diff options
| -rw-r--r-- | config/apache_mod_security/apache_mod_security.inc | 108 | ||||
| -rw-r--r-- | config/apache_mod_security/apache_mod_security.xml | 33 | ||||
| -rw-r--r-- | config/apache_mod_security/apache_mod_security_settings.xml | 31 |
3 files changed, 120 insertions, 52 deletions
diff --git a/config/apache_mod_security/apache_mod_security.inc b/config/apache_mod_security/apache_mod_security.inc index 1349ab8c..82fc5a5a 100644 --- a/config/apache_mod_security/apache_mod_security.inc +++ b/config/apache_mod_security/apache_mod_security.inc @@ -140,15 +140,21 @@ function generate_apache_configuration() { if($config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalsiteadminemail']) { $global_site_email = $config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalsiteadminemail']; } else { - $global_site_email = "admin@admin.comn"; + $config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalsiteadminemail'] = "admin@admin.com"; + $global_site_email = $config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalsiteadminemail']; + // update configuration with default value in this case + write_config($pkg['addedit_string']); log_error("WARNING! Global site Administrator E-Mail address has not been set. Defaulting to bogus e-mail address."); } // Set ServerName - if($config['installedpackages']['apachemodsecuritysettings']['config']['hostname']) { + if($config['installedpackages']['apachemodsecuritysettings']['config'][0]['hostname']) { $servername = "ServerName {$config['installedpackages']['apachemodsecuritysettings']['config'][0]['hostname']}\n"; } else { $servername = "ServerName " . `hostname` . "\n"; + $config['installedpackages']['apachemodsecuritysettings']['config'][0]['hostname'] = `hostname`; + // update configuration with default value in this case + write_config($pkg['addedit_string']); } // Set global listening directive and ensure nothing is listening on this port already @@ -170,7 +176,10 @@ function generate_apache_configuration() { else $global_listen .= ":80"; } else { - $global_listen = "{$config['system']['hostname']}.{$config['system']['domain']}"; + $config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalbindtoipaddr'] = "{$config['system']['hostname']}.{$config['system']['domain']}"; + $global_listen = $config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalbindtoipaddr']; + // update configuration with default value in this case + write_config($pkg['addedit_string']); if($config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalbindtoport']) $global_listen .= ":" . $config['installedpackages']['apachemodsecuritysettings']['config'][0]['globalbindtoport']; else @@ -268,9 +277,27 @@ EOF; #------------------------------------------------- ##################################################### */ + $mod_proxy .= "\n"; + $configuredaliases = array(); + // Read already configured addresses + if($config['installedpackages']['apachemodsecuritysettings']['config']['0']) { + foreach($config['installedpackages']['apachemodsecuritysettings']['config']['0']['row'] as $row) { + if ($row['ipaddress'] && $row['ipport']) { + $configuredaliases[] = $row; + } + } + } + + + // clear list of bound addresses + $config['installedpackages']['apachemodsecuritysettings']['config'][0]['row'] = array(); + + // Process proxy sites // Configure NameVirtualHost directives + $aliases = ""; $processed = array(); + if($config['installedpackages']['apachemodsecurity']) { foreach($config['installedpackages']['apachemodsecurity']['config'] as $ams) { if($ams['ipaddress'] && $ams['port']) @@ -281,7 +308,9 @@ EOF; if(!in_array($local_ip_port, $processed)) { // explicit bind if not global ip:port if ($local_ip_port != $global_listen) { - $mod_proxy .= "Listen $local_ip_port\n"; + $aliases .= "Listen $local_ip_port\n"; + // Automatically add this to configuration + $config['installedpackages']['apachemodsecuritysettings']['config'][0]['row'][] = array('ipaddress' => $ams['ipaddress'], 'ipport' => $ams['port']); } $mod_proxy .= "NameVirtualHost $local_ip_port\n"; $processed[] = $local_ip_port; @@ -289,32 +318,57 @@ EOF; } } +//** Uncomment to allow adding ip/ports not used by any site proxies +//** Otherwise unused addresses/ports will be automatically deleted from the configuration +// foreach ($configuredaliases as $ams) { +// $local_ip_port = "{$ams['ipaddress']}:{$ams['ipport']}"; +// if(!in_array($local_ip_port, $processed)) { +// // explicit bind if not global ip:port +// if ($local_ip_port != $global_listen) { +// $aliases .= "Listen $local_ip_port\n"; +// // Automatically add this to configuration +// $config['installedpackages']['apachemodsecuritysettings']['config'][0]['row'][] = array('ipaddress' => $ams['ipaddress'], 'ipport' => $ams['ipport']); +// } +// } +// } + + // update configuration with actual ip bindings + write_config($pkg['addedit_string']); + + // Setup mod_proxy entries $mod_proxy if($config['installedpackages']['apachemodsecurity']) { foreach($config['installedpackages']['apachemodsecurity']['config'] as $ams) { // Set rowhelper used variables + $additionalsitehostnames = ""; foreach($ams['row'] as $row) { - // Ensure leading http(s):// - if(!strstr($row['additionalsitehostnames'], "http")) - $additionalsitehostnames .= "http://"; - $additionalsitehostnames .= "{$row['additionalsitehostnames']}"; - // Ensure trailing / - if(substr($row['additionalsitehostnames'],count($row['additionalsitehostnames']),1) != "/") - $additionalsitehostnames .= "/ "; - else - $additionalsitehostnames .= " "; + if ($row['additionalsitehostnames']) { + $additionalsitehostnames .= "{$row['additionalsitehostnames']} "; } - $backend_sites = ""; // not technically needed. added for readability due to .='s + } + $backend_sites = ""; + $sslproxyengine = ""; + $backend_sites_count = 0; + $balancer_members = ""; // not technically needed. foreach($ams['row'] as $row) { + if ($row['webserveripaddr']) { + $normalised_ipaddr = ""; + if (substr(trim($row['webserveripaddr']), 0, strlen("https:")) == "https:") { + // if backend is https, then enable SSLProxyEngine + $sslproxyengine = "SSLProxyEngine on"; + } else if (substr(trim($row['webserveripaddr']), 0, strlen("http:")) != "http:") { // Ensure leading http(s):// - if(!strstr($row['webserveripaddr'], "http")) - $backend_sites .= "http://"; - $backend_sites .= "{$row['webserveripaddr']}"; + $normalised_ipaddr .= "http://"; + } + $normalised_ipaddr .= trim($row['webserveripaddr']); + $balancer_members .= " BalancerMember " . $normalised_ipaddr . "\n"; // Ensure trailing / - if(substr($row['webserveripaddr'],count($row['webserveripaddr']),1) != "/") - $backend_sites .= "/ "; - else - $backend_sites .= " "; + if(substr($normalised_ipaddr,-1) != "/") { + $normalised_ipaddr .= "/"; + } + $backend_sites .= $normalised_ipaddr . " "; + $backend_sites_count++; + } } // Set general items if