src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclNameList.h"
  15 #include "acl/AclSizeLimit.h"
  16 #include "acl/Address.h"
  17 #include "acl/Gadgets.h"
  18 #include "acl/MethodData.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "AuthReg.h"
  23 #include "base/RunnersRegistry.h"
  24 #include "cache_cf.h"
  25 #include "CachePeer.h"
  26 #include "ConfigParser.h"
  27 #include "CpuAffinityMap.h"
  28 #include "DiskIO/DiskIOModule.h"
  29 #include "eui/Config.h"
  30 #include "ExternalACL.h"
  31 #include "format/Format.h"
  32 #include "ftp/Elements.h"
  33 #include "globals.h"
  34 #include "HttpHeaderTools.h"
  35 #include "icmp/IcmpConfig.h"
  36 #include "ident/Config.h"
  37 #include "ip/Intercept.h"
  38 #include "ip/QosConfig.h"
  39 #include "ip/tools.h"
  40 #include "ipc/Kids.h"
  41 #include "log/Config.h"
  42 #include "log/CustomLog.h"
  43 #include "MemBuf.h"
  44 #include "mgr/ActionPasswordList.h"
  45 #include "mgr/Registration.h"
  46 #include "neighbors.h"
  47 #include "NeighborTypeDomainList.h"
  48 #include "Parsing.h"
  49 #include "pconn.h"
  50 #include "PeerDigest.h"
  51 #include "PeerPoolMgr.h"
  52 #include "redirect.h"
  53 #include "RefreshPattern.h"
  54 #include "rfc1738.h"
  55 #include "SBufList.h"
  56 #include "SquidConfig.h"
  57 #include "SquidString.h"
  58 #include "ssl/ProxyCerts.h"
  59 #include "Store.h"
  60 #include "StoreFileSystem.h"
  61 #include "SwapDir.h"
  62 #include "tools.h"
  63 #include "util.h"
  64 #include "wordlist.h"
  65 /* wccp2 has its own conditional definitions */
  66 #include "wccp2.h"
  67 #if USE_ADAPTATION
  68 #include "adaptation/Config.h"
  69 #endif
  70 #if ICAP_CLIENT
  71 #include "adaptation/icap/Config.h"
  72 #endif
  73 #if USE_ECAP
  74 #include "adaptation/ecap/Config.h"
  75 #endif
  76 #if USE_OPENSSL
  77 #include "ssl/Config.h"
  78 #include "ssl/support.h"
  79 #endif
  80 #if USE_AUTH
  81 #include "auth/Config.h"
  82 #include "auth/Scheme.h"
  83 #endif
  84 #if USE_SQUID_ESI
  85 #include "esi/Parser.h"
  86 #endif
  87 #if SQUID_SNMP
  88 #include "snmp.h"
  89 #endif
  90
  91 #if HAVE_GLOB_H
  92 #include <glob.h>
  93 #endif
  94 #include <limits>
  95 #include <list>
  96 #if HAVE_PWD_H
  97 #include <pwd.h>
  98 #endif
  99 #if HAVE_GRP_H
 100 #include <grp.h>
 101 #endif
 102 #if HAVE_SYS_STAT_H
 103 #include <sys/stat.h>
 104 #endif
 105
 106 #if USE_OPENSSL
 107 #include "ssl/gadgets.h"
 108 #endif
 109
 110 #if USE_ADAPTATION
 111 static void parse_adaptation_service_set_type();
 112 static void parse_adaptation_service_chain_type();
 113 static void parse_adaptation_access_type();
 114 #endif
 115
 116 #if ICAP_CLIENT
 117 static void parse_icap_service_type(Adaptation::Icap::Config *);
 118 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 119 static void free_icap_service_type(Adaptation::Icap::Config *);
 120 static void parse_icap_class_type();
 121 static void parse_icap_access_type();
 122
 123 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 124 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 125 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 126 #endif
 127
 128 #if USE_ECAP
 129 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 130 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 131 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 132 #endif
 133
 134 static peer_t parseNeighborType(const char *s);
 135
 136 static const char *const T_MILLISECOND_STR = "millisecond";
 137 static const char *const T_SECOND_STR = "second";
 138 static const char *const T_MINUTE_STR = "minute";
 139 static const char *const T_HOUR_STR = "hour";
 140 static const char *const T_DAY_STR = "day";
 141 static const char *const T_WEEK_STR = "week";
 142 static const char *const T_FORTNIGHT_STR = "fortnight";
 143 static const char *const T_MONTH_STR = "month";
 144 static const char *const T_YEAR_STR = "year";
 145 static const char *const T_DECADE_STR = "decade";
 146
 147 static const char *const B_BYTES_STR = "bytes";
 148 static const char *const B_KBYTES_STR = "KB";
 149 static const char *const B_MBYTES_STR = "MB";
 150 static const char *const B_GBYTES_STR = "GB";
 151
 152 static const char *const list_sep = ", \t\n\r";
 153
 154 static void parse_access_log(CustomLog ** customlog_definitions);
 155 static int check_null_access_log(CustomLog *customlog_definitions);
 156 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 157 static void free_access_log(CustomLog ** definitions);
 158 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 159
 160 static void configDoConfigure(void);
 161 static void parse_refreshpattern(RefreshPattern **);
 162 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 163 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 164 static void parse_u_short(unsigned short * var);
 165 static void parse_string(char **);
 166 static void default_all(void);
 167 static void defaults_if_none(void);
 168 static void defaults_postscriptum(void);
 169 static int parse_line(char *);
 170 static void parse_obsolete(const char *);
 171 static void parseBytesLine(size_t * bptr, const char *units);
 172 #if USE_OPENSSL
 173 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 174 #endif
 175 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 176 static size_t parseBytesUnits(const char *unit);
 177 static void free_all(void);
 178 void requirePathnameExists(const char *name, const char *path);
 179 static OBJH dump_config;
 180 #if USE_HTTP_VIOLATIONS
 181 static void free_HeaderManglers(HeaderManglers **pm);
 182 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 183 static void parse_http_header_access(HeaderManglers **manglers);
 184 #define free_http_header_access free_HeaderManglers
 185 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 186 static void parse_http_header_replace(HeaderManglers **manglers);
 187 #define free_http_header_replace free_HeaderManglers
 188 #endif
 189 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 190 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 191 static void free_HeaderWithAclList(HeaderWithAclList **header);
 192 static void parse_note(Notes *);
 193 static void dump_note(StoreEntry *, const char *, Notes &);
 194 static void free_note(Notes *);
 195 static void parse_denyinfo(AclDenyInfoList ** var);
 196 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 197 static void free_denyinfo(AclDenyInfoList ** var);
 198
 199 #if USE_WCCPv2
 200 static void parse_IpAddress_list(Ip::Address_list **);
 201 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 202 static void free_IpAddress_list(Ip::Address_list **);
 203 #if CURRENTLY_UNUSED
 204 static int check_null_IpAddress_list(const Ip::Address_list *);
 205 #endif /* CURRENTLY_UNUSED */
 206 #endif /* USE_WCCPv2 */
 207
 208 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 209 #define parse_PortCfg(l) parsePortCfg((l), token)
 210 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 211 #define free_PortCfg(h)  *(h)=NULL
 212
 213 #if USE_OPENSSL
 214 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 215 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 216 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 217 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 218 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 219 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 220 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 221 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 222 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 223 #endif /* USE_OPENSSL */
 224
 225 static void parse_ftp_epsv(acl_access **ftp_epsv);
 226 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 227 static void free_ftp_epsv(acl_access **ftp_epsv);
 228
 229 static void parse_b_size_t(size_t * var);
 230 static void parse_b_int64_t(int64_t * var);
 231
 232 static bool parseNamedIntList(const char *data, const String &name, std::vector<int> &list);
 233
 234 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 235 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 236 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 237
 238 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 239 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 240 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 241
 242 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 243
 244 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 245 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 246 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 247 static void parse_on_unsupported_protocol(acl_access **access);
 248 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 249 static void free_on_unsupported_protocol(acl_access **access);
 250
 251 /*
 252  * LegacyParser is a parser for legacy code that uses the global
 253  * approach.  This is static so that it is only exposed to cache_cf.
 254  * Other modules needing access to a ConfigParser should have it
 255  * provided to them in their parserFOO methods.
 256  */
 257 static ConfigParser LegacyParser = ConfigParser();
 258
 259 void
 260 self_destruct(void)
 261 {
 262     LegacyParser.destruct();
 263 }
 264
 265 static void
 266 SetConfigFilename(char const *file_name, bool is_pipe)
 267 {
 268     if (is_pipe)
 269         cfg_filename = file_name + 1;
 270     else
 271         cfg_filename = file_name;
 272 }
 273
 274 static const char*
 275 skip_ws(const char* s)
 276 {
 277     while (xisspace(*s))
 278         ++s;
 279
 280     return s;
 281 }
 282
 283 static int
 284 parseManyConfigFiles(char* files, int depth)
 285 {
 286     int error_count = 0;
 287     char* saveptr = NULL;
 288 #if HAVE_GLOB
 289     char *path;
 290     glob_t globbuf;
 291     int i;
 292     memset(&globbuf, 0, sizeof(globbuf));
 293     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 294         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 295             fatalf("Unable to find configuration file: %s: %s",
 296                    path, xstrerror());
 297         }
 298     }
 299     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 300         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 301     }
 302     globfree(&globbuf);
 303 #else
 304     char* file = strwordtok(files, &saveptr);
 305     while (file != NULL) {
 306         error_count += parseOneConfigFile(file, depth);
 307         file = strwordtok(NULL, &saveptr);
 308     }
 309 #endif /* HAVE_GLOB */
 310     return error_count;
 311 }
 312
 313 static void
 314 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 315 {
 316     assert(str != NULL);
 317     assert(newSubstr != NULL);
 318
 319     unsigned newSubstrLen = strlen(newSubstr);
 320     if (newSubstrLen > substrLen)
 321         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 322
 323     // move tail part including zero
 324     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 325     // copy new substring in place
 326     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 327
 328     len = strlen(str);
 329 }
 330
 331 static void
 332 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 333 {
 334     assert(line != NULL);
 335     assert(macroName != NULL);
 336     assert(substStr != NULL);
 337     unsigned macroNameLen = strlen(macroName);
 338     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 339         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 340 }
 341
 342 static void
 343 ProcessMacros(char*& line, int& len)
 344 {
 345     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 346     SubstituteMacro(line, len, "${process_name}", TheKidName);
 347     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 348 }
 349
 350 static void
 351 trim_trailing_ws(char* str)
 352 {
 353     assert(str != NULL);
 354     unsigned i = strlen(str);
 355     while ((i > 0) && xisspace(str[i - 1]))
 356         --i;
 357     str[i] = '\0';
 358 }
 359
 360 static const char*
 361 FindStatement(const char* line, const char* statement)
 362 {
 363     assert(line != NULL);
 364     assert(statement != NULL);
 365
 366     const char* str = skip_ws(line);
 367     unsigned len = strlen(statement);
 368     if (strncmp(str, statement, len) == 0) {
 369         str += len;
 370         if (*str == '\0')
 371             return str;
 372         else if (xisspace(*str))
 373             return skip_ws(str);
 374     }
 375
 376     return NULL;
 377 }
 378
 379 static bool
 380 StrToInt(const char* str, long& number)
 381 {
 382     assert(str != NULL);
 383
 384     char* end;
 385     number = strtol(str, &end, 0);
 386
 387     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 388 }
 389
 390 static bool
 391 EvalBoolExpr(const char* expr)
 392 {
 393     assert(expr != NULL);
 394     if (strcmp(expr, "true") == 0) {
 395         return true;
 396     } else if (strcmp(expr, "false") == 0) {
 397         return false;
 398     } else if (const char* equation = strchr(expr, '=')) {
 399         const char* rvalue = skip_ws(equation + 1);
 400         char* lvalue = (char*)xmalloc(equation - expr + 1);
 401         xstrncpy(lvalue, expr, equation - expr + 1);
 402         trim_trailing_ws(lvalue);
 403
 404         long number1;
 405         if (!StrToInt(lvalue, number1))
 406             fatalf("String is not a integer number: '%s'\n", lvalue);
 407         long number2;
 408         if (!StrToInt(rvalue, number2))
 409             fatalf("String is not a integer number: '%s'\n", rvalue);
 410
 411         xfree(lvalue);
 412         return number1 == number2;
 413     }
 414     fatalf("Unable to evaluate expression '%s'\n", expr);
 415     return false; // this place cannot be reached
 416 }
 417
 418 static int
 419 parseOneConfigFile(const char *file_name, unsigned int depth)
 420 {
 421     FILE *fp = NULL;
 422     const char *orig_cfg_filename = cfg_filename;
 423     const int orig_config_lineno = config_lineno;
 424     char *token = NULL;
 425     char *tmp_line = NULL;
 426     int tmp_line_len = 0;
 427     int err_count = 0;
 428     int is_pipe = 0;
 429
 430     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 431     if (depth > 16) {
 432         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 433         return 1;
 434     }
 435
 436     if (file_name[0] == '!' || file_name[0] == '|') {
 437         fp = popen(file_name + 1, "r");
 438         is_pipe = 1;
 439     } else {
 440         fp = fopen(file_name, "r");
 441     }
 442
 443     if (fp == NULL)
 444         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerror());
 445
 446 #if _SQUID_WINDOWS_
 447     setmode(fileno(fp), O_TEXT);
 448 #endif
 449
 450     SetConfigFilename(file_name, bool(is_pipe));
 451
 452     memset(config_input_line, '\0', BUFSIZ);
 453
 454     config_lineno = 0;
 455
 456     std::vector<bool> if_states;
 457     while (fgets(config_input_line, BUFSIZ, fp)) {
 458         ++config_lineno;
 459
 460         if ((token = strchr(config_input_line, '\n')))
 461             *token = '\0';
 462
 463         if ((token = strchr(config_input_line, '\r')))
 464             *token = '\0';
 465
 466         // strip any prefix whitespace off the line.
 467         const char *p = skip_ws(config_input_line);
 468         if (config_input_line != p)
 469             memmove(config_input_line, p, strlen(p)+1);
 470
 471         if (strncmp(config_input_line, "#line ", 6) == 0) {
 472             static char new_file_name[1024];
 473             static char *file;
 474             static char new_lineno;
 475             token = config_input_line + 6;
 476             new_lineno = strtol(token, &file, 0) - 1;
 477
 478             if (file == token)
 479                 continue;   /* Not a valid #line directive, may be a comment */
 480
 481             while (*file && xisspace((unsigned char) *file))
 482                 ++file;
 483
 484             if (*file) {
 485                 if (*file != '"')
 486                     continue;   /* Not a valid #line directive, may be a comment */
 487
 488                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 489
 490                 if ((token = strchr(new_file_name, '"')))
 491                     *token = '\0';
 492
 493                 SetConfigFilename(new_file_name, false);
 494             }
 495
 496             config_lineno = new_lineno;
 497         }
 498
 499         if (config_input_line[0] == '#')
 500             continue;
 501
 502         if (config_input_line[0] == '\0')
 503             continue;
 504
 505         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 506
 507         size_t append_len = strlen(append);
 508
 509         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 510
 511         strcpy(tmp_line + tmp_line_len, append);
 512
 513         tmp_line_len += append_len;
 514
 515         if (tmp_line[tmp_line_len-1] == '\\') {
 516             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 517             tmp_line[--tmp_line_len] = '\0';
 518             continue;
 519         }
 520
 521         trim_trailing_ws(tmp_line);
 522         ProcessMacros(tmp_line, tmp_line_len);
 523         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 524
 525         if (const char* expr = FindStatement(tmp_line, "if")) {
 526             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 527         } else if (FindStatement(tmp_line, "endif")) {
 528             if (!if_states.empty())
 529                 if_states.pop_back(); // remove last if-statement meaning
 530             else
 531                 fatalf("'endif' without 'if'\n");
 532         } else if (FindStatement(tmp_line, "else")) {
 533             if (!if_states.empty())
 534                 if_states.back() = !if_states.back();
 535             else
 536                 fatalf("'else' without 'if'\n");
 537         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 538             /* Handle includes here */
 539             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 540                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 541             } else if (!parse_line(tmp_line)) {
 542                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 543                 ++err_count;
 544             }
 545         }
 546
 547         safe_free(tmp_line);
 548         tmp_line_len = 0;
 549
 550     }
 551     if (!if_states.empty())
 552         fatalf("if-statement without 'endif'\n");
 553
 554     if (is_pipe) {
 555         int ret = pclose(fp);
 556
 557         if (ret != 0)
 558             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 559     } else {
 560         fclose(fp);
 561     }
 562
 563     SetConfigFilename(orig_cfg_filename, false);
 564     config_lineno = orig_config_lineno;
 565
 566     xfree(tmp_line);
 567     return err_count;
 568 }
 569
 570 int
 571 parseConfigFile(const char *file_name)
 572 {
 573     int err_count = 0;
 574
 575     debugs(5, 4, HERE);
 576
 577     configFreeMemory();
 578
 579     ACLMethodData::ThePurgeCount = 0;
 580     default_all();
 581
 582     err_count = parseOneConfigFile(file_name, 0);
 583
 584     defaults_if_none();
 585
 586     defaults_postscriptum();
 587
 588     /*
 589      * We must call configDoConfigure() before leave_suid() because
 590      * configDoConfigure() is where we turn username strings into
 591      * uid values.
