cache_cf.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2022 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9/* DEBUG: section 03 Configuration File Parsing */
10
11#include "squid.h"
12#include "acl/Acl.h"
13#include "acl/AclDenyInfoList.h"
14#include "acl/AclSizeLimit.h"
15#include "acl/Address.h"
16#include "acl/Gadgets.h"
17#include "acl/MethodData.h"
18#include "acl/Tree.h"
19#include "anyp/PortCfg.h"
20#include "anyp/UriScheme.h"
21#include "auth/Config.h"
22#include "auth/Scheme.h"
23#include "AuthReg.h"
24#include "base/PackableStream.h"
26#include "cache_cf.h"
27#include "CachePeer.h"
28#include "ConfigOption.h"
29#include "ConfigParser.h"
30#include "CpuAffinityMap.h"
31#include "debug/Messages.h"
32#include "DiskIO/DiskIOModule.h"
33#include "eui/Config.h"
34#include "ExternalACL.h"
35#include "format/Format.h"
36#include "fqdncache.h"
37#include "ftp/Elements.h"
38#include "globals.h"
39#include "HttpHeaderTools.h"
41#include "icmp/IcmpConfig.h"
42#include "ident/Config.h"
43#include "ip/Intercept.h"
44#include "ip/NfMarkConfig.h"
45#include "ip/QosConfig.h"
46#include "ip/tools.h"
47#include "ipc/Kids.h"
48#include "log/Config.h"
49#include "log/CustomLog.h"
50#include "MemBuf.h"
51#include "MessageDelayPools.h"
53#include "mgr/Registration.h"
54#include "neighbors.h"
56#include "Parsing.h"
57#include "pconn.h"
58#include "PeerDigest.h"
59#include "PeerPoolMgr.h"
60#include "redirect.h"
61#include "RefreshPattern.h"
62#include "rfc1738.h"
63#include "sbuf/List.h"
64#include "sbuf/Stream.h"
65#include "SquidConfig.h"
66#include "SquidString.h"
67#include "ssl/ProxyCerts.h"
68#include "Store.h"
69#include "store/Disks.h"
70#include "tools.h"
71#include "util.h"
72#include "wordlist.h"
73/* wccp2 has its own conditional definitions */
74#include "wccp2.h"
75#if USE_ADAPTATION
76#include "adaptation/Config.h"
77#endif
78#if ICAP_CLIENT
80#endif
81#if USE_ECAP
83#endif
84#if USE_OPENSSL
85#include "ssl/Config.h"
86#include "ssl/support.h"
87#endif
88#if USE_SQUID_ESI
89#include "esi/Parser.h"
90#endif
91#if SQUID_SNMP
92#include "snmp.h"
93#endif
94
95#if HAVE_GLOB_H
96#include <glob.h>
97#endif
98#include <chrono>
99#include <limits>
100#include <list>
101#if HAVE_PWD_H
102#include <pwd.h>
103#endif
104#if HAVE_GRP_H
105#include <grp.h>
106#endif
107#if HAVE_SYS_SOCKET_H
108#include <sys/socket.h>
109#endif
110#if HAVE_SYS_STAT_H
111#include <sys/stat.h>
112#endif
113
114#if USE_OPENSSL
115#include "ssl/gadgets.h"
116#endif
117
118#if USE_ADAPTATION
121static void parse_adaptation_access_type();
122#endif
123
124#if ICAP_CLIENT
126static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
128static void parse_icap_class_type();
129static void parse_icap_access_type();
130
132static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
134#endif
135
136#if USE_ECAP
138static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
140#endif
141
142static peer_t parseNeighborType(const char *s);
143
144static const char *const T_NANOSECOND_STR = "nanosecond";
145static const char *const T_MICROSECOND_STR = "microsecond";
146static const char *const T_MILLISECOND_STR = "millisecond";
147static const char *const T_SECOND_STR = "second";
148static const char *const T_MINUTE_STR = "minute";
149static const char *const T_HOUR_STR = "hour";
150static const char *const T_DAY_STR = "day";
151static const char *const T_WEEK_STR = "week";
152static const char *const T_FORTNIGHT_STR = "fortnight";
153static const char *const T_MONTH_STR = "month";
154static const char *const T_YEAR_STR = "year";
155static const char *const T_DECADE_STR = "decade";
156
157static const char *const B_BYTES_STR = "bytes";
158static const char *const B_KBYTES_STR = "KB";
159static const char *const B_MBYTES_STR = "MB";
160static const char *const B_GBYTES_STR = "GB";
161
162// std::chrono::years requires C++20. Do our own rough calculation for now.
163static const double HoursPerYear = 24*365.2522;
164
165static void parse_cache_log_message(DebugMessages **messages);
166static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *messages);
167static void free_cache_log_message(DebugMessages **messages);
168
169static void parse_access_log(CustomLog ** customlog_definitions);
170static int check_null_access_log(CustomLog *customlog_definitions);
171static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
172static void free_access_log(CustomLog ** definitions);
173
174static void configDoConfigure(void);
176static void parse_u_short(unsigned short * var);
177static void parse_string(char **);
178static void default_all(void);
179static void defaults_if_none(void);
180static void defaults_postscriptum(void);
181static int parse_line(char *);
182static void parse_obsolete(const char *);
183static void parseBytesLine(size_t * bptr, const char *units);
184static void parseBytesLineSigned(ssize_t * bptr, const char *units);
185static size_t parseBytesUnits(const char *unit);
186static void free_all(void);
187void requirePathnameExists(const char *name, const char *path);
189#if USE_HTTP_VIOLATIONS
190static void free_HeaderManglers(HeaderManglers **pm);
191static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
192static void parse_http_header_access(HeaderManglers **manglers);
193#define free_http_header_access free_HeaderManglers
194static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
195static void parse_http_header_replace(HeaderManglers **manglers);
196#define free_http_header_replace free_HeaderManglers
197#endif
198static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
199static void parse_HeaderWithAclList(HeaderWithAclList **header);
200static void free_HeaderWithAclList(HeaderWithAclList **header);
201static void parse_note(Notes *);
202static void dump_note(StoreEntry *, const char *, Notes &);
203static void free_note(Notes *);
204static void parse_denyinfo(AclDenyInfoList ** var);
205static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
206static void free_denyinfo(AclDenyInfoList ** var);
207
208#if USE_WCCPv2
210static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
212#if CURRENTLY_UNUSED
213static int check_null_IpAddress_list(const Ip::Address_list *);
214#endif /* CURRENTLY_UNUSED */
215#endif /* USE_WCCPv2 */
216
217static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
218#define parse_PortCfg(l) parsePortCfg((l), token)
219static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
220#define free_PortCfg(h) *(h)=NULL
221
222#if USE_OPENSSL
223static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
224static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
225static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
226static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
227static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
228static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
229static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
230static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
231static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
232#endif /* USE_OPENSSL */
233
234static void parse_ftp_epsv(acl_access **ftp_epsv);
235static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
236static void free_ftp_epsv(acl_access **ftp_epsv);
237
238static void parse_b_size_t(size_t * var);
239static void parse_b_int64_t(int64_t * var);
240
241static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
242static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
243static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
244
248
249static int parseOneConfigFile(const char *file_name, unsigned int depth);
250
251static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
252static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
253static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
254static void parse_on_unsupported_protocol(acl_access **access);
255static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
256static void free_on_unsupported_protocol(acl_access **access);
257static void ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl = nullptr);
259static void dump_http_upgrade_request_protocols(StoreEntry *entry, const char *name, HttpUpgradeProtocolAccess *protoGuards);
261
262/*
263 * LegacyParser is a parser for legacy code that uses the global
264 * approach. This is static so that it is only exposed to cache_cf.
265 * Other modules needing access to a ConfigParser should have it
266 * provided to them in their parserFOO methods.
267 */
269
270const char *cfg_directive = nullptr;
271const char *cfg_filename = nullptr;
274
275void
277{
279}
280
281static void
282SetConfigFilename(char const *file_name, bool is_pipe)
283{
284 if (is_pipe)
285 cfg_filename = file_name + 1;
286 else
287 cfg_filename = file_name;
288}
289
290static const char*
291skip_ws(const char* s)
292{
293 while (xisspace(*s))
294 ++s;
295
296 return s;
297}
298
299static int
300parseManyConfigFiles(char* files, int depth)
301{
302 int error_count = 0;
303 char* saveptr = nullptr;
304#if HAVE_GLOB
305 char *path;
306 glob_t globbuf;
307 int i;
308 memset(&globbuf, 0, sizeof(globbuf));
309 for (path = strwordtok(files, &saveptr); path; path = strwordtok(nullptr, &saveptr)) {
310 if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, nullptr, &globbuf) != 0) {
311 int xerrno = errno;
312 fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
313 }
314 }
315 for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
316 error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
317 }
318 globfree(&globbuf);
319#else
320 char* file = strwordtok(files, &saveptr);
321 while (file != NULL) {
322 error_count += parseOneConfigFile(file, depth);
323 file = strwordtok(NULL, &saveptr);
324 }
325#endif /* HAVE_GLOB */
326 return error_count;
327}
328
329static void
330ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
331{
332 assert(str != nullptr);
333 assert(newSubstr != nullptr);
334
335 unsigned newSubstrLen = strlen(newSubstr);
336 if (newSubstrLen > substrLen)
337 str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
338
339 // move tail part including zero
340 memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
341 // copy new substring in place
342 memcpy(str + substrIdx, newSubstr, newSubstrLen);
343
344 len = strlen(str);
345}
346
347static void
348SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
349{
350 assert(line != nullptr);
351 assert(macroName != nullptr);
352 assert(substStr != nullptr);
353 unsigned macroNameLen = strlen(macroName);
354 while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
355 ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
356}
357
358static void
359ProcessMacros(char*& line, int& len)
360{
361 SubstituteMacro(line, len, "${service_name}", service_name.c_str());
362 SubstituteMacro(line, len, "${process_name}", TheKidName.c_str());
363 SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
364}
365
366static void
368{
369 assert(str != nullptr);
370 unsigned i = strlen(str);
371 while ((i > 0) && xisspace(str[i - 1]))
372 --i;
373 str[i] = '\0';
374}
375
376static const char*
377FindStatement(const char* line, const char* statement)
378{
379 assert(line != nullptr);
380 assert(statement != nullptr);
381
382 const char* str = skip_ws(line);
383 unsigned len = strlen(statement);
384 if (strncmp(str, statement, len) == 0) {
385 str += len;
386 if (*str == '\0')
387 return str;
388 else if (xisspace(*str))
389 return skip_ws(str);
390 }
391
392 return nullptr;
393}
394
395static bool
396StrToInt(const char* str, long& number)
397{
398 assert(str != nullptr);
399
400 char* end;
401 number = strtol(str, &end, 0);
402
403 return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
404}
405
406static bool
407EvalBoolExpr(const char* expr)
408{
409 assert(expr != nullptr);
410 if (strcmp(expr, "true") == 0) {
411 return true;
412 } else if (strcmp(expr, "false") == 0) {
413 return false;
414 } else if (const char* equation = strchr(expr, '=')) {
415 const char* rvalue = skip_ws(equation + 1);
416 char* lvalue = (char*)xmalloc(equation - expr + 1);
417 xstrncpy(lvalue, expr, equation - expr + 1);
418 trim_trailing_ws(lvalue);
419
420 long number1;
421 if (!StrToInt(lvalue, number1))
422 fatalf("String is not a integer number: '%s'\n", lvalue);
423 long number2;
424 if (!StrToInt(rvalue, number2))
425 fatalf("String is not a integer number: '%s'\n", rvalue);
426
427 xfree(lvalue);
428 return number1 == number2;
429 }
430 fatalf("Unable to evaluate expression '%s'\n", expr);
431 return false; // this place cannot be reached
432}
433
434static int
435parseOneConfigFile(const char *file_name, unsigned int depth)
436{
437 FILE *fp = nullptr;
438 const char *orig_cfg_filename = cfg_filename;
439 const int orig_config_lineno = config_lineno;
440 char *token = nullptr;
441 char *tmp_line = nullptr;
442 int tmp_line_len = 0;
443 int err_count = 0;
444 int is_pipe = 0;
445
446 debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
447 if (depth > 16) {
448 fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
449 return 1;
450 }
451
452 if (file_name[0] == '!' || file_name[0] == '|') {
453 fp = popen(file_name + 1, "r");
454 is_pipe = 1;
455 } else {
456 fp = fopen(file_name, "r");
457 }
458
459 if (!fp) {
460 int xerrno = errno;
461 fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
462 }
463
464#if _SQUID_WINDOWS_
465 setmode(fileno(fp), O_TEXT);
466#endif
467
468 SetConfigFilename(file_name, bool(is_pipe));
469
470 memset(config_input_line, '\0', BUFSIZ);
471
472 config_lineno = 0;
473
474 std::vector<bool> if_states;
475 while (fgets(config_input_line, BUFSIZ, fp)) {
477
478 if ((token = strchr(config_input_line, '\n')))
479 *token = '\0';
480
481 if ((token = strchr(config_input_line, '\r')))
482 *token = '\0';
483
484 // strip any prefix whitespace off the line.
485 const char *p = skip_ws(config_input_line);
486 if (config_input_line != p)
487 memmove(config_input_line, p, strlen(p)+1);
488
489 if (strncmp(config_input_line, "#line ", 6) == 0) {
490 static char new_file_name[1024];
491 static char *file;
492 static char new_lineno;
493 token = config_input_line + 6;
494 new_lineno = strtol(token, &file, 0) - 1;
495
496 if (file == token)
497 continue; /* Not a valid #line directive, may be a comment */
498
499 while (*file && xisspace((unsigned char) *file))
500 ++file;
501
502 if (*file) {
503 if (*file != '"')
504 continue; /* Not a valid #line directive, may be a comment */
505
506 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
507
508 if ((token = strchr(new_file_name, '"')))
509 *token = '\0';
510
511 SetConfigFilename(new_file_name, false);
512 }
513
514 config_lineno = new_lineno;
515 }
516
517 if (config_input_line[0] == '#')
518 continue;
519
520 if (config_input_line[0] == '\0')
521 continue;
522
523 const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
524
525 size_t append_len = strlen(append);
526
527 tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
528
529 strcpy(tmp_line + tmp_line_len, append);
530
531 tmp_line_len += append_len;
532
533 if (tmp_line[tmp_line_len-1] == '\\') {
534 debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
535 tmp_line[--tmp_line_len] = '\0';
536 continue;
537 }
538
539 trim_trailing_ws(tmp_line);
540 ProcessMacros(tmp_line, tmp_line_len);
541 debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
542
543 if (const char* expr = FindStatement(tmp_line, "if")) {
544 if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
545 } else if (FindStatement(tmp_line, "endif")) {
546 if (!if_states.empty())
547 if_states.pop_back(); // remove last if-statement meaning
548 else
549 fatalf("'endif' without 'if'\n");
550 } else if (FindStatement(tmp_line, "else")) {
551 if (!if_states.empty())
552 if_states.back() = !if_states.back();
553 else
554 fatalf("'else' without 'if'\n");
555 } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
556 /* Handle includes here */
557 if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
558 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
559 } else {
560 try {
561 if (!parse_line(tmp_line)) {
562 debugs(3, DBG_CRITICAL, ConfigParser::CurrentLocation() << ": unrecognized: '" << tmp_line << "'");
563 ++err_count;
564 }
565 } catch (...) {
566 // fatal for now
567 debugs(3, DBG_CRITICAL, "ERROR: configuration failure: " << CurrentException);
569 }
570 }
571 }
572
573 safe_free(tmp_line);
574 tmp_line_len = 0;
575
576 }
577 if (!if_states.empty())
578 fatalf("if-statement without 'endif'\n");
579
580 if (is_pipe) {
581 int ret = pclose(fp);
582
583 if (ret != 0)
584 fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
585 } else {
586 fclose(fp);
587 }
588
589 SetConfigFilename(orig_cfg_filename, false);
590 config_lineno = orig_config_lineno;
591
592 xfree(tmp_line);
593 return err_count;
594}
595
596static
597int
598parseConfigFileOrThrow(const char *file_name)
599{
600 int err_count = 0;
601
602 debugs(5, 4, MYNAME);
603
605
607 default_all();
608
609 err_count = parseOneConfigFile(file_name, 0);
610
612
614
615 /*
616 * We must call configDoConfigure() before leave_suid() because
617 * configDoConfigure() is where we turn username strings into
618 * uid values.
619 */
621
622 if (opt_send_signal == -1) {
623 Mgr::RegisterAction("config",
624 "Current Squid Configuration",
626 1, 1);
627 }
628
629 return err_count;
630}
631
632// TODO: Refactor main.cc to centrally handle (and report) all exceptions.
