cache_cf.cc
Go to the documentation of this file.
1/*
2 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
3 *
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
7 */
8
9/* DEBUG: section 03 Configuration File Parsing */
10
11#include "squid.h"
12#include "acl/Acl.h"
13#include "acl/AclDenyInfoList.h"
14#include "acl/AclSizeLimit.h"
15#include "acl/Address.h"
16#include "acl/Gadgets.h"
17#include "acl/MethodData.h"
18#include "acl/Tree.h"
19#include "anyp/PortCfg.h"
20#include "anyp/UriScheme.h"
21#include "auth/Config.h"
22#include "auth/Scheme.h"
23#include "AuthReg.h"
24#include "base/PackableStream.h"
26#include "cache_cf.h"
27#include "CachePeer.h"
28#include "ConfigOption.h"
29#include "ConfigParser.h"
30#include "CpuAffinityMap.h"
31#include "debug/Messages.h"
32#include "DiskIO/DiskIOModule.h"
33#include "eui/Config.h"
34#include "ExternalACL.h"
35#include "format/Format.h"
36#include "fqdncache.h"
37#include "ftp/Elements.h"
38#include "globals.h"
39#include "HttpHeaderTools.h"
41#include "icmp/IcmpConfig.h"
42#include "ident/Config.h"
43#include "ip/Intercept.h"
44#include "ip/NfMarkConfig.h"
45#include "ip/QosConfig.h"
46#include "ip/tools.h"
47#include "ipc/Kids.h"
48#include "log/Config.h"
49#include "log/CustomLog.h"
50#include "MemBuf.h"
51#include "MessageDelayPools.h"
53#include "mgr/Registration.h"
54#include "neighbors.h"
56#include "Parsing.h"
57#include "pconn.h"
58#include "PeerDigest.h"
59#include "PeerPoolMgr.h"
60#include "redirect.h"
61#include "RefreshPattern.h"
62#include "rfc1738.h"
63#include "sbuf/List.h"
64#include "sbuf/Stream.h"
65#include "SquidConfig.h"
66#include "SquidString.h"
67#include "ssl/ProxyCerts.h"
68#include "Store.h"
69#include "store/Disks.h"
70#include "tools.h"
71#include "util.h"
72#include "wordlist.h"
73/* wccp2 has its own conditional definitions */
74#include "wccp2.h"
75#if USE_ADAPTATION
76#include "adaptation/Config.h"
77#endif
78#if ICAP_CLIENT
80#endif
81#if USE_ECAP
83#endif
84#if USE_OPENSSL
85#include "ssl/Config.h"
86#include "ssl/support.h"
87#endif
88#if USE_SQUID_ESI
89#include "esi/Parser.h"
90#endif
91#if SQUID_SNMP
92#include "snmp.h"
93#endif
94
95#if HAVE_GLOB_H
96#include <glob.h>
97#endif
98#include <chrono>
99#include <limits>
100#include <list>
101#if HAVE_PWD_H
102#include <pwd.h>
103#endif
104#if HAVE_GRP_H
105#include <grp.h>
106#endif
107#if HAVE_SYS_SOCKET_H
108#include <sys/socket.h>
109#endif
110#if HAVE_SYS_STAT_H
111#include <sys/stat.h>
112#endif
113
114#if USE_OPENSSL
115#include "ssl/gadgets.h"
116#endif
117
118#if USE_ADAPTATION
121static void parse_adaptation_access_type();
122#endif
123
124#if ICAP_CLIENT
126static void dump_icap_service_type(StoreEntry *, const char *, const Adaptation::Icap::Config &);
128static void parse_icap_class_type();
129static void parse_icap_access_type();
130
132static void dump_icap_service_failure_limit(StoreEntry *, const char *, const Adaptation::Icap::Config &);
134#endif
135
136#if USE_ECAP
138static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &);
140#endif
141
142static peer_t parseNeighborType(const char *s);
143
144static const char *const T_NANOSECOND_STR = "nanosecond";
145static const char *const T_MICROSECOND_STR = "microsecond";
146static const char *const T_MILLISECOND_STR = "millisecond";
147static const char *const T_SECOND_STR = "second";
148static const char *const T_MINUTE_STR = "minute";
149static const char *const T_HOUR_STR = "hour";
150static const char *const T_DAY_STR = "day";
151static const char *const T_WEEK_STR = "week";
152static const char *const T_FORTNIGHT_STR = "fortnight";
153static const char *const T_MONTH_STR = "month";
154static const char *const T_YEAR_STR = "year";
155static const char *const T_DECADE_STR = "decade";
156
157static const char *const B_BYTES_STR = "bytes";
158static const char *const B_KBYTES_STR = "KB";
159static const char *const B_MBYTES_STR = "MB";
160static const char *const B_GBYTES_STR = "GB";
161
162// std::chrono::years requires C++20. Do our own rough calculation for now.
163static const double HoursPerYear = 24*365.2522;
164
165static void parse_cache_log_message(DebugMessages **messages);
166static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *messages);
167static void free_cache_log_message(DebugMessages **messages);
168
169static void parse_access_log(CustomLog ** customlog_definitions);
170static int check_null_access_log(CustomLog *customlog_definitions);
171static void dump_access_log(StoreEntry * entry, const char *name, CustomLog * definitions);
172static void free_access_log(CustomLog ** definitions);
173
174static void configDoConfigure(void);
176static void parse_u_short(unsigned short * var);
177static void parse_string(char **);
178static void default_all(void);
179static void defaults_if_none(void);
180static void defaults_postscriptum(void);
181static int parse_line(char *);
182static void parse_obsolete(const char *);
183static void parseBytesLine(size_t * bptr, const char *units);
184static void parseBytesLineSigned(ssize_t * bptr, const char *units);
185static size_t parseBytesUnits(const char *unit);
186static void free_all(void);
187void requirePathnameExists(const char *name, const char *path);
189#if USE_HTTP_VIOLATIONS
190static void free_HeaderManglers(HeaderManglers **pm);
191static void dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
192static void parse_http_header_access(HeaderManglers **manglers);
193#define free_http_header_access free_HeaderManglers
194static void dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers);
195static void parse_http_header_replace(HeaderManglers **manglers);
196#define free_http_header_replace free_HeaderManglers
197#endif
198static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers);
199static void parse_HeaderWithAclList(HeaderWithAclList **header);
200static void free_HeaderWithAclList(HeaderWithAclList **header);
201static void parse_note(Notes *);
202static void dump_note(StoreEntry *, const char *, Notes &);
203static void free_note(Notes *);
204static void parse_denyinfo(AclDenyInfoList ** var);
205static void dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var);
206static void free_denyinfo(AclDenyInfoList ** var);
207
208#if USE_WCCPv2
210static void dump_IpAddress_list(StoreEntry *, const char *, const Ip::Address_list *);
212#if CURRENTLY_UNUSED
213static int check_null_IpAddress_list(const Ip::Address_list *);
214#endif /* CURRENTLY_UNUSED */
215#endif /* USE_WCCPv2 */
216
217static void parsePortCfg(AnyP::PortCfgPointer *, const char *protocol);
218#define parse_PortCfg(l) parsePortCfg((l), token)
219static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &);
220#define free_PortCfg(h) *(h)=NULL
221
222#if USE_OPENSSL
223static void parse_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
224static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign);
225static void free_sslproxy_cert_sign(sslproxy_cert_sign **cert_sign);
226static void parse_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
227static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt);
228static void free_sslproxy_cert_adapt(sslproxy_cert_adapt **cert_adapt);
229static void parse_sslproxy_ssl_bump(acl_access **ssl_bump);
230static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump);
231static void free_sslproxy_ssl_bump(acl_access **ssl_bump);
232#endif /* USE_OPENSSL */
233
234static void parse_ftp_epsv(acl_access **ftp_epsv);
235static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv);
236static void free_ftp_epsv(acl_access **ftp_epsv);
237
238static void parse_b_size_t(size_t * var);
239static void parse_b_int64_t(int64_t * var);
240
241static void parse_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
242static void dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap);
243static void free_CpuAffinityMap(CpuAffinityMap **const cpuAffinityMap);
244
248
249static int parseOneConfigFile(const char *file_name, unsigned int depth);
250
251static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues);
252static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues);
253static void free_configuration_includes_quoted_values(bool *recognizeQuotedValues);
254static void parse_on_unsupported_protocol(acl_access **access);
255static void dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access);
256static void free_on_unsupported_protocol(acl_access **access);
257static void ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl = nullptr);
259static void dump_http_upgrade_request_protocols(StoreEntry *entry, const char *name, HttpUpgradeProtocolAccess *protoGuards);
261
262/*
263 * LegacyParser is a parser for legacy code that uses the global
264 * approach. This is static so that it is only exposed to cache_cf.
265 * Other modules needing access to a ConfigParser should have it
266 * provided to them in their parserFOO methods.
267 */
269
270const char *cfg_directive = nullptr;
271const char *cfg_filename = nullptr;
274
275void
277{
279}
280
281static void
282SetConfigFilename(char const *file_name, bool is_pipe)
283{
284 if (is_pipe)
285 cfg_filename = file_name + 1;
286 else
287 cfg_filename = file_name;
288}
289
290static const char*
291skip_ws(const char* s)
292{
293 while (xisspace(*s))
294 ++s;
295
296 return s;
297}
298
299static int
300parseManyConfigFiles(char* files, int depth)
301{
302 int error_count = 0;
303 char* saveptr = nullptr;
304#if HAVE_GLOB
305 char *path;
306 glob_t globbuf;
307 int i;
308 memset(&globbuf, 0, sizeof(globbuf));
309 for (path = strwordtok(files, &saveptr); path; path = strwordtok(nullptr, &saveptr)) {
310 if (glob(path, globbuf.gl_pathc ? GLOB_APPEND : 0, nullptr, &globbuf) != 0) {
311 int xerrno = errno;
312 fatalf("Unable to find configuration file: %s: %s", path, xstrerr(xerrno));
313 }
314 }
315 for (i = 0; i < (int)globbuf.gl_pathc; ++i) {
316 error_count += parseOneConfigFile(globbuf.gl_pathv[i], depth);
317 }
318 globfree(&globbuf);
319#else
320 char* file = strwordtok(files, &saveptr);
321 while (file != NULL) {
322 error_count += parseOneConfigFile(file, depth);
323 file = strwordtok(NULL, &saveptr);
324 }
325#endif /* HAVE_GLOB */
326 return error_count;
327}
328
329static void
330ReplaceSubstr(char*& str, int& len, unsigned substrIdx, unsigned substrLen, const char* newSubstr)
331{
332 assert(str != nullptr);
333 assert(newSubstr != nullptr);
334
335 unsigned newSubstrLen = strlen(newSubstr);
336 if (newSubstrLen > substrLen)
337 str = (char*)realloc(str, len - substrLen + newSubstrLen + 1);
338
339 // move tail part including zero
340 memmove(str + substrIdx + newSubstrLen, str + substrIdx + substrLen, len - substrIdx - substrLen + 1);
341 // copy new substring in place
342 memcpy(str + substrIdx, newSubstr, newSubstrLen);
343
344 len = strlen(str);
345}
346
347static void
348SubstituteMacro(char*& line, int& len, const char* macroName, const char* substStr)
349{
350 assert(line != nullptr);
351 assert(macroName != nullptr);
352 assert(substStr != nullptr);
353 unsigned macroNameLen = strlen(macroName);
354 while (const char* macroPos = strstr(line, macroName)) // we would replace all occurrences
355 ReplaceSubstr(line, len, macroPos - line, macroNameLen, substStr);
356}
357
358static void
359ProcessMacros(char*& line, int& len)
360{
361 SubstituteMacro(line, len, "${service_name}", service_name.c_str());
362 SubstituteMacro(line, len, "${process_name}", TheKidName.c_str());
363 SubstituteMacro(line, len, "${process_number}", xitoa(KidIdentifier));
364}
365
366static void
368{
369 assert(str != nullptr);
370 unsigned i = strlen(str);
371 while ((i > 0) && xisspace(str[i - 1]))
372 --i;
373 str[i] = '\0';
374}
375
376static const char*
377FindStatement(const char* line, const char* statement)
378{
379 assert(line != nullptr);
380 assert(statement != nullptr);
381
382 const char* str = skip_ws(line);
383 unsigned len = strlen(statement);
384 if (strncmp(str, statement, len) == 0) {
385 str += len;
386 if (*str == '\0')
387 return str;
388 else if (xisspace(*str))
389 return skip_ws(str);
390 }
391
392 return nullptr;
393}
394
395static bool
396StrToInt(const char* str, long& number)
397{
398 assert(str != nullptr);
399
400 char* end;
401 number = strtol(str, &end, 0);
402
403 return (end != str) && (*end == '\0'); // returns true if string contains nothing except number
404}
405
406static bool
407EvalBoolExpr(const char* expr)
408{
409 assert(expr != nullptr);
410 if (strcmp(expr, "true") == 0) {
411 return true;
412 } else if (strcmp(expr, "false") == 0) {
413 return false;
414 } else if (const char* equation = strchr(expr, '=')) {
415 const char* rvalue = skip_ws(equation + 1);
416 char* lvalue = (char*)xmalloc(equation - expr + 1);
417 xstrncpy(lvalue, expr, equation - expr + 1);
418 trim_trailing_ws(lvalue);
419
420 long number1;
421 if (!StrToInt(lvalue, number1))
422 fatalf("String is not a integer number: '%s'\n", lvalue);
423 long number2;
424 if (!StrToInt(rvalue, number2))
425 fatalf("String is not a integer number: '%s'\n", rvalue);
426
427 xfree(lvalue);
428 return number1 == number2;
429 }
430 fatalf("Unable to evaluate expression '%s'\n", expr);
431 return false; // this place cannot be reached
432}
433
434static int
435parseOneConfigFile(const char *file_name, unsigned int depth)
436{
437 FILE *fp = nullptr;
438 const char *orig_cfg_filename = cfg_filename;
439 const int orig_config_lineno = config_lineno;
440 char *token = nullptr;
441 char *tmp_line = nullptr;
442 int tmp_line_len = 0;
443 int err_count = 0;
444 int is_pipe = 0;
445
446 debugs(3, DBG_IMPORTANT, "Processing Configuration File: " << file_name << " (depth " << depth << ")");
447 if (depth > 16) {
448 fatalf("WARNING: can't include %s: includes are nested too deeply (>16)!\n", file_name);
449 return 1;
450 }
451
452 if (file_name[0] == '!' || file_name[0] == '|') {
453 fp = popen(file_name + 1, "r");
454 is_pipe = 1;
455 } else {
456 fp = fopen(file_name, "r");
457 }
458
459 if (!fp) {
460 int xerrno = errno;
461 fatalf("Unable to open configuration file: %s: %s", file_name, xstrerr(xerrno));
462 }
463
464#if _SQUID_WINDOWS_
465 setmode(fileno(fp), O_TEXT);
466#endif
467
468 SetConfigFilename(file_name, bool(is_pipe));
469
470 memset(config_input_line, '\0', BUFSIZ);
471
472 config_lineno = 0;
473
474 std::vector<bool> if_states;
475 while (fgets(config_input_line, BUFSIZ, fp)) {
477
478 if ((token = strchr(config_input_line, '\n')))
479 *token = '\0';
480
481 if ((token = strchr(config_input_line, '\r')))
482 *token = '\0';
483
484 // strip any prefix whitespace off the line.
485 const char *p = skip_ws(config_input_line);
486 if (config_input_line != p)
487 memmove(config_input_line, p, strlen(p)+1);
488
489 if (strncmp(config_input_line, "#line ", 6) == 0) {
490 static char new_file_name[1024];
491 static char *file;
492 static char new_lineno;
493 token = config_input_line + 6;
494 new_lineno = strtol(token, &file, 0) - 1;
495
496 if (file == token)
497 continue; /* Not a valid #line directive, may be a comment */
498
499 while (*file && xisspace((unsigned char) *file))
500 ++file;
501
502 if (*file) {
503 if (*file != '"')
504 continue; /* Not a valid #line directive, may be a comment */
505
506 xstrncpy(new_file_name, file + 1, sizeof(new_file_name));
507
508 if ((token = strchr(new_file_name, '"')))
509 *token = '\0';
510
511 SetConfigFilename(new_file_name, false);
512 }
513
514 config_lineno = new_lineno;
515 }
516
517 if (config_input_line[0] == '#')
518 continue;
519
520 if (config_input_line[0] == '\0')
521 continue;
522
523 const char* append = tmp_line_len ? skip_ws(config_input_line) : config_input_line;
524
525 size_t append_len = strlen(append);
526
527 tmp_line = (char*)xrealloc(tmp_line, tmp_line_len + append_len + 1);
528
529 strcpy(tmp_line + tmp_line_len, append);
530
531 tmp_line_len += append_len;
532
533 if (tmp_line[tmp_line_len-1] == '\\') {
534 debugs(3, 5, "parseConfigFile: tmp_line='" << tmp_line << "'");
535 tmp_line[--tmp_line_len] = '\0';
536 continue;
537 }
538
539 trim_trailing_ws(tmp_line);
540 ProcessMacros(tmp_line, tmp_line_len);
541 debugs(3, (opt_parse_cfg_only?1:5), "Processing: " << tmp_line);
542
543 if (const char* expr = FindStatement(tmp_line, "if")) {
544 if_states.push_back(EvalBoolExpr(expr)); // store last if-statement meaning
545 } else if (FindStatement(tmp_line, "endif")) {
546 if (!if_states.empty())
547 if_states.pop_back(); // remove last if-statement meaning
548 else
549 fatalf("'endif' without 'if'\n");
550 } else if (FindStatement(tmp_line, "else")) {
551 if (!if_states.empty())
552 if_states.back() = !if_states.back();
553 else
554 fatalf("'else' without 'if'\n");
555 } else if (if_states.empty() || if_states.back()) { // test last if-statement meaning if present
556 /* Handle includes here */
557 if (tmp_line_len >= 9 && strncmp(tmp_line, "include", 7) == 0 && xisspace(tmp_line[7])) {
558 err_count += parseManyConfigFiles(tmp_line + 8, depth + 1);
559 } else {
560 try {
561 if (!parse_line(tmp_line)) {
562 debugs(3, DBG_CRITICAL, ConfigParser::CurrentLocation() << ": unrecognized: '" << tmp_line << "'");
563 ++err_count;
564 }
565 } catch (...) {
566 // fatal for now
567 debugs(3, DBG_CRITICAL, "ERROR: configuration failure: " << CurrentException);
569 }
570 }
571 }
572
573 safe_free(tmp_line);
574 tmp_line_len = 0;
575
576 }
577 if (!if_states.empty())
578 fatalf("if-statement without 'endif'\n");
579
580 if (is_pipe) {
581 int ret = pclose(fp);
582
583 if (ret != 0)
584 fatalf("parseConfigFile: '%s' failed with exit code %d\n", file_name, ret);
585 } else {
586 fclose(fp);
587 }
588
589 SetConfigFilename(orig_cfg_filename, false);
590 config_lineno = orig_config_lineno;
591
592 xfree(tmp_line);
593 return err_count;
594}
595
596static
597int
598parseConfigFileOrThrow(const char *file_name)
599{
600 int err_count = 0;
601
602 debugs(5, 4, MYNAME);
603
605
607 default_all();
608
609 err_count = parseOneConfigFile(file_name, 0);
610
612
614
615 /*
616 * We must call configDoConfigure() before leave_suid() because
617 * configDoConfigure() is where we turn username strings into
618 * uid values.
619 */
621
622 if (opt_send_signal == -1) {
623 Mgr::RegisterAction("config",
624 "Current Squid Configuration",
626 1, 1);
627 }
628
629 return err_count;
630}
631
632// TODO: Refactor main.cc to centrally handle (and report) all exceptions.
633int
634parseConfigFile(const char *file_name)
635{
636 try {
637 return parseConfigFileOrThrow(file_name);
638 }
639 catch (const std::exception &ex) {
640 debugs(3, DBG_CRITICAL, "FATAL: bad configuration: " << ex.what());
642 return 1; // not reached
643 }
644}
645
646/*
647 * The templated functions below are essentially ConfigParser methods. They are
648 * not implemented as such because our generated code calling them is the only
649 * code that can instantiate implementations for each T -- we cannot place these
650 * definitions into ConfigParser.cc unless cf_parser.cci is moved there.
