cache_cf.cc
Go to the documentation of this file.
1 /*
2  * Copyright (C) 1996-2020 The Squid Software Foundation and contributors
3  *
4  * Squid software is distributed under GPLv2+ license and includes
5  * contributions from numerous individuals and organizations.
6  * Please see the COPYING and CONTRIBUTORS files for details.
7  */
8 
9 /* DEBUG: section 03 Configuration File Parsing */
10 
11 #include "squid.h"
12 #include "acl/Acl.h"
13 #include "acl/AclDenyInfoList.h"
14 #include "acl/AclSizeLimit.h"
15 #include "acl/Address.h"
16 #include "acl/Gadgets.h"
17 #include "acl/MethodData.h"
18 #include "acl/Tree.h"
19 #include "anyp/PortCfg.h"
20 #include "anyp/UriScheme.h"
21 #include "auth/Config.h"
22 #include "auth/Scheme.h"
23 #include "AuthReg.h"
24 #include "base/RunnersRegistry.h"
25 #include "cache_cf.h"
26 #include "CachePeer.h"
27 #include "ConfigParser.h"
28 #include "CpuAffinityMap.h"
29 #include "DiskIO/DiskIOModule.h"
30 #include "eui/Config.h"
31 #include "ExternalACL.h"
32 #include "format/Format.h"
33 #include "ftp/Elements.h"
34 #include "globals.h"
35 #include "HttpHeaderTools.h"
37 #include "icmp/IcmpConfig.h"
38 #include "ident/Config.h"
39 #include "ip/Intercept.h"
40 #include "ip/NfMarkConfig.h"
41 #include "ip/QosConfig.h"
42 #include "ip/tools.h"
43 #include "ipc/Kids.h"
44 #include "log/Config.h"
45 #include "log/CustomLog.h"
46 #include "MemBuf.h"
47 #include "MessageDelayPools.h"
48 #include "mgr/ActionPasswordList.h"
49 #include "mgr/Registration.h"
50 #include "neighbors.h"
51 #include "NeighborTypeDomainList.h"
52 #include "Parsing.h"
53 #include "pconn.h"
54 #include "PeerDigest.h"
55 #include "PeerPoolMgr.h"
56 #include "redirect.h"
57 #include "RefreshPattern.h"
58 #include "rfc1738.h"
59 #include "sbuf/List.h"
60 #include "sbuf/Stream.h"
61 #include "SquidConfig.h"
62 #include "SquidString.h"
63 #include "ssl/ProxyCerts.h"
64 #include "Store.h"
65 #include "store/Disk.h"
66 #include "store/Disks.h"
67 #include "StoreFileSystem.h"
68 #include "tools.h"
69 #include "util.h"
70 #include "wordlist.h"
71 /* wccp2 has its own conditional definitions */
72 #include "wccp2.h"
73 #if USE_ADAPTATION
74 #include "adaptation/Config.h"
75 #endif
76 #if ICAP_CLIENT
77 #include "adaptation/icap/Config.h"
78 #endif
79 #if USE_ECAP
80 #include "adaptation/ecap/Config.h"
81 #endif
82 #if USE_OPENSSL
83 #include "ssl/Config.h"
84 #include "ssl/support.h"
85 #endif
86 #if USE_SQUID_ESI
87 #include "esi/Parser.h"
88 #endif
89 #if SQUID_SNMP
90 #include "snmp.h"
91 #endif
92 
93 #if HAVE_GLOB_H
94 #include <glob.h>
95 #endif
96 #include <chrono>
97 #include <limits>
98 #include <list>
99 #if HAVE_PWD_H
100 #include <pwd.h>
101 #endif
102 #if HAVE_GRP_H
103 #include <grp.h>
104 #endif
105 #if HAVE_SYS_SOCKET_H
106 #include <sys/socket.h>
107 #endif
108 #if HAVE_SYS_STAT_H
109 #include <sys/stat.h>
110 #endif
111 
112 #if USE_OPENSSL
113 #include "ssl/gadgets.h"
114 #endif
115 
116 #if USE_ADAPTATION
119 static void parse_adaptation_access_type();
120 #endif
121 
122 #if ICAP_CLIENT
124 static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
126 static void parse_icap_class_type();
127 static void parse_icap_access_type();
128 
130 static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
132 #endif
133 
134 #if USE_ECAP
136 static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
138 #endif
139 
140 static peer_t parseNeighborType(const char *s);
141 
142 static const char *const T_NANOSECOND_STR = "nanosecond";
143 static const char *const T_MICROSECOND_STR = "microsecond";
144 static const char *const T_MILLISECOND_STR = "millisecond";
145 static const char *const T_SECOND_STR = "second";
146 static const char *const T_MINUTE_STR = "minute";
147 static const char *const T_HOUR_STR = "hour";
148 static const char *const T_DAY_STR = "day";
149 static const char *const T_WEEK_STR = "week";
150 static const char *const T_FORTNIGHT_STR = "fortnight";
151 static const char *const T_MONTH_STR = "month";
152 static const char *const T_YEAR_STR = "year";
153 static const char *const T_DECADE_STR = "decade";
154 
155 static const char *const B_BYTES_STR = "bytes";
156 static const char *const B_KBYTES_STR = "KB";
157 static const char *const B_MBYTES_STR = "MB";
158 static const char *const B_GBYTES_STR = "GB";
159 
160 static const char *const list_sep = ", \t\n\r";
161 
162 // std::chrono::years requires C++20. Do our own rough calculation for now.
163 static const double HoursPerYear = 24*365.2522;
164 
165 static void parse_access_log(CustomLog ** customlog_definitions);
166 static int check_null_access_log(CustomLog *customlog_definitions);
167 static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
168 static void free_access_log(CustomLog ** definitions);
169 static bool setLogformat(CustomLog *cl, const char *name, const bool dieWhenMissing);
170 
171 static void configDoConfigure(void);
172 static void parse_refreshpattern(RefreshPattern **);
173 static void parse_u_short(unsigned short * var);
174 static void parse_string(char **);
175 static void default_all(void);
176 static void defaults_if_none(void);
177 static void defaults_postscriptum(void);
178 static int parse_line(char *);
179 static void parse_obsolete(const char *);
180 static void parseBytesLine(size_t * bptr, const char *units);
181 static void parseBytesLineSigned(ssize_t * bptr, const char *units);
182 static size_t parseBytesUnits(const char *unit);
183 static void free_all(void);
184 void requirePathnameExists(const char *name, const char *path);
186 #if USE_HTTP_VIOLATIONS
187 static void free_HeaderManglers(HeaderManglers **pm);
188 static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
189 static void parse_http_header_access(HeaderManglers **manglers);
190 #define free_http_header_access free_HeaderManglers
191 static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
192 static void parse_http_header_replace(HeaderManglers **manglers);
193 #define free_http_header_replace free_HeaderManglers
194 #endif
195 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
196 static void parse_HeaderWithAclList(HeaderWithAclList **header);
197 static void free_HeaderWithAclList(HeaderWithAclList **header);
198 static void parse_note(Notes *);
199 static void dump_note(StoreEntry *, const char *, Notes &);
200 static void free_note(Notes *);
201 static void parse_denyinfo(AclDenyInfoList ** var);
202 static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
203 static void free_denyinfo(AclDenyInfoList ** var);
204 
205 #if USE_WCCPv2
206 static void parse_IpAddress_list(Ip::Address_list **);
207 static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
208 static void free_IpAddress_list(Ip::Address_list **);
209 #if CURRENTLY_UNUSED
210 static int check_null_IpAddress_list(const Ip::Address_list *);
211 #endif /* CURRENTLY_UNUSED */
212 #endif /* USE_WCCPv2 */
213 
214 static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
215 #define parse_PortCfg(l) parsePortCfg((l), token)
216 static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
217 #define free_PortCfg(h) *(h)=NULL
218 
219 #if USE_OPENSSL
220 static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
221 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
222 static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
223 static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
224 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
225 static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
226 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
227 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
228 static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
229 #endif /* USE_OPENSSL */
230 
231 static void parse_ftp_epsv(acl_access **ftp_epsv);
232 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
233 static void free_ftp_epsv(acl_access **ftp_epsv);
234 
235 static void parse_b_size_t(size_t * var);
236 static void parse_b_int64_t(int64_t * var);
237 
238 static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
239 static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
240 static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
241 
243 static void dump_UrlHelperTimeout(StoreEntry *, const char *, SquidConfig::UrlHelperTimeout &);
245 
246 static int parseOneConfigFile(const char *file_name, unsigned int depth);
247 
248 static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
249 static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
250 static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
251 static void parse_on_unsupported_protocol(acl_access **access);
252 static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
253 static void free_on_unsupported_protocol(acl_access **access);
254 static void ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl = nullptr);
256 static void dump_http_upgrade_request_protocols(StoreEntry *entry, const char *name, HttpUpgradeProtocolAccess *protoGuards);
258 
259 /*
260  * LegacyParser is a parser for legacy code that uses the global
261  * approach. This is static so that it is only exposed to cache_cf.
262  * Other modules needing access to a ConfigParser should have it
263  * provided to them in their parserFOO methods.
264  */
266 
267 void
269 {
271 }
272 
273 static void
274 SetConfigFilename(char const *file_name, bool is_pipe)
275 {
276  if (is_pipe)
277  cfg_filename = file_name + 1;
278  else
279  cfg_filename = file_name;
280 }
281 
282 static const char*
283 skip_ws(const char* s)
284 {
285  while (xisspace(*s))
286  ++s;
287 
288  return s;
289 }
290 
291 static int
292 parseManyConfigFiles(char* files, int depth)
293 {
294  int error_count = 0;
295  char* saveptr = NULL;
296 #if HAVE_GLOB
297  char *path;
298  glob_t globbuf;
299  int i;
300  memset(&globbuf, 0, sizeof(globbuf));
301  for (path = strwordtok(files, &saveptr); path; path = strwordtok(NULL, &saveptr)) {
302  if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, NULL, &globbuf) != 0) {
303  int xerrno = errno;
304  fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
305  }
306  }
307  for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
308  error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
309  }
310  globfree(&globbuf);
311 #else
312  char* file = strwordtok(files, &saveptr);
313  while (file != NULL) {
314  error_count += parseOneConfigFile(file, depth);
315  file = strwordtok(NULL, &saveptr);
316  }
317 #endif /* HAVE_GLOB */
318  return error_count;
319 }
320 
321 static void
322 ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
323 {
324  assert(str != NULL);
325  assert(newSubstr != NULL);
326 
327  unsigned newSubstrLen = strlen(newSubstr);
328  if (newSubstrLen > substrLen)
329  str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
330 
331  // move tail part including zero
332  memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
333  // copy new substring in place
334  memcpy(str + substrIdx, newSubstr, newSubstrLen);
335 
336  len = strlen(str);
337 }
338 
339 static void
340 SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
341 {
342  assert(line != NULL);
343  assert(macroName != NULL);
344  assert(substStr != NULL);
345  unsigned macroNameLen = strlen(macroName);
346  while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
347  ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
348 }
349 
350 static void
351 ProcessMacros(char*& line, int& len)
352 {
353  SubstituteMacro(line, len, "${service_name}", service_name.c_str());
354  SubstituteMacro(line, len, "${process_name}", TheKidName.c_str());
355  SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
356 }
357 
358 static void
360 {
361  assert(str != NULL);
362  unsigned i = strlen(str);
363  while ((i > 0) && xisspace(str[i - 1]))
364  --i;
365  str[i] = '\0';
366 }
367 
368 static const char*
369 FindStatement(const char* line, const char* statement)
370 {
371  assert(line != NULL);
372  assert(statement != NULL);
373 
374  const char* str = skip_ws(line);
375  unsigned len = strlen(statement);
376  if (strncmp(str, statement, len) == 0) {
377  str += len;
378  if (*str == '\0')
379  return str;
380  else if (xisspace(*str))
381  return skip_ws(str);
382  }
383 
384  return NULL;
385 }
386 
387 static bool
388 StrToInt(const char* str, long& number)
389 {
390  assert(str != NULL);
391 
392  char* end;
393  number = strtol(str, &end, 0);
394 
395  return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
396 }
397 
398 static bool
399 EvalBoolExpr(const char* expr)
400 {
401  assert(expr != NULL);
402  if (strcmp(expr, "true") == 0) {
403  return true;
404  } else if (strcmp(expr, "false") == 0) {
405  return false;
406  } else if (const char* equation = strchr(expr, '=')) {
407  const char* rvalue = skip_ws(equation + 1);
408  char* lvalue = (char*)xmalloc(equation - expr + 1);
409  xstrncpy(lvalue, expr, equation - expr + 1);
410  trim_trailing_ws(lvalue);
411 
412  long number1;
413  if (!StrToInt(lvalue, number1))
414  fatalf("String is not a integer number: '%s'\n", lvalue);
415  long number2;
416  if (!StrToInt(rvalue, number2))
417  fatalf("String is not a integer number: '%s'\n", rvalue);
418 
419  xfree(lvalue);
420  return number1 == number2;
421  }
422  fatalf("Unable to evaluate expression '%s'\n", expr);
423  return false; // this place cannot be reached
424 }
425 
426 static int
427 parseOneConfigFile(const char *file_name, unsigned int depth)
428 {
429  FILE *fp = NULL;
430  const char *orig_cfg_filename = cfg_filename;
431  const int orig_config_lineno = config_lineno;
432  char *token = NULL;
433  char *tmp_line = NULL;
434  int tmp_line_len = 0;
435  int err_count = 0;
436  int is_pipe = 0;
437 
438  debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
439  if (depth > 16) {
440  fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
441  return 1;
442  }
443 
444  if (file_name[0] == '!' || file_name[0] == '|') {
445  fp = popen(file_name + 1, "r");
446  is_pipe = 1;
447  } else {
448  fp = fopen(file_name, "r");
449  }
450 
451  if (!fp) {
452  int xerrno = errno;
453  fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
454  }
455 
456 #if _SQUID_WINDOWS_
457  setmode(fileno(fp), O_TEXT);
458 #endif
459 
460  SetConfigFilename(file_name, bool(is_pipe));
461 
462  memset(config_input_line, '\0', BUFSIZ);
463 
464  config_lineno = 0;
465 
466  std::vector<bool> if_states;
467  while (fgets(config_input_line, BUFSIZ, fp)) {
468  ++config_lineno;
469 
470  if ((token = strchr(config_input_line, '\n')))
471  *token = '\0';
472 
473  if ((token = strchr(config_input_line, '\r')))
474  *token = '\0';
475 
476  // strip any prefix whitespace off the line.
477  const char *p = skip_ws(config_input_line);
478  if (config_input_line != p)
479  memmove(config_input_line, p, strlen(p)+1);
480 
481  if (strncmp(config_input_line, "#line ", 6) == 0) {
482  static char new_file_name[1024];
483  static char *file;
484  static char new_lineno;
485  token = config_input_line + 6;
486  new_lineno = strtol(token, &file, 0) - 1;
487 
488  if (file == token)
489  continue; /* Not a valid #line directive, may be a comment */
490 
491  while (*file && xisspace((unsigned char) *file))
492  ++file;
493 
494  if (*file) {
495  if (*file != '"')
496  continue; /* Not a valid #line directive, may be a comment */
497 
498  xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
499 
500  if ((token = strchr(new_file_name, '"')))
501  *token = '\0';
502 
503  SetConfigFilename(new_file_name, false);
504  }
505 
506  config_lineno = new_lineno;
507  }
508 
509  if (config_input_line[0] == '#')
510  continue;
511 
512  if (config_input_line[0] == '\0')
513  continue;
514 
515  const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
516 
517  size_t append_len = strlen(append);
518 
519  tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
520 
521  strcpy(tmp_line + tmp_line_len, append);
522 
523  tmp_line_len += append_len;
524 
525  if (tmp_line[tmp_line_len-1] == '\\') {
526  debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
527  tmp_line[--tmp_line_len] = '\0';
528  continue;
529  }
530 
531  trim_trailing_ws(tmp_line);
532  ProcessMacros(tmp_line, tmp_line_len);
533  debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
534 
535  if (const char* expr = FindStatement(tmp_line, "if")) {
536  if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
537  } else if (FindStatement(tmp_line, "endif")) {
538  if (!if_states.empty())
539  if_states.pop_back(); // remove last if-statement meaning
540  else
541  fatalf("'endif' without 'if'\n");
542  } else if (FindStatement(tmp_line, "else")) {
543  if (!if_states.empty())
544  if_states.back() = !if_states.back();
545  else
546  fatalf("'else' without 'if'\n");
547  } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
548  /* Handle includes here */
549  if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
550  err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
551  } else {
552  try {
553  if (!parse_line(tmp_line)) {
554  debugs(3, DBG_CRITICAL, ConfigParser::CurrentLocation() << ": unrecognized: '" << tmp_line << "'");
555  ++err_count;
556  }
557  } catch (...) {
558  // fatal for now
559  debugs(3, DBG_CRITICAL, "configuration error: " << CurrentException);
560  self_destruct();
561  }
562  }
563  }
564 
565  safe_free(tmp_line);
566  tmp_line_len = 0;
567 
568  }
569  if (!if_states.empty())
570  fatalf("if-statement without 'endif'\n");
571 
572  if (is_pipe) {
573  int ret = pclose(fp);
574 
575  if (ret != 0)
576  fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
577  } else {
578  fclose(fp);
579  }
580 
581  SetConfigFilename(orig_cfg_filename, false);
582  config_lineno = orig_config_lineno;
583 
584  xfree(tmp_line);
585  return err_count;
586 }
587 
588 static
589 int
590 parseConfigFileOrThrow(const char *file_name)
591 {
592  int err_count = 0;
593 
594  debugs(5, 4, HERE);
595 
597 
599  default_all();
600 
601  err_count = parseOneConfigFile(file_name, 0);
602 
604 
606 
607  /*
608  * We must call configDoConfigure() before leave_suid() because
609  * configDoConfigure() is where we turn username strings into
610  * uid values.
611  */
613 
614  if (opt_send_signal == -1) {
615  Mgr::RegisterAction("config",
616  "Current Squid Configuration",
617  dump_config,
618  1, 1);
619  }
620 
621  return err_count;
622 }
623 
624 // TODO: Refactor main.cc to centrally handle (and report) all exceptions.