633int
634parseConfigFile(const char *file_name)
635{
636 try {
637 return parseConfigFileOrThrow(file_name);
638 }
639 catch (const std::exception &ex) {
640 debugs(3, DBG_CRITICAL, "FATAL: bad configuration: " << ex.what());
642 return 1; // not reached
643 }
644}
645
646/*
647 * The templated functions below are essentially ConfigParser methods. They are
648 * not implemented as such because our generated code calling them is the only
649 * code that can instantiate implementations for each T -- we cannot place these
650 * definitions into ConfigParser.cc unless cf_parser.cci is moved there.
651 */
652
653// TODO: When adding Ts incompatible with this trivial API and implementation,
654// replace both with a ConfigParser-maintained table of seen directives.
656template <typename T>
657static bool
658SawDirective(const T &raw)
659{
660 return bool(raw);
661}
662
665template <typename T>
666static void
668{
669 if (SawDirective(raw))
671
672 // TODO: parser.openDirective(directiveName);
673 Must(!raw);
675 Must(raw);
676 parser.closeDirective();
677}
678
681template <typename T>
682static void
683DumpDirective(const T &raw, StoreEntry *entry, const char *name)
684{
685 if (!SawDirective(raw))
686 return; // not configured
687
688 entry->append(name, strlen(name));
689 SBufStream os;
691 const auto buf = os.buf();
692 if (buf.length()) {
693 entry->append(" ", 1);
694 entry->append(buf.rawContent(), buf.length());
695 }
696 entry->append("\n", 1);
697}
698
700template <typename T>
701static void
703{
705
706 // While the implementation may change, there is no way to avoid zeroing.
707 // Even migration to a proper SquidConfig class would not help: While
708 // ordinary destructors do not need to zero data members, a SquidConfig
709 // destructor would have to zero to protect any SquidConfig::x destruction
710 // code from accidentally dereferencing an already destroyed Config.y.
711 static_assert(std::is_trivial<T>::value, "SquidConfig member is trivial");
712 memset(&raw, 0, sizeof(raw));
713}
714
715static void
717{
718 Config2.clear();
719 /* init memory as early as possible */
720 memConfigure();
721 /* Sanity checks */
722
723 if (Debug::rotateNumber < 0) {
725 }
726
727#if SIZEOF_OFF_T <= 4
728 if (Config.Store.maxObjectSize > 0x7FFF0000) {
729 debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
730 Config.Store.maxObjectSize = 0x7FFF0000;
731 }
732#endif
733
736 else
737 visible_appname_string = (char const *)APP_FULLNAME;
738
739 if (Config.Program.redirect) {
740 if (Config.redirectChildren.n_max < 1) {
743 }
744 }
745
746 if (Config.Program.store_id) {
747 if (Config.storeIdChildren.n_max < 1) {
750 }
751 }
752
754 if (*Config.appendDomain != '.')
755 fatal("append_domain must begin with a '.'");
756
757 if (Config.errHtmlText == nullptr)
759
760#if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
761 if (Config.max_filedescriptors > 0) {
762 debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
763 }
764#elif USE_SELECT || USE_SELECT_WIN32
765 if (Config.max_filedescriptors > FD_SETSIZE) {
766 debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
767 }
768#endif
769
771
772 snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
775
776 /*
777 * the extra space is for loop detection in client_side.c -- we search
778 * for substrings in the Via header.
779 */
780 snprintf(ThisCache2, sizeof(ThisCache2), " %s (%s)",
783
784 /* Use visible_hostname as default surrogate_id */
786 const char *t = getMyHostname();
787 Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
788 }
789
792
795 else
797
798 if (Config.connect_retries > 10) {
799 debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
801 }
802
803 requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
804#if USE_UNLINKD
805
806 requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
807#endif
808 bool logDaemonUsed = false;
809 for (const auto *log = Config.Log.accesslogs; !logDaemonUsed && log; log = log->next)
810 logDaemonUsed = log->usesDaemon();
811#if ICAP_CLIENT
812 for (const auto *log = Config.Log.icaplogs; !logDaemonUsed && log; log = log->next)
813 logDaemonUsed = log->usesDaemon();
814#endif
815 if (logDaemonUsed)
816 requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
817
819 requirePathnameExists("redirect_program", Config.Program.redirect->key);
820
822 requirePathnameExists("store_id_program", Config.Program.store_id->key);
823
824 requirePathnameExists("Icon Directory", Config.icons.directory);
825
827 requirePathnameExists("Error Directory", Config.errorDirectory);
828
829#if USE_HTTP_VIOLATIONS
830
831 {
832 const RefreshPattern *R;
833
834 for (R = Config.Refresh; R; R = R->next) {
835 if (!R->flags.override_expire)
836 continue;
837
838 debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
839
840 break;
841 }
842
843 for (R = Config.Refresh; R; R = R->next) {
844 if (!R->flags.override_lastmod)
845 continue;
846
847 debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
848
849 break;
850 }
851
852 for (R = Config.Refresh; R; R = R->next) {
853 if (!R->flags.reload_into_ims)
854 continue;
855
856 debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
857
858 break;
859 }
860
861 for (R = Config.Refresh; R; R = R->next) {
862 if (!R->flags.ignore_reload)
863 continue;
864
865 debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
866
867 break;
868 }
869
870 for (R = Config.Refresh; R; R = R->next) {
871 if (!R->flags.ignore_no_store)
872 continue;
873
874 debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
875
876 break;
877 }
878
879 for (R = Config.Refresh; R; R = R->next) {
880 if (!R->flags.ignore_private)
881 continue;
882
883 debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
884
885 break;
886 }
887 }
888#endif
889#if !USE_HTTP_VIOLATIONS
890 Config.onoff.via = 1;
891#else
892
893 if (!Config.onoff.via)
894 debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
895
896#endif
897
898 // we enable runtime PURGE checks if there is at least one PURGE method ACL
899 // TODO: replace with a dedicated "purge" ACL option?
901
902 if (geteuid() == 0) {
903 if (nullptr != Config.effectiveUser) {
904
905 struct passwd *pwd = getpwnam(Config.effectiveUser);
906
907 if (nullptr == pwd) {
908 /*
909 * Andres Kroonmaa <andre@online.ee>:
910 * Some getpwnam() implementations (Solaris?) require
911 * an available FD < 256 for opening a FILE* to the
912 * passwd file.
913 * DW:
914 * This should be safe at startup, but might still fail
915 * during reconfigure.
916 */
917 fatalf("getpwnam failed to find userid for effective user '%s'",
919 return;
920 }
921
922 Config2.effectiveUserID = pwd->pw_uid;
923
924 Config2.effectiveGroupID = pwd->pw_gid;
925
926#if HAVE_PUTENV
927 if (pwd->pw_dir && *pwd->pw_dir) {
928 // putenv() leaks by design; avoid leaks when nothing changes
929 static SBuf lastDir;
930 if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
931 lastDir = pwd->pw_dir;
932 int len = strlen(pwd->pw_dir) + 6;
933 char *env_str = (char *)xcalloc(len, 1);
934 snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
935 putenv(env_str);
936 }
937 }
938#endif
939 }
940 } else {
941 Config2.effectiveUserID = geteuid();
942 Config2.effectiveGroupID = getegid();
943 }
944
945 if (nullptr != Config.effectiveGroup) {
946
947 struct group *grp = getgrnam(Config.effectiveGroup);
948
949 if (nullptr == grp) {
950 fatalf("getgrnam failed to find groupid for effective group '%s'",
952 return;
953 }
954
955 Config2.effectiveGroupID = grp->gr_gid;
956 }
957
958#if USE_OPENSSL
961#endif
962
963 if (Security::ProxyOutgoingConfig.encryptTransport) {
964 debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
967#if USE_OPENSSL
968 fatal("ERROR: Could not initialize https:// proxy context");
969#else
970 debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
971#endif
972 }
973#if USE_OPENSSL
975#endif
976 }
977
978 for (CachePeer *p = Config.peers; p != nullptr; p = p->next) {
979
980 // default value for ssldomain= is the peer host/IP
981 if (p->secure.sslDomain.isEmpty())
982 p->secure.sslDomain = p->host;
983
984 if (p->secure.encryptTransport) {
985 debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " TLS context");
986 p->sslContext = p->secure.createClientContext(true);
987 if (!p->sslContext) {
988 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize cache_peer " << p->name << " TLS context");
990 return;
991 }
992 }
993 }
994
995 for (AnyP::PortCfgPointer s = HttpPortList; s != nullptr; s = s->next) {
996 if (!s->secure.encryptTransport)
997 continue;
998 debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS contexts");
999 s->secure.initServerContexts(*s);
1000 }
1001
1002 // prevent infinite fetch loops in the request parser
1003 // due to buffer full but not enough data received to finish parse
1005 fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
1006 " Change client_request_buffer_max or request_header_max_size limits.",
1008 }
1009
1010 /*
1011 * Disable client side request pipelining if client_persistent_connections OFF.
1012 * Waste of resources queueing any pipelined requests when the first will close the connection.
1013 */
1015 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
1016 " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
1018 }
1019
1020#if USE_AUTH
1021 /*
1022 * disable client side request pipelining. There is a race with
1023 * Negotiate and NTLM when the client sends a second request on an
1024 * connection before the authenticate challenge is sent. With
1025 * pipelining OFF, the client may fail to authenticate, but squid's
1026 * state will be preserved.
1027 */
1028 if (Config.pipeline_max_prefetch > 0) {
1029 Auth::SchemeConfig *nego = Auth::SchemeConfig::Find("Negotiate");
1031 if ((nego && nego->active()) || (ntlm && ntlm->active())) {
1032 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
1034 }
1035 }
1036
1037 for (auto &authSchemes : Auth::TheConfig.schemeLists) {
1038 authSchemes.expand();
1039 if (authSchemes.authConfigs.empty()) {
1040 debugs(3, DBG_CRITICAL, "auth_schemes: at least one scheme name is required; got: " << authSchemes.rawSchemes);
1041 self_destruct();
1042 }
1043 }
1044#endif
1045}
1046
1053void
1054parse_obsolete(const char *name)
1055{
1056 // Directives which have been radically changed rather than removed
1057 if (!strcmp(name, "url_rewrite_concurrency")) {
1058 int cval;
1059 parse_int(&cval);
1060 debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
1062 }
1063
1064 if (!strcmp(name, "log_access")) {
1065 self_destruct();
1066 return;
1067 }
1068
1069 if (!strcmp(name, "log_icap")) {
1070 self_destruct();
1071 return;
1072 }
1073
1074 if (!strcmp(name, "ignore_ims_on_miss")) {
1075 // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
1076 // than the 2.7 directive. We need to parse and invert the configured value.
1077 int temp = 0;
1078 parse_onoff(&temp);
1080 }
1081
1082 if (!strncmp(name, "sslproxy_", 9)) {
1083 // the replacement directive tls_outgoing_options uses options instead of whole-line input
1084 SBuf tmp;
1085 if (!strcmp(name, "sslproxy_cafile"))
1086 tmp.append("cafile=");
1087 else if (!strcmp(name, "sslproxy_capath"))
1088 tmp.append("capath=");
1089 else if (!strcmp(name, "sslproxy_cipher"))
1090 tmp.append("cipher=");
1091 else if (!strcmp(name, "sslproxy_client_certificate"))
1092 tmp.append("cert=");
1093 else if (!strcmp(name, "sslproxy_client_key"))
1094 tmp.append("key=");
1095 else if (!strcmp(name, "sslproxy_flags"))
1096 tmp.append("flags=");
1097 else if (!strcmp(name, "sslproxy_options"))
1098 tmp.append("options=");
1099 else if (!strcmp(name, "sslproxy_version"))
1100 tmp.append("version=");
1101 else {
1102 debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1103 self_destruct();
1104 return;
1105 }
1106
1107 // add the value as unquoted-string because the old values did not support whitespace
1108 const char *token = ConfigParser::NextQuotedOrToEol();
1109 tmp.append(token, strlen(token));
1111 }
1112}
1113
1114template <class MinimalUnit>
1115static const char *
1117{
1118 const auto minUnit = MinimalUnit(1);
1119 if(minUnit == std::chrono::nanoseconds(1))
1120 return T_NANOSECOND_STR;
1121 else if (minUnit == std::chrono::microseconds(1))
1122 return T_MICROSECOND_STR;
1123 else if (minUnit == std::chrono::milliseconds(1))
1124 return T_MILLISECOND_STR;
1125 else {
1126 assert(minUnit >= std::chrono::seconds(1));
1127 return T_SECOND_STR;
1128 }
1129}
1130
1136template <class MinimalUnit>
1137static bool
1138parseTimeUnit(const char *unitName, std::chrono::nanoseconds &ns)
1139{
1140 if (!unitName)
1141 throw TexcHere("missing time unit");
1142
1143 if (!strncasecmp(unitName, T_NANOSECOND_STR, strlen(T_NANOSECOND_STR)))
1144 ns = std::chrono::nanoseconds(1);
1145 else if (!strncasecmp(unitName, T_MICROSECOND_STR, strlen(T_MICROSECOND_STR)))
1146 ns = std::chrono::microseconds(1);
1147 else if (!strncasecmp(unitName, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1148 ns = std::chrono::milliseconds(1);
1149 else if (!strncasecmp(unitName, T_SECOND_STR, strlen(T_SECOND_STR)))
1150 ns = std::chrono::seconds(1);
1151 else if (!strncasecmp(unitName, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1152 ns = std::chrono::minutes(1);
1153 else if (!strncasecmp(unitName, T_HOUR_STR, strlen(T_HOUR_STR)))
1154 ns = std::chrono::hours(1);
1155 else if (!strncasecmp(unitName, T_DAY_STR, strlen(T_DAY_STR)))
1156 ns = std::chrono::hours(24);
1157 else if (!strncasecmp(unitName, T_WEEK_STR, strlen(T_WEEK_STR)))
1158 ns = std::chrono::hours(24 * 7);
1159 else if (!strncasecmp(unitName, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1160 ns = std::chrono::hours(24 * 14);
1161 else if (!strncasecmp(unitName, T_MONTH_STR, strlen(T_MONTH_STR)))
1162 ns = std::chrono::hours(24 * 30);
1163 else if (!strncasecmp(unitName, T_YEAR_STR, strlen(T_YEAR_STR)))
1164 ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear));
1165 else if (!strncasecmp(unitName, T_DECADE_STR, strlen(T_DECADE_STR)))
1166 ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear * 10));
1167 else
1168 return false;
1169
1170 if (ns < MinimalUnit(1)) {
1171 throw TexcHere(ToSBuf("time unit '", unitName, "' is too small to be used in this context, the minimal unit is ",
1172 TimeUnitToString<MinimalUnit>()));
1173 }
1174
1175 return true;
1176}
1177
1178static std::chrono::nanoseconds
1179ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
1180{
1181 if (value < 0.0)
1182 throw TexcHere("time must have a positive value");
1183
1184 if (value > (static_cast<double>(std::chrono::nanoseconds::max().count()) / unit.count())) {
1185 const auto maxYears = std::chrono::duration_cast<std::chrono::hours>(std::chrono::nanoseconds::max()).count()/HoursPerYear;
1186 throw TexcHere(ToSBuf("time values cannot exceed ", maxYears, " years"));
1187 }
1188
1189 return std::chrono::duration_cast<std::chrono::nanoseconds>(unit * value);
1190}
1191
1192template <class TimeUnit>
1193static TimeUnit
1194FromNanoseconds(const std::chrono::nanoseconds &ns, const double parsedValue)
1195{
1196 const auto result = std::chrono::duration_cast<TimeUnit>(ns);
1197 if (!result.count()) {
1198 throw TexcHere(ToSBuf("time value '", parsedValue,
1199 "' is too small to be used in this context, the minimal value is 1 ",
1200 TimeUnitToString<TimeUnit>()));
1201 }
1202 return result;
1203}
1204
1207template <class TimeUnit>
1208static TimeUnit
1210{
1211 const auto valueToken = ConfigParser::NextToken();
1212 if (!valueToken)
1213 throw TexcHere("cannot read a time value");
1214
1215 const auto parsedValue = xatof(valueToken);
1216
1217 if (parsedValue == 0)
1218 return TimeUnit::zero();
1219
1220 std::chrono::nanoseconds parsedUnitDuration;
1221
1222 const auto token = ConfigParser::PeekAtToken();
1223
1224 if (!parseTimeUnit<TimeUnit>(token, parsedUnitDuration))
1225 throw TexcHere(ToSBuf("unknown time unit '", token, "'"));
1226
1228
1229 const auto nanoseconds = ToNanoSeconds(parsedValue, parsedUnitDuration);
1230
1231 // validate precisions (time-units-small only)
1232 if (TimeUnit(1) <= std::chrono::microseconds(1)) {
1233 if (0 < nanoseconds.count() && nanoseconds.count() < 3) {
1235 "Squid time measurement precision is likely to be far worse than " <<
1236 "the nanosecond-level precision implied by the configured value: " << parsedValue << ' ' << token);
1237 }
1238 }
1239
1240 return FromNanoseconds<TimeUnit>(nanoseconds, parsedValue);
1241}
1242
1243static void
1244parseBytesLine64(int64_t * bptr, const char *units)
1245{
1246 char *token;
1247 double d;
1248 int64_t m;
1249 int64_t u;
1250
1251 if ((u = parseBytesUnits(units)) == 0) {
1252 self_destruct();
1253 return;
1254 }
1255
1256 if ((token = ConfigParser::NextToken()) == nullptr) {
1257 self_destruct();
1258 return;
1259 }
1260
1261 if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1262 *bptr = -1;
1263 return;
1264 }
1265
1266 d = xatof(token);
1267
1268 m = u; /* default to 'units' if none specified */
1269
1270 if (0.0 == d)
1271 (void) 0;
1272 else if ((token = ConfigParser::NextToken()) == nullptr)
1273 debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1274 config_input_line << "', assuming " <<
1275 d << " " << units );
1276 else if ((m = parseBytesUnits(token)) == 0) {
1277 self_destruct();
1278 return;
1279 }
1280
1281 *bptr = static_cast<int64_t>(m * d / u);
1282
1283 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1284 debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1285 d << " " << token << ": integer overflow (int64_t).");
1286 self_destruct();
1287 }
1288}
1289
1290static void
1291parseBytesLine(size_t * bptr, const char *units)
1292{
1293 char *token;
1294 double d;
1295 int m;
1296 int u;
1297
1298 if ((u = parseBytesUnits(units)) == 0) {
1299 self_destruct();
1300 return;
1301 }
1302
1303 if ((token = ConfigParser::NextToken()) == nullptr) {
1304 self_destruct();
1305 return;
1306 }
1307
1308 if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1309 *bptr = static_cast<size_t>(-1);
1310 return;
1311 }
1312
1313 d = xatof(token);
1314
1315 m = u; /* default to 'units' if none specified */
1316
1317 if (0.0 == d)
1318 (void) 0;
1319 else if ((token = ConfigParser::NextToken()) == nullptr)
1320 debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1321 config_input_line << "', assuming " <<
1322 d << " " << units );
1323 else if ((m = parseBytesUnits(token)) == 0) {
1324 self_destruct();
1325 return;
1326 }
1327
1328 *bptr = static_cast<size_t>(m * d / u);
1329
1330 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1331 debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1332 d << " " << token << ": integer overflow (size_t).");
1333 self_destruct();
1334 }
1335}
1336
1337static void
1338parseBytesLineSigned(ssize_t * bptr, const char *units)
1339{
1340 char *token;
1341 double d;
1342 int m;
1343 int u;
1344
1345 if ((u = parseBytesUnits(units)) == 0) {
1346 self_destruct();
1347 return;
1348 }
1349
1350 if ((token = ConfigParser::NextToken()) == nullptr) {
1351 self_destruct();
1352 return;
1353 }
1354
1355 if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1356 *bptr = -1;
1357 return;
1358 }
1359
1360 d = xatof(token);
1361
1362 m = u; /* default to 'units' if none specified */
1363
1364 if (0.0 == d)
1365 (void) 0;
1366 else if ((token = ConfigParser::NextToken()) == nullptr)
1367 debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1368 config_input_line << "', assuming " <<
1369 d << " " << units );
1370 else if ((m = parseBytesUnits(token)) == 0) {
1371 self_destruct();
1372 return;
1373 }
1374
1375 *bptr = static_cast<ssize_t>(m * d / u);
1376
1377 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1378 debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1379 d << " " << token << ": integer overflow (ssize_t).");
1380 self_destruct();
1381 }
1382}
1383
1389void
1390parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1391{
1392 int u;
1393 if ((u = parseBytesUnits(units)) == 0) {
1394 self_destruct();
1395 return;
1396 }
1397
1398 // Find number from string beginning.