 592      */
 593     configDoConfigure();
 594
 595     if (!Config.chroot_dir) {
 596         leave_suid();
 597         setUmask(Config.umask);
 598         _db_init(Debug::cache_log, Debug::debugOptions);
 599         enter_suid();
 600     }
 601
 602     if (opt_send_signal == -1) {
 603         Mgr::RegisterAction("config",
 604                             "Current Squid Configuration",
 605                             dump_config,
 606                             1, 1);
 607     }
 608
 609     return err_count;
 610 }
 611
 612 static void
 613 configDoConfigure(void)
 614 {
 615     memset(&Config2, '\0', sizeof(SquidConfig2));
 616     /* init memory as early as possible */
 617     memConfigure();
 618     /* Sanity checks */
 619
 620     Config.cacheSwap.n_strands = 0; // no diskers by default
 621     if (Config.cacheSwap.swapDirs == NULL) {
 622         /* Memory-only cache probably in effect. */
 623         /* turn off the cache rebuild delays... */
 624         StoreController::store_dirs_rebuilding = 0;
 625     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 626         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 627             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 628             if (sd->needsDiskStrand())
 629                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 630         }
 631     }
 632
 633     if (Debug::rotateNumber < 0) {
 634         Debug::rotateNumber = Config.Log.rotateNumber;
 635     }
 636
 637 #if SIZEOF_OFF_T <= 4
 638     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 639         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 640         Config.Store.maxObjectSize = 0x7FFF0000;
 641     }
 642 #endif
 643
 644     if (Config.Announce.period > 0) {
 645         Config.onoff.announce = 1;
 646     } else {
 647         Config.Announce.period = 86400 * 365;   /* one year */
 648         Config.onoff.announce = 0;
 649     }
 650
 651     if (Config.onoff.httpd_suppress_version_string)
 652         visible_appname_string = (char *)appname_string;
 653     else
 654         visible_appname_string = (char const *)APP_FULLNAME;
 655
 656     if (Config.Program.redirect) {
 657         if (Config.redirectChildren.n_max < 1) {
 658             Config.redirectChildren.n_max = 0;
 659             wordlistDestroy(&Config.Program.redirect);
 660         }
 661     }
 662
 663     if (Config.Program.store_id) {
 664         if (Config.storeIdChildren.n_max < 1) {
 665             Config.storeIdChildren.n_max = 0;
 666             wordlistDestroy(&Config.Program.store_id);
 667         }
 668     }
 669
 670     if (Config.appendDomain)
 671         if (*Config.appendDomain != '.')
 672             fatal("append_domain must begin with a '.'");
 673
 674     if (Config.errHtmlText == NULL)
 675         Config.errHtmlText = xstrdup(null_string);
 676
 677 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 678     if (Config.max_filedescriptors > 0) {
 679         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 680     }
 681 #elif USE_SELECT || USE_SELECT_WIN32
 682     if (Config.max_filedescriptors > FD_SETSIZE) {
 683         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 684     }
 685 #endif
 686
 687     storeConfigure();
 688
 689     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 690              uniqueHostname(),
 691              visible_appname_string);
 692
 693     /*
 694      * the extra space is for loop detection in client_side.c -- we search
 695      * for substrings in the Via header.
 696      */
 697     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 698              uniqueHostname(),
 699              visible_appname_string);
 700
 701     /* Use visible_hostname as default surrogate_id */
 702     if (!Config.Accel.surrogate_id) {
 703         const char *t = getMyHostname();
 704         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 705     }
 706
 707     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 708         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 709
 710     if (Config.appendDomain)
 711         Config.appendDomainLen = strlen(Config.appendDomain);
 712     else
 713         Config.appendDomainLen = 0;
 714
 715     if (Config.connect_retries > 10) {
 716         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 717         Config.connect_retries = 10;
 718     }
 719
 720     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 721 #if USE_UNLINKD
 722
 723     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 724 #endif
 725     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 726     if (Config.Program.redirect)
 727         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 728
 729     if (Config.Program.store_id)
 730         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 731
 732     requirePathnameExists("Icon Directory", Config.icons.directory);
 733
 734     if (Config.errorDirectory)
 735         requirePathnameExists("Error Directory", Config.errorDirectory);
 736
 737 #if USE_HTTP_VIOLATIONS
 738
 739     {
 740         const RefreshPattern *R;
 741
 742         for (R = Config.Refresh; R; R = R->next) {
 743             if (!R->flags.override_expire)
 744                 continue;
 745
 746             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 747
 748             break;
 749         }
 750
 751         for (R = Config.Refresh; R; R = R->next) {
 752             if (!R->flags.override_lastmod)
 753                 continue;
 754
 755             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 756
 757             break;
 758         }
 759
 760         for (R = Config.Refresh; R; R = R->next) {
 761             if (!R->flags.reload_into_ims)
 762                 continue;
 763
 764             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 765
 766             break;
 767         }
 768
 769         for (R = Config.Refresh; R; R = R->next) {
 770             if (!R->flags.ignore_reload)
 771                 continue;
 772
 773             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 774
 775             break;
 776         }
 777
 778         for (R = Config.Refresh; R; R = R->next) {
 779             if (!R->flags.ignore_no_store)
 780                 continue;
 781
 782             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 783
 784             break;
 785         }
 786
 787         for (R = Config.Refresh; R; R = R->next) {
 788             if (!R->flags.ignore_private)
 789                 continue;
 790
 791             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 792
 793             break;
 794         }
 795     }
 796 #endif
 797 #if !USE_HTTP_VIOLATIONS
 798     Config.onoff.via = 1;
 799 #else
 800
 801     if (!Config.onoff.via)
 802         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 803
 804 #endif
 805
 806     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 807     // TODO: replace with a dedicated "purge" ACL option?
 808     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 809
 810     Config2.onoff.mangle_request_headers = (Config.request_header_access != NULL);
 811
 812     if (geteuid() == 0) {
 813         if (NULL != Config.effectiveUser) {
 814
 815             struct passwd *pwd = getpwnam(Config.effectiveUser);
 816
 817             if (NULL == pwd) {
 818                 /*
 819                  * Andres Kroonmaa <andre@online.ee>:
 820                  * Some getpwnam() implementations (Solaris?) require
 821                  * an available FD < 256 for opening a FILE* to the
 822                  * passwd file.
 823                  * DW:
 824                  * This should be safe at startup, but might still fail
 825                  * during reconfigure.
 826                  */
 827                 fatalf("getpwnam failed to find userid for effective user '%s'",
 828                        Config.effectiveUser);
 829                 return;
 830             }
 831
 832             Config2.effectiveUserID = pwd->pw_uid;
 833
 834             Config2.effectiveGroupID = pwd->pw_gid;
 835
 836 #if HAVE_PUTENV
 837             if (pwd->pw_dir && *pwd->pw_dir) {
 838                 // putenv() leaks by design; avoid leaks when nothing changes
 839                 static SBuf lastDir;
 840                 if (lastDir.isEmpty() || !lastDir.cmp(pwd->pw_dir)) {
 841                     lastDir = pwd->pw_dir;
 842                     int len = strlen(pwd->pw_dir) + 6;
 843                     char *env_str = (char *)xcalloc(len, 1);
 844                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 845                     putenv(env_str);
 846                 }
 847             }
 848 #endif
 849         }
 850     } else {
 851         Config2.effectiveUserID = geteuid();
 852         Config2.effectiveGroupID = getegid();
 853     }
 854
 855     if (NULL != Config.effectiveGroup) {
 856
 857         struct group *grp = getgrnam(Config.effectiveGroup);
 858
 859         if (NULL == grp) {
 860             fatalf("getgrnam failed to find groupid for effective group '%s'",
 861                    Config.effectiveGroup);
 862             return;
 863         }
 864
 865         Config2.effectiveGroupID = grp->gr_gid;
 866     }
 867
 868     if (Security::ProxyOutgoingConfig.encryptTransport) {
 869         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 870         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 871         if (!Config.ssl_client.sslContext) {
 872 #if USE_OPENSSL
 873             fatal("ERROR: Could not initialize https:// proxy context");
 874 #else
 875             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 876 #endif
 877         }
 878     }
 879
 880     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 881
 882         // default value for ssldomain= is the peer host/IP
 883         if (p->secure.sslDomain.isEmpty())
 884             p->secure.sslDomain = p->host;
 885
 886         if (p->secure.encryptTransport) {
 887             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 888             p->sslContext = p->secure.createClientContext(true);
 889             if (!p->sslContext) {
 890                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 891                 self_destruct();
 892             }
 893         }
 894     }
 895
 896 #if USE_OPENSSL
 897     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 898         if (!s->flags.tunnelSslBumping)
 899             continue;
 900
 901         debugs(3, DBG_IMPORTANT, "Initializing http_port " << s->s << " SSL context");
 902         s->configureSslServerContext();
 903     }
 904
 905     for (AnyP::PortCfgPointer s = HttpsPortList; s != NULL; s = s->next) {
 906         debugs(3, DBG_IMPORTANT, "Initializing https_port " << s->s << " SSL context");
 907         s->configureSslServerContext();
 908     }
 909
 910 #endif
 911
 912     // prevent infinite fetch loops in the request parser
 913     // due to buffer full but not enough data recived to finish parse
 914     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 915         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 916                " Change client_request_buffer_max or request_header_max_size limits.",
 917                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 918     }
 919
 920     /*
 921      * Disable client side request pipelining if client_persistent_connections OFF.
 922      * Waste of resources queueing any pipelined requests when the first will close the connection.
 923      */
 924     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 925         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 926                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 927         Config.pipeline_max_prefetch = 0;
 928     }
 929
 930 #if USE_AUTH
 931     /*
 932      * disable client side request pipelining. There is a race with
 933      * Negotiate and NTLM when the client sends a second request on an
 934      * connection before the authenticate challenge is sent. With
 935      * pipelining OFF, the client may fail to authenticate, but squid's
 936      * state will be preserved.
 937      */
 938     if (Config.pipeline_max_prefetch > 0) {
 939         Auth::Config *nego = Auth::Config::Find("Negotiate");
 940         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 941         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 942             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 943             Config.pipeline_max_prefetch = 0;
 944         }
 945     }
 946 #endif
 947 }
 948
 949 /** Parse a line containing an obsolete directive.
 950  * To upgrade it where possible instead of just "Bungled config" for
 951  * directives which cannot be marked as simply aliases of the some name.
 952  * For example if the parameter order and content has changed.
 953  * Or if the directive has been completely removed.
 954  */
 955 void
 956 parse_obsolete(const char *name)
 957 {
 958     // Directives which have been radically changed rather than removed
 959     if (!strcmp(name, "url_rewrite_concurrency")) {
 960         int cval;
 961         parse_int(&cval);
 962         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 963         Config.redirectChildren.concurrency = cval;
 964     }
 965
 966     if (!strcmp(name, "log_access"))
 967         self_destruct();
 968
 969     if (!strcmp(name, "log_icap"))
 970         self_destruct();
 971
 972     if (!strcmp(name, "ignore_ims_on_miss")) {
 973         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 974         // than the 2.7 directive. We need to parse and invert the configured value.
 975         int temp = 0;
 976         parse_onoff(&temp);
 977         Config.onoff.cache_miss_revalidate = !temp;
 978     }
 979
 980     if (!strncmp(name, "sslproxy_", 9)) {
 981         // the replacement directive tls_outgoing_options uses options instead of whole-line input
 982         SBuf tmp;
 983         if (!strcmp(name, "sslproxy_cafile"))
 984             tmp.append("cafile=");
 985         else if (!strcmp(name, "sslproxy_capath"))
 986             tmp.append("capath=");
 987         else if (!strcmp(name, "sslproxy_cipher"))
 988             tmp.append("cipher=");
 989         else if (!strcmp(name, "sslproxy_client_certificate"))
 990             tmp.append("cert=");
 991         else if (!strcmp(name, "sslproxy_client_key"))
 992             tmp.append("key=");
 993         else if (!strcmp(name, "sslproxy_flags"))
 994             tmp.append("flags=");
 995         else if (!strcmp(name, "sslproxy_options"))
 996             tmp.append("options=");
 997         else if (!strcmp(name, "sslproxy_version"))
 998             tmp.append("version=");
 999         else {
1000             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1001             self_destruct();
1002         }
1003
1004         // add the value as unquoted-string because the old values did not support whitespace
1005         const char *token = ConfigParser::NextQuotedOrToEol();
1006         tmp.append(token, strlen(token));
1007         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1008     }
1009 }
1010
1011 /* Parse a time specification from the config file.  Store the
1012  * result in 'tptr', after converting it to 'units' */
1013 static void
1014 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
1015 {
1016     time_msec_t u;
1017     if ((u = parseTimeUnits(units, allowMsec)) == 0)
1018         self_destruct();
1019
1020     char *token;
1021     if ((token = ConfigParser::NextToken()) == NULL)
1022         self_destruct();
1023
1024     double d = xatof(token);
1025
1026     time_msec_t m = u; /* default to 'units' if none specified */
1027
1028     if (d) {
1029         if ((token = ConfigParser::PeekAtToken()) && (m = parseTimeUnits(token, allowMsec))) {
1030             (void)ConfigParser::NextToken();
1031
1032         } else if (!expectMoreArguments) {
1033             self_destruct();
1034
1035         } else {
1036             token = NULL; // show default units if dying below
1037             debugs(3, DBG_CRITICAL, "WARNING: No units on '" << config_input_line << "', assuming " << d << " " << units);
1038         }
1039     } else
1040         token = NULL; // show default units if dying below.
1041
1042     *tptr = static_cast<time_msec_t>(m * d);
1043
1044     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1045         debugs(3, DBG_CRITICAL, "FATAL: Invalid value '" <<
1046                d << " " << (token ? token : units) << ": integer overflow (time_msec_t).");
1047         self_destruct();
1048     }
1049 }
1050
1051 static uint64_t
1052 parseTimeUnits(const char *unit, bool allowMsec)
1053 {
1054     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1055         return 1;
1056
1057     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1058         return 1000;
1059
1060     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1061         return 60 * 1000;
1062
1063     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1064         return 3600 * 1000;
1065
1066     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1067         return 86400 * 1000;
1068
1069     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1070         return 86400 * 7 * 1000;
1071
1072     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1073         return 86400 * 14 * 1000;
1074
1075     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1076         return static_cast<uint64_t>(86400) * 30 * 1000;
1077
1078     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1079         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1080
1081     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1082         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1083
1084     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1085
1086     return 0;
1087 }
1088
1089 static void
1090 parseBytesLine64(int64_t * bptr, const char *units)
1091 {
1092     char *token;
1093     double d;
1094     int64_t m;
1095     int64_t u;
1096
1097     if ((u = parseBytesUnits(units)) == 0) {
1098         self_destruct();
1099         return;
1100     }
1101
1102     if ((token = ConfigParser::NextToken()) == NULL) {
1103         self_destruct();
1104         return;
1105     }
1106
1107     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1108         *bptr = -1;
1109         return;
1110     }
1111
1112     d = xatof(token);
1113
1114     m = u;          /* default to 'units' if none specified */
1115
1116     if (0.0 == d)
1117         (void) 0;
1118     else if ((token = ConfigParser::NextToken()) == NULL)
1119         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1120                config_input_line << "', assuming " <<
1121                d << " " <<  units  );
1122     else if ((m = parseBytesUnits(token)) == 0) {
1123         self_destruct();
1124         return;
1125     }
1126
1127     *bptr = static_cast<int64_t>(m * d / u);
1128
1129     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1130         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1131                d << " " << token << ": integer overflow (int64_t).");
1132         self_destruct();
1133     }
1134 }
1135
1136 static void
1137 parseBytesLine(size_t * bptr, const char *units)
1138 {
1139     char *token;
1140     double d;
1141     int m;
1142     int u;
1143
1144     if ((u = parseBytesUnits(units)) == 0) {
1145         self_destruct();
1146         return;
1147     }
1148
1149     if ((token = ConfigParser::NextToken()) == NULL) {
1150         self_destruct();
1151         return;
1152     }
1153
1154     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1155         *bptr = static_cast<size_t>(-1);
1156         return;
1157     }
1158
1159     d = xatof(token);
1160
1161     m = u;          /* default to 'units' if none specified */
1162
1163     if (0.0 == d)
1164         (void) 0;
1165     else if ((token = ConfigParser::NextToken()) == NULL)
1166         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1167                config_input_line << "', assuming " <<
1168                d << " " <<  units  );
1169     else if ((m = parseBytesUnits(token)) == 0) {
1170         self_destruct();
1171         return;
1172     }
1173
1174     *bptr = static_cast<size_t>(m * d / u);
1175
1176     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1177         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1178                d << " " << token << ": integer overflow (size_t).");
1179         self_destruct();
1180     }
1181 }
1182
1183 static void
1184 parseBytesLineSigned(ssize_t * bptr, const char *units)
1185 {
1186     char *token;
1187     double d;
1188     int m;
1189     int u;
1190
1191     if ((u = parseBytesUnits(units)) == 0) {
1192         self_destruct();
1193         return;
1194     }
1195
1196     if ((token = ConfigParser::NextToken()) == NULL) {
1197         self_destruct();
1198         return;
1199     }
1200
1201     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1202         *bptr = -1;
1203         return;
1204     }
1205
1206     d = xatof(token);
1207
1208     m = u;          /* default to 'units' if none specified */
1209
1210     if (0.0 == d)
1211         (void) 0;
1212     else if ((token = ConfigParser::NextToken()) == NULL)
1213         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1214                config_input_line << "', assuming " <<
1215                d << " " <<  units  );
1216     else if ((m = parseBytesUnits(token)) == 0) {
1217         self_destruct();
1218         return;
1219     }
1220
1221     *bptr = static_cast<ssize_t>(m * d / u);
1222
1223     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1224         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1225                d << " " << token << ": integer overflow (ssize_t).");
1226         self_destruct();
1227     }
1228 }
1229
1230 /**
1231  * Parse bytes from a string.
1232  * Similar to the parseBytesLine function but parses the string value instead of
1233  * the current token value.
1234  */
1235 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1236 {
1237     int u;
1238     if ((u = parseBytesUnits(units)) == 0) {
1239         self_destruct();
1240         return;
1241     }
1242
1243     // Find number from string beginning.
1244     char const * number_begin = value;
1245     char const * number_end = value;
1246
1247     while ((*number_end >= '0' && *number_end <= '9')) {
1248         ++number_end;
1249     }
1250
1251     String number;
1252     number.limitInit(number_begin, number_end - number_begin);
1253
1254     int d = xatoi(number.termedBuf());
1255     int m;
1256     if ((m = parseBytesUnits(number_end)) == 0) {
1257         self_destruct();
1258         return;
1259     }
1260
1261     *bptr = static_cast<size_t>(m * d / u);
1262     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1263         self_destruct();
1264 }
1265
1266 static size_t
1267 parseBytesUnits(const char *unit)
1268 {
1269     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1270         return 1;
1271
1272     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1273         return 1 << 10;
1274
1275     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1276         return 1 << 20;
1277
1278     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1279         return 1 << 30;
1280
1281     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1282
1283     return 0;
1284 }
1285
1286 static void
1287 dump_SBufList(StoreEntry * entry, const SBufList &words)
1288 {
1289     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1290         entry->append(i->rawContent(), i->length());
1291         entry->append(" ",1);
1292     }
1293     entry->append("\n",1);
1294 }
1295
1296 static void
1297 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1298 {
1299     while (ae != NULL) {
1300         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1301         storeAppendPrintf(entry, "%s %s %s %s ",
1302                           name,
1303                           ae->name,
1304                           ae->typeString(),
1305                           ae->flags.flagsStr());
1306         dump_SBufList(entry, ae->dump());
1307         ae = ae->next;
1308     }
1309 }
1310
1311 static void
1312 parse_acl(ACL ** ae)
1313 {
1314     ACL::ParseAclLine(LegacyParser, ae);
1315 }
1316
1317 static void
1318 free_acl(ACL ** ae)
1319 {
1320     aclDestroyAcls(ae);
1321 }
1322
1323 void
1324 dump_acl_list(StoreEntry * entry, ACLList * head)
1325 {
1326     dump_SBufList(entry, head->dump());
1327 }
1328
1329 void
1330 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1331 {
1332     if (head)
1333         dump_SBufList(entry, head->treeDump(name,NULL));
1334 }
1335
1336 static void
1337 parse_acl_access(acl_access ** head)
1338 {
1339     aclParseAccessLine(cfg_directive, LegacyParser, head);
1340 }
1341
1342 static void
1343 free_acl_access(acl_access ** head)
1344 {
1345     aclDestroyAccessList(head);
1346 }
1347
1348 static void
1349 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1350 {
1351     char buf[MAX_IPSTRLEN];
1352     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1353 }
1354
1355 static void
1356 parse_address(Ip::Address *addr)
1357 {
1358     char *token = ConfigParser::NextToken();
1359
1360     if (!token) {
1361         self_destruct();
1362         return;
1363     }
1364
1365     if (!strcmp(token,"any_addr"))
1366         addr->setAnyAddr();
1367     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1368         addr->setNoAddr();
1369     else if ( (*addr = token) ) // try parse numeric/IPA
1370         (void) 0;
1371     else if (addr->GetHostByName(token)) // dont use ipcache
1372         (void) 0;
1373     else { // not an IP and not a hostname
1374         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1375         self_destruct();
1376     }
1377 }
1378
1379 static void
1380 free_address(Ip::Address *addr)
1381 {
1382     addr->setEmpty();
1383 }
1384
1385 static void
1386 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1387 {
1388     char buf[MAX_IPSTRLEN];
1389
1390     for (Acl::Address *l = head; l; l = l->next) {
1391         if (!l->addr.isAnyAddr())
1392             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1393         else
1394             storeAppendPrintf(entry, "%s autoselect", name);
1395
1396         dump_acl_list(entry, l->aclList);
1397
1398         storeAppendPrintf(entry, "\n");
1399     }
1400 }
1401
1402 static void
1403 parse_acl_address(Acl::Address ** head)
1404 {
1405     Acl::Address *l = new Acl::Address;
1406     parse_address(&l->addr);
1407     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1408
1409     Acl::Address **tail = head;
1410     while (*tail)
1411         tail = &(*tail)->next;
1412
1413     *tail = l;
1414 }
1415
1416 static void
1417 free_acl_address(Acl::Address ** head)
1418 {
1419     delete *head;
1420     *head = NULL;
1421 }
1422
1423 static void
1424 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1425 {
1426     acl_tos *l;
1427
1428     for (l = head; l; l = l->next) {
1429         if (l->tos > 0)
1430             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1431         else
1432             storeAppendPrintf(entry, "%s none", name);
1433
1434         dump_acl_list(entry, l->aclList);
1435
1436         storeAppendPrintf(entry, "\n");
1437     }
1438 }
1439
1440 static void
1441 parse_acl_tos(acl_tos ** head)
1442 {
1443     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1444     char *token = ConfigParser::NextToken();
1445
1446     if (!token) {
1447         self_destruct();
1448         return;
1449     }
1450
1451     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1452         self_destruct();
1453         return;
1454     }
1455
1456     const unsigned int chTos = tos & 0xFC;
1457     if (chTos != tos) {
1458         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1459         tos = chTos;
1460     }
1461
1462     acl_tos *l = new acl_tos;
1463
1464     l->tos = (tos_t)tos;
1465
1466     aclParseAclList(LegacyParser, &l->aclList, token);
1467
1468     acl_tos **tail = head;  /* sane name below */
1469     while (*tail)
1470         tail = &(*tail)->next;
1471
1472     *tail = l;
1473 }
1474
1475 static void
1476 free_acl_tos(acl_tos ** head)
1477 {
1478     delete *head;
1479     head = NULL;
1480 }
1481
1482 #if SO_MARK && USE_LIBCAP
1483
1484 static void
1485 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1486 {
1487     for (acl_nfmark *l = head; l; l = l->next) {
1488         if (l->nfmark > 0)
1489             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1490         else
1491             storeAppendPrintf(entry, "%s none", name);
1492
1493         dump_acl_list(entry, l->aclList);
1494
1495         storeAppendPrintf(entry, "\n");
1496     }
1497 }
1498
1499 static void
1500 parse_acl_nfmark(acl_nfmark ** head)
1501 {
1502     nfmark_t mark;
1503     char *token = ConfigParser::NextToken();
1504
1505     if (!token) {
1506         self_destruct();
1507         return;
1508     }
1509
1510     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1511         self_destruct();
1512         return;
1513     }
1514
1515     acl_nfmark *l = new acl_nfmark;
1516
1517     l->nfmark = mark;
1518
1519     aclParseAclList(LegacyParser, &l->aclList, token);
1520
1521     acl_nfmark **tail = head;   /* sane name below */
1522     while (*tail)
1523         tail = &(*tail)->next;
1524
1525     *tail = l;
1526 }
1527
1528 static void
1529 free_acl_nfmark(acl_nfmark ** head)
1530 {
1531     delete *head;
1532     head = NULL;
1533 }
1534 #endif /* SO_MARK */
1535
1536 static void
1537 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1538 {
1539     for (AclSizeLimit *l = head; l; l = l->next) {
1540         if (l->size != -1)
1541             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1542         else
1543             storeAppendPrintf(entry, "%s none", name);
1544
1545         dump_acl_list(entry, l->aclList);
1546
1547         storeAppendPrintf(entry, "\n");
1548     }
1549 }
1550
1551 static void
1552 parse_acl_b_size_t(AclSizeLimit ** head)
1553 {
1554     AclSizeLimit *l = new AclSizeLimit;
1555
1556     parse_b_int64_t(&l->size);
1557
1558     aclParseAclList(LegacyParser, &l->aclList, l->size);
1559
1560     AclSizeLimit **tail = head; /* sane name below */
1561     while (*tail)
1562         tail = &(*tail)->next;
1563
1564     *tail = l;
1565 }
1566
1567 static void
1568 free_acl_b_size_t(AclSizeLimit ** head)
1569 {
1570     delete *head;
1571     *head = NULL;
1572 }
1573
1574 #if USE_DELAY_POOLS
1575
1576 #include "DelayConfig.h"
1577 #include "DelayPools.h"
1578 /* do nothing - free_delay_pool_count is the magic free function.
1579  * this is why delay_pool_count isn't just marked TYPE: u_short
1580  */
1581 #define free_delay_pool_class(X)
1582 #define free_delay_pool_access(X)
1583 #define free_delay_pool_rates(X)
1584 #define dump_delay_pool_class(X, Y, Z)
1585 #define dump_delay_pool_access(X, Y, Z)
1586 #define dump_delay_pool_rates(X, Y, Z)
1587
1588 static void
1589 free_delay_pool_count(DelayConfig * cfg)
1590 {
1591     cfg->freePoolCount();
1592 }
1593
1594 static void
1595 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1596 {
1597     cfg.dumpPoolCount (entry, name);
1598 }
1599
1600 static void
1601 parse_delay_pool_count(DelayConfig * cfg)
1602 {
1603     cfg->parsePoolCount();
1604 }
1605
1606 static void
1607 parse_delay_pool_class(DelayConfig * cfg)
1608 {
1609     cfg->parsePoolClass();
1610 }
1611
1612 static void
1613 parse_delay_pool_rates(DelayConfig * cfg)
1614 {
1615     cfg->parsePoolRates();
1616 }
1617
1618 static void
1619 parse_delay_pool_access(DelayConfig * cfg)
1620 {
1621     cfg->parsePoolAccess(LegacyParser);
1622 }
1623
1624 #endif
1625
1626 #if USE_DELAY_POOLS
1627 #include "ClientDelayConfig.h"
1628 /* do nothing - free_client_delay_pool_count is the magic free function.
1629  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1630  */
1631
1632 #define free_client_delay_pool_access(X)
1633 #define free_client_delay_pool_rates(X)
1634 #define dump_client_delay_pool_access(X, Y, Z)
1635 #define dump_client_delay_pool_rates(X, Y, Z)
1636
1637 static void
1638 free_client_delay_pool_count(ClientDelayConfig * cfg)
1639 {
1640     cfg->freePoolCount();
1641 }
1642
1643 static void
1644 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1645 {
1646     cfg.dumpPoolCount (entry, name);
1647 }
1648
1649 static void
1650 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1651 {
1652     cfg->parsePoolCount();
1653 }
1654
1655 static void
1656 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1657 {
1658     cfg->parsePoolRates();
1659 }
1660
1661 static void
1662 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1663 {
1664     cfg->parsePoolAccess(LegacyParser);
1665 }
1666 #endif
1667
1668 #if USE_HTTP_VIOLATIONS
1669 static void
1670 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1671 {
1672     if (manglers)
1673         manglers->dumpAccess(entry, name);
1674 }
1675
1676 static void
1677 parse_http_header_access(HeaderManglers **pm)
1678 {
1679     char *t = NULL;
1680
1681     if ((t = ConfigParser::NextToken()) == NULL) {
1682         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1683         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1684         return;
1685     }
1686
1687     if (!*pm)
1688         *pm = new HeaderManglers;
1689     HeaderManglers *manglers = *pm;
1690     headerMangler *mangler = manglers->track(t);
1691     assert(mangler);
1692
1693     std::string directive = "http_header_access ";
1694     directive += t;
1695     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1696 }
1697
1698 static void
1699 free_HeaderManglers(HeaderManglers **pm)
1700 {
1701     // we delete the entire http_header_* mangler configuration at once
1702     if (const HeaderManglers *manglers = *pm) {
1703         delete manglers;
1704         *pm = NULL;
1705     }
1706 }
1707
1708 static void
1709 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1710 {
1711     if (manglers)
1712         manglers->dumpReplacement(entry, name);
1713 }
1714
1715 static void
1716 parse_http_header_replace(HeaderManglers **pm)
1717 {
1718     char *t = NULL;
1719
1720     if ((t = ConfigParser::NextToken()) == NULL) {
1721         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1722         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1723         return;
1724     }
1725
1726     const char *value = ConfigParser::NextQuotedOrToEol();
1727
1728     if (!*pm)
1729         *pm = new HeaderManglers;
1730     HeaderManglers *manglers = *pm;
1731     manglers->setReplacement(t, value);
1732 }
1733
1734 #endif
1735
1736 static void
1737 dump_cachedir(StoreEntry * entry, const char *name, SquidConfig::_cacheSwap swap)
1738 {
1739     SwapDir *s;
1740     int i;
1741     assert (entry);
1742
1743     for (i = 0; i < swap.n_configured; ++i) {
1744         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1745         if (!s) continue;
1746         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1747         s->dump(*entry);
1748         storeAppendPrintf(entry, "\n");
1749     }
1750 }
1751
1752 static int
1753 check_null_string(char *s)
1754 {
1755     return s == NULL;
1756 }
1757
1758 #if USE_AUTH
1759 static void
1760 parse_authparam(Auth::ConfigVector * config)
1761 {
1762     char *type_str;
1763     char *param_str;
1764
1765     if ((type_str = ConfigParser::NextToken()) == NULL)
1766         self_destruct();
1767
1768     if ((param_str = ConfigParser::NextToken()) == NULL)
1769         self_destruct();
1770
1771     /* find a configuration for the scheme in the currently parsed configs... */
1772     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1773
1774     if (schemeCfg == NULL) {
1775         /* Create a configuration based on the scheme info */
1776         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1777
1778         if (theScheme == NULL) {
1779             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1780             self_destruct();
1781         }
1782
1783         config->push_back(theScheme->createConfig());
1784         schemeCfg = Auth::Config::Find(type_str);
1785         if (schemeCfg == NULL) {
1786             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1787             self_destruct();
1788         }
1789     }
1790
1791     schemeCfg->parse(schemeCfg, config->size(), param_str);
1792 }
1793
1794 static void
1795 free_authparam(Auth::ConfigVector * cfg)
1796 {
1797     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1798     cfg->clear();
1799
1800     /* on reconfigure initialize new auth schemes for the new config. */
1801     if (reconfiguring) {
1802         Auth::Init();
1803     }
1804 }
1805
1806 static void
1807 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1808 {
1809     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1810         (*i)->dump(entry, name, (*i));
1811 }
1812 #endif /* USE_AUTH */
1813
1814 /* TODO: just return the object, the # is irrelevant */
1815 static int
1816 find_fstype(char *type)
1817 {
1818     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1819         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1820             return (int)i;
1821
1822     return (-1);
1823 }
1824
1825 static void
1826 parse_cachedir(SquidConfig::_cacheSwap * swap)
1827 {
1828     char *type_str;
1829     char *path_str;
1830     RefCount<SwapDir> sd;
1831     int i;
1832     int fs;
1833
1834     if ((type_str = ConfigParser::NextToken()) == NULL)
1835         self_destruct();
1836
1837     if ((path_str = ConfigParser::NextToken()) == NULL)
1838         self_destruct();
1839
1840     fs = find_fstype(type_str);
1841
1842     if (fs < 0) {
1843         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1844         return;
1845     }
1846
1847     /* reconfigure existing dir */
1848
1849     for (i = 0; i < swap->n_configured; ++i) {
1850         assert (swap->swapDirs[i].getRaw());
1851
1852         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1853             /* this is specific to on-fs Stores. The right
1854              * way to handle this is probably to have a mapping
1855              * from paths to stores, and have on-fs stores
1856              * register with that, and lookip in that in their
1857              * own setup logic. RBC 20041225. TODO.
