;
 742
 743         for (R = Config.Refresh; R; R = R->next) {
 744             if (!R->flags.override_expire)
 745                 continue;
 746
 747             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 748
 749             break;
 750         }
 751
 752         for (R = Config.Refresh; R; R = R->next) {
 753             if (!R->flags.override_lastmod)
 754                 continue;
 755
 756             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 757
 758             break;
 759         }
 760
 761         for (R = Config.Refresh; R; R = R->next) {
 762             if (!R->flags.reload_into_ims)
 763                 continue;
 764
 765             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 766
 767             break;
 768         }
 769
 770         for (R = Config.Refresh; R; R = R->next) {
 771             if (!R->flags.ignore_reload)
 772                 continue;
 773
 774             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 775
 776             break;
 777         }
 778
 779         for (R = Config.Refresh; R; R = R->next) {
 780             if (!R->flags.ignore_no_store)
 781                 continue;
 782
 783             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 784
 785             break;
 786         }
 787
 788         for (R = Config.Refresh; R; R = R->next) {
 789             if (!R->flags.ignore_private)
 790                 continue;
 791
 792             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 793
 794             break;
 795         }
 796     }
 797 #endif
 798 #if !USE_HTTP_VIOLATIONS
 799     Config.onoff.via = 1;
 800 #else
 801
 802     if (!Config.onoff.via)
 803         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 804
 805 #endif
 806
 807     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 808     // TODO: replace with a dedicated "purge" ACL option?
 809     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 810
 811     if (geteuid() == 0) {
 812         if (NULL != Config.effectiveUser) {
 813
 814             struct passwd *pwd = getpwnam(Config.effectiveUser);
 815
 816             if (NULL == pwd) {
 817                 /*
 818                  * Andres Kroonmaa <andre@online.ee>:
 819                  * Some getpwnam() implementations (Solaris?) require
 820                  * an available FD < 256 for opening a FILE* to the
 821                  * passwd file.
 822                  * DW:
 823                  * This should be safe at startup, but might still fail
 824                  * during reconfigure.
 825                  */
 826                 fatalf("getpwnam failed to find userid for effective user '%s'",
 827                        Config.effectiveUser);
 828                 return;
 829             }
 830
 831             Config2.effectiveUserID = pwd->pw_uid;
 832
 833             Config2.effectiveGroupID = pwd->pw_gid;
 834
 835 #if HAVE_PUTENV
 836             if (pwd->pw_dir && *pwd->pw_dir) {
 837                 // putenv() leaks by design; avoid leaks when nothing changes
 838                 static SBuf lastDir;
 839                 if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
 840                     lastDir = pwd->pw_dir;
 841                     int len = strlen(pwd->pw_dir) + 6;
 842                     char *env_str = (char *)xcalloc(len, 1);
 843                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 844                     putenv(env_str);
 845                 }
 846             }
 847 #endif
 848         }
 849     } else {
 850         Config2.effectiveUserID = geteuid();
 851         Config2.effectiveGroupID = getegid();
 852     }
 853
 854     if (NULL != Config.effectiveGroup) {
 855
 856         struct group *grp = getgrnam(Config.effectiveGroup);
 857
 858         if (NULL == grp) {
 859             fatalf("getgrnam failed to find groupid for effective group '%s'",
 860                    Config.effectiveGroup);
 861             return;
 862         }
 863
 864         Config2.effectiveGroupID = grp->gr_gid;
 865     }
 866
 867 #if USE_OPENSSL
 868     if (Config.ssl_client.foreignIntermediateCertsPath)
 869         Ssl::loadSquidUntrusted(Config.ssl_client.foreignIntermediateCertsPath);
 870 #endif
 871
 872     if (Security::ProxyOutgoingConfig.encryptTransport) {
 873         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 874         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 875         if (!Config.ssl_client.sslContext) {
 876 #if USE_OPENSSL
 877             fatal("ERROR: Could not initialize https:// proxy context");
 878 #else
 879             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 880 #endif
 881         }
 882 #if USE_OPENSSL
 883         Ssl::useSquidUntrusted(Config.ssl_client.sslContext.get());
 884 #endif
 885     }
 886
 887     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 888
 889         // default value for ssldomain= is the peer host/IP
 890         if (p->secure.sslDomain.isEmpty())
 891             p->secure.sslDomain = p->host;
 892
 893         if (p->secure.encryptTransport) {
 894             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 895             p->sslContext = p->secure.createClientContext(true);
 896             if (!p->sslContext) {
 897                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 898                 self_destruct();
 899                 return;
 900             }
 901         }
 902     }
 903
 904 #if USE_OPENSSL
 905     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 906         if (!s->secure.encryptTransport)
 907             continue;
 908         debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS context");
 909         s->configureSslServerContext();
 910     }
 911 #endif
 912
 913     // prevent infinite fetch loops in the request parser
 914     // due to buffer full but not enough data recived to finish parse
 915     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 916         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 917                " Change client_request_buffer_max or request_header_max_size limits.",
 918                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 919     }
 920
 921     /*
 922      * Disable client side request pipelining if client_persistent_connections OFF.
 923      * Waste of resources queueing any pipelined requests when the first will close the connection.
 924      */
 925     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 926         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 927                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 928         Config.pipeline_max_prefetch = 0;
 929     }
 930
 931 #if USE_AUTH
 932     /*
 933      * disable client side request pipelining. There is a race with
 934      * Negotiate and NTLM when the client sends a second request on an
 935      * connection before the authenticate challenge is sent. With
 936      * pipelining OFF, the client may fail to authenticate, but squid's
 937      * state will be preserved.
 938      */
 939     if (Config.pipeline_max_prefetch > 0) {
 940         Auth::Config *nego = Auth::Config::Find("Negotiate");
 941         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 942         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 943             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 944             Config.pipeline_max_prefetch = 0;
 945         }
 946     }
 947 #endif
 948 }
 949
 950 /** Parse a line containing an obsolete directive.
 951  * To upgrade it where possible instead of just "Bungled config" for
 952  * directives which cannot be marked as simply aliases of the some name.
 953  * For example if the parameter order and content has changed.
 954  * Or if the directive has been completely removed.
 955  */
 956 void
 957 parse_obsolete(const char *name)
 958 {
 959     // Directives which have been radically changed rather than removed
 960     if (!strcmp(name, "url_rewrite_concurrency")) {
 961         int cval;
 962         parse_int(&cval);
 963         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 964         Config.redirectChildren.concurrency = cval;
 965     }
 966
 967     if (!strcmp(name, "log_access")) {
 968         self_destruct();
 969         return;
 970     }
 971
 972     if (!strcmp(name, "log_icap")) {
 973         self_destruct();
 974         return;
 975     }
 976
 977     if (!strcmp(name, "ignore_ims_on_miss")) {
 978         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 979         // than the 2.7 directive. We need to parse and invert the configured value.
 980         int temp = 0;
 981         parse_onoff(&temp);
 982         Config.onoff.cache_miss_revalidate = !temp;
 983     }
 984
 985     if (!strncmp(name, "sslproxy_", 9)) {
 986         // the replacement directive tls_outgoing_options uses options instead of whole-line input
 987         SBuf tmp;
 988         if (!strcmp(name, "sslproxy_cafile"))
 989             tmp.append("cafile=");
 990         else if (!strcmp(name, "sslproxy_capath"))
 991             tmp.append("capath=");
 992         else if (!strcmp(name, "sslproxy_cipher"))
 993             tmp.append("cipher=");
 994         else if (!strcmp(name, "sslproxy_client_certificate"))
 995             tmp.append("cert=");
 996         else if (!strcmp(name, "sslproxy_client_key"))
 997             tmp.append("key=");
 998         else if (!strcmp(name, "sslproxy_flags"))
 999             tmp.append("flags=");
1000         else if (!strcmp(name, "sslproxy_options"))
1001             tmp.append("options=");
1002         else if (!strcmp(name, "sslproxy_version"))
1003             tmp.append("version=");
1004         else {
1005             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1006             self_destruct();
1007             return;
1008         }
1009
1010         // add the value as unquoted-string because the old values did not support whitespace
1011         const char *token = ConfigParser::NextQuotedOrToEol();
1012         tmp.append(token, strlen(token));
1013         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1014     }
1015 }
1016
1017 /* Parse a time specification from the config file.  Store the
1018  * result in 'tptr', after converting it to 'units' */
1019 static void
1020 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
1021 {
1022     time_msec_t u = parseTimeUnits(units, allowMsec);
1023     if (u == 0) {
1024         self_destruct();
1025         return;
1026     }
1027
1028     char *token = ConfigParser::NextToken();;
1029     if (!token) {
1030         self_destruct();
1031         return;
1032     }
1033
1034     double d = xatof(token);
1035
1036     time_msec_t m = u; /* default to 'units' if none specified */
1037
1038     if (d) {
1039         if ((token = ConfigParser::PeekAtToken()) && (m = parseTimeUnits(token, allowMsec))) {
1040             (void)ConfigParser::NextToken();
1041
1042         } else if (!expectMoreArguments) {
1043             self_destruct();
1044             return;
1045
1046         } else {
1047             token = NULL; // show default units if dying below
1048             debugs(3, DBG_CRITICAL, "WARNING: No units on '" << config_input_line << "', assuming " << d << " " << units);
1049         }
1050     } else
1051         token = NULL; // show default units if dying below.
1052
1053     *tptr = static_cast<time_msec_t>(m * d);
1054
1055     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1056         debugs(3, DBG_CRITICAL, "FATAL: Invalid value '" <<
1057                d << " " << (token ? token : units) << ": integer overflow (time_msec_t).");
1058         self_destruct();
1059     }
1060 }
1061
1062 static uint64_t
1063 parseTimeUnits(const char *unit, bool allowMsec)
1064 {
1065     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1066         return 1;
1067
1068     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1069         return 1000;
1070
1071     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1072         return 60 * 1000;
1073
1074     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1075         return 3600 * 1000;
1076
1077     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1078         return 86400 * 1000;
1079
1080     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1081         return 86400 * 7 * 1000;
1082
1083     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1084         return 86400 * 14 * 1000;
1085
1086     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1087         return static_cast<uint64_t>(86400) * 30 * 1000;
1088
1089     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1090         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1091
1092     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1093         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1094
1095     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1096
1097     return 0;
1098 }
1099
1100 static void
1101 parseBytesLine64(int64_t * bptr, const char *units)
1102 {
1103     char *token;
1104     double d;
1105     int64_t m;
1106     int64_t u;
1107
1108     if ((u = parseBytesUnits(units)) == 0) {
1109         self_destruct();
1110         return;
1111     }
1112
1113     if ((token = ConfigParser::NextToken()) == NULL) {
1114         self_destruct();
1115         return;
1116     }
1117
1118     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1119         *bptr = -1;
1120         return;
1121     }
1122
1123     d = xatof(token);
1124
1125     m = u;          /* default to 'units' if none specified */
1126
1127     if (0.0 == d)
1128         (void) 0;
1129     else if ((token = ConfigParser::NextToken()) == NULL)
1130         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1131                config_input_line << "', assuming " <<
1132                d << " " <<  units  );
1133     else if ((m = parseBytesUnits(token)) == 0) {
1134         self_destruct();
1135         return;
1136     }
1137
1138     *bptr = static_cast<int64_t>(m * d / u);
1139
1140     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1141         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1142                d << " " << token << ": integer overflow (int64_t).");
1143         self_destruct();
1144     }
1145 }
1146
1147 static void
1148 parseBytesLine(size_t * bptr, const char *units)
1149 {
1150     char *token;
1151     double d;
1152     int m;
1153     int u;
1154
1155     if ((u = parseBytesUnits(units)) == 0) {
1156         self_destruct();
1157         return;
1158     }
1159
1160     if ((token = ConfigParser::NextToken()) == NULL) {
1161         self_destruct();
1162         return;
1163     }
1164
1165     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1166         *bptr = static_cast<size_t>(-1);
1167         return;
1168     }
1169
1170     d = xatof(token);
1171
1172     m = u;          /* default to 'units' if none specified */
1173
1174     if (0.0 == d)
1175         (void) 0;
1176     else if ((token = ConfigParser::NextToken()) == NULL)
1177         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1178                config_input_line << "', assuming " <<
1179                d << " " <<  units  );
1180     else if ((m = parseBytesUnits(token)) == 0) {
1181         self_destruct();
1182         return;
1183     }
1184
1185     *bptr = static_cast<size_t>(m * d / u);
1186
1187     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1188         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1189                d << " " << token << ": integer overflow (size_t).");
1190         self_destruct();
1191     }
1192 }
1193
1194 static void
1195 parseBytesLineSigned(ssize_t * bptr, const char *units)
1196 {
1197     char *token;
1198     double d;
1199     int m;
1200     int u;
1201
1202     if ((u = parseBytesUnits(units)) == 0) {
1203         self_destruct();
1204         return;
1205     }
1206
1207     if ((token = ConfigParser::NextToken()) == NULL) {
1208         self_destruct();
1209         return;
1210     }
1211
1212     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1213         *bptr = -1;
1214         return;
1215     }
1216
1217     d = xatof(token);
1218
1219     m = u;          /* default to 'units' if none specified */
1220
1221     if (0.0 == d)
1222         (void) 0;
1223     else if ((token = ConfigParser::NextToken()) == NULL)
1224         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1225                config_input_line << "', assuming " <<
1226                d << " " <<  units  );
1227     else if ((m = parseBytesUnits(token)) == 0) {
1228         self_destruct();
1229         return;
1230     }
1231
1232     *bptr = static_cast<ssize_t>(m * d / u);
1233
1234     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1235         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1236                d << " " << token << ": integer overflow (ssize_t).");
1237         self_destruct();
1238     }
1239 }
1240
1241 /**
1242  * Parse bytes from a string.
1243  * Similar to the parseBytesLine function but parses the string value instead of
1244  * the current token value.
1245  */
1246 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1247 {
1248     int u;
1249     if ((u = parseBytesUnits(units)) == 0) {
1250         self_destruct();
1251         return;
1252     }
1253
1254     // Find number from string beginning.
