src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2022 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclSizeLimit.h"
  15 #include "acl/Address.h"
  16 #include "acl/Gadgets.h"
  17 #include "acl/MethodData.h"
  18 #include "acl/Tree.h"
  19 #include "anyp/PortCfg.h"
  20 #include "anyp/UriScheme.h"
  21 #include "auth/Config.h"
  22 #include "auth/Scheme.h"
  23 #include "AuthReg.h"
  24 #include "base/PackableStream.h"
  25 #include "base/RunnersRegistry.h"
  26 #include "cache_cf.h"
  27 #include "CachePeer.h"
  28 #include "ConfigOption.h"
  29 #include "ConfigParser.h"
  30 #include "CpuAffinityMap.h"
  31 #include "DebugMessages.h"
  32 #include "DiskIO/DiskIOModule.h"
  33 #include "eui/Config.h"
  34 #include "ExternalACL.h"
  35 #include "format/Format.h"
  36 #include "fqdncache.h"
  37 #include "ftp/Elements.h"
  38 #include "globals.h"
  39 #include "HttpHeaderTools.h"
  40 #include "HttpUpgradeProtocolAccess.h"
  41 #include "icmp/IcmpConfig.h"
  42 #include "ident/Config.h"
  43 #include "ip/Intercept.h"
  44 #include "ip/NfMarkConfig.h"
  45 #include "ip/QosConfig.h"
  46 #include "ip/tools.h"
  47 #include "ipc/Kids.h"
  48 #include "log/Config.h"
  49 #include "log/CustomLog.h"
  50 #include "MemBuf.h"
  51 #include "MessageDelayPools.h"
  52 #include "mgr/ActionPasswordList.h"
  53 #include "mgr/Registration.h"
  54 #include "neighbors.h"
  55 #include "NeighborTypeDomainList.h"
  56 #include "Parsing.h"
  57 #include "pconn.h"
  58 #include "PeerDigest.h"
  59 #include "PeerPoolMgr.h"
  60 #include "redirect.h"
  61 #include "RefreshPattern.h"
  62 #include "rfc1738.h"
  63 #include "sbuf/List.h"
  64 #include "sbuf/Stream.h"
  65 #include "SquidConfig.h"
  66 #include "SquidString.h"
  67 #include "ssl/ProxyCerts.h"
  68 #include "Store.h"
  69 #include "store/Disks.h"
  70 #include "tools.h"
  71 #include "util.h"
  72 #include "wordlist.h"
  73 /* wccp2 has its own conditional definitions */
  74 #include "wccp2.h"
  75 #if USE_ADAPTATION
  76 #include "adaptation/Config.h"
  77 #endif
  78 #if ICAP_CLIENT
  79 #include "adaptation/icap/Config.h"
  80 #endif
  81 #if USE_ECAP
  82 #include "adaptation/ecap/Config.h"
  83 #endif
  84 #if USE_OPENSSL
  85 #include "ssl/Config.h"
  86 #include "ssl/support.h"
  87 #endif
  88 #if USE_SQUID_ESI
  89 #include "esi/Parser.h"
  90 #endif
  91 #if SQUID_SNMP
  92 #include "snmp.h"
  93 #endif
  94
  95 #if HAVE_GLOB_H
  96 #include <glob.h>
  97 #endif
  98 #include <chrono>
  99 #include <limits>
 100 #include <list>
 101 #if HAVE_PWD_H
 102 #include <pwd.h>
 103 #endif
 104 #if HAVE_GRP_H
 105 #include <grp.h>
 106 #endif
 107 #if HAVE_SYS_SOCKET_H
 108 #include <sys/socket.h>
 109 #endif
 110 #if HAVE_SYS_STAT_H
 111 #include <sys/stat.h>
 112 #endif
 113
 114 #if USE_OPENSSL
 115 #include "ssl/gadgets.h"
 116 #endif
 117
 118 #if USE_ADAPTATION
 119 static void parse_adaptation_service_set_type();
 120 static void parse_adaptation_service_chain_type();
 121 static void parse_adaptation_access_type();
 122 #endif
 123
 124 #if ICAP_CLIENT
 125 static void parse_icap_service_type(Adaptation::Icap::Config *);
 126 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 127 static void free_icap_service_type(Adaptation::Icap::Config *);
 128 static void parse_icap_class_type();
 129 static void parse_icap_access_type();
 130
 131 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 132 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 133 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 134 #endif
 135
 136 #if USE_ECAP
 137 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 138 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 139 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 140 #endif
 141
 142 static peer_t parseNeighborType(const char *s);
 143
 144 static const char *const T_NANOSECOND_STR = "nanosecond";
 145 static const char *const T_MICROSECOND_STR = "microsecond";
 146 static const char *const T_MILLISECOND_STR = "millisecond";
 147 static const char *const T_SECOND_STR = "second";
 148 static const char *const T_MINUTE_STR = "minute";
 149 static const char *const T_HOUR_STR = "hour";
 150 static const char *const T_DAY_STR = "day";
 151 static const char *const T_WEEK_STR = "week";
 152 static const char *const T_FORTNIGHT_STR = "fortnight";
 153 static const char *const T_MONTH_STR = "month";
 154 static const char *const T_YEAR_STR = "year";
 155 static const char *const T_DECADE_STR = "decade";
 156
 157 static const char *const B_BYTES_STR = "bytes";
 158 static const char *const B_KBYTES_STR = "KB";
 159 static const char *const B_MBYTES_STR = "MB";
 160 static const char *const B_GBYTES_STR = "GB";
 161
 162 // std::chrono::years requires C++20. Do our own rough calculation for now.
 163 static const double HoursPerYear = 24*365.2522;
 164
 165 static void parse_cache_log_message(DebugMessages **messages);
 166 static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *messages);
 167 static void free_cache_log_message(DebugMessages **messages);
 168
 169 static void parse_access_log(CustomLog ** customlog_definitions);
 170 static int check_null_access_log(CustomLog *customlog_definitions);
 171 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 172 static void free_access_log(CustomLog ** definitions);
 173
 174 static void configDoConfigure(void);
 175 static void parse_refreshpattern(RefreshPattern **);
 176 static void parse_u_short(unsigned short * var);
 177 static void parse_string(char **);
 178 static void default_all(void);
 179 static void defaults_if_none(void);
 180 static void defaults_postscriptum(void);
 181 static int parse_line(char *);
 182 static void parse_obsolete(const char *);
 183 static void parseBytesLine(size_t * bptr, const char *units);
 184 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 185 static size_t parseBytesUnits(const char *unit);
 186 static void free_all(void);
 187 void requirePathnameExists(const char *name, const char *path);
 188 static OBJH dump_config;
 189 #if USE_HTTP_VIOLATIONS
 190 static void free_HeaderManglers(HeaderManglers **pm);
 191 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 192 static void parse_http_header_access(HeaderManglers **manglers);
 193 #define free_http_header_access free_HeaderManglers
 194 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 195 static void parse_http_header_replace(HeaderManglers **manglers);
 196 #define free_http_header_replace free_HeaderManglers
 197 #endif
 198 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 199 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 200 static void free_HeaderWithAclList(HeaderWithAclList **header);
 201 static void parse_note(Notes *);
 202 static void dump_note(StoreEntry *, const char *, Notes &);
 203 static void free_note(Notes *);
 204 static void parse_denyinfo(AclDenyInfoList ** var);
 205 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 206 static void free_denyinfo(AclDenyInfoList ** var);
 207
 208 #if USE_WCCPv2
 209 static void parse_IpAddress_list(Ip::Address_list **);
 210 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 211 static void free_IpAddress_list(Ip::Address_list **);
 212 #if CURRENTLY_UNUSED
 213 static int check_null_IpAddress_list(const Ip::Address_list *);
 214 #endif /* CURRENTLY_UNUSED */
 215 #endif /* USE_WCCPv2 */
 216
 217 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 218 #define parse_PortCfg(l) parsePortCfg((l), token)
 219 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 220 #define free_PortCfg(h)  *(h)=NULL
 221
 222 #if USE_OPENSSL
 223 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 224 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 225 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 226 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 227 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 228 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 229 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 230 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 231 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 232 #endif /* USE_OPENSSL */
 233
 234 static void parse_ftp_epsv(acl_access **ftp_epsv);
 235 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 236 static void free_ftp_epsv(acl_access **ftp_epsv);
 237
 238 static void parse_b_size_t(size_t * var);
 239 static void parse_b_int64_t(int64_t * var);
 240
 241 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 242 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 243 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 244
 245 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 246 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 247 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 248
 249 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 250
 251 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 252 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 253 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 254 static void parse_on_unsupported_protocol(acl_access **access);
 255 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 256 static void free_on_unsupported_protocol(acl_access **access);
 257 static void ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl = nullptr);
 258 static void parse_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards);
 259 static void dump_http_upgrade_request_protocols(StoreEntry *entry, const char *name, HttpUpgradeProtocolAccess *protoGuards);
 260 static void free_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards);
 261
 262 /*
 263  * LegacyParser is a parser for legacy code that uses the global
 264  * approach.  This is static so that it is only exposed to cache_cf.
 265  * Other modules needing access to a ConfigParser should have it
 266  * provided to them in their parserFOO methods.
 267  */
 268 static ConfigParser LegacyParser = ConfigParser();
 269
 270 const char *cfg_directive = nullptr;
 271 const char *cfg_filename = nullptr;
 272 int config_lineno = 0;
 273 char config_input_line[BUFSIZ] = {};
 274
 275 void
 276 self_destruct(void)
 277 {
 278     LegacyParser.destruct();
 279 }
 280
 281 static void
 282 SetConfigFilename(char const *file_name, bool is_pipe)
 283 {
 284     if (is_pipe)
 285         cfg_filename = file_name + 1;
 286     else
 287         cfg_filename = file_name;
 288 }
 289
 290 static const char*
 291 skip_ws(const char* s)
 292 {
 293     while (xisspace(*s))
 294         ++s;
 295
 296     return s;
 297 }
 298
 299 static int
 300 parseManyConfigFiles(char* files, int depth)
 301 {
 302     int error_count = 0;
 303     char* saveptr = NULL;
 304 #if HAVE_GLOB
 305     char *path;
 306     glob_t globbuf;
 307     int i;
 308     memset(&globbuf, 0, sizeof(globbuf));
 309     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 310         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 311             int xerrno = errno;
 312             fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
 313         }
 314     }
 315     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 316         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 317     }
 318     globfree(&globbuf);
 319 #else
 320     char* file = strwordtok(files, &saveptr);
 321     while (file != NULL) {
 322         error_count += parseOneConfigFile(file, depth);
 323         file = strwordtok(NULL, &saveptr);
 324     }
 325 #endif /* HAVE_GLOB */
 326     return error_count;
 327 }
 328
 329 static void
 330 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 331 {
 332     assert(str != NULL);
 333     assert(newSubstr != NULL);
 334
 335     unsigned newSubstrLen = strlen(newSubstr);
 336     if (newSubstrLen > substrLen)
 337         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 338
 339     // move tail part including zero
 340     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 341     // copy new substring in place
 342     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 343
 344     len = strlen(str);
 345 }
 346
 347 static void
 348 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 349 {
 350     assert(line != NULL);
 351     assert(macroName != NULL);
 352     assert(substStr != NULL);
 353     unsigned macroNameLen = strlen(macroName);
 354     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 355         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 356 }
 357
 358 static void
 359 ProcessMacros(char*& line, int& len)
 360 {
 361     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 362     SubstituteMacro(line, len, "${process_name}", TheKidName.c_str());
 363     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 364 }
 365
 366 static void
 367 trim_trailing_ws(char* str)
 368 {
 369     assert(str != NULL);
 370     unsigned i = strlen(str);
 371     while ((i > 0) && xisspace(str[i - 1]))
 372         --i;
 373     str[i] = '\0';
 374 }
 375
 376 static const char*
 377 FindStatement(const char* line, const char* statement)
 378 {
 379     assert(line != NULL);
 380     assert(statement != NULL);
 381
 382     const char* str = skip_ws(line);
 383     unsigned len = strlen(statement);
 384     if (strncmp(str, statement, len) == 0) {
 385         str += len;
 386         if (*str == '\0')
 387             return str;
 388         else if (xisspace(*str))
 389             return skip_ws(str);
 390     }
 391
 392     return NULL;
 393 }
 394
 395 static bool
 396 StrToInt(const char* str, long& number)
 397 {
 398     assert(str != NULL);
 399
 400     char* end;
 401     number = strtol(str, &end, 0);
 402
 403     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 404 }
 405
 406 static bool
 407 EvalBoolExpr(const char* expr)
 408 {
 409     assert(expr != NULL);
 410     if (strcmp(expr, "true") == 0) {
 411         return true;
 412     } else if (strcmp(expr, "false") == 0) {
 413         return false;
 414     } else if (const char* equation = strchr(expr, '=')) {
 415         const char* rvalue = skip_ws(equation + 1);
 416         char* lvalue = (char*)xmalloc(equation - expr + 1);
 417         xstrncpy(lvalue, expr, equation - expr + 1);
 418         trim_trailing_ws(lvalue);
 419
 420         long number1;
 421         if (!StrToInt(lvalue, number1))
 422             fatalf("String is not a integer number: '%s'\n", lvalue);
 423         long number2;
 424         if (!StrToInt(rvalue, number2))
 425             fatalf("String is not a integer number: '%s'\n", rvalue);
 426
 427         xfree(lvalue);
 428         return number1 == number2;
 429     }
 430     fatalf("Unable to evaluate expression '%s'\n", expr);
 431     return false; // this place cannot be reached
 432 }
 433
 434 static int
 435 parseOneConfigFile(const char *file_name, unsigned int depth)
 436 {
 437     FILE *fp = NULL;
 438     const char *orig_cfg_filename = cfg_filename;
 439     const int orig_config_lineno = config_lineno;
 440     char *token = NULL;
 441     char *tmp_line = NULL;
 442     int tmp_line_len = 0;
 443     int err_count = 0;
 444     int is_pipe = 0;
 445
 446     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 447     if (depth > 16) {
 448         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 449         return 1;
 450     }
 451
 452     if (file_name[0] == '!' || file_name[0] == '|') {
 453         fp = popen(file_name + 1, "r");
 454         is_pipe = 1;
 455     } else {
 456         fp = fopen(file_name, "r");
 457     }
 458
 459     if (!fp) {
 460         int xerrno = errno;
 461         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
 462     }
 463
 464 #if _SQUID_WINDOWS_
 465     setmode(fileno(fp), O_TEXT);
 466 #endif
 467
 468     SetConfigFilename(file_name, bool(is_pipe));
 469
 470     memset(config_input_line, '\0', BUFSIZ);
 471
 472     config_lineno = 0;
 473
 474     std::vector<bool> if_states;
 475     while (fgets(config_input_line, BUFSIZ, fp)) {
 476         ++config_lineno;
 477
 478         if ((token = strchr(config_input_line, '\n')))
 479             *token = '\0';
 480
 481         if ((token = strchr(config_input_line, '\r')))
 482             *token = '\0';
 483
 484         // strip any prefix whitespace off the line.
 485         const char *p = skip_ws(config_input_line);
 486         if (config_input_line != p)
 487             memmove(config_input_line, p, strlen(p)+1);
 488
 489         if (strncmp(config_input_line, "#line ", 6) == 0) {
 490             static char new_file_name[1024];
 491             static char *file;
 492             static char new_lineno;
 493             token = config_input_line + 6;
 494             new_lineno = strtol(token, &file, 0) - 1;
 495
 496             if (file == token)
 497                 continue;   /* Not a valid #line directive, may be a comment */
 498
 499             while (*file && xisspace((unsigned char) *file))
 500                 ++file;
 501
 502             if (*file) {
 503                 if (*file != '"')
 504                     continue;   /* Not a valid #line directive, may be a comment */
 505
 506                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 507
 508                 if ((token = strchr(new_file_name, '"')))
 509                     *token = '\0';
 510
 511                 SetConfigFilename(new_file_name, false);
 512             }
 513
 514             config_lineno = new_lineno;
 515         }
 516
 517         if (config_input_line[0] == '#')
 518             continue;
 519
 520         if (config_input_line[0] == '\0')
 521             continue;
 522
 523         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 524
 525         size_t append_len = strlen(append);
 526
 527         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 528
 529         strcpy(tmp_line + tmp_line_len, append);
 530
 531         tmp_line_len += append_len;
 532
 533         if (tmp_line[tmp_line_len-1] == '\\') {
 534             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 535             tmp_line[--tmp_line_len] = '\0';
 536             continue;
 537         }
 538
 539         trim_trailing_ws(tmp_line);
 540         ProcessMacros(tmp_line, tmp_line_len);
 541         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 542
 543         if (const char* expr = FindStatement(tmp_line, "if")) {
 544             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 545         } else if (FindStatement(tmp_line, "endif")) {
 546             if (!if_states.empty())
 547                 if_states.pop_back(); // remove last if-statement meaning
 548             else
 549                 fatalf("'endif' without 'if'\n");
 550         } else if (FindStatement(tmp_line, "else")) {
 551             if (!if_states.empty())
 552                 if_states.back() = !if_states.back();
 553             else
 554                 fatalf("'else' without 'if'\n");
 555         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 556             /* Handle includes here */
 557             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 558                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 559             } else {
 560                 try {
 561                     if (!parse_line(tmp_line)) {
 562                         debugs(3, DBG_CRITICAL, ConfigParser::CurrentLocation() << ": unrecognized: '" << tmp_line << "'");
 563                         ++err_count;
 564                     }
 565                 } catch (...) {
 566                     // fatal for now
 567                     debugs(3, DBG_CRITICAL, "ERROR: configuration failure: " << CurrentException);
 568                     self_destruct();
 569                 }
 570             }
 571         }
 572
 573         safe_free(tmp_line);
 574         tmp_line_len = 0;
 575
 576     }
 577     if (!if_states.empty())
 578         fatalf("if-statement without 'endif'\n");
 579
 580     if (is_pipe) {
 581         int ret = pclose(fp);
 582
 583         if (ret != 0)
 584             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 585     } else {
 586         fclose(fp);
 587     }
 588
 589     SetConfigFilename(orig_cfg_filename, false);
 590     config_lineno = orig_config_lineno;
 591
 592     xfree(tmp_line);
 593     return err_count;
 594 }
 595
 596 static
 597 int
 598 parseConfigFileOrThrow(const char *file_name)
 599 {
 600     int err_count = 0;
 601
 602     debugs(5, 4, MYNAME);
 603
 604     configFreeMemory();
 605
 606     ACLMethodData::ThePurgeCount = 0;
 607     default_all();
 608
 609     err_count = parseOneConfigFile(file_name, 0);
 610
 611     defaults_if_none();
 612
 613     defaults_postscriptum();
 614
 615     /*
 616      * We must call configDoConfigure() before leave_suid() because
 617      * configDoConfigure() is where we turn username strings into
 618      * uid values.