1399 char const * number_begin = value;
1400 char const * number_end = value;
1401
1402 while ((*number_end >= '0' && *number_end <= '9')) {
1403 ++number_end;
1404 }
1405
1406 String number;
1407 number.assign(number_begin, number_end - number_begin);
1408
1409 int d = xatoi(number.termedBuf());
1410 int m;
1411 if ((m = parseBytesUnits(number_end)) == 0) {
1412 self_destruct();
1413 return;
1414 }
1415
1416 *bptr = static_cast<size_t>(m * d / u);
1417 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1418 self_destruct();
1419}
1420
1421static size_t
1422parseBytesUnits(const char *unit)
1423{
1424 if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1425 return 1;
1426
1427 if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1428 return 1 << 10;
1429
1430 if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1431 return 1 << 20;
1432
1433 if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1434 return 1 << 30;
1435
1436 debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1437
1438 return 0;
1439}
1440
1441static void
1443{
1444 while (char *token = ConfigParser::NextQuotedToken())
1445 list->push_back(SBuf(token));
1446}
1447
1448// just dump a list, no directive name
1449static void
1450dump_SBufList(StoreEntry * entry, const SBufList &words)
1451{
1452 for (const auto &i : words) {
1453 entry->append(i.rawContent(), i.length());
1454 entry->append(" ",1);
1455 }
1456 entry->append("\n",1);
1457}
1458
1459// dump a SBufList type directive with name
1460static void
1461dump_SBufList(StoreEntry * entry, const char *name, SBufList &list)
1462{
1463 if (!list.empty()) {
1464 entry->append(name, strlen(name));
1465 entry->append(" ", 1);
1466 dump_SBufList(entry, list);
1467 }
1468}
1469
1470static void
1472{
1473 if (list)
1474 list->clear();
1475}
1476
1477static void
1478dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1479{
1480 while (ae != nullptr) {
1481 debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1482 storeAppendPrintf(entry, "%s %s %s ",
1483 name,
1484 ae->name,
1485 ae->typeString());
1486 SBufList tail;
1487 tail.splice(tail.end(), ae->dumpOptions());
1488 tail.splice(tail.end(), ae->dump()); // ACL parameters
1489 dump_SBufList(entry, tail);
1490 ae = ae->next;
1491 }
1492}
1493
1494static void
1496{
1498}
1499
1500static void
1502{
1503 aclDestroyAcls(ae);
1504}
1505
1506void
1508{
1509 // XXX: Should dump ACL names like "foo !bar" but dumps parsing context like
1510 // "(clientside_tos 0x11 line)".
1511 dump_SBufList(entry, head->dump());
1512}
1513
1514void
1515dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1516{
1517 if (head)
1518 dump_SBufList(entry, head->treeDump(name, &Acl::AllowOrDeny));
1519}
1520
1521static void
1523{
1525}
1526
1527static void
1529{
1531}
1532
1533static void
1534dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1535{
1536 char buf[MAX_IPSTRLEN];
1537 storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1538}
1539
1540static void
1542{
1543 char *token = ConfigParser::NextToken();
1544
1545 if (!token) {
1546 self_destruct();
1547 return;
1548 }
1549
1550 if (!strcmp(token,"any_addr"))
1551 addr->setAnyAddr();
1552 else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1553 addr->setNoAddr();
1554 else if ( (*addr = token) ) // try parse numeric/IPA
1555 (void) 0;
1556 else if (addr->GetHostByName(token)) // do not use ipcache
1557 (void) 0;
1558 else { // not an IP and not a hostname
1559 debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1560 self_destruct();
1561 }
1562}
1563
1564static void
1566{
1567 addr->setEmpty();
1568}
1569
1570static void
1571dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1572{
1573 char buf[MAX_IPSTRLEN];
1574
1575 for (Acl::Address *l = head; l; l = l->next) {
1576 if (!l->addr.isAnyAddr())
1577 storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1578 else
1579 storeAppendPrintf(entry, "%s autoselect", name);
1580
1581 dump_acl_list(entry, l->aclList);
1582
1583 storeAppendPrintf(entry, "\n");
1584 }
1585}
1586
1587static void
1589{
1590 Acl::Address *l = new Acl::Address;
1591 parse_address(&l->addr);
1593
1594 Acl::Address **tail = head;
1595 while (*tail)
1596 tail = &(*tail)->next;
1597
1598 *tail = l;
1599}
1600
1601static void
1603{
1604 delete *head;
1605 *head = nullptr;
1606}
1607
1608static void
1609dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1610{
1611 acl_tos *l;
1612
1613 for (l = head; l; l = l->next) {
1614 if (l->tos > 0)
1615 storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1616 else
1617 storeAppendPrintf(entry, "%s none", name);
1618
1619 dump_acl_list(entry, l->aclList);
1620
1621 storeAppendPrintf(entry, "\n");
1622 }
1623}
1624
1625static void
1627{
1628 unsigned int tos; /* Initially uint for strtoui. Casted to tos_t before return */
1629 char *token = ConfigParser::NextToken();
1630
1631 if (!token) {
1632 self_destruct();
1633 return;
1634 }
1635
1636 if (!xstrtoui(token, nullptr, &tos, 0, std::numeric_limits<tos_t>::max())) {
1637 self_destruct();
1638 return;
1639 }
1640
1641 const unsigned int chTos = tos & 0xFC;
1642 if (chTos != tos) {
1643 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1644 tos = chTos;
1645 }
1646
1647 acl_tos *l = new acl_tos;
1648
1649 l->tos = (tos_t)tos;
1650
1652
1653 acl_tos **tail = head; /* sane name below */
1654 while (*tail)
1655 tail = &(*tail)->next;
1656
1657 *tail = l;
1658}
1659
1660static void
1662{
1663 delete *head;
1664 *head = nullptr;
1665}
1666
1667#if SO_MARK && USE_LIBCAP
1668
1669static void
1670dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1671{
1672 for (acl_nfmark *l = head; l; l = l->next) {
1673 storeAppendPrintf(entry, "%s %s", name, ToSBuf(l->markConfig).c_str());
1674
1675 dump_acl_list(entry, l->aclList);
1676
1677 storeAppendPrintf(entry, "\n");
1678 }
1679}
1680
1681static void
1682parse_acl_nfmark(acl_nfmark ** head)
1683{
1685 const auto mc = Ip::NfMarkConfig::Parse(token);
1686
1687 // Packet marking directives should not allow to use masks.
1688 const auto pkt_dirs = {"mark_client_packet", "clientside_mark", "tcp_outgoing_mark"};
1689 if (mc.hasMask() && std::find(pkt_dirs.begin(), pkt_dirs.end(), cfg_directive) != pkt_dirs.end())
1690 throw TexcHere(ToSBuf("'", cfg_directive, "' does not support masked marks"));
1691
1692 acl_nfmark *l = new acl_nfmark;
1693 l->markConfig = mc;
1694
1695 aclParseAclList(LegacyParser, &l->aclList, token.c_str());
1696
1697 acl_nfmark **tail = head; /* sane name below */
1698 while (*tail)
1699 tail = &(*tail)->next;
1700
1701 *tail = l;
1702}
1703
1704static void
1705free_acl_nfmark(acl_nfmark ** head)
1706{
1707 delete *head;
1708 *head = nullptr;
1709}
1710#endif /* SO_MARK */
1711
1712static void
1713dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1714{
1715 for (AclSizeLimit *l = head; l; l = l->next) {
1716 if (l->size != -1)
1717 storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1718 else
1719 storeAppendPrintf(entry, "%s none", name);
1720
1721 dump_acl_list(entry, l->aclList);
1722
1723 storeAppendPrintf(entry, "\n");
1724 }
1725}
1726
1727static void
1729{
1730 AclSizeLimit *l = new AclSizeLimit;
1731
1732 parse_b_int64_t(&l->size);
1733
1735
1736 AclSizeLimit **tail = head; /* sane name below */
1737 while (*tail)
1738 tail = &(*tail)->next;
1739
1740 *tail = l;
1741}
1742
1743static void
1745{
1746 delete *head;
1747 *head = nullptr;
1748}
1749
1750#if USE_DELAY_POOLS
1751
1752#include "DelayConfig.h"
1753#include "DelayPools.h"
1754/* do nothing - free_delay_pool_count is the magic free function.
1755 * this is why delay_pool_count isn't just marked TYPE: u_short
1756 */
1757#define free_delay_pool_class(X)
1758#define free_delay_pool_access(X)
1759#define free_delay_pool_rates(X)
1760#define dump_delay_pool_class(X, Y, Z)
1761#define dump_delay_pool_access(X, Y, Z)
1762#define dump_delay_pool_rates(X, Y, Z)
1763
1764static void
1766{
1767 cfg->freePoolCount();
1768}
1769
1770static void
1771dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1772{
1773 cfg.dumpPoolCount (entry, name);
1774}
1775
1776static void
1778{
1779 cfg->parsePoolCount();
1780}
1781
1782static void
1784{
1785 cfg->parsePoolClass();
1786}
1787
1788static void
1790{
1791 cfg->parsePoolRates();
1792}
1793
1794static void
1796{
1798}
1799
1800#endif
1801
1802#if USE_DELAY_POOLS
1803#include "ClientDelayConfig.h"
1804/* do nothing - free_client_delay_pool_count is the magic free function.