1255     char const * number_begin = value;
1256     char const * number_end = value;
1257
1258     while ((*number_end >= '0' && *number_end <= '9')) {
1259         ++number_end;
1260     }
1261
1262     String number;
1263     number.limitInit(number_begin, number_end - number_begin);
1264
1265     int d = xatoi(number.termedBuf());
1266     int m;
1267     if ((m = parseBytesUnits(number_end)) == 0) {
1268         self_destruct();
1269         return;
1270     }
1271
1272     *bptr = static_cast<size_t>(m * d / u);
1273     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1274         self_destruct();
1275 }
1276
1277 static size_t
1278 parseBytesUnits(const char *unit)
1279 {
1280     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1281         return 1;
1282
1283     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1284         return 1 << 10;
1285
1286     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1287         return 1 << 20;
1288
1289     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1290         return 1 << 30;
1291
1292     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1293
1294     return 0;
1295 }
1296
1297 static void
1298 dump_SBufList(StoreEntry * entry, const SBufList &words)
1299 {
1300     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1301         entry->append(i->rawContent(), i->length());
1302         entry->append(" ",1);
1303     }
1304     entry->append("\n",1);
1305 }
1306
1307 static void
1308 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1309 {
1310     while (ae != NULL) {
1311         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1312         storeAppendPrintf(entry, "%s %s %s %s ",
1313                           name,
1314                           ae->name,
1315                           ae->typeString(),
1316                           ae->flags.flagsStr());
1317         dump_SBufList(entry, ae->dump());
1318         ae = ae->next;
1319     }
1320 }
1321
1322 static void
1323 parse_acl(ACL ** ae)
1324 {
1325     ACL::ParseAclLine(LegacyParser, ae);
1326 }
1327
1328 static void
1329 free_acl(ACL ** ae)
1330 {
1331     aclDestroyAcls(ae);
1332 }
1333
1334 void
1335 dump_acl_list(StoreEntry * entry, ACLList * head)
1336 {
1337     dump_SBufList(entry, head->dump());
1338 }
1339
1340 void
1341 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1342 {
1343     if (head)
1344         dump_SBufList(entry, head->treeDump(name,NULL));
1345 }
1346
1347 static void
1348 parse_acl_access(acl_access ** head)
1349 {
1350     aclParseAccessLine(cfg_directive, LegacyParser, head);
1351 }
1352
1353 static void
1354 free_acl_access(acl_access ** head)
1355 {
1356     aclDestroyAccessList(head);
1357 }
1358
1359 static void
1360 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1361 {
1362     char buf[MAX_IPSTRLEN];
1363     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1364 }
1365
1366 static void
1367 parse_address(Ip::Address *addr)
1368 {
1369     char *token = ConfigParser::NextToken();
1370
1371     if (!token) {
1372         self_destruct();
1373         return;
1374     }
1375
1376     if (!strcmp(token,"any_addr"))
1377         addr->setAnyAddr();
1378     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1379         addr->setNoAddr();
1380     else if ( (*addr = token) ) // try parse numeric/IPA
1381         (void) 0;
1382     else if (addr->GetHostByName(token)) // dont use ipcache
1383         (void) 0;
1384     else { // not an IP and not a hostname
1385         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1386         self_destruct();
1387     }
1388 }
1389
1390 static void
1391 free_address(Ip::Address *addr)
1392 {
1393     addr->setEmpty();
1394 }
1395
1396 static void
1397 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1398 {
1399     char buf[MAX_IPSTRLEN];
1400
1401     for (Acl::Address *l = head; l; l = l->next) {
1402         if (!l->addr.isAnyAddr())
1403             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1404         else
1405             storeAppendPrintf(entry, "%s autoselect", name);
1406
1407         dump_acl_list(entry, l->aclList);
1408
1409         storeAppendPrintf(entry, "\n");
1410     }
1411 }
1412
1413 static void
1414 parse_acl_address(Acl::Address ** head)
1415 {
1416     Acl::Address *l = new Acl::Address;
1417     parse_address(&l->addr);
1418     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1419
1420     Acl::Address **tail = head;
1421     while (*tail)
1422         tail = &(*tail)->next;
1423
1424     *tail = l;
1425 }
1426
1427 static void
1428 free_acl_address(Acl::Address ** head)
1429 {
1430     delete *head;
1431     *head = NULL;
1432 }
1433
1434 static void
1435 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1436 {
1437     acl_tos *l;
1438
1439     for (l = head; l; l = l->next) {
1440         if (l->tos > 0)
1441             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1442         else
1443             storeAppendPrintf(entry, "%s none", name);
1444
1445         dump_acl_list(entry, l->aclList);
1446
1447         storeAppendPrintf(entry, "\n");
1448     }
1449 }
1450
1451 static void
1452 parse_acl_tos(acl_tos ** head)
1453 {
1454     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1455     char *token = ConfigParser::NextToken();
1456
1457     if (!token) {
1458         self_destruct();
1459         return;
1460     }
1461
1462     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1463         self_destruct();
1464         return;
1465     }
1466
1467     const unsigned int chTos = tos & 0xFC;
1468     if (chTos != tos) {
1469         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1470         tos = chTos;
1471     }
1472
1473     acl_tos *l = new acl_tos;
1474
1475     l->tos = (tos_t)tos;
1476
1477     aclParseAclList(LegacyParser, &l->aclList, token);
1478
1479     acl_tos **tail = head;  /* sane name below */
1480     while (*tail)
1481         tail = &(*tail)->next;
1482
1483     *tail = l;
1484 }
1485
1486 static void
1487 free_acl_tos(acl_tos ** head)
1488 {
1489     delete *head;
1490     *head = NULL;
1491 }
1492
1493 #if SO_MARK && USE_LIBCAP
1494
1495 static void
1496 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1497 {
1498     for (acl_nfmark *l = head; l; l = l->next) {
1499         if (l->nfmark > 0)
1500             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1501         else
1502             storeAppendPrintf(entry, "%s none", name);
1503
1504         dump_acl_list(entry, l->aclList);
1505
1506         storeAppendPrintf(entry, "\n");
1507     }
1508 }
1509
1510 static void
1511 parse_acl_nfmark(acl_nfmark ** head)
1512 {
1513     nfmark_t mark;
1514     char *token = ConfigParser::NextToken();
1515
1516     if (!token) {
1517         self_destruct();
1518         return;
1519     }
1520
1521     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1522         self_destruct();
1523         return;
1524     }
1525
1526     acl_nfmark *l = new acl_nfmark;
1527
1528     l->nfmark = mark;
1529
1530     aclParseAclList(LegacyParser, &l->aclList, token);
1531
1532     acl_nfmark **tail = head;   /* sane name below */
1533     while (*tail)
1534         tail = &(*tail)->next;
1535
1536     *tail = l;
1537 }
1538
1539 static void
1540 free_acl_nfmark(acl_nfmark ** head)
1541 {
1542     delete *head;
1543     *head = NULL;
1544 }
1545 #endif /* SO_MARK */
1546
1547 static void
1548 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1549 {
1550     for (AclSizeLimit *l = head; l; l = l->next) {
1551         if (l->size != -1)
1552             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1553         else
1554             storeAppendPrintf(entry, "%s none", name);
1555
1556         dump_acl_list(entry, l->aclList);
1557
1558         storeAppendPrintf(entry, "\n");
1559     }
1560 }
1561
1562 static void
1563 parse_acl_b_size_t(AclSizeLimit ** head)
1564 {
1565     AclSizeLimit *l = new AclSizeLimit;
1566
1567     parse_b_int64_t(&l->size);
1568
1569     aclParseAclList(LegacyParser, &l->aclList, l->size);
1570
1571     AclSizeLimit **tail = head; /* sane name below */
1572     while (*tail)
1573         tail = &(*tail)->next;
1574
1575     *tail = l;
1576 }
1577
1578 static void
1579 free_acl_b_size_t(AclSizeLimit ** head)
1580 {
1581     delete *head;
1582     *head = NULL;
1583 }
1584
1585 #if USE_DELAY_POOLS
1586
1587 #include "DelayConfig.h"
1588 #include "DelayPools.h"
1589 /* do nothing - free_delay_pool_count is the magic free function.
1590  * this is why delay_pool_count isn't just marked TYPE: u_short
1591  */
1592 #define free_delay_pool_class(X)
1593 #define free_delay_pool_access(X)
1594 #define free_delay_pool_rates(X)
1595 #define dump_delay_pool_class(X, Y, Z)
1596 #define dump_delay_pool_access(X, Y, Z)
1597 #define dump_delay_pool_rates(X, Y, Z)
1598
1599 static void
1600 free_delay_pool_count(DelayConfig * cfg)
1601 {
1602     cfg->freePoolCount();
1603 }
1604
1605 static void
1606 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1607 {
1608     cfg.dumpPoolCount (entry, name);
1609 }
1610
1611 static void
1612 parse_delay_pool_count(DelayConfig * cfg)
1613 {
1614     cfg->parsePoolCount();
1615 }
1616
1617 static void
1618 parse_delay_pool_class(DelayConfig * cfg)
1619 {
1620     cfg->parsePoolClass();
1621 }
1622
1623 static void
1624 parse_delay_pool_rates(DelayConfig * cfg)
1625 {
1626     cfg->parsePoolRates();
1627 }
1628
1629 static void
1630 parse_delay_pool_access(DelayConfig * cfg)
1631 {
1632     cfg->parsePoolAccess(LegacyParser);
1633 }
1634
1635 #endif
1636
1637 #if USE_DELAY_POOLS
1638 #include "ClientDelayConfig.h"
1639 /* do nothing - free_client_delay_pool_count is the magic free function.
1640  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1641  */
1642
1643 #define free_client_delay_pool_access(X)
1644 #define free_client_delay_pool_rates(X)
1645 #define dump_client_delay_pool_access(X, Y, Z)
1646 #define dump_client_delay_pool_rates(X, Y, Z)
1647
1648 static void
1649 free_client_delay_pool_count(ClientDelayConfig * cfg)
1650 {
1651     cfg->freePoolCount();
1652 }
1653
1654 static void
1655 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1656 {
1657     cfg.dumpPoolCount (entry, name);
1658 }
1659
1660 static void
1661 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1662 {
1663     cfg->parsePoolCount();
1664 }
1665
1666 static void
1667 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1668 {
1669     cfg->parsePoolRates();
1670 }
1671
1672 static void
1673 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1674 {
1675     cfg->parsePoolAccess(LegacyParser);
1676 }
1677 #endif
1678
1679 #if USE_HTTP_VIOLATIONS
1680 static void
1681 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1682 {
1683     if (manglers)
1684         manglers->dumpAccess(entry, name);
1685 }
1686
1687 static void
1688 parse_http_header_access(HeaderManglers **pm)
1689 {
1690     char *t = NULL;
1691
1692     if ((t = ConfigParser::NextToken()) == NULL) {
1693         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1694         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1695         return;
1696     }
1697
1698     if (!*pm)
1699         *pm = new HeaderManglers;
1700     HeaderManglers *manglers = *pm;
1701     headerMangler *mangler = manglers->track(t);
1702     assert(mangler);
1703
1704     std::string directive = "http_header_access ";
1705     directive += t;
1706     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1707 }
1708
1709 static void
1710 free_HeaderManglers(HeaderManglers **pm)
1711 {
1712     // we delete the entire http_header_* mangler configuration at once
1713     if (const HeaderManglers *manglers = *pm) {
1714         delete manglers;
1715         *pm = NULL;
1716     }
1717 }
1718
1719 static void
1720 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1721 {
1722     if (manglers)
1723         manglers->dumpReplacement(entry, name);
1724 }
1725
1726 static void
1727 parse_http_header_replace(HeaderManglers **pm)
1728 {
1729     char *t = NULL;
1730
1731     if ((t = ConfigParser::NextToken()) == NULL) {
1732         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1733         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1734         return;
1735     }
1736
1737     const char *value = ConfigParser::NextQuotedOrToEol();
1738
1739     if (!*pm)
1740         *pm = new HeaderManglers;
1741     HeaderManglers *manglers = *pm;
1742     manglers->setReplacement(t, value);
1743 }
1744
1745 #endif
1746
1747 static void
1748 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1749 {
1750     SwapDir *s;
1751     int i;
1752     assert (entry);
1753
1754     for (i = 0; i < swap.n_configured; ++i) {
1755         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1756         if (!s) continue;
1757         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1758         s->dump(*entry);
1759         storeAppendPrintf(entry, "\n");
1760     }
1761 }
1762
1763 static int
1764 check_null_string(char *s)
1765 {
1766     return s == NULL;
1767 }
1768
1769 #if USE_AUTH
1770 static void
1771 parse_authparam(Auth::ConfigVector * config)
1772 {
1773     char *type_str = ConfigParser::NextToken();
1774     if (!type_str) {
1775         self_destruct();
1776         return;
1777     }
1778
1779     char *param_str = ConfigParser::NextToken();
1780     if (!param_str) {
1781         self_destruct();
1782         return;
1783     }
1784
1785     /* find a configuration for the scheme in the currently parsed configs... */
1786     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1787
1788     if (schemeCfg == NULL) {
1789         /* Create a configuration based on the scheme info */
1790         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1791
1792         if (theScheme == NULL) {
1793             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1794             self_destruct();
1795             return;
1796         }
1797
1798         config->push_back(theScheme->createConfig());
1799         schemeCfg = Auth::Config::Find(type_str);
1800         if (schemeCfg == NULL) {
1801             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1802             self_destruct();
1803             return;
1804         }
1805     }
1806
1807     schemeCfg->parse(schemeCfg, config->size(), param_str);
1808 }
1809
1810 static void
1811 free_authparam(Auth::ConfigVector * cfg)
1812 {
1813     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1814     cfg->clear();
1815
1816     /* on reconfigure initialize new auth schemes for the new config. */
1817     if (reconfiguring) {
1818         Auth::Init();
1819     }
1820 }
1821
1822 static void
1823 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1824 {
1825     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1826         (*i)->dump(entry, name, (*i));
1827 }
1828 #endif /* USE_AUTH */
1829
1830 /* TODO: just return the object, the # is irrelevant */
1831 static int
1832 find_fstype(char *type)
1833 {
1834     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1835         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1836             return (int)i;
1837
1838     return (-1);
1839 }
1840
1841 static void
1842 parse_cachedir(Store::DiskConfig *swap)
1843 {
1844     char *type_str = ConfigParser::NextToken();
1845     if (!type_str) {
1846         self_destruct();
1847         return;
1848     }
1849
1850     char *path_str = ConfigParser::NextToken();
1851     if (!path_str) {
1852         self_destruct();
1853         return;
1854     }
1855
1856     int fs = find_fstype(type_str);
1857     if (fs < 0) {
1858         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1859         return;
1860     }
1861
1862     /* reconfigure existing dir */
1863
1864     RefCount<SwapDir> sd;
1865     for (int i = 0; i < swap->n_configured; ++i) {
1866         assert (swap->swapDirs[i].getRaw());
1867
1868         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1869             /* this is specific to on-fs Stores. The right
1870              * way to handle this is probably to have a mapping
1871              * from paths to stores, and have on-fs stores
1872              * register with that, and lookip in that in their
1873              * own setup logic. RBC 20041225. TODO.
