[master] 6f4bd2fd0 param: Refuse read-only setting for aliases

[Dridi Boukelmoune]

commit 6f4bd2fd07be86f5d1bb01285425fbc64b14a63e
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Fri May 2 15:05:03 2025 +0200

    param: Refuse read-only setting for aliases
    
    The alternative could have been to mark both aliases and their original
    parameters as protected but there isn't always a one-to-one mapping
    between deprecated aliases and the parameters they point to.
    
    The old vcc_* boolean parameters turned into vcc_feature flags.
    
    Refs #4323

diff --git a/bin/varnishd/mgt/mgt_param.c b/bin/varnishd/mgt/mgt_param.c
index f88dc4014..75491f695 100644
--- a/bin/varnishd/mgt/mgt_param.c
+++ b/bin/varnishd/mgt/mgt_param.c
@@ -536,8 +536,9 @@ mcf_param_show_json(struct cli *cli, const char * const *av, void *priv)
 void
 MCF_ParamProtect(struct cli *cli, const char *args)
 {
-	char **av;
+	const struct parspec *orig;
 	struct parspec *pp;
+	char **av;
 	int i;
 
 	av = VAV_Parse(args, NULL, ARGV_COMMA);
@@ -552,8 +553,17 @@ MCF_ParamProtect(struct cli *cli, const char *args)
 		if (pp == NULL) {
 			VCLI_Out(cli, "Unknown parameter %s", av[i]);
 			VCLI_SetResult(cli, CLIS_PARAM);
-			VAV_Free(av);
-			return;
+			break;
+		}
+		if (pp->func == tweak_alias) {
+			orig = TRUST_ME(pp->priv);
+			AN(orig);
+			VCLI_Out(cli,
+			    "Cannot mark alias %s read only.\n"
+			    "Did you mean to mark %s read only?",
+			    pp->name, orig->name);
+			VCLI_SetResult(cli, CLIS_PARAM);
+			break;
 		}
 		pp->flags |= PROTECTED;
 	}
diff --git a/bin/varnishtest/tests/r04323.vtc b/bin/varnishtest/tests/r04323.vtc
index 02365fe2b..5bd595227 100644
--- a/bin/varnishtest/tests/r04323.vtc
+++ b/bin/varnishtest/tests/r04323.vtc
@@ -4,3 +4,7 @@ varnish v1 -arg "-r vcc_feature"
 
 varnish v1 -clierr 107 "param.set vcc_feature all"
 varnish v1 -clierr 107 "param.set vcc_allow_inline_c on"
+
+shell -err -expect "Cannot mark alias vcc_allow_inline_c read only" {
+	varnishd -d -r vcc_allow_inline_c -n ${tmpdir}/vd
+}