1805 * this is why client_delay_pool_count isn't just marked TYPE: u_short
1806 */
1807
1808#define free_client_delay_pool_access(X)
1809#define free_client_delay_pool_rates(X)
1810#define dump_client_delay_pool_access(X, Y, Z)
1811#define dump_client_delay_pool_rates(X, Y, Z)
1812
1813static void
1815{
1816 cfg->freePools();
1817}
1818
1819static void
1821{
1822 cfg.dumpPoolCount (entry, name);
1823}
1824
1825static void
1827{
1828 cfg->parsePoolCount();
1829}
1830
1831static void
1833{
1834 cfg->parsePoolRates();
1835}
1836
1837static void
1839{
1841}
1842#endif
1843
1844#if USE_HTTP_VIOLATIONS
1845static void
1846dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1847{
1848 if (manglers)
1849 manglers->dumpAccess(entry, name);
1850}
1851
1852static void
1854{
1855 char *t = nullptr;
1856
1857 if ((t = ConfigParser::NextToken()) == nullptr) {
1858 debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1859 debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_access: missing header name.");
1860 return;
1861 }
1862
1863 if (!*pm)
1864 *pm = new HeaderManglers;
1865 HeaderManglers *manglers = *pm;
1866 headerMangler *mangler = manglers->track(t);
1867 assert(mangler);
1868
1869 std::string directive = "http_header_access ";
1870 directive += t;
1871 aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1872}
1873
1874static void
1876{
1877 // we delete the entire http_header_* mangler configuration at once
1878 if (const HeaderManglers *manglers = *pm) {
1879 delete manglers;
1880 *pm = nullptr;
1881 }
1882}
1883
1884static void
1885dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1886{
1887 if (manglers)
1888 manglers->dumpReplacement(entry, name);
1889}
1890
1891static void
1893{
1894 char *t = nullptr;
1895
1896 if ((t = ConfigParser::NextToken()) == nullptr) {
1897 debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1898 debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_replace: missing header name.");
1899 return;
1900 }
1901
1902 const char *value = ConfigParser::NextQuotedOrToEol();
1903
1904 if (!*pm)
1905 *pm = new HeaderManglers;
1906 HeaderManglers *manglers = *pm;
1907 manglers->setReplacement(t, value);
1908}
1909
1910#endif
1911
1912static void
1913dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1914{
1915 Store::Disks::Dump(swap, *entry, name);
1916}
1917
1918static int
1920{
1921 return s == nullptr;
1922}
1923
1924#if USE_AUTH
1925static void
1927{
1928 char *type_str = ConfigParser::NextToken();
1929 if (!type_str) {
1930 self_destruct();
1931 return;
1932 }
1933
1934 char *param_str = ConfigParser::NextToken();
1935 if (!param_str) {
1936 self_destruct();
1937 return;
1938 }
1939
1940 /* find a configuration for the scheme in the currently parsed configs... */
1941 Auth::SchemeConfig *schemeCfg = Auth::SchemeConfig::Find(type_str);
1942
1943 if (schemeCfg == nullptr) {
1944 /* Create a configuration based on the scheme info */
1945 Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1946
1947 if (theScheme == nullptr) {
1948 debugs(3, DBG_CRITICAL, "ERROR: Failure while parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1949 self_destruct();
1950 return;
1951 }
1952
1953 config->push_back(theScheme->createConfig());
1954 schemeCfg = Auth::SchemeConfig::Find(type_str);
1955 if (schemeCfg == nullptr) {
1956 debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1957 self_destruct();
1958 return;
1959 }
1960 }
1961
1962 schemeCfg->parse(schemeCfg, config->size(), param_str);
1963}
1964
1965static void
1967{
1968 /* Wipe the Auth globals and Detach/Destruct component config + state. */
1969 cfg->clear();
1970
1971 /* on reconfigure initialize new auth schemes for the new config. */
1972 if (reconfiguring) {
1973 Auth::Init();
1974 }
1975}
1976
1977static void
1978dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1979{
1980 for (auto *scheme : cfg)
1981 scheme->dump(entry, name, scheme);
1982}
1983
1984static void
1986{
1987 const char *tok = ConfigParser::NextQuotedToken();
1988 if (!tok) {
1989 debugs(29, DBG_CRITICAL, "FATAL: auth_schemes missing the parameter");
1990 self_destruct();
1991 return;
1992 }
1994 const auto action = Acl::Answer(ACCESS_ALLOWED, Auth::TheConfig.schemeLists.size() - 1);
1995 ParseAclWithAction(authSchemes, action, "auth_schemes");
1996}
1997
1998static void
2000{
2002 free_acl_access(authSchemes);
2003}
2004
2005static void
2006dump_AuthSchemes(StoreEntry *entry, const char *name, acl_access *authSchemes)
2007{
2008 if (authSchemes)
2009 dump_SBufList(entry, authSchemes->treeDump(name, [](const Acl::Answer &action) {
2010 return Auth::TheConfig.schemeLists.at(action.kind).rawSchemes;
2011 }));
2012}
2013
2014#endif /* USE_AUTH */
2015
2016static void
2017ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl)
2018{
2019 assert(access);
2020 SBuf name;
2021 if (!*access) {
2022 *access = new Acl::Tree;
2023 name.Printf("(%s rules)", desc);
2024 (*access)->context(name.c_str(), config_input_line);
2025 }
2026 Acl::AndNode *rule = new Acl::AndNode;
2027 name.Printf("(%s rule)", desc);
2028 rule->context(name.c_str(), config_input_line);
2029 if (acl)
2030 rule->add(acl);
2031 else
2032 rule->lineParse();
2033 (*access)->add(rule, action);
2034}
2035
2036static void
2038{
2039 assert(swap);
2040 Store::Disks::Parse(*swap);
2041}
2042
2043static const char *
2045{
2046 const char * result;
2047
2048 switch (type) {
2049
2050 case PEER_PARENT:
2051 result = "parent";
2052 break;
2053
2054 case PEER_SIBLING:
2055 result = "sibling";
2056 break;
2057
2058 case PEER_MULTICAST:
2059 result = "multicast";
2060 break;
2061
2062 default:
2063 result = "unknown";
2064 break;
2065 }
2066
2067 return result;
2068}
2069
2070static void
2071dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
2072{
2074 LOCAL_ARRAY(char, xname, 128);
2075
2076 while (p != nullptr) {
2077 storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
2078 name,
2079 p->host,
2080 neighborTypeStr(p),
2081 p->http_port,
2082 p->icp.port,
2083 p->name);
2084 dump_peer_options(entry, p);
2085
2086 if (p->access) {
2087 snprintf(xname, 128, "cache_peer_access %s", p->name);
2088 dump_acl_access(entry, xname, p->access);
2089 }
2090
2091 for (t = p->typelist; t; t = t->next) {
2092 storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
2093 p->host,
2094 peer_type_str(t->type),
2095 t->domain);
2096 }
2097
2098 p = p->next;
2099 }
2100}
2101
2106static bool
2107isUnsignedNumeric(const char *str, size_t len)
2108{
2109 if (len < 1) return false;
2110
2111 for (; len >0 && *str; ++str, --len) {
2112 if (! isdigit(*str))
2113 return false;
2114 }
2115 return true;
2116}
2117
2122static unsigned short
2123GetService(const char *proto)
2124{
2125 struct servent *port = nullptr;
2127 char *token = ConfigParser::NextToken();
2128 if (token == nullptr) {
2129 self_destruct();
2130 return 0; /* NEVER REACHED */
2131 }
2133 if ( !isUnsignedNumeric(token, strlen(token)) )
2134 port = getservbyname(token, proto);
2135 if (port != nullptr) {
2136 return ntohs((unsigned short)port->s_port);
2137 }
2139 return xatos(token);
2140}
2141
2146inline unsigned short
2148{
2149 return GetService("tcp");
2150}
2151
2156inline unsigned short
2158{
2159 return GetService("udp");
2160}
2161
2162static void
2164{
2165 char *host_str = ConfigParser::NextToken();
2166 if (!host_str) {
2167 self_destruct();
2168 return;
2169 }
2170
2171 char *token = ConfigParser::NextToken();
2172 if (!token) {
2173 self_destruct();
2174 return;
2175 }
2176
2177 CachePeer *p = new CachePeer;
2178 p->host = xstrdup(host_str);
2179 Tolower(p->host);
2180 p->name = xstrdup(host_str);
2181 p->type = parseNeighborType(token);
2182
2183 if (p->type == PEER_MULTICAST) {
2184 p->options.no_digest = true;
2185 p->options.no_netdb_exchange = true;
2186 }
2187
2188 p->http_port = GetTcpService();
2189
2190 if (!p->http_port) {
2191 delete p;
2192 self_destruct();
2193 return;
2194 }
2195
2196 p->icp.port = GetUdpService();
2197
2198 while ((token = ConfigParser::NextToken())) {
2199 if (!strcmp(token, "proxy-only")) {
2200 p->options.proxy_only = true;
2201 } else if (!strcmp(token, "no-query")) {
2202 p->options.no_query = true;
2203 } else if (!strcmp(token, "background-ping")) {
2204 p->options.background_ping = true;
2205 } else if (!strcmp(token, "no-digest")) {
2206 p->options.no_digest = true;
2207 } else if (!strcmp(token, "no-tproxy")) {
2208 p->options.no_tproxy = true;
2209 } else if (!strcmp(token, "multicast-responder")) {
2210 p->options.mcast_responder = true;
2211#if PEER_MULTICAST_SIBLINGS
2212 } else if (!strcmp(token, "multicast-siblings")) {
2213 p->options.mcast_siblings = true;
2214#endif
2215 } else if (!strncmp(token, "weight=", 7)) {
2216 p->weight = xatoi(token + 7);
2217 } else if (!strncmp(token, "basetime=", 9)) {
2218 p->basetime = xatoi(token + 9);
2219 } else if (!strcmp(token, "closest-only")) {
2220 p->options.closest_only = true;
2221 } else if (!strncmp(token, "ttl=", 4)) {
2222 p->mcast.ttl = xatoi(token + 4);
2223
2224 if (p->mcast.ttl < 0)
2225 p->mcast.ttl = 0;
2226
2227 if (p->mcast.ttl > 128)
2228 p->mcast.ttl = 128;
2229 } else if (!strcmp(token, "default")) {
2230 p->options.default_parent = true;
2231 } else if (!strcmp(token, "round-robin")) {
2232 p->options.roundrobin = true;
2233 } else if (!strcmp(token, "weighted-round-robin")) {
2234 p->options.weighted_roundrobin = true;
2235#if USE_HTCP
2236 } else if (!strcmp(token, "htcp")) {
2237 p->options.htcp = true;
2238 } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2239 /* Note: The htcp- form is deprecated, replaced by htcp= */
2240 p->options.htcp = true;
2241 char *tmp = xstrdup(token+5);
2242 char *mode, *nextmode;
2243 for (mode = nextmode = tmp; mode; mode = nextmode) {
2244 nextmode = strchr(mode, ',');
2245 if (nextmode) {
2246 *nextmode = '\0';
2247 ++nextmode;
2248 }
2249 if (!strcmp(mode, "no-clr")) {
2250 if (p->options.htcp_only_clr)
2251 fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2252 p->options.htcp_no_clr = true;
2253 } else if (!strcmp(mode, "no-purge-clr")) {
2254 p->options.htcp_no_purge_clr = true;
2255 } else if (!strcmp(mode, "only-clr")) {
2256 if (p->options.htcp_no_clr)
2257 fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2258 p->options.htcp_only_clr = true;
2259 } else if (!strcmp(mode, "forward-clr")) {
2260 p->options.htcp_forward_clr = true;
2261 } else if (!strcmp(mode, "oldsquid")) {
2262 p->options.htcp_oldsquid = true;
2263 } else {
2264 fatalf("invalid HTCP mode '%s'", mode);
2265 }
2266 }
2267 safe_free(tmp);
2268#endif
2269 } else if (!strcmp(token, "no-netdb-exchange")) {
2270 p->options.no_netdb_exchange = true;
2271
2272 } else if (!strcmp(token, "carp")) {
2273 if (p->type != PEER_PARENT)
2274 fatalf("parse_peer: non-parent carp peer %s/%d\n", p->host, p->http_port);
2275
2276 p->options.carp = true;
2277 } else if (!strncmp(token, "carp-key=", 9)) {
2278 if (p->options.carp != true)
2279 fatalf("parse_peer: carp-key specified on non-carp peer %s/%d\n", p->host, p->http_port);
2280 p->options.carp_key.set = true;
2281 char *nextkey=token+strlen("carp-key="), *key=nextkey;
2282 for (; key; key = nextkey) {
2283 nextkey=strchr(key,',');
2284 if (nextkey) ++nextkey; // skip the comma, any
2285 if (0==strncmp(key,"scheme",6)) {
2286 p->options.carp_key.scheme = true;
2287 } else if (0==strncmp(key,"host",4)) {
2288 p->options.carp_key.host = true;
2289 } else if (0==strncmp(key,"port",4)) {
2290 p->options.carp_key.port = true;
2291 } else if (0==strncmp(key,"path",4)) {
2292 p->options.carp_key.path = true;
2293 } else if (0==strncmp(key,"params",6)) {
2294 p->options.carp_key.params = true;
2295 } else {
2296 fatalf("invalid carp-key '%s'",key);
2297 }
2298 }
2299 } else if (!strcmp(token, "userhash")) {
2300#if USE_AUTH
2301 if (p->type != PEER_PARENT)
2302 fatalf("parse_peer: non-parent userhash peer %s/%d\n", p->host, p->http_port);
2303
2304 p->options.userhash = true;
2305#else
2306 fatalf("parse_peer: userhash requires authentication. peer %s/%d\n", p->host, p->http_port);
2307#endif
2308 } else if (!strcmp(token, "sourcehash")) {
2309 if (p->type != PEER_PARENT)
2310 fatalf("parse_peer: non-parent sourcehash peer %s/%d\n", p->host, p->http_port);
2311
2312 p->options.sourcehash = true;
2313
2314 } else if (!strcmp(token, "no-delay")) {
2315#if USE_DELAY_POOLS
2316 p->options.no_delay = true;
2317#else
2318 debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2319#endif
2320 } else if (!strncmp(token, "login=", 6)) {
2321 p->login = xstrdup(token + 6);
2323 } else if (!strcmp(token, "auth-no-keytab")) {
2324 p->options.auth_no_keytab = 1;
2325 } else if (!strncmp(token, "connect-timeout=", 16)) {
2326 p->connect_timeout_raw = xatoi(token + 16);
2327 } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2328 p->connect_fail_limit = xatoi(token + 19);
2329#if USE_CACHE_DIGESTS
2330 } else if (!strncmp(token, "digest-url=", 11)) {
2331 p->digest_url = xstrdup(token + 11);
2332#endif
2333
2334 } else if (!strcmp(token, "allow-miss")) {
2335 p->options.allow_miss = true;
2336 } else if (!strncmp(token, "max-conn=", 9)) {
2337 p->max_conn = xatoi(token + 9);
2338 } else if (!strncmp(token, "standby=", 8)) {
2339 p->standby.limit = xatoi(token + 8);
2340 } else if (!strcmp(token, "originserver")) {
2341 p->options.originserver = true;
2342 } else if (!strncmp(token, "name=", 5)) {
2343 safe_free(p->name);
2344
2345 if (token[5])
2346 p->name = xstrdup(token + 5);
2347 } else if (!strncmp(token, "forceddomain=", 13)) {
2348 safe_free(p->domain);
2349 if (token[13])
2350 p->domain = xstrdup(token + 13);
2351
2352 } else if (strncmp(token, "ssl", 3) == 0) {
2353#if !USE_OPENSSL
2354 debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2355#else
2356 p->secure.parse(token+3);
2357#endif
2358 } else if (strncmp(token, "tls-", 4) == 0) {
2359 p->secure.parse(token+4);
2360 } else if (strncmp(token, "tls", 3) == 0) {
2361 p->secure.parse(token+3);
2362 } else if (strcmp(token, "front-end-https") == 0) {
2363 p->front_end_https = 1;
2364 } else if (strcmp(token, "front-end-https=on") == 0) {
2365 p->front_end_https = 1;
2366 } else if (strcmp(token, "front-end-https=auto") == 0) {
2367 p->front_end_https = 2;
2368 } else if (strcmp(token, "connection-auth=off") == 0) {
2369 p->connection_auth = 0;
2370 } else if (strcmp(token, "connection-auth") == 0) {
2371 p->connection_auth = 1;
2372 } else if (strcmp(token, "connection-auth=on") == 0) {
2373 p->connection_auth = 1;
2374 } else if (strcmp(token, "connection-auth=auto") == 0) {
2375 p->connection_auth = 2;
2376 } else if (token[0] == '#') {
2377 // start of a text comment. stop reading this line.
2378 break;
2379 } else {
2380 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2381 }
2382 }
2383
2384 if (peerFindByName(p->name))
2385 fatalf("ERROR: cache_peer %s specified twice\n", p->name);
2386
2387 if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2388 fatalf("ERROR: cache_peer %s max-conn=%d is lower than its standby=%d\n", p->host, p->max_conn, p->standby.limit);
2389
2390 if (p->weight < 1)
2391 p->weight = 1;
2392
2393 if (p->connect_fail_limit < 1)
2394 p->connect_fail_limit = 10;
2395
2396#if USE_CACHE_DIGESTS
2397 if (!p->options.no_digest)
2399#endif
2400
2401 if (p->secure.encryptTransport)
2402 p->secure.parseOptions();
2403
2404 p->index = ++Config.npeers;
2405
2406 while (*head != nullptr)
2407 head = &(*head)->next;
2408
2409 *head = p;
2410
2412}
2413
2414static void
2416{
2417 delete *P;
2418 *P = nullptr;
2419 Config.npeers = 0;
2420}
2421
2422static void
2424{
2425 while (list) {
2426 if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2427 storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2428 else
2429 storeAppendPrintf(entry, "%s %s", name, list->passwd);
2430
2431 for (auto w : list->actions)
2432 entry->appendf(" " SQUIDSBUFPH, SQUIDSBUFPRINT(w));
2433
2434 storeAppendPrintf(entry, "\n");
2435 list = list->next;
2436 }
2437}
2438
2439static void
2441{
2442 char *passwd = nullptr;
2443 parse_string(&passwd);
2444
2446 p->passwd = passwd;
2447
2448 while (char *token = ConfigParser::NextQuotedToken())
2449 p->actions.push_back(SBuf(token));
2450
2452 for (P = head; *P; P = &(*P)->next) {
2453 /*
2454 * See if any of the actions from this line already have a
2455 * password from previous lines. The password checking
2456 * routines in cache_manager.c take the the password from
2457 * the first Mgr::ActionPasswordList that contains the
2458 * requested action. Thus, we should warn users who might
2459 * think they can have two passwords for the same action.