1874              */
1875
1876             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1877
1878             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1879                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1880                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1881                 return;
1882             }
1883
1884             sd->reconfigure();
1885             return;
1886         }
1887     }
1888
1889     /* new cache_dir */
1890     if (swap->n_configured > 63) {
1891         /* 7 bits, signed */
1892         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1893         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1894         self_destruct();
1895         return;
1896     }
1897
1898     allocate_new_swapdir(swap);
1899
1900     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1901
1902     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1903
1904     /* parse the FS parameters and options */
1905     sd->parse(swap->n_configured, path_str);
1906
1907     ++swap->n_configured;
1908 }
1909
1910 static const char *
1911 peer_type_str(const peer_t type)
1912 {
1913     const char * result;
1914
1915     switch (type) {
1916
1917     case PEER_PARENT:
1918         result = "parent";
1919         break;
1920
1921     case PEER_SIBLING:
1922         result = "sibling";
1923         break;
1924
1925     case PEER_MULTICAST:
1926         result = "multicast";
1927         break;
1928
1929     default:
1930         result = "unknown";
1931         break;
1932     }
1933
1934     return result;
1935 }
1936
1937 static void
1938 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1939 {
1940     NeighborTypeDomainList *t;
1941     LOCAL_ARRAY(char, xname, 128);
1942
1943     while (p != NULL) {
1944         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1945                           name,
1946                           p->host,
1947                           neighborTypeStr(p),
1948                           p->http_port,
1949                           p->icp.port,
1950                           p->name);
1951         dump_peer_options(entry, p);
1952
1953         if (p->access) {
1954             snprintf(xname, 128, "cache_peer_access %s", p->name);
1955             dump_acl_access(entry, xname, p->access);
1956         }
1957
1958         for (t = p->typelist; t; t = t->next) {
1959             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1960                               p->host,
1961                               peer_type_str(t->type),
1962                               t->domain);
1963         }
1964
1965         p = p->next;
1966     }
1967 }
1968
1969 /**
1970  * utility function to prevent getservbyname() being called with a numeric value
1971  * on Windows at least it returns garage results.
1972  */
1973 static bool
1974 isUnsignedNumeric(const char *str, size_t len)
1975 {
1976     if (len < 1) return false;
1977
1978     for (; len >0 && *str; ++str, --len) {
1979         if (! isdigit(*str))
1980             return false;
1981     }
1982     return true;
1983 }
1984
1985 /**
1986  \param proto   'tcp' or 'udp' for protocol
1987  \returns       Port the named service is supposed to be listening on.
1988  */
1989 static unsigned short
1990 GetService(const char *proto)
1991 {
1992     struct servent *port = NULL;
1993     /** Parses a port number or service name from the squid.conf */
1994     char *token = ConfigParser::NextToken();
1995     if (token == NULL) {
1996         self_destruct();
1997         return 0; /* NEVER REACHED */
1998     }
1999     /** Returns either the service port number from /etc/services */
2000     if ( !isUnsignedNumeric(token, strlen(token)) )
2001         port = getservbyname(token, proto);
2002     if (port != NULL) {
2003         return ntohs((unsigned short)port->s_port);
2004     }
2005     /** Or a numeric translation of the config text. */
2006     return xatos(token);
2007 }
2008
2009 /**
2010  \returns       Port the named TCP service is supposed to be listening on.
2011  \copydoc GetService(const char *proto)
2012  */
2013 inline unsigned short
2014 GetTcpService(void)
2015 {
2016     return GetService("tcp");
2017 }
2018
2019 /**
2020  \returns       Port the named UDP service is supposed to be listening on.
2021  \copydoc GetService(const char *proto)
2022  */
2023 inline unsigned short
2024 GetUdpService(void)
2025 {
2026     return GetService("udp");
2027 }
2028
2029 static void
2030 parse_peer(CachePeer ** head)
2031 {
2032     char *host_str = ConfigParser::NextToken();
2033     if (!host_str) {
2034         self_destruct();
2035         return;
2036     }
2037
2038     char *token = ConfigParser::NextToken();
2039     if (!token) {
2040         self_destruct();
2041         return;
2042     }
2043
2044     CachePeer *p = new CachePeer;
2045     p->host = xstrdup(host_str);
2046     p->name = xstrdup(host_str);
2047     p->type = parseNeighborType(token);
2048
2049     if (p->type == PEER_MULTICAST) {
2050         p->options.no_digest = true;
2051         p->options.no_netdb_exchange = true;
2052     }
2053
2054     p->http_port = GetTcpService();
2055
2056     if (!p->http_port) {
2057         delete p;
2058         self_destruct();
2059         return;
2060     }
2061
2062     p->icp.port = GetUdpService();
2063
2064     while ((token = ConfigParser::NextToken())) {
2065         if (!strcmp(token, "proxy-only")) {
2066             p->options.proxy_only = true;
2067         } else if (!strcmp(token, "no-query")) {
2068             p->options.no_query = true;
2069         } else if (!strcmp(token, "background-ping")) {
2070             p->options.background_ping = true;
2071         } else if (!strcmp(token, "no-digest")) {
2072             p->options.no_digest = true;
2073         } else if (!strcmp(token, "no-tproxy")) {
2074             p->options.no_tproxy = true;
2075         } else if (!strcmp(token, "multicast-responder")) {
2076             p->options.mcast_responder = true;
2077 #if PEER_MULTICAST_SIBLINGS
2078         } else if (!strcmp(token, "multicast-siblings")) {
2079             p->options.mcast_siblings = true;
2080 #endif
2081         } else if (!strncmp(token, "weight=", 7)) {
2082             p->weight = xatoi(token + 7);
2083         } else if (!strncmp(token, "basetime=", 9)) {
2084             p->basetime = xatoi(token + 9);
2085         } else if (!strcmp(token, "closest-only")) {
2086             p->options.closest_only = true;
2087         } else if (!strncmp(token, "ttl=", 4)) {
2088             p->mcast.ttl = xatoi(token + 4);
2089
2090             if (p->mcast.ttl < 0)
2091                 p->mcast.ttl = 0;
2092
2093             if (p->mcast.ttl > 128)
2094                 p->mcast.ttl = 128;
2095         } else if (!strcmp(token, "default")) {
2096             p->options.default_parent = true;
2097         } else if (!strcmp(token, "round-robin")) {
2098             p->options.roundrobin = true;
2099         } else if (!strcmp(token, "weighted-round-robin")) {
2100             p->options.weighted_roundrobin = true;
2101 #if USE_HTCP
2102         } else if (!strcmp(token, "htcp")) {
2103             p->options.htcp = true;
2104         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2105             /* Note: The htcp- form is deprecated, replaced by htcp= */
2106             p->options.htcp = true;
2107             char *tmp = xstrdup(token+5);
2108             char *mode, *nextmode;
2109             for (mode = nextmode = tmp; mode; mode = nextmode) {
2110                 nextmode = strchr(mode, ',');
2111                 if (nextmode) {
2112                     *nextmode = '\0';
2113                     ++nextmode;
2114                 }
2115                 if (!strcmp(mode, "no-clr")) {
2116                     if (p->options.htcp_only_clr)
2117                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2118                     p->options.htcp_no_clr = true;
2119                 } else if (!strcmp(mode, "no-purge-clr")) {
2120                     p->options.htcp_no_purge_clr = true;
2121                 } else if (!strcmp(mode, "only-clr")) {
2122                     if (p->options.htcp_no_clr)
2123                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2124                     p->options.htcp_only_clr = true;
2125                 } else if (!strcmp(mode, "forward-clr")) {
2126                     p->options.htcp_forward_clr = true;
2127                 } else if (!strcmp(mode, "oldsquid")) {
2128                     p->options.htcp_oldsquid = true;
2129                 } else {
2130                     fatalf("invalid HTCP mode '%s'", mode);
2131                 }
2132             }
2133             safe_free(tmp);
2134 #endif
2135         } else if (!strcmp(token, "no-netdb-exchange")) {
2136             p->options.no_netdb_exchange = true;
2137
2138         } else if (!strcmp(token, "carp")) {
2139             if (p->type != PEER_PARENT)
2140                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2141
2142             p->options.carp = true;
2143         } else if (!strncmp(token, "carp-key=", 9)) {
2144             if (p->options.carp != true)
2145                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2146             p->options.carp_key.set = true;
2147             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2148             for (; key; key = nextkey) {
2149                 nextkey=strchr(key,',');
2150                 if (nextkey) ++nextkey; // skip the comma, any
2151                 if (0==strncmp(key,"scheme",6)) {
2152                     p->options.carp_key.scheme = true;
2153                 } else if (0==strncmp(key,"host",4)) {
2154                     p->options.carp_key.host = true;
2155                 } else if (0==strncmp(key,"port",4)) {
2156                     p->options.carp_key.port = true;
2157                 } else if (0==strncmp(key,"path",4)) {
2158                     p->options.carp_key.path = true;
2159                 } else if (0==strncmp(key,"params",6)) {
2160                     p->options.carp_key.params = true;
2161                 } else {
2162                     fatalf("invalid carp-key '%s'",key);
2163                 }
2164             }
2165         } else if (!strcmp(token, "userhash")) {
2166 #if USE_AUTH
2167             if (p->type != PEER_PARENT)
2168                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2169
2170             p->options.userhash = true;
2171 #else
2172             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2173 #endif
2174         } else if (!strcmp(token, "sourcehash")) {
2175             if (p->type != PEER_PARENT)
2176                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2177
2178             p->options.sourcehash = true;
2179
2180         } else if (!strcmp(token, "no-delay")) {
2181 #if USE_DELAY_POOLS
2182             p->options.no_delay = true;
2183 #else
2184             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2185 #endif
2186         } else if (!strncmp(token, "login=", 6)) {
2187             p->login = xstrdup(token + 6);
2188             rfc1738_unescape(p->login);
2189         } else if (!strcmp(token, "auth-no-keytab")) {
2190             p->options.auth_no_keytab = 1;
2191         } else if (!strncmp(token, "connect-timeout=", 16)) {
2192             p->connect_timeout = xatoi(token + 16);
2193         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2194             p->connect_fail_limit = xatoi(token + 19);
2195 #if USE_CACHE_DIGESTS
2196         } else if (!strncmp(token, "digest-url=", 11)) {
2197             p->digest_url = xstrdup(token + 11);
2198 #endif
2199
2200         } else if (!strcmp(token, "allow-miss")) {
2201             p->options.allow_miss = true;
2202         } else if (!strncmp(token, "max-conn=", 9)) {
2203             p->max_conn = xatoi(token + 9);
2204         } else if (!strncmp(token, "standby=", 8)) {
2205             p->standby.limit = xatoi(token + 8);
2206         } else if (!strcmp(token, "originserver")) {
2207             p->options.originserver = true;
2208         } else if (!strncmp(token, "name=", 5)) {
2209             safe_free(p->name);
2210
2211             if (token[5])
2212                 p->name = xstrdup(token + 5);
2213         } else if (!strncmp(token, "forceddomain=", 13)) {
2214             safe_free(p->domain);
2215             if (token[13])
2216                 p->domain = xstrdup(token + 13);
2217
2218         } else if (strncmp(token, "ssl", 3) == 0) {
2219 #if !USE_OPENSSL
2220             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2221 #else
2222             p->secure.parse(token+3);
2223 #endif
2224         } else if (strncmp(token, "tls-", 4) == 0) {
2225             p->secure.parse(token+4);
2226         } else if (strncmp(token, "tls", 3) == 0) {
2227             p->secure.parse(token+3);
2228         } else if (strcmp(token, "front-end-https") == 0) {
2229             p->front_end_https = 1;
2230         } else if (strcmp(token, "front-end-https=on") == 0) {
2231             p->front_end_https = 1;
2232         } else if (strcmp(token, "front-end-https=auto") == 0) {
2233             p->front_end_https = 2;
2234         } else if (strcmp(token, "connection-auth=off") == 0) {
2235             p->connection_auth = 0;
2236         } else if (strcmp(token, "connection-auth") == 0) {
2237             p->connection_auth = 1;
2238         } else if (strcmp(token, "connection-auth=on") == 0) {
2239             p->connection_auth = 1;
2240         } else if (strcmp(token, "connection-auth=auto") == 0) {
2241             p->connection_auth = 2;
2242         } else if (token[0] == '#') {
2243             // start of a text comment. stop reading this line.
2244             break;
2245         } else {
2246             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2247         }
2248     }
2249
2250     if (peerFindByName(p->name))
2251         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2252
2253     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2254         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2255
2256     if (p->weight < 1)
2257         p->weight = 1;
2258
2259     if (p->connect_fail_limit < 1)
2260         p->connect_fail_limit = 10;
2261
2262 #if USE_CACHE_DIGESTS
2263
2264     if (!p->options.no_digest) {
2265         /* XXX This looks odd.. who has the original pointer
2266          * then?
2267          */
2268         PeerDigest *pd = peerDigestCreate(p);
2269         p->digest = cbdataReference(pd);
2270     }
2271
2272 #endif
2273
2274     p->index =  ++Config.npeers;
2275
2276     while (*head != NULL)
2277         head = &(*head)->next;
2278
2279     *head = p;
2280
2281     peerClearRRStart();
2282 }
2283
2284 static void
2285 free_peer(CachePeer ** P)
2286 {
2287     delete *P;
2288     *P = NULL;
2289     Config.npeers = 0;
2290 }
2291
2292 static void
2293 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2294 {
2295     wordlist *w;
2296
2297     while (list != NULL) {
2298         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2299             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2300         else
2301             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2302
2303         for (w = list->actions; w != NULL; w = w->next) {
2304             storeAppendPrintf(entry, " %s", w->key);
2305         }
2306
2307         storeAppendPrintf(entry, "\n");
2308         list = list->next;
2309     }
2310 }
2311
2312 static void
2313 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2314 {
2315     char *passwd = NULL;
2316     wordlist *actions = NULL;
2317     Mgr::ActionPasswordList *p;
2318     Mgr::ActionPasswordList **P;
2319     parse_string(&passwd);
2320     parse_wordlist(&actions);
2321     p = new Mgr::ActionPasswordList;
2322     p->passwd = passwd;
2323     p->actions = actions;
2324
2325     for (P = head; *P; P = &(*P)->next) {
2326         /*
2327          * See if any of the actions from this line already have a
2328          * password from previous lines.  The password checking
2329          * routines in cache_manager.c take the the password from
2330          * the first Mgr::ActionPasswordList that contains the
2331          * requested action.  Thus, we should warn users who might
2332          * think they can have two passwords for the same action.