651 */
652
653// TODO: When adding Ts incompatible with this trivial API and implementation,
654// replace both with a ConfigParser-maintained table of seen directives.
656template <typename T>
657static bool
658SawDirective(const T &raw)
659{
660 return bool(raw);
661}
662
665template <typename T>
666static void
668{
669 if (SawDirective(raw))
671
672 // TODO: parser.openDirective(directiveName);
673 Must(!raw);
675 Must(raw);
676 parser.closeDirective();
677}
678
681template <typename T>
682static void
683DumpDirective(const T &raw, StoreEntry *entry, const char *name)
684{
685 if (!SawDirective(raw))
686 return; // not configured
687
688 entry->append(name, strlen(name));
689 SBufStream os;
691 const auto buf = os.buf();
692 if (buf.length()) {
693 entry->append(" ", 1);
694 entry->append(buf.rawContent(), buf.length());
695 }
696 entry->append("\n", 1);
697}
698
700template <typename T>
701static void
703{
705
706 // While the implementation may change, there is no way to avoid zeroing.
707 // Even migration to a proper SquidConfig class would not help: While
708 // ordinary destructors do not need to zero data members, a SquidConfig
709 // destructor would have to zero to protect any SquidConfig::x destruction
710 // code from accidentally dereferencing an already destroyed Config.y.
711 static_assert(std::is_trivial<T>::value, "SquidConfig member is trivial");
712 memset(&raw, 0, sizeof(raw));
713}
714
715static void
717{
718 Config2.clear();
719 /* init memory as early as possible */
720 memConfigure();
721 /* Sanity checks */
722
723 if (Debug::rotateNumber < 0) {
725 }
726
727#if SIZEOF_OFF_T <= 4
728 if (Config.Store.maxObjectSize > 0x7FFF0000) {
729 debugs(3, DBG_CRITICAL, "WARNING: This Squid binary can not handle files larger than 2GB. Limiting maximum_object_size to just below 2GB");
730 Config.Store.maxObjectSize = 0x7FFF0000;
731 }
732#endif
733
736 else
737 visible_appname_string = (char const *)APP_FULLNAME;
738
739 if (Config.Program.redirect) {
740 if (Config.redirectChildren.n_max < 1) {
743 }
744 }
745
746 if (Config.Program.store_id) {
747 if (Config.storeIdChildren.n_max < 1) {
750 }
751 }
752
754 if (*Config.appendDomain != '.')
755 fatal("append_domain must begin with a '.'");
756
757 if (Config.errHtmlText == nullptr)
759
760#if !HAVE_SETRLIMIT || !defined(RLIMIT_NOFILE)
761 if (Config.max_filedescriptors > 0) {
762 debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors disabled. Operating System setrlimit(RLIMIT_NOFILE) is missing.");
763 }
764#elif USE_SELECT || USE_SELECT_WIN32
765 if (Config.max_filedescriptors > FD_SETSIZE) {
766 debugs(0, DBG_IMPORTANT, "WARNING: max_filedescriptors limited to " << FD_SETSIZE << " by select() algorithm.");
767 }
768#endif
769
771
772 snprintf(ThisCache, sizeof(ThisCache), "%s (%s)",
775
776 /*
777 * the extra space is for loop detection in client_side.c -- we search
778 * for substrings in the Via header.
779 */
780 snprintf(ThisCache2, sizeof(ThisCache2), " %s (%s)",
783
784 /* Use visible_hostname as default surrogate_id */
786 const char *t = getMyHostname();
787 Config.Accel.surrogate_id = xstrdup( (t?t:"unset-id") );
788 }
789
792
795 else
797
798 if (Config.connect_retries > 10) {
799 debugs(0,DBG_CRITICAL, "WARNING: connect_retries cannot be larger than 10. Resetting to 10.");
801 }
802
803 requirePathnameExists("MIME Config Table", Config.mimeTablePathname);
804#if USE_UNLINKD
805
806 requirePathnameExists("unlinkd_program", Config.Program.unlinkd);
807#endif
808 bool logDaemonUsed = false;
809 for (const auto *log = Config.Log.accesslogs; !logDaemonUsed && log; log = log->next)
810 logDaemonUsed = log->usesDaemon();
811#if ICAP_CLIENT
812 for (const auto *log = Config.Log.icaplogs; !logDaemonUsed && log; log = log->next)
813 logDaemonUsed = log->usesDaemon();
814#endif
815 if (logDaemonUsed)
816 requirePathnameExists("logfile_daemon", Log::TheConfig.logfile_daemon);
817
819 requirePathnameExists("redirect_program", Config.Program.redirect->key);
820
822 requirePathnameExists("store_id_program", Config.Program.store_id->key);
823
824 requirePathnameExists("Icon Directory", Config.icons.directory);
825
827 requirePathnameExists("Error Directory", Config.errorDirectory);
828
829#if USE_HTTP_VIOLATIONS
830
831 {
832 const RefreshPattern *R;
833
834 for (R = Config.Refresh; R; R = R->next) {
835 if (!R->flags.override_expire)
836 continue;
837
838 debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP");
839
840 break;
841 }
842
843 for (R = Config.Refresh; R; R = R->next) {
844 if (!R->flags.override_lastmod)
845 continue;
846
847 debugs(22, DBG_IMPORTANT, "WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP");
848
849 break;
850 }
851
852 for (R = Config.Refresh; R; R = R->next) {
853 if (!R->flags.reload_into_ims)
854 continue;
855
856 debugs(22, DBG_IMPORTANT, "WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP");
857
858 break;
859 }
860
861 for (R = Config.Refresh; R; R = R->next) {
862 if (!R->flags.ignore_reload)
863 continue;
864
865 debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP");
866
867 break;
868 }
869
870 for (R = Config.Refresh; R; R = R->next) {
871 if (!R->flags.ignore_no_store)
872 continue;
873
874 debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP");
875
876 break;
877 }
878
879 for (R = Config.Refresh; R; R = R->next) {
880 if (!R->flags.ignore_private)
881 continue;
882
883 debugs(22, DBG_IMPORTANT, "WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP");
884
885 break;
886 }
887 }
888#endif
889#if !USE_HTTP_VIOLATIONS
890 Config.onoff.via = 1;
891#else
892
893 if (!Config.onoff.via)
894 debugs(22, DBG_IMPORTANT, "WARNING: HTTP requires the use of Via");
895
896#endif
897
898 // we enable runtime PURGE checks if there is at least one PURGE method ACL
899 // TODO: replace with a dedicated "purge" ACL option?
901
902 if (geteuid() == 0) {
903 if (nullptr != Config.effectiveUser) {
904
905 struct passwd *pwd = getpwnam(Config.effectiveUser);
906
907 if (nullptr == pwd) {
908 /*
909 * Andres Kroonmaa <andre@online.ee>:
910 * Some getpwnam() implementations (Solaris?) require
911 * an available FD < 256 for opening a FILE* to the
912 * passwd file.
913 * DW:
914 * This should be safe at startup, but might still fail
915 * during reconfigure.
916 */
917 fatalf("getpwnam failed to find userid for effective user '%s'",
919 return;
920 }
921
922 Config2.effectiveUserID = pwd->pw_uid;
923
924 Config2.effectiveGroupID = pwd->pw_gid;
925
926#if HAVE_PUTENV
927 if (pwd->pw_dir && *pwd->pw_dir) {
928 // putenv() leaks by design; avoid leaks when nothing changes
929 static SBuf lastDir;
930 if (lastDir.isEmpty() || lastDir.cmp(pwd->pw_dir) != 0) {
931 lastDir = pwd->pw_dir;
932 int len = strlen(pwd->pw_dir) + 6;
933 char *env_str = (char *)xcalloc(len, 1);
934 snprintf(env_str, len, "HOME=%s", pwd->pw_dir);
935 putenv(env_str);
936 }
937 }
938#endif
939 }
940 } else {
941 Config2.effectiveUserID = geteuid();
942 Config2.effectiveGroupID = getegid();
943 }
944
945 if (nullptr != Config.effectiveGroup) {
946
947 struct group *grp = getgrnam(Config.effectiveGroup);
948
949 if (nullptr == grp) {
950 fatalf("getgrnam failed to find groupid for effective group '%s'",
952 return;
953 }
954
955 Config2.effectiveGroupID = grp->gr_gid;
956 }
957
958#if USE_OPENSSL
961#endif
962
963 if (Security::ProxyOutgoingConfig.encryptTransport) {
964 debugs(3, DBG_IMPORTANT, "Initializing https:// proxy context");
967#if USE_OPENSSL
968 fatal("ERROR: Could not initialize https:// proxy context");
969#else
970 debugs(3, DBG_IMPORTANT, "ERROR: proxying https:// currently still requires --with-openssl");
971#endif
972 }
973#if USE_OPENSSL
975#endif
976 }
977
978 for (CachePeer *p = Config.peers; p != nullptr; p = p->next) {
979
980 // default value for ssldomain= is the peer host/IP
981 if (p->secure.sslDomain.isEmpty())
982 p->secure.sslDomain = p->host;
983
984 if (p->secure.encryptTransport) {
985 debugs(3, DBG_IMPORTANT, "Initializing TLS context for cache_peer " << *p);
986 p->sslContext = p->secure.createClientContext(true);
987 if (!p->sslContext) {
988 debugs(3, DBG_CRITICAL, "ERROR: Could not initialize TLS context for cache_peer " << *p);
990 return;
991 }
992 }
993 }
994
995 for (AnyP::PortCfgPointer s = HttpPortList; s != nullptr; s = s->next) {
996 if (!s->secure.encryptTransport)
997 continue;
998 debugs(3, DBG_IMPORTANT, "Initializing " << AnyP::UriScheme(s->transport.protocol) << "_port " << s->s << " TLS contexts");
999 s->secure.initServerContexts(*s);
1000 }
1001
1002 // prevent infinite fetch loops in the request parser
1003 // due to buffer full but not enough data received to finish parse
1005 fatalf("Client request buffer of %u bytes cannot hold a request with %u bytes of headers." \
1006 " Change client_request_buffer_max or request_header_max_size limits.",
1008 }
1009
1010 /*
1011 * Disable client side request pipelining if client_persistent_connections OFF.
1012 * Waste of resources queueing any pipelined requests when the first will close the connection.
1013 */
1015 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch " << Config.pipeline_max_prefetch <<
1016 " requires client_persistent_connections ON. Forced pipeline_prefetch 0.");
1018 }
1019
1020#if USE_AUTH
1021 /*
1022 * disable client side request pipelining. There is a race with
1023 * Negotiate and NTLM when the client sends a second request on an
1024 * connection before the authenticate challenge is sent. With
1025 * pipelining OFF, the client may fail to authenticate, but squid's
1026 * state will be preserved.
1027 */
1028 if (Config.pipeline_max_prefetch > 0) {
1029 Auth::SchemeConfig *nego = Auth::SchemeConfig::Find("Negotiate");
1031 if ((nego && nego->active()) || (ntlm && ntlm->active())) {
1032 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: pipeline_prefetch breaks NTLM and Negotiate authentication. Forced pipeline_prefetch 0.");
1034 }
1035 }
1036
1037 for (auto &authSchemes : Auth::TheConfig.schemeLists) {
1038 authSchemes.expand();
1039 if (authSchemes.authConfigs.empty()) {
1040 debugs(3, DBG_CRITICAL, "auth_schemes: at least one scheme name is required; got: " << authSchemes.rawSchemes);
1041 self_destruct();
1042 }
1043 }
1044#endif
1045}
1046
1053void
1054parse_obsolete(const char *name)
1055{
1056 // Directives which have been radically changed rather than removed
1057 if (!strcmp(name, "url_rewrite_concurrency")) {
1058 int cval;
1059 parse_int(&cval);
1060 debugs(3, DBG_CRITICAL, "WARNING: url_rewrite_concurrency upgrade overriding url_rewrite_children settings.");
1062 }
1063
1064 if (!strcmp(name, "log_access")) {
1065 self_destruct();
1066 return;
1067 }
1068
1069 if (!strcmp(name, "log_icap")) {
1070 self_destruct();
1071 return;
1072 }
1073
1074 if (!strcmp(name, "ignore_ims_on_miss")) {
1075 // the replacement directive cache_revalidate_on_miss has opposite meanings for ON/OFF value
1076 // than the 2.7 directive. We need to parse and invert the configured value.
1077 int temp = 0;
1078 parse_onoff(&temp);
1080 }
1081
1082 if (!strncmp(name, "sslproxy_", 9)) {
1083 // the replacement directive tls_outgoing_options uses options instead of whole-line input
1084 SBuf tmp;
1085 if (!strcmp(name, "sslproxy_cafile"))
1086 tmp.append("cafile=");
1087 else if (!strcmp(name, "sslproxy_capath"))
1088 tmp.append("capath=");
1089 else if (!strcmp(name, "sslproxy_cipher"))
1090 tmp.append("cipher=");
1091 else if (!strcmp(name, "sslproxy_client_certificate"))
1092 tmp.append("cert=");
1093 else if (!strcmp(name, "sslproxy_client_key"))
1094 tmp.append("key=");
1095 else if (!strcmp(name, "sslproxy_flags"))
1096 tmp.append("flags=");
1097 else if (!strcmp(name, "sslproxy_options"))
1098 tmp.append("options=");
1099 else if (!strcmp(name, "sslproxy_version"))
1100 tmp.append("version=");
1101 else {
1102 debugs(3, DBG_CRITICAL, "ERROR: unknown directive: " << name);
1103 self_destruct();
1104 return;
1105 }
1106
1107 // add the value as unquoted-string because the old values did not support whitespace
1108 const char *token = ConfigParser::NextQuotedOrToEol();
1109 tmp.append(token, strlen(token));
1111 }
1112}
1113
1114template <class MinimalUnit>
1115static const char *
1117{
1118 const auto minUnit = MinimalUnit(1);
1119 if(minUnit == std::chrono::nanoseconds(1))
1120 return T_NANOSECOND_STR;
1121 else if (minUnit == std::chrono::microseconds(1))
1122 return T_MICROSECOND_STR;
1123 else if (minUnit == std::chrono::milliseconds(1))
1124 return T_MILLISECOND_STR;
1125 else {
1126 assert(minUnit >= std::chrono::seconds(1));
1127 return T_SECOND_STR;
1128 }
1129}
1130
1136template <class MinimalUnit>
1137static bool
1138parseTimeUnit(const char *unitName, std::chrono::nanoseconds &ns)
1139{
1140 if (!unitName)
1141 throw TexcHere("missing time unit");
1142
1143 if (!strncasecmp(unitName, T_NANOSECOND_STR, strlen(T_NANOSECOND_STR)))
1144 ns = std::chrono::nanoseconds(1);
1145 else if (!strncasecmp(unitName, T_MICROSECOND_STR, strlen(T_MICROSECOND_STR)))
1146 ns = std::chrono::microseconds(1);
1147 else if (!strncasecmp(unitName, T_MILLISECOND_STR, strlen(T_MILLISECOND_STR)))
1148 ns = std::chrono::milliseconds(1);
1149 else if (!strncasecmp(unitName, T_SECOND_STR, strlen(T_SECOND_STR)))
1150 ns = std::chrono::seconds(1);
1151 else if (!strncasecmp(unitName, T_MINUTE_STR, strlen(T_MINUTE_STR)))
1152 ns = std::chrono::minutes(1);
1153 else if (!strncasecmp(unitName, T_HOUR_STR, strlen(T_HOUR_STR)))
1154 ns = std::chrono::hours(1);
1155 else if (!strncasecmp(unitName, T_DAY_STR, strlen(T_DAY_STR)))
1156 ns = std::chrono::hours(24);
1157 else if (!strncasecmp(unitName, T_WEEK_STR, strlen(T_WEEK_STR)))
1158 ns = std::chrono::hours(24 * 7);
1159 else if (!strncasecmp(unitName, T_FORTNIGHT_STR, strlen(T_FORTNIGHT_STR)))
1160 ns = std::chrono::hours(24 * 14);
1161 else if (!strncasecmp(unitName, T_MONTH_STR, strlen(T_MONTH_STR)))
1162 ns = std::chrono::hours(24 * 30);
1163 else if (!strncasecmp(unitName, T_YEAR_STR, strlen(T_YEAR_STR)))
1164 ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear));
1165 else if (!strncasecmp(unitName, T_DECADE_STR, strlen(T_DECADE_STR)))
1166 ns = std::chrono::hours(static_cast<std::chrono::hours::rep>(HoursPerYear * 10));
1167 else
1168 return false;
1169
1170 if (ns < MinimalUnit(1)) {
1171 throw TexcHere(ToSBuf("time unit '", unitName, "' is too small to be used in this context, the minimal unit is ",
1172 TimeUnitToString<MinimalUnit>()));
1173 }
1174
1175 return true;
1176}
1177
1178static std::chrono::nanoseconds
1179ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
1180{
1181 if (value < 0.0)
1182 throw TexcHere("time must have a positive value");
1183
1184 if (value > (static_cast<double>(std::chrono::nanoseconds::max().count()) / unit.count())) {
1185 const auto maxYears = std::chrono::duration_cast<std::chrono::hours>(std::chrono::nanoseconds::max()).count()/HoursPerYear;
1186 throw TexcHere(ToSBuf("time values cannot exceed ", maxYears, " years"));
1187 }
1188
1189 return std::chrono::duration_cast<std::chrono::nanoseconds>(unit * value);
1190}
1191
1192template <class TimeUnit>
1193static TimeUnit
1194FromNanoseconds(const std::chrono::nanoseconds &ns, const double parsedValue)
1195{
1196 const auto result = std::chrono::duration_cast<TimeUnit>(ns);
1197 if (!result.count()) {
1198 throw TexcHere(ToSBuf("time value '", parsedValue,
1199 "' is too small to be used in this context, the minimal value is 1 ",
1200 TimeUnitToString<TimeUnit>()));
1201 }
1202 return result;
1203}
1204
1207template <class TimeUnit>
1208static TimeUnit
1210{
1211 const auto valueToken = ConfigParser::NextToken();
1212 if (!valueToken)
1213 throw TexcHere("cannot read a time value");
1214
1215 const auto parsedValue = xatof(valueToken);
1216
1217 if (parsedValue == 0)
1218 return TimeUnit::zero();
1219
1220 std::chrono::nanoseconds parsedUnitDuration;
1221
1222 const auto token = ConfigParser::PeekAtToken();
1223
1224 if (!parseTimeUnit<TimeUnit>(token, parsedUnitDuration))
1225 throw TexcHere(ToSBuf("unknown time unit '", token, "'"));
1226
1228
1229 const auto nanoseconds = ToNanoSeconds(parsedValue, parsedUnitDuration);
1230
1231 // validate precisions (time-units-small only)
1232 if (TimeUnit(1) <= std::chrono::microseconds(1)) {
1233 if (0 < nanoseconds.count() && nanoseconds.count() < 3) {
1235 "Squid time measurement precision is likely to be far worse than " <<
1236 "the nanosecond-level precision implied by the configured value: " << parsedValue << ' ' << token);
1237 }
1238 }
1239
1240 return FromNanoseconds<TimeUnit>(nanoseconds, parsedValue);
1241}
1242
1243static void
1244parseBytesLine64(int64_t * bptr, const char *units)
1245{
1246 char *token;
1247 double d;
1248 int64_t m;
1249 int64_t u;
1250
1251 if ((u = parseBytesUnits(units)) == 0) {
1252 self_destruct();
1253 return;
1254 }
1255
1256 if ((token = ConfigParser::NextToken()) == nullptr) {
1257 self_destruct();
1258 return;
1259 }
1260
1261 if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1262 *bptr = -1;
1263 return;
1264 }
1265
1266 d = xatof(token);
1267
1268 m = u; /* default to 'units' if none specified */
1269
1270 if (0.0 == d)
1271 (void) 0;
1272 else if ((token = ConfigParser::NextToken()) == nullptr)
1273 debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1274 config_input_line << "', assuming " <<
1275 d << " " << units );
1276 else if ((m = parseBytesUnits(token)) == 0) {
1277 self_destruct();
1278 return;
1279 }
1280
1281 *bptr = static_cast<int64_t>(m * d / u);
1282
1283 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1284 debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1285 d << " " << token << ": integer overflow (int64_t).");
1286 self_destruct();
1287 }
1288}
1289
1290static void
1291parseBytesLine(size_t * bptr, const char *units)
1292{
1293 char *token;
1294 double d;
1295 int m;
1296 int u;
1297
1298 if ((u = parseBytesUnits(units)) == 0) {
1299 self_destruct();
1300 return;
1301 }
1302
1303 if ((token = ConfigParser::NextToken()) == nullptr) {
1304 self_destruct();
1305 return;
1306 }
1307
1308 if (strcmp(token, "none") == 0 || strcmp(token, "-1") == 0) {
1309 *bptr = static_cast<size_t>(-1);
1310 return;
1311 }
1312
1313 d = xatof(token);
1314
1315 m = u; /* default to 'units' if none specified */
1316
1317 if (0.0 == d)
1318 (void) 0;
1319 else if ((token = ConfigParser::NextToken()) == nullptr)
1320 debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1321 config_input_line << "', assuming " <<
1322 d << " " << units );
1323 else if ((m = parseBytesUnits(token)) == 0) {
1324 self_destruct();
1325 return;
1326 }
1327
1328 *bptr = static_cast<size_t>(m * d / u);
1329
1330 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1331 debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1332 d << " " << token << ": integer overflow (size_t).");
1333 self_destruct();
1334 }
1335}
1336
1337static void
1338parseBytesLineSigned(ssize_t * bptr, const char *units)
1339{
1340 char *token;
1341 double d;
1342 int m;
1343 int u;
1344
1345 if ((u = parseBytesUnits(units)) == 0) {
1346 self_destruct();
1347 return;
1348 }
1349
1350 if ((token = ConfigParser::NextToken()) == nullptr) {
1351 self_destruct();
1352 return;
1353 }
1354
1355 if (strcmp(token, "none") == 0 || token[0] == '-' /* -N */) {
1356 *bptr = -1;
1357 return;
1358 }
1359
1360 d = xatof(token);
1361
1362 m = u; /* default to 'units' if none specified */
1363
1364 if (0.0 == d)
1365 (void) 0;
1366 else if ((token = ConfigParser::NextToken()) == nullptr)
1367 debugs(3, DBG_CRITICAL, "WARNING: No units on '" <<
1368 config_input_line << "', assuming " <<
1369 d << " " << units );
1370 else if ((m = parseBytesUnits(token)) == 0) {
1371 self_destruct();
1372 return;
1373 }
1374
1375 *bptr = static_cast<ssize_t>(m * d / u);
1376
1377 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2) {
1378 debugs(3, DBG_CRITICAL, "ERROR: Invalid value '" <<
1379 d << " " << token << ": integer overflow (ssize_t).");
1380 self_destruct();
1381 }
1382}
1383
1389void
1390parseBytesOptionValue(size_t * bptr, const char *units, char const * value)
1391{
1392 int u;
1393 if ((u = parseBytesUnits(units)) == 0) {
1394 self_destruct();
1395 return;
1396 }
1397
1398 // Find number from string beginning.