 619      */
 620     configDoConfigure();
 621
 622     if (opt_send_signal == -1) {
 623         Mgr::RegisterAction("config",
 624                             "Current Squid Configuration",
 625                             dump_config,
 626                             1, 1);
 627     }
 628
 629     return err_count;
 630 }
 631
 632 // TODO: Refactor main.cc to centrally handle (and report) all exceptions.
 633 int
 634 parseConfigFile(const char *file_name)
 635 {
 636     try {
 637         return parseConfigFileOrThrow(file_name);
 638     }
 639     catch (const std::exception &ex) {
 640         debugs(3, DBG_CRITICAL, "FATAL: bad configuration: " << ex.what());
 641         self_destruct();
 642         return 1; // not reached
 643     }
 644 }
 645
 646 /*
 647  * The templated functions below are essentially ConfigParser methods. They are
 648  * not implemented as such because our generated code calling them is the only
 649  * code that can instantiate implementations for each T -- we cannot place these
 650  * definitions into ConfigParser.cc unless cf_parser.cci is moved there.
 651  */
 652
 653 // TODO: When adding Ts incompatible with this trivial API and implementation,
 654 // replace both with a ConfigParser-maintained table of seen directives.
 655 /// whether we have seen (and, hence, configured) the given directive
 656 template <typename T>
 657 static bool
 658 SawDirective(const T &raw)
 659 {
 660     return bool(raw);
 661 }
 662
 663 /// Sets the given raw SquidConfig data member.
 664 /// Extracts and interprets parser's configuration tokens.
 665 template <typename T>
 666 static void
 667 ParseDirective(T &raw, ConfigParser &parser)
 668 {
 669     if (SawDirective(raw))
 670         parser.rejectDuplicateDirective();
 671
 672     // TODO: parser.openDirective(directiveName);
 673     Must(!raw);
 674     raw = Configuration::Component<T>::Parse(parser);
 675     Must(raw);
 676     parser.closeDirective();
 677 }
 678
 679 /// reports raw SquidConfig data member configuration using squid.conf syntax
 680 /// \param name the name of the configuration directive being dumped
 681 template <typename T>
 682 static void
 683 DumpDirective(const T &raw, StoreEntry *entry, const char *name)
 684 {
 685     if (!SawDirective(raw))
 686         return; // not configured
 687
 688     entry->append(name, strlen(name));
 689     SBufStream os;
 690     Configuration::Component<T>::Print(os, raw);
 691     const auto buf = os.buf();
 692     if (buf.length()) {
 693         entry->append(" ", 1);
 694         entry->append(buf.rawContent(), buf.length());
 695     }
 696     entry->append("\n", 1);
 697 }
 698
 699 /// frees any resources associated with the given raw SquidConfig data member
 700 template <typename T>
 701 static void
 702 FreeDirective(T &raw)
 703 {
 704     Configuration::Component<T>::Free(raw);
 705
 706     // While the implementation may change, there is no way to avoid zeroing.
 707     // Even migration to a proper SquidConfig class would not help: While
 708     // ordinary destructors do not need to zero data members, a SquidConfig
 709     // destructor would have to zero to protect any SquidConfig::x destruction
 710     // code from accidentally dereferencing an already destroyed Config.y.
 711     static_assert(std::is_trivial<T>::value, "SquidConfig member is trivial");
 712     memset(&raw, 0, sizeof(raw));
 713 }
 714
 715 static void
 716 configDoConfigure(void)
 717 {
 718     Config2.clear();
 719     /* init memory as early as possible */
 720     memConfigure();
 721     /* Sanity checks */
 722
 723     if (Debug::rotateNumber < 0) {
 724         Debug::rotateNumber = Config.Log.rotateNumber;
 725     }
 726
 727 #if SIZEOF_OFF_T <= 4
 728     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 729         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 730         Config.Store.maxObjectSize = 0x7FFF0000;
 731     }
 732 #endif
 733
 734     if (Config.Announce.period > 0) {
 735         Config.onoff.announce = 1;
 736     } else {
 737         Config.Announce.period = 86400 * 365;   /* one year */
 738         Config.onoff.announce = 0;
 739     }
 740
 741     if (Config.onoff.httpd_suppress_version_string)
 742         visible_appname_string = (char *)appname_string;
 743     else
 744         visible_appname_string = (char const *)APP_FULLNAME;
 745
 746     if (Config.Program.redirect) {
 747         if (Config.redirectChildren.n_max < 1) {
 748             Config.redirectChildren.n_max = 0;
 749             wordlistDestroy(&Config.Program.redirect);
 750         }
 751     }
 752
 753     if (Config.Program.store_id) {
 754         if (Config.storeIdChildren.n_max < 1) {
 755             Config.storeIdChildren.n_max = 0;
 756             wordlistDestroy(&Config.Program.store_id);
 757         }
 758     }
 759
 760     if (Config.appendDomain)
 761         if (*Config.appendDomain != '.')
 762             fatal("append_domain must begin with a '.'");
 763
 764     if (Config.errHtmlText == NULL)
 765         Config.errHtmlText = xstrdup(null_string);
 766
 767 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 768     if (Config.max_filedescriptors > 0) {
 769         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 770     }
 771 #elif USE_SELECT || USE_SELECT_WIN32
 772     if (Config.max_filedescriptors > FD_SETSIZE) {
 773         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 774     }
 775 #endif
 776
 777     storeConfigure();
 778
 779     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 780              uniqueHostname(),
 781              visible_appname_string);
 782
 783     /*
 784      * the extra space is for loop detection in client_side.c -- we search
 785      * for substrings in the Via header.
 786      */
 787     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 788              uniqueHostname(),
 789              visible_appname_string);
 790
 791     /* Use visible_hostname as default surrogate_id */
 792     if (!Config.Accel.surrogate_id) {
 793         const char *t = getMyHostname();
 794         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 795     }
 796
 797     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 798         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 799
 800     if (Config.appendDomain)
 801         Config.appendDomainLen = strlen(Config.appendDomain);
 802     else
 803         Config.appendDomainLen = 0;
 804
 805     if (Config.connect_retries > 10) {
 806         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 807         Config.connect_retries = 10;
 808     }
 809
 810     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 811 #if USE_UNLINKD
 812
 813     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 814 #endif
 815     bool logDaemonUsed = false;
 816     for (const auto *log = Config.Log.accesslogs; !logDaemonUsed && log; log = log->next)
 817         logDaemonUsed = log->usesDaemon();
 818 #if ICAP_CLIENT
 819     for (const auto *log = Config.Log.icaplogs; !logDaemonUsed && log; log = log->next)
 820         logDaemonUsed = log->usesDaemon();
 821 #endif
 822     if (logDaemonUsed)
 823         requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 824
 825     if (Config.Program.redirect)
 826         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 827
 828     if (Config.Program.store_id)
 829         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 830
 831     requirePathnameExists("Icon Directory", Config.icons.directory);
 832
 833     if (Config.errorDirectory)
 834         requirePathnameExists("Error Directory", Config.errorDirectory);
 835
 836 #if USE_HTTP_VIOLATIONS
 837
 838     {
 839         const RefreshPattern *R;
 840
 841         for (R = Config.Refresh; R; R = R->next) {
 842             if (!R->flags.override_expire)
 843                 continue;
 844
 845             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 846
 847             break;
 848         }
 849
 850         for (R = Config.Refresh; R; R = R->next) {
 851             if (!R->flags.override_lastmod)
 852                 continue;
 853
 854             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 855
 856             break;
 857         }
 858
 859         for (R = Config.Refresh; R; R = R->next) {
 860             if (!R->flags.reload_into_ims)
 861                 continue;
 862
 863             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 864
 865             break;
 866         }
 867
 868         for (R = Config.Refresh; R; R = R->next) {
 869             if (!R->flags.ignore_reload)
 870                 continue;
 871
 872             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 873
 874             break;
 875         }
 876
 877         for (R = Config.Refresh; R; R = R->next) {
 878             if (!R->flags.ignore_no_store)
 879                 continue;
 880
 881             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 882
 883             break;
 884         }
 885
 886         for (R = Config.Refresh; R; R = R->next) {
 887             if (!R->flags.ignore_private)
 888                 continue;
 889
 890             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 891
 892             break;
 893         }
 894     }
 895 #endif
 896 #if !USE_HTTP_VIOLATIONS
 897     Config.onoff.via = 1;
 898 #else
 899
 900     if (!Config.onoff.via)
 901         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 902
 903 #endif
 904
 905     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 906     // TODO: replace with a dedicated "purge" ACL option?
 907     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 908
 909     if (geteuid() == 0) {
 910         if (NULL != Config.effectiveUser) {
 911
 912             struct passwd *pwd = getpwnam(Config.effectiveUser);
 913
 914             if (NULL == pwd) {
 915                 /*
 916                  * Andres Kroonmaa <andre@online.ee>:
 917                  * Some getpwnam() implementations (Solaris?) require
 918                  * an available FD < 256 for opening a FILE* to the
 919                  * passwd file.
 920                  * DW:
 921                  * This should be safe at startup, but might still fail
 922                  * during reconfigure.
 923                  */
 924                 fatalf("getpwnam failed to find userid for effective user '%s'",
 925                        Config.effectiveUser);
 926                 return;
 927             }
 928
 929             Config2.effectiveUserID = pwd->pw_uid;
 930
 931             Config2.effectiveGroupID = pwd->pw_gid;
 932
 933 #if HAVE_PUTENV
 934             if (pwd->pw_dir && *pwd->pw_dir) {
 935                 // putenv() leaks by design; avoid leaks when nothing changes
 936                 static SBuf lastDir;
 937                 if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
 938                     lastDir = pwd->pw_dir;
 939                     int len = strlen(pwd->pw_dir) + 6;
 940                     char *env_str = (char *)xcalloc(len, 1);
 941                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 942                     putenv(env_str);
 943                 }
 944             }
 945 #endif
 946         }
 947     } else {
 948         Config2.effectiveUserID = geteuid();
 949         Config2.effectiveGroupID = getegid();
 950     }
 951
 952     if (NULL != Config.effectiveGroup) {
 953
 954         struct group *grp = getgrnam(Config.effectiveGroup);
 955
 956         if (NULL == grp) {
 957             fatalf("getgrnam failed to find groupid for effective group '%s'",
 958                    Config.effectiveGroup);
 959             return;
 960         }
 961
 962         Config2.effectiveGroupID = grp->gr_gid;
 963     }
 964
 965 #if USE_OPENSSL
 966     if (Config.ssl_client.foreignIntermediateCertsPath)
 967         Ssl::loadSquidUntrusted(Config.ssl_client.foreignIntermediateCertsPath);
 968 #endif
 969
 970     if (Security::ProxyOutgoingConfig.encryptTransport) {
 971         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 972         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 973         if (!Config.ssl_client.sslContext) {
 974 #if USE_OPENSSL
 975             fatal("ERROR: Could not initialize https:// proxy context");
 976 #else
 977             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 978 #endif
 979         }
 980 #if USE_OPENSSL
 981         Ssl::useSquidUntrusted(Config.ssl_client.sslContext.get());
 982 #endif
 983     }
 984
 985     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 986
 987         // default value for ssldomain= is the peer host/IP
 988         if (p->secure.sslDomain.isEmpty())
 989             p->secure.sslDomain = p->host;
 990
 991         if (p->secure.encryptTransport) {
 992             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 993             p->sslContext = p->secure.createClientContext(true);
 994             if (!p->sslContext) {
 995                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 996                 self_destruct();
 997                 return;
 998             }
 999         }
1000     }
1001
1002     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
1003         if (!s->secure.encryptTransport)
1004             continue;
1005         debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS contexts");
1006         s->secure.initServerContexts(*s);
1007     }
1008
1009     // prevent infinite fetch loops in the request parser
1010     // due to buffer full but not enough data received to finish parse
1011     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
1012         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
1013                " Change client_request_buffer_max or request_header_max_size limits.",
1014                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
1015     }
1016
1017     /*
1018      * Disable client side request pipelining if client_persistent_connections OFF.
1019      * Waste of resources queueing any pipelined requests when the first will close the connection.
1020      */
1021     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
1022         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
1023                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
1024         Config.pipeline_max_prefetch = 0;
1025     }
1026
1027 #if USE_AUTH
1028     /*
1029      * disable client side request pipelining. There is a race with
1030      * Negotiate and NTLM when the client sends a second request on an
1031      * connection before the authenticate challenge is sent. With
1032      * pipelining OFF, the client may fail to authenticate, but squid's
1033      * state will be preserved.
1034      */
1035     if (Config.pipeline_max_prefetch > 0) {
1036         Auth::SchemeConfig *nego = Auth::SchemeConfig::Find("Negotiate");
1037         Auth::SchemeConfig *ntlm = Auth::SchemeConfig::Find("NTLM");
1038         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
1039             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
1040             Config.pipeline_max_prefetch = 0;
1041         }
1042     }
1043
1044     for (auto &authSchemes : Auth::TheConfig.schemeLists) {
1045         authSchemes.expand();
1046         if (authSchemes.authConfigs.empty()) {
1047             debugs(3, DBG_CRITICAL, "auth_schemes: at least one scheme name is required; got: " << authSchemes.rawSchemes);
1048             self_destruct();
1049         }
1050     }
1051 #endif
1052 }
1053
1054 /** Parse a line containing an obsolete directive.
1055  * To upgrade it where possible instead of just "Bungled config" for
1056  * directives which cannot be marked as simply aliases of the some name.
1057  * For example if the parameter order and content has changed.
1058  * Or if the directive has been completely removed.
1059  */
1060 void
1061 parse_obsolete(const char *name)
1062 {
1063     // Directives which have been radically changed rather than removed
1064     if (!strcmp(name, "url_rewrite_concurrency")) {
1065         int cval;
1066         parse_int(&cval);
1067         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
1068         Config.redirectChildren.concurrency = cval;
1069     }
1070
1071     if (!strcmp(name, "log_access")) {
1072         self_destruct();
1073         return;
1074     }
1075
1076     if (!strcmp(name, "log_icap")) {
1077         self_destruct();
1078         return;
1079     }
1080
1081     if (!strcmp(name, "ignore_ims_on_miss")) {
1082         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
1083         // than the 2.7 directive. We need to parse and invert the configured value.
1084         int temp = 0;
1085         parse_onoff(&temp);
1086         Config.onoff.cache_miss_revalidate = !temp;
1087     }
1088
1089     if (!strncmp(name, "sslproxy_", 9)) {
1090         // the replacement directive tls_outgoing_options uses options instead of whole-line input
1091         SBuf tmp;
1092         if (!strcmp(name, "sslproxy_cafile"))
1093             tmp.append("cafile=");
1094         else if (!strcmp(name, "sslproxy_capath"))
1095             tmp.append("capath=");
1096         else if (!strcmp(name, "sslproxy_cipher"))
1097             tmp.append("cipher=");
1098         else if (!strcmp(name, "sslproxy_client_certificate"))
1099             tmp.append("cert=");
1100         else if (!strcmp(name, "sslproxy_client_key"))
1101             tmp.append("key=");
1102         else if (!strcmp(name, "sslproxy_flags"))
1103             tmp.append("flags=");
1104         else if (!strcmp(name, "sslproxy_options"))
1105             tmp.append("options=");
1106         else if (!strcmp(name, "sslproxy_version"))
1107             tmp.append("version=");
1108         else {
1109             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1110             self_destruct();
1111             return;
1112         }
1113
1114         // add the value as unquoted-string because the old values did not support whitespace
1115         const char *token = ConfigParser::NextQuotedOrToEol();
1116         tmp.append(token, strlen(token));
1117         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1118     }
1119 }
1120
1121 template <class MinimalUnit>
1122 static const char *
1123 TimeUnitToString()
1124 {
1125     const auto minUnit = MinimalUnit(1);
1126     if(minUnit == std::chrono::nanoseconds(1))
1127         return T_NANOSECOND_STR;
1128     else if (minUnit == std::chrono::microseconds(1))
1129         return T_MICROSECOND_STR;
1130     else if (minUnit == std::chrono::milliseconds(1))
1131         return T_MILLISECOND_STR;
1132     else {
1133         assert(minUnit >= std::chrono::seconds(1));
1134         return T_SECOND_STR;
1135     }
1136 }
1137
1138 /// Assigns 'ns' the number of nanoseconds corresponding to 'unitName'.
1139 /// \param MinimalUnit is a chrono duration type specifying the minimal
1140 /// allowed time unit.
1141 /// \returns true if unitName is correct and its time unit is not less
1142 /// than MinimalUnit.