2333          */
2334         wordlist *w;
2335         wordlist *u;
2336
2337         for (w = (*P)->actions; w; w = w->next) {
2338             for (u = actions; u; u = u->next) {
2339                 if (strcmp(w->key, u->key))
2340                     continue;
2341
2342                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2343             }
2344         }
2345     }
2346
2347     *P = p;
2348 }
2349
2350 static void
2351 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2352 {
2353     Mgr::ActionPasswordList *p;
2354
2355     while ((p = *head) != NULL) {
2356         *head = p->next;
2357         xfree(p->passwd);
2358         wordlistDestroy(&p->actions);
2359         xfree(p);
2360     }
2361 }
2362
2363 static void
2364 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2365 {
2366     AclNameList *a;
2367
2368     while (var != NULL) {
2369         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2370
2371         for (a = var->acl_list; a != NULL; a = a->next)
2372             storeAppendPrintf(entry, " %s", a->name);
2373
2374         storeAppendPrintf(entry, "\n");
2375
2376         var = var->next;
2377     }
2378 }
2379
2380 static void
2381 parse_denyinfo(AclDenyInfoList ** var)
2382 {
2383     aclParseDenyInfoLine(var);
2384 }
2385
2386 void
2387 free_denyinfo(AclDenyInfoList ** list)
2388 {
2389     AclDenyInfoList *a = NULL;
2390     AclDenyInfoList *a_next = NULL;
2391     AclNameList *l = NULL;
2392     AclNameList *l_next = NULL;
2393
2394     for (a = *list; a; a = a_next) {
2395         for (l = a->acl_list; l; l = l_next) {
2396             l_next = l->next;
2397             memFree(l, MEM_ACL_NAME_LIST);
2398             l = NULL;
2399         }
2400
2401         a_next = a->next;
2402         memFree(a, MEM_ACL_DENY_INFO_LIST);
2403         a = NULL;
2404     }
2405
2406     *list = NULL;
2407 }
2408
2409 static void
2410 parse_peer_access(void)
2411 {
2412     char *host = ConfigParser::NextToken();
2413     if (!host) {
2414         self_destruct();
2415         return;
2416     }
2417
2418     CachePeer *p = peerFindByName(host);
2419     if (!p) {
2420         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2421         return;
2422     }
2423
2424     std::string directive = "peer_access ";
2425     directive += host;
2426     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2427 }
2428
2429 static void
2430 parse_hostdomaintype(void)
2431 {
2432     char *host = ConfigParser::NextToken();
2433     if (!host) {
2434         self_destruct();
2435         return;
2436     }
2437
2438     char *type = ConfigParser::NextToken();
2439     if (!type) {
2440         self_destruct();
2441         return;
2442     }
2443
2444     char *domain = nullptr;
2445     while ((domain = ConfigParser::NextToken())) {
2446         CachePeer *p = peerFindByName(host);
2447         if (!p) {
2448             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2449             return;
2450         }
2451
2452         auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2453         l->type = parseNeighborType(type);
2454         l->domain = xstrdup(domain);
2455
2456         NeighborTypeDomainList **L = nullptr;
2457         for (L = &(p->typelist); *L; L = &((*L)->next));
2458         *L = l;
2459     }
2460 }
2461
2462 static void
2463 dump_int(StoreEntry * entry, const char *name, int var)
2464 {
2465     storeAppendPrintf(entry, "%s %d\n", name, var);
2466 }
2467
2468 void
2469 parse_int(int *var)
2470 {
2471     int i;
2472     i = GetInteger();
2473     *var = i;
2474 }
2475
2476 static void
2477 free_int(int *var)
2478 {
2479     *var = 0;
2480 }
2481
2482 static void
2483 dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2484 {
2485     storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2486 }
2487
2488 void
2489 parse_int64_t(int64_t *var)
2490 {
2491     int64_t i;
2492     i = GetInteger64();
2493     *var = i;
2494 }
2495
2496 static void
2497 free_int64_t(int64_t *var)
2498 {
2499     *var = 0;
2500 }
2501
2502 static void
2503 dump_onoff(StoreEntry * entry, const char *name, int var)
2504 {
2505     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2506 }
2507
2508 void
2509 parse_onoff(int *var)
2510 {
2511     char *token = ConfigParser::NextToken();
2512     if (!token) {
2513         self_destruct();
2514         return;
2515     }
2516
2517     if (!strcmp(token, "on")) {
2518         *var = 1;
2519     } else if (!strcmp(token, "enable")) {
2520         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2521         *var = 1;
2522     } else if (!strcmp(token, "off")) {
2523         *var = 0;
2524     } else if (!strcmp(token, "disable")) {
2525         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2526         *var = 0;
2527     } else {
2528         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2529         self_destruct();
2530     }
2531 }
2532
2533 #define free_onoff free_int
2534
2535 static void
2536 dump_tristate(StoreEntry * entry, const char *name, int var)
2537 {
2538     const char *state;
2539
2540     if (var > 0)
2541         state = "on";
2542     else if (var < 0)
2543         state = "warn";
2544     else
2545         state = "off";
2546
2547     storeAppendPrintf(entry, "%s %s\n", name, state);
2548 }
2549
2550 static void
2551 parse_tristate(int *var)
2552 {
2553     char *token = ConfigParser::NextToken();
2554     if (!token) {
2555         self_destruct();
2556         return;
2557     }
2558
2559     if (!strcmp(token, "on")) {
2560         *var = 1;
2561     } else if (!strcmp(token, "enable")) {
2562         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2563         *var = 1;
2564     } else if (!strcmp(token, "warn")) {
2565         *var = -1;
2566     } else if (!strcmp(token, "off")) {
2567         *var = 0;
2568     } else if (!strcmp(token, "disable")) {
2569         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2570         *var = 0;
2571     } else {
2572         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2573         self_destruct();
2574     }
2575 }
2576
2577 #define free_tristate free_int
2578
2579 void
2580 parse_pipelinePrefetch(int *var)
2581 {
2582     char *token = ConfigParser::PeekAtToken();
2583     if (!token) {
2584         self_destruct();
2585         return;
2586     }
2587
2588     if (!strcmp(token, "on")) {
2589         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2590         *var = 1;
2591         //pop the token
2592         (void)ConfigParser::NextToken();
2593     } else if (!strcmp(token, "off")) {
2594         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2595         *var = 0;
2596         //pop the token
2597         (void)ConfigParser::NextToken();
2598     } else
2599         parse_int(var);
2600 }
2601
2602 #define free_pipelinePrefetch free_int
2603 #define dump_pipelinePrefetch dump_int
2604
2605 static void
2606 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2607 {
2608     while (head != NULL) {
2609         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2610                           name,
2611                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2612                           head->pattern.c_str(),
2613                           (int) head->min / 60,
2614                           (int) (100.0 * head->pct + 0.5),
2615                           (int) head->max / 60);
2616
2617         if (head->max_stale >= 0)
2618             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2619
2620         if (head->flags.refresh_ims)
2621             storeAppendPrintf(entry, " refresh-ims");
2622
2623         if (head->flags.store_stale)
2624             storeAppendPrintf(entry, " store-stale");
2625
2626 #if USE_HTTP_VIOLATIONS
2627
2628         if (head->flags.override_expire)
2629             storeAppendPrintf(entry, " override-expire");
2630
2631         if (head->flags.override_lastmod)
2632             storeAppendPrintf(entry, " override-lastmod");
2633
2634         if (head->flags.reload_into_ims)
2635             storeAppendPrintf(entry, " reload-into-ims");
2636
2637         if (head->flags.ignore_reload)
2638             storeAppendPrintf(entry, " ignore-reload");
2639
2640         if (head->flags.ignore_no_store)
2641             storeAppendPrintf(entry, " ignore-no-store");
2642
2643         if (head->flags.ignore_private)
2644             storeAppendPrintf(entry, " ignore-private");
2645 #endif
2646
2647         storeAppendPrintf(entry, "\n");
2648
2649         head = head->next;
2650     }
2651 }
2652
2653 static void
2654 parse_refreshpattern(RefreshPattern ** head)
2655 {
2656     char *token;
2657     char *pattern;
2658     time_t min = 0;
2659     double pct = 0.0;
2660     time_t max = 0;
2661     int refresh_ims = 0;
2662     int store_stale = 0;
2663     int max_stale = -1;
2664
2665 #if USE_HTTP_VIOLATIONS
2666
2667     int override_expire = 0;
2668     int override_lastmod = 0;
2669     int reload_into_ims = 0;
2670     int ignore_reload = 0;
2671     int ignore_no_store = 0;
2672     int ignore_private = 0;
2673 #endif
2674
2675     int i;
2676     RefreshPattern *t;
2677     regex_t comp;
2678     int errcode;
2679     int flags = REG_EXTENDED | REG_NOSUB;
2680
2681     if ((token = ConfigParser::RegexPattern()) != NULL) {
2682
2683         if (strcmp(token, "-i") == 0) {
2684             flags |= REG_ICASE;
2685             token = ConfigParser::RegexPattern();
2686         } else if (strcmp(token, "+i") == 0) {
2687             flags &= ~REG_ICASE;
2688             token = ConfigParser::RegexPattern();
2689         }
2690
2691     }
2692
2693     if (token == NULL) {
2694         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2695         self_destruct();
2696         return;
2697     }
2698
2699     pattern = xstrdup(token);
2700
2701     i = GetInteger();       /* token: min */
2702
2703     /* catch negative and insanely huge values close to 32-bit wrap */
2704     if (i < 0) {
2705         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2706         i = 0;
2707     }
2708     if (i > 60*24*365) {
2709         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2710         i = 60*24*365;
2711     }
2712
2713     min = (time_t) (i * 60);    /* convert minutes to seconds */
2714
2715     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2716
2717     i = GetInteger();       /* token: max */
2718
2719     /* catch negative and insanely huge values close to 32-bit wrap */
2720     if (i < 0) {
2721         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2722         i = 0;
2723     }
2724     if (i > 60*24*365) {
2725         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2726         i = 60*24*365;
2727     }
2728
2729     max = (time_t) (i * 60);    /* convert minutes to seconds */
2730
2731     /* Options */
2732     while ((token = ConfigParser::NextToken()) != NULL) {
2733         if (!strcmp(token, "refresh-ims")) {
2734             refresh_ims = 1;
2735         } else if (!strcmp(token, "store-stale")) {
2736             store_stale = 1;
2737         } else if (!strncmp(token, "max-stale=", 10)) {
2738             max_stale = xatoi(token + 10);
2739
2740 #if USE_HTTP_VIOLATIONS
2741
2742         } else if (!strcmp(token, "override-expire"))
2743             override_expire = 1;
2744         else if (!strcmp(token, "override-lastmod"))
2745             override_lastmod = 1;
2746         else if (!strcmp(token, "ignore-no-store"))
2747             ignore_no_store = 1;
2748         else if (!strcmp(token, "ignore-private"))
2749             ignore_private = 1;
2750         else if (!strcmp(token, "reload-into-ims")) {
2751             reload_into_ims = 1;
2752             refresh_nocache_hack = 1;
2753             /* tell client_side.c that this is used */
2754         } else if (!strcmp(token, "ignore-reload")) {
2755             ignore_reload = 1;
2756             refresh_nocache_hack = 1;
2757             /* tell client_side.c that this is used */
2758 #endif
2759
2760         } else if (!strcmp(token, "ignore-no-cache") ||
2761                    !strcmp(token, "ignore-must-revalidate") ||
2762                    !strcmp(token, "ignore-auth")
2763                   ) {
2764             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2765         } else
2766             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2767     }
2768
2769     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2770         char errbuf[256];
2771         regerror(errcode, &comp, errbuf, sizeof errbuf);
2772         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2773         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2774         xfree(pattern);
2775         return;
2776     }
2777
2778     pct = pct < 0.0 ? 0.0 : pct;
2779     max = max < 0 ? 0 : max;
2780     t = new RefreshPattern(pattern, flags);
2781     t->pattern.regex = comp;
2782     t->min = min;
2783     t->pct = pct;
2784     t->max = max;
2785
2786     if (refresh_ims)
2787         t->flags.refresh_ims = true;
2788
2789     if (store_stale)
2790         t->flags.store_stale = true;
2791
2792     t->max_stale = max_stale;
2793
2794 #if USE_HTTP_VIOLATIONS
2795
2796     if (override_expire)
2797         t->flags.override_expire = true;
2798
2799     if (override_lastmod)
2800         t->flags.override_lastmod = true;
2801
2802     if (reload_into_ims)
2803         t->flags.reload_into_ims = true;
2804
2805     if (ignore_reload)
2806         t->flags.ignore_reload = true;
2807
2808     if (ignore_no_store)
2809         t->flags.ignore_no_store = true;
2810
2811     if (ignore_private)
2812         t->flags.ignore_private = true;
2813 #endif
2814
2815     t->next = NULL;
2816
2817     while (*head)
2818         head = &(*head)->next;
2819
2820     *head = t;
2821
2822     xfree(pattern);
2823 }
2824
2825 static void
2826 free_refreshpattern(RefreshPattern ** head)
2827 {
2828     delete *head;
2829     *head = nullptr;
2830
2831 #if USE_HTTP_VIOLATIONS
2832     refresh_nocache_hack = 0;
2833
2834 #endif
2835 }
2836
2837 static void
2838 dump_string(StoreEntry * entry, const char *name, char *var)
2839 {
2840     if (var != NULL)
2841         storeAppendPrintf(entry, "%s %s\n", name, var);
2842 }
2843
2844 static void
2845 parse_string(char **var)
2846 {
2847     safe_free(*var);
2848
2849     char *token = ConfigParser::NextToken();
2850     if (!token) {
2851         self_destruct();
2852         return;
2853     }
2854
2855     *var = xstrdup(token);
2856 }
2857
2858 static void
2859 free_string(char **var)
2860 {
2861     safe_free(*var);
2862 }
2863
2864 void
2865 parse_eol(char *volatile *var)
2866 {
2867     if (!var) {
2868         self_destruct();
2869         return;
2870     }
2871
2872     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2873     safe_free(*var);
2874
2875     if (!token) {
2876         self_destruct();
2877         return;
2878     }
2879
2880     while (*token && xisspace(*token))
2881         ++token;
2882
2883     if (!*token) {
2884         self_destruct();
2885         return;
2886     }
2887
2888     *var = xstrdup((char *) token);
2889 }
2890
2891 #define dump_eol dump_string
2892 #define free_eol free_string
2893
2894 static void
2895 parse_TokenOrQuotedString(char **var)
2896 {
2897     safe_free(*var);
2898
2899     char *token = ConfigParser::NextQuotedToken();
2900     if (!token) {
2901         self_destruct();
2902         return;
2903     }
2904
2905     *var = xstrdup(token);
2906 }
2907
2908 #define dump_TokenOrQuotedString dump_string
2909 #define free_TokenOrQuotedString free_string
2910
2911 static void
2912 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2913 {
2914     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2915 }
2916
2917 void
2918 parse_time_t(time_t * var)
2919 {
2920     time_msec_t tval;
2921     parseTimeLine(&tval, T_SECOND_STR, false);
2922     *var = static_cast<time_t>(tval/1000);
2923 }
2924
2925 static void
2926 free_time_t(time_t * var)
2927 {
2928     *var = 0;
2929 }
2930
2931 static void
2932 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2933 {