1399 char const * number_begin = value;
1400 char const * number_end = value;
1401
1402 while ((*number_end >= '0' && *number_end <= '9')) {
1403 ++number_end;
1404 }
1405
1406 String number;
1407 number.assign(number_begin, number_end - number_begin);
1408
1409 int d = xatoi(number.termedBuf());
1410 int m;
1411 if ((m = parseBytesUnits(number_end)) == 0) {
1412 self_destruct();
1413 return;
1414 }
1415
1416 *bptr = static_cast<size_t>(m * d / u);
1417 if (static_cast<double>(*bptr) * 2 != (m * d / u) * 2)
1418 self_destruct();
1419}
1420
1421static size_t
1422parseBytesUnits(const char *unit)
1423{
1424 if (!strncasecmp(unit, B_BYTES_STR, strlen(B_BYTES_STR)))
1425 return 1;
1426
1427 if (!strncasecmp(unit, B_KBYTES_STR, strlen(B_KBYTES_STR)))
1428 return 1 << 10;
1429
1430 if (!strncasecmp(unit, B_MBYTES_STR, strlen(B_MBYTES_STR)))
1431 return 1 << 20;
1432
1433 if (!strncasecmp(unit, B_GBYTES_STR, strlen(B_GBYTES_STR)))
1434 return 1 << 30;
1435
1436 debugs(3, DBG_CRITICAL, "WARNING: Unknown bytes unit '" << unit << "'");
1437
1438 return 0;
1439}
1440
1441static void
1443{
1444 while (char *token = ConfigParser::NextQuotedToken())
1445 list->push_back(SBuf(token));
1446}
1447
1448// just dump a list, no directive name
1449static void
1450dump_SBufList(StoreEntry * entry, const SBufList &words)
1451{
1452 for (const auto &i : words) {
1453 entry->append(i.rawContent(), i.length());
1454 entry->append(" ",1);
1455 }
1456 entry->append("\n",1);
1457}
1458
1459// dump a SBufList type directive with name
1460static void
1461dump_SBufList(StoreEntry * entry, const char *name, SBufList &list)
1462{
1463 if (!list.empty()) {
1464 entry->append(name, strlen(name));
1465 entry->append(" ", 1);
1466 dump_SBufList(entry, list);
1467 }
1468}
1469
1470static void
1472{
1473 if (list)
1474 list->clear();
1475}
1476
1477static void
1478dump_acl(StoreEntry * entry, const char *name, ACL * ae)
1479{
1480 while (ae != nullptr) {
1481 debugs(3, 3, "dump_acl: " << name << " " << ae->name);
1482 storeAppendPrintf(entry, "%s %s %s ",
1483 name,
1484 ae->name,
1485 ae->typeString());
1486 SBufList tail;
1487 tail.splice(tail.end(), ae->dumpOptions());
1488 tail.splice(tail.end(), ae->dump()); // ACL parameters
1489 dump_SBufList(entry, tail);
1490 ae = ae->next;
1491 }
1492}
1493
1494static void
1496{
1498}
1499
1500static void
1502{
1503 aclDestroyAcls(ae);
1504}
1505
1506void
1508{
1509 // XXX: Should dump ACL names like "foo !bar" but dumps parsing context like
1510 // "(clientside_tos 0x11 line)".
1511 dump_SBufList(entry, head->dump());
1512}
1513
1514void
1515dump_acl_access(StoreEntry * entry, const char *name, acl_access * head)
1516{
1517 if (head)
1518 dump_SBufList(entry, head->treeDump(name, &Acl::AllowOrDeny));
1519}
1520
1521static void
1523{
1525}
1526
1527static void
1529{
1531}
1532
1533static void
1534dump_address(StoreEntry * entry, const char *name, Ip::Address &addr)
1535{
1536 char buf[MAX_IPSTRLEN];
1537 storeAppendPrintf(entry, "%s %s\n", name, addr.toStr(buf,MAX_IPSTRLEN) );
1538}
1539
1540static void
1542{
1543 char *token = ConfigParser::NextToken();
1544
1545 if (!token) {
1546 self_destruct();
1547 return;
1548 }
1549
1550 if (!strcmp(token,"any_addr"))
1551 addr->setAnyAddr();
1552 else if ( (!strcmp(token,"no_addr")) || (!strcmp(token,"full_mask")) )
1553 addr->setNoAddr();
1554 else if ( (*addr = token) ) // try parse numeric/IPA
1555 (void) 0;
1556 else if (addr->GetHostByName(token)) // do not use ipcache
1557 (void) 0;
1558 else { // not an IP and not a hostname
1559 debugs(3, DBG_CRITICAL, "FATAL: invalid IP address or domain name '" << token << "'");
1560 self_destruct();
1561 }
1562}
1563
1564static void
1566{
1567 addr->setEmpty();
1568}
1569
1570static void
1571dump_acl_address(StoreEntry * entry, const char *name, Acl::Address * head)
1572{
1573 char buf[MAX_IPSTRLEN];
1574
1575 for (Acl::Address *l = head; l; l = l->next) {
1576 if (!l->addr.isAnyAddr())
1577 storeAppendPrintf(entry, "%s %s", name, l->addr.toStr(buf,MAX_IPSTRLEN));
1578 else
1579 storeAppendPrintf(entry, "%s autoselect", name);
1580
1581 dump_acl_list(entry, l->aclList);
1582
1583 storeAppendPrintf(entry, "\n");
1584 }
1585}
1586
1587static void
1589{
1590 Acl::Address *l = new Acl::Address;
1591 parse_address(&l->addr);
1593
1594 Acl::Address **tail = head;
1595 while (*tail)
1596 tail = &(*tail)->next;
1597
1598 *tail = l;
1599}
1600
1601static void
1603{
1604 delete *head;
1605 *head = nullptr;
1606}
1607
1608static void
1609dump_acl_tos(StoreEntry * entry, const char *name, acl_tos * head)
1610{
1611 acl_tos *l;
1612
1613 for (l = head; l; l = l->next) {
1614 if (l->tos > 0)
1615 storeAppendPrintf(entry, "%s 0x%02X", name, l->tos);
1616 else
1617 storeAppendPrintf(entry, "%s none", name);
1618
1619 dump_acl_list(entry, l->aclList);
1620
1621 storeAppendPrintf(entry, "\n");
1622 }
1623}
1624
1625static void
1627{
1628 unsigned int tos; /* Initially uint for strtoui. Casted to tos_t before return */
1629 char *token = ConfigParser::NextToken();
1630
1631 if (!token) {
1632 self_destruct();
1633 return;
1634 }
1635
1636 if (!xstrtoui(token, nullptr, &tos, 0, std::numeric_limits<tos_t>::max())) {
1637 self_destruct();
1638 return;
1639 }
1640
1641 const unsigned int chTos = tos & 0xFC;
1642 if (chTos != tos) {
1643 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: Tos value '" << tos << "' adjusted to '" << chTos << "'");
1644 tos = chTos;
1645 }
1646
1647 acl_tos *l = new acl_tos;
1648
1649 l->tos = (tos_t)tos;
1650
1652
1653 acl_tos **tail = head; /* sane name below */
1654 while (*tail)
1655 tail = &(*tail)->next;
1656
1657 *tail = l;
1658}
1659
1660static void
1662{
1663 delete *head;
1664 *head = nullptr;
1665}
1666
1667#if SO_MARK && USE_LIBCAP
1668
1669static void
1670dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
1671{
1672 for (acl_nfmark *l = head; l; l = l->next) {
1673 storeAppendPrintf(entry, "%s %s", name, ToSBuf(l->markConfig).c_str());
1674
1675 dump_acl_list(entry, l->aclList);
1676
1677 storeAppendPrintf(entry, "\n");
1678 }
1679}
1680
1681static void
1682parse_acl_nfmark(acl_nfmark ** head)
1683{
1685 const auto mc = Ip::NfMarkConfig::Parse(token);
1686
1687 // Packet marking directives should not allow to use masks.
1688 const auto pkt_dirs = {"mark_client_packet", "clientside_mark", "tcp_outgoing_mark"};
1689 if (mc.hasMask() && std::find(pkt_dirs.begin(), pkt_dirs.end(), cfg_directive) != pkt_dirs.end())
1690 throw TexcHere(ToSBuf("'", cfg_directive, "' does not support masked marks"));
1691
1692 acl_nfmark *l = new acl_nfmark;
1693 l->markConfig = mc;
1694
1695 aclParseAclList(LegacyParser, &l->aclList, token.c_str());
1696
1697 acl_nfmark **tail = head; /* sane name below */
1698 while (*tail)
1699 tail = &(*tail)->next;
1700
1701 *tail = l;
1702}
1703
1704static void
1705free_acl_nfmark(acl_nfmark ** head)
1706{
1707 delete *head;
1708 *head = nullptr;
1709}
1710#endif /* SO_MARK */
1711
1712static void
1713dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)
1714{
1715 for (AclSizeLimit *l = head; l; l = l->next) {
1716 if (l->size != -1)
1717 storeAppendPrintf(entry, "%s %d %s\n", name, (int) l->size, B_BYTES_STR);
1718 else
1719 storeAppendPrintf(entry, "%s none", name);
1720
1721 dump_acl_list(entry, l->aclList);
1722
1723 storeAppendPrintf(entry, "\n");
1724 }
1725}
1726
1727static void
1729{
1730 AclSizeLimit *l = new AclSizeLimit;
1731
1732 parse_b_int64_t(&l->size);
1733
1735
1736 AclSizeLimit **tail = head; /* sane name below */
1737 while (*tail)
1738 tail = &(*tail)->next;
1739
1740 *tail = l;
1741}
1742
1743static void
1745{
1746 delete *head;
1747 *head = nullptr;
1748}
1749
1750#if USE_DELAY_POOLS
1751
1752#include "DelayConfig.h"
1753#include "DelayPools.h"
1754/* do nothing - free_delay_pool_count is the magic free function.
1755 * this is why delay_pool_count isn't just marked TYPE: u_short
1756 */
1757#define free_delay_pool_class(X)
1758#define free_delay_pool_access(X)
1759#define free_delay_pool_rates(X)
1760#define dump_delay_pool_class(X, Y, Z)
1761#define dump_delay_pool_access(X, Y, Z)
1762#define dump_delay_pool_rates(X, Y, Z)
1763
1764static void
1766{
1767 cfg->freePoolCount();
1768}
1769
1770static void
1771dump_delay_pool_count(StoreEntry * entry, const char *name, DelayConfig &cfg)
1772{
1773 cfg.dumpPoolCount (entry, name);
1774}
1775
1776static void
1778{
1779 cfg->parsePoolCount();
1780}
1781
1782static void
1784{
1785 cfg->parsePoolClass();
1786}
1787
1788static void
1790{
1791 cfg->parsePoolRates();
1792}
1793
1794static void
1796{
1798}
1799
1800#endif
1801
1802#if USE_DELAY_POOLS
1803#include "ClientDelayConfig.h"
1804/* do nothing - free_client_delay_pool_count is the magic free function.
1805 * this is why client_delay_pool_count isn't just marked TYPE: u_short
1806 */
1807
1808#define free_client_delay_pool_access(X)
1809#define free_client_delay_pool_rates(X)
1810#define dump_client_delay_pool_access(X, Y, Z)
1811#define dump_client_delay_pool_rates(X, Y, Z)
1812
1813static void
1815{
1816 cfg->freePools();
1817}
1818
1819static void
1821{
1822 cfg.dumpPoolCount (entry, name);
1823}
1824
1825static void
1827{
1828 cfg->parsePoolCount();
1829}
1830
1831static void
1833{
1834 cfg->parsePoolRates();
1835}
1836
1837static void
1839{
1841}
1842#endif
1843
1844#if USE_HTTP_VIOLATIONS
1845static void
1846dump_http_header_access(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1847{
1848 if (manglers)
1849 manglers->dumpAccess(entry, name);
1850}
1851
1852static void
1854{
1855 char *t = nullptr;
1856
1857 if ((t = ConfigParser::NextToken()) == nullptr) {
1858 debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1859 debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_access: missing header name.");
1860 return;
1861 }
1862
1863 if (!*pm)
1864 *pm = new HeaderManglers;
1865 HeaderManglers *manglers = *pm;
1866 headerMangler *mangler = manglers->track(t);
1867 assert(mangler);
1868
1869 std::string directive = "http_header_access ";
1870 directive += t;
1871 aclParseAccessLine(directive.c_str(), LegacyParser, &mangler->access_list);
1872}
1873
1874static void
1876{
1877 // we delete the entire http_header_* mangler configuration at once
1878 if (const HeaderManglers *manglers = *pm) {
1879 delete manglers;
1880 *pm = nullptr;
1881 }
1882}
1883
1884static void
1885dump_http_header_replace(StoreEntry * entry, const char *name, const HeaderManglers *manglers)
1886{
1887 if (manglers)
1888 manglers->dumpReplacement(entry, name);
1889}
1890
1891static void
1893{
1894 char *t = nullptr;
1895
1896 if ((t = ConfigParser::NextToken()) == nullptr) {
1897 debugs(3, DBG_CRITICAL, "" << cfg_filename << " line " << config_lineno << ": " << config_input_line);
1898 debugs(3, DBG_CRITICAL, "ERROR: parse_http_header_replace: missing header name.");
1899 return;
1900 }
1901
1902 const char *value = ConfigParser::NextQuotedOrToEol();
1903
1904 if (!*pm)
1905 *pm = new HeaderManglers;
1906 HeaderManglers *manglers = *pm;
1907 manglers->setReplacement(t, value);
1908}
1909
1910#endif
1911
1912static void
1913dump_cachedir(StoreEntry * entry, const char *name, const Store::DiskConfig &swap)
1914{
1915 Store::Disks::Dump(swap, *entry, name);
1916}
1917
1918static int
1920{
1921 return s == nullptr;
1922}
1923
1924#if USE_AUTH
1925static void
1927{
1928 char *type_str = ConfigParser::NextToken();
1929 if (!type_str) {
1930 self_destruct();
1931 return;
1932 }
1933
1934 char *param_str = ConfigParser::NextToken();
1935 if (!param_str) {
1936 self_destruct();
1937 return;
1938 }
1939
1940 /* find a configuration for the scheme in the currently parsed configs... */
1941 Auth::SchemeConfig *schemeCfg = Auth::SchemeConfig::Find(type_str);
1942
1943 if (schemeCfg == nullptr) {
1944 /* Create a configuration based on the scheme info */
1945 Auth::Scheme::Pointer theScheme = Auth::Scheme::Find(type_str);
1946
1947 if (theScheme == nullptr) {
1948 debugs(3, DBG_CRITICAL, "ERROR: Failure while parsing Config File: Unknown authentication scheme '" << type_str << "'.");
1949 self_destruct();
1950 return;
1951 }
1952
1953 config->push_back(theScheme->createConfig());
1954 schemeCfg = Auth::SchemeConfig::Find(type_str);
1955 if (schemeCfg == nullptr) {
1956 debugs(3, DBG_CRITICAL, "Parsing Config File: Corruption configuring authentication scheme '" << type_str << "'.");
1957 self_destruct();
1958 return;
1959 }
1960 }
1961
1962 schemeCfg->parse(schemeCfg, config->size(), param_str);
1963}
1964
1965static void
1967{
1968 /* Wipe the Auth globals and Detach/Destruct component config + state. */
1969 cfg->clear();
1970
1971 /* on reconfigure initialize new auth schemes for the new config. */
1972 if (reconfiguring) {
1973 Auth::Init();
1974 }
1975}
1976
1977static void
1978dump_authparam(StoreEntry * entry, const char *name, Auth::ConfigVector cfg)
1979{
1980 for (auto *scheme : cfg)
1981 scheme->dump(entry, name, scheme);
1982}
1983
1984static void
1986{
1987 const char *tok = ConfigParser::NextQuotedToken();
1988 if (!tok) {
1989 debugs(29, DBG_CRITICAL, "FATAL: auth_schemes missing the parameter");
1990 self_destruct();
1991 return;
1992 }
1994 const auto action = Acl::Answer(ACCESS_ALLOWED, Auth::TheConfig.schemeLists.size() - 1);
1995 ParseAclWithAction(authSchemes, action, "auth_schemes");
1996}
1997
1998static void
2000{
2002 free_acl_access(authSchemes);
2003}
2004
2005static void
2006dump_AuthSchemes(StoreEntry *entry, const char *name, acl_access *authSchemes)
2007{
2008 if (authSchemes)
2009 dump_SBufList(entry, authSchemes->treeDump(name, [](const Acl::Answer &action) {
2010 return Auth::TheConfig.schemeLists.at(action.kind).rawSchemes;
2011 }));
2012}
2013
2014#endif /* USE_AUTH */
2015
2016static void
2017ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl)
2018{
2019 assert(access);
2020 SBuf name;
2021 if (!*access) {
2022 *access = new Acl::Tree;
2023 name.Printf("(%s rules)", desc);
2024 (*access)->context(name.c_str(), config_input_line);
2025 }
2026 Acl::AndNode *rule = new Acl::AndNode;
2027 name.Printf("(%s rule)", desc);
2028 rule->context(name.c_str(), config_input_line);
2029 if (acl)
2030 rule->add(acl);
2031 else
2032 rule->lineParse();
2033 (*access)->add(rule, action);
2034}
2035
2036static void
2038{
2039 assert(swap);
2040 Store::Disks::Parse(*swap);
2041}
2042
2043static const char *
2045{
2046 const char * result;
2047
2048 switch (type) {
2049
2050 case PEER_PARENT:
2051 result = "parent";
2052 break;
2053
2054 case PEER_SIBLING:
2055 result = "sibling";
2056 break;
2057
2058 case PEER_MULTICAST:
2059 result = "multicast";
2060 break;
2061
2062 default:
2063 result = "unknown";
2064 break;
2065 }
2066
2067 return result;
2068}
2069
2070static void
2071dump_peer(StoreEntry * entry, const char *name, CachePeer * p)
2072{
2074 LOCAL_ARRAY(char, xname, 128);
2075
2076 while (p != nullptr) {
2077 storeAppendPrintf(entry, "%s %s %s %d %d name=%s",
2078 name,
2079 p->host,
2080 neighborTypeStr(p),
2081 p->http_port,
2082 p->icp.port,
2083 p->name);
2084 dump_peer_options(entry, p);
2085
2086 if (p->access) {
2087 snprintf(xname, 128, "cache_peer_access %s", p->name);
2088 dump_acl_access(entry, xname, p->access);
2089 }
2090
2091 for (t = p->typelist; t; t = t->next) {
2092 storeAppendPrintf(entry, "neighbor_type_domain %s %s %s\n",
2093 p->host,
2094 peer_type_str(t->type),
2095 t->domain);
2096 }
2097
2098 p = p->next;
2099 }
2100}
2101
2106static bool
2107isUnsignedNumeric(const char *str, size_t len)
2108{
2109 if (len < 1) return false;
2110
2111 for (; len >0 && *str; ++str, --len) {
2112 if (! isdigit(*str))
2113 return false;
2114 }
2115 return true;
2116}
2117
2122static unsigned short
2123GetService(const char *proto)
2124{
2125 struct servent *port = nullptr;
2127 char *token = ConfigParser::NextToken();
2128 if (token == nullptr) {
2129 self_destruct();
2130 return 0; /* NEVER REACHED */
2131 }
2133 if ( !isUnsignedNumeric(token, strlen(token)) )
2134 port = getservbyname(token, proto);
2135 if (port != nullptr) {
2136 return ntohs((unsigned short)port->s_port);
2137 }
2139 return xatos(token);
2140}
2141
2146inline unsigned short
2148{
2149 return GetService("tcp");
2150}
2151
2156inline unsigned short
2158{
2159 return GetService("udp");
2160}
2161
2162static void
2164{
2165 char *host_str = ConfigParser::NextToken();
2166 if (!host_str) {
2167 self_destruct();
2168 return;
2169 }
2170
2171 char *token = ConfigParser::NextToken();
2172 if (!token) {
2173 self_destruct();