1858              */
1859
1860             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1861
1862             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1863                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1864                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1865                 return;
1866             }
1867
1868             sd->reconfigure();
1869             return;
1870         }
1871     }
1872
1873     /* new cache_dir */
1874     if (swap->n_configured > 63) {
1875         /* 7 bits, signed */
1876         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1877         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1878         self_destruct();
1879         return;
1880     }
1881
1882     allocate_new_swapdir(swap);
1883
1884     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1885
1886     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1887
1888     /* parse the FS parameters and options */
1889     sd->parse(swap->n_configured, path_str);
1890
1891     ++swap->n_configured;
1892 }
1893
1894 static const char *
1895 peer_type_str(const peer_t type)
1896 {
1897     const char * result;
1898
1899     switch (type) {
1900
1901     case PEER_PARENT:
1902         result = "parent";
1903         break;
1904
1905     case PEER_SIBLING:
1906         result = "sibling";
1907         break;
1908
1909     case PEER_MULTICAST:
1910         result = "multicast";
1911         break;
1912
1913     default:
1914         result = "unknown";
1915         break;
1916     }
1917
1918     return result;
1919 }
1920
1921 static void
1922 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1923 {
1924     NeighborTypeDomainList *t;
1925     LOCAL_ARRAY(char, xname, 128);
1926
1927     while (p != NULL) {
1928         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1929                           name,
1930                           p->host,
1931                           neighborTypeStr(p),
1932                           p->http_port,
1933                           p->icp.port,
1934                           p->name);
1935         dump_peer_options(entry, p);
1936
1937         if (p->access) {
1938             snprintf(xname, 128, "cache_peer_access %s", p->name);
1939             dump_acl_access(entry, xname, p->access);
1940         }
1941
1942         for (t = p->typelist; t; t = t->next) {
1943             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1944                               p->host,
1945                               peer_type_str(t->type),
1946                               t->domain);
1947         }
1948
1949         p = p->next;
1950     }
1951 }
1952
1953 /**
1954  * utility function to prevent getservbyname() being called with a numeric value
1955  * on Windows at least it returns garage results.
1956  */
1957 static bool
1958 isUnsignedNumeric(const char *str, size_t len)
1959 {
1960     if (len < 1) return false;
1961
1962     for (; len >0 && *str; ++str, --len) {
1963         if (! isdigit(*str))
1964             return false;
1965     }
1966     return true;
1967 }
1968
1969 /**
1970  \param proto   'tcp' or 'udp' for protocol
1971  \returns       Port the named service is supposed to be listening on.
1972  */
1973 static unsigned short
1974 GetService(const char *proto)
1975 {
1976     struct servent *port = NULL;
1977     /** Parses a port number or service name from the squid.conf */
1978     char *token = ConfigParser::NextToken();
1979     if (token == NULL) {
1980         self_destruct();
1981         return 0; /* NEVER REACHED */
1982     }
1983     /** Returns either the service port number from /etc/services */
1984     if ( !isUnsignedNumeric(token, strlen(token)) )
1985         port = getservbyname(token, proto);
1986     if (port != NULL) {
1987         return ntohs((unsigned short)port->s_port);
1988     }
1989     /** Or a numeric translation of the config text. */
1990     return xatos(token);
1991 }
1992
1993 /**
1994  \returns       Port the named TCP service is supposed to be listening on.
1995  \copydoc GetService(const char *proto)
1996  */
1997 inline unsigned short
1998 GetTcpService(void)
1999 {
2000     return GetService("tcp");
2001 }
2002
2003 /**
2004  \returns       Port the named UDP service is supposed to be listening on.
2005  \copydoc GetService(const char *proto)
2006  */
2007 inline unsigned short
2008 GetUdpService(void)
2009 {
2010     return GetService("udp");
2011 }
2012
2013 static void
2014 parse_peer(CachePeer ** head)
2015 {
2016     char *token = NULL;
2017     CachePeer *p = new CachePeer;
2018
2019     if ((token = ConfigParser::NextToken()) == NULL)
2020         self_destruct();
2021
2022     p->host = xstrdup(token);
2023
2024     p->name = xstrdup(token);
2025
2026     if ((token = ConfigParser::NextToken()) == NULL)
2027         self_destruct();
2028
2029     p->type = parseNeighborType(token);
2030
2031     if (p->type == PEER_MULTICAST) {
2032         p->options.no_digest = true;
2033         p->options.no_netdb_exchange = true;
2034     }
2035
2036     p->http_port = GetTcpService();
2037
2038     if (!p->http_port)
2039         self_destruct();
2040
2041     p->icp.port = GetUdpService();
2042
2043     while ((token = ConfigParser::NextToken())) {
2044         if (!strcmp(token, "proxy-only")) {
2045             p->options.proxy_only = true;
2046         } else if (!strcmp(token, "no-query")) {
2047             p->options.no_query = true;
2048         } else if (!strcmp(token, "background-ping")) {
2049             p->options.background_ping = true;
2050         } else if (!strcmp(token, "no-digest")) {
2051             p->options.no_digest = true;
2052         } else if (!strcmp(token, "no-tproxy")) {
2053             p->options.no_tproxy = true;
2054         } else if (!strcmp(token, "multicast-responder")) {
2055             p->options.mcast_responder = true;
2056 #if PEER_MULTICAST_SIBLINGS
2057         } else if (!strcmp(token, "multicast-siblings")) {
2058             p->options.mcast_siblings = true;
2059 #endif
2060         } else if (!strncmp(token, "weight=", 7)) {
2061             p->weight = xatoi(token + 7);
2062         } else if (!strncmp(token, "basetime=", 9)) {
2063             p->basetime = xatoi(token + 9);
2064         } else if (!strcmp(token, "closest-only")) {
2065             p->options.closest_only = true;
2066         } else if (!strncmp(token, "ttl=", 4)) {
2067             p->mcast.ttl = xatoi(token + 4);
2068
2069             if (p->mcast.ttl < 0)
2070                 p->mcast.ttl = 0;
2071
2072             if (p->mcast.ttl > 128)
2073                 p->mcast.ttl = 128;
2074         } else if (!strcmp(token, "default")) {
2075             p->options.default_parent = true;
2076         } else if (!strcmp(token, "round-robin")) {
2077             p->options.roundrobin = true;
2078         } else if (!strcmp(token, "weighted-round-robin")) {
2079             p->options.weighted_roundrobin = true;
2080 #if USE_HTCP
2081         } else if (!strcmp(token, "htcp")) {
2082             p->options.htcp = true;
2083         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2084             /* Note: The htcp- form is deprecated, replaced by htcp= */
2085             p->options.htcp = true;
2086             char *tmp = xstrdup(token+5);
2087             char *mode, *nextmode;
2088             for (mode = nextmode = tmp; mode; mode = nextmode) {
2089                 nextmode = strchr(mode, ',');
2090                 if (nextmode) {
2091                     *nextmode = '\0';
2092                     ++nextmode;
2093                 }
2094                 if (!strcmp(mode, "no-clr")) {
2095                     if (p->options.htcp_only_clr)
2096                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2097                     p->options.htcp_no_clr = true;
2098                 } else if (!strcmp(mode, "no-purge-clr")) {
2099                     p->options.htcp_no_purge_clr = true;
2100                 } else if (!strcmp(mode, "only-clr")) {
2101                     if (p->options.htcp_no_clr)
2102                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2103                     p->options.htcp_only_clr = true;
2104                 } else if (!strcmp(mode, "forward-clr")) {
2105                     p->options.htcp_forward_clr = true;
2106                 } else if (!strcmp(mode, "oldsquid")) {
2107                     p->options.htcp_oldsquid = true;
2108                 } else {
2109                     fatalf("invalid HTCP mode '%s'", mode);
2110                 }
2111             }
2112             safe_free(tmp);
2113 #endif
2114         } else if (!strcmp(token, "no-netdb-exchange")) {
2115             p->options.no_netdb_exchange = true;
2116
2117         } else if (!strcmp(token, "carp")) {
2118             if (p->type != PEER_PARENT)
2119                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2120
2121             p->options.carp = true;
2122         } else if (!strncmp(token, "carp-key=", 9)) {
2123             if (p->options.carp != true)
2124                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2125             p->options.carp_key.set = true;
2126             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2127             for (; key; key = nextkey) {
2128                 nextkey=strchr(key,',');
2129                 if (nextkey) ++nextkey; // skip the comma, any
2130                 if (0==strncmp(key,"scheme",6)) {
2131                     p->options.carp_key.scheme = true;
2132                 } else if (0==strncmp(key,"host",4)) {
2133                     p->options.carp_key.host = true;
2134                 } else if (0==strncmp(key,"port",4)) {
2135                     p->options.carp_key.port = true;
2136                 } else if (0==strncmp(key,"path",4)) {
2137                     p->options.carp_key.path = true;
2138                 } else if (0==strncmp(key,"params",6)) {
2139                     p->options.carp_key.params = true;
2140                 } else {
2141                     fatalf("invalid carp-key '%s'",key);
2142                 }
2143             }
2144         } else if (!strcmp(token, "userhash")) {
2145 #if USE_AUTH
2146             if (p->type != PEER_PARENT)
2147                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2148
2149             p->options.userhash = true;
2150 #else
2151             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2152 #endif
2153         } else if (!strcmp(token, "sourcehash")) {
2154             if (p->type != PEER_PARENT)
2155                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2156
2157             p->options.sourcehash = true;
2158
2159         } else if (!strcmp(token, "no-delay")) {
2160 #if USE_DELAY_POOLS
2161             p->options.no_delay = true;
2162 #else
2163             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2164 #endif
2165         } else if (!strncmp(token, "login=", 6)) {
2166             p->login = xstrdup(token + 6);
2167             rfc1738_unescape(p->login);
2168         } else if (!strncmp(token, "connect-timeout=", 16)) {
2169             p->connect_timeout = xatoi(token + 16);
2170         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2171             p->connect_fail_limit = xatoi(token + 19);
2172 #if USE_CACHE_DIGESTS
2173         } else if (!strncmp(token, "digest-url=", 11)) {
2174             p->digest_url = xstrdup(token + 11);
2175 #endif
2176
2177         } else if (!strcmp(token, "allow-miss")) {
2178             p->options.allow_miss = true;
2179         } else if (!strncmp(token, "max-conn=", 9)) {
2180             p->max_conn = xatoi(token + 9);
2181         } else if (!strncmp(token, "standby=", 8)) {
2182             p->standby.limit = xatoi(token + 8);
2183         } else if (!strcmp(token, "originserver")) {
2184             p->options.originserver = true;
2185         } else if (!strncmp(token, "name=", 5)) {
2186             safe_free(p->name);
2187
2188             if (token[5])
2189                 p->name = xstrdup(token + 5);
2190         } else if (!strncmp(token, "forceddomain=", 13)) {
2191             safe_free(p->domain);
2192             if (token[13])
2193                 p->domain = xstrdup(token + 13);
2194
2195         } else if (strncmp(token, "ssl", 3) == 0) {
2196 #if !USE_OPENSSL
2197             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2198 #else
2199             p->secure.parse(token+3);
2200 #endif
2201         } else if (strncmp(token, "tls-", 4) == 0) {
2202             p->secure.parse(token+4);
2203         } else if (strcmp(token, "front-end-https") == 0) {
2204             p->front_end_https = 1;
2205         } else if (strcmp(token, "front-end-https=on") == 0) {
2206             p->front_end_https = 1;
2207         } else if (strcmp(token, "front-end-https=auto") == 0) {
2208             p->front_end_https = 2;
2209         } else if (strcmp(token, "connection-auth=off") == 0) {
2210             p->connection_auth = 0;
2211         } else if (strcmp(token, "connection-auth") == 0) {
2212             p->connection_auth = 1;
2213         } else if (strcmp(token, "connection-auth=on") == 0) {
2214             p->connection_auth = 1;
2215         } else if (strcmp(token, "connection-auth=auto") == 0) {
2216             p->connection_auth = 2;
2217         } else if (token[0] == '#') {
2218             // start of a text comment. stop reading this line.
2219             break;
2220         } else {
2221             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2222         }
2223     }
2224
2225     if (peerFindByName(p->name))
2226         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2227
2228     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2229         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2230
2231     if (p->weight < 1)
2232         p->weight = 1;
2233
2234     if (p->connect_fail_limit < 1)
2235         p->connect_fail_limit = 10;
2236
2237 #if USE_CACHE_DIGESTS
2238
2239     if (!p->options.no_digest) {
2240         /* XXX This looks odd.. who has the original pointer
2241          * then?
2242          */
2243         PeerDigest *pd = peerDigestCreate(p);
2244         p->digest = cbdataReference(pd);
2245     }
2246
2247 #endif
2248
2249     p->index =  ++Config.npeers;
2250
2251     while (*head != NULL)
2252         head = &(*head)->next;
2253
2254     *head = p;
2255
2256     peerClearRRStart();
2257 }
2258
2259 static void
2260 free_peer(CachePeer ** P)
2261 {
2262     delete *P;
2263     *P = NULL;
2264     Config.npeers = 0;
2265 }
2266
2267 static void
2268 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2269 {
2270     wordlist *w;
2271
2272     while (list != NULL) {
2273         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2274             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2275         else
2276             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2277
2278         for (w = list->actions; w != NULL; w = w->next) {
2279             storeAppendPrintf(entry, " %s", w->key);
2280         }
2281
2282         storeAppendPrintf(entry, "\n");
2283         list = list->next;
2284     }
2285 }
2286
2287 static void
2288 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2289 {
2290     char *passwd = NULL;
2291     wordlist *actions = NULL;
2292     Mgr::ActionPasswordList *p;
2293     Mgr::ActionPasswordList **P;
2294     parse_string(&passwd);
2295     parse_wordlist(&actions);
2296     p = new Mgr::ActionPasswordList;
2297     p->passwd = passwd;
2298     p->actions = actions;
2299
2300     for (P = head; *P; P = &(*P)->next) {
2301         /*
2302          * See if any of the actions from this line already have a
2303          * password from previous lines.  The password checking
2304          * routines in cache_manager.c take the the password from
2305          * the first Mgr::ActionPasswordList that contains the
2306          * requested action.  Thus, we should warn users who might
2307          * think they can have two passwords for the same action.