2934     if (var % 1000)
2935         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2936     else
2937         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2938 }
2939
2940 void
2941 parse_time_msec(time_msec_t * var)
2942 {
2943     parseTimeLine(var, T_SECOND_STR, true);
2944 }
2945
2946 static void
2947 free_time_msec(time_msec_t * var)
2948 {
2949     *var = 0;
2950 }
2951
2952 #if UNUSED_CODE
2953 static void
2954 dump_size_t(StoreEntry * entry, const char *name, size_t var)
2955 {
2956     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
2957 }
2958 #endif
2959
2960 static void
2961 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
2962 {
2963     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2964 }
2965
2966 static void
2967 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
2968 {
2969     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2970 }
2971
2972 #if UNUSED_CODE
2973 static void
2974 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
2975 {
2976     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
2977 }
2978 #endif
2979
2980 static void
2981 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
2982 {
2983     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
2984 }
2985
2986 static void
2987 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
2988 {
2989     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
2990 }
2991
2992 #if UNUSED_CODE
2993 static void
2994 parse_size_t(size_t * var)
2995 {
2996     int i;
2997     i = GetInteger();
2998     *var = (size_t) i;
2999 }
3000 #endif
3001
3002 static void
3003 parse_b_size_t(size_t * var)
3004 {
3005     parseBytesLine(var, B_BYTES_STR);
3006 }
3007
3008 static void
3009 parse_b_ssize_t(ssize_t * var)
3010 {
3011     parseBytesLineSigned(var, B_BYTES_STR);
3012 }
3013
3014 #if UNUSED_CODE
3015 static void
3016 parse_kb_size_t(size_t * var)
3017 {
3018     parseBytesLine(var, B_KBYTES_STR);
3019 }
3020 #endif
3021
3022 static void
3023 parse_b_int64_t(int64_t * var)
3024 {
3025     parseBytesLine64(var, B_BYTES_STR);
3026 }
3027
3028 static void
3029 parse_kb_int64_t(int64_t * var)
3030 {
3031     parseBytesLine64(var, B_KBYTES_STR);
3032 }
3033
3034 static void
3035 free_size_t(size_t * var)
3036 {
3037     *var = 0;
3038 }
3039
3040 static void
3041 free_ssize_t(ssize_t * var)
3042 {
3043     *var = 0;
3044 }
3045
3046 static void
3047 free_b_int64_t(int64_t * var)
3048 {
3049     *var = 0;
3050 }
3051
3052 #define free_b_size_t free_size_t
3053 #define free_b_ssize_t free_ssize_t
3054 #define free_kb_size_t free_size_t
3055 #define free_mb_size_t free_size_t
3056 #define free_gb_size_t free_size_t
3057 #define free_kb_int64_t free_b_int64_t
3058
3059 static void
3060 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3061 {
3062     storeAppendPrintf(entry, "%s %d\n", name, var);
3063 }
3064
3065 static void
3066 free_u_short(unsigned short * u)
3067 {
3068     *u = 0;
3069 }
3070
3071 static void
3072 parse_u_short(unsigned short * var)
3073 {
3074     ConfigParser::ParseUShort(var);
3075 }
3076
3077 void
3078 ConfigParser::ParseUShort(unsigned short *var)
3079 {
3080     *var = GetShort();
3081 }
3082
3083 void
3084 ConfigParser::ParseBool(bool *var)
3085 {
3086     int i = GetInteger();
3087
3088     if (0 == i)
3089         *var = false;
3090     else if (1 == i)
3091         *var = true;
3092     else
3093         self_destruct();
3094 }
3095
3096 static void
3097 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3098 {
3099     while (list != NULL) {
3100         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3101         list = list->next;
3102     }
3103 }
3104
3105 void
3106 ConfigParser::ParseWordList(wordlist ** list)
3107 {
3108     parse_wordlist(list);
3109 }
3110
3111 void
3112 parse_wordlist(wordlist ** list)
3113 {
3114     char *token;
3115     while ((token = ConfigParser::NextQuotedToken()))
3116         wordlistAdd(list, token);
3117 }
3118
3119 #if 0 /* now unused */
3120 static int
3121 check_null_wordlist(wordlist * w)
3122 {
3123     return w == NULL;
3124 }
3125 #endif
3126
3127 static int
3128 check_null_acl_access(acl_access * a)
3129 {
3130     return a == NULL;
3131 }
3132
3133 #define free_wordlist wordlistDestroy
3134
3135 #define free_uri_whitespace free_int
3136
3137 static void
3138 parse_uri_whitespace(int *var)
3139 {
3140     char *token = ConfigParser::NextToken();
3141     if (!token) {
3142         self_destruct();
3143         return;
3144     }
3145
3146     if (!strcmp(token, "strip"))
3147         *var = URI_WHITESPACE_STRIP;
3148     else if (!strcmp(token, "deny"))
3149         *var = URI_WHITESPACE_DENY;
3150     else if (!strcmp(token, "allow"))
3151         *var = URI_WHITESPACE_ALLOW;
3152     else if (!strcmp(token, "encode"))
3153         *var = URI_WHITESPACE_ENCODE;
3154     else if (!strcmp(token, "chop"))
3155         *var = URI_WHITESPACE_CHOP;
3156     else {
3157         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3158         self_destruct();
3159     }
3160 }
3161
3162 static void
3163 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3164 {
3165     const char *s;
3166
3167     if (var == URI_WHITESPACE_ALLOW)
3168         s = "allow";
3169     else if (var == URI_WHITESPACE_ENCODE)
3170         s = "encode";
3171     else if (var == URI_WHITESPACE_CHOP)
3172         s = "chop";
3173     else if (var == URI_WHITESPACE_DENY)
3174         s = "deny";
3175     else
3176         s = "strip";
3177
3178     storeAppendPrintf(entry, "%s %s\n", name, s);
3179 }
3180
3181 static void
3182 free_removalpolicy(RemovalPolicySettings ** settings)
3183 {
3184     if (!*settings)
3185         return;
3186
3187     free_string(&(*settings)->type);
3188
3189     free_wordlist(&(*settings)->args);
3190
3191     delete *settings;
3192
3193     *settings = NULL;
3194 }
3195
3196 static void
3197 parse_removalpolicy(RemovalPolicySettings ** settings)
3198 {
3199     if (*settings)
3200         free_removalpolicy(settings);
3201
3202     *settings = new RemovalPolicySettings;
3203
3204     parse_string(&(*settings)->type);
3205
3206     parse_wordlist(&(*settings)->args);
3207 }
3208
3209 static void
3210 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3211 {
3212     wordlist *args;
3213     storeAppendPrintf(entry, "%s %s", name, settings->type);
3214     args = settings->args;
3215
3216     while (args) {
3217         storeAppendPrintf(entry, " %s", args->key);
3218         args = args->next;
3219     }
3220
3221     storeAppendPrintf(entry, "\n");
3222 }
3223
3224 inline void
3225 free_YesNoNone(YesNoNone *)
3226 {}
3227
3228 static void
3229 parse_YesNoNone(YesNoNone *option)
3230 {
3231     int value = 0;
3232     parse_onoff(&value);
3233     option->configure(value > 0);
3234 }
3235
3236 static void
3237 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3238 {
3239     if (option.configured())
3240         dump_onoff(entry, name, option ? 1 : 0);
3241 }
3242
3243 static void
3244 free_memcachemode(SquidConfig *)
3245 {}
3246
3247 static void
3248 parse_memcachemode(SquidConfig *)
3249 {
3250     char *token = ConfigParser::NextToken();
3251     if (!token) {
3252         self_destruct();
3253         return;
3254     }
3255
3256     if (strcmp(token, "always") == 0) {
3257         Config.onoff.memory_cache_first = 1;
3258         Config.onoff.memory_cache_disk = 1;
3259     } else if (strcmp(token, "disk") == 0) {
3260         Config.onoff.memory_cache_first = 0;
3261         Config.onoff.memory_cache_disk = 1;
3262     } else if (strncmp(token, "net", 3) == 0) {
3263         Config.onoff.memory_cache_first = 1;
3264         Config.onoff.memory_cache_disk = 0;
3265     } else if (strcmp(token, "never") == 0) {
3266         Config.onoff.memory_cache_first = 0;
3267         Config.onoff.memory_cache_disk = 0;
3268     } else {
3269         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3270         self_destruct();
3271     }
3272 }
3273
3274 static void
3275 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3276 {
3277     storeAppendPrintf(entry, "%s ", name);
3278     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3279         storeAppendPrintf(entry, "always");
3280     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3281         storeAppendPrintf(entry, "disk");
3282     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3283         storeAppendPrintf(entry, "network");
3284     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3285         storeAppendPrintf(entry, "none");
3286     storeAppendPrintf(entry, "\n");
3287 }
3288
3289 #include "cf_parser.cci"
3290
3291 peer_t
3292 parseNeighborType(const char *s)
3293 {
3294     if (!strcmp(s, "parent"))
3295         return PEER_PARENT;
3296
3297     if (!strcmp(s, "neighbor"))
3298         return PEER_SIBLING;
3299
3300     if (!strcmp(s, "neighbour"))
3301         return PEER_SIBLING;
3302
3303     if (!strcmp(s, "sibling"))
3304         return PEER_SIBLING;
3305
3306     if (!strcmp(s, "multicast"))
3307         return PEER_MULTICAST;
3308
3309     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3310
3311     return PEER_SIBLING;
3312 }
3313
3314 #if USE_WCCPv2
3315 static void
3316 parse_IpAddress_list(Ip::Address_list ** head)
3317 {
3318     char *token;
3319     Ip::Address_list *s;
3320     Ip::Address ipa;
3321
3322     while ((token = ConfigParser::NextToken())) {
3323         if (GetHostWithPort(token, &ipa)) {
3324
3325             while (*head)
3326                 head = &(*head)->next;
3327
3328             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3329             s->s = ipa;
3330
3331             *head = s;
3332         } else {
3333             self_destruct();
3334             return;
3335         }
3336     }
3337 }
3338
3339 static void
3340 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3341 {
3342     char ntoabuf[MAX_IPSTRLEN];
3343
3344     while (s) {
3345         storeAppendPrintf(e, "%s %s\n",
3346                           n,
3347                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3348         s = s->next;
3349     }
3350 }
3351
3352 static void
3353 free_IpAddress_list(Ip::Address_list ** head)
3354 {
3355     if (*head) delete *head;
3356     *head = NULL;
3357 }
3358
3359 #if CURRENTLY_UNUSED
3360 /* This code was previously used by http_port. Left as it really should
3361  * be used by icp_port and htcp_port
3362  */
3363 static int
3364 check_null_IpAddress_list(const Ip::Address_list * s)
3365 {
3366     return NULL == s;
3367 }
3368
3369 #endif /* CURRENTLY_UNUSED */
3370 #endif /* USE_WCCPv2 */
3371
3372 static void
3373 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3374 {
3375     char *host = NULL;
3376     unsigned short port = 0;
3377     char *t = NULL;
3378     char *junk = NULL;
3379
3380     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3381     s->name = xstrdup(token);
3382     s->connection_auth_disabled = false;
3383
3384     const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3385
3386     if (*token == '[') {
3387         /* [ipv6]:port */
3388         host = token + 1;
3389         t = strchr(host, ']');
3390         if (!t) {
3391             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3392             self_destruct();
3393             return;
3394         }
3395         *t = '\0';
3396         ++t;
3397         if (*t != ':') {
3398             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3399             self_destruct();
3400             return;
3401         }
3402         if (!Ip::EnableIpv6) {
3403             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3404             self_destruct();
3405             return;
3406         }
3407         port = xatos(t + 1);
3408     } else if ((t = strchr(token, ':'))) {
3409         /* host:port */
3410         /* ipv4:port */
3411         host = token;
3412         *t = '\0';
3413         port = xatos(t + 1);
3414
3415     } else if (strtol(token, &junk, 10) && !*junk) {
3416         port = xatos(token);
3417         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3418     } else {
3419         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3420         self_destruct();
3421         return;
3422     }
3423
3424     if (port == 0 && host != NULL) {
3425         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3426         self_destruct();
3427         return;
3428     }
3429
3430     if (NULL == host) {
3431         s->s.setAnyAddr();
3432         s->s.port(port);
3433         if (!Ip::EnableIpv6)
3434             s->s.setIPv4();
3435         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3436     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3437         s->s.port(port);
3438         if (!Ip::EnableIpv6)
3439             s->s.setIPv4();
3440         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3441     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3442         /* dont use ipcache */
3443         s->defaultsite = xstrdup(host);
3444         s->s.port(port);
3445         if (!Ip::EnableIpv6)
3446             s->s.setIPv4();
3447         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3448     } else {
3449         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3450         self_destruct();
3451     }
3452 }
3453
3454 /// parses the protocol= option of the *_port directive, returning parsed value
3455 /// unsupported option values result in a fatal error message
3456 /// upper case values required; caller may convert for backward compatibility
3457 static AnyP::ProtocolVersion
3458 parsePortProtocol(const SBuf &value)
3459 {
3460     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3461     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3462     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3463         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3464
3465     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3466         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3467
3468     if (value.cmp("FTP") == 0)
3469         return Ftp::ProtocolVersion();
3470
3471     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3472     return AnyP::ProtocolVersion(); // not reached
3473 }
3474
3475 static void
3476 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3477 {
3478     /* modes first */
3479
3480     if (strcmp(token, "accel") == 0) {
3481         if (s->flags.isIntercepted()) {
3482             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3483             self_destruct();
3484             return;
3485         }
3486         s->flags.accelSurrogate = true;
3487         s->vhost = true;
3488     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3489         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3490             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3491             self_destruct();
3492             return;
3493         }
3494         s->flags.natIntercept = true;
3495         Ip::Interceptor.StartInterception();
3496         /* Log information regarding the port modes under interception. */
3497         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3498         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3499     } else if (strcmp(token, "tproxy") == 0) {
3500         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3501             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3502             self_destruct();
3503             return;
3504         }
3505         s->flags.tproxyIntercept = true;
3506         Ip::Interceptor.StartTransparency();
3507         /* Log information regarding the port modes under transparency. */
3508         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3509
3510         if (s->flags.proxySurrogate) {
3511             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3512         }
3513
3514         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3515             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3516             self_destruct();
3517             return;
3518         }
3519
3520     } else if (strcmp(token, "require-proxy-header") == 0) {