2174 return;
2175 }
2176
2177 const auto p = new CachePeer(host_str);
2178
2179 p->type = parseNeighborType(token);
2180
2181 if (p->type == PEER_MULTICAST) {
2182 p->options.no_digest = true;
2183 p->options.no_netdb_exchange = true;
2184 }
2185
2186 p->http_port = GetTcpService();
2187
2188 if (!p->http_port) {
2189 delete p;
2190 self_destruct();
2191 return;
2192 }
2193
2194 p->icp.port = GetUdpService();
2195
2196 while ((token = ConfigParser::NextToken())) {
2197 if (!strcmp(token, "proxy-only")) {
2198 p->options.proxy_only = true;
2199 } else if (!strcmp(token, "no-query")) {
2200 p->options.no_query = true;
2201 } else if (!strcmp(token, "background-ping")) {
2202 p->options.background_ping = true;
2203 } else if (!strcmp(token, "no-digest")) {
2204 p->options.no_digest = true;
2205 } else if (!strcmp(token, "no-tproxy")) {
2206 p->options.no_tproxy = true;
2207 } else if (!strcmp(token, "multicast-responder")) {
2208 p->options.mcast_responder = true;
2209#if PEER_MULTICAST_SIBLINGS
2210 } else if (!strcmp(token, "multicast-siblings")) {
2211 p->options.mcast_siblings = true;
2212#endif
2213 } else if (!strncmp(token, "weight=", 7)) {
2214 p->weight = xatoi(token + 7);
2215 } else if (!strncmp(token, "basetime=", 9)) {
2216 p->basetime = xatoi(token + 9);
2217 } else if (!strcmp(token, "closest-only")) {
2218 p->options.closest_only = true;
2219 } else if (!strncmp(token, "ttl=", 4)) {
2220 p->mcast.ttl = xatoi(token + 4);
2221
2222 if (p->mcast.ttl < 0)
2223 p->mcast.ttl = 0;
2224
2225 if (p->mcast.ttl > 128)
2226 p->mcast.ttl = 128;
2227 } else if (!strcmp(token, "default")) {
2228 p->options.default_parent = true;
2229 } else if (!strcmp(token, "round-robin")) {
2230 p->options.roundrobin = true;
2231 } else if (!strcmp(token, "weighted-round-robin")) {
2232 p->options.weighted_roundrobin = true;
2233#if USE_HTCP
2234 } else if (!strcmp(token, "htcp")) {
2235 p->options.htcp = true;
2236 } else if (!strncmp(token, "htcp=", 5) || !strncmp(token, "htcp-", 5)) {
2237 /* Note: The htcp- form is deprecated, replaced by htcp= */
2238 p->options.htcp = true;
2239 char *tmp = xstrdup(token+5);
2240 char *mode, *nextmode;
2241 for (mode = nextmode = tmp; mode; mode = nextmode) {
2242 nextmode = strchr(mode, ',');
2243 if (nextmode) {
2244 *nextmode = '\0';
2245 ++nextmode;
2246 }
2247 if (!strcmp(mode, "no-clr")) {
2248 if (p->options.htcp_only_clr)
2249 fatalf("parse_peer: can't set htcp-no-clr and htcp-only-clr simultaneously");
2250 p->options.htcp_no_clr = true;
2251 } else if (!strcmp(mode, "no-purge-clr")) {
2252 p->options.htcp_no_purge_clr = true;
2253 } else if (!strcmp(mode, "only-clr")) {
2254 if (p->options.htcp_no_clr)
2255 fatalf("parse_peer: can't set htcp no-clr and only-clr simultaneously");
2256 p->options.htcp_only_clr = true;
2257 } else if (!strcmp(mode, "forward-clr")) {
2258 p->options.htcp_forward_clr = true;
2259 } else if (!strcmp(mode, "oldsquid")) {
2260 p->options.htcp_oldsquid = true;
2261 } else {
2262 fatalf("invalid HTCP mode '%s'", mode);
2263 }
2264 }
2265 safe_free(tmp);
2266#endif
2267 } else if (!strcmp(token, "no-netdb-exchange")) {
2268 p->options.no_netdb_exchange = true;
2269
2270 } else if (!strcmp(token, "carp")) {
2271 if (p->type != PEER_PARENT)
2272 throw TextException(ToSBuf("non-parent carp cache_peer ", *p), Here());
2273
2274 p->options.carp = true;
2275 } else if (!strncmp(token, "carp-key=", 9)) {
2276 if (p->options.carp != true)
2277 throw TextException(ToSBuf("carp-key specified on non-carp cache_peer ", *p), Here());
2278 p->options.carp_key.set = true;
2279 char *nextkey=token+strlen("carp-key="), *key=nextkey;
2280 for (; key; key = nextkey) {
2281 nextkey=strchr(key,',');
2282 if (nextkey) ++nextkey; // skip the comma, any
2283 if (0==strncmp(key,"scheme",6)) {
2284 p->options.carp_key.scheme = true;
2285 } else if (0==strncmp(key,"host",4)) {
2286 p->options.carp_key.host = true;
2287 } else if (0==strncmp(key,"port",4)) {
2288 p->options.carp_key.port = true;
2289 } else if (0==strncmp(key,"path",4)) {
2290 p->options.carp_key.path = true;
2291 } else if (0==strncmp(key,"params",6)) {
2292 p->options.carp_key.params = true;
2293 } else {
2294 fatalf("invalid carp-key '%s'",key);
2295 }
2296 }
2297 } else if (!strcmp(token, "userhash")) {
2298#if USE_AUTH
2299 if (p->type != PEER_PARENT)
2300 throw TextException(ToSBuf("non-parent userhash cache_peer ", *p), Here());
2301
2302 p->options.userhash = true;
2303#else
2304 throw TextException(ToSBuf("missing authentication support; required for userhash cache_peer ", *p), Here());
2305#endif
2306 } else if (!strcmp(token, "sourcehash")) {
2307 if (p->type != PEER_PARENT)
2308 throw TextException(ToSBuf("non-parent sourcehash cache_peer ", *p), Here());
2309
2310 p->options.sourcehash = true;
2311
2312 } else if (!strcmp(token, "no-delay")) {
2313#if USE_DELAY_POOLS
2314 p->options.no_delay = true;
2315#else
2316 debugs(0, DBG_CRITICAL, "WARNING: cache_peer option 'no-delay' requires --enable-delay-pools");
2317#endif
2318 } else if (!strncmp(token, "login=", 6)) {
2319 p->login = xstrdup(token + 6);
2320 rfc1738_unescape(p->login);
2321 } else if (!strcmp(token, "auth-no-keytab")) {
2322 p->options.auth_no_keytab = 1;
2323 } else if (!strncmp(token, "connect-timeout=", 16)) {
2324 p->connect_timeout_raw = xatoi(token + 16);
2325 } else if (!strncmp(token, "connect-fail-limit=", 19)) {
2326 p->connect_fail_limit = xatoi(token + 19);
2327#if USE_CACHE_DIGESTS
2328 } else if (!strncmp(token, "digest-url=", 11)) {
2329 p->digest_url = xstrdup(token + 11);
2330#endif
2331
2332 } else if (!strcmp(token, "allow-miss")) {
2333 p->options.allow_miss = true;
2334 } else if (!strncmp(token, "max-conn=", 9)) {
2335 p->max_conn = xatoi(token + 9);
2336 } else if (!strncmp(token, "standby=", 8)) {
2337 p->standby.limit = xatoi(token + 8);
2338 } else if (!strcmp(token, "originserver")) {
2339 p->options.originserver = true;
2340 } else if (!strncmp(token, "name=", 5)) {
2341 p->rename(token + 5);
2342 } else if (!strncmp(token, "forceddomain=", 13)) {
2343 safe_free(p->domain);
2344 if (token[13])
2345 p->domain = xstrdup(token + 13);
2346
2347 } else if (strncmp(token, "ssl", 3) == 0) {
2348#if !USE_OPENSSL
2349 debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-openssl");
2350#else
2351 p->secure.parse(token+3);
2352#endif
2353 } else if (strncmp(token, "tls-", 4) == 0) {
2354 p->secure.parse(token+4);
2355 } else if (strncmp(token, "tls", 3) == 0) {
2356 p->secure.parse(token+3);
2357 } else if (strcmp(token, "front-end-https") == 0) {
2358 p->front_end_https = 1;
2359 } else if (strcmp(token, "front-end-https=on") == 0) {
2360 p->front_end_https = 1;
2361 } else if (strcmp(token, "front-end-https=auto") == 0) {
2362 p->front_end_https = 2;
2363 } else if (strcmp(token, "connection-auth=off") == 0) {
2364 p->connection_auth = 0;
2365 } else if (strcmp(token, "connection-auth") == 0) {
2366 p->connection_auth = 1;
2367 } else if (strcmp(token, "connection-auth=on") == 0) {
2368 p->connection_auth = 1;
2369 } else if (strcmp(token, "connection-auth=auto") == 0) {
2370 p->connection_auth = 2;
2371 } else if (token[0] == '#') {
2372 // start of a text comment. stop reading this line.
2373 break;
2374 } else {
2375 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Ignoring unknown cache_peer option '" << token << "'");
2376 }
2377 }
2378
2379 if (findCachePeerByName(p->name))
2380 throw TextException(ToSBuf("cache_peer ", *p, " specified twice"), Here());
2381
2382 if (p->max_conn > 0 && p->max_conn < p->standby.limit)
2383 throw TextException(ToSBuf("cache_peer ", *p, " max-conn=", p->max_conn,
2384 " is lower than its standby=", p->standby.limit), Here());
2385
2386 if (p->weight < 1)
2387 p->weight = 1;
2388
2389 if (p->connect_fail_limit < 1)
2390 p->connect_fail_limit = 10;
2391
2392#if USE_CACHE_DIGESTS
2393 if (!p->options.no_digest)
2395#endif
2396
2397 if (p->secure.encryptTransport)
2398 p->secure.parseOptions();
2399
2400 p->index = ++Config.npeers;
2401
2402 while (*head != nullptr)
2403 head = &(*head)->next;
2404
2405 *head = p;
2406
2408}
2409
2410static void
2412{
2413 delete *P;
2414 *P = nullptr;
2415 Config.npeers = 0;
2416}
2417
2418static void
2420{
2421 while (list) {
2422 if (strcmp(list->passwd, "none") && strcmp(list->passwd, "disable"))
2423 storeAppendPrintf(entry, "%s XXXXXXXXXX", name);
2424 else
2425 storeAppendPrintf(entry, "%s %s", name, list->passwd);
2426
2427 for (auto w : list->actions)
2428 entry->appendf(" " SQUIDSBUFPH, SQUIDSBUFPRINT(w));
2429
2430 storeAppendPrintf(entry, "\n");
2431 list = list->next;
2432 }
2433}
2434
2435static void
2437{
2438 char *passwd = nullptr;
2439 parse_string(&passwd);
2440
2442 p->passwd = passwd;
2443
2444 while (char *token = ConfigParser::NextQuotedToken())
2445 p->actions.push_back(SBuf(token));
2446
2448 for (P = head; *P; P = &(*P)->next) {
2449 /*
2450 * See if any of the actions from this line already have a
2451 * password from previous lines. The password checking
2452 * routines in cache_manager.c take the the password from
2453 * the first Mgr::ActionPasswordList that contains the
2454 * requested action. Thus, we should warn users who might
2455 * think they can have two passwords for the same action.
2456 */
2457 for (const auto &w : (*P)->actions) {
2458 for (const auto &u : p->actions) {
2459 if (w != u)
2460 continue;
2461
2462 debugs(0, DBG_PARSE_NOTE(1), "ERROR: action '" << u << "' (line " << config_lineno << ") already has a password");
2463 }
2464 }
2465 }
2466
2467 *P = p;
2468}
2469
2470static void
2472{
2473 delete *head;
2474 *head = nullptr;
2475}
2476
2477static void
2478dump_denyinfo(StoreEntry * entry, const char *name, AclDenyInfoList * var)
2479{
2480 while (var != nullptr) {
2481 storeAppendPrintf(entry, "%s %s", name, var->err_page_name);
2482
2483 for (const auto &aclName: var->acl_list)
2484 storeAppendPrintf(entry, " " SQUIDSBUFPH, SQUIDSBUFPRINT(aclName));
2485
2486 storeAppendPrintf(entry, "\n");
2487
2488 var = var->next;
2489 }
2490}
2491
2492static void
2494{
2496}
2497
2498void
2500{
2501 delete *list;
2502 *list = nullptr;
2503}
2504
2505static void
2507{
2508 auto &p = LegacyParser.cachePeer("cache_peer_access peer-name");
2509 std::string directive = "peer_access ";
2510 directive += p.name;
2511 aclParseAccessLine(directive.c_str(), LegacyParser, &p.access);
2512}
2513
2514static void
2516{
2517 auto &p = LegacyParser.cachePeer("neighbor_type_domain peer-name");
2518
2519 char *type = ConfigParser::NextToken();
2520 if (!type) {
2521 self_destruct();
2522 return;
2523 }
2524
2525 char *domain = nullptr;
2526 while ((domain = ConfigParser::NextToken())) {
2527 auto *l = static_cast<NeighborTypeDomainList *>(xcalloc(1, sizeof(NeighborTypeDomainList)));
2528 l->type = parseNeighborType(type);
2529 l->domain = xstrdup(domain);
2530
2531 NeighborTypeDomainList **L = nullptr;
2532 for (L = &p.typelist; *L; L = &((*L)->next));
2533 *L = l;
2534 }
2535}
2536
2537static void
2538dump_int(StoreEntry * entry, const char *name, int var)
2539{
2540 storeAppendPrintf(entry, "%s %d\n", name, var);
2541}
2542
2543void
2544parse_int(int *var)
2545{
2546 int i;
2547 i = GetInteger();
2548 *var = i;
2549}
2550
2551static void
2552free_int(int *var)
2553{
2554 *var = 0;
2555}
2556
2557static void
2558dump_int64_t(StoreEntry * entry, const char *name, int64_t var)
2559{
2560 storeAppendPrintf(entry, "%s %" PRId64 "\n", name, var);
2561}
2562
2563static void
2564parse_int64_t(int64_t *var)
2565{
2566 int64_t i;
2567 i = GetInteger64();
2568 *var = i;
2569}
2570
2571static void
2572free_int64_t(int64_t *var)
2573{
2574 *var = 0;
2575}
2576
2577static void
2578dump_onoff(StoreEntry * entry, const char *name, int var)
2579{
2580 storeAppendPrintf(entry, "%s %s\n", name, var ? "on" : "off");
2581}
2582
2583void
2585{
2586 char *token = ConfigParser::NextToken();
2587 if (!token) {
2588 self_destruct();
2589 return;
2590 }
2591
2592 if (!strcmp(token, "on")) {
2593 *var = 1;
2594 } else if (!strcmp(token, "enable")) {
2595 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use 'on'.");
2596 *var = 1;
2597 } else if (!strcmp(token, "off")) {
2598 *var = 0;
2599 } else if (!strcmp(token, "disable")) {
2600 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use 'off'.");
2601 *var = 0;
2602 } else {
2603 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Boolean options can only be 'on' or 'off'.");
2604 self_destruct();
2605 }
2606}
2607
2608#define free_onoff free_int
2609
2610static void
2611dump_tristate(StoreEntry * entry, const char *name, int var)
2612{
2613 const char *state;
2614
2615 if (var > 0)
2616 state = "on";
2617 else if (var < 0)
2618 state = "warn";
2619 else
2620 state = "off";
2621
2622 storeAppendPrintf(entry, "%s %s\n", name, state);
2623}
2624
2625static void
2627{
2628 char *token = ConfigParser::NextToken();
2629 if (!token) {
2630 self_destruct();
2631 return;
2632 }
2633
2634 if (!strcmp(token, "on")) {
2635 *var = 1;
2636 } else if (!strcmp(token, "enable")) {
2637 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'enable' is deprecated. Please update to use value 'on'.");
2638 *var = 1;
2639 } else if (!strcmp(token, "warn")) {
2640 *var = -1;
2641 } else if (!strcmp(token, "off")) {
2642 *var = 0;
2643 } else if (!strcmp(token, "disable")) {
2644 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'disable' is deprecated. Please update to use value 'off'.");
2645 *var = 0;
2646 } else {
2647 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "ERROR: Invalid option: Tristate options can only be 'on', 'off', or 'warn'.");
2648 self_destruct();
2649 }
2650}
2651
2652#define free_tristate free_int
2653
2654static void
2656{
2657 char *token = ConfigParser::PeekAtToken();
2658 if (!token) {
2659 self_destruct();
2660 return;
2661 }
2662
2663 if (!strcmp(token, "on")) {
2664 debugs(0, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: 'pipeline_prefetch on' is deprecated. Please update to use 1 (or a higher number).");
2665 *var = 1;
2666 //pop the token
2668 } else if (!strcmp(token, "off")) {
2669 debugs(0, DBG_PARSE_NOTE(2), "WARNING: 'pipeline_prefetch off' is deprecated. Please update to use '0'.");
2670 *var = 0;
2671 //pop the token
2673 } else
2674 parse_int(var);
2675}
2676
2677#define free_pipelinePrefetch free_int
2678#define dump_pipelinePrefetch dump_int
2679
2680static void
2682{
2683 while (head != nullptr) {
2684 PackableStream os(*entry);
2685 os << name << ' ';
2686 head->printHead(os);
2687
2688 if (head->max_stale >= 0)
2689 storeAppendPrintf(entry, " max-stale=%d", head->max_stale);
2690
2691 if (head->flags.refresh_ims)
2692 storeAppendPrintf(entry, " refresh-ims");
2693
2694 if (head->flags.store_stale)
2695 storeAppendPrintf(entry, " store-stale");
2696
2697#if USE_HTTP_VIOLATIONS
2698
2699 if (head->flags.override_expire)
2700 storeAppendPrintf(entry, " override-expire");
2701
2702 if (head->flags.override_lastmod)
2703 storeAppendPrintf(entry, " override-lastmod");
2704
2705 if (head->flags.reload_into_ims)
2706 storeAppendPrintf(entry, " reload-into-ims");
2707
2708 if (head->flags.ignore_reload)
2709 storeAppendPrintf(entry, " ignore-reload");
2710
2711 if (head->flags.ignore_no_store)
2712 storeAppendPrintf(entry, " ignore-no-store");
2713
2714 if (head->flags.ignore_private)
2715 storeAppendPrintf(entry, " ignore-private");
2716#endif
2717
2718 storeAppendPrintf(entry, "\n");
2719
2720 head = head->next;
2721 }
2722}
2723
2724static void
2726{
2727 char *token;
2728 time_t min = 0;
2729 double pct = 0.0;
2730 time_t max = 0;
2731 int refresh_ims = 0;
2732 int store_stale = 0;
2733 int max_stale = -1;
2734
2735#if USE_HTTP_VIOLATIONS
2736
2737 int override_expire = 0;
2738 int override_lastmod = 0;
2739 int reload_into_ims = 0;
2740 int ignore_reload = 0;
2741 int ignore_no_store = 0;
2742 int ignore_private = 0;
2743#endif
2744
2745 int i;
2746 RefreshPattern *t;
2747
2748 auto regex = LegacyParser.regex("refresh_pattern regex");
2749
2750 i = GetInteger(); /* token: min */
2751
2752 /* catch negative and insanely huge values close to 32-bit wrap */
2753 if (i < 0) {
2754 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age negative. Cropped back to zero.");
2755 i = 0;
2756 }
2757 if (i > 60*24*365) {
2758 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern minimum age too high. Cropped back to 1 year.");
2759 i = 60*24*365;
2760 }
2761