625 int
626 parseConfigFile(const char *file_name)
627 {
628  try {
629  return parseConfigFileOrThrow(file_name);
630  }
631  catch (const std::exception &ex) {
632  debugs(3, DBG_CRITICAL, "FATAL: bad configuration: " << ex.what());
633  self_destruct();
634  return 1; // not reached
635  }
636 }
637 
638 static void
640 {
641  Config2.clear();
642  /* init memory as early as possible */
643  memConfigure();
644  /* Sanity checks */
645 
646  Config.cacheSwap.n_strands = 0; // no diskers by default
647  if (Config.cacheSwap.swapDirs == NULL) {
648  /* Memory-only cache probably in effect. */
649  /* turn off the cache rebuild delays... */
651  } else if (InDaemonMode()) { // no diskers in non-daemon mode
652  for (int i = 0; i < Config.cacheSwap.n_configured; ++i) {
654  if (sd->needsDiskStrand())
656  }
657  }
658 
659  if (Debug::rotateNumber < 0) {
661  }
662 
663 #if SIZEOF_OFF_T <= 4
664  if (Config.Store.maxObjectSize > 0x7FFF0000) {
665  debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
666  Config.Store.maxObjectSize = 0x7FFF0000;
667  }
668 #endif
669 
670  if (Config.Announce.period > 0) {
671  Config.onoff.announce = 1;
672  } else {
673  Config.Announce.period = 86400 * 365; /* one year */
674  Config.onoff.announce = 0;
675  }
676 
679  else
680  visible_appname_string = (char const *)APP_FULLNAME;
681 
682  if (Config.Program.redirect) {
683  if (Config.redirectChildren.n_max < 1) {
686  }
687  }
688 
689  if (Config.Program.store_id) {
690  if (Config.storeIdChildren.n_max < 1) {
693  }
694  }
695 
696  if (Config.appendDomain)
697  if (*Config.appendDomain != '.')
698  fatal("append_domain must begin with a '.'");
699 
700  if (Config.errHtmlText == NULL)
702 
703 #if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
704  if (Config.max_filedescriptors > 0) {
705  debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
706  }
707 #elif USE_SELECT || USE_SELECT_WIN32
708  if (Config.max_filedescriptors > FD_SETSIZE) {
709  debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
710  }
711 #endif
712 
713  storeConfigure();
714 
715  snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
716  uniqueHostname(),
718 
719  /*
720  * the extra space is for loop detection in client_side.c -- we search
721  * for substrings in the Via header.
722  */
723  snprintf(ThisCache2, sizeof(ThisCache), " %s (%s)",
724  uniqueHostname(),
726 
727  /* Use visible_hostname as default surrogate_id */
728  if (!Config.Accel.surrogate_id) {
729  const char *t = getMyHostname();
730  Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
731  }
732 
735 
736  if (Config.appendDomain)
738  else
740 
741  if (Config.connect_retries > 10) {
742  debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
743  Config.connect_retries = 10;
744  }
745 
746  requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
747 #if USE_UNLINKD
748 
749  requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
750 #endif
751  bool logDaemonUsed = false;
752  for (const auto *log = Config.Log.accesslogs; !logDaemonUsed && log; log = log->next)
753  logDaemonUsed = log->usesDaemon();
754 #if ICAP_CLIENT
755  for (const auto *log = Config.Log.icaplogs; !logDaemonUsed && log; log = log->next)
756  logDaemonUsed = log->usesDaemon();
757 #endif
758  if (logDaemonUsed)
759  requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
760 
761  if (Config.Program.redirect)
762  requirePathnameExists("redirect_program", Config.Program.redirect->key);
763 
764  if (Config.Program.store_id)
765  requirePathnameExists("store_id_program", Config.Program.store_id->key);
766 
767  requirePathnameExists("Icon Directory", Config.icons.directory);
768 
770  requirePathnameExists("Error Directory", Config.errorDirectory);
771 
772 #if USE_HTTP_VIOLATIONS
773 
774  {
775  const RefreshPattern *R;
776 
777  for (R = Config.Refresh; R; R = R->next) {
778  if (!R->flags.override_expire)
779  continue;
780 
781  debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
782 
783  break;
784  }
785 
786  for (R = Config.Refresh; R; R = R->next) {
787  if (!R->flags.override_lastmod)
788  continue;
789 
790  debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
791 
792  break;
793  }
794 
795  for (R = Config.Refresh; R; R = R->next) {
796  if (!R->flags.reload_into_ims)
797  continue;
798 
799  debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
800 
801  break;
802  }
803 
804  for (R = Config.Refresh; R; R = R->next) {
805  if (!R->flags.ignore_reload)
806  continue;
807 
808  debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
809 
810  break;
811  }
812 
813  for (R = Config.Refresh; R; R = R->next) {
814  if (!R->flags.ignore_no_store)
815  continue;
816 
817  debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
818 
819  break;
820  }
821 
822  for (R = Config.Refresh; R; R = R->next) {
823  if (!R->flags.ignore_private)
824  continue;
825 
826  debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
827 
828  break;
829  }
830  }
831 #endif
832 #if !USE_HTTP_VIOLATIONS
833  Config.onoff.via = 1;
834 #else
835 
836  if (!Config.onoff.via)
837  debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
838 
839 #endif
840 
841  // we enable runtime PURGE checks if there is at least one PURGE method ACL
842  // TODO: replace with a dedicated "purge" ACL option?
844 
845  if (geteuid() == 0) {
846  if (NULL != Config.effectiveUser) {
847 
848  struct passwd *pwd = getpwnam(Config.effectiveUser);
849 
850  if (NULL == pwd) {
851  /*
852  * Andres Kroonmaa <andre@online.ee>:
853  * Some getpwnam() implementations (Solaris?) require
854  * an available FD < 256 for opening a FILE* to the
855  * passwd file.
856  * DW:
857  * This should be safe at startup, but might still fail
858  * during reconfigure.
859  */
860  fatalf("getpwnam failed to find userid for effective user '%s'",
862  return;
863  }
864 
865  Config2.effectiveUserID = pwd->pw_uid;
866 
867  Config2.effectiveGroupID = pwd->pw_gid;
868 
869 #if HAVE_PUTENV
870  if (pwd->pw_dir && *pwd->pw_dir) {
871  // putenv() leaks by design; avoid leaks when nothing changes
872  static SBuf lastDir;
873  if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
874  lastDir = pwd->pw_dir;
875  int len = strlen(pwd->pw_dir) + 6;
876  char *env_str = (char *)xcalloc(len, 1);
877  snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
878  putenv(env_str);
879  }
880  }
881 #endif
882  }
883  } else {
884  Config2.effectiveUserID = geteuid();
885  Config2.effectiveGroupID = getegid();
886  }
887 
888  if (NULL != Config.effectiveGroup) {
889 
890  struct group *grp = getgrnam(Config.effectiveGroup);
891 
892  if (NULL == grp) {
893  fatalf("getgrnam failed to find groupid for effective group '%s'",
895  return;
896  }
897 
898  Config2.effectiveGroupID = grp->gr_gid;
899  }
900 
901 #if USE_OPENSSL
904 #endif
905 
906  if (Security::ProxyOutgoingConfig.encryptTransport) {
907  debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
910 #if USE_OPENSSL
911  fatal("ERROR: Could not initialize https:// proxy context");
912 #else
913  debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
914 #endif
915  }
916 #if USE_OPENSSL
918 #endif
919  }
920 
921  for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
922 
923  // default value for ssldomain= is the peer host/IP
924  if (p->secure.sslDomain.isEmpty())
925  p->secure.sslDomain = p->host;
926 
927  if (p->secure.encryptTransport) {
928  debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
929  p->sslContext = p->secure.createClientContext(true);
930  if (!p->sslContext) {
931  debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
932  self_destruct();
933  return;
934  }
935  }
936  }
937 
938  for (AnyP::PortCfgPointer s = HttpPortList; s != NULL; s = s->next) {
939  if (!s->secure.encryptTransport)
940  continue;
941  debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS contexts");
942  s->secure.initServerContexts(*s);
943  }
944 
945  // prevent infinite fetch loops in the request parser
946  // due to buffer full but not enough data received to finish parse
948  fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
949  " Change client_request_buffer_max or request_header_max_size limits.",
951  }
952 
953  /*
954  * Disable client side request pipelining if client_persistent_connections OFF.
955  * Waste of resources queueing any pipelined requests when the first will close the connection.
956  */
958  debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
959  " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
961  }
962 
963 #if USE_AUTH
964  /*
965  * disable client side request pipelining. There is a race with
966  * Negotiate and NTLM when the client sends a second request on an
967  * connection before the authenticate challenge is sent. With
968  * pipelining OFF, the client may fail to authenticate, but squid's
969  * state will be preserved.
970  */
971  if (Config.pipeline_max_prefetch > 0) {
972  Auth::SchemeConfig *nego = Auth::SchemeConfig::Find("Negotiate");
974  if ((nego && nego->active()) || (ntlm && ntlm->active())) {
975  debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
977  }
978  }
979 
980  for (auto &authSchemes : Auth::TheConfig.schemeLists) {
981  authSchemes.expand();
982  if (authSchemes.authConfigs.empty()) {
983  debugs(3, DBG_CRITICAL, "auth_schemes: at least one scheme name is required; got: " << authSchemes.rawSchemes);
984  self_destruct();
985  }
986  }
987 #endif
988 }
989 
996 void
997 parse_obsolete(const char *name)
998 {
999  // Directives which have been radically changed rather than removed
1000  if (!strcmp(name, "url_rewrite_concurrency")) {
1001  int cval;
1002  parse_int(&cval);
1003  debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
1005  }
1006 
1007  if (!strcmp(name, "log_access")) {
1008  self_destruct();
1009  return;
1010  }
1011 
1012  if (!strcmp(name, "log_icap")) {
1013  self_destruct();
1014  return;
1015  }
1016 
1017  if (!strcmp(name, "ignore_ims_on_miss")) {
1018  // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
1019  // than the 2.7 directive. We need to parse and invert the configured value.
1020  int temp = 0;
1021  parse_onoff(&temp);
1023  }
1024 
1025  if (!strncmp(name, "sslproxy_", 9)) {
1026  // the replacement directive tls_outgoing_options uses options instead of whole-line input
1027  SBuf tmp;
1028  if (!strcmp(name, "sslproxy_cafile"))
1029  tmp.append("cafile=");
1030  else if (!strcmp(name, "sslproxy_capath"))
1031  tmp.append("capath=");
1032  else if (!strcmp(name, "sslproxy_cipher"))
1033  tmp.append("cipher=");
1034  else if (!strcmp(name, "sslproxy_client_certificate"))
1035  tmp.append("cert=");
1036  else if (!strcmp(name, "sslproxy_client_key"))
1037  tmp.append("key=");
1038  else if (!strcmp(name, "sslproxy_flags"))
1039  tmp.append("flags=");
1040  else if (!strcmp(name, "sslproxy_options"))
1041  tmp.append("options=");
1042  else if (!strcmp(name, "sslproxy_version"))
1043  tmp.append("version=");
1044  else {
1045  debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1046  self_destruct();
1047  return;
1048  }
1049 
1050  // add the value as unquoted-string because the old values did not support whitespace
1051  const char *token = ConfigParser::NextQuotedOrToEol();
1052  tmp.append(token, strlen(token));
1054  }
1055 }
1056 
1057 template <class MinimalUnit>
1058 static const char *
1060 {
1061  const auto minUnit = MinimalUnit(1);
1062  if(minUnit == std::chrono::nanoseconds(1))
1063  return T_NANOSECOND_STR;
1064  else if (minUnit == std::chrono::microseconds(1))
1065  return T_MICROSECOND_STR;
1066  else if (minUnit == std::chrono::milliseconds(1))
1067  return T_MILLISECOND_STR;
1068  else {
1069  assert(minUnit >= std::chrono::seconds(1));
1070  return T_SECOND_STR;
1071  }
1072 }
1073 
1079 template <class MinimalUnit>
1080 static bool
1081 parseTimeUnit(const char *unitName, std::chrono::nanoseconds &ns)
1082 {
1083  if (!unitName)
1084  throw TexcHere("missing time unit");
1085 
1086  if (!strncasecmp(unitName, T_NANOSECOND_STR, strlen(T_NANOSECOND_STR)))
1087  ns = std::chrono::nanoseconds(1);
1088  else if (!strncasecmp(unitName, T_MICROSECOND_STR, strlen(T_MICROSECOND_STR)))
1089  ns = std::chrono::microseconds(1);
1090  else if (!strncasecmp(unitName, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1091  ns = std::chrono::milliseconds(1);
1092  else if (!strncasecmp(unitName, T_SECOND_STR, strlen(T_SECOND_STR)))
1093  ns = std::chrono::seconds(1);
1094  else if (!strncasecmp(unitName, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1095  ns = std::chrono::minutes(1);
1096  else if (!strncasecmp(unitName, T_HOUR_STR, strlen(T_HOUR_STR)))
1097  ns = std::chrono::hours(1);
1098  else if (!strncasecmp(unitName, T_DAY_STR, strlen(T_DAY_STR)))
1099  ns = std::chrono::hours(24);
1100  else if (!strncasecmp(unitName, T_WEEK_STR, strlen(T_WEEK_STR)))
1101  ns = std::chrono::hours(24 * 7);
1102  else if (!strncasecmp(unitName, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1103  ns = std::chrono::hours(24 * 14);
1104  else if (!strncasecmp(unitName, T_MONTH_STR, strlen(T_MONTH_STR)))
1105  ns = std::chrono::hours(24 * 30);
1106  else if (!strncasecmp(unitName, T_YEAR_STR, strlen(T_YEAR_STR)))
1107  ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear));
1108  else if (!strncasecmp(unitName, T_DECADE_STR, strlen(T_DECADE_STR)))
1109  ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear * 10));
1110  else
1111  return false;
1112 
1113  if (ns < MinimalUnit(1)) {
1114  throw TexcHere(ToSBuf("time unit '", unitName, "' is too small to be used in this context, the minimal unit is ",
1115  TimeUnitToString<MinimalUnit>()));
1116  }
1117 
1118  return true;
1119 }
1120 
1121 static std::chrono::nanoseconds
1122 ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
1123 {
1124  if (value < 0.0)
1125  throw TexcHere("time must have a positive value");
1126 
1127  if (value > (static_cast<double>(std::chrono::nanoseconds::max().count()) / unit.count())) {
1128  const auto maxYears = std::chrono::duration_cast<std::chrono::hours>(std::chrono::nanoseconds::max()).count()/HoursPerYear;
1129  throw TexcHere(ToSBuf("time values cannot exceed ", maxYears, " years"));
1130  }
1131 
1132  return std::chrono::duration_cast<std::chrono::nanoseconds>(unit * value);
1133 }
1134 
1135 template <class TimeUnit>
1136 static TimeUnit
1137 FromNanoseconds(const std::chrono::nanoseconds &ns, const double parsedValue)
1138 {
1139  const auto result = std::chrono::duration_cast<TimeUnit>(ns);
1140  if (!result.count()) {
1141  throw TexcHere(ToSBuf("time value '", parsedValue,
1142  "' is too small to be used in this context, the minimal value is 1 ",
1143  TimeUnitToString<TimeUnit>()));
1144  }
1145  return result;
1146 }
1147 
1150 template <class TimeUnit>
1151 static TimeUnit
1153 {
1154  const auto valueToken = ConfigParser::NextToken();
1155  if (!valueToken)
1156  throw TexcHere("cannot read a time value");
1157 
1158  const auto parsedValue = xatof(valueToken);
1159 
1160  if (parsedValue == 0)
1161  return TimeUnit::zero();
1162 
1163  std::chrono::nanoseconds parsedUnitDuration;
1164 
1165  const auto token = ConfigParser::PeekAtToken();
1166 
1167  if (!parseTimeUnit<TimeUnit>(token, parsedUnitDuration))
1168  throw TexcHere(ToSBuf("unknown time unit '", token, "'"));
1169 
1170  (void)ConfigParser::NextToken();
1171 
1172  const auto nanoseconds = ToNanoSeconds(parsedValue, parsedUnitDuration);
1173 
1174  // validate precisions (time-units-small only)
1175  if (TimeUnit(1) <= std::chrono::microseconds(1)) {
1176  if (0 < nanoseconds.count() && nanoseconds.count() < 3) {
1178  "Squid time measurement precision is likely to be far worse than " <<
1179  "the nanosecond-level precision implied by the configured value: " << parsedValue << ' ' << token);
1180  }
1181  }
1182 
1183  return FromNanoseconds<TimeUnit>(nanoseconds, parsedValue);
1184 }
1185 
1186 static void
1187 parseBytesLine64(int64_t * bptr, const char *units)
1188 {
1189  char *token;
1190  double d;
1191  int64_t m;
1192  int64_t u;
1193 
1194  if ((u = parseBytesUnits(units)) == 0) {
1195  self_destruct();
1196  return;
1197  }
1198 
1199  if ((token = ConfigParser::NextToken()) == NULL) {
1200  self_destruct();
1201  return;
1202  }
1203 
1204  if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1205  *bptr = -1;
1206  return;
1207  }
1208 
1209  d = xatof(token);
1210 
1211  m = u; /* default to 'units' if none specified */
1212 
1213  if (0.0 == d)
1214  (void) 0;
1215  else if ((token = ConfigParser::NextToken()) == NULL)
1216  debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1217  config_input_line << "', assuming " <<
1218  d << " " << units );
1219  else if ((m = parseBytesUnits(token)) == 0) {
1220  self_destruct();
1221  return;
1222  }
1223 
1224  *bptr = static_cast<int64_t>(m * d / u);
1225 
1226  if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1227  debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1228  d << " " << token << ": integer overflow (int64_t).");
1229  self_destruct();
1230  }
1231 }
1232 
1233 static void
1234 parseBytesLine(size_t * bptr, const char *units)
1235 {
1236  char *token;
1237  double d;
1238  int m;
1239  int u;
1240 
1241  if ((u = parseBytesUnits(units)) == 0) {
1242  self_destruct();
1243  return;
1244  }
1245 
1246  if ((token = ConfigParser::NextToken()) == NULL) {
1247  self_destruct();
1248  return;
1249  }
1250 
1251  if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1252  *bptr = static_cast<size_t>(-1);
1253  return;
1254  }
1255 
1256  d = xatof(token);
1257 
1258  m = u; /* default to 'units' if none specified */
1259 
1260  if (0.0 == d)
1261  (void) 0;
1262  else if ((token = ConfigParser::NextToken()) == NULL)
1263  debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1264  config_input_line << "', assuming " <<
1265  d << " " << units );
1266  else if ((m = parseBytesUnits(token)) == 0) {
1267  self_destruct();
1268  return;
1269  }
1270 
1271  *bptr = static_cast<size_t>(m * d / u);
1272 
1273  if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1274  debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1275  d << " " << token << ": integer overflow (size_t).");
1276  self_destruct();
1277  }
1278 }
1279 
1280 static void
1281 parseBytesLineSigned(ssize_t * bptr, const char *units)
1282 {
1283  char *token;
1284  double d;
1285  int m;
1286  int u;
1287 
1288  if ((u = parseBytesUnits(units)) == 0) {
1289  self_destruct();
1290  return;
1291  }
1292 
1293  if ((token = ConfigParser::NextToken()) == NULL) {
1294  self_destruct();
1295  return;
1296  }
1297 
1298  if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1299  *bptr = -1;
1300  return;
1301  }
1302 
1303  d = xatof(token);
1304 
1305  m = u; /* default to 'units' if none specified */
1306 
1307  if (0.0 == d)
1308  (void) 0;
1309  else if ((token = ConfigParser::NextToken()) == NULL)
1310  debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1311  config_input_line << "', assuming " <<
1312  d << " " << units );
1313  else if ((m = parseBytesUnits(token)) == 0) {
1314  self_destruct();
1315  return;
1316  }
1317 
1318  *bptr = static_cast<ssize_t>(m * d / u);
1319 
1320  if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1321  debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1322  d << " " << token << ": integer overflow (ssize_t).");
1323  self_destruct();
1324  }
1325 }
1326 
1332 void
1333 parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1334 {
1335  int u;
1336  if ((u = parseBytesUnits(units)) == 0) {
1337  self_destruct();
1338  return;
1339  }
1340 
1341  // Find number from string beginning.