3521         s->flags.proxySurrogate = true;
3522         if (s->flags.tproxyIntercept) {
3523             // receiving is still permitted, so we do not unset the TPROXY flag
3524             // spoofing access control override takes care of the spoof disable later
3525             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3526         }
3527
3528     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3529         if (!s->flags.accelSurrogate) {
3530             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3531             self_destruct();
3532             return;
3533         }
3534         safe_free(s->defaultsite);
3535         s->defaultsite = xstrdup(token + 12);
3536     } else if (strcmp(token, "vhost") == 0) {
3537         if (!s->flags.accelSurrogate) {
3538             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3539         }
3540         s->flags.accelSurrogate = true;
3541         s->vhost = true;
3542     } else if (strcmp(token, "no-vhost") == 0) {
3543         if (!s->flags.accelSurrogate) {
3544             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3545         }
3546         s->vhost = false;
3547     } else if (strcmp(token, "vport") == 0) {
3548         if (!s->flags.accelSurrogate) {
3549             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3550             self_destruct();
3551             return;
3552         }
3553         s->vport = -1;
3554     } else if (strncmp(token, "vport=", 6) == 0) {
3555         if (!s->flags.accelSurrogate) {
3556             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3557             self_destruct();
3558             return;
3559         }
3560         s->vport = xatos(token + 6);
3561     } else if (strncmp(token, "protocol=", 9) == 0) {
3562         if (!s->flags.accelSurrogate) {
3563             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3564             self_destruct();
3565             return;
3566         }
3567         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3568     } else if (strcmp(token, "allow-direct") == 0) {
3569         if (!s->flags.accelSurrogate) {
3570             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3571             self_destruct();
3572             return;
3573         }
3574         s->allow_direct = true;
3575     } else if (strcmp(token, "act-as-origin") == 0) {
3576         if (!s->flags.accelSurrogate) {
3577             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3578         } else
3579             s->actAsOrigin = true;
3580     } else if (strcmp(token, "ignore-cc") == 0) {
3581 #if !USE_HTTP_VIOLATIONS
3582         if (!s->flags.accelSurrogate) {
3583             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3584             self_destruct();
3585             return;
3586         }
3587 #endif
3588         s->ignore_cc = true;
3589     } else if (strncmp(token, "name=", 5) == 0) {
3590         safe_free(s->name);
3591         s->name = xstrdup(token + 5);
3592     } else if (strcmp(token, "no-connection-auth") == 0) {
3593         s->connection_auth_disabled = true;
3594     } else if (strcmp(token, "connection-auth=off") == 0) {
3595         s->connection_auth_disabled = true;
3596     } else if (strcmp(token, "connection-auth") == 0) {
3597         s->connection_auth_disabled = false;
3598     } else if (strcmp(token, "connection-auth=on") == 0) {
3599         s->connection_auth_disabled = false;
3600     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3601         if (!strcmp(token + 23, "off"))
3602             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3603         else if (!strcmp(token + 23, "transparent"))
3604             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3605         else if (!strcmp(token + 23, "always"))
3606             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3607         else {
3608             self_destruct();
3609             return;
3610         }
3611     } else if (strcmp(token, "ipv4") == 0) {
3612         if ( !s->s.setIPv4() ) {
3613             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3614             self_destruct();
3615             return;
3616         }
3617     } else if (strcmp(token, "tcpkeepalive") == 0) {
3618         s->tcp_keepalive.enabled = true;
3619     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3620         char *t = token + 13;
3621         s->tcp_keepalive.enabled = true;
3622         s->tcp_keepalive.idle = xatoui(t,',');
3623         t = strchr(t, ',');
3624         if (t) {
3625             ++t;
3626             s->tcp_keepalive.interval = xatoui(t,',');
3627             t = strchr(t, ',');
3628         }
3629         if (t) {
3630             ++t;
3631             s->tcp_keepalive.timeout = xatoui(t);
3632         }
3633 #if USE_OPENSSL
3634     } else if (strcmp(token, "sslBump") == 0) {
3635         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3636                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3637         s->flags.tunnelSslBumping = true;
3638     } else if (strcmp(token, "ssl-bump") == 0) {
3639         s->flags.tunnelSslBumping = true;
3640     } else if (strncmp(token, "cert=", 5) == 0) {
3641         s->secure.parse(token);
3642     } else if (strncmp(token, "key=", 4) == 0) {
3643         s->secure.parse(token);
3644     } else if (strncmp(token, "version=", 8) == 0) {
3645         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3646                "in " << cfg_directive << ". Use 'options=' instead.");
3647         s->secure.parse(token);
3648     } else if (strncmp(token, "options=", 8) == 0) {
3649         s->secure.parse(token);
3650     } else if (strncmp(token, "cipher=", 7) == 0) {
3651         s->secure.parse(token);
3652     } else if (strncmp(token, "clientca=", 9) == 0) {
3653         safe_free(s->clientca);
3654         s->clientca = xstrdup(token + 9);
3655     } else if (strncmp(token, "cafile=", 7) == 0) {
3656         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3657                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3658         s->secure.parse(token);
3659     } else if (strncmp(token, "capath=", 7) == 0) {
3660         s->secure.parse(token);
3661     } else if (strncmp(token, "crlfile=", 8) == 0) {
3662         s->secure.parse(token);
3663     } else if (strncmp(token, "dhparams=", 9) == 0) {
3664         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3665                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3666         s->secure.parse(token);
3667     } else if (strncmp(token, "sslflags=", 9) == 0) {
3668         // NP: deprecation warnings output by secure.parse() when relevant
3669         s->secure.parse(token+3);
3670     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3671         safe_free(s->sslContextSessionId);
3672         s->sslContextSessionId = xstrdup(token + 11);
3673     } else if (strcmp(token, "generate-host-certificates") == 0) {
3674         s->generateHostCertificates = true;
3675     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3676         s->generateHostCertificates = true;
3677     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3678         s->generateHostCertificates = false;
3679     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3680         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3681 #endif
3682     } else if (strncmp(token, "tls-", 4) == 0) {
3683         s->secure.parse(token+4);
3684     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3685         s->ftp_track_dirs = true;
3686     } else {
3687         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3688         self_destruct();
3689     }
3690 }
3691
3692 void
3693 add_http_port(char *portspec)
3694 {
3695     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3696     s->transport = parsePortProtocol(SBuf("HTTP"));
3697     parsePortSpecification(s, portspec);
3698     // we may need to merge better if the above returns a list with clones
3699     assert(s->next == NULL);
3700     s->next = HttpPortList;
3701     HttpPortList = s;
3702 }
3703
3704 static void
3705 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3706 {
3707     SBuf protoName;
3708     if (strcmp(optionName, "http_port") == 0 ||
3709             strcmp(optionName, "ascii_port") == 0)
3710         protoName = "HTTP";
3711     else if (strcmp(optionName, "https_port") == 0)
3712         protoName = "HTTPS";
3713     else if (strcmp(optionName, "ftp_port") == 0)
3714         protoName = "FTP";
3715     if (protoName.isEmpty()) {
3716         self_destruct();
3717         return;
3718     }
3719
3720     char *token = ConfigParser::NextToken();
3721
3722     if (!token) {
3723         self_destruct();
3724         return;
3725     }
3726
3727     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3728     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3729     parsePortSpecification(s, token);
3730
3731     /* parse options ... */
3732     while ((token = ConfigParser::NextToken())) {
3733         parse_port_option(s, token);
3734     }
3735
3736 #if USE_OPENSSL
3737     // if clientca has been defined but not cafile, then use it to verify
3738     // but if cafile has been defined, only use that to verify
3739     if (s->clientca && !s->secure.caFiles.size())
3740         s->secure.caFiles.emplace_back(SBuf(s->clientca));
3741 #endif
3742
3743     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3744         s->secure.encryptTransport = true;
3745 #if USE_OPENSSL
3746         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3747         const bool hijacked = s->flags.isIntercepted();
3748         if (s->flags.tunnelSslBumping && !hijacked) {
3749             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3750             self_destruct();
3751             return;
3752         }
3753         if (hijacked && !s->flags.tunnelSslBumping) {
3754             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3755             self_destruct();
3756             return;
3757         }
3758 #endif
3759         if (s->flags.proxySurrogate) {
3760             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3761             self_destruct();
3762             return;
3763         }
3764     } else if (protoName.cmp("FTP") == 0) {
3765         /* ftp_port does not support ssl-bump */
3766         if (s->flags.tunnelSslBumping) {
3767             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3768             self_destruct();
3769             return;
3770         }
3771         if (s->flags.proxySurrogate) {
3772             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3773             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3774             self_destruct();
3775             return;
3776         }
3777     }
3778
3779     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3780         // clone the port options from *s to *(s->next)
3781         s->next = s->clone();
3782         s->next->s.setIPv4();
3783         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).image() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3784     }
3785
3786     while (*head != NULL)
3787         head = &((*head)->next);
3788
3789     *head = s;
3790 }
3791
3792 static void
3793 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3794 {
3795     char buf[MAX_IPSTRLEN];
3796
3797     storeAppendPrintf(e, "%s %s",
3798                       n,
3799                       s->s.toUrl(buf,MAX_IPSTRLEN));
3800
3801     // MODES and specific sub-options.
3802     if (s->flags.natIntercept)
3803         storeAppendPrintf(e, " intercept");
3804
3805     else if (s->flags.tproxyIntercept)
3806         storeAppendPrintf(e, " tproxy");
3807
3808     else if (s->flags.proxySurrogate)
3809         storeAppendPrintf(e, " require-proxy-header");
3810
3811     else if (s->flags.accelSurrogate) {
3812         storeAppendPrintf(e, " accel");
3813
3814         if (s->vhost)
3815             storeAppendPrintf(e, " vhost");
3816
3817         if (s->vport < 0)
3818             storeAppendPrintf(e, " vport");
3819         else if (s->vport > 0)
3820             storeAppendPrintf(e, " vport=%d", s->vport);
3821
3822         if (s->defaultsite)
3823             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3824
3825         // TODO: compare against prefix of 'n' instead of assuming http_port
3826         if (s->transport.protocol != AnyP::PROTO_HTTP)
3827             storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3828
3829         if (s->allow_direct)
3830             storeAppendPrintf(e, " allow-direct");
3831
3832         if (s->ignore_cc)
3833             storeAppendPrintf(e, " ignore-cc");
3834
3835     }
3836
3837     // Generic independent options
3838
3839     if (s->name)
3840         storeAppendPrintf(e, " name=%s", s->name);
3841
3842 #if USE_HTTP_VIOLATIONS
3843     if (!s->flags.accelSurrogate && s->ignore_cc)
3844         storeAppendPrintf(e, " ignore-cc");
3845 #endif
3846
3847     if (s->connection_auth_disabled)
3848         storeAppendPrintf(e, " connection-auth=off");
3849     else
3850         storeAppendPrintf(e, " connection-auth=on");
3851
3852     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3853         const char *pmtu;
3854
3855         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3856             pmtu = "always";
3857         else
3858             pmtu = "transparent";
3859
3860         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3861     }
3862
3863     if (s->s.isAnyAddr() && !s->s.isIPv6())
3864         storeAppendPrintf(e, " ipv4");
3865
3866     if (s->tcp_keepalive.enabled) {
3867         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3868             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3869         } else {
3870             storeAppendPrintf(e, " tcpkeepalive");
3871         }
3872     }
3873
3874 #if USE_OPENSSL
3875     if (s->flags.tunnelSslBumping)
3876         storeAppendPrintf(e, " ssl-bump");
3877 #endif
3878
3879     s->secure.dumpCfg(e, "tls-");
3880
3881 #if USE_OPENSSL
3882     if (s->sslContextSessionId)
3883         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3884
3885     if (s->generateHostCertificates)
3886         storeAppendPrintf(e, " generate-host-certificates");
3887
3888     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3889         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3890 #endif
3891 }
3892
3893 static void
3894 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3895 {
3896     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3897         dump_generic_port(e, n, p);
3898         storeAppendPrintf(e, "\n");
3899     }
3900 }
3901
3902 void
3903 configFreeMemory(void)
3904 {
3905     free_all();
3906     Config.ssl_client.sslContext.reset();
3907 #if USE_OPENSSL
3908     Ssl::unloadSquidUntrusted();
3909 #endif
3910 }
3911
3912 void
3913 requirePathnameExists(const char *name, const char *path)
3914 {
3915
3916     struct stat sb;
3917     char pathbuf[BUFSIZ];
3918     assert(path != NULL);
3919
3920     if (Config.chroot_dir && (geteuid() == 0)) {
3921         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3922         path = pathbuf;
3923     }
3924
3925     if (stat(path, &sb) < 0) {
3926         int xerrno = errno;
3927         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
3928         // keep going to find more issues if we are only checking the config file with "-k parse"
3929         if (opt_parse_cfg_only)
3930             return;
3931         // this is fatal if it is found during startup or reconfigure
3932         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3933             fatalf("%s %s: %s", name, path, xstrerr(xerrno));
3934     }
3935 }
3936
3937 #include "AccessLogEntry.h"
3938
3939 /**
3940  * We support several access_log configuration styles:
3941  *
3942  * #1: Deprecated ancient style without an explicit logging module:
3943  * access_log /var/log/access.log
3944  *
3945  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3946  * access_log none [acl ...]