2762 min = (time_t) (i * 60); /* convert minutes to seconds */
2763
2764 pct = GetPercentage(false); /* token: pct . with no limit on size */
2765
2766 i = GetInteger(); /* token: max */
2767
2768 /* catch negative and insanely huge values close to 32-bit wrap */
2769 if (i < 0) {
2770 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age negative. Cropped back to zero.");
2771 i = 0;
2772 }
2773 if (i > 60*24*365) {
2774 debugs(3, DBG_IMPORTANT, "WARNING: refresh_pattern maximum age too high. Cropped back to 1 year.");
2775 i = 60*24*365;
2776 }
2777
2778 max = (time_t) (i * 60); /* convert minutes to seconds */
2779
2780 /* Options */
2781 while ((token = ConfigParser::NextToken()) != nullptr) {
2782 if (!strcmp(token, "refresh-ims")) {
2783 refresh_ims = 1;
2784 } else if (!strcmp(token, "store-stale")) {
2785 store_stale = 1;
2786 } else if (!strncmp(token, "max-stale=", 10)) {
2787 max_stale = xatoi(token + 10);
2788
2789#if USE_HTTP_VIOLATIONS
2790
2791 } else if (!strcmp(token, "override-expire"))
2792 override_expire = 1;
2793 else if (!strcmp(token, "override-lastmod"))
2794 override_lastmod = 1;
2795 else if (!strcmp(token, "ignore-no-store"))
2796 ignore_no_store = 1;
2797 else if (!strcmp(token, "ignore-private"))
2798 ignore_private = 1;
2799 else if (!strcmp(token, "reload-into-ims")) {
2800 reload_into_ims = 1;
2802 /* tell client_side.c that this is used */
2803 } else if (!strcmp(token, "ignore-reload")) {
2804 ignore_reload = 1;
2806 /* tell client_side.c that this is used */
2807#endif
2808
2809 } else if (!strcmp(token, "ignore-no-cache") ||
2810 !strcmp(token, "ignore-must-revalidate") ||
2811 !strcmp(token, "ignore-auth")
2812 ) {
2813 debugs(22, DBG_PARSE_NOTE(2), "UPGRADE: refresh_pattern option '" << token << "' is obsolete. Remove it.");
2814 } else
2815 debugs(22, DBG_CRITICAL, "ERROR: Unknown refresh_pattern option: " << token);
2816 }
2817
2818 pct = pct < 0.0 ? 0.0 : pct;
2819 max = max < 0 ? 0 : max;
2820 t = new RefreshPattern(std::move(regex));
2821 t->min = min;
2822 t->pct = pct;
2823 t->max = max;
2824
2825 if (refresh_ims)
2826 t->flags.refresh_ims = true;
2827
2828 if (store_stale)
2829 t->flags.store_stale = true;
2830
2831 t->max_stale = max_stale;
2832
2833#if USE_HTTP_VIOLATIONS
2834
2835 if (override_expire)
2836 t->flags.override_expire = true;
2837
2838 if (override_lastmod)
2839 t->flags.override_lastmod = true;
2840
2841 if (reload_into_ims)
2842 t->flags.reload_into_ims = true;
2843
2844 if (ignore_reload)
2845 t->flags.ignore_reload = true;
2846
2847 if (ignore_no_store)
2848 t->flags.ignore_no_store = true;
2849
2850 if (ignore_private)
2851 t->flags.ignore_private = true;
2852#endif
2853
2854 t->next = nullptr;
2855
2856 while (*head)
2857 head = &(*head)->next;
2858
2859 *head = t;
2860}
2861
2862static void
2864{
2865 delete *head;
2866 *head = nullptr;
2867
2868#if USE_HTTP_VIOLATIONS
2870
2871#endif
2872}
2873
2874static void
2875dump_string(StoreEntry * entry, const char *name, char *var)
2876{
2877 if (var != nullptr)
2878 storeAppendPrintf(entry, "%s %s\n", name, var);
2879}
2880
2881static void
2882parse_string(char **var)
2883{
2884 safe_free(*var);
2885
2886 char *token = ConfigParser::NextToken();
2887 if (!token) {
2888 self_destruct();
2889 return;
2890 }
2891
2892 *var = xstrdup(token);
2893}
2894
2895static void
2896free_string(char **var)
2897{
2898 safe_free(*var);
2899}
2900
2901void
2902parse_eol(char *volatile *var)
2903{
2904 if (!var) {
2905 self_destruct();
2906 return;
2907 }
2908
2909 unsigned char *token = (unsigned char *) ConfigParser::NextQuotedOrToEol();
2910 safe_free(*var);
2911
2912 if (!token) {
2913 self_destruct();
2914 return;
2915 }
2916
2917 while (*token && xisspace(*token))
2918 ++token;
2919
2920 if (!*token) {
2921 self_destruct();
2922 return;
2923 }
2924
2925 *var = xstrdup((char *) token);
2926}
2927
2928#define dump_eol dump_string
2929#define free_eol free_string
2930
2931static void
2933{
2934 safe_free(*var);
2935
2936 char *token = ConfigParser::NextQuotedToken();
2937 if (!token) {
2938 self_destruct();
2939 return;
2940 }
2941
2942 *var = xstrdup(token);
2943}
2944
2945#define dump_TokenOrQuotedString dump_string
2946#define free_TokenOrQuotedString free_string
2947
2948static void
2949dump_time_t(StoreEntry * entry, const char *name, time_t var)
2950{
2951 storeAppendPrintf(entry, "%s %d seconds\n", name, (int) var);
2952}
2953
2954void
2955parse_time_t(time_t * var)
2956{
2957 const auto maxTime = std::numeric_limits<time_t>::max();
2958 const auto seconds = parseTimeLine<std::chrono::seconds>();
2959 if (maxTime < seconds.count())
2960 throw TexcHere(ToSBuf("directive supports time values up to ", maxTime, " but is given ", seconds.count(), " seconds"));
2961 *var = static_cast<time_t>(seconds.count());
2962}
2963
2964static void
2965free_time_t(time_t * var)
2966{
2967 *var = 0;
2968}
2969
2970static void
2971dump_time_msec(StoreEntry * entry, const char *name, time_msec_t var)
2972{
2973 if (var % 1000)
2974 storeAppendPrintf(entry, "%s %" PRId64 " milliseconds\n", name, var);
2975 else
2976 storeAppendPrintf(entry, "%s %d seconds\n", name, (int)(var/1000) );
2977}
2978
2979static void
2981{
2982 *var = parseTimeLine<std::chrono::milliseconds>().count();
2983}
2984
2985static void
2987{
2988 *var = 0;
2989}
2990
2991static void
2992dump_time_nanoseconds(StoreEntry *entry, const char *name, const std::chrono::nanoseconds &var)
2993{
2994 // std::chrono::nanoseconds::rep is unknown a priori so we cast to (and print) the largest supported integer
2995 storeAppendPrintf(entry, "%s %jd nanoseconds\n", name, static_cast<intmax_t>(var.count()));
2996}
2997
2998static void
2999parse_time_nanoseconds(std::chrono::nanoseconds *var)
3000{
3001 *var = parseTimeLine<std::chrono::nanoseconds>();
3002}
3003
3004static void
3005free_time_nanoseconds(std::chrono::nanoseconds *var)
3006{
3007 *var = std::chrono::nanoseconds::zero();
3008}
3009
3010static void
3011dump_b_size_t(StoreEntry * entry, const char *name, size_t var)
3012{
3013 storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3014}
3015
3016static void
3017dump_b_ssize_t(StoreEntry * entry, const char *name, ssize_t var)
3018{
3019 storeAppendPrintf(entry, "%s %d %s\n", name, (int) var, B_BYTES_STR);
3020}
3021
3022static void
3023dump_b_int64_t(StoreEntry * entry, const char *name, int64_t var)
3024{
3025 storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_BYTES_STR);
3026}
3027
3028static void
3029dump_kb_int64_t(StoreEntry * entry, const char *name, int64_t var)
3030{
3031 storeAppendPrintf(entry, "%s %" PRId64 " %s\n", name, var, B_KBYTES_STR);
3032}
3033
3034static void
3035parse_b_size_t(size_t * var)
3036{
3038}
3039
3040static void
3041parse_b_ssize_t(ssize_t * var)
3042{
3044}
3045
3046static void
3047parse_b_int64_t(int64_t * var)
3048{
3050}
3051
3052static void
3053parse_kb_int64_t(int64_t * var)
3054{
3056}
3057
3058static void
3059free_size_t(size_t * var)
3060{
3061 *var = 0;
3062}
3063
3064static void
3065free_ssize_t(ssize_t * var)
3066{
3067 *var = 0;
3068}
3069
3070static void
3071free_b_int64_t(int64_t * var)
3072{
3073 *var = 0;
3074}
3075
3076#define free_b_size_t free_size_t
3077#define free_b_ssize_t free_ssize_t
3078#define free_kb_size_t free_size_t
3079#define free_mb_size_t free_size_t
3080#define free_gb_size_t free_size_t
3081#define free_kb_int64_t free_b_int64_t
3082
3083static void
3084dump_u_short(StoreEntry * entry, const char *name, unsigned short var)
3085{
3086 storeAppendPrintf(entry, "%s %d\n", name, var);
3087}
3088
3089static void
3090free_u_short(unsigned short * u)
3091{
3092 *u = 0;
3093}
3094
3095static void
3096parse_u_short(unsigned short * var)
3097{
3099}
3100
3101void
3102ConfigParser::ParseUShort(unsigned short *var)
3103{
3104 *var = GetShort();
3105}
3106
3107void
3109{
3110 int i = GetInteger();
3111
3112 if (0 == i)
3113 *var = false;
3114 else if (1 == i)
3115 *var = true;
3116 else
3117 self_destruct();
3118}
3119
3120static void
3121dump_wordlist(StoreEntry * entry, const char *name, wordlist * list)
3122{
3123 while (list != nullptr) {
3124 storeAppendPrintf(entry, "%s %s\n", name, list->key);
3125 list = list->next;
3126 }
3127}
3128
3129void
3131{
3132 parse_wordlist(list);
3133}
3134
3135void
3137{
3138 char *token;
3139 while ((token = ConfigParser::NextQuotedToken()))
3140 wordlistAdd(list, token);
3141}
3142
3143static int
3145{
3146 return a == nullptr;
3147}
3148
3149#define free_wordlist wordlistDestroy
3150
3151#define free_uri_whitespace free_int
3152
3153static void
3155{
3156 char *token = ConfigParser::NextToken();
3157 if (!token) {
3158 self_destruct();
3159 return;
3160 }
3161
3162 if (!strcmp(token, "strip"))
3163 *var = URI_WHITESPACE_STRIP;
3164 else if (!strcmp(token, "deny"))
3165 *var = URI_WHITESPACE_DENY;
3166 else if (!strcmp(token, "allow"))
3167 *var = URI_WHITESPACE_ALLOW;
3168 else if (!strcmp(token, "encode"))
3169 *var = URI_WHITESPACE_ENCODE;
3170 else if (!strcmp(token, "chop"))
3171 *var = URI_WHITESPACE_CHOP;
3172 else {
3173 debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'uri_whitespace' accepts 'strip', 'deny', 'allow', 'encode', and 'chop'.");
3174 self_destruct();
3175 }
3176}
3177
3178static void
3179dump_uri_whitespace(StoreEntry * entry, const char *name, int var)
3180{
3181 const char *s;
3182
3183 if (var == URI_WHITESPACE_ALLOW)
3184 s = "allow";
3185 else if (var == URI_WHITESPACE_ENCODE)
3186 s = "encode";
3187 else if (var == URI_WHITESPACE_CHOP)
3188 s = "chop";
3189 else if (var == URI_WHITESPACE_DENY)
3190 s = "deny";
3191 else
3192 s = "strip";
3193
3194 storeAppendPrintf(entry, "%s %s\n", name, s);
3195}
3196
3197static void
3199{
3200 if (!*settings)
3201 return;
3202
3203 free_string(&(*settings)->type);
3204
3205 free_wordlist(&(*settings)->args);
3206
3207 delete *settings;
3208
3209 *settings = nullptr;
3210}
3211
3212static void
3214{
3215 if (*settings)
3216 free_removalpolicy(settings);
3217
3218 *settings = new RemovalPolicySettings;
3219
3220 parse_string(&(*settings)->type);
3221
3222 parse_wordlist(&(*settings)->args);
3223}
3224
3225static void
3226dump_removalpolicy(StoreEntry * entry, const char *name, RemovalPolicySettings * settings)
3227{
3228 wordlist *args;
3229 storeAppendPrintf(entry, "%s %s", name, settings->type);
3230 args = settings->args;
3231
3232 while (args) {
3233 storeAppendPrintf(entry, " %s", args->key);
3234 args = args->next;
3235 }
3236
3237 storeAppendPrintf(entry, "\n");
3238}
3239
3240inline void
3242{}
3243
3244static void
3246{
3247 int value = 0;
3248 parse_onoff(&value);
3249 option->configure(value > 0);
3250}
3251
3252static void
3253dump_YesNoNone(StoreEntry * entry, const char *name, YesNoNone &option)
3254{
3255 if (option.configured())
3256 dump_onoff(entry, name, option ? 1 : 0);
3257}
3258
3259static void
3261{}
3262
3263static void
3265{
3266 char *token = ConfigParser::NextToken();
3267 if (!token) {
3268 self_destruct();
3269 return;
3270 }
3271
3272 if (strcmp(token, "always") == 0) {
3275 } else if (strcmp(token, "disk") == 0) {
3278 } else if (strncmp(token, "net", 3) == 0) {
3281 } else if (strcmp(token, "never") == 0) {
3284 } else {
3285 debugs(0, DBG_PARSE_NOTE(2), "ERROR: Invalid option '" << token << "': 'memory_cache_mode' accepts 'always', 'disk', 'network', and 'never'.");
3286 self_destruct();
3287 }
3288}
3289
3290static void
3291dump_memcachemode(StoreEntry * entry, const char *name, SquidConfig &)
3292{
3293 storeAppendPrintf(entry, "%s ", name);
3295 storeAppendPrintf(entry, "always");
3297 storeAppendPrintf(entry, "disk");
3299 storeAppendPrintf(entry, "network");
3301 storeAppendPrintf(entry, "none");
3302 storeAppendPrintf(entry, "\n");
3303}
3304
3305#include "cf_parser.cci"
3306
3307peer_t
3308parseNeighborType(const char *s)
3309{
3310 if (!strcmp(s, "parent"))
3311 return PEER_PARENT;
3312
3313 if (!strcmp(s, "neighbor"))
3314 return PEER_SIBLING;
3315
3316 if (!strcmp(s, "neighbour"))
3317 return PEER_SIBLING;
3318
3319 if (!strcmp(s, "sibling"))
3320 return PEER_SIBLING;
3321
3322 if (!strcmp(s, "multicast"))
3323 return PEER_MULTICAST;
3324
3325 debugs(15, DBG_CRITICAL, "WARNING: Unknown neighbor type: " << s);
3326
3327 return PEER_SIBLING;
3328}
3329
3330#if USE_WCCPv2
3331static void
3333{
3334 char *token;
3336 Ip::Address ipa;
3337
3338 while ((token = ConfigParser::NextToken())) {
3339 if (GetHostWithPort(token, &ipa)) {
3340
3341 while (*head)
3342 head = &(*head)->next;
3343
3344 s = static_cast<Ip::Address_list *>(xcalloc(1, sizeof(*s)));
3345 s->s = ipa;
3346
3347 *head = s;
3348 } else {
3349 self_destruct();
3350 return;
3351 }
3352 }
3353}
3354
3355static void
3357{
3358 char ntoabuf[MAX_IPSTRLEN];
3359
3360 while (s) {
3361 storeAppendPrintf(e, "%s %s\n",
3362 n,
3363 s->s.toStr(ntoabuf,MAX_IPSTRLEN));
3364 s = s->next;
3365 }
3366}
3367
3368static void
3370{
3371 if (*head) delete *head;
3372 *head = nullptr;
3373}
3374
3375#if CURRENTLY_UNUSED
3376/* This code was previously used by http_port. Left as it really should
3377 * be used by icp_port and htcp_port
3378 */
3379static int
3380check_null_IpAddress_list(const Ip::Address_list * s)
3381{
3382 return NULL == s;
3383}
3384
3385#endif /* CURRENTLY_UNUSED */
3386#endif /* USE_WCCPv2 */
3387
3388static void
3390{
3391 char *host = nullptr;
3392 unsigned short port = 0;
3393 char *t = nullptr;
3394 char *junk = nullptr;
3395
3396 s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3397 s->name = xstrdup(token);
3398 s->connection_auth_disabled = false;
3399
3400 const SBuf &portType = AnyP::UriScheme(s->transport.protocol).image();
3401
3402 if (*token == '[') {
3403 /* [ipv6]:port */
3404 host = token + 1;
3405 t = strchr(host, ']');
3406 if (!t) {
3407 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing ']' on IPv6 address: " << token);
3408 self_destruct();
3409 return;
3410 }
3411 *t = '\0';
3412 ++t;
3413 if (*t != ':') {
3414 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port in: " << token);
3415 self_destruct();
3416 return;
3417 }
3418 if (!Ip::EnableIpv6) {
3419 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: IPv6 is not available.");
3420 self_destruct();
3421 return;
3422 }
3423 port = xatos(t + 1);
3424 } else if ((t = strchr(token, ':'))) {
3425 /* host:port */
3426 /* ipv4:port */
3427 host = token;
3428 *t = '\0';
3429 port = xatos(t + 1);
3430
3431 } else if (strtol(token, &junk, 10) && !*junk) {
3432 port = xatos(token);
3433 debugs(3, 3, portType << "_port: found Listen on Port: " << port);
3434 } else {
3435 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: missing Port: " << token);
3436 self_destruct();
3437 return;
3438 }
3439
3440 if (port == 0 && host != nullptr) {
3441 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: Port cannot be 0: " << token);
3442 self_destruct();
3443 return;
3444 }
3445
3446 if (nullptr == host) {
3447 s->s.setAnyAddr();
3448 s->s.port(port);
3449 if (!Ip::EnableIpv6)
3450 s->s.setIPv4();
3451 debugs(3, 3, portType << "_port: found Listen on wildcard address: *:" << s->s.port());
3452 } else if ( (s->s = host) ) { /* check/parse numeric IPA */
3453 s->s.port(port);
3454 if (!Ip::EnableIpv6)
3455 s->s.setIPv4();
3456 debugs(3, 3, portType << "_port: Listen on Host/IP: " << host << " --> " << s->s);
3457 } else if ( s->s.GetHostByName(host) ) { /* check/parse for FQDN */
3458 /* do not use ipcache */
3459 s->defaultsite = xstrdup(host);
3460 s->s.port(port);
3461 if (!Ip::EnableIpv6)
3462 s->s.setIPv4();
3463 debugs(3, 3, portType << "_port: found Listen as Host " << s->defaultsite << " on IP: " << s->s);
3464 } else {
3465 debugs(3, DBG_CRITICAL, "FATAL: " << portType << "_port: failed to resolve Host/IP: " << host);
3466 self_destruct();
3467 }
3468}
3469
3475{
3476 // HTTP/1.0 not supported because we are version 1.1 which contains a superset of 1.0
3477 // and RFC 2616 requires us to upgrade 1.0 to 1.1
3478 if (value.cmp("HTTP") == 0 || value.cmp("HTTP/1.1") == 0)
3479 return Http::ProtocolVersion(1,1);
3480
3481 if (value.cmp("HTTPS") == 0 || value.cmp("HTTPS/1.1") == 0)
3483
3484 if (value.cmp("FTP") == 0)
3485 return Ftp::ProtocolVersion();
3486
3487 fatalf("%s directive does not support protocol=" SQUIDSBUFPH "\n", cfg_directive, SQUIDSBUFPRINT(value));
3488 return AnyP::ProtocolVersion(); // not reached
3489}
3490
3491static void
3493{
3494 /* modes first */
3495
3496 if (strcmp(token, "accel") == 0) {
3497 if (s->flags.isIntercepted()) {
