src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2025 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclSizeLimit.h"
  15 #include "acl/Address.h"
  16 #include "acl/Gadgets.h"
  17 #include "acl/MethodData.h"
  18 #include "acl/Node.h"
  19 #include "acl/Tree.h"
  20 #include "anyp/PortCfg.h"
  21 #include "anyp/UriScheme.h"
  22 #include "auth/Config.h"
  23 #include "auth/Scheme.h"
  24 #include "AuthReg.h"
  25 #include "base/CharacterSet.h"
  26 #include "base/PackableStream.h"
  27 #include "base/RunnersRegistry.h"
  28 #include "cache_cf.h"
  29 #include "CachePeer.h"
  30 #include "CachePeers.h"
  31 #include "ConfigOption.h"
  32 #include "ConfigParser.h"
  33 #include "CpuAffinityMap.h"
  34 #include "debug/Messages.h"
  35 #include "DiskIO/DiskIOModule.h"
  36 #include "eui/Config.h"
  37 #include "ExternalACL.h"
  38 #include "format/Format.h"
  39 #include "fqdncache.h"
  40 #include "ftp/Elements.h"
  41 #include "globals.h"
  42 #include "HttpHeaderTools.h"
  43 #include "HttpUpgradeProtocolAccess.h"
  44 #include "icmp/IcmpConfig.h"
  45 #include "ip/Intercept.h"
  46 #include "ip/NfMarkConfig.h"
  47 #include "ip/QosConfig.h"
  48 #include "ip/tools.h"
  49 #include "ipc/Kids.h"
  50 #include "log/Config.h"
  51 #include "log/CustomLog.h"
  52 #include "MemBuf.h"
  53 #include "MessageDelayPools.h"
  54 #include "mgr/ActionPasswordList.h"
  55 #include "mgr/Registration.h"
  56 #include "neighbors.h"
  57 #include "NeighborTypeDomainList.h"
  58 #include "Parsing.h"
  59 #include "pconn.h"
  60 #include "PeerDigest.h"
  61 #include "PeerPoolMgr.h"
  62 #include "redirect.h"
  63 #include "RefreshPattern.h"
  64 #include "rfc1738.h"
  65 #include "sbuf/List.h"
  66 #include "sbuf/Stream.h"
  67 #include "SquidConfig.h"
  68 #include "SquidString.h"
  69 #include "ssl/ProxyCerts.h"
  70 #include "Store.h"
  71 #include "store/Disks.h"
  72 #include "tools.h"
  73 #include "util.h"
  74 #include "wordlist.h"
  75 /* wccp2 has its own conditional definitions */
  76 #include "wccp2.h"
  77 #if USE_ADAPTATION
  78 #include "adaptation/Config.h"
  79 #endif
  80 #if ICAP_CLIENT
  81 #include "adaptation/icap/Config.h"
  82 #endif
  83 #if USE_ECAP
  84 #include "adaptation/ecap/Config.h"
  85 #endif
  86 #if USE_OPENSSL
  87 #include "ssl/Config.h"
  88 #include "ssl/support.h"
  89 #endif
  90 #if SQUID_SNMP
  91 #include "snmp.h"
  92 #endif
  93
  94 #include <algorithm>
  95 #if HAVE_GLOB_H
  96 #include <glob.h>
  97 #endif
  98 #include <chrono>
  99 #include <limits>
 100 #include <list>
 101 #if HAVE_PWD_H
 102 #include <pwd.h>
 103 #endif
 104 #if HAVE_GRP_H
 105 #include <grp.h>
 106 #endif
 107 #if HAVE_SYS_SOCKET_H
 108 #include <sys/socket.h>
 109 #endif
 110 #if HAVE_SYS_STAT_H
 111 #include <sys/stat.h>
 112 #endif
 113
 114 #if USE_OPENSSL
 115 #include "ssl/gadgets.h"
 116 #endif
 117
 118 #if USE_ADAPTATION
 119 static void parse_adaptation_service_set_type();
 120 static void parse_adaptation_service_chain_type();
 121 static void parse_adaptation_access_type();
 122 #endif
 123
 124 #if ICAP_CLIENT
 125 static void parse_icap_service_type(Adaptation::Icap::Config *);
 126 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 127 static void free_icap_service_type(Adaptation::Icap::Config *);
 128 static void parse_icap_class_type();
 129 static void parse_icap_access_type();
 130
 131 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 132 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 133 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 134 #endif
 135
 136 #if USE_ECAP
 137 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 138 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 139 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 140 #endif
 141
 142 static peer_t parseNeighborType(const char *s);
 143
 144 static const char *const T_NANOSECOND_STR = "nanosecond";
 145 static const char *const T_MICROSECOND_STR = "microsecond";
 146 static const char *const T_MILLISECOND_STR = "millisecond";
 147 static const char *const T_SECOND_STR = "second";
 148 static const char *const T_MINUTE_STR = "minute";
 149 static const char *const T_HOUR_STR = "hour";
 150 static const char *const T_DAY_STR = "day";
 151 static const char *const T_WEEK_STR = "week";
 152 static const char *const T_FORTNIGHT_STR = "fortnight";
 153 static const char *const T_MONTH_STR = "month";
 154 static const char *const T_YEAR_STR = "year";
 155 static const char *const T_DECADE_STR = "decade";
 156
 157 static const char *const B_BYTES_STR = "bytes";
 158 static const char *const B_KBYTES_STR = "KB";
 159 static const char *const B_MBYTES_STR = "MB";
 160 static const char *const B_GBYTES_STR = "GB";
 161
 162 // std::chrono::years requires C++20. Do our own rough calculation for now.
 163 static const double HoursPerYear = 24*365.2522;
 164
 165 static void parse_cache_log_message(DebugMessages **messages);
 166 static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *messages);
 167 static void free_cache_log_message(DebugMessages **messages);
 168
 169 static void parse_access_log(CustomLog ** customlog_definitions);
 170 static int check_null_access_log(CustomLog *customlog_definitions);
 171 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 172 static void free_access_log(CustomLog ** definitions);
 173
 174 static void configDoConfigure(void);
 175 static void parse_refreshpattern(RefreshPattern **);
 176 static void parse_u_short(unsigned short * var);
 177 static void parse_string(char **);
 178 static void default_all(void);
 179 static void defaults_if_none(void);
 180 static void defaults_postscriptum(void);
 181 static int parse_line(char *);
 182 static void parse_obsolete(const char *);
 183 static void parseBytesLine(size_t * bptr, const char *units);
 184 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 185 static size_t parseBytesUnits(const char *unit);
 186 static void free_all(void);
 187 void requirePathnameExists(const char *name, const char *path);
 188 static OBJH dump_config;
 189 #if USE_HTTP_VIOLATIONS
 190 static void free_HeaderManglers(HeaderManglers **pm);
 191 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 192 static void parse_http_header_access(HeaderManglers **manglers);
 193 #define free_http_header_access free_HeaderManglers
 194 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 195 static void parse_http_header_replace(HeaderManglers **manglers);
 196 #define free_http_header_replace free_HeaderManglers
 197 #endif
 198 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 199 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 200 static void free_HeaderWithAclList(HeaderWithAclList **header);
 201 static void parse_note(Notes *);
 202 static void dump_note(StoreEntry *, const char *, Notes &);
 203 static void free_note(Notes *);
 204 static void parse_denyinfo(AclDenyInfoList ** var);
 205 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 206 static void free_denyinfo(AclDenyInfoList ** var);
 207
 208 #if USE_WCCPv2
 209 static void parse_IpAddress_list(Ip::Address_list **);
 210 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 211 static void free_IpAddress_list(Ip::Address_list **);
 212 #if CURRENTLY_UNUSED
 213 static int check_null_IpAddress_list(const Ip::Address_list *);
 214 #endif /* CURRENTLY_UNUSED */
 215 #endif /* USE_WCCPv2 */
 216
 217 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 218 #define parse_PortCfg(l) parsePortCfg((l), token)
 219 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 220 #define free_PortCfg(h)  *(h)=NULL
 221
 222 #if USE_OPENSSL
 223 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 224 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 225 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 226 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 227 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 228 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 229 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 230 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 231 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 232 #endif /* USE_OPENSSL */
 233
 234 static void parse_ftp_epsv(acl_access **ftp_epsv);
 235 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 236 static void free_ftp_epsv(acl_access **ftp_epsv);
 237
 238 static void parse_b_size_t(size_t * var);
 239 static void parse_b_int64_t(int64_t * var);
 240
 241 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 242 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 243 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 244
 245 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 246 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 247 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 248
 249 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 250
 251 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 252 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 253 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 254 static void parse_on_unsupported_protocol(acl_access **access);
 255 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 256 static void free_on_unsupported_protocol(acl_access **access);
 257 static void ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, Acl::Node *acl = nullptr);
 258 static void parse_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards);
 259 static void dump_http_upgrade_request_protocols(StoreEntry *entry, const char *name, HttpUpgradeProtocolAccess *protoGuards);
 260 static void free_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards);
 261
 262 /*
 263  * LegacyParser is a parser for legacy code that uses the global
 264  * approach.  This is static so that it is only exposed to cache_cf.
 265  * Other modules needing access to a ConfigParser should have it
 266  * provided to them in their parserFOO methods.
 267  */
 268 static ConfigParser LegacyParser = ConfigParser();
 269
 270 const char *cfg_directive = nullptr;
 271 const char *cfg_filename = nullptr;
 272 int config_lineno = 0;
 273 char config_input_line[BUFSIZ] = {};
 274
 275 void
 276 self_destruct(void)
 277 {
 278     LegacyParser.destruct();
 279 }
 280
 281 static void
 282 SetConfigFilename(char const *file_name, bool is_pipe)
 283 {
 284     if (is_pipe)
 285         cfg_filename = file_name + 1;
 286     else
 287         cfg_filename = file_name;
 288 }
 289
 290 /// Determines whether the given squid.conf character is a token-delimiting
 291 /// space character according to squid.conf preprocessor grammar. That grammar
 292 /// only recognizes two space characters: ASCII SP and HT. Unlike isspace(3),
 293 /// this function is not sensitive to locale(1) and does not classify LF, VT,
 294 /// FF, and CR characters as token-delimiting space. However, some squid.conf
 295 /// directive-specific parsers still define space based on isspace(3).
 296 static bool
 297 IsSpace(const char ch)
 298 {
 299     return CharacterSet::WSP[ch];
 300 }
 301
 302 static const char*
 303 skip_ws(const char* s)
 304 {
 305     while (IsSpace(*s))
 306         ++s;
 307
 308     return s;
 309 }
 310
 311 static int
 312 parseManyConfigFiles(char* files, int depth)
 313 {
 314     int error_count = 0;
 315     char* saveptr = nullptr;
 316 #if HAVE_GLOB
 317     char *path;
 318     glob_t globbuf;
 319     int i;
 320     memset(&globbuf, 0, sizeof(globbuf));
 321     for (path = strwordtok(files, &saveptr); path; path = strwordtok(nullptr, &saveptr)) {
 322         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, nullptr, &globbuf) != 0) {
 323             int xerrno = errno;
 324             fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
 325         }
 326     }
 327     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 328         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 329     }
 330     globfree(&globbuf);
 331 #else
 332     char* file = strwordtok(files, &saveptr);
 333     while (file != NULL) {
 334         error_count += parseOneConfigFile(file, depth);
 335         file = strwordtok(nullptr, &saveptr);
 336     }
 337 #endif /* HAVE_GLOB */
 338     return error_count;
 339 }
 340
 341 static void
 342 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 343 {
 344     assert(str != nullptr);
 345     assert(newSubstr != nullptr);
 346
 347     unsigned newSubstrLen = strlen(newSubstr);
 348     if (newSubstrLen > substrLen)
 349         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 350
 351     // move tail part including zero
 352     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 353     // copy new substring in place
 354     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 355
 356     len = strlen(str);
 357 }
 358
 359 static void
 360 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 361 {
 362     assert(line != nullptr);
 363     assert(macroName != nullptr);
 364     assert(substStr != nullptr);
 365     unsigned macroNameLen = strlen(macroName);
 366     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 367         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 368 }
 369
 370 static void
 371 ProcessMacros(char*& line, int& len)
 372 {
 373     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 374     SubstituteMacro(line, len, "${process_name}", TheKidName.c_str());
 375     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 376 }
 377
 378 static void
 379 trim_trailing_ws(char* str)
 380 {
 381     assert(str != nullptr);
 382     unsigned i = strlen(str);
 383     while ((i > 0) && IsSpace(str[i - 1]))
 384         --i;
 385     str[i] = '\0';
 386 }
 387
 388 static const char*
 389 FindStatement(const char* line, const char* statement)
 390 {
 391     assert(line != nullptr);
 392     assert(statement != nullptr);
 393
 394     const char* str = skip_ws(line);
 395     unsigned len = strlen(statement);
 396     if (strncmp(str, statement, len) == 0) {
 397         str += len;
 398         if (*str == '\0')
 399             return str;
 400         else if (IsSpace(*str))
 401             return skip_ws(str);
 402     }
 403
 404     return nullptr;
 405 }
 406
 407 static bool
 408 StrToInt(const char* str, long& number)
 409 {
 410     assert(str != nullptr);
 411
 412     char* end;
 413     number = strtol(str, &end, 0);
 414
 415     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 416 }
 417
 418 static bool
 419 EvalBoolExpr(const char* expr)
 420 {
 421     assert(expr != nullptr);
 422     if (strcmp(expr, "true") == 0) {
 423         return true;
 424     } else if (strcmp(expr, "false") == 0) {
 425         return false;
 426     } else if (const char* equation = strchr(expr, '=')) {
 427         const char* rvalue = skip_ws(equation + 1);
 428         char* lvalue = (char*)xmalloc(equation - expr + 1);
 429         xstrncpy(lvalue, expr, equation - expr + 1);
 430         trim_trailing_ws(lvalue);
 431
 432         long number1;
 433         if (!StrToInt(lvalue, number1))
 434             fatalf("String is not a integer number: '%s'\n", lvalue);
 435         long number2;
 436         if (!StrToInt(rvalue, number2))
 437             fatalf("String is not a integer number: '%s'\n", rvalue);
 438
 439         xfree(lvalue);
 440         return number1 == number2;
 441     }
 442     fatalf("Unable to evaluate expression '%s'\n", expr);
 443     return false; // this place cannot be reached
 444 }
 445
 446 static int
 447 parseOneConfigFile(const char *file_name, unsigned int depth)
 448 {
 449     FILE *fp = nullptr;
 450     const char *orig_cfg_filename = cfg_filename;
 451     const int orig_config_lineno = config_lineno;
 452     char *token = nullptr;
 453     char *tmp_line = nullptr;
 454     int tmp_line_len = 0;
 455     int err_count = 0;
 456     int is_pipe = 0;
 457
 458     debugs(3, Important(68), "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 459     if (depth > 16) {
 460         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 461         return 1;
 462     }
 463
 464     if (file_name[0] == '!' || file_name[0] == '|') {
 465         fp = popen(file_name + 1, "r");
 466         is_pipe = 1;
 467     } else {
 468         fp = fopen(file_name, "r");
 469     }
 470
 471     if (!fp) {
 472         int xerrno = errno;
 473         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
 474     }
 475
 476 #if _SQUID_WINDOWS_
 477     setmode(fileno(fp), O_TEXT);
 478 #endif
 479
 480     SetConfigFilename(file_name, bool(is_pipe));
 481
 482     memset(config_input_line, '\0', BUFSIZ);
 483
 484     config_lineno = 0;
 485
 486     std::vector<bool> if_states;
 487     while (fgets(config_input_line, BUFSIZ, fp)) {
 488         ++config_lineno;
 489
 490         if ((token = strchr(config_input_line, '\n')))
 491             *token = '\0';
 492
 493         if ((token = strchr(config_input_line, '\r')))
 494             *token = '\0';
 495
 496         // strip any prefix whitespace off the line.
 497         const char *p = skip_ws(config_input_line);
 498         if (config_input_line != p)
 499             memmove(config_input_line, p, strlen(p)+1);
 500
 501         if (strncmp(config_input_line, "#line ", 6) == 0) {
 502             static char new_file_name[1024];
 503             static char *file;
 504             static char new_lineno;
 505             token = config_input_line + 6;
 506             new_lineno = strtol(token, &file, 0) - 1;
 507
 508             if (file == token)
 509                 continue;   /* Not a valid #line directive, may be a comment */
 510
 511             while (*file && IsSpace(*file))
 512                 ++file;
 513
 514             if (*file) {
 515                 if (*file != '"')
 516                     continue;   /* Not a valid #line directive, may be a comment */
 517
 518                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 519
 520                 if ((token = strchr(new_file_name, '"')))
 521                     *token = '\0';
 522
 523                 SetConfigFilename(new_file_name, false);
 524             }
 525
 526             config_lineno = new_lineno;
 527         }
 528
 529         if (config_input_line[0] == '#')
 530             continue;
 531
 532         if (config_input_line[0] == '\0')
 533             continue;
 534
 535         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 536
 537         size_t append_len = strlen(append);
 538
 539         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 540
 541         strcpy(tmp_line + tmp_line_len, append);
 542
 543         tmp_line_len += append_len;
 544
 545         if (tmp_line[tmp_line_len-1] == '\\') {
 546             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 547             tmp_line[--tmp_line_len] = '\0';
 548             continue;
 549         }
 550
 551         trim_trailing_ws(tmp_line);
 552         ProcessMacros(tmp_line, tmp_line_len);
 553         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 554
 555         if (const char* expr = FindStatement(tmp_line, "if")) {
 556             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 557         } else if (FindStatement(tmp_line, "endif")) {
 558             if (!if_states.empty())
 559                 if_states.pop_back(); // remove last if-statement meaning
 560             else
 561                 fatalf("'endif' without 'if'\n");
 562         } else if (FindStatement(tmp_line, "else")) {
 563             if (!if_states.empty())
 564                 if_states.back() = !if_states.back();
 565             else
 566                 fatalf("'else' without 'if'\n");
 567         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 568             /* Handle includes here */
 569             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && IsSpace(tmp_line[7])) {
 570                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 571             } else {
 572                 try {
 573                     if (!parse_line(tmp_line)) {
 574                         debugs(3, DBG_CRITICAL, "ERROR: unrecognized directive near '" << tmp_line << "'" <<
 575                                Debug::Extra << "directive location: " << ConfigParser::CurrentLocation());
 576                         ++err_count;
 577                     }
 578                 } catch (...) {
 579                     // fatal for now
 580                     debugs(3, DBG_CRITICAL, "ERROR: configuration failure: " << CurrentException);
 581                     self_destruct();
 582                 }
 583             }
 584         }
 585
 586         safe_free(tmp_line);
 587         tmp_line_len = 0;
 588
 589     }
 590     if (!if_states.empty())
 591         fatalf("if-statement without 'endif'\n");
 592
 593     if (is_pipe) {
 594         int ret = pclose(fp);
 595
 596         if (ret != 0)
 597             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 598     } else {
 599         fclose(fp);
 600     }
 601
 602     SetConfigFilename(orig_cfg_filename, false);
 603     config_lineno = orig_config_lineno;
 604
 605     xfree(tmp_line);
 606     return err_count;
 607 }
 608
 609 void
 610 Configuration::Parse()
 611 {
 612     debugs(5, 4, MYNAME);
 613
 614     configFreeMemory();
 615
 616     ACLMethodData::ThePurgeCount = 0;
 617     default_all();
 618
 619     const auto unrecognizedDirectives = parseOneConfigFile(ConfigFile, 0);
 620
 621     defaults_if_none();
 622
 623     defaults_postscriptum();
 624
 625     if (unrecognizedDirectives)
 626         throw TextException(ToSBuf("Found ", unrecognizedDirectives, " unrecognized directive(s)"), Here());
 627
 628     /*
 629      * We must call configDoConfigure() before leave_suid() because
 630      * configDoConfigure() is where we turn username strings into
 631      * uid values.