3947  *
3948  * #3: Configurable logging module without named options:
3949  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3950  * If no explicit logformat name is given, the first ACL name, if any,
3951  * should not be an existing logformat name or it will be treated as such.
3952  * access_log module:place [logformat_name] [acl ...]
3953  *
3954  * #4: Configurable logging module with name=value options such as logformat=x:
3955  * The first ACL name may not contain '='.
3956  * access_log module:place [option ...] [acl ...]
3957  *
3958  */
3959 static void
3960 parse_access_log(CustomLog ** logs)
3961 {
3962     const char *filename = ConfigParser::NextToken();
3963     if (!filename) {
3964         self_destruct();
3965         return;
3966     }
3967
3968     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
3969
3970     cl->filename = xstrdup(filename);
3971     // default buffer size and fatal settings
3972     cl->bufferSize = 8*MAX_URL;
3973     cl->fatal = true;
3974
3975     if (strcmp(filename, "none") == 0) {
3976         cl->type = Log::Format::CLF_NONE;
3977         aclParseAclList(LegacyParser, &cl->aclList, filename);
3978         while (*logs)
3979             logs = &(*logs)->next;
3980         *logs = cl;
3981         return;
3982     }
3983
3984     cl->type = Log::Format::CLF_UNKNOWN;
3985     cl->rotateCount = -1; // default: use global logfile_rotate setting.
3986
3987     const char *token = ConfigParser::PeekAtToken();
3988     if (!token) { // style #1
3989         // no options to deal with
3990     } else if (!strchr(token, '=')) { // style #3
3991         // if logformat name is recognized,
3992         // pop the previewed token; Else it must be an ACL name
3993         if (setLogformat(cl, token, false))
3994             (void)ConfigParser::NextToken();
3995     } else { // style #4
3996         do {
3997             if (strncasecmp(token, "on-error=", 9) == 0) {
3998                 if (strncasecmp(token+9, "die", 3) == 0) {
3999                     cl->fatal = true;
4000                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
4001                     cl->fatal = false;
4002                 } else {
4003                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
4004                            token << "' expected 'drop' or 'die'");
4005                     xfree(cl->filename);
4006                     xfree(cl);
4007                     self_destruct();
4008                     return;
4009                 }
4010             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
4011                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
4012             } else if (strncasecmp(token, "rotate=", 7) == 0) {
4013                 cl->rotateCount = xatoi(token + 7);
4014             } else if (strncasecmp(token, "logformat=", 10) == 0) {
4015                 setLogformat(cl, token+10, true);
4016             } else if (!strchr(token, '=')) {
4017                 // Do not pop the token; it must be an ACL name
4018                 break; // done with name=value options, now to ACLs
4019             } else {
4020                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
4021                 xfree(cl->filename);
4022                 xfree(cl);
4023                 self_destruct();
4024                 return;
4025             }
4026             // Pop the token, it was a valid "name=value" option
4027             (void)ConfigParser::NextToken();
4028             // Get next with preview ConfigParser::NextToken call.
4029         } while ((token = ConfigParser::PeekAtToken()) != NULL);
4030     }
4031
4032     // set format if it has not been specified explicitly
4033     if (cl->type == Log::Format::CLF_UNKNOWN)
4034         setLogformat(cl, "squid", true);
4035
4036     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4037
4038     while (*logs)
4039         logs = &(*logs)->next;
4040
4041     *logs = cl;
4042 }
4043
4044 /// sets CustomLog::type and, if needed, CustomLog::lf
4045 /// returns false iff there is no named log format
4046 static bool
4047 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
4048 {
4049     assert(cl);
4050     assert(logdef_name);
4051
4052     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
4053
4054     if (cl->type != Log::Format::CLF_UNKNOWN) {
4055         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
4056                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
4057         self_destruct();
4058         return false;
4059     }
4060
4061     /* look for the definition pointer corresponding to this name */
4062     Format::Format *lf = Log::TheConfig.logformats;
4063
4064     while (lf != NULL) {
4065         debugs(3, 9, "Comparing against '" << lf->name << "'");
4066
4067         if (strcmp(lf->name, logdef_name) == 0)
4068             break;
4069
4070         lf = lf->next;
4071     }
4072
4073     if (lf != NULL) {
4074         cl->type = Log::Format::CLF_CUSTOM;
4075         cl->logFormat = lf;
4076     } else if (strcmp(logdef_name, "auto") == 0) {
4077         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
4078         cl->type = Log::Format::CLF_SQUID;
4079     } else if (strcmp(logdef_name, "squid") == 0) {
4080         cl->type = Log::Format::CLF_SQUID;
4081     } else if (strcmp(logdef_name, "common") == 0) {
4082         cl->type = Log::Format::CLF_COMMON;
4083     } else if (strcmp(logdef_name, "combined") == 0) {
4084         cl->type = Log::Format::CLF_COMBINED;
4085 #if ICAP_CLIENT
4086     } else if (strcmp(logdef_name, "icap_squid") == 0) {
4087         cl->type = Log::Format::CLF_ICAP_SQUID;
4088 #endif
4089     } else if (strcmp(logdef_name, "useragent") == 0) {
4090         cl->type = Log::Format::CLF_USERAGENT;
4091     } else if (strcmp(logdef_name, "referrer") == 0) {
4092         cl->type = Log::Format::CLF_REFERER;
4093     } else if (dieWhenMissing) {
4094         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4095         self_destruct();
4096         return false;
4097     } else {
4098         return false;
4099     }
4100
4101     return true;
4102 }
4103
4104 static int
4105 check_null_access_log(CustomLog *customlog_definitions)
4106 {
4107     return customlog_definitions == NULL;
4108 }
4109
4110 static void
4111 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4112 {
4113     CustomLog *log;
4114
4115     for (log = logs; log; log = log->next) {
4116         storeAppendPrintf(entry, "%s ", name);
4117
4118         switch (log->type) {
4119
4120         case Log::Format::CLF_CUSTOM:
4121             storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4122             break;
4123
4124         case Log::Format::CLF_NONE:
4125             storeAppendPrintf(entry, "logformat=none");
4126             break;
4127
4128         case Log::Format::CLF_SQUID:
4129             storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4130             break;
4131
4132         case Log::Format::CLF_COMBINED:
4133             storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4134             break;
4135
4136         case Log::Format::CLF_COMMON:
4137             storeAppendPrintf(entry, "%s logformat=common", log->filename);
4138             break;
4139
4140 #if ICAP_CLIENT
4141         case Log::Format::CLF_ICAP_SQUID:
4142             storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4143             break;
4144 #endif
4145         case Log::Format::CLF_USERAGENT:
4146             storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4147             break;
4148
4149         case Log::Format::CLF_REFERER:
4150             storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4151             break;
4152
4153         case Log::Format::CLF_UNKNOWN:
4154             break;
4155         }
4156
4157         // default is on-error=die
4158         if (!log->fatal)
4159             storeAppendPrintf(entry, " on-error=drop");
4160
4161         // default: 64KB
4162         if (log->bufferSize != 64*1024)
4163             storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4164
4165         if (log->rotateCount >= 0)
4166             storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4167
4168         if (log->aclList)
4169             dump_acl_list(entry, log->aclList);
4170
4171         storeAppendPrintf(entry, "\n");
4172     }
4173 }
4174
4175 static void
4176 free_access_log(CustomLog ** definitions)
4177 {
4178     while (*definitions) {
4179         CustomLog *log = *definitions;
4180         *definitions = log->next;
4181
4182         log->logFormat = NULL;
4183         log->type = Log::Format::CLF_UNKNOWN;
4184
4185         if (log->aclList)
4186             aclDestroyAclList(&log->aclList);
4187
4188         safe_free(log->filename);
4189
4190         xfree(log);
4191     }
4192 }
4193
4194 #if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4195 /// parses list of integers form name=N1,N2,N3,...
4196 static bool
4197 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4198 {
4199     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4200         data += name.size();
4201         if (*data == '=') {
4202             while (true) {
4203                 ++data;
4204                 int value = 0;
4205                 if (!StringToInt(data, value, &data, 10))
4206                     break;
4207                 list.push_back(value);
4208                 if (*data == '\0' || *data != ',')
4209                     break;
4210             }
4211         }
4212     }
4213     return data && *data == '\0';
4214 }
4215 #endif
4216
4217 static void
4218 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4219 {
4220 #if !HAVE_CPU_AFFINITY
4221     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4222            "support, do not set 'cpu_affinity_map'");
4223     self_destruct();
4224
4225 #else /* HAVE_CPU_AFFINITY */
4226     if (!*cpuAffinityMap)
4227         *cpuAffinityMap = new CpuAffinityMap;
4228
4229     const char *const pToken = ConfigParser::NextToken();
4230     const char *const cToken = ConfigParser::NextToken();
4231     std::vector<int> processes, cores;
4232     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4233         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4234                "in 'cpu_affinity_map'");
4235         self_destruct();
4236     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4237         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4238                "'cpu_affinity_map'");
4239         self_destruct();
4240     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4241         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4242                "process_numbers and cores lists differ in length or " <<
4243                "contain numbers <= 0");
4244         self_destruct();
4245     }
4246 #endif
4247 }
4248
4249 static void
4250 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4251 {
4252     if (cpuAffinityMap) {
4253         storeAppendPrintf(entry, "%s process_numbers=", name);
4254         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4255             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4256                               cpuAffinityMap->processes()[i]);
4257         }
4258         storeAppendPrintf(entry, " cores=");
4259         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4260             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4261                               cpuAffinityMap->cores()[i]);
4262         }
4263         storeAppendPrintf(entry, "\n");
4264     }
4265 }
4266
4267 static void
4268 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4269 {
4270     delete *cpuAffinityMap;
4271     *cpuAffinityMap = NULL;
4272 }
4273
4274 #if USE_ADAPTATION
4275
4276 static void
4277 parse_adaptation_service_set_type()
4278 {
4279     Adaptation::Config::ParseServiceSet();
4280 }
4281
4282 static void
4283 parse_adaptation_service_chain_type()
4284 {
4285     Adaptation::Config::ParseServiceChain();
4286 }
4287
4288 static void
4289 parse_adaptation_access_type()
4290 {
4291     Adaptation::Config::ParseAccess(LegacyParser);
4292 }
4293 #endif /* USE_ADAPTATION */
4294
4295 #if ICAP_CLIENT
4296
4297 static void
4298 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4299 {
4300     cfg->parseService();
4301 }
4302
4303 static void
4304 free_icap_service_type(Adaptation::Icap::Config * cfg)
4305 {
4306     cfg->freeService();
4307 }
4308
4309 static void
4310 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4311 {
4312     cfg.dumpService(entry, name);
4313 }
4314
4315 static void
4316 parse_icap_class_type()
4317 {
4318     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4319            "Use 'adaptation_service_set' instead");
4320     Adaptation::Config::ParseServiceSet();
4321 }
4322
4323 static void
4324 parse_icap_access_type()
4325 {
4326     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4327            "Use 'adaptation_access' instead");
4328     Adaptation::Config::ParseAccess(LegacyParser);
4329 }
4330
4331 #endif
4332
4333 #if USE_ECAP
4334
4335 static void
4336 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4337 {
4338     cfg->parseService();
4339 }
4340
4341 static void
4342 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4343 {
4344     cfg->freeService();
4345 }
4346
4347 static void
4348 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4349 {
4350     cfg.dumpService(entry, name);
4351 }
4352
4353 #endif /* USE_ECAP */
4354
4355 #if ICAP_CLIENT
4356 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4357 {
4358     char *token;
4359     time_t d;
4360     time_t m;
4361     cfg->service_failure_limit = GetInteger();
4362
4363     if ((token = ConfigParser::NextToken()) == NULL)
4364         return;
4365
4366     if (strcmp(token,"in") != 0) {
4367         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4368         self_destruct();
4369         return;
4370     }
4371
4372     if ((token = ConfigParser::NextToken()) == NULL) {
4373         self_destruct();
4374         return;
4375     }
4376
4377     d = static_cast<time_t> (xatoi(token));
4378
4379     m = static_cast<time_t> (1);
4380
4381     if (0 == d)
4382         (void) 0;
4383     else if ((token = ConfigParser::NextToken()) == NULL) {
4384         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4385         self_destruct();
4386         return;
4387     } else if ((m = parseTimeUnits(token, false)) == 0) {
4388         self_destruct();
4389         return;
4390     }
4391
4392     cfg->oldest_service_failure = (m * d);
4393 }
4394
4395 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4396 {
4397     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4398     if (cfg.oldest_service_failure > 0) {
4399         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4400     }
4401     storeAppendPrintf(entry, "\n");
4402 }
4403
4404 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4405 {
4406     cfg->oldest_service_failure = 0;
4407     cfg->service_failure_limit = 0;
4408 }
4409 #endif
4410
4411 #if USE_OPENSSL
4412 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4413 {
4414     char *al;
4415     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4416     if ((al = ConfigParser::NextToken()) == NULL) {
4417         xfree(ca);
4418         self_destruct();
4419         return;
4420     }
4421
4422     const char *param;
4423     if ( char *s = strchr(al, '{')) {
4424         *s = '\0'; // terminate the al string
4425         ++s;
4426         param = s;
4427         s = strchr(s, '}');
4428         if (!s) {
4429             xfree(ca);
4430             self_destruct();
4431             return;
4432         }
4433         *s = '\0';
4434     } else
4435         param = NULL;
4436
4437     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4438         ca->alg = Ssl::algSetValidAfter;
4439         ca->param = xstrdup("on");
4440     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4441         ca->alg = Ssl::algSetValidBefore;
4442         ca->param = xstrdup("on");
4443     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4444         ca->alg = Ssl::algSetCommonName;
4445         if (param) {
4446             if (strlen(param) > 64) {
4447                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4448                 xfree(ca);
4449                 self_destruct();
4450                 return;
4451             }
4452             ca->param = xstrdup(param);
4453         }
4454     } else {
4455         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4456         xfree(ca);
4457         self_destruct();
4458         return;
4459     }
4460
4461     aclParseAclList(LegacyParser, &ca->aclList, al);
4462
4463     while (*cert_adapt)
4464         cert_adapt = &(*cert_adapt)->next;
4465
4466     *cert_adapt = ca;
4467 }
4468
4469 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4470 {
4471     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4472         storeAppendPrintf(entry, "%s ", name);
4473         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4474         if (ca->aclList)