3498 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Accelerator mode requires its own port. It cannot be shared with other modes.");
3499 self_destruct();
3500 return;
3501 }
3502 s->flags.accelSurrogate = true;
3503 s->vhost = true;
3504 } else if (strcmp(token, "transparent") == 0 || strcmp(token, "intercept") == 0) {
3505 if (s->flags.accelSurrogate || s->flags.tproxyIntercept) {
3506 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": Intercept mode requires its own interception port. It cannot be shared with other modes.");
3507 self_destruct();
3508 return;
3509 }
3510 s->flags.natIntercept = true;
3511 Ip::Interceptor.StartInterception();
3512 /* Log information regarding the port modes under interception. */
3513 debugs(3, DBG_IMPORTANT, "Starting Authentication on port " << s->s);
3514 debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (interception enabled)");
3515 } else if (strcmp(token, "tproxy") == 0) {
3516 if (s->flags.natIntercept || s->flags.accelSurrogate) {
3517 debugs(3,DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY option requires its own interception port. It cannot be shared with other modes.");
3518 self_destruct();
3519 return;
3520 }
3521 s->flags.tproxyIntercept = true;
3522 Ip::Interceptor.StartTransparency();
3523 /* Log information regarding the port modes under transparency. */
3524 debugs(3, DBG_IMPORTANT, "Disabling Authentication on port " << s->s << " (TPROXY enabled)");
3525
3526 if (s->flags.proxySurrogate) {
3527 debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3528 }
3529
3530 if (!Ip::Interceptor.ProbeForTproxy(s->s)) {
3531 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": TPROXY support in the system does not work.");
3532 self_destruct();
3533 return;
3534 }
3535
3536 } else if (strcmp(token, "require-proxy-header") == 0) {
3537 s->flags.proxySurrogate = true;
3538 if (s->flags.tproxyIntercept) {
3539 // receiving is still permitted, so we do not unset the TPROXY flag
3540 // spoofing access control override takes care of the spoof disable later
3541 debugs(3, DBG_IMPORTANT, "Disabling TPROXY Spoofing on port " << s->s << " (require-proxy-header enabled)");
3542 }
3543
3544 } else if (strncmp(token, "defaultsite=", 12) == 0) {
3545 if (!s->flags.accelSurrogate) {
3546 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": defaultsite option requires Acceleration mode flag.");
3547 self_destruct();
3548 return;
3549 }
3550 safe_free(s->defaultsite);
3551 s->defaultsite = xstrdup(token + 12);
3552 } else if (strcmp(token, "vhost") == 0) {
3553 if (!s->flags.accelSurrogate) {
3554 debugs(3, DBG_CRITICAL, "WARNING: " << cfg_directive << ": vhost option is deprecated. Use 'accel' mode flag instead.");
3555 }
3556 s->flags.accelSurrogate = true;
3557 s->vhost = true;
3558 } else if (strcmp(token, "no-vhost") == 0) {
3559 if (!s->flags.accelSurrogate) {
3560 debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": no-vhost option requires Acceleration mode flag.");
3561 }
3562 s->vhost = false;
3563 } else if (strcmp(token, "vport") == 0) {
3564 if (!s->flags.accelSurrogate) {
3565 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3566 self_destruct();
3567 return;
3568 }
3569 s->vport = -1;
3570 } else if (strncmp(token, "vport=", 6) == 0) {
3571 if (!s->flags.accelSurrogate) {
3572 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": vport option requires Acceleration mode flag.");
3573 self_destruct();
3574 return;
3575 }
3576 s->vport = xatos(token + 6);
3577 } else if (strncmp(token, "protocol=", 9) == 0) {
3578 if (!s->flags.accelSurrogate) {
3579 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": protocol option requires Acceleration mode flag.");
3580 self_destruct();
3581 return;
3582 }
3583 s->transport = parsePortProtocol(ToUpper(SBuf(token + 9)));
3584 } else if (strcmp(token, "allow-direct") == 0) {
3585 if (!s->flags.accelSurrogate) {
3586 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": allow-direct option requires Acceleration mode flag.");
3587 self_destruct();
3588 return;
3589 }
3590 s->allow_direct = true;
3591 } else if (strcmp(token, "act-as-origin") == 0) {
3592 if (!s->flags.accelSurrogate) {
3593 debugs(3, DBG_IMPORTANT, "ERROR: " << cfg_directive << ": act-as-origin option requires Acceleration mode flag.");
3594 } else
3595 s->actAsOrigin = true;
3596 } else if (strcmp(token, "ignore-cc") == 0) {
3597#if !USE_HTTP_VIOLATIONS
3598 if (!s->flags.accelSurrogate) {
3599 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": ignore-cc option requires Acceleration mode flag.");
3600 self_destruct();
3601 return;
3602 }
3603#endif
3604 s->ignore_cc = true;
3605 } else if (strncmp(token, "name=", 5) == 0) {
3606 safe_free(s->name);
3607 s->name = xstrdup(token + 5);
3608 } else if (strcmp(token, "no-connection-auth") == 0) {
3609 s->connection_auth_disabled = true;
3610 } else if (strcmp(token, "connection-auth=off") == 0) {
3611 s->connection_auth_disabled = true;
3612 } else if (strcmp(token, "connection-auth") == 0) {
3613 s->connection_auth_disabled = false;
3614 } else if (strcmp(token, "connection-auth=on") == 0) {
3615 s->connection_auth_disabled = false;
3616 } else if (strncmp(token, "disable-pmtu-discovery=", 23) == 0) {
3617 if (!strcmp(token + 23, "off"))
3618 s->disable_pmtu_discovery = DISABLE_PMTU_OFF;
3619 else if (!strcmp(token + 23, "transparent"))
3620 s->disable_pmtu_discovery = DISABLE_PMTU_TRANSPARENT;
3621 else if (!strcmp(token + 23, "always"))
3622 s->disable_pmtu_discovery = DISABLE_PMTU_ALWAYS;
3623 else {
3624 self_destruct();
3625 return;
3626 }
3627 } else if (strcmp(token, "ipv4") == 0) {
3628 if ( !s->s.setIPv4() ) {
3629 debugs(3, DBG_CRITICAL, "FATAL: " << cfg_directive << ": IPv6 addresses cannot be used as IPv4-Only. " << s->s );
3630 self_destruct();
3631 return;
3632 }
3633 } else if (strcmp(token, "tcpkeepalive") == 0) {
3634 s->tcp_keepalive.enabled = true;
3635 } else if (strncmp(token, "tcpkeepalive=", 13) == 0) {
3636 char *t = token + 13;
3637 s->tcp_keepalive.enabled = true;
3638 s->tcp_keepalive.idle = xatoui(t,',');
3639 t = strchr(t, ',');
3640 if (t) {
3641 ++t;
3642 s->tcp_keepalive.interval = xatoui(t,',');
3643 t = strchr(t, ',');
3644 }
3645 if (t) {
3646 ++t;
3647 s->tcp_keepalive.timeout = xatoui(t);
3648 }
3649#if USE_OPENSSL
3650 } else if (strcmp(token, "sslBump") == 0) {
3651 debugs(3, DBG_PARSE_NOTE(1), "WARNING: '" << token << "' is deprecated " <<
3652 "in " << cfg_directive << ". Use 'ssl-bump' instead.");
3653 s->flags.tunnelSslBumping = true;
3654 } else if (strcmp(token, "ssl-bump") == 0) {
3655 s->flags.tunnelSslBumping = true;
3656 } else if (strncmp(token, "cert=", 5) == 0) {
3657 s->secure.parse(token);
3658 } else if (strncmp(token, "key=", 4) == 0) {
3659 s->secure.parse(token);
3660 } else if (strncmp(token, "version=", 8) == 0) {
3661 debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3662 "in " << cfg_directive << ". Use 'options=' instead.");
3663 s->secure.parse(token);
3664 } else if (strncmp(token, "options=", 8) == 0) {
3665 s->secure.parse(token);
3666 } else if (strncmp(token, "cipher=", 7) == 0) {
3667 s->secure.parse(token);
3668 } else if (strncmp(token, "clientca=", 9) == 0) {
3669 s->secure.parse(token);
3670 } else if (strncmp(token, "cafile=", 7) == 0) {
3671 debugs(3, DBG_PARSE_NOTE(1), "WARNING: UPGRADE: '" << token << "' is deprecated " <<
3672 "in " << cfg_directive << ". Use 'tls-cafile=' instead.");
3673 s->secure.parse(token);
3674 } else if (strncmp(token, "capath=", 7) == 0) {
3675 s->secure.parse(token);
3676 } else if (strncmp(token, "crlfile=", 8) == 0) {
3677 s->secure.parse(token);
3678 } else if (strncmp(token, "dhparams=", 9) == 0) {
3679 debugs(3, DBG_PARSE_NOTE(DBG_IMPORTANT), "WARNING: '" << token << "' is deprecated " <<
3680 "in " << cfg_directive << ". Use 'tls-dh=' instead.");
3681 s->secure.parse(token);
3682 } else if (strncmp(token, "sslflags=", 9) == 0) {
3683 // NP: deprecation warnings output by secure.parse() when relevant
3684 s->secure.parse(token+3);
3685 } else if (strncmp(token, "sslcontext=", 11) == 0) {
3686 // NP: deprecation warnings output by secure.parse() when relevant
3687 s->secure.parse(token+3);
3688 } else if (strncmp(token, "generate-host-certificates", 26) == 0) {
3689 s->secure.parse(token);
3690#endif
3691 } else if (strncmp(token, "dynamic_cert_mem_cache_size=", 28) == 0) {
3692 s->secure.parse(token);
3693 } else if (strncmp(token, "tls-", 4) == 0) {
3694 s->secure.parse(token+4);
3695 } else if (strcmp(token, "ftp-track-dirs") == 0) {
3696 s->ftp_track_dirs = true;
3697 } else if (strcmp(token, "worker-queues") == 0) {
3698#if !defined(SO_REUSEADDR)
3699#error missing system #include that #defines SO_* constants
3700#endif
3701#if !defined(SO_REUSEPORT)
3702 throw TexcHere(ToSBuf(cfg_directive, ' ', token, " option requires building Squid where SO_REUSEPORT is supported by the TCP stack"));
3703#endif
3704 s->workerQueues = true;
3705 } else {
3706 debugs(3, DBG_CRITICAL, "FATAL: Unknown " << cfg_directive << " option '" << token << "'.");
3707 self_destruct();
3708 }
3709}
3710
3711void
3712add_http_port(char *portspec)
3713{
3715 s->transport = parsePortProtocol(SBuf("HTTP"));
3716 parsePortSpecification(s, portspec);
3717 // we may need to merge better if the above returns a list with clones
3718 assert(s->next == nullptr);
3719 s->next = HttpPortList;
3720 HttpPortList = s;
3721}
3722
3723static void
3724parsePortCfg(AnyP::PortCfgPointer *head, const char *optionName)
3725{
3726 SBuf protoName;
3727 if (strcmp(optionName, "http_port") == 0 ||
3728 strcmp(optionName, "ascii_port") == 0)
3729 protoName = "HTTP";
3730 else if (strcmp(optionName, "https_port") == 0)
3731 protoName = "HTTPS";
3732 else if (strcmp(optionName, "ftp_port") == 0)
3733 protoName = "FTP";
3734 if (protoName.isEmpty()) {
3735 self_destruct();
3736 return;
3737 }
3738
3739 char *token = ConfigParser::NextToken();
3740
3741 if (!token) {
3742 self_destruct();
3743 return;
3744 }
3745
3747 s->transport = parsePortProtocol(protoName); // default; protocol=... overwrites
3748 parsePortSpecification(s, token);
3749
3750 /* parse options ... */
3751 while ((token = ConfigParser::NextToken())) {
3752 parse_port_option(s, token);
3753 }
3754
3755 s->secure.syncCaFiles();
3756
3757 if (s->transport.protocol == AnyP::PROTO_HTTPS) {
3758 s->secure.encryptTransport = true;
3759#if USE_OPENSSL
3760 /* ssl-bump on https_port configuration requires either tproxy or intercept, and vice versa */
3761 const bool hijacked = s->flags.isIntercepted();
3762 if (s->flags.tunnelSslBumping && !hijacked) {
3763 debugs(3, DBG_CRITICAL, "FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.");
3764 self_destruct();
3765 return;
3766 }
3767 if (hijacked && !s->flags.tunnelSslBumping) {
3768 debugs(3, DBG_CRITICAL, "FATAL: tproxy/intercept on https_port requires ssl-bump which is missing.");
3769 self_destruct();
3770 return;
3771 }
3772#endif
3773 if (s->flags.proxySurrogate) {
3774 debugs(3,DBG_CRITICAL, "FATAL: https_port: require-proxy-header option is not supported on HTTPS ports.");
3775 self_destruct();
3776 return;
3777 }
3778 } else if (protoName.cmp("FTP") == 0) {
3779 /* ftp_port does not support ssl-bump */
3780 if (s->flags.tunnelSslBumping) {
3781 debugs(3, DBG_CRITICAL, "FATAL: ssl-bump is not supported for ftp_port.");
3782 self_destruct();
3783 return;
3784 }
3785 if (s->flags.proxySurrogate) {
3786 // Passive FTP data channel does not work without deep protocol inspection in the frontend.
3787 debugs(3,DBG_CRITICAL, "FATAL: require-proxy-header option is not supported on ftp_port.");
3788 self_destruct();
3789 return;
3790 }
3791 }
3792
3793 if (s->secure.encryptTransport) {
3794 if (s->secure.certs.empty()) {
3795 debugs(3, DBG_CRITICAL, "FATAL: " << AnyP::UriScheme(s->transport.protocol) << "_port requires a cert= parameter");
3796 self_destruct();
3797 return;
3798 }
3799 s->secure.parseOptions();
3800 }
3801
3802 // *_port line should now be fully valid so we can clone it if necessary
3803 if (Ip::EnableIpv6&IPV6_SPECIAL_SPLITSTACK && s->s.isAnyAddr()) {
3804 s->next = s->ipV4clone();
3805 }
3806
3807 while (*head != nullptr)
3808 head = &((*head)->next);
3809
3810 *head = s;
3811}
3812
3813static void
3815{
3816 char buf[MAX_IPSTRLEN];
3817
3818 storeAppendPrintf(e, "%s %s",
3819 n,
3820 s->s.toUrl(buf,MAX_IPSTRLEN));
3821
3822 // MODES and specific sub-options.
3823 if (s->flags.natIntercept)
3824 storeAppendPrintf(e, " intercept");
3825
3826 else if (s->flags.tproxyIntercept)
3827 storeAppendPrintf(e, " tproxy");
3828
3829 else if (s->flags.proxySurrogate)
3830 storeAppendPrintf(e, " require-proxy-header");
3831
3832 else if (s->flags.accelSurrogate) {
3833 storeAppendPrintf(e, " accel");
3834
3835 if (s->vhost)
3836 storeAppendPrintf(e, " vhost");
3837
3838 if (s->vport < 0)
3839 storeAppendPrintf(e, " vport");
3840 else if (s->vport > 0)
3841 storeAppendPrintf(e, " vport=%d", s->vport);
3842
3843 if (s->defaultsite)
3844 storeAppendPrintf(e, " defaultsite=%s", s->defaultsite);
3845
3846 // TODO: compare against prefix of 'n' instead of assuming http_port
3847 if (s->transport.protocol != AnyP::PROTO_HTTP)
3848 storeAppendPrintf(e, " protocol=%s", AnyP::ProtocolType_str[s->transport.protocol]);
3849
3850 if (s->allow_direct)
3851 storeAppendPrintf(e, " allow-direct");
3852
3853 if (s->ignore_cc)
3854 storeAppendPrintf(e, " ignore-cc");
3855
3856 }
3857
3858 // Generic independent options
3859
3860 if (s->name)
3861 storeAppendPrintf(e, " name=%s", s->name);
3862
3863#if USE_HTTP_VIOLATIONS
3864 if (!s->flags.accelSurrogate && s->ignore_cc)
3865 storeAppendPrintf(e, " ignore-cc");
3866#endif
3867
3868 if (s->connection_auth_disabled)
3869 storeAppendPrintf(e, " connection-auth=off");
3870 else
3871 storeAppendPrintf(e, " connection-auth=on");
3872
3873 if (s->disable_pmtu_discovery != DISABLE_PMTU_OFF) {
3874 const char *pmtu;
3875
3876 if (s->disable_pmtu_discovery == DISABLE_PMTU_ALWAYS)
3877 pmtu = "always";
3878 else
3879 pmtu = "transparent";
3880
3881 storeAppendPrintf(e, " disable-pmtu-discovery=%s", pmtu);
3882 }
3883
3884 if (s->s.isAnyAddr() && !s->s.isIPv6())
3885 storeAppendPrintf(e, " ipv4");
3886
3887 if (s->tcp_keepalive.enabled) {
3888 if (s->tcp_keepalive.idle || s->tcp_keepalive.interval || s->tcp_keepalive.timeout) {
3889 storeAppendPrintf(e, " tcpkeepalive=%d,%d,%d", s->tcp_keepalive.idle, s->tcp_keepalive.interval, s->tcp_keepalive.timeout);
3890 } else {
3891 storeAppendPrintf(e, " tcpkeepalive");
3892 }
3893 }
3894
3895#if USE_OPENSSL
3896 if (s->flags.tunnelSslBumping)
3897 storeAppendPrintf(e, " ssl-bump");
3898#endif
3899
3900 s->secure.dumpCfg(e, "tls-");
3901}
3902
3903static void
3904dump_PortCfg(StoreEntry * e, const char *n, const AnyP::PortCfgPointer &s)
3905{
3906 for (AnyP::PortCfgPointer p = s; p != nullptr; p = p->next) {
3907 dump_generic_port(e, n, p);
3908 storeAppendPrintf(e, "\n");
3909 }
3910}
3911
3912void
3914{
3915 free_all();
3918#if USE_OPENSSL
3920#endif
3921}
3922
3923void
3924requirePathnameExists(const char *name, const char *path)
3925{
3926
3927 struct stat sb;
3928 char pathbuf[BUFSIZ];
3929 assert(path != nullptr);
3930
3931 if (Config.chroot_dir && (geteuid() == 0)) {
3932 snprintf(pathbuf, BUFSIZ, "%s/%s", Config.chroot_dir, path);
3933 path = pathbuf;
3934 }
3935
3936 if (stat(path, &sb) < 0) {
3937 int xerrno = errno;
3938 debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerr(xerrno));
3939 // keep going to find more issues if we are only checking the config file with "-k parse"
3941 return;
3942 // this is fatal if it is found during startup or reconfigure
3943 if (opt_send_signal == -1 || opt_send_signal == SIGHUP)
3944 fatalf("%s %s: %s", name, path, xstrerr(xerrno));
3945 }
3946}
3947
3948#include "AccessLogEntry.h"
3949
3972static void
3974{
3975 const char *filename = ConfigParser::NextToken();
3976 if (!filename) {
3977 self_destruct();
3978 return;
3979 }
3980
3981 const auto cl = new CustomLog();
3982
3983 cl->filename = xstrdup(filename);
3984
3985 if (strcmp(filename, "none") == 0) {
3986 cl->type = Log::Format::CLF_NONE;
3987 aclParseAclList(LegacyParser, &cl->aclList, filename);
3988 while (*logs)
3989 logs = &(*logs)->next;
3990 *logs = cl;
3991 return;
3992 }
3993
3994 const char *token = ConfigParser::PeekAtToken();
3995 if (token && !strchr(token, '=')) { // style #3
3996 // TODO: Deprecate this style to avoid this dangerous guessing.