1342  char const * number_begin = value;
1343  char const * number_end = value;
1344 
1345  while ((*number_end >= '0' && *number_end <= '9')) {
1346  ++number_end;
1347  }
1348 
1349  String number;
1350  number.assign(number_begin, number_end - number_begin);
1351 
1352  int d = xatoi(number.termedBuf());
1353  int m;
1354  if ((m = parseBytesUnits(number_end)) == 0) {
1355  self_destruct();
1356  return;
1357  }
1358 
1359  *bptr = static_cast<size_t>(m * d / u);
1360  if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1361  self_destruct();
1362 }
1363 
1364 static size_t
1365 parseBytesUnits(const char *unit)
1366 {
1367  if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1368  return 1;
1369 
1370  if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1371  return 1 << 10;
1372 
1373  if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1374  return 1 << 20;
1375 
1376  if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1377  return 1 << 30;
1378 
1379  debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1380 
1381  return 0;
1382 }
1383 
1384 static void
1386 {
1387  while (char *token = ConfigParser::NextQuotedToken())
1388  list->push_back(SBuf(token));
1389 }
1390 
1391 // just dump a list, no directive name
1392 static void
1393 dump_SBufList(StoreEntry * entry, const SBufList &words)
1394 {
1395  for (const auto &i : words) {
1396  entry->append(i.rawContent(), i.length());
1397  entry->append(" ",1);
1398  }
1399  entry->append("\n",1);
1400 }
1401 
1402 // dump a SBufList type directive with name
1403 static void
1404 dump_SBufList(StoreEntry * entry, const char *name, SBufList &list)
1405 {
1406  if (!list.empty()) {
1407  entry->append(name, strlen(name));
1408  entry->append(" ", 1);
1409  dump_SBufList(entry, list);
1410  }
1411 }
1412 
1413 static void
1415 {
1416  if (list)
1417  list->clear();
1418 }
1419 
1420 static void
1421 dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1422 {
1423  while (ae != NULL) {
1424  debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1425  storeAppendPrintf(entry, "%s %s %s ",
1426  name,
1427  ae->name,
1428  ae->typeString());
1429  SBufList tail;
1430  tail.splice(tail.end(), ae->dumpOptions());
1431  tail.splice(tail.end(), ae->dump()); // ACL parameters
1432  dump_SBufList(entry, tail);
1433  ae = ae->next;
1434  }
1435 }
1436 
1437 static void
1439 {
1441 }
1442 
1443 static void
1445 {
1446  aclDestroyAcls(ae);
1447 }
1448 
1449 void
1451 {
1452  dump_SBufList(entry, head->dump());
1453 }
1454 
1455 void
1456 dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1457 {
1458  if (head)
1459  dump_SBufList(entry, head->treeDump(name, &Acl::AllowOrDeny));
1460 }
1461 
1462 static void
1464 {
1466 }
1467 
1468 static void
1470 {
1472 }
1473 
1474 static void
1475 dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1476 {
1477  char buf[MAX_IPSTRLEN];
1478  storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1479 }
1480 
1481 static void
1483 {
1484  char *token = ConfigParser::NextToken();
1485 
1486  if (!token) {
1487  self_destruct();
1488  return;
1489  }
1490 
1491  if (!strcmp(token,"any_addr"))
1492  addr->setAnyAddr();
1493  else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1494  addr->setNoAddr();
1495  else if ( (*addr = token) ) // try parse numeric/IPA
1496  (void) 0;
1497  else if (addr->GetHostByName(token)) // do not use ipcache
1498  (void) 0;
1499  else { // not an IP and not a hostname
1500  debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1501  self_destruct();
1502  }
1503 }
1504 
1505 static void
1507 {
1508  addr->setEmpty();
1509 }
1510 
1511 static void
1512 dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1513 {
1514  char buf[MAX_IPSTRLEN];
1515 
1516  for (Acl::Address *l = head; l; l = l->next) {
1517  if (!l->addr.isAnyAddr())
1518  storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1519  else
1520  storeAppendPrintf(entry, "%s autoselect", name);
1521 
1522  dump_acl_list(entry, l->aclList);
1523 
1524  storeAppendPrintf(entry, "\n");
1525  }
1526 }
1527 
1528 static void
1530 {
1531  Acl::Address *l = new Acl::Address;
1532  parse_address(&l->addr);
1534 
1535  Acl::Address **tail = head;
1536  while (*tail)
1537  tail = &(*tail)->next;
1538 
1539  *tail = l;
1540 }
1541 
1542 static void
1544 {
1545  delete *head;
1546  *head = NULL;
1547 }
1548 
1549 static void
1550 dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1551 {
1552  acl_tos *l;
1553 
1554  for (l = head; l; l = l->next) {
1555  if (l->tos > 0)
1556  storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1557  else
1558  storeAppendPrintf(entry, "%s none", name);
1559 
1560  dump_acl_list(entry, l->aclList);
1561 
1562  storeAppendPrintf(entry, "\n");
1563  }
1564 }
1565 
1566 static void
1568 {
1569  unsigned int tos; /* Initially uint for strtoui. Casted to tos_t before return */
1570  char *token = ConfigParser::NextToken();
1571 
1572  if (!token) {
1573  self_destruct();
1574  return;
1575  }
1576 
1577  if (!xstrtoui(token, NULL, &tos, 0, std::numeric_limits<tos_t>::max())) {
1578  self_destruct();
1579  return;
1580  }
1581 
1582  const unsigned int chTos = tos & 0xFC;
1583  if (chTos != tos) {
1584  debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1585  tos = chTos;
1586  }
1587 
1588  acl_tos *l = new acl_tos;
1589 
1590  l->tos = (tos_t)tos;
1591 
1592  aclParseAclList(LegacyParser, &l->aclList, token);
1593 
1594  acl_tos **tail = head; /* sane name below */
1595  while (*tail)
1596  tail = &(*tail)->next;
1597 
1598  *tail = l;
1599 }
1600 
1601 static void
1603 {
1604  delete *head;
1605  *head = NULL;
1606 }
1607 
1608 #if SO_MARK && USE_LIBCAP
1609 
1610 static void
1611 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1612 {
1613  for (acl_nfmark *l = head; l; l = l->next) {
1614  storeAppendPrintf(entry, "%s %s", name, ToSBuf(l->markConfig).c_str());
1615 
1616  dump_acl_list(entry, l->aclList);
1617 
1618  storeAppendPrintf(entry, "\n");
1619  }
1620 }
1621 
1622 static void
1623 parse_acl_nfmark(acl_nfmark ** head)
1624 {
1625  SBuf token(ConfigParser::NextToken());
1626  const auto mc = Ip::NfMarkConfig::Parse(token);
1627 
1628  // Packet marking directives should not allow to use masks.
1629  const auto pkt_dirs = {"mark_client_packet", "clientside_mark", "tcp_outgoing_mark"};
1630  if (mc.hasMask() && std::find(pkt_dirs.begin(), pkt_dirs.end(), cfg_directive) != pkt_dirs.end())
1631  throw TexcHere(ToSBuf("'", cfg_directive, "' does not support masked marks"));
1632 
1633  acl_nfmark *l = new acl_nfmark;
1634  l->markConfig = mc;
1635 
1636  aclParseAclList(LegacyParser, &l->aclList, token.c_str());
1637 
1638  acl_nfmark **tail = head; /* sane name below */
1639  while (*tail)
1640  tail = &(*tail)->next;
1641 
1642  *tail = l;
1643 }
1644 
1645 static void
1646 free_acl_nfmark(acl_nfmark ** head)
1647 {
1648  delete *head;
1649  *head = NULL;
1650 }
1651 #endif /* SO_MARK */
1652 
1653 static void
1654 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1655 {
1656  for (AclSizeLimit *l = head; l; l = l->next) {
1657  if (l->size != -1)
1658  storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1659  else
1660  storeAppendPrintf(entry, "%s none", name);
1661 
1662  dump_acl_list(entry, l->aclList);
1663 
1664  storeAppendPrintf(entry, "\n");
1665  }
1666 }
1667 
1668 static void
1670 {
1671  AclSizeLimit *l = new AclSizeLimit;
1672 
1673  parse_b_int64_t(&l->size);
1674 
1676 
1677  AclSizeLimit **tail = head; /* sane name below */
1678  while (*tail)
1679  tail = &(*tail)->next;
1680 
1681  *tail = l;
1682 }
1683 
1684 static void
1686 {
1687  delete *head;
1688  *head = NULL;
1689 }
1690 
1691 #if USE_DELAY_POOLS
1692 
1693 #include "DelayConfig.h"
1694 #include "DelayPools.h"
1695 /* do nothing - free_delay_pool_count is the magic free function.
1696  * this is why delay_pool_count isn't just marked TYPE: u_short
1697  */
1698 #define free_delay_pool_class(X)
1699 #define free_delay_pool_access(X)
1700 #define free_delay_pool_rates(X)
1701 #define dump_delay_pool_class(X, Y, Z)
1702 #define dump_delay_pool_access(X, Y, Z)
1703 #define dump_delay_pool_rates(X, Y, Z)
1704 
1705 static void
1707 {
1708  cfg->freePoolCount();
1709 }
1710 
1711 static void
1712 dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1713 {
1714  cfg.dumpPoolCount (entry, name);
1715 }
1716 
1717 static void
1719 {
1720  cfg->parsePoolCount();
1721 }
1722 
1723 static void
1725 {
1726  cfg->parsePoolClass();
1727 }
1728 
1729 static void
1731 {
1732  cfg->parsePoolRates();
1733 }
1734 
1735 static void
1737 {
1739 }
1740 
1741 #endif
1742 
1743 #if USE_DELAY_POOLS
1744 #include "ClientDelayConfig.h"
1745 /* do nothing - free_client_delay_pool_count is the magic free function.
1746  * this is why client_delay_pool_count isn't just marked TYPE: u_short
1747  */
1748 
1749 #define free_client_delay_pool_access(X)
1750 #define free_client_delay_pool_rates(X)
1751 #define dump_client_delay_pool_access(X, Y, Z)
1752 #define dump_client_delay_pool_rates(X, Y, Z)
1753 
1754 static void
1756 {
1757  cfg->freePools();
1758 }
1759 
1760 static void
1762 {
1763  cfg.dumpPoolCount (entry, name);
1764 }
1765 
1766 static void
1768 {
1769  cfg->parsePoolCount();
1770 }
1771 
1772 static void
1774 {
1775  cfg->parsePoolRates();
1776 }
1777 
1778 static void
1780 {
1782 }
1783 #endif
1784 
1785 #if USE_HTTP_VIOLATIONS
1786 static void
1787 dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1788 {
1789  if (manglers)
1790  manglers->dumpAccess(entry, name);
1791 }
1792 
1793 static void
1795 {
1796  char *t = NULL;
1797 
1798  if ((t = ConfigParser::NextToken()) == NULL) {
1799  debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1800  debugs(3, DBG_CRITICAL, "parse_http_header_access: missing header name.");
1801  return;
1802  }
1803 
1804  if (!*pm)
1805  *pm = new HeaderManglers;
1806  HeaderManglers *manglers = *pm;
1807  headerMangler *mangler = manglers->track(t);
1808  assert(mangler);
1809 
1810  std::string directive = "http_header_access ";
1811  directive += t;
1812  aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1813 }
1814 
1815 static void
1817 {
1818  // we delete the entire http_header_* mangler configuration at once
1819  if (const HeaderManglers *manglers = *pm) {
1820  delete manglers;
1821  *pm = NULL;
1822  }
1823 }
1824 
1825 static void
1826 dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1827 {
1828  if (manglers)
1829  manglers->dumpReplacement(entry, name);
1830 }
1831 
1832 static void
1834 {
1835  char *t = NULL;
1836 
1837  if ((t = ConfigParser::NextToken()) == NULL) {
1838  debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1839  debugs(3, DBG_CRITICAL, "parse_http_header_replace: missing header name.");
1840  return;
1841  }
1842 
1843  const char *value = ConfigParser::NextQuotedOrToEol();
1844 
1845  if (!*pm)
1846  *pm = new HeaderManglers;
1847  HeaderManglers *manglers = *pm;
1848  manglers->setReplacement(t, value);
1849 }
1850 
1851 #endif
1852 
1853 static void
1854 dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1855 {
1856  SwapDir *s;
1857  int i;
1858  assert (entry);
1859 
1860  for (i = 0; i < swap.n_configured; ++i) {
1861  s = dynamic_cast<SwapDir *>(swap.swapDirs[i].getRaw());
1862  if (!s) continue;
1863  storeAppendPrintf(entry, "%s %s %s", name, s->type(), s->path);
1864  s->dump(*entry);
1865  storeAppendPrintf(entry, "\n");
1866  }
1867 }
1868 
1869 static int
1871 {
1872  return s == NULL;
1873 }
1874 
1875 #if USE_AUTH
1876 static void
1878 {
1879  char *type_str = ConfigParser::NextToken();
1880  if (!type_str) {
1881  self_destruct();
1882  return;
1883  }
1884 
1885  char *param_str = ConfigParser::NextToken();
1886  if (!param_str) {
1887  self_destruct();
1888  return;
1889  }
1890 
1891  /* find a configuration for the scheme in the currently parsed configs... */
1892  Auth::SchemeConfig *schemeCfg = Auth::SchemeConfig::Find(type_str);
1893 
1894  if (schemeCfg == NULL) {
1895  /* Create a configuration based on the scheme info */
1896  Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1897 
1898  if (theScheme == NULL) {
1899  debugs(3, DBG_CRITICAL, "Parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1900  self_destruct();
1901  return;
1902  }
1903 
1904  config->push_back(theScheme->createConfig());
1905  schemeCfg = Auth::SchemeConfig::Find(type_str);
1906  if (schemeCfg == NULL) {
1907  debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1908  self_destruct();
1909  return;
1910  }
1911  }
1912 
1913  schemeCfg->parse(schemeCfg, config->size(), param_str);
1914 }
1915 
1916 static void
1918 {
1919  /* Wipe the Auth globals and Detach/Destruct component config + state. */
1920  cfg->clear();
1921 
1922  /* on reconfigure initialize new auth schemes for the new config. */
1923  if (reconfiguring) {
1924  Auth::Init();
1925  }
1926 }
1927 
1928 static void
1929 dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1930 {
1931  for (auto *scheme : cfg)
1932  scheme->dump(entry, name, scheme);
1933 }
1934 
1935 static void
1937 {
1938  const char *tok = ConfigParser::NextQuotedToken();
1939  if (!tok) {
1940  debugs(29, DBG_CRITICAL, "FATAL: auth_schemes missing the parameter");
1941  self_destruct();
1942  return;
1943  }
1945  const auto action = Acl::Answer(ACCESS_ALLOWED, Auth::TheConfig.schemeLists.size() - 1);
1946  ParseAclWithAction(authSchemes, action, "auth_schemes");
1947 }
1948 
1949 static void
1951 {
1952  Auth::TheConfig.schemeLists.clear();
1953  free_acl_access(authSchemes);
1954 }
1955 
1956 static void
1957 dump_AuthSchemes(StoreEntry *entry, const char *name, acl_access *authSchemes)
1958 {
1959  if (authSchemes)
1960  dump_SBufList(entry, authSchemes->treeDump(name, [](const Acl::Answer &action) {
1961  return Auth::TheConfig.schemeLists.at(action.kind).rawSchemes;
1962  }));
1963 }
1964 
1965 #endif /* USE_AUTH */
1966 
1967 static void
1968 ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl)
1969 {
1970  assert(access);
1971  SBuf name;
1972  if (!*access) {
1973  *access = new Acl::Tree;
1974  name.Printf("(%s rules)", desc);
1975  (*access)->context(name.c_str(), config_input_line);
1976  }
1977  Acl::AndNode *rule = new Acl::AndNode;
1978  name.Printf("(%s rule)", desc);
1979  rule->context(name.c_str(), config_input_line);
1980  acl ? rule->add(acl) : rule->lineParse();
1981  (*access)->add(rule, action);
1982 }
1983 
1984 /* TODO: just return the object, the # is irrelevant */
1985 static int
1987 {
1988  for (size_t i = 0; i < StoreFileSystem::FileSystems().size(); ++i)
1989  if (strcasecmp(type, StoreFileSystem::FileSystems().at(i)->type()) == 0)
1990  return (int)i;
1991 
1992  return (-1);
1993 }
1994 
1995 static void
1997 {
1998  char *type_str = ConfigParser::NextToken();
1999  if (!type_str) {
2000  self_destruct();
2001  return;
2002  }
2003 
2004  char *path_str = ConfigParser::NextToken();
2005  if (!path_str) {
2006  self_destruct();
2007  return;
2008  }
2009 
2010  int fs = find_fstype(type_str);
2011  if (fs < 0) {
2012  debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: This proxy does not support the '" << type_str << "' cache type. Ignoring.");
2013  return;
2014  }
2015 
2016  /* reconfigure existing dir */
2017 
2018  RefCount<SwapDir> sd;
2019  for (int i = 0; i < swap->n_configured; ++i) {
2020  assert (swap->swapDirs[i].getRaw());
2021 
2022  if ((strcasecmp(path_str, dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw())->path)) == 0) {
2023  /* this is specific to on-fs Stores. The right
2024  * way to handle this is probably to have a mapping
2025  * from paths to stores, and have on-fs stores
2026  * register with that, and lookip in that in their
2027  * own setup logic. RBC 20041225. TODO.
2028  */
2029 
2030  sd = dynamic_cast<SwapDir *>(swap->swapDirs[i].getRaw());
2031 
2032  if (strcmp(sd->type(), StoreFileSystem::FileSystems().at(fs)->type()) != 0) {
2033  debugs(3, DBG_CRITICAL, "ERROR: Can't change type of existing cache_dir " <<
2034  sd->type() << " " << sd->path << " to " << type_str << ". Restart required");
2035  return;
2036  }
2037 
2038  sd->reconfigure();
2039  return;
2040  }
2041  }
2042 
2043  /* new cache_dir */
2044  if (swap->n_configured > 63) {
2045  /* 7 bits, signed */
2046  debugs(3, DBG_CRITICAL, "WARNING: There is a fixed maximum of 63 cache_dir entries Squid can handle.");
2047  debugs(3, DBG_CRITICAL, "WARNING: '" << path_str << "' is one to many.");
2048  self_destruct();
2049  return;
2050  }
2051 
2052  allocate_new_swapdir(swap);
2053 
2054  swap->swapDirs[swap->n_configured] = StoreFileSystem::FileSystems().at(fs)->createSwapDir();
2055 
2056  sd = dynamic_cast<SwapDir *>(swap->swapDirs[swap->n_configured].getRaw());
2057 
2058  /* parse the FS parameters and options */
2059  sd->parse(swap->n_configured, path_str);
2060 
2061  ++swap->n_configured;
2062 }
2063 
2064 static const char *
2066 {
2067  const char * result;
2068 
2069  switch (type) {
2070 
2071  case PEER_PARENT:
2072  result = "parent";
2073  break;
2074 
2075  case PEER_SIBLING:
2076  result = "sibling";
2077  break;
2078 
2079  case PEER_MULTICAST:
2080  result = "multicast";
2081  break;
2082 
2083  default:
2084  result = "unknown";
2085  break;
2086  }
2087 
2088  return result;
2089 }
2090 
2091 static void
2092 dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
2093 {
2095  LOCAL_ARRAY(char, xname, 128);
2096 
2097  while (p != NULL) {
2098  storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
2099  name,
2100  p->host,
2101  neighborTypeStr(p),
2102  p->http_port,
2103  p->icp.port,
2104  p->name);
2105  dump_peer_options(entry, p);
2106 
2107  if (p->access) {
2108  snprintf(xname, 128, "cache_peer_access %s", p->name);
2109  dump_acl_access(entry, xname, p->access);
2110  }
2111 
2112  for (t = p->typelist; t; t = t->next) {
2113  storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
2114  p->host,
2115  peer_type_str(t->type),
2116  t->domain);
2117  }
2118 
2119  p = p->next;
2120  }
2121 }
2122 
2127 static bool
2128 isUnsignedNumeric(const char *str, size_t len)
2129 {
2130  if (len < 1) return false;
2131 
2132  for (; len >0 && *str; ++str, --len) {
2133  if (! isdigit(*str))
2134  return false;
2135  }
2136  return true;
2137 }
2138 
2143 static unsigned short
2144 GetService(const char *proto)
2145 {
2146  struct servent *port = NULL;
2148  char *token = ConfigParser::NextToken();
2149  if (token == NULL) {
2150  self_destruct();
2151  return 0; /* NEVER REACHED */
2152  }
2154  if ( !isUnsignedNumeric(token, strlen(token)) )
2155  port = getservbyname(token, proto);
2156  if (port != NULL) {
2157  return ntohs((unsigned short)port->s_port);
2158  }
2160  return xatos(token);
2161 }
2162 
2167 inline unsigned short
2169 {
2170  return GetService("tcp");
2171 }
2172 
2177 inline unsigned short
2179 {
2180  return GetService("udp");
2181 }
2182 
2183 static void
2185 {
2186  char *host_str = ConfigParser::NextToken();
2187  if (!host_str) {
2188  self_destruct();
2189  return;
2190  }
2191 
2192  char *token = ConfigParser::NextToken();
2193  if (!token) {
2194  self_destruct();
2195  return;
2196  }
2197 
2198  CachePeer *p = new CachePeer;
2199  p->host = xstrdup(host_str);
2200  Tolower(p->host);
2201  p->name = xstrdup(host_str);
2202  p->type = parseNeighborType(token);
2203 
2204  if (p->type == PEER_MULTICAST) {
2205  p->options.no_digest = true;
2206  p->options.no_netdb_exchange = true;
2207  }
2208 
2209  p->http_port = GetTcpService();
2210 
2211  if (!p->http_port) {
2212  delete p;
2213  self_destruct();
2214  return;
2215  }
2216 
2217  p->icp.port = GetUdpService();
2218 
2219  while ((token = ConfigParser::NextToken())) {
2220  if (!strcmp(token, "proxy-only")) {
2221  p->options.proxy_only = true;
2222  } else if (!strcmp(token, "no-query")) {
2223  p->options.no_query = true;
2224  } else if (!strcmp(token, "background-ping")) {
2225  p->options.background_ping = true;
2226  } else if (!strcmp(token, "no-digest")) {
2227  p->options.no_digest = true;
2228  } else if (!strcmp(token, "no-tproxy")) {
2229  p->options.no_tproxy = true;
2230  } else if (!strcmp(token, "multicast-responder")) {
2231  p->options.mcast_responder = true;
2232 #if PEER_MULTICAST_SIBLINGS
2233  } else if (!strcmp(token, "multicast-siblings")) {
2234  p->options.mcast_siblings = true;
2235 #endif
2236  } else if (!strncmp(token, "weight=", 7)) {
2237  p->weight = xatoi(token + 7);
2238  } else if (!strncmp(token, "basetime=", 9)) {
2239  p->basetime = xatoi(token + 9);
2240  } else if (!strcmp(token, "closest-only")) {
2241  p->options.closest_only = true;
2242  } else if (!strncmp(token, "ttl=", 4)) {
2243  p->mcast.ttl = xatoi(token + 4);
2244 
2245  if (p->mcast.ttl < 0)
2246  p->mcast.ttl = 0;
2247 
2248  if (p->mcast.ttl > 128)
2249  p->mcast.ttl = 128;
2250  } else if (!strcmp(token, "default")) {
2251  p->options.default_parent = true;
2252  } else if (!strcmp(token, "round-robin")) {
2253  p->options.roundrobin = true;
2254  } else if (!strcmp(token, "weighted-round-robin")) {
2255  p->options.weighted_roundrobin = true;
2256 #if USE_HTCP
2257  } else if (!strcmp(token, "htcp")) {
2258  p->options.htcp = true;
2259  } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2260  /* Note: The htcp- form is deprecated, replaced by htcp= */
2261  p->options.htcp = true;
2262  char *tmp = xstrdup(token+5);
2263  char *mode, *nextmode;
2264  for (mode = nextmode = tmp; mode; mode = nextmode) {
2265  nextmode = strchr(mode, ',');
2266  if (nextmode) {
2267  *nextmode = '\0';
2268  ++nextmode;
2269  }
2270  if (!strcmp(mode, "no-clr")) {
2271  if (p->options.htcp_only_clr)
2272  fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2273  p->options.htcp_no_clr = true;
2274  } else if (!strcmp(mode, "no-purge-clr")) {
2275  p->options.htcp_no_purge_clr = true;
2276  } else if (!strcmp(mode, "only-clr")) {
2277  if (p->options.htcp_no_clr)
2278  fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2279  p->options.htcp_only_clr = true;
2280  } else if (!strcmp(mode, "forward-clr")) {
2281  p->options.htcp_forward_clr = true;
2282  } else if (!strcmp(mode, "oldsquid")) {
2283  p->options.htcp_oldsquid = true;
2284  } else {
2285  fatalf("invalid HTCP mode '%s'", mode);
2286  }
2287  }
2288  safe_free(tmp);
2289 #endif
2290  } else if (!strcmp(token, "no-netdb-exchange")) {
2291  p->options.no_netdb_exchange = true;
2292 
2293  } else if (!strcmp(token, "carp")) {
2294  if (p->type != PEER_PARENT)
2295  fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2296 
2297  p->options.carp = true;
2298  } else if (!strncmp(token, "carp-key=", 9)) {
2299  if (p->options.carp != true)
2300  fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2301  p->options.carp_key.set = true;
2302  char *nextkey=token+strlen("carp-key="), *key=nextkey;
2303  for (; key; key = nextkey) {
2304  nextkey=strchr(key,',');
2305  if (nextkey) ++nextkey; // skip the comma, any
2306  if (0==strncmp(key,"scheme",6)) {
2307  p->options.carp_key.scheme = true;
2308  } else if (0==strncmp(key,"host",4)) {
2309  p->options.carp_key.host = true;
2310  } else if (0==strncmp(key,"port",4)) {
2311  p->options.carp_key.port = true;
2312  } else if (0==strncmp(key,"path",4)) {
2313  p->options.carp_key.path = true;
2314  } else if (0==strncmp(key,"params",6)) {
2315  p->options.carp_key.params = true;
2316  } else {
2317  fatalf("invalid carp-key '%s'",key);
2318  }
2319  }
2320  } else if (!strcmp(token, "userhash")) {
2321 #if USE_AUTH
2322  if (p->type != PEER_PARENT)
2323  fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2324 
2325  p->options.userhash = true;
2326 #else
2327  fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2328 #endif
2329  } else if (!strcmp(token, "sourcehash")) {
2330  if (p->type != PEER_PARENT)
2331  fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2332 
2333  p->options.sourcehash = true;
2334 
2335  } else if (!strcmp(token, "no-delay")) {
2336 #if USE_DELAY_POOLS
2337  p->options.no_delay = true;
2338 #else
2339  debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2340 #endif
2341  } else if (!strncmp(token, "login=", 6)) {
2342  p->login = xstrdup(token + 6);
2343  rfc1738_unescape(p->login);
2344  } else if (!strcmp(token, "auth-no-keytab")) {
2345  p->options.auth_no_keytab = 1;
2346  } else if (!strncmp(token, "connect-timeout=", 16)) {
2347  p->connect_timeout_raw = xatoi(token + 16);
2348  } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2349  p->connect_fail_limit = xatoi(token + 19);
2350 #if USE_CACHE_DIGESTS
2351  } else if (!strncmp(token, "digest-url=", 11)) {
2352  p->digest_url = xstrdup(token + 11);
2353 #endif
2354 
2355  } else if (!strcmp(token, "allow-miss")) {
2356  p->options.allow_miss = true;
2357  } else if (!strncmp(token, "max-conn=", 9)) {
2358  p->max_conn = xatoi(token + 9);
2359  } else if (!strncmp(token, "standby=", 8)) {
2360  p->standby.limit = xatoi(token + 8);
2361  } else if (!strcmp(token, "originserver")) {
2362  p->options.originserver = true;
2363  } else if (!strncmp(token, "name=", 5)) {
2364  safe_free(p->name);
2365 
2366  if (token[5])
2367  p->name = xstrdup(token + 5);
2368  } else if (!strncmp(token, "forceddomain=", 13)) {
2369  safe_free(p->domain);
2370  if (token[13])
2371  p->domain = xstrdup(token + 13);
2372 
2373  } else if (strncmp(token, "ssl", 3) == 0) {
2374 #if !USE_OPENSSL
2375  debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2376 #else
2377  p->secure.parse(token+3);
2378 #endif
2379  } else if (strncmp(token, "tls-", 4) == 0) {
2380  p->secure.parse(token+4);
2381  } else if (strncmp(token, "tls", 3) == 0) {
2382  p->secure.parse(token+3);
2383  } else if (strcmp(token, "front-end-https") == 0) {
2384  p->front_end_https = 1;
2385  } else if (strcmp(token, "front-end-https=on") == 0) {
2386  p->front_end_https = 1;
2387  } else if (strcmp(token, "front-end-https=auto") == 0) {
2388  p->front_end_https = 2;
2389  } else if (strcmp(token, "connection-auth=off") == 0) {
2390  p->connection_auth = 0;
2391  } else if (strcmp(token, "connection-auth") == 0) {
2392  p->connection_auth = 1;
2393  } else if (strcmp(token, "connection-auth=on") == 0) {
2394  p->connection_auth = 1;
2395  } else if (strcmp(token, "connection-auth=auto") == 0) {
2396  p->connection_auth = 2;
2397  } else if (token[0] == '#') {
2398  // start of a text comment. stop reading this line.
2399  break;
2400  } else {
2401  debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2402  }
2403  }
2404 
2405  if (peerFindByName(p->name))
2406  fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2407 
2408  if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2409  fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2410 
2411  if (p->weight < 1)
2412  p->weight = 1;
2413 
2414  if (p->connect_fail_limit < 1)
2415  p->connect_fail_limit = 10;
2416 
2417 #if USE_CACHE_DIGESTS
2418  if (!p->options.no_digest)
2419  peerDigestCreate(p);
2420 #endif
2421 
2422  if (p->secure.encryptTransport)
2423  p->secure.parseOptions();
2424 
2425  p->index = ++Config.npeers;
2426 
2427  while (*head != NULL)
2428  head = &(*head)->next;
2429 
2430  *head = p;
2431 
2432  peerClearRRStart();
2433 }
2434 
2435 static void
2437 {
2438  delete *P;
2439  *P = NULL;
2440  Config.npeers = 0;
2441 }
2442 
2443 static void
2444 dump_cachemgrpasswd(StoreEntry * entry, const char *name, Mgr::ActionPasswordList * list)
2445 {
2446  while (list) {
2447  if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2448  storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2449  else
2450  storeAppendPrintf(entry, "%s %s", name, list->passwd);
2451 
2452  for (auto w : list->actions)
2453  entry->appendf(" " SQUIDSBUFPH, SQUIDSBUFPRINT(w));
2454 
2455  storeAppendPrintf(entry, "\n");
2456  list = list->next;
2457  }
2458 }
2459 
2460 static void
2462 {
2463  char *passwd = nullptr;
2464  parse_string(&passwd);
2465 
2467  p->passwd = passwd;
2468 
2469  while (char *token = ConfigParser::NextQuotedToken())
2470  p->actions.push_back(SBuf(token));
2471 
2473  for (P = head; *P; P = &(*P)->next) {
2474  /*
2475  * See if any of the actions from this line already have a
2476  * password from previous lines. The password checking
2477  * routines in cache_manager.c take the the password from
2478  * the first Mgr::ActionPasswordList that contains the
2479  * requested action. Thus, we should warn users who might
2480  * think they can have two passwords for the same action.
2481  */
2482  for (const auto &w : (*P)->actions) {
2483  for (const auto &u : p->actions) {
2484  if (w != u)
2485  continue;
2486 
2487  debugs(0, DBG_PARSE_NOTE(1), "ERROR: action '" << u << "' (line " << config_lineno << ") already has a password");
2488  }
2489  }
2490  }
2491 
2492  *P = p;
2493 }
2494 
2495 static void
2497 {
2498  delete *head;
2499  *head = nullptr;
2500 }
2501 
2502 static void
2503 dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2504 {
2505  while (var != NULL) {
2506  storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2507 
2508  for (const auto &aclName: var->acl_list)
2509  storeAppendPrintf(entry, " " SQUIDSBUFPH, SQUIDSBUFPRINT(aclName));
2510 
2511  storeAppendPrintf(entry, "\n");
2512 
2513  var = var->next;
2514  }
2515 }
2516 
2517 static void
2519 {
2520  aclParseDenyInfoLine(var);
2521 }
2522 
2523 void
2525 {
2526  delete *list;
2527  *list = nullptr;
2528 }
2529 
2530 static void
2532 {
2533  char *host = ConfigParser::NextToken();
2534  if (!host) {
2535  self_destruct();
2536  return;
2537  }
2538 
2539  CachePeer *p = peerFindByName(host);
2540  if (!p) {
2541  debugs(15, DBG_CRITICAL, "ERROR: " << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2542  return;
2543  }
2544 
2545  std::string directive = "peer_access ";
2546  directive += host;
2547  aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2548 }
2549 
2550 static void
2552 {
2553  char *host = ConfigParser::NextToken();
2554  if (!host) {
2555  self_destruct();
2556  return;
2557  }
2558 
2559  char *type = ConfigParser::NextToken();
2560  if (!type) {
2561  self_destruct();
2562  return;
2563  }
2564 
2565  char *domain = nullptr;
2566  while ((domain = ConfigParser::NextToken())) {
2567  CachePeer *p = peerFindByName(host);
2568  if (!p) {
2569  debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2570  return;
2571  }
2572 
2573  auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2574  l->type = parseNeighborType(type);
2575  l->domain = xstrdup(domain);
2576 
2577  NeighborTypeDomainList **L = nullptr;
2578  for (L = &(p->typelist); *L; L = &((*L)->next));
2579  *L = l;
2580  }
2581 }
2582 
2583 static void
2584 dump_int(StoreEntry * entry, const char *name, int var)
2585 {
2586  storeAppendPrintf(entry, "%s %d\n", name, var);
2587 }
2588 
2589 void
2590 parse_int(int *var)
2591 {
2592  int i;
2593  i = GetInteger();
2594  *var = i;
2595 }
2596 
2597 static void
2598 free_int(int *var)
2599 {
2600  *var = 0;
2601 }
2602 
2603 static void
2604 dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2605 {
2606  storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2607 }
2608 
2609 void
2610 parse_int64_t(int64_t *var)
2611 {
2612  int64_t i;
2613  i = GetInteger64();
2614  *var = i;
2615 }
2616 
2617 static void
2618 free_int64_t(int64_t *var)
2619 {
2620  *var = 0;
2621 }
2622 
2623 static void
2624 dump_onoff(StoreEntry * entry, const char *name, int var)
2625 {
2626  storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2627 }
2628 
2629 void
2630 parse_onoff(int *var)
2631 {
2632  char *token = ConfigParser::NextToken();
2633  if (!token) {
2634  self_destruct();
2635  return;
2636  }
2637 
2638  if (!strcmp(token, "on")) {
2639  *var = 1;
2640  } else if (!strcmp(token, "enable")) {
2641  debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2642  *var = 1;
2643  } else if (!strcmp(token, "off")) {
2644  *var = 0;
2645  } else if (!strcmp(token, "disable")) {
2646  debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2647  *var = 0;
2648  } else {
2649  debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2650  self_destruct();
2651  }
2652 }
2653 
2654 #define free_onoff free_int
2655 
2656 static void
2657 dump_tristate(StoreEntry * entry, const char *name, int var)
2658 {
2659  const char *state;
2660 
2661  if (var > 0)
2662  state = "on";
2663  else if (var < 0)
2664  state = "warn";
2665  else
2666  state = "off";
2667 
2668  storeAppendPrintf(entry, "%s %s\n", name, state);
2669 }
2670 
2671 static void
2673 {
2674  char *token = ConfigParser::NextToken();
2675  if (!token) {
2676  self_destruct();
2677  return;
2678  }
2679 
2680  if (!strcmp(token, "on")) {
2681  *var = 1;
2682  } else if (!strcmp(token, "enable")) {
2683  debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2684  *var = 1;
2685  } else if (!strcmp(token, "warn")) {
2686  *var = -1;
2687  } else if (!strcmp(token, "off")) {
2688  *var = 0;
2689  } else if (!strcmp(token, "disable")) {
2690  debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2691  *var = 0;
2692  } else {
2693  debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2694  self_destruct();
2695  }
2696 }
2697 
2698 #define free_tristate free_int
2699 
2700 void
2702 {
2703  char *token = ConfigParser::PeekAtToken();
2704  if (!token) {
2705  self_destruct();
2706  return;
2707  }
2708 
2709  if (!strcmp(token, "on")) {
2710  debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2711  *var = 1;
2712  //pop the token
2713  (void)ConfigParser::NextToken();
2714  } else if (!strcmp(token, "off")) {
2715  debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2716  *var = 0;
2717  //pop the token
2718  (void)ConfigParser::NextToken();
2719  } else
2720  parse_int(var);
2721 }
2722 
2723 #define free_pipelinePrefetch free_int
2724 #define dump_pipelinePrefetch dump_int
2725 
2726 static void
2727 dump_refreshpattern(StoreEntry * entry, const char *name, RefreshPattern * head)
2728 {
2729  while (head != NULL) {
2730  storeAppendPrintf(entry, "%s%s %s %d %d%% %d",
2731  name,
2732  head->pattern.flags&REG_ICASE ? " -i" : null_string,
2733  head->pattern.c_str(),
2734  (int) head->min / 60,
2735  (int) (100.0 * head->pct + 0.5),
2736  (int) head->max / 60);
2737 
2738  if (head->max_stale >= 0)
2739  storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2740 
2741  if (head->flags.refresh_ims)
2742  storeAppendPrintf(entry, " refresh-ims");
2743 
2744  if (head->flags.store_stale)
2745  storeAppendPrintf(entry, " store-stale");
2746 
2747 #if USE_HTTP_VIOLATIONS
2748 
2749  if (head->flags.override_expire)
2750  storeAppendPrintf(entry, " override-expire");
2751 
2752  if (head->flags.override_lastmod)
2753  storeAppendPrintf(entry, " override-lastmod");
2754 
2755  if (head->flags.reload_into_ims)
2756  storeAppendPrintf(entry, " reload-into-ims");
2757 
2758  if (head->flags.ignore_reload)
2759  storeAppendPrintf(entry, " ignore-reload");
2760 
2761  if (head->flags.ignore_no_store)
2762  storeAppendPrintf(entry, " ignore-no-store");
2763 
2764  if (head->flags.ignore_private)
2765  storeAppendPrintf(entry, " ignore-private");
2766 #endif
2767 
2768  storeAppendPrintf(entry, "\n");
2769 
2770  head = head->next;
2771  }
2772 }
2773 
2774 static void
2776 {
2777  char *token;
2778  char *pattern;
2779  time_t min = 0;
2780  double pct = 0.0;
2781  time_t max = 0;
2782  int refresh_ims = 0;
2783  int store_stale = 0;
2784  int max_stale = -1;
2785 
2786 #if USE_HTTP_VIOLATIONS
2787 
2788  int override_expire = 0;
2789  int override_lastmod = 0;
2790  int reload_into_ims = 0;
2791  int ignore_reload = 0;
2792  int ignore_no_store = 0;
2793  int ignore_private = 0;
2794 #endif
2795 
2796  int i;
2797  RefreshPattern *t;
2798  regex_t comp;
2799  int errcode;
2800  int flags = REG_EXTENDED | REG_NOSUB;
2801 
2802  if ((token = ConfigParser::RegexPattern()) != NULL) {
2803 
2804  if (strcmp(token, "-i") == 0) {
2805  flags |= REG_ICASE;
2806  token = ConfigParser::RegexPattern();
2807  } else if (strcmp(token, "+i") == 0) {
2808  flags &= ~REG_ICASE;
2809  token = ConfigParser::RegexPattern();
2810  }
2811 
2812  }
2813 
2814  if (token == NULL) {
2815  debugs(3, DBG_CRITICAL, "FATAL: refresh_pattern missing the regex pattern parameter");
2816  self_destruct();
2817  return;
2818  }
2819 
2820  pattern = xstrdup(token);
2821 
2822  i = GetInteger(); /* token: min */
2823 
2824  /* catch negative and insanely huge values close to 32-bit wrap */
2825  if (i < 0) {
2826  debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2827  i = 0;
2828  }
2829  if (i > 60*24*365) {
2830  debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2831  i = 60*24*365;
2832  }
2833 
2834  min = (time_t) (i * 60); /* convert minutes to seconds */
2835 
2836  pct = GetPercentage(false); /* token: pct . with no limit on size */
2837 
2838  i = GetInteger(); /* token: max */
2839 
2840  /* catch negative and insanely huge values close to 32-bit wrap */
2841  if (i < 0) {
2842  debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2843  i = 0;
2844  }
2845  if (i > 60*24*365) {
2846  debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2847  i = 60*24*365;
2848  }
2849 
2850  max = (time_t) (i * 60); /* convert minutes to seconds */
2851 
2852  /* Options */
2853  while ((token = ConfigParser::NextToken()) != NULL) {
2854  if (!strcmp(token, "refresh-ims")) {
2855  refresh_ims = 1;
2856  } else if (!strcmp(token, "store-stale")) {
2857  store_stale = 1;
2858  } else if (!strncmp(token, "max-stale=", 10)) {
2859  max_stale = xatoi(token + 10);
2860 
2861 #if USE_HTTP_VIOLATIONS
2862 
2863  } else if (!strcmp(token, "override-expire"))
2864  override_expire = 1;
2865  else if (!strcmp(token, "override-lastmod"))
2866  override_lastmod = 1;
2867  else if (!strcmp(token, "ignore-no-store"))
2868  ignore_no_store = 1;
2869  else if (!strcmp(token, "ignore-private"))
2870  ignore_private = 1;
2871  else if (!strcmp(token, "reload-into-ims")) {
2872  reload_into_ims = 1;
2874  /* tell client_side.c that this is used */
2875  } else if (!strcmp(token, "ignore-reload")) {
2876  ignore_reload = 1;
2878  /* tell client_side.c that this is used */
2879 #endif
2880 
2881  } else if (!strcmp(token, "ignore-no-cache") ||
2882  !strcmp(token, "ignore-must-revalidate") ||
2883  !strcmp(token, "ignore-auth")
2884  ) {
2885  debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2886  } else
2887  debugs(22, DBG_CRITICAL, "refreshAddToList: Unknown option '" << pattern << "': " << token);
2888  }
2889 
2890  if ((errcode = regcomp(&comp, pattern, flags)) != 0) {
2891  char errbuf[256];
2892  regerror(errcode, &comp, errbuf, sizeof errbuf);
2893  debugs(22, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
2894  debugs(22, DBG_CRITICAL, "refreshAddToList: Invalid regular expression '" << pattern << "': " << errbuf);
2895  xfree(pattern);
2896  return;
2897  }
2898 
2899  pct = pct < 0.0 ? 0.0 : pct;
2900  max = max < 0 ? 0 : max;
2901  t = new RefreshPattern(pattern, flags);
2902  t->pattern.regex = comp;
2903  t->min = min;
2904  t->pct = pct;
2905  t->max = max;
2906 
2907  if (refresh_ims)
2908  t->flags.refresh_ims = true;
2909 
2910  if (store_stale)
2911  t->flags.store_stale = true;
2912 
2913  t->max_stale = max_stale;
2914 
2915 #if USE_HTTP_VIOLATIONS
2916 
2917  if (override_expire)
2918  t->flags.override_expire = true;
2919 
2920  if (override_lastmod)
2921  t->flags.override_lastmod = true;
2922 
2923  if (reload_into_ims)
2924  t->flags.reload_into_ims = true;
2925 
2926  if (ignore_reload)
2927  t->flags.ignore_reload = true;
2928 
2929  if (ignore_no_store)
2930  t->flags.ignore_no_store = true;
2931 
2932  if (ignore_private)
2933  t->flags.ignore_private = true;
2934 #endif
2935 
2936  t->next = NULL;
2937 
2938  while (*head)
2939  head = &(*head)->next;
2940 
2941  *head = t;
2942 
2943  xfree(pattern);
2944 }
2945 
2946 static void
2948 {
2949  delete *head;
2950  *head = nullptr;
2951 
2952 #if USE_HTTP_VIOLATIONS
2954 
2955 #endif
2956 }
2957 
2958 static void
2959 dump_string(StoreEntry * entry, const char *name, char *var)
2960 {
2961  if (var != NULL)
2962  storeAppendPrintf(entry, "%s %s\n", name, var);
2963 }
2964 
2965 static void
2966 parse_string(char **var)
2967 {
2968  safe_free(*var);
2969 
2970  char *token = ConfigParser::NextToken();
2971  if (!token) {
2972  self_destruct();
2973  return;
2974  }
2975 
2976  *var = xstrdup(token);
2977 }
2978 
2979 static void
2980 free_string(char **var)
2981 {
2982  safe_free(*var);
2983 }
2984 
2985 void
2986 parse_eol(char *volatile *var)
2987 {
2988  if (!var) {
2989  self_destruct();
2990  return;
2991  }
2992 
2993  unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2994  safe_free(*var);
2995 
2996  if (!token) {
2997  self_destruct();
2998  return;
2999  }
3000 
3001  while (*token && xisspace(*token))
3002  ++token;
3003 
3004  if (!*token) {
3005  self_destruct();
3006  return;
3007  }
3008 
3009  *var = xstrdup((char *) token);
3010 }
3011 
3012 #define dump_eol dump_string
3013 #define free_eol free_string
3014 
3015 static void
3017 {
3018  safe_free(*var);
3019 
3020  char *token = ConfigParser::NextQuotedToken();
3021  if (!token) {
3022  self_destruct();
3023  return;
3024  }
3025 
3026  *var = xstrdup(token);
3027 }
3028 
3029 #define dump_TokenOrQuotedString dump_string
3030 #define free_TokenOrQuotedString free_string
3031 
3032 static void
3033 dump_time_t(StoreEntry * entry, const char *name, time_t var)
3034 {
3035  storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
3036 }
3037 
3038 void
3039 parse_time_t(time_t * var)
3040 {
3041  const auto maxTime = std::numeric_limits<time_t>::max();
3042  const auto seconds = parseTimeLine<std::chrono::seconds>();
3043  if (maxTime < seconds.count())
3044  throw TexcHere(ToSBuf("directive supports time values up to ", maxTime, " but is given ", seconds.count(), " seconds"));
3045  *var = static_cast<time_t>(seconds.count());
3046 }
3047 
3048 static void
3049 free_time_t(time_t * var)
3050 {
3051  *var = 0;
3052 }
3053 
3054 static void
3055 dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
3056 {
3057  if (var % 1000)
3058  storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
3059  else
3060  storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
3061 }
3062 
3063 void
3065 {
3066  *var = parseTimeLine<std::chrono::milliseconds>().count();
3067 }
3068 
3069 static void
3071 {
3072  *var = 0;
3073 }
3074 
3075 static void
3076 dump_time_nanoseconds(StoreEntry *entry, const char *name, const std::chrono::nanoseconds &var)
3077 {
3078  // std::chrono::nanoseconds::rep is unknown a priori so we cast to (and print) the largest supported integer
3079  storeAppendPrintf(entry, "%s %jd nanoseconds\n", name, static_cast<intmax_t>(var.count()));
3080 }
3081 
3082 static void
3083 parse_time_nanoseconds(std::chrono::nanoseconds *var)
3084 {
3085  *var = parseTimeLine<std::chrono::nanoseconds>();
3086 }
3087 
3088 static void
3089 free_time_nanoseconds(std::chrono::nanoseconds *var)
3090 {
3091  *var = std::chrono::nanoseconds::zero();
3092 }
3093 
3094 #if UNUSED_CODE
3095 static void
3096 dump_size_t(StoreEntry * entry, const char *name, size_t var)
3097 {
3098  storeAppendPrintf(entry, "%s %d\n", name, (int) var);
3099 }
3100 #endif
3101 
3102 static void
3103 dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3104 {
3105  storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3106 }
3107 
3108 static void
3109 dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3110 {
3111  storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3112 }
3113 
3114 #if UNUSED_CODE
3115 static void
3116 dump_kb_size_t(StoreEntry * entry, const char *name, size_t var)
3117 {
3118  storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_KBYTES_STR);
3119 }
3120 #endif
3121 
3122 static void
3123 dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3124 {
3125  storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3126 }
3127 
3128 static void
3129 dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3130 {
3131  storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3132 }
3133 
3134 #if UNUSED_CODE
3135 static void
3136 parse_size_t(size_t * var)
3137 {
3138  int i;
3139  i = GetInteger();
3140  *var = (size_t) i;
3141 }
3142 #endif
3143 
3144 static void
3145 parse_b_size_t(size_t * var)
3146 {
3148 }
3149 
3150 static void
3151 parse_b_ssize_t(ssize_t * var)
3152 {
3154 }
3155 
3156 #if UNUSED_CODE
3157 static void
3158 parse_kb_size_t(size_t * var)
3159 {
3161 }
3162 #endif
3163 
3164 static void
3165 parse_b_int64_t(int64_t * var)
3166 {
3168 }
3169 
3170 static void
3171 parse_kb_int64_t(int64_t * var)
3172 {
3174 }
3175 
3176 static void
3177 free_size_t(size_t * var)
3178 {
3179  *var = 0;
3180 }
3181 
3182 static void
3183 free_ssize_t(ssize_t * var)
3184 {
3185  *var = 0;
3186 }
3187 
3188 static void
3189 free_b_int64_t(int64_t * var)
3190 {
3191  *var = 0;
3192 }
3193 
3194 #define free_b_size_t free_size_t
3195 #define free_b_ssize_t free_ssize_t
3196 #define free_kb_size_t free_size_t
3197 #define free_mb_size_t free_size_t
3198 #define free_gb_size_t free_size_t
3199 #define free_kb_int64_t free_b_int64_t
3200 
3201 static void
3202 dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3203 {
3204  storeAppendPrintf(entry, "%s %d\n", name, var);
3205 }
3206 
3207 static void
3208 free_u_short(unsigned short * u)
3209 {
3210  *u = 0;
3211 }
3212 
3213 static void
3214 parse_u_short(unsigned short * var)
3215 {
3217 }
3218 
3219 void
3220 ConfigParser::ParseUShort(unsigned short *var)
3221 {
3222  *var = GetShort();
3223 }
3224 
3225 void
3227 {
3228  int i = GetInteger();
3229 
3230  if (0 == i)
3231  *var = false;
3232  else if (1 == i)
3233  *var = true;
3234  else
3235  self_destruct();
3236 }
3237 
3238 static void
3239 dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3240 {
3241  while (list != NULL) {
3242  storeAppendPrintf(entry, "%s %s\n", name, list->key);
3243  list = list->next;
3244  }
3245 }
3246 
3247 void
3249 {
3250  parse_wordlist(list);
3251 }
3252 
3253 void
3255 {
3256  char *token;
3257  while ((token = ConfigParser::NextQuotedToken()))
3258  wordlistAdd(list, token);
3259 }
3260 
3261 #if 0 /* now unused */
3262 static int
3263 check_null_wordlist(wordlist * w)
3264 {
3265  return w == NULL;
3266 }
3267 #endif
3268 
3269 static int
3271 {
3272  return a == NULL;
3273 }
3274 
3275 #define free_wordlist wordlistDestroy
3276 
3277 #define free_uri_whitespace free_int
3278 
3279 static void
3281 {
3282  char *token = ConfigParser::NextToken();
3283  if (!token) {
3284  self_destruct();
3285  return;
3286  }
3287 
3288  if (!strcmp(token, "strip"))
3289  *var = URI_WHITESPACE_STRIP;
3290  else if (!strcmp(token, "deny"))
3291  *var = URI_WHITESPACE_DENY;
3292  else if (!strcmp(token, "allow"))
3293  *var = URI_WHITESPACE_ALLOW;
3294  else if (!strcmp(token, "encode"))
3295  *var = URI_WHITESPACE_ENCODE;
3296  else if (!strcmp(token, "chop"))
3297  *var = URI_WHITESPACE_CHOP;
3298  else {
3299  debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3300  self_destruct();
3301  }
3302 }
3303 
3304 static void
3305 dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3306 {
3307  const char *s;
3308 
3309  if (var == URI_WHITESPACE_ALLOW)
3310  s = "allow";
3311  else if (var == URI_WHITESPACE_ENCODE)
3312  s = "encode";
3313  else if (var == URI_WHITESPACE_CHOP)
3314  s = "chop";
3315  else if (var == URI_WHITESPACE_DENY)
3316  s = "deny";
3317  else
3318  s = "strip";
3319 
3320  storeAppendPrintf(entry, "%s %s\n", name, s);
3321 }
3322 
3323 static void
3325 {
3326  if (!*settings)
3327  return;
3328 
3329  free_string(&(*settings)->type);
3330 
3331  free_wordlist(&(*settings)->args);
3332 
3333  delete *settings;
3334 
3335  *settings = NULL;
3336 }
3337 
3338 static void
3340 {
3341  if (*settings)
3342  free_removalpolicy(settings);
3343 
3344  *settings = new RemovalPolicySettings;
3345 
3346  parse_string(&(*settings)->type);
3347 
3348  parse_wordlist(&(*settings)->args);
3349 }
3350 
3351 static void
3352 dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3353 {
3354  wordlist *args;
3355  storeAppendPrintf(entry, "%s %s", name, settings->type);
3356  args = settings->args;
3357 
3358  while (args) {
3359  storeAppendPrintf(entry, " %s", args->key);
3360  args = args->next;
3361  }
3362 
3363  storeAppendPrintf(entry, "\n");
3364 }
3365 
3366 inline void
3368 {}
3369 
3370 static void
3372 {
3373  int value = 0;
3374  parse_onoff(&value);
3375  option->configure(value > 0);
3376 }
3377 
3378 static void
3379 dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3380 {
3381  if (option.configured())
3382  dump_onoff(entry, name, option ? 1 : 0);
3383 }
3384 
3385 static void
3387 {}
3388 
3389 static void
3391 {
3392  char *token = ConfigParser::NextToken();
3393  if (!token) {
3394  self_destruct();
3395  return;
3396  }
3397 
3398  if (strcmp(token, "always") == 0) {
3401  } else if (strcmp(token, "disk") == 0) {
3404  } else if (strncmp(token, "net", 3) == 0) {
3407  } else if (strcmp(token, "never") == 0) {
3410  } else {
3411  debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3412  self_destruct();
3413  }
3414 }
3415 
3416 static void
3417 dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3418 {
3419  storeAppendPrintf(entry, "%s ", name);
3421  storeAppendPrintf(entry, "always");
3423  storeAppendPrintf(entry, "disk");
3425  storeAppendPrintf(entry, "network");
3427  storeAppendPrintf(entry, "none");
3428  storeAppendPrintf(entry, "\n");
3429 }
3430 
3431 #include "cf_parser.cci"
3432 
3433 peer_t
3434 parseNeighborType(const char *s)
3435 {
3436  if (!strcmp(s, "parent"))
3437  return PEER_PARENT;
3438 
3439  if (!strcmp(s, "neighbor"))
3440  return PEER_SIBLING;
3441 
3442  if (!strcmp(s, "neighbour"))
3443  return PEER_SIBLING;
3444 
3445  if (!strcmp(s, "sibling"))
3446  return PEER_SIBLING;
3447 
3448  if (!strcmp(s, "multicast"))
3449  return PEER_MULTICAST;
3450 
3451  debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3452 
3453  return PEER_SIBLING;
3454 }
3455 
3456 #if USE_WCCPv2
3457 static void
3459 {
3460  char *token;
3461  Ip::Address_list *s;
3462  Ip::Address ipa;
3463 
3464  while ((token = ConfigParser::NextToken())) {
3465  if (GetHostWithPort(token, &ipa)) {
3466 
3467  while (*head)
3468  head = &(*head)->next;
3469 
3470  s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3471  s->s = ipa;
3472 
3473  *head = s;
3474  } else {
3475  self_destruct();
3476  return;
3477  }
3478  }
3479 }
3480 
3481 static void
3482 dump_IpAddress_list(StoreEntry * e, const char *n, const Ip::Address_list * s)
3483 {
3484  char ntoabuf[MAX_IPSTRLEN];
3485 
3486  while (s) {
3487  storeAppendPrintf(e, "%s %s\n",
3488  n,
3489  s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3490  s = s->next;
3491  }
3492 }
3493 
3494 static void
3496 {
3497  if (*head) delete *head;
3498  *head = NULL;
3499 }
3500 
3501 #if CURRENTLY_UNUSED
3502 /* This code was previously used by http_port. Left as it really should
3503  * be used by icp_port and htcp_port
3504  */
3505 static int
3506 check_null_IpAddress_list(const Ip::Address_list * s)
3507 {
3508  return NULL == s;
3509 }
3510 
3511 #endif /* CURRENTLY_UNUSED */
3512 #endif /* USE_WCCPv2 */
3513 
3514 static void
3516 {
3517  char *host = NULL;
3518  unsigned short port = 0;
3519  char *t = NULL;
3520  char *junk = NULL;
3521 
3522  s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3523  s->name = xstrdup(token);
3524  s->connection_auth_disabled = false;
3525 
3526  const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3527 
3528  if (*token == '[') {
3529  /* [ipv6]:port */
3530  host = token + 1;
3531  t = strchr(host, ']');
3532  if (!t) {
3533  debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3534  self_destruct();
3535  return;
3536  }
3537  *t = '\0';
3538  ++t;
3539  if (*t != ':') {
3540  debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3541  self_destruct();
3542  return;
3543  }
3544  if (!Ip::EnableIpv6) {
3545  debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3546  self_destruct();
3547  return;
3548  }
3549  port = xatos(t + 1);
3550  } else if ((t = strchr(token, ':'))) {
3551  /* host:port */
3552  /* ipv4:port */
3553  host = token;
3554  *t = '\0';
3555  port = xatos(t + 1);
3556 
3557  } else if (strtol(token, &junk, 10) && !*junk) {
3558  port = xatos(token);
3559  debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3560  } else {
3561  debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3562  self_destruct();
3563  return;
3564  }
3565 
3566  if (port == 0 && host != NULL) {
3567  debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3568  self_destruct();
3569  return;
3570  }
3571 
3572  if (NULL == host) {
3573  s->s.setAnyAddr();
3574  s->s.port(port);
3575  if (!Ip::EnableIpv6)
3576  s->s.setIPv4();
3577  debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3578  } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3579  s->s.port(port);
3580  if (!Ip::EnableIpv6)
3581  s->s.setIPv4();
3582  debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3583  } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3584  /* do not use ipcache */
3585  s->defaultsite = xstrdup(host);
3586  s->s.port(port);
3587  if (!Ip::EnableIpv6)
3588  s->s.setIPv4();
3589  debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3590  } else {
3591  debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3592  self_destruct();
3593  }
3594 }
3595 
3599 static AnyP::ProtocolVersion
3601 {
3602  // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3603  // and RFC 2616 requires us to upgrade 1.0 to 1.1
3604  if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3605  return Http::ProtocolVersion(1,1);
3606 
3607  if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3609 
3610  if (value.cmp("FTP") == 0)
3611  return Ftp::ProtocolVersion();
3612 
3613  fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3614  return AnyP::ProtocolVersion(); // not reached
3615 }
3616 
3617 static void
3619 {
3620  /* modes first */
3621 
3622  if (strcmp(token, "accel") == 0) {
3623  if (s->flags.isIntercepted()) {
3624  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3625  self_destruct();
3626  return;
3627  }
3628  s->flags.accelSurrogate = true;
3629  s->vhost = true;
3630  } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3631  if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3632  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3633  self_destruct();
3634  return;
3635  }
3636  s->flags.natIntercept = true;
3638  /* Log information regarding the port modes under interception. */
3639  debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3640  debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3641  } else if (strcmp(token, "tproxy") == 0) {
3642  if (s->flags.natIntercept || s->flags.accelSurrogate) {
3643  debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3644  self_destruct();
3645  return;
3646  }
3647  s->flags.tproxyIntercept = true;
3649  /* Log information regarding the port modes under transparency. */
3650  debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3651 
3652  if (s->flags.proxySurrogate) {
3653  debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3654  }
3655 
3656  if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3657  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3658  self_destruct();
3659  return;
3660  }
3661 
3662  } else if (strcmp(token, "require-proxy-header") == 0) {
3663  s->flags.proxySurrogate = true;
3664  if (s->flags.tproxyIntercept) {
3665  // receiving is still permitted, so we do not unset the TPROXY flag
3666  // spoofing access control override takes care of the spoof disable later
3667  debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3668  }
3669 
3670  } else if (strncmp(token, "defaultsite=", 12) == 0) {
3671  if (!s->flags.accelSurrogate) {
3672  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3673  self_destruct();
3674  return;
3675  }
3676  safe_free(s->defaultsite);
3677  s->defaultsite = xstrdup(token + 12);
3678  } else if (strcmp(token, "vhost") == 0) {
3679  if (!s->flags.accelSurrogate) {
3680  debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3681  }
3682  s->flags.accelSurrogate = true;
3683  s->vhost = true;
3684  } else if (strcmp(token, "no-vhost") == 0) {
3685  if (!s->flags.accelSurrogate) {
3686  debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3687  }
3688  s->vhost = false;
3689  } else if (strcmp(token, "vport") == 0) {
3690  if (!s->flags.accelSurrogate) {
3691  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3692  self_destruct();
3693  return;
3694  }
3695  s->vport = -1;
3696  } else if (strncmp(token, "vport=", 6) == 0) {
3697  if (!s->flags.accelSurrogate) {
3698  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3699  self_destruct();
3700  return;
3701  }
3702  s->vport = xatos(token + 6);
3703  } else if (strncmp(token, "protocol=", 9) == 0) {
3704  if (!s->flags.accelSurrogate) {
3705  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3706  self_destruct();
3707  return;
3708  }
3709  s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3710  } else if (strcmp(token, "allow-direct") == 0) {
3711  if (!s->flags.accelSurrogate) {
3712  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3713  self_destruct();
3714  return;
3715  }
3716  s->allow_direct = true;
3717  } else if (strcmp(token, "act-as-origin") == 0) {
3718  if (!s->flags.accelSurrogate) {
3719  debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3720  } else
3721  s->actAsOrigin = true;
3722  } else if (strcmp(token, "ignore-cc") == 0) {
3723 #if !USE_HTTP_VIOLATIONS
3724  if (!s->flags.accelSurrogate) {
3725  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3726  self_destruct();
3727  return;
3728  }
3729 #endif
3730  s->ignore_cc = true;
3731  } else if (strncmp(token, "name=", 5) == 0) {
3732  safe_free(s->name);
3733  s->name = xstrdup(token + 5);
3734  } else if (strcmp(token, "no-connection-auth") == 0) {
3735  s->connection_auth_disabled = true;
3736  } else if (strcmp(token, "connection-auth=off") == 0) {
3737  s->connection_auth_disabled = true;
3738  } else if (strcmp(token, "connection-auth") == 0) {
3739  s->connection_auth_disabled = false;
3740  } else if (strcmp(token, "connection-auth=on") == 0) {
3741  s->connection_auth_disabled = false;
3742  } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3743  if (!strcmp(token + 23, "off"))
3744  s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3745  else if (!strcmp(token + 23, "transparent"))
3746  s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3747  else if (!strcmp(token + 23, "always"))
3748  s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3749  else {
3750  self_destruct();
3751  return;
3752  }
3753  } else if (strcmp(token, "ipv4") == 0) {
3754  if ( !s->s.setIPv4() ) {
3755  debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3756  self_destruct();
3757  return;
3758  }
3759  } else if (strcmp(token, "tcpkeepalive") == 0) {
3760  s->tcp_keepalive.enabled = true;
3761  } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3762  char *t = token + 13;
3763  s->tcp_keepalive.enabled = true;
3764  s->tcp_keepalive.idle = xatoui(t,',');
3765  t = strchr(t, ',');
3766  if (t) {
3767  ++t;
3768  s->tcp_keepalive.interval = xatoui(t,',');
3769  t = strchr(t, ',');
3770  }
3771  if (t) {
3772  ++t;
3773  s->tcp_keepalive.timeout = xatoui(t);
3774  }
3775 #if USE_OPENSSL
3776  } else if (strcmp(token, "sslBump") == 0) {
3777  debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3778  "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3779  s->flags.tunnelSslBumping = true;
3780  } else if (strcmp(token, "ssl-bump") == 0) {
3781  s->flags.tunnelSslBumping = true;
3782  } else if (strncmp(token, "cert=", 5) == 0) {
3783  s->secure.parse(token);
3784  } else if (strncmp(token, "key=", 4) == 0) {
3785  s->secure.parse(token);
3786  } else if (strncmp(token, "version=", 8) == 0) {
3787  debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3788  "in " << cfg_directive << ". Use 'options=' instead.");
3789  s->secure.parse(token);
3790  } else if (strncmp(token, "options=", 8) == 0) {
3791  s->secure.parse(token);
3792  } else if (strncmp(token, "cipher=", 7) == 0) {
3793  s->secure.parse(token);
3794  } else if (strncmp(token, "clientca=", 9) == 0) {
3795  s->secure.parse(token);
3796  } else if (strncmp(token, "cafile=", 7) == 0) {
3797  debugs(3, DBG_PARSE_NOTE(1), "UPGRADE WARNING: '" << token << "' is deprecated " <<
3798  "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3799  s->secure.parse(token);
3800  } else if (strncmp(token, "capath=", 7) == 0) {
3801  s->secure.parse(token);
3802  } else if (strncmp(token, "crlfile=", 8) == 0) {
3803  s->secure.parse(token);
3804  } else if (strncmp(token, "dhparams=", 9) == 0) {
3805  debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3806  "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3807  s->secure.parse(token);
3808  } else if (strncmp(token, "sslflags=", 9) == 0) {
3809  // NP: deprecation warnings output by secure.parse() when relevant
3810  s->secure.parse(token+3);
3811  } else if (strncmp(token, "sslcontext=", 11) == 0) {
3812  // NP: deprecation warnings output by secure.parse() when relevant
3813  s->secure.parse(token+3);
3814  } else if (strncmp(token, "generate-host-certificates", 26) == 0) {
3815  s->secure.parse(token);
3816 #endif
3817  } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3818  s->secure.parse(token);
3819  } else if (strncmp(token, "tls-", 4) == 0) {
3820  s->secure.parse(token+4);
3821  } else if (strcmp(token, "ftp-track-dirs") == 0) {
3822  s->ftp_track_dirs = true;
3823  } else if (strcmp(token, "worker-queues") == 0) {
3824 #if !defined(SO_REUSEADDR)
3825 #error missing system #include that #defines SO_* constants
3826 #endif
3827 #if !defined(SO_REUSEPORT)
3828  throw TexcHere(ToSBuf(cfg_directive, ' ', token, " option requires building Squid where SO_REUSEPORT is supported by the TCP stack"));
3829 #endif
3830  s->workerQueues = true;
3831  } else {
3832  debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3833  self_destruct();
3834  }
3835 }
3836 
3837 void
3838 add_http_port(char *portspec)
3839 {
3841  s->transport = parsePortProtocol(SBuf("HTTP"));
3842  parsePortSpecification(s, portspec);
3843  // we may need to merge better if the above returns a list with clones
3844  assert(s->next == NULL);
3845  s->next = HttpPortList;
3846  HttpPortList = s;
3847 }
3848 
3849 static void
3850 parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3851 {
3852  SBuf protoName;
3853  if (strcmp(optionName, "http_port") == 0 ||
3854  strcmp(optionName, "ascii_port") == 0)
3855  protoName = "HTTP";
3856  else if (strcmp(optionName, "https_port") == 0)
3857  protoName = "HTTPS";
3858  else if (strcmp(optionName, "ftp_port") == 0)
3859  protoName = "FTP";
3860  if (protoName.isEmpty()) {
3861  self_destruct();
3862  return;
3863  }
3864 
3865  char *token = ConfigParser::NextToken();
3866 
3867  if (!token) {
3868  self_destruct();
3869  return;
3870  }
3871 
3873  s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3874  parsePortSpecification(s, token);
3875 
3876  /* parse options ... */
3877  while ((token = ConfigParser::NextToken())) {
3878  parse_port_option(s, token);
3879  }
3880 
3881  s->secure.syncCaFiles();
3882 
3883  if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3884  s->secure.encryptTransport = true;
3885 #if USE_OPENSSL
3886  /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3887  const bool hijacked = s->flags.isIntercepted();
3888  if (s->flags.tunnelSslBumping && !hijacked) {
3889  debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3890  self_destruct();
3891  return;
3892  }
3893  if (hijacked && !s->flags.tunnelSslBumping) {
3894  debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3895  self_destruct();
3896  return;
3897  }
3898 #endif
3899  if (s->flags.proxySurrogate) {
3900  debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3901  self_destruct();
3902  return;
3903  }
3904  } else if (protoName.cmp("FTP") == 0) {
3905  /* ftp_port does not support ssl-bump */
3906  if (s->flags.tunnelSslBumping) {
3907  debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3908  self_destruct();
3909  return;
3910  }
3911  if (s->flags.proxySurrogate) {
3912  // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3913  debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3914  self_destruct();
3915  return;
3916  }
3917  }
3918 
3919  if (s->secure.encryptTransport) {
3920  if (s->secure.certs.empty()) {
3921  debugs(3, DBG_CRITICAL, "FATAL: " << AnyP::UriScheme(s->transport.protocol) << "_port requires a cert= parameter");
3922  self_destruct();
3923  return;
3924  }
3925  s->secure.parseOptions();
3926  }
3927 
3928  // *_port line should now be fully valid so we can clone it if necessary
3929  if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3930  // clone the port options from *s to *(s->next)
3931  s->next = s->clone();
3932  s->next->s.setIPv4();
3933  debugs(3, 3, AnyP::UriScheme(s->transport.protocol).image() << "_port: clone wildcard address for split-stack: " << s->s << " and " << s->next->s);
3934  }
3935 
3936  while (*head != NULL)
3937  head = &((*head)->next);
3938 
3939  *head = s;
3940 }
3941 
3942 static void
3944 {
3945  char buf[MAX_IPSTRLEN];
3946 
3947  storeAppendPrintf(e, "%s %s",
3948  n,
3949  s->s.toUrl(buf,MAX_IPSTRLEN));
3950 
3951  // MODES and specific sub-options.
3952  if (s->flags.natIntercept)
3953  storeAppendPrintf(e, " intercept");
3954 
3955  else if (s->flags.tproxyIntercept)
3956  storeAppendPrintf(e, " tproxy");
3957 
3958  else if (s->flags.proxySurrogate)
3959  storeAppendPrintf(e, " require-proxy-header");
3960 
3961  else if (s->flags.accelSurrogate) {
3962  storeAppendPrintf(e, " accel");
3963 
3964  if (s->vhost)
3965  storeAppendPrintf(e, " vhost");
3966 
3967  if (s->vport < 0)
3968  storeAppendPrintf(e, " vport");
3969  else if (s->vport > 0)
3970  storeAppendPrintf(e, " vport=%d", s->vport);
3971 
3972  if (s->defaultsite)
3973  storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3974 
3975  // TODO: compare against prefix of 'n' instead of assuming http_port
3976  if (s->transport.protocol != AnyP::PROTO_HTTP)
3977  storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3978 
3979  if (s->allow_direct)
3980  storeAppendPrintf(e, " allow-direct");
3981 
3982  if (s->ignore_cc)
3983  storeAppendPrintf(e, " ignore-cc");
3984 
3985  }
3986 
3987  // Generic independent options
3988 
3989  if (s->name)
3990  storeAppendPrintf(e, " name=%s", s->name);
3991 
3992 #if USE_HTTP_VIOLATIONS
3993  if (!s->flags.accelSurrogate && s->ignore_cc)
3994  storeAppendPrintf(e, " ignore-cc");
3995 #endif
3996 
3997  if (s->connection_auth_disabled)
3998  storeAppendPrintf(e, " connection-auth=off");
3999  else
4000  storeAppendPrintf(e, " connection-auth=on");
4001 
4002  if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
4003  const char *pmtu;
4004 
4005  if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
4006  pmtu = "always";
4007  else
4008  pmtu = "transparent";
4009 
4010  storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
4011  }
4012 
4013  if (s->s.isAnyAddr() && !s->s.isIPv6())
4014  storeAppendPrintf(e, " ipv4");
4015 
4016  if (s->tcp_keepalive.enabled) {
4017  if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
4018  storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
4019  } else {
4020  storeAppendPrintf(e, " tcpkeepalive");
4021  }
4022  }
4023 
4024 #if USE_OPENSSL
4025  if (s->flags.tunnelSslBumping)
4026  storeAppendPrintf(e, " ssl-bump");
4027 #endif
4028 
4029  s->secure.dumpCfg(e, "tls-");
4030 }
4031 
4032 static void
4033 dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
4034 {
4035  for (AnyP::PortCfgPointer p = s; p != NULL; p = p->next) {
4036  dump_generic_port(e, n, p);
4037  storeAppendPrintf(e, "\n");
4038  }
4039 }
4040 
4041 void
4043 {
4044  free_all();
4045  Config.ssl_client.sslContext.reset();
4046 #if USE_OPENSSL
4048 #endif
4049 }
4050 
4051 void
4052 requirePathnameExists(const char *name, const char *path)
4053 {
4054 
4055  struct stat sb;
4056  char pathbuf[BUFSIZ];
4057  assert(path != NULL);
4058 
4059  if (Config.chroot_dir && (geteuid() == 0)) {
4060  snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
4061  path = pathbuf;
4062  }
4063 
4064  if (stat(path, &sb) < 0) {
4065  int xerrno = errno;
4066  debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
4067  // keep going to find more issues if we are only checking the config file with "-k parse"
4068  if (opt_parse_cfg_only)
4069  return;
4070  // this is fatal if it is found during startup or reconfigure
4071  if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
4072  fatalf("%s %s: %s", name, path, xstrerr(xerrno));
4073  }
4074 }
4075 
4076 #include "AccessLogEntry.h"
4077 
4098 static void
4100 {
4101  const char *filename = ConfigParser::NextToken();
4102  if (!filename) {
4103  self_destruct();
4104  return;
4105  }
4106 
4107  CustomLog *cl = (CustomLog *)xcalloc(1, sizeof(*cl));
4108 
4109  cl->filename = xstrdup(filename);
4110  // default buffer size and fatal settings
4111  cl->bufferSize = 8*MAX_URL;
4112  cl->fatal = true;
4113 
4114  if (strcmp(filename, "none") == 0) {
4116  aclParseAclList(LegacyParser, &cl->aclList, filename);
4117  while (*logs)
4118  logs = &(*logs)->next;
4119  *logs = cl;
4120  return;
4121  }
4122 
4124  cl->rotateCount = -1; // default: use global logfile_rotate setting.
4125 
4126  const char *token = ConfigParser::PeekAtToken();
4127  if (!token) { // style #1
4128  // no options to deal with
4129  } else if (!strchr(token, '=')) { // style #3
4130  // if logformat name is recognized,
4131  // pop the previewed token; Else it must be an ACL name
4132  if (setLogformat(cl, token, false))
4133  (void)ConfigParser::NextToken();
4134  } else { // style #4
4135  do {
4136  if (strncasecmp(token, "on-error=", 9) == 0) {
4137  if (strncasecmp(token+9, "die", 3) == 0) {
4138  cl->fatal = true;
4139  } else if (strncasecmp(token+9, "drop", 4) == 0) {
4140  cl->fatal = false;
4141  } else {
4142  debugs(3, DBG_CRITICAL, "Unknown value for on-error '" <<
4143  token << "' expected 'drop' or 'die'");
4144  xfree(cl->filename);
4145  xfree(cl);
4146  self_destruct();
4147  return;
4148  }
4149  } else if (strncasecmp(token, "buffer-size=", 12) == 0) {
4150  parseBytesOptionValue(&cl->bufferSize, B_BYTES_STR, token+12);
4151  } else if (strncasecmp(token, "rotate=", 7) == 0) {
4152  cl->rotateCount = xatoi(token + 7);
4153  } else if (strncasecmp(token, "logformat=", 10) == 0) {
4154  setLogformat(cl, token+10, true);
4155  } else if (!strchr(token, '=')) {
4156  // Do not pop the token; it must be an ACL name
4157  break; // done with name=value options, now to ACLs
4158  } else {
4159  debugs(3, DBG_CRITICAL, "Unknown access_log option " << token);
4160  xfree(cl->filename);
4161  xfree(cl);
4162  self_destruct();
4163  return;
4164  }
4165  // Pop the token, it was a valid "name=value" option
4166  (void)ConfigParser::NextToken();
4167  // Get next with preview ConfigParser::NextToken call.
4168  } while ((token = ConfigParser::PeekAtToken()) != NULL);
4169  }
4170 
4171  // set format if it has not been specified explicitly
4172  if (cl->type == Log::Format::CLF_UNKNOWN)
4173  setLogformat(cl, "squid", true);
4174 
4176 
4177  while (*logs)
4178  logs = &(*logs)->next;
4179 
4180  *logs = cl;
4181 }
4182 
4185 static bool
4186 setLogformat(CustomLog *cl, const char *logdef_name, const bool dieWhenMissing)
4187 {
4188  assert(cl);
4189  assert(logdef_name);
4190 
4191  debugs(3, 9, "possible " << cl->filename << " logformat: " << logdef_name);
4192 
4193  if (cl->type != Log::Format::CLF_UNKNOWN) {
4194  debugs(3, DBG_CRITICAL, "FATAL: Second logformat name in one access_log: " <<
4195  logdef_name << " " << cl->type << " ? " << Log::Format::CLF_NONE);
4196  self_destruct();
4197  return false;
4198  }
4199 
4200  /* look for the definition pointer corresponding to this name */
4202 
4203  while (lf != NULL) {
4204  debugs(3, 9, "Comparing against '" << lf->name << "'");
4205 
4206  if (strcmp(lf->name, logdef_name) == 0)
4207  break;
4208 
4209  lf = lf->next;
4210  }
4211 
4212  if (lf != NULL) {
4214  cl->logFormat = lf;
4215  } else if (strcmp(logdef_name, "auto") == 0) {
4216  debugs(0, DBG_CRITICAL, "WARNING: Log format 'auto' no longer exists. Using 'squid' instead.");
4218  } else if (strcmp(logdef_name, "squid") == 0) {
4220  } else if (strcmp(logdef_name, "common") == 0) {
4222  } else if (strcmp(logdef_name, "combined") == 0) {
4224 #if ICAP_CLIENT
4225  } else if (strcmp(logdef_name, "icap_squid") == 0) {
4227 #endif
4228  } else if (strcmp(logdef_name, "useragent") == 0) {
4230  } else if (strcmp(logdef_name, "referrer") == 0) {
4232  } else if (dieWhenMissing) {
4233  debugs(3, DBG_CRITICAL, "FATAL: Log format '" << logdef_name << "' is not defined");
4234  self_destruct();
4235  return false;
4236  } else {
4237  return false;
4238  }
4239 
4240  return true;
4241 }
4242 
4243 static int
4244 check_null_access_log(CustomLog *customlog_definitions)
4245 {
4246  return customlog_definitions == NULL;
4247 }
4248 
4249 static void
4250 dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4251 {
4252  CustomLog *log;
4253 
4254  for (log = logs; log; log = log->next) {
4255  storeAppendPrintf(entry, "%s ", name);
4256 
4257  switch (log->type) {
4258 
4260  storeAppendPrintf(entry, "%s logformat=%s", log->filename, log->logFormat->name);
4261  break;
4262 
4263  case Log::Format::CLF_NONE:
4264  storeAppendPrintf(entry, "logformat=none");
4265  break;
4266 
4268  // this is the default, no need to add to the dump
4269  //storeAppendPrintf(entry, "%s logformat=squid", log->filename);
4270  break;
4271 
4273  storeAppendPrintf(entry, "%s logformat=combined", log->filename);
4274  break;
4275 
4277  storeAppendPrintf(entry, "%s logformat=common", log->filename);
4278  break;
4279 
4280 #if ICAP_CLIENT
4282  storeAppendPrintf(entry, "%s logformat=icap_squid", log->filename);
4283  break;
4284 #endif
4286  storeAppendPrintf(entry, "%s logformat=useragent", log->filename);
4287  break;
4288 
4290  storeAppendPrintf(entry, "%s logformat=referrer", log->filename);
4291  break;
4292 
4294  break;
4295  }
4296 
4297  // default is on-error=die
4298  if (!log->fatal)
4299  storeAppendPrintf(entry, " on-error=drop");
4300 
4301  // default: 64KB
4302  if (log->bufferSize != 64*1024)
4303  storeAppendPrintf(entry, " buffer-size=%" PRIuSIZE, log->bufferSize);
4304 
4305  if (log->rotateCount >= 0)
4306  storeAppendPrintf(entry, " rotate=%d", log->rotateCount);
4307 
4308  if (log->aclList)
4309  dump_acl_list(entry, log->aclList);
4310 
4311  storeAppendPrintf(entry, "\n");
4312  }
4313 }
4314 
4315 static void
4317 {
4318  while (*definitions) {
4319  CustomLog *log = *definitions;
4320  *definitions = log->next;
4321 
4322  log->logFormat = NULL;
4323  log->type = Log::Format::CLF_UNKNOWN;
4324 
4325  if (log->aclList)
4326  aclDestroyAclList(&log->aclList);
4327 
4328  safe_free(log->filename);
4329 
4330  xfree(log);
4331  }
4332 }
4333 
4334 #if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4335 static bool
4337 parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4338 {
4339  if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4340  data += name.size();
4341  if (*data == '=') {
4342  while (true) {
4343  ++data;
4344  int value = 0;
4345  if (!StringToInt(data, value, &data, 10))
4346  break;
4347  list.push_back(value);
4348  if (*data == '\0' || *data != ',')
4349  break;
4350  }
4351  }
4352  }
4353  return data && *data == '\0';
4354 }
4355 #endif
4356 
4357 static void
4358 parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4359 {
4360 #if !HAVE_CPU_AFFINITY
4361  debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4362  "support, do not set 'cpu_affinity_map'");
4363  self_destruct();
4364 
4365 #else /* HAVE_CPU_AFFINITY */
4366  if (!*cpuAffinityMap)
4367  *cpuAffinityMap = new CpuAffinityMap;
4368 
4369  const char *const pToken = ConfigParser::NextToken();
4370  const char *const cToken = ConfigParser::NextToken();
4371  std::vector<int> processes, cores;
4372  if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4373  debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4374  "in 'cpu_affinity_map'");
4375  self_destruct();
4376  } else if (!parseNamedIntList(cToken, "cores", cores)) {
4377  debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4378  "'cpu_affinity_map'");
4379  self_destruct();
4380  } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4381  debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4382  "process_numbers and cores lists differ in length or " <<
4383  "contain numbers <= 0");
4384  self_destruct();
4385  }
4386 #endif
4387 }
4388 
4389 static void
4390 dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4391 {
4392  if (cpuAffinityMap) {
4393  storeAppendPrintf(entry, "%s process_numbers=", name);
4394  for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4395  storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4396  cpuAffinityMap->processes()[i]);
4397  }
4398  storeAppendPrintf(entry, " cores=");
4399  for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4400  storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4401  cpuAffinityMap->cores()[i]);
4402  }
4403  storeAppendPrintf(entry, "\n");
4404  }
4405 }
4406 
4407 static void
4408 free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
4409 {
4410  delete *cpuAffinityMap;
4411  *cpuAffinityMap = NULL;
4412 }
4413 
4414 #if USE_ADAPTATION
4415 
4416 static void
4418 {
4420 }
4421 
4422 static void
4424 {
4426 }
4427 
4428 static void
4430 {
4432 }
4433 #endif /* USE_ADAPTATION */
4434 
4435 #if ICAP_CLIENT
4436 
4437 static void
4439 {
4440  cfg->parseService();
4441 }
4442 
4443 static void
4445 {
4446  cfg->freeService();
4447 }
4448 
4449 static void
4450 dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4451 {
4452  cfg.dumpService(entry, name);
4453 }
4454 
4455 static void
4457 {
4458  debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is deprecated. " <<
4459  "Use 'adaptation_service_set' instead");
4461 }
4462 
4463 static void
4465 {
4466  debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is deprecated. " <<
4467  "Use 'adaptation_access' instead");
4469 }
4470 
4471 #endif
4472 
4473 #if USE_ECAP
4474 
4475 static void
4477 {
4478  cfg->parseService();
4479 }
4480 
4481 static void
4483 {
4484  cfg->freeService();
4485 }
4486 
4487 static void
4488 dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4489 {
4490  cfg.dumpService(entry, name);
4491 }
4492 
4493 #endif /* USE_ECAP */
4494 
4495 #if ICAP_CLIENT
4497 {
4498  char *token;
4500 
4501  if ((token = ConfigParser::NextToken()) == NULL)
4502  return;
4503 
4504  if (strcmp(token,"in") != 0) {
4505  debugs(3, DBG_CRITICAL, "expecting 'in' on'" << config_input_line << "'");
4506  self_destruct();
4507  return;
4508  }
4509 
4511 }
4512 
4513 static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4514 {
4515  storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4516  if (cfg.oldest_service_failure > 0) {
4517  storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4518  }
4519  storeAppendPrintf(entry, "\n");
4520 }
4521 
4523 {
4524  cfg->oldest_service_failure = 0;
4525  cfg->service_failure_limit = 0;
4526 }
4527 #endif
4528 
4529 #if USE_OPENSSL
4531 {
4532  char *al;
4534  if ((al = ConfigParser::NextToken()) == NULL) {
4535  xfree(ca);
4536  self_destruct();
4537  return;
4538  }
4539 
4540  const char *param;
4541  if ( char *s = strchr(al, '{')) {
4542  *s = '\0'; // terminate the al string
4543  ++s;
4544  param = s;
4545  s = strchr(s, '}');
4546  if (!s) {
4547  xfree(ca);
4548  self_destruct();
4549  return;
4550  }
4551  *s = '\0';
4552  } else
4553  param = NULL;
4554 
4555  if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4556  ca->alg = Ssl::algSetValidAfter;
4557  ca->param = xstrdup("on");
4558  } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4560  ca->param = xstrdup("on");
4561  } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4562  ca->alg = Ssl::algSetCommonName;
4563  if (param) {
4564  if (strlen(param) > 64) {
4565  debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4566  xfree(ca);
4567  self_destruct();
4568  return;
4569  }
4570  ca->param = xstrdup(param);
4571  }
4572  } else {
4573  debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4574  xfree(ca);
4575  self_destruct();
4576  return;
4577  }
4578 
4580 
4581  while (*cert_adapt)
4582  cert_adapt = &(*cert_adapt)->next;
4583 
4584  *cert_adapt = ca;
4585 }
4586 
4587 static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4588 {
4589  for (sslproxy_cert_adapt *ca = cert_adapt; ca != NULL; ca = ca->next) {
4590  storeAppendPrintf(entry, "%s ", name);
4591  storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4592  if (ca->aclList)
4593  dump_acl_list(entry, ca->aclList);
4594  storeAppendPrintf(entry, "\n");
4595  }
4596 }
4597 
4599 {
4600  while (*cert_adapt) {
4601  sslproxy_cert_adapt *ca = *cert_adapt;
4602  *cert_adapt = ca->next;
4603  safe_free(ca->param);
4604 
4605  if (ca->aclList)
4606  aclDestroyAclList(&ca->aclList);
4607 
4608  safe_free(ca);
4609  }
4610 }
4611 
4613 {
4614  char *al;
4616  if ((al = ConfigParser::NextToken()) == NULL) {
4617  xfree(cs);
4618  self_destruct();
4619  return;
4620  }
4621 
4622  if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4623  cs->alg = Ssl::algSignTrusted;
4624  else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4625  cs->alg = Ssl::algSignUntrusted;
4626  else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4627  cs->alg = Ssl::algSignSelf;
4628  else {
4629  debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4630  xfree(cs);
4631  self_destruct();
4632  return;
4633  }
4634 
4636 
4637  while (*cert_sign)
4638  cert_sign = &(*cert_sign)->next;
4639 
4640  *cert_sign = cs;
4641 }
4642 
4643 static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4644 {
4645  sslproxy_cert_sign *cs;
4646  for (cs = cert_sign; cs != NULL; cs = cs->next) {
4647  storeAppendPrintf(entry, "%s ", name);
4648  storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4649  if (cs->aclList)
4650  dump_acl_list(entry, cs->aclList);
4651  storeAppendPrintf(entry, "\n");
4652  }
4653 }
4654 
4656 {
4657  while (*cert_sign) {
4658  sslproxy_cert_sign *cs = *cert_sign;
4659  *cert_sign = cs->next;
4660 
4661  if (cs->aclList)
4662  aclDestroyAclList(&cs->aclList);
4663 
4664  safe_free(cs);
4665  }
4666 }
4667 
4669 {
4670 public:
4672  /* RegisteredRunner API */
4673  virtual void finalizeConfig();
4674 };
4675 
4677 
4679 
4680 void
4682 {
4685  static char buf[1024];
4687  strcpy(buf, "ssl_bump deny all");
4688  debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4689  "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4690  "must not use implicit rules. Update your ssl_bump rules.");
4691  } else {
4692  strcpy(buf, "ssl_bump allow all");
4693  debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4694  "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4695  "inferior to the newer server-first bumping mode. New ssl_bump"
4696  " configurations must not use implicit rules. Update your ssl_bump rules.");
4697  }
4698  parse_line(buf);
4699  }
4700 }
4701 
4702 static void parse_sslproxy_ssl_bump(acl_access **ssl_bump)
4703 {
4704  typedef const char *BumpCfgStyle;
4705  BumpCfgStyle bcsNone = NULL;
4706  BumpCfgStyle bcsNew = "new client/server-first/none";
4707  BumpCfgStyle bcsOld = "deprecated allow/deny";
4708  static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4709  BumpCfgStyle bumpCfgStyleNow = bcsNone;
4710  char *bm;
4711  if ((bm = ConfigParser::NextToken()) == NULL) {
4712  self_destruct();
4713  return;
4714  }
4715 
4716  // if this is the first rule processed
4717  if (*ssl_bump == NULL) {
4718  bumpCfgStyleLast = bcsNone;
4720  }
4721 
4723 
4724  if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4726  bumpCfgStyleNow = bcsNew;
4727  } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4729  bumpCfgStyleNow = bcsNew;
4730  } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4731  action.kind = Ssl::bumpPeek;
4732  bumpCfgStyleNow = bcsNew;
4733  } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4734  action.kind = Ssl::bumpStare;
4735  bumpCfgStyleNow = bcsNew;
4736  } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4737  action.kind = Ssl::bumpSplice;
4738  bumpCfgStyleNow = bcsNew;
4739  } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4740  action.kind = Ssl::bumpBump;
4741  bumpCfgStyleNow = bcsNew;
4742  } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4743  action.kind = Ssl::bumpTerminate;
4744  bumpCfgStyleNow = bcsNew;
4745  } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4746  action.kind = Ssl::bumpNone;
4747  bumpCfgStyleNow = bcsNew;
4748  } else if (strcmp(bm, "allow") == 0) {
4749  debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4750  "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4751  "is usually inferior to the newer server-first "
4752  "bumping mode. Update your ssl_bump rules.");
4754  bumpCfgStyleNow = bcsOld;
4756  } else if (strcmp(bm, "deny") == 0) {
4757  debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4758  "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4759  "your ssl_bump rules.");
4760  action.kind = Ssl::bumpNone;
4761  bumpCfgStyleNow = bcsOld;
4763  } else {
4764  debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4765  self_destruct();
4766  return;
4767  }
4768 
4769  if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4770  debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4771  bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4772  self_destruct();
4773  return;
4774  }
4775 
4776  bumpCfgStyleLast = bumpCfgStyleNow;
4777 
4778  // empty rule OK
4779  ParseAclWithAction(ssl_bump, action, "ssl_bump");
4780 }
4781 
4782 static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4783 {
4784  if (ssl_bump)
4785  dump_SBufList(entry, ssl_bump->treeDump(name, [](const Acl::Answer &action) {
4786  return Ssl::BumpModeStr.at(action.kind);
4787  }));
4788 }
4789 
4790 static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4791 {
4792  free_acl_access(ssl_bump);
4793 }
4794 
4795 #endif
4796 
4797 static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4798 {
4799  if (!headers)
4800  return;
4801 
4802  for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4803  storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4804  if (hwa->aclList)
4805  dump_acl_list(entry, hwa->aclList);
4806  storeAppendPrintf(entry, "\n");
4807  }
4808 }
4809 
4811 {
4812  char *fn;
4813  if (!*headers) {
4814  *headers = new HeaderWithAclList;
4815  }
4816  if ((fn = ConfigParser::NextToken()) == NULL) {
4817  self_destruct();
4818  return;
4819  }
4820  HeaderWithAcl hwa;
4821  hwa.fieldName = fn;
4823  if (hwa.fieldId == Http::HdrType::BAD_HDR)
4825 
4826  Format::Format *nlf = new ::Format::Format("hdrWithAcl");
4830  hwa.fieldValue = buf.termedBuf();
4832  if (hwa.quoted) {
4833  if (!nlf->parse(hwa.fieldValue.c_str())) {
4834  self_destruct();
4835  return;
4836  }
4837  hwa.valueFormat = nlf;
4838  } else
4839  delete nlf;
4840  aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4841  (*headers)->push_back(hwa);
4842 }
4843 
4845 {
4846  if (!(*header))
4847  return;
4848 
4849  for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4850  if (hwa->aclList)
4851  aclDestroyAclList(&hwa->aclList);
4852 
4853  if (hwa->valueFormat) {
4854  delete hwa->valueFormat;
4855  hwa->valueFormat = NULL;
4856  }
4857  }
4858  delete *header;
4859  *header = NULL;
4860 }
4861 
4862 static void parse_note(Notes *notes)
4863 {
4864  assert(notes);
4865  notes->parse(LegacyParser);
4866 }
4867 
4868 static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4869 {
4870  notes.dump(entry, name);
4871 }
4872 
4873 static void free_note(Notes *notes)
4874 {
4875  notes->clean();
4876 }
4877 
4878 static bool FtpEspvDeprecated = false;
4879 static void parse_ftp_epsv(acl_access **ftp_epsv)
4880 {
4881  Acl::Answer ftpEpsvDeprecatedAction;
4882  bool ftpEpsvIsDeprecatedRule = false;
4883 
4884  char *t = ConfigParser::PeekAtToken();
4885  if (!t) {
4886  self_destruct();
4887  return;
4888  }
4889 
4890  if (!strcmp(t, "off")) {
4891  (void)ConfigParser::NextToken();
4892  ftpEpsvIsDeprecatedRule = true;
4893  ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_DENIED);
4894  } else if (!strcmp(t, "on")) {
4895  (void)ConfigParser::NextToken();
4896  ftpEpsvIsDeprecatedRule = true;
4897  ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_ALLOWED);
4898  }
4899 
4900  // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4901  // 1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4902  // 2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4903  // then abort
4904  if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4905  (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != NULL)) {
4906  debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4907  self_destruct();
4908  return;
4909  }
4910 
4911  if (ftpEpsvIsDeprecatedRule) {
4912  // overwrite previous ftp_epsv lines
4913  delete *ftp_epsv;
4914  *ftp_epsv = nullptr;
4915 
4916  if (ftpEpsvDeprecatedAction == Acl::Answer(ACCESS_DENIED)) {
4917  if (ACL *a = ACL::FindByName("all"))
4918  ParseAclWithAction(ftp_epsv, ftpEpsvDeprecatedAction, "ftp_epsv", a);
4919  else {
4920  self_destruct();
4921  return;
4922  }
4923  }
4924  FtpEspvDeprecated = true;
4925  } else {
4927  }
4928 }
4929 
4930 static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4931 {
4932  if (ftp_epsv)
4933  dump_SBufList(entry, ftp_epsv->treeDump(name, Acl::AllowOrDeny));
4934 }
4935 
4936 static void free_ftp_epsv(acl_access **ftp_epsv)
4937 {
4938  free_acl_access(ftp_epsv);
4939  FtpEspvDeprecated = false;
4940 }
4941 
4944 static std::chrono::seconds
4946 {
4947  const auto timeValueToken = ConfigParser::NextToken();
4948  if (!timeValueToken)
4949  throw TexcHere("cannot read a time value");
4950 
4951  using Seconds = std::chrono::seconds;
4952 
4953  const auto parsedTimeValue = xatof(timeValueToken);
4954 
4955  if (parsedTimeValue == 0)
4956  return std::chrono::seconds::zero();
4957 
4958  std::chrono::nanoseconds parsedUnitDuration;
4959 
4960  const auto unitToken = ConfigParser::PeekAtToken();
4961  if (parseTimeUnit<Seconds>(unitToken, parsedUnitDuration))
4962  (void)ConfigParser::NextToken();
4963  else {
4964  const auto defaultParsed = parseTimeUnit<Seconds>(T_SECOND_STR, parsedUnitDuration);
4965  assert(defaultParsed);
4967  ": WARNING: missing time unit, using deprecated default '" << T_SECOND_STR << "'");
4968  }
4969 
4970  const auto nanoseconds = ToNanoSeconds(parsedTimeValue, parsedUnitDuration);
4971 
4972  return FromNanoseconds<Seconds>(nanoseconds, parsedTimeValue);
4973 }
4974 
4975 static void
4977 {
4978  // TODO: do not allow optional timeunit (as the documentation prescribes)
4979  // and use parseTimeLine() instead.
4981 
4982  char *key, *value;
4983  while(ConfigParser::NextKvPair(key, value)) {
4984  if (strcasecmp(key, "on_timeout") == 0) {
4985  if (strcasecmp(value, "bypass") == 0)
4986  config->action = toutActBypass;
4987  else if (strcasecmp(value, "fail") == 0)
4988  config->action = toutActFail;
4989  else if (strcasecmp(value, "retry") == 0)
4990  config->action = toutActRetry;
4991  else if (strcasecmp(value, "use_configured_response") == 0) {
4993  } else {
4994  debugs(3, DBG_CRITICAL, "FATAL: unsupported \"on_timeout\" action: " << value);
4995  self_destruct();
4996  return;
4997  }
4998  } else if (strcasecmp(key, "response") == 0) {
4999  config->response = xstrdup(value);
5000  } else {
5001  debugs(3, DBG_CRITICAL, "FATAL: unsupported option " << key);
5002  self_destruct();
5003  return;
5004  }
5005  }
5006 
5007  if (config->action == toutActUseConfiguredResponse && !config->response) {
5008  debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
5009  self_destruct();
5010  }
5011 
5012  if (config->action != toutActUseConfiguredResponse && config->response) {
5013  debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the 'on_timeout=use_configured_response' option");
5014  self_destruct();
5015  }
5016 }
5017 
5018 static void
5020 {
5021  const char *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
5022  assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
5023 
5024  dump_time_t(entry, name, Config.Timeout.urlRewrite);
5025  storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
5026 
5027  if (config.response)
5028  storeAppendPrintf(entry, " response=\"%s\"", config.response);
5029 
5030  storeAppendPrintf(entry, "\n");
5031 }
5032 
5033 static void
5035 {
5037  config->action = 0;
5038  safe_free(config->response);
5039 }
5040 
5041 static void
5043 {
5044  int val = 0;
5045  parse_onoff(&val);
5046 
5047  // If quoted values is set to on then enable new strict mode parsing
5048  if (val) {
5050  ConfigParser::StrictMode = true;
5051  } else {
5053  ConfigParser::StrictMode = false;
5054  }
5055 }
5056 
5057 static void
5058 dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
5059 {
5060  int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
5061  dump_onoff(entry, name, val);
5062 }
5063 
5064 static void
5066 {
5068  ConfigParser::StrictMode = false;
5069 }
5070 
5071 static void
5073 {
5074  char *tm;
5075  if ((tm = ConfigParser::NextToken()) == NULL) {
5076  self_destruct();
5077  return;
5078  }
5079 
5081  if (strcmp(tm, "tunnel") == 0)
5082  action.kind = 1;
5083  else if (strcmp(tm, "respond") == 0)
5084  action.kind = 2;
5085  else {
5086  debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
5087  self_destruct();
5088  return;
5089  }
5090 
5091  // empty rule OK
5092  ParseAclWithAction(access, action, "on_unsupported_protocol");
5093 }
5094 
5095 static void
5096 dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
5097 {
5098  static const std::vector<const char *> onErrorTunnelMode = {
5099  "none",
5100  "tunnel",
5101  "respond"
5102  };
5103  if (access) {
5104  SBufList lines = access->treeDump(name, [](const Acl::Answer &action) {
5105  return onErrorTunnelMode.at(action.kind);
5106  });
5107  dump_SBufList(entry, lines);
5108  }
5109 }
5110 
5111 static void
5113 {
5114  free_acl_access(access);
5115 }
5116 
5117 static void
5119 {
5120  assert(protoGuardsPtr);
5121  auto &protoGuards = *protoGuardsPtr;
5122  if (!protoGuards)
5123  protoGuards = new HttpUpgradeProtocolAccess();
5124  protoGuards->configureGuard(LegacyParser);
5125 }
5126 
5127 static void
5129 {
5130  if (!protoGuards)
5131  return;
5132 
5133  const SBuf name(rawName);
5134  protoGuards->forEach([entry,&name](const SBuf &proto, const acl_access *acls) {
5135  SBufList line;
5136  line.push_back(name);
5137  line.push_back(proto);
5138  const auto acld = acls->treeDump("", &Acl::AllowOrDeny);
5139  line.insert(line.end(), acld.begin(), acld.end());
5140  dump_SBufList(entry, line);
5141  });
5142 }
5143 
5144 static void
5146 {
5147  assert(protoGuardsPtr);
5148  auto &protoGuards = *protoGuardsPtr;
5149  delete protoGuards;
5150  protoGuards = nullptr;
5151 }
5152 
char * errorDirectory
Definition: SquidConfig.h:433
const SQUIDCEXTERN char * xitoa(int num)
Definition: util.c:79
static peer_t parseNeighborType(const char *s)
Definition: cache_cf.cc:3434
acl_access * access_list
static void parse_http_header_access(HeaderManglers **manglers)
Definition: cache_cf.cc:1794
bool proxy_only
Definition: CachePeer.h:82
static void dump_wordlist(StoreEntry *entry, const char *name, wordlist *list)
Definition: cache_cf.cc:3239
void fatal(const char *message)
Definition: fatal.cc:28
const char * xstrerr(int error)
Definition: xstrerror.cc:83
bool no_query
Definition: CachePeer.h:83
#define URI_WHITESPACE_ENCODE
Definition: defines.h:196
@ bumpPeek
Definition: support.h:136
virtual void dump(StoreEntry &) const
Definition: Disk.cc:43
static void parse_adaptation_access_type()
Definition: cache_cf.cc:4429
static void dump_access_log(StoreEntry *entry, const char *name, CustomLog *definitions)
Definition: cache_cf.cc:4250
void parse_int(int *var)
Definition: cache_cf.cc:2590
static const char * FindStatement(const char *line, const char *statement)
Definition: cache_cf.cc:369
static void parsePortSpecification(const AnyP::PortCfgPointer &s, char *token)
Definition: cache_cf.cc:3515
static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &)
Definition: cache_cf.cc:4450
bool htcp_no_clr
Definition: CachePeer.h:94
time_t period
Definition: SquidConfig.h:232
static void dump_time_msec(StoreEntry *entry, const char *name, time_msec_t var)
Definition: cache_cf.cc:3055
int connection_auth
0 - off, 1 - on, 2 - auto
Definition: CachePeer.h:195
@ PEER_MULTICAST
Definition: enums.h:31
virtual bool active() const =0
static void ParseAccess(ConfigParser &parser)
Definition: Config.cc:276
void * xcalloc(size_t n, size_t sz)
Definition: xalloc.cc:72
void wordlistDestroy(wordlist **list)
destroy a wordlist
Definition: wordlist.cc:16
bool background_ping
Definition: CachePeer.h:84
static std::chrono::nanoseconds ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
Definition: cache_cf.cc:1122
static SBuf CurrentLocation()
static void parse_TokenOrQuotedString(char **var)
Definition: cache_cf.cc:3016
CachePeer * peerFindByName(const char *name)
Definition: neighbors.cc:1124
int opt_send_signal
void appendf(const char *fmt,...) PRINTF_FORMAT_ARG2
Append operation with printf-style arguments.
Definition: Packable.h:61
RunnerRegistrationEntry(sslBumpCfgRr)
const char * rawBuf() const
Definition: SquidString.h:85
#define BUFSIZ
Definition: defines.h:20
ACLList * aclList
Definition: QosConfig.h:37
static const char * peer_type_str(const peer_t type)
Definition: cache_cf.cc:2065
const char * uniqueHostname(void)
Definition: tools.cc:492
static void free_int(int *var)
Definition: cache_cf.cc:2598
static size_t parseBytesUnits(const char *unit)
Definition: cache_cf.cc:1365
static char * NextQuotedToken()
static void parse_icap_service_type(Adaptation::Icap::Config *)
Definition: cache_cf.cc:4438
static void parse_u_short(unsigned short *var)
Definition: cache_cf.cc:3214
CustomLog * icaplogs
Definition: SquidConfig.h:185
#define xmalloc
static void free_acl_tos(acl_tos **head)
Definition: cache_cf.cc:1602
@ CLF_COMMON
Definition: Formats.h:29
struct CachePeer::@31 options
struct squidaio_request_t * next
Definition: aiops.cc:51
acl_access * access
Definition: CachePeer.h:79
#define URI_WHITESPACE_STRIP
Definition: defines.h:194
bool xstrtoui(const char *s, char **end, unsigned int *value, unsigned int min, unsigned int max)
Definition: xstrto.cc:86
static void dump_tristate(StoreEntry *entry, const char *name, int var)
Definition: cache_cf.cc:2657
static void parse_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards)
Definition: cache_cf.cc:5118
void parsePoolClass()
Definition: DelayConfig.cc:31
static void dump_time_nanoseconds(StoreEntry *entry, const char *name, const std::chrono::nanoseconds &var)
Definition: cache_cf.cc:3076
static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap)
Definition: cache_cf.cc:4408
char * unlinkd
Definition: SquidConfig.h:201
void peerDigestCreate(CachePeer *p)
Definition: peer_digest.cc:130
static void parse_ecap_service_type(Adaptation::Ecap::Config *)
Definition: cache_cf.cc:4476
static void parse_delay_pool_class(DelayConfig *cfg)
Definition: cache_cf.cc:1724
#define URI_WHITESPACE_CHOP
Definition: defines.h:197
void useSquidUntrusted(SSL_CTX *sslContext)
Definition: support.cc:1176
Security::ContextPointer createClientContext(bool setOptions)
generate a security client-context from these configured options
Definition: PeerOptions.cc:271
u_int index
Definition: CachePeer.h:38
static void dump_kb_int64_t(StoreEntry *entry, const char *name, int64_t var)
Definition: cache_cf.cc:3129
static int parseManyConfigFiles(char *files, int depth)
Definition: cache_cf.cc:292
static ConfigParser LegacyParser
Definition: cache_cf.cc:265
double GetPercentage(bool limit)
Definition: Parsing.cc:172
static int parse_line(char *)
AnyP::ProtocolVersion ProtocolVersion()
Protocol version to use in Http::Message structures wrapping FTP messages.
Definition: Elements.cc:24
static void free_removalpolicy(RemovalPolicySettings **settings)
Definition: cache_cf.cc:3324
Log::Format::log_type type
Definition: CustomLog.h:33
manages a single cache_dir
Definition: Disk.h:21
#define LOCAL_ARRAY(type, name, size)
Definition: squid.h:75
static const char *const T_HOUR_STR
Definition: cache_cf.cc:147
static void parse_kb_int64_t(int64_t *var)
Definition: cache_cf.cc:3171
AnyP::PortCfgPointer HttpPortList
list of Squid http(s)_port configured
Definition: PortCfg.cc:21
static int check_null_acl_access(acl_access *a)
Definition: cache_cf.cc:3270
static void parse_refreshpattern(RefreshPattern **)
Definition: cache_cf.cc:2775
static void parse_address(Ip::Address *addr)
Definition: cache_cf.cc:1482
int memory_cache_first
Definition: SquidConfig.h:341
static void parse_acl_tos(acl_tos **head)
Definition: cache_cf.cc:1567
peer_t type
Definition: CachePeer.h:41
SBuf TheKidName
current Squid process name (e.g., "squid-coord")
Definition: Kids.cc:19
void log(char *format,...)
bool isEmpty() const
Definition: SBuf.h:420
static void free_acl_access(acl_access **head)
Definition: cache_cf.cc:1469
static ACL * FindByName(const char *name)
Definition: Acl.cc:93
static void free_cachemgrpasswd(Mgr::ActionPasswordList **head)
Definition: cache_cf.cc:2496
char config_input_line[BUFSIZ]