 632      */
 633     configDoConfigure();
 634
 635     if (opt_send_signal == -1) {
 636         Mgr::RegisterAction("config",
 637                             "Current Squid Configuration",
 638                             dump_config,
 639                             1, 1);
 640     }
 641 }
 642
 643 /*
 644  * The templated functions below are essentially ConfigParser methods. They are
 645  * not implemented as such because our generated code calling them is the only
 646  * code that can instantiate implementations for each T -- we cannot place these
 647  * definitions into ConfigParser.cc unless cf_parser.cci is moved there.
 648  */
 649
 650 // TODO: When adding Ts incompatible with this trivial API and implementation,
 651 // replace both with a ConfigParser-maintained table of seen directives.
 652 /// whether we have seen (and, hence, configured) the given directive
 653 template <typename T>
 654 static bool
 655 SawDirective(const T &raw)
 656 {
 657     return bool(raw);
 658 }
 659
 660 /// Sets the given raw SquidConfig data member.
 661 /// Extracts and interprets parser's configuration tokens.
 662 template <typename T>
 663 static void
 664 ParseDirective(T &raw, ConfigParser &parser)
 665 {
 666     if (SawDirective(raw))
 667         parser.rejectDuplicateDirective();
 668
 669     // TODO: parser.openDirective(directiveName);
 670     Must(!raw);
 671     raw = Configuration::Component<T>::Parse(parser);
 672     Must(raw);
 673     parser.closeDirective();
 674 }
 675
 676 /// reports raw SquidConfig data member configuration using squid.conf syntax
 677 /// \param name the name of the configuration directive being dumped
 678 template <typename T>
 679 static void
 680 DumpDirective(const T &raw, StoreEntry *entry, const char *name)
 681 {
 682     if (!SawDirective(raw))
 683         return; // not configured
 684
 685     entry->append(name, strlen(name));
 686     SBufStream os;
 687     Configuration::Component<T>::Print(os, raw);
 688     const auto buf = os.buf();
 689     if (buf.length()) {
 690         entry->append(" ", 1);
 691         entry->append(buf.rawContent(), buf.length());
 692     }
 693     entry->append("\n", 1);
 694 }
 695
 696 /// frees any resources associated with the given raw SquidConfig data member
 697 template <typename T>
 698 static void
 699 FreeDirective(T &raw)
 700 {
 701     Configuration::Component<T>::Free(raw);
 702
 703     // While the implementation may change, there is no way to avoid zeroing.
 704     // Even migration to a proper SquidConfig class would not help: While
 705     // ordinary destructors do not need to zero data members, a SquidConfig
 706     // destructor would have to zero to protect any SquidConfig::x destruction
 707     // code from accidentally dereferencing an already destroyed Config.y.
 708     static_assert(std::is_trivial<T>::value, "SquidConfig member is trivial");
 709     memset(&raw, 0, sizeof(raw));
 710 }
 711
 712 static void
 713 configDoConfigure(void)
 714 {
 715     Config2.clear();
 716     /* init memory as early as possible */
 717     memConfigure();
 718     /* Sanity checks */
 719
 720     if (Debug::rotateNumber < 0) {
 721         Debug::rotateNumber = Config.Log.rotateNumber;
 722     }
 723
 724 #if SIZEOF_OFF_T <= 4
 725     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 726         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 727         Config.Store.maxObjectSize = 0x7FFF0000;
 728     }
 729 #endif
 730
 731     if (Config.onoff.httpd_suppress_version_string)
 732         visible_appname_string = (char *)appname_string;
 733     else
 734         visible_appname_string = (char const *)APP_FULLNAME;
 735
 736     if (Config.Program.redirect) {
 737         if (Config.redirectChildren.n_max < 1) {
 738             Config.redirectChildren.n_max = 0;
 739             wordlistDestroy(&Config.Program.redirect);
 740         }
 741     }
 742
 743     if (Config.Program.store_id) {
 744         if (Config.storeIdChildren.n_max < 1) {
 745             Config.storeIdChildren.n_max = 0;
 746             wordlistDestroy(&Config.Program.store_id);
 747         }
 748     }
 749
 750     if (Config.appendDomain)
 751         if (*Config.appendDomain != '.')
 752             fatal("append_domain must begin with a '.'");
 753
 754     if (Config.errHtmlText == nullptr)
 755         Config.errHtmlText = xstrdup(null_string);
 756
 757 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 758     if (Config.max_filedescriptors > 0) {
 759         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 760     }
 761 #elif USE_SELECT
 762     if (Config.max_filedescriptors > FD_SETSIZE) {
 763         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 764     }
 765 #endif
 766
 767     storeConfigure();
 768
 769     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 770              uniqueHostname(),
 771              visible_appname_string);
 772
 773     /*
 774      * the extra space is for loop detection in client_side.c -- we search
 775      * for substrings in the Via header.
 776      */
 777     snprintf(ThisCache2, sizeof(ThisCache2), " %s (%s)",
 778              uniqueHostname(),
 779              visible_appname_string);
 780
 781     /* Use visible_hostname as default surrogate_id */
 782     if (!Config.Accel.surrogate_id) {
 783         const char *t = getMyHostname();
 784         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 785     }
 786
 787     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 788         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 789
 790     if (Config.appendDomain)
 791         Config.appendDomainLen = strlen(Config.appendDomain);
 792     else
 793         Config.appendDomainLen = 0;
 794
 795     if (Config.connect_retries > 10) {
 796         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 797         Config.connect_retries = 10;
 798     }
 799
 800     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 801 #if USE_UNLINKD
 802
 803     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 804 #endif
 805     bool logDaemonUsed = false;
 806     for (const auto *log = Config.Log.accesslogs; !logDaemonUsed && log; log = log->next)
 807         logDaemonUsed = log->usesDaemon();
 808 #if ICAP_CLIENT
 809     for (const auto *log = Config.Log.icaplogs; !logDaemonUsed && log; log = log->next)
 810         logDaemonUsed = log->usesDaemon();
 811 #endif
 812     if (logDaemonUsed)
 813         requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 814
 815     if (Config.Program.redirect)
 816         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 817
 818     if (Config.Program.store_id)
 819         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 820
 821     requirePathnameExists("Icon Directory", Config.icons.directory);
 822
 823     if (Config.errorDirectory)
 824         requirePathnameExists("Error Directory", Config.errorDirectory);
 825
 826 #if USE_HTTP_VIOLATIONS
 827
 828     {
 829         const RefreshPattern *R;
 830
 831         for (R = Config.Refresh; R; R = R->next) {
 832             if (!R->flags.override_expire)
 833                 continue;
 834
 835             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 836
 837             break;
 838         }
 839
 840         for (R = Config.Refresh; R; R = R->next) {
 841             if (!R->flags.override_lastmod)
 842                 continue;
 843
 844             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 845
 846             break;
 847         }
 848
 849         for (R = Config.Refresh; R; R = R->next) {
 850             if (!R->flags.reload_into_ims)
 851                 continue;
 852
 853             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 854
 855             break;
 856         }
 857
 858         for (R = Config.Refresh; R; R = R->next) {
 859             if (!R->flags.ignore_reload)
 860                 continue;
 861
 862             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 863
 864             break;
 865         }
 866
 867         for (R = Config.Refresh; R; R = R->next) {
 868             if (!R->flags.ignore_no_store)
 869                 continue;
 870
 871             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 872
 873             break;
 874         }
 875
 876         for (R = Config.Refresh; R; R = R->next) {
 877             if (!R->flags.ignore_private)
 878                 continue;
 879
 880             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 881
 882             break;
 883         }
 884     }
 885 #endif
 886 #if !USE_HTTP_VIOLATIONS
 887     Config.onoff.via = 1;
 888 #else
 889
 890     if (!Config.onoff.via)
 891         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 892
 893 #endif
 894
 895     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 896     // TODO: replace with a dedicated "purge" ACL option?
 897     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 898
 899     if (geteuid() == 0) {
 900         if (nullptr != Config.effectiveUser) {
 901
 902             struct passwd *pwd = getpwnam(Config.effectiveUser);
 903
 904             if (nullptr == pwd) {
 905                 /*
 906                  * Andres Kroonmaa <andre@online.ee>:
 907                  * Some getpwnam() implementations (Solaris?) require
 908                  * an available FD < 256 for opening a FILE* to the
 909                  * passwd file.
 910                  * DW:
 911                  * This should be safe at startup, but might still fail
 912                  * during reconfigure.
 913                  */
 914                 fatalf("getpwnam failed to find userid for effective user '%s'",
 915                        Config.effectiveUser);
 916                 return;
 917             }
 918
 919             Config2.effectiveUserID = pwd->pw_uid;
 920
 921             Config2.effectiveGroupID = pwd->pw_gid;
 922
 923 #if HAVE_PUTENV
 924             if (pwd->pw_dir && *pwd->pw_dir) {
 925                 // putenv() leaks by design; avoid leaks when nothing changes
 926                 static SBuf lastDir;
 927                 if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
 928                     lastDir = pwd->pw_dir;
 929                     int len = strlen(pwd->pw_dir) + 6;
 930                     char *env_str = (char *)xcalloc(len, 1);
 931                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 932                     putenv(env_str);
 933                 }
 934             }
 935 #endif
 936         }
 937     } else {
 938         Config2.effectiveUserID = geteuid();
 939         Config2.effectiveGroupID = getegid();
 940     }
 941
 942     if (nullptr != Config.effectiveGroup) {
 943
 944         struct group *grp = getgrnam(Config.effectiveGroup);
 945
 946         if (nullptr == grp) {
 947             fatalf("getgrnam failed to find groupid for effective group '%s'",
 948                    Config.effectiveGroup);
 949             return;
 950         }
 951
 952         Config2.effectiveGroupID = grp->gr_gid;
 953     }
 954
 955 #if USE_OPENSSL
 956     if (Config.ssl_client.foreignIntermediateCertsPath)
 957         Ssl::loadSquidUntrusted(Config.ssl_client.foreignIntermediateCertsPath);
 958 #endif
 959
 960     if (Security::ProxyOutgoingConfig().encryptTransport) {
 961         debugs(3, 2, "initializing https:// proxy context");
 962
 963         const auto rawSslContext = Security::ProxyOutgoingConfig().createClientContext(false);
 964         Config.ssl_client.sslContext_ = rawSslContext ? new Security::ContextPointer(rawSslContext) : nullptr;
 965         if (!Config.ssl_client.sslContext_) {
 966 #if USE_OPENSSL
 967             fatal("ERROR: Could not initialize https:// proxy context");
 968 #else
 969             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 970 #endif
 971         }
 972 #if USE_OPENSSL
 973         Ssl::useSquidUntrusted(Config.ssl_client.sslContext_->get());
 974 #endif
 975         Config.ssl_client.defaultPeerContext = new Security::FuturePeerContext(Security::ProxyOutgoingConfig(), *Config.ssl_client.sslContext_);
 976     }
 977
 978     for (const auto &p: CurrentCachePeers()) {
 979
 980         // default value for ssldomain= is the peer host/IP
 981         if (p->secure.sslDomain.isEmpty())
 982             p->secure.sslDomain = p->host;
 983
 984         if (p->secure.encryptTransport) {
 985             debugs(3, 2, "initializing TLS context for cache_peer " << *p);
 986             p->sslContext = p->secure.createClientContext(true);
 987             if (!p->sslContext) {
 988                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize TLS context for cache_peer " << *p);
 989                 self_destruct();
 990                 return;
 991             }
 992         }
 993     }
 994
 995     for (AnyP::PortCfgPointer s = HttpPortList; s != nullptr; s = s->next) {
 996         if (!s->secure.encryptTransport)
 997             continue;
 998         debugs(3, 2, "initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS contexts");
 999         s->secure.initServerContexts(*s);
1000     }
1001
1002     // prevent infinite fetch loops in the request parser
1003     // due to buffer full but not enough data received to finish parse
1004     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
1005         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
1006                " Change client_request_buffer_max or request_header_max_size limits.",
1007                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
1008     }
1009
1010     // Warn about the dangers of exceeding String limits when manipulating HTTP
1011     // headers. Technically, we do not concatenate _requests_, so we could relax
1012     // their check, but we keep the two checks the same for simplicity sake.
1013     const auto safeRawHeaderValueSizeMax = (String::SizeMaxXXX()+1)/3;
1014     // TODO: static_assert(safeRawHeaderValueSizeMax >= 64*1024); // no WARNINGs for default settings
1015     if (Config.maxRequestHeaderSize > safeRawHeaderValueSizeMax)
1016         debugs(3, DBG_CRITICAL, "WARNING: Increasing request_header_max_size beyond " << safeRawHeaderValueSizeMax <<
1017                " bytes makes Squid more vulnerable to denial-of-service attacks; configured value: " << Config.maxRequestHeaderSize << " bytes");
1018     if (Config.maxReplyHeaderSize > safeRawHeaderValueSizeMax)
1019         debugs(3, DBG_CRITICAL, "WARNING: Increasing reply_header_max_size beyond " << safeRawHeaderValueSizeMax <<
1020                " bytes makes Squid more vulnerable to denial-of-service attacks; configured value: " << Config.maxReplyHeaderSize << " bytes");
1021
1022     /*
1023      * Disable client side request pipelining if client_persistent_connections OFF.
1024      * Waste of resources queueing any pipelined requests when the first will close the connection.
1025      */
1026     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
1027         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
1028                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
1029         Config.pipeline_max_prefetch = 0;
1030     }
1031
1032 #if USE_AUTH
1033     /*
1034      * disable client side request pipelining. There is a race with
1035      * Negotiate and NTLM when the client sends a second request on an
1036      * connection before the authenticate challenge is sent. With
1037      * pipelining OFF, the client may fail to authenticate, but squid's
1038      * state will be preserved.
1039      */
1040     if (Config.pipeline_max_prefetch > 0) {
1041         Auth::SchemeConfig *nego = Auth::SchemeConfig::Find("Negotiate");
1042         Auth::SchemeConfig *ntlm = Auth::SchemeConfig::Find("NTLM");
1043         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
1044             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
1045             Config.pipeline_max_prefetch = 0;
1046         }
1047     }
1048
1049     for (auto &authSchemes : Auth::TheConfig.schemeLists) {
1050         authSchemes.expand();
1051         if (authSchemes.authConfigs.empty()) {
1052             debugs(3, DBG_CRITICAL, "auth_schemes: at least one scheme name is required; got: " << authSchemes.rawSchemes);
1053             self_destruct();
1054         }
1055     }
1056 #endif
1057 }
1058
1059 /** Parse a line containing an obsolete directive.
1060  * To upgrade it where possible instead of just "Bungled config" for
1061  * directives which cannot be marked as simply aliases of the some name.
1062  * For example if the parameter order and content has changed.
1063  * Or if the directive has been completely removed.
1064  */
1065 void
1066 parse_obsolete(const char *name)
1067 {
1068     // Directives which have been radically changed rather than removed
1069     if (!strcmp(name, "url_rewrite_concurrency")) {
1070         int cval;
1071         parse_int(&cval);
1072         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
1073         Config.redirectChildren.concurrency = cval;
1074     }
1075
1076     if (!strcmp(name, "ignore_ims_on_miss")) {
1077         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
1078         // than the 2.7 directive. We need to parse and invert the configured value.
1079         int temp = 0;
1080         parse_onoff(&temp);
1081         Config.onoff.cache_miss_revalidate = !temp;
1082     }
1083
1084     if (!strncmp(name, "sslproxy_", 9)) {
1085         // the replacement directive tls_outgoing_options uses options instead of whole-line input
1086         SBuf tmp;
1087         if (!strcmp(name, "sslproxy_cafile"))
1088             tmp.append("cafile=");
1089         else if (!strcmp(name, "sslproxy_capath"))
1090             tmp.append("capath=");
1091         else if (!strcmp(name, "sslproxy_cipher"))
1092             tmp.append("cipher=");
1093         else if (!strcmp(name, "sslproxy_client_certificate"))
1094             tmp.append("cert=");
1095         else if (!strcmp(name, "sslproxy_client_key"))
1096             tmp.append("key=");
1097         else if (!strcmp(name, "sslproxy_flags"))
1098             tmp.append("flags=");
1099         else if (!strcmp(name, "sslproxy_options"))
1100             tmp.append("options=");
1101         else if (!strcmp(name, "sslproxy_version"))
1102             tmp.append("version=");
1103         else {
1104             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1105             self_destruct();
1106             return;
1107         }
1108
1109         // add the value as unquoted-string because the old values did not support whitespace
1110         const char *token = ConfigParser::NextQuotedOrToEol();
1111         if (!token)
1112             throw TextException(ToSBuf("missing required parameter for obsolete directive: ", name), Here());
1113
1114         tmp.append(token, strlen(token));
1115         Security::ProxyOutgoingConfig().parse(tmp.c_str());
1116     }
1117 }
1118
1119 template <class MinimalUnit>
1120 static const char *
1121 TimeUnitToString()
1122 {
1123     const auto minUnit = MinimalUnit(1);
1124     if(minUnit == std::chrono::nanoseconds(1))
1125         return T_NANOSECOND_STR;
1126     else if (minUnit == std::chrono::microseconds(1))
1127         return T_MICROSECOND_STR;
1128     else if (minUnit == std::chrono::milliseconds(1))
1129         return T_MILLISECOND_STR;
1130     else {
1131         assert(minUnit >= std::chrono::seconds(1));
1132         return T_SECOND_STR;
1133     }
1134 }
1135
1136 /// Assigns 'ns' the number of nanoseconds corresponding to 'unitName'.
