src/cache_cf.cc

   1 /*
   2  * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 03    Configuration File Parsing */
  10
  11 #include "squid.h"
  12 #include "acl/Acl.h"
  13 #include "acl/AclDenyInfoList.h"
  14 #include "acl/AclSizeLimit.h"
  15 #include "acl/Address.h"
  16 #include "acl/Gadgets.h"
  17 #include "acl/MethodData.h"
  18 #include "acl/Tree.h"
  19 #include "anyp/PortCfg.h"
  20 #include "anyp/UriScheme.h"
  21 #include "AuthReg.h"
  22 #include "base/RunnersRegistry.h"
  23 #include "cache_cf.h"
  24 #include "CachePeer.h"
  25 #include "ConfigParser.h"
  26 #include "CpuAffinityMap.h"
  27 #include "DiskIO/DiskIOModule.h"
  28 #include "eui/Config.h"
  29 #include "ExternalACL.h"
  30 #include "format/Format.h"
  31 #include "ftp/Elements.h"
  32 #include "globals.h"
  33 #include "HttpHeaderTools.h"
  34 #include "icmp/IcmpConfig.h"
  35 #include "ident/Config.h"
  36 #include "ip/Intercept.h"
  37 #include "ip/QosConfig.h"
  38 #include "ip/tools.h"
  39 #include "ipc/Kids.h"
  40 #include "log/Config.h"
  41 #include "log/CustomLog.h"
  42 #include "MemBuf.h"
  43 #include "mgr/ActionPasswordList.h"
  44 #include "mgr/Registration.h"
  45 #include "neighbors.h"
  46 #include "NeighborTypeDomainList.h"
  47 #include "Parsing.h"
  48 #include "pconn.h"
  49 #include "PeerDigest.h"
  50 #include "PeerPoolMgr.h"
  51 #include "redirect.h"
  52 #include "RefreshPattern.h"
  53 #include "rfc1738.h"
  54 #include "sbuf/List.h"
  55 #include "SquidConfig.h"
  56 #include "SquidString.h"
  57 #include "ssl/ProxyCerts.h"
  58 #include "Store.h"
  59 #include "store/Disk.h"
  60 #include "store/Disks.h"
  61 #include "StoreFileSystem.h"
  62 #include "tools.h"
  63 #include "util.h"
  64 #include "wordlist.h"
  65 /* wccp2 has its own conditional definitions */
  66 #include "wccp2.h"
  67 #if USE_ADAPTATION
  68 #include "adaptation/Config.h"
  69 #endif
  70 #if ICAP_CLIENT
  71 #include "adaptation/icap/Config.h"
  72 #endif
  73 #if USE_ECAP
  74 #include "adaptation/ecap/Config.h"
  75 #endif
  76 #if USE_OPENSSL
  77 #include "ssl/Config.h"
  78 #include "ssl/support.h"
  79 #endif
  80 #if USE_AUTH
  81 #include "auth/Config.h"
  82 #include "auth/Scheme.h"
  83 #endif
  84 #if USE_SQUID_ESI
  85 #include "esi/Parser.h"
  86 #endif
  87 #if SQUID_SNMP
  88 #include "snmp.h"
  89 #endif
  90
  91 #if HAVE_GLOB_H
  92 #include <glob.h>
  93 #endif
  94 #include <limits>
  95 #include <list>
  96 #if HAVE_PWD_H
  97 #include <pwd.h>
  98 #endif
  99 #if HAVE_GRP_H
 100 #include <grp.h>
 101 #endif
 102 #if HAVE_SYS_STAT_H
 103 #include <sys/stat.h>
 104 #endif
 105
 106 #if USE_OPENSSL
 107 #include "ssl/gadgets.h"
 108 #endif
 109
 110 #if USE_ADAPTATION
 111 static void parse_adaptation_service_set_type();
 112 static void parse_adaptation_service_chain_type();
 113 static void parse_adaptation_access_type();
 114 #endif
 115
 116 #if ICAP_CLIENT
 117 static void parse_icap_service_type(Adaptation::Icap::Config *);
 118 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 119 static void free_icap_service_type(Adaptation::Icap::Config *);
 120 static void parse_icap_class_type();
 121 static void parse_icap_access_type();
 122
 123 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *);
 124 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
 125 static void free_icap_service_failure_limit(Adaptation::Icap::Config *);
 126 #endif
 127
 128 #if USE_ECAP
 129 static void parse_ecap_service_type(Adaptation::Ecap::Config *);
 130 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
 131 static void free_ecap_service_type(Adaptation::Ecap::Config *);
 132 #endif
 133
 134 static peer_t parseNeighborType(const char *s);
 135
 136 static const char *const T_MILLISECOND_STR = "millisecond";
 137 static const char *const T_SECOND_STR = "second";
 138 static const char *const T_MINUTE_STR = "minute";
 139 static const char *const T_HOUR_STR = "hour";
 140 static const char *const T_DAY_STR = "day";
 141 static const char *const T_WEEK_STR = "week";
 142 static const char *const T_FORTNIGHT_STR = "fortnight";
 143 static const char *const T_MONTH_STR = "month";
 144 static const char *const T_YEAR_STR = "year";
 145 static const char *const T_DECADE_STR = "decade";
 146
 147 static const char *const B_BYTES_STR = "bytes";
 148 static const char *const B_KBYTES_STR = "KB";
 149 static const char *const B_MBYTES_STR = "MB";
 150 static const char *const B_GBYTES_STR = "GB";
 151
 152 static const char *const list_sep = ", \t\n\r";
 153
 154 static void parse_access_log(CustomLog ** customlog_definitions);
 155 static int check_null_access_log(CustomLog *customlog_definitions);
 156 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
 157 static void free_access_log(CustomLog ** definitions);
 158 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
 159
 160 static void configDoConfigure(void);
 161 static void parse_refreshpattern(RefreshPattern **);
 162 static uint64_t parseTimeUnits(const char *unit,  bool allowMsec);
 163 static void parseTimeLine(time_msec_t * tptr, const char *units, bool allowMsec, bool expectMoreArguments);
 164 static void parse_u_short(unsigned short * var);
 165 static void parse_string(char **);
 166 static void default_all(void);
 167 static void defaults_if_none(void);
 168 static void defaults_postscriptum(void);
 169 static int parse_line(char *);
 170 static void parse_obsolete(const char *);
 171 static void parseBytesLine(size_t * bptr, const char *units);
 172 #if USE_OPENSSL
 173 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value);
 174 #endif
 175 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
 176 static size_t parseBytesUnits(const char *unit);
 177 static void free_all(void);
 178 void requirePathnameExists(const char *name, const char *path);
 179 static OBJH dump_config;
 180 #if USE_HTTP_VIOLATIONS
 181 static void free_HeaderManglers(HeaderManglers **pm);
 182 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 183 static void parse_http_header_access(HeaderManglers **manglers);
 184 #define free_http_header_access free_HeaderManglers
 185 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
 186 static void parse_http_header_replace(HeaderManglers **manglers);
 187 #define free_http_header_replace free_HeaderManglers
 188 #endif
 189 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
 190 static void parse_HeaderWithAclList(HeaderWithAclList **header);
 191 static void free_HeaderWithAclList(HeaderWithAclList **header);
 192 static void parse_note(Notes *);
 193 static void dump_note(StoreEntry *, const char *, Notes &);
 194 static void free_note(Notes *);
 195 static void parse_denyinfo(AclDenyInfoList ** var);
 196 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
 197 static void free_denyinfo(AclDenyInfoList ** var);
 198
 199 #if USE_WCCPv2
 200 static void parse_IpAddress_list(Ip::Address_list **);
 201 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
 202 static void free_IpAddress_list(Ip::Address_list **);
 203 #if CURRENTLY_UNUSED
 204 static int check_null_IpAddress_list(const Ip::Address_list *);
 205 #endif /* CURRENTLY_UNUSED */
 206 #endif /* USE_WCCPv2 */
 207
 208 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
 209 #define parse_PortCfg(l) parsePortCfg((l), token)
 210 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
 211 #define free_PortCfg(h)  *(h)=NULL
 212
 213 #if USE_OPENSSL
 214 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 215 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
 216 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
 217 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 218 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
 219 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
 220 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
 221 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
 222 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
 223 #endif /* USE_OPENSSL */
 224
 225 static void parse_ftp_epsv(acl_access **ftp_epsv);
 226 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
 227 static void free_ftp_epsv(acl_access **ftp_epsv);
 228
 229 static void parse_b_size_t(size_t * var);
 230 static void parse_b_int64_t(int64_t * var);
 231
 232 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 233 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
 234 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
 235
 236 static void parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 237 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
 238 static void free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *);
 239
 240 static int parseOneConfigFile(const char *file_name, unsigned int depth);
 241
 242 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 243 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
 244 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
 245 static void parse_on_unsupported_protocol(acl_access **access);
 246 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
 247 static void free_on_unsupported_protocol(acl_access **access);
 248
 249 /*
 250  * LegacyParser is a parser for legacy code that uses the global
 251  * approach.  This is static so that it is only exposed to cache_cf.
 252  * Other modules needing access to a ConfigParser should have it
 253  * provided to them in their parserFOO methods.
 254  */
 255 static ConfigParser LegacyParser = ConfigParser();
 256
 257 void
 258 self_destruct(void)
 259 {
 260     LegacyParser.destruct();
 261 }
 262
 263 static void
 264 SetConfigFilename(char const *file_name, bool is_pipe)
 265 {
 266     if (is_pipe)
 267         cfg_filename = file_name + 1;
 268     else
 269         cfg_filename = file_name;
 270 }
 271
 272 static const char*
 273 skip_ws(const char* s)
 274 {
 275     while (xisspace(*s))
 276         ++s;
 277
 278     return s;
 279 }
 280
 281 static int
 282 parseManyConfigFiles(char* files, int depth)
 283 {
 284     int error_count = 0;
 285     char* saveptr = NULL;
 286 #if HAVE_GLOB
 287     char *path;
 288     glob_t globbuf;
 289     int i;
 290     memset(&globbuf, 0, sizeof(globbuf));
 291     for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
 292         if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
 293             int xerrno = errno;
 294             fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
 295         }
 296     }
 297     for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
 298         error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
 299     }
 300     globfree(&globbuf);
 301 #else
 302     char* file = strwordtok(files, &saveptr);
 303     while (file != NULL) {
 304         error_count += parseOneConfigFile(file, depth);
 305         file = strwordtok(NULL, &saveptr);
 306     }
 307 #endif /* HAVE_GLOB */
 308     return error_count;
 309 }
 310
 311 static void
 312 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
 313 {
 314     assert(str != NULL);
 315     assert(newSubstr != NULL);
 316
 317     unsigned newSubstrLen = strlen(newSubstr);
 318     if (newSubstrLen > substrLen)
 319         str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
 320
 321     // move tail part including zero
 322     memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
 323     // copy new substring in place
 324     memcpy(str + substrIdx, newSubstr, newSubstrLen);
 325
 326     len = strlen(str);
 327 }
 328
 329 static void
 330 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
 331 {
 332     assert(line != NULL);
 333     assert(macroName != NULL);
 334     assert(substStr != NULL);
 335     unsigned macroNameLen = strlen(macroName);
 336     while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
 337         ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
 338 }
 339
 340 static void
 341 ProcessMacros(char*& line, int& len)
 342 {
 343     SubstituteMacro(line, len, "${service_name}", service_name.c_str());
 344     SubstituteMacro(line, len, "${process_name}", TheKidName);
 345     SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
 346 }
 347
 348 static void
 349 trim_trailing_ws(char* str)
 350 {
 351     assert(str != NULL);
 352     unsigned i = strlen(str);
 353     while ((i > 0) && xisspace(str[i - 1]))
 354         --i;
 355     str[i] = '\0';
 356 }
 357
 358 static const char*
 359 FindStatement(const char* line, const char* statement)
 360 {
 361     assert(line != NULL);
 362     assert(statement != NULL);
 363
 364     const char* str = skip_ws(line);
 365     unsigned len = strlen(statement);
 366     if (strncmp(str, statement, len) == 0) {
 367         str += len;
 368         if (*str == '\0')
 369             return str;
 370         else if (xisspace(*str))
 371             return skip_ws(str);
 372     }
 373
 374     return NULL;
 375 }
 376
 377 static bool
 378 StrToInt(const char* str, long& number)
 379 {
 380     assert(str != NULL);
 381
 382     char* end;
 383     number = strtol(str, &end, 0);
 384
 385     return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
 386 }
 387
 388 static bool
 389 EvalBoolExpr(const char* expr)
 390 {
 391     assert(expr != NULL);
 392     if (strcmp(expr, "true") == 0) {
 393         return true;
 394     } else if (strcmp(expr, "false") == 0) {
 395         return false;
 396     } else if (const char* equation = strchr(expr, '=')) {
 397         const char* rvalue = skip_ws(equation + 1);
 398         char* lvalue = (char*)xmalloc(equation - expr + 1);
 399         xstrncpy(lvalue, expr, equation - expr + 1);
 400         trim_trailing_ws(lvalue);
 401
 402         long number1;
 403         if (!StrToInt(lvalue, number1))
 404             fatalf("String is not a integer number: '%s'\n", lvalue);
 405         long number2;
 406         if (!StrToInt(rvalue, number2))
 407             fatalf("String is not a integer number: '%s'\n", rvalue);
 408
 409         xfree(lvalue);
 410         return number1 == number2;
 411     }
 412     fatalf("Unable to evaluate expression '%s'\n", expr);
 413     return false; // this place cannot be reached
 414 }
 415
 416 static int
 417 parseOneConfigFile(const char *file_name, unsigned int depth)
 418 {
 419     FILE *fp = NULL;
 420     const char *orig_cfg_filename = cfg_filename;
 421     const int orig_config_lineno = config_lineno;
 422     char *token = NULL;
 423     char *tmp_line = NULL;
 424     int tmp_line_len = 0;
 425     int err_count = 0;
 426     int is_pipe = 0;
 427
 428     debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
 429     if (depth > 16) {
 430         fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
 431         return 1;
 432     }
 433
 434     if (file_name[0] == '!' || file_name[0] == '|') {
 435         fp = popen(file_name + 1, "r");
 436         is_pipe = 1;
 437     } else {
 438         fp = fopen(file_name, "r");
 439     }
 440
 441     if (!fp) {
 442         int xerrno = errno;
 443         fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
 444     }
 445
 446 #if _SQUID_WINDOWS_
 447     setmode(fileno(fp), O_TEXT);
 448 #endif
 449
 450     SetConfigFilename(file_name, bool(is_pipe));
 451
 452     memset(config_input_line, '\0', BUFSIZ);
 453
 454     config_lineno = 0;
 455
 456     std::vector<bool> if_states;
 457     while (fgets(config_input_line, BUFSIZ, fp)) {
 458         ++config_lineno;
 459
 460         if ((token = strchr(config_input_line, '\n')))
 461             *token = '\0';
 462
 463         if ((token = strchr(config_input_line, '\r')))
 464             *token = '\0';
 465
 466         // strip any prefix whitespace off the line.
 467         const char *p = skip_ws(config_input_line);
 468         if (config_input_line != p)
 469             memmove(config_input_line, p, strlen(p)+1);
 470
 471         if (strncmp(config_input_line, "#line ", 6) == 0) {
 472             static char new_file_name[1024];
 473             static char *file;
 474             static char new_lineno;
 475             token = config_input_line + 6;
 476             new_lineno = strtol(token, &file, 0) - 1;
 477
 478             if (file == token)
 479                 continue;   /* Not a valid #line directive, may be a comment */
 480
 481             while (*file && xisspace((unsigned char) *file))
 482                 ++file;
 483
 484             if (*file) {
 485                 if (*file != '"')
 486                     continue;   /* Not a valid #line directive, may be a comment */
 487
 488                 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
 489
 490                 if ((token = strchr(new_file_name, '"')))
 491                     *token = '\0';
 492
 493                 SetConfigFilename(new_file_name, false);
 494             }
 495
 496             config_lineno = new_lineno;
 497         }
 498
 499         if (config_input_line[0] == '#')
 500             continue;
 501
 502         if (config_input_line[0] == '\0')
 503             continue;
 504
 505         const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
 506
 507         size_t append_len = strlen(append);
 508
 509         tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
 510
 511         strcpy(tmp_line + tmp_line_len, append);
 512
 513         tmp_line_len += append_len;
 514
 515         if (tmp_line[tmp_line_len-1] == '\\') {
 516             debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
 517             tmp_line[--tmp_line_len] = '\0';
 518             continue;
 519         }
 520
 521         trim_trailing_ws(tmp_line);
 522         ProcessMacros(tmp_line, tmp_line_len);
 523         debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
 524
 525         if (const char* expr = FindStatement(tmp_line, "if")) {
 526             if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
 527         } else if (FindStatement(tmp_line, "endif")) {
 528             if (!if_states.empty())
 529                 if_states.pop_back(); // remove last if-statement meaning
 530             else
 531                 fatalf("'endif' without 'if'\n");
 532         } else if (FindStatement(tmp_line, "else")) {
 533             if (!if_states.empty())
 534                 if_states.back() = !if_states.back();
 535             else
 536                 fatalf("'else' without 'if'\n");
 537         } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
 538             /* Handle includes here */
 539             if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
 540                 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
 541             } else if (!parse_line(tmp_line)) {
 542                 debugs(3, DBG_CRITICAL, HERE << cfg_filename << ":" << config_lineno << " unrecognized: '" << tmp_line << "'");
 543                 ++err_count;
 544             }
 545         }
 546
 547         safe_free(tmp_line);
 548         tmp_line_len = 0;
 549
 550     }
 551     if (!if_states.empty())
 552         fatalf("if-statement without 'endif'\n");
 553
 554     if (is_pipe) {
 555         int ret = pclose(fp);
 556
 557         if (ret != 0)
 558             fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
 559     } else {
 560         fclose(fp);
 561     }
 562
 563     SetConfigFilename(orig_cfg_filename, false);
 564     config_lineno = orig_config_lineno;
 565
 566     xfree(tmp_line);
 567     return err_count;
 568 }
 569
 570 int
 571 parseConfigFile(const char *file_name)
 572 {
 573     int err_count = 0;
 574
 575     debugs(5, 4, HERE);
 576
 577     configFreeMemory();
 578
 579     ACLMethodData::ThePurgeCount = 0;
 580     default_all();
 581
 582     err_count = parseOneConfigFile(file_name, 0);
 583
 584     defaults_if_none();
 585
 586     defaults_postscriptum();
 587
 588     /*
 589      * We must call configDoConfigure() before leave_suid() because
 590      * configDoConfigure() is where we turn username strings into
 591      * uid values.
 592      */
 593     configDoConfigure();
 594
 595     if (!Config.chroot_dir) {
 596         leave_suid();
 597         setUmask(Config.umask);
 598         _db_init(Debug::cache_log, Debug::debugOptions);
 599         enter_suid();
 600     }
 601
 602     if (opt_send_signal == -1) {
 603         Mgr::RegisterAction("config",
 604                             "Current Squid Configuration",
 605                             dump_config,
 606                             1, 1);
 607     }
 608
 609     return err_count;
 610 }
 611
 612 static void
 613 configDoConfigure(void)
 614 {
 615     Config2.clear();
 616     /* init memory as early as possible */
 617     memConfigure();
 618     /* Sanity checks */
 619
 620     Config.cacheSwap.n_strands = 0; // no diskers by default
 621     if (Config.cacheSwap.swapDirs == NULL) {
 622         /* Memory-only cache probably in effect. */
 623         /* turn off the cache rebuild delays... */
 624         StoreController::store_dirs_rebuilding = 0;
 625     } else if (InDaemonMode()) { // no diskers in non-daemon mode
 626         for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
 627             const RefCount<SwapDir> sd = Config.cacheSwap.swapDirs[i];
 628             if (sd->needsDiskStrand())
 629                 sd->disker = Config.workers + (++Config.cacheSwap.n_strands);
 630         }
 631     }
 632
 633     if (Debug::rotateNumber < 0) {
 634         Debug::rotateNumber = Config.Log.rotateNumber;
 635     }
 636
 637 #if SIZEOF_OFF_T <= 4
 638     if (Config.Store.maxObjectSize > 0x7FFF0000) {
 639         debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
 640         Config.Store.maxObjectSize = 0x7FFF0000;
 641     }
 642 #endif
 643
 644     if (Config.Announce.period > 0) {
 645         Config.onoff.announce = 1;
 646     } else {
 647         Config.Announce.period = 86400 * 365;   /* one year */
 648         Config.onoff.announce = 0;
 649     }
 650
 651     if (Config.onoff.httpd_suppress_version_string)
 652         visible_appname_string = (char *)appname_string;
 653     else
 654         visible_appname_string = (char const *)APP_FULLNAME;
 655
 656     if (Config.Program.redirect) {
 657         if (Config.redirectChildren.n_max < 1) {
 658             Config.redirectChildren.n_max = 0;
 659             wordlistDestroy(&Config.Program.redirect);
 660         }
 661     }
 662
 663     if (Config.Program.store_id) {
 664         if (Config.storeIdChildren.n_max < 1) {
 665             Config.storeIdChildren.n_max = 0;
 666             wordlistDestroy(&Config.Program.store_id);
 667         }
 668     }
 669
 670     if (Config.appendDomain)
 671         if (*Config.appendDomain != '.')
 672             fatal("append_domain must begin with a '.'");
 673
 674     if (Config.errHtmlText == NULL)
 675         Config.errHtmlText = xstrdup(null_string);
 676
 677 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
 678     if (Config.max_filedescriptors > 0) {
 679         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
 680     }
 681 #elif USE_SELECT || USE_SELECT_WIN32
 682     if (Config.max_filedescriptors > FD_SETSIZE) {
 683         debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
 684     }
 685 #endif
 686
 687     storeConfigure();
 688
 689     snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
 690              uniqueHostname(),
 691              visible_appname_string);
 692
 693     /*
 694      * the extra space is for loop detection in client_side.c -- we search
 695      * for substrings in the Via header.
 696      */
 697     snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
 698              uniqueHostname(),
 699              visible_appname_string);
 700
 701     /* Use visible_hostname as default surrogate_id */
 702     if (!Config.Accel.surrogate_id) {
 703         const char *t = getMyHostname();
 704         Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
 705     }
 706
 707     if (!Config.udpMaxHitObjsz || Config.udpMaxHitObjsz > SQUID_UDP_SO_SNDBUF)
 708         Config.udpMaxHitObjsz = SQUID_UDP_SO_SNDBUF;
 709
 710     if (Config.appendDomain)
 711         Config.appendDomainLen = strlen(Config.appendDomain);
 712     else
 713         Config.appendDomainLen = 0;
 714
 715     if (Config.connect_retries > 10) {
 716         debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
 717         Config.connect_retries = 10;
 718     }
 719
 720     requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
 721 #if USE_UNLINKD
 722
 723     requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
 724 #endif
 725     requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
 726     if (Config.Program.redirect)
 727         requirePathnameExists("redirect_program", Config.Program.redirect->key);
 728
 729     if (Config.Program.store_id)
 730         requirePathnameExists("store_id_program", Config.Program.store_id->key);
 731
 732     requirePathnameExists("Icon Directory", Config.icons.directory);
 733
 734     if (Config.errorDirectory)
 735         requirePathnameExists("Error Directory", Config.errorDirectory);
 736
 737 #if USE_HTTP_VIOLATIONS
 738
 739     {
 740         const RefreshPattern *R;
 741
 742         for (R = Config.Refresh; R; R = R->next) {
 743             if (!R->flags.override_expire)
 744                 continue;
 745
 746             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
 747
 748             break;
 749         }
 750
 751         for (R = Config.Refresh; R; R = R->next) {
 752             if (!R->flags.override_lastmod)
 753                 continue;
 754
 755             debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
 756
 757             break;
 758         }
 759
 760         for (R = Config.Refresh; R; R = R->next) {
 761             if (!R->flags.reload_into_ims)
 762                 continue;
 763
 764             debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
 765
 766             break;
 767         }
 768
 769         for (R = Config.Refresh; R; R = R->next) {
 770             if (!R->flags.ignore_reload)
 771                 continue;
 772
 773             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
 774
 775             break;
 776         }
 777
 778         for (R = Config.Refresh; R; R = R->next) {
 779             if (!R->flags.ignore_no_store)
 780                 continue;
 781
 782             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
 783
 784             break;
 785         }
 786
 787         for (R = Config.Refresh; R; R = R->next) {
 788             if (!R->flags.ignore_private)
 789                 continue;
 790
 791             debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
 792
 793             break;
 794         }
 795     }
 796 #endif
 797 #if !USE_HTTP_VIOLATIONS
 798     Config.onoff.via = 1;
 799 #else
 800
 801     if (!Config.onoff.via)
 802         debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
 803
 804 #endif
 805
 806     // we enable runtime PURGE checks if there is at least one PURGE method ACL
 807     // TODO: replace with a dedicated "purge" ACL option?
 808     Config2.onoff.enable_purge = (ACLMethodData::ThePurgeCount > 0);
 809
 810     if (geteuid() == 0) {
 811         if (NULL != Config.effectiveUser) {
 812
 813             struct passwd *pwd = getpwnam(Config.effectiveUser);
 814
 815             if (NULL == pwd) {
 816                 /*
 817                  * Andres Kroonmaa <andre@online.ee>:
 818                  * Some getpwnam() implementations (Solaris?) require
 819                  * an available FD < 256 for opening a FILE* to the
 820                  * passwd file.
 821                  * DW:
 822                  * This should be safe at startup, but might still fail
 823                  * during reconfigure.
 824                  */
 825                 fatalf("getpwnam failed to find userid for effective user '%s'",
 826                        Config.effectiveUser);
 827                 return;
 828             }
 829
 830             Config2.effectiveUserID = pwd->pw_uid;
 831
 832             Config2.effectiveGroupID = pwd->pw_gid;
 833
 834 #if HAVE_PUTENV
 835             if (pwd->pw_dir && *pwd->pw_dir) {
 836                 // putenv() leaks by design; avoid leaks when nothing changes
 837                 static SBuf lastDir;
 838                 if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
 839                     lastDir = pwd->pw_dir;
 840                     int len = strlen(pwd->pw_dir) + 6;
 841                     char *env_str = (char *)xcalloc(len, 1);
 842                     snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
 843                     putenv(env_str);
 844                 }
 845             }
 846 #endif
 847         }
 848     } else {
 849         Config2.effectiveUserID = geteuid();
 850         Config2.effectiveGroupID = getegid();
 851     }
 852
 853     if (NULL != Config.effectiveGroup) {
 854
 855         struct group *grp = getgrnam(Config.effectiveGroup);
 856
 857         if (NULL == grp) {
 858             fatalf("getgrnam failed to find groupid for effective group '%s'",
 859                    Config.effectiveGroup);
 860             return;
 861         }
 862
 863         Config2.effectiveGroupID = grp->gr_gid;
 864     }
 865
 866 #if USE_OPENSSL
 867     if (Config.ssl_client.foreignIntermediateCertsPath)
 868         Ssl::loadSquidUntrusted(Config.ssl_client.foreignIntermediateCertsPath);
 869 #endif
 870
 871     if (Security::ProxyOutgoingConfig.encryptTransport) {
 872         debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
 873         Config.ssl_client.sslContext = Security::ProxyOutgoingConfig.createClientContext(false);
 874         if (!Config.ssl_client.sslContext) {
 875 #if USE_OPENSSL
 876             fatal("ERROR: Could not initialize https:// proxy context");
 877 #else
 878             debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
 879 #endif
 880         }
 881 #if USE_OPENSSL
 882         Ssl::useSquidUntrusted(Config.ssl_client.sslContext.get());
 883 #endif
 884     }
 885
 886     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
 887
 888         // default value for ssldomain= is the peer host/IP
 889         if (p->secure.sslDomain.isEmpty())
 890             p->secure.sslDomain = p->host;
 891
 892         if (p->secure.encryptTransport) {
 893             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
 894             p->sslContext = p->secure.createClientContext(true);
 895             if (!p->sslContext) {
 896                 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
 897                 self_destruct();
 898                 return;
 899             }
 900         }
 901     }
 902
 903 #if USE_OPENSSL
 904     for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
 905         if (!s->secure.encryptTransport)
 906             continue;
 907         debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS context");
 908         s->configureSslServerContext();
 909     }
 910 #endif
 911
 912     // prevent infinite fetch loops in the request parser
 913     // due to buffer full but not enough data recived to finish parse
 914     if (Config.maxRequestBufferSize <= Config.maxRequestHeaderSize) {
 915         fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
 916                " Change client_request_buffer_max or request_header_max_size limits.",
 917                (uint32_t)Config.maxRequestBufferSize, (uint32_t)Config.maxRequestHeaderSize);
 918     }
 919
 920     /*
 921      * Disable client side request pipelining if client_persistent_connections OFF.
 922      * Waste of resources queueing any pipelined requests when the first will close the connection.
 923      */
 924     if (Config.pipeline_max_prefetch > 0 && !Config.onoff.client_pconns) {
 925         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
 926                " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
 927         Config.pipeline_max_prefetch = 0;
 928     }
 929
 930 #if USE_AUTH
 931     /*
 932      * disable client side request pipelining. There is a race with
 933      * Negotiate and NTLM when the client sends a second request on an
 934      * connection before the authenticate challenge is sent. With
 935      * pipelining OFF, the client may fail to authenticate, but squid's
 936      * state will be preserved.
 937      */
 938     if (Config.pipeline_max_prefetch > 0) {
 939         Auth::Config *nego = Auth::Config::Find("Negotiate");
 940         Auth::Config *ntlm = Auth::Config::Find("NTLM");
 941         if ((nego && nego->active()) || (ntlm && ntlm->active())) {
 942             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
 943             Config.pipeline_max_prefetch = 0;
 944         }
 945     }
 946 #endif
 947 }
 948
 949 /** Parse a line containing an obsolete directive.
 950  * To upgrade it where possible instead of just "Bungled config" for
 951  * directives which cannot be marked as simply aliases of the some name.
 952  * For example if the parameter order and content has changed.
 953  * Or if the directive has been completely removed.
 954  */
 955 void
 956 parse_obsolete(const char *name)
 957 {
 958     // Directives which have been radically changed rather than removed
 959     if (!strcmp(name, "url_rewrite_concurrency")) {
 960         int cval;
 961         parse_int(&cval);
 962         debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
 963         Config.redirectChildren.concurrency = cval;
 964     }
 965
 966     if (!strcmp(name, "log_access")) {
 967         self_destruct();
 968         return;
 969     }
 970
 971     if (!strcmp(name, "log_icap")) {
 972         self_destruct();
 973         return;
 974     }
 975
 976     if (!strcmp(name, "ignore_ims_on_miss")) {
 977         // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
 978         // than the 2.7 directive. We need to parse and invert the configured value.
 979         int temp = 0;
 980         parse_onoff(&temp);
 981         Config.onoff.cache_miss_revalidate = !temp;
 982     }
 983
 984     if (!strncmp(name, "sslproxy_", 9)) {
 985         // the replacement directive tls_outgoing_options uses options instead of whole-line input
 986         SBuf tmp;
 987         if (!strcmp(name, "sslproxy_cafile"))
 988             tmp.append("cafile=");
 989         else if (!strcmp(name, "sslproxy_capath"))
 990             tmp.append("capath=");
 991         else if (!strcmp(name, "sslproxy_cipher"))
 992             tmp.append("cipher=");
 993         else if (!strcmp(name, "sslproxy_client_certificate"))
 994             tmp.append("cert=");
 995         else if (!strcmp(name, "sslproxy_client_key"))
 996             tmp.append("key=");
 997         else if (!strcmp(name, "sslproxy_flags"))
 998             tmp.append("flags=");
 999         else if (!strcmp(name, "sslproxy_options"))
1000             tmp.append("options=");
1001         else if (!strcmp(name, "sslproxy_version"))
1002             tmp.append("version=");
1003         else {
1004             debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1005             self_destruct();
1006             return;
1007         }
1008
1009         // add the value as unquoted-string because the old values did not support whitespace
1010         const char *token = ConfigParser::NextQuotedOrToEol();
1011         tmp.append(token, strlen(token));
1012         Security::ProxyOutgoingConfig.parse(tmp.c_str());
1013     }
1014 }
1015
1016 /* Parse a time specification from the config file.  Store the
1017  * result in 'tptr', after converting it to 'units' */
1018 static void
1019 parseTimeLine(time_msec_t * tptr, const char *units,  bool allowMsec,  bool expectMoreArguments = false)
1020 {
1021     time_msec_t u = parseTimeUnits(units, allowMsec);
1022     if (u == 0) {
1023         self_destruct();
1024         return;
1025     }
1026
1027     char *token = ConfigParser::NextToken();;
1028     if (!token) {
1029         self_destruct();
1030         return;
1031     }
1032
1033     double d = xatof(token);
1034
1035     time_msec_t m = u; /* default to 'units' if none specified */
1036
1037     if (d) {
1038         if ((token = ConfigParser::PeekAtToken()) && (m = parseTimeUnits(token, allowMsec))) {
1039             (void)ConfigParser::NextToken();
1040
1041         } else if (!expectMoreArguments) {
1042             self_destruct();
1043             return;
1044
1045         } else {
1046             token = NULL; // show default units if dying below
1047             debugs(3, DBG_CRITICAL, "WARNING: No units on '" << config_input_line << "', assuming " << d << " " << units);
1048         }
1049     } else
1050         token = NULL; // show default units if dying below.
1051
1052     *tptr = static_cast<time_msec_t>(m * d);
1053
1054     if (static_cast<double>(*tptr) * 2 != m * d * 2) {
1055         debugs(3, DBG_CRITICAL, "FATAL: Invalid value '" <<
1056                d << " " << (token ? token : units) << ": integer overflow (time_msec_t).");
1057         self_destruct();
1058     }
1059 }
1060
1061 static uint64_t
1062 parseTimeUnits(const char *unit, bool allowMsec)
1063 {
1064     if (allowMsec && !strncasecmp(unit, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1065         return 1;
1066
1067     if (!strncasecmp(unit, T_SECOND_STR, strlen(T_SECOND_STR)))
1068         return 1000;
1069
1070     if (!strncasecmp(unit, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1071         return 60 * 1000;
1072
1073     if (!strncasecmp(unit, T_HOUR_STR, strlen(T_HOUR_STR)))
1074         return 3600 * 1000;
1075
1076     if (!strncasecmp(unit, T_DAY_STR, strlen(T_DAY_STR)))
1077         return 86400 * 1000;
1078
1079     if (!strncasecmp(unit, T_WEEK_STR, strlen(T_WEEK_STR)))
1080         return 86400 * 7 * 1000;
1081
1082     if (!strncasecmp(unit, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1083         return 86400 * 14 * 1000;
1084
1085     if (!strncasecmp(unit, T_MONTH_STR, strlen(T_MONTH_STR)))
1086         return static_cast<uint64_t>(86400) * 30 * 1000;
1087
1088     if (!strncasecmp(unit, T_YEAR_STR, strlen(T_YEAR_STR)))
1089         return static_cast<uint64_t>(86400 * 1000 * 365.2522);
1090
1091     if (!strncasecmp(unit, T_DECADE_STR, strlen(T_DECADE_STR)))
1092         return static_cast<uint64_t>(86400 * 1000 * 365.2522 * 10);
1093
1094     debugs(3, DBG_IMPORTANT, "parseTimeUnits: unknown time unit '" << unit << "'");
1095
1096     return 0;
1097 }
1098
1099 static void
1100 parseBytesLine64(int64_t * bptr, const char *units)
1101 {
1102     char *token;
1103     double d;
1104     int64_t m;
1105     int64_t u;
1106
1107     if ((u = parseBytesUnits(units)) == 0) {
1108         self_destruct();
1109         return;
1110     }
1111
1112     if ((token = ConfigParser::NextToken()) == NULL) {
1113         self_destruct();
1114         return;
1115     }
1116
1117     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1118         *bptr = -1;
1119         return;
1120     }
1121
1122     d = xatof(token);
1123
1124     m = u;          /* default to 'units' if none specified */
1125
1126     if (0.0 == d)
1127         (void) 0;
1128     else if ((token = ConfigParser::NextToken()) == NULL)
1129         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1130                config_input_line << "', assuming " <<
1131                d << " " <<  units  );
1132     else if ((m = parseBytesUnits(token)) == 0) {
1133         self_destruct();
1134         return;
1135     }
1136
1137     *bptr = static_cast<int64_t>(m * d / u);
1138
1139     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1140         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1141                d << " " << token << ": integer overflow (int64_t).");
1142         self_destruct();
1143     }
1144 }
1145
1146 static void
1147 parseBytesLine(size_t * bptr, const char *units)
1148 {
1149     char *token;
1150     double d;
1151     int m;
1152     int u;
1153
1154     if ((u = parseBytesUnits(units)) == 0) {
1155         self_destruct();
1156         return;
1157     }
1158
1159     if ((token = ConfigParser::NextToken()) == NULL) {
1160         self_destruct();
1161         return;
1162     }
1163
1164     if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1165         *bptr = static_cast<size_t>(-1);
1166         return;
1167     }
1168
1169     d = xatof(token);
1170
1171     m = u;          /* default to 'units' if none specified */
1172
1173     if (0.0 == d)
1174         (void) 0;
1175     else if ((token = ConfigParser::NextToken()) == NULL)
1176         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1177                config_input_line << "', assuming " <<
1178                d << " " <<  units  );
1179     else if ((m = parseBytesUnits(token)) == 0) {
1180         self_destruct();
1181         return;
1182     }
1183
1184     *bptr = static_cast<size_t>(m * d / u);
1185
1186     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1187         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1188                d << " " << token << ": integer overflow (size_t).");
1189         self_destruct();
1190     }
1191 }
1192
1193 static void
1194 parseBytesLineSigned(ssize_t * bptr, const char *units)
1195 {
1196     char *token;
1197     double d;
1198     int m;
1199     int u;
1200
1201     if ((u = parseBytesUnits(units)) == 0) {
1202         self_destruct();
1203         return;
1204     }
1205
1206     if ((token = ConfigParser::NextToken()) == NULL) {
1207         self_destruct();
1208         return;
1209     }
1210
1211     if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1212         *bptr = -1;
1213         return;
1214     }
1215
1216     d = xatof(token);
1217
1218     m = u;          /* default to 'units' if none specified */
1219
1220     if (0.0 == d)
1221         (void) 0;
1222     else if ((token = ConfigParser::NextToken()) == NULL)
1223         debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1224                config_input_line << "', assuming " <<
1225                d << " " <<  units  );
1226     else if ((m = parseBytesUnits(token)) == 0) {
1227         self_destruct();
1228         return;
1229     }
1230
1231     *bptr = static_cast<ssize_t>(m * d / u);
1232
1233     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1234         debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1235                d << " " << token << ": integer overflow (ssize_t).");
1236         self_destruct();
1237     }
1238 }
1239
1240 /**
1241  * Parse bytes from a string.
1242  * Similar to the parseBytesLine function but parses the string value instead of
1243  * the current token value.
1244  */
1245 static void parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1246 {
1247     int u;
1248     if ((u = parseBytesUnits(units)) == 0) {
1249         self_destruct();
1250         return;
1251     }
1252
1253     // Find number from string beginning.
1254     char const * number_begin = value;
1255     char const * number_end = value;
1256
1257     while ((*number_end >= '0' && *number_end <= '9')) {
1258         ++number_end;
1259     }
1260
1261     String number;
1262     number.limitInit(number_begin, number_end - number_begin);
1263
1264     int d = xatoi(number.termedBuf());
1265     int m;
1266     if ((m = parseBytesUnits(number_end)) == 0) {
1267         self_destruct();
1268         return;
1269     }
1270
1271     *bptr = static_cast<size_t>(m * d / u);
1272     if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1273         self_destruct();
1274 }
1275
1276 static size_t
1277 parseBytesUnits(const char *unit)
1278 {
1279     if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1280         return 1;
1281
1282     if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1283         return 1 << 10;
1284
1285     if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1286         return 1 << 20;
1287
1288     if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1289         return 1 << 30;
1290
1291     debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1292
1293     return 0;
1294 }
1295
1296 static void
1297 dump_SBufList(StoreEntry * entry, const SBufList &words)
1298 {
1299     for (SBufList::const_iterator i = words.begin(); i != words.end(); ++i) {
1300         entry->append(i->rawContent(), i->length());
1301         entry->append(" ",1);
1302     }
1303     entry->append("\n",1);
1304 }
1305
1306 static void
1307 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1308 {
1309     while (ae != NULL) {
1310         debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1311         storeAppendPrintf(entry, "%s %s %s %s ",
1312                           name,
1313                           ae->name,
1314                           ae->typeString(),
1315                           ae->flags.flagsStr());
1316         dump_SBufList(entry, ae->dump());
1317         ae = ae->next;
1318     }
1319 }
1320
1321 static void
1322 parse_acl(ACL ** ae)
1323 {
1324     ACL::ParseAclLine(LegacyParser, ae);
1325 }
1326
1327 static void
1328 free_acl(ACL ** ae)
1329 {
1330     aclDestroyAcls(ae);
1331 }
1332
1333 void
1334 dump_acl_list(StoreEntry * entry, ACLList * head)
1335 {
1336     dump_SBufList(entry, head->dump());
1337 }
1338
1339 void
1340 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1341 {
1342     if (head)
1343         dump_SBufList(entry, head->treeDump(name, &Acl::AllowOrDeny));
1344 }
1345
1346 static void
1347 parse_acl_access(acl_access ** head)
1348 {
1349     aclParseAccessLine(cfg_directive, LegacyParser, head);
1350 }
1351
1352 static void
1353 free_acl_access(acl_access ** head)
1354 {
1355     aclDestroyAccessList(head);
1356 }
1357
1358 static void
1359 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1360 {
1361     char buf[MAX_IPSTRLEN];
1362     storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1363 }
1364
1365 static void
1366 parse_address(Ip::Address *addr)
1367 {
1368     char *token = ConfigParser::NextToken();
1369
1370     if (!token) {
1371         self_destruct();
1372         return;
1373     }
1374
1375     if (!strcmp(token,"any_addr"))
1376         addr->setAnyAddr();
1377     else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1378         addr->setNoAddr();
1379     else if ( (*addr = token) ) // try parse numeric/IPA
1380         (void) 0;
1381     else if (addr->GetHostByName(token)) // dont use ipcache
1382         (void) 0;
1383     else { // not an IP and not a hostname
1384         debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1385         self_destruct();
1386     }
1387 }
1388
1389 static void
1390 free_address(Ip::Address *addr)
1391 {
1392     addr->setEmpty();
1393 }
1394
1395 static void
1396 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1397 {
1398     char buf[MAX_IPSTRLEN];
1399
1400     for (Acl::Address *l = head; l; l = l->next) {
1401         if (!l->addr.isAnyAddr())
1402             storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1403         else
1404             storeAppendPrintf(entry, "%s autoselect", name);
1405
1406         dump_acl_list(entry, l->aclList);
1407
1408         storeAppendPrintf(entry, "\n");
1409     }
1410 }
1411
1412 static void
1413 parse_acl_address(Acl::Address ** head)
1414 {
1415     Acl::Address *l = new Acl::Address;
1416     parse_address(&l->addr);
1417     aclParseAclList(LegacyParser, &l->aclList, l->addr);
1418
1419     Acl::Address **tail = head;
1420     while (*tail)
1421         tail = &(*tail)->next;
1422
1423     *tail = l;
1424 }
1425
1426 static void
1427 free_acl_address(Acl::Address ** head)
1428 {
1429     delete *head;
1430     *head = NULL;
1431 }
1432
1433 static void
1434 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1435 {
1436     acl_tos *l;
1437
1438     for (l = head; l; l = l->next) {
1439         if (l->tos > 0)
1440             storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1441         else
1442             storeAppendPrintf(entry, "%s none", name);
1443
1444         dump_acl_list(entry, l->aclList);
1445
1446         storeAppendPrintf(entry, "\n");
1447     }
1448 }
1449
1450 static void
1451 parse_acl_tos(acl_tos ** head)
1452 {
1453     unsigned int tos;           /* Initially uint for strtoui. Casted to tos_t before return */
1454     char *token = ConfigParser::NextToken();
1455
1456     if (!token) {
1457         self_destruct();
1458         return;
1459     }
1460
1461     if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1462         self_destruct();
1463         return;
1464     }
1465
1466     const unsigned int chTos = tos & 0xFC;
1467     if (chTos != tos) {
1468         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1469         tos = chTos;
1470     }
1471
1472     acl_tos *l = new acl_tos;
1473
1474     l->tos = (tos_t)tos;
1475
1476     aclParseAclList(LegacyParser, &l->aclList, token);
1477
1478     acl_tos **tail = head;  /* sane name below */
1479     while (*tail)
1480         tail = &(*tail)->next;
1481
1482     *tail = l;
1483 }
1484
1485 static void
1486 free_acl_tos(acl_tos ** head)
1487 {
1488     delete *head;
1489     *head = NULL;
1490 }
1491
1492 #if SO_MARK && USE_LIBCAP
1493
1494 static void
1495 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1496 {
1497     for (acl_nfmark *l = head; l; l = l->next) {
1498         if (l->nfmark > 0)
1499             storeAppendPrintf(entry, "%s 0x%02X", name, l->nfmark);
1500         else
1501             storeAppendPrintf(entry, "%s none", name);
1502
1503         dump_acl_list(entry, l->aclList);
1504
1505         storeAppendPrintf(entry, "\n");
1506     }
1507 }
1508
1509 static void
1510 parse_acl_nfmark(acl_nfmark ** head)
1511 {
1512     nfmark_t mark;
1513     char *token = ConfigParser::NextToken();
1514
1515     if (!token) {
1516         self_destruct();
1517         return;
1518     }
1519
1520     if (!xstrtoui(token, NULL, &mark, 0, std::numeric_limits<nfmark_t>::max())) {
1521         self_destruct();
1522         return;
1523     }
1524
1525     acl_nfmark *l = new acl_nfmark;
1526
1527     l->nfmark = mark;
1528
1529     aclParseAclList(LegacyParser, &l->aclList, token);
1530
1531     acl_nfmark **tail = head;   /* sane name below */
1532     while (*tail)
1533         tail = &(*tail)->next;
1534
1535     *tail = l;
1536 }
1537
1538 static void
1539 free_acl_nfmark(acl_nfmark ** head)
1540 {
1541     delete *head;
1542     *head = NULL;
1543 }
1544 #endif /* SO_MARK */
1545
1546 static void
1547 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1548 {
1549     for (AclSizeLimit *l = head; l; l = l->next) {
1550         if (l->size != -1)
1551             storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1552         else
1553             storeAppendPrintf(entry, "%s none", name);
1554
1555         dump_acl_list(entry, l->aclList);
1556
1557         storeAppendPrintf(entry, "\n");
1558     }
1559 }
1560
1561 static void
1562 parse_acl_b_size_t(AclSizeLimit ** head)
1563 {
1564     AclSizeLimit *l = new AclSizeLimit;
1565
1566     parse_b_int64_t(&l->size);
1567
1568     aclParseAclList(LegacyParser, &l->aclList, l->size);
1569
1570     AclSizeLimit **tail = head; /* sane name below */
1571     while (*tail)
1572         tail = &(*tail)->next;
1573
1574     *tail = l;
1575 }
1576
1577 static void
1578 free_acl_b_size_t(AclSizeLimit ** head)
1579 {
1580     delete *head;
1581     *head = NULL;
1582 }
1583
1584 #if USE_DELAY_POOLS
1585
1586 #include "DelayConfig.h"
1587 #include "DelayPools.h"
1588 /* do nothing - free_delay_pool_count is the magic free function.
1589  * this is why delay_pool_count isn't just marked TYPE: u_short
1590  */
1591 #define free_delay_pool_class(X)
1592 #define free_delay_pool_access(X)
1593 #define free_delay_pool_rates(X)
1594 #define dump_delay_pool_class(X, Y, Z)
1595 #define dump_delay_pool_access(X, Y, Z)
1596 #define dump_delay_pool_rates(X, Y, Z)
1597
1598 static void
1599 free_delay_pool_count(DelayConfig * cfg)
1600 {
1601     cfg->freePoolCount();
1602 }
1603
1604 static void
1605 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1606 {
1607     cfg.dumpPoolCount (entry, name);
1608 }
1609
1610 static void
1611 parse_delay_pool_count(DelayConfig * cfg)
1612 {
1613     cfg->parsePoolCount();
1614 }
1615
1616 static void
1617 parse_delay_pool_class(DelayConfig * cfg)
1618 {
1619     cfg->parsePoolClass();
1620 }
1621
1622 static void
1623 parse_delay_pool_rates(DelayConfig * cfg)
1624 {
1625     cfg->parsePoolRates();
1626 }
1627
1628 static void
1629 parse_delay_pool_access(DelayConfig * cfg)
1630 {
1631     cfg->parsePoolAccess(LegacyParser);
1632 }
1633
1634 #endif
1635
1636 #if USE_DELAY_POOLS
1637 #include "ClientDelayConfig.h"
1638 /* do nothing - free_client_delay_pool_count is the magic free function.
1639  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1640  */
1641
1642 #define free_client_delay_pool_access(X)
1643 #define free_client_delay_pool_rates(X)
1644 #define dump_client_delay_pool_access(X, Y, Z)
1645 #define dump_client_delay_pool_rates(X, Y, Z)
1646
1647 static void
1648 free_client_delay_pool_count(ClientDelayConfig * cfg)
1649 {
1650     cfg->freePoolCount();
1651 }
1652
1653 static void
1654 dump_client_delay_pool_count(StoreEntry * entry, const char *name, ClientDelayConfig &cfg)
1655 {
1656     cfg.dumpPoolCount (entry, name);
1657 }
1658
1659 static void
1660 parse_client_delay_pool_count(ClientDelayConfig * cfg)
1661 {
1662     cfg->parsePoolCount();
1663 }
1664
1665 static void
1666 parse_client_delay_pool_rates(ClientDelayConfig * cfg)
1667 {
1668     cfg->parsePoolRates();
1669 }
1670
1671 static void
1672 parse_client_delay_pool_access(ClientDelayConfig * cfg)
1673 {
1674     cfg->parsePoolAccess(LegacyParser);
1675 }
1676 #endif
1677
1678 #if USE_HTTP_VIOLATIONS
1679 static void
1680 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1681 {
1682     if (manglers)
1683         manglers->dumpAccess(entry, name);
1684 }
1685
1686 static void
1687 parse_http_header_access(HeaderManglers **pm)
1688 {
1689     char *t = NULL;
1690
1691     if ((t = ConfigParser::NextToken()) == NULL) {
1692         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1693         debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1694         return;
1695     }
1696
1697     if (!*pm)
1698         *pm = new HeaderManglers;
1699     HeaderManglers *manglers = *pm;
1700     headerMangler *mangler = manglers->track(t);
1701     assert(mangler);
1702
1703     std::string directive = "http_header_access ";
1704     directive += t;
1705     aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1706 }
1707
1708 static void
1709 free_HeaderManglers(HeaderManglers **pm)
1710 {
1711     // we delete the entire http_header_* mangler configuration at once
1712     if (const HeaderManglers *manglers = *pm) {
1713         delete manglers;
1714         *pm = NULL;
1715     }
1716 }
1717
1718 static void
1719 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1720 {
1721     if (manglers)
1722         manglers->dumpReplacement(entry, name);
1723 }
1724
1725 static void
1726 parse_http_header_replace(HeaderManglers **pm)
1727 {
1728     char *t = NULL;
1729
1730     if ((t = ConfigParser::NextToken()) == NULL) {
1731         debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1732         debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1733         return;
1734     }
1735
1736     const char *value = ConfigParser::NextQuotedOrToEol();
1737
1738     if (!*pm)
1739         *pm = new HeaderManglers;
1740     HeaderManglers *manglers = *pm;
1741     manglers->setReplacement(t, value);
1742 }
1743
1744 #endif
1745
1746 static void
1747 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1748 {
1749     SwapDir *s;
1750     int i;
1751     assert (entry);
1752
1753     for (i = 0; i < swap.n_configured; ++i) {
1754         s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1755         if (!s) continue;
1756         storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1757         s->dump(*entry);
1758         storeAppendPrintf(entry, "\n");
1759     }
1760 }
1761
1762 static int
1763 check_null_string(char *s)
1764 {
1765     return s == NULL;
1766 }
1767
1768 #if USE_AUTH
1769 static void
1770 parse_authparam(Auth::ConfigVector * config)
1771 {
1772     char *type_str = ConfigParser::NextToken();
1773     if (!type_str) {
1774         self_destruct();
1775         return;
1776     }
1777
1778     char *param_str = ConfigParser::NextToken();
1779     if (!param_str) {
1780         self_destruct();
1781         return;
1782     }
1783
1784     /* find a configuration for the scheme in the currently parsed configs... */
1785     Auth::Config *schemeCfg = Auth::Config::Find(type_str);
1786
1787     if (schemeCfg == NULL) {
1788         /* Create a configuration based on the scheme info */
1789         Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1790
1791         if (theScheme == NULL) {
1792             debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1793             self_destruct();
1794             return;
1795         }
1796
1797         config->push_back(theScheme->createConfig());
1798         schemeCfg = Auth::Config::Find(type_str);
1799         if (schemeCfg == NULL) {
1800             debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1801             self_destruct();
1802             return;
1803         }
1804     }
1805
1806     schemeCfg->parse(schemeCfg, config->size(), param_str);
1807 }
1808
1809 static void
1810 free_authparam(Auth::ConfigVector * cfg)
1811 {
1812     /* Wipe the Auth globals and Detach/Destruct component config + state. */
1813     cfg->clear();
1814
1815     /* on reconfigure initialize new auth schemes for the new config. */
1816     if (reconfiguring) {
1817         Auth::Init();
1818     }
1819 }
1820
1821 static void
1822 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1823 {
1824     for (Auth::ConfigVector::iterator  i = cfg.begin(); i != cfg.end(); ++i)
1825         (*i)->dump(entry, name, (*i));
1826 }
1827 #endif /* USE_AUTH */
1828
1829 static void
1830 ParseAclWithAction(acl_access **access, const allow_t &action, const char *desc, ACL *acl = nullptr)
1831 {
1832     assert(access);
1833     SBuf name;
1834     if (!*access) {
1835         *access = new Acl::Tree;
1836         name.Printf("(%s rules)", desc);
1837         (*access)->context(name.c_str(), config_input_line);
1838     }
1839     Acl::AndNode *rule = new Acl::AndNode;
1840     name.Printf("(%s rule)", desc);
1841     rule->context(name.c_str(), config_input_line);
1842     acl ? rule->add(acl) : rule->lineParse();
1843     (*access)->add(rule, action);
1844 }
1845
1846 /* TODO: just return the object, the # is irrelevant */
1847 static int
1848 find_fstype(char *type)
1849 {
1850     for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1851         if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1852             return (int)i;
1853
1854     return (-1);
1855 }
1856
1857 static void
1858 parse_cachedir(Store::DiskConfig *swap)
1859 {
1860     char *type_str = ConfigParser::NextToken();
1861     if (!type_str) {
1862         self_destruct();
1863         return;
1864     }
1865
1866     char *path_str = ConfigParser::NextToken();
1867     if (!path_str) {
1868         self_destruct();
1869         return;
1870     }
1871
1872     int fs = find_fstype(type_str);
1873     if (fs < 0) {
1874         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
1875         return;
1876     }
1877
1878     /* reconfigure existing dir */
1879
1880     RefCount<SwapDir> sd;
1881     for (int i = 0; i < swap->n_configured; ++i) {
1882         assert (swap->swapDirs[i].getRaw());
1883
1884         if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
1885             /* this is specific to on-fs Stores. The right
1886              * way to handle this is probably to have a mapping
1887              * from paths to stores, and have on-fs stores
1888              * register with that, and lookip in that in their
1889              * own setup logic. RBC 20041225. TODO.
1890              */
1891
1892             sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
1893
1894             if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
1895                 debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
1896                        sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
1897                 return;
1898             }
1899
1900             sd->reconfigure();
1901             return;
1902         }
1903     }
1904
1905     /* new cache_dir */
1906     if (swap->n_configured > 63) {
1907         /* 7 bits, signed */
1908         debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
1909         debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
1910         self_destruct();
1911         return;
1912     }
1913
1914     allocate_new_swapdir(swap);
1915
1916     swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
1917
1918     sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
1919
1920     /* parse the FS parameters and options */
1921     sd->parse(swap->n_configured, path_str);
1922
1923     ++swap->n_configured;
1924 }
1925
1926 static const char *
1927 peer_type_str(const peer_t type)
1928 {
1929     const char * result;
1930
1931     switch (type) {
1932
1933     case PEER_PARENT:
1934         result = "parent";
1935         break;
1936
1937     case PEER_SIBLING:
1938         result = "sibling";
1939         break;
1940
1941     case PEER_MULTICAST:
1942         result = "multicast";
1943         break;
1944
1945     default:
1946         result = "unknown";
1947         break;
1948     }
1949
1950     return result;
1951 }
1952
1953 static void
1954 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
1955 {
1956     NeighborTypeDomainList *t;
1957     LOCAL_ARRAY(char, xname, 128);
1958
1959     while (p != NULL) {
1960         storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
1961                           name,
1962                           p->host,
1963                           neighborTypeStr(p),
1964                           p->http_port,
1965                           p->icp.port,
1966                           p->name);
1967         dump_peer_options(entry, p);
1968
1969         if (p->access) {
1970             snprintf(xname, 128, "cache_peer_access %s", p->name);
1971             dump_acl_access(entry, xname, p->access);
1972         }
1973
1974         for (t = p->typelist; t; t = t->next) {
1975             storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
1976                               p->host,
1977                               peer_type_str(t->type),
1978                               t->domain);
1979         }
1980
1981         p = p->next;
1982     }
1983 }
1984
1985 /**
1986  * utility function to prevent getservbyname() being called with a numeric value
1987  * on Windows at least it returns garage results.
1988  */
1989 static bool
1990 isUnsignedNumeric(const char *str, size_t len)
1991 {
1992     if (len < 1) return false;
1993
1994     for (; len >0 && *str; ++str, --len) {
1995         if (! isdigit(*str))
1996             return false;
1997     }
1998     return true;
1999 }
2000
2001 /**
2002  \param proto   'tcp' or 'udp' for protocol
2003  \returns       Port the named service is supposed to be listening on.
2004  */
2005 static unsigned short
2006 GetService(const char *proto)
2007 {
2008     struct servent *port = NULL;
2009     /** Parses a port number or service name from the squid.conf */
2010     char *token = ConfigParser::NextToken();
2011     if (token == NULL) {
2012         self_destruct();
2013         return 0; /* NEVER REACHED */
2014     }
2015     /** Returns either the service port number from /etc/services */
2016     if ( !isUnsignedNumeric(token, strlen(token)) )
2017         port = getservbyname(token, proto);
2018     if (port != NULL) {
2019         return ntohs((unsigned short)port->s_port);
2020     }
2021     /** Or a numeric translation of the config text. */
2022     return xatos(token);
2023 }
2024
2025 /**
2026  \returns       Port the named TCP service is supposed to be listening on.
2027  \copydoc GetService(const char *proto)
2028  */
2029 inline unsigned short
2030 GetTcpService(void)
2031 {
2032     return GetService("tcp");
2033 }
2034
2035 /**
2036  \returns       Port the named UDP service is supposed to be listening on.
2037  \copydoc GetService(const char *proto)
2038  */
2039 inline unsigned short
2040 GetUdpService(void)
2041 {
2042     return GetService("udp");
2043 }
2044
2045 static void
2046 parse_peer(CachePeer ** head)
2047 {
2048     char *host_str = ConfigParser::NextToken();
2049     if (!host_str) {
2050         self_destruct();
2051         return;
2052     }
2053
2054     char *token = ConfigParser::NextToken();
2055     if (!token) {
2056         self_destruct();
2057         return;
2058     }
2059
2060     CachePeer *p = new CachePeer;
2061     p->host = xstrdup(host_str);
2062     p->name = xstrdup(host_str);
2063     p->type = parseNeighborType(token);
2064
2065     if (p->type == PEER_MULTICAST) {
2066         p->options.no_digest = true;
2067         p->options.no_netdb_exchange = true;
2068     }
2069
2070     p->http_port = GetTcpService();
2071
2072     if (!p->http_port) {
2073         delete p;
2074         self_destruct();
2075         return;
2076     }
2077
2078     p->icp.port = GetUdpService();
2079
2080     while ((token = ConfigParser::NextToken())) {
2081         if (!strcmp(token, "proxy-only")) {
2082             p->options.proxy_only = true;
2083         } else if (!strcmp(token, "no-query")) {
2084             p->options.no_query = true;
2085         } else if (!strcmp(token, "background-ping")) {
2086             p->options.background_ping = true;
2087         } else if (!strcmp(token, "no-digest")) {
2088             p->options.no_digest = true;
2089         } else if (!strcmp(token, "no-tproxy")) {
2090             p->options.no_tproxy = true;
2091         } else if (!strcmp(token, "multicast-responder")) {
2092             p->options.mcast_responder = true;
2093 #if PEER_MULTICAST_SIBLINGS
2094         } else if (!strcmp(token, "multicast-siblings")) {
2095             p->options.mcast_siblings = true;
2096 #endif
2097         } else if (!strncmp(token, "weight=", 7)) {
2098             p->weight = xatoi(token + 7);
2099         } else if (!strncmp(token, "basetime=", 9)) {
2100             p->basetime = xatoi(token + 9);
2101         } else if (!strcmp(token, "closest-only")) {
2102             p->options.closest_only = true;
2103         } else if (!strncmp(token, "ttl=", 4)) {
2104             p->mcast.ttl = xatoi(token + 4);
2105
2106             if (p->mcast.ttl < 0)
2107                 p->mcast.ttl = 0;
2108
2109             if (p->mcast.ttl > 128)
2110                 p->mcast.ttl = 128;
2111         } else if (!strcmp(token, "default")) {
2112             p->options.default_parent = true;
2113         } else if (!strcmp(token, "round-robin")) {
2114             p->options.roundrobin = true;
2115         } else if (!strcmp(token, "weighted-round-robin")) {
2116             p->options.weighted_roundrobin = true;
2117 #if USE_HTCP
2118         } else if (!strcmp(token, "htcp")) {
2119             p->options.htcp = true;
2120         } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2121             /* Note: The htcp- form is deprecated, replaced by htcp= */
2122             p->options.htcp = true;
2123             char *tmp = xstrdup(token+5);
2124             char *mode, *nextmode;
2125             for (mode = nextmode = tmp; mode; mode = nextmode) {
2126                 nextmode = strchr(mode, ',');
2127                 if (nextmode) {
2128                     *nextmode = '\0';
2129                     ++nextmode;
2130                 }
2131                 if (!strcmp(mode, "no-clr")) {
2132                     if (p->options.htcp_only_clr)
2133                         fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2134                     p->options.htcp_no_clr = true;
2135                 } else if (!strcmp(mode, "no-purge-clr")) {
2136                     p->options.htcp_no_purge_clr = true;
2137                 } else if (!strcmp(mode, "only-clr")) {
2138                     if (p->options.htcp_no_clr)
2139                         fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2140                     p->options.htcp_only_clr = true;
2141                 } else if (!strcmp(mode, "forward-clr")) {
2142                     p->options.htcp_forward_clr = true;
2143                 } else if (!strcmp(mode, "oldsquid")) {
2144                     p->options.htcp_oldsquid = true;
2145                 } else {
2146                     fatalf("invalid HTCP mode '%s'", mode);
2147                 }
2148             }
2149             safe_free(tmp);
2150 #endif
2151         } else if (!strcmp(token, "no-netdb-exchange")) {
2152             p->options.no_netdb_exchange = true;
2153
2154         } else if (!strcmp(token, "carp")) {
2155             if (p->type != PEER_PARENT)
2156                 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2157
2158             p->options.carp = true;
2159         } else if (!strncmp(token, "carp-key=", 9)) {
2160             if (p->options.carp != true)
2161                 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2162             p->options.carp_key.set = true;
2163             char *nextkey=token+strlen("carp-key="), *key=nextkey;
2164             for (; key; key = nextkey) {
2165                 nextkey=strchr(key,',');
2166                 if (nextkey) ++nextkey; // skip the comma, any
2167                 if (0==strncmp(key,"scheme",6)) {
2168                     p->options.carp_key.scheme = true;
2169                 } else if (0==strncmp(key,"host",4)) {
2170                     p->options.carp_key.host = true;
2171                 } else if (0==strncmp(key,"port",4)) {
2172                     p->options.carp_key.port = true;
2173                 } else if (0==strncmp(key,"path",4)) {
2174                     p->options.carp_key.path = true;
2175                 } else if (0==strncmp(key,"params",6)) {
2176                     p->options.carp_key.params = true;
2177                 } else {
2178                     fatalf("invalid carp-key '%s'",key);
2179                 }
2180             }
2181         } else if (!strcmp(token, "userhash")) {
2182 #if USE_AUTH
2183             if (p->type != PEER_PARENT)
2184                 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2185
2186             p->options.userhash = true;
2187 #else
2188             fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2189 #endif
2190         } else if (!strcmp(token, "sourcehash")) {
2191             if (p->type != PEER_PARENT)
2192                 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2193
2194             p->options.sourcehash = true;
2195
2196         } else if (!strcmp(token, "no-delay")) {
2197 #if USE_DELAY_POOLS
2198             p->options.no_delay = true;
2199 #else
2200             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2201 #endif
2202         } else if (!strncmp(token, "login=", 6)) {
2203             p->login = xstrdup(token + 6);
2204             rfc1738_unescape(p->login);
2205         } else if (!strcmp(token, "auth-no-keytab")) {
2206             p->options.auth_no_keytab = 1;
2207         } else if (!strncmp(token, "connect-timeout=", 16)) {
2208             p->connect_timeout = xatoi(token + 16);
2209         } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2210             p->connect_fail_limit = xatoi(token + 19);
2211 #if USE_CACHE_DIGESTS
2212         } else if (!strncmp(token, "digest-url=", 11)) {
2213             p->digest_url = xstrdup(token + 11);
2214 #endif
2215
2216         } else if (!strcmp(token, "allow-miss")) {
2217             p->options.allow_miss = true;
2218         } else if (!strncmp(token, "max-conn=", 9)) {
2219             p->max_conn = xatoi(token + 9);
2220         } else if (!strncmp(token, "standby=", 8)) {
2221             p->standby.limit = xatoi(token + 8);
2222         } else if (!strcmp(token, "originserver")) {
2223             p->options.originserver = true;
2224         } else if (!strncmp(token, "name=", 5)) {
2225             safe_free(p->name);
2226
2227             if (token[5])
2228                 p->name = xstrdup(token + 5);
2229         } else if (!strncmp(token, "forceddomain=", 13)) {
2230             safe_free(p->domain);
2231             if (token[13])
2232                 p->domain = xstrdup(token + 13);
2233
2234         } else if (strncmp(token, "ssl", 3) == 0) {
2235 #if !USE_OPENSSL
2236             debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2237 #else
2238             p->secure.parse(token+3);
2239 #endif
2240         } else if (strncmp(token, "tls-", 4) == 0) {
2241             p->secure.parse(token+4);
2242         } else if (strncmp(token, "tls", 3) == 0) {
2243             p->secure.parse(token+3);
2244         } else if (strcmp(token, "front-end-https") == 0) {
2245             p->front_end_https = 1;
2246         } else if (strcmp(token, "front-end-https=on") == 0) {
2247             p->front_end_https = 1;
2248         } else if (strcmp(token, "front-end-https=auto") == 0) {
2249             p->front_end_https = 2;
2250         } else if (strcmp(token, "connection-auth=off") == 0) {
2251             p->connection_auth = 0;
2252         } else if (strcmp(token, "connection-auth") == 0) {
2253             p->connection_auth = 1;
2254         } else if (strcmp(token, "connection-auth=on") == 0) {
2255             p->connection_auth = 1;
2256         } else if (strcmp(token, "connection-auth=auto") == 0) {
2257             p->connection_auth = 2;
2258         } else if (token[0] == '#') {
2259             // start of a text comment. stop reading this line.
2260             break;
2261         } else {
2262             debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2263         }
2264     }
2265
2266     if (peerFindByName(p->name))
2267         fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2268
2269     if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2270         fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2271
2272     if (p->weight < 1)
2273         p->weight = 1;
2274
2275     if (p->connect_fail_limit < 1)
2276         p->connect_fail_limit = 10;
2277
2278 #if USE_CACHE_DIGESTS
2279
2280     if (!p->options.no_digest) {
2281         /* XXX This looks odd.. who has the original pointer
2282          * then?
2283          */
2284         PeerDigest *pd = peerDigestCreate(p);
2285         p->digest = cbdataReference(pd);
2286     }
2287
2288 #endif
2289
2290     p->index =  ++Config.npeers;
2291
2292     while (*head != NULL)
2293         head = &(*head)->next;
2294
2295     *head = p;
2296
2297     peerClearRRStart();
2298 }
2299
2300 static void
2301 free_peer(CachePeer ** P)
2302 {
2303     delete *P;
2304     *P = NULL;
2305     Config.npeers = 0;
2306 }
2307
2308 static void
2309 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2310 {
2311     while (list) {
2312         if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2313             storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2314         else
2315             storeAppendPrintf(entry, "%s %s", name, list->passwd);
2316
2317         for (auto w : list->actions)
2318             entry->appendf(" " SQUIDSBUFPH, SQUIDSBUFPRINT(w));
2319
2320         storeAppendPrintf(entry, "\n");
2321         list = list->next;
2322     }
2323 }
2324
2325 static void
2326 parse_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2327 {
2328     char *passwd = nullptr;
2329     parse_string(&passwd);
2330
2331     Mgr::ActionPasswordList *p = new Mgr::ActionPasswordList;
2332     p->passwd = passwd;
2333
2334     while (char *token = ConfigParser::NextQuotedToken())
2335         p->actions.push_back(SBuf(token));
2336
2337     Mgr::ActionPasswordList **P;
2338     for (P = head; *P; P = &(*P)->next) {
2339         /*
2340          * See if any of the actions from this line already have a
2341          * password from previous lines.  The password checking
2342          * routines in cache_manager.c take the the password from
2343          * the first Mgr::ActionPasswordList that contains the
2344          * requested action.  Thus, we should warn users who might
2345          * think they can have two passwords for the same action.
2346          */
2347         for (const auto &w : (*P)->actions) {
2348             for (const auto &u : p->actions) {
2349                 if (w != u)
2350                     continue;
2351
2352                 debugs(0, DBG_PARSE_NOTE(1), "ERROR: action '" << u << "' (line " << config_lineno << ") already has a password");
2353             }
2354         }
2355     }
2356
2357     *P = p;
2358 }
2359
2360 static void
2361 free_cachemgrpasswd(Mgr::ActionPasswordList ** head)
2362 {
2363     delete *head;
2364     *head = nullptr;
2365 }
2366
2367 static void
2368 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2369 {
2370     while (var != NULL) {
2371         storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2372
2373         for (auto *a = var->acl_list; a != NULL; a = a->next)
2374             storeAppendPrintf(entry, " %s", a->name);
2375
2376         storeAppendPrintf(entry, "\n");
2377
2378         var = var->next;
2379     }
2380 }
2381
2382 static void
2383 parse_denyinfo(AclDenyInfoList ** var)
2384 {
2385     aclParseDenyInfoLine(var);
2386 }
2387
2388 void
2389 free_denyinfo(AclDenyInfoList ** list)
2390 {
2391     delete *list;
2392     *list = nullptr;
2393 }
2394
2395 static void
2396 parse_peer_access(void)
2397 {
2398     char *host = ConfigParser::NextToken();
2399     if (!host) {
2400         self_destruct();
2401         return;
2402     }
2403
2404     CachePeer *p = peerFindByName(host);
2405     if (!p) {
2406         debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2407         return;
2408     }
2409
2410     std::string directive = "peer_access ";
2411     directive += host;
2412     aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2413 }
2414
2415 static void
2416 parse_hostdomaintype(void)
2417 {
2418     char *host = ConfigParser::NextToken();
2419     if (!host) {
2420         self_destruct();
2421         return;
2422     }
2423
2424     char *type = ConfigParser::NextToken();
2425     if (!type) {
2426         self_destruct();
2427         return;
2428     }
2429
2430     char *domain = nullptr;
2431     while ((domain = ConfigParser::NextToken())) {
2432         CachePeer *p = peerFindByName(host);
2433         if (!p) {
2434             debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2435             return;
2436         }
2437
2438         auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2439         l->type = parseNeighborType(type);
2440         l->domain = xstrdup(domain);
2441
2442         NeighborTypeDomainList **L = nullptr;
2443         for (L = &(p->typelist); *L; L = &((*L)->next));
2444         *L = l;
2445     }
2446 }
2447
2448 static void
2449 dump_int(StoreEntry * entry, const char *name, int var)
2450 {
2451     storeAppendPrintf(entry, "%s %d\n", name, var);
2452 }
2453
2454 void
2455 parse_int(int *var)
2456 {
2457     int i;
2458     i = GetInteger();
2459     *var = i;
2460 }
2461
2462 static void
2463 free_int(int *var)
2464 {
2465     *var = 0;
2466 }
2467
2468 static void
2469 dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2470 {
2471     storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2472 }
2473
2474 void
2475 parse_int64_t(int64_t *var)
2476 {
2477     int64_t i;
2478     i = GetInteger64();
2479     *var = i;
2480 }
2481
2482 static void
2483 free_int64_t(int64_t *var)
2484 {
2485     *var = 0;
2486 }
2487
2488 static void
2489 dump_onoff(StoreEntry * entry, const char *name, int var)
2490 {
2491     storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2492 }
2493
2494 void
2495 parse_onoff(int *var)
2496 {
2497     char *token = ConfigParser::NextToken();
2498     if (!token) {
2499         self_destruct();
2500         return;
2501     }
2502
2503     if (!strcmp(token, "on")) {
2504         *var = 1;
2505     } else if (!strcmp(token, "enable")) {
2506         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2507         *var = 1;
2508     } else if (!strcmp(token, "off")) {
2509         *var = 0;
2510     } else if (!strcmp(token, "disable")) {
2511         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2512         *var = 0;
2513     } else {
2514         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2515         self_destruct();
2516     }
2517 }
2518
2519 #define free_onoff free_int
2520
2521 static void
2522 dump_tristate(StoreEntry * entry, const char *name, int var)
2523 {
2524     const char *state;
2525
2526     if (var > 0)
2527         state = "on";
2528     else if (var < 0)
2529         state = "warn";
2530     else
2531         state = "off";
2532
2533     storeAppendPrintf(entry, "%s %s\n", name, state);
2534 }
2535
2536 static void
2537 parse_tristate(int *var)
2538 {
2539     char *token = ConfigParser::NextToken();
2540     if (!token) {
2541         self_destruct();
2542         return;
2543     }
2544
2545     if (!strcmp(token, "on")) {
2546         *var = 1;
2547     } else if (!strcmp(token, "enable")) {
2548         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2549         *var = 1;
2550     } else if (!strcmp(token, "warn")) {
2551         *var = -1;
2552     } else if (!strcmp(token, "off")) {
2553         *var = 0;
2554     } else if (!strcmp(token, "disable")) {
2555         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2556         *var = 0;
2557     } else {
2558         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2559         self_destruct();
2560     }
2561 }
2562
2563 #define free_tristate free_int
2564
2565 void
2566 parse_pipelinePrefetch(int *var)
2567 {
2568     char *token = ConfigParser::PeekAtToken();
2569     if (!token) {
2570         self_destruct();
2571         return;
2572     }
2573
2574     if (!strcmp(token, "on")) {
2575         debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2576         *var = 1;
2577         //pop the token
2578         (void)ConfigParser::NextToken();
2579     } else if (!strcmp(token, "off")) {
2580         debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2581         *var = 0;
2582         //pop the token
2583         (void)ConfigParser::NextToken();
2584     } else
2585         parse_int(var);
2586 }
2587
2588 #define free_pipelinePrefetch free_int
2589 #define dump_pipelinePrefetch dump_int
2590
2591 static void
2592 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2593 {
2594     while (head != NULL) {
2595         storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2596                           name,
2597                           head->pattern.flags&REG_ICASE ? " -i" : null_string,
2598                           head->pattern.c_str(),
2599                           (int) head->min / 60,
2600                           (int) (100.0 * head->pct + 0.5),
2601                           (int) head->max / 60);
2602
2603         if (head->max_stale >= 0)
2604             storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2605
2606         if (head->flags.refresh_ims)
2607             storeAppendPrintf(entry, " refresh-ims");
2608
2609         if (head->flags.store_stale)
2610             storeAppendPrintf(entry, " store-stale");
2611
2612 #if USE_HTTP_VIOLATIONS
2613
2614         if (head->flags.override_expire)
2615             storeAppendPrintf(entry, " override-expire");
2616
2617         if (head->flags.override_lastmod)
2618             storeAppendPrintf(entry, " override-lastmod");
2619
2620         if (head->flags.reload_into_ims)
2621             storeAppendPrintf(entry, " reload-into-ims");
2622
2623         if (head->flags.ignore_reload)
2624             storeAppendPrintf(entry, " ignore-reload");
2625
2626         if (head->flags.ignore_no_store)
2627             storeAppendPrintf(entry, " ignore-no-store");
2628
2629         if (head->flags.ignore_private)
2630             storeAppendPrintf(entry, " ignore-private");
2631 #endif
2632
2633         storeAppendPrintf(entry, "\n");
2634
2635         head = head->next;
2636     }
2637 }
2638
2639 static void
2640 parse_refreshpattern(RefreshPattern ** head)
2641 {
2642     char *token;
2643     char *pattern;
2644     time_t min = 0;
2645     double pct = 0.0;
2646     time_t max = 0;
2647     int refresh_ims = 0;
2648     int store_stale = 0;
2649     int max_stale = -1;
2650
2651 #if USE_HTTP_VIOLATIONS
2652
2653     int override_expire = 0;
2654     int override_lastmod = 0;
2655     int reload_into_ims = 0;
2656     int ignore_reload = 0;
2657     int ignore_no_store = 0;
2658     int ignore_private = 0;
2659 #endif
2660
2661     int i;
2662     RefreshPattern *t;
2663     regex_t comp;
2664     int errcode;
2665     int flags = REG_EXTENDED | REG_NOSUB;
2666
2667     if ((token = ConfigParser::RegexPattern()) != NULL) {
2668
2669         if (strcmp(token, "-i") == 0) {
2670             flags |= REG_ICASE;
2671             token = ConfigParser::RegexPattern();
2672         } else if (strcmp(token, "+i") == 0) {
2673             flags &= ~REG_ICASE;
2674             token = ConfigParser::RegexPattern();
2675         }
2676
2677     }
2678
2679     if (token == NULL) {
2680         debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2681         self_destruct();
2682         return;
2683     }
2684
2685     pattern = xstrdup(token);
2686
2687     i = GetInteger();       /* token: min */
2688
2689     /* catch negative and insanely huge values close to 32-bit wrap */
2690     if (i < 0) {
2691         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2692         i = 0;
2693     }
2694     if (i > 60*24*365) {
2695         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2696         i = 60*24*365;
2697     }
2698
2699     min = (time_t) (i * 60);    /* convert minutes to seconds */
2700
2701     pct = GetPercentage(false);    /* token: pct . with no limit on size */
2702
2703     i = GetInteger();       /* token: max */
2704
2705     /* catch negative and insanely huge values close to 32-bit wrap */
2706     if (i < 0) {
2707         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2708         i = 0;
2709     }
2710     if (i > 60*24*365) {
2711         debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2712         i = 60*24*365;
2713     }
2714
2715     max = (time_t) (i * 60);    /* convert minutes to seconds */
2716
2717     /* Options */
2718     while ((token = ConfigParser::NextToken()) != NULL) {
2719         if (!strcmp(token, "refresh-ims")) {
2720             refresh_ims = 1;
2721         } else if (!strcmp(token, "store-stale")) {
2722             store_stale = 1;
2723         } else if (!strncmp(token, "max-stale=", 10)) {
2724             max_stale = xatoi(token + 10);
2725
2726 #if USE_HTTP_VIOLATIONS
2727
2728         } else if (!strcmp(token, "override-expire"))
2729             override_expire = 1;
2730         else if (!strcmp(token, "override-lastmod"))
2731             override_lastmod = 1;
2732         else if (!strcmp(token, "ignore-no-store"))
2733             ignore_no_store = 1;
2734         else if (!strcmp(token, "ignore-private"))
2735             ignore_private = 1;
2736         else if (!strcmp(token, "reload-into-ims")) {
2737             reload_into_ims = 1;
2738             refresh_nocache_hack = 1;
2739             /* tell client_side.c that this is used */
2740         } else if (!strcmp(token, "ignore-reload")) {
2741             ignore_reload = 1;
2742             refresh_nocache_hack = 1;
2743             /* tell client_side.c that this is used */
2744 #endif
2745
2746         } else if (!strcmp(token, "ignore-no-cache") ||
2747                    !strcmp(token, "ignore-must-revalidate") ||
2748                    !strcmp(token, "ignore-auth")
2749                   ) {
2750             debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2751         } else
2752             debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2753     }
2754
2755     if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2756         char errbuf[256];
2757         regerror(errcode, &comp, errbuf, sizeof errbuf);
2758         debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2759         debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2760         xfree(pattern);
2761         return;
2762     }
2763
2764     pct = pct < 0.0 ? 0.0 : pct;
2765     max = max < 0 ? 0 : max;
2766     t = new RefreshPattern(pattern, flags);
2767     t->pattern.regex = comp;
2768     t->min = min;
2769     t->pct = pct;
2770     t->max = max;
2771
2772     if (refresh_ims)
2773         t->flags.refresh_ims = true;
2774
2775     if (store_stale)
2776         t->flags.store_stale = true;
2777
2778     t->max_stale = max_stale;
2779
2780 #if USE_HTTP_VIOLATIONS
2781
2782     if (override_expire)
2783         t->flags.override_expire = true;
2784
2785     if (override_lastmod)
2786         t->flags.override_lastmod = true;
2787
2788     if (reload_into_ims)
2789         t->flags.reload_into_ims = true;
2790
2791     if (ignore_reload)
2792         t->flags.ignore_reload = true;
2793
2794     if (ignore_no_store)
2795         t->flags.ignore_no_store = true;
2796
2797     if (ignore_private)
2798         t->flags.ignore_private = true;
2799 #endif
2800
2801     t->next = NULL;
2802
2803     while (*head)
2804         head = &(*head)->next;
2805
2806     *head = t;
2807
2808     xfree(pattern);
2809 }
2810
2811 static void
2812 free_refreshpattern(RefreshPattern ** head)
2813 {
2814     delete *head;
2815     *head = nullptr;
2816
2817 #if USE_HTTP_VIOLATIONS
2818     refresh_nocache_hack = 0;
2819
2820 #endif
2821 }
2822
2823 static void
2824 dump_string(StoreEntry * entry, const char *name, char *var)
2825 {
2826     if (var != NULL)
2827         storeAppendPrintf(entry, "%s %s\n", name, var);
2828 }
2829
2830 static void
2831 parse_string(char **var)
2832 {
2833     safe_free(*var);
2834
2835     char *token = ConfigParser::NextToken();
2836     if (!token) {
2837         self_destruct();
2838         return;
2839     }
2840
2841     *var = xstrdup(token);
2842 }
2843
2844 static void
2845 free_string(char **var)
2846 {
2847     safe_free(*var);
2848 }
2849
2850 void
2851 parse_eol(char *volatile *var)
2852 {
2853     if (!var) {
2854         self_destruct();
2855         return;
2856     }
2857
2858     unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2859     safe_free(*var);
2860
2861     if (!token) {
2862         self_destruct();
2863         return;
2864     }
2865
2866     while (*token && xisspace(*token))
2867         ++token;
2868
2869     if (!*token) {
2870         self_destruct();
2871         return;
2872     }
2873
2874     *var = xstrdup((char *) token);
2875 }
2876
2877 #define dump_eol dump_string
2878 #define free_eol free_string
2879
2880 static void
2881 parse_TokenOrQuotedString(char **var)
2882 {
2883     safe_free(*var);
2884
2885     char *token = ConfigParser::NextQuotedToken();
2886     if (!token) {
2887         self_destruct();
2888         return;
2889     }
2890
2891     *var = xstrdup(token);
2892 }
2893
2894 #define dump_TokenOrQuotedString dump_string
2895 #define free_TokenOrQuotedString free_string
2896
2897 static void
2898 dump_time_t(StoreEntry * entry, const char *name, time_t var)
2899 {
2900     storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2901 }
2902
2903 void
2904 parse_time_t(time_t * var)
2905 {
2906     time_msec_t tval;
2907     parseTimeLine(&tval, T_SECOND_STR, false);
2908     *var = static_cast<time_t>(tval/1000);
2909 }
2910
2911 static void
2912 free_time_t(time_t * var)
2913 {
2914     *var = 0;
2915 }
2916
2917 static void
2918 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2919 {
2920     if (var % 1000)
2921         storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2922     else
2923         storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2924 }
2925
2926 void
2927 parse_time_msec(time_msec_t * var)
2928 {
2929     parseTimeLine(var, T_SECOND_STR, true);
2930 }
2931
2932 static void
2933 free_time_msec(time_msec_t * var)
2934 {
2935     *var = 0;
2936 }
2937
2938 #if UNUSED_CODE
2939 static void
2940 dump_size_t(StoreEntry * entry, const char *name, size_t var)
2941 {
2942     storeAppendPrintf(entry, "%s %d\n", name, (int) var);
2943 }
2944 #endif
2945
2946 static void
2947 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
2948 {
2949     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2950 }
2951
2952 static void
2953 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
2954 {
2955     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
2956 }
2957
2958 #if UNUSED_CODE
2959 static void
2960 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
2961 {
2962     storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
2963 }
2964 #endif
2965
2966 static void
2967 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
2968 {
2969     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
2970 }
2971
2972 static void
2973 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
2974 {
2975     storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
2976 }
2977
2978 #if UNUSED_CODE
2979 static void
2980 parse_size_t(size_t * var)
2981 {
2982     int i;
2983     i = GetInteger();
2984     *var = (size_t) i;
2985 }
2986 #endif
2987
2988 static void
2989 parse_b_size_t(size_t * var)
2990 {
2991     parseBytesLine(var, B_BYTES_STR);
2992 }
2993
2994 static void
2995 parse_b_ssize_t(ssize_t * var)
2996 {
2997     parseBytesLineSigned(var, B_BYTES_STR);
2998 }
2999
3000 #if UNUSED_CODE
3001 static void
3002 parse_kb_size_t(size_t * var)
3003 {
3004     parseBytesLine(var, B_KBYTES_STR);
3005 }
3006 #endif
3007
3008 static void
3009 parse_b_int64_t(int64_t * var)
3010 {
3011     parseBytesLine64(var, B_BYTES_STR);
3012 }
3013
3014 static void
3015 parse_kb_int64_t(int64_t * var)
3016 {
3017     parseBytesLine64(var, B_KBYTES_STR);
3018 }
3019
3020 static void
3021 free_size_t(size_t * var)
3022 {
3023     *var = 0;
3024 }
3025
3026 static void
3027 free_ssize_t(ssize_t * var)
3028 {
3029     *var = 0;
3030 }
3031
3032 static void
3033 free_b_int64_t(int64_t * var)
3034 {
3035     *var = 0;
3036 }
3037
3038 #define free_b_size_t free_size_t
3039 #define free_b_ssize_t free_ssize_t
3040 #define free_kb_size_t free_size_t
3041 #define free_mb_size_t free_size_t
3042 #define free_gb_size_t free_size_t
3043 #define free_kb_int64_t free_b_int64_t
3044
3045 static void
3046 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3047 {
3048     storeAppendPrintf(entry, "%s %d\n", name, var);
3049 }
3050
3051 static void
3052 free_u_short(unsigned short * u)
3053 {
3054     *u = 0;
3055 }
3056
3057 static void
3058 parse_u_short(unsigned short * var)
3059 {
3060     ConfigParser::ParseUShort(var);
3061 }
3062
3063 void
3064 ConfigParser::ParseUShort(unsigned short *var)
3065 {
3066     *var = GetShort();
3067 }
3068
3069 void
3070 ConfigParser::ParseBool(bool *var)
3071 {
3072     int i = GetInteger();
3073
3074     if (0 == i)
3075         *var = false;
3076     else if (1 == i)
3077         *var = true;
3078     else
3079         self_destruct();
3080 }
3081
3082 static void
3083 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3084 {
3085     while (list != NULL) {
3086         storeAppendPrintf(entry, "%s %s\n", name, list->key);
3087         list = list->next;
3088     }
3089 }
3090
3091 void
3092 ConfigParser::ParseWordList(wordlist ** list)
3093 {
3094     parse_wordlist(list);
3095 }
3096
3097 void
3098 parse_wordlist(wordlist ** list)
3099 {
3100     char *token;
3101     while ((token = ConfigParser::NextQuotedToken()))
3102         wordlistAdd(list, token);
3103 }
3104
3105 #if 0 /* now unused */
3106 static int
3107 check_null_wordlist(wordlist * w)
3108 {
3109     return w == NULL;
3110 }
3111 #endif
3112
3113 static int
3114 check_null_acl_access(acl_access * a)
3115 {
3116     return a == NULL;
3117 }
3118
3119 #define free_wordlist wordlistDestroy
3120
3121 #define free_uri_whitespace free_int
3122
3123 static void
3124 parse_uri_whitespace(int *var)
3125 {
3126     char *token = ConfigParser::NextToken();
3127     if (!token) {
3128         self_destruct();
3129         return;
3130     }
3131
3132     if (!strcmp(token, "strip"))
3133         *var = URI_WHITESPACE_STRIP;
3134     else if (!strcmp(token, "deny"))
3135         *var = URI_WHITESPACE_DENY;
3136     else if (!strcmp(token, "allow"))
3137         *var = URI_WHITESPACE_ALLOW;
3138     else if (!strcmp(token, "encode"))
3139         *var = URI_WHITESPACE_ENCODE;
3140     else if (!strcmp(token, "chop"))
3141         *var = URI_WHITESPACE_CHOP;
3142     else {
3143         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3144         self_destruct();
3145     }
3146 }
3147
3148 static void
3149 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3150 {
3151     const char *s;
3152
3153     if (var == URI_WHITESPACE_ALLOW)
3154         s = "allow";
3155     else if (var == URI_WHITESPACE_ENCODE)
3156         s = "encode";
3157     else if (var == URI_WHITESPACE_CHOP)
3158         s = "chop";
3159     else if (var == URI_WHITESPACE_DENY)
3160         s = "deny";
3161     else
3162         s = "strip";
3163
3164     storeAppendPrintf(entry, "%s %s\n", name, s);
3165 }
3166
3167 static void
3168 free_removalpolicy(RemovalPolicySettings ** settings)
3169 {
3170     if (!*settings)
3171         return;
3172
3173     free_string(&(*settings)->type);
3174
3175     free_wordlist(&(*settings)->args);
3176
3177     delete *settings;
3178
3179     *settings = NULL;
3180 }
3181
3182 static void
3183 parse_removalpolicy(RemovalPolicySettings ** settings)
3184 {
3185     if (*settings)
3186         free_removalpolicy(settings);
3187
3188     *settings = new RemovalPolicySettings;
3189
3190     parse_string(&(*settings)->type);
3191
3192     parse_wordlist(&(*settings)->args);
3193 }
3194
3195 static void
3196 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3197 {
3198     wordlist *args;
3199     storeAppendPrintf(entry, "%s %s", name, settings->type);
3200     args = settings->args;
3201
3202     while (args) {
3203         storeAppendPrintf(entry, " %s", args->key);
3204         args = args->next;
3205     }
3206
3207     storeAppendPrintf(entry, "\n");
3208 }
3209
3210 inline void
3211 free_YesNoNone(YesNoNone *)
3212 {}
3213
3214 static void
3215 parse_YesNoNone(YesNoNone *option)
3216 {
3217     int value = 0;
3218     parse_onoff(&value);
3219     option->configure(value > 0);
3220 }
3221
3222 static void
3223 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3224 {
3225     if (option.configured())
3226         dump_onoff(entry, name, option ? 1 : 0);
3227 }
3228
3229 static void
3230 free_memcachemode(SquidConfig *)
3231 {}
3232
3233 static void
3234 parse_memcachemode(SquidConfig *)
3235 {
3236     char *token = ConfigParser::NextToken();
3237     if (!token) {
3238         self_destruct();
3239         return;
3240     }
3241
3242     if (strcmp(token, "always") == 0) {
3243         Config.onoff.memory_cache_first = 1;
3244         Config.onoff.memory_cache_disk = 1;
3245     } else if (strcmp(token, "disk") == 0) {
3246         Config.onoff.memory_cache_first = 0;
3247         Config.onoff.memory_cache_disk = 1;
3248     } else if (strncmp(token, "net", 3) == 0) {
3249         Config.onoff.memory_cache_first = 1;
3250         Config.onoff.memory_cache_disk = 0;
3251     } else if (strcmp(token, "never") == 0) {
3252         Config.onoff.memory_cache_first = 0;
3253         Config.onoff.memory_cache_disk = 0;
3254     } else {
3255         debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3256         self_destruct();
3257     }
3258 }
3259
3260 static void
3261 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3262 {
3263     storeAppendPrintf(entry, "%s ", name);
3264     if (Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3265         storeAppendPrintf(entry, "always");
3266     else if (!Config.onoff.memory_cache_first && Config.onoff.memory_cache_disk)
3267         storeAppendPrintf(entry, "disk");
3268     else if (Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3269         storeAppendPrintf(entry, "network");
3270     else if (!Config.onoff.memory_cache_first && !Config.onoff.memory_cache_disk)
3271         storeAppendPrintf(entry, "none");
3272     storeAppendPrintf(entry, "\n");
3273 }
3274
3275 #include "cf_parser.cci"
3276
3277 peer_t
3278 parseNeighborType(const char *s)
3279 {
3280     if (!strcmp(s, "parent"))
3281         return PEER_PARENT;
3282
3283     if (!strcmp(s, "neighbor"))
3284         return PEER_SIBLING;
3285
3286     if (!strcmp(s, "neighbour"))
3287         return PEER_SIBLING;
3288
3289     if (!strcmp(s, "sibling"))
3290         return PEER_SIBLING;
3291
3292     if (!strcmp(s, "multicast"))
3293         return PEER_MULTICAST;
3294
3295     debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3296
3297     return PEER_SIBLING;
3298 }
3299
3300 #if USE_WCCPv2
3301 static void
3302 parse_IpAddress_list(Ip::Address_list ** head)
3303 {
3304     char *token;
3305     Ip::Address_list *s;
3306     Ip::Address ipa;
3307
3308     while ((token = ConfigParser::NextToken())) {
3309         if (GetHostWithPort(token, &ipa)) {
3310
3311             while (*head)
3312                 head = &(*head)->next;
3313
3314             s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3315             s->s = ipa;
3316
3317             *head = s;
3318         } else {
3319             self_destruct();
3320             return;
3321         }
3322     }
3323 }
3324
3325 static void
3326 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3327 {
3328     char ntoabuf[MAX_IPSTRLEN];
3329
3330     while (s) {
3331         storeAppendPrintf(e, "%s %s\n",
3332                           n,
3333                           s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3334         s = s->next;
3335     }
3336 }
3337
3338 static void
3339 free_IpAddress_list(Ip::Address_list ** head)
3340 {
3341     if (*head) delete *head;
3342     *head = NULL;
3343 }
3344
3345 #if CURRENTLY_UNUSED
3346 /* This code was previously used by http_port. Left as it really should
3347  * be used by icp_port and htcp_port
3348  */
3349 static int
3350 check_null_IpAddress_list(const Ip::Address_list * s)
3351 {
3352     return NULL == s;
3353 }
3354
3355 #endif /* CURRENTLY_UNUSED */
3356 #endif /* USE_WCCPv2 */
3357
3358 static void
3359 parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
3360 {
3361     char *host = NULL;
3362     unsigned short port = 0;
3363     char *t = NULL;
3364     char *junk = NULL;
3365
3366     s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3367     s->name = xstrdup(token);
3368     s->connection_auth_disabled = false;
3369
3370     const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3371
3372     if (*token == '[') {
3373         /* [ipv6]:port */
3374         host = token + 1;
3375         t = strchr(host, ']');
3376         if (!t) {
3377             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3378             self_destruct();
3379             return;
3380         }
3381         *t = '\0';
3382         ++t;
3383         if (*t != ':') {
3384             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3385             self_destruct();
3386             return;
3387         }
3388         if (!Ip::EnableIpv6) {
3389             debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3390             self_destruct();
3391             return;
3392         }
3393         port = xatos(t + 1);
3394     } else if ((t = strchr(token, ':'))) {
3395         /* host:port */
3396         /* ipv4:port */
3397         host = token;
3398         *t = '\0';
3399         port = xatos(t + 1);
3400
3401     } else if (strtol(token, &junk, 10) && !*junk) {
3402         port = xatos(token);
3403         debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3404     } else {
3405         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3406         self_destruct();
3407         return;
3408     }
3409
3410     if (port == 0 && host != NULL) {
3411         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3412         self_destruct();
3413         return;
3414     }
3415
3416     if (NULL == host) {
3417         s->s.setAnyAddr();
3418         s->s.port(port);
3419         if (!Ip::EnableIpv6)
3420             s->s.setIPv4();
3421         debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3422     } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3423         s->s.port(port);
3424         if (!Ip::EnableIpv6)
3425             s->s.setIPv4();
3426         debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3427     } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3428         /* dont use ipcache */
3429         s->defaultsite = xstrdup(host);
3430         s->s.port(port);
3431         if (!Ip::EnableIpv6)
3432             s->s.setIPv4();
3433         debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3434     } else {
3435         debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3436         self_destruct();
3437     }
3438 }
3439
3440 /// parses the protocol= option of the *_port directive, returning parsed value
3441 /// unsupported option values result in a fatal error message
3442 /// upper case values required; caller may convert for backward compatibility
3443 static AnyP::ProtocolVersion
3444 parsePortProtocol(const SBuf &value)
3445 {
3446     // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3447     // and RFC 2616 requires us to upgrade 1.0 to 1.1
3448     if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3449         return AnyP::ProtocolVersion(AnyP::PROTO_HTTP, 1,1);
3450
3451     if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3452         return AnyP::ProtocolVersion(AnyP::PROTO_HTTPS, 1,1);
3453
3454     if (value.cmp("FTP") == 0)
3455         return Ftp::ProtocolVersion();
3456
3457     fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3458     return AnyP::ProtocolVersion(); // not reached
3459 }
3460
3461 static void
3462 parse_port_option(AnyP::PortCfgPointer &s, char *token)
3463 {
3464     /* modes first */
3465
3466     if (strcmp(token, "accel") == 0) {
3467         if (s->flags.isIntercepted()) {
3468             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3469             self_destruct();
3470             return;
3471         }
3472         s->flags.accelSurrogate = true;
3473         s->vhost = true;
3474     } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3475         if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3476             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3477             self_destruct();
3478             return;
3479         }
3480         s->flags.natIntercept = true;
3481         Ip::Interceptor.StartInterception();
3482         /* Log information regarding the port modes under interception. */
3483         debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3484         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3485     } else if (strcmp(token, "tproxy") == 0) {
3486         if (s->flags.natIntercept || s->flags.accelSurrogate) {
3487             debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3488             self_destruct();
3489             return;
3490         }
3491         s->flags.tproxyIntercept = true;
3492         Ip::Interceptor.StartTransparency();
3493         /* Log information regarding the port modes under transparency. */
3494         debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3495
3496         if (s->flags.proxySurrogate) {
3497             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3498         }
3499
3500         if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3501             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3502             self_destruct();
3503             return;
3504         }
3505
3506     } else if (strcmp(token, "require-proxy-header") == 0) {
3507         s->flags.proxySurrogate = true;
3508         if (s->flags.tproxyIntercept) {
3509             // receiving is still permitted, so we do not unset the TPROXY flag
3510             // spoofing access control override takes care of the spoof disable later
3511             debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3512         }
3513
3514     } else if (strncmp(token, "defaultsite=", 12) == 0) {
3515         if (!s->flags.accelSurrogate) {
3516             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3517             self_destruct();
3518             return;
3519         }
3520         safe_free(s->defaultsite);
3521         s->defaultsite = xstrdup(token + 12);
3522     } else if (strcmp(token, "vhost") == 0) {
3523         if (!s->flags.accelSurrogate) {
3524             debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3525         }
3526         s->flags.accelSurrogate = true;
3527         s->vhost = true;
3528     } else if (strcmp(token, "no-vhost") == 0) {
3529         if (!s->flags.accelSurrogate) {
3530             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3531         }
3532         s->vhost = false;
3533     } else if (strcmp(token, "vport") == 0) {
3534         if (!s->flags.accelSurrogate) {
3535             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3536             self_destruct();
3537             return;
3538         }
3539         s->vport = -1;
3540     } else if (strncmp(token, "vport=", 6) == 0) {
3541         if (!s->flags.accelSurrogate) {
3542             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3543             self_destruct();
3544             return;
3545         }
3546         s->vport = xatos(token + 6);
3547     } else if (strncmp(token, "protocol=", 9) == 0) {
3548         if (!s->flags.accelSurrogate) {
3549             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3550             self_destruct();
3551             return;
3552         }
3553         s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3554     } else if (strcmp(token, "allow-direct") == 0) {
3555         if (!s->flags.accelSurrogate) {
3556             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3557             self_destruct();
3558             return;
3559         }
3560         s->allow_direct = true;
3561     } else if (strcmp(token, "act-as-origin") == 0) {
3562         if (!s->flags.accelSurrogate) {
3563             debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3564         } else
3565             s->actAsOrigin = true;
3566     } else if (strcmp(token, "ignore-cc") == 0) {
3567 #if !USE_HTTP_VIOLATIONS
3568         if (!s->flags.accelSurrogate) {
3569             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3570             self_destruct();
3571             return;
3572         }
3573 #endif
3574         s->ignore_cc = true;
3575     } else if (strncmp(token, "name=", 5) == 0) {
3576         safe_free(s->name);
3577         s->name = xstrdup(token + 5);
3578     } else if (strcmp(token, "no-connection-auth") == 0) {
3579         s->connection_auth_disabled = true;
3580     } else if (strcmp(token, "connection-auth=off") == 0) {
3581         s->connection_auth_disabled = true;
3582     } else if (strcmp(token, "connection-auth") == 0) {
3583         s->connection_auth_disabled = false;
3584     } else if (strcmp(token, "connection-auth=on") == 0) {
3585         s->connection_auth_disabled = false;
3586     } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3587         if (!strcmp(token + 23, "off"))
3588             s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3589         else if (!strcmp(token + 23, "transparent"))
3590             s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3591         else if (!strcmp(token + 23, "always"))
3592             s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3593         else {
3594             self_destruct();
3595             return;
3596         }
3597     } else if (strcmp(token, "ipv4") == 0) {
3598         if ( !s->s.setIPv4() ) {
3599             debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3600             self_destruct();
3601             return;
3602         }
3603     } else if (strcmp(token, "tcpkeepalive") == 0) {
3604         s->tcp_keepalive.enabled = true;
3605     } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3606         char *t = token + 13;
3607         s->tcp_keepalive.enabled = true;
3608         s->tcp_keepalive.idle = xatoui(t,',');
3609         t = strchr(t, ',');
3610         if (t) {
3611             ++t;
3612             s->tcp_keepalive.interval = xatoui(t,',');
3613             t = strchr(t, ',');
3614         }
3615         if (t) {
3616             ++t;
3617             s->tcp_keepalive.timeout = xatoui(t);
3618         }
3619 #if USE_OPENSSL
3620     } else if (strcmp(token, "sslBump") == 0) {
3621         debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3622                "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3623         s->flags.tunnelSslBumping = true;
3624     } else if (strcmp(token, "ssl-bump") == 0) {
3625         s->flags.tunnelSslBumping = true;
3626     } else if (strncmp(token, "cert=", 5) == 0) {
3627         s->secure.parse(token);
3628     } else if (strncmp(token, "key=", 4) == 0) {
3629         s->secure.parse(token);
3630     } else if (strncmp(token, "version=", 8) == 0) {
3631         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3632                "in " << cfg_directive << ". Use 'options=' instead.");
3633         s->secure.parse(token);
3634     } else if (strncmp(token, "options=", 8) == 0) {
3635         s->secure.parse(token);
3636     } else if (strncmp(token, "cipher=", 7) == 0) {
3637         s->secure.parse(token);
3638     } else if (strncmp(token, "clientca=", 9) == 0) {
3639         safe_free(s->clientca);
3640         s->clientca = xstrdup(token + 9);
3641     } else if (strncmp(token, "cafile=", 7) == 0) {
3642         debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3643                "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3644         s->secure.parse(token);
3645     } else if (strncmp(token, "capath=", 7) == 0) {
3646         s->secure.parse(token);
3647     } else if (strncmp(token, "crlfile=", 8) == 0) {
3648         s->secure.parse(token);
3649     } else if (strncmp(token, "dhparams=", 9) == 0) {
3650         debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3651                "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3652         s->secure.parse(token);
3653     } else if (strncmp(token, "sslflags=", 9) == 0) {
3654         // NP: deprecation warnings output by secure.parse() when relevant
3655         s->secure.parse(token+3);
3656     } else if (strncmp(token, "sslcontext=", 11) == 0) {
3657         safe_free(s->sslContextSessionId);
3658         s->sslContextSessionId = xstrdup(token + 11);
3659     } else if (strcmp(token, "generate-host-certificates") == 0) {
3660         s->generateHostCertificates = true;
3661     } else if (strcmp(token, "generate-host-certificates=on") == 0) {
3662         s->generateHostCertificates = true;
3663     } else if (strcmp(token, "generate-host-certificates=off") == 0) {
3664         s->generateHostCertificates = false;
3665     } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3666         parseBytesOptionValue(&s->dynamicCertMemCacheSize, B_BYTES_STR, token + 28);
3667 #endif
3668     } else if (strncmp(token, "tls-", 4) == 0) {
3669         s->secure.parse(token+4);
3670     } else if (strcmp(token, "ftp-track-dirs") == 0) {
3671         s->ftp_track_dirs = true;
3672     } else {
3673         debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3674         self_destruct();
3675     }
3676 }
3677
3678 void
3679 add_http_port(char *portspec)
3680 {
3681     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3682     s->transport = parsePortProtocol(SBuf("HTTP"));
3683     parsePortSpecification(s, portspec);
3684     // we may need to merge better if the above returns a list with clones
3685     assert(s->next == NULL);
3686     s->next = HttpPortList;
3687     HttpPortList = s;
3688 }
3689
3690 static void
3691 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3692 {
3693     SBuf protoName;
3694     if (strcmp(optionName, "http_port") == 0 ||
3695             strcmp(optionName, "ascii_port") == 0)
3696         protoName = "HTTP";
3697     else if (strcmp(optionName, "https_port") == 0)
3698         protoName = "HTTPS";
3699     else if (strcmp(optionName, "ftp_port") == 0)
3700         protoName = "FTP";
3701     if (protoName.isEmpty()) {
3702         self_destruct();
3703         return;
3704     }
3705
3706     char *token = ConfigParser::NextToken();
3707
3708     if (!token) {
3709         self_destruct();
3710         return;
3711     }
3712
3713     AnyP::PortCfgPointer s = new AnyP::PortCfg();
3714     s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3715     parsePortSpecification(s, token);
3716
3717     /* parse options ... */
3718     while ((token = ConfigParser::NextToken())) {
3719         parse_port_option(s, token);
3720     }
3721
3722 #if USE_OPENSSL
3723     // if clientca has been defined but not cafile, then use it to verify
3724     // but if cafile has been defined, only use that to verify
3725     if (s->clientca && !s->secure.caFiles.size())
3726         s->secure.caFiles.emplace_back(SBuf(s->clientca));
3727 #endif
3728
3729     if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3730         s->secure.encryptTransport = true;
3731 #if USE_OPENSSL
3732         /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3733         const bool hijacked = s->flags.isIntercepted();
3734         if (s->flags.tunnelSslBumping && !hijacked) {
3735             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3736             self_destruct();
3737             return;
3738         }
3739         if (hijacked && !s->flags.tunnelSslBumping) {
3740             debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3741             self_destruct();
3742             return;
3743         }
3744 #endif
3745         if (s->flags.proxySurrogate) {
3746             debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3747             self_destruct();
3748             return;
3749         }
3750     } else if (protoName.cmp("FTP") == 0) {
3751         /* ftp_port does not support ssl-bump */
3752         if (s->flags.tunnelSslBumping) {
3753             debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3754             self_destruct();
3755             return;
3756         }
3757         if (s->flags.proxySurrogate) {
3758             // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3759             debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3760             self_destruct();
3761             return;
3762         }
3763     }
3764
3765     if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3766         // clone the port options from *s to *(s->next)
3767         s->next = s->clone();
3768         s->next->s.setIPv4();
3769         debugs(3, 3, AnyP::UriScheme(s->transport.protocol).image() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3770     }
3771
3772     while (*head != NULL)
3773         head = &((*head)->next);
3774
3775     *head = s;
3776 }
3777
3778 static void
3779 dump_generic_port(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3780 {
3781     char buf[MAX_IPSTRLEN];
3782
3783     storeAppendPrintf(e, "%s %s",
3784                       n,
3785                       s->s.toUrl(buf,MAX_IPSTRLEN));
3786
3787     // MODES and specific sub-options.
3788     if (s->flags.natIntercept)
3789         storeAppendPrintf(e, " intercept");
3790
3791     else if (s->flags.tproxyIntercept)
3792         storeAppendPrintf(e, " tproxy");
3793
3794     else if (s->flags.proxySurrogate)
3795         storeAppendPrintf(e, " require-proxy-header");
3796
3797     else if (s->flags.accelSurrogate) {
3798         storeAppendPrintf(e, " accel");
3799
3800         if (s->vhost)
3801             storeAppendPrintf(e, " vhost");
3802
3803         if (s->vport < 0)
3804             storeAppendPrintf(e, " vport");
3805         else if (s->vport > 0)
3806             storeAppendPrintf(e, " vport=%d", s->vport);
3807
3808         if (s->defaultsite)
3809             storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3810
3811         // TODO: compare against prefix of 'n' instead of assuming http_port
3812         if (s->transport.protocol != AnyP::PROTO_HTTP)
3813             storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3814
3815         if (s->allow_direct)
3816             storeAppendPrintf(e, " allow-direct");
3817
3818         if (s->ignore_cc)
3819             storeAppendPrintf(e, " ignore-cc");
3820
3821     }
3822
3823     // Generic independent options
3824
3825     if (s->name)
3826         storeAppendPrintf(e, " name=%s", s->name);
3827
3828 #if USE_HTTP_VIOLATIONS
3829     if (!s->flags.accelSurrogate && s->ignore_cc)
3830         storeAppendPrintf(e, " ignore-cc");
3831 #endif
3832
3833     if (s->connection_auth_disabled)
3834         storeAppendPrintf(e, " connection-auth=off");
3835     else
3836         storeAppendPrintf(e, " connection-auth=on");
3837
3838     if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3839         const char *pmtu;
3840
3841         if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3842             pmtu = "always";
3843         else
3844             pmtu = "transparent";
3845
3846         storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3847     }
3848
3849     if (s->s.isAnyAddr() && !s->s.isIPv6())
3850         storeAppendPrintf(e, " ipv4");
3851
3852     if (s->tcp_keepalive.enabled) {
3853         if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3854             storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3855         } else {
3856             storeAppendPrintf(e, " tcpkeepalive");
3857         }
3858     }
3859
3860 #if USE_OPENSSL
3861     if (s->flags.tunnelSslBumping)
3862         storeAppendPrintf(e, " ssl-bump");
3863 #endif
3864
3865     s->secure.dumpCfg(e, "tls-");
3866
3867 #if USE_OPENSSL
3868     if (s->sslContextSessionId)
3869         storeAppendPrintf(e, " sslcontext=%s", s->sslContextSessionId);
3870
3871     if (!s->generateHostCertificates)
3872         storeAppendPrintf(e, " generate-host-certificates=off");
3873
3874     if (s->dynamicCertMemCacheSize != 4*1024*1024) // 4MB default
3875         storeAppendPrintf(e, "dynamic_cert_mem_cache_size=%" PRIuSIZE "%s\n", s->dynamicCertMemCacheSize, B_BYTES_STR);
3876 #endif
3877 }
3878
3879 static void
3880 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3881 {
3882     for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
3883         dump_generic_port(e, n, p);
3884         storeAppendPrintf(e, "\n");
3885     }
3886 }
3887
3888 void
3889 configFreeMemory(void)
3890 {
3891     free_all();
3892     Config.ssl_client.sslContext.reset();
3893 #if USE_OPENSSL
3894     Ssl::unloadSquidUntrusted();
3895 #endif
3896 }
3897
3898 void
3899 requirePathnameExists(const char *name, const char *path)
3900 {
3901
3902     struct stat sb;
3903     char pathbuf[BUFSIZ];
3904     assert(path != NULL);
3905
3906     if (Config.chroot_dir && (geteuid() == 0)) {
3907         snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3908         path = pathbuf;
3909     }
3910
3911     if (stat(path, &sb) < 0) {
3912         int xerrno = errno;
3913         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
3914         // keep going to find more issues if we are only checking the config file with "-k parse"
3915         if (opt_parse_cfg_only)
3916             return;
3917         // this is fatal if it is found during startup or reconfigure
3918         if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3919             fatalf("%s %s: %s", name, path, xstrerr(xerrno));
3920     }
3921 }
3922
3923 #include "AccessLogEntry.h"
3924
3925 /**
3926  * We support several access_log configuration styles:
3927  *
3928  * #1: Deprecated ancient style without an explicit logging module:
3929  * access_log /var/log/access.log
3930  *
3931  * #2: The "none" logging module (i.e., no logging [of matching transactions]):
3932  * access_log none [acl ...]
3933  *
3934  * #3: Configurable logging module without named options:
3935  * Logformat or the first ACL name, whichever comes first, may not contain '='.
3936  * If no explicit logformat name is given, the first ACL name, if any,
3937  * should not be an existing logformat name or it will be treated as such.
3938  * access_log module:place [logformat_name] [acl ...]
3939  *
3940  * #4: Configurable logging module with name=value options such as logformat=x:
3941  * The first ACL name may not contain '='.
3942  * access_log module:place [option ...] [acl ...]
3943  *
3944  */
3945 static void
3946 parse_access_log(CustomLog ** logs)
3947 {
3948     const char *filename = ConfigParser::NextToken();
3949     if (!filename) {
3950         self_destruct();
3951         return;
3952     }
3953
3954     CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
3955
3956     cl->filename = xstrdup(filename);
3957     // default buffer size and fatal settings
3958     cl->bufferSize = 8*MAX_URL;
3959     cl->fatal = true;
3960
3961     if (strcmp(filename, "none") == 0) {
3962         cl->type = Log::Format::CLF_NONE;
3963         aclParseAclList(LegacyParser, &cl->aclList, filename);
3964         while (*logs)
3965             logs = &(*logs)->next;
3966         *logs = cl;
3967         return;
3968     }
3969
3970     cl->type = Log::Format::CLF_UNKNOWN;
3971     cl->rotateCount = -1; // default: use global logfile_rotate setting.
3972
3973     const char *token = ConfigParser::PeekAtToken();
3974     if (!token) { // style #1
3975         // no options to deal with
3976     } else if (!strchr(token, '=')) { // style #3
3977         // if logformat name is recognized,
3978         // pop the previewed token; Else it must be an ACL name
3979         if (setLogformat(cl, token, false))
3980             (void)ConfigParser::NextToken();
3981     } else { // style #4
3982         do {
3983             if (strncasecmp(token, "on-error=", 9) == 0) {
3984                 if (strncasecmp(token+9, "die", 3) == 0) {
3985                     cl->fatal = true;
3986                 } else if (strncasecmp(token+9, "drop", 4) == 0) {
3987                     cl->fatal = false;
3988                 } else {
3989                     debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
3990                            token << "' expected 'drop' or 'die'");
3991                     xfree(cl->filename);
3992                     xfree(cl);
3993                     self_destruct();
3994                     return;
3995                 }
3996             } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
3997                 parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
3998             } else if (strncasecmp(token, "rotate=", 7) == 0) {
3999                 cl->rotateCount = xatoi(token + 7);
4000             } else if (strncasecmp(token, "logformat=", 10) == 0) {
4001                 setLogformat(cl, token+10, true);
4002             } else if (!strchr(token, '=')) {
4003                 // Do not pop the token; it must be an ACL name
4004                 break; // done with name=value options, now to ACLs
4005             } else {
4006                 debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
4007                 xfree(cl->filename);
4008                 xfree(cl);
4009                 self_destruct();
4010                 return;
4011             }
4012             // Pop the token, it was a valid "name=value" option
4013             (void)ConfigParser::NextToken();
4014             // Get next with preview ConfigParser::NextToken call.
4015         } while ((token = ConfigParser::PeekAtToken()) != NULL);
4016     }
4017
4018     // set format if it has not been specified explicitly
4019     if (cl->type == Log::Format::CLF_UNKNOWN)
4020         setLogformat(cl, "squid", true);
4021
4022     aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4023
4024     while (*logs)
4025         logs = &(*logs)->next;
4026
4027     *logs = cl;
4028 }
4029
4030 /// sets CustomLog::type and, if needed, CustomLog::lf
4031 /// returns false iff there is no named log format
4032 static bool
4033 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
4034 {
4035     assert(cl);
4036     assert(logdef_name);
4037
4038     debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
4039
4040     if (cl->type != Log::Format::CLF_UNKNOWN) {
4041         debugs(3, DBG_CRITICAL, "Second logformat name in one access_log: " <<
4042                logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
4043         self_destruct();
4044         return false;
4045     }
4046
4047     /* look for the definition pointer corresponding to this name */
4048     Format::Format *lf = Log::TheConfig.logformats;
4049
4050     while (lf != NULL) {
4051         debugs(3, 9, "Comparing against '" << lf->name << "'");
4052
4053         if (strcmp(lf->name, logdef_name) == 0)
4054             break;
4055
4056         lf = lf->next;
4057     }
4058
4059     if (lf != NULL) {
4060         cl->type = Log::Format::CLF_CUSTOM;
4061         cl->logFormat = lf;
4062     } else if (strcmp(logdef_name, "auto") == 0) {
4063         debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
4064         cl->type = Log::Format::CLF_SQUID;
4065     } else if (strcmp(logdef_name, "squid") == 0) {
4066         cl->type = Log::Format::CLF_SQUID;
4067     } else if (strcmp(logdef_name, "common") == 0) {
4068         cl->type = Log::Format::CLF_COMMON;
4069     } else if (strcmp(logdef_name, "combined") == 0) {
4070         cl->type = Log::Format::CLF_COMBINED;
4071 #if ICAP_CLIENT
4072     } else if (strcmp(logdef_name, "icap_squid") == 0) {
4073         cl->type = Log::Format::CLF_ICAP_SQUID;
4074 #endif
4075     } else if (strcmp(logdef_name, "useragent") == 0) {
4076         cl->type = Log::Format::CLF_USERAGENT;
4077     } else if (strcmp(logdef_name, "referrer") == 0) {
4078         cl->type = Log::Format::CLF_REFERER;
4079     } else if (dieWhenMissing) {
4080         debugs(3, DBG_CRITICAL, "Log format '" << logdef_name << "' is not defined");
4081         self_destruct();
4082         return false;
4083     } else {
4084         return false;
4085     }
4086
4087     return true;
4088 }
4089
4090 static int
4091 check_null_access_log(CustomLog *customlog_definitions)
4092 {
4093     return customlog_definitions == NULL;
4094 }
4095
4096 static void
4097 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4098 {
4099     CustomLog *log;
4100
4101     for (log = logs; log; log = log->next) {
4102         storeAppendPrintf(entry, "%s ", name);
4103
4104         switch (log->type) {
4105
4106         case Log::Format::CLF_CUSTOM:
4107             storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4108             break;
4109
4110         case Log::Format::CLF_NONE:
4111             storeAppendPrintf(entry, "logformat=none");
4112             break;
4113
4114         case Log::Format::CLF_SQUID:
4115             storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4116             break;
4117
4118         case Log::Format::CLF_COMBINED:
4119             storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4120             break;
4121
4122         case Log::Format::CLF_COMMON:
4123             storeAppendPrintf(entry, "%s logformat=common", log->filename);
4124             break;
4125
4126 #if ICAP_CLIENT
4127         case Log::Format::CLF_ICAP_SQUID:
4128             storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4129             break;
4130 #endif
4131         case Log::Format::CLF_USERAGENT:
4132             storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4133             break;
4134
4135         case Log::Format::CLF_REFERER:
4136             storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4137             break;
4138
4139         case Log::Format::CLF_UNKNOWN:
4140             break;
4141         }
4142
4143         // default is on-error=die
4144         if (!log->fatal)
4145             storeAppendPrintf(entry, " on-error=drop");
4146
4147         // default: 64KB
4148         if (log->bufferSize != 64*1024)
4149             storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4150
4151         if (log->rotateCount >= 0)
4152             storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4153
4154         if (log->aclList)
4155             dump_acl_list(entry, log->aclList);
4156
4157         storeAppendPrintf(entry, "\n");
4158     }
4159 }
4160
4161 static void
4162 free_access_log(CustomLog ** definitions)
4163 {
4164     while (*definitions) {
4165         CustomLog *log = *definitions;
4166         *definitions = log->next;
4167
4168         log->logFormat = NULL;
4169         log->type = Log::Format::CLF_UNKNOWN;
4170
4171         if (log->aclList)
4172             aclDestroyAclList(&log->aclList);
4173
4174         safe_free(log->filename);
4175
4176         xfree(log);
4177     }
4178 }
4179
4180 #if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4181 /// parses list of integers form name=N1,N2,N3,...
4182 static bool
4183 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4184 {
4185     if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4186         data += name.size();
4187         if (*data == '=') {
4188             while (true) {
4189                 ++data;
4190                 int value = 0;
4191                 if (!StringToInt(data, value, &data, 10))
4192                     break;
4193                 list.push_back(value);
4194                 if (*data == '\0' || *data != ',')
4195                     break;
4196             }
4197         }
4198     }
4199     return data && *data == '\0';
4200 }
4201 #endif
4202
4203 static void
4204 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4205 {
4206 #if !HAVE_CPU_AFFINITY
4207     debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4208            "support, do not set 'cpu_affinity_map'");
4209     self_destruct();
4210
4211 #else /* HAVE_CPU_AFFINITY */
4212     if (!*cpuAffinityMap)
4213         *cpuAffinityMap = new CpuAffinityMap;
4214
4215     const char *const pToken = ConfigParser::NextToken();
4216     const char *const cToken = ConfigParser::NextToken();
4217     std::vector<int> processes, cores;
4218     if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4219         debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4220                "in 'cpu_affinity_map'");
4221         self_destruct();
4222     } else if (!parseNamedIntList(cToken, "cores", cores)) {
4223         debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4224                "'cpu_affinity_map'");
4225         self_destruct();
4226     } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4227         debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4228                "process_numbers and cores lists differ in length or " <<
4229                "contain numbers <= 0");
4230         self_destruct();
4231     }
4232 #endif
4233 }
4234
4235 static void
4236 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4237 {
4238     if (cpuAffinityMap) {
4239         storeAppendPrintf(entry, "%s process_numbers=", name);
4240         for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4241             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4242                               cpuAffinityMap->processes()[i]);
4243         }
4244         storeAppendPrintf(entry, " cores=");
4245         for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4246             storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4247                               cpuAffinityMap->cores()[i]);
4248         }
4249         storeAppendPrintf(entry, "\n");
4250     }
4251 }
4252
4253 static void
4254 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4255 {
4256     delete *cpuAffinityMap;
4257     *cpuAffinityMap = NULL;
4258 }
4259
4260 #if USE_ADAPTATION
4261
4262 static void
4263 parse_adaptation_service_set_type()
4264 {
4265     Adaptation::Config::ParseServiceSet();
4266 }
4267
4268 static void
4269 parse_adaptation_service_chain_type()
4270 {
4271     Adaptation::Config::ParseServiceChain();
4272 }
4273
4274 static void
4275 parse_adaptation_access_type()
4276 {
4277     Adaptation::Config::ParseAccess(LegacyParser);
4278 }
4279 #endif /* USE_ADAPTATION */
4280
4281 #if ICAP_CLIENT
4282
4283 static void
4284 parse_icap_service_type(Adaptation::Icap::Config * cfg)
4285 {
4286     cfg->parseService();
4287 }
4288
4289 static void
4290 free_icap_service_type(Adaptation::Icap::Config * cfg)
4291 {
4292     cfg->freeService();
4293 }
4294
4295 static void
4296 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4297 {
4298     cfg.dumpService(entry, name);
4299 }
4300
4301 static void
4302 parse_icap_class_type()
4303 {
4304     debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is depricated. " <<
4305            "Use 'adaptation_service_set' instead");
4306     Adaptation::Config::ParseServiceSet();
4307 }
4308
4309 static void
4310 parse_icap_access_type()
4311 {
4312     debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is depricated. " <<
4313            "Use 'adaptation_access' instead");
4314     Adaptation::Config::ParseAccess(LegacyParser);
4315 }
4316
4317 #endif
4318
4319 #if USE_ECAP
4320
4321 static void
4322 parse_ecap_service_type(Adaptation::Ecap::Config * cfg)
4323 {
4324     cfg->parseService();
4325 }
4326
4327 static void
4328 free_ecap_service_type(Adaptation::Ecap::Config * cfg)
4329 {
4330     cfg->freeService();
4331 }
4332
4333 static void
4334 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4335 {
4336     cfg.dumpService(entry, name);
4337 }
4338
4339 #endif /* USE_ECAP */
4340
4341 #if ICAP_CLIENT
4342 static void parse_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4343 {
4344     char *token;
4345     time_t d;
4346     time_t m;
4347     cfg->service_failure_limit = GetInteger();
4348
4349     if ((token = ConfigParser::NextToken()) == NULL)
4350         return;
4351
4352     if (strcmp(token,"in") != 0) {
4353         debugs(3, DBG_CRITICAL, "expecting 'in' on'"  << config_input_line << "'");
4354         self_destruct();
4355         return;
4356     }
4357
4358     if ((token = ConfigParser::NextToken()) == NULL) {
4359         self_destruct();
4360         return;
4361     }
4362
4363     d = static_cast<time_t> (xatoi(token));
4364
4365     m = static_cast<time_t> (1);
4366
4367     if (0 == d)
4368         (void) 0;
4369     else if ((token = ConfigParser::NextToken()) == NULL) {
4370         debugs(3, DBG_CRITICAL, "No time-units on '" << config_input_line << "'");
4371         self_destruct();
4372         return;
4373     } else if ((m = parseTimeUnits(token, false)) == 0) {
4374         self_destruct();
4375         return;
4376     }
4377
4378     cfg->oldest_service_failure = (m * d);
4379 }
4380
4381 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4382 {
4383     storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4384     if (cfg.oldest_service_failure > 0) {
4385         storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4386     }
4387     storeAppendPrintf(entry, "\n");
4388 }
4389
4390 static void free_icap_service_failure_limit(Adaptation::Icap::Config *cfg)
4391 {
4392     cfg->oldest_service_failure = 0;
4393     cfg->service_failure_limit = 0;
4394 }
4395 #endif
4396
4397 #if USE_OPENSSL
4398 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4399 {
4400     char *al;
4401     sslproxy_cert_adapt *ca = (sslproxy_cert_adapt *) xcalloc(1, sizeof(sslproxy_cert_adapt));
4402     if ((al = ConfigParser::NextToken()) == NULL) {
4403         xfree(ca);
4404         self_destruct();
4405         return;
4406     }
4407
4408     const char *param;
4409     if ( char *s = strchr(al, '{')) {
4410         *s = '\0'; // terminate the al string
4411         ++s;
4412         param = s;
4413         s = strchr(s, '}');
4414         if (!s) {
4415             xfree(ca);
4416             self_destruct();
4417             return;
4418         }
4419         *s = '\0';
4420     } else
4421         param = NULL;
4422
4423     if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4424         ca->alg = Ssl::algSetValidAfter;
4425         ca->param = xstrdup("on");
4426     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4427         ca->alg = Ssl::algSetValidBefore;
4428         ca->param = xstrdup("on");
4429     } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4430         ca->alg = Ssl::algSetCommonName;
4431         if (param) {
4432             if (strlen(param) > 64) {
4433                 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4434                 xfree(ca);
4435                 self_destruct();
4436                 return;
4437             }
4438             ca->param = xstrdup(param);
4439         }
4440     } else {
4441         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4442         xfree(ca);
4443         self_destruct();
4444         return;
4445     }
4446
4447     aclParseAclList(LegacyParser, &ca->aclList, al);
4448
4449     while (*cert_adapt)
4450         cert_adapt = &(*cert_adapt)->next;
4451
4452     *cert_adapt = ca;
4453 }
4454
4455 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4456 {
4457     for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4458         storeAppendPrintf(entry, "%s ", name);
4459         storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4460         if (ca->aclList)
4461             dump_acl_list(entry, ca->aclList);
4462         storeAppendPrintf(entry, "\n");
4463     }
4464 }
4465
4466 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt)
4467 {
4468     while (*cert_adapt) {
4469         sslproxy_cert_adapt *ca = *cert_adapt;
4470         *cert_adapt = ca->next;
4471         safe_free(ca->param);
4472
4473         if (ca->aclList)
4474             aclDestroyAclList(&ca->aclList);
4475
4476         safe_free(ca);
4477     }
4478 }
4479
4480 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4481 {
4482     char *al;
4483     sslproxy_cert_sign *cs = (sslproxy_cert_sign *) xcalloc(1, sizeof(sslproxy_cert_sign));
4484     if ((al = ConfigParser::NextToken()) == NULL) {
4485         xfree(cs);
4486         self_destruct();
4487         return;
4488     }
4489
4490     if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4491         cs->alg = Ssl::algSignTrusted;
4492     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4493         cs->alg = Ssl::algSignUntrusted;
4494     else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4495         cs->alg = Ssl::algSignSelf;
4496     else {
4497         debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4498         xfree(cs);
4499         self_destruct();
4500         return;
4501     }
4502
4503     aclParseAclList(LegacyParser, &cs->aclList, al);
4504
4505     while (*cert_sign)
4506         cert_sign = &(*cert_sign)->next;
4507
4508     *cert_sign = cs;
4509 }
4510
4511 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4512 {
4513     sslproxy_cert_sign *cs;
4514     for (cs = cert_sign; cs != NULL; cs = cs->next) {
4515         storeAppendPrintf(entry, "%s ", name);
4516         storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4517         if (cs->aclList)
4518             dump_acl_list(entry, cs->aclList);
4519         storeAppendPrintf(entry, "\n");
4520     }
4521 }
4522
4523 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign)
4524 {
4525     while (*cert_sign) {
4526         sslproxy_cert_sign *cs = *cert_sign;
4527         *cert_sign = cs->next;
4528
4529         if (cs->aclList)
4530             aclDestroyAclList(&cs->aclList);
4531
4532         safe_free(cs);
4533     }
4534 }
4535
4536 class sslBumpCfgRr: public ::RegisteredRunner
4537 {
4538 public:
4539     static Ssl::BumpMode lastDeprecatedRule;
4540     /* RegisteredRunner API */
4541     virtual void finalizeConfig();
4542 };
4543
4544 Ssl::BumpMode sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4545
4546 RunnerRegistrationEntry(sslBumpCfgRr);
4547
4548 void
4549 sslBumpCfgRr::finalizeConfig()
4550 {
4551     if (lastDeprecatedRule != Ssl::bumpEnd) {
4552         assert( lastDeprecatedRule == Ssl::bumpClientFirst || lastDeprecatedRule == Ssl::bumpNone);
4553         static char buf[1024];
4554         if (lastDeprecatedRule == Ssl::bumpClientFirst) {
4555             strcpy(buf, "ssl_bump deny all");
4556             debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4557                    "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4558                    "must not use implicit rules. Update your ssl_bump rules.");
4559         } else {
4560             strcpy(buf, "ssl_bump allow all");
4561             debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4562                    "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4563                    "inferior to the newer server-first bumping mode. New ssl_bump"
4564                    " configurations must not use implicit rules. Update your ssl_bump rules.");
4565         }
4566         parse_line(buf);
4567     }
4568 }
4569
4570 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4571 {
4572     typedef const char *BumpCfgStyle;
4573     BumpCfgStyle bcsNone = NULL;
4574     BumpCfgStyle bcsNew = "new client/server-first/none";
4575     BumpCfgStyle bcsOld = "deprecated allow/deny";
4576     static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4577     BumpCfgStyle bumpCfgStyleNow = bcsNone;
4578     char *bm;
4579     if ((bm = ConfigParser::NextToken()) == NULL) {
4580         self_destruct();
4581         return;
4582     }
4583
4584     // if this is the first rule proccessed
4585     if (*ssl_bump == NULL) {
4586         bumpCfgStyleLast = bcsNone;
4587         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpEnd;
4588     }
4589
4590     allow_t action = allow_t(ACCESS_ALLOWED);
4591
4592     if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4593         action.kind = Ssl::bumpClientFirst;
4594         bumpCfgStyleNow = bcsNew;
4595     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4596         action.kind = Ssl::bumpServerFirst;
4597         bumpCfgStyleNow = bcsNew;
4598     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4599         action.kind = Ssl::bumpPeek;
4600         bumpCfgStyleNow = bcsNew;
4601     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4602         action.kind = Ssl::bumpStare;
4603         bumpCfgStyleNow = bcsNew;
4604     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4605         action.kind = Ssl::bumpSplice;
4606         bumpCfgStyleNow = bcsNew;
4607     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4608         action.kind = Ssl::bumpBump;
4609         bumpCfgStyleNow = bcsNew;
4610     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4611         action.kind = Ssl::bumpTerminate;
4612         bumpCfgStyleNow = bcsNew;
4613     } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4614         action.kind = Ssl::bumpNone;
4615         bumpCfgStyleNow = bcsNew;
4616     } else if (strcmp(bm, "allow") == 0) {
4617         debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4618                "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4619                "is usually inferior to the newer server-first "
4620                "bumping mode. Update your ssl_bump rules.");
4621         action.kind = Ssl::bumpClientFirst;
4622         bumpCfgStyleNow = bcsOld;
4623         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpClientFirst;
4624     } else if (strcmp(bm, "deny") == 0) {
4625         debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4626                "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4627                "your ssl_bump rules.");
4628         action.kind = Ssl::bumpNone;
4629         bumpCfgStyleNow = bcsOld;
4630         sslBumpCfgRr::lastDeprecatedRule = Ssl::bumpNone;
4631     } else {
4632         debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4633         self_destruct();
4634         return;
4635     }
4636
4637     if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4638         debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4639                bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4640         self_destruct();
4641         return;
4642     }
4643
4644     bumpCfgStyleLast = bumpCfgStyleNow;
4645
4646     // empty rule OK
4647     ParseAclWithAction(ssl_bump, action, "ssl_bump");
4648 }
4649
4650 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4651 {
4652     if (ssl_bump)
4653         dump_SBufList(entry, ssl_bump->treeDump(name, [](const allow_t &action) {
4654         return Ssl::BumpModeStr.at(action.kind);
4655     }));
4656 }
4657
4658 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4659 {
4660     free_acl_access(ssl_bump);
4661 }
4662
4663 #endif
4664
4665 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4666 {
4667     if (!headers)
4668         return;
4669
4670     for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4671         storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4672         if (hwa->aclList)
4673             dump_acl_list(entry, hwa->aclList);
4674         storeAppendPrintf(entry, "\n");
4675     }
4676 }
4677
4678 static void parse_HeaderWithAclList(HeaderWithAclList **headers)
4679 {
4680     char *fn;
4681     if (!*headers) {
4682         *headers = new HeaderWithAclList;
4683     }
4684     if ((fn = ConfigParser::NextToken()) == NULL) {
4685         self_destruct();
4686         return;
4687     }
4688     HeaderWithAcl hwa;
4689     hwa.fieldName = fn;
4690     hwa.fieldId = Http::HeaderLookupTable.lookup(hwa.fieldName).id;
4691     if (hwa.fieldId == Http::HdrType::BAD_HDR)
4692         hwa.fieldId = Http::HdrType::OTHER;
4693
4694     Format::Format *nlf =  new ::Format::Format("hdrWithAcl");
4695     ConfigParser::EnableMacros();
4696     String buf = ConfigParser::NextQuotedToken();
4697     ConfigParser::DisableMacros();
4698     hwa.fieldValue = buf.termedBuf();
4699     hwa.quoted = ConfigParser::LastTokenWasQuoted();
4700     if (hwa.quoted) {
4701         if (!nlf->parse(hwa.fieldValue.c_str())) {
4702             self_destruct();
4703             return;
4704         }
4705         hwa.valueFormat = nlf;
4706     } else
4707         delete nlf;
4708     aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4709     (*headers)->push_back(hwa);
4710 }
4711
4712 static void free_HeaderWithAclList(HeaderWithAclList **header)
4713 {
4714     if (!(*header))
4715         return;
4716
4717     for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4718         if (hwa->aclList)
4719             aclDestroyAclList(&hwa->aclList);
4720
4721         if (hwa->valueFormat) {
4722             delete hwa->valueFormat;
4723             hwa->valueFormat = NULL;
4724         }
4725     }
4726     delete *header;
4727     *header = NULL;
4728 }
4729
4730 static void parse_note(Notes *notes)
4731 {
4732     assert(notes);
4733     notes->parse(LegacyParser);
4734 }
4735
4736 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4737 {
4738     notes.dump(entry, name);
4739 }
4740
4741 static void free_note(Notes *notes)
4742 {
4743     notes->clean();
4744 }
4745
4746 static bool FtpEspvDeprecated = false;
4747 static void parse_ftp_epsv(acl_access **ftp_epsv)
4748 {
4749     allow_t ftpEpsvDeprecatedAction;
4750     bool ftpEpsvIsDeprecatedRule = false;
4751
4752     char *t = ConfigParser::PeekAtToken();
4753     if (!t) {
4754         self_destruct();
4755         return;
4756     }
4757
4758     if (!strcmp(t, "off")) {
4759         (void)ConfigParser::NextToken();
4760         ftpEpsvIsDeprecatedRule = true;
4761         ftpEpsvDeprecatedAction = allow_t(ACCESS_DENIED);
4762     } else if (!strcmp(t, "on")) {
4763         (void)ConfigParser::NextToken();
4764         ftpEpsvIsDeprecatedRule = true;
4765         ftpEpsvDeprecatedAction = allow_t(ACCESS_ALLOWED);
4766     }
4767
4768     // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4769     //   1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4770     //   2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4771     // then abort
4772     if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4773             (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4774         debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4775         self_destruct();
4776         return;
4777     }
4778
4779     if (ftpEpsvIsDeprecatedRule) {
4780         // overwrite previous ftp_epsv lines
4781         delete *ftp_epsv;
4782         *ftp_epsv = nullptr;
4783
4784         if (ftpEpsvDeprecatedAction == allow_t(ACCESS_DENIED)) {
4785             if (ACL *a = ACL::FindByName("all"))
4786                 ParseAclWithAction(ftp_epsv, ftpEpsvDeprecatedAction, "ftp_epsv", a);
4787             else {
4788                 self_destruct();
4789                 return;
4790             }
4791         }
4792         FtpEspvDeprecated = true;
4793     } else {
4794         aclParseAccessLine(cfg_directive, LegacyParser, ftp_epsv);
4795     }
4796 }
4797
4798 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4799 {
4800     if (ftp_epsv)
4801         dump_SBufList(entry, ftp_epsv->treeDump(name, Acl::AllowOrDeny));
4802 }
4803
4804 static void free_ftp_epsv(acl_access **ftp_epsv)
4805 {
4806     free_acl_access(ftp_epsv);
4807     FtpEspvDeprecated = false;
4808 }
4809
4810 static void
4811 parse_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4812 {
4813     time_msec_t tval;
4814     parseTimeLine(&tval, T_SECOND_STR, false, true);
4815     Config.Timeout.urlRewrite = static_cast<time_t>(tval/1000);
4816
4817     char *key, *value;
4818     while(ConfigParser::NextKvPair(key, value)) {
4819         if (strcasecmp(key, "on_timeout") == 0) {
4820             if (strcasecmp(value, "bypass") == 0)
4821                 config->action = toutActBypass;
4822             else if (strcasecmp(value, "fail") == 0)
4823                 config->action = toutActFail;
4824             else if (strcasecmp(value, "retry") == 0)
4825                 config->action = toutActRetry;
4826             else if (strcasecmp(value, "use_configured_response") == 0) {
4827                 config->action = toutActUseConfiguredResponse;
4828             } else {
4829                 debugs(3, DBG_CRITICAL, "FATAL: unsuported \"on_timeout\"  action:" << value);
4830                 self_destruct();
4831                 return;
4832             }
4833         } else if (strcasecmp(key, "response") == 0) {
4834             config->response = xstrdup(value);
4835         } else {
4836             debugs(3, DBG_CRITICAL, "FATAL: unsuported option " << key);
4837             self_destruct();
4838             return;
4839         }
4840     }
4841
4842     if (config->action == toutActUseConfiguredResponse && !config->response) {
4843         debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4844         self_destruct();
4845     }
4846
4847     if (config->action != toutActUseConfiguredResponse && config->response) {
4848         debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the  'on_timeout=use_configured_response' option");
4849         self_destruct();
4850     }
4851 }
4852
4853 static void
4854 dump_UrlHelperTimeout(StoreEntry *entry, const char *name, SquidConfig::UrlHelperTimeout &config)
4855 {
4856     const char  *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4857     assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4858
4859     dump_time_t(entry, name, Config.Timeout.urlRewrite);
4860     storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4861
4862     if (config.response)
4863         storeAppendPrintf(entry, " response=\"%s\"", config.response);
4864
4865     storeAppendPrintf(entry, "\n");
4866 }
4867
4868 static void
4869 free_UrlHelperTimeout(SquidConfig::UrlHelperTimeout *config)
4870 {
4871     Config.Timeout.urlRewrite = 0;
4872     config->action = 0;
4873     safe_free(config->response);
4874 }
4875
4876 static void
4877 parse_configuration_includes_quoted_values(bool *)
4878 {
4879     int val = 0;
4880     parse_onoff(&val);
4881
4882     // If quoted values is set to on then enable new strict mode parsing
4883     if (val) {
4884         ConfigParser::RecognizeQuotedValues = true;
4885         ConfigParser::StrictMode = true;
4886     } else {
4887         ConfigParser::RecognizeQuotedValues = false;
4888         ConfigParser::StrictMode = false;
4889     }
4890 }
4891
4892 static void
4893 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4894 {
4895     int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4896     dump_onoff(entry, name, val);
4897 }
4898
4899 static void
4900 free_configuration_includes_quoted_values(bool *)
4901 {
4902     ConfigParser::RecognizeQuotedValues = false;
4903     ConfigParser::StrictMode = false;
4904 }
4905
4906 static void
4907 parse_on_unsupported_protocol(acl_access **access)
4908 {
4909     char *tm;
4910     if ((tm = ConfigParser::NextToken()) == NULL) {
4911         self_destruct();
4912         return;
4913     }
4914
4915     allow_t action = allow_t(ACCESS_ALLOWED);
4916     if (strcmp(tm, "tunnel") == 0)
4917         action.kind = 1;
4918     else if (strcmp(tm, "respond") == 0)
4919         action.kind = 2;
4920     else {
4921         debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4922         self_destruct();
4923         return;
4924     }
4925
4926     // empty rule OK
4927     ParseAclWithAction(access, action, "on_unsupported_protocol");
4928 }
4929
4930 static void
4931 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4932 {
4933     static const std::vector<const char *> onErrorTunnelMode = {
4934         "none",
4935         "tunnel",
4936         "respond"
4937     };
4938     if (access) {
4939         SBufList lines = access->treeDump(name, [](const allow_t &action) {
4940             return onErrorTunnelMode.at(action.kind);
4941         });
4942         dump_SBufList(entry, lines);
4943     }
4944 }
4945
4946 static void
4947 free_on_unsupported_protocol(acl_access **access)
4948 {
4949     free_acl_access(access);
4950 }
4951