4475             dump_acl_list(entry, ca->aclList);
4476         storeAppendPrintf(entry, "\n");
4477     }
4478 }
4479
4480 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4481 {
4482     while (*cert_adapt) {
4483         sslproxy_cert_adapt *ca = *cert_adapt;
4484         *cert_adapt = ca->next;
4485         safe_free(ca->param);
4486
4487         if (ca->aclList)
4488             aclDestroyAclList(&ca->aclList);
4489
4490         safe_free(ca);
4491     }
4492 }
4493
4494 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4495 {
4496     char *al;
4497     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4498     if ((al = ConfigParser::NextToken()) == NULL) {
4499         xfree(cs);
4500         self_destruct();
4501         return;
4502     }
4503
4504     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4505         cs->alg = Ssl::algSignTrusted;
4506     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4507         cs->alg = Ssl::algSignUntrusted;
4508     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4509         cs->alg = Ssl::algSignSelf;
4510     else {
4511         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4512         xfree(cs);
4513         self_destruct();
4514         return;
4515     }
4516
4517     aclParseAclList(LegacyParser, &cs->aclList, al);
4518
4519     while (*cert_sign)
4520         cert_sign = &(*cert_sign)->next;
4521
4522     *cert_sign = cs;
4523 }
4524
4525 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4526 {
4527     sslproxy_cert_sign *cs;
4528     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4529         storeAppendPrintf(entry, "%s ", name);
4530         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4531         if (cs->aclList)
4532             dump_acl_list(entry, cs->aclList);
4533         storeAppendPrintf(entry, "\n");
4534     }
4535 }
4536
4537 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4538 {
4539     while (*cert_sign) {
4540         sslproxy_cert_sign *cs = *cert_sign;
4541         *cert_sign = cs->next;
4542
4543         if (cs->aclList)
4544             aclDestroyAclList(&cs->aclList);
4545
4546         safe_free(cs);
4547     }
4548 }
4549
4550 class sslBumpCfgRr: public ::RegisteredRunner
4551 {
4552 public:
4553     static Ssl::BumpMode lastDeprecatedRule;
4554     /* RegisteredRunner API */
4555     virtual void finalizeConfig();
4556 };
4557
4558 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4559
4560 RunnerRegistrationEntry(sslBumpCfgRr);
4561
4562 void
4563 sslBumpCfgRr::finalizeConfig()
4564 {
4565     if (lastDeprecatedRule != Ssl::bumpEnd) {
4566         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4567         static char buf[1024];
4568         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4569             strcpy(buf, "ssl_bump deny all");
4570             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4571                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4572                    "must not use implicit rules. Update your ssl_bump rules.");
4573         } else {
4574             strcpy(buf, "ssl_bump allow all");
4575             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4576                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4577                    "inferior to the newer server-first bumping mode. New ssl_bump"
4578                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4579         }
4580         parse_line(buf);
4581     }
4582 }
4583
4584 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4585 {
4586     typedef const char *BumpCfgStyle;
4587     BumpCfgStyle bcsNone = NULL;
4588     BumpCfgStyle bcsNew = "new client/server-first/none";
4589     BumpCfgStyle bcsOld = "deprecated allow/deny";
4590     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4591     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4592     char *bm;
4593     if ((bm = ConfigParser::NextToken()) == NULL) {
4594         self_destruct();
4595         return;
4596     }
4597
4598     // if this is the first rule proccessed
4599     if (*ssl_bump == NULL) {
4600         bumpCfgStyleLast = bcsNone;
4601         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4602     }
4603
4604     allow_t action = allow_t(ACCESS_ALLOWED);
4605
4606     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4607         action.kind = Ssl::bumpClientFirst;
4608         bumpCfgStyleNow = bcsNew;
4609     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4610         action.kind = Ssl::bumpServerFirst;
4611         bumpCfgStyleNow = bcsNew;
4612     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4613         action.kind = Ssl::bumpPeek;
4614         bumpCfgStyleNow = bcsNew;
4615     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4616         action.kind = Ssl::bumpStare;
4617         bumpCfgStyleNow = bcsNew;
4618     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4619         action.kind = Ssl::bumpSplice;
4620         bumpCfgStyleNow = bcsNew;
4621     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4622         action.kind = Ssl::bumpBump;
4623         bumpCfgStyleNow = bcsNew;
4624     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4625         action.kind = Ssl::bumpTerminate;
4626         bumpCfgStyleNow = bcsNew;
4627     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4628         action.kind = Ssl::bumpNone;
4629         bumpCfgStyleNow = bcsNew;
4630     } else if (strcmp(bm, "allow") == 0) {
4631         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4632                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4633                "is usually inferior to the newer server-first "
4634                "bumping mode. Update your ssl_bump rules.");
4635         action.kind = Ssl::bumpClientFirst;
4636         bumpCfgStyleNow = bcsOld;
4637         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4638     } else if (strcmp(bm, "deny") == 0) {
4639         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4640                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4641                "your ssl_bump rules.");
4642         action.kind = Ssl::bumpNone;
4643         bumpCfgStyleNow = bcsOld;
4644         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4645     } else {
4646         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4647         self_destruct();
4648         return;
4649     }
4650
4651     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4652         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4653                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4654         self_destruct();
4655         return;
4656     }
4657
4658     bumpCfgStyleLast = bumpCfgStyleNow;
4659
4660     Acl::AndNode *rule = new Acl::AndNode;
4661     rule->context("(ssl_bump rule)", config_input_line);
4662     rule->lineParse();
4663     // empty rule OK
4664
4665     assert(ssl_bump);
4666     if (!*ssl_bump) {
4667         *ssl_bump = new Acl::Tree;
4668         (*ssl_bump)->context("(ssl_bump rules)", config_input_line);
4669     }
4670
4671     (*ssl_bump)->add(rule, action);
4672 }
4673
4674 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4675 {
4676     if (ssl_bump)
4677         dump_SBufList(entry, ssl_bump->treeDump(name, Ssl::BumpModeStr));
4678 }
4679
4680 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4681 {
4682     free_acl_access(ssl_bump);
4683 }
4684
4685 #endif
4686
4687 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4688 {
4689     if (!headers)
4690         return;
4691
4692     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4693         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4694         if (hwa->aclList)
4695             dump_acl_list(entry, hwa->aclList);
4696         storeAppendPrintf(entry, "\n");
4697     }
4698 }
4699
4700 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4701 {
4702     char *fn;
4703     if (!*headers) {
4704         *headers = new HeaderWithAclList;
4705     }
4706     if ((fn = ConfigParser::NextToken()) == NULL) {
4707         self_destruct();
4708         return;
4709     }
4710     HeaderWithAcl hwa;
4711     hwa.fieldName = fn;
4712     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4713     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4714         hwa.fieldId = Http::HdrType::OTHER;
4715
4716     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4717     ConfigParser::EnableMacros();
4718     String buf = ConfigParser::NextQuotedToken();
4719     ConfigParser::DisableMacros();
4720     hwa.fieldValue = buf.termedBuf();
4721     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4722     if (hwa.quoted) {
4723         if (!nlf->parse(hwa.fieldValue.c_str())) {
4724             self_destruct();
4725             return;
4726         }
4727         hwa.valueFormat = nlf;
4728     } else
4729         delete nlf;
4730     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4731     (*headers)->push_back(hwa);
4732 }
4733
4734 static void free_HeaderWithAclList(HeaderWithAclList **header)
4735 {
4736     if (!(*header))
4737         return;
4738
4739     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4740         if (hwa->aclList)
4741             aclDestroyAclList(&hwa->aclList);
4742
4743         if (hwa->valueFormat) {
4744             delete hwa->valueFormat;
4745             hwa->valueFormat = NULL;
4746         }
4747     }
4748     delete *header;
4749     *header = NULL;
4750 }
4751
4752 static void parse_note(Notes *notes)
4753 {
4754     assert(notes);
4755     notes->parse(LegacyParser);
4756 }
4757
4758 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4759 {
4760     notes.dump(entry, name);
4761 }
4762
4763 static void free_note(Notes *notes)
4764 {
4765     notes->clean();
4766 }
4767
4768 static bool FtpEspvDeprecated = false;
4769 static void parse_ftp_epsv(acl_access **ftp_epsv)
4770 {
4771     allow_t ftpEpsvDeprecatedAction;
4772     bool ftpEpsvIsDeprecatedRule = false;
4773
4774     char *t = ConfigParser::PeekAtToken();
4775     if (!t) {
4776         self_destruct();
4777         return;
4778     }
4779
4780     if (!strcmp(t, "off")) {
4781         (void)ConfigParser::NextToken();
4782         ftpEpsvIsDeprecatedRule = true;
4783         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4784     } else if (!strcmp(t, "on")) {
4785         (void)ConfigParser::NextToken();
4786         ftpEpsvIsDeprecatedRule = true;
4787         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4788     }
4789
4790     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4791     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4792     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4793     // then abort
4794     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4795             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4796         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4797         self_destruct();
4798         return;
4799     }
4800
4801     if (ftpEpsvIsDeprecatedRule) {
4802         // overwrite previous ftp_epsv lines
4803         delete *ftp_epsv;
4804         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4805             Acl::AndNode *ftpEpsvRule = new Acl::AndNode;
4806             ftpEpsvRule->context("(ftp_epsv rule)", config_input_line);
4807             ACL *a = ACL::FindByName("all");
4808             if (!a) {
4809                 delete ftpEpsvRule;
4810                 self_destruct();
4811                 return;
4812             }
4813             ftpEpsvRule->add(a);
4814             *ftp_epsv = new Acl::Tree;
4815             (*ftp_epsv)->context("(ftp_epsv rules)", config_input_line);
4816             (*ftp_epsv)->add(ftpEpsvRule, ftpEpsvDeprecatedAction);
4817         } else
4818             *ftp_epsv = NULL;
4819         FtpEspvDeprecated = true;
4820     } else {
4821         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4822     }
4823 }
4824
4825 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4826 {
4827     if (ftp_epsv)
4828         dump_SBufList(entry, ftp_epsv->treeDump(name, NULL));
4829 }
4830
4831 static void free_ftp_epsv(acl_access **ftp_epsv)
4832 {
4833     free_acl_access(ftp_epsv);
4834     FtpEspvDeprecated = false;
4835 }
4836
4837 static void
4838 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4839 {
4840     time_msec_t tval;
4841     parseTimeLine(&tval, T_SECOND_STR, false, true);
4842     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4843
4844     char *key, *value;
4845     while(ConfigParser::NextKvPair(key, value)) {
4846         if (strcasecmp(key, "on_timeout") == 0) {
4847             if (strcasecmp(value, "bypass") == 0)
4848                 config->action = toutActBypass;
4849             else if (strcasecmp(value, "fail") == 0)
4850                 config->action = toutActFail;
4851             else if (strcasecmp(value, "retry") == 0)
4852                 config->action = toutActRetry;
4853             else if (strcasecmp(value, "use_configured_response") == 0) {
4854                 config->action = toutActUseConfiguredResponse;
4855             } else {
4856                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4857                 self_destruct();
4858                 return;
4859             }
4860         } else if (strcasecmp(key, "response") == 0) {
4861             config->response = xstrdup(value);
4862         } else {
4863             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4864             self_destruct();
4865             return;
4866         }
4867     }
4868
4869     if (config->action == toutActUseConfiguredResponse && !config->response) {
4870         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4871         self_destruct();
4872     }
4873
4874     if (config->action != toutActUseConfiguredResponse && config->response) {
4875         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4876         self_destruct();
4877     }
4878 }
4879
4880 static void
4881 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4882 {
4883     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4884     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4885
4886     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4887     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4888
4889     if (config.response)
4890         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4891
4892     storeAppendPrintf(entry, "\n");
4893 }
4894
4895 static void
4896 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4897 {
4898     Config.Timeout.urlRewrite = 0;
4899     config->action = 0;
4900     safe_free(config->response);
4901 }
4902
4903 static void
4904 parse_configuration_includes_quoted_values(bool *)
4905 {
4906     int val = 0;
4907     parse_onoff(&val);
4908
4909     // If quoted values is set to on then enable new strict mode parsing
4910     if (val) {
4911         ConfigParser::RecognizeQuotedValues = true;
4912         ConfigParser::StrictMode = true;
4913     } else {
4914         ConfigParser::RecognizeQuotedValues = false;
4915         ConfigParser::StrictMode = false;
4916     }
4917 }
4918
4919 static void
4920 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4921 {
4922     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4923     dump_onoff(entry, name, val);
4924 }
4925
4926 static void
4927 free_configuration_includes_quoted_values(bool *)
4928 {
4929     ConfigParser::RecognizeQuotedValues = false;
4930     ConfigParser::StrictMode = false;
4931 }
4932
4933 static void
4934 parse_on_unsupported_protocol(acl_access **access)
4935 {
4936     char *tm;
4937     if ((tm = ConfigParser::NextToken()) == NULL) {
4938         self_destruct();
4939         return;
4940     }
4941
4942     allow_t action = allow_t(ACCESS_ALLOWED);
4943     if (strcmp(tm, "tunnel") == 0)
4944         action.kind = 1;
4945     else if (strcmp(tm, "respond") == 0)
4946         action.kind = 2;
4947     else {
4948         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4949         self_destruct();
4950         return;
4951     }
4952
4953     Acl::AndNode *rule = new Acl::AndNode;
4954     rule->context("(on_unsupported_protocol rule)", config_input_line);
4955     rule->lineParse();
4956     // empty rule OK
4957
4958     assert(access);
4959     if (!*access) {
4960         *access = new Acl::Tree;
4961         (*access)->context("(on_unsupported_protocol rules)", config_input_line);
4962     }
4963
4964     (*access)->add(rule, action);
4965 }
4966
4967 static void
4968 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4969 {
4970     const char *on_error_tunnel_mode_str[] = {
4971         "none",
4972         "tunnel",
4973         "respond",
4974         NULL
4975     };
4976     if (access) {
4977         SBufList lines = access->treeDump(name, on_error_tunnel_mode_str);
4978         dump_SBufList(entry, lines);
4979     }
4980 }
4981
4982 static void
4983 free_on_unsupported_protocol(acl_access **access)
4984 {
4985     free_acl_access(access);
4986 }
4987