2460 */
2461 for (const auto &w : (*P)->actions) {
2462 for (const auto &u : p->actions) {
2463 if (w != u)
2464 continue;
2465
2466 debugs(0, DBG_PARSE_NOTE(1), "ERROR: action '" << u << "' (line " << config_lineno << ") already has a password");
2467 }
2468 }
2469 }
2470
2471 *P = p;
2472}
2473
2474static void
2476{
2477 delete *head;
2478 *head = nullptr;
2479}
2480
2481static void
2482dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2483{
2484 while (var != nullptr) {
2485 storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2486
2487 for (const auto &aclName: var->acl_list)
2488 storeAppendPrintf(entry, " " SQUIDSBUFPH, SQUIDSBUFPRINT(aclName));
2489
2490 storeAppendPrintf(entry, "\n");
2491
2492 var = var->next;
2493 }
2494}
2495
2496static void
2498{
2500}
2501
2502void
2504{
2505 delete *list;
2506 *list = nullptr;
2507}
2508
2509static void
2511{
2512 char *host = ConfigParser::NextToken();
2513 if (!host) {
2514 self_destruct();
2515 return;
2516 }
2517
2518 CachePeer *p = peerFindByName(host);
2519 if (!p) {
2520 debugs(15, DBG_CRITICAL, "ERROR: " << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2521 return;
2522 }
2523
2524 std::string directive = "peer_access ";
2525 directive += host;
2526 aclParseAccessLine(directive.c_str(), LegacyParser, &p->access);
2527}
2528
2529static void
2531{
2532 char *host = ConfigParser::NextToken();
2533 if (!host) {
2534 self_destruct();
2535 return;
2536 }
2537
2538 char *type = ConfigParser::NextToken();
2539 if (!type) {
2540 self_destruct();
2541 return;
2542 }
2543
2544 char *domain = nullptr;
2545 while ((domain = ConfigParser::NextToken())) {
2546 CachePeer *p = peerFindByName(host);
2547 if (!p) {
2548 debugs(15, DBG_CRITICAL, "" << cfg_filename << ", line " << config_lineno << ": No cache_peer '" << host << "'");
2549 return;
2550 }
2551
2552 auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2553 l->type = parseNeighborType(type);
2554 l->domain = xstrdup(domain);
2555
2556 NeighborTypeDomainList **L = nullptr;
2557 for (L = &(p->typelist); *L; L = &((*L)->next));
2558 *L = l;
2559 }
2560}
2561
2562static void
2563dump_int(StoreEntry * entry, const char *name, int var)
2564{
2565 storeAppendPrintf(entry, "%s %d\n", name, var);
2566}
2567
2568void
2569parse_int(int *var)
2570{
2571 int i;
2572 i = GetInteger();
2573 *var = i;
2574}
2575
2576static void
2577free_int(int *var)
2578{
2579 *var = 0;
2580}
2581
2582static void
2583dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2584{
2585 storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2586}
2587
2588static void
2589parse_int64_t(int64_t *var)
2590{
2591 int64_t i;
2592 i = GetInteger64();
2593 *var = i;
2594}
2595
2596static void
2597free_int64_t(int64_t *var)
2598{
2599 *var = 0;
2600}
2601
2602static void
2603dump_onoff(StoreEntry * entry, const char *name, int var)
2604{
2605 storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2606}
2607
2608void
2610{
2611 char *token = ConfigParser::NextToken();
2612 if (!token) {
2613 self_destruct();
2614 return;
2615 }
2616
2617 if (!strcmp(token, "on")) {
2618 *var = 1;
2619 } else if (!strcmp(token, "enable")) {
2620 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2621 *var = 1;
2622 } else if (!strcmp(token, "off")) {
2623 *var = 0;
2624 } else if (!strcmp(token, "disable")) {
2625 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2626 *var = 0;
2627 } else {
2628 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2629 self_destruct();
2630 }
2631}
2632
2633#define free_onoff free_int
2634
2635static void
2636dump_tristate(StoreEntry * entry, const char *name, int var)
2637{
2638 const char *state;
2639
2640 if (var > 0)
2641 state = "on";
2642 else if (var < 0)
2643 state = "warn";
2644 else
2645 state = "off";
2646
2647 storeAppendPrintf(entry, "%s %s\n", name, state);
2648}
2649
2650static void
2652{
2653 char *token = ConfigParser::NextToken();
2654 if (!token) {
2655 self_destruct();
2656 return;
2657 }
2658
2659 if (!strcmp(token, "on")) {
2660 *var = 1;
2661 } else if (!strcmp(token, "enable")) {
2662 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2663 *var = 1;
2664 } else if (!strcmp(token, "warn")) {
2665 *var = -1;
2666 } else if (!strcmp(token, "off")) {
2667 *var = 0;
2668 } else if (!strcmp(token, "disable")) {
2669 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2670 *var = 0;
2671 } else {
2672 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2673 self_destruct();
2674 }
2675}
2676
2677#define free_tristate free_int
2678
2679static void
2681{
2682 char *token = ConfigParser::PeekAtToken();
2683 if (!token) {
2684 self_destruct();
2685 return;
2686 }
2687
2688 if (!strcmp(token, "on")) {
2689 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2690 *var = 1;
2691 //pop the token
2693 } else if (!strcmp(token, "off")) {
2694 debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2695 *var = 0;
2696 //pop the token
2698 } else
2699 parse_int(var);
2700}
2701
2702#define free_pipelinePrefetch free_int
2703#define dump_pipelinePrefetch dump_int
2704
2705static void
2707{
2708 while (head != nullptr) {
2709 PackableStream os(*entry);
2710 os << name << ' ';
2711 head->printHead(os);
2712
2713 if (head->max_stale >= 0)
2714 storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2715
2716 if (head->flags.refresh_ims)
2717 storeAppendPrintf(entry, " refresh-ims");
2718
2719 if (head->flags.store_stale)
2720 storeAppendPrintf(entry, " store-stale");
2721
2722#if USE_HTTP_VIOLATIONS
2723
2724 if (head->flags.override_expire)
2725 storeAppendPrintf(entry, " override-expire");
2726
2727 if (head->flags.override_lastmod)
2728 storeAppendPrintf(entry, " override-lastmod");
2729
2730 if (head->flags.reload_into_ims)
2731 storeAppendPrintf(entry, " reload-into-ims");
2732
2733 if (head->flags.ignore_reload)
2734 storeAppendPrintf(entry, " ignore-reload");
2735
2736 if (head->flags.ignore_no_store)
2737 storeAppendPrintf(entry, " ignore-no-store");
2738
2739 if (head->flags.ignore_private)
2740 storeAppendPrintf(entry, " ignore-private");
2741#endif
2742
2743 storeAppendPrintf(entry, "\n");
2744
2745 head = head->next;
2746 }
2747}
2748
2749static void
2751{
2752 char *token;
2753 time_t min = 0;
2754 double pct = 0.0;
2755 time_t max = 0;
2756 int refresh_ims = 0;
2757 int store_stale = 0;
2758 int max_stale = -1;
2759
2760#if USE_HTTP_VIOLATIONS
2761
2762 int override_expire = 0;
2763 int override_lastmod = 0;
2764 int reload_into_ims = 0;
2765 int ignore_reload = 0;
2766 int ignore_no_store = 0;
2767 int ignore_private = 0;
2768#endif
2769
2770 int i;
2771 RefreshPattern *t;
2772
2773 auto regex = LegacyParser.regex("refresh_pattern regex");
2774
2775 i = GetInteger(); /* token: min */
2776
2777 /* catch negative and insanely huge values close to 32-bit wrap */
2778 if (i < 0) {
2779 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2780 i = 0;
2781 }
2782 if (i > 60*24*365) {
2783 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2784 i = 60*24*365;
2785 }
2786
2787 min = (time_t) (i * 60); /* convert minutes to seconds */
2788
2789 pct = GetPercentage(false); /* token: pct . with no limit on size */
2790
2791 i = GetInteger(); /* token: max */
2792
2793 /* catch negative and insanely huge values close to 32-bit wrap */
2794 if (i < 0) {
2795 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2796 i = 0;
2797 }
2798 if (i > 60*24*365) {
2799 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2800 i = 60*24*365;
2801 }
2802
2803 max = (time_t) (i * 60); /* convert minutes to seconds */
2804
2805 /* Options */
2806 while ((token = ConfigParser::NextToken()) != nullptr) {
2807 if (!strcmp(token, "refresh-ims")) {
2808 refresh_ims = 1;
2809 } else if (!strcmp(token, "store-stale")) {
2810 store_stale = 1;
2811 } else if (!strncmp(token, "max-stale=", 10)) {
2812 max_stale = xatoi(token + 10);
2813
2814#if USE_HTTP_VIOLATIONS
2815
2816 } else if (!strcmp(token, "override-expire"))
2817 override_expire = 1;
2818 else if (!strcmp(token, "override-lastmod"))
2819 override_lastmod = 1;
2820 else if (!strcmp(token, "ignore-no-store"))
2821 ignore_no_store = 1;
2822 else if (!strcmp(token, "ignore-private"))
2823 ignore_private = 1;
2824 else if (!strcmp(token, "reload-into-ims")) {
2825 reload_into_ims = 1;
2827 /* tell client_side.c that this is used */
2828 } else if (!strcmp(token, "ignore-reload")) {
2829 ignore_reload = 1;
2831 /* tell client_side.c that this is used */
2832#endif
2833
2834 } else if (!strcmp(token, "ignore-no-cache") ||
2835 !strcmp(token, "ignore-must-revalidate") ||
2836 !strcmp(token, "ignore-auth")
2837 ) {
2838 debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2839 } else
2840 debugs(22, DBG_CRITICAL, "ERROR: Unknown refresh_pattern option: " << token);
2841 }
2842
2843 pct = pct < 0.0 ? 0.0 : pct;
2844 max = max < 0 ? 0 : max;
2845 t = new RefreshPattern(std::move(regex));
2846 t->min = min;
2847 t->pct = pct;
2848 t->max = max;
2849
2850 if (refresh_ims)
2851 t->flags.refresh_ims = true;
2852
2853 if (store_stale)
2854 t->flags.store_stale = true;
2855
2856 t->max_stale = max_stale;
2857
2858#if USE_HTTP_VIOLATIONS
2859
2860 if (override_expire)
2861 t->flags.override_expire = true;
2862
2863 if (override_lastmod)
2864 t->flags.override_lastmod = true;
2865
2866 if (reload_into_ims)
2867 t->flags.reload_into_ims = true;
2868
2869 if (ignore_reload)
2870 t->flags.ignore_reload = true;
2871
2872 if (ignore_no_store)
2873 t->flags.ignore_no_store = true;
2874
2875 if (ignore_private)
2876 t->flags.ignore_private = true;
2877#endif
2878
2879 t->next = nullptr;
2880
2881 while (*head)
2882 head = &(*head)->next;
2883
2884 *head = t;
2885}
2886
2887static void
2889{
2890 delete *head;
2891 *head = nullptr;
2892
2893#if USE_HTTP_VIOLATIONS
2895
2896#endif
2897}
2898
2899static void
2900dump_string(StoreEntry * entry, const char *name, char *var)
2901{
2902 if (var != nullptr)
2903 storeAppendPrintf(entry, "%s %s\n", name, var);
2904}
2905
2906static void
2907parse_string(char **var)
2908{
2909 safe_free(*var);
2910
2911 char *token = ConfigParser::NextToken();
2912 if (!token) {
2913 self_destruct();
2914 return;
2915 }
2916
2917 *var = xstrdup(token);
2918}
2919
2920static void
2921free_string(char **var)
2922{
2923 safe_free(*var);
2924}
2925
2926void
2927parse_eol(char *volatile *var)
2928{
2929 if (!var) {
2930 self_destruct();
2931 return;
2932 }
2933
2934 unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2935 safe_free(*var);
2936
2937 if (!token) {
2938 self_destruct();
2939 return;
2940 }
2941
2942 while (*token && xisspace(*token))
2943 ++token;
2944
2945 if (!*token) {
2946 self_destruct();
2947 return;
2948 }
2949
2950 *var = xstrdup((char *) token);
2951}
2952
2953#define dump_eol dump_string
2954#define free_eol free_string
2955
2956static void
2958{
2959 safe_free(*var);
2960
2961 char *token = ConfigParser::NextQuotedToken();
2962 if (!token) {
2963 self_destruct();
2964 return;
2965 }
2966
2967 *var = xstrdup(token);
2968}
2969
2970#define dump_TokenOrQuotedString dump_string
2971#define free_TokenOrQuotedString free_string
2972
2973static void
2974dump_time_t(StoreEntry * entry, const char *name, time_t var)
2975{
2976 storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2977}
2978
2979void
2980parse_time_t(time_t * var)
2981{
2982 const auto maxTime = std::numeric_limits<time_t>::max();
2983 const auto seconds = parseTimeLine<std::chrono::seconds>();
2984 if (maxTime < seconds.count())
2985 throw TexcHere(ToSBuf("directive supports time values up to ", maxTime, " but is given ", seconds.count(), " seconds"));
2986 *var = static_cast<time_t>(seconds.count());
2987}
2988
2989static void
2990free_time_t(time_t * var)
2991{
2992 *var = 0;
2993}
2994
2995static void
2996dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2997{
2998 if (var % 1000)
2999 storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
3000 else
3001 storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
3002}
3003
3004static void
3006{
3007 *var = parseTimeLine<std::chrono::milliseconds>().count();
3008}
3009
3010static void
3012{
3013 *var = 0;
3014}
3015
3016static void
3017dump_time_nanoseconds(StoreEntry *entry, const char *name, const std::chrono::nanoseconds &var)
3018{
3019 // std::chrono::nanoseconds::rep is unknown a priori so we cast to (and print) the largest supported integer
3020 storeAppendPrintf(entry, "%s %jd nanoseconds\n", name, static_cast<intmax_t>(var.count()));
3021}
3022
3023static void
3024parse_time_nanoseconds(std::chrono::nanoseconds *var)
3025{
3026 *var = parseTimeLine<std::chrono::nanoseconds>();
3027}
3028
3029static void
3030free_time_nanoseconds(std::chrono::nanoseconds *var)
3031{
3032 *var = std::chrono::nanoseconds::zero();
3033}
3034
3035static void
3036dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3037{
3038 storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3039}
3040
3041static void
3042dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3043{
3044 storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3045}
3046
3047static void
3048dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3049{
3050 storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3051}
3052
3053static void
3054dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3055{
3056 storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3057}
3058
3059static void
3060parse_b_size_t(size_t * var)
3061{
3063}
3064
3065static void
3066parse_b_ssize_t(ssize_t * var)
3067{
3069}
3070
3071static void
3072parse_b_int64_t(int64_t * var)
3073{
3075}
3076
3077static void
3078parse_kb_int64_t(int64_t * var)
3079{
3081}
3082
3083static void
3084free_size_t(size_t * var)
3085{
3086 *var = 0;
3087}
3088
3089static void
3090free_ssize_t(ssize_t * var)
3091{
3092 *var = 0;
3093}
3094
3095static void
3096free_b_int64_t(int64_t * var)
3097{
3098 *var = 0;
3099}
3100
3101#define free_b_size_t free_size_t
3102#define free_b_ssize_t free_ssize_t
3103#define free_kb_size_t free_size_t
3104#define free_mb_size_t free_size_t
3105#define free_gb_size_t free_size_t
3106#define free_kb_int64_t free_b_int64_t
3107
3108static void
3109dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3110{
3111 storeAppendPrintf(entry, "%s %d\n", name, var);
3112}
3113
3114static void
3115free_u_short(unsigned short * u)
3116{
3117 *u = 0;
3118}
3119
3120static void
3121parse_u_short(unsigned short * var)
3122{
3124}
3125
3126void
3127ConfigParser::ParseUShort(unsigned short *var)
3128{
3129 *var = GetShort();
3130}
3131
3132void
3134{
3135 int i = GetInteger();
3136
3137 if (0 == i)
3138 *var = false;
3139 else if (1 == i)
3140 *var = true;
3141 else
3142 self_destruct();
3143}
3144
3145static void
3146dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3147{
3148 while (list != nullptr) {
3149 storeAppendPrintf(entry, "%s %s\n", name, list->key);
3150 list = list->next;
3151 }
3152}
3153
3154void
3156{
3157 parse_wordlist(list);
3158}
3159
3160void
3162{
3163 char *token;
3164 while ((token = ConfigParser::NextQuotedToken()))
3165 wordlistAdd(list, token);
3166}
3167
3168static int
3170{
3171 return a == nullptr;
3172}
3173
3174#define free_wordlist wordlistDestroy
3175
3176#define free_uri_whitespace free_int
3177
3178static void
3180{
3181 char *token = ConfigParser::NextToken();
3182 if (!token) {
3183 self_destruct();
3184 return;
3185 }
3186
3187 if (!strcmp(token, "strip"))
3188 *var = URI_WHITESPACE_STRIP;
3189 else if (!strcmp(token, "deny"))
3190 *var = URI_WHITESPACE_DENY;
3191 else if (!strcmp(token, "allow"))
3192 *var = URI_WHITESPACE_ALLOW;
3193 else if (!strcmp(token, "encode"))
3194 *var = URI_WHITESPACE_ENCODE;
3195 else if (!strcmp(token, "chop"))
3196 *var = URI_WHITESPACE_CHOP;
3197 else {
3198 debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3199 self_destruct();
3200 }
3201}
3202
3203static void
3204dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3205{
3206 const char *s;
3207
3208 if (var == URI_WHITESPACE_ALLOW)
3209 s = "allow";
3210 else if (var == URI_WHITESPACE_ENCODE)
3211 s = "encode";
3212 else if (var == URI_WHITESPACE_CHOP)
3213 s = "chop";
3214 else if (var == URI_WHITESPACE_DENY)
3215 s = "deny";
3216 else
3217 s = "strip";
3218
3219 storeAppendPrintf(entry, "%s %s\n", name, s);
3220}
3221
3222static void
3224{
3225 if (!*settings)
3226 return;
3227
3228 free_string(&(*settings)->type);
3229
3230 free_wordlist(&(*settings)->args);
3231
3232 delete *settings;
3233
3234 *settings = nullptr;
3235}
3236
3237static void
3239{
3240 if (*settings)
3241 free_removalpolicy(settings);
3242
3243 *settings = new RemovalPolicySettings;
3244
3245 parse_string(&(*settings)->type);
3246
3247 parse_wordlist(&(*settings)->args);
3248}
3249
3250static void