3997 if (Log::TheConfig.knownFormat(token)) {
3998 cl->setLogformat(token);
3999 (void)ConfigParser::NextToken(); // consume the token used above
4000 } else {
4001 // assume there is no explicit logformat name and use the default
4002 cl->setLogformat("squid");
4003 }
4004 } else { // style #1 or style #4
4005 // TODO: Drop deprecated style #1 support. We already warn about it, and
4006 // its exceptional treatment makes detecting "module" typos impractical!
4007 cl->parseOptions(LegacyParser, "squid");
4008 }
4009 assert(cl->type); // setLogformat() was called
4010
4011 aclParseAclList(LegacyParser, &cl->aclList, cl->filename);
4012
4013 while (*logs)
4014 logs = &(*logs)->next;
4015
4016 *logs = cl;
4017}
4018
4019static int
4020check_null_access_log(CustomLog *customlog_definitions)
4021{
4022 return customlog_definitions == nullptr;
4023}
4024
4025static void
4026dump_access_log(StoreEntry * entry, const char *name, CustomLog * logs)
4027{
4028 assert(entry);
4029 for (auto log = logs; log; log = log->next) {
4030 {
4031 PackableStream os(*entry);
4032 os << name; // directive name
4033 os << ' ' << log->filename; // including "none"
4034 log->dumpOptions(os);
4035 }
4036
4037 if (log->aclList)
4038 dump_acl_list(entry, log->aclList);
4039
4040 storeAppendPrintf(entry, "\n");
4041 }
4042}
4043
4044static void
4046{
4047 while (*definitions) {
4048 CustomLog *log = *definitions;
4049 *definitions = log->next;
4050 delete log;
4051 }
4052}
4053
4054#if HAVE_CPU_AFFINITY /* until somebody else needs this general code */
4056static bool
4057parseNamedIntList(const char *data, const String &name, std::vector<int> &list)
4058{
4059 if (data && (strncmp(data, name.rawBuf(), name.size()) == 0)) {
4060 data += name.size();
4061 if (*data == '=') {
4062 while (true) {
4063 ++data;
4064 int value = 0;
4065 if (!StringToInt(data, value, &data, 10))
4066 break;
4067 list.push_back(value);
4068 if (*data == '\0' || *data != ',')
4069 break;
4070 }
4071 }
4072 }
4073 return data && *data == '\0';
4074}
4075#endif
4076
4077static void
4079{
4080#if !HAVE_CPU_AFFINITY
4081 (void)cpuAffinityMap;
4082 debugs(3, DBG_CRITICAL, "FATAL: Squid built with no CPU affinity " <<
4083 "support, do not set 'cpu_affinity_map'");
4084 self_destruct();
4085
4086#else /* HAVE_CPU_AFFINITY */
4087 if (!*cpuAffinityMap)
4088 *cpuAffinityMap = new CpuAffinityMap;
4089
4090 const char *const pToken = ConfigParser::NextToken();
4091 const char *const cToken = ConfigParser::NextToken();
4092 std::vector<int> processes, cores;
4093 if (!parseNamedIntList(pToken, "process_numbers", processes)) {
4094 debugs(3, DBG_CRITICAL, "FATAL: bad 'process_numbers' parameter " <<
4095 "in 'cpu_affinity_map'");
4096 self_destruct();
4097 } else if (!parseNamedIntList(cToken, "cores", cores)) {
4098 debugs(3, DBG_CRITICAL, "FATAL: bad 'cores' parameter in " <<
4099 "'cpu_affinity_map'");
4100 self_destruct();
4101 } else if (!(*cpuAffinityMap)->add(processes, cores)) {
4102 debugs(3, DBG_CRITICAL, "FATAL: bad 'cpu_affinity_map'; " <<
4103 "process_numbers and cores lists differ in length or " <<
4104 "contain numbers <= 0");
4105 self_destruct();
4106 }
4107#endif
4108}
4109
4110static void
4111dump_CpuAffinityMap(StoreEntry *const entry, const char *const name, const CpuAffinityMap *const cpuAffinityMap)
4112{
4113 if (cpuAffinityMap) {
4114 storeAppendPrintf(entry, "%s process_numbers=", name);
4115 for (size_t i = 0; i < cpuAffinityMap->processes().size(); ++i) {
4116 storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4117 cpuAffinityMap->processes()[i]);
4118 }
4119 storeAppendPrintf(entry, " cores=");
4120 for (size_t i = 0; i < cpuAffinityMap->cores().size(); ++i) {
4121 storeAppendPrintf(entry, "%s%i", (i ? "," : ""),
4122 cpuAffinityMap->cores()[i]);
4123 }
4124 storeAppendPrintf(entry, "\n");
4125 }
4126}
4127
4128static void
4130{
4131 delete *cpuAffinityMap;
4132 *cpuAffinityMap = nullptr;
4133}
4134
4135#if USE_ADAPTATION
4136
4137static void
4139{
4141}
4142
4143static void
4145{
4147}
4148
4149static void
4151{
4153}
4154#endif /* USE_ADAPTATION */
4155
4156#if ICAP_CLIENT
4157
4158static void
4160{
4161 cfg->parseService();
4162}
4163
4164static void
4166{
4167 cfg->freeService();
4168}
4169
4170static void
4171dump_icap_service_type(StoreEntry * entry, const char *name, const Adaptation::Icap::Config &cfg)
4172{
4173 cfg.dumpService(entry, name);
4174}
4175
4176static void
4178{
4179 debugs(93, DBG_CRITICAL, "WARNING: 'icap_class' is deprecated. " <<
4180 "Use 'adaptation_service_set' instead");
4182}
4183
4184static void
4186{
4187 debugs(93, DBG_CRITICAL, "WARNING: 'icap_access' is deprecated. " <<
4188 "Use 'adaptation_access' instead");
4190}
4191
4192#endif
4193
4194#if USE_ECAP
4195
4196static void
4198{
4199 cfg->parseService();
4200}
4201
4202static void
4204{
4205 cfg->freeService();
4206}
4207
4208static void
4209dump_ecap_service_type(StoreEntry * entry, const char *name, const Adaptation::Ecap::Config &cfg)
4210{
4211 cfg.dumpService(entry, name);
4212}
4213
4214#endif /* USE_ECAP */
4215
4216#if ICAP_CLIENT
4218{
4219 char *token;
4221
4222 if ((token = ConfigParser::NextToken()) == nullptr)
4223 return;
4224
4225 if (strcmp(token,"in") != 0) {
4226 debugs(3, DBG_CRITICAL, "expecting 'in' on'" << config_input_line << "'");
4227 self_destruct();
4228 return;
4229 }
4230
4232}
4233
4234static void dump_icap_service_failure_limit(StoreEntry *entry, const char *name, const Adaptation::Icap::Config &cfg)
4235{
4236 storeAppendPrintf(entry, "%s %d", name, cfg.service_failure_limit);
4237 if (cfg.oldest_service_failure > 0) {
4238 storeAppendPrintf(entry, " in %d seconds", (int)cfg.oldest_service_failure);
4239 }
4240 storeAppendPrintf(entry, "\n");
4241}
4242
4244{
4245 cfg->oldest_service_failure = 0;
4246 cfg->service_failure_limit = 0;
4247}
4248#endif
4249
4250#if USE_OPENSSL
4252{
4253 auto *al = ConfigParser::NextToken();
4254 if (!al) {
4255 self_destruct();
4256 return;
4257 }
4258
4259 const char *param;
4260 if ( char *s = strchr(al, '{')) {
4261 *s = '\0'; // terminate the al string
4262 ++s;
4263 param = s;
4264 s = strchr(s, '}');
4265 if (!s) {
4266 self_destruct();
4267 return;
4268 }
4269 *s = '\0';
4270 } else
4271 param = nullptr;
4272
4273 std::unique_ptr<sslproxy_cert_adapt> ca(new sslproxy_cert_adapt);
4274 if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidAfter]) == 0) {
4275 ca->alg = Ssl::algSetValidAfter;
4276 ca->param = xstrdup("on");
4277 } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetValidBefore]) == 0) {
4278 ca->alg = Ssl::algSetValidBefore;
4279 ca->param = xstrdup("on");
4280 } else if (strcmp(al, Ssl::CertAdaptAlgorithmStr[Ssl::algSetCommonName]) == 0) {
4281 ca->alg = Ssl::algSetCommonName;
4282 if (param) {
4283 if (strlen(param) > 64) {
4284 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: setCommonName{" <<param << "} : using common name longer than 64 bytes is not supported");
4285 self_destruct();
4286 return;
4287 }
4288 ca->param = xstrdup(param);
4289 }
4290 } else {
4291 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_adapt: unknown cert adaptation algorithm: " << al);
4292 self_destruct();
4293 return;
4294 }
4295
4296 aclParseAclList(LegacyParser, &ca->aclList, al);
4297
4298 while (*cert_adapt)
4299 cert_adapt = &(*cert_adapt)->next;
4300
4301 *cert_adapt = ca.release();
4302}
4303
4304static void dump_sslproxy_cert_adapt(StoreEntry *entry, const char *name, sslproxy_cert_adapt *cert_adapt)
4305{
4306 for (const auto *ca = cert_adapt; ca; ca = ca->next) {
4307 storeAppendPrintf(entry, "%s ", name);
4308 storeAppendPrintf(entry, "%s{%s} ", Ssl::sslCertAdaptAlgoritm(ca->alg), ca->param);
4309 if (ca->aclList)
4310 dump_acl_list(entry, ca->aclList);
4311 storeAppendPrintf(entry, "\n");
4312 }
4313}
4314
4316{
4317 delete *cert_adapt;
4318 *cert_adapt = nullptr;
4319}
4320
4322{
4323 const auto al = ConfigParser::NextToken();
4324 if (!al) {
4325 self_destruct();
4326 return;
4327 }
4328
4329 std::unique_ptr<sslproxy_cert_sign> cs(new sslproxy_cert_sign);
4330 if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignTrusted]) == 0)
4331 cs->alg = Ssl::algSignTrusted;
4332 else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignUntrusted]) == 0)
4333 cs->alg = Ssl::algSignUntrusted;
4334 else if (strcmp(al, Ssl::CertSignAlgorithmStr[Ssl::algSignSelf]) == 0)
4335 cs->alg = Ssl::algSignSelf;
4336 else {
4337 debugs(3, DBG_CRITICAL, "FATAL: sslproxy_cert_sign: unknown cert signing algorithm: " << al);
4338 self_destruct();
4339 return;
4340 }
4341
4342 aclParseAclList(LegacyParser, &cs->aclList, al);
4343
4344 while (*cert_sign)
4345 cert_sign = &(*cert_sign)->next;
4346
4347 *cert_sign = cs.release();
4348}
4349
4350static void dump_sslproxy_cert_sign(StoreEntry *entry, const char *name, sslproxy_cert_sign *cert_sign)
4351{
4352 for (const auto *cs = cert_sign; cs; cs = cs->next) {
4353 storeAppendPrintf(entry, "%s ", name);
4354 storeAppendPrintf(entry, "%s ", Ssl::certSignAlgorithm(cs->alg));
4355 if (cs->aclList)
4356 dump_acl_list(entry, cs->aclList);
4357 storeAppendPrintf(entry, "\n");
4358 }
4359}
4360
4362{
4363 delete *cert_sign;
4364 *cert_sign = nullptr;
4365}
4366
4368{
4369public:
4371 /* RegisteredRunner API */
4372 void finalizeConfig() override;
4373};
4374
4376
4378
4379void
4381{
4384 static char buf[1024];
4386 strcpy(buf, "ssl_bump deny all");
4387 debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated implicit "
4388 "\"ssl_bump deny all\" to \"ssl_bump none all\". New ssl_bump configurations "
4389 "must not use implicit rules. Update your ssl_bump rules.");
4390 } else {
4391 strcpy(buf, "ssl_bump allow all");
4392 debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated implicit "
4393 "\"ssl_bump allow all\" to \"ssl_bump client-first all\" which is usually "
4394 "inferior to the newer server-first bumping mode. New ssl_bump"
4395 " configurations must not use implicit rules. Update your ssl_bump rules.");
4396 }
4397 parse_line(buf);
4398 }
4399}
4400
4402{
4403 typedef const char *BumpCfgStyle;
4404 BumpCfgStyle bcsNone = nullptr;
4405 BumpCfgStyle bcsNew = "new client/server-first/none";
4406 BumpCfgStyle bcsOld = "deprecated allow/deny";
4407 static BumpCfgStyle bumpCfgStyleLast = bcsNone;
4408 BumpCfgStyle bumpCfgStyleNow = bcsNone;
4409 char *bm;
4410 if ((bm = ConfigParser::NextToken()) == nullptr) {
4411 self_destruct();
4412 return;
4413 }
4414
4415 // if this is the first rule processed
4416 if (*ssl_bump == nullptr) {
4417 bumpCfgStyleLast = bcsNone;
4419 }
4420
4422
4423 if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpClientFirst]) == 0) {
4425 bumpCfgStyleNow = bcsNew;
4426 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpServerFirst]) == 0) {
4428 bumpCfgStyleNow = bcsNew;
4429 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpPeek]) == 0) {
4430 action.kind = Ssl::bumpPeek;
4431 bumpCfgStyleNow = bcsNew;
4432 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpStare]) == 0) {
4433 action.kind = Ssl::bumpStare;
4434 bumpCfgStyleNow = bcsNew;
4435 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpSplice]) == 0) {
4436 action.kind = Ssl::bumpSplice;
4437 bumpCfgStyleNow = bcsNew;
4438 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpBump]) == 0) {
4439 action.kind = Ssl::bumpBump;
4440 bumpCfgStyleNow = bcsNew;
4441 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpTerminate]) == 0) {
4443 bumpCfgStyleNow = bcsNew;
4444 } else if (strcmp(bm, Ssl::BumpModeStr[Ssl::bumpNone]) == 0) {
4445 action.kind = Ssl::bumpNone;
4446 bumpCfgStyleNow = bcsNew;
4447 } else if (strcmp(bm, "allow") == 0) {
4448 debugs(3, DBG_CRITICAL, "SECURITY NOTICE: auto-converting deprecated "
4449 "\"ssl_bump allow <acl>\" to \"ssl_bump client-first <acl>\" which "
4450 "is usually inferior to the newer server-first "
4451 "bumping mode. Update your ssl_bump rules.");
4453 bumpCfgStyleNow = bcsOld;
4455 } else if (strcmp(bm, "deny") == 0) {
4456 debugs(3, DBG_CRITICAL, "WARNING: auto-converting deprecated "
4457 "\"ssl_bump deny <acl>\" to \"ssl_bump none <acl>\". Update "
4458 "your ssl_bump rules.");
4459 action.kind = Ssl::bumpNone;
4460 bumpCfgStyleNow = bcsOld;
4462 } else {
4463 debugs(3, DBG_CRITICAL, "FATAL: unknown ssl_bump mode: " << bm);
4464 self_destruct();
4465 return;
4466 }
4467
4468 if (bumpCfgStyleLast != bcsNone && bumpCfgStyleNow != bumpCfgStyleLast) {
4469 debugs(3, DBG_CRITICAL, "FATAL: do not mix " << bumpCfgStyleNow << " actions with " <<
4470 bumpCfgStyleLast << " actions. Update your ssl_bump rules.");
4471 self_destruct();
4472 return;
4473 }
4474
4475 bumpCfgStyleLast = bumpCfgStyleNow;
4476
4477 // empty rule OK
4478 ParseAclWithAction(ssl_bump, action, "ssl_bump");
4479}
4480
4481static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
4482{
4483 if (ssl_bump)
4484 dump_SBufList(entry, ssl_bump->treeDump(name, [](const Acl::Answer &action) {
4485 return Ssl::BumpModeStr.at(action.kind);
4486 }));
4487}
4488
4489static void free_sslproxy_ssl_bump(acl_access **ssl_bump)
4490{
4491 free_acl_access(ssl_bump);
4492}
4493
4494#endif
4495
4496static void dump_HeaderWithAclList(StoreEntry * entry, const char *name, HeaderWithAclList *headers)
4497{
4498 if (!headers)
4499 return;
4500
4501 for (HeaderWithAclList::iterator hwa = headers->begin(); hwa != headers->end(); ++hwa) {
4502 storeAppendPrintf(entry, "%s %s %s", name, hwa->fieldName.c_str(), hwa->fieldValue.c_str());
4503 if (hwa->aclList)
4504 dump_acl_list(entry, hwa->aclList);
4505 storeAppendPrintf(entry, "\n");
4506 }
4507}
4508
4510{
4511 char *fn;
4512 if (!*headers) {
4513 *headers = new HeaderWithAclList;
4514 }
4515 if ((fn = ConfigParser::NextToken()) == nullptr) {
4516 self_destruct();
4517 return;
4518 }
4519 HeaderWithAcl hwa;
4520 hwa.fieldName = fn;
4524
4525 Format::Format *nlf = new ::Format::Format("hdrWithAcl");
4529 hwa.fieldValue = buf.termedBuf();
4531 if (hwa.quoted) {
4532 if (!nlf->parse(hwa.fieldValue.c_str())) {
4533 self_destruct();
4534 return;
4535 }
4536 hwa.valueFormat = nlf;
4537 } else
4538 delete nlf;
4539 aclParseAclList(LegacyParser, &hwa.aclList, (hwa.fieldName + ':' + hwa.fieldValue).c_str());
4540 (*headers)->push_back(hwa);
4541}
4542
4544{
4545 if (!(*header))
4546 return;
4547
4548 for (HeaderWithAclList::iterator hwa = (*header)->begin(); hwa != (*header)->end(); ++hwa) {
4549 if (hwa->aclList)
4550 aclDestroyAclList(&hwa->aclList);
4551
4552 if (hwa->valueFormat) {
4553 delete hwa->valueFormat;
4554 hwa->valueFormat = nullptr;
4555 }
4556 }
4557 delete *header;
4558 *header = nullptr;
4559}
4560
4561static void parse_note(Notes *notes)
4562{
4563 assert(notes);
4564 notes->parse(LegacyParser);
4565}
4566
4567static void dump_note(StoreEntry *entry, const char *name, Notes &notes)
4568{
4569 notes.dump(entry, name);
4570}
4571
4572static void free_note(Notes *notes)
4573{
4574 notes->clean();
4575}
4576
4577static DebugMessageId ParseDebugMessageId(const char *value, const char eov)
4578{
4579 const auto id = xatoui(value, eov);
4580 if (!(0 < id && id < DebugMessageIdUpperBound))
4581 throw TextException(ToSBuf("unknown cache_log_message ID: ", value), Here());
4582 return static_cast<DebugMessageId>(id);
4583}
4584
4585static void parse_cache_log_message(DebugMessages **debugMessages)
4586{
4587 DebugMessage msg;
4588 DebugMessageId minId = 0;
4589 DebugMessageId maxId = 0;
4590
4591 char *key = nullptr;
4592 char *value = nullptr;
4593 while (ConfigParser::NextKvPair(key, value)) {
4594 if (strcmp(key, "id") == 0) {
4595 if (minId > 0)
4596 break;
4597 minId = maxId = ParseDebugMessageId(value, '\0');
4598 } else if (strcmp(key, "ids") == 0) {
4599 if (minId > 0)
4600 break;
4601 const auto dash = strchr(value, '-');
4602 if (!dash)
4603 throw TextException(ToSBuf("malformed cache_log_message ID range: ", key, '=', value), Here());
4604 minId = ParseDebugMessageId(value, '-');
4605 maxId = ParseDebugMessageId(dash+1, '\0');
4606 if (minId > maxId)
4607 throw TextException(ToSBuf("invalid cache_log_message ID range: ", key, '=', value), Here());
4608 } else if (strcmp(key, "level") == 0) {
4609 if (msg.levelled())
4610 break;
4611 const auto level = xatoi(value);
4612 if (level < 0)
4613 throw TextException(ToSBuf("negative cache_log_message level: ", value), Here());
4614 msg.level = level;
4615 } else if (strcmp(key, "limit") == 0) {
4616 if (msg.limited())
4617 break;
4618 msg.limit = xatoull(value, 10);
4619 } else {
4620 throw TextException(ToSBuf("unsupported cache_log_message option: ", key), Here());
4621 }
4622 key = value = nullptr;
4623 }
4624
4625 if (key && value)
4626 throw TextException(ToSBuf("repeated or conflicting cache_log_message option: ", key, '=', value), Here());
4627
4628 if (!minId)
4629 throw TextException("cache_log_message is missing a required id=... or ids=... option", Here());
4630
4631 if (!(msg.levelled() || msg.limited()))
4632 throw TextException("cache_log_message is missing a required level=... or limit=... option", Here());
4633
4634 assert(debugMessages);
4635 if (!*debugMessages)
4636 *debugMessages = new DebugMessages();
4637
4638 for (auto id = minId; id <= maxId; ++id) {
4639 msg.id = id;
4640 (*debugMessages)->messages.at(id) = msg;
4641 }
4642}
4643
4644static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *debugMessages)
4645{
4646 if (!debugMessages)
4647 return;
4648
4649 SBufStream out;
4650 for (const auto &msg: debugMessages->messages) {
4651 if (!msg.configured())
4652 continue;
4653 out << name << " id=" << msg.id;
4654 if (msg.levelled())
4655 out << " level=" << msg.level;
4656 if (msg.limited())
4657 out << " limit=" << msg.limit;
4658 out << "\n";
4659 }
4660 const auto buf = out.buf();
4661 entry->append(buf.rawContent(), buf.length()); // may be empty
4662}
4663
4664static void free_cache_log_message(DebugMessages **debugMessages)
4665{
4666 // clear old messages to avoid cumulative effect across (re)configurations
4667 assert(debugMessages);
4668 delete *debugMessages;
4669 *debugMessages = nullptr;
4670}
4671
4672static bool FtpEspvDeprecated = false;
4673static void parse_ftp_epsv(acl_access **ftp_epsv)
4674{
4675 Acl::Answer ftpEpsvDeprecatedAction;
4676 bool ftpEpsvIsDeprecatedRule = false;
4677
4678 char *t = ConfigParser::PeekAtToken();
4679 if (!t) {
4680 self_destruct();
4681 return;
4682 }
4683
4684 if (!strcmp(t, "off")) {
4686 ftpEpsvIsDeprecatedRule = true;
4687 ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_DENIED);
4688 } else if (!strcmp(t, "on")) {
4690 ftpEpsvIsDeprecatedRule = true;
4691 ftpEpsvDeprecatedAction = Acl::Answer(ACCESS_ALLOWED);
4692 }
4693
4694 // Check for mixing "ftp_epsv on|off" and "ftp_epsv allow|deny .." rules:
4695 // 1) if this line is "ftp_epsv allow|deny ..." and already exist rules of "ftp_epsv on|off"
4696 // 2) if this line is "ftp_epsv on|off" and already exist rules of "ftp_epsv allow|deny ..."