1143 template <class MinimalUnit>
1144 static bool
1145 parseTimeUnit(const char *unitName, std::chrono::nanoseconds &ns)
1146 {
1147     if (!unitName)
1148         throw TexcHere("missing time unit");
1149
1150     if (!strncasecmp(unitName, T_NANOSECOND_STR, strlen(T_NANOSECOND_STR)))
1151         ns = std::chrono::nanoseconds(1);
1152     else if (!strncasecmp(unitName, T_MICROSECOND_STR, strlen(T_MICROSECOND_STR)))
1153         ns = std::chrono::microseconds(1);
1154     else if (!strncasecmp(unitName, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1155         ns = std::chrono::milliseconds(1);
1156     else if (!strncasecmp(unitName, T_SECOND_STR, strlen(T_SECOND_STR)))
1157         ns = std::chrono::seconds(1);
1158     else if (!strncasecmp(unitName, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1159         ns = std::chrono::minutes(1);
1160     else if (!strncasecmp(unitName, T_HOUR_STR, strlen(T_HOUR_STR)))
1161         ns = std::chrono::hours(1);
1162     else if (!strncasecmp(unitName, T_DAY_STR, strlen(T_DAY_STR)))
1163         ns = std::chrono::hours(24);
1164     else if (!strncasecmp(unitName, T_WEEK_STR, strlen(T_WEEK_STR)))
1165         ns = std::chrono::hours(24 * 7);
1166     else if (!strncasecmp(unitName, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1167         ns = std::chrono::hours(24 * 14);
1168     else if (!strncasecmp(unitName, T_MONTH_STR, strlen(T_MONTH_STR)))
1169         ns = std::chrono::hours(24 * 30);
1170     else if (!strncasecmp(unitName, T_YEAR_STR, strlen(T_YEAR_STR)))
1171         ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear));
1172     else if (!strncasecmp(unitName, T_DECADE_STR, strlen(T_DECADE_STR)))
1173         ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear * 10));
1174     else
1175         return false;
1176
1177     if (ns < MinimalUnit(1)) {
1178         throw TexcHere(ToSBuf("time unit '", unitName, "' is too small to be used in this context, the minimal unit is ",
1179                               TimeUnitToString<MinimalUnit>()));
1180     }
1181
1182     return true;
1183 }
1184
1185 static std::chrono::nanoseconds
1186 ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
1187 {
1188     if (value < 0.0)
1189         throw TexcHere("time must have a positive value");
1190
1191     if (value > (static_cast<double>(std::chrono::nanoseconds::max().count()) / unit.count())) {
1192         const auto maxYears = std::chrono::duration_cast<std::chrono::hours>(std::chrono::nanoseconds::max()).count()/HoursPerYear;
1193         throw TexcHere(ToSBuf("time values cannot exceed ", maxYears, " years"));
1194     }
1195
1196     return std::chrono::duration_cast<std::chrono::nanoseconds>(unit * value);
1197 }
1198
1199 template <class TimeUnit>
1200 static TimeUnit
1201 FromNanoseconds(const std::chrono::nanoseconds &ns, const double parsedValue)
1202 {
1203     const auto result = std::chrono::duration_cast<TimeUnit>(ns);
1204     if (!result.count()) {
1205         throw TexcHere(ToSBuf("time value '", parsedValue,
1206                               "' is too small to be used in this context, the minimal value is 1 ",
1207                               TimeUnitToString<TimeUnit>()));
1208     }
1209     return result;
1210 }
1211
1212 /// Parses a time specification from the config file and
1213 /// returns the time as a chrono duration object of 'TimeUnit' type.
1214 template <class TimeUnit>
1215 static TimeUnit
1216 parseTimeLine()
1217 {
1218     const auto valueToken = ConfigParser::NextToken();
1219     if (!valueToken)
1220         throw TexcHere("cannot read a time value");
1221
1222     const auto parsedValue = xatof(valueToken);
1223
1224     if (parsedValue == 0)
1225         return TimeUnit::zero();
1226
1227     std::chrono::nanoseconds parsedUnitDuration;
1228
1229     const auto token = ConfigParser::PeekAtToken();
1230
1231     if (!parseTimeUnit<TimeUnit>(token, parsedUnitDuration))
1232         throw TexcHere(ToSBuf("unknown time unit '", token, "'"));
1233
1234     (void)ConfigParser::NextToken();
1235
1236     const auto nanoseconds = ToNanoSeconds(parsedValue, parsedUnitDuration);
1237
1238     // validate precisions (time-units-small only)
1239     if (TimeUnit(1) <= std::chrono::microseconds(1)) {
1240         if (0 < nanoseconds.count() && nanoseconds.count() < 3) {
1241             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), ConfigParser::CurrentLocation() << ": WARNING: " <<
1242                    "Squid time measurement precision is likely to be far worse than " <<
1243                    "the nanosecond-level precision implied by the configured value: " << parsedValue << ' ' << token);
1244         }
1245     }
1246
1247     return FromNanoseconds<TimeUnit>(nanoseconds, parsedValue);
1248 }
1249
1250 static void
1251 parseBytesLine64(int64_t * bptr, const char *units)
1252 {
1253     char *token;
1254     double d;
1255     int64_t m;
1256     int64_t u;
1257
1258     if ((u = parseBytesUnits(units)) == 0) {
1259         self_destruct();
1260         return;
1261     }
1262
1263     if ((token = ConfigParser::NextToken()) == NULL) {
1264         self_destruct();
1265         return;
1266     }
1267
1268     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1269         *bptr = -1;
1270         return;
1271     }
1272
1273     d = xatof(token);
1274
1275     m = u;          /* default to 'units' if none specified */
1276
1277     if (0.0 == d)
1278         (void) 0;
1279     else if ((token = ConfigParser::NextToken()) == NULL)
1280         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1281                config_input_line << "', assuming " <<
1282                d << " " <<  units  );
1283     else if ((m = parseBytesUnits(token)) == 0) {
1284         self_destruct();
1285         return;
1286     }
1287
1288     *bptr = static_cast<int64_t>(m * d / u);
1289
1290     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1291         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1292                d << " " << token << ": integer overflow (int64_t).");
1293         self_destruct();
1294     }
1295 }
1296
1297 static void
1298 parseBytesLine(size_t * bptr, const char *units)
1299 {
1300     char *token;
1301     double d;
1302     int m;
1303     int u;
1304
1305     if ((u = parseBytesUnits(units)) == 0) {
1306         self_destruct();
1307         return;
1308     }
1309
1310     if ((token = ConfigParser::NextToken()) == NULL) {
1311         self_destruct();
1312         return;
1313     }
1314
1315     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1316         *bptr = static_cast<size_t>(-1);
1317         return;
1318     }
1319
1320     d = xatof(token);
1321
1322     m = u;          /* default to 'units' if none specified */
1323
1324     if (0.0 == d)
1325         (void) 0;
1326     else if ((token = ConfigParser::NextToken()) == NULL)
1327         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1328                config_input_line << "', assuming " <<
1329                d << " " <<  units  );
1330     else if ((m = parseBytesUnits(token)) == 0) {
1331         self_destruct();
1332         return;
1333     }
1334
1335     *bptr = static_cast<size_t>(m * d / u);
1336
1337     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1338         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1339                d << " " << token << ": integer overflow (size_t).");
1340         self_destruct();
1341     }
1342 }
1343
1344 static void
1345 parseBytesLineSigned(ssize_t * bptr, const char *units)
1346 {
1347     char *token;
1348     double d;
1349     int m;
1350     int u;
1351
1352     if ((u = parseBytesUnits(units)) == 0) {
1353         self_destruct();
1354         return;
1355     }
1356
1357     if ((token = ConfigParser::NextToken()) == NULL) {
1358         self_destruct();
1359         return;
1360     }
1361
1362     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1363         *bptr = -1;
1364         return;
1365     }
1366
1367     d = xatof(token);
1368
1369     m = u;          /* default to 'units' if none specified */
1370
1371     if (0.0 == d)
1372         (void) 0;
1373     else if ((token = ConfigParser::NextToken()) == NULL)
1374         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1375                config_input_line << "', assuming " <<
1376                d << " " <<  units  );
1377     else if ((m = parseBytesUnits(token)) == 0) {
1378         self_destruct();
1379         return;
1380     }
1381
1382     *bptr = static_cast<ssize_t>(m * d / u);
1383
1384     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1385         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1386                d << " " << token << ": integer overflow (ssize_t).");
1387         self_destruct();
1388     }
1389 }
1390
1391 /**
1392  * Parse bytes from a string.
1393  * Similar to the parseBytesLine function but parses the string value instead of
1394  * the current token value.
1395  */
1396 void
1397 parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1398 {
1399     int u;
1400     if ((u = parseBytesUnits(units)) == 0) {
1401         self_destruct();
1402         return;
1403     }
1404
1405     // Find number from string beginning.
1406     char const * number_begin = value;
1407     char const * number_end = value;
1408
1409     while ((*number_end >= '0' && *number_end <= '9')) {
1410         ++number_end;
1411     }
1412
1413     String number;
1414     number.assign(number_begin, number_end - number_begin);
1415
1416     int d = xatoi(number.termedBuf());
1417     int m;
1418     if ((m = parseBytesUnits(number_end)) == 0) {
1419         self_destruct();
1420         return;
1421     }
1422
1423     *bptr = static_cast<size_t>(m * d / u);
1424     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1425         self_destruct();
1426 }
1427
1428 static size_t
1429 parseBytesUnits(const char *unit)
1430 {
1431     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1432         return 1;
1433
1434     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1435         return 1 << 10;
1436
1437     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1438         return 1 << 20;
1439
1440     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1441         return 1 << 30;
1442
1443     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1444
1445     return 0;
1446 }
1447
1448 static void
1449 parse_SBufList(SBufList * list)
1450 {
1451     while (char *token = ConfigParser::NextQuotedToken())
1452         list->push_back(SBuf(token));
1453 }
1454
1455 // just dump a list, no directive name
1456 static void
1457 dump_SBufList(StoreEntry * entry, const SBufList &words)
1458 {
1459     for (const auto &i : words) {
1460         entry->append(i.rawContent(), i.length());
1461         entry->append(" ",1);
1462     }
1463     entry->append("\n",1);
1464 }
1465
1466 // dump a SBufList type directive with name
1467 static void
1468 dump_SBufList(StoreEntry * entry, const char *name, SBufList &list)
1469 {
1470     if (!list.empty()) {
1471         entry->append(name, strlen(name));
1472         entry->append(" ", 1);
1473         dump_SBufList(entry, list);
1474     }
1475 }
1476
1477 static void
1478 free_SBufList(SBufList *list)
1479 {
1480     if (list)
1481         list->clear();
1482 }
1483
1484 static void
1485 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1486 {
1487     while (ae != NULL) {
1488         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1489         storeAppendPrintf(entry, "%s %s %s ",
1490                           name,
1491                           ae->name,
1492                           ae->typeString());
1493         SBufList tail;
1494         tail.splice(tail.end(), ae->dumpOptions());
1495         tail.splice(tail.end(), ae->dump()); // ACL parameters
1496         dump_SBufList(entry, tail);
1497         ae = ae->next;
1498     }
1499 }
1500
1501 static void
1502 parse_acl(ACL ** ae)
1503 {
1504     ACL::ParseAclLine(LegacyParser, ae);
1505 }
1506
1507 static void
1508 free_acl(ACL ** ae)
1509 {
1510     aclDestroyAcls(ae);
1511 }
1512
1513 void
1514 dump_acl_list(StoreEntry * entry, ACLList * head)
1515 {
1516     // XXX: Should dump ACL names like "foo !bar" but dumps parsing context like
1517     // "(clientside_tos 0x11 line)".
1518     dump_SBufList(entry, head->dump());
1519 }
1520
1521 void
1522 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1523 {
1524     if (head)
1525         dump_SBufList(entry, head->treeDump(name, &Acl::AllowOrDeny));
1526 }
1527
1528 static void
1529 parse_acl_access(acl_access ** head)
1530 {
1531     aclParseAccessLine(cfg_directive, LegacyParser, head);
1532 }
1533
1534 static void
1535 free_acl_access(acl_access ** head)
1536 {
1537     aclDestroyAccessList(head);
1538 }
1539
1540 static void
1541 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1542 {
1543     char buf[MAX_IPSTRLEN];
1544     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1545 }
1546
1547 static void
1548 parse_address(Ip::Address *addr)
1549 {
1550     char *token = ConfigParser::NextToken();
1551
1552     if (!token) {
1553         self_destruct();
1554         return;
1555     }
1556
1557     if (!strcmp(token,"any_addr"))
1558         addr->setAnyAddr();
1559     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1560         addr->setNoAddr();
1561     else if ( (*addr = token) ) // try parse numeric/IPA
1562         (void) 0;
1563     else if (addr->GetHostByName(token)) // do not use ipcache
1564         (void) 0;
1565     else { // not an IP and not a hostname
1566         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1567         self_destruct();
1568     }
1569 }
1570
1571 static void
1572 free_address(Ip::Address *addr)
1573 {
1574     addr->setEmpty();
1575 }
1576
1577 static void
1578 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1579 {
1580     char buf[MAX_IPSTRLEN];
1581
1582     for (Acl::Address *l = head; l; l = l->next) {
1583         if (!l->addr.isAnyAddr())
1584             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1585         else
1586             storeAppendPrintf(entry, "%s autoselect", name);
1587
1588         dump_acl_list(entry, l->aclList);
1589
1590         storeAppendPrintf(entry, "\n");
1591     }
1592 }
1593
1594 static void
1595 parse_acl_address(Acl::Address ** head)
1596 {
1597     Acl::Address *l = new Acl::Address;
1598     parse_address(&l->addr);
1599     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1600
1601     Acl::Address **tail = head;
1602     while (*tail)
1603         tail = &(*tail)->next;
1604
1605     *tail = l;
1606 }
1607
1608 static void
1609 free_acl_address(Acl::Address ** head)
1610 {
1611     delete *head;
1612     *head = NULL;
1613 }
1614
1615 static void
1616 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1617 {
1618     acl_tos *l;
1619
1620     for (l = head; l; l = l->next) {
1621         if (l->tos > 0)
1622             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1623         else
1624             storeAppendPrintf(entry, "%s none", name);
1625
1626         dump_acl_list(entry, l->aclList);
1627
1628         storeAppendPrintf(entry, "\n");
1629     }
1630 }
1631
1632 static void
1633 parse_acl_tos(acl_tos ** head)
1634 {
1635     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1636     char *token = ConfigParser::NextToken();
1637
1638     if (!token) {
1639         self_destruct();
1640         return;
1641     }
1642
1643     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1644         self_destruct();
1645         return;
1646     }
1647
1648     const unsigned int chTos = tos & 0xFC;
1649     if (chTos != tos) {
1650         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1651         tos = chTos;
1652     }
1653
1654     acl_tos *l = new acl_tos;
1655
1656     l->tos = (tos_t)tos;
1657
1658     aclParseAclList(LegacyParser, &l->aclList, token);
1659
1660     acl_tos **tail = head;  /* sane name below */
1661     while (*tail)
1662         tail = &(*tail)->next;
1663
1664     *tail = l;
1665 }
1666
1667 static void
1668 free_acl_tos(acl_tos ** head)
1669 {
1670     delete *head;
1671     *head = NULL;
1672 }
1673
1674 #if SO_MARK && USE_LIBCAP
1675
1676 static void
1677 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1678 {
1679     for (acl_nfmark *l = head; l; l = l->next) {
1680         storeAppendPrintf(entry, "%s %s", name, ToSBuf(l->markConfig).c_str());
1681
1682         dump_acl_list(entry, l->aclList);
1683
1684         storeAppendPrintf(entry, "\n");
1685     }
1686 }
1687
1688 static void
1689 parse_acl_nfmark(acl_nfmark ** head)
1690 {
1691     SBuf token(ConfigParser::NextToken());
1692     const auto mc = Ip::NfMarkConfig::Parse(token);
1693
1694     // Packet marking directives should not allow to use masks.
1695     const auto pkt_dirs = {"mark_client_packet", "clientside_mark", "tcp_outgoing_mark"};
1696     if (mc.hasMask() && std::find(pkt_dirs.begin(), pkt_dirs.end(), cfg_directive) != pkt_dirs.end())
1697         throw TexcHere(ToSBuf("'", cfg_directive, "' does not support masked marks"));
1698
1699     acl_nfmark *l = new acl_nfmark;
1700     l->markConfig = mc;
1701
1702     aclParseAclList(LegacyParser, &l->aclList, token.c_str());
1703
1704     acl_nfmark **tail = head;   /* sane name below */
1705     while (*tail)
1706         tail = &(*tail)->next;
1707
1708     *tail = l;
1709 }
1710
1711 static void
1712 free_acl_nfmark(acl_nfmark ** head)
1713 {
1714     delete *head;
1715     *head = NULL;
1716 }
1717 #endif /* SO_MARK */
1718
1719 static void
1720 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1721 {
1722     for (AclSizeLimit *l = head; l; l = l->next) {
1723         if (l->size != -1)
1724             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1725         else
1726             storeAppendPrintf(entry, "%s none", name);
1727
1728         dump_acl_list(entry, l->aclList);
1729
1730         storeAppendPrintf(entry, "\n");
1731     }
1732 }
1733
1734 static void
1735 parse_acl_b_size_t(AclSizeLimit ** head)
1736 {
1737     AclSizeLimit *l = new AclSizeLimit;
1738
1739     parse_b_int64_t(&l->size);
1740
1741     aclParseAclList(LegacyParser, &l->aclList, l->size);
1742
1743     AclSizeLimit **tail = head; /* sane name below */
1744     while (*tail)
1745         tail = &(*tail)->next;
1746
1747     *tail = l;
1748 }
1749
1750 static void
1751 free_acl_b_size_t(AclSizeLimit ** head)
1752 {
1753     delete *head;
1754     *head = NULL;
1755 }
1756
1757 #if USE_DELAY_POOLS
1758
1759 #include "DelayConfig.h"
1760 #include "DelayPools.h"
1761 /* do nothing - free_delay_pool_count is the magic free function.
1762  * this is why delay_pool_count isn't just marked TYPE: u_short
1763  */
1764 #define free_delay_pool_class(X)
1765 #define free_delay_pool_access(X)
1766 #define free_delay_pool_rates(X)
1767 #define dump_delay_pool_class(X, Y, Z)
1768 #define dump_delay_pool_access(X, Y, Z)
1769 #define dump_delay_pool_rates(X, Y, Z)
1770
1771 static void
1772 free_delay_pool_count(DelayConfig * cfg)
1773 {
1774     cfg->freePoolCount();
1775 }
1776
1777 static void
1778 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1779 {
1780     cfg.dumpPoolCount (entry, name);
1781 }
1782
1783 static void
1784 parse_delay_pool_count(DelayConfig * cfg)
1785 {
1786     cfg->parsePoolCount();
1787 }
1788
1789 static void
1790 parse_delay_pool_class(DelayConfig * cfg)
1791 {
1792     cfg->parsePoolClass();
1793 }
1794
1795 static void
1796 parse_delay_pool_rates(DelayConfig * cfg)
1797 {
1798     cfg->parsePoolRates();
1799 }
1800
1801 static void
1802 parse_delay_pool_access(DelayConfig * cfg)
1803 {
1804     cfg->parsePoolAccess(LegacyParser);
1805 }
1806
1807 #endif
1808
1809 #if USE_DELAY_POOLS
1810 #include "ClientDelayConfig.h"
1811 /* do nothing - free_client_delay_pool_count is the magic free function.
1812  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1813  */
1814
1815 #define free_client_delay_pool_access(X)
1816 #define free_client_delay_pool_rates(X)
1817 #define dump_client_delay_pool_access(X, Y, Z)
1818 #define dump_client_delay_pool_rates(X, Y, Z)
1819
1820 static void
1821 free_client_delay_pool_count(ClientDelayConfig * cfg)
1822 {
1823     cfg->freePools();
1824 }
1825
1826 static void
1827 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1828 {
1829     cfg.dumpPoolCount (entry, name);
1830 }
1831
1832 static void
1833 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1834 {
1835     cfg->parsePoolCount();
1836 }
1837
1838 static void
1839 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1840 {
1841     cfg->parsePoolRates();
1842 }
1843
1844 static void
1845 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1846 {
1847     cfg->parsePoolAccess(LegacyParser);
1848 }
1849 #endif
1850
1851 #if USE_HTTP_VIOLATIONS
1852 static void
1853 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1854 {
1855     if (manglers)
1856         manglers->dumpAccess(entry, name);
1857 }
1858
1859 static void
1860 parse_http_header_access(HeaderManglers **pm)
1861 {
1862     char *t = NULL;
1863
1864     if ((t = ConfigParser::NextToken()) == NULL) {
1865         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1866         debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_access: missing header name.");
1867         return;
1868     }
1869
1870     if (!*pm)
1871         *pm = new HeaderManglers;
1872     HeaderManglers *manglers = *pm;
1873     headerMangler *mangler = manglers->track(t);
1874     assert(mangler);
1875
1876     std::string directive = "http_header_access ";
1877     directive += t;
1878     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1879 }
1880
1881 static void
1882 free_HeaderManglers(HeaderManglers **pm)
1883 {
1884     // we delete the entire http_header_* mangler configuration at once
1885     if (const HeaderManglers *manglers = *pm) {
1886         delete manglers;
1887         *pm = NULL;
1888     }
1889 }
1890
1891 static void
1892 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1893 {
1894     if (manglers)
1895         manglers->dumpReplacement(entry, name);
1896 }
1897
1898 static void
1899 parse_http_header_replace(HeaderManglers **pm)
1900 {
1901     char *t = NULL;
1902
1903     if ((t = ConfigParser::NextToken()) == NULL) {
1904         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1905         debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_replace: missing header name.");
1906         return;
1907     }
1908
1909     const char *value = ConfigParser::NextQuotedOrToEol();
1910
1911     if (!*pm)
1912         *pm = new HeaderManglers;
1913     HeaderManglers *manglers = *pm;
1914     manglers->setReplacement(t, value);
1915 }
1916
1917 #endif
1918
1919 static void
1920 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1921 {
1922     Store::Disks::Dump(swap, *entry, name);
1923 }
1924
1925 static int
1926 check_null_string(char *s)
1927 {
1928     return s == NULL;
1929 }
1930
1931 #if USE_AUTH
1932 static void
1933 parse_authparam(Auth::ConfigVector * config)
1934 {
1935     char *type_str = ConfigParser::NextToken();
1936     if (!type_str) {
1937         self_destruct();
1938         return;
1939     }
1940
1941     char *param_str = ConfigParser::NextToken();
1942     if (!param_str) {
1943         self_destruct();
1944         return;
1945     }
1946
1947     /* find a configuration for the scheme in the currently parsed configs... */
1948     Auth::SchemeConfig *schemeCfg = Auth::SchemeConfig::Find(type_str);
1949
1950     if (schemeCfg == NULL) {
1951         /* Create a configuration based on the scheme info */
1952         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1953
1954         if (theScheme == NULL) {
1955             debugs(3, DBG_CRITICAL, "ERROR: Failure while parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1956             self_destruct();
1957             return;
1958         }
1959
1960         config->push_back(theScheme->createConfig());
1961         schemeCfg = Auth::SchemeConfig::Find(type_str);
1962         if (schemeCfg == NULL) {
1963             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1964             self_destruct();
1965             return;
1966         }
1967     }
1968
1969     schemeCfg->parse(schemeCfg, config->size(), param_str);
1970 }
1971
1972 static void
1973 free_authparam(Auth::ConfigVector * cfg)
1974 {
1975     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1976     cfg->clear();
1977
1978     /* on reconfigure initialize new auth schemes for the new config. */
1979     if (reconfiguring) {
1980         Auth::Init();
1981     }
1982 }
1983
1984 static void
1985 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1986 {
1987     for (auto *scheme : cfg)
1988         scheme->dump(entry, name, scheme);
1989 }
1990
1991 static void
1992 parse_AuthSchemes(acl_access **authSchemes)
1993 {
1994     const char *tok = ConfigParser::NextQuotedToken();
1995     if (!tok) {
1996         debugs(29, DBG_CRITICAL, "FATAL: auth_schemes missing the parameter");
1997         self_destruct();
1998         return;
1999     }
2000     Auth::TheConfig.schemeLists.emplace_back(tok, ConfigParser::LastTokenWasQuoted());
2001     const auto action = Acl::Answer(ACCESS_ALLOWED, Auth::TheConfig.schemeLists.size() - 1);
2002     ParseAclWithAction(authSchemes, action, "auth_schemes");
2003 }
2004
2005 static void
2006 free_AuthSchemes(acl_access **authSchemes)
2007 {
2008     Auth::TheConfig.schemeLists.clear();
2009     free_acl_access(authSchemes);
2010 }
2011
2012 static void
2013 dump_AuthSchemes(StoreEntry *entry, const char *name, acl_access *authSchemes)
2014 {
2015     if (authSchemes)
2016         dump_SBufList(entry, authSchemes->treeDump(name, [](const Acl::Answer &action) {
2017         return Auth::TheConfig.schemeLists.at(action.kind).rawSchemes;
2018     }));
2019 }
2020
2021 #endif /* USE_AUTH */
2022
2023 static void
2024 ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl)
2025 {
2026     assert(access);
2027     SBuf name;
2028     if (!*access) {
2029         *access = new Acl::Tree;
2030         name.Printf("(%s rules)", desc);
2031         (*access)->context(name.c_str(), config_input_line);
2032     }
2033     Acl::AndNode *rule = new Acl::AndNode;
2034     name.Printf("(%s rule)", desc);
2035     rule->context(name.c_str(), config_input_line);
2036     if (acl)
2037         rule->add(acl);
2038     else
2039         rule->lineParse();
2040     (*access)->add(rule, action);
2041 }
2042
2043 static void
2044 parse_cachedir(Store::DiskConfig *swap)
2045 {
2046     assert(swap);
2047     Store::Disks::Parse(*swap);
2048 }
2049
2050 static const char *
2051 peer_type_str(const peer_t type)
2052 {
2053     const char * result;
2054
2055     switch (type) {
2056
2057     case PEER_PARENT:
2058         result = "parent";
2059         break;
2060
2061     case PEER_SIBLING:
2062         result = "sibling";
2063         break;
2064
2065     case PEER_MULTICAST:
2066         result = "multicast";
2067         break;
2068
2069     default:
2070         result = "unknown";
2071         break;
2072     }
2073
2074     return result;
2075 }
2076
2077 static void
2078 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
2079 {
2080     NeighborTypeDomainList *t;
2081     LOCAL_ARRAY(char, xname, 128);
2082
2083     while (p != NULL) {
2084         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
2085                           name,
2086                           p->host,
2087                           neighborTypeStr(p),
2088                           p->http_port,
2089                           p->icp.port,
2090                           p->name);
2091         dump_peer_options(entry, p);
2092
2093         if (p->access) {
2094             snprintf(xname, 128, "cache_peer_access %s", p->name);
2095             dump_acl_access(entry, xname, p->access);
2096         }
2097
2098         for (t = p->typelist; t; t = t->next) {
2099             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
2100                               p->host,
2101                               peer_type_str(t->type),
2102                               t->domain);
2103         }
2104
2105         p = p->next;
2106     }
2107 }
2108
2109 /**
2110  * utility function to prevent getservbyname() being called with a numeric value
2111  * on Windows at least it returns garage results.
2112  */
2113 static bool
2114 isUnsignedNumeric(const char *str, size_t len)
2115 {
2116     if (len < 1) return false;
2117
2118     for (; len >0 && *str; ++str, --len) {
2119         if (! isdigit(*str))
2120             return false;
2121     }
2122     return true;
2123 }
2124
2125 /**
2126  \param proto   'tcp' or 'udp' for protocol
2127  \returns       Port the named service is supposed to be listening on.
2128  */
2129 static unsigned short
2130 GetService(const char *proto)
2131 {
2132     struct servent *port = NULL;
2133     /** Parses a port number or service name from the squid.conf */
2134     char *token = ConfigParser::NextToken();
2135     if (token == NULL) {
2136         self_destruct();
2137         return 0; /* NEVER REACHED */
2138     }
2139     /** Returns either the service port number from /etc/services */
2140     if ( !isUnsignedNumeric(token, strlen(token)) )
2141         port = getservbyname(token, proto);
2142     if (port != NULL) {
2143         return ntohs((unsigned short)port->s_port);
2144     }
2145     /** Or a numeric translation of the config text. */
2146     return xatos(token);
2147 }
2148
2149 /**
2150  \returns       Port the named TCP service is supposed to be listening on.
2151  \copydoc GetService(const char *proto)
2152  */
2153 inline unsigned short
2154 GetTcpService(void)
2155 {
2156     return GetService("tcp");
2157 }
2158
2159 /**
2160  \returns       Port the named UDP service is supposed to be listening on.
2161  \copydoc GetService(const char *proto)
2162  */
2163 inline unsigned short
2164 GetUdpService(void)
2165 {
2166     return GetService("udp");
2167 }
2168
2169 static void
2170 parse_peer(CachePeer ** head)
2171 {
2172     char *host_str = ConfigParser::NextToken();
2173     if (!host_str) {
2174         self_destruct();
2175         return;
2176     }
2177
2178     char *token = ConfigParser::NextToken();
2179     if (!token) {
2180         self_destruct();
2181         return;
2182     }
2183
2184     CachePeer *p = new CachePeer;
2185     p->host = xstrdup(host_str);
2186     Tolower(p->host);
2187     p->name = xstrdup(host_str);
2188     p->type = parseNeighborType(token);
2189
2190     if (p->type == PEER_MULTICAST) {
2191         p->options.no_digest = true;
2192         p->options.no_netdb_exchange = true;
2193     }
2194
2195     p->http_port = GetTcpService();
2196
2197     if (!p->http_port) {
2198         delete p;
2199         self_destruct();
2200         return;
2201     }
2202
2203     p->icp.port = GetUdpService();
2204
2205     while ((token = ConfigParser::NextToken())) {
2206         if (!strcmp(token, "proxy-only")) {
2207             p->options.proxy_only = true;
2208         } else if (!strcmp(token, "no-query")) {
2209             p->options.no_query = true;
2210         } else if (!strcmp(token, "background-ping")) {
2211             p->options.background_ping = true;
2212         } else if (!strcmp(token, "no-digest")) {
2213             p->options.no_digest = true;
2214         } else if (!strcmp(token, "no-tproxy")) {
2215             p->options.no_tproxy = true;
2216         } else if (!strcmp(token, "multicast-responder")) {
2217             p->options.mcast_responder = true;
2218 #if PEER_MULTICAST_SIBLINGS
2219         } else if (!strcmp(token, "multicast-siblings")) {
2220             p->options.mcast_siblings = true;
2221 #endif
2222         } else if (!strncmp(token, "weight=", 7)) {
2223             p->weight = xatoi(token + 7);
2224         } else if (!strncmp(token, "basetime=", 9)) {
2225             p->basetime = xatoi(token + 9);
2226         } else if (!strcmp(token, "closest-only")) {
2227             p->options.closest_only = true;
2228         } else if (!strncmp(token, "ttl=", 4)) {
2229             p->mcast.ttl = xatoi(token + 4);
2230
2231             if (p->mcast.ttl < 0)
2232                 p->mcast.ttl = 0;
2233
2234             if (p->mcast.ttl > 128)
2235                 p->mcast.ttl = 128;
2236         } else if (!strcmp(token, "default")) {
2237             p->options.default_parent = true;
2238         } else if (!strcmp(token, "round-robin")) {
2239             p->options.roundrobin = true;
2240         } else if (!strcmp(token, "weighted-round-robin")) {
2241             p->options.weighted_roundrobin = true;
2242 #if USE_HTCP
2243         } else if (!strcmp(token, "htcp")) {
2244             p->options.htcp = true;
2245         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2246             /* Note: The htcp- form is deprecated, replaced by htcp= */
2247             p->options.htcp = true;
2248             char *tmp = xstrdup(token+5);
2249             char *mode, *nextmode;
2250             for (mode = nextmode = tmp; mode; mode = nextmode) {
2251                 nextmode = strchr(mode, ',');
2252                 if (nextmode) {
2253                     *nextmode = '\0';
2254                     ++nextmode;
2255                 }
2256                 if (!strcmp(mode, "no-clr")) {
2257                     if (p->options.htcp_only_clr)
2258                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2259                     p->options.htcp_no_clr = true;
2260                 } else if (!strcmp(mode, "no-purge-clr")) {
2261                     p->options.htcp_no_purge_clr = true;
2262                 } else if (!strcmp(mode, "only-clr")) {
2263                     if (p->options.htcp_no_clr)
2264                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2265                     p->options.htcp_only_clr = true;
2266                 } else if (!strcmp(mode, "forward-clr")) {
2267                     p->options.htcp_forward_clr = true;
2268                 } else if (!strcmp(mode, "oldsquid")) {
2269                     p->options.htcp_oldsquid = true;
2270                 } else {
2271                     fatalf("invalid HTCP mode '%s'", mode);
2272                 }
2273             }
2274             safe_free(tmp);
2275 #endif
2276         } else if (!strcmp(token, "no-netdb-exchange")) {
2277             p->options.no_netdb_exchange = true;
2278
2279         } else if (!strcmp(token, "carp")) {
2280             if (p->type != PEER_PARENT)
2281                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2282
2283             p->options.carp = true;
2284         } else if (!strncmp(token, "carp-key=", 9)) {
2285             if (p->options.carp != true)
2286                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2287             p->options.carp_key.set = true;
2288             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2289             for (; key; key = nextkey) {
2290                 nextkey=strchr(key,',');
2291                 if (nextkey) ++nextkey; // skip the comma, any
2292                 if (0==strncmp(key,"scheme",6)) {
2293                     p->options.carp_key.scheme = true;
2294                 } else if (0==strncmp(key,"host",4)) {
2295                     p->options.carp_key.host = true;
2296                 } else if (0==strncmp(key,"port",4)) {
2297                     p->options.carp_key.port = true;
2298                 } else if (0==strncmp(key,"path",4)) {
2299                     p->options.carp_key.path = true;
2300                 } else if (0==strncmp(key,"params",6)) {
2301                     p->options.carp_key.params = true;
2302                 } else {
2303                     fatalf("invalid carp-key '%s'",key);
2304                 }
2305             }
2306         } else if (!strcmp(token, "userhash")) {
2307 #if USE_AUTH
2308             if (p->type != PEER_PARENT)
2309                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2310
2311             p->options.userhash = true;
2312 #else
2313             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2314 #endif
2315         } else if (!strcmp(token, "sourcehash")) {
2316             if (p->type != PEER_PARENT)
2317                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2318
2319             p->options.sourcehash = true;
2320
2321         } else if (!strcmp(token, "no-delay")) {
2322 #if USE_DELAY_POOLS
2323             p->options.no_delay = true;
2324 #else
2325             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2326 #endif
2327         } else if (!strncmp(token, "login=", 6)) {
2328             p->login = xstrdup(token + 6);
2329             rfc1738_unescape(p->login);
2330         } else if (!strcmp(token, "auth-no-keytab")) {
2331             p->options.auth_no_keytab = 1;
2332         } else if (!strncmp(token, "connect-timeout=", 16)) {
2333             p->connect_timeout_raw = xatoi(token + 16);
2334         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2335             p->connect_fail_limit = xatoi(token + 19);
2336 #if USE_CACHE_DIGESTS
2337         } else if (!strncmp(token, "digest-url=", 11)) {
2338             p->digest_url = xstrdup(token + 11);
2339 #endif
2340
2341         } else if (!strcmp(token, "allow-miss")) {
2342             p->options.allow_miss = true;
2343         } else if (!strncmp(token, "max-conn=", 9)) {
2344             p->max_conn = xatoi(token + 9);
2345         } else if (!strncmp(token, "standby=", 8)) {
2346             p->standby.limit = xatoi(token + 8);
2347         } else if (!strcmp(token, "originserver")) {
2348             p->options.originserver = true;
2349         } else if (!strncmp(token, "name=", 5)) {
2350             safe_free(p->name);
2351
2352             if (token[5])
2353                 p->name = xstrdup(token + 5);
2354         } else if (!strncmp(token, "forceddomain=", 13)) {
2355             safe_free(p->domain);
2356             if (token[13])
2357                 p->domain = xstrdup(token + 13);
2358
2359         } else if (strncmp(token, "ssl", 3) == 0) {
2360 #if !USE_OPENSSL
2361             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2362 #else
2363             p->secure.parse(token+3);
2364 #endif
2365         } else if (strncmp(token, "tls-", 4) == 0) {
2366             p->secure.parse(token+4);
2367         } else if (strncmp(token, "tls", 3) == 0) {
2368             p->secure.parse(token+3);
2369         } else if (strcmp(token, "front-end-https") == 0) {
2370             p->front_end_https = 1;
2371         } else if (strcmp(token, "front-end-https=on") == 0) {
2372             p->front_end_https = 1;
2373         } else if (strcmp(token, "front-end-https=auto") == 0) {
2374             p->front_end_https = 2;
2375         } else if (strcmp(token, "connection-auth=off") == 0) {
2376             p->connection_auth = 0;
2377         } else if (strcmp(token, "connection-auth") == 0) {
2378             p->connection_auth = 1;
2379         } else if (strcmp(token, "connection-auth=on") == 0) {
2380             p->connection_auth = 1;
2381         } else if (strcmp(token, "connection-auth=auto") == 0) {
2382             p->connection_auth = 2;
2383         } else if (token[0] == '#') {
2384             // start of a text comment. stop reading this line.
2385             break;
2386         } else {
2387             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2388         }
2389     }
2390
2391     if (peerFindByName(p->name))
2392         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2393
2394     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2395         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2396
2397     if (p->weight < 1)
2398         p->weight = 1;
2399
2400     if (p->connect_fail_limit < 1)
2401         p->connect_fail_limit = 10;
2402
2403 #if USE_CACHE_DIGESTS
2404     if (!p->options.no_digest)
2405         peerDigestCreate(p);
2406 #endif
2407
2408     if (p->secure.encryptTransport)
2409         p->secure.parseOptions();
2410
2411     p->index =  ++Config.npeers;
2412
2413     while (*head != NULL)
2414         head = &(*head)->next;
2415
2416     *head = p;
2417
2418     peerClearRRStart();
2419 }
2420
2421 static void
2422 free_peer(CachePeer ** P)
2423 {
2424     delete *P;
2425     *P = NULL;
2426     Config.npeers = 0;
2427 }
2428
2429 static void
2430 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2431 {
2432     while (list) {
2433         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2434             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2435         else
2436             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2437
2438         for (auto w : list->actions)
2439             entry->appendf(" " SQUIDSBUFPH, SQUIDSBUFPRINT(w));
2440
2441         storeAppendPrintf(entry, "\n");
2442         list = list->next;
2443     }
2444 }
2445
2446 static void
2447 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2448 {
2449     char *passwd = nullptr;
2450     parse_string(&passwd);
2451
2452     Mgr::ActionPasswordList *p = new Mgr::ActionPasswordList;
2453     p->passwd = passwd;
2454
2455     while (char *token = ConfigParser::NextQuotedToken())
2456         p->actions.push_back(SBuf(token));
2457
2458     Mgr::ActionPasswordList **P;
2459     for (P = head; *P; P = &(*P)->next) {
2460         /*
2461          * See if any of the actions from this line already have a
2462          * password from previous lines.  The password checking
2463          * routines in cache_manager.c take the the password from
2464          * the first Mgr::ActionPasswordList that contains the
2465          * requested action.  Thus, we should warn users who might
2466          * think they can have two passwords for the same action.
2467          */
2468         for (const auto &w : (*P)->actions) {
2469             for (const auto &u : p->actions) {
2470                 if (w != u)
2471                     continue;
2472
2473                 debugs(0, DBG_PARSE_NOTE(1), "ERROR: action '" << u << "' (line " << config_lineno << ") already has a password");
2474             }
2475         }
2476     }
2477
2478     *P = p;
2479 }
2480
2481 static void
2482 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2483 {
2484     delete *head;
2485     *head = nullptr;
2486 }
2487
2488 static void
2489 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2490 {
2491     while (var != NULL) {
2492         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2493
2494         for (const auto &aclName: var->acl_list)
2495             storeAppendPrintf(entry, " " SQUIDSBUFPH, SQUIDSBUFPRINT(aclName));
2496
2497         storeAppendPrintf(entry, "\n");
2498
2499         var = var->next;
2500     }
2501 }
2502
2503 static void
2504 parse_denyinfo(AclDenyInfoList ** var)
2505 {
2506     aclParseDenyInfoLine(var);
2507 }
2508
2509 void
2510 free_denyinfo(AclDenyInfoList ** list)
2511 {
2512     delete *list;
2513     *list = nullptr;
2514 }
2515
2516 static void
2517 parse_peer_access(void)
2518 {
2519     char *host = ConfigParser::NextToken();
2520     if (!host) {
2521         self_destruct();
2522         return;
2523     }
2524
2525     CachePeer *p = peerFindByName(host);
2526     if (!p) {
2527         debugs(15, DBG_CRITICAL, "ERROR: " << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2528         return;
2529     }
2530
2531     std::string directive = "peer_access ";
2532     directive += host;
2533     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2534 }
2535
2536 static void
2537 parse_hostdomaintype(void)
2538 {
2539     char *host = ConfigParser::NextToken();
2540     if (!host) {
2541         self_destruct();
2542         return;
2543     }
2544
2545     char *type = ConfigParser::NextToken();
2546     if (!type) {
2547         self_destruct();
2548         return;
2549     }
2550
2551     char *domain = nullptr;
2552     while ((domain = ConfigParser::NextToken())) {
2553         CachePeer *p = peerFindByName(host);
2554         if (!p) {
2555             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2556             return;
2557         }
2558
2559         auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2560         l->type = parseNeighborType(type);
2561         l->domain = xstrdup(domain);
2562
2563         NeighborTypeDomainList **L = nullptr;
2564         for (L = &(p->typelist); *L; L = &((*L)->next));
2565         *L = l;
2566     }
2567 }
2568
2569 static void
2570 dump_int(StoreEntry * entry, const char *name, int var)
2571 {
2572     storeAppendPrintf(entry, "%s %d\n", name, var);
2573 }
2574
2575 void
2576 parse_int(int *var)
2577 {
2578     int i;
2579     i = GetInteger();
2580     *var = i;
2581 }
2582
2583 static void
2584 free_int(int *var)
2585 {
2586     *var = 0;
2587 }
2588
2589 static void
2590 dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2591 {
2592     storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2593 }
2594
2595 static void
2596 parse_int64_t(int64_t *var)
2597 {
2598     int64_t i;
2599     i = GetInteger64();
2600     *var = i;
2601 }
2602
2603 static void
2604 free_int64_t(int64_t *var)
2605 {
2606     *var = 0;
2607 }
2608
2609 static void
2610 dump_onoff(StoreEntry * entry, const char *name, int var)
2611 {
2612     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2613 }
2614
2615 void
2616 parse_onoff(int *var)
2617 {
2618     char *token = ConfigParser::NextToken();
2619     if (!token) {
2620         self_destruct();
2621         return;
2622     }
2623
2624     if (!strcmp(token, "on")) {
2625         *var = 1;
2626     } else if (!strcmp(token, "enable")) {
2627         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2628         *var = 1;
2629     } else if (!strcmp(token, "off")) {
2630         *var = 0;
2631     } else if (!strcmp(token, "disable")) {
2632         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2633         *var = 0;
2634     } else {
2635         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2636         self_destruct();
2637     }
2638 }
2639
2640 #define free_onoff free_int
2641
2642 static void
2643 dump_tristate(StoreEntry * entry, const char *name, int var)
2644 {
2645     const char *state;
2646
2647     if (var > 0)
2648         state = "on";
2649     else if (var < 0)
2650         state = "warn";
2651     else
2652         state = "off";
2653
2654     storeAppendPrintf(entry, "%s %s\n", name, state);
2655 }
2656
2657 static void
2658 parse_tristate(int *var)
2659 {
2660     char *token = ConfigParser::NextToken();
2661     if (!token) {
2662         self_destruct();
2663         return;
2664     }
2665
2666     if (!strcmp(token, "on")) {
2667         *var = 1;
2668     } else if (!strcmp(token, "enable")) {
2669         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2670         *var = 1;
2671     } else if (!strcmp(token, "warn")) {
2672         *var = -1;
2673     } else if (!strcmp(token, "off")) {
2674         *var = 0;
2675     } else if (!strcmp(token, "disable")) {
2676         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2677         *var = 0;
2678     } else {
2679         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2680         self_destruct();
2681     }
2682 }
2683
2684 #define free_tristate free_int
2685
2686 static void
2687 parse_pipelinePrefetch(int *var)
2688 {
2689     char *token = ConfigParser::PeekAtToken();
2690     if (!token) {
2691         self_destruct();
2692         return;
2693     }
2694
2695     if (!strcmp(token, "on")) {
2696         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2697         *var = 1;
2698         //pop the token
2699         (void)ConfigParser::NextToken();
2700     } else if (!strcmp(token, "off")) {
2701         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2702         *var = 0;
2703         //pop the token
2704         (void)ConfigParser::NextToken();
2705     } else
2706         parse_int(var);
2707 }
2708
2709 #define free_pipelinePrefetch free_int
2710 #define dump_pipelinePrefetch dump_int
2711
2712 static void
2713 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2714 {
2715     while (head != NULL) {
2716         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2717                           name,
2718                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2719                           head->pattern.c_str(),
2720                           (int) head->min / 60,
2721                           (int) (100.0 * head->pct + 0.5),
2722                           (int) head->max / 60);
2723
2724         if (head->max_stale >= 0)
2725             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2726
2727         if (head->flags.refresh_ims)
2728             storeAppendPrintf(entry, " refresh-ims");
2729
2730         if (head->flags.store_stale)
2731             storeAppendPrintf(entry, " store-stale");
2732
2733 #if USE_HTTP_VIOLATIONS
2734
2735         if (head->flags.override_expire)
2736             storeAppendPrintf(entry, " override-expire");
2737
2738         if (head->flags.override_lastmod)
2739             storeAppendPrintf(entry, " override-lastmod");
2740
2741         if (head->flags.reload_into_ims)
2742             storeAppendPrintf(entry, " reload-into-ims");
2743
2744         if (head->flags.ignore_reload)
2745             storeAppendPrintf(entry, " ignore-reload");
2746
2747         if (head->flags.ignore_no_store)
2748             storeAppendPrintf(entry, " ignore-no-store");
2749
2750         if (head->flags.ignore_private)
2751             storeAppendPrintf(entry, " ignore-private");
2752 #endif
2753
2754         storeAppendPrintf(entry, "\n");
2755
2756         head = head->next;
2757     }
2758 }
2759
2760 static void
2761 parse_refreshpattern(RefreshPattern ** head)
2762 {
2763     char *token;
2764     char *pattern;
2765     time_t min = 0;
2766     double pct = 0.0;
2767     time_t max = 0;
2768     int refresh_ims = 0;
2769     int store_stale = 0;
2770     int max_stale = -1;
2771
2772 #if USE_HTTP_VIOLATIONS
2773
2774     int override_expire = 0;
2775     int override_lastmod = 0;
2776     int reload_into_ims = 0;
2777     int ignore_reload = 0;
2778     int ignore_no_store = 0;
2779     int ignore_private = 0;
2780 #endif
2781
2782     int i;
2783     RefreshPattern *t;
2784     regex_t comp;
2785     int errcode;
2786     int flags = REG_EXTENDED | REG_NOSUB;
2787
2788     if ((token = ConfigParser::RegexPattern()) != NULL) {
2789
2790         if (strcmp(token, "-i") == 0) {
2791             flags |= REG_ICASE;
2792             token = ConfigParser::RegexPattern();
2793         } else if (strcmp(token, "+i") == 0) {
2794             flags &= ~REG_ICASE;
2795             token = ConfigParser::RegexPattern();
2796         }
2797
2798     }
2799
2800     if (token == NULL) {
2801         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2802         self_destruct();
2803         return;
2804     }
2805
2806     pattern = xstrdup(token);
2807
2808     i = GetInteger();       /* token: min */
2809
2810     /* catch negative and insanely huge values close to 32-bit wrap */
2811     if (i < 0) {
2812         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2813         i = 0;
2814     }
2815     if (i > 60*24*365) {
2816         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2817         i = 60*24*365;
2818     }
2819
2820     min = (time_t) (i * 60);    /* convert minutes to seconds */
2821
2822     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2823
2824     i = GetInteger();       /* token: max */
2825
2826     /* catch negative and insanely huge values close to 32-bit wrap */
2827     if (i < 0) {
2828         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2829         i = 0;
2830     }
2831     if (i > 60*24*365) {
2832         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2833         i = 60*24*365;
2834     }
2835
2836     max = (time_t) (i * 60);    /* convert minutes to seconds */
2837
2838     /* Options */
2839     while ((token = ConfigParser::NextToken()) != NULL) {
2840         if (!strcmp(token, "refresh-ims")) {
2841             refresh_ims = 1;
2842         } else if (!strcmp(token, "store-stale")) {
2843             store_stale = 1;
2844         } else if (!strncmp(token, "max-stale=", 10)) {
2845             max_stale = xatoi(token + 10);
2846
2847 #if USE_HTTP_VIOLATIONS
2848
2849         } else if (!strcmp(token, "override-expire"))
2850             override_expire = 1;
2851         else if (!strcmp(token, "override-lastmod"))
2852             override_lastmod = 1;
2853         else if (!strcmp(token, "ignore-no-store"))
2854             ignore_no_store = 1;
2855         else if (!strcmp(token, "ignore-private"))
2856             ignore_private = 1;
2857         else if (!strcmp(token, "reload-into-ims")) {
2858             reload_into_ims = 1;
2859             refresh_nocache_hack = 1;
2860             /* tell client_side.c that this is used */
2861         } else if (!strcmp(token, "ignore-reload")) {
2862             ignore_reload = 1;
2863             refresh_nocache_hack = 1;
2864             /* tell client_side.c that this is used */
2865 #endif
2866
2867         } else if (!strcmp(token, "ignore-no-cache") ||
2868                    !strcmp(token, "ignore-must-revalidate") ||
2869                    !strcmp(token, "ignore-auth")
2870                   ) {
2871             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2872         } else
2873             debugs(22, DBG_CRITICAL, "ERROR: refreshAddToList: Unknown option '" << pattern << "': " << token);
2874     }
2875
2876     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2877         char errbuf[256];
2878         regerror(errcode, &comp, errbuf, sizeof errbuf);
2879         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2880         debugs(22, DBG_CRITICAL, "ERROR: refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2881         xfree(pattern);
2882         return;
2883     }
2884
2885     pct = pct < 0.0 ? 0.0 : pct;
2886     max = max < 0 ? 0 : max;
2887     t = new RefreshPattern(pattern, flags);
2888     t->pattern.regex = comp;
2889     t->min = min;
2890     t->pct = pct;
2891     t->max = max;
2892
2893     if (refresh_ims)
2894         t->flags.refresh_ims = true;
2895
2896     if (store_stale)
2897         t->flags.store_stale = true;
2898
2899     t->max_stale = max_stale;
2900
2901 #if USE_HTTP_VIOLATIONS
2902
2903     if (override_expire)
2904         t->flags.override_expire = true;
2905
2906     if (override_lastmod)
2907         t->flags.override_lastmod = true;
2908
2909     if (reload_into_ims)
2910         t->flags.reload_into_ims = true;
2911
2912     if (ignore_reload)
2913         t->flags.ignore_reload = true;
2914
2915     if (ignore_no_store)
2916         t->flags.ignore_no_store = true;
2917
2918     if (ignore_private)
2919         t->flags.ignore_private = true;
2920 #endif
2921
2922     t->next = NULL;
2923
2924     while (*head)
2925         head = &(*head)->next;
2926
2927     *head = t;
2928
2929     xfree(pattern);
2930 }
2931
2932 static void
2933 free_refreshpattern(RefreshPattern ** head)
2934 {
2935     delete *head;
2936     *head = nullptr;
2937
2938 #if USE_HTTP_VIOLATIONS
2939     refresh_nocache_hack = 0;
2940
2941 #endif
2942 }
2943
2944 static void
2945 dump_string(StoreEntry * entry, const char *name, char *var)
2946 {
2947     if (var != NULL)
2948         storeAppendPrintf(entry, "%s %s\n", name, var);
2949 }
2950
2951 static void
2952 parse_string(char **var)
2953 {
2954     safe_free(*var);
2955
2956     char *token = ConfigParser::NextToken();
2957     if (!token) {
2958         self_destruct();
2959         return;
2960     }
2961
2962     *var = xstrdup(token);
2963 }
2964
2965 static void
2966 free_string(char **var)
2967 {
2968     safe_free(*var);
2969 }
2970
2971 void
2972 parse_eol(char *volatile *var)
2973 {
2974     if (!var) {
2975         self_destruct();
2976         return;
2977     }
2978
2979     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2980     safe_free(*var);
2981
2982     if (!token) {
2983         self_destruct();
2984         return;
2985     }
2986
2987     while (*token && xisspace(*token))
2988         ++token;
2989
2990     if (!*token) {
2991         self_destruct();
2992         return;
2993     }
2994
2995     *var = xstrdup((char *) token);
2996 }
2997
2998 #define dump_eol dump_string
2999 #define free_eol free_string
3000
3001 static void
3002 parse_TokenOrQuotedString(char **var)
3003 {
3004     safe_free(*var);
3005
3006     char *token = ConfigParser::NextQuotedToken();
3007     if (!token) {
3008         self_destruct();
3009         return;
3010     }
3011
3012     *var = xstrdup(token);
3013 }
3014
3015 #define dump_TokenOrQuotedString dump_string
3016 #define free_TokenOrQuotedString free_string
3017
3018 static void
3019 dump_time_t(StoreEntry * entry, const char *name, time_t var)
3020 {
3021     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
3022 }
3023
3024 void
3025 parse_time_t(time_t * var)
3026 {
3027     const auto maxTime = std::numeric_limits<time_t>::max();
3028     const auto seconds = parseTimeLine<std::chrono::seconds>();
3029     if (maxTime < seconds.count())
3030         throw TexcHere(ToSBuf("directive supports time values up to ", maxTime, " but is given ", seconds.count(), " seconds"));
3031     *var = static_cast<time_t>(seconds.count());
3032 }
3033
3034 static void
3035 free_time_t(time_t * var)
3036 {
3037     *var = 0;
3038 }
3039
3040 static void
3041 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
3042 {
3043     if (var % 1000)
3044         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
3045     else
3046         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
3047 }
3048
3049 static void
3050 parse_time_msec(time_msec_t *var)
3051 {
3052     *var = parseTimeLine<std::chrono::milliseconds>().count();
3053 }
3054
3055 static void
3056 free_time_msec(time_msec_t * var)
3057 {
3058     *var = 0;
3059 }
3060
3061 static void
3062 dump_time_nanoseconds(StoreEntry *entry, const char *name, const std::chrono::nanoseconds &var)
3063 {
3064     // std::chrono::nanoseconds::rep is unknown a priori so we cast to (and print) the largest supported integer
3065     storeAppendPrintf(entry, "%s %jd nanoseconds\n", name, static_cast<intmax_t>(var.count()));
3066 }
3067
3068 static void
3069 parse_time_nanoseconds(std::chrono::nanoseconds *var)
3070 {
3071     *var = parseTimeLine<std::chrono::nanoseconds>();
3072 }
3073
3074 static void
3075 free_time_nanoseconds(std::chrono::nanoseconds *var)
3076 {
3077     *var = std::chrono::nanoseconds::zero();
3078 }
3079
3080 static void
3081 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3082 {
3083     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3084 }
3085
3086 static void
3087 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3088 {
3089     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3090 }
3091
3092 static void
3093 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3094 {
3095     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3096 }
3097
3098 static void
3099 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3100 {
3101     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3102 }
3103
3104 static void
3105 parse_b_size_t(size_t * var)
3106 {
3107     parseBytesLine(var, B_BYTES_STR);
3108 }
3109
3110 static void
3111 parse_b_ssize_t(ssize_t * var)
3112 {
3113     parseBytesLineSigned(var, B_BYTES_STR);
3114 }
3115
3116 static void
3117 parse_b_int64_t(int64_t * var)
3118 {
3119     parseBytesLine64(var, B_BYTES_STR);
3120 }
3121
3122 static void
3123 parse_kb_int64_t(int64_t * var)
3124 {
3125     parseBytesLine64(var, B_KBYTES_STR);
3126 }
3127
3128 static void
3129 free_size_t(size_t * var)
3130 {
3131     *var = 0;
3132 }
3133
3134 static void
3135 free_ssize_t(ssize_t * var)
3136 {
3137     *var = 0;
3138 }
3139
3140 static void
3141 free_b_int64_t(int64_t * var)
3142 {
3143     *var = 0;
3144 }
3145
3146 #define free_b_size_t free_size_t
3147 #define free_b_ssize_t free_ssize_t
3148 #define free_kb_size_t free_size_t
3149 #define free_mb_size_t free_size_t
3150 #define free_gb_size_t free_size_t
3151 #define free_kb_int64_t free_b_int64_t
3152
3153 static void
3154 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3155 {
3156     storeAppendPrintf(entry, "%s %d\n", name, var);
3157 }
3158
3159 static void
3160 free_u_short(unsigned short * u)
3161 {
3162     *u = 0;
3163 }
3164
3165 static void
3166 parse_u_short(unsigned short * var)
3167 {
3168     ConfigParser::ParseUShort(var);
3169 }
3170
3171 void
3172 ConfigParser::ParseUShort(unsigned short *var)
3173 {
3174     *var = GetShort();
3175 }
3176
3177 void
3178 ConfigParser::ParseBool(bool *var)
3179 {
3180     int i = GetInteger();
3181
3182     if (0 == i)
3183         *var = false;
3184     else if (1 == i)
3185         *var = true;
3186     else
3187         self_destruct();
3188 }
3189
3190 static void
3191 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3192 {
3193     while (list != NULL) {
3194         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3195         list = list->next;
3196     }
3197 }
3198
3199 void
3200 ConfigParser::ParseWordList(wordlist ** list)
3201 {
3202     parse_wordlist(list);
3203 }
3204
3205 void
3206 parse_wordlist(wordlist ** list)
3207 {
3208     char *token;
3209     while ((token = ConfigParser::NextQuotedToken()))
3210         wordlistAdd(list, token);
3211 }
3212
3213 static int
3214 check_null_acl_access(acl_access * a)
3215 {
3216     return a == NULL;
3217 }
3218
3219 #define free_wordlist wordlistDestroy
3220
3221 #define free_uri_whitespace free_int
3222
3223 static void
3224 parse_uri_whitespace(int *var)
3225 {
3226     char *token = ConfigParser::NextToken();
3227     if (!token) {
3228         self_destruct();
3229         return;
3230     }
3231
3232     if (!strcmp(token, "strip"))
3233         *var = URI_WHITESPACE_STRIP;
3234     else if (!strcmp(token, "deny"))
3235         *var = URI_WHITESPACE_DENY;
3236     else if (!strcmp(token, "allow"))
3237         *var = URI_WHITESPACE_ALLOW;
3238     else if (!strcmp(token, "encode"))
3239         *var = URI_WHITESPACE_ENCODE;
3240     else if (!strcmp(token, "chop"))
3241         *var = URI_WHITESPACE_CHOP;
3242     else {
3243         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3244         self_destruct();
3245     }
3246 }
3247
3248 static void
3249 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3250 {
3251     const char *s;
3252
3253     if (var == URI_WHITESPACE_ALLOW)
3254         s = "allow";
3255     else if (var == URI_WHITESPACE_ENCODE)
3256         s = "encode";
3257     else if (var == URI_WHITESPACE_CHOP)
3258         s = "chop";
3259     else if (var == URI_WHITESPACE_DENY)
3260         s = "deny";
3261     else
3262         s = "strip";
3263
3264     storeAppendPrintf(entry, "%s %s\n", name, s);
3265 }
3266
3267 static void
3268 free_removalpolicy(RemovalPolicySettings ** settings)
3269 {
3270     if (!*settings)
3271         return;
3272
3273     free_string(&(*settings)->type);
3274
3275     free_wordlist(&(*settings)->args);
3276
3277     delete *settings;
3278
3279     *settings = NULL;
3280 }
3281
3282 static void
3283 parse_removalpolicy(RemovalPolicySettings ** settings)
3284 {
3285     if (*settings)
3286         free_removalpolicy(settings);
3287
3288     *settings = new RemovalPolicySettings;
3289
3290     parse_string(&(*settings)->type);
3291
3292     parse_wordlist(&(*settings)->args);
3293 }
3294
3295 static void
3296 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3297 {
3298     wordlist *args;
3299     storeAppendPrintf(entry, "%s %s", name, settings->type);
3300     args = settings->args;
3301
3302     while (args) {
3303         storeAppendPrintf(entry, " %s", args->key);
3304         args = args->next;
3305     }
3306
3307     storeAppendPrintf(entry, "\n");
3308 }
3309
3310 inline void
3311 free_YesNoNone(YesNoNone *)
3312 {}
3313
3314 static void
3315 parse_YesNoNone(YesNoNone *option)
3316 {
3317     int value = 0;
3318     parse_onoff(&value);
3319     option->configure(value > 0);
3320 }
3321
3322 static void
3323 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3324 {
3325     if (option.configured())
3326         dump_onoff(entry, name, option ? 1 : 0);
3327 }
3328
3329 static void
3330 free_memcachemode(SquidConfig *)
3331 {}
3332
3333 static void
3334 parse_memcachemode(SquidConfig *)
3335 {
3336     char *token = ConfigParser::NextToken();
3337     if (!token) {
3338         self_destruct();
3339         return;
3340     }
3341
3342     if (strcmp(token, "always") == 0) {
3343         Config.onoff.memory_cache_first = 1;
3344         Config.onoff.memory_cache_disk = 1;
3345     } else if (strcmp(token, "disk") == 0) {
3346         Config.onoff.memory_cache_first = 0;
3347         Config.onoff.memory_cache_disk = 1;
3348     } else if (strncmp(token, "net", 3) == 0) {
3349         Config.onoff.memory_cache_first = 1;
3350         Config.onoff.memory_cache_disk = 0;
3351     } else if (strcmp(token, "never") == 0) {
3352         Config.onoff.memory_cache_first = 0;
3353         Config.onoff.memory_cache_disk = 0;
3354     } else {
3355         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3356         self_destruct();
3357     }
3358 }
3359
3360 static void
3361 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3362 {
3363     storeAppendPrintf(entry, "%s ", name);
3364     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3365         storeAppendPrintf(entry, "always");
3366     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3367         storeAppendPrintf(entry, "disk");
3368     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3369         storeAppendPrintf(entry, "network");
3370     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3371         storeAppendPrintf(entry, "none");
3372     storeAppendPrintf(entry, "\n");
3373 }
3374
3375 #include "cf_parser.cci"
3376
3377 peer_t
3378 parseNeighborType(const char *s)
3379 {
3380     if (!strcmp(s, "parent"))
3381         return PEER_PARENT;
3382
3383     if (!strcmp(s, "neighbor"))
3384         return PEER_SIBLING;
3385
3386     if (!strcmp(s, "neighbour"))
3387         return PEER_SIBLING;
3388
3389     if (!strcmp(s, "sibling"))
3390         return PEER_SIBLING;
3391
3392     if (!strcmp(s, "multicast"))
3393         return PEER_MULTICAST;
3394
3395     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3396
3397     return PEER_SIBLING;
3398 }
3399
3400 #if USE_WCCPv2
3401 static void
3402 parse_IpAddress_list(Ip::Address_list ** head)
3403 {
3404     char *token;
3405     Ip::Address_list *s;
3406     Ip::Address ipa;
3407
3408     while ((token = ConfigParser::NextToken())) {
3409         if (GetHostWithPort(token, &ipa)) {
3410
3411             while (*head)
3412                 head = &(*head)->next;
3413
3414             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3415             s->s = ipa;
3416
3417             *head = s;
3418         } else {
3419             self_destruct();
3420             return;
3421         }
3422     }
3423 }
3424
3425 static void
3426 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3427 {
3428     char ntoabuf[MAX_IPSTRLEN];
3429
3430     while (s) {
3431         storeAppendPrintf(e, "%s %s\n",
3432                           n,
3433                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3434         s = s->next;
3435     }
3436 }
3437
3438 static void
3439 free_IpAddress_list(Ip::Address_list ** head)
3440 {
3441     if (*head) delete *head;
3442     *head = NULL;
3443 }
3444
3445 #if CURRENTLY_UNUSED
3446 /* This code was previously used by http_port. Left as it really should
3447  * be used by icp_port and htcp_port
3448  */
3449 static int
3450 check_null_IpAddress_list(const Ip::Address_list * s)
3451 {
3452     return NULL == s;
3453 }
3454
3455 #endif /* CURRENTLY_UNUSED */
3456 #endif /* USE_WCCPv2 */
3457
3458 static void
3459 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3460 {
3461     char *host = NULL;
3462     unsigned short port = 0;
3463     char *t = NULL;
3464     char *junk = NULL;
3465
3466     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3467     s->name = xstrdup(token);
3468     s->connection_auth_disabled = false;
3469
3470     const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3471
3472     if (*token == '[') {
3473         /* [ipv6]:port */
3474         host = token + 1;
3475         t = strchr(host, ']');
3476         if (!t) {
3477             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3478             self_destruct();
3479             return;
3480         }
3481         *t = '\0';
3482         ++t;
3483         if (*t != ':') {
3484             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3485             self_destruct();
3486             return;
3487         }
3488         if (!Ip::EnableIpv6) {
3489             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3490             self_destruct();
3491             return;
3492         }
3493         port = xatos(t + 1);
3494     } else if ((t = strchr(token, ':'))) {
3495         /* host:port */
3496         /* ipv4:port */
3497         host = token;
3498         *t = '\0';
3499         port = xatos(t + 1);
3500
3501     } else if (strtol(token, &junk, 10) && !*junk) {
3502         port = xatos(token);
3503         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3504     } else {
3505         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3506         self_destruct();
3507         return;
3508     }
3509
3510     if (port == 0 && host != NULL) {
3511         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3512         self_destruct();
3513         return;
3514     }
3515
3516     if (NULL == host) {
3517         s->s.setAnyAddr();
3518         s->s.port(port);
3519         if (!Ip::EnableIpv6)
3520             s->s.setIPv4();
3521         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3522     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3523         s->s.port(port);
3524         if (!Ip::EnableIpv6)
3525             s->s.setIPv4();
3526         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3527     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3528         /* do not use ipcache */
3529         s->defaultsite = xstrdup(host);
3530         s->s.port(port);
3531         if (!Ip::EnableIpv6)
3532             s->s.setIPv4();
3533         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3534     } else {
3535         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3536         self_destruct();
3537     }
3538 }
3539
3540 /// parses the protocol= option of the *_port directive, returning parsed value
3541 /// unsupported option values result in a fatal error message
3542 /// upper case values required; caller may convert for backward compatibility
3543 static AnyP::ProtocolVersion
3544 parsePortProtocol(const SBuf &value)
3545 {
3546     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3547     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3548     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3549         return Http::ProtocolVersion(1,1);
3550
3551     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3552         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3553
3554     if (value.cmp("FTP") == 0)
3555         return Ftp::ProtocolVersion();
3556
3557     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3558     return AnyP::ProtocolVersion(); // not reached
3559 }
3560
3561 static void
3562 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3563 {
3564     /* modes first */
3565
3566     if (strcmp(token, "accel") == 0) {
3567         if (s->flags.isIntercepted()) {
3568             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3569             self_destruct();
3570             return;
3571         }
3572         s->flags.accelSurrogate = true;
3573         s->vhost = true;
3574     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3575         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3576             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3577             self_destruct();
3578             return;
3579         }
3580         s->flags.natIntercept = true;
3581         Ip::Interceptor.StartInterception();
3582         /* Log information regarding the port modes under interception. */
3583         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3584         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3585     } else if (strcmp(token, "tproxy") == 0) {
3586         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3587             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3588             self_destruct();
3589             return;
3590         }
3591         s->flags.tproxyIntercept = true;
3592         Ip::Interceptor.StartTransparency();
3593         /* Log information regarding the port modes under transparency. */
3594         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3595
3596         if (s->flags.proxySurrogate) {
3597             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3598         }
3599
3600         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3601             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3602             self_destruct();
3603             return;
3604         }
3605
3606     } else if (strcmp(token, "require-proxy-header") == 0) {
3607         s->flags.proxySurrogate = true;
3608         if (s->flags.tproxyIntercept) {
3609             // receiving is still permitted, so we do not unset the TPROXY flag
3610             // spoofing access control override takes care of the spoof disable later
3611             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3612         }
3613
3614     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3615         if (!s->flags.accelSurrogate) {
3616             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3617             self_destruct();
3618             return;
3619         }
3620         safe_free(s->defaultsite);
3621         s->defaultsite = xstrdup(token + 12);
3622     } else if (strcmp(token, "vhost") == 0) {
3623         if (!s->flags.accelSurrogate) {
3624             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3625         }
3626         s->flags.accelSurrogate = true;
3627         s->vhost = true;
3628     } else if (strcmp(token, "no-vhost") == 0) {
3629         if (!s->flags.accelSurrogate) {
3630             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3631         }
3632         s->vhost = false;
3633     } else if (strcmp(token, "vport") == 0) {
3634         if (!s->flags.accelSurrogate) {
3635             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3636             self_destruct();
3637             return;
3638         }
3639         s->vport = -1;
3640     } else if (strncmp(token, "vport=", 6) == 0) {
3641         if (!s->flags.accelSurrogate) {
3642             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3643             self_destruct();
3644             return;
3645         }
3646         s->vport = xatos(token + 6);
3647     } else if (strncmp(token, "protocol=", 9) == 0) {
3648         if (!s->flags.accelSurrogate) {
3649             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3650             self_destruct();
3651             return;
3652         }
3653         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3654     } else if (strcmp(token, "allow-direct") == 0) {
3655         if (!s->flags.accelSurrogate) {
3656             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3657             self_destruct();
3658             return;
3659         }
3660         s->allow_direct = true;
3661     } else if (strcmp(token, "act-as-origin") == 0) {
3662         if (!s->flags.accelSurrogate) {
3663             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3664         } else
3665             s->actAsOrigin = true;
3666     } else if (strcmp(token, "ignore-cc") == 0) {
3667 #if !USE_HTTP_VIOLATIONS
3668         if (!s->flags.accelSurrogate) {
3669             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3670             self_destruct();
3671             return;
3672         }
3673 #endif
3674         s->ignore_cc = true;
3675     } else if (strncmp(token, "name=", 5) == 0) {
3676         safe_free(s->name);
3677         s->name = xstrdup(token + 5);
3678     } else if (strcmp(token, "no-connection-auth") == 0) {
3679         s->connection_auth_disabled = true;
3680     } else if (strcmp(token, "connection-auth=off") == 0) {
3681         s->connection_auth_disabled = true;
3682     } else if (strcmp(token, "connection-auth") == 0) {
3683         s->connection_auth_disabled = false;
3684     } else if (strcmp(token, "connection-auth=on") == 0) {
3685         s->connection_auth_disabled = false;
3686     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3687         if (!strcmp(token + 23, "off"))
3688             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3689         else if (!strcmp(token + 23, "transparent"))
3690             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3691         else if (!strcmp(token + 23, "always"))
3692             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3693         else {
3694             self_destruct();
3695             return;
3696         }
3697     } else if (strcmp(token, "ipv4") == 0) {
3698         if ( !s->s.setIPv4() ) {
3699             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3700             self_destruct();
3701             return;
3702         }
3703     } else if (strcmp(token, "tcpkeepalive") == 0) {
3704         s->tcp_keepalive.enabled = true;
3705     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3706         char *t = token + 13;
3707         s->tcp_keepalive.enabled = true;
3708         s->tcp_keepalive.idle = xatoui(t,',');
3709         t = strchr(t, ',');
3710         if (t) {
3711             ++t;
3712             s->tcp_keepalive.interval = xatoui(t,',');
3713             t = strchr(t, ',');
3714         }
3715         if (t) {
3716             ++t;
3717             s->tcp_keepalive.timeout = xatoui(t);
3718         }
3719 #if USE_OPENSSL
3720     } else if (strcmp(token, "sslBump") == 0) {
3721         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3722                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3723         s->flags.tunnelSslBumping = true;
3724     } else if (strcmp(token, "ssl-bump") == 0) {
3725         s->flags.tunnelSslBumping = true;
3726     } else if (strncmp(token, "cert=", 5) == 0) {
3727         s->secure.parse(token);
3728     } else if (strncmp(token, "key=", 4) == 0) {
3729         s->secure.parse(token);
3730     } else if (strncmp(token, "version=", 8) == 0) {
3731         debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3732                "in " << cfg_directive << ". Use 'options=' instead.");
3733         s->secure.parse(token);
3734     } else if (strncmp(token, "options=", 8) == 0) {
3735         s->secure.parse(token);
3736     } else if (strncmp(token, "cipher=", 7) == 0) {
3737         s->secure.parse(token);
3738     } else if (strncmp(token, "clientca=", 9) == 0) {
3739         s->secure.parse(token);
3740     } else if (strncmp(token, "cafile=", 7) == 0) {
3741         debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3742                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3743         s->secure.parse(token);
3744     } else if (strncmp(token, "capath=", 7) == 0) {
3745         s->secure.parse(token);
3746     } else if (strncmp(token, "crlfile=", 8) == 0) {
3747         s->secure.parse(token);
3748     } else if (strncmp(token, "dhparams=", 9) == 0) {
3749         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3750                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3751         s->secure.parse(token);
3752     } else if (strncmp(token, "sslflags=", 9) == 0) {
3753         // NP: deprecation warnings output by secure.parse() when relevant
3754         s->secure.parse(token+3);
3755     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3756         // NP: deprecation warnings output by secure.parse() when relevant
3757         s->secure.parse(token+3);
3758     } else if (strncmp(token, "generate-host-certificates", 26) == 0) {
3759         s->secure.parse(token);
3760 #endif
3761     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3762         s->secure.parse(token);
3763     } else if (strncmp(token, "tls-", 4) == 0) {
3764         s->secure.parse(token+4);
3765     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3766         s->ftp_track_dirs = true;
3767     } else if (strcmp(token, "worker-queues") == 0) {
3768 #if !defined(SO_REUSEADDR)
3769 #error missing system #include that #defines SO_* constants
3770 #endif
3771 #if !defined(SO_REUSEPORT)
3772         throw TexcHere(ToSBuf(cfg_directive, ' ', token, " option requires building Squid where SO_REUSEPORT is supported by the TCP stack"));
3773 #endif
3774         s->workerQueues = true;
3775     } else {
3776         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3777         self_destruct();
3778     }
3779 }
3780
3781 void
3782 add_http_port(char *portspec)
3783 {
3784     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3785     s->transport = parsePortProtocol(SBuf("HTTP"));
3786     parsePortSpecification(s, portspec);
3787     // we may need to merge better if the above returns a list with clones
3788     assert(s->next == NULL);
3789     s->next = HttpPortList;
3790     HttpPortList = s;
3791 }
3792
3793 static void
3794 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3795 {
3796     SBuf protoName;
3797     if (strcmp(optionName, "http_port") == 0 ||
3798             strcmp(optionName, "ascii_port") == 0)
3799         protoName = "HTTP";
3800     else if (strcmp(optionName, "https_port") == 0)
3801         protoName = "HTTPS";
3802     else if (strcmp(optionName, "ftp_port") == 0)
3803         protoName = "FTP";
3804     if (protoName.isEmpty()) {
3805         self_destruct();
3806         return;
3807     }
3808
3809     char *token = ConfigParser::NextToken();
3810
3811     if (!token) {
3812         self_destruct();
3813         return;
3814     }
3815
3816     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3817     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3818     parsePortSpecification(s, token);
3819
3820     /* parse options ... */
3821     while ((token = ConfigParser::NextToken())) {
3822         parse_port_option(s, token);
3823     }
3824
3825     s->secure.syncCaFiles();
3826
3827     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3828         s->secure.encryptTransport = true;
3829 #if USE_OPENSSL
3830         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3831         const bool hijacked = s->flags.isIntercepted();
3832         if (s->flags.tunnelSslBumping && !hijacked) {
3833             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3834             self_destruct();
3835             return;
3836         }
3837         if (hijacked && !s->flags.tunnelSslBumping) {
3838             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3839             self_destruct();
3840             return;
3841         }
3842 #endif
3843         if (s->flags.proxySurrogate) {
3844             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3845             self_destruct();
3846             return;
3847         }
3848     } else if (protoName.cmp("FTP") == 0) {
3849         /* ftp_port does not support ssl-bump */
3850         if (s->flags.tunnelSslBumping) {
3851             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3852             self_destruct();
3853             return;
3854         }
3855         if (s->flags.proxySurrogate) {
3856             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3857             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3858             self_destruct();
3859             return;
3860         }
3861     }
3862
3863     if (s->secure.encryptTransport) {
3864         if (s->secure.certs.empty()) {
3865             debugs(3, DBG_CRITICAL, "FATAL: " << AnyP::UriScheme(s->transport.protocol) << "_port requires a cert= parameter");
3866             self_destruct();
3867             return;
3868         }
3869         s->secure.parseOptions();
3870     }
3871
3872     // *_port line should now be fully valid so we can clone it if necessary
3873     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3874         // clone the port options from *s to *(s->next)
3875         s->next = s->clone();
3876         s->next->s.setIPv4();
3877         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).image() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3878     }
3879
3880     while (*head != NULL)
3881         head = &((*head)->next);
3882
3883     *head = s;
3884 }
3885
3886 static void
3887 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3888 {
3889     char buf[MAX_IPSTRLEN];
3890
3891     storeAppendPrintf(e, "%s %s",
3892                       n,
3893                       s->s.toUrl(buf,MAX_IPSTRLEN));
3894
3895     // MODES and specific sub-options.
3896     if (s->flags.natIntercept)
3897         storeAppendPrintf(e, " intercept");
3898
3899     else if (s->flags.tproxyIntercept)
3900         storeAppendPrintf(e, " tproxy");
3901
3902     else if (s->flags.proxySurrogate)
3903         storeAppendPrintf(e, " require-proxy-header");
3904
3905     else if (s->flags.accelSurrogate) {
3906         storeAppendPrintf(e, " accel");
3907
3908         if (s->vhost)
3909             storeAppendPrintf(e, " vhost");
3910
3911         if (s->vport < 0)
3912             storeAppendPrintf(e, " vport");
3913         else if (s->vport > 0)
3914             storeAppendPrintf(e, " vport=%d", s->vport);
3915
3916         if (s->defaultsite)
3917             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3918
3919         // TODO: compare against prefix of 'n' instead of assuming http_port
3920         if (s->transport.protocol != AnyP::PROTO_HTTP)
3921             storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3922
3923         if (s->allow_direct)
3924             storeAppendPrintf(e, " allow-direct");
3925
3926         if (s->ignore_cc)
3927             storeAppendPrintf(e, " ignore-cc");
3928
3929     }
3930
3931     // Generic independent options
3932
3933     if (s->name)
3934         storeAppendPrintf(e, " name=%s", s->name);
3935
3936 #if USE_HTTP_VIOLATIONS
3937     if (!s->flags.accelSurrogate && s->ignore_cc)
3938         storeAppendPrintf(e, " ignore-cc");
3939 #endif
3940
3941     if (s->connection_auth_disabled)
3942         storeAppendPrintf(e, " connection-auth=off");
3943     else
3944         storeAppendPrintf(e, " connection-auth=on");
3945
3946     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3947         const char *pmtu;
3948
3949         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3950             pmtu = "always";
3951         else
3952             pmtu = "transparent";
3953
3954         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3955     }
3956
3957     if (s->s.isAnyAddr() && !s->s.isIPv6())
3958         storeAppendPrintf(e, " ipv4");
3959
3960     if (s->tcp_keepalive.enabled) {
3961         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3962             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3963         } else {
3964             storeAppendPrintf(e, " tcpkeepalive");
3965         }
3966     }
3967
3968 #if USE_OPENSSL
3969     if (s->flags.tunnelSslBumping)
3970         storeAppendPrintf(e, " ssl-bump");
3971 #endif
3972
3973     s->secure.dumpCfg(e, "tls-");
3974 }
3975
3976 static void
3977 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3978 {
3979     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3980         dump_generic_port(e, n, p);
3981         storeAppendPrintf(e, "\n");
3982     }
3983 }
3984
3985 void
3986 configFreeMemory(void)
3987 {
3988     free_all();
3989     Dns::ResolveClientAddressesAsap = false;
3990     Config.ssl_client.sslContext.reset();
3991 #if USE_OPENSSL
3992     Ssl::unloadSquidUntrusted();
3993 #endif
3994 }
3995
3996 void
3997 requirePathnameExists(const char *name, const char *path)
3998 {
3999
4000     struct stat sb;
4001     char pathbuf[BUFSIZ];
4002     assert(path != NULL);
4003
4004     if (Config.chroot_dir && (geteuid() == 0)) {
4005         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
4006         path = pathbuf;
4007     }
4008
4009     if (stat(path, &sb) < 0) {
4010         int xerrno = errno;
4011         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
4012         // keep going to find more issues if we are only checking the config file with "-k parse"
4013         if (opt_parse_cfg_only)
4014             return;
4015         // this is fatal if it is found during startup or reconfigure
4016         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
4017             fatalf("%s %s: %s", name, path, xstrerr(xerrno));
4018     }
4019 }
4020
4021 #include "AccessLogEntry.h"
4022
4023 /**
4024  * We support several access_log configuration styles:
4025  *
4026  * #1: Deprecated ancient style without an explicit logging module:
4027  * access_log /var/log/access.log
4028  *
4029  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
4030  * access_log none [acl ...]
4031  *
4032  * #3: Configurable logging module without named options:
4033  * Logformat or the first ACL name, whichever comes first, may not contain '='.
4034  * If no explicit logformat name is given, the first ACL name, if any,
4035  * should not be an existing logformat name or it will be treated as such.
4036  * access_log module:place [logformat_name] [acl ...]
4037  *
4038  * #4: Configurable logging module with name=value options such as logformat=x:
4039  * The first ACL name may not contain '='.
4040  * Without any optional parts, directives using this style are indistinguishable
4041  * from directives using style #1 until we start requiring the "module:" prefix.
4042  * access_log module:place [option ...] [acl ...]
4043  *
4044  */
4045 static void
4046 parse_access_log(CustomLog ** logs)
4047 {
4048     const char *filename = ConfigParser::NextToken();
4049     if (!filename) {
4050         self_destruct();
4051         return;
4052     }
4053
4054     const auto cl = new CustomLog();
4055
4056     cl->filename = xstrdup(filename);
4057
4058     if (strcmp(filename, "none") == 0) {
4059         cl->type = Log::Format::CLF_NONE;
4060         aclParseAclList(LegacyParser, &cl->aclList, filename);
4061         while (*logs)
4062             logs = &(*logs)->next;
4063         *logs = cl;
4064         return;
4065     }
4066
4067     const char *token = ConfigParser::PeekAtToken();
4068     if (token && !strchr(token, '=')) { // style #3
4069         // TODO: Deprecate this style to avoid this dangerous guessing.
4070         if (Log::TheConfig.knownFormat(token)) {
4071             cl->setLogformat(token);
4072             (void)ConfigParser::NextToken(); // consume the token used above
4073         } else {
4074             // assume there is no explicit logformat name and use the default
4075             cl->setLogformat("squid");
4076         }
4077     } else { // style #1 or style #4
4078         // TODO: Drop deprecated style #1 support. We already warn about it, and
4079         // its exceptional treatment makes detecting "module" typos impractical!
4080         cl->parseOptions(LegacyParser, "squid");
4081     }
4082     assert(cl->type); // setLogformat() was called
4083
4084     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4085
4086     while (*logs)
4087         logs = &(*logs)->next;
4088
4089     *logs = cl;
4090 }
4091
4092 static int
4093 check_null_access_log(CustomLog *customlog_definitions)
4094 {
4095     return customlog_definitions == NULL;
4096 }
4097
4098 static void
4099 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4100 {
4101     assert(entry);
4102     for (auto log = logs; log; log = log->next) {
4103         {
4104             PackableStream os(*entry);
4105             os << name; // directive name
4106             os << ' ' << log->filename; // including "none"
4107             log->dumpOptions(os);
4108         }
4109
4110         if (log->aclList)
4111             dump_acl_list(entry, log->aclList);
4112
4113         storeAppendPrintf(entry, "\n");
4114     }
4115 }
4116
4117 static void
4118 free_access_log(CustomLog ** definitions)
4119 {
4120     while (*definitions) {
4121         CustomLog *log = *definitions;
4122         *definitions = log->next;
4123         delete log;
4124     }
4125 }
4126
4127 #if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4128 /// parses list of integers form name=N1,N2,N3,...
4129 static bool
4130 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4131 {
4132     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4133         data += name.size();
4134         if (*data == '=') {
4135             while (true) {
4136                 ++data;
4137                 int value = 0;
4138                 if (!StringToInt(data, value, &data, 10))
4139                     break;
4140                 list.push_back(value);
4141                 if (*data == '\0' || *data != ',')
4142                     break;
4143             }
4144         }
4145     }
4146     return data && *data == '\0';
4147 }
4148 #endif
4149
4150 static void
4151 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4152 {
4153 #if !HAVE_CPU_AFFINITY
4154     (void)cpuAffinityMap;
4155     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4156            "support, do not set 'cpu_affinity_map'");
4157     self_destruct();
4158
4159 #else /* HAVE_CPU_AFFINITY */
4160     if (!*cpuAffinityMap)
4161         *cpuAffinityMap = new CpuAffinityMap;
4162
4163     const char *const pToken = ConfigParser::NextToken();
4164     const char *const cToken = ConfigParser::NextToken();
4165     std::vector<int> processes, cores;
4166     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4167         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4168                "in 'cpu_affinity_map'");
4169         self_destruct();
4170     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4171         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4172                "'cpu_affinity_map'");
4173         self_destruct();
4174     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4175         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4176                "process_numbers and cores lists differ in length or " <<
4177                "contain numbers <= 0");
4178         self_destruct();
4179     }
4180 #endif
4181 }
4182
4183 static void
4184 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4185 {
4186     if (cpuAffinityMap) {
4187         storeAppendPrintf(entry, "%s process_numbers=", name);
4188         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4189             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4190                               cpuAffinityMap->processes()[i]);
4191         }
4192         storeAppendPrintf(entry, " cores=");
4193         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4194             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4195                               cpuAffinityMap->cores()[i]);
4196         }
4197         storeAppendPrintf(entry, "\n");
4198     }
4199 }
4200
4201 static void
4202 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4203 {
4204     delete *cpuAffinityMap;
4205     *cpuAffinityMap = NULL;
4206 }
4207
4208 #if USE_ADAPTATION
4209
4210 static void
4211 parse_adaptation_service_set_type()
4212 {
4213     Adaptation::Config::ParseServiceSet();
4214 }
4215
4216 static void
4217 parse_adaptation_service_chain_type()
4218 {
4219     Adaptation::Config::ParseServiceChain();
4220 }
4221
4222 static void
4223 parse_adaptation_access_type()
4224 {
4225     Adaptation::Config::ParseAccess(LegacyParser);
4226 }
4227 #endif /* USE_ADAPTATION */
4228
4229 #if ICAP_CLIENT
4230
4231 static void
4232 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4233 {
4234     cfg->parseService();
4235 }
4236
4237 static void
4238 free_icap_service_type(Adaptation::Icap::Config * cfg)
4239 {
4240     cfg->freeService();
4241 }
4242
4243 static void
4244 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4245 {
4246     cfg.dumpService(entry, name);
4247 }
4248
4249 static void
4250 parse_icap_class_type()
4251 {
4252     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is deprecated. " <<
4253            "Use 'adaptation_service_set' instead");
4254     Adaptation::Config::ParseServiceSet();
4255 }
4256
4257 static void
4258 parse_icap_access_type()
4259 {
4260     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is deprecated. " <<
4261            "Use 'adaptation_access' instead");
4262     Adaptation::Config::ParseAccess(LegacyParser);
4263 }
4264
4265 #endif
4266
4267 #if USE_ECAP
4268
4269 static void
4270 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4271 {
4272     cfg->parseService();
4273 }
4274
4275 static void
4276 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4277 {
4278     cfg->freeService();
4279 }
4280
4281 static void
4282 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4283 {
4284     cfg.dumpService(entry, name);
4285 }
4286
4287 #endif /* USE_ECAP */
4288
4289 #if ICAP_CLIENT
4290 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4291 {
4292     char *token;
4293     cfg->service_failure_limit = GetInteger();
4294
4295     if ((token = ConfigParser::NextToken()) == NULL)
4296         return;
4297
4298     if (strcmp(token,"in") != 0) {
4299         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4300         self_destruct();
4301         return;
4302     }
4303
4304     parse_time_t(&cfg->oldest_service_failure);
4305 }
4306
4307 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4308 {
4309     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4310     if (cfg.oldest_service_failure > 0) {
4311         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4312     }
4313     storeAppendPrintf(entry, "\n");
4314 }
4315
4316 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4317 {
4318     cfg->oldest_service_failure = 0;
4319     cfg->service_failure_limit = 0;
4320 }
4321 #endif
4322
4323 #if USE_OPENSSL
4324 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4325 {
4326     char *al;
4327     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4328     if ((al = ConfigParser::NextToken()) == NULL) {
4329         xfree(ca);
4330         self_destruct();
4331         return;
4332     }
4333
4334     const char *param;
4335     if ( char *s = strchr(al, '{')) {
4336         *s = '\0'; // terminate the al string
4337         ++s;
4338         param = s;
4339         s = strchr(s, '}');
4340         if (!s) {
4341             xfree(ca);
4342             self_destruct();
4343             return;
4344         }
4345         *s = '\0';
4346     } else
4347         param = NULL;
4348
4349     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4350         ca->alg = Ssl::algSetValidAfter;
4351         ca->param = xstrdup("on");
4352     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4353         ca->alg = Ssl::algSetValidBefore;
4354         ca->param = xstrdup("on");
4355     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4356         ca->alg = Ssl::algSetCommonName;
4357         if (param) {
4358             if (strlen(param) > 64) {
4359                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4360                 xfree(ca);
4361                 self_destruct();
4362                 return;
4363             }
4364             ca->param = xstrdup(param);
4365         }
4366     } else {
4367         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4368         xfree(ca);
4369         self_destruct();
4370         return;
4371     }
4372
4373     aclParseAclList(LegacyParser, &ca->aclList, al);
4374
4375     while (*cert_adapt)
4376         cert_adapt = &(*cert_adapt)->next;
4377
4378     *cert_adapt = ca;
4379 }
4380
4381 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4382 {
4383     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4384         storeAppendPrintf(entry, "%s ", name);
4385         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4386         if (ca->aclList)
4387             dump_acl_list(entry, ca->aclList);
4388         storeAppendPrintf(entry, "\n");
4389     }
4390 }
4391
4392 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4393 {
4394     while (*cert_adapt) {
4395         sslproxy_cert_adapt *ca = *cert_adapt;
4396         *cert_adapt = ca->next;
4397         safe_free(ca->param);
4398
4399         if (ca->aclList)
4400             aclDestroyAclList(&ca->aclList);
4401
4402         safe_free(ca);
4403     }
4404 }
4405
4406 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4407 {
4408     char *al;
4409     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4410     if ((al = ConfigParser::NextToken()) == NULL) {
4411         xfree(cs);
4412         self_destruct();
4413         return;
4414     }
4415
4416     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4417         cs->alg = Ssl::algSignTrusted;
4418     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4419         cs->alg = Ssl::algSignUntrusted;
4420     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4421         cs->alg = Ssl::algSignSelf;
4422     else {
4423         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4424         xfree(cs);
4425         self_destruct();
4426         return;
4427     }
4428
4429     aclParseAclList(LegacyParser, &cs->aclList, al);
4430
4431     while (*cert_sign)
4432         cert_sign = &(*cert_sign)->next;
4433
4434     *cert_sign = cs;
4435 }
4436
4437 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4438 {
4439     sslproxy_cert_sign *cs;
4440     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4441         storeAppendPrintf(entry, "%s ", name);
4442         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4443         if (cs->aclList)
4444             dump_acl_list(entry, cs->aclList);
4445         storeAppendPrintf(entry, "\n");
4446     }
4447 }
4448
4449 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4450 {
4451     while (*cert_sign) {
4452         sslproxy_cert_sign *cs = *cert_sign;
4453         *cert_sign = cs->next;
4454
4455         if (cs->aclList)
4456             aclDestroyAclList(&cs->aclList);
4457
4458         safe_free(cs);
4459     }
4460 }
4461
4462 class sslBumpCfgRr: public ::RegisteredRunner
4463 {
4464 public:
4465     static Ssl::BumpMode lastDeprecatedRule;
4466     /* RegisteredRunner API */
4467     virtual void finalizeConfig();
4468 };
4469
4470 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4471
4472 RunnerRegistrationEntry(sslBumpCfgRr);
4473
4474 void
4475 sslBumpCfgRr::finalizeConfig()
4476 {
4477     if (lastDeprecatedRule != Ssl::bumpEnd) {
4478         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4479         static char buf[1024];
4480         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4481             strcpy(buf, "ssl_bump deny all");
4482             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4483                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4484                    "must not use implicit rules. Update your ssl_bump rules.");
4485         } else {
4486             strcpy(buf, "ssl_bump allow all");
4487             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4488                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4489                    "inferior to the newer server-first bumping mode. New ssl_bump"
4490                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4491         }
4492         parse_line(buf);
4493     }
4494 }
4495
4496 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4497 {
4498     typedef const char *BumpCfgStyle;
4499     BumpCfgStyle bcsNone = NULL;
4500     BumpCfgStyle bcsNew = "new client/server-first/none";
4501     BumpCfgStyle bcsOld = "deprecated allow/deny";
4502     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4503     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4504     char *bm;
4505     if ((bm = ConfigParser::NextToken()) == NULL) {
4506         self_destruct();
4507         return;
4508     }
4509
4510     // if this is the first rule processed
4511     if (*ssl_bump == NULL) {
4512         bumpCfgStyleLast = bcsNone;
4513         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4514     }
4515
4516     auto action = Acl::Answer(ACCESS_ALLOWED);
4517
4518     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4519         action.kind = Ssl::bumpClientFirst;
4520         bumpCfgStyleNow = bcsNew;
4521     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4522         action.kind = Ssl::bumpServerFirst;
4523         bumpCfgStyleNow = bcsNew;
4524     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4525         action.kind = Ssl::bumpPeek;
4526         bumpCfgStyleNow = bcsNew;
4527     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4528         action.kind = Ssl::bumpStare;
4529         bumpCfgStyleNow = bcsNew;
4530     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4531         action.kind = Ssl::bumpSplice;
4532         bumpCfgStyleNow = bcsNew;
4533     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4534         action.kind = Ssl::bumpBump;
4535         bumpCfgStyleNow = bcsNew;
4536     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4537         action.kind = Ssl::bumpTerminate;
4538         bumpCfgStyleNow = bcsNew;
4539     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4540         action.kind = Ssl::bumpNone;
4541         bumpCfgStyleNow = bcsNew;
4542     } else if (strcmp(bm, "allow") == 0) {
4543         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4544                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4545                "is usually inferior to the newer server-first "
4546                "bumping mode. Update your ssl_bump rules.");
4547         action.kind = Ssl::bumpClientFirst;
4548         bumpCfgStyleNow = bcsOld;
4549         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4550     } else if (strcmp(bm, "deny") == 0) {
4551         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4552                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4553                "your ssl_bump rules.");
4554         action.kind = Ssl::bumpNone;
4555         bumpCfgStyleNow = bcsOld;
4556         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4557     } else {
4558         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4559         self_destruct();
4560         return;
4561     }
4562
4563     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4564         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4565                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4566         self_destruct();
4567         return;
4568     }
4569
4570     bumpCfgStyleLast = bumpCfgStyleNow;
4571
4572     // empty rule OK
4573     ParseAclWithAction(ssl_bump, action, "ssl_bump");
4574 }
4575
4576 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4577 {
4578     if (ssl_bump)
4579         dump_SBufList(entry, ssl_bump->treeDump(name, [](const Acl::Answer &action) {
4580         return Ssl::BumpModeStr.at(action.kind);
4581     }));
4582 }
4583
4584 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4585 {
4586     free_acl_access(ssl_bump);
4587 }
4588
4589 #endif
4590
4591 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4592 {
4593     if (!headers)
4594         return;
4595
4596     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4597         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4598         if (hwa->aclList)
4599             dump_acl_list(entry, hwa->aclList);
4600         storeAppendPrintf(entry, "\n");
4601     }
4602 }
4603
4604 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4605 {
4606     char *fn;
4607     if (!*headers) {
4608         *headers = new HeaderWithAclList;
4609     }
4610     if ((fn = ConfigParser::NextToken()) == NULL) {
4611         self_destruct();
4612         return;
4613     }
4614     HeaderWithAcl hwa;
4615     hwa.fieldName = fn;
4616     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4617     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4618         hwa.fieldId = Http::HdrType::OTHER;
4619
4620     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4621     ConfigParser::EnableMacros();
4622     String buf = ConfigParser::NextQuotedToken();
4623     ConfigParser::DisableMacros();
4624     hwa.fieldValue = buf.termedBuf();
4625     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4626     if (hwa.quoted) {
4627         if (!nlf->parse(hwa.fieldValue.c_str())) {
4628             self_destruct();
4629             return;
4630         }
4631         hwa.valueFormat = nlf;
4632     } else
4633         delete nlf;
4634     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4635     (*headers)->push_back(hwa);
4636 }
4637
4638 static void free_HeaderWithAclList(HeaderWithAclList **header)
4639 {
4640     if (!(*header))
4641         return;
4642
4643     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4644         if (hwa->aclList)
4645             aclDestroyAclList(&hwa->aclList);
4646
4647         if (hwa->valueFormat) {
4648             delete hwa->valueFormat;
4649             hwa->valueFormat = NULL;
4650         }
4651     }
4652     delete *header;
4653     *header = NULL;
4654 }
4655
4656 static void parse_note(Notes *notes)
4657 {
4658     assert(notes);
4659     notes->parse(LegacyParser);
4660 }
4661
4662 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4663 {
4664     notes.dump(entry, name);
4665 }
4666
4667 static void free_note(Notes *notes)
4668 {
4669     notes->clean();
4670 }
4671
4672 static DebugMessageId ParseDebugMessageId(const char *value, const char eov)
4673 {
4674     const auto id = xatoui(value, eov);
4675     if (!(0 < id && id < DebugMessageIdUpperBound))
4676         throw TextException(ToSBuf("unknown cache_log_message ID: ", value), Here());
4677     return static_cast<DebugMessageId>(id);
4678 }
4679
4680 static void parse_cache_log_message(DebugMessages **debugMessages)
4681 {
4682     DebugMessage msg;
4683     DebugMessageId minId = 0;
4684     DebugMessageId maxId = 0;
4685
4686     char *key = nullptr;
4687     char *value = nullptr;
4688     while (ConfigParser::NextKvPair(key, value)) {
4689         if (strcmp(key, "id") == 0) {
4690             if (minId > 0)
4691                 break;
4692             minId = maxId = ParseDebugMessageId(value, '\0');
4693         } else if (strcmp(key, "ids") == 0) {
4694             if (minId > 0)
4695                 break;
4696             const auto dash = strchr(value, '-');
4697             if (!dash)
4698                 throw TextException(ToSBuf("malformed cache_log_message ID range: ", key, '=', value), Here());
4699             minId = ParseDebugMessageId(value, '-');
4700             maxId = ParseDebugMessageId(dash+1, '\0');
4701             if (minId > maxId)
4702                 throw TextException(ToSBuf("invalid cache_log_message ID range: ", key, '=', value), Here());
4703         } else if (strcmp(key, "level") == 0) {
4704             if (msg.levelled())
4705                 break;
4706             const auto level = xatoi(value);
4707             if (level < 0)
4708                 throw TextException(ToSBuf("negative cache_log_message level: ", value), Here());
4709             msg.level = level;
4710         } else if (strcmp(key, "limit") == 0) {
4711             if (msg.limited())
4712                 break;
4713             msg.limit = xatoull(value, 10);
4714         } else {
4715             throw TextException(ToSBuf("unsupported cache_log_message option: ", key), Here());
4716         }
4717         key = value = nullptr;
4718     }
4719
4720     if (key && value)
4721         throw TextException(ToSBuf("repeated or conflicting cache_log_message option: ", key, '=', value), Here());
4722
4723     if (!minId)
4724         throw TextException("cache_log_message is missing a required id=... or ids=... option", Here());
4725
4726     if (!(msg.levelled() || msg.limited()))
4727         throw TextException("cache_log_message is missing a required level=... or limit=... option", Here());
4728
4729     assert(debugMessages);
4730     if (!*debugMessages)
4731         *debugMessages = new DebugMessages();
4732
4733     for (auto id = minId; id <= maxId; ++id) {
4734         msg.id = id;
4735         (*debugMessages)->messages.at(id) = msg;
4736     }
4737 }
4738
4739 static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *debugMessages)
4740 {
4741     if (!debugMessages)
4742         return;
4743
4744     SBufStream out;
4745     for (const auto &msg: debugMessages->messages) {
4746         if (!msg.configured())
4747             continue;
4748         out << name << " id=" << msg.id;
4749         if (msg.levelled())
4750             out << " level=" << msg.level;
4751         if (msg.limited())
4752             out << " limit=" << msg.limit;
4753         out << "\n";
4754     }
4755     const auto buf = out.buf();
4756     entry->append(buf.rawContent(), buf.length()); // may be empty
4757 }
4758
4759 static void free_cache_log_message(DebugMessages **debugMessages)
4760 {
4761     // clear old messages to avoid cumulative effect across (re)configurations
4762     assert(debugMessages);
4763     delete *debugMessages;
4764     *debugMessages = nullptr;
4765 }
4766
4767 static bool FtpEspvDeprecated = false;
4768 static void parse_ftp_epsv(acl_access **ftp_epsv)
4769 {
4770     Acl::Answer ftpEpsvDeprecatedAction;
4771     bool ftpEpsvIsDeprecatedRule = false;
4772
4773     char *t = ConfigParser::PeekAtToken();
4774     if (!t) {
4775         self_destruct();
4776         return;
4777     }
4778
4779     if (!strcmp(t, "off")) {
4780         (void)ConfigParser::NextToken();
4781         ftpEpsvIsDeprecatedRule = true;
4782         ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_DENIED);
4783     } else if (!strcmp(t, "on")) {
4784         (void)ConfigParser::NextToken();
4785         ftpEpsvIsDeprecatedRule = true;
4786         ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_ALLOWED);
4787     }
4788
4789     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4790     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4791     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4792     // then abort
4793     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4794             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4795         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4796         self_destruct();
4797         return;
4798     }
4799
4800     if (ftpEpsvIsDeprecatedRule) {
4801         // overwrite previous ftp_epsv lines
4802         delete *ftp_epsv;
4803         *ftp_epsv = nullptr;
4804
4805         if (ftpEpsvDeprecatedAction == Acl::Answer(ACCESS_DENIED)) {
4806             if (ACL *a = ACL::FindByName("all"))
4807                 ParseAclWithAction(ftp_epsv, ftpEpsvDeprecatedAction, "ftp_epsv", a);
4808             else {
4809                 self_destruct();
4810                 return;
4811             }
4812         }
4813         FtpEspvDeprecated = true;
4814     } else {
4815         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4816     }
4817 }
4818
4819 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4820 {
4821     if (ftp_epsv)
4822         dump_SBufList(entry, ftp_epsv->treeDump(name, Acl::AllowOrDeny));
4823 }
4824
4825 static void free_ftp_epsv(acl_access **ftp_epsv)
4826 {
4827     free_acl_access(ftp_epsv);
4828     FtpEspvDeprecated = false;
4829 }
4830
4831 /// Like parseTimeLine() but does not require the timeunit to be specified.
4832 /// If missed, the default 'second' timeunit is assumed.
4833 static std::chrono::seconds
4834 ParseUrlRewriteTimeout()
4835 {
4836     const auto timeValueToken = ConfigParser::NextToken();
4837     if (!timeValueToken)
4838         throw TexcHere("cannot read a time value");
4839
4840     using Seconds = std::chrono::seconds;
4841
4842     const auto parsedTimeValue = xatof(timeValueToken);
4843
4844     if (parsedTimeValue == 0)
4845         return std::chrono::seconds::zero();
4846
4847     std::chrono::nanoseconds parsedUnitDuration;
4848
4849     const auto unitToken = ConfigParser::PeekAtToken();
4850     if (parseTimeUnit<Seconds>(unitToken, parsedUnitDuration))
4851         (void)ConfigParser::NextToken();
4852     else {
4853         const auto defaultParsed = parseTimeUnit<Seconds>(T_SECOND_STR, parsedUnitDuration);
4854         assert(defaultParsed);
4855         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), ConfigParser::CurrentLocation() <<
4856                ": WARNING: missing time unit, using deprecated default '" << T_SECOND_STR << "'");
4857     }
4858
4859     const auto nanoseconds = ToNanoSeconds(parsedTimeValue, parsedUnitDuration);
4860
4861     return FromNanoseconds<Seconds>(nanoseconds, parsedTimeValue);
4862 }
4863
4864 static void
4865 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4866 {
4867     // TODO: do not allow optional timeunit (as the documentation prescribes)
4868     // and use parseTimeLine() instead.
4869     Config.Timeout.urlRewrite = ParseUrlRewriteTimeout().count();
4870
4871     char *key, *value;
4872     while(ConfigParser::NextKvPair(key, value)) {
4873         if (strcasecmp(key, "on_timeout") == 0) {
4874             if (strcasecmp(value, "bypass") == 0)
4875                 config->action = toutActBypass;
4876             else if (strcasecmp(value, "fail") == 0)
4877                 config->action = toutActFail;
4878             else if (strcasecmp(value, "retry") == 0)
4879                 config->action = toutActRetry;
4880             else if (strcasecmp(value, "use_configured_response") == 0) {
4881                 config->action = toutActUseConfiguredResponse;
4882             } else {
4883                 debugs(3, DBG_CRITICAL, "FATAL: unsupported \"on_timeout\" action: " << value);
4884                 self_destruct();
4885                 return;
4886             }
4887         } else if (strcasecmp(key, "response") == 0) {
4888             config->response = xstrdup(value);
4889         } else {
4890             debugs(3, DBG_CRITICAL, "FATAL: unsupported option " << key);
4891             self_destruct();
4892             return;
4893         }
4894     }
4895
4896     if (config->action == toutActUseConfiguredResponse && !config->response) {
4897         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4898         self_destruct();
4899     }
4900
4901     if (config->action != toutActUseConfiguredResponse && config->response) {
4902         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the 'on_timeout=use_configured_response' option");
4903         self_destruct();
4904     }
4905 }
4906
4907 static void
4908 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4909 {
4910     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4911     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4912
4913     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4914     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4915
4916     if (config.response)
4917         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4918
4919     storeAppendPrintf(entry, "\n");
4920 }
4921
4922 static void
4923 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4924 {
4925     Config.Timeout.urlRewrite = 0;
4926     config->action = 0;
4927     safe_free(config->response);
4928 }
4929
4930 static void
4931 parse_configuration_includes_quoted_values(bool *)
4932 {
4933     int val = 0;
4934     parse_onoff(&val);
4935
4936     // If quoted values is set to on then enable new strict mode parsing
4937     if (val) {
4938         ConfigParser::RecognizeQuotedValues = true;
4939         ConfigParser::StrictMode = true;
4940     } else {
4941         ConfigParser::RecognizeQuotedValues = false;
4942         ConfigParser::StrictMode = false;
4943     }
4944 }
4945
4946 static void
4947 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4948 {
4949     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4950     dump_onoff(entry, name, val);
4951 }
4952
4953 static void
4954 free_configuration_includes_quoted_values(bool *)
4955 {
4956     ConfigParser::RecognizeQuotedValues = false;
4957     ConfigParser::StrictMode = false;
4958 }
4959
4960 static void
4961 parse_on_unsupported_protocol(acl_access **access)
4962 {
4963     char *tm;
4964     if ((tm = ConfigParser::NextToken()) == NULL) {
4965         self_destruct();
4966         return;
4967     }
4968
4969     auto action = Acl::Answer(ACCESS_ALLOWED);
4970     if (strcmp(tm, "tunnel") == 0)
4971         action.kind = 1;
4972     else if (strcmp(tm, "respond") == 0)
4973         action.kind = 2;
4974     else {
4975         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4976         self_destruct();
4977         return;
4978     }
4979
4980     // empty rule OK
4981     ParseAclWithAction(access, action, "on_unsupported_protocol");
4982 }
4983
4984 static void
4985 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4986 {
4987     static const std::vector<const char *> onErrorTunnelMode = {
4988         "none",
4989         "tunnel",
4990         "respond"
4991     };
4992     if (access) {
4993         SBufList lines = access->treeDump(name, [](const Acl::Answer &action) {
4994             return onErrorTunnelMode.at(action.kind);
4995         });
4996         dump_SBufList(entry, lines);
4997     }
4998 }
4999
5000 static void
5001 free_on_unsupported_protocol(acl_access **access)
5002 {
5003     free_acl_access(access);
5004 }
5005
5006 static void
5007 parse_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuardsPtr)
5008 {
5009     assert(protoGuardsPtr);
5010     auto &protoGuards = *protoGuardsPtr;
5011     if (!protoGuards)
5012         protoGuards = new HttpUpgradeProtocolAccess();
5013     protoGuards->configureGuard(LegacyParser);
5014 }
5015
5016 static void
5017 dump_http_upgrade_request_protocols(StoreEntry *entry, const char *rawName, HttpUpgradeProtocolAccess *protoGuards)
5018 {
5019     if (!protoGuards)
5020         return;
5021
5022     const SBuf name(rawName);
5023     protoGuards->forEach([entry,&name](const SBuf &proto, const acl_access *acls) {
5024         SBufList line;
5025         line.push_back(name);
5026         line.push_back(proto);
5027         const auto acld = acls->treeDump("", &Acl::AllowOrDeny);
5028         line.insert(line.end(), acld.begin(), acld.end());
5029         dump_SBufList(entry, line);
5030     });
5031 }
5032
5033 static void
5034 free_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuardsPtr)
5035 {
5036     assert(protoGuardsPtr);
5037     auto &protoGuards = *protoGuardsPtr;
5038     delete protoGuards;
5039     protoGuards = nullptr;
5040 }
5041