3251dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3252{
3253 wordlist *args;
3254 storeAppendPrintf(entry, "%s %s", name, settings->type);
3255 args = settings->args;
3256
3257 while (args) {
3258 storeAppendPrintf(entry, " %s", args->key);
3259 args = args->next;
3260 }
3261
3262 storeAppendPrintf(entry, "\n");
3263}
3264
3265inline void
3267{}
3268
3269static void
3271{
3272 int value = 0;
3273 parse_onoff(&value);
3274 option->configure(value > 0);
3275}
3276
3277static void
3278dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3279{
3280 if (option.configured())
3281 dump_onoff(entry, name, option ? 1 : 0);
3282}
3283
3284static void
3286{}
3287
3288static void
3290{
3291 char *token = ConfigParser::NextToken();
3292 if (!token) {
3293 self_destruct();
3294 return;
3295 }
3296
3297 if (strcmp(token, "always") == 0) {
3300 } else if (strcmp(token, "disk") == 0) {
3303 } else if (strncmp(token, "net", 3) == 0) {
3306 } else if (strcmp(token, "never") == 0) {
3309 } else {
3310 debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3311 self_destruct();
3312 }
3313}
3314
3315static void
3316dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3317{
3318 storeAppendPrintf(entry, "%s ", name);
3320 storeAppendPrintf(entry, "always");
3322 storeAppendPrintf(entry, "disk");
3324 storeAppendPrintf(entry, "network");
3326 storeAppendPrintf(entry, "none");
3327 storeAppendPrintf(entry, "\n");
3328}
3329
3330#include "cf_parser.cci"
3331
3332peer_t
3333parseNeighborType(const char *s)
3334{
3335 if (!strcmp(s, "parent"))
3336 return PEER_PARENT;
3337
3338 if (!strcmp(s, "neighbor"))
3339 return PEER_SIBLING;
3340
3341 if (!strcmp(s, "neighbour"))
3342 return PEER_SIBLING;
3343
3344 if (!strcmp(s, "sibling"))
3345 return PEER_SIBLING;
3346
3347 if (!strcmp(s, "multicast"))
3348 return PEER_MULTICAST;
3349
3350 debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3351
3352 return PEER_SIBLING;
3353}
3354
3355#if USE_WCCPv2
3356static void
3358{
3359 char *token;
3361 Ip::Address ipa;
3362
3363 while ((token = ConfigParser::NextToken())) {
3364 if (GetHostWithPort(token, &ipa)) {
3365
3366 while (*head)
3367 head = &(*head)->next;
3368
3369 s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3370 s->s = ipa;
3371
3372 *head = s;
3373 } else {
3374 self_destruct();
3375 return;
3376 }
3377 }
3378}
3379
3380static void
3382{
3383 char ntoabuf[MAX_IPSTRLEN];
3384
3385 while (s) {
3386 storeAppendPrintf(e, "%s %s\n",
3387 n,
3388 s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3389 s = s->next;
3390 }
3391}
3392
3393static void
3395{
3396 if (*head) delete *head;
3397 *head = nullptr;
3398}
3399
3400#if CURRENTLY_UNUSED
3401/* This code was previously used by http_port. Left as it really should
3402 * be used by icp_port and htcp_port
3403 */
3404static int
3405check_null_IpAddress_list(const Ip::Address_list * s)
3406{
3407 return NULL == s;
3408}
3409
3410#endif /* CURRENTLY_UNUSED */
3411#endif /* USE_WCCPv2 */
3412
3413static void
3415{
3416 char *host = nullptr;
3417 unsigned short port = 0;
3418 char *t = nullptr;
3419 char *junk = nullptr;
3420
3421 s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3422 s->name = xstrdup(token);
3423 s->connection_auth_disabled = false;
3424
3425 const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3426
3427 if (*token == '[') {
3428 /* [ipv6]:port */
3429 host = token + 1;
3430 t = strchr(host, ']');
3431 if (!t) {
3432 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3433 self_destruct();
3434 return;
3435 }
3436 *t = '\0';
3437 ++t;
3438 if (*t != ':') {
3439 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3440 self_destruct();
3441 return;
3442 }
3443 if (!Ip::EnableIpv6) {
3444 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3445 self_destruct();
3446 return;
3447 }
3448 port = xatos(t + 1);
3449 } else if ((t = strchr(token, ':'))) {
3450 /* host:port */
3451 /* ipv4:port */
3452 host = token;
3453 *t = '\0';
3454 port = xatos(t + 1);
3455
3456 } else if (strtol(token, &junk, 10) && !*junk) {
3457 port = xatos(token);
3458 debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3459 } else {
3460 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3461 self_destruct();
3462 return;
3463 }
3464
3465 if (port == 0 && host != nullptr) {
3466 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3467 self_destruct();
3468 return;
3469 }
3470
3471 if (nullptr == host) {
3472 s->s.setAnyAddr();
3473 s->s.port(port);
3474 if (!Ip::EnableIpv6)
3475 s->s.setIPv4();
3476 debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3477 } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3478 s->s.port(port);
3479 if (!Ip::EnableIpv6)
3480 s->s.setIPv4();
3481 debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3482 } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3483 /* do not use ipcache */
3484 s->defaultsite = xstrdup(host);
3485 s->s.port(port);
3486 if (!Ip::EnableIpv6)
3487 s->s.setIPv4();
3488 debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3489 } else {
3490 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3491 self_destruct();
3492 }
3493}
3494
3500{
3501 // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3502 // and RFC 2616 requires us to upgrade 1.0 to 1.1
3503 if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3504 return Http::ProtocolVersion(1,1);
3505
3506 if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3508
3509 if (value.cmp("FTP") == 0)
3510 return Ftp::ProtocolVersion();
3511
3512 fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3513 return AnyP::ProtocolVersion(); // not reached
3514}
3515
3516static void
3518{
3519 /* modes first */
3520
3521 if (strcmp(token, "accel") == 0) {
3522 if (s->flags.isIntercepted()) {
3523 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3524 self_destruct();
3525 return;
3526 }
3527 s->flags.accelSurrogate = true;
3528 s->vhost = true;
3529 } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3530 if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3531 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3532 self_destruct();
3533 return;
3534 }
3535 s->flags.natIntercept = true;
3536 Ip::Interceptor.StartInterception();
3537 /* Log information regarding the port modes under interception. */
3538 debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3539 debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3540 } else if (strcmp(token, "tproxy") == 0) {
3541 if (s->flags.natIntercept || s->flags.accelSurrogate) {
3542 debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3543 self_destruct();
3544 return;
3545 }
3546 s->flags.tproxyIntercept = true;
3547 Ip::Interceptor.StartTransparency();
3548 /* Log information regarding the port modes under transparency. */
3549 debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3550
3551 if (s->flags.proxySurrogate) {
3552 debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3553 }
3554
3555 if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3556 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3557 self_destruct();
3558 return;
3559 }
3560
3561 } else if (strcmp(token, "require-proxy-header") == 0) {
3562 s->flags.proxySurrogate = true;
3563 if (s->flags.tproxyIntercept) {
3564 // receiving is still permitted, so we do not unset the TPROXY flag
3565 // spoofing access control override takes care of the spoof disable later
3566 debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3567 }
3568
3569 } else if (strncmp(token, "defaultsite=", 12) == 0) {
3570 if (!s->flags.accelSurrogate) {
3571 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3572 self_destruct();
3573 return;
3574 }
3575 safe_free(s->defaultsite);
3576 s->defaultsite = xstrdup(token + 12);
3577 } else if (strcmp(token, "vhost") == 0) {
3578 if (!s->flags.accelSurrogate) {
3579 debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3580 }
3581 s->flags.accelSurrogate = true;
3582 s->vhost = true;
3583 } else if (strcmp(token, "no-vhost") == 0) {
3584 if (!s->flags.accelSurrogate) {
3585 debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3586 }
3587 s->vhost = false;
3588 } else if (strcmp(token, "vport") == 0) {
3589 if (!s->flags.accelSurrogate) {
3590 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3591 self_destruct();
3592 return;
3593 }
3594 s->vport = -1;
3595 } else if (strncmp(token, "vport=", 6) == 0) {
3596 if (!s->flags.accelSurrogate) {
3597 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3598 self_destruct();
3599 return;
3600 }
3601 s->vport = xatos(token + 6);
3602 } else if (strncmp(token, "protocol=", 9) == 0) {
3603 if (!s->flags.accelSurrogate) {
3604 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3605 self_destruct();
3606 return;
3607 }
3608 s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3609 } else if (strcmp(token, "allow-direct") == 0) {
3610 if (!s->flags.accelSurrogate) {
3611 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3612 self_destruct();
3613 return;
3614 }
3615 s->allow_direct = true;
3616 } else if (strcmp(token, "act-as-origin") == 0) {
3617 if (!s->flags.accelSurrogate) {
3618 debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3619 } else
3620 s->actAsOrigin = true;
3621 } else if (strcmp(token, "ignore-cc") == 0) {
3622#if !USE_HTTP_VIOLATIONS
3623 if (!s->flags.accelSurrogate) {
3624 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3625 self_destruct();
3626 return;
3627 }
3628#endif
3629 s->ignore_cc = true;
3630 } else if (strncmp(token, "name=", 5) == 0) {
3631 safe_free(s->name);
3632 s->name = xstrdup(token + 5);
3633 } else if (strcmp(token, "no-connection-auth") == 0) {
3634 s->connection_auth_disabled = true;
3635 } else if (strcmp(token, "connection-auth=off") == 0) {
3636 s->connection_auth_disabled = true;
3637 } else if (strcmp(token, "connection-auth") == 0) {
3638 s->connection_auth_disabled = false;
3639 } else if (strcmp(token, "connection-auth=on") == 0) {
3640 s->connection_auth_disabled = false;
3641 } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3642 if (!strcmp(token + 23, "off"))
3643 s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3644 else if (!strcmp(token + 23, "transparent"))
3645 s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3646 else if (!strcmp(token + 23, "always"))
3647 s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3648 else {
3649 self_destruct();
3650 return;
3651 }
3652 } else if (strcmp(token, "ipv4") == 0) {
3653 if ( !s->s.setIPv4() ) {
3654 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3655 self_destruct();
3656 return;
3657 }
3658 } else if (strcmp(token, "tcpkeepalive") == 0) {
3659 s->tcp_keepalive.enabled = true;
3660 } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3661 char *t = token + 13;
3662 s->tcp_keepalive.enabled = true;
3663 s->tcp_keepalive.idle = xatoui(t,',');
3664 t = strchr(t, ',');
3665 if (t) {
3666 ++t;
3667 s->tcp_keepalive.interval = xatoui(t,',');
3668 t = strchr(t, ',');
3669 }
3670 if (t) {
3671 ++t;
3672 s->tcp_keepalive.timeout = xatoui(t);
3673 }
3674#if USE_OPENSSL
3675 } else if (strcmp(token, "sslBump") == 0) {
3676 debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3677 "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3678 s->flags.tunnelSslBumping = true;
3679 } else if (strcmp(token, "ssl-bump") == 0) {
3680 s->flags.tunnelSslBumping = true;
3681 } else if (strncmp(token, "cert=", 5) == 0) {
3682 s->secure.parse(token);
3683 } else if (strncmp(token, "key=", 4) == 0) {
3684 s->secure.parse(token);
3685 } else if (strncmp(token, "version=", 8) == 0) {
3686 debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3687 "in " << cfg_directive << ". Use 'options=' instead.");
3688 s->secure.parse(token);
3689 } else if (strncmp(token, "options=", 8) == 0) {
3690 s->secure.parse(token);
3691 } else if (strncmp(token, "cipher=", 7) == 0) {
3692 s->secure.parse(token);
3693 } else if (strncmp(token, "clientca=", 9) == 0) {
3694 s->secure.parse(token);
3695 } else if (strncmp(token, "cafile=", 7) == 0) {
3696 debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3697 "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3698 s->secure.parse(token);
3699 } else if (strncmp(token, "capath=", 7) == 0) {
3700 s->secure.parse(token);
3701 } else if (strncmp(token, "crlfile=", 8) == 0) {
3702 s->secure.parse(token);
3703 } else if (strncmp(token, "dhparams=", 9) == 0) {
3704 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3705 "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3706 s->secure.parse(token);
3707 } else if (strncmp(token, "sslflags=", 9) == 0) {
3708 // NP: deprecation warnings output by secure.parse() when relevant
3709 s->secure.parse(token+3);
3710 } else if (strncmp(token, "sslcontext=", 11) == 0) {
3711 // NP: deprecation warnings output by secure.parse() when relevant
3712 s->secure.parse(token+3);
3713 } else if (strncmp(token, "generate-host-certificates", 26) == 0) {
3714 s->secure.parse(token);
3715#endif
3716 } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3717 s->secure.parse(token);
3718 } else if (strncmp(token, "tls-", 4) == 0) {
3719 s->secure.parse(token+4);
3720 } else if (strcmp(token, "ftp-track-dirs") == 0) {
3721 s->ftp_track_dirs = true;
3722 } else if (strcmp(token, "worker-queues") == 0) {
3723#if !defined(SO_REUSEADDR)
3724#error missing system #include that #defines SO_* constants
3725#endif
3726#if !defined(SO_REUSEPORT)
3727 throw TexcHere(ToSBuf(cfg_directive, ' ', token, " option requires building Squid where SO_REUSEPORT is supported by the TCP stack"));
3728#endif
3729 s->workerQueues = true;
3730 } else {
3731 debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3732 self_destruct();
3733 }
3734}
3735
3736void
3737add_http_port(char *portspec)
3738{
3740 s->transport = parsePortProtocol(SBuf("HTTP"));
3741 parsePortSpecification(s, portspec);
3742 // we may need to merge better if the above returns a list with clones
3743 assert(s->next == nullptr);
3744 s->next = HttpPortList;
3745 HttpPortList = s;
3746}
3747
3748static void
3749parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3750{
3751 SBuf protoName;
3752 if (strcmp(optionName, "http_port") == 0 ||
3753 strcmp(optionName, "ascii_port") == 0)
3754 protoName = "HTTP";
3755 else if (strcmp(optionName, "https_port") == 0)
3756 protoName = "HTTPS";
3757 else if (strcmp(optionName, "ftp_port") == 0)
3758 protoName = "FTP";
3759 if (protoName.isEmpty()) {
3760 self_destruct();
3761 return;
3762 }
3763
3764 char *token = ConfigParser::NextToken();
3765
3766 if (!token) {
3767 self_destruct();
3768 return;
3769 }
3770
3772 s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3773 parsePortSpecification(s, token);
3774
3775 /* parse options ... */
3776 while ((token = ConfigParser::NextToken())) {
3777 parse_port_option(s, token);
3778 }
3779
3780 s->secure.syncCaFiles();
3781
3782 if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3783 s->secure.encryptTransport = true;
3784#if USE_OPENSSL
3785 /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3786 const bool hijacked = s->flags.isIntercepted();
3787 if (s->flags.tunnelSslBumping && !hijacked) {
3788 debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3789 self_destruct();
3790 return;
3791 }
3792 if (hijacked && !s->flags.tunnelSslBumping) {
3793 debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3794 self_destruct();
3795 return;
3796 }
3797#endif
3798 if (s->flags.proxySurrogate) {
3799 debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3800 self_destruct();
3801 return;
3802 }
3803 } else if (protoName.cmp("FTP") == 0) {
3804 /* ftp_port does not support ssl-bump */
3805 if (s->flags.tunnelSslBumping) {
3806 debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3807 self_destruct();
3808 return;
3809 }
3810 if (s->flags.proxySurrogate) {
3811 // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3812 debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3813 self_destruct();
3814 return;
3815 }
3816 }
3817
3818 if (s->secure.encryptTransport) {
3819 if (s->secure.certs.empty()) {
3820 debugs(3, DBG_CRITICAL, "FATAL: " << AnyP::UriScheme(s->transport.protocol) << "_port requires a cert= parameter");
3821 self_destruct();
3822 return;
3823 }
3824 s->secure.parseOptions();
3825 }
3826
3827 // *_port line should now be fully valid so we can clone it if necessary
3828 if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3829 s->next = s->ipV4clone();
3830 }
3831
3832 while (*head != nullptr)
3833 head = &((*head)->next);
3834
3835 *head = s;
3836}
3837
3838static void
3840{
3841 char buf[MAX_IPSTRLEN];
3842
3843 storeAppendPrintf(e, "%s %s",
3844 n,
3845 s->s.toUrl(buf,MAX_IPSTRLEN));
3846
3847 // MODES and specific sub-options.
3848 if (s->flags.natIntercept)
3849 storeAppendPrintf(e, " intercept");
3850
3851 else if (s->flags.tproxyIntercept)
3852 storeAppendPrintf(e, " tproxy");
3853
3854 else if (s->flags.proxySurrogate)
3855 storeAppendPrintf(e, " require-proxy-header");
3856
3857 else if (s->flags.accelSurrogate) {
3858 storeAppendPrintf(e, " accel");
3859
3860 if (s->vhost)
3861 storeAppendPrintf(e, " vhost");
3862
3863 if (s->vport < 0)
3864 storeAppendPrintf(e, " vport");
3865 else if (s->vport > 0)
3866 storeAppendPrintf(e, " vport=%d", s->vport);
3867
3868 if (s->defaultsite)
3869 storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3870
3871 // TODO: compare against prefix of 'n' instead of assuming http_port
3872 if (s->transport.protocol != AnyP::PROTO_HTTP)
3873 storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3874
3875 if (s->allow_direct)
3876 storeAppendPrintf(e, " allow-direct");
3877
3878 if (s->ignore_cc)
3879 storeAppendPrintf(e, " ignore-cc");
3880
3881 }
3882
3883 // Generic independent options
3884
3885 if (s->name)
3886 storeAppendPrintf(e, " name=%s", s->name);
3887
3888#if USE_HTTP_VIOLATIONS
3889 if (!s->flags.accelSurrogate && s->ignore_cc)
3890 storeAppendPrintf(e, " ignore-cc");
3891#endif
3892
3893 if (s->connection_auth_disabled)
3894 storeAppendPrintf(e, " connection-auth=off");
3895 else
3896 storeAppendPrintf(e, " connection-auth=on");
3897
3898 if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3899 const char *pmtu;
3900
3901 if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3902 pmtu = "always";
3903 else
3904 pmtu = "transparent";
3905
3906 storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3907 }
3908
3909 if (s->s.isAnyAddr() && !s->s.isIPv6())
3910 storeAppendPrintf(e, " ipv4");
3911
3912 if (s->tcp_keepalive.enabled) {
3913 if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3914 storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3915 } else {
3916 storeAppendPrintf(e, " tcpkeepalive");
3917 }
3918 }
3919
3920#if USE_OPENSSL
3921 if (s->flags.tunnelSslBumping)
3922 storeAppendPrintf(e, " ssl-bump");
3923#endif
3924
3925 s->secure.dumpCfg(e, "tls-");
3926}
3927
3928static void
3929dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3930{
3931 for (AnyP::PortCfgPointer p = s; p != nullptr; p = p->next) {
3932 dump_generic_port(e, n, p);
3933 storeAppendPrintf(e, "\n");
3934 }
3935}
3936
3937void
3939{
3940 free_all();
3943#if USE_OPENSSL
3945#endif
3946}
3947
3948void
3949requirePathnameExists(const char *name, const char *path)
3950{
3951
3952 struct stat sb;
3953 char pathbuf[BUFSIZ];
3954 assert(path != nullptr);
3955
3956 if (Config.chroot_dir && (geteuid() == 0)) {
3957 snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3958 path = pathbuf;
3959 }
3960
3961 if (stat(path, &sb) < 0) {
3962 int xerrno = errno;
3963 debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
3964 // keep going to find more issues if we are only checking the config file with "-k parse"
3966 return;
3967 // this is fatal if it is found during startup or reconfigure
3968 if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3969 fatalf("%s %s: %s", name, path, xstrerr(xerrno));
3970 }
3971}
3972
3973#include "AccessLogEntry.h"
3974
3997static void
3999{
4000 const char *filename = ConfigParser::NextToken();
4001 if (!filename) {
4002 self_destruct();
4003 return;
4004 }
4005
4006 const auto cl = new CustomLog();
4007
4008 cl->filename = xstrdup(filename);
4009
4010 if (strcmp(filename, "none") == 0) {
4011 cl->type = Log::Format::CLF_NONE;
4012 aclParseAclList(LegacyParser, &cl->aclList, filename);
4013 while (*logs)
4014 logs = &(*logs)->next;
4015 *logs = cl;
4016 return;
4017 }
4018
4019 const char *token = ConfigParser::PeekAtToken();
4020 if (token && !strchr(token, '=')) { // style #3
4021 // TODO: Deprecate this style to avoid this dangerous guessing.
4022 if (Log::TheConfig.knownFormat(token)) {
4023 cl->setLogformat(token);
4024 (void)ConfigParser::NextToken(); // consume the token used above
4025 } else {
4026 // assume there is no explicit logformat name and use the default
4027 cl->setLogformat("squid");
4028 }
4029 } else { // style #1 or style #4
4030 // TODO: Drop deprecated style #1 support. We already warn about it, and
4031 // its exceptional treatment makes detecting "module" typos impractical!
4032 cl->parseOptions(LegacyParser, "squid");
4033 }
4034 assert(cl->type); // setLogformat() was called
4035
4036 aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4037
4038 while (*logs)
4039 logs = &(*logs)->next;
4040
4041 *logs = cl;
4042}
4043
4044static int
4045check_null_access_log(CustomLog *customlog_definitions)
4046{
4047 return customlog_definitions == nullptr;
4048}
4049
4050static void
4051dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4052{
4053 assert(entry);
4054 for (auto log = logs; log; log = log->next) {
4055 {
4056 PackableStream os(*entry);
4057 os << name; // directive name
4058 os << ' ' << log->filename; // including "none"
4059 log->dumpOptions(os);
4060 }
4061
4062 if (log->aclList)
4063 dump_acl_list(entry, log->aclList);
4064
4065 storeAppendPrintf(entry, "\n");
4066 }
4067}
4068
4069static void
4071{
4072 while (*definitions) {
4073 CustomLog *log = *definitions;
4074 *definitions = log->next;
4075 delete log;
4076 }
4077}
4078
4079#if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4081static bool
4082parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4083{
4084 if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4085 data += name.size();
4086 if (*data == '=') {
4087 while (true) {
4088 ++data;
4089 int value = 0;
4090 if (!StringToInt(data, value, &data, 10))
4091 break;
4092 list.push_back(value);
4093 if (*data == '\0' || *data != ',')
4094 break;
4095 }
4096 }
4097 }
4098 return data && *data == '\0';
4099}
4100#endif
4101
4102static void
4104{
4105#if !HAVE_CPU_AFFINITY
4106 (void)cpuAffinityMap;
4107 debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4108 "support, do not set 'cpu_affinity_map'");
4109 self_destruct();
4110
4111#else /* HAVE_CPU_AFFINITY */
4112 if (!*cpuAffinityMap)
4113 *cpuAffinityMap = new CpuAffinityMap;
4114
4115 const char *const pToken = ConfigParser::NextToken();
4116 const char *const cToken = ConfigParser::NextToken();
4117 std::vector<int> processes, cores;
4118 if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4119 debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4120 "in 'cpu_affinity_map'");
4121 self_destruct();
4122 } else if (!parseNamedIntList(cToken, "cores", cores)) {
4123 debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4124 "'cpu_affinity_map'");
4125 self_destruct();
4126 } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4127 debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4128 "process_numbers and cores lists differ in length or " <<
4129 "contain numbers <= 0");
4130 self_destruct();
4131 }
4132#endif
4133}
4134
4135static void
4136dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4137{
4138 if (cpuAffinityMap) {
4139 storeAppendPrintf(entry, "%s process_numbers=", name);
4140 for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4141 storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4142 cpuAffinityMap->processes()[i]);
4143 }
4144 storeAppendPrintf(entry, " cores=");
4145 for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4146 storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4147 cpuAffinityMap->cores()[i]);
4148 }
4149 storeAppendPrintf(entry, "\n");
4150 }
4151}
4152
4153static void
4155{
4156 delete *cpuAffinityMap;
4157 *cpuAffinityMap = nullptr;
4158}
4159
4160#if USE_ADAPTATION
4161
4162static void
4164{
4166}
4167
4168static void
4170{
4172}
4173
4174static void
4176{
4178}
4179#endif /* USE_ADAPTATION */
4180
4181#if ICAP_CLIENT
4182
4183static void
4185{
4186 cfg->parseService();
4187}
4188
4189static void
4191{
4192 cfg->freeService();
4193}
4194
4195static void
4196dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4197{
4198 cfg.dumpService(entry, name);
4199}
4200
4201static void
4203{
4204 debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is deprecated. " <<
4205 "Use 'adaptation_service_set' instead");
4207}
4208
4209static void
4211{
4212 debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is deprecated. " <<
4213 "Use 'adaptation_access' instead");
4215}
4216
4217#endif
4218
4219#if USE_ECAP
4220
4221static void
4223{
4224 cfg->parseService();
4225}
4226
4227static void
4229{
4230 cfg->freeService();
4231}
4232
4233static void
4234dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4235{
4236 cfg.dumpService(entry, name);
4237}
4238
4239#endif /* USE_ECAP */
4240
4241#if ICAP_CLIENT
4243{
4244 char *token;
4246
4247 if ((token = ConfigParser::NextToken()) == nullptr)
4248 return;
4249
4250 if (strcmp(token,"in") != 0) {
4251 debugs(3, DBG_CRITICAL, "expecting 'in' on'" << config_input_line << "'");
4252 self_destruct();
4253 return;
4254 }
4255
4257}
4258
4259static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4260{
4261 storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4262 if (cfg.oldest_service_failure > 0) {
4263 storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4264 }
4265 storeAppendPrintf(entry, "\n");
4266}
4267
4269{
4270 cfg->oldest_service_failure = 0;
4271 cfg->service_failure_limit = 0;
4272}
4273#endif
4274
4275#if USE_OPENSSL
4277{
4278 auto *al = ConfigParser::NextToken();
4279 if (!al) {
4280 self_destruct();
4281 return;
4282 }
4283
4284 const char *param;
4285 if ( char *s = strchr(al, '{')) {
4286 *s = '\0'; // terminate the al string
4287 ++s;
4288 param = s;
4289 s = strchr(s, '}');
4290 if (!s) {
4291 self_destruct();
4292 return;
4293 }
4294 *s = '\0';
4295 } else
4296 param = nullptr;
4297
4298 std::unique_ptr<sslproxy_cert_adapt> ca(new sslproxy_cert_adapt);
4299 if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4300 ca->alg = Ssl::algSetValidAfter;
4301 ca->param = xstrdup("on");
4302 } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4303 ca->alg = Ssl::algSetValidBefore;
4304 ca->param = xstrdup("on");
4305 } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4306 ca->alg = Ssl::algSetCommonName;
4307 if (param) {
4308 if (strlen(param) > 64) {
4309 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4310 self_destruct();
4311 return;
4312 }
4313 ca->param = xstrdup(param);
4314 }
4315 } else {
4316 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4317 self_destruct();
4318 return;
4319 }
4320
4321 aclParseAclList(LegacyParser, &ca->aclList, al);
4322
4323 while (*cert_adapt)
4324 cert_adapt = &(*cert_adapt)->next;
4325
4326 *cert_adapt = ca.release();
4327}
4328
4329static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4330{
4331 for (const auto *ca = cert_adapt; ca; ca = ca->next) {
4332 storeAppendPrintf(entry, "%s ", name);
4333 storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4334 if (ca->aclList)
4335 dump_acl_list(entry, ca->aclList);
4336 storeAppendPrintf(entry, "\n");
4337 }
4338}
4339
4341{
4342 delete *cert_adapt;
4343 *cert_adapt = nullptr;
4344}
4345
4347{
4348 const auto al = ConfigParser::NextToken();
4349 if (!al) {
4350 self_destruct();
4351 return;
4352 }
4353
4354 std::unique_ptr<sslproxy_cert_sign> cs(new sslproxy_cert_sign);
4355 if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4356 cs->alg = Ssl::algSignTrusted;
4357 else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4358 cs->alg = Ssl::algSignUntrusted;
4359 else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4360 cs->alg = Ssl::algSignSelf;
4361 else {
4362 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4363 self_destruct();
4364 return;
4365 }
4366
4367 aclParseAclList(LegacyParser, &cs->aclList, al);
4368
4369 while (*cert_sign)
4370 cert_sign = &(*cert_sign)->next;
4371
4372 *cert_sign = cs.release();
4373}
4374
4375static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4376{
4377 for (const auto *cs = cert_sign; cs; cs = cs->next) {
4378 storeAppendPrintf(entry, "%s ", name);
4379 storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4380 if (cs->aclList)
4381 dump_acl_list(entry, cs->aclList);
4382 storeAppendPrintf(entry, "\n");
4383 }
4384}
4385
4387{
4388 delete *cert_sign;
4389 *cert_sign = nullptr;
4390}
4391
4393{
4394public:
4396 /* RegisteredRunner API */
4397 virtual void finalizeConfig();
4398};
4399
4401
4403
4404void
4406{
4409 static char buf[1024];
4411 strcpy(buf, "ssl_bump deny all");
4412 debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4413 "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4414 "must not use implicit rules. Update your ssl_bump rules.");
4415 } else {
4416 strcpy(buf, "ssl_bump allow all");
4417 debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4418 "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4419 "inferior to the newer server-first bumping mode. New ssl_bump"
4420 " configurations must not use implicit rules. Update your ssl_bump rules.");
4421 }
4422 parse_line(buf);
4423 }
4424}
4425
4427{
4428 typedef const char *BumpCfgStyle;
4429 BumpCfgStyle bcsNone = nullptr;
4430 BumpCfgStyle bcsNew = "new client/server-first/none";
4431 BumpCfgStyle bcsOld = "deprecated allow/deny";
4432 static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4433 BumpCfgStyle bumpCfgStyleNow = bcsNone;
4434 char *bm;
4435 if ((bm = ConfigParser::NextToken()) == nullptr) {
4436 self_destruct();
4437 return;
4438 }
4439
4440 // if this is the first rule processed
4441 if (*ssl_bump == nullptr) {
4442 bumpCfgStyleLast = bcsNone;
4444 }
4445
4447
4448 if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4450 bumpCfgStyleNow = bcsNew;
4451 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4453 bumpCfgStyleNow = bcsNew;
4454 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4455 action.kind = Ssl::bumpPeek;
4456 bumpCfgStyleNow = bcsNew;
4457 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4458 action.kind = Ssl::bumpStare;
4459 bumpCfgStyleNow = bcsNew;
4460 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4461 action.kind = Ssl::bumpSplice;
4462 bumpCfgStyleNow = bcsNew;
4463 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4464 action.kind = Ssl::bumpBump;
4465 bumpCfgStyleNow = bcsNew;
4466 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4468 bumpCfgStyleNow = bcsNew;
4469 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4470 action.kind = Ssl::bumpNone;
4471 bumpCfgStyleNow = bcsNew;
4472 } else if (strcmp(bm, "allow") == 0) {
4473 debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4474 "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4475 "is usually inferior to the newer server-first "
4476 "bumping mode. Update your ssl_bump rules.");
4478 bumpCfgStyleNow = bcsOld;
4480 } else if (strcmp(bm, "deny") == 0) {
4481 debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4482 "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4483 "your ssl_bump rules.");
4484 action.kind = Ssl::bumpNone;
4485 bumpCfgStyleNow = bcsOld;
4487 } else {
4488 debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4489 self_destruct();
4490 return;
4491 }
4492
4493 if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4494 debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4495 bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4496 self_destruct();
4497 return;
4498 }
4499
4500 bumpCfgStyleLast = bumpCfgStyleNow;
4501
4502 // empty rule OK
4503 ParseAclWithAction(ssl_bump, action, "ssl_bump");
4504}
4505
4506static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4507{
4508 if (ssl_bump)
4509 dump_SBufList(entry, ssl_bump->treeDump(name, [](const Acl::Answer &action) {
4510 return Ssl::BumpModeStr.at(action.kind);
4511 }));
4512}
4513
4514static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4515{
4516 free_acl_access(ssl_bump);
4517}
4518
4519#endif
4520
4521static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4522{
4523 if (!headers)
4524 return;
4525
4526 for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4527 storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4528 if (hwa->aclList)
4529 dump_acl_list(entry, hwa->aclList);
4530 storeAppendPrintf(entry, "\n");
4531 }
4532}
4533
4535{
4536 char *fn;
4537 if (!*headers) {
4538 *headers = new HeaderWithAclList;
4539 }
4540 if ((fn = ConfigParser::NextToken()) == nullptr) {
4541 self_destruct();
4542 return;
4543 }
4544 HeaderWithAcl hwa;
4545 hwa.fieldName = fn;
4549
4550 Format::Format *nlf = new ::Format::Format("hdrWithAcl");
4554 hwa.fieldValue = buf.termedBuf();
4556 if (hwa.quoted) {
4557 if (!nlf->parse(hwa.fieldValue.c_str())) {
4558 self_destruct();
4559 return;
4560 }
4561 hwa.valueFormat = nlf;
4562 } else
4563 delete nlf;
4564 aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4565 (*headers)->push_back(hwa);
4566}
4567
4569{
4570 if (!(*header))
4571 return;
4572
4573 for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4574 if (hwa->aclList)
4575 aclDestroyAclList(&hwa->aclList);
4576
4577 if (hwa->valueFormat) {
4578 delete hwa->valueFormat;
4579 hwa->valueFormat = nullptr;
4580 }
4581 }
4582 delete *header;
4583 *header = nullptr;
4584}
4585
4586static void parse_note(Notes *notes)
4587{
4588 assert(notes);
4589 notes->parse(LegacyParser);
4590}
4591
4592static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4593{
4594 notes.dump(entry, name);
4595}
4596
4597static void free_note(Notes *notes)
4598{
4599 notes->clean();
4600}
4601
4602static DebugMessageId ParseDebugMessageId(const char *value, const char eov)
4603{
4604 const auto id = xatoui(value, eov);
4605 if (!(0 < id && id < DebugMessageIdUpperBound))
4606 throw TextException(ToSBuf("unknown cache_log_message ID: ", value), Here());
4607 return static_cast<DebugMessageId>(id);
4608}
4609
4610static void parse_cache_log_message(DebugMessages **debugMessages)
4611{
4612 DebugMessage msg;
4613 DebugMessageId minId = 0;
4614 DebugMessageId maxId = 0;
4615
4616 char *key = nullptr;
4617 char *value = nullptr;
4618 while (ConfigParser::NextKvPair(key, value)) {
4619 if (strcmp(key, "id") == 0) {
4620 if (minId > 0)
4621 break;
4622 minId = maxId = ParseDebugMessageId(value, '\0');
4623 } else if (strcmp(key, "ids") == 0) {
4624 if (minId > 0)
4625 break;
4626 const auto dash = strchr(value, '-');
4627 if (!dash)
4628 throw TextException(ToSBuf("malformed cache_log_message ID range: ", key, '=', value), Here());
4629 minId = ParseDebugMessageId(value, '-');
4630 maxId = ParseDebugMessageId(dash+1, '\0');
4631 if (minId > maxId)
4632 throw TextException(ToSBuf("invalid cache_log_message ID range: ", key, '=', value), Here());
4633 } else if (strcmp(key, "level") == 0) {
4634 if (msg.levelled())
4635 break;
4636 const auto level = xatoi(value);
4637 if (level < 0)
4638 throw TextException(ToSBuf("negative cache_log_message level: ", value), Here());
4639 msg.level = level;
4640 } else if (strcmp(key, "limit") == 0) {
4641 if (msg.limited())
4642 break;
4643 msg.limit = xatoull(value, 10);
4644 } else {
4645 throw TextException(ToSBuf("unsupported cache_log_message option: ", key), Here());
4646 }
4647 key = value = nullptr;
4648 }
4649
4650 if (key && value)
4651 throw TextException(ToSBuf("repeated or conflicting cache_log_message option: ", key, '=', value), Here());
4652
4653 if (!minId)
4654 throw TextException("cache_log_message is missing a required id=... or ids=... option", Here());
4655
4656 if (!(msg.levelled() || msg.limited()))
4657 throw TextException("cache_log_message is missing a required level=... or limit=... option", Here());
4658
4659 assert(debugMessages);
4660 if (!*debugMessages)
4661 *debugMessages = new DebugMessages();
4662
4663 for (auto id = minId; id <= maxId; ++id) {
4664 msg.id = id;
4665 (*debugMessages)->messages.at(id) = msg;
4666 }
4667}
4668
4669static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *debugMessages)
4670{
4671 if (!debugMessages)
4672 return;
4673
4674 SBufStream out;
4675 for (const auto &msg: debugMessages->messages) {
4676 if (!msg.configured())
4677 continue;
4678 out << name << " id=" << msg.id;
4679 if (msg.levelled())
4680 out << " level=" << msg.level;
4681 if (msg.limited())
4682 out << " limit=" << msg.limit;
4683 out << "\n";
4684 }
4685 const auto buf = out.buf();
4686 entry->append(buf.rawContent(), buf.length()); // may be empty
4687}
4688
4689static void free_cache_log_message(DebugMessages **debugMessages)
4690{
4691 // clear old messages to avoid cumulative effect across (re)configurations
4692 assert(debugMessages);
4693 delete *debugMessages;
4694 *debugMessages = nullptr;
4695}
4696
4697static bool FtpEspvDeprecated = false;
4698static void parse_ftp_epsv(acl_access **ftp_epsv)
4699{
4700 Acl::Answer ftpEpsvDeprecatedAction;
4701 bool ftpEpsvIsDeprecatedRule = false;
4702
4703 char *t = ConfigParser::PeekAtToken();
4704 if (!t) {
4705 self_destruct();
4706 return;
4707 }
4708
4709 if (!strcmp(t, "off")) {
4711 ftpEpsvIsDeprecatedRule = true;
4712 ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_DENIED);
4713 } else if (!strcmp(t, "on")) {
4715 ftpEpsvIsDeprecatedRule = true;
4716 ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_ALLOWED);
4717 }
4718
4719 // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4720 // 1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4721 // 2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4722 // then abort
4723 if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4724 (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != nullptr)) {
4725 debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4726 self_destruct();
4727 return;
4728 }
4729
4730 if (ftpEpsvIsDeprecatedRule) {
4731 // overwrite previous ftp_epsv lines
4732 delete *ftp_epsv;
4733 *ftp_epsv = nullptr;
4734
4735 if (ftpEpsvDeprecatedAction == Acl::Answer(ACCESS_DENIED)) {
4736 if (ACL *a = ACL::FindByName("all"))
4737 ParseAclWithAction(ftp_epsv, ftpEpsvDeprecatedAction, "ftp_epsv", a);
4738 else {
4739 self_destruct();
4740 return;
4741 }
4742 }
4743 FtpEspvDeprecated = true;
4744 } else {
4746 }
4747}
4748
4749static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4750{
4751 if (ftp_epsv)
4752 dump_SBufList(entry, ftp_epsv->treeDump(name, Acl::AllowOrDeny));
4753}
4754
4755static void free_ftp_epsv(acl_access **ftp_epsv)
4756{
4757 free_acl_access(ftp_epsv);
4758 FtpEspvDeprecated = false;
4759}
4760
4763static std::chrono::seconds
4765{
4766 const auto timeValueToken = ConfigParser::NextToken();
4767 if (!timeValueToken)
4768 throw TexcHere("cannot read a time value");
4769
4770 using Seconds = std::chrono::seconds;
4771
4772 const auto parsedTimeValue = xatof(timeValueToken);
4773
4774 if (parsedTimeValue == 0)
4775 return std::chrono::seconds::zero();
4776
4777 std::chrono::nanoseconds parsedUnitDuration;
4778
4779 const auto unitToken = ConfigParser::PeekAtToken();
4780 if (parseTimeUnit<Seconds>(unitToken, parsedUnitDuration))
4782 else {
4783 const auto defaultParsed = parseTimeUnit<Seconds>(T_SECOND_STR, parsedUnitDuration);
4784 assert(defaultParsed);
4786 ": WARNING: missing time unit, using deprecated default '" << T_SECOND_STR << "'");
4787 }
4788
4789 const auto nanoseconds = ToNanoSeconds(parsedTimeValue, parsedUnitDuration);
4790
4791 return FromNanoseconds<Seconds>(nanoseconds, parsedTimeValue);
4792}
4793
4794static void
4796{
4797 // TODO: do not allow optional timeunit (as the documentation prescribes)
4798 // and use parseTimeLine() instead.
4800
4801 char *key, *value;
4802 while(ConfigParser::NextKvPair(key, value)) {
4803 if (strcasecmp(key, "on_timeout") == 0) {
4804 if (strcasecmp(value, "bypass") == 0)
4805 config->action = toutActBypass;
4806 else if (strcasecmp(value, "fail") == 0)
4807 config->action = toutActFail;
4808 else if (strcasecmp(value, "retry") == 0)
4809 config->action = toutActRetry;
4810 else if (strcasecmp(value, "use_configured_response") == 0) {
4812 } else {
4813 debugs(3, DBG_CRITICAL, "FATAL: unsupported \"on_timeout\" action: " << value);
4814 self_destruct();
4815 return;
4816 }
4817 } else if (strcasecmp(key, "response") == 0) {
4818 config->response = xstrdup(value);
4819 } else {
4820 debugs(3, DBG_CRITICAL, "FATAL: unsupported option " << key);
4821 self_destruct();
4822 return;
4823 }
4824 }
4825
4826 if (config->action == toutActUseConfiguredResponse && !config->response) {
4827 debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4828 self_destruct();
4829 }
4830
4831 if (config->action != toutActUseConfiguredResponse && config->response) {
4832 debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the 'on_timeout=use_configured_response' option");
4833 self_destruct();
4834 }
4835}
4836
4837static void
4839{
4840 const char *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4841 assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4842
4843 dump_time_t(entry, name, Config.Timeout.urlRewrite);
4844 storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4845
4846 if (config.response)
4847 storeAppendPrintf(entry, " response=\"%s\"", config.response);
4848
4849 storeAppendPrintf(entry, "\n");
4850}
4851
4852static void
4854{
4856 config->action = 0;
4857 safe_free(config->response);
4858}
4859
4860static void
4862{
4863 int val = 0;
4864 parse_onoff(&val);
4865
4866 // If quoted values is set to on then enable new strict mode parsing
4867 if (val) {
4870 } else {
4873 }
4874}
4875
4876static void
4877dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4878{
4879 int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4880 dump_onoff(entry, name, val);
4881}
4882
4883static void
4885{
4888}
4889
4890static void
4892{
4893 char *tm;
4894 if ((tm = ConfigParser::NextToken()) == nullptr) {
4895 self_destruct();
4896 return;
4897 }
4898
4900 if (strcmp(tm, "tunnel") == 0)
4901 action.kind = 1;
4902 else if (strcmp(tm, "respond") == 0)
4903 action.kind = 2;
4904 else {
4905 debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4906 self_destruct();
4907 return;
4908 }
4909
4910 // empty rule OK
4911 ParseAclWithAction(access, action, "on_unsupported_protocol");
4912}
4913
4914static void
4915dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4916{
4917 static const std::vector<const char *> onErrorTunnelMode = {
4918 "none",
4919 "tunnel",
4920 "respond"
4921 };
4922 if (access) {
4923 SBufList lines = access->treeDump(name, [](const Acl::Answer &action) {
4924 return onErrorTunnelMode.at(action.kind);
4925 });
4926 dump_SBufList(entry, lines);
4927 }
4928}
4929
4930static void
4932{
4933 free_acl_access(access);
4934}
4935
4936static void
4938{
4939 assert(protoGuardsPtr);
4940 auto &protoGuards = *protoGuardsPtr;
4941 if (!protoGuards)
4942 protoGuards = new HttpUpgradeProtocolAccess();
4943 protoGuards->configureGuard(LegacyParser);
4944}
4945
4946static void
4948{
4949 if (!protoGuards)
4950 return;
4951
4952 const SBuf name(rawName);
4953 protoGuards->forEach([entry,&name](const SBuf &proto, const acl_access *acls) {
4954 SBufList line;
4955 line.push_back(name);
4956 line.push_back(proto);
4957 const auto acld = acls->treeDump("", &Acl::AllowOrDeny);
4958 line.insert(line.end(), acld.begin(), acld.end());
4959 dump_SBufList(entry, line);
4960 });
4961}
4962
4963static void
4965{
4966 assert(protoGuardsPtr);
4967 auto &protoGuards = *protoGuardsPtr;
4968 delete protoGuards;
4969 protoGuards = nullptr;
4970}
4971
#define Here()
source code location of the caller
Definition: Here.h:15
std::list< HeaderWithAcl > HeaderWithAclList
SBuf TheKidName
current Squid process name (e.g., "squid-coord")
Definition: Kids.cc:19
int size
Definition: ModDevPoll.cc:75
unsigned int xatoui(const char *token, char eov)
Definition: Parsing.cc:58
double GetPercentage(bool limit)
Definition: Parsing.cc:178
bool GetHostWithPort(char *token, Ip::Address *ipa)
Definition: Parsing.cc:257
uint64_t xatoull(const char *token, int base, char eov)
Definition: Parsing.cc:105
double xatof(const char *token)
Definition: Parsing.cc:25
unsigned short xatos(const char *token)
Definition: Parsing.cc:114
bool StringToInt(const char *s, int &result, const char **p, int base)
Definition: Parsing.cc:217
int64_t GetInteger64(void)
Definition: Parsing.cc:132
unsigned short GetShort(void)
Definition: Parsing.cc:205
int GetInteger(void)
Definition: Parsing.cc:148
int xatoi(const char *token)
Definition: Parsing.cc:44
AnyP::PortCfgPointer HttpPortList
list of Squid http(s)_port configured
Definition: PortCfg.cc:22
SBuf ToUpper(SBuf buf)
Returns a lower-cased copy of its parameter.
Definition: SBuf.h:721
#define SQUIDSBUFPH
Definition: SBuf.h:31
#define SQUIDSBUFPRINT(s)
Definition: SBuf.h:32
class SquidConfig Config
Definition: SquidConfig.cc:12
class SquidConfig2 Config2
Definition: SquidConfig.cc:14
char * strwordtok(char *buf, char **t)
Definition: String.cc:393
std::ostream & CurrentException(std::ostream &os)
prints active (i.e., thrown but not yet handled) exception
#define TexcHere(msg)
legacy convenience macro; it is not difficult to type Here() now
Definition: TextException.h:59
#define Must(condition)
Definition: TextException.h:71
void aclParseAccessLine(const char *directive, ConfigParser &, acl_access **treep)
Definition: Gadgets.cc:138
size_t aclParseAclList(ConfigParser &, Acl::Tree **treep, const char *label)
Definition: Gadgets.cc:191
void log(char *format,...)
#define acl_access
Definition: forward.h:45
#define ACLList
Definition: forward.h:46
squidaio_request_t * head
Definition: aiops.cc:126
#define assert(EX)
Definition: assert.h:19
static DebugMessageId ParseDebugMessageId(const char *value, const char eov)
Definition: cache_cf.cc:4602
static std::chrono::nanoseconds ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
Definition: cache_cf.cc:1179
static void SetConfigFilename(char const *file_name, bool is_pipe)
Definition: cache_cf.cc:282
void parse_time_t(time_t *var)
Definition: cache_cf.cc:2980
static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
Definition: cache_cf.cc:4506
static void free_authparam(Auth::ConfigVector *cfg)
Definition: cache_cf.cc:1966
static void dump_cachemgrpasswd(StoreEntry *entry, const char *name, Mgr::ActionPasswordList *list)
Definition: cache_cf.cc:2423
static void parse_address(Ip::Address *addr)
Definition: cache_cf.cc:1541
static void free_icap_service_failure_limit(Adaptation::Icap::Config *)
Definition: cache_cf.cc:4268
static const char *const T_SECOND_STR
Definition: cache_cf.cc:147
static void ReplaceSubstr(char *&str, int &len, unsigned substrIdx, unsigned substrLen, const char *newSubstr)
Definition: cache_cf.cc:330
static void parse_b_size_t(size_t *var)
Definition: cache_cf.cc:3060
static int parseOneConfigFile(const char *file_name, unsigned int depth)
Definition: cache_cf.cc:435
static void parse_icap_service_failure_limit(Adaptation::Icap::Config *)
Definition: cache_cf.cc:4242
static void free_b_int64_t(int64_t *var)
Definition: cache_cf.cc:3096
static void free_int64_t(int64_t *var)
Definition: cache_cf.cc:2597
static void free_refreshpattern(RefreshPattern **head)
Definition: cache_cf.cc:2888