2308          */
2309         wordlist *w;
2310         wordlist *u;
2311
2312         for (w = (*P)->actions; w; w = w->next) {
2313             for (u = actions; u; u = u->next) {
2314                 if (strcmp(w->key, u->key))
2315                     continue;
2316
2317                 debugs(0, DBG_CRITICAL, "WARNING: action '" << u->key << "' (line " << config_lineno << ") already has a password");
2318             }
2319         }
2320     }
2321
2322     *P = p;
2323 }
2324
2325 static void
2326 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2327 {
2328     Mgr::ActionPasswordList *p;
2329
2330     while ((p = *head) != NULL) {
2331         *head = p->next;
2332         xfree(p->passwd);
2333         wordlistDestroy(&p->actions);
2334         xfree(p);
2335     }
2336 }
2337
2338 static void
2339 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2340 {
2341     AclNameList *a;
2342
2343     while (var != NULL) {
2344         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2345
2346         for (a = var->acl_list; a != NULL; a = a->next)
2347             storeAppendPrintf(entry, " %s", a->name);
2348
2349         storeAppendPrintf(entry, "\n");
2350
2351         var = var->next;
2352     }
2353 }
2354
2355 static void
2356 parse_denyinfo(AclDenyInfoList ** var)
2357 {
2358     aclParseDenyInfoLine(var);
2359 }
2360
2361 void
2362 free_denyinfo(AclDenyInfoList ** list)
2363 {
2364     AclDenyInfoList *a = NULL;
2365     AclDenyInfoList *a_next = NULL;
2366     AclNameList *l = NULL;
2367     AclNameList *l_next = NULL;
2368
2369     for (a = *list; a; a = a_next) {
2370         for (l = a->acl_list; l; l = l_next) {
2371             l_next = l->next;
2372             memFree(l, MEM_ACL_NAME_LIST);
2373             l = NULL;
2374         }
2375
2376         a_next = a->next;
2377         memFree(a, MEM_ACL_DENY_INFO_LIST);
2378         a = NULL;
2379     }
2380
2381     *list = NULL;
2382 }
2383
2384 static void
2385 parse_peer_access(void)
2386 {
2387     char *host = NULL;
2388     CachePeer *p;
2389
2390     if (!(host = ConfigParser::NextToken()))
2391         self_destruct();
2392
2393     if ((p = peerFindByName(host)) == NULL) {
2394         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2395         return;
2396     }
2397
2398     std::string directive = "peer_access ";
2399     directive += host;
2400     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2401 }
2402
2403 static void
2404 parse_hostdomaintype(void)
2405 {
2406     char *host = NULL;
2407     char *type = NULL;
2408     char *domain = NULL;
2409
2410     if (!(host = ConfigParser::NextToken()))
2411         self_destruct();
2412
2413     if (!(type = ConfigParser::NextToken()))
2414         self_destruct();
2415
2416     while ((domain = ConfigParser::NextToken())) {
2417         NeighborTypeDomainList *l = NULL;
2418         NeighborTypeDomainList **L = NULL;
2419         CachePeer *p;
2420
2421         if ((p = peerFindByName(host)) == NULL) {
2422             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2423             return;
2424         }
2425
2426         l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2427         l->type = parseNeighborType(type);
2428         l->domain = xstrdup(domain);
2429
2430         for (L = &(p->typelist); *L; L = &((*L)->next));
2431         *L = l;
2432     }
2433 }
2434
2435 static void
2436 dump_int(StoreEntry * entry, const char *name, int var)
2437 {
2438     storeAppendPrintf(entry, "%s %d\n", name, var);
2439 }
2440
2441 void
2442 parse_int(int *var)
2443 {
2444     int i;
2445     i = GetInteger();
2446     *var = i;
2447 }
2448
2449 static void
2450 free_int(int *var)
2451 {
2452     *var = 0;
2453 }
2454
2455 static void
2456 dump_onoff(StoreEntry * entry, const char *name, int var)
2457 {
2458     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2459 }
2460
2461 void
2462 parse_onoff(int *var)
2463 {
2464     char *token = ConfigParser::NextToken();
2465
2466     if (token == NULL)
2467         self_destruct();
2468
2469     if (!strcmp(token, "on")) {
2470         *var = 1;
2471     } else if (!strcmp(token, "enable")) {
2472         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2473         *var = 1;
2474     } else if (!strcmp(token, "off")) {
2475         *var = 0;
2476     } else if (!strcmp(token, "disable")) {
2477         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2478         *var = 0;
2479     } else {
2480         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2481         self_destruct();
2482     }
2483 }
2484
2485 #define free_onoff free_int
2486
2487 static void
2488 dump_tristate(StoreEntry * entry, const char *name, int var)
2489 {
2490     const char *state;
2491
2492     if (var > 0)
2493         state = "on";
2494     else if (var < 0)
2495         state = "warn";
2496     else
2497         state = "off";
2498
2499     storeAppendPrintf(entry, "%s %s\n", name, state);
2500 }
2501
2502 static void
2503 parse_tristate(int *var)
2504 {
2505     char *token = ConfigParser::NextToken();
2506
2507     if (token == NULL)
2508         self_destruct();
2509
2510     if (!strcmp(token, "on")) {
2511         *var = 1;
2512     } else if (!strcmp(token, "enable")) {
2513         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2514         *var = 1;
2515     } else if (!strcmp(token, "warn")) {
2516         *var = -1;
2517     } else if (!strcmp(token, "off")) {
2518         *var = 0;
2519     } else if (!strcmp(token, "disable")) {
2520         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2521         *var = 0;
2522     } else {
2523         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2524         self_destruct();
2525     }
2526 }
2527
2528 #define free_tristate free_int
2529
2530 void
2531 parse_pipelinePrefetch(int *var)
2532 {
2533     char *token = ConfigParser::PeekAtToken();
2534
2535     if (token == NULL)
2536         self_destruct();
2537
2538     if (!strcmp(token, "on")) {
2539         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2540         *var = 1;
2541         //pop the token
2542         (void)ConfigParser::NextToken();
2543     } else if (!strcmp(token, "off")) {
2544         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2545         *var = 0;
2546         //pop the token
2547         (void)ConfigParser::NextToken();
2548     } else
2549         parse_int(var);
2550 }
2551
2552 #define free_pipelinePrefetch free_int
2553 #define dump_pipelinePrefetch dump_int
2554
2555 static void
2556 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2557 {
2558     while (head != NULL) {
2559         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2560                           name,
2561                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2562                           head->pattern.c_str(),
2563                           (int) head->min / 60,
2564                           (int) (100.0 * head->pct + 0.5),
2565                           (int) head->max / 60);
2566
2567         if (head->max_stale >= 0)
2568             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2569
2570         if (head->flags.refresh_ims)
2571             storeAppendPrintf(entry, " refresh-ims");
2572
2573         if (head->flags.store_stale)
2574             storeAppendPrintf(entry, " store-stale");
2575
2576 #if USE_HTTP_VIOLATIONS
2577
2578         if (head->flags.override_expire)
2579             storeAppendPrintf(entry, " override-expire");
2580
2581         if (head->flags.override_lastmod)
2582             storeAppendPrintf(entry, " override-lastmod");
2583
2584         if (head->flags.reload_into_ims)
2585             storeAppendPrintf(entry, " reload-into-ims");
2586
2587         if (head->flags.ignore_reload)
2588             storeAppendPrintf(entry, " ignore-reload");
2589
2590         if (head->flags.ignore_no_store)
2591             storeAppendPrintf(entry, " ignore-no-store");
2592
2593         if (head->flags.ignore_private)
2594             storeAppendPrintf(entry, " ignore-private");
2595 #endif
2596
2597         storeAppendPrintf(entry, "\n");
2598
2599         head = head->next;
2600     }
2601 }
2602
2603 static void
2604 parse_refreshpattern(RefreshPattern ** head)
2605 {
2606     char *token;
2607     char *pattern;
2608     time_t min = 0;
2609     double pct = 0.0;
2610     time_t max = 0;
2611     int refresh_ims = 0;
2612     int store_stale = 0;
2613     int max_stale = -1;
2614
2615 #if USE_HTTP_VIOLATIONS
2616
2617     int override_expire = 0;
2618     int override_lastmod = 0;
2619     int reload_into_ims = 0;
2620     int ignore_reload = 0;
2621     int ignore_no_store = 0;
2622     int ignore_private = 0;
2623 #endif
2624
2625     int i;
2626     RefreshPattern *t;
2627     regex_t comp;
2628     int errcode;
2629     int flags = REG_EXTENDED | REG_NOSUB;
2630
2631     if ((token = ConfigParser::RegexPattern()) != NULL) {
2632
2633         if (strcmp(token, "-i") == 0) {
2634             flags |= REG_ICASE;
2635             token = ConfigParser::RegexPattern();
2636         } else if (strcmp(token, "+i") == 0) {
2637             flags &= ~REG_ICASE;
2638             token = ConfigParser::RegexPattern();
2639         }
2640
2641     }
2642
2643     if (token == NULL) {
2644         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2645         self_destruct();
2646         return;
2647     }
2648
2649     pattern = xstrdup(token);
2650
2651     i = GetInteger();       /* token: min */
2652
2653     /* catch negative and insanely huge values close to 32-bit wrap */
2654     if (i < 0) {
2655         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2656         i = 0;
2657     }
2658     if (i > 60*24*365) {
2659         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2660         i = 60*24*365;
2661     }
2662
2663     min = (time_t) (i * 60);    /* convert minutes to seconds */
2664
2665     i = GetPercentage();    /* token: pct */
2666
2667     pct = (double) i / 100.0;
2668
2669     i = GetInteger();       /* token: max */
2670
2671     /* catch negative and insanely huge values close to 32-bit wrap */
2672     if (i < 0) {
2673         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2674         i = 0;
2675     }
2676     if (i > 60*24*365) {
2677         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2678         i = 60*24*365;
2679     }
2680
2681     max = (time_t) (i * 60);    /* convert minutes to seconds */
2682
2683     /* Options */
2684     while ((token = ConfigParser::NextToken()) != NULL) {
2685         if (!strcmp(token, "refresh-ims")) {
2686             refresh_ims = 1;
2687         } else if (!strcmp(token, "store-stale")) {
2688             store_stale = 1;
2689         } else if (!strncmp(token, "max-stale=", 10)) {
2690             max_stale = xatoi(token + 10);
2691
2692 #if USE_HTTP_VIOLATIONS
2693
2694         } else if (!strcmp(token, "override-expire"))
2695             override_expire = 1;
2696         else if (!strcmp(token, "override-lastmod"))
2697             override_lastmod = 1;
2698         else if (!strcmp(token, "ignore-no-store"))
2699             ignore_no_store = 1;
2700         else if (!strcmp(token, "ignore-private"))
2701             ignore_private = 1;
2702         else if (!strcmp(token, "reload-into-ims")) {
2703             reload_into_ims = 1;
2704             refresh_nocache_hack = 1;
2705             /* tell client_side.c that this is used */
2706         } else if (!strcmp(token, "ignore-reload")) {
2707             ignore_reload = 1;
2708             refresh_nocache_hack = 1;
2709             /* tell client_side.c that this is used */
2710 #endif
2711
2712         } else if (!strcmp(token, "ignore-no-cache") ||
2713                    !strcmp(token, "ignore-must-revalidate") ||
2714                    !strcmp(token, "ignore-auth")
2715                   ) {
2716             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2717         } else
2718             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2719     }
2720
2721     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2722         char errbuf[256];
2723         regerror(errcode, &comp, errbuf, sizeof errbuf);
2724         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2725         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2726         xfree(pattern);
2727         return;
2728     }
2729
2730     pct = pct < 0.0 ? 0.0 : pct;
2731     max = max < 0 ? 0 : max;
2732     t = new RefreshPattern(pattern, flags);
2733     t->pattern.regex = comp;
2734     t->min = min;
2735     t->pct = pct;
2736     t->max = max;
2737
2738     if (refresh_ims)
2739         t->flags.refresh_ims = true;
2740
2741     if (store_stale)
2742         t->flags.store_stale = true;
2743
2744     t->max_stale = max_stale;
2745
2746 #if USE_HTTP_VIOLATIONS
2747
2748     if (override_expire)
2749         t->flags.override_expire = true;
2750
2751     if (override_lastmod)
2752         t->flags.override_lastmod = true;
2753
2754     if (reload_into_ims)
2755         t->flags.reload_into_ims = true;
2756
2757     if (ignore_reload)
2758         t->flags.ignore_reload = true;
2759
2760     if (ignore_no_store)
2761         t->flags.ignore_no_store = true;
2762
2763     if (ignore_private)
2764         t->flags.ignore_private = true;
2765 #endif
2766
2767     t->next = NULL;
2768
2769     while (*head)
2770         head = &(*head)->next;
2771
2772     *head = t;
2773
2774     xfree(pattern);
2775 }
2776
2777 static void
2778 free_refreshpattern(RefreshPattern ** head)
2779 {
2780     delete *head;
2781     *head = nullptr;
2782
2783 #if USE_HTTP_VIOLATIONS
2784     refresh_nocache_hack = 0;
2785
2786 #endif
2787 }
2788
2789 static void
2790 dump_string(StoreEntry * entry, const char *name, char *var)
2791 {
2792     if (var != NULL)
2793         storeAppendPrintf(entry, "%s %s\n", name, var);
2794 }
2795
2796 static void
2797 parse_string(char **var)
2798 {
2799     char *token = ConfigParser::NextToken();
2800     safe_free(*var);
2801
2802     if (token == NULL)
2803         self_destruct();
2804
2805     *var = xstrdup(token);
2806 }
2807
2808 static void
2809 free_string(char **var)
2810 {
2811     safe_free(*var);
2812 }
2813
2814 void
2815 parse_eol(char *volatile *var)
2816 {
2817     if (!var) {
2818         self_destruct();
2819         return;
2820     }
2821
2822     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2823     safe_free(*var);
2824
2825     if (!token) {
2826         self_destruct();
2827         return;
2828     }
2829
2830     while (*token && xisspace(*token))
2831         ++token;
2832
2833     if (!*token) {
2834         self_destruct();
2835         return;
2836     }
2837
2838     *var = xstrdup((char *) token);
2839 }
2840
2841 #define dump_eol dump_string
2842 #define free_eol free_string
2843
2844 static void
2845 parse_TokenOrQuotedString(char **var)
2846 {
2847     char *token = ConfigParser::NextQuotedToken();
2848     safe_free(*var);
2849
2850     if (token == NULL)
2851         self_destruct();
2852
2853     *var = xstrdup(token);
2854 }
2855
2856 #define dump_TokenOrQuotedString dump_string
2857 #define free_TokenOrQuotedString free_string
2858
2859 static void
2860 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2861 {
2862     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2863 }
2864
2865 void
2866 parse_time_t(time_t * var)
2867 {
2868     time_msec_t tval;
2869     parseTimeLine(&tval, T_SECOND_STR, false);
2870     *var = static_cast<time_t>(tval/1000);
2871 }
2872
2873 static void
2874 free_time_t(time_t * var)
2875 {
2876     *var = 0;
2877 }
2878
2879 static void
2880 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2881 {
2882     if (var % 1000)
2883         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2884     else
2885         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2886 }
2887
2888 void
2889 parse_time_msec(time_msec_t * var)
2890 {
2891     parseTimeLine(var, T_SECOND_STR, true);
2892 }
2893
2894 static void
2895 free_time_msec(time_msec_t * var)
2896 {
2897     *var = 0;
2898 }
2899
2900 #if UNUSED_CODE
2901 static void
2902 dump_size_t(StoreEntry * entry, const char *name, size_t var)
2903 {
2904     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
2905 }
2906 #endif
2907
2908 static void
2909 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
2910 {
2911     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2912 }
2913
2914 static void
2915 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
2916 {
2917     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2918 }
2919
2920 #if UNUSED_CODE
2921 static void
2922 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
2923 {
2924     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
2925 }
2926 #endif
2927
2928 static void
2929 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
2930 {
2931     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
2932 }
2933
2934 static void
2935 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
2936 {
2937     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
2938 }
2939
2940 #if UNUSED_CODE
2941 static void
2942 parse_size_t(size_t * var)
2943 {
2944     int i;
2945     i = GetInteger();
2946     *var = (size_t) i;
2947 }
2948 #endif
2949
2950 static void
2951 parse_b_size_t(size_t * var)
2952 {
2953     parseBytesLine(var, B_BYTES_STR);
2954 }
2955
2956 static void
2957 parse_b_ssize_t(ssize_t * var)
2958 {
2959     parseBytesLineSigned(var, B_BYTES_STR);
2960 }
2961
2962 #if UNUSED_CODE
2963 static void
2964 parse_kb_size_t(size_t * var)
2965 {
2966     parseBytesLine(var, B_KBYTES_STR);
2967 }
2968 #endif
2969
2970 static void
2971 parse_b_int64_t(int64_t * var)
2972 {
2973     parseBytesLine64(var, B_BYTES_STR);
2974 }
2975
2976 static void
2977 parse_kb_int64_t(int64_t * var)
2978 {
2979     parseBytesLine64(var, B_KBYTES_STR);
2980 }
2981
2982 static void
2983 free_size_t(size_t * var)
2984 {
2985     *var = 0;
2986 }
2987
2988 static void
2989 free_ssize_t(ssize_t * var)
2990 {
2991     *var = 0;
2992 }
2993
2994 static void
2995 free_b_int64_t(int64_t * var)
2996 {
2997     *var = 0;
2998 }
2999
3000 #define free_b_size_t free_size_t
3001 #define free_b_ssize_t free_ssize_t
3002 #define free_kb_size_t free_size_t
3003 #define free_mb_size_t free_size_t
3004 #define free_gb_size_t free_size_t
3005 #define free_kb_int64_t free_b_int64_t
3006
3007 static void
3008 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3009 {
3010     storeAppendPrintf(entry, "%s %d\n", name, var);
3011 }
3012
3013 static void
3014 free_u_short(unsigned short * u)
3015 {
3016     *u = 0;
3017 }
3018
3019 static void
3020 parse_u_short(unsigned short * var)
3021 {
3022     ConfigParser::ParseUShort(var);
3023 }
3024
3025 void
3026 ConfigParser::ParseUShort(unsigned short *var)
3027 {
3028     *var = GetShort();
3029 }
3030
3031 void
3032 ConfigParser::ParseBool(bool *var)
3033 {
3034     int i = GetInteger();
3035
3036     if (0 == i)
3037         *var = false;
3038     else if (1 == i)
3039         *var = true;
3040     else
3041         self_destruct();
3042 }
3043
3044 static void
3045 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3046 {
3047     while (list != NULL) {
3048         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3049         list = list->next;
3050     }
3051 }
3052
3053 void
3054 ConfigParser::ParseWordList(wordlist ** list)
3055 {
3056     parse_wordlist(list);
3057 }
3058
3059 void
3060 parse_wordlist(wordlist ** list)
3061 {
3062     char *token;
3063     while ((token = ConfigParser::NextQuotedToken()))
3064         wordlistAdd(list, token);
3065 }
3066
3067 #if 0 /* now unused */
3068 static int
3069 check_null_wordlist(wordlist * w)
3070 {
3071     return w == NULL;
3072 }
3073 #endif
3074
3075 static int
3076 check_null_acl_access(acl_access * a)
3077 {
3078     return a == NULL;
3079 }
3080
3081 #define free_wordlist wordlistDestroy
3082
3083 #define free_uri_whitespace free_int
3084
3085 static void
3086 parse_uri_whitespace(int *var)
3087 {
3088     char *token = ConfigParser::NextToken();
3089
3090     if (token == NULL)
3091         self_destruct();
3092
3093     if (!strcmp(token, "strip"))
3094         *var = URI_WHITESPACE_STRIP;
3095     else if (!strcmp(token, "deny"))
3096         *var = URI_WHITESPACE_DENY;
3097     else if (!strcmp(token, "allow"))
3098         *var = URI_WHITESPACE_ALLOW;
3099     else if (!strcmp(token, "encode"))
3100         *var = URI_WHITESPACE_ENCODE;
3101     else if (!strcmp(token, "chop"))
3102         *var = URI_WHITESPACE_CHOP;
3103     else {
3104         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3105         self_destruct();
3106     }
3107 }
3108
3109 static void
3110 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3111 {
3112     const char *s;
3113
3114     if (var == URI_WHITESPACE_ALLOW)
3115         s = "allow";
3116     else if (var == URI_WHITESPACE_ENCODE)
3117         s = "encode";
3118     else if (var == URI_WHITESPACE_CHOP)
3119         s = "chop";
3120     else if (var == URI_WHITESPACE_DENY)
3121         s = "deny";
3122     else
3123         s = "strip";
3124
3125     storeAppendPrintf(entry, "%s %s\n", name, s);
3126 }
3127
3128 static void
3129 free_removalpolicy(RemovalPolicySettings ** settings)
3130 {
3131     if (!*settings)
3132         return;
3133
3134     free_string(&(*settings)->type);
3135
3136     free_wordlist(&(*settings)->args);
3137
3138     delete *settings;
3139
3140     *settings = NULL;
3141 }
3142
3143 static void
3144 parse_removalpolicy(RemovalPolicySettings ** settings)
3145 {
3146     if (*settings)
3147         free_removalpolicy(settings);
3148
3149     *settings = new RemovalPolicySettings;
3150
3151     parse_string(&(*settings)->type);
3152
3153     parse_wordlist(&(*settings)->args);
3154 }
3155
3156 static void
3157 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3158 {
3159     wordlist *args;
3160     storeAppendPrintf(entry, "%s %s", name, settings->type);
3161     args = settings->args;
3162
3163     while (args) {
3164         storeAppendPrintf(entry, " %s", args->key);
3165         args = args->next;
3166     }
3167
3168     storeAppendPrintf(entry, "\n");
3169 }
3170
3171 inline void
3172 free_YesNoNone(YesNoNone *)
3173 {}
3174
3175 static void
3176 parse_YesNoNone(YesNoNone *option)
3177 {
3178     int value = 0;
3179     parse_onoff(&value);
3180     option->configure(value > 0);
3181 }
3182
3183 static void
3184 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3185 {
3186     if (option.configured())
3187         dump_onoff(entry, name, option ? 1 : 0);
3188 }
3189
3190 static void
3191 free_memcachemode(SquidConfig *)
3192 {}
3193
3194 static void
3195 parse_memcachemode(SquidConfig *)
3196 {
3197     char *token = ConfigParser::NextToken();
3198     if (!token)
3199         self_destruct();
3200
3201     if (strcmp(token, "always") == 0) {
3202         Config.onoff.memory_cache_first = 1;
3203         Config.onoff.memory_cache_disk = 1;
3204     } else if (strcmp(token, "disk") == 0) {
3205         Config.onoff.memory_cache_first = 0;
3206         Config.onoff.memory_cache_disk = 1;
3207     } else if (strncmp(token, "net", 3) == 0) {
3208         Config.onoff.memory_cache_first = 1;
3209         Config.onoff.memory_cache_disk = 0;
3210     } else if (strcmp(token, "never") == 0) {
3211         Config.onoff.memory_cache_first = 0;
3212         Config.onoff.memory_cache_disk = 0;
3213     } else {
3214         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3215         self_destruct();
3216     }
3217 }
3218
3219 static void
3220 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3221 {
3222     storeAppendPrintf(entry, "%s ", name);
3223     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3224         storeAppendPrintf(entry, "always");
3225     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3226         storeAppendPrintf(entry, "disk");
3227     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3228         storeAppendPrintf(entry, "network");
3229     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3230         storeAppendPrintf(entry, "none");
3231     storeAppendPrintf(entry, "\n");
3232 }
3233
3234 #include "cf_parser.cci"
3235
3236 peer_t
3237 parseNeighborType(const char *s)
3238 {
3239     if (!strcmp(s, "parent"))
3240         return PEER_PARENT;
3241
3242     if (!strcmp(s, "neighbor"))
3243         return PEER_SIBLING;
3244
3245     if (!strcmp(s, "neighbour"))
3246         return PEER_SIBLING;
3247
3248     if (!strcmp(s, "sibling"))
3249         return PEER_SIBLING;
3250
3251     if (!strcmp(s, "multicast"))
3252         return PEER_MULTICAST;
3253
3254     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3255
3256     return PEER_SIBLING;
3257 }
3258
3259 #if USE_WCCPv2
3260 static void
3261 parse_IpAddress_list(Ip::Address_list ** head)
3262 {
3263     char *token;
3264     Ip::Address_list *s;
3265     Ip::Address ipa;
3266
3267     while ((token = ConfigParser::NextToken())) {
3268         if (GetHostWithPort(token, &ipa)) {
3269
3270             while (*head)
3271                 head = &(*head)->next;
3272
3273             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3274             s->s = ipa;
3275
3276             *head = s;
3277         } else
3278             self_destruct();
3279     }
3280 }
3281
3282 static void
3283 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3284 {
3285     char ntoabuf[MAX_IPSTRLEN];
3286
3287     while (s) {
3288         storeAppendPrintf(e, "%s %s\n",
3289                           n,
3290                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3291         s = s->next;
3292     }
3293 }
3294
3295 static void
3296 free_IpAddress_list(Ip::Address_list ** head)
3297 {
3298     if (*head) delete *head;
3299     *head = NULL;
3300 }
3301
3302 #if CURRENTLY_UNUSED
3303 /* This code was previously used by http_port. Left as it really should
3304  * be used by icp_port and htcp_port
3305  */
3306 static int
3307 check_null_IpAddress_list(const Ip::Address_list * s)
3308 {
3309     return NULL == s;
3310 }
3311
3312 #endif /* CURRENTLY_UNUSED */
3313 #endif /* USE_WCCPv2 */
3314
3315 static void
3316 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3317 {
3318     char *host = NULL;
3319     unsigned short port = 0;
3320     char *t = NULL;
3321     char *junk = NULL;
3322
3323     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3324     s->name = xstrdup(token);
3325     s->connection_auth_disabled = false;
3326
3327     const char *portType = AnyP::UriScheme(s->transport.protocol).c_str();
3328
3329     if (*token == '[') {
3330         /* [ipv6]:port */
3331         host = token + 1;
3332         t = strchr(host, ']');
3333         if (!t) {
3334             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3335             self_destruct();
3336         }
3337         *t = '\0';
3338         ++t;
3339         if (*t != ':') {
3340             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3341             self_destruct();
3342         }
3343         if (!Ip::EnableIpv6) {
3344             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3345             self_destruct();
3346         }
3347         port = xatos(t + 1);
3348     } else if ((t = strchr(token, ':'))) {
3349         /* host:port */
3350         /* ipv4:port */
3351         host = token;
3352         *t = '\0';
3353         port = xatos(t + 1);
3354
3355     } else if (strtol(token, &junk, 10) && !*junk) {
3356         port = xatos(token);
3357         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3358     } else {
3359         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3360         self_destruct();
3361     }
3362
3363     if (port == 0 && host != NULL) {
3364         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3365         self_destruct();
3366     }
3367
3368     if (NULL == host) {
3369         s->s.setAnyAddr();
3370         s->s.port(port);
3371         if (!Ip::EnableIpv6)
3372             s->s.setIPv4();
3373         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3374     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3375         s->s.port(port);
3376         if (!Ip::EnableIpv6)
3377             s->s.setIPv4();
3378         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3379     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3380         /* dont use ipcache */
3381         s->defaultsite = xstrdup(host);
3382         s->s.port(port);
3383         if (!Ip::EnableIpv6)
3384             s->s.setIPv4();
3385         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3386     } else {
3387         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3388         self_destruct();
3389     }
3390 }
3391
3392 /// parses the protocol= option of the *_port directive, returning parsed value
3393 /// unsupported option values result in a fatal error message
3394 /// upper case values required; caller may convert for backward compatibility
3395 static AnyP::ProtocolVersion
3396 parsePortProtocol(const SBuf &value)
3397 {
3398     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3399     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3400     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3401         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3402
3403     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3404         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3405
3406     if (value.cmp("FTP") == 0)
3407         return Ftp::ProtocolVersion();
3408
3409     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3410     return AnyP::ProtocolVersion(); // not reached
3411 }
3412
3413 static void
3414 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3415 {
3416     /* modes first */
3417
3418     if (strcmp(token, "accel") == 0) {
3419         if (s->flags.isIntercepted()) {
3420             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3421             self_destruct();
3422         }
3423         s->flags.accelSurrogate = true;
3424         s->vhost = true;
3425     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3426         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3427             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3428             self_destruct();
3429         }
3430         s->flags.natIntercept = true;
3431         Ip::Interceptor.StartInterception();
3432         /* Log information regarding the port modes under interception. */
3433         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3434         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3435     } else if (strcmp(token, "tproxy") == 0) {
3436         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3437             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3438             self_destruct();
3439         }
3440         s->flags.tproxyIntercept = true;
3441         Ip::Interceptor.StartTransparency();
3442         /* Log information regarding the port modes under transparency. */
3443         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3444
3445         if (s->flags.proxySurrogate) {
3446             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3447         }
3448
3449         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3450             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3451             self_destruct();
3452         }
3453
3454     } else if (strcmp(token, "require-proxy-header") == 0) {
3455         s->flags.proxySurrogate = true;
3456         if (s->flags.tproxyIntercept) {
3457             // receiving is still permitted, so we do not unset the TPROXY flag
3458             // spoofing access control override takes care of the spoof disable later
3459             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3460         }
3461
3462     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3463         if (!s->flags.accelSurrogate) {
3464             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3465             self_destruct();
3466         }
3467         safe_free(s->defaultsite);
3468         s->defaultsite = xstrdup(token + 12);
3469     } else if (strcmp(token, "vhost") == 0) {
3470         if (!s->flags.accelSurrogate) {
3471             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3472         }
3473         s->flags.accelSurrogate = true;
3474         s->vhost = true;
3475     } else if (strcmp(token, "no-vhost") == 0) {
3476         if (!s->flags.accelSurrogate) {
3477             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3478         }
3479         s->vhost = false;
3480     } else if (strcmp(token, "vport") == 0) {
3481         if (!s->flags.accelSurrogate) {
3482             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3483             self_destruct();
3484         }
3485         s->vport = -1;
3486     } else if (strncmp(token, "vport=", 6) == 0) {
3487         if (!s->flags.accelSurrogate) {
3488             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3489             self_destruct();
3490         }
3491         s->vport = xatos(token + 6);
3492     } else if (strncmp(token, "protocol=", 9) == 0) {
3493         if (!s->flags.accelSurrogate) {
3494             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3495             self_destruct();
3496         }
3497         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3498     } else if (strcmp(token, "allow-direct") == 0) {
3499         if (!s->flags.accelSurrogate) {
3500             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3501             self_destruct();
3502         }
3503         s->allow_direct = true;
3504     } else if (strcmp(token, "act-as-origin") == 0) {
3505         if (!s->flags.accelSurrogate) {
3506             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3507         } else
3508             s->actAsOrigin = true;
3509     } else if (strcmp(token, "ignore-cc") == 0) {
3510 #if !USE_HTTP_VIOLATIONS
3511         if (!s->flags.accelSurrogate) {
3512             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3513             self_destruct();
3514         }
3515 #endif
3516         s->ignore_cc = true;
3517     } else if (strncmp(token, "name=", 5) == 0) {
3518         safe_free(s->name);
3519         s->name = xstrdup(token + 5);
3520     } else if (strcmp(token, "no-connection-auth") == 0) {
3521         s->connection_auth_disabled = true;
3522     } else if (strcmp(token, "connection-auth=off") == 0) {
3523         s->connection_auth_disabled = true;
3524     } else if (strcmp(token, "connection-auth") == 0) {
3525         s->connection_auth_disabled = false;
3526     } else if (strcmp(token, "connection-auth=on") == 0) {
3527         s->connection_auth_disabled = false;
3528     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3529         if (!strcmp(token + 23, "off"))
3530             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3531         else if (!strcmp(token + 23, "transparent"))
3532             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3533         else if (!strcmp(token + 23, "always"))
3534             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3535         else
3536             self_destruct();
3537     } else if (strcmp(token, "ipv4") == 0) {
3538         if ( !s->s.setIPv4() ) {
3539             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3540             self_destruct();
3541         }
3542     } else if (strcmp(token, "tcpkeepalive") == 0) {
3543         s->tcp_keepalive.enabled = true;
3544     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3545         char *t = token + 13;
3546         s->tcp_keepalive.enabled = true;
3547         s->tcp_keepalive.idle = xatoui(t,',');
3548         t = strchr(t, ',');
3549         if (t) {
3550             ++t;
3551             s->tcp_keepalive.interval = xatoui(t,',');
3552             t = strchr(t, ',');
3553         }
3554         if (t) {
3555             ++t;
3556             s->tcp_keepalive.timeout = xatoui(t);
3557         }
3558 #if USE_OPENSSL
3559     } else if (strcmp(token, "sslBump") == 0) {
3560         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3561                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3562         s->flags.tunnelSslBumping = true;
3563     } else if (strcmp(token, "ssl-bump") == 0) {
3564         s->flags.tunnelSslBumping = true;
3565     } else if (strncmp(token, "cert=", 5) == 0) {
3566         s->secure.parse(token);
3567     } else if (strncmp(token, "key=", 4) == 0) {
3568         s->secure.parse(token);
3569     } else if (strncmp(token, "version=", 8) == 0) {
3570         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3571                "in " << cfg_directive << ". Use 'options=' instead.");
3572         s->secure.parse(token);
3573     } else if (strncmp(token, "options=", 8) == 0) {
3574         s->secure.parse(token);
3575     } else if (strncmp(token, "cipher=", 7) == 0) {
3576         s->secure.parse(token);
3577     } else if (strncmp(token, "clientca=", 9) == 0) {
3578         safe_free(s->clientca);
3579         s->clientca = xstrdup(token + 9);
3580     } else if (strncmp(token, "cafile=", 7) == 0) {
3581         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3582                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3583         s->secure.parse(token);
3584     } else if (strncmp(token, "capath=", 7) == 0) {
3585         s->secure.parse(token);
3586     } else if (strncmp(token, "crlfile=", 8) == 0) {
3587         s->secure.parse(token);
3588     } else if (strncmp(token, "dhparams=", 9) == 0) {
3589         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3590                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3591         s->secure.parse(token);
3592     } else if (strncmp(token, "sslflags=", 9) == 0) {
3593         // NP: deprecation warnings output by secure.parse() when relevant
3594         s->secure.parse(token+3);
3595     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3596         safe_free(s->sslContextSessionId);
3597         s->sslContextSessionId = xstrdup(token + 11);
3598     } else if (strcmp(token, "generate-host-certificates") == 0) {
3599         s->generateHostCertificates = true;
3600     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3601         s->generateHostCertificates = true;
3602     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3603         s->generateHostCertificates = false;
3604     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3605         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3606 #endif
3607     } else if (strncmp(token, "tls-", 4) == 0) {
3608         s->secure.parse(token+4);
3609     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3610         s->ftp_track_dirs = true;
3611     } else {
3612         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3613         self_destruct();
3614     }
3615 }
3616
3617 void
3618 add_http_port(char *portspec)
3619 {
3620     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3621     s->transport = parsePortProtocol(SBuf("HTTP"));
3622     parsePortSpecification(s, portspec);
3623     // we may need to merge better if the above returns a list with clones
3624     assert(s->next == NULL);
3625     s->next = HttpPortList;
3626     HttpPortList = s;
3627 }
3628
3629 static void
3630 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3631 {
3632     SBuf protoName;
3633     if (strcmp(optionName, "http_port") == 0 ||
3634             strcmp(optionName, "ascii_port") == 0)
3635         protoName = "HTTP";
3636     else if (strcmp(optionName, "https_port") == 0)
3637         protoName = "HTTPS";
3638     else if (strcmp(optionName, "ftp_port") == 0)
3639         protoName = "FTP";
3640     if (protoName.isEmpty()) {
3641         self_destruct();
3642         return;
3643     }
3644
3645     char *token = ConfigParser::NextToken();
3646
3647     if (!token) {
3648         self_destruct();
3649         return;
3650     }
3651
3652     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3653     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3654     parsePortSpecification(s, token);
3655
3656     /* parse options ... */
3657     while ((token = ConfigParser::NextToken())) {
3658         parse_port_option(s, token);
3659     }
3660
3661 #if USE_OPENSSL
3662     // if clientca has been defined but not cafile, then use it to verify
3663     // but if cafile has been defined, only use that to verify
3664     if (s->clientca && !s->secure.caFiles.size())
3665         s->secure.caFiles.emplace_back(SBuf(s->clientca));
3666 #endif
3667
3668     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3669         s->secure.encryptTransport = true;
3670 #if USE_OPENSSL
3671         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3672         const bool hijacked = s->flags.isIntercepted();
3673         if (s->flags.tunnelSslBumping && !hijacked) {
3674             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3675             self_destruct();
3676         }
3677         if (hijacked && !s->flags.tunnelSslBumping) {
3678             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3679             self_destruct();
3680         }
3681 #endif
3682         if (s->flags.proxySurrogate) {
3683             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3684             self_destruct();
3685         }
3686     } else if (protoName.cmp("FTP") == 0) {
3687         /* ftp_port does not support ssl-bump */
3688         if (s->flags.tunnelSslBumping) {
3689             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3690             self_destruct();
3691         }
3692         if (s->flags.proxySurrogate) {
3693             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3694             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3695             self_destruct();
3696         }
3697     }
3698
3699     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3700         // clone the port options from *s to *(s->next)
3701         s->next = s->clone();
3702         s->next->s.setIPv4();
3703         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).c_str() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3704     }
3705
3706     while (*head != NULL)
3707         head = &((*head)->next);
3708
3709     *head = s;
3710 }
3711
3712 static void
3713 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3714 {
3715     char buf[MAX_IPSTRLEN];
3716
3717     storeAppendPrintf(e, "%s %s",
3718                       n,
3719                       s->s.toUrl(buf,MAX_IPSTRLEN));
3720
3721     // MODES and specific sub-options.
3722     if (s->flags.natIntercept)
3723         storeAppendPrintf(e, " intercept");
3724
3725     else if (s->flags.tproxyIntercept)
3726         storeAppendPrintf(e, " tproxy");
3727
3728     else if (s->flags.proxySurrogate)
3729         storeAppendPrintf(e, " require-proxy-header");
3730
3731     else if (s->flags.accelSurrogate) {
3732         storeAppendPrintf(e, " accel");
3733
3734         if (s->vhost)
3735             storeAppendPrintf(e, " vhost");
3736
3737         if (s->vport < 0)
3738             storeAppendPrintf(e, " vport");
3739         else if (s->vport > 0)
3740             storeAppendPrintf(e, " vport=%d", s->vport);
3741
3742         if (s->defaultsite)
3743             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3744
3745         // TODO: compare against prefix of 'n' instead of assuming http_port
3746         if (s->transport.protocol != AnyP::PROTO_HTTP)
3747             storeAppendPrintf(e, " protocol=%s", AnyP::UriScheme(s->transport.protocol).c_str());
3748
3749         if (s->allow_direct)
3750             storeAppendPrintf(e, " allow-direct");
3751
3752         if (s->ignore_cc)
3753             storeAppendPrintf(e, " ignore-cc");
3754
3755     }
3756
3757     // Generic independent options
3758
3759     if (s->name)
3760         storeAppendPrintf(e, " name=%s", s->name);
3761
3762 #if USE_HTTP_VIOLATIONS
3763     if (!s->flags.accelSurrogate && s->ignore_cc)
3764         storeAppendPrintf(e, " ignore-cc");
3765 #endif
3766
3767     if (s->connection_auth_disabled)
3768         storeAppendPrintf(e, " connection-auth=off");
3769     else
3770         storeAppendPrintf(e, " connection-auth=on");
3771
3772     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3773         const char *pmtu;
3774
3775         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3776             pmtu = "always";
3777         else
3778             pmtu = "transparent";
3779
3780         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3781     }
3782
3783     if (s->s.isAnyAddr() && !s->s.isIPv6())
3784         storeAppendPrintf(e, " ipv4");
3785
3786     if (s->tcp_keepalive.enabled) {
3787         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3788             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3789         } else {
3790             storeAppendPrintf(e, " tcpkeepalive");
3791         }
3792     }
3793
3794 #if USE_OPENSSL
3795     if (s->flags.tunnelSslBumping)
3796         storeAppendPrintf(e, " ssl-bump");
3797 #endif
3798
3799     s->secure.dumpCfg(e, "tls-");
3800
3801 #if USE_OPENSSL
3802     if (s->sslContextSessionId)
3803         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3804
3805     if (s->generateHostCertificates)
3806         storeAppendPrintf(e, " generate-host-certificates");
3807
3808     if (s->dynamicCertMemCacheSize != std::numeric_limits<size_t>::max())
3809         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%lu%s\n", (unsigned long)s->dynamicCertMemCacheSize, B_BYTES_STR);
3810 #endif
3811 }
3812
3813 static void
3814 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3815 {
3816     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3817         dump_generic_port(e, n, p);
3818         storeAppendPrintf(e, "\n");
3819     }
3820 }
3821
3822 void
3823 configFreeMemory(void)
3824 {
3825     free_all();
3826 #if USE_OPENSSL
3827     SSL_CTX_free(Config.ssl_client.sslContext);
3828 #endif
3829 }
3830
3831 void
3832 requirePathnameExists(const char *name, const char *path)
3833 {
3834
3835     struct stat sb;
3836     char pathbuf[BUFSIZ];
3837     assert(path != NULL);
3838
3839     if (Config.chroot_dir && (geteuid() == 0)) {
3840         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3841         path = pathbuf;
3842     }
3843
3844     if (stat(path, &sb) < 0) {
3845         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerror());
3846         // keep going to find more issues if we are only checking the config file with "-k parse"
3847         if (opt_parse_cfg_only)
3848             return;
3849         // this is fatal if it is found during startup or reconfigure
3850         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3851             fatalf("%s %s: %s", name, path, xstrerror());
3852     }
3853 }
3854
3855 #include "AccessLogEntry.h"
3856
3857 /**
3858  * We support several access_log configuration styles:
3859  *
3860  * #1: Deprecated ancient style without an explicit logging module:
3861  * access_log /var/log/access.log
3862  *
3863  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3864  * access_log none [acl ...]
3865  *
3866  * #3: Configurable logging module without named options:
3867  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3868  * If no explicit logformat name is given, the first ACL name, if any,
3869  * should not be an existing logformat name or it will be treated as such.
3870  * access_log module:place [logformat_name] [acl ...]
3871  *
3872  * #4: Configurable logging module with name=value options such as logformat=x:
3873  * The first ACL name may not contain '='.
3874  * access_log module:place [option ...] [acl ...]
3875  *
3876  */
3877 static void
3878 parse_access_log(CustomLog ** logs)
3879 {
3880     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
3881
3882     // default buffer size and fatal settings
3883     cl->bufferSize = 8*MAX_URL;
3884     cl->fatal = true;
3885
3886     /* determine configuration style */
3887
3888     const char *filename = ConfigParser::NextToken();
3889     if (!filename) {
3890         self_destruct();
3891         return;
3892     }
3893
3894     if (strcmp(filename, "none") == 0) {
3895         cl->type = Log::Format::CLF_NONE;
3896         aclParseAclList(LegacyParser, &cl->aclList, filename);
3897         while (*logs)
3898             logs = &(*logs)->next;
3899         *logs = cl;
3900         return;
3901     }
3902
3903     cl->filename = xstrdup(filename);
3904     cl->type = Log::Format::CLF_UNKNOWN;
3905     cl->rotateCount = -1; // default: use global logfile_rotate setting.
3906
3907     const char *token = ConfigParser::PeekAtToken();
3908     if (!token) { // style #1
3909         // no options to deal with
3910     } else if (!strchr(token, '=')) { // style #3
3911         // if logformat name is recognized,
3912         // pop the previewed token; Else it must be an ACL name
3913         if (setLogformat(cl, token, false))
3914             (void)ConfigParser::NextToken();
3915     } else { // style #4
3916         do {
3917             if (strncasecmp(token, "on-error=", 9) == 0) {
3918                 if (strncasecmp(token+9, "die", 3) == 0) {
3919                     cl->fatal = true;
3920                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
3921                     cl->fatal = false;
3922                 } else {
3923                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
3924                            token << "' expected 'drop' or 'die'");
3925                     self_destruct();
3926                 }
3927             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
3928                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
3929             } else if (strncasecmp(token, "rotate=", 7) == 0) {
3930                 cl->rotateCount = xatoi(token + 7);
3931             } else if (strncasecmp(token, "logformat=", 10) == 0) {
3932                 setLogformat(cl, token+10, true);
3933             } else if (!strchr(token, '=')) {
3934                 // Do not pop the token; it must be an ACL name
3935                 break; // done with name=value options, now to ACLs
3936             } else {
3937                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
3938                 self_destruct();
3939             }
3940             // Pop the token, it was a valid "name=value" option
3941             (void)ConfigParser::NextToken();
3942             // Get next with preview ConfigParser::NextToken call.
3943         } while ((token = ConfigParser::PeekAtToken()) != NULL);
3944     }
3945
3946     // set format if it has not been specified explicitly
3947     if (cl->type == Log::Format::CLF_UNKNOWN)
3948         setLogformat(cl, "squid", true);
3949
3950     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
3951
3952     while (*logs)
3953         logs = &(*logs)->next;
3954
3955     *logs = cl;
3956 }
3957
3958 /// sets CustomLog::type and, if needed, CustomLog::lf
3959 /// returns false iff there is no named log format
3960 static bool
3961 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
3962 {
3963     assert(cl);
3964     assert(logdef_name);
3965
3966     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
3967
3968     if (cl->type != Log::Format::CLF_UNKNOWN) {
3969         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
3970                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
3971         self_destruct();
3972         return false;
3973     }
3974
3975     /* look for the definition pointer corresponding to this name */
3976     Format::Format *lf = Log::TheConfig.logformats;
3977
3978     while (lf != NULL) {
3979         debugs(3, 9, "Comparing against '" << lf->name << "'");
3980
3981         if (strcmp(lf->name, logdef_name) == 0)
3982             break;
3983
3984         lf = lf->next;
3985     }
3986
3987     if (lf != NULL) {
3988         cl->type = Log::Format::CLF_CUSTOM;
3989         cl->logFormat = lf;
3990     } else if (strcmp(logdef_name, "auto") == 0) {
3991         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
3992         cl->type = Log::Format::CLF_SQUID;
3993     } else if (strcmp(logdef_name, "squid") == 0) {
3994         cl->type = Log::Format::CLF_SQUID;
3995     } else if (strcmp(logdef_name, "common") == 0) {
3996         cl->type = Log::Format::CLF_COMMON;
3997     } else if (strcmp(logdef_name, "combined") == 0) {
3998         cl->type = Log::Format::CLF_COMBINED;
3999 #if ICAP_CLIENT
4000     } else if (strcmp(logdef_name, "icap_squid") == 0) {
4001         cl->type = Log::Format::CLF_ICAP_SQUID;
4002 #endif
4003     } else if (strcmp(logdef_name, "useragent") == 0) {
4004         cl->type = Log::Format::CLF_USERAGENT;
4005     } else if (strcmp(logdef_name, "referrer") == 0) {
4006         cl->type = Log::Format::CLF_REFERER;
4007     } else if (dieWhenMissing) {
4008         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4009         self_destruct();
4010         return false;
4011     } else {
4012         return false;
4013     }
4014
4015     return true;
4016 }
4017
4018 static int
4019 check_null_access_log(CustomLog *customlog_definitions)
4020 {
4021     return customlog_definitions == NULL;
4022 }
4023
4024 static void
4025 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4026 {
4027     CustomLog *log;
4028
4029     for (log = logs; log; log = log->next) {
4030         storeAppendPrintf(entry, "%s ", name);
4031
4032         switch (log->type) {
4033
4034         case Log::Format::CLF_CUSTOM:
4035             storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4036             break;
4037
4038         case Log::Format::CLF_NONE:
4039             storeAppendPrintf(entry, "logformat=none");
4040             break;
4041
4042         case Log::Format::CLF_SQUID:
4043             storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4044             break;
4045
4046         case Log::Format::CLF_COMBINED:
4047             storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4048             break;
4049
4050         case Log::Format::CLF_COMMON:
4051             storeAppendPrintf(entry, "%s logformat=common", log->filename);
4052             break;
4053
4054 #if ICAP_CLIENT
4055         case Log::Format::CLF_ICAP_SQUID:
4056             storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4057             break;
4058 #endif
4059         case Log::Format::CLF_USERAGENT:
4060             storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4061             break;
4062
4063         case Log::Format::CLF_REFERER:
4064             storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4065             break;
4066
4067         case Log::Format::CLF_UNKNOWN:
4068             break;
4069         }
4070
4071         // default is on-error=die
4072         if (!log->fatal)
4073             storeAppendPrintf(entry, " on-error=drop");
4074
4075         // default: 64KB
4076         if (log->bufferSize != 64*1024)
4077             storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4078
4079         if (log->rotateCount >= 0)
4080             storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4081
4082         if (log->aclList)
4083             dump_acl_list(entry, log->aclList);
4084
4085         storeAppendPrintf(entry, "\n");
4086     }
4087 }
4088
4089 static void
4090 free_access_log(CustomLog ** definitions)
4091 {
4092     while (*definitions) {
4093         CustomLog *log = *definitions;
4094         *definitions = log->next;
4095
4096         log->logFormat = NULL;
4097         log->type = Log::Format::CLF_UNKNOWN;
4098
4099         if (log->aclList)
4100             aclDestroyAclList(&log->aclList);
4101
4102         safe_free(log->filename);
4103
4104         xfree(log);
4105     }
4106 }
4107
4108 /// parses list of integers form name=N1,N2,N3,...
4109 static bool
4110 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4111 {
4112     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4113         data += name.size();
4114         if (*data == '=') {
4115             while (true) {
4116                 ++data;
4117                 int value = 0;
4118                 if (!StringToInt(data, value, &data, 10))
4119                     break;
4120                 list.push_back(value);
4121                 if (*data == '\0' || *data != ',')
4122                     break;
4123             }
4124         }
4125     }
4126     return data && *data == '\0';
4127 }
4128
4129 static void
4130 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4131 {
4132 #if !HAVE_CPU_AFFINITY
4133     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4134            "support, do not set 'cpu_affinity_map'");
4135     self_destruct();
4136 #endif /* HAVE_CPU_AFFINITY */
4137
4138     if (!*cpuAffinityMap)
4139         *cpuAffinityMap = new CpuAffinityMap;
4140
4141     const char *const pToken = ConfigParser::NextToken();
4142     const char *const cToken = ConfigParser::NextToken();
4143     std::vector<int> processes, cores;
4144     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4145         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4146                "in 'cpu_affinity_map'");
4147         self_destruct();
4148     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4149         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4150                "'cpu_affinity_map'");
4151         self_destruct();
4152     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4153         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4154                "process_numbers and cores lists differ in length or " <<
4155                "contain numbers <= 0");
4156         self_destruct();
4157     }
4158 }
4159
4160 static void
4161 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4162 {
4163     if (cpuAffinityMap) {
4164         storeAppendPrintf(entry, "%s process_numbers=", name);
4165         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4166             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4167                               cpuAffinityMap->processes()[i]);
4168         }
4169         storeAppendPrintf(entry, " cores=");
4170         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4171             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4172                               cpuAffinityMap->cores()[i]);
4173         }
4174         storeAppendPrintf(entry, "\n");
4175     }
4176 }
4177
4178 static void
4179 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4180 {
4181     delete *cpuAffinityMap;
4182     *cpuAffinityMap = NULL;
4183 }
4184
4185 #if USE_ADAPTATION
4186
4187 static void
4188 parse_adaptation_service_set_type()
4189 {
4190     Adaptation::Config::ParseServiceSet();
4191 }
4192
4193 static void
4194 parse_adaptation_service_chain_type()
4195 {
4196     Adaptation::Config::ParseServiceChain();
4197 }
4198
4199 static void
4200 parse_adaptation_access_type()
4201 {
4202     Adaptation::Config::ParseAccess(LegacyParser);
4203 }
4204 #endif /* USE_ADAPTATION */
4205
4206 #if ICAP_CLIENT
4207
4208 static void
4209 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4210 {
4211     cfg->parseService();
4212 }
4213
4214 static void
4215 free_icap_service_type(Adaptation::Icap::Config * cfg)
4216 {
4217     cfg->freeService();
4218 }
4219
4220 static void
4221 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4222 {
4223     cfg.dumpService(entry, name);
4224 }
4225
4226 static void
4227 parse_icap_class_type()
4228 {
4229     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4230            "Use 'adaptation_service_set' instead");
4231     Adaptation::Config::ParseServiceSet();
4232 }
4233
4234 static void
4235 parse_icap_access_type()
4236 {
4237     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4238            "Use 'adaptation_access' instead");
4239     Adaptation::Config::ParseAccess(LegacyParser);
4240 }
4241
4242 #endif
4243
4244 #if USE_ECAP
4245
4246 static void
4247 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4248 {
4249     cfg->parseService();
4250 }
4251
4252 static void
4253 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4254 {
4255     cfg->freeService();
4256 }
4257
4258 static void
4259 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4260 {
4261     cfg.dumpService(entry, name);
4262 }
4263
4264 #endif /* USE_ECAP */
4265
4266 #if ICAP_CLIENT
4267 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4268 {
4269     char *token;
4270     time_t d;
4271     time_t m;
4272     cfg->service_failure_limit = GetInteger();
4273
4274     if ((token = ConfigParser::NextToken()) == NULL)
4275         return;
4276
4277     if (strcmp(token,"in") != 0) {
4278         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4279         self_destruct();
4280     }
4281
4282     if ((token = ConfigParser::NextToken()) == NULL) {
4283         self_destruct();
4284     }
4285
4286     d = static_cast<time_t> (xatoi(token));
4287
4288     m = static_cast<time_t> (1);
4289
4290     if (0 == d)
4291         (void) 0;
4292     else if ((token = ConfigParser::NextToken()) == NULL) {
4293         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4294         self_destruct();
4295     } else if ((m = parseTimeUnits(token, false)) == 0)
4296         self_destruct();
4297
4298     cfg->oldest_service_failure = (m * d);
4299 }
4300
4301 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4302 {
4303     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4304     if (cfg.oldest_service_failure > 0) {
4305         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4306     }
4307     storeAppendPrintf(entry, "\n");
4308 }
4309
4310 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4311 {
4312     cfg->oldest_service_failure = 0;
4313     cfg->service_failure_limit = 0;
4314 }
4315 #endif
4316
4317 #if USE_OPENSSL
4318 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4319 {
4320     char *al;
4321     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4322     if ((al = ConfigParser::NextToken()) == NULL) {
4323         self_destruct();
4324         return;
4325     }
4326
4327     const char *param;
4328     if ( char *s = strchr(al, '{')) {
4329         *s = '\0'; // terminate the al string
4330         ++s;
4331         param = s;
4332         s = strchr(s, '}');
4333         if (!s) {
4334             self_destruct();
4335             return;
4336         }
4337         *s = '\0';
4338     } else
4339         param = NULL;
4340
4341     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4342         ca->alg = Ssl::algSetValidAfter;
4343         ca->param = xstrdup("on");
4344     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4345         ca->alg = Ssl::algSetValidBefore;
4346         ca->param = xstrdup("on");
4347     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4348         ca->alg = Ssl::algSetCommonName;
4349         if (param) {
4350             if (strlen(param) > 64) {
4351                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4352                 self_destruct();
4353                 return;
4354             }
4355             ca->param = xstrdup(param);
4356         }
4357     } else {
4358         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4359         self_destruct();
4360         return;
4361     }
4362
4363     aclParseAclList(LegacyParser, &ca->aclList, al);
4364
4365     while (*cert_adapt)
4366         cert_adapt = &(*cert_adapt)->next;
4367
4368     *cert_adapt = ca;
4369 }
4370
4371 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4372 {
4373     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4374         storeAppendPrintf(entry, "%s ", name);
4375         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4376         if (ca->aclList)
4377             dump_acl_list(entry, ca->aclList);
4378         storeAppendPrintf(entry, "\n");
4379     }
4380 }
4381
4382 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4383 {
4384     while (*cert_adapt) {
4385         sslproxy_cert_adapt *ca = *cert_adapt;
4386         *cert_adapt = ca->next;
4387         safe_free(ca->param);
4388
4389         if (ca->aclList)
4390             aclDestroyAclList(&ca->aclList);
4391
4392         safe_free(ca);
4393     }
4394 }
4395
4396 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4397 {
4398     char *al;
4399     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4400     if ((al = ConfigParser::NextToken()) == NULL) {
4401         self_destruct();
4402         return;
4403     }
4404
4405     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4406         cs->alg = Ssl::algSignTrusted;
4407     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4408         cs->alg = Ssl::algSignUntrusted;
4409     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4410         cs->alg = Ssl::algSignSelf;
4411     else {
4412         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4413         self_destruct();
4414         return;
4415     }
4416
4417     aclParseAclList(LegacyParser, &cs->aclList, al);
4418
4419     while (*cert_sign)
4420         cert_sign = &(*cert_sign)->next;
4421
4422     *cert_sign = cs;
4423 }
4424
4425 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4426 {
4427     sslproxy_cert_sign *cs;
4428     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4429         storeAppendPrintf(entry, "%s ", name);
4430         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4431         if (cs->aclList)
4432             dump_acl_list(entry, cs->aclList);
4433         storeAppendPrintf(entry, "\n");
4434     }
4435 }
4436
4437 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4438 {
4439     while (*cert_sign) {
4440         sslproxy_cert_sign *cs = *cert_sign;
4441         *cert_sign = cs->next;
4442
4443         if (cs->aclList)
4444             aclDestroyAclList(&cs->aclList);
4445
4446         safe_free(cs);
4447     }
4448 }
4449
4450 class sslBumpCfgRr: public ::RegisteredRunner
4451 {
4452 public:
4453     static Ssl::BumpMode lastDeprecatedRule;
4454     /* RegisteredRunner API */
4455     virtual void finalizeConfig();
4456 };
4457
4458 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4459
4460 RunnerRegistrationEntry(sslBumpCfgRr);
4461
4462 void
4463 sslBumpCfgRr::finalizeConfig()
4464 {
4465     if (lastDeprecatedRule != Ssl::bumpEnd) {
4466         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4467         static char buf[1024];
4468         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4469             strcpy(buf, "ssl_bump deny all");
4470             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4471                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4472                    "must not use implicit rules. Update your ssl_bump rules.");
4473         } else {
4474             strcpy(buf, "ssl_bump allow all");
4475             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4476                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4477                    "inferior to the newer server-first bumping mode. New ssl_bump"
4478                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4479         }
4480         parse_line(buf);
4481     }
4482 }
4483
4484 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4485 {
4486     typedef const char *BumpCfgStyle;
4487     BumpCfgStyle bcsNone = NULL;
4488     BumpCfgStyle bcsNew = "new client/server-first/none";
4489     BumpCfgStyle bcsOld = "deprecated allow/deny";
4490     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4491     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4492     char *bm;
4493     if ((bm = ConfigParser::NextToken()) == NULL) {
4494         self_destruct();
4495         return;
4496     }
4497
4498     // if this is the first rule proccessed
4499     if (*ssl_bump == NULL) {
4500         bumpCfgStyleLast = bcsNone;
4501         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4502     }
4503
4504     allow_t action = allow_t(ACCESS_ALLOWED);
4505
4506     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4507         action.kind = Ssl::bumpClientFirst;
4508         bumpCfgStyleNow = bcsNew;
4509     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4510         action.kind = Ssl::bumpServerFirst;
4511         bumpCfgStyleNow = bcsNew;
4512     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4513         action.kind = Ssl::bumpPeek;
4514         bumpCfgStyleNow = bcsNew;
4515     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4516         action.kind = Ssl::bumpStare;
4517         bumpCfgStyleNow = bcsNew;
4518     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4519         action.kind = Ssl::bumpSplice;
4520         bumpCfgStyleNow = bcsNew;
4521     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4522         action.kind = Ssl::bumpBump;
4523         bumpCfgStyleNow = bcsNew;
4524     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4525         action.kind = Ssl::bumpTerminate;
4526         bumpCfgStyleNow = bcsNew;
4527     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4528         action.kind = Ssl::bumpNone;
4529         bumpCfgStyleNow = bcsNew;
4530     } else if (strcmp(bm, "allow") == 0) {
4531         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4532                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4533                "is usually inferior to the newer server-first "
4534                "bumping mode. Update your ssl_bump rules.");
4535         action.kind = Ssl::bumpClientFirst;
4536         bumpCfgStyleNow = bcsOld;
4537         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4538     } else if (strcmp(bm, "deny") == 0) {
4539         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4540                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4541                "your ssl_bump rules.");
4542         action.kind = Ssl::bumpNone;
4543         bumpCfgStyleNow = bcsOld;
4544         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4545     } else {
4546         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4547         self_destruct();
4548         return;
4549     }
4550
4551     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4552         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4553                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4554         self_destruct();
4555         return;
4556     }
4557
4558     bumpCfgStyleLast = bumpCfgStyleNow;
4559
4560     Acl::AndNode *rule = new Acl::AndNode;
4561     rule->context("(ssl_bump rule)", config_input_line);
4562     rule->lineParse();
4563     // empty rule OK
4564
4565     assert(ssl_bump);
4566     if (!*ssl_bump) {
4567         *ssl_bump = new Acl::Tree;
4568         (*ssl_bump)->context("(ssl_bump rules)", config_input_line);
4569     }
4570
4571     (*ssl_bump)->add(rule, action);
4572 }
4573
4574 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4575 {
4576     if (ssl_bump)
4577         dump_SBufList(entry, ssl_bump->treeDump(name, Ssl::BumpModeStr));
4578 }
4579
4580 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4581 {
4582     free_acl_access(ssl_bump);
4583 }
4584
4585 #endif
4586
4587 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4588 {
4589     if (!headers)
4590         return;
4591
4592     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4593         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4594         if (hwa->aclList)
4595             dump_acl_list(entry, hwa->aclList);
4596         storeAppendPrintf(entry, "\n");
4597     }
4598 }
4599
4600 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4601 {
4602     char *fn;
4603     if (!*headers) {
4604         *headers = new HeaderWithAclList;
4605     }
4606     if ((fn = ConfigParser::NextToken()) == NULL) {
4607         self_destruct();
4608         return;
4609     }
4610     HeaderWithAcl hwa;
4611     hwa.fieldName = fn;
4612     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4613     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4614         hwa.fieldId = Http::HdrType::OTHER;
4615
4616     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4617     ConfigParser::EnableMacros();
4618     String buf = ConfigParser::NextQuotedToken();
4619     ConfigParser::DisableMacros();
4620     hwa.fieldValue = buf.termedBuf();
4621     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4622     if (hwa.quoted) {
4623         if (!nlf->parse(hwa.fieldValue.c_str())) {
4624             self_destruct();
4625             return;
4626         }
4627         hwa.valueFormat = nlf;
4628     } else
4629         delete nlf;
4630     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4631     (*headers)->push_back(hwa);
4632 }
4633
4634 static void free_HeaderWithAclList(HeaderWithAclList **header)
4635 {
4636     if (!(*header))
4637         return;
4638
4639     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4640         if (hwa->aclList)
4641             aclDestroyAclList(&hwa->aclList);
4642
4643         if (hwa->valueFormat) {
4644             delete hwa->valueFormat;
4645             hwa->valueFormat = NULL;
4646         }
4647     }
4648     delete *header;
4649     *header = NULL;
4650 }
4651
4652 static void parse_note(Notes *notes)
4653 {
4654     assert(notes);
4655     notes->parse(LegacyParser);
4656 }
4657
4658 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4659 {
4660     notes.dump(entry, name);
4661 }
4662
4663 static void free_note(Notes *notes)
4664 {
4665     notes->clean();
4666 }
4667
4668 static bool FtpEspvDeprecated = false;
4669 static void parse_ftp_epsv(acl_access **ftp_epsv)
4670 {
4671     allow_t ftpEpsvDeprecatedAction;
4672     bool ftpEpsvIsDeprecatedRule = false;
4673
4674     char *t = ConfigParser::PeekAtToken();
4675     if (!t) {
4676         self_destruct();
4677         return;
4678     }
4679
4680     if (!strcmp(t, "off")) {
4681         (void)ConfigParser::NextToken();
4682         ftpEpsvIsDeprecatedRule = true;
4683         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4684     } else if (!strcmp(t, "on")) {
4685         (void)ConfigParser::NextToken();
4686         ftpEpsvIsDeprecatedRule = true;
4687         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4688     }
4689
4690     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4691     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4692     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4693     // then abort
4694     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4695             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4696         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4697         self_destruct();
4698     }
4699
4700     if (ftpEpsvIsDeprecatedRule) {
4701         // overwrite previous ftp_epsv lines
4702         delete *ftp_epsv;
4703         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4704             Acl::AndNode *ftpEpsvRule = new Acl::AndNode;
4705             ftpEpsvRule->context("(ftp_epsv rule)", config_input_line);
4706             ACL *a = ACL::FindByName("all");
4707             if (!a) {
4708                 self_destruct();
4709                 return;
4710             }
4711             ftpEpsvRule->add(a);
4712             *ftp_epsv = new Acl::Tree;
4713             (*ftp_epsv)->context("(ftp_epsv rules)", config_input_line);
4714             (*ftp_epsv)->add(ftpEpsvRule, ftpEpsvDeprecatedAction);
4715         } else
4716             *ftp_epsv = NULL;
4717         FtpEspvDeprecated = true;
4718     } else {
4719         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4720     }
4721 }
4722
4723 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4724 {
4725     if (ftp_epsv)
4726         dump_SBufList(entry, ftp_epsv->treeDump(name, NULL));
4727 }
4728
4729 static void free_ftp_epsv(acl_access **ftp_epsv)
4730 {
4731     free_acl_access(ftp_epsv);
4732     FtpEspvDeprecated = false;
4733 }
4734
4735 static void
4736 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4737 {
4738     time_msec_t tval;
4739     parseTimeLine(&tval, T_SECOND_STR, false, true);
4740     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4741
4742     char *key, *value;
4743     while(ConfigParser::NextKvPair(key, value)) {
4744         if (strcasecmp(key, "on_timeout") == 0) {
4745             if (strcasecmp(value, "bypass") == 0)
4746                 config->action = toutActBypass;
4747             else if (strcasecmp(value, "fail") == 0)
4748                 config->action = toutActFail;
4749             else if (strcasecmp(value, "retry") == 0)
4750                 config->action = toutActRetry;
4751             else if (strcasecmp(value, "use_configured_response") == 0) {
4752                 config->action = toutActUseConfiguredResponse;
4753             } else {
4754                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4755                 self_destruct();
4756             }
4757         } else if (strcasecmp(key, "response") == 0) {
4758             config->response = xstrdup(value);
4759         } else {
4760             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4761             self_destruct();
4762         }
4763     }
4764
4765     if (config->action == toutActUseConfiguredResponse && !config->response) {
4766         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4767         self_destruct();
4768     }
4769
4770     if (config->action != toutActUseConfiguredResponse && config->response) {
4771         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4772         self_destruct();
4773     }
4774 }
4775
4776 static void
4777 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4778 {
4779     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4780     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4781
4782     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4783     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4784
4785     if (config.response)
4786         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4787
4788     storeAppendPrintf(entry, "\n");
4789 }
4790
4791 static void
4792 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4793 {
4794     Config.Timeout.urlRewrite = 0;
4795     config->action = 0;
4796     safe_free(config->response);
4797 }
4798
4799 static void
4800 parse_configuration_includes_quoted_values(bool *)
4801 {
4802     int val = 0;
4803     parse_onoff(&val);
4804
4805     // If quoted values is set to on then enable new strict mode parsing
4806     if (val) {
4807         ConfigParser::RecognizeQuotedValues = true;
4808         ConfigParser::StrictMode = true;
4809     } else {
4810         ConfigParser::RecognizeQuotedValues = false;
4811         ConfigParser::StrictMode = false;
4812     }
4813 }
4814
4815 static void
4816 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4817 {
4818     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4819     dump_onoff(entry, name, val);
4820 }
4821
4822 static void
4823 free_configuration_includes_quoted_values(bool *)
4824 {
4825     ConfigParser::RecognizeQuotedValues = false;
4826     ConfigParser::StrictMode = false;
4827 }
4828
4829 static void
4830 parse_on_unsupported_protocol(acl_access **access)
4831 {
4832     char *tm;
4833     if ((tm = ConfigParser::NextToken()) == NULL) {
4834         self_destruct();
4835         return;
4836     }
4837
4838     allow_t action = allow_t(ACCESS_ALLOWED);
4839     if (strcmp(tm, "tunnel") == 0)
4840         action.kind = 1;
4841     else if (strcmp(tm, "respond") == 0)
4842         action.kind = 2;
4843     else {
4844         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4845         self_destruct();
4846         return;
4847     }
4848
4849     Acl::AndNode *rule = new Acl::AndNode;
4850     rule->context("(on_unsupported_protocol rule)", config_input_line);
4851     rule->lineParse();
4852     // empty rule OK
4853
4854     assert(access);
4855     if (!*access) {
4856         *access = new Acl::Tree;
4857         (*access)->context("(on_unsupported_protocol rules)", config_input_line);
4858     }
4859
4860     (*access)->add(rule, action);
4861 }
4862
4863 static void
4864 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4865 {
4866     const char *on_error_tunnel_mode_str[] = {
4867         "none",
4868         "tunnel",
4869         "respond",
4870         NULL
4871     };
4872     if (access) {
4873         SBufList lines = access->treeDump(name, on_error_tunnel_mode_str);
4874         dump_SBufList(entry, lines);
4875     }
4876 }
4877
4878 static void
4879 free_on_unsupported_protocol(acl_access **access)
4880 {
4881     free_acl_access(access);
4882 }
4883