1137 /// \param MinimalUnit is a chrono duration type specifying the minimal
1138 /// allowed time unit.
1139 /// \returns true if unitName is correct and its time unit is not less
1140 /// than MinimalUnit.
1141 template <class MinimalUnit>
1142 static bool
1143 parseTimeUnit(const char *unitName, std::chrono::nanoseconds &ns)
1144 {
1145     if (!unitName)
1146         throw TexcHere("missing time unit");
1147
1148     if (!strncasecmp(unitName, T_NANOSECOND_STR, strlen(T_NANOSECOND_STR)))
1149         ns = std::chrono::nanoseconds(1);
1150     else if (!strncasecmp(unitName, T_MICROSECOND_STR, strlen(T_MICROSECOND_STR)))
1151         ns = std::chrono::microseconds(1);
1152     else if (!strncasecmp(unitName, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1153         ns = std::chrono::milliseconds(1);
1154     else if (!strncasecmp(unitName, T_SECOND_STR, strlen(T_SECOND_STR)))
1155         ns = std::chrono::seconds(1);
1156     else if (!strncasecmp(unitName, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1157         ns = std::chrono::minutes(1);
1158     else if (!strncasecmp(unitName, T_HOUR_STR, strlen(T_HOUR_STR)))
1159         ns = std::chrono::hours(1);
1160     else if (!strncasecmp(unitName, T_DAY_STR, strlen(T_DAY_STR)))
1161         ns = std::chrono::hours(24);
1162     else if (!strncasecmp(unitName, T_WEEK_STR, strlen(T_WEEK_STR)))
1163         ns = std::chrono::hours(24 * 7);
1164     else if (!strncasecmp(unitName, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1165         ns = std::chrono::hours(24 * 14);
1166     else if (!strncasecmp(unitName, T_MONTH_STR, strlen(T_MONTH_STR)))
1167         ns = std::chrono::hours(24 * 30);
1168     else if (!strncasecmp(unitName, T_YEAR_STR, strlen(T_YEAR_STR)))
1169         ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear));
1170     else if (!strncasecmp(unitName, T_DECADE_STR, strlen(T_DECADE_STR)))
1171         ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear * 10));
1172     else
1173         return false;
1174
1175     if (ns < MinimalUnit(1)) {
1176         throw TexcHere(ToSBuf("time unit '", unitName, "' is too small to be used in this context, the minimal unit is ",
1177                               TimeUnitToString<MinimalUnit>()));
1178     }
1179
1180     return true;
1181 }
1182
1183 static std::chrono::nanoseconds
1184 ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
1185 {
1186     if (value < 0.0)
1187         throw TexcHere("time must have a positive value");
1188
1189     if (value > (static_cast<double>(std::chrono::nanoseconds::max().count()) / unit.count())) {
1190         const auto maxYears = std::chrono::duration_cast<std::chrono::hours>(std::chrono::nanoseconds::max()).count()/HoursPerYear;
1191         throw TexcHere(ToSBuf("time values cannot exceed ", maxYears, " years"));
1192     }
1193
1194     return std::chrono::duration_cast<std::chrono::nanoseconds>(unit * value);
1195 }
1196
1197 template <class TimeUnit>
1198 static TimeUnit
1199 FromNanoseconds(const std::chrono::nanoseconds &ns, const double parsedValue)
1200 {
1201     const auto result = std::chrono::duration_cast<TimeUnit>(ns);
1202     if (!result.count()) {
1203         throw TexcHere(ToSBuf("time value '", parsedValue,
1204                               "' is too small to be used in this context, the minimal value is 1 ",
1205                               TimeUnitToString<TimeUnit>()));
1206     }
1207     return result;
1208 }
1209
1210 /// Parses a time specification from the config file and
1211 /// returns the time as a chrono duration object of 'TimeUnit' type.
1212 template <class TimeUnit>
1213 static TimeUnit
1214 parseTimeLine()
1215 {
1216     const auto valueToken = ConfigParser::NextToken();
1217     if (!valueToken)
1218         throw TexcHere("cannot read a time value");
1219
1220     const auto parsedValue = xatof(valueToken);
1221
1222     if (parsedValue == 0)
1223         return TimeUnit::zero();
1224
1225     std::chrono::nanoseconds parsedUnitDuration;
1226
1227     const auto token = ConfigParser::PeekAtToken();
1228
1229     if (!parseTimeUnit<TimeUnit>(token, parsedUnitDuration))
1230         throw TexcHere(ToSBuf("unknown time unit '", token, "'"));
1231
1232     (void)ConfigParser::NextToken();
1233
1234     const auto nanoseconds = ToNanoSeconds(parsedValue, parsedUnitDuration);
1235
1236     // validate precisions (time-units-small only)
1237     if (TimeUnit(1) <= std::chrono::microseconds(1)) {
1238         if (0 < nanoseconds.count() && nanoseconds.count() < 3) {
1239             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), ConfigParser::CurrentLocation() << ": WARNING: " <<
1240                    "Squid time measurement precision is likely to be far worse than " <<
1241                    "the nanosecond-level precision implied by the configured value: " << parsedValue << ' ' << token);
1242         }
1243     }
1244
1245     return FromNanoseconds<TimeUnit>(nanoseconds, parsedValue);
1246 }
1247
1248 static void
1249 parseBytesLine64(int64_t * bptr, const char *units)
1250 {
1251     char *token;
1252     double d;
1253     int64_t m;
1254     int64_t u;
1255
1256     if ((u = parseBytesUnits(units)) == 0) {
1257         self_destruct();
1258         return;
1259     }
1260
1261     if ((token = ConfigParser::NextToken()) == nullptr) {
1262         self_destruct();
1263         return;
1264     }
1265
1266     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1267         *bptr = -1;
1268         return;
1269     }
1270
1271     d = xatof(token);
1272
1273     m = u;          /* default to 'units' if none specified */
1274
1275     if (0.0 == d)
1276         (void) 0;
1277     else if ((token = ConfigParser::NextToken()) == nullptr)
1278         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1279                config_input_line << "', assuming " <<
1280                d << " " <<  units  );
1281     else if ((m = parseBytesUnits(token)) == 0) {
1282         self_destruct();
1283         return;
1284     }
1285
1286     *bptr = static_cast<int64_t>(m * d / u);
1287
1288     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1289         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1290                d << " " << token << ": integer overflow (int64_t).");
1291         self_destruct();
1292     }
1293 }
1294
1295 static void
1296 parseBytesLine(size_t * bptr, const char *units)
1297 {
1298     char *token;
1299     double d;
1300     int m;
1301     int u;
1302
1303     if ((u = parseBytesUnits(units)) == 0) {
1304         self_destruct();
1305         return;
1306     }
1307
1308     if ((token = ConfigParser::NextToken()) == nullptr) {
1309         self_destruct();
1310         return;
1311     }
1312
1313     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1314         *bptr = static_cast<size_t>(-1);
1315         return;
1316     }
1317
1318     d = xatof(token);
1319
1320     m = u;          /* default to 'units' if none specified */
1321
1322     if (0.0 == d)
1323         (void) 0;
1324     else if ((token = ConfigParser::NextToken()) == nullptr)
1325         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1326                config_input_line << "', assuming " <<
1327                d << " " <<  units  );
1328     else if ((m = parseBytesUnits(token)) == 0) {
1329         self_destruct();
1330         return;
1331     }
1332
1333     *bptr = static_cast<size_t>(m * d / u);
1334
1335     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1336         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1337                d << " " << token << ": integer overflow (size_t).");
1338         self_destruct();
1339     }
1340 }
1341
1342 static void
1343 parseBytesLineSigned(ssize_t * bptr, const char *units)
1344 {
1345     char *token;
1346     double d;
1347     int m;
1348     int u;
1349
1350     if ((u = parseBytesUnits(units)) == 0) {
1351         self_destruct();
1352         return;
1353     }
1354
1355     if ((token = ConfigParser::NextToken()) == nullptr) {
1356         self_destruct();
1357         return;
1358     }
1359
1360     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1361         *bptr = -1;
1362         return;
1363     }
1364
1365     d = xatof(token);
1366
1367     m = u;          /* default to 'units' if none specified */
1368
1369     if (0.0 == d)
1370         (void) 0;
1371     else if ((token = ConfigParser::NextToken()) == nullptr)
1372         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1373                config_input_line << "', assuming " <<
1374                d << " " <<  units  );
1375     else if ((m = parseBytesUnits(token)) == 0) {
1376         self_destruct();
1377         return;
1378     }
1379
1380     *bptr = static_cast<ssize_t>(m * d / u);
1381
1382     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1383         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1384                d << " " << token << ": integer overflow (ssize_t).");
1385         self_destruct();
1386     }
1387 }
1388
1389 /**
1390  * Parse bytes from a string.
1391  * Similar to the parseBytesLine function but parses the string value instead of
1392  * the current token value.
1393  */
1394 void
1395 parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1396 {
1397     int u;
1398     if ((u = parseBytesUnits(units)) == 0) {
1399         self_destruct();
1400         return;
1401     }
1402
1403     // Find number from string beginning.
1404     char const * number_begin = value;
1405     char const * number_end = value;
1406
1407     while ((*number_end >= '0' && *number_end <= '9')) {
1408         ++number_end;
1409     }
1410
1411     String number;
1412     number.assign(number_begin, number_end - number_begin);
1413
1414     int d = xatoi(number.termedBuf());
1415     int m;
1416     if ((m = parseBytesUnits(number_end)) == 0) {
1417         self_destruct();
1418         return;
1419     }
1420
1421     *bptr = static_cast<size_t>(m * d / u);
1422     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1423         self_destruct();
1424 }
1425
1426 static size_t
1427 parseBytesUnits(const char *unit)
1428 {
1429     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1430         return 1;
1431
1432     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1433         return 1 << 10;
1434
1435     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1436         return 1 << 20;
1437
1438     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1439         return 1 << 30;
1440
1441     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1442
1443     return 0;
1444 }
1445
1446 static void
1447 parse_SBufList(SBufList * list)
1448 {
1449     while (char *token = ConfigParser::NextQuotedToken())
1450         list->push_back(SBuf(token));
1451 }
1452
1453 // just dump a list, no directive name
1454 static void
1455 dump_SBufList(StoreEntry * entry, const SBufList &words)
1456 {
1457     for (const auto &i : words) {
1458         entry->append(i.rawContent(), i.length());
1459         entry->append(" ",1);
1460     }
1461     entry->append("\n",1);
1462 }
1463
1464 // dump a SBufList type directive with name
1465 static void
1466 dump_SBufList(StoreEntry * entry, const char *name, SBufList &list)
1467 {
1468     if (!list.empty()) {
1469         entry->append(name, strlen(name));
1470         entry->append(" ", 1);
1471         dump_SBufList(entry, list);
1472     }
1473 }
1474
1475 static void
1476 free_SBufList(SBufList *list)
1477 {
1478     if (list)
1479         list->clear();
1480 }
1481
1482 static void
1483 dump_acl(StoreEntry *entry, const char *directiveName, Acl::NamedAcls *config)
1484 {
1485     PackableStream os(*entry);
1486     Acl::DumpNamedAcls(os, directiveName, config);
1487 }
1488
1489 static void
1490 parse_acl(Acl::NamedAcls **config)
1491 {
1492     assert(config);
1493     Acl::Node::ParseNamedAcl(LegacyParser, *config);
1494 }
1495
1496 static void
1497 free_acl(Acl::NamedAcls **config)
1498 {
1499     Acl::FreeNamedAcls(config);
1500 }
1501
1502 void
1503 dump_acl_list(StoreEntry * entry, ACLList * head)
1504 {
1505     // XXX: Should dump ACL names like "foo !bar" but dumps parsing context like
1506     // "(clientside_tos 0x11 line)".
1507     dump_SBufList(entry, ToTree(head).dump());
1508 }
1509
1510 void
1511 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1512 {
1513     if (head)
1514         dump_SBufList(entry, ToTree(head).treeDump(name, &Acl::AllowOrDeny));
1515 }
1516
1517 static void
1518 parse_acl_access(acl_access ** head)
1519 {
1520     aclParseAccessLine(cfg_directive, LegacyParser, head);
1521 }
1522
1523 static void
1524 free_acl_access(acl_access ** head)
1525 {
1526     aclDestroyAccessList(head);
1527 }
1528
1529 static void
1530 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1531 {
1532     char buf[MAX_IPSTRLEN];
1533     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1534 }
1535
1536 static void
1537 parse_address(Ip::Address *addr)
1538 {
1539     char *token = ConfigParser::NextToken();
1540
1541     if (!token) {
1542         self_destruct();
1543         return;
1544     }
1545
1546     if (!strcmp(token,"any_addr"))
1547         addr->setAnyAddr();
1548     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1549         addr->setNoAddr();
1550     else if ( (*addr = token) ) // try parse numeric/IPA
1551         (void) 0;
1552     else if (addr->GetHostByName(token)) // do not use ipcache
1553         (void) 0;
1554     else { // not an IP and not a hostname
1555         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1556         self_destruct();
1557     }
1558 }
1559
1560 static void
1561 free_address(Ip::Address *addr)
1562 {
1563     addr->setEmpty();
1564 }
1565
1566 static void
1567 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1568 {
1569     char buf[MAX_IPSTRLEN];
1570
1571     for (Acl::Address *l = head; l; l = l->next) {
1572         if (!l->addr.isAnyAddr())
1573             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1574         else
1575             storeAppendPrintf(entry, "%s autoselect", name);
1576
1577         dump_acl_list(entry, l->aclList);
1578
1579         storeAppendPrintf(entry, "\n");
1580     }
1581 }
1582
1583 static void
1584 parse_acl_address(Acl::Address ** head)
1585 {
1586     Acl::Address *l = new Acl::Address;
1587     parse_address(&l->addr);
1588     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1589
1590     Acl::Address **tail = head;
1591     while (*tail)
1592         tail = &(*tail)->next;
1593
1594     *tail = l;
1595 }
1596
1597 static void
1598 free_acl_address(Acl::Address ** head)
1599 {
1600     delete *head;
1601     *head = nullptr;
1602 }
1603
1604 static void
1605 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1606 {
1607     acl_tos *l;
1608
1609     for (l = head; l; l = l->next) {
1610         if (l->tos > 0)
1611             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1612         else
1613             storeAppendPrintf(entry, "%s none", name);
1614
1615         dump_acl_list(entry, l->aclList);
1616
1617         storeAppendPrintf(entry, "\n");
1618     }
1619 }
1620
1621 static void
1622 parse_acl_tos(acl_tos ** head)
1623 {
1624     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1625     char *token = ConfigParser::NextToken();
1626
1627     if (!token) {
1628         self_destruct();
1629         return;
1630     }
1631
1632     if (!xstrtoui(token, nullptr, &tos, 0, std::numeric_limits<tos_t>::max())) {
1633         self_destruct();
1634         return;
1635     }
1636
1637     const unsigned int chTos = tos & 0xFC;
1638     if (chTos != tos) {
1639         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1640         tos = chTos;
1641     }
1642
1643     acl_tos *l = new acl_tos;
1644
1645     l->tos = (tos_t)tos;
1646
1647     aclParseAclList(LegacyParser, &l->aclList, token);
1648
1649     acl_tos **tail = head;  /* sane name below */
1650     while (*tail)
1651         tail = &(*tail)->next;
1652
1653     *tail = l;
1654 }
1655
1656 static void
1657 free_acl_tos(acl_tos ** head)
1658 {
1659     delete *head;
1660     *head = nullptr;
1661 }
1662
1663 #if HAVE_LIBCAP && SO_MARK
1664
1665 static void
1666 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1667 {
1668     for (acl_nfmark *l = head; l; l = l->next) {
1669         storeAppendPrintf(entry, "%s %s", name, ToSBuf(l->markConfig).c_str());
1670
1671         dump_acl_list(entry, l->aclList);
1672
1673         storeAppendPrintf(entry, "\n");
1674     }
1675 }
1676
1677 static void
1678 parse_acl_nfmark(acl_nfmark ** head)
1679 {
1680     SBuf token(ConfigParser::NextToken());
1681     const auto mc = Ip::NfMarkConfig::Parse(token);
1682
1683     // Packet marking directives should not allow to use masks.
1684     const auto pkt_dirs = {"mark_client_packet", "clientside_mark", "tcp_outgoing_mark"};
1685     if (mc.hasMask() && std::find(pkt_dirs.begin(), pkt_dirs.end(), cfg_directive) != pkt_dirs.end())
1686         throw TexcHere(ToSBuf("'", cfg_directive, "' does not support masked marks"));
1687
1688     acl_nfmark *l = new acl_nfmark;
1689     l->markConfig = mc;
1690
1691     aclParseAclList(LegacyParser, &l->aclList, token.c_str());
1692
1693     acl_nfmark **tail = head;   /* sane name below */
1694     while (*tail)
1695         tail = &(*tail)->next;
1696
1697     *tail = l;
1698 }
1699
1700 static void
1701 free_acl_nfmark(acl_nfmark ** head)
1702 {
1703     delete *head;
1704     *head = nullptr;
1705 }
1706 #endif /* HAVE_LIBCAP && SO_MARK */
1707
1708 static void
1709 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1710 {
1711     for (AclSizeLimit *l = head; l; l = l->next) {
1712         if (l->size != -1)
1713             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1714         else
1715             storeAppendPrintf(entry, "%s none", name);
1716
1717         dump_acl_list(entry, l->aclList);
1718
1719         storeAppendPrintf(entry, "\n");
1720     }
1721 }
1722
1723 static void
1724 parse_acl_b_size_t(AclSizeLimit ** head)
1725 {
1726     AclSizeLimit *l = new AclSizeLimit;
1727
1728     parse_b_int64_t(&l->size);
1729
1730     aclParseAclList(LegacyParser, &l->aclList, l->size);
1731
1732     AclSizeLimit **tail = head; /* sane name below */
1733     while (*tail)
1734         tail = &(*tail)->next;
1735
1736     *tail = l;
1737 }
1738
1739 static void
1740 free_acl_b_size_t(AclSizeLimit ** head)
1741 {
1742     delete *head;
1743     *head = nullptr;
1744 }
1745
1746 #if USE_DELAY_POOLS
1747
1748 #include "DelayConfig.h"
1749 #include "DelayPools.h"
1750 /* do nothing - free_delay_pool_count is the magic free function.