4697 // then abort
4698 if ((!ftpEpsvIsDeprecatedRule && FtpEspvDeprecated) ||
4699 (ftpEpsvIsDeprecatedRule && !FtpEspvDeprecated && *ftp_epsv != nullptr)) {
4700 debugs(3, DBG_CRITICAL, "FATAL: do not mix \"ftp_epsv on|off\" cfg lines with \"ftp_epsv allow|deny ...\" cfg lines. Update your ftp_epsv rules.");
4701 self_destruct();
4702 return;
4703 }
4704
4705 if (ftpEpsvIsDeprecatedRule) {
4706 // overwrite previous ftp_epsv lines
4707 delete *ftp_epsv;
4708 *ftp_epsv = nullptr;
4709
4710 if (ftpEpsvDeprecatedAction == Acl::Answer(ACCESS_DENIED)) {
4711 if (ACL *a = ACL::FindByName("all"))
4712 ParseAclWithAction(ftp_epsv, ftpEpsvDeprecatedAction, "ftp_epsv", a);
4713 else {
4714 self_destruct();
4715 return;
4716 }
4717 }
4718 FtpEspvDeprecated = true;
4719 } else {
4721 }
4722}
4723
4724static void dump_ftp_epsv(StoreEntry *entry, const char *name, acl_access *ftp_epsv)
4725{
4726 if (ftp_epsv)
4727 dump_SBufList(entry, ftp_epsv->treeDump(name, Acl::AllowOrDeny));
4728}
4729
4730static void free_ftp_epsv(acl_access **ftp_epsv)
4731{
4732 free_acl_access(ftp_epsv);
4733 FtpEspvDeprecated = false;
4734}
4735
4738static std::chrono::seconds
4740{
4741 const auto timeValueToken = ConfigParser::NextToken();
4742 if (!timeValueToken)
4743 throw TexcHere("cannot read a time value");
4744
4745 using Seconds = std::chrono::seconds;
4746
4747 const auto parsedTimeValue = xatof(timeValueToken);
4748
4749 if (parsedTimeValue == 0)
4750 return std::chrono::seconds::zero();
4751
4752 std::chrono::nanoseconds parsedUnitDuration;
4753
4754 const auto unitToken = ConfigParser::PeekAtToken();
4755 if (parseTimeUnit<Seconds>(unitToken, parsedUnitDuration))
4757 else {
4758 const auto defaultParsed = parseTimeUnit<Seconds>(T_SECOND_STR, parsedUnitDuration);
4759 assert(defaultParsed);
4761 ": WARNING: missing time unit, using deprecated default '" << T_SECOND_STR << "'");
4762 }
4763
4764 const auto nanoseconds = ToNanoSeconds(parsedTimeValue, parsedUnitDuration);
4765
4766 return FromNanoseconds<Seconds>(nanoseconds, parsedTimeValue);
4767}
4768
4769static void
4771{
4772 // TODO: do not allow optional timeunit (as the documentation prescribes)
4773 // and use parseTimeLine() instead.
4775
4776 char *key, *value;
4777 while(ConfigParser::NextKvPair(key, value)) {
4778 if (strcasecmp(key, "on_timeout") == 0) {
4779 if (strcasecmp(value, "bypass") == 0)
4780 config->action = toutActBypass;
4781 else if (strcasecmp(value, "fail") == 0)
4782 config->action = toutActFail;
4783 else if (strcasecmp(value, "retry") == 0)
4784 config->action = toutActRetry;
4785 else if (strcasecmp(value, "use_configured_response") == 0) {
4787 } else {
4788 debugs(3, DBG_CRITICAL, "FATAL: unsupported \"on_timeout\" action: " << value);
4789 self_destruct();
4790 return;
4791 }
4792 } else if (strcasecmp(key, "response") == 0) {
4793 config->response = xstrdup(value);
4794 } else {
4795 debugs(3, DBG_CRITICAL, "FATAL: unsupported option " << key);
4796 self_destruct();
4797 return;
4798 }
4799 }
4800
4801 if (config->action == toutActUseConfiguredResponse && !config->response) {
4802 debugs(3, DBG_CRITICAL, "FATAL: Expected 'response=' option after 'on_timeout=use_configured_response' option");
4803 self_destruct();
4804 }
4805
4806 if (config->action != toutActUseConfiguredResponse && config->response) {
4807 debugs(3, DBG_CRITICAL, "FATAL: 'response=' option is valid only when used with the 'on_timeout=use_configured_response' option");
4808 self_destruct();
4809 }
4810}
4811
4812static void
4814{
4815 const char *onTimedOutActions[] = {"bypass", "fail", "retry", "use_configured_response"};
4816 assert(config.action >= 0 && config.action <= toutActUseConfiguredResponse);
4817
4818 dump_time_t(entry, name, Config.Timeout.urlRewrite);
4819 storeAppendPrintf(entry, " on_timeout=%s", onTimedOutActions[config.action]);
4820
4821 if (config.response)
4822 storeAppendPrintf(entry, " response=\"%s\"", config.response);
4823
4824 storeAppendPrintf(entry, "\n");
4825}
4826
4827static void
4829{
4831 config->action = 0;
4832 safe_free(config->response);
4833}
4834
4835static void
4837{
4838 int val = 0;
4839 parse_onoff(&val);
4840
4841 // If quoted values is set to on then enable new strict mode parsing
4842 if (val) {
4845 } else {
4848 }
4849}
4850
4851static void
4852dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool)
4853{
4854 int val = ConfigParser::RecognizeQuotedValues ? 1 : 0;
4855 dump_onoff(entry, name, val);
4856}
4857
4858static void
4860{
4863}
4864
4865static void
4867{
4868 char *tm;
4869 if ((tm = ConfigParser::NextToken()) == nullptr) {
4870 self_destruct();
4871 return;
4872 }
4873
4875 if (strcmp(tm, "tunnel") == 0)
4876 action.kind = 1;
4877 else if (strcmp(tm, "respond") == 0)
4878 action.kind = 2;
4879 else {
4880 debugs(3, DBG_CRITICAL, "FATAL: unknown on_unsupported_protocol mode: " << tm);
4881 self_destruct();
4882 return;
4883 }
4884
4885 // empty rule OK
4886 ParseAclWithAction(access, action, "on_unsupported_protocol");
4887}
4888
4889static void
4890dump_on_unsupported_protocol(StoreEntry *entry, const char *name, acl_access *access)
4891{
4892 static const std::vector<const char *> onErrorTunnelMode = {
4893 "none",
4894 "tunnel",
4895 "respond"
4896 };
4897 if (access) {
4898 SBufList lines = access->treeDump(name, [](const Acl::Answer &action) {
4899 return onErrorTunnelMode.at(action.kind);
4900 });
4901 dump_SBufList(entry, lines);
4902 }
4903}
4904
4905static void
4907{
4908 free_acl_access(access);
4909}
4910
4911static void
4913{
4914 assert(protoGuardsPtr);
4915 auto &protoGuards = *protoGuardsPtr;
4916 if (!protoGuards)
4917 protoGuards = new HttpUpgradeProtocolAccess();
4918 protoGuards->configureGuard(LegacyParser);
4919}
4920
4921static void
4923{
4924 if (!protoGuards)
4925 return;
4926
4927 const SBuf name(rawName);
4928 protoGuards->forEach([entry,&name](const SBuf &proto, const acl_access *acls) {
4929 SBufList line;
4930 line.push_back(name);
4931 line.push_back(proto);
4932 const auto acld = acls->treeDump("", &Acl::AllowOrDeny);
4933 line.insert(line.end(), acld.begin(), acld.end());
4934 dump_SBufList(entry, line);
4935 });
4936}
4937
4938static void
4940{
4941 assert(protoGuardsPtr);
4942 auto &protoGuards = *protoGuardsPtr;
4943 delete protoGuards;
4944 protoGuards = nullptr;
4945}
4946
#define Here()
source code location of the caller
Definition: Here.h:15
std::list< HeaderWithAcl > HeaderWithAclList
SBuf TheKidName
current Squid process name (e.g., "squid-coord")
Definition: Kids.cc:19
int size
Definition: ModDevPoll.cc:75
unsigned int xatoui(const char *token, char eov)
Definition: Parsing.cc:58
double GetPercentage(bool limit)
Definition: Parsing.cc:178
bool GetHostWithPort(char *token, Ip::Address *ipa)
Definition: Parsing.cc:257
uint64_t xatoull(const char *token, int base, char eov)
Definition: Parsing.cc:105
double xatof(const char *token)
Definition: Parsing.cc:25
unsigned short xatos(const char *token)
Definition: Parsing.cc:114
bool StringToInt(const char *s, int &result, const char **p, int base)
Definition: Parsing.cc:217
int64_t GetInteger64(void)
Definition: Parsing.cc:132
unsigned short GetShort(void)
Definition: Parsing.cc:205
int GetInteger(void)
Definition: Parsing.cc:148
int xatoi(const char *token)
Definition: Parsing.cc:44
AnyP::PortCfgPointer HttpPortList
list of Squid http(s)_port configured
Definition: PortCfg.cc:22
SBuf ToUpper(SBuf buf)
Returns a lower-cased copy of its parameter.
Definition: SBuf.h:721
#define SQUIDSBUFPH
Definition: SBuf.h:31
#define SQUIDSBUFPRINT(s)
Definition: SBuf.h:32
class SquidConfig Config
Definition: SquidConfig.cc:12
class SquidConfig2 Config2
Definition: SquidConfig.cc:14
char * strwordtok(char *buf, char **t)
Definition: String.cc:393
std::ostream & CurrentException(std::ostream &os)
prints active (i.e., thrown but not yet handled) exception
#define TexcHere(msg)
legacy convenience macro; it is not difficult to type Here() now
Definition: TextException.h:59
#define Must(condition)
Definition: TextException.h:71
void aclParseAccessLine(const char *directive, ConfigParser &, acl_access **treep)
Definition: Gadgets.cc:138
size_t aclParseAclList(ConfigParser &, Acl::Tree **treep, const char *label)
Definition: Gadgets.cc:191
void log(char *format,...)
#define acl_access
Definition: forward.h:45
#define ACLList
Definition: forward.h:46
squidaio_request_t * head
Definition: aiops.cc:126
#define assert(EX)
Definition: assert.h:17
static DebugMessageId ParseDebugMessageId(const char *value, const char eov)
Definition: cache_cf.cc:4577
static std::chrono::nanoseconds ToNanoSeconds(const double value, const std::chrono::nanoseconds &unit)
Definition: cache_cf.cc:1179
static void SetConfigFilename(char const *file_name, bool is_pipe)
Definition: cache_cf.cc:282
void parse_time_t(time_t *var)
Definition: cache_cf.cc:2955
static void dump_sslproxy_ssl_bump(StoreEntry *entry, const char *name, acl_access *ssl_bump)
Definition: cache_cf.cc:4481
static void free_authparam(Auth::ConfigVector *cfg)
Definition: cache_cf.cc:1966
static void dump_cachemgrpasswd(StoreEntry *entry, const char *name, Mgr::ActionPasswordList *list)
Definition: cache_cf.cc:2419
static void parse_address(Ip::Address *addr)
Definition: cache_cf.cc:1541
static void free_icap_service_failure_limit(Adaptation::Icap::Config *)
Definition: cache_cf.cc:4243
static const char *const T_SECOND_STR
Definition: cache_cf.cc:147
static void ReplaceSubstr(char *&str, int &len, unsigned substrIdx, unsigned substrLen, const char *newSubstr)
Definition: cache_cf.cc:330
static void parse_b_size_t(size_t *var)
Definition: cache_cf.cc:3035
static int parseOneConfigFile(const char *file_name, unsigned int depth)
Definition: cache_cf.cc:435
static void parse_icap_service_failure_limit(Adaptation::Icap::Config *)
Definition: cache_cf.cc:4217
static void free_b_int64_t(int64_t *var)
Definition: cache_cf.cc:3071
static void free_int64_t(int64_t *var)
Definition: cache_cf.cc:2572
static void free_refreshpattern(RefreshPattern **head)
Definition: cache_cf.cc:2863
static void parse_authparam(Auth::ConfigVector *config)
Definition: cache_cf.cc:1926
static void dump_SBufList(StoreEntry *entry, const SBufList &words)
Definition: cache_cf.cc:1450
static void free_time_nanoseconds(std::chrono::nanoseconds *var)
Definition: cache_cf.cc:3005
void free_YesNoNone(YesNoNone *)
Definition: cache_cf.cc:3241
static void free_HeaderManglers(HeaderManglers **pm)
Definition: cache_cf.cc:1875
static void dump_note(StoreEntry *, const char *, Notes &)
Definition: cache_cf.cc:4567
int parseConfigFile(const char *file_name)
Definition: cache_cf.cc:634
static void free_delay_pool_count(DelayConfig *cfg)
Definition: cache_cf.cc:1765
void configFreeMemory(void)
Definition: cache_cf.cc:3913
static void free_memcachemode(SquidConfig *)
Definition: cache_cf.cc:3260
static void free_time_msec(time_msec_t *var)
Definition: cache_cf.cc:2986
static void parse_b_ssize_t(ssize_t *var)
Definition: cache_cf.cc:3041
static void dump_cache_log_message(StoreEntry *entry, const char *name, const DebugMessages *messages)
Definition: cache_cf.cc:4644
static void free_time_t(time_t *var)
Definition: cache_cf.cc:2965
static void dump_configuration_includes_quoted_values(StoreEntry *const entry, const char *const name, bool recognizeQuotedValues)
Definition: cache_cf.cc:4852
static void parse_client_delay_pool_count(ClientDelayConfig *cfg)
Definition: cache_cf.cc:1826
static void parse_adaptation_service_set_type()
Definition: cache_cf.cc:4138
static void parse_ftp_epsv(acl_access **ftp_epsv)
Definition: cache_cf.cc:4673
static void parse_string(char **)
Definition: cache_cf.cc:2882
static const char *const T_MONTH_STR
Definition: cache_cf.cc:153
static void parse_port_option(AnyP::PortCfgPointer &s, char *token)
Definition: cache_cf.cc:3492
static void ParseAclWithAction(acl_access **access, const Acl::Answer &action, const char *desc, ACL *acl=nullptr)
Definition: cache_cf.cc:2017
static void dump_removalpolicy(StoreEntry *entry, const char *name, RemovalPolicySettings *settings)
Definition: cache_cf.cc:3226
static const char *const B_MBYTES_STR
Definition: cache_cf.cc:159
static void parse_acl_access(acl_access **head)
Definition: cache_cf.cc:1522
static void free_http_upgrade_request_protocols(HttpUpgradeProtocolAccess **protoGuards)
Definition: cache_cf.cc:4939
static void free_AuthSchemes(acl_access **authSchemes)
Definition: cache_cf.cc:1999
static void free_ecap_service_type(Adaptation::Ecap::Config *)
Definition: cache_cf.cc:4203
static void dump_AuthSchemes(StoreEntry *entry, const char *name, acl_access *authSchemes)
Definition: cache_cf.cc:2006
static void free_client_delay_pool_count(ClientDelayConfig *cfg)
Definition: cache_cf.cc:1814
static void parse_adaptation_access_type()
Definition: cache_cf.cc:4150
static void parse_peer(CachePeer **head)
Definition: cache_cf.cc:2163
static void dump_PortCfg(StoreEntry *, const char *, const AnyP::PortCfgPointer &)
Definition: cache_cf.cc:3904
static void dump_ecap_service_type(StoreEntry *, const char *, const Adaptation::Ecap::Config &)
Definition: cache_cf.cc:4209
static const char *const T_WEEK_STR
Definition: cache_cf.cc:151
static void dump_delay_pool_count(StoreEntry *entry, const char *name, DelayConfig &cfg)
Definition: cache_cf.cc:1771
static void dump_b_ssize_t(StoreEntry *entry, const char *name, ssize_t var)
Definition: cache_cf.cc:3017
static int parse_line(char *)
static void defaults_postscriptum(void)
static void parse_configuration_includes_quoted_values(bool *recognizeQuotedValues)
Definition: cache_cf.cc:4836
static void free_SBufList(SBufList *list)
Definition: cache_cf.cc:1471
static void parse_adaptation_service_chain_type()
Definition: cache_cf.cc:4144
static void SubstituteMacro(char *&line, int &len, const char *macroName, const char *substStr)
Definition: cache_cf.cc:348
static void dump_refreshpattern(StoreEntry *entry, const char *name, RefreshPattern *head)
Definition: cache_cf.cc:2681
static void parse_icap_service_type(Adaptation::Icap::Config *)
Definition: cache_cf.cc:4159
static void parse_time_msec(time_msec_t *var)
Definition: cache_cf.cc:2980
static void free_removalpolicy(RemovalPolicySettings **settings)
Definition: cache_cf.cc:3198
void parse_onoff(int *var)
Definition: cache_cf.cc:2584
static void parse_obsolete(const char *)
Definition: cache_cf.cc:1054
static void dump_b_size_t(StoreEntry *entry, const char *name, size_t var)
Definition: cache_cf.cc:3011
static void dump_client_delay_pool_count(StoreEntry *entry, const char *name, ClientDelayConfig &cfg)
Definition: