src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclNameList.h"
  15 #include "acl/AclSizeLimit.h"
  16 #include "acl/Address.h"
  17 #include "acl/Gadgets.h"
  18 #include "acl/MethodData.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "AuthReg.h"
  23 #include "base/RunnersRegistry.h"
  24 #include "cache_cf.h"
  25 #include "CachePeer.h"
  26 #include "ConfigParser.h"
  27 #include "CpuAffinityMap.h"
  28 #include "DiskIO/DiskIOModule.h"
  29 #include "eui/Config.h"
  30 #include "ExternalACL.h"
  31 #include "format/Format.h"
  32 #include "ftp/Elements.h"
  33 #include "globals.h"
  34 #include "HttpHeaderTools.h"
  35 #include "icmp/IcmpConfig.h"
  36 #include "ident/Config.h"
  37 #include "ip/Intercept.h"
  38 #include "ip/QosConfig.h"
  39 #include "ip/tools.h"
  40 #include "ipc/Kids.h"
  41 #include "log/Config.h"
  42 #include "log/CustomLog.h"
  43 #include "MemBuf.h"
  44 #include "mgr/ActionPasswordList.h"
  45 #include "mgr/Registration.h"
  46 #include "neighbors.h"
  47 #include "NeighborTypeDomainList.h"
  48 #include "Parsing.h"
  49 #include "pconn.h"
  50 #include "PeerDigest.h"
  51 #include "PeerPoolMgr.h"
  52 #include "redirect.h"
  53 #include "RefreshPattern.h"
  54 #include "rfc1738.h"
  55 #include "SBufList.h"
  56 #include "SquidConfig.h"
  57 #include "SquidString.h"
  58 #include "ssl/ProxyCerts.h"
  59 #include "Store.h"
  60 #include "store/Disk.h"
  61 #include "store/Disks.h"
  62 #include "StoreFileSystem.h"
  63 #include "tools.h"
  64 #include "util.h"
  65 #include "wordlist.h"
  66 /* wccp2 has its own conditional definitions */
  67 #include "wccp2.h"
  68 #if USE_ADAPTATION
  69 #include "adaptation/Config.h"
  70 #endif
  71 #if ICAP_CLIENT
  72 #include "adaptation/icap/Config.h"
  73 #endif
  74 #if USE_ECAP
  75 #include "adaptation/ecap/Config.h"
  76 #endif
  77 #if USE_OPENSSL
  78 #include "ssl/Config.h"
  79 #include "ssl/support.h"
  80 #endif
  81 #if USE_AUTH
  82 #include "auth/Config.h"
  83 #include "auth/Scheme.h"
  84 #endif
  85 #if USE_SQUID_ESI
  86 #include "esi/Parser.h"
  87 #endif
  88 #if SQUID_SNMP
  89 #include "snmp.h"
  90 #endif
  91
  92 #if HAVE_GLOB_H
  93 #include <glob.h>
  94 #endif
  95 #include <limits>
  96 #include <list>
  97 #if HAVE_PWD_H
  98 #include <pwd.h>
  99 #endif
 100 #if HAVE_GRP_H
 101 #include <grp.h>
 102 #endif
 103 #if HAVE_SYS_STAT_H
 104 #include <sys/stat.h>
 105 #endif
 106
 107 #if USE_OPENSSL
 108 #include "ssl/gadgets.h"
 109 #endif
 110
 111 #if USE_ADAPTATION
 112 static void parse_adaptation_service_set_type();
 113 static void parse_adaptation_service_chain_type();
 114 static void parse_adaptation_access_type();
 115 #endif
 116
 117 #if ICAP_CLIENT
 118 static void parse_icap_service_type(Adaptation::Icap::Config *);
 119 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 120 static void free_icap_service_type(Adaptation::Icap::Config *);
 121 static void parse_icap_class_type();
 122 static void parse_icap_access_type();
 123
 124 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 125 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 126 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 127 #endif
 128
 129 #if USE_ECAP
 130 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 131 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 132 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 133 #endif
 134
 135 static peer_t parseNeighborType(const char *s);
 136
 137 static const char *const T_MILLISECOND_STR = "millisecond";
 138 static const char *const T_SECOND_STR = "second";
 139 static const char *const T_MINUTE_STR = "minute";
 140 static const char *const T_HOUR_STR = "hour";
 141 static const char *const T_DAY_STR = "day";
 142 static const char *const T_WEEK_STR = "week";
 143 static const char *const T_FORTNIGHT_STR = "fortnight";
 144 static const char *const T_MONTH_STR = "month";
 145 static const char *const T_YEAR_STR = "year";
 146 static const char *const T_DECADE_STR = "decade";
 147
 148 static const char *const B_BYTES_STR = "bytes";
 149 static const char *const B_KBYTES_STR = "KB";
 150 static const char *const B_MBYTES_STR = "MB";
 151 static const char *const B_GBYTES_STR = "GB";
 152
 153 static const char *const list_sep = ", \t\n\r";
 154
 155 static void parse_access_log(CustomLog ** customlog_definitions);
 156 static int check_null_access_log(CustomLog *customlog_definitions);
 157 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 158 static void free_access_log(CustomLog ** definitions);
 159 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 160
 161 static void configDoConfigure(void);
 162 static void parse_refreshpattern(RefreshPattern **);
 163 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 164 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 165 static void parse_u_short(unsigned short * var);
 166 static void parse_string(char **);
 167 static void default_all(void);
 168 static void defaults_if_none(void);
 169 static void defaults_postscriptum(void);
 170 static int parse_line(char *);
 171 static void parse_obsolete(const char *);
 172 static void parseBytesLine(size_t * bptr, const char *units);
 173 #if USE_OPENSSL
 174 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 175 #endif
 176 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 177 static size_t parseBytesUnits(const char *unit);
 178 static void free_all(void);
 179 void requirePathnameExists(const char *name, const char *path);
 180 static OBJH dump_config;
 181 #if USE_HTTP_VIOLATIONS
 182 static void free_HeaderManglers(HeaderManglers **pm);
 183 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 184 static void parse_http_header_access(HeaderManglers **manglers);
 185 #define free_http_header_access free_HeaderManglers
 186 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 187 static void parse_http_header_replace(HeaderManglers **manglers);
 188 #define free_http_header_replace free_HeaderManglers
 189 #endif
 190 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 191 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 192 static void free_HeaderWithAclList(HeaderWithAclList **header);
 193 static void parse_note(Notes *);
 194 static void dump_note(StoreEntry *, const char *, Notes &);
 195 static void free_note(Notes *);
 196 static void parse_denyinfo(AclDenyInfoList ** var);
 197 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 198 static void free_denyinfo(AclDenyInfoList ** var);
 199
 200 #if USE_WCCPv2
 201 static void parse_IpAddress_list(Ip::Address_list **);
 202 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 203 static void free_IpAddress_list(Ip::Address_list **);
 204 #if CURRENTLY_UNUSED
 205 static int check_null_IpAddress_list(const Ip::Address_list *);
 206 #endif /* CURRENTLY_UNUSED */
 207 #endif /* USE_WCCPv2 */
 208
 209 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 210 #define parse_PortCfg(l) parsePortCfg((l), token)
 211 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 212 #define free_PortCfg(h)  *(h)=NULL
 213
 214 #if USE_OPENSSL
 215 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 216 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 217 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 218 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 219 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 220 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 221 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 222 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 223 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 224 #endif /* USE_OPENSSL */
 225
 226 static void parse_ftp_epsv(acl_access **ftp_epsv);
 227 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 228 static void free_ftp_epsv(acl_access **ftp_epsv);
 229
 230 static void parse_b_size_t(size_t * var);
 231 static void parse_b_int64_t(int64_t * var);
 232
 233 static bool parseNamedIntList(const char *data, const String &name, std::vector<int> &list);
 234
 235 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 236 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 237 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 238
 239 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 240 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 241 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 242
 243 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 244
 245 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 246 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 247 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 248 static void parse_on_unsupported_protocol(acl_access **access);
 249 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 250 static void free_on_unsupported_protocol(acl_access **access);
 251
 252 /*
 253  * LegacyParser is a parser for legacy code that uses the global
 254  * approach.  This is static so that it is only exposed to cache_cf.
 255  * Other modules needing access to a ConfigParser should have it
 256  * provided to them in their parserFOO methods.
 257  */
 258 static ConfigParser LegacyParser = ConfigParser();
 259
 260 void
 261 self_destruct(void)
 262 {
 263     LegacyParser.destruct();
 264 }
 265
 266 static void
 267 SetConfigFilename(char const *file_name, bool is_pipe)
 268 {
 269     if (is_pipe)
 270         cfg_filename = file_name + 1;
 271     else
 272         cfg_filename = file_name;
 273 }
 274
 275 static const char*
 276 skip_ws(const char* s)
 277 {
 278     while (xisspace(*s))
 279         ++s;
 280
 281     return s;
 282 }
 283
 284 static int
 285 parseManyConfigFiles(char* files, int depth)
 286 {
 287     int error_count = 0;
 288     char* saveptr = NULL;
 289 #if HAVE_GLOB
 290     char *path;
 291     glob_t globbuf;
 292     int i;
 293     memset(&globbuf, 0, sizeof(globbuf));
 294     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 295         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 296             fatalf("Unable to find configuration file: %s: %s",
 297                    path, xstrerror());
 298         }
 299     }
 300     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 301         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 302     }
 303     globfree(&globbuf);
 304 #else
 305     char* file = strwordtok(files, &saveptr);
 306     while (file != NULL) {
 307         error_count += parseOneConfigFile(file, depth);
 308         file = strwordtok(NULL, &saveptr);
 309     }
 310 #endif /* HAVE_GLOB */
 311     return error_count;
 312 }
 313
 314 static void
 315 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 316 {
 317     assert(str != NULL);
 318     assert(newSubstr != NULL);
 319
 320     unsigned newSubstrLen = strlen(newSubstr);
 321     if (newSubstrLen > substrLen)
 322         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 323
 324     // move tail part including zero
 325     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 326     // copy new substring in place
 327     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 328
 329     len = strlen(str);
 330 }
 331
 332 static void
 333 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 334 {
 335     assert(line != NULL);
 336     assert(macroName != NULL);
 337     assert(substStr != NULL);
 338     unsigned macroNameLen = strlen(macroName);
 339     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 340         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 341 }
 342
 343 static void
 344 ProcessMacros(char*& line, int& len)
 345 {
 346     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 347     SubstituteMacro(line, len, "${process_name}", TheKidName);
 348     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 349 }
 350
 351 static void
 352 trim_trailing_ws(char* str)
 353 {
 354     assert(str != NULL);
 355     unsigned i = strlen(str);
 356     while ((i > 0) && xisspace(str[i - 1]))
 357         --i;
 358     str[i] = '\0';
 359 }
 360
 361 static const char*
 362 FindStatement(const char* line, const char* statement)
 363 {
 364     assert(line != NULL);
 365     assert(statement != NULL);
 366
 367     const char* str = skip_ws(line);
 368     unsigned len = strlen(statement);
 369     if (strncmp(str, statement, len) == 0) {
 370         str += len;
 371         if (*str == '\0')
 372             return str;
 373         else if (xisspace(*str))
 374             return skip_ws(str);
 375     }
 376
 377     return NULL;
 378 }
 379
 380 static bool
 381 StrToInt(const char* str, long& number)
 382 {
 383     assert(str != NULL);
 384
 385     char* end;
 386     number = strtol(str, &end, 0);
 387
 388     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 389 }
 390
 391 static bool
 392 EvalBoolExpr(const char* expr)
 393 {
 394     assert(expr != NULL);
 395     if (strcmp(expr, "true") == 0) {
 396         return true;
 397     } else if (strcmp(expr, "false") == 0) {
 398         return false;
 399     } else if (const char* equation = strchr(expr, '=')) {
 400         const char* rvalue = skip_ws(equation + 1);
 401         char* lvalue = (char*)xmalloc(equation - expr + 1);
 402         xstrncpy(lvalue, expr, equation - expr + 1);
 403         trim_trailing_ws(lvalue);
 404
 405         long number1;
 406         if (!StrToInt(lvalue, number1))
 407             fatalf("String is not a integer number: '%s'\n", lvalue);
 408         long number2;
 409         if (!StrToInt(rvalue, number2))
 410             fatalf("String is not a integer number: '%s'\n", rvalue);
 411
 412         xfree(lvalue);
 413         return number1 == number2;
 414     }
 415     fatalf("Unable to evaluate expression '%s'\n", expr);
 416     return false; // this place cannot be reached
 417 }
 418
 419 static int
 420 parseOneConfigFile(const char *file_name, unsigned int depth)
 421 {
 422     FILE *fp = NULL;
 423     const char *orig_cfg_filename = cfg_filename;
 424     const int orig_config_lineno = config_lineno;
 425     char *token = NULL;
 426     char *tmp_line = NULL;
 427     int tmp_line_len = 0;
 428     int err_count = 0;
 429     int is_pipe = 0;
 430
 431     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 432     if (depth > 16) {
 433         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 434         return 1;
 435     }
 436
 437     if (file_name[0] == '!' || file_name[0] == '|') {
 438         fp = popen(file_name + 1, "r");
 439         is_pipe = 1;
 440     } else {
 441         fp = fopen(file_name, "r");
 442     }
 443
 444     if (fp == NULL)
 445         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerror());
 446
 447 #if _SQUID_WINDOWS_
 448     setmode(fileno(fp), O_TEXT);
 449 #endif
 450
 451     SetConfigFilename(file_name, bool(is_pipe));
 452
 453     memset(config_input_line, '\0', BUFSIZ);
 454
 455     config_lineno = 0;
 456
 457     std::vector<bool> if_states;
 458     while (fgets(config_input_line, BUFSIZ, fp)) {
 459         ++config_lineno;
 460
 461         if ((token = strchr(config_input_line, '\n')))
 462             *token = '\0';
 463
 464         if ((token = strchr(config_input_line, '\r')))
 465             *token = '\0';
 466
 467         // strip any prefix whitespace off the line.
 468         const char *p = skip_ws(config_input_line);
 469         if (config_input_line != p)
 470             memmove(config_input_line, p, strlen(p)+1);
 471
 472         if (strncmp(config_input_line, "#line ", 6) == 0) {
 473             static char new_file_name[1024];
 474             static char *file;
 475             static char new_lineno;
 476             token = config_input_line + 6;
 477             new_lineno = strtol(token, &file, 0) - 1;
 478
 479             if (file == token)
 480                 continue;   /* Not a valid #line directive, may be a comment */
 481
 482             while (*file && xisspace((unsigned char) *file))
 483                 ++file;
 484
 485             if (*file) {
 486                 if (*file != '"')
 487                     continue;   /* Not a valid #line directive, may be a comment */
 488
 489                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 490
 491                 if ((token = strchr(new_file_name, '"')))
 492                     *token = '\0';
 493
 494                 SetConfigFilename(new_file_name, false);
 495             }
 496
 497             config_lineno = new_lineno;
 498         }
 499
 500         if (config_input_line[0] == '#')
 501             continue;
 502
 503         if (config_input_line[0] == '\0')
 504             continue;
 505
 506         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 507
 508         size_t append_len = strlen(append);
 509
 510         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 511
 512         strcpy(tmp_line + tmp_line_len, append);
 513
 514         tmp_line_len += append_len;
 515
 516         if (tmp_line[tmp_line_len-1] == '\\') {
 517             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 518             tmp_line[--tmp_line_len] = '\0';
 519             continue;
 520         }
 521
 522         trim_trailing_ws(tmp_line);
 523         ProcessMacros(tmp_line, tmp_line_len);
 524         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 525
 526         if (const char* expr = FindStatement(tmp_line, "if")) {
 527             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 528         } else if (FindStatement(tmp_line, "endif")) {
 529             if (!if_states.empty())
 530                 if_states.pop_back(); // remove last if-statement meaning
 531             else
 532                 fatalf("'endif' without 'if'\n");
 533         } else if (FindStatement(tmp_line, "else")) {
 534             if (!if_states.empty())
 535                 if_states.back() = !if_states.back();
 536             else
 537                 fatalf("'else' without 'if'\n");
 538         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 539             /* Handle includes here */
 540             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 541                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 542             } else if (!parse_line(tmp_line)) {
 543                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 544                 ++err_count;
 545             }
 546         }
 547
 548         safe_free(tmp_line);
 549         tmp_line_len = 0;
 550
 551     }
 552     if (!if_states.empty())
 553         fatalf("if-statement without 'endif'\n");
 554
 555     if (is_pipe) {
 556         int ret = pclose(fp);
 557
 558         if (ret != 0)
 559             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 560     } else {
 561         fclose(fp);
 562     }
 563
 564     SetConfigFilename(orig_cfg_filename, false);
 565     config_lineno = orig_config_lineno;
 566
 567     xfree(tmp_line);
 568     return err_count;
 569 }
 570
 571 int
 572 parseConfigFile(const char *file_name)
 573 {
 574     int err_count = 0;
 575
 576     debugs(5, 4, HERE);
 577
 578     configFreeMemory();
 579
 580     ACLMethodData::ThePurgeCount = 0;
 581     default_all();
 582
 583     err_count = parseOneConfigFile(file_name, 0);
 584
 585     defaults_if_none();
 586
 587     defaults_postscriptum();
 588
 589     /*
 590      * We must call configDoConfigure() before leave_suid() because
 591      * configDoConfigure() is where we turn username strings into
 592      * uid values.
 593      */
 594     configDoConfigure();
 595
 596     if (!Config.chroot_dir) {
 597         leave_suid();
 598         setUmask(Config.umask);
 599         _db_init(Debug::cache_log, Debug::debugOptions);
 600         enter_suid();
 601     }
 602
 603     if (opt_send_signal == -1) {
 604         Mgr::RegisterAction("config",
 605                             "Current Squid Configuration",
 606                             dump_config,
 607                             1, 1);
 608     }
 609
 610     return err_count;
 611 }
 612
 613 static void
 614 configDoConfigure(void)
 615 {
 616     memset(&Config2, '\0', sizeof(SquidConfig2));
 617     /* init memory as early as possible */
 618     memConfigure();
 619     /* Sanity checks */
 620
 621     Config.cacheSwap.n_strands = 0; // no diskers by default
 622     if (Config.cacheSwap.swapDirs == NULL) {
 623         /* Memory-only cache probably in effect. */
 624         /* turn off the cache rebuild delays... */
 625         StoreController::store_dirs_rebuilding = 0;
 626     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 627         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 628             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 629             if (sd->needsDiskStrand())
 630                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 631         }
 632     }
 633
 634     if (Debug::rotateNumber < 0) {
 635         Debug::rotateNumber = Config.Log.rotateNumber;
 636     }
 637
 638 #if SIZEOF_OFF_T <= 4
 639     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 640         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 641         Config.Store.maxObjectSize = 0x7FFF0000;
 642     }
 643 #endif
 644
 645     if (Config.Announce.period > 0) {
 646         Config.onoff.announce = 1;
 647     } else {
 648         Config.Announce.period = 86400 * 365;   /* one year */
 649         Config.onoff.announce = 0;
 650     }
 651
 652     if (Config.onoff.httpd_suppress_version_string)
 653         visible_appname_string = (char *)appname_string;
 654     else
 655         visible_appname_string = (char const *)APP_FULLNAME;
 656
 657     if (Config.Program.redirect) {
 658         if (Config.redirectChildren.n_max < 1) {
 659             Config.redirectChildren.n_max = 0;
 660             wordlistDestroy(&Config.Program.redirect);
 661         }
 662     }
 663
 664     if (Config.Program.store_id) {
 665         if (Config.storeIdChildren.n_max < 1) {
 666             Config.storeIdChildren.n_max = 0;
 667             wordlistDestroy(&Config.Program.store_id);
 668         }
 669     }
 670
 671     if (Config.appendDomain)
 672         if (*Config.appendDomain != '.')
 673             fatal("append_domain must begin with a '.'");
 674
 675     if (Config.errHtmlText == NULL)
 676         Config.errHtmlText = xstrdup(null_string);
 677
 678 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 679     if (Config.max_filedescriptors > 0) {
 680         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 681     }
 682 #elif USE_SELECT || USE_SELECT_WIN32
 683     if (Config.max_filedescriptors > FD_SETSIZE) {
 684         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 685     }
 686 #endif
 687
 688     storeConfigure();
 689
 690     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 691              uniqueHostname(),
 692              visible_appname_string);
 693
 694     /*
 695      * the extra space is for loop detection in client_side.c -- we search
 696      * for substrings in the Via header.
 697      */
 698     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 699              uniqueHostname(),
 700              visible_appname_string);
 701
 702     /* Use visible_hostname as default surrogate_id */
 703     if (!Config.Accel.surrogate_id) {
 704         const char *t = getMyHostname();
 705         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 706     }
 707
 708     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 709         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 710
 711     if (Config.appendDomain)
 712         Config.appendDomainLen = strlen(Config.appendDomain);
 713     else
 714         Config.appendDomainLen = 0;
 715
 716     if (Config.connect_retries > 10) {
 717         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 718         Config.connect_retries = 10;
 719     }
 720
 721     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 722 #if USE_UNLINKD
 723
 724     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 725 #endif
 726     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 727     if (Config.Program.redirect)
 728         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 729
 730     if (Config.Program.store_id)
 731         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 732
 733     requirePathnameExists("Icon Directory", Config.icons.directory);
 734
 735     if (Config.errorDirectory)
 736         requirePathnameExists("Error Directory", Config.errorDirectory);
 737
 738 #if USE_HTTP_VIOLATIONS
 739
 740     {
 741         const RefreshPattern *R;
 742
 743         for (R = Config.Refresh; R; R = R->next) {
 744             if (!R->flags.override_expire)
 745                 continue;
 746
 747             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 748
 749             break;
 750         }
 751
 752         for (R = Config.Refresh; R; R = R->next) {
 753             if (!R->flags.override_lastmod)
 754                 continue;
 755
 756             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 757
 758             break;
 759         }
 760
 761         for (R = Config.Refresh; R; R = R->next) {
 762             if (!R->flags.reload_into_ims)
 763                 continue;
 764
 765             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 766
 767             break;
 768         }
 769
 770         for (R = Config.Refresh; R; R = R->next) {
 771             if (!R->flags.ignore_reload)
 772                 continue;
 773
 774             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 775
 776             break;
 777         }
 778
 779         for (R = Config.Refresh; R; R = R->next) {
 780             if (!R->flags.ignore_no_store)
 781                 continue;
 782
 783             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 784
 785             break;
 786         }
 787
 788         for (R = Config.Refresh; R; R = R->next) {
 789             if (!R->flags.ignore_private)
 790                 continue;
 791
 792             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 793
 794             break;
 795         }
 796     }
 797 #endif
 798 #if !USE_HTTP_VIOLATIONS
 799     Config.onoff.via = 1;
 800 #else
 801
 802     if (!Config.onoff.via)
 803         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 804
 805 #endif
 806
 807     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 808     // TODO: replace with a dedicated "purge" ACL option?
 809     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 810
 811     Config2.onoff.mangle_request_headers = (Config.request_header_access != NULL);
 812
 813     if (geteuid() == 0) {
 814         if (NULL != Config.effectiveUser) {
 815
 816             struct passwd *pwd = getpwnam(Config.effectiveUser);
 817
 818             if (NULL == pwd) {
 819                 /*
 820                  * Andres Kroonmaa <andre@online.ee>:
 821                  * Some getpwnam() implementations (Solaris?) require
 822                  * an available FD < 256 for opening a FILE* to the
 823                  * passwd file.
 824                  * DW:
 825                  * This should be safe at startup, but might still fail
 826                  * during reconfigure.
 827                  */
 828                 fatalf("getpwnam failed to find userid for effective user '%s'",
 829                        Config.effectiveUser);
 830                 return;
 831             }
 832
 833             Config2.effectiveUserID = pwd->pw_uid;
 834
 835             Config2.effectiveGroupID = pwd->pw_gid;
 836
 837 #if HAVE_PUTENV
 838             if (pwd->pw_dir && *pwd->pw_dir) {
 839                 // putenv() leaks by design; avoid leaks when nothing changes
 840                 static SBuf lastDir;
 841                 if (lastDir.isEmpty() || !lastDir.cmp(pwd->pw_dir)) {
 842                     lastDir = pwd->pw_dir;
 843                     int len = strlen(pwd->pw_dir) + 6;
 844                     char *env_str = (char *)xcalloc(len, 1);
 845                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 846                     putenv(env_str);
 847                 }
 848             }
 849 #endif
 850         }
 851     } else {
 852         Config2.effectiveUserID = geteuid();
 853         Config2.effectiveGroupID = getegid();
 854     }
 855
 856     if (NULL != Config.effectiveGroup) {
 857
 858         struct group *grp = getgrnam(Config.effectiveGroup);
 859
 860         if (NULL == grp) {
 861             fatalf("getgrnam failed to find groupid for effective group '%s'",
 862                    Config.effectiveGroup);
 863             return;
 864         }
 865
 866         Config2.effectiveGroupID = grp->gr_gid;
 867     }
 868
 869     if (Security::ProxyOutgoingConfig.encryptTransport) {
 870         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 871         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 872         if (!Config.ssl_client.sslContext) {
 873 #if USE_OPENSSL
 874             fatal("ERROR: Could not initialize https:// proxy context");
 875 #else
 876             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 877 #endif
 878         }
 879     }
 880
 881     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 882
 883         // default value for ssldomain= is the peer host/IP
 884         if (p->secure.sslDomain.isEmpty())
 885             p->secure.sslDomain = p->host;
 886
 887         if (p->secure.encryptTransport) {
 888             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 889             p->sslContext = p->secure.createClientContext(true);
 890             if (!p->sslContext) {
 891                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 892                 self_destruct();
 893             }
 894         }
 895     }
 896
 897 #if USE_OPENSSL
 898     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 899         if (!s->secure.encryptTransport)
 900             continue;
 901         debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS context");
 902         s->configureSslServerContext();
 903     }
 904 #endif
 905
 906     // prevent infinite fetch loops in the request parser
 907     // due to buffer full but not enough data recived to finish parse
 908     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 909         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 910                " Change client_request_buffer_max or request_header_max_size limits.",
 911                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 912     }
 913
 914     /*
 915      * Disable client side request pipelining if client_persistent_connections OFF.
 916      * Waste of resources queueing any pipelined requests when the first will close the connection.
 917      */
 918     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 919         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 920                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 921         Config.pipeline_max_prefetch = 0;
 922     }
 923
 924 #if USE_AUTH
 925     /*
 926      * disable client side request pipelining. There is a race with
 927      * Negotiate and NTLM when the client sends a second request on an
 928      * connection before the authenticate challenge is sent. With
 929      * pipelining OFF, the client may fail to authenticate, but squid's
 930      * state will be preserved.
 931      */
 932     if (Config.pipeline_max_prefetch > 0) {
 933         Auth::Config *nego = Auth::Config::Find("Negotiate");
 934         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 935         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 936             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 937             Config.pipeline_max_prefetch = 0;
 938         }
 939     }
 940 #endif
 941 }
 942
 943 /** Parse a line containing an obsolete directive.
 944  * To upgrade it where possible instead of just "Bungled config" for
 945  * directives which cannot be marked as simply aliases of the some name.
 946  * For example if the parameter order and content has changed.
 947  * Or if the directive has been completely removed.
 948  */
 949 void
 950 parse_obsolete(const char *name)
 951 {
 952     // Directives which have been radically changed rather than removed
 953     if (!strcmp(name, "url_rewrite_concurrency")) {
 954         int cval;
 955         parse_int(&cval);
 956         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 957         Config.redirectChildren.concurrency = cval;
 958     }
 959
 960     if (!strcmp(name, "log_access"))
 961         self_destruct();
 962
 963     if (!strcmp(name, "log_icap"))
 964         self_destruct();
 965
 966     if (!strcmp(name, "ignore_ims_on_miss")) {
 967         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 968         // than the 2.7 directive. We need to parse and invert the configured value.
 969         int temp = 0;
 970         parse_onoff(&temp);
 971         Config.onoff.cache_miss_revalidate = !temp;
 972     }
 973
 974     if (!strncmp(name, "sslproxy_", 9)) {
 975         // the replacement directive tls_outgoing_options uses options instead of whole-line input
 976         SBuf tmp;
 977         if (!strcmp(name, "sslproxy_cafile"))
 978             tmp.append("cafile=");
 979         else if (!strcmp(name, "sslproxy_capath"))
 980             tmp.append("capath=");
 981         else if (!strcmp(name, "sslproxy_cipher"))
 982             tmp.append("cipher=");
 983         else if (!strcmp(name, "sslproxy_client_certificate"))
 984             tmp.append("cert=");
 985         else if (!strcmp(name, "sslproxy_client_key"))
 986             tmp.append("key=");
 987         else if (!strcmp(name, "sslproxy_flags"))
 988             tmp.append("flags=");
 989         else if (!strcmp(name, "sslproxy_options"))
 990             tmp.append("options=");
 991         else if (!strcmp(name, "sslproxy_version"))
 992             tmp.append("version=");
 993         else {
 994             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
 995             self_destruct();
 996         }
 997
 998         // add the value as unquoted-string because the old values did not support whitespace
 999         const char *token = ConfigParser::NextQuotedOrToEol();
1000         tmp.append(token, strlen(token));
1001         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1002     }
1003 }
1004
1005 /* Parse a time specification from the config file.  Store the
1006  * result in 'tptr', after converting it to 'units' */
1007 static void
1008 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
1009 {
1010     time_msec_t u;
1011     if ((u = parseTimeUnits(units, allowMsec)) == 0)
1012         self_destruct();
1013
1014     char *token;
1015     if ((token = ConfigParser::NextToken()) == NULL)
1016         self_destruct();
1017
1018     double d = xatof(token);
1019
1020     time_msec_t m = u; /* default to 'units' if none specified */
1021
1022     if (d) {
1023         if ((token = ConfigParser::PeekAtToken()) && (m = parseTimeUnits(token, allowMsec))) {
1024             (void)ConfigParser::NextToken();
1025
1026         } else if (!expectMoreArguments) {
1027             self_destruct();
1028
1029         } else {
1030             token = NULL; // show default units if dying below
1031             debugs(3, DBG_CRITICAL, "WARNING: No units on '" << config_input_line << "', assuming " << d << " " << units);
1032         }
1033     } else
1034         token = NULL; // show default units if dying below.
1035
1036     *tptr = static_cast<time_msec_t>(m * d);
1037
1038     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1039         debugs(3, DBG_CRITICAL, "FATAL: Invalid value '" <<
1040                d << " " << (token ? token : units) << ": integer overflow (time_msec_t).");
1041         self_destruct();
1042     }
1043 }
1044
1045 static uint64_t
1046 parseTimeUnits(const char *unit, bool allowMsec)
1047 {
1048     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1049         return 1;
1050
1051     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1052         return 1000;
1053
1054     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1055         return 60 * 1000;
1056
1057     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1058         return 3600 * 1000;
1059
1060     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1061         return 86400 * 1000;
1062
1063     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1064         return 86400 * 7 * 1000;
1065
1066     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1067         return 86400 * 14 * 1000;
1068
1069     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1070         return static_cast<uint64_t>(86400) * 30 * 1000;
1071
1072     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1073         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1074
1075     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1076         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1077
1078     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1079
1080     return 0;
1081 }
1082
1083 static void
1084 parseBytesLine64(int64_t * bptr, const char *units)
1085 {
1086     char *token;
1087     double d;
1088     int64_t m;
1089     int64_t u;
1090
1091     if ((u = parseBytesUnits(units)) == 0) {
1092         self_destruct();
1093         return;
1094     }
1095
1096     if ((token = ConfigParser::NextToken()) == NULL) {
1097         self_destruct();
1098         return;
1099     }
1100
1101     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1102         *bptr = -1;
1103         return;
1104     }
1105
1106     d = xatof(token);
1107
1108     m = u;          /* default to 'units' if none specified */
1109
1110     if (0.0 == d)
1111         (void) 0;
1112     else if ((token = ConfigParser::NextToken()) == NULL)
1113         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1114                config_input_line << "', assuming " <<
1115                d << " " <<  units  );
1116     else if ((m = parseBytesUnits(token)) == 0) {
1117         self_destruct();
1118         return;
1119     }
1120
1121     *bptr = static_cast<int64_t>(m * d / u);
1122
1123     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1124         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1125                d << " " << token << ": integer overflow (int64_t).");
1126         self_destruct();
1127     }
1128 }
1129
1130 static void
1131 parseBytesLine(size_t * bptr, const char *units)
1132 {
1133     char *token;
1134     double d;
1135     int m;
1136     int u;
1137
1138     if ((u = parseBytesUnits(units)) == 0) {
1139         self_destruct();
1140         return;
1141     }
1142
1143     if ((token = ConfigParser::NextToken()) == NULL) {
1144         self_destruct();
1145         return;
1146     }
1147
1148     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1149         *bptr = static_cast<size_t>(-1);
1150         return;
1151     }
1152
1153     d = xatof(token);
1154
1155     m = u;          /* default to 'units' if none specified */
1156
1157     if (0.0 == d)
1158         (void) 0;
1159     else if ((token = ConfigParser::NextToken()) == NULL)
1160         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1161                config_input_line << "', assuming " <<
1162                d << " " <<  units  );
1163     else if ((m = parseBytesUnits(token)) == 0) {
1164         self_destruct();
1165         return;
1166     }
1167
1168     *bptr = static_cast<size_t>(m * d / u);
1169
1170     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1171         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1172                d << " " << token << ": integer overflow (size_t).");
1173         self_destruct();
1174     }
1175 }
1176
1177 static void
1178 parseBytesLineSigned(ssize_t * bptr, const char *units)
1179 {
1180     char *token;
1181     double d;
1182     int m;
1183     int u;
1184
1185     if ((u = parseBytesUnits(units)) == 0) {
1186         self_destruct();
1187         return;
1188     }
1189
1190     if ((token = ConfigParser::NextToken()) == NULL) {
1191         self_destruct();
1192         return;
1193     }
1194
1195     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1196         *bptr = -1;
1197         return;
1198     }
1199
1200     d = xatof(token);
1201
1202     m = u;          /* default to 'units' if none specified */
1203
1204     if (0.0 == d)
1205         (void) 0;
1206     else if ((token = ConfigParser::NextToken()) == NULL)
1207         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1208                config_input_line << "', assuming " <<
1209                d << " " <<  units  );
1210     else if ((m = parseBytesUnits(token)) == 0) {
1211         self_destruct();
1212         return;
1213     }
1214
1215     *bptr = static_cast<ssize_t>(m * d / u);
1216
1217     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1218         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1219                d << " " << token << ": integer overflow (ssize_t).");
1220         self_destruct();
1221     }
1222 }
1223
1224 /**
1225  * Parse bytes from a string.
1226  * Similar to the parseBytesLine function but parses the string value instead of
1227  * the current token value.
1228  */
1229 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1230 {
1231     int u;
1232     if ((u = parseBytesUnits(units)) == 0) {
1233         self_destruct();
1234         return;
1235     }
1236
1237     // Find number from string beginning.
1238     char const * number_begin = value;
1239     char const * number_end = value;
1240
1241     while ((*number_end >= '0' && *number_end <= '9')) {
1242         ++number_end;
1243     }
1244
1245     String number;
1246     number.limitInit(number_begin, number_end - number_begin);
1247
1248     int d = xatoi(number.termedBuf());
1249     int m;
1250     if ((m = parseBytesUnits(number_end)) == 0) {
1251         self_destruct();
1252         return;
1253     }
1254
1255     *bptr = static_cast<size_t>(m * d / u);
1256     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1257         self_destruct();
1258 }
1259
1260 static size_t
1261 parseBytesUnits(const char *unit)
1262 {
1263     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1264         return 1;
1265
1266     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1267         return 1 << 10;
1268
1269     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1270         return 1 << 20;
1271
1272     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1273         return 1 << 30;
1274
1275     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1276
1277     return 0;
1278 }
1279
1280 static void
1281 dump_SBufList(StoreEntry * entry, const SBufList &words)
1282 {
1283     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1284         entry->append(i->rawContent(), i->length());
1285         entry->append(" ",1);
1286     }
1287     entry->append("\n",1);
1288 }
1289
1290 static void
1291 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1292 {
1293     while (ae != NULL) {
1294         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1295         storeAppendPrintf(entry, "%s %s %s %s ",
1296                           name,
1297                           ae->name,
1298                           ae->typeString(),
1299                           ae->flags.flagsStr());
1300         dump_SBufList(entry, ae->dump());
1301         ae = ae->next;
1302     }
1303 }
1304
1305 static void
1306 parse_acl(ACL ** ae)
1307 {
1308     ACL::ParseAclLine(LegacyParser, ae);
1309 }
1310
1311 static void
1312 free_acl(ACL ** ae)
1313 {
1314     aclDestroyAcls(ae);
1315 }
1316
1317 void
1318 dump_acl_list(StoreEntry * entry, ACLList * head)
1319 {
1320     dump_SBufList(entry, head->dump());
1321 }
1322
1323 void
1324 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1325 {
1326     if (head)
1327         dump_SBufList(entry, head->treeDump(name,NULL));
1328 }
1329
1330 static void
1331 parse_acl_access(acl_access ** head)
1332 {
1333     aclParseAccessLine(cfg_directive, LegacyParser, head);
1334 }
1335
1336 static void
1337 free_acl_access(acl_access ** head)
1338 {
1339     aclDestroyAccessList(head);
1340 }
1341
1342 static void
1343 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1344 {
1345     char buf[MAX_IPSTRLEN];
1346     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1347 }
1348
1349 static void
1350 parse_address(Ip::Address *addr)
1351 {
1352     char *token = ConfigParser::NextToken();
1353
1354     if (!token) {
1355         self_destruct();
1356         return;
1357     }
1358
1359     if (!strcmp(token,"any_addr"))
1360         addr->setAnyAddr();
1361     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1362         addr->setNoAddr();
1363     else if ( (*addr = token) ) // try parse numeric/IPA
1364         (void) 0;
1365     else if (addr->GetHostByName(token)) // dont use ipcache
1366         (void) 0;
1367     else { // not an IP and not a hostname
1368         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1369         self_destruct();
1370     }
1371 }
1372
1373 static void
1374 free_address(Ip::Address *addr)
1375 {
1376     addr->setEmpty();
1377 }
1378
1379 static void
1380 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1381 {
1382     char buf[MAX_IPSTRLEN];
1383
1384     for (Acl::Address *l = head; l; l = l->next) {
1385         if (!l->addr.isAnyAddr())
1386             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1387         else
1388             storeAppendPrintf(entry, "%s autoselect", name);
1389
1390         dump_acl_list(entry, l->aclList);
1391
1392         storeAppendPrintf(entry, "\n");
1393     }
1394 }
1395
1396 static void
1397 parse_acl_address(Acl::Address ** head)
1398 {
1399     Acl::Address *l = new Acl::Address;
1400     parse_address(&l->addr);
1401     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1402
1403     Acl::Address **tail = head;
1404     while (*tail)
1405         tail = &(*tail)->next;
1406
1407     *tail = l;
1408 }
1409
1410 static void
1411 free_acl_address(Acl::Address ** head)
1412 {
1413     delete *head;
1414     *head = NULL;
1415 }
1416
1417 static void
1418 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1419 {
1420     acl_tos *l;
1421
1422     for (l = head; l; l = l->next) {
1423         if (l->tos > 0)
1424             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1425         else
1426             storeAppendPrintf(entry, "%s none", name);
1427
1428         dump_acl_list(entry, l->aclList);
1429
1430         storeAppendPrintf(entry, "\n");
1431     }
1432 }
1433
1434 static void
1435 parse_acl_tos(acl_tos ** head)
1436 {
1437     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1438     char *token = ConfigParser::NextToken();
1439
1440     if (!token) {
1441         self_destruct();
1442         return;
1443     }
1444
1445     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1446         self_destruct();
1447         return;
1448     }
1449
1450     const unsigned int chTos = tos & 0xFC;
1451     if (chTos != tos) {
1452         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1453         tos = chTos;
1454     }
1455
1456     acl_tos *l = new acl_tos;
1457
1458     l->tos = (tos_t)tos;
1459
1460     aclParseAclList(LegacyParser, &l->aclList, token);
1461
1462     acl_tos **tail = head;  /* sane name below */
1463     while (*tail)
1464         tail = &(*tail)->next;
1465
1466     *tail = l;
1467 }
1468
1469 static void
1470 free_acl_tos(acl_tos ** head)
1471 {
1472     delete *head;
1473     head = NULL;
1474 }
1475
1476 #if SO_MARK && USE_LIBCAP
1477
1478 static void
1479 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1480 {
1481     for (acl_nfmark *l = head; l; l = l->next) {
1482         if (l->nfmark > 0)
1483             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1484         else
1485             storeAppendPrintf(entry, "%s none", name);
1486
1487         dump_acl_list(entry, l->aclList);
1488
1489         storeAppendPrintf(entry, "\n");
1490     }
1491 }
1492
1493 static void
1494 parse_acl_nfmark(acl_nfmark ** head)
1495 {
1496     nfmark_t mark;
1497     char *token = ConfigParser::NextToken();
1498
1499     if (!token) {
1500         self_destruct();
1501         return;
1502     }
1503
1504     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1505         self_destruct();
1506         return;
1507     }
1508
1509     acl_nfmark *l = new acl_nfmark;
1510
1511     l->nfmark = mark;
1512
1513     aclParseAclList(LegacyParser, &l->aclList, token);
1514
1515     acl_nfmark **tail = head;   /* sane name below */
1516     while (*tail)
1517         tail = &(*tail)->next;
1518
1519     *tail = l;
1520 }
1521
1522 static void
1523 free_acl_nfmark(acl_nfmark ** head)
1524 {
1525     delete *head;
1526     head = NULL;
1527 }
1528 #endif /* SO_MARK */
1529
1530 static void
1531 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1532 {
1533     for (AclSizeLimit *l = head; l; l = l->next) {
1534         if (l->size != -1)
1535             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1536         else
1537             storeAppendPrintf(entry, "%s none", name);
1538
1539         dump_acl_list(entry, l->aclList);
1540
1541         storeAppendPrintf(entry, "\n");
1542     }
1543 }
1544
1545 static void
1546 parse_acl_b_size_t(AclSizeLimit ** head)
1547 {
1548     AclSizeLimit *l = new AclSizeLimit;
1549
1550     parse_b_int64_t(&l->size);
1551
1552     aclParseAclList(LegacyParser, &l->aclList, l->size);
1553
1554     AclSizeLimit **tail = head; /* sane name below */
1555     while (*tail)
1556         tail = &(*tail)->next;
1557
1558     *tail = l;
1559 }
1560
1561 static void
1562 free_acl_b_size_t(AclSizeLimit ** head)
1563 {
1564     delete *head;
1565     *head = NULL;
1566 }
1567
1568 #if USE_DELAY_POOLS
1569
1570 #include "DelayConfig.h"
1571 #include "DelayPools.h"
1572 /* do nothing - free_delay_pool_count is the magic free function.
1573  * this is why delay_pool_count isn't just marked TYPE: u_short
1574  */
1575 #define free_delay_pool_class(X)
1576 #define free_delay_pool_access(X)
1577 #define free_delay_pool_rates(X)
1578 #define dump_delay_pool_class(X, Y, Z)
1579 #define dump_delay_pool_access(X, Y, Z)
1580 #define dump_delay_pool_rates(X, Y, Z)
1581
1582 static void
1583 free_delay_pool_count(DelayConfig * cfg)
1584 {
1585     cfg->freePoolCount();
1586 }
1587
1588 static void
1589 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1590 {
1591     cfg.dumpPoolCount (entry, name);
1592 }
1593
1594 static void
1595 parse_delay_pool_count(DelayConfig * cfg)
1596 {
1597     cfg->parsePoolCount();
1598 }
1599
1600 static void
1601 parse_delay_pool_class(DelayConfig * cfg)
1602 {
1603     cfg->parsePoolClass();
1604 }
1605
1606 static void
1607 parse_delay_pool_rates(DelayConfig * cfg)
1608 {
1609     cfg->parsePoolRates();
1610 }
1611
1612 static void
1613 parse_delay_pool_access(DelayConfig * cfg)
1614 {
1615     cfg->parsePoolAccess(LegacyParser);
1616 }
1617
1618 #endif
1619
1620 #if USE_DELAY_POOLS
1621 #include "ClientDelayConfig.h"
1622 /* do nothing - free_client_delay_pool_count is the magic free function.
1623  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1624  */
1625
1626 #define free_client_delay_pool_access(X)
1627 #define free_client_delay_pool_rates(X)
1628 #define dump_client_delay_pool_access(X, Y, Z)
1629 #define dump_client_delay_pool_rates(X, Y, Z)
1630
1631 static void
1632 free_client_delay_pool_count(ClientDelayConfig * cfg)
1633 {
1634     cfg->freePoolCount();
1635 }
1636
1637 static void
1638 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1639 {
1640     cfg.dumpPoolCount (entry, name);
1641 }
1642
1643 static void
1644 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1645 {
1646     cfg->parsePoolCount();
1647 }
1648
1649 static void
1650 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1651 {
1652     cfg->parsePoolRates();
1653 }
1654
1655 static void
1656 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1657 {
1658     cfg->parsePoolAccess(LegacyParser);
1659 }
1660 #endif
1661
1662 #if USE_HTTP_VIOLATIONS
1663 static void
1664 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1665 {
1666     if (manglers)
1667         manglers->dumpAccess(entry, name);
1668 }
1669
1670 static void
1671 parse_http_header_access(HeaderManglers **pm)
1672 {
1673     char *t = NULL;
1674
1675     if ((t = ConfigParser::NextToken()) == NULL) {
1676         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1677         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1678         return;
1679     }
1680
1681     if (!*pm)
1682         *pm = new HeaderManglers;
1683     HeaderManglers *manglers = *pm;
1684     headerMangler *mangler = manglers->track(t);
1685     assert(mangler);
1686
1687     std::string directive = "http_header_access ";
1688     directive += t;
1689     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1690 }
1691
1692 static void
1693 free_HeaderManglers(HeaderManglers **pm)
1694 {
1695     // we delete the entire http_header_* mangler configuration at once
1696     if (const HeaderManglers *manglers = *pm) {
1697         delete manglers;
1698         *pm = NULL;
1699     }
1700 }
1701
1702 static void
1703 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1704 {
1705     if (manglers)
1706         manglers->dumpReplacement(entry, name);
1707 }
1708
1709 static void
1710 parse_http_header_replace(HeaderManglers **pm)
1711 {
1712     char *t = NULL;
1713
1714     if ((t = ConfigParser::NextToken()) == NULL) {
1715         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1716         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1717         return;
1718     }
1719
1720     const char *value = ConfigParser::NextQuotedOrToEol();
1721
1722     if (!*pm)
1723         *pm = new HeaderManglers;
1724     HeaderManglers *manglers = *pm;
1725     manglers->setReplacement(t, value);
1726 }
1727
1728 #endif
1729
1730 static void
1731 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1732 {
1733     SwapDir *s;
1734     int i;
1735     assert (entry);
1736
1737     for (i = 0; i < swap.n_configured; ++i) {
1738         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1739         if (!s) continue;
1740         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1741         s->dump(*entry);
1742         storeAppendPrintf(entry, "\n");
1743     }
1744 }
1745
1746 static int
1747 check_null_string(char *s)
1748 {
1749     return s == NULL;
1750 }
1751
1752 #if USE_AUTH
1753 static void
1754 parse_authparam(Auth::ConfigVector * config)
1755 {
1756     char *type_str;
1757     char *param_str;
1758
1759     if ((type_str = ConfigParser::NextToken()) == NULL)
1760         self_destruct();
1761
1762     if ((param_str = ConfigParser::NextToken()) == NULL)
1763         self_destruct();
1764
1765     /* find a configuration for the scheme in the currently parsed configs... */
1766     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1767
1768     if (schemeCfg == NULL) {
1769         /* Create a configuration based on the scheme info */
1770         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1771
1772         if (theScheme == NULL) {
1773             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1774             self_destruct();
1775         }
1776
1777         config->push_back(theScheme->createConfig());
1778         schemeCfg = Auth::Config::Find(type_str);
1779         if (schemeCfg == NULL) {
1780             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1781             self_destruct();
1782         }
1783     }
1784
1785     schemeCfg->parse(schemeCfg, config->size(), param_str);
1786 }
1787
1788 static void
1789 free_authparam(Auth::ConfigVector * cfg)
1790 {
1791     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1792     cfg->clear();
1793
1794     /* on reconfigure initialize new auth schemes for the new config. */
1795     if (reconfiguring) {
1796         Auth::Init();
1797     }
1798 }
1799
1800 static void
1801 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1802 {
1803     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1804         (*i)->dump(entry, name, (*i));
1805 }
1806 #endif /* USE_AUTH */
1807
1808 /* TODO: just return the object, the # is irrelevant */
1809 static int
1810 find_fstype(char *type)
1811 {
1812     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1813         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1814             return (int)i;
1815
1816     return (-1);
1817 }
1818
1819 static void
1820 parse_cachedir(Store::DiskConfig *swap)
1821 {
1822     char *type_str;
1823     char *path_str;
1824     RefCount<SwapDir> sd;
1825     int i;
1826     int fs;
1827
1828     if ((type_str = ConfigParser::NextToken()) == NULL)
1829         self_destruct();
1830
1831     if ((path_str = ConfigParser::NextToken()) == NULL)
1832         self_destruct();
1833
1834     fs = find_fstype(type_str);
1835
1836     if (fs < 0) {
1837         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1838         return;
1839     }
1840
1841     /* reconfigure existing dir */
1842
1843     for (i = 0; i < swap->n_configured; ++i) {
1844         assert (swap->swapDirs[i].getRaw());
1845
1846         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1847             /* this is specific to on-fs Stores. The right
1848              * way to handle this is probably to have a mapping
1849              * from paths to stores, and have on-fs stores
1850              * register with that, and lookip in that in their
1851              * own setup logic. RBC 20041225. TODO.
1852              */
1853
1854             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1855
1856             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1857                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1858                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1859                 return;
1860             }
1861
1862             sd->reconfigure();
1863             return;
1864         }
1865     }
1866
1867     /* new cache_dir */
1868     if (swap->n_configured > 63) {
1869         /* 7 bits, signed */
1870         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1871         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1872         self_destruct();
1873         return;
1874     }
1875
1876     allocate_new_swapdir(swap);
1877
1878     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1879
1880     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1881
1882     /* parse the FS parameters and options */
1883     sd->parse(swap->n_configured, path_str);
1884
1885     ++swap->n_configured;
1886 }
1887
1888 static const char *
1889 peer_type_str(const peer_t type)
1890 {
1891     const char * result;
1892
1893     switch (type) {
1894
1895     case PEER_PARENT:
1896         result = "parent";
1897         break;
1898
1899     case PEER_SIBLING:
1900         result = "sibling";
1901         break;
1902
1903     case PEER_MULTICAST:
1904         result = "multicast";
1905         break;
1906
1907     default:
1908         result = "unknown";
1909         break;
1910     }
1911
1912     return result;
1913 }
1914
1915 static void
1916 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1917 {
1918     NeighborTypeDomainList *t;
1919     LOCAL_ARRAY(char, xname, 128);
1920
1921     while (p != NULL) {
1922         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1923                           name,
1924                           p->host,
1925                           neighborTypeStr(p),
1926                           p->http_port,
1927                           p->icp.port,
1928                           p->name);
1929         dump_peer_options(entry, p);
1930
1931         if (p->access) {
1932             snprintf(xname, 128, "cache_peer_access %s", p->name);
1933             dump_acl_access(entry, xname, p->access);
1934         }
1935
1936         for (t = p->typelist; t; t = t->next) {
1937             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1938                               p->host,
1939                               peer_type_str(t->type),
1940                               t->domain);
1941         }
1942
1943         p = p->next;
1944     }
1945 }
1946
1947 /**
1948  * utility function to prevent getservbyname() being called with a numeric value
1949  * on Windows at least it returns garage results.
1950  */
1951 static bool
1952 isUnsignedNumeric(const char *str, size_t len)
1953 {
1954     if (len < 1) return false;
1955
1956     for (; len >0 && *str; ++str, --len) {
1957         if (! isdigit(*str))
1958             return false;
1959     }
1960     return true;
1961 }
1962
1963 /**
1964  \param proto   'tcp' or 'udp' for protocol
1965  \returns       Port the named service is supposed to be listening on.
1966  */
1967 static unsigned short
1968 GetService(const char *proto)
1969 {
1970     struct servent *port = NULL;
1971     /** Parses a port number or service name from the squid.conf */
1972     char *token = ConfigParser::NextToken();
1973     if (token == NULL) {
1974         self_destruct();
1975         return 0; /* NEVER REACHED */
1976     }
1977     /** Returns either the service port number from /etc/services */
1978     if ( !isUnsignedNumeric(token, strlen(token)) )
1979         port = getservbyname(token, proto);
1980     if (port != NULL) {
1981         return ntohs((unsigned short)port->s_port);
1982     }
1983     /** Or a numeric translation of the config text. */
1984     return xatos(token);
1985 }
1986
1987 /**
1988  \returns       Port the named TCP service is supposed to be listening on.
1989  \copydoc GetService(const char *proto)
1990  */
1991 inline unsigned short
1992 GetTcpService(void)
1993 {
1994     return GetService("tcp");
1995 }
1996
1997 /**
1998  \returns       Port the named UDP service is supposed to be listening on.
1999  \copydoc GetService(const char *proto)
2000  */
2001 inline unsigned short
2002 GetUdpService(void)
2003 {
2004     return GetService("udp");
2005 }
2006
2007 static void
2008 parse_peer(CachePeer ** head)
2009 {
2010     char *token = NULL;
2011     CachePeer *p = new CachePeer;
2012
2013     if ((token = ConfigParser::NextToken()) == NULL)
2014         self_destruct();
2015
2016     p->host = xstrdup(token);
2017
2018     p->name = xstrdup(token);
2019
2020     if ((token = ConfigParser::NextToken()) == NULL)
2021         self_destruct();
2022
2023     p->type = parseNeighborType(token);
2024
2025     if (p->type == PEER_MULTICAST) {
2026         p->options.no_digest = true;
2027         p->options.no_netdb_exchange = true;
2028     }
2029
2030     p->http_port = GetTcpService();
2031
2032     if (!p->http_port)
2033         self_destruct();
2034
2035     p->icp.port = GetUdpService();
2036
2037     while ((token = ConfigParser::NextToken())) {
2038         if (!strcmp(token, "proxy-only")) {
2039             p->options.proxy_only = true;
2040         } else if (!strcmp(token, "no-query")) {
2041             p->options.no_query = true;
2042         } else if (!strcmp(token, "background-ping")) {
2043             p->options.background_ping = true;
2044         } else if (!strcmp(token, "no-digest")) {
2045             p->options.no_digest = true;
2046         } else if (!strcmp(token, "no-tproxy")) {
2047             p->options.no_tproxy = true;
2048         } else if (!strcmp(token, "multicast-responder")) {
2049             p->options.mcast_responder = true;
2050 #if PEER_MULTICAST_SIBLINGS
2051         } else if (!strcmp(token, "multicast-siblings")) {
2052             p->options.mcast_siblings = true;
2053 #endif
2054         } else if (!strncmp(token, "weight=", 7)) {
2055             p->weight = xatoi(token + 7);
2056         } else if (!strncmp(token, "basetime=", 9)) {
2057             p->basetime = xatoi(token + 9);
2058         } else if (!strcmp(token, "closest-only")) {
2059             p->options.closest_only = true;
2060         } else if (!strncmp(token, "ttl=", 4)) {
2061             p->mcast.ttl = xatoi(token + 4);
2062
2063             if (p->mcast.ttl < 0)
2064                 p->mcast.ttl = 0;
2065
2066             if (p->mcast.ttl > 128)
2067                 p->mcast.ttl = 128;
2068         } else if (!strcmp(token, "default")) {
2069             p->options.default_parent = true;
2070         } else if (!strcmp(token, "round-robin")) {
2071             p->options.roundrobin = true;
2072         } else if (!strcmp(token, "weighted-round-robin")) {
2073             p->options.weighted_roundrobin = true;
2074 #if USE_HTCP
2075         } else if (!strcmp(token, "htcp")) {
2076             p->options.htcp = true;
2077         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2078             /* Note: The htcp- form is deprecated, replaced by htcp= */
2079             p->options.htcp = true;
2080             char *tmp = xstrdup(token+5);
2081             char *mode, *nextmode;
2082             for (mode = nextmode = tmp; mode; mode = nextmode) {
2083                 nextmode = strchr(mode, ',');
2084                 if (nextmode) {
2085                     *nextmode = '\0';
2086                     ++nextmode;
2087                 }
2088                 if (!strcmp(mode, "no-clr")) {
2089                     if (p->options.htcp_only_clr)
2090                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2091                     p->options.htcp_no_clr = true;
2092                 } else if (!strcmp(mode, "no-purge-clr")) {
2093                     p->options.htcp_no_purge_clr = true;
2094                 } else if (!strcmp(mode, "only-clr")) {
2095                     if (p->options.htcp_no_clr)
2096                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2097                     p->options.htcp_only_clr = true;
2098                 } else if (!strcmp(mode, "forward-clr")) {
2099                     p->options.htcp_forward_clr = true;
2100                 } else if (!strcmp(mode, "oldsquid")) {
2101                     p->options.htcp_oldsquid = true;
2102                 } else {
2103                     fatalf("invalid HTCP mode '%s'", mode);
2104                 }
2105             }
2106             safe_free(tmp);
2107 #endif
2108         } else if (!strcmp(token, "no-netdb-exchange")) {
2109             p->options.no_netdb_exchange = true;
2110
2111         } else if (!strcmp(token, "carp")) {
2112             if (p->type != PEER_PARENT)
2113                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2114
2115             p->options.carp = true;
2116         } else if (!strncmp(token, "carp-key=", 9)) {
2117             if (p->options.carp != true)
2118                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2119             p->options.carp_key.set = true;
2120             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2121             for (; key; key = nextkey) {
2122                 nextkey=strchr(key,',');
2123                 if (nextkey) ++nextkey; // skip the comma, any
2124                 if (0==strncmp(key,"scheme",6)) {
2125                     p->options.carp_key.scheme = true;
2126                 } else if (0==strncmp(key,"host",4)) {
2127                     p->options.carp_key.host = true;
2128                 } else if (0==strncmp(key,"port",4)) {
2129                     p->options.carp_key.port = true;
2130                 } else if (0==strncmp(key,"path",4)) {
2131                     p->options.carp_key.path = true;
2132                 } else if (0==strncmp(key,"params",6)) {
2133                     p->options.carp_key.params = true;
2134                 } else {
2135                     fatalf("invalid carp-key '%s'",key);
2136                 }
2137             }
2138         } else if (!strcmp(token, "userhash")) {
2139 #if USE_AUTH
2140             if (p->type != PEER_PARENT)
2141                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2142
2143             p->options.userhash = true;
2144 #else
2145             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2146 #endif
2147         } else if (!strcmp(token, "sourcehash")) {
2148             if (p->type != PEER_PARENT)
2149                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2150
2151             p->options.sourcehash = true;
2152
2153         } else if (!strcmp(token, "no-delay")) {
2154 #if USE_DELAY_POOLS
2155             p->options.no_delay = true;
2156 #else
2157             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2158 #endif
2159         } else if (!strncmp(token, "login=", 6)) {
2160             p->login = xstrdup(token + 6);
2161             rfc1738_unescape(p->login);
2162         } else if (!strncmp(token, "connect-timeout=", 16)) {
2163             p->connect_timeout = xatoi(token + 16);
2164         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2165             p->connect_fail_limit = xatoi(token + 19);
2166 #if USE_CACHE_DIGESTS
2167         } else if (!strncmp(token, "digest-url=", 11)) {
2168             p->digest_url = xstrdup(token + 11);
2169 #endif
2170
2171         } else if (!strcmp(token, "allow-miss")) {
2172             p->options.allow_miss = true;
2173         } else if (!strncmp(token, "max-conn=", 9)) {
2174             p->max_conn = xatoi(token + 9);
2175         } else if (!strncmp(token, "standby=", 8)) {
2176             p->standby.limit = xatoi(token + 8);
2177         } else if (!strcmp(token, "originserver")) {
2178             p->options.originserver = true;
2179         } else if (!strncmp(token, "name=", 5)) {
2180             safe_free(p->name);
2181
2182             if (token[5])
2183                 p->name = xstrdup(token + 5);
2184         } else if (!strncmp(token, "forceddomain=", 13)) {
2185             safe_free(p->domain);
2186             if (token[13])
2187                 p->domain = xstrdup(token + 13);
2188
2189         } else if (strncmp(token, "ssl", 3) == 0) {
2190 #if !USE_OPENSSL
2191             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2192 #else
2193             p->secure.parse(token+3);
2194 #endif
2195         } else if (strncmp(token, "tls-", 4) == 0) {
2196             p->secure.parse(token+4);
2197         } else if (strcmp(token, "front-end-https") == 0) {
2198             p->front_end_https = 1;
2199         } else if (strcmp(token, "front-end-https=on") == 0) {
2200             p->front_end_https = 1;
2201         } else if (strcmp(token, "front-end-https=auto") == 0) {
2202             p->front_end_https = 2;
2203         } else if (strcmp(token, "connection-auth=off") == 0) {
2204             p->connection_auth = 0;
2205         } else if (strcmp(token, "connection-auth") == 0) {
2206             p->connection_auth = 1;
2207         } else if (strcmp(token, "connection-auth=on") == 0) {
2208             p->connection_auth = 1;
2209         } else if (strcmp(token, "connection-auth=auto") == 0) {
2210             p->connection_auth = 2;
2211         } else if (token[0] == '#') {
2212             // start of a text comment. stop reading this line.
2213             break;
2214         } else {
2215             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2216         }
2217     }
2218
2219     if (peerFindByName(p->name))
2220         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2221
2222     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2223         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2224
2225     if (p->weight < 1)
2226         p->weight = 1;
2227
2228     if (p->connect_fail_limit < 1)
2229         p->connect_fail_limit = 10;
2230
2231 #if USE_CACHE_DIGESTS
2232
2233     if (!p->options.no_digest) {
2234         /* XXX This looks odd.. who has the original pointer
2235          * then?
2236          */
2237         PeerDigest *pd = peerDigestCreate(p);
2238         p->digest = cbdataReference(pd);
2239     }
2240
2241 #endif
2242
2243     p->index =  ++Config.npeers;
2244
2245     while (*head != NULL)
2246         head = &(*head)->next;
2247
2248     *head = p;
2249
2250     peerClearRRStart();
2251 }
2252
2253 static void
2254 free_peer(CachePeer ** P)
2255 {
2256     delete *P;
2257     *P = NULL;
2258     Config.npeers = 0;
2259 }
2260
2261 static void
2262 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2263 {
2264     wordlist *w;
2265
2266     while (list != NULL) {
2267         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2268             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2269         else
2270             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2271
2272         for (w = list->actions; w != NULL; w = w->next) {
2273             storeAppendPrintf(entry, " %s", w->key);
2274         }
2275
2276         storeAppendPrintf(entry, "\n");
2277         list = list->next;
2278     }
2279 }
2280
2281 static void
2282 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2283 {
2284     char *passwd = NULL;
2285     wordlist *actions = NULL;
2286     Mgr::ActionPasswordList *p;
2287     Mgr::ActionPasswordList **P;
2288     parse_string(&passwd);
2289     parse_wordlist(&actions);
2290     p = new Mgr::ActionPasswordList;
2291     p->passwd = passwd;
2292     p->actions = actions;
2293
2294     for (P = head; *P; P = &(*P)->next) {
2295         /*
2296          * See if any of the actions from this line already have a
2297          * password from previous lines.  The password checking
2298          * routines in cache_manager.c take the the password from
2299          * the first Mgr::ActionPasswordList that contains the
2300          * requested action.  Thus, we should warn users who might
2301          * think they can have two passwords for the same action.
2302          */
2303         wordlist *w;
2304         wordlist *u;
2305
2306         for (w = (*P)->actions; w; w = w->next) {
2307             for (u = actions; u; u = u->next) {
2308                 if (strcmp(w->key, u->key))
2309                     continue;
2310
2311                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2312             }
2313         }
2314     }
2315
2316     *P = p;
2317 }
2318
2319 static void
2320 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2321 {
2322     Mgr::ActionPasswordList *p;
2323
2324     while ((p = *head) != NULL) {
2325         *head = p->next;
2326         xfree(p->passwd);
2327         wordlistDestroy(&p->actions);
2328         xfree(p);
2329     }
2330 }
2331
2332 static void
2333 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2334 {
2335     AclNameList *a;
2336
2337     while (var != NULL) {
2338         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2339
2340         for (a = var->acl_list; a != NULL; a = a->next)
2341             storeAppendPrintf(entry, " %s", a->name);
2342
2343         storeAppendPrintf(entry, "\n");
2344
2345         var = var->next;
2346     }
2347 }
2348
2349 static void
2350 parse_denyinfo(AclDenyInfoList ** var)
2351 {
2352     aclParseDenyInfoLine(var);
2353 }
2354
2355 void
2356 free_denyinfo(AclDenyInfoList ** list)
2357 {
2358     AclDenyInfoList *a = NULL;
2359     AclDenyInfoList *a_next = NULL;
2360     AclNameList *l = NULL;
2361     AclNameList *l_next = NULL;
2362
2363     for (a = *list; a; a = a_next) {
2364         for (l = a->acl_list; l; l = l_next) {
2365             l_next = l->next;
2366             memFree(l, MEM_ACL_NAME_LIST);
2367             l = NULL;
2368         }
2369
2370         a_next = a->next;
2371         memFree(a, MEM_ACL_DENY_INFO_LIST);
2372         a = NULL;
2373     }
2374
2375     *list = NULL;
2376 }
2377
2378 static void
2379 parse_peer_access(void)
2380 {
2381     char *host = NULL;
2382     CachePeer *p;
2383
2384     if (!(host = ConfigParser::NextToken()))
2385         self_destruct();
2386
2387     if ((p = peerFindByName(host)) == NULL) {
2388         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2389         return;
2390     }
2391
2392     std::string directive = "peer_access ";
2393     directive += host;
2394     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2395 }
2396
2397 static void
2398 parse_hostdomaintype(void)
2399 {
2400     char *host = NULL;
2401     char *type = NULL;
2402     char *domain = NULL;
2403
2404     if (!(host = ConfigParser::NextToken()))
2405         self_destruct();
2406
2407     if (!(type = ConfigParser::NextToken()))
2408         self_destruct();
2409
2410     while ((domain = ConfigParser::NextToken())) {
2411         NeighborTypeDomainList *l = NULL;
2412         NeighborTypeDomainList **L = NULL;
2413         CachePeer *p;
2414
2415         if ((p = peerFindByName(host)) == NULL) {
2416             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2417             return;
2418         }
2419
2420         l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2421         l->type = parseNeighborType(type);
2422         l->domain = xstrdup(domain);
2423
2424         for (L = &(p->typelist); *L; L = &((*L)->next));
2425         *L = l;
2426     }
2427 }
2428
2429 static void
2430 dump_int(StoreEntry * entry, const char *name, int var)
2431 {
2432     storeAppendPrintf(entry, "%s %d\n", name, var);
2433 }
2434
2435 void
2436 parse_int(int *var)
2437 {
2438     int i;
2439     i = GetInteger();
2440     *var = i;
2441 }
2442
2443 static void
2444 free_int(int *var)
2445 {
2446     *var = 0;
2447 }
2448
2449 static void
2450 dump_onoff(StoreEntry * entry, const char *name, int var)
2451 {
2452     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2453 }
2454
2455 void
2456 parse_onoff(int *var)
2457 {
2458     char *token = ConfigParser::NextToken();
2459
2460     if (token == NULL)
2461         self_destruct();
2462
2463     if (!strcmp(token, "on")) {
2464         *var = 1;
2465     } else if (!strcmp(token, "enable")) {
2466         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2467         *var = 1;
2468     } else if (!strcmp(token, "off")) {
2469         *var = 0;
2470     } else if (!strcmp(token, "disable")) {
2471         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2472         *var = 0;
2473     } else {
2474         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2475         self_destruct();
2476     }
2477 }
2478
2479 #define free_onoff free_int
2480
2481 static void
2482 dump_tristate(StoreEntry * entry, const char *name, int var)
2483 {
2484     const char *state;
2485
2486     if (var > 0)
2487         state = "on";
2488     else if (var < 0)
2489         state = "warn";
2490     else
2491         state = "off";
2492
2493     storeAppendPrintf(entry, "%s %s\n", name, state);
2494 }
2495
2496 static void
2497 parse_tristate(int *var)
2498 {
2499     char *token = ConfigParser::NextToken();
2500
2501     if (token == NULL)
2502         self_destruct();
2503
2504     if (!strcmp(token, "on")) {
2505         *var = 1;
2506     } else if (!strcmp(token, "enable")) {
2507         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2508         *var = 1;
2509     } else if (!strcmp(token, "warn")) {
2510         *var = -1;
2511     } else if (!strcmp(token, "off")) {
2512         *var = 0;
2513     } else if (!strcmp(token, "disable")) {
2514         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2515         *var = 0;
2516     } else {
2517         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2518         self_destruct();
2519     }
2520 }
2521
2522 #define free_tristate free_int
2523
2524 void
2525 parse_pipelinePrefetch(int *var)
2526 {
2527     char *token = ConfigParser::PeekAtToken();
2528
2529     if (token == NULL)
2530         self_destruct();
2531
2532     if (!strcmp(token, "on")) {
2533         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2534         *var = 1;
2535         //pop the token
2536         (void)ConfigParser::NextToken();
2537     } else if (!strcmp(token, "off")) {
2538         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2539         *var = 0;
2540         //pop the token
2541         (void)ConfigParser::NextToken();
2542     } else
2543         parse_int(var);
2544 }
2545
2546 #define free_pipelinePrefetch free_int
2547 #define dump_pipelinePrefetch dump_int
2548
2549 static void
2550 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2551 {
2552     while (head != NULL) {
2553         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2554                           name,
2555                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2556                           head->pattern.c_str(),
2557                           (int) head->min / 60,
2558                           (int) (100.0 * head->pct + 0.5),
2559                           (int) head->max / 60);
2560
2561         if (head->max_stale >= 0)
2562             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2563
2564         if (head->flags.refresh_ims)
2565             storeAppendPrintf(entry, " refresh-ims");
2566
2567         if (head->flags.store_stale)
2568             storeAppendPrintf(entry, " store-stale");
2569
2570 #if USE_HTTP_VIOLATIONS
2571
2572         if (head->flags.override_expire)
2573             storeAppendPrintf(entry, " override-expire");
2574
2575         if (head->flags.override_lastmod)
2576             storeAppendPrintf(entry, " override-lastmod");
2577
2578         if (head->flags.reload_into_ims)
2579             storeAppendPrintf(entry, " reload-into-ims");
2580
2581         if (head->flags.ignore_reload)
2582             storeAppendPrintf(entry, " ignore-reload");
2583
2584         if (head->flags.ignore_no_store)
2585             storeAppendPrintf(entry, " ignore-no-store");
2586
2587         if (head->flags.ignore_private)
2588             storeAppendPrintf(entry, " ignore-private");
2589 #endif
2590
2591         storeAppendPrintf(entry, "\n");
2592
2593         head = head->next;
2594     }
2595 }
2596
2597 static void
2598 parse_refreshpattern(RefreshPattern ** head)
2599 {
2600     char *token;
2601     char *pattern;
2602     time_t min = 0;
2603     double pct = 0.0;
2604     time_t max = 0;
2605     int refresh_ims = 0;
2606     int store_stale = 0;
2607     int max_stale = -1;
2608
2609 #if USE_HTTP_VIOLATIONS
2610
2611     int override_expire = 0;
2612     int override_lastmod = 0;
2613     int reload_into_ims = 0;
2614     int ignore_reload = 0;
2615     int ignore_no_store = 0;
2616     int ignore_private = 0;
2617 #endif
2618
2619     int i;
2620     RefreshPattern *t;
2621     regex_t comp;
2622     int errcode;
2623     int flags = REG_EXTENDED | REG_NOSUB;
2624
2625     if ((token = ConfigParser::RegexPattern()) != NULL) {
2626
2627         if (strcmp(token, "-i") == 0) {
2628             flags |= REG_ICASE;
2629             token = ConfigParser::RegexPattern();
2630         } else if (strcmp(token, "+i") == 0) {
2631             flags &= ~REG_ICASE;
2632             token = ConfigParser::RegexPattern();
2633         }
2634
2635     }
2636
2637     if (token == NULL) {
2638         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2639         self_destruct();
2640         return;
2641     }
2642
2643     pattern = xstrdup(token);
2644
2645     i = GetInteger();       /* token: min */
2646
2647     /* catch negative and insanely huge values close to 32-bit wrap */
2648     if (i < 0) {
2649         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2650         i = 0;
2651     }
2652     if (i > 60*24*365) {
2653         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2654         i = 60*24*365;
2655     }
2656
2657     min = (time_t) (i * 60);    /* convert minutes to seconds */
2658
2659     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2660
2661     i = GetInteger();       /* token: max */
2662
2663     /* catch negative and insanely huge values close to 32-bit wrap */
2664     if (i < 0) {
2665         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2666         i = 0;
2667     }
2668     if (i > 60*24*365) {
2669         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2670         i = 60*24*365;
2671     }
2672
2673     max = (time_t) (i * 60);    /* convert minutes to seconds */
2674
2675     /* Options */
2676     while ((token = ConfigParser::NextToken()) != NULL) {
2677         if (!strcmp(token, "refresh-ims")) {
2678             refresh_ims = 1;
2679         } else if (!strcmp(token, "store-stale")) {
2680             store_stale = 1;
2681         } else if (!strncmp(token, "max-stale=", 10)) {
2682             max_stale = xatoi(token + 10);
2683
2684 #if USE_HTTP_VIOLATIONS
2685
2686         } else if (!strcmp(token, "override-expire"))
2687             override_expire = 1;
2688         else if (!strcmp(token, "override-lastmod"))
2689             override_lastmod = 1;
2690         else if (!strcmp(token, "ignore-no-store"))
2691             ignore_no_store = 1;
2692         else if (!strcmp(token, "ignore-private"))
2693             ignore_private = 1;
2694         else if (!strcmp(token, "reload-into-ims")) {
2695             reload_into_ims = 1;
2696             refresh_nocache_hack = 1;
2697             /* tell client_side.c that this is used */
2698         } else if (!strcmp(token, "ignore-reload")) {
2699             ignore_reload = 1;
2700             refresh_nocache_hack = 1;
2701             /* tell client_side.c that this is used */
2702 #endif
2703
2704         } else if (!strcmp(token, "ignore-no-cache") ||
2705                    !strcmp(token, "ignore-must-revalidate") ||
2706                    !strcmp(token, "ignore-auth")
2707                   ) {
2708             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2709         } else
2710             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2711     }
2712
2713     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2714         char errbuf[256];
2715         regerror(errcode, &comp, errbuf, sizeof errbuf);
2716         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2717         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2718         xfree(pattern);
2719         return;
2720     }
2721
2722     pct = pct < 0.0 ? 0.0 : pct;
2723     max = max < 0 ? 0 : max;
2724     t = new RefreshPattern(pattern, flags);
2725     t->pattern.regex = comp;
2726     t->min = min;
2727     t->pct = pct;
2728     t->max = max;
2729
2730     if (refresh_ims)
2731         t->flags.refresh_ims = true;
2732
2733     if (store_stale)
2734         t->flags.store_stale = true;
2735
2736     t->max_stale = max_stale;
2737
2738 #if USE_HTTP_VIOLATIONS
2739
2740     if (override_expire)
2741         t->flags.override_expire = true;
2742
2743     if (override_lastmod)
2744         t->flags.override_lastmod = true;
2745
2746     if (reload_into_ims)
2747         t->flags.reload_into_ims = true;
2748
2749     if (ignore_reload)
2750         t->flags.ignore_reload = true;
2751
2752     if (ignore_no_store)
2753         t->flags.ignore_no_store = true;
2754
2755     if (ignore_private)
2756         t->flags.ignore_private = true;
2757 #endif
2758
2759     t->next = NULL;
2760
2761     while (*head)
2762         head = &(*head)->next;
2763
2764     *head = t;
2765
2766     xfree(pattern);
2767 }
2768
2769 static void
2770 free_refreshpattern(RefreshPattern ** head)
2771 {
2772     delete *head;
2773     *head = nullptr;
2774
2775 #if USE_HTTP_VIOLATIONS
2776     refresh_nocache_hack = 0;
2777
2778 #endif
2779 }
2780
2781 static void
2782 dump_string(StoreEntry * entry, const char *name, char *var)
2783 {
2784     if (var != NULL)
2785         storeAppendPrintf(entry, "%s %s\n", name, var);
2786 }
2787
2788 static void
2789 parse_string(char **var)
2790 {
2791     char *token = ConfigParser::NextToken();
2792     safe_free(*var);
2793
2794     if (token == NULL)
2795         self_destruct();
2796
2797     *var = xstrdup(token);
2798 }
2799
2800 static void
2801 free_string(char **var)
2802 {
2803     safe_free(*var);
2804 }
2805
2806 void
2807 parse_eol(char *volatile *var)
2808 {
2809     if (!var) {
2810         self_destruct();
2811         return;
2812     }
2813
2814     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2815     safe_free(*var);
2816
2817     if (!token) {
2818         self_destruct();
2819         return;
2820     }
2821
2822     while (*token && xisspace(*token))
2823         ++token;
2824
2825     if (!*token) {
2826         self_destruct();
2827         return;
2828     }
2829
2830     *var = xstrdup((char *) token);
2831 }
2832
2833 #define dump_eol dump_string
2834 #define free_eol free_string
2835
2836 static void
2837 parse_TokenOrQuotedString(char **var)
2838 {
2839     char *token = ConfigParser::NextQuotedToken();
2840     safe_free(*var);
2841
2842     if (token == NULL)
2843         self_destruct();
2844
2845     *var = xstrdup(token);
2846 }
2847
2848 #define dump_TokenOrQuotedString dump_string
2849 #define free_TokenOrQuotedString free_string
2850
2851 static void
2852 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2853 {
2854     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2855 }
2856
2857 void
2858 parse_time_t(time_t * var)
2859 {
2860     time_msec_t tval;
2861     parseTimeLine(&tval, T_SECOND_STR, false);
2862     *var = static_cast<time_t>(tval/1000);
2863 }
2864
2865 static void
2866 free_time_t(time_t * var)
2867 {
2868     *var = 0;
2869 }
2870
2871 static void
2872 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2873 {
2874     if (var % 1000)
2875         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2876     else
2877         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2878 }
2879
2880 void
2881 parse_time_msec(time_msec_t * var)
2882 {
2883     parseTimeLine(var, T_SECOND_STR, true);
2884 }
2885
2886 static void
2887 free_time_msec(time_msec_t * var)
2888 {
2889     *var = 0;
2890 }
2891
2892 #if UNUSED_CODE
2893 static void
2894 dump_size_t(StoreEntry * entry, const char *name, size_t var)
2895 {
2896     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
2897 }
2898 #endif
2899
2900 static void
2901 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
2902 {
2903     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2904 }
2905
2906 static void
2907 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
2908 {
2909     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2910 }
2911
2912 #if UNUSED_CODE
2913 static void
2914 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
2915 {
2916     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
2917 }
2918 #endif
2919
2920 static void
2921 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
2922 {
2923     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
2924 }
2925
2926 static void
2927 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
2928 {
2929     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
2930 }
2931
2932 #if UNUSED_CODE
2933 static void
2934 parse_size_t(size_t * var)
2935 {
2936     int i;
2937     i = GetInteger();
2938     *var = (size_t) i;
2939 }
2940 #endif
2941
2942 static void
2943 parse_b_size_t(size_t * var)
2944 {
2945     parseBytesLine(var, B_BYTES_STR);
2946 }
2947
2948 static void
2949 parse_b_ssize_t(ssize_t * var)
2950 {
2951     parseBytesLineSigned(var, B_BYTES_STR);
2952 }
2953
2954 #if UNUSED_CODE
2955 static void
2956 parse_kb_size_t(size_t * var)
2957 {
2958     parseBytesLine(var, B_KBYTES_STR);
2959 }
2960 #endif
2961
2962 static void
2963 parse_b_int64_t(int64_t * var)
2964 {
2965     parseBytesLine64(var, B_BYTES_STR);
2966 }
2967
2968 static void
2969 parse_kb_int64_t(int64_t * var)
2970 {
2971     parseBytesLine64(var, B_KBYTES_STR);
2972 }
2973
2974 static void
2975 free_size_t(size_t * var)
2976 {
2977     *var = 0;
2978 }
2979
2980 static void
2981 free_ssize_t(ssize_t * var)
2982 {
2983     *var = 0;
2984 }
2985
2986 static void
2987 free_b_int64_t(int64_t * var)
2988 {
2989     *var = 0;
2990 }
2991
2992 #define free_b_size_t free_size_t
2993 #define free_b_ssize_t free_ssize_t
2994 #define free_kb_size_t free_size_t
2995 #define free_mb_size_t free_size_t
2996 #define free_gb_size_t free_size_t
2997 #define free_kb_int64_t free_b_int64_t
2998
2999 static void
3000 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3001 {
3002     storeAppendPrintf(entry, "%s %d\n", name, var);
3003 }
3004
3005 static void
3006 free_u_short(unsigned short * u)
3007 {
3008     *u = 0;
3009 }
3010
3011 static void
3012 parse_u_short(unsigned short * var)
3013 {
3014     ConfigParser::ParseUShort(var);
3015 }
3016
3017 void
3018 ConfigParser::ParseUShort(unsigned short *var)
3019 {
3020     *var = GetShort();
3021 }
3022
3023 void
3024 ConfigParser::ParseBool(bool *var)
3025 {
3026     int i = GetInteger();
3027
3028     if (0 == i)
3029         *var = false;
3030     else if (1 == i)
3031         *var = true;
3032     else
3033         self_destruct();
3034 }
3035
3036 static void
3037 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3038 {
3039     while (list != NULL) {
3040         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3041         list = list->next;
3042     }
3043 }
3044
3045 void
3046 ConfigParser::ParseWordList(wordlist ** list)
3047 {
3048     parse_wordlist(list);
3049 }
3050
3051 void
3052 parse_wordlist(wordlist ** list)
3053 {
3054     char *token;
3055     while ((token = ConfigParser::NextQuotedToken()))
3056         wordlistAdd(list, token);
3057 }
3058
3059 #if 0 /* now unused */
3060 static int
3061 check_null_wordlist(wordlist * w)
3062 {
3063     return w == NULL;
3064 }
3065 #endif
3066
3067 static int
3068 check_null_acl_access(acl_access * a)
3069 {
3070     return a == NULL;
3071 }
3072
3073 #define free_wordlist wordlistDestroy
3074
3075 #define free_uri_whitespace free_int
3076
3077 static void
3078 parse_uri_whitespace(int *var)
3079 {
3080     char *token = ConfigParser::NextToken();
3081
3082     if (token == NULL)
3083         self_destruct();
3084
3085     if (!strcmp(token, "strip"))
3086         *var = URI_WHITESPACE_STRIP;
3087     else if (!strcmp(token, "deny"))
3088         *var = URI_WHITESPACE_DENY;
3089     else if (!strcmp(token, "allow"))
3090         *var = URI_WHITESPACE_ALLOW;
3091     else if (!strcmp(token, "encode"))
3092         *var = URI_WHITESPACE_ENCODE;
3093     else if (!strcmp(token, "chop"))
3094         *var = URI_WHITESPACE_CHOP;
3095     else {
3096         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3097         self_destruct();
3098     }
3099 }
3100
3101 static void
3102 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3103 {
3104     const char *s;
3105
3106     if (var == URI_WHITESPACE_ALLOW)
3107         s = "allow";
3108     else if (var == URI_WHITESPACE_ENCODE)
3109         s = "encode";
3110     else if (var == URI_WHITESPACE_CHOP)
3111         s = "chop";
3112     else if (var == URI_WHITESPACE_DENY)
3113         s = "deny";
3114     else
3115         s = "strip";
3116
3117     storeAppendPrintf(entry, "%s %s\n", name, s);
3118 }
3119
3120 static void
3121 free_removalpolicy(RemovalPolicySettings ** settings)
3122 {
3123     if (!*settings)
3124         return;
3125
3126     free_string(&(*settings)->type);
3127
3128     free_wordlist(&(*settings)->args);
3129
3130     delete *settings;
3131
3132     *settings = NULL;
3133 }
3134
3135 static void
3136 parse_removalpolicy(RemovalPolicySettings ** settings)
3137 {
3138     if (*settings)
3139         free_removalpolicy(settings);
3140
3141     *settings = new RemovalPolicySettings;
3142
3143     parse_string(&(*settings)->type);
3144
3145     parse_wordlist(&(*settings)->args);
3146 }
3147
3148 static void
3149 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3150 {
3151     wordlist *args;
3152     storeAppendPrintf(entry, "%s %s", name, settings->type);
3153     args = settings->args;
3154
3155     while (args) {
3156         storeAppendPrintf(entry, " %s", args->key);
3157         args = args->next;
3158     }
3159
3160     storeAppendPrintf(entry, "\n");
3161 }
3162
3163 inline void
3164 free_YesNoNone(YesNoNone *)
3165 {}
3166
3167 static void
3168 parse_YesNoNone(YesNoNone *option)
3169 {
3170     int value = 0;
3171     parse_onoff(&value);
3172     option->configure(value > 0);
3173 }
3174
3175 static void
3176 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3177 {
3178     if (option.configured())
3179         dump_onoff(entry, name, option ? 1 : 0);
3180 }
3181
3182 static void
3183 free_memcachemode(SquidConfig *)
3184 {}
3185
3186 static void
3187 parse_memcachemode(SquidConfig *)
3188 {
3189     char *token = ConfigParser::NextToken();
3190     if (!token)
3191         self_destruct();
3192
3193     if (strcmp(token, "always") == 0) {
3194         Config.onoff.memory_cache_first = 1;
3195         Config.onoff.memory_cache_disk = 1;
3196     } else if (strcmp(token, "disk") == 0) {
3197         Config.onoff.memory_cache_first = 0;
3198         Config.onoff.memory_cache_disk = 1;
3199     } else if (strncmp(token, "net", 3) == 0) {
3200         Config.onoff.memory_cache_first = 1;
3201         Config.onoff.memory_cache_disk = 0;
3202     } else if (strcmp(token, "never") == 0) {
3203         Config.onoff.memory_cache_first = 0;
3204         Config.onoff.memory_cache_disk = 0;
3205     } else {
3206         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3207         self_destruct();
3208     }
3209 }
3210
3211 static void
3212 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3213 {
3214     storeAppendPrintf(entry, "%s ", name);
3215     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3216         storeAppendPrintf(entry, "always");
3217     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3218         storeAppendPrintf(entry, "disk");
3219     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3220         storeAppendPrintf(entry, "network");
3221     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3222         storeAppendPrintf(entry, "none");
3223     storeAppendPrintf(entry, "\n");
3224 }
3225
3226 #include "cf_parser.cci"
3227
3228 peer_t
3229 parseNeighborType(const char *s)
3230 {
3231     if (!strcmp(s, "parent"))
3232         return PEER_PARENT;
3233
3234     if (!strcmp(s, "neighbor"))
3235         return PEER_SIBLING;
3236
3237     if (!strcmp(s, "neighbour"))
3238         return PEER_SIBLING;
3239
3240     if (!strcmp(s, "sibling"))
3241         return PEER_SIBLING;
3242
3243     if (!strcmp(s, "multicast"))
3244         return PEER_MULTICAST;
3245
3246     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3247
3248     return PEER_SIBLING;
3249 }
3250
3251 #if USE_WCCPv2
3252 static void
3253 parse_IpAddress_list(Ip::Address_list ** head)
3254 {
3255     char *token;
3256     Ip::Address_list *s;
3257     Ip::Address ipa;
3258
3259     while ((token = ConfigParser::NextToken())) {
3260         if (GetHostWithPort(token, &ipa)) {
3261
3262             while (*head)
3263                 head = &(*head)->next;
3264
3265             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3266             s->s = ipa;
3267
3268             *head = s;
3269         } else
3270             self_destruct();
3271     }
3272 }
3273
3274 static void
3275 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3276 {
3277     char ntoabuf[MAX_IPSTRLEN];
3278
3279     while (s) {
3280         storeAppendPrintf(e, "%s %s\n",
3281                           n,
3282                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3283         s = s->next;
3284     }
3285 }
3286
3287 static void
3288 free_IpAddress_list(Ip::Address_list ** head)
3289 {
3290     if (*head) delete *head;
3291     *head = NULL;
3292 }
3293
3294 #if CURRENTLY_UNUSED
3295 /* This code was previously used by http_port. Left as it really should
3296  * be used by icp_port and htcp_port
3297  */
3298 static int
3299 check_null_IpAddress_list(const Ip::Address_list * s)
3300 {
3301     return NULL == s;
3302 }
3303
3304 #endif /* CURRENTLY_UNUSED */
3305 #endif /* USE_WCCPv2 */
3306
3307 static void
3308 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3309 {
3310     char *host = NULL;
3311     unsigned short port = 0;
3312     char *t = NULL;
3313     char *junk = NULL;
3314
3315     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3316     s->name = xstrdup(token);
3317     s->connection_auth_disabled = false;
3318
3319     const char *portType = AnyP::UriScheme(s->transport.protocol).c_str();
3320
3321     if (*token == '[') {
3322         /* [ipv6]:port */
3323         host = token + 1;
3324         t = strchr(host, ']');
3325         if (!t) {
3326             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3327             self_destruct();
3328         }
3329         *t = '\0';
3330         ++t;
3331         if (*t != ':') {
3332             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3333             self_destruct();
3334         }
3335         if (!Ip::EnableIpv6) {
3336             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3337             self_destruct();
3338         }
3339         port = xatos(t + 1);
3340     } else if ((t = strchr(token, ':'))) {
3341         /* host:port */
3342         /* ipv4:port */
3343         host = token;
3344         *t = '\0';
3345         port = xatos(t + 1);
3346
3347     } else if (strtol(token, &junk, 10) && !*junk) {
3348         port = xatos(token);
3349         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3350     } else {
3351         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3352         self_destruct();
3353     }
3354
3355     if (port == 0 && host != NULL) {
3356         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3357         self_destruct();
3358     }
3359
3360     if (NULL == host) {
3361         s->s.setAnyAddr();
3362         s->s.port(port);
3363         if (!Ip::EnableIpv6)
3364             s->s.setIPv4();
3365         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3366     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3367         s->s.port(port);
3368         if (!Ip::EnableIpv6)
3369             s->s.setIPv4();
3370         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3371     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3372         /* dont use ipcache */
3373         s->defaultsite = xstrdup(host);
3374         s->s.port(port);
3375         if (!Ip::EnableIpv6)
3376             s->s.setIPv4();
3377         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3378     } else {
3379         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3380         self_destruct();
3381     }
3382 }
3383
3384 /// parses the protocol= option of the *_port directive, returning parsed value
3385 /// unsupported option values result in a fatal error message
3386 /// upper case values required; caller may convert for backward compatibility
3387 static AnyP::ProtocolVersion
3388 parsePortProtocol(const SBuf &value)
3389 {
3390     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3391     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3392     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3393         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3394
3395     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3396         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3397
3398     if (value.cmp("FTP") == 0)
3399         return Ftp::ProtocolVersion();
3400
3401     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3402     return AnyP::ProtocolVersion(); // not reached
3403 }
3404
3405 static void
3406 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3407 {
3408     /* modes first */
3409
3410     if (strcmp(token, "accel") == 0) {
3411         if (s->flags.isIntercepted()) {
3412             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3413             self_destruct();
3414         }
3415         s->flags.accelSurrogate = true;
3416         s->vhost = true;
3417     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3418         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3419             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3420             self_destruct();
3421         }
3422         s->flags.natIntercept = true;
3423         Ip::Interceptor.StartInterception();
3424         /* Log information regarding the port modes under interception. */
3425         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3426         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3427     } else if (strcmp(token, "tproxy") == 0) {
3428         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3429             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3430             self_destruct();
3431         }
3432         s->flags.tproxyIntercept = true;
3433         Ip::Interceptor.StartTransparency();
3434         /* Log information regarding the port modes under transparency. */
3435         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3436
3437         if (s->flags.proxySurrogate) {
3438             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3439         }
3440
3441         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3442             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3443             self_destruct();
3444         }
3445
3446     } else if (strcmp(token, "require-proxy-header") == 0) {
3447         s->flags.proxySurrogate = true;
3448         if (s->flags.tproxyIntercept) {
3449             // receiving is still permitted, so we do not unset the TPROXY flag
3450             // spoofing access control override takes care of the spoof disable later
3451             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3452         }
3453
3454     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3455         if (!s->flags.accelSurrogate) {
3456             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3457             self_destruct();
3458         }
3459         safe_free(s->defaultsite);
3460         s->defaultsite = xstrdup(token + 12);
3461     } else if (strcmp(token, "vhost") == 0) {
3462         if (!s->flags.accelSurrogate) {
3463             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3464         }
3465         s->flags.accelSurrogate = true;
3466         s->vhost = true;
3467     } else if (strcmp(token, "no-vhost") == 0) {
3468         if (!s->flags.accelSurrogate) {
3469             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3470         }
3471         s->vhost = false;
3472     } else if (strcmp(token, "vport") == 0) {
3473         if (!s->flags.accelSurrogate) {
3474             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3475             self_destruct();
3476         }
3477         s->vport = -1;
3478     } else if (strncmp(token, "vport=", 6) == 0) {
3479         if (!s->flags.accelSurrogate) {
3480             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3481             self_destruct();
3482         }
3483         s->vport = xatos(token + 6);
3484     } else if (strncmp(token, "protocol=", 9) == 0) {
3485         if (!s->flags.accelSurrogate) {
3486             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3487             self_destruct();
3488         }
3489         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3490     } else if (strcmp(token, "allow-direct") == 0) {
3491         if (!s->flags.accelSurrogate) {
3492             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3493             self_destruct();
3494         }
3495         s->allow_direct = true;
3496     } else if (strcmp(token, "act-as-origin") == 0) {
3497         if (!s->flags.accelSurrogate) {
3498             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3499         } else
3500             s->actAsOrigin = true;
3501     } else if (strcmp(token, "ignore-cc") == 0) {
3502 #if !USE_HTTP_VIOLATIONS
3503         if (!s->flags.accelSurrogate) {
3504             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3505             self_destruct();
3506         }
3507 #endif
3508         s->ignore_cc = true;
3509     } else if (strncmp(token, "name=", 5) == 0) {
3510         safe_free(s->name);
3511         s->name = xstrdup(token + 5);
3512     } else if (strcmp(token, "no-connection-auth") == 0) {
3513         s->connection_auth_disabled = true;
3514     } else if (strcmp(token, "connection-auth=off") == 0) {
3515         s->connection_auth_disabled = true;
3516     } else if (strcmp(token, "connection-auth") == 0) {
3517         s->connection_auth_disabled = false;
3518     } else if (strcmp(token, "connection-auth=on") == 0) {
3519         s->connection_auth_disabled = false;
3520     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3521         if (!strcmp(token + 23, "off"))
3522             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3523         else if (!strcmp(token + 23, "transparent"))
3524             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3525         else if (!strcmp(token + 23, "always"))
3526             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3527         else
3528             self_destruct();
3529     } else if (strcmp(token, "ipv4") == 0) {
3530         if ( !s->s.setIPv4() ) {
3531             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3532             self_destruct();
3533         }
3534     } else if (strcmp(token, "tcpkeepalive") == 0) {
3535         s->tcp_keepalive.enabled = true;
3536     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3537         char *t = token + 13;
3538         s->tcp_keepalive.enabled = true;
3539         s->tcp_keepalive.idle = xatoui(t,',');
3540         t = strchr(t, ',');
3541         if (t) {
3542             ++t;
3543             s->tcp_keepalive.interval = xatoui(t,',');
3544             t = strchr(t, ',');
3545         }
3546         if (t) {
3547             ++t;
3548             s->tcp_keepalive.timeout = xatoui(t);
3549         }
3550 #if USE_OPENSSL
3551     } else if (strcmp(token, "sslBump") == 0) {
3552         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3553                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3554         s->flags.tunnelSslBumping = true;
3555     } else if (strcmp(token, "ssl-bump") == 0) {
3556         s->flags.tunnelSslBumping = true;
3557     } else if (strncmp(token, "cert=", 5) == 0) {
3558         s->secure.parse(token);
3559     } else if (strncmp(token, "key=", 4) == 0) {
3560         s->secure.parse(token);
3561     } else if (strncmp(token, "version=", 8) == 0) {
3562         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3563                "in " << cfg_directive << ". Use 'options=' instead.");
3564         s->secure.parse(token);
3565     } else if (strncmp(token, "options=", 8) == 0) {
3566         s->secure.parse(token);
3567     } else if (strncmp(token, "cipher=", 7) == 0) {
3568         s->secure.parse(token);
3569     } else if (strncmp(token, "clientca=", 9) == 0) {
3570         safe_free(s->clientca);
3571         s->clientca = xstrdup(token + 9);
3572     } else if (strncmp(token, "cafile=", 7) == 0) {
3573         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3574                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3575         s->secure.parse(token);
3576     } else if (strncmp(token, "capath=", 7) == 0) {
3577         s->secure.parse(token);
3578     } else if (strncmp(token, "crlfile=", 8) == 0) {
3579         s->secure.parse(token);
3580     } else if (strncmp(token, "dhparams=", 9) == 0) {
3581         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3582                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3583         s->secure.parse(token);
3584     } else if (strncmp(token, "sslflags=", 9) == 0) {
3585         // NP: deprecation warnings output by secure.parse() when relevant
3586         s->secure.parse(token+3);
3587     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3588         safe_free(s->sslContextSessionId);
3589         s->sslContextSessionId = xstrdup(token + 11);
3590     } else if (strcmp(token, "generate-host-certificates") == 0) {
3591         s->generateHostCertificates = true;
3592     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3593         s->generateHostCertificates = true;
3594     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3595         s->generateHostCertificates = false;
3596     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3597         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3598 #endif
3599     } else if (strncmp(token, "tls-", 4) == 0) {
3600         s->secure.parse(token+4);
3601     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3602         s->ftp_track_dirs = true;
3603     } else {
3604         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3605         self_destruct();
3606     }
3607 }
3608
3609 void
3610 add_http_port(char *portspec)
3611 {
3612     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3613     s->transport = parsePortProtocol(SBuf("HTTP"));
3614     parsePortSpecification(s, portspec);
3615     // we may need to merge better if the above returns a list with clones
3616     assert(s->next == NULL);
3617     s->next = HttpPortList;
3618     HttpPortList = s;
3619 }
3620
3621 static void
3622 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3623 {
3624     SBuf protoName;
3625     if (strcmp(optionName, "http_port") == 0 ||
3626             strcmp(optionName, "ascii_port") == 0)
3627         protoName = "HTTP";
3628     else if (strcmp(optionName, "https_port") == 0)
3629         protoName = "HTTPS";
3630     else if (strcmp(optionName, "ftp_port") == 0)
3631         protoName = "FTP";
3632     if (protoName.isEmpty()) {
3633         self_destruct();
3634         return;
3635     }
3636
3637     char *token = ConfigParser::NextToken();
3638
3639     if (!token) {
3640         self_destruct();
3641         return;
3642     }
3643
3644     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3645     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3646     parsePortSpecification(s, token);
3647
3648     /* parse options ... */
3649     while ((token = ConfigParser::NextToken())) {
3650         parse_port_option(s, token);
3651     }
3652
3653 #if USE_OPENSSL
3654     // if clientca has been defined but not cafile, then use it to verify
3655     // but if cafile has been defined, only use that to verify
3656     if (s->clientca && !s->secure.caFiles.size())
3657         s->secure.caFiles.emplace_back(SBuf(s->clientca));
3658 #endif
3659
3660     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3661         s->secure.encryptTransport = true;
3662 #if USE_OPENSSL
3663         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3664         const bool hijacked = s->flags.isIntercepted();
3665         if (s->flags.tunnelSslBumping && !hijacked) {
3666             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3667             self_destruct();
3668         }
3669         if (hijacked && !s->flags.tunnelSslBumping) {
3670             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3671             self_destruct();
3672         }
3673 #endif
3674         if (s->flags.proxySurrogate) {
3675             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3676             self_destruct();
3677         }
3678     } else if (protoName.cmp("FTP") == 0) {
3679         /* ftp_port does not support ssl-bump */
3680         if (s->flags.tunnelSslBumping) {
3681             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3682             self_destruct();
3683         }
3684         if (s->flags.proxySurrogate) {
3685             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3686             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3687             self_destruct();
3688         }
3689     }
3690
3691     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3692         // clone the port options from *s to *(s->next)
3693         s->next = s->clone();
3694         s->next->s.setIPv4();
3695         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).c_str() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3696     }
3697
3698     while (*head != NULL)
3699         head = &((*head)->next);
3700
3701     *head = s;
3702 }
3703
3704 static void
3705 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3706 {
3707     char buf[MAX_IPSTRLEN];
3708
3709     storeAppendPrintf(e, "%s %s",
3710                       n,
3711                       s->s.toUrl(buf,MAX_IPSTRLEN));
3712
3713     // MODES and specific sub-options.
3714     if (s->flags.natIntercept)
3715         storeAppendPrintf(e, " intercept");
3716
3717     else if (s->flags.tproxyIntercept)
3718         storeAppendPrintf(e, " tproxy");
3719
3720     else if (s->flags.proxySurrogate)
3721         storeAppendPrintf(e, " require-proxy-header");
3722
3723     else if (s->flags.accelSurrogate) {
3724         storeAppendPrintf(e, " accel");
3725
3726         if (s->vhost)
3727             storeAppendPrintf(e, " vhost");
3728
3729         if (s->vport < 0)
3730             storeAppendPrintf(e, " vport");
3731         else if (s->vport > 0)
3732             storeAppendPrintf(e, " vport=%d", s->vport);
3733
3734         if (s->defaultsite)
3735             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3736
3737         // TODO: compare against prefix of 'n' instead of assuming http_port
3738         if (s->transport.protocol != AnyP::PROTO_HTTP)
3739             storeAppendPrintf(e, " protocol=%s", AnyP::UriScheme(s->transport.protocol).c_str());
3740
3741         if (s->allow_direct)
3742             storeAppendPrintf(e, " allow-direct");
3743
3744         if (s->ignore_cc)
3745             storeAppendPrintf(e, " ignore-cc");
3746
3747     }
3748
3749     // Generic independent options
3750
3751     if (s->name)
3752         storeAppendPrintf(e, " name=%s", s->name);
3753
3754 #if USE_HTTP_VIOLATIONS
3755     if (!s->flags.accelSurrogate && s->ignore_cc)
3756         storeAppendPrintf(e, " ignore-cc");
3757 #endif
3758
3759     if (s->connection_auth_disabled)
3760         storeAppendPrintf(e, " connection-auth=off");
3761     else
3762         storeAppendPrintf(e, " connection-auth=on");
3763
3764     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3765         const char *pmtu;
3766
3767         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3768             pmtu = "always";
3769         else
3770             pmtu = "transparent";
3771
3772         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3773     }
3774
3775     if (s->s.isAnyAddr() && !s->s.isIPv6())
3776         storeAppendPrintf(e, " ipv4");
3777
3778     if (s->tcp_keepalive.enabled) {
3779         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3780             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3781         } else {
3782             storeAppendPrintf(e, " tcpkeepalive");
3783         }
3784     }
3785
3786 #if USE_OPENSSL
3787     if (s->flags.tunnelSslBumping)
3788         storeAppendPrintf(e, " ssl-bump");
3789 #endif
3790
3791     s->secure.dumpCfg(e, "tls-");
3792
3793 #if USE_OPENSSL
3794     if (s->sslContextSessionId)
3795         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3796
3797     if (s->generateHostCertificates)
3798         storeAppendPrintf(e, " generate-host-certificates");
3799
3800     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3801         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3802 #endif
3803 }
3804
3805 static void
3806 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3807 {
3808     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3809         dump_generic_port(e, n, p);
3810         storeAppendPrintf(e, "\n");
3811     }
3812 }
3813
3814 void
3815 configFreeMemory(void)
3816 {
3817     free_all();
3818 #if USE_OPENSSL
3819     SSL_CTX_free(Config.ssl_client.sslContext);
3820 #endif
3821 }
3822
3823 void
3824 requirePathnameExists(const char *name, const char *path)
3825 {
3826
3827     struct stat sb;
3828     char pathbuf[BUFSIZ];
3829     assert(path != NULL);
3830
3831     if (Config.chroot_dir && (geteuid() == 0)) {
3832         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3833         path = pathbuf;
3834     }
3835
3836     if (stat(path, &sb) < 0) {
3837         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerror());
3838         // keep going to find more issues if we are only checking the config file with "-k parse"
3839         if (opt_parse_cfg_only)
3840             return;
3841         // this is fatal if it is found during startup or reconfigure
3842         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3843             fatalf("%s %s: %s", name, path, xstrerror());
3844     }
3845 }
3846
3847 #include "AccessLogEntry.h"
3848
3849 /**
3850  * We support several access_log configuration styles:
3851  *
3852  * #1: Deprecated ancient style without an explicit logging module:
3853  * access_log /var/log/access.log
3854  *
3855  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3856  * access_log none [acl ...]
3857  *
3858  * #3: Configurable logging module without named options:
3859  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3860  * If no explicit logformat name is given, the first ACL name, if any,
3861  * should not be an existing logformat name or it will be treated as such.
3862  * access_log module:place [logformat_name] [acl ...]
3863  *
3864  * #4: Configurable logging module with name=value options such as logformat=x:
3865  * The first ACL name may not contain '='.
3866  * access_log module:place [option ...] [acl ...]
3867  *
3868  */
3869 static void
3870 parse_access_log(CustomLog ** logs)
3871 {
3872     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
3873
3874     // default buffer size and fatal settings
3875     cl->bufferSize = 8*MAX_URL;
3876     cl->fatal = true;
3877
3878     /* determine configuration style */
3879
3880     const char *filename = ConfigParser::NextToken();
3881     if (!filename) {
3882         self_destruct();
3883         return;
3884     }
3885
3886     if (strcmp(filename, "none") == 0) {
3887         cl->type = Log::Format::CLF_NONE;
3888         aclParseAclList(LegacyParser, &cl->aclList, filename);
3889         while (*logs)
3890             logs = &(*logs)->next;
3891         *logs = cl;
3892         return;
3893     }
3894
3895     cl->filename = xstrdup(filename);
3896     cl->type = Log::Format::CLF_UNKNOWN;
3897     cl->rotateCount = -1; // default: use global logfile_rotate setting.
3898
3899     const char *token = ConfigParser::PeekAtToken();
3900     if (!token) { // style #1
3901         // no options to deal with
3902     } else if (!strchr(token, '=')) { // style #3
3903         // if logformat name is recognized,
3904         // pop the previewed token; Else it must be an ACL name
3905         if (setLogformat(cl, token, false))
3906             (void)ConfigParser::NextToken();
3907     } else { // style #4
3908         do {
3909             if (strncasecmp(token, "on-error=", 9) == 0) {
3910                 if (strncasecmp(token+9, "die", 3) == 0) {
3911                     cl->fatal = true;
3912                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
3913                     cl->fatal = false;
3914                 } else {
3915                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
3916                            token << "' expected 'drop' or 'die'");
3917                     self_destruct();
3918                 }
3919             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
3920                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
3921             } else if (strncasecmp(token, "rotate=", 7) == 0) {
3922                 cl->rotateCount = xatoi(token + 7);
3923             } else if (strncasecmp(token, "logformat=", 10) == 0) {
3924                 setLogformat(cl, token+10, true);
3925             } else if (!strchr(token, '=')) {
3926                 // Do not pop the token; it must be an ACL name
3927                 break; // done with name=value options, now to ACLs
3928             } else {
3929                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
3930                 self_destruct();
3931             }
3932             // Pop the token, it was a valid "name=value" option
3933             (void)ConfigParser::NextToken();
3934             // Get next with preview ConfigParser::NextToken call.
3935         } while ((token = ConfigParser::PeekAtToken()) != NULL);
3936     }
3937
3938     // set format if it has not been specified explicitly
3939     if (cl->type == Log::Format::CLF_UNKNOWN)
3940         setLogformat(cl, "squid", true);
3941
3942     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
3943
3944     while (*logs)
3945         logs = &(*logs)->next;
3946
3947     *logs = cl;
3948 }
3949
3950 /// sets CustomLog::type and, if needed, CustomLog::lf
3951 /// returns false iff there is no named log format
3952 static bool
3953 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
3954 {
3955     assert(cl);
3956     assert(logdef_name);
3957
3958     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
3959
3960     if (cl->type != Log::Format::CLF_UNKNOWN) {
3961         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
3962                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
3963         self_destruct();
3964         return false;
3965     }
3966
3967     /* look for the definition pointer corresponding to this name */
3968     Format::Format *lf = Log::TheConfig.logformats;
3969
3970     while (lf != NULL) {
3971         debugs(3, 9, "Comparing against '" << lf->name << "'");
3972
3973         if (strcmp(lf->name, logdef_name) == 0)
3974             break;
3975
3976         lf = lf->next;
3977     }
3978
3979     if (lf != NULL) {
3980         cl->type = Log::Format::CLF_CUSTOM;
3981         cl->logFormat = lf;
3982     } else if (strcmp(logdef_name, "auto") == 0) {
3983         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
3984         cl->type = Log::Format::CLF_SQUID;
3985     } else if (strcmp(logdef_name, "squid") == 0) {
3986         cl->type = Log::Format::CLF_SQUID;
3987     } else if (strcmp(logdef_name, "common") == 0) {
3988         cl->type = Log::Format::CLF_COMMON;
3989     } else if (strcmp(logdef_name, "combined") == 0) {
3990         cl->type = Log::Format::CLF_COMBINED;
3991 #if ICAP_CLIENT
3992     } else if (strcmp(logdef_name, "icap_squid") == 0) {
3993         cl->type = Log::Format::CLF_ICAP_SQUID;
3994 #endif
3995     } else if (strcmp(logdef_name, "useragent") == 0) {
3996         cl->type = Log::Format::CLF_USERAGENT;
3997     } else if (strcmp(logdef_name, "referrer") == 0) {
3998         cl->type = Log::Format::CLF_REFERER;
3999     } else if (dieWhenMissing) {
4000         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4001         self_destruct();
4002         return false;
4003     } else {
4004         return false;
4005     }
4006
4007     return true;
4008 }
4009
4010 static int
4011 check_null_access_log(CustomLog *customlog_definitions)
4012 {
4013     return customlog_definitions == NULL;
4014 }
4015
4016 static void
4017 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4018 {
4019     CustomLog *log;
4020
4021     for (log = logs; log; log = log->next) {
4022         storeAppendPrintf(entry, "%s ", name);
4023
4024         switch (log->type) {
4025
4026         case Log::Format::CLF_CUSTOM:
4027             storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4028             break;
4029
4030         case Log::Format::CLF_NONE:
4031             storeAppendPrintf(entry, "logformat=none");
4032             break;
4033
4034         case Log::Format::CLF_SQUID:
4035             storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4036             break;
4037
4038         case Log::Format::CLF_COMBINED:
4039             storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4040             break;
4041
4042         case Log::Format::CLF_COMMON:
4043             storeAppendPrintf(entry, "%s logformat=common", log->filename);
4044             break;
4045
4046 #if ICAP_CLIENT
4047         case Log::Format::CLF_ICAP_SQUID:
4048             storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4049             break;
4050 #endif
4051         case Log::Format::CLF_USERAGENT:
4052             storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4053             break;
4054
4055         case Log::Format::CLF_REFERER:
4056             storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4057             break;
4058
4059         case Log::Format::CLF_UNKNOWN:
4060             break;
4061         }
4062
4063         // default is on-error=die
4064         if (!log->fatal)
4065             storeAppendPrintf(entry, " on-error=drop");
4066
4067         // default: 64KB
4068         if (log->bufferSize != 64*1024)
4069             storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4070
4071         if (log->rotateCount >= 0)
4072             storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4073
4074         if (log->aclList)
4075             dump_acl_list(entry, log->aclList);
4076
4077         storeAppendPrintf(entry, "\n");
4078     }
4079 }
4080
4081 static void
4082 free_access_log(CustomLog ** definitions)
4083 {
4084     while (*definitions) {
4085         CustomLog *log = *definitions;
4086         *definitions = log->next;
4087
4088         log->logFormat = NULL;
4089         log->type = Log::Format::CLF_UNKNOWN;
4090
4091         if (log->aclList)
4092             aclDestroyAclList(&log->aclList);
4093
4094         safe_free(log->filename);
4095
4096         xfree(log);
4097     }
4098 }
4099
4100 /// parses list of integers form name=N1,N2,N3,...
4101 static bool
4102 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4103 {
4104     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4105         data += name.size();
4106         if (*data == '=') {
4107             while (true) {
4108                 ++data;
4109                 int value = 0;
4110                 if (!StringToInt(data, value, &data, 10))
4111                     break;
4112                 list.push_back(value);
4113                 if (*data == '\0' || *data != ',')
4114                     break;
4115             }
4116         }
4117     }
4118     return data && *data == '\0';
4119 }
4120
4121 static void
4122 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4123 {
4124 #if !HAVE_CPU_AFFINITY
4125     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4126            "support, do not set 'cpu_affinity_map'");
4127     self_destruct();
4128 #endif /* HAVE_CPU_AFFINITY */
4129
4130     if (!*cpuAffinityMap)
4131         *cpuAffinityMap = new CpuAffinityMap;
4132
4133     const char *const pToken = ConfigParser::NextToken();
4134     const char *const cToken = ConfigParser::NextToken();
4135     std::vector<int> processes, cores;
4136     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4137         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4138                "in 'cpu_affinity_map'");
4139         self_destruct();
4140     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4141         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4142                "'cpu_affinity_map'");
4143         self_destruct();
4144     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4145         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4146                "process_numbers and cores lists differ in length or " <<
4147                "contain numbers <= 0");
4148         self_destruct();
4149     }
4150 }
4151
4152 static void
4153 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4154 {
4155     if (cpuAffinityMap) {
4156         storeAppendPrintf(entry, "%s process_numbers=", name);
4157         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4158             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4159                               cpuAffinityMap->processes()[i]);
4160         }
4161         storeAppendPrintf(entry, " cores=");
4162         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4163             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4164                               cpuAffinityMap->cores()[i]);
4165         }
4166         storeAppendPrintf(entry, "\n");
4167     }
4168 }
4169
4170 static void
4171 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4172 {
4173     delete *cpuAffinityMap;
4174     *cpuAffinityMap = NULL;
4175 }
4176
4177 #if USE_ADAPTATION
4178
4179 static void
4180 parse_adaptation_service_set_type()
4181 {
4182     Adaptation::Config::ParseServiceSet();
4183 }
4184
4185 static void
4186 parse_adaptation_service_chain_type()
4187 {
4188     Adaptation::Config::ParseServiceChain();
4189 }
4190
4191 static void
4192 parse_adaptation_access_type()
4193 {
4194     Adaptation::Config::ParseAccess(LegacyParser);
4195 }
4196 #endif /* USE_ADAPTATION */
4197
4198 #if ICAP_CLIENT
4199
4200 static void
4201 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4202 {
4203     cfg->parseService();
4204 }
4205
4206 static void
4207 free_icap_service_type(Adaptation::Icap::Config * cfg)
4208 {
4209     cfg->freeService();
4210 }
4211
4212 static void
4213 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4214 {
4215     cfg.dumpService(entry, name);
4216 }
4217
4218 static void
4219 parse_icap_class_type()
4220 {
4221     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4222            "Use 'adaptation_service_set' instead");
4223     Adaptation::Config::ParseServiceSet();
4224 }
4225
4226 static void
4227 parse_icap_access_type()
4228 {
4229     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4230            "Use 'adaptation_access' instead");
4231     Adaptation::Config::ParseAccess(LegacyParser);
4232 }
4233
4234 #endif
4235
4236 #if USE_ECAP
4237
4238 static void
4239 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4240 {
4241     cfg->parseService();
4242 }
4243
4244 static void
4245 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4246 {
4247     cfg->freeService();
4248 }
4249
4250 static void
4251 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4252 {
4253     cfg.dumpService(entry, name);
4254 }
4255
4256 #endif /* USE_ECAP */
4257
4258 #if ICAP_CLIENT
4259 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4260 {
4261     char *token;
4262     time_t d;
4263     time_t m;
4264     cfg->service_failure_limit = GetInteger();
4265
4266     if ((token = ConfigParser::NextToken()) == NULL)
4267         return;
4268
4269     if (strcmp(token,"in") != 0) {
4270         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4271         self_destruct();
4272     }
4273
4274     if ((token = ConfigParser::NextToken()) == NULL) {
4275         self_destruct();
4276     }
4277
4278     d = static_cast<time_t> (xatoi(token));
4279
4280     m = static_cast<time_t> (1);
4281
4282     if (0 == d)
4283         (void) 0;
4284     else if ((token = ConfigParser::NextToken()) == NULL) {
4285         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4286         self_destruct();
4287     } else if ((m = parseTimeUnits(token, false)) == 0)
4288         self_destruct();
4289
4290     cfg->oldest_service_failure = (m * d);
4291 }
4292
4293 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4294 {
4295     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4296     if (cfg.oldest_service_failure > 0) {
4297         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4298     }
4299     storeAppendPrintf(entry, "\n");
4300 }
4301
4302 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4303 {
4304     cfg->oldest_service_failure = 0;
4305     cfg->service_failure_limit = 0;
4306 }
4307 #endif
4308
4309 #if USE_OPENSSL
4310 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4311 {
4312     char *al;
4313     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4314     if ((al = ConfigParser::NextToken()) == NULL) {
4315         self_destruct();
4316         return;
4317     }
4318
4319     const char *param;
4320     if ( char *s = strchr(al, '{')) {
4321         *s = '\0'; // terminate the al string
4322         ++s;
4323         param = s;
4324         s = strchr(s, '}');
4325         if (!s) {
4326             self_destruct();
4327             return;
4328         }
4329         *s = '\0';
4330     } else
4331         param = NULL;
4332
4333     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4334         ca->alg = Ssl::algSetValidAfter;
4335         ca->param = xstrdup("on");
4336     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4337         ca->alg = Ssl::algSetValidBefore;
4338         ca->param = xstrdup("on");
4339     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4340         ca->alg = Ssl::algSetCommonName;
4341         if (param) {
4342             if (strlen(param) > 64) {
4343                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4344                 self_destruct();
4345                 return;
4346             }
4347             ca->param = xstrdup(param);
4348         }
4349     } else {
4350         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4351         self_destruct();
4352         return;
4353     }
4354
4355     aclParseAclList(LegacyParser, &ca->aclList, al);
4356
4357     while (*cert_adapt)
4358         cert_adapt = &(*cert_adapt)->next;
4359
4360     *cert_adapt = ca;
4361 }
4362
4363 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4364 {
4365     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4366         storeAppendPrintf(entry, "%s ", name);
4367         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4368         if (ca->aclList)
4369             dump_acl_list(entry, ca->aclList);
4370         storeAppendPrintf(entry, "\n");
4371     }
4372 }
4373
4374 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4375 {
4376     while (*cert_adapt) {
4377         sslproxy_cert_adapt *ca = *cert_adapt;
4378         *cert_adapt = ca->next;
4379         safe_free(ca->param);
4380
4381         if (ca->aclList)
4382             aclDestroyAclList(&ca->aclList);
4383
4384         safe_free(ca);
4385     }
4386 }
4387
4388 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4389 {
4390     char *al;
4391     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4392     if ((al = ConfigParser::NextToken()) == NULL) {
4393         self_destruct();
4394         return;
4395     }
4396
4397     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4398         cs->alg = Ssl::algSignTrusted;
4399     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4400         cs->alg = Ssl::algSignUntrusted;
4401     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4402         cs->alg = Ssl::algSignSelf;
4403     else {
4404         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4405         self_destruct();
4406         return;
4407     }
4408
4409     aclParseAclList(LegacyParser, &cs->aclList, al);
4410
4411     while (*cert_sign)
4412         cert_sign = &(*cert_sign)->next;
4413
4414     *cert_sign = cs;
4415 }
4416
4417 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4418 {
4419     sslproxy_cert_sign *cs;
4420     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4421         storeAppendPrintf(entry, "%s ", name);
4422         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4423         if (cs->aclList)
4424             dump_acl_list(entry, cs->aclList);
4425         storeAppendPrintf(entry, "\n");
4426     }
4427 }
4428
4429 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4430 {
4431     while (*cert_sign) {
4432         sslproxy_cert_sign *cs = *cert_sign;
4433         *cert_sign = cs->next;
4434
4435         if (cs->aclList)
4436             aclDestroyAclList(&cs->aclList);
4437
4438         safe_free(cs);
4439     }
4440 }
4441
4442 class sslBumpCfgRr: public ::RegisteredRunner
4443 {
4444 public:
4445     static Ssl::BumpMode lastDeprecatedRule;
4446     /* RegisteredRunner API */
4447     virtual void finalizeConfig();
4448 };
4449
4450 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4451
4452 RunnerRegistrationEntry(sslBumpCfgRr);
4453
4454 void
4455 sslBumpCfgRr::finalizeConfig()
4456 {
4457     if (lastDeprecatedRule != Ssl::bumpEnd) {
4458         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4459         static char buf[1024];
4460         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4461             strcpy(buf, "ssl_bump deny all");
4462             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4463                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4464                    "must not use implicit rules. Update your ssl_bump rules.");
4465         } else {
4466             strcpy(buf, "ssl_bump allow all");
4467             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4468                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4469                    "inferior to the newer server-first bumping mode. New ssl_bump"
4470                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4471         }
4472         parse_line(buf);
4473     }
4474 }
4475
4476 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4477 {
4478     typedef const char *BumpCfgStyle;
4479     BumpCfgStyle bcsNone = NULL;
4480     BumpCfgStyle bcsNew = "new client/server-first/none";
4481     BumpCfgStyle bcsOld = "deprecated allow/deny";
4482     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4483     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4484     char *bm;
4485     if ((bm = ConfigParser::NextToken()) == NULL) {
4486         self_destruct();
4487         return;
4488     }
4489
4490     // if this is the first rule proccessed
4491     if (*ssl_bump == NULL) {
4492         bumpCfgStyleLast = bcsNone;
4493         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4494     }
4495
4496     allow_t action = allow_t(ACCESS_ALLOWED);
4497
4498     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4499         action.kind = Ssl::bumpClientFirst;
4500         bumpCfgStyleNow = bcsNew;
4501     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4502         action.kind = Ssl::bumpServerFirst;
4503         bumpCfgStyleNow = bcsNew;
4504     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4505         action.kind = Ssl::bumpPeek;
4506         bumpCfgStyleNow = bcsNew;
4507     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4508         action.kind = Ssl::bumpStare;
4509         bumpCfgStyleNow = bcsNew;
4510     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4511         action.kind = Ssl::bumpSplice;
4512         bumpCfgStyleNow = bcsNew;
4513     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4514         action.kind = Ssl::bumpBump;
4515         bumpCfgStyleNow = bcsNew;
4516     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4517         action.kind = Ssl::bumpTerminate;
4518         bumpCfgStyleNow = bcsNew;
4519     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4520         action.kind = Ssl::bumpNone;
4521         bumpCfgStyleNow = bcsNew;
4522     } else if (strcmp(bm, "allow") == 0) {
4523         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4524                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4525                "is usually inferior to the newer server-first "
4526                "bumping mode. Update your ssl_bump rules.");
4527         action.kind = Ssl::bumpClientFirst;
4528         bumpCfgStyleNow = bcsOld;
4529         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4530     } else if (strcmp(bm, "deny") == 0) {
4531         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4532                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4533                "your ssl_bump rules.");
4534         action.kind = Ssl::bumpNone;
4535         bumpCfgStyleNow = bcsOld;
4536         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4537     } else {
4538         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4539         self_destruct();
4540         return;
4541     }
4542
4543     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4544         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4545                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4546         self_destruct();
4547         return;
4548     }
4549
4550     bumpCfgStyleLast = bumpCfgStyleNow;
4551
4552     Acl::AndNode *rule = new Acl::AndNode;
4553     rule->context("(ssl_bump rule)", config_input_line);
4554     rule->lineParse();
4555     // empty rule OK
4556
4557     assert(ssl_bump);
4558     if (!*ssl_bump) {
4559         *ssl_bump = new Acl::Tree;
4560         (*ssl_bump)->context("(ssl_bump rules)", config_input_line);
4561     }
4562
4563     (*ssl_bump)->add(rule, action);
4564 }
4565
4566 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4567 {
4568     if (ssl_bump)
4569         dump_SBufList(entry, ssl_bump->treeDump(name, Ssl::BumpModeStr));
4570 }
4571
4572 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4573 {
4574     free_acl_access(ssl_bump);
4575 }
4576
4577 #endif
4578
4579 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4580 {
4581     if (!headers)
4582         return;
4583
4584     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4585         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4586         if (hwa->aclList)
4587             dump_acl_list(entry, hwa->aclList);
4588         storeAppendPrintf(entry, "\n");
4589     }
4590 }
4591
4592 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4593 {
4594     char *fn;
4595     if (!*headers) {
4596         *headers = new HeaderWithAclList;
4597     }
4598     if ((fn = ConfigParser::NextToken()) == NULL) {
4599         self_destruct();
4600         return;
4601     }
4602     HeaderWithAcl hwa;
4603     hwa.fieldName = fn;
4604     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4605     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4606         hwa.fieldId = Http::HdrType::OTHER;
4607
4608     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4609     ConfigParser::EnableMacros();
4610     String buf = ConfigParser::NextQuotedToken();
4611     ConfigParser::DisableMacros();
4612     hwa.fieldValue = buf.termedBuf();
4613     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4614     if (hwa.quoted) {
4615         if (!nlf->parse(hwa.fieldValue.c_str())) {
4616             self_destruct();
4617             return;
4618         }
4619         hwa.valueFormat = nlf;
4620     } else
4621         delete nlf;
4622     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4623     (*headers)->push_back(hwa);
4624 }
4625
4626 static void free_HeaderWithAclList(HeaderWithAclList **header)
4627 {
4628     if (!(*header))
4629         return;
4630
4631     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4632         if (hwa->aclList)
4633             aclDestroyAclList(&hwa->aclList);
4634
4635         if (hwa->valueFormat) {
4636             delete hwa->valueFormat;
4637             hwa->valueFormat = NULL;
4638         }
4639     }
4640     delete *header;
4641     *header = NULL;
4642 }
4643
4644 static void parse_note(Notes *notes)
4645 {
4646     assert(notes);
4647     notes->parse(LegacyParser);
4648 }
4649
4650 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4651 {
4652     notes.dump(entry, name);
4653 }
4654
4655 static void free_note(Notes *notes)
4656 {
4657     notes->clean();
4658 }
4659
4660 static bool FtpEspvDeprecated = false;
4661 static void parse_ftp_epsv(acl_access **ftp_epsv)
4662 {
4663     allow_t ftpEpsvDeprecatedAction;
4664     bool ftpEpsvIsDeprecatedRule = false;
4665
4666     char *t = ConfigParser::PeekAtToken();
4667     if (!t) {
4668         self_destruct();
4669         return;
4670     }
4671
4672     if (!strcmp(t, "off")) {
4673         (void)ConfigParser::NextToken();
4674         ftpEpsvIsDeprecatedRule = true;
4675         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4676     } else if (!strcmp(t, "on")) {
4677         (void)ConfigParser::NextToken();
4678         ftpEpsvIsDeprecatedRule = true;
4679         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4680     }
4681
4682     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4683     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4684     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4685     // then abort
4686     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4687             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4688         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4689         self_destruct();
4690     }
4691
4692     if (ftpEpsvIsDeprecatedRule) {
4693         // overwrite previous ftp_epsv lines
4694         delete *ftp_epsv;
4695         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4696             Acl::AndNode *ftpEpsvRule = new Acl::AndNode;
4697             ftpEpsvRule->context("(ftp_epsv rule)", config_input_line);
4698             ACL *a = ACL::FindByName("all");
4699             if (!a) {
4700                 self_destruct();
4701                 return;
4702             }
4703             ftpEpsvRule->add(a);
4704             *ftp_epsv = new Acl::Tree;
4705             (*ftp_epsv)->context("(ftp_epsv rules)", config_input_line);
4706             (*ftp_epsv)->add(ftpEpsvRule, ftpEpsvDeprecatedAction);
4707         } else
4708             *ftp_epsv = NULL;
4709         FtpEspvDeprecated = true;
4710     } else {
4711         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4712     }
4713 }
4714
4715 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4716 {
4717     if (ftp_epsv)
4718         dump_SBufList(entry, ftp_epsv->treeDump(name, NULL));
4719 }
4720
4721 static void free_ftp_epsv(acl_access **ftp_epsv)
4722 {
4723     free_acl_access(ftp_epsv);
4724     FtpEspvDeprecated = false;
4725 }
4726
4727 static void
4728 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4729 {
4730     time_msec_t tval;
4731     parseTimeLine(&tval, T_SECOND_STR, false, true);
4732     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4733
4734     char *key, *value;
4735     while(ConfigParser::NextKvPair(key, value)) {
4736         if (strcasecmp(key, "on_timeout") == 0) {
4737             if (strcasecmp(value, "bypass") == 0)
4738                 config->action = toutActBypass;
4739             else if (strcasecmp(value, "fail") == 0)
4740                 config->action = toutActFail;
4741             else if (strcasecmp(value, "retry") == 0)
4742                 config->action = toutActRetry;
4743             else if (strcasecmp(value, "use_configured_response") == 0) {
4744                 config->action = toutActUseConfiguredResponse;
4745             } else {
4746                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4747                 self_destruct();
4748             }
4749         } else if (strcasecmp(key, "response") == 0) {
4750             config->response = xstrdup(value);
4751         } else {
4752             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4753             self_destruct();
4754         }
4755     }
4756
4757     if (config->action == toutActUseConfiguredResponse && !config->response) {
4758         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4759         self_destruct();
4760     }
4761
4762     if (config->action != toutActUseConfiguredResponse && config->response) {
4763         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4764         self_destruct();
4765     }
4766 }
4767
4768 static void
4769 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4770 {
4771     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4772     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4773
4774     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4775     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4776
4777     if (config.response)
4778         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4779
4780     storeAppendPrintf(entry, "\n");
4781 }
4782
4783 static void
4784 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4785 {
4786     Config.Timeout.urlRewrite = 0;
4787     config->action = 0;
4788     safe_free(config->response);
4789 }
4790
4791 static void
4792 parse_configuration_includes_quoted_values(bool *)
4793 {
4794     int val = 0;
4795     parse_onoff(&val);
4796
4797     // If quoted values is set to on then enable new strict mode parsing
4798     if (val) {
4799         ConfigParser::RecognizeQuotedValues = true;
4800         ConfigParser::StrictMode = true;
4801     } else {
4802         ConfigParser::RecognizeQuotedValues = false;
4803         ConfigParser::StrictMode = false;
4804     }
4805 }
4806
4807 static void
4808 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4809 {
4810     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4811     dump_onoff(entry, name, val);
4812 }
4813
4814 static void
4815 free_configuration_includes_quoted_values(bool *)
4816 {
4817     ConfigParser::RecognizeQuotedValues = false;
4818     ConfigParser::StrictMode = false;
4819 }
4820
4821 static void
4822 parse_on_unsupported_protocol(acl_access **access)
4823 {
4824     char *tm;
4825     if ((tm = ConfigParser::NextToken()) == NULL) {
4826         self_destruct();
4827         return;
4828     }
4829
4830     allow_t action = allow_t(ACCESS_ALLOWED);
4831     if (strcmp(tm, "tunnel") == 0)
4832         action.kind = 1;
4833     else if (strcmp(tm, "respond") == 0)
4834         action.kind = 2;
4835     else {
4836         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4837         self_destruct();
4838         return;
4839     }
4840
4841     Acl::AndNode *rule = new Acl::AndNode;
4842     rule->context("(on_unsupported_protocol rule)", config_input_line);
4843     rule->lineParse();
4844     // empty rule OK
4845
4846     assert(access);
4847     if (!*access) {
4848         *access = new Acl::Tree;
4849         (*access)->context("(on_unsupported_protocol rules)", config_input_line);
4850     }
4851
4852     (*access)->add(rule, action);
4853 }
4854
4855 static void
4856 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4857 {
4858     const char *on_error_tunnel_mode_str[] = {
4859         "none",
4860         "tunnel",
4861         "respond",
4862         NULL
4863     };
4864     if (access) {
4865         SBufList lines = access->treeDump(name, on_error_tunnel_mode_str);
4866         dump_SBufList(entry, lines);
4867     }
4868 }
4869
4870 static void
4871 free_on_unsupported_protocol(acl_access **access)
4872 {
4873     free_acl_access(access);
4874 }
4875