1751  * this is why delay_pool_count isn't just marked TYPE: u_short
1752  */
1753 #define free_delay_pool_class(X)
1754 #define free_delay_pool_access(X)
1755 #define free_delay_pool_rates(X)
1756 #define dump_delay_pool_class(X, Y, Z)
1757 #define dump_delay_pool_access(X, Y, Z)
1758 #define dump_delay_pool_rates(X, Y, Z)
1759
1760 static void
1761 free_delay_pool_count(DelayConfig * cfg)
1762 {
1763     cfg->freePoolCount();
1764 }
1765
1766 static void
1767 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1768 {
1769     cfg.dumpPoolCount (entry, name);
1770 }
1771
1772 static void
1773 parse_delay_pool_count(DelayConfig * cfg)
1774 {
1775     cfg->parsePoolCount();
1776 }
1777
1778 static void
1779 parse_delay_pool_class(DelayConfig * cfg)
1780 {
1781     cfg->parsePoolClass();
1782 }
1783
1784 static void
1785 parse_delay_pool_rates(DelayConfig * cfg)
1786 {
1787     cfg->parsePoolRates();
1788 }
1789
1790 static void
1791 parse_delay_pool_access(DelayConfig * cfg)
1792 {
1793     cfg->parsePoolAccess(LegacyParser);
1794 }
1795
1796 #endif
1797
1798 #if USE_DELAY_POOLS
1799 #include "ClientDelayConfig.h"
1800 /* do nothing - free_client_delay_pool_count is the magic free function.
1801  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1802  */
1803
1804 #define free_client_delay_pool_access(X)
1805 #define free_client_delay_pool_rates(X)
1806 #define dump_client_delay_pool_access(X, Y, Z)
1807 #define dump_client_delay_pool_rates(X, Y, Z)
1808
1809 static void
1810 free_client_delay_pool_count(ClientDelayConfig * cfg)
1811 {
1812     cfg->freePools();
1813 }
1814
1815 static void
1816 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1817 {
1818     cfg.dumpPoolCount (entry, name);
1819 }
1820
1821 static void
1822 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1823 {
1824     cfg->parsePoolCount();
1825 }
1826
1827 static void
1828 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1829 {
1830     cfg->parsePoolRates();
1831 }
1832
1833 static void
1834 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1835 {
1836     cfg->parsePoolAccess(LegacyParser);
1837 }
1838 #endif
1839
1840 #if USE_HTTP_VIOLATIONS
1841 static void
1842 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1843 {
1844     if (manglers)
1845         manglers->dumpAccess(entry, name);
1846 }
1847
1848 static void
1849 parse_http_header_access(HeaderManglers **pm)
1850 {
1851     char *t = nullptr;
1852
1853     if ((t = ConfigParser::NextToken()) == nullptr) {
1854         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1855         debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_access: missing header name.");
1856         return;
1857     }
1858
1859     if (!*pm)
1860         *pm = new HeaderManglers;
1861     HeaderManglers *manglers = *pm;
1862     headerMangler *mangler = manglers->track(t);
1863     assert(mangler);
1864
1865     std::string directive = "http_header_access ";
1866     directive += t;
1867     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1868 }
1869
1870 static void
1871 free_HeaderManglers(HeaderManglers **pm)
1872 {
1873     // we delete the entire http_header_* mangler configuration at once
1874     if (const HeaderManglers *manglers = *pm) {
1875         delete manglers;
1876         *pm = nullptr;
1877     }
1878 }
1879
1880 static void
1881 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1882 {
1883     if (manglers)
1884         manglers->dumpReplacement(entry, name);
1885 }
1886
1887 static void
1888 parse_http_header_replace(HeaderManglers **pm)
1889 {
1890     char *t = nullptr;
1891
1892     if ((t = ConfigParser::NextToken()) == nullptr) {
1893         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1894         debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_replace: missing header name.");
1895         return;
1896     }
1897
1898     const char *value = ConfigParser::NextQuotedOrToEol();
1899
1900     if (!*pm)
1901         *pm = new HeaderManglers;
1902     HeaderManglers *manglers = *pm;
1903     manglers->setReplacement(t, value);
1904 }
1905
1906 #endif
1907
1908 static void
1909 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1910 {
1911     Store::Disks::Dump(swap, *entry, name);
1912 }
1913
1914 static int
1915 check_null_string(char *s)
1916 {
1917     return s == nullptr;
1918 }
1919
1920 #if USE_AUTH
1921 static void
1922 parse_authparam(Auth::ConfigVector * config)
1923 {
1924     char *type_str = ConfigParser::NextToken();
1925     if (!type_str) {
1926         self_destruct();
1927         return;
1928     }
1929
1930     char *param_str = ConfigParser::NextToken();
1931     if (!param_str) {
1932         self_destruct();
1933         return;
1934     }
1935
1936     /* find a configuration for the scheme in the currently parsed configs... */
1937     Auth::SchemeConfig *schemeCfg = Auth::SchemeConfig::Find(type_str);
1938
1939     if (schemeCfg == nullptr) {
1940         /* Create a configuration based on the scheme info */
1941         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1942
1943         if (theScheme == nullptr) {
1944             debugs(3, DBG_CRITICAL, "ERROR: Failure while parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1945             self_destruct();
1946             return;
1947         }
1948
1949         config->push_back(theScheme->createConfig());
1950         schemeCfg = Auth::SchemeConfig::Find(type_str);
1951         if (schemeCfg == nullptr) {
1952             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1953             self_destruct();
1954             return;
1955         }
1956     }
1957
1958     schemeCfg->parse(schemeCfg, config->size(), param_str);
1959 }
1960
1961 static void
1962 free_authparam(Auth::ConfigVector * cfg)
1963 {
1964     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1965     cfg->clear();
1966
1967     /* on reconfigure initialize new auth schemes for the new config. */
1968     if (reconfiguring) {
1969         Auth::Init();
1970     }
1971 }
1972
1973 static void
1974 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1975 {
1976     for (auto *scheme : cfg)
1977         scheme->dump(entry, name, scheme);
1978 }
1979
1980 static void
1981 parse_AuthSchemes(acl_access **authSchemes)
1982 {
1983     const char *tok = ConfigParser::NextQuotedToken();
1984     if (!tok) {
1985         debugs(29, DBG_CRITICAL, "FATAL: auth_schemes missing the parameter");
1986         self_destruct();
1987         return;
1988     }
1989     Auth::TheConfig.schemeLists.emplace_back(tok, ConfigParser::LastTokenWasQuoted());
1990     const auto action = Acl::Answer(ACCESS_ALLOWED, Auth::TheConfig.schemeLists.size() - 1);
1991     ParseAclWithAction(authSchemes, action, "auth_schemes");
1992 }
1993
1994 static void
1995 free_AuthSchemes(acl_access **authSchemes)
1996 {
1997     Auth::TheConfig.schemeLists.clear();
1998     free_acl_access(authSchemes);
1999 }
2000
2001 static void
2002 dump_AuthSchemes(StoreEntry *entry, const char *name, acl_access *authSchemes)
2003 {
2004     if (authSchemes)
2005         dump_SBufList(entry, ToTree(authSchemes).treeDump(name, [](const Acl::Answer &action) {
2006         return Auth::TheConfig.schemeLists.at(action.kind).rawSchemes;
2007     }));
2008 }
2009
2010 #endif /* USE_AUTH */
2011
2012 static void
2013 ParseAclWithAction(acl_access **config, const Acl::Answer &action, const char *desc, Acl::Node *acl)
2014 {
2015     assert(config);
2016     auto &access = *config;
2017     if (!access) {
2018         const auto tree = new Acl::Tree;
2019         tree->context(ToSBuf('(', desc, " rules)"), config_input_line);
2020         access = new acl_access(tree);
2021     }
2022     assert(access);
2023
2024     Acl::AndNode *rule = new Acl::AndNode;
2025     rule->context(ToSBuf('(', desc, " rule)"), config_input_line);
2026     if (acl)
2027         rule->add(acl);
2028     else
2029         rule->lineParse();
2030     (*access)->add(rule, action);
2031 }
2032
2033 static void
2034 parse_cachedir(Store::DiskConfig *swap)
2035 {
2036     assert(swap);
2037     Store::Disks::Parse(*swap);
2038 }
2039
2040 static const char *
2041 peer_type_str(const peer_t type)
2042 {
2043     const char * result;
2044
2045     switch (type) {
2046
2047     case PEER_PARENT:
2048         result = "parent";
2049         break;
2050
2051     case PEER_SIBLING:
2052         result = "sibling";
2053         break;
2054
2055     case PEER_MULTICAST:
2056         result = "multicast";
2057         break;
2058
2059     default:
2060         result = "unknown";
2061         break;
2062     }
2063
2064     return result;
2065 }
2066
2067 static void
2068 dump_peer(StoreEntry * entry, const char *name, const CachePeers *peers)
2069 {
2070     if (!peers)
2071         return;
2072
2073     NeighborTypeDomainList *t;
2074     LOCAL_ARRAY(char, xname, 128);
2075
2076     for (const auto &peer: *peers) {
2077         const auto p = peer.get();
2078         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
2079                           name,
2080                           p->host,
2081                           neighborTypeStr(p),
2082                           p->http_port,
2083                           p->icp.port,
2084                           p->name);
2085         dump_peer_options(entry, p);
2086
2087         if (p->access) {
2088             snprintf(xname, 128, "cache_peer_access %s", p->name);
2089             dump_acl_access(entry, xname, p->access);
2090         }
2091
2092         for (t = p->typelist; t; t = t->next) {
2093             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
2094                               p->host,
2095                               peer_type_str(t->type),
2096                               t->domain);
2097         }
2098     }
2099 }
2100
2101 /**
2102  * utility function to prevent getservbyname() being called with a numeric value
2103  * on Windows at least it returns garage results.
2104  */
2105 static bool
2106 isUnsignedNumeric(const char *str, size_t len)
2107 {
2108     if (len < 1) return false;
2109
2110     for (; len >0 && *str; ++str, --len) {
2111         if (! isdigit(*str))
2112             return false;
2113     }
2114     return true;
2115 }
2116
2117 /**
2118  \param proto   'tcp' or 'udp' for protocol
2119  \returns       Port the named service is supposed to be listening on.
2120  */
2121 static unsigned short
2122 GetService(const char *proto)
2123 {
2124     struct servent *port = nullptr;
2125     /** Parses a port number or service name from the squid.conf */
2126     char *token = ConfigParser::NextToken();
2127     if (token == nullptr) {
2128         self_destruct();
2129         return 0; /* NEVER REACHED */
2130     }
2131     /** Returns either the service port number from /etc/services */
2132     if ( !isUnsignedNumeric(token, strlen(token)) )
2133         port = getservbyname(token, proto);
2134     if (port != nullptr) {
2135         return ntohs((unsigned short)port->s_port);
2136     }
2137     /** Or a numeric translation of the config text. */
2138     return xatos(token);
2139 }
2140
2141 /**
2142  \returns       Port the named TCP service is supposed to be listening on.
2143  \copydoc GetService(const char *proto)
2144  */
2145 inline unsigned short
2146 GetTcpService(void)
2147 {
2148     return GetService("tcp");
2149 }
2150
2151 /**
2152  \returns       Port the named UDP service is supposed to be listening on.
2153  \copydoc GetService(const char *proto)
2154  */
2155 inline unsigned short
2156 GetUdpService(void)
2157 {
2158     return GetService("udp");
2159 }
2160
2161 static void
2162 parse_peer(CachePeers **peers)
2163 {
2164     char *host_str = ConfigParser::NextToken();
2165     if (!host_str) {
2166         self_destruct();
2167         return;
2168     }
2169
2170     char *token = ConfigParser::NextToken();
2171     if (!token) {
2172         self_destruct();
2173         return;
2174     }
2175
2176     const auto p = new CachePeer(host_str);
2177
2178     p->type = parseNeighborType(token);
2179
2180     if (p->type == PEER_MULTICAST) {
2181         p->options.no_digest = true;
2182         p->options.no_netdb_exchange = true;
2183     }
2184
2185     p->http_port = GetTcpService();
2186
2187     if (!p->http_port) {
2188         delete p;
2189         self_destruct();
2190         return;
2191     }
2192
2193     p->icp.port = GetUdpService();
2194
2195     while ((token = ConfigParser::NextToken())) {
2196         if (!strcmp(token, "proxy-only")) {
2197             p->options.proxy_only = true;
2198         } else if (!strcmp(token, "no-query")) {
2199             p->options.no_query = true;
2200         } else if (!strcmp(token, "background-ping")) {
2201             p->options.background_ping = true;
2202         } else if (!strcmp(token, "no-digest")) {
2203             p->options.no_digest = true;
2204         } else if (!strcmp(token, "no-tproxy")) {
2205             p->options.no_tproxy = true;
2206         } else if (!strcmp(token, "multicast-responder")) {
2207             p->options.mcast_responder = true;
2208         } else if (!strcmp(token, "multicast-siblings")) {
2209             p->options.mcast_siblings = true;
2210         } else if (!strncmp(token, "weight=", 7)) {
2211             p->weight = xatoi(token + 7);
2212         } else if (!strncmp(token, "basetime=", 9)) {
2213             p->basetime = xatoi(token + 9);
2214         } else if (!strcmp(token, "closest-only")) {
2215             p->options.closest_only = true;
2216         } else if (!strncmp(token, "ttl=", 4)) {
2217             p->mcast.ttl = xatoi(token + 4);
2218
2219             if (p->mcast.ttl < 0)
2220                 p->mcast.ttl = 0;
2221
2222             if (p->mcast.ttl > 128)
2223                 p->mcast.ttl = 128;
2224         } else if (!strcmp(token, "default")) {
2225             p->options.default_parent = true;
2226         } else if (!strcmp(token, "round-robin")) {
2227             p->options.roundrobin = true;
2228         } else if (!strcmp(token, "weighted-round-robin")) {
2229             p->options.weighted_roundrobin = true;
2230 #if USE_HTCP
2231         } else if (!strcmp(token, "htcp")) {
2232             p->options.htcp = true;
2233         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2234             /* Note: The htcp- form is deprecated, replaced by htcp= */
2235             p->options.htcp = true;
2236             char *tmp = xstrdup(token+5);
2237             char *mode, *nextmode;
2238             for (mode = nextmode = tmp; mode; mode = nextmode) {
2239                 nextmode = strchr(mode, ',');
2240                 if (nextmode) {
2241                     *nextmode = '\0';
2242                     ++nextmode;
2243                 }
2244                 if (!strcmp(mode, "no-clr")) {
2245                     if (p->options.htcp_only_clr)
2246                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2247                     p->options.htcp_no_clr = true;
2248                 } else if (!strcmp(mode, "no-purge-clr")) {
2249                     p->options.htcp_no_purge_clr = true;
2250                 } else if (!strcmp(mode, "only-clr")) {
2251                     if (p->options.htcp_no_clr)
2252                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2253                     p->options.htcp_only_clr = true;
2254                 } else if (!strcmp(mode, "forward-clr")) {
2255                     p->options.htcp_forward_clr = true;
2256                 } else if (!strcmp(mode, "oldsquid")) {
2257                     p->options.htcp_oldsquid = true;
2258                 } else {
2259                     fatalf("invalid HTCP mode '%s'", mode);
2260                 }
2261             }
2262             safe_free(tmp);
2263 #endif
2264         } else if (!strcmp(token, "no-netdb-exchange")) {
2265             p->options.no_netdb_exchange = true;
2266
2267         } else if (!strcmp(token, "carp")) {
2268             if (p->type != PEER_PARENT)
2269                 throw TextException(ToSBuf("non-parent carp cache_peer ", *p), Here());
2270
2271             p->options.carp = true;
2272         } else if (!strncmp(token, "carp-key=", 9)) {
2273             if (p->options.carp != true)
2274                 throw TextException(ToSBuf("carp-key specified on non-carp cache_peer ", *p), Here());
2275             p->options.carp_key.set = true;
2276             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2277             for (; key; key = nextkey) {
2278                 nextkey=strchr(key,',');
2279                 if (nextkey) ++nextkey; // skip the comma, any
2280                 if (0==strncmp(key,"scheme",6)) {
2281                     p->options.carp_key.scheme = true;
2282                 } else if (0==strncmp(key,"host",4)) {
2283                     p->options.carp_key.host = true;
2284                 } else if (0==strncmp(key,"port",4)) {
2285                     p->options.carp_key.port = true;
2286                 } else if (0==strncmp(key,"path",4)) {
2287                     p->options.carp_key.path = true;
2288                 } else if (0==strncmp(key,"params",6)) {
2289                     p->options.carp_key.params = true;
2290                 } else {
2291                     fatalf("invalid carp-key '%s'",key);
2292                 }
2293             }
2294         } else if (!strcmp(token, "userhash")) {
2295 #if USE_AUTH
2296             if (p->type != PEER_PARENT)
2297                 throw TextException(ToSBuf("non-parent userhash cache_peer ", *p), Here());
2298
2299             p->options.userhash = true;
2300 #else
2301             throw TextException(ToSBuf("missing authentication support; required for userhash cache_peer ", *p), Here());
2302 #endif
2303         } else if (!strcmp(token, "sourcehash")) {
2304             if (p->type != PEER_PARENT)
2305                 throw TextException(ToSBuf("non-parent sourcehash cache_peer ", *p), Here());
2306
2307             p->options.sourcehash = true;
2308
2309         } else if (!strcmp(token, "no-delay")) {
2310 #if USE_DELAY_POOLS
2311             p->options.no_delay = true;
2312 #else
2313             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2314 #endif
2315         } else if (!strncmp(token, "login=", 6)) {
2316             p->login = xstrdup(token + 6);
2317             rfc1738_unescape(p->login);
2318         } else if (!strcmp(token, "auth-no-keytab")) {
2319             p->options.auth_no_keytab = 1;
2320         } else if (!strncmp(token, "connect-timeout=", 16)) {
2321             p->connect_timeout_raw = xatoi(token + 16);
2322         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2323             p->connect_fail_limit = xatoi(token + 19);
2324 #if USE_CACHE_DIGESTS
2325         } else if (!strncmp(token, "digest-url=", 11)) {
2326             p->digest_url = xstrdup(token + 11);
2327 #endif
2328
2329         } else if (!strcmp(token, "allow-miss")) {
2330             p->options.allow_miss = true;
2331         } else if (!strncmp(token, "max-conn=", 9)) {
2332             p->max_conn = xatoi(token + 9);
2333         } else if (!strncmp(token, "standby=", 8)) {
2334             p->standby.limit = xatoi(token + 8);
2335         } else if (!strcmp(token, "originserver")) {
2336             p->options.originserver = true;
2337         } else if (!strncmp(token, "name=", 5)) {
2338             p->rename(token + 5);
2339         } else if (!strncmp(token, "forceddomain=", 13)) {
2340             safe_free(p->domain);
2341             if (token[13])
2342                 p->domain = xstrdup(token + 13);
2343
2344         } else if (strncmp(token, "ssl", 3) == 0) {
2345 #if !USE_OPENSSL
2346             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2347 #else
2348             p->secure.parse(token+3);
2349 #endif
2350         } else if (strncmp(token, "tls-", 4) == 0) {
2351             p->secure.parse(token+4);
2352         } else if (strncmp(token, "tls", 3) == 0) {
2353             p->secure.parse(token+3);
2354         } else if (strcmp(token, "front-end-https") == 0) {
2355             p->front_end_https = 1;
2356         } else if (strcmp(token, "front-end-https=on") == 0) {
2357             p->front_end_https = 1;
2358         } else if (strcmp(token, "front-end-https=auto") == 0) {
2359             p->front_end_https = 2;
2360         } else if (strcmp(token, "connection-auth=off") == 0) {
2361             p->connection_auth = 0;
2362         } else if (strcmp(token, "connection-auth") == 0) {
2363             p->connection_auth = 1;
2364         } else if (strcmp(token, "connection-auth=on") == 0) {
2365             p->connection_auth = 1;
2366         } else if (strcmp(token, "connection-auth=auto") == 0) {
2367             p->connection_auth = 2;
2368         } else if (token[0] == '#') {
2369             // start of a text comment. stop reading this line.
2370             break;
2371         } else {
2372             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2373         }
2374     }
2375
2376     if (findCachePeerByName(p->name))
2377         throw TextException(ToSBuf("cache_peer ", *p, " specified twice"), Here());
2378
2379     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2380         throw TextException(ToSBuf("cache_peer ", *p, " max-conn=", p->max_conn,
2381                                    " is lower than its standby=", p->standby.limit), Here());
2382
2383     if (p->weight < 1)
2384         p->weight = 1;
2385
2386     if (p->connect_fail_limit < 1)
2387         p->connect_fail_limit = 10;
2388
2389 #if USE_CACHE_DIGESTS
2390     if (!p->options.no_digest)
2391         p->digest = new PeerDigest(p);
2392 #endif
2393
2394     if (p->secure.encryptTransport)
2395         p->secure.parseOptions();
2396
2397     if (!*peers)
2398         *peers = new CachePeers;
2399
2400     (*peers)->add(p);
2401
2402     p->index = (*peers)->size();
2403
2404     peerClearRRStart();
2405 }
2406
2407 static void
2408 free_peer(CachePeers ** const peers)
2409 {
2410     delete *peers;
2411     *peers = nullptr;
2412 }
2413
2414 static void
2415 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2416 {
2417     while (list) {
2418         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2419             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2420         else
2421             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2422
2423         for (auto w : list->actions)
2424             entry->appendf(" " SQUIDSBUFPH, SQUIDSBUFPRINT(w));
2425
2426         storeAppendPrintf(entry, "\n");
2427         list = list->next;
2428     }
2429 }
2430
2431 static void
2432 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2433 {
2434     char *passwd = nullptr;
2435     parse_string(&passwd);
2436
2437     Mgr::ActionPasswordList *p = new Mgr::ActionPasswordList;
2438     p->passwd = passwd;
2439
2440     while (char *token = ConfigParser::NextQuotedToken())
2441         p->actions.push_back(SBuf(token));
2442
2443     Mgr::ActionPasswordList **P;
2444     for (P = head; *P; P = &(*P)->next) {
2445         /*
2446          * See if any of the actions from this line already have a
2447          * password from previous lines.  The password checking
2448          * routines in cache_manager.c take the the password from
2449          * the first Mgr::ActionPasswordList that contains the
2450          * requested action.  Thus, we should warn users who might
2451          * think they can have two passwords for the same action.
2452          */
2453         for (const auto &w : (*P)->actions) {
2454             for (const auto &u : p->actions) {
2455                 if (w != u)
2456                     continue;
2457
2458                 debugs(0, DBG_PARSE_NOTE(1), "ERROR: action '" << u << "' (line " << config_lineno << ") already has a password");
2459             }
2460         }
2461     }
2462
2463     *P = p;
2464 }
2465
2466 static void
2467 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2468 {
2469     delete *head;
2470     *head = nullptr;
2471 }
2472
2473 static void
2474 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2475 {
2476     while (var != nullptr) {
2477         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2478
2479         for (const auto &aclName: var->acl_list)
2480             storeAppendPrintf(entry, " " SQUIDSBUFPH, SQUIDSBUFPRINT(aclName));
2481
2482         storeAppendPrintf(entry, "\n");
2483
2484         var = var->next;
2485     }
2486 }
2487
2488 static void
2489 parse_denyinfo(AclDenyInfoList ** var)
2490 {
2491     aclParseDenyInfoLine(var);
2492 }
2493
2494 void
2495 free_denyinfo(AclDenyInfoList ** list)
2496 {
2497     delete *list;
2498     *list = nullptr;
2499 }
2500
2501 static void
2502 parse_peer_access(void)
2503 {
2504     auto &p = LegacyParser.cachePeer("cache_peer_access peer-name");
2505     std::string directive = "peer_access ";
2506     directive += p.name;
2507     aclParseAccessLine(directive.c_str(), LegacyParser, &p.access);
2508 }
2509
2510 static void
2511 parse_hostdomaintype(void)
2512 {
2513     auto &p = LegacyParser.cachePeer("neighbor_type_domain peer-name");
2514
2515     char *type = ConfigParser::NextToken();
2516     if (!type) {
2517         self_destruct();
2518         return;
2519     }
2520
2521     char *domain = nullptr;
2522     while ((domain = ConfigParser::NextToken())) {
2523         auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2524         l->type = parseNeighborType(type);
2525         l->domain = xstrdup(domain);
2526
2527         NeighborTypeDomainList **L = nullptr;
2528         for (L = &p.typelist; *L; L = &((*L)->next));
2529         *L = l;
2530     }
2531 }
2532
2533 static void
2534 dump_int(StoreEntry * entry, const char *name, int var)
2535 {
2536     storeAppendPrintf(entry, "%s %d\n", name, var);
2537 }
2538
2539 void
2540 parse_int(int *var)
2541 {
2542     int i;
2543     i = GetInteger();
2544     *var = i;
2545 }
2546
2547 static void
2548 free_int(int *var)
2549 {
2550     *var = 0;
2551 }
2552
2553 static void
2554 dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2555 {
2556     storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2557 }
2558
2559 static void
2560 parse_int64_t(int64_t *var)
2561 {
2562     int64_t i;
2563     i = GetInteger64();
2564     *var = i;
2565 }
2566
2567 static void
2568 free_int64_t(int64_t *var)
2569 {
2570     *var = 0;
2571 }
2572
2573 static void
2574 dump_onoff(StoreEntry * entry, const char *name, int var)
2575 {
2576     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2577 }
2578
2579 void
2580 parse_onoff(int *var)
2581 {
2582     char *token = ConfigParser::NextToken();
2583     if (!token) {
2584         self_destruct();
2585         return;
2586     }
2587
2588     if (!strcmp(token, "on")) {
2589         *var = 1;
2590     } else if (!strcmp(token, "enable")) {
2591         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2592         *var = 1;
2593     } else if (!strcmp(token, "off")) {
2594         *var = 0;
2595     } else if (!strcmp(token, "disable")) {
2596         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2597         *var = 0;
2598     } else {
2599         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2600         self_destruct();
2601     }
2602 }
2603
2604 #define free_onoff free_int
2605
2606 static void
2607 dump_tristate(StoreEntry * entry, const char *name, int var)
2608 {
2609     const char *state;
2610
2611     if (var > 0)
2612         state = "on";
2613     else if (var < 0)
2614         state = "warn";
2615     else
2616         state = "off";
2617
2618     storeAppendPrintf(entry, "%s %s\n", name, state);
2619 }
2620
2621 static void
2622 parse_tristate(int *var)
2623 {
2624     char *token = ConfigParser::NextToken();
2625     if (!token) {
2626         self_destruct();
2627         return;
2628     }
2629
2630     if (!strcmp(token, "on")) {
2631         *var = 1;
2632     } else if (!strcmp(token, "enable")) {
2633         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2634         *var = 1;
2635     } else if (!strcmp(token, "warn")) {
2636         *var = -1;
2637     } else if (!strcmp(token, "off")) {
2638         *var = 0;
2639     } else if (!strcmp(token, "disable")) {
2640         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2641         *var = 0;
2642     } else {
2643         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2644         self_destruct();
2645     }
2646 }
2647
2648 #define free_tristate free_int
2649
2650 static void
2651 parse_pipelinePrefetch(int *var)
2652 {
2653     char *token = ConfigParser::PeekAtToken();
2654     if (!token) {
2655         self_destruct();
2656         return;
2657     }
2658
2659     if (!strcmp(token, "on")) {
2660         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2661         *var = 1;
2662         //pop the token
2663         (void)ConfigParser::NextToken();
2664     } else if (!strcmp(token, "off")) {
2665         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2666         *var = 0;
2667         //pop the token
2668         (void)ConfigParser::NextToken();
2669     } else
2670         parse_int(var);
2671 }
2672
2673 #define free_pipelinePrefetch free_int
2674 #define dump_pipelinePrefetch dump_int
2675
2676 static void
2677 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2678 {
2679     while (head != nullptr) {
2680         PackableStream os(*entry);
2681         os << name << ' ';
2682         head->printHead(os);
2683
2684         if (head->max_stale >= 0)
2685             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2686
2687         if (head->flags.refresh_ims)
2688             storeAppendPrintf(entry, " refresh-ims");
2689
2690         if (head->flags.store_stale)
2691             storeAppendPrintf(entry, " store-stale");
2692
2693 #if USE_HTTP_VIOLATIONS
2694
2695         if (head->flags.override_expire)
2696             storeAppendPrintf(entry, " override-expire");
2697
2698         if (head->flags.override_lastmod)
2699             storeAppendPrintf(entry, " override-lastmod");
2700
2701         if (head->flags.reload_into_ims)
2702             storeAppendPrintf(entry, " reload-into-ims");
2703
2704         if (head->flags.ignore_reload)
2705             storeAppendPrintf(entry, " ignore-reload");
2706
2707         if (head->flags.ignore_no_store)
2708             storeAppendPrintf(entry, " ignore-no-store");
2709
2710         if (head->flags.ignore_private)
2711             storeAppendPrintf(entry, " ignore-private");
2712 #endif
2713
2714         storeAppendPrintf(entry, "\n");
2715
2716         head = head->next;
2717     }
2718 }
2719
2720 static void
2721 parse_refreshpattern(RefreshPattern ** head)
2722 {
2723     char *token;
2724     time_t min = 0;
2725     double pct = 0.0;
2726     time_t max = 0;
2727     int refresh_ims = 0;
2728     int store_stale = 0;
2729     int max_stale = -1;
2730
2731 #if USE_HTTP_VIOLATIONS
2732
2733     int override_expire = 0;
2734     int override_lastmod = 0;
2735     int reload_into_ims = 0;
2736     int ignore_reload = 0;
2737     int ignore_no_store = 0;
2738     int ignore_private = 0;
2739 #endif
2740
2741     int i;
2742     RefreshPattern *t;
2743
2744     auto regex = LegacyParser.regex("refresh_pattern regex");
2745
2746     i = GetInteger();       /* token: min */
2747
2748     /* catch negative and insanely huge values close to 32-bit wrap */
2749     if (i < 0) {
2750         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2751         i = 0;
2752     }
2753     if (i > 60*24*365) {
2754         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2755         i = 60*24*365;
2756     }
2757
2758     min = (time_t) (i * 60);    /* convert minutes to seconds */
2759
2760     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2761
2762     i = GetInteger();       /* token: max */
2763
2764     /* catch negative and insanely huge values close to 32-bit wrap */
2765     if (i < 0) {
2766         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2767         i = 0;
2768     }
2769     if (i > 60*24*365) {
2770         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2771         i = 60*24*365;
2772     }
2773
2774     max = (time_t) (i * 60);    /* convert minutes to seconds */
2775
2776     /* Options */
2777     while ((token = ConfigParser::NextToken()) != nullptr) {
2778         if (!strcmp(token, "refresh-ims")) {
2779             refresh_ims = 1;
2780         } else if (!strcmp(token, "store-stale")) {
2781             store_stale = 1;
2782         } else if (!strncmp(token, "max-stale=", 10)) {
2783             max_stale = xatoi(token + 10);
2784
2785 #if USE_HTTP_VIOLATIONS
2786
2787         } else if (!strcmp(token, "override-expire"))
2788             override_expire = 1;
2789         else if (!strcmp(token, "override-lastmod"))
2790             override_lastmod = 1;
2791         else if (!strcmp(token, "ignore-no-store"))
2792             ignore_no_store = 1;
2793         else if (!strcmp(token, "ignore-private"))
2794             ignore_private = 1;
2795         else if (!strcmp(token, "reload-into-ims")) {
2796             reload_into_ims = 1;
2797             refresh_nocache_hack = 1;
2798             /* tell client_side.c that this is used */
2799         } else if (!strcmp(token, "ignore-reload")) {
2800             ignore_reload = 1;
2801             refresh_nocache_hack = 1;
2802             /* tell client_side.c that this is used */
2803 #endif
2804
2805         } else if (!strcmp(token, "ignore-no-cache") ||
2806                    !strcmp(token, "ignore-must-revalidate") ||
2807                    !strcmp(token, "ignore-auth")
2808                   ) {
2809             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2810         } else
2811             debugs(22, DBG_CRITICAL, "ERROR: Unknown refresh_pattern option: " << token);
2812     }
2813
2814     pct = pct < 0.0 ? 0.0 : pct;
2815     max = max < 0 ? 0 : max;
2816     t = new RefreshPattern(std::move(regex));
2817     t->min = min;
2818     t->pct = pct;
2819     t->max = max;
2820
2821     if (refresh_ims)
2822         t->flags.refresh_ims = true;
2823
2824     if (store_stale)
2825         t->flags.store_stale = true;
2826
2827     t->max_stale = max_stale;
2828
2829 #if USE_HTTP_VIOLATIONS
2830
2831     if (override_expire)
2832         t->flags.override_expire = true;
2833
2834     if (override_lastmod)
2835         t->flags.override_lastmod = true;
2836
2837     if (reload_into_ims)
2838         t->flags.reload_into_ims = true;
2839
2840     if (ignore_reload)
2841         t->flags.ignore_reload = true;
2842
2843     if (ignore_no_store)
2844         t->flags.ignore_no_store = true;
2845
2846     if (ignore_private)
2847         t->flags.ignore_private = true;
2848 #endif
2849
2850     t->next = nullptr;
2851
2852     while (*head)
2853         head = &(*head)->next;
2854
2855     *head = t;
2856 }
2857
2858 static void
2859 free_refreshpattern(RefreshPattern ** head)
2860 {
2861     delete *head;
2862     *head = nullptr;
2863
2864 #if USE_HTTP_VIOLATIONS
2865     refresh_nocache_hack = 0;
2866
2867 #endif
2868 }
2869
2870 static void
2871 dump_string(StoreEntry * entry, const char *name, char *var)
2872 {
2873     if (var != nullptr)
2874         storeAppendPrintf(entry, "%s %s\n", name, var);
2875 }
2876
2877 static void
2878 parse_string(char **var)
2879 {
2880     safe_free(*var);
2881
2882     char *token = ConfigParser::NextToken();
2883     if (!token) {
2884         self_destruct();
2885         return;
2886     }
2887
2888     *var = xstrdup(token);
2889 }
2890
2891 static void
2892 free_string(char **var)
2893 {
2894     safe_free(*var);
2895 }
2896
2897 void
2898 parse_eol(char *volatile *var)
2899 {
2900     if (!var) {
2901         self_destruct();
2902         return;
2903     }
2904
2905     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2906     safe_free(*var);
2907
2908     if (!token) {
2909         self_destruct();
2910         return;
2911     }
2912
2913     while (*token && xisspace(*token))
2914         ++token;
2915
2916     if (!*token) {
2917         self_destruct();
2918         return;
2919     }
2920
2921     *var = xstrdup((char *) token);
2922 }
2923
2924 #define dump_eol dump_string
2925 #define free_eol free_string
2926
2927 static void
2928 parse_TokenOrQuotedString(char **var)
2929 {
2930     safe_free(*var);
2931
2932     char *token = ConfigParser::NextQuotedToken();
2933     if (!token) {
2934         self_destruct();
2935         return;
2936     }
2937
2938     *var = xstrdup(token);
2939 }
2940
2941 #define dump_TokenOrQuotedString dump_string
2942 #define free_TokenOrQuotedString free_string
2943
2944 static void
2945 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2946 {
2947     PackableStream os(*entry);
2948     os << name << ' ' << var << " seconds\n";
2949 }
2950
2951 void
2952 parse_time_t(time_t * var)
2953 {
2954     const auto maxTime = std::numeric_limits<time_t>::max();
2955     const auto seconds = parseTimeLine<std::chrono::seconds>();
2956     if (maxTime < seconds.count())
2957         throw TexcHere(ToSBuf("directive supports time values up to ", maxTime, " but is given ", seconds.count(), " seconds"));
2958     *var = static_cast<time_t>(seconds.count());
2959 }
2960
2961 static void
2962 free_time_t(time_t * var)
2963 {
2964     *var = 0;
2965 }
2966
2967 static void
2968 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2969 {
2970     PackableStream os(*entry);
2971     if (var % 1000)
2972         os << name << ' ' << var << " milliseconds\n";
2973     else
2974         os << name << ' ' << (var/1000) << " seconds\n";
2975 }
2976
2977 static void
2978 parse_time_msec(time_msec_t *var)
2979 {
2980     *var = parseTimeLine<std::chrono::milliseconds>().count();
2981 }
2982
2983 static void
2984 free_time_msec(time_msec_t * var)
2985 {
2986     *var = 0;
2987 }
2988
2989 static void
2990 dump_time_nanoseconds(StoreEntry *entry, const char *name, const std::chrono::nanoseconds &var)
2991 {
2992     // std::chrono::nanoseconds::rep is unknown a priori so we cast to (and print) the largest supported integer
2993     storeAppendPrintf(entry, "%s %jd nanoseconds\n", name, static_cast<intmax_t>(var.count()));
2994 }
2995
2996 static void
2997 parse_time_nanoseconds(std::chrono::nanoseconds *var)
2998 {
2999     *var = parseTimeLine<std::chrono::nanoseconds>();
3000 }
3001
3002 static void
3003 free_time_nanoseconds(std::chrono::nanoseconds *var)
3004 {
3005     *var = std::chrono::nanoseconds::zero();
3006 }
3007
3008 static void
3009 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3010 {
3011     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3012 }
3013
3014 static void
3015 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3016 {
3017     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3018 }
3019
3020 static void
3021 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3022 {
3023     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3024 }
3025
3026 static void
3027 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3028 {
3029     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3030 }
3031
3032 static void
3033 parse_b_size_t(size_t * var)
3034 {
3035     parseBytesLine(var, B_BYTES_STR);
3036 }
3037
3038 static void
3039 parse_b_ssize_t(ssize_t * var)
3040 {
3041     parseBytesLineSigned(var, B_BYTES_STR);
3042 }
3043
3044 static void
3045 parse_b_int64_t(int64_t * var)
3046 {
3047     parseBytesLine64(var, B_BYTES_STR);
3048 }
3049
3050 static void
3051 parse_kb_int64_t(int64_t * var)
3052 {
3053     parseBytesLine64(var, B_KBYTES_STR);
3054 }
3055
3056 static void
3057 free_size_t(size_t * var)
3058 {
3059     *var = 0;
3060 }
3061
3062 static void
3063 free_ssize_t(ssize_t * var)
3064 {
3065     *var = 0;
3066 }
3067
3068 static void
3069 free_b_int64_t(int64_t * var)
3070 {
3071     *var = 0;
3072 }
3073
3074 #define free_b_size_t free_size_t
3075 #define free_b_ssize_t free_ssize_t
3076 #define free_kb_size_t free_size_t
3077 #define free_mb_size_t free_size_t
3078 #define free_gb_size_t free_size_t
3079 #define free_kb_int64_t free_b_int64_t
3080
3081 static void
3082 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3083 {
3084     storeAppendPrintf(entry, "%s %d\n", name, var);
3085 }
3086
3087 static void
3088 free_u_short(unsigned short * u)
3089 {
3090     *u = 0;
3091 }
3092
3093 static void
3094 parse_u_short(unsigned short * var)
3095 {
3096     ConfigParser::ParseUShort(var);
3097 }
3098
3099 void
3100 ConfigParser::ParseUShort(unsigned short *var)
3101 {
3102     *var = GetShort();
3103 }
3104
3105 void
3106 ConfigParser::ParseBool(bool *var)
3107 {
3108     int i = GetInteger();
3109
3110     if (0 == i)
3111         *var = false;
3112     else if (1 == i)
3113         *var = true;
3114     else
3115         self_destruct();
3116 }
3117
3118 static void
3119 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3120 {
3121     while (list != nullptr) {
3122         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3123         list = list->next;
3124     }
3125 }
3126
3127 void
3128 ConfigParser::ParseWordList(wordlist ** list)
3129 {
3130     parse_wordlist(list);
3131 }
3132
3133 void
3134 parse_wordlist(wordlist ** list)
3135 {
3136     char *token;
3137     while ((token = ConfigParser::NextQuotedToken()))
3138         wordlistAdd(list, token);
3139 }
3140
3141 static int
3142 check_null_acl_access(acl_access * a)
3143 {
3144     return a == nullptr;
3145 }
3146
3147 #define free_wordlist wordlistDestroy
3148
3149 #define free_uri_whitespace free_int
3150
3151 static void
3152 parse_uri_whitespace(int *var)
3153 {
3154     char *token = ConfigParser::NextToken();
3155     if (!token) {
3156         self_destruct();
3157         return;
3158     }
3159
3160     if (!strcmp(token, "strip"))
3161         *var = URI_WHITESPACE_STRIP;
3162     else if (!strcmp(token, "deny"))
3163         *var = URI_WHITESPACE_DENY;
3164     else if (!strcmp(token, "allow"))
3165         *var = URI_WHITESPACE_ALLOW;
3166     else if (!strcmp(token, "encode"))
3167         *var = URI_WHITESPACE_ENCODE;
3168     else if (!strcmp(token, "chop"))
3169         *var = URI_WHITESPACE_CHOP;
3170     else {
3171         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3172         self_destruct();
3173     }
3174 }
3175
3176 static void
3177 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3178 {
3179     const char *s;
3180
3181     if (var == URI_WHITESPACE_ALLOW)
3182         s = "allow";
3183     else if (var == URI_WHITESPACE_ENCODE)
3184         s = "encode";
3185     else if (var == URI_WHITESPACE_CHOP)
3186         s = "chop";
3187     else if (var == URI_WHITESPACE_DENY)
3188         s = "deny";
3189     else
3190         s = "strip";
3191
3192     storeAppendPrintf(entry, "%s %s\n", name, s);
3193 }
3194
3195 static void
3196 free_removalpolicy(RemovalPolicySettings ** settings)
3197 {
3198     if (!*settings)
3199         return;
3200
3201     free_string(&(*settings)->type);
3202
3203     free_wordlist(&(*settings)->args);
3204
3205     delete *settings;
3206
3207     *settings = nullptr;
3208 }
3209
3210 static void
3211 parse_removalpolicy(RemovalPolicySettings ** settings)
3212 {
3213     if (*settings)
3214         free_removalpolicy(settings);
3215
3216     *settings = new RemovalPolicySettings;
3217
3218     parse_string(&(*settings)->type);
3219
3220     parse_wordlist(&(*settings)->args);
3221 }
3222
3223 static void
3224 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3225 {
3226     wordlist *args;
3227     storeAppendPrintf(entry, "%s %s", name, settings->type);
3228     args = settings->args;
3229
3230     while (args) {
3231         storeAppendPrintf(entry, " %s", args->key);
3232         args = args->next;
3233     }
3234
3235     storeAppendPrintf(entry, "\n");
3236 }
3237
3238 inline void
3239 free_YesNoNone(YesNoNone *)
3240 {}
3241
3242 static void
3243 parse_YesNoNone(YesNoNone *option)
3244 {
3245     int value = 0;
3246     parse_onoff(&value);
3247     option->configure(value > 0);
3248 }
3249
3250 static void
3251 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3252 {
3253     if (option.configured())
3254         dump_onoff(entry, name, option ? 1 : 0);
3255 }
3256
3257 static void
3258 free_memcachemode(SquidConfig *)
3259 {}
3260
3261 static void
3262 parse_memcachemode(SquidConfig *)
3263 {
3264     char *token = ConfigParser::NextToken();
3265     if (!token) {
3266         self_destruct();
3267         return;
3268     }
3269
3270     if (strcmp(token, "always") == 0) {
3271         Config.onoff.memory_cache_first = 1;
3272         Config.onoff.memory_cache_disk = 1;
3273     } else if (strcmp(token, "disk") == 0) {
3274         Config.onoff.memory_cache_first = 0;
3275         Config.onoff.memory_cache_disk = 1;
3276     } else if (strncmp(token, "net", 3) == 0) {
3277         Config.onoff.memory_cache_first = 1;
3278         Config.onoff.memory_cache_disk = 0;
3279     } else if (strcmp(token, "never") == 0) {
3280         Config.onoff.memory_cache_first = 0;
3281         Config.onoff.memory_cache_disk = 0;
3282     } else {
3283         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3284         self_destruct();
3285     }
3286 }
3287
3288 static void
3289 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3290 {
3291     storeAppendPrintf(entry, "%s ", name);
3292     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3293         storeAppendPrintf(entry, "always");
3294     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3295         storeAppendPrintf(entry, "disk");
3296     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3297         storeAppendPrintf(entry, "network");
3298     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3299         storeAppendPrintf(entry, "none");
3300     storeAppendPrintf(entry, "\n");
3301 }
3302
3303 #include "cf_parser.cci"
3304
3305 peer_t
3306 parseNeighborType(const char *s)
3307 {
3308     if (!strcmp(s, "parent"))
3309         return PEER_PARENT;
3310
3311     if (!strcmp(s, "neighbor"))
3312         return PEER_SIBLING;
3313
3314     if (!strcmp(s, "neighbour"))
3315         return PEER_SIBLING;
3316
3317     if (!strcmp(s, "sibling"))
3318         return PEER_SIBLING;
3319
3320     if (!strcmp(s, "multicast"))
3321         return PEER_MULTICAST;
3322
3323     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3324
3325     return PEER_SIBLING;
3326 }
3327
3328 #if USE_WCCPv2
3329 static void
3330 parse_IpAddress_list(Ip::Address_list ** head)
3331 {
3332     char *token;
3333     Ip::Address_list *s;
3334     Ip::Address ipa;
3335
3336     while ((token = ConfigParser::NextToken())) {
3337         if (GetHostWithPort(token, &ipa)) {
3338
3339             while (*head)
3340                 head = &(*head)->next;
3341
3342             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3343             s->s = ipa;
3344
3345             *head = s;
3346         } else {
3347             self_destruct();
3348             return;
3349         }
3350     }
3351 }
3352
3353 static void
3354 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3355 {
3356     char ntoabuf[MAX_IPSTRLEN];
3357
3358     while (s) {
3359         storeAppendPrintf(e, "%s %s\n",
3360                           n,
3361                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3362         s = s->next;
3363     }
3364 }
3365
3366 static void
3367 free_IpAddress_list(Ip::Address_list ** head)
3368 {
3369     if (*head) delete *head;
3370     *head = nullptr;
3371 }
3372
3373 #if CURRENTLY_UNUSED
3374 /* This code was previously used by http_port. Left as it really should
3375  * be used by icp_port and htcp_port
3376  */
3377 static int
3378 check_null_IpAddress_list(const Ip::Address_list * s)
3379 {
3380     return NULL == s;
3381 }
3382
3383 #endif /* CURRENTLY_UNUSED */
3384 #endif /* USE_WCCPv2 */
3385
3386 static void
3387 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3388 {
3389     char *host = nullptr;
3390     unsigned short port = 0;
3391     char *t = nullptr;
3392     char *junk = nullptr;
3393
3394     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3395     s->name = xstrdup(token);
3396     s->connection_auth_disabled = false;
3397
3398     const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3399
3400     if (*token == '[') {
3401         /* [ipv6]:port */
3402         host = token + 1;
3403         t = strchr(host, ']');
3404         if (!t) {
3405             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3406             self_destruct();
3407             return;
3408         }
3409         *t = '\0';
3410         ++t;
3411         if (*t != ':') {
3412             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3413             self_destruct();
3414             return;
3415         }
3416         if (!Ip::EnableIpv6) {
3417             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3418             self_destruct();
3419             return;
3420         }
3421         port = xatos(t + 1);
3422     } else if ((t = strchr(token, ':'))) {
3423         /* host:port */
3424         /* ipv4:port */
3425         host = token;
3426         *t = '\0';
3427         port = xatos(t + 1);
3428
3429     } else if (strtol(token, &junk, 10) && !*junk) {
3430         port = xatos(token);
3431         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3432     } else {
3433         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3434         self_destruct();
3435         return;
3436     }
3437
3438     if (port == 0 && host != nullptr) {
3439         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3440         self_destruct();
3441         return;
3442     }
3443
3444     if (nullptr == host) {
3445         s->s.setAnyAddr();
3446         s->s.port(port);
3447         if (!Ip::EnableIpv6)
3448             s->s.setIPv4();
3449         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3450     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3451         s->s.port(port);
3452         if (!Ip::EnableIpv6)
3453             s->s.setIPv4();
3454         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3455     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3456         /* do not use ipcache */
3457         s->defaultsite = xstrdup(host);
3458         s->s.port(port);
3459         if (!Ip::EnableIpv6)
3460             s->s.setIPv4();
3461         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3462     } else {
3463         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3464         self_destruct();
3465     }
3466 }
3467
3468 /// parses the protocol= option of the *_port directive, returning parsed value
3469 /// unsupported option values result in a fatal error message
3470 /// upper case values required; caller may convert for backward compatibility
3471 static AnyP::ProtocolVersion
3472 parsePortProtocol(const SBuf &value)
3473 {
3474     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3475     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3476     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3477         return Http::ProtocolVersion(1,1);
3478
3479     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3480         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3481
3482     if (value.cmp("FTP") == 0)
3483         return Ftp::ProtocolVersion();
3484
3485     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3486     return AnyP::ProtocolVersion(); // not reached
3487 }
3488
3489 static void
3490 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3491 {
3492     /* modes first */
3493
3494     if (strcmp(token, "accel") == 0) {
3495         if (s->flags.isIntercepted()) {
3496             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3497             self_destruct();
3498             return;
3499         }
3500         s->flags.accelSurrogate = true;
3501         s->vhost = true;
3502     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3503         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3504             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3505             self_destruct();
3506             return;
3507         }
3508         s->flags.natIntercept = true;
3509         Ip::Interceptor.StartInterception();
3510         /* Log information regarding the port modes under interception. */
3511         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3512         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3513     } else if (strcmp(token, "tproxy") == 0) {
3514         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3515             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3516             self_destruct();
3517             return;
3518         }
3519         s->flags.tproxyIntercept = true;
3520         Ip::Interceptor.StartTransparency();
3521         /* Log information regarding the port modes under transparency. */
3522         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3523
3524         if (s->flags.proxySurrogate) {
3525             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3526         }
3527
3528         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3529             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3530             self_destruct();
3531             return;
3532         }
3533
3534     } else if (strcmp(token, "require-proxy-header") == 0) {
3535         s->flags.proxySurrogate = true;
3536         if (s->flags.tproxyIntercept) {
3537             // receiving is still permitted, so we do not unset the TPROXY flag
3538             // spoofing access control override takes care of the spoof disable later
3539             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3540         }
3541
3542     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3543         if (!s->flags.accelSurrogate) {
3544             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3545             self_destruct();
3546             return;
3547         }
3548         safe_free(s->defaultsite);
3549         s->defaultsite = xstrdup(token + 12);
3550     } else if (strcmp(token, "vhost") == 0) {
3551         if (!s->flags.accelSurrogate) {
3552             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3553         }
3554         s->flags.accelSurrogate = true;
3555         s->vhost = true;
3556     } else if (strcmp(token, "no-vhost") == 0) {
3557         if (!s->flags.accelSurrogate) {
3558             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3559         }
3560         s->vhost = false;
3561     } else if (strcmp(token, "vport") == 0) {
3562         if (!s->flags.accelSurrogate) {
3563             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3564             self_destruct();
3565             return;
3566         }
3567         s->vport = -1;
3568     } else if (strncmp(token, "vport=", 6) == 0) {
3569         if (!s->flags.accelSurrogate) {
3570             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3571             self_destruct();
3572             return;
3573         }
3574         s->vport = xatos(token + 6);
3575     } else if (strncmp(token, "protocol=", 9) == 0) {
3576         if (!s->flags.accelSurrogate) {
3577             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3578             self_destruct();
3579             return;
3580         }
3581         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3582     } else if (strcmp(token, "allow-direct") == 0) {
3583         if (!s->flags.accelSurrogate) {
3584             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3585             self_destruct();
3586             return;
3587         }
3588         s->allow_direct = true;
3589     } else if (strcmp(token, "act-as-origin") == 0) {
3590         if (!s->flags.accelSurrogate) {
3591             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3592         } else
3593             s->actAsOrigin = true;
3594     } else if (strcmp(token, "ignore-cc") == 0) {
3595 #if !USE_HTTP_VIOLATIONS
3596         if (!s->flags.accelSurrogate) {
3597             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3598             self_destruct();
3599             return;
3600         }
3601 #endif
3602         s->ignore_cc = true;
3603     } else if (strncmp(token, "name=", 5) == 0) {
3604         safe_free(s->name);
3605         s->name = xstrdup(token + 5);
3606     } else if (strcmp(token, "no-connection-auth") == 0) {
3607         s->connection_auth_disabled = true;
3608     } else if (strcmp(token, "connection-auth=off") == 0) {
3609         s->connection_auth_disabled = true;
3610     } else if (strcmp(token, "connection-auth") == 0) {
3611         s->connection_auth_disabled = false;
3612     } else if (strcmp(token, "connection-auth=on") == 0) {
3613         s->connection_auth_disabled = false;
3614     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3615         if (!strcmp(token + 23, "off"))
3616             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3617         else if (!strcmp(token + 23, "transparent"))
3618             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3619         else if (!strcmp(token + 23, "always"))
3620             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3621         else {
3622             self_destruct();
3623             return;
3624         }
3625     } else if (strcmp(token, "ipv4") == 0) {
3626         if ( !s->s.setIPv4() ) {
3627             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3628             self_destruct();
3629             return;
3630         }
3631     } else if (strcmp(token, "tcpkeepalive") == 0) {
3632         s->tcp_keepalive.enabled = true;
3633     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3634         char *t = token + 13;
3635         s->tcp_keepalive.enabled = true;
3636         s->tcp_keepalive.idle = xatoui(t,',');
3637         t = strchr(t, ',');
3638         if (t) {
3639             ++t;
3640             s->tcp_keepalive.interval = xatoui(t,',');
3641             t = strchr(t, ',');
3642         }
3643         if (t) {
3644             ++t;
3645             s->tcp_keepalive.timeout = xatoui(t);
3646         }
3647 #if USE_OPENSSL
3648     } else if (strcmp(token, "sslBump") == 0) {
3649         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3650                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3651         s->flags.tunnelSslBumping = true;
3652     } else if (strcmp(token, "ssl-bump") == 0) {
3653         s->flags.tunnelSslBumping = true;
3654     } else if (strncmp(token, "cert=", 5) == 0) {
3655         s->secure.parse(token);
3656     } else if (strncmp(token, "key=", 4) == 0) {
3657         s->secure.parse(token);
3658     } else if (strncmp(token, "version=", 8) == 0) {
3659         debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3660                "in " << cfg_directive << ". Use 'options=' instead.");
3661         s->secure.parse(token);
3662     } else if (strncmp(token, "options=", 8) == 0) {
3663         s->secure.parse(token);
3664     } else if (strncmp(token, "cipher=", 7) == 0) {
3665         s->secure.parse(token);
3666     } else if (strncmp(token, "clientca=", 9) == 0) {
3667         s->secure.parse(token);
3668     } else if (strncmp(token, "cafile=", 7) == 0) {
3669         debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3670                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3671         s->secure.parse(token);
3672     } else if (strncmp(token, "capath=", 7) == 0) {
3673         s->secure.parse(token);
3674     } else if (strncmp(token, "crlfile=", 8) == 0) {
3675         s->secure.parse(token);
3676     } else if (strncmp(token, "dhparams=", 9) == 0) {
3677         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3678                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3679         s->secure.parse(token);
3680     } else if (strncmp(token, "sslflags=", 9) == 0) {
3681         // NP: deprecation warnings output by secure.parse() when relevant
3682         s->secure.parse(token+3);
3683     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3684         // NP: deprecation warnings output by secure.parse() when relevant
3685         s->secure.parse(token+3);
3686     } else if (strncmp(token, "generate-host-certificates", 26) == 0) {
3687         s->secure.parse(token);
3688 #endif
3689     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3690         s->secure.parse(token);
3691     } else if (strncmp(token, "tls-", 4) == 0) {
3692         s->secure.parse(token+4);
3693     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3694         s->ftp_track_dirs = true;
3695     } else if (strcmp(token, "worker-queues") == 0) {
3696 #if !defined(SO_REUSEADDR)
3697 #error missing system #include that #defines SO_* constants
3698 #endif
3699 #if !defined(SO_REUSEPORT)
3700         throw TexcHere(ToSBuf(cfg_directive, ' ', token, " option requires building Squid where SO_REUSEPORT is supported by the TCP stack"));
3701 #endif
3702         s->workerQueues = true;
3703     } else {
3704         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3705         self_destruct();
3706     }
3707 }
3708
3709 void
3710 add_http_port(char *portspec)
3711 {
3712     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3713     s->transport = parsePortProtocol(SBuf("HTTP"));
3714     parsePortSpecification(s, portspec);
3715     // we may need to merge better if the above returns a list with clones
3716     assert(s->next == nullptr);
3717     s->next = HttpPortList;
3718     HttpPortList = s;
3719 }
3720
3721 static void
3722 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3723 {
3724     SBuf protoName;
3725     if (strcmp(optionName, "http_port") == 0 ||
3726             strcmp(optionName, "ascii_port") == 0)
3727         protoName = "HTTP";
3728     else if (strcmp(optionName, "https_port") == 0)
3729         protoName = "HTTPS";
3730     else if (strcmp(optionName, "ftp_port") == 0)
3731         protoName = "FTP";
3732     if (protoName.isEmpty()) {
3733         self_destruct();
3734         return;
3735     }
3736
3737     char *token = ConfigParser::NextToken();
3738
3739     if (!token) {
3740         self_destruct();
3741         return;
3742     }
3743
3744     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3745     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3746     parsePortSpecification(s, token);
3747
3748     /* parse options ... */
3749     while ((token = ConfigParser::NextToken())) {
3750         parse_port_option(s, token);
3751     }
3752
3753     s->secure.syncCaFiles();
3754
3755     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3756         s->secure.encryptTransport = true;
3757 #if USE_OPENSSL
3758         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3759         const bool hijacked = s->flags.isIntercepted();
3760         if (s->flags.tunnelSslBumping && !hijacked) {
3761             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3762             self_destruct();
3763             return;
3764         }
3765         if (hijacked && !s->flags.tunnelSslBumping) {
3766             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3767             self_destruct();
3768             return;
3769         }
3770 #endif
3771         if (s->flags.proxySurrogate) {
3772             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3773             self_destruct();
3774             return;
3775         }
3776     } else if (protoName.cmp("FTP") == 0) {
3777         /* ftp_port does not support ssl-bump */
3778         if (s->flags.tunnelSslBumping) {
3779             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3780             self_destruct();
3781             return;
3782         }
3783         if (s->flags.proxySurrogate) {
3784             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3785             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3786             self_destruct();
3787             return;
3788         }
3789     }
3790
3791     if (s->secure.encryptTransport) {
3792         if (s->secure.certs.empty()) {
3793             debugs(3, DBG_CRITICAL, "FATAL: " << AnyP::UriScheme(s->transport.protocol) << "_port requires a cert= parameter");
3794             self_destruct();
3795             return;
3796         }
3797         s->secure.parseOptions();
3798     }
3799
3800     // *_port line should now be fully valid so we can clone it if necessary
3801     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3802         s->next = s->ipV4clone();
3803     }
3804
3805     while (*head != nullptr)
3806         head = &((*head)->next);
3807
3808     *head = s;
3809 }
3810
3811 static void
3812 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3813 {
3814     char buf[MAX_IPSTRLEN];
3815
3816     storeAppendPrintf(e, "%s %s",
3817                       n,
3818                       s->s.toUrl(buf,MAX_IPSTRLEN));
3819
3820     // MODES and specific sub-options.
3821     if (s->flags.natIntercept)
3822         storeAppendPrintf(e, " intercept");
3823
3824     else if (s->flags.tproxyIntercept)
3825         storeAppendPrintf(e, " tproxy");
3826
3827     else if (s->flags.proxySurrogate)
3828         storeAppendPrintf(e, " require-proxy-header");
3829
3830     else if (s->flags.accelSurrogate) {
3831         storeAppendPrintf(e, " accel");
3832
3833         if (s->vhost)
3834             storeAppendPrintf(e, " vhost");
3835
3836         if (s->vport < 0)
3837             storeAppendPrintf(e, " vport");
3838         else if (s->vport > 0)
3839             storeAppendPrintf(e, " vport=%d", s->vport);
3840
3841         if (s->defaultsite)
3842             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3843
3844         // TODO: compare against prefix of 'n' instead of assuming http_port
3845         if (s->transport.protocol != AnyP::PROTO_HTTP)
3846             storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3847
3848         if (s->allow_direct)
3849             storeAppendPrintf(e, " allow-direct");
3850
3851         if (s->ignore_cc)
3852             storeAppendPrintf(e, " ignore-cc");
3853
3854     }
3855
3856     // Generic independent options
3857
3858     if (s->name)
3859         storeAppendPrintf(e, " name=%s", s->name);
3860
3861 #if USE_HTTP_VIOLATIONS
3862     if (!s->flags.accelSurrogate && s->ignore_cc)
3863         storeAppendPrintf(e, " ignore-cc");
3864 #endif
3865
3866     if (s->connection_auth_disabled)
3867         storeAppendPrintf(e, " connection-auth=off");
3868     else
3869         storeAppendPrintf(e, " connection-auth=on");
3870
3871     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3872         const char *pmtu;
3873
3874         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3875             pmtu = "always";
3876         else
3877             pmtu = "transparent";
3878
3879         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3880     }
3881
3882     if (s->s.isAnyAddr() && !s->s.isIPv6())
3883         storeAppendPrintf(e, " ipv4");
3884
3885     if (s->tcp_keepalive.enabled) {
3886         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3887             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3888         } else {
3889             storeAppendPrintf(e, " tcpkeepalive");
3890         }
3891     }
3892
3893 #if USE_OPENSSL
3894     if (s->flags.tunnelSslBumping)
3895         storeAppendPrintf(e, " ssl-bump");
3896 #endif
3897
3898     PackableStream os(*e);
3899     s->secure.dumpCfg(os, "tls-");
3900 }
3901
3902 static void
3903 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3904 {
3905     for (AnyP::PortCfgPointer p = s; p != nullptr; p = p->next) {
3906         dump_generic_port(e, n, p);
3907         storeAppendPrintf(e, "\n");
3908     }
3909 }
3910
3911 void
3912 configFreeMemory(void)
3913 {
3914     free_all();
3915     Dns::ResolveClientAddressesAsap = false;
3916     delete Config.ssl_client.defaultPeerContext;
3917     Config.ssl_client.defaultPeerContext = nullptr;
3918     delete Config.ssl_client.sslContext_;
3919     Config.ssl_client.sslContext_ = nullptr;
3920 #if USE_OPENSSL
3921     Ssl::unloadSquidUntrusted();
3922 #endif
3923 }
3924
3925 void
3926 requirePathnameExists(const char *name, const char *path)
3927 {
3928
3929     struct stat sb;
3930     char pathbuf[BUFSIZ];
3931     assert(path != nullptr);
3932
3933     if (Config.chroot_dir && (geteuid() == 0)) {
3934         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3935         path = pathbuf;
3936     }
3937
3938     if (stat(path, &sb) < 0) {
3939         int xerrno = errno;
3940         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
3941         // keep going to find more issues if we are only checking the config file with "-k parse"
3942         if (opt_parse_cfg_only)
3943             return;
3944         // this is fatal if it is found during startup or reconfigure
3945         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3946             fatalf("%s %s: %s", name, path, xstrerr(xerrno));
3947     }
3948 }
3949
3950 #include "AccessLogEntry.h"
3951
3952 /**
3953  * We support several access_log configuration styles:
3954  *
3955  * #1: Deprecated ancient style without an explicit logging module:
3956  * access_log /var/log/access.log
3957  *
3958  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3959  * access_log none [acl ...]
3960  *
3961  * #3: Configurable logging module without named options:
3962  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3963  * If no explicit logformat name is given, the first ACL name, if any,
3964  * should not be an existing logformat name or it will be treated as such.
3965  * access_log module:place [logformat_name] [acl ...]
3966  *
3967  * #4: Configurable logging module with name=value options such as logformat=x:
3968  * The first ACL name may not contain '='.
3969  * Without any optional parts, directives using this style are indistinguishable
3970  * from directives using style #1 until we start requiring the "module:" prefix.
3971  * access_log module:place [option ...] [acl ...]
3972  *
3973  */
3974 static void
3975 parse_access_log(CustomLog ** logs)
3976 {
3977     const char *filename = ConfigParser::NextToken();
3978     if (!filename) {
3979         self_destruct();
3980         return;
3981     }
3982
3983     const auto cl = new CustomLog();
3984
3985     cl->filename = xstrdup(filename);
3986
3987     if (strcmp(filename, "none") == 0) {
3988         cl->type = Log::Format::CLF_NONE;
3989         aclParseAclList(LegacyParser, &cl->aclList, filename);
3990         while (*logs)
3991             logs = &(*logs)->next;
3992         *logs = cl;
3993         return;
3994     }
3995
3996     const char *token = ConfigParser::PeekAtToken();
3997     if (token && !strchr(token, '=')) { // style #3
3998         // TODO: Deprecate this style to avoid this dangerous guessing.
3999         if (Log::TheConfig.knownFormat(token)) {
4000             cl->setLogformat(token);
4001             (void)ConfigParser::NextToken(); // consume the token used above
4002         } else {
4003             // assume there is no explicit logformat name and use the default
4004             cl->setLogformat("squid");
4005         }
4006     } else { // style #1 or style #4
4007         // TODO: Drop deprecated style #1 support. We already warn about it, and
4008         // its exceptional treatment makes detecting "module" typos impractical!
4009         cl->parseOptions(LegacyParser, "squid");
4010     }
4011     assert(cl->type); // setLogformat() was called
4012
4013     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4014
4015     while (*logs)
4016         logs = &(*logs)->next;
4017
4018     *logs = cl;
4019 }
4020
4021 static int
4022 check_null_access_log(CustomLog *customlog_definitions)
4023 {
4024     return customlog_definitions == nullptr;
4025 }
4026
4027 static void
4028 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4029 {
4030     assert(entry);
4031     for (auto log = logs; log; log = log->next) {
4032         {
4033             PackableStream os(*entry);
4034             os << name; // directive name
4035             os << ' ' << log->filename; // including "none"
4036             log->dumpOptions(os);
4037         }
4038
4039         if (log->aclList)
4040             dump_acl_list(entry, log->aclList);
4041
4042         storeAppendPrintf(entry, "\n");
4043     }
4044 }
4045
4046 static void
4047 free_access_log(CustomLog ** definitions)
4048 {
4049     while (*definitions) {
4050         CustomLog *log = *definitions;
4051         *definitions = log->next;
4052         delete log;
4053     }
4054 }
4055
4056 #if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4057 /// parses list of integers form name=N1,N2,N3,...
4058 static bool
4059 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4060 {
4061     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4062         data += name.size();
4063         if (*data == '=') {
4064             while (true) {
4065                 ++data;
4066                 int value = 0;
4067                 if (!StringToInt(data, value, &data, 10))
4068                     break;
4069                 list.push_back(value);
4070                 if (*data == '\0' || *data != ',')
4071                     break;
4072             }
4073         }
4074     }
4075     return data && *data == '\0';
4076 }
4077 #endif
4078
4079 static void
4080 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4081 {
4082 #if !HAVE_CPU_AFFINITY
4083     (void)cpuAffinityMap;
4084     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4085            "support, do not set 'cpu_affinity_map'");
4086     self_destruct();
4087
4088 #else /* HAVE_CPU_AFFINITY */
4089     if (!*cpuAffinityMap)
4090         *cpuAffinityMap = new CpuAffinityMap;
4091
4092     const char *const pToken = ConfigParser::NextToken();
4093     const char *const cToken = ConfigParser::NextToken();
4094     std::vector<int> processes, cores;
4095     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4096         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4097                "in 'cpu_affinity_map'");
4098         self_destruct();
4099     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4100         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4101                "'cpu_affinity_map'");
4102         self_destruct();
4103     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4104         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4105                "process_numbers and cores lists differ in length or " <<
4106                "contain numbers <= 0");
4107         self_destruct();
4108     }
4109 #endif
4110 }
4111
4112 static void
4113 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4114 {
4115     if (cpuAffinityMap) {
4116         storeAppendPrintf(entry, "%s process_numbers=", name);
4117         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4118             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4119                               cpuAffinityMap->processes()[i]);
4120         }
4121         storeAppendPrintf(entry, " cores=");
4122         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4123             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4124                               cpuAffinityMap->cores()[i]);
4125         }
4126         storeAppendPrintf(entry, "\n");
4127     }
4128 }
4129
4130 static void
4131 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4132 {
4133     delete *cpuAffinityMap;
4134     *cpuAffinityMap = nullptr;
4135 }
4136
4137 #if USE_ADAPTATION
4138
4139 static void
4140 parse_adaptation_service_set_type()
4141 {
4142     Adaptation::Config::ParseServiceSet();
4143 }
4144
4145 static void
4146 parse_adaptation_service_chain_type()
4147 {
4148     Adaptation::Config::ParseServiceChain();
4149 }
4150
4151 static void
4152 parse_adaptation_access_type()
4153 {
4154     Adaptation::Config::ParseAccess(LegacyParser);
4155 }
4156 #endif /* USE_ADAPTATION */
4157
4158 #if ICAP_CLIENT
4159
4160 static void
4161 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4162 {
4163     cfg->parseService();
4164 }
4165
4166 static void
4167 free_icap_service_type(Adaptation::Icap::Config * cfg)
4168 {
4169     cfg->freeService();
4170 }
4171
4172 static void
4173 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4174 {
4175     cfg.dumpService(entry, name);
4176 }
4177
4178 static void
4179 parse_icap_class_type()
4180 {
4181     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is deprecated. " <<
4182            "Use 'adaptation_service_set' instead");
4183     Adaptation::Config::ParseServiceSet();
4184 }
4185
4186 static void
4187 parse_icap_access_type()
4188 {
4189     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is deprecated. " <<
4190            "Use 'adaptation_access' instead");
4191     Adaptation::Config::ParseAccess(LegacyParser);
4192 }
4193
4194 #endif
4195
4196 #if USE_ECAP
4197
4198 static void
4199 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4200 {
4201     cfg->parseService();
4202 }
4203
4204 static void
4205 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4206 {
4207     cfg->freeService();
4208 }
4209
4210 static void
4211 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4212 {
4213     cfg.dumpService(entry, name);
4214 }
4215
4216 #endif /* USE_ECAP */
4217
4218 #if ICAP_CLIENT
4219 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4220 {
4221     char *token;
4222     cfg->service_failure_limit = GetInteger();
4223
4224     if ((token = ConfigParser::NextToken()) == nullptr)
4225         return;
4226
4227     if (strcmp(token,"in") != 0) {
4228         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4229         self_destruct();
4230         return;
4231     }
4232
4233     parse_time_t(&cfg->oldest_service_failure);
4234 }
4235
4236 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4237 {
4238     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4239     if (cfg.oldest_service_failure > 0) {
4240         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4241     }
4242     storeAppendPrintf(entry, "\n");
4243 }
4244
4245 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4246 {
4247     cfg->oldest_service_failure = 0;
4248     cfg->service_failure_limit = 0;
4249 }
4250 #endif
4251
4252 #if USE_OPENSSL
4253 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4254 {
4255     auto *al = ConfigParser::NextToken();
4256     if (!al) {
4257         self_destruct();
4258         return;
4259     }
4260
4261     const char *param;
4262     if ( char *s = strchr(al, '{')) {
4263         *s = '\0'; // terminate the al string
4264         ++s;
4265         param = s;
4266         s = strchr(s, '}');
4267         if (!s) {
4268             self_destruct();
4269             return;
4270         }
4271         *s = '\0';
4272     } else
4273         param = nullptr;
4274
4275     std::unique_ptr<sslproxy_cert_adapt> ca(new sslproxy_cert_adapt);
4276     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4277         ca->alg = Ssl::algSetValidAfter;
4278         ca->param = xstrdup("on");
4279     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4280         ca->alg = Ssl::algSetValidBefore;
4281         ca->param = xstrdup("on");
4282     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4283         ca->alg = Ssl::algSetCommonName;
4284         if (param) {
4285             if (strlen(param) > 64) {
4286                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4287                 self_destruct();
4288                 return;
4289             }
4290             ca->param = xstrdup(param);
4291         }
4292     } else {
4293         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4294         self_destruct();
4295         return;
4296     }
4297
4298     aclParseAclList(LegacyParser, &ca->aclList, al);
4299
4300     while (*cert_adapt)
4301         cert_adapt = &(*cert_adapt)->next;
4302
4303     *cert_adapt = ca.release();
4304 }
4305
4306 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4307 {
4308     for (const auto *ca = cert_adapt; ca; ca = ca->next) {
4309         storeAppendPrintf(entry, "%s ", name);
4310         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4311         if (ca->aclList)
4312             dump_acl_list(entry, ca->aclList);
4313         storeAppendPrintf(entry, "\n");
4314     }
4315 }
4316
4317 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4318 {
4319     delete *cert_adapt;
4320     *cert_adapt = nullptr;
4321 }
4322
4323 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4324 {
4325     const auto al = ConfigParser::NextToken();
4326     if (!al) {
4327         self_destruct();
4328         return;
4329     }
4330
4331     std::unique_ptr<sslproxy_cert_sign> cs(new sslproxy_cert_sign);
4332     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4333         cs->alg = Ssl::algSignTrusted;
4334     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4335         cs->alg = Ssl::algSignUntrusted;
4336     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4337         cs->alg = Ssl::algSignSelf;
4338     else {
4339         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4340         self_destruct();
4341         return;
4342     }
4343
4344     aclParseAclList(LegacyParser, &cs->aclList, al);
4345
4346     while (*cert_sign)
4347         cert_sign = &(*cert_sign)->next;
4348
4349     *cert_sign = cs.release();
4350 }
4351
4352 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4353 {
4354     for (const auto *cs = cert_sign; cs; cs = cs->next) {
4355         storeAppendPrintf(entry, "%s ", name);
4356         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4357         if (cs->aclList)
4358             dump_acl_list(entry, cs->aclList);
4359         storeAppendPrintf(entry, "\n");
4360     }
4361 }
4362
4363 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4364 {
4365     delete *cert_sign;
4366     *cert_sign = nullptr;
4367 }
4368
4369 class sslBumpCfgRr: public ::RegisteredRunner
4370 {
4371 public:
4372     static Ssl::BumpMode lastDeprecatedRule;
4373     /* RegisteredRunner API */
4374     void finalizeConfig() override;
4375 };
4376
4377 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4378
4379 DefineRunnerRegistrator(sslBumpCfgRr);
4380
4381 void
4382 sslBumpCfgRr::finalizeConfig()
4383 {
4384     if (lastDeprecatedRule != Ssl::bumpEnd) {
4385         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4386         static char buf[1024];
4387         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4388             strcpy(buf, "ssl_bump deny all");
4389             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4390                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4391                    "must not use implicit rules. Update your ssl_bump rules.");
4392         } else {
4393             strcpy(buf, "ssl_bump allow all");
4394             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4395                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4396                    "inferior to the newer server-first bumping mode. New ssl_bump"
4397                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4398         }
4399         parse_line(buf);
4400     }
4401 }
4402
4403 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4404 {
4405     typedef const char *BumpCfgStyle;
4406     BumpCfgStyle bcsNone = nullptr;
4407     BumpCfgStyle bcsNew = "new client/server-first/none";
4408     BumpCfgStyle bcsOld = "deprecated allow/deny";
4409     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4410     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4411     char *bm;
4412     if ((bm = ConfigParser::NextToken()) == nullptr) {
4413         self_destruct();
4414         return;
4415     }
4416
4417     // if this is the first rule processed
4418     if (*ssl_bump == nullptr) {
4419         bumpCfgStyleLast = bcsNone;
4420         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4421     }
4422
4423     auto action = Acl::Answer(ACCESS_ALLOWED);
4424
4425     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4426         action.kind = Ssl::bumpClientFirst;
4427         bumpCfgStyleNow = bcsNew;
4428     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4429         action.kind = Ssl::bumpServerFirst;
4430         bumpCfgStyleNow = bcsNew;
4431     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4432         action.kind = Ssl::bumpPeek;
4433         bumpCfgStyleNow = bcsNew;
4434     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4435         action.kind = Ssl::bumpStare;
4436         bumpCfgStyleNow = bcsNew;
4437     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4438         action.kind = Ssl::bumpSplice;
4439         bumpCfgStyleNow = bcsNew;
4440     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4441         action.kind = Ssl::bumpBump;
4442         bumpCfgStyleNow = bcsNew;
4443     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4444         action.kind = Ssl::bumpTerminate;
4445         bumpCfgStyleNow = bcsNew;
4446     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4447         action.kind = Ssl::bumpNone;
4448         bumpCfgStyleNow = bcsNew;
4449     } else if (strcmp(bm, "allow") == 0) {
4450         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4451                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4452                "is usually inferior to the newer server-first "
4453                "bumping mode. Update your ssl_bump rules.");
4454         action.kind = Ssl::bumpClientFirst;
4455         bumpCfgStyleNow = bcsOld;
4456         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4457     } else if (strcmp(bm, "deny") == 0) {
4458         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4459                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4460                "your ssl_bump rules.");
4461         action.kind = Ssl::bumpNone;
4462         bumpCfgStyleNow = bcsOld;
4463         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4464     } else {
4465         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4466         self_destruct();
4467         return;
4468     }
4469
4470     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4471         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4472                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4473         self_destruct();
4474         return;
4475     }
4476
4477     bumpCfgStyleLast = bumpCfgStyleNow;
4478
4479     // empty rule OK
4480     ParseAclWithAction(ssl_bump, action, "ssl_bump");
4481 }
4482
4483 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4484 {
4485     if (ssl_bump)
4486         dump_SBufList(entry, ToTree(ssl_bump).treeDump(name, [](const Acl::Answer &action) {
4487         return Ssl::BumpModeStr.at(action.kind);
4488     }));
4489 }
4490
4491 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4492 {
4493     free_acl_access(ssl_bump);
4494 }
4495
4496 #endif
4497
4498 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4499 {
4500     if (!headers)
4501         return;
4502
4503     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4504         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4505         if (hwa->aclList)
4506             dump_acl_list(entry, hwa->aclList);
4507         storeAppendPrintf(entry, "\n");
4508     }
4509 }
4510
4511 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4512 {
4513     char *fn;
4514     if (!*headers) {
4515         *headers = new HeaderWithAclList;
4516     }
4517     if ((fn = ConfigParser::NextToken()) == nullptr) {
4518         self_destruct();
4519         return;
4520     }
4521     HeaderWithAcl hwa;
4522     hwa.fieldName = fn;
4523     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4524     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4525         hwa.fieldId = Http::HdrType::OTHER;
4526
4527     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4528     ConfigParser::EnableMacros();
4529     String buf = ConfigParser::NextQuotedToken();
4530     ConfigParser::DisableMacros();
4531     hwa.fieldValue = buf.termedBuf();
4532     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4533     if (hwa.quoted) {
4534         if (!nlf->parse(hwa.fieldValue.c_str())) {
4535             self_destruct();
4536             return;
4537         }
4538         hwa.valueFormat = nlf;
4539     } else
4540         delete nlf;
4541     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4542     (*headers)->push_back(hwa);
4543 }
4544
4545 static void free_HeaderWithAclList(HeaderWithAclList **header)
4546 {
4547     if (!(*header))
4548         return;
4549
4550     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4551         if (hwa->aclList)
4552             aclDestroyAclList(&hwa->aclList);
4553
4554         if (hwa->valueFormat) {
4555             delete hwa->valueFormat;
4556             hwa->valueFormat = nullptr;
4557         }
4558     }
4559     delete *header;
4560     *header = nullptr;
4561 }
4562
4563 static void parse_note(Notes *notes)
4564 {
4565     assert(notes);
4566     notes->parse(LegacyParser);
4567 }
4568
4569 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4570 {
4571     notes.printAsNoteDirectives(entry, name);
4572 }
4573
4574 static void free_note(Notes *notes)
4575 {
4576     notes->clean();
4577 }
4578
4579 static DebugMessageId ParseDebugMessageId(const char *value, const char eov)
4580 {
4581     const auto id = xatoui(value, eov);
4582     if (!(0 < id && id < DebugMessageIdUpperBound))
4583         throw TextException(ToSBuf("unknown cache_log_message ID: ", value), Here());
4584     return static_cast<DebugMessageId>(id);
4585 }
4586
4587 static void parse_cache_log_message(DebugMessages **debugMessages)
4588 {
4589     DebugMessage msg;
4590     DebugMessageId minId = 0;
4591     DebugMessageId maxId = 0;
4592
4593     char *key = nullptr;
4594     char *value = nullptr;
4595     while (ConfigParser::NextKvPair(key, value)) {
4596         if (strcmp(key, "id") == 0) {
4597             if (minId > 0)
4598                 break;
4599             minId = maxId = ParseDebugMessageId(value, '\0');
4600         } else if (strcmp(key, "ids") == 0) {
4601             if (minId > 0)
4602                 break;
4603             const auto dash = strchr(value, '-');
4604             if (!dash)
4605                 throw TextException(ToSBuf("malformed cache_log_message ID range: ", key, '=', value), Here());
4606             minId = ParseDebugMessageId(value, '-');
4607             maxId = ParseDebugMessageId(dash+1, '\0');
4608             if (minId > maxId)
4609                 throw TextException(ToSBuf("invalid cache_log_message ID range: ", key, '=', value), Here());
4610         } else if (strcmp(key, "level") == 0) {
4611             if (msg.levelled())
4612                 break;
4613             const auto level = xatoi(value);
4614             if (level < 0)
4615                 throw TextException(ToSBuf("negative cache_log_message level: ", value), Here());
4616             msg.level = level;
4617         } else if (strcmp(key, "limit") == 0) {
4618             if (msg.limited())
4619                 break;
4620             msg.limit = xatoull(value, 10);
4621         } else {
4622             throw TextException(ToSBuf("unsupported cache_log_message option: ", key), Here());
4623         }
4624         key = value = nullptr;
4625     }
4626
4627     if (key && value)
4628         throw TextException(ToSBuf("repeated or conflicting cache_log_message option: ", key, '=', value), Here());
4629
4630     if (!minId)
4631         throw TextException("cache_log_message is missing a required id=... or ids=... option", Here());
4632
4633     if (!(msg.levelled() || msg.limited()))
4634         throw TextException("cache_log_message is missing a required level=... or limit=... option", Here());
4635
4636     assert(debugMessages);
4637     if (!*debugMessages)
4638         *debugMessages = new DebugMessages();
4639
4640     for (auto id = minId; id <= maxId; ++id) {
4641         msg.id = id;
4642         (*debugMessages)->messages.at(id) = msg;
4643     }
4644 }
4645
4646 static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *debugMessages)
4647 {
4648     if (!debugMessages)
4649         return;
4650
4651     SBufStream out;
4652     for (const auto &msg: debugMessages->messages) {
4653         if (!msg.configured())
4654             continue;
4655         out << name << " id=" << msg.id;
4656         if (msg.levelled())
4657             out << " level=" << msg.level;
4658         if (msg.limited())
4659             out << " limit=" << msg.limit;
4660         out << "\n";
4661     }
4662     const auto buf = out.buf();
4663     entry->append(buf.rawContent(), buf.length()); // may be empty
4664 }
4665
4666 static void free_cache_log_message(DebugMessages **debugMessages)
4667 {
4668     // clear old messages to avoid cumulative effect across (re)configurations
4669     assert(debugMessages);
4670     delete *debugMessages;
4671     *debugMessages = nullptr;
4672 }
4673
4674 static bool FtpEspvDeprecated = false;
4675 static void parse_ftp_epsv(acl_access **ftp_epsv)
4676 {
4677     Acl::Answer ftpEpsvDeprecatedAction;
4678     bool ftpEpsvIsDeprecatedRule = false;
4679
4680     char *t = ConfigParser::PeekAtToken();
4681     if (!t) {
4682         self_destruct();
4683         return;
4684     }
4685
4686     if (!strcmp(t, "off")) {
4687         (void)ConfigParser::NextToken();
4688         ftpEpsvIsDeprecatedRule = true;
4689         ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_DENIED);
4690     } else if (!strcmp(t, "on")) {
4691         (void)ConfigParser::NextToken();
4692         ftpEpsvIsDeprecatedRule = true;
4693         ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_ALLOWED);
4694     }
4695
4696     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4697     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4698     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4699     // then abort
4700     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4701             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != nullptr)) {
4702         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4703         self_destruct();
4704         return;
4705     }
4706
4707     if (ftpEpsvIsDeprecatedRule) {
4708         // overwrite previous ftp_epsv lines
4709         delete *ftp_epsv;
4710         *ftp_epsv = nullptr;
4711
4712         if (ftpEpsvDeprecatedAction == Acl::Answer(ACCESS_DENIED)) {
4713             static const auto all = new SBuf("all");
4714             if (const auto a = Acl::Node::FindByName(*all))
4715                 ParseAclWithAction(ftp_epsv, ftpEpsvDeprecatedAction, "ftp_epsv", a);
4716             else {
4717                 self_destruct();
4718                 return;
4719             }
4720         }
4721         FtpEspvDeprecated = true;
4722     } else {
4723         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4724     }
4725 }
4726
4727 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4728 {
4729     if (ftp_epsv)
4730         dump_SBufList(entry, ToTree(ftp_epsv).treeDump(name, Acl::AllowOrDeny));
4731 }
4732
4733 static void free_ftp_epsv(acl_access **ftp_epsv)
4734 {
4735     free_acl_access(ftp_epsv);
4736     FtpEspvDeprecated = false;
4737 }
4738
4739 /// Like parseTimeLine() but does not require the timeunit to be specified.
4740 /// If missed, the default 'second' timeunit is assumed.
4741 static std::chrono::seconds
4742 ParseUrlRewriteTimeout()
4743 {
4744     const auto timeValueToken = ConfigParser::NextToken();
4745     if (!timeValueToken)
4746         throw TexcHere("cannot read a time value");
4747
4748     using Seconds = std::chrono::seconds;
4749
4750     const auto parsedTimeValue = xatof(timeValueToken);
4751
4752     if (parsedTimeValue == 0)
4753         return std::chrono::seconds::zero();
4754
4755     std::chrono::nanoseconds parsedUnitDuration;
4756
4757     const auto unitToken = ConfigParser::PeekAtToken();
4758     if (parseTimeUnit<Seconds>(unitToken, parsedUnitDuration))
4759         (void)ConfigParser::NextToken();
4760     else {
4761         const auto defaultParsed = parseTimeUnit<Seconds>(T_SECOND_STR, parsedUnitDuration);
4762         assert(defaultParsed);
4763         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), ConfigParser::CurrentLocation() <<
4764                ": WARNING: missing time unit, using deprecated default '" << T_SECOND_STR << "'");
4765     }
4766
4767     const auto nanoseconds = ToNanoSeconds(parsedTimeValue, parsedUnitDuration);
4768
4769     return FromNanoseconds<Seconds>(nanoseconds, parsedTimeValue);
4770 }
4771
4772 static void
4773 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4774 {
4775     // TODO: do not allow optional timeunit (as the documentation prescribes)
4776     // and use parseTimeLine() instead.
4777     Config.Timeout.urlRewrite = ParseUrlRewriteTimeout().count();
4778
4779     char *key, *value;
4780     while(ConfigParser::NextKvPair(key, value)) {
4781         if (strcasecmp(key, "on_timeout") == 0) {
4782             if (strcasecmp(value, "bypass") == 0)
4783                 config->action = toutActBypass;
4784             else if (strcasecmp(value, "fail") == 0)
4785                 config->action = toutActFail;
4786             else if (strcasecmp(value, "retry") == 0)
4787                 config->action = toutActRetry;
4788             else if (strcasecmp(value, "use_configured_response") == 0) {
4789                 config->action = toutActUseConfiguredResponse;
4790             } else {
4791                 debugs(3, DBG_CRITICAL, "FATAL: unsupported \"on_timeout\" action: " << value);
4792                 self_destruct();
4793                 return;
4794             }
4795         } else if (strcasecmp(key, "response") == 0) {
4796             config->response = xstrdup(value);
4797         } else {
4798             debugs(3, DBG_CRITICAL, "FATAL: unsupported option " << key);
4799             self_destruct();
4800             return;
4801         }
4802     }
4803
4804     if (config->action == toutActUseConfiguredResponse && !config->response) {
4805         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4806         self_destruct();
4807     }
4808
4809     if (config->action != toutActUseConfiguredResponse && config->response) {
4810         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the 'on_timeout=use_configured_response' option");
4811         self_destruct();
4812     }
4813 }
4814
4815 static void
4816 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4817 {
4818     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4819     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4820
4821     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4822     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4823
4824     if (config.response)
4825         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4826
4827     storeAppendPrintf(entry, "\n");
4828 }
4829
4830 static void
4831 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4832 {
4833     Config.Timeout.urlRewrite = 0;
4834     config->action = 0;
4835     safe_free(config->response);
4836 }
4837
4838 static void
4839 parse_configuration_includes_quoted_values(bool *)
4840 {
4841     int val = 0;
4842     parse_onoff(&val);
4843
4844     // If quoted values is set to on then enable new strict mode parsing
4845     if (val) {
4846         ConfigParser::RecognizeQuotedValues = true;
4847         ConfigParser::StrictMode = true;
4848     } else {
4849         ConfigParser::RecognizeQuotedValues = false;
4850         ConfigParser::StrictMode = false;
4851     }
4852 }
4853
4854 static void
4855 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4856 {
4857     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4858     dump_onoff(entry, name, val);
4859 }
4860
4861 static void
4862 free_configuration_includes_quoted_values(bool *)
4863 {
4864     ConfigParser::RecognizeQuotedValues = false;
4865     ConfigParser::StrictMode = false;
4866 }
4867
4868 static void
4869 parse_on_unsupported_protocol(acl_access **access)
4870 {
4871     char *tm;
4872     if ((tm = ConfigParser::NextToken()) == nullptr) {
4873         self_destruct();
4874         return;
4875     }
4876
4877     auto action = Acl::Answer(ACCESS_ALLOWED);
4878     if (strcmp(tm, "tunnel") == 0)
4879         action.kind = 1;
4880     else if (strcmp(tm, "respond") == 0)
4881         action.kind = 2;
4882     else {
4883         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4884         self_destruct();
4885         return;
4886     }
4887
4888     // empty rule OK
4889     ParseAclWithAction(access, action, "on_unsupported_protocol");
4890 }
4891
4892 static void
4893 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4894 {
4895     static const std::vector<const char *> onErrorTunnelMode = {
4896         "none",
4897         "tunnel",
4898         "respond"
4899     };
4900     if (access) {
4901         const auto lines = ToTree(access).treeDump(name, [](const Acl::Answer &action) {
4902             return onErrorTunnelMode.at(action.kind);
4903         });
4904         dump_SBufList(entry, lines);
4905     }
4906 }
4907
4908 static void
4909 free_on_unsupported_protocol(acl_access **access)
4910 {
4911     free_acl_access(access);
4912 }
4913
4914 static void
4915 parse_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuardsPtr)
4916 {
4917     assert(protoGuardsPtr);
4918     auto &protoGuards = *protoGuardsPtr;
4919     if (!protoGuards)
4920         protoGuards = new HttpUpgradeProtocolAccess();
4921     protoGuards->configureGuard(LegacyParser);
4922 }
4923
4924 static void
4925 dump_http_upgrade_request_protocols(StoreEntry *entry, const char *rawName, HttpUpgradeProtocolAccess *protoGuards)
4926 {
4927     if (!protoGuards)
4928         return;
4929
4930     const SBuf name(rawName);
4931     protoGuards->forEach([entry,&name](const SBuf &proto, const acl_access *acls) {
4932         SBufList line;
4933         line.push_back(name);
4934         line.push_back(proto);
4935         const auto acld = ToTree(acls).treeDump("", &Acl::AllowOrDeny);
4936         line.insert(line.end(), acld.begin(), acld.end());
4937         dump_SBufList(entry, line);
4938     });
4939 }
4940
4941 static void
4942 free_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuardsPtr)
4943 {
4944     assert(protoGuardsPtr);
4945     auto &protoGuards = *protoGuardsPtr;
4946     delete protoGuards;
4947     protoGuards = nullptr;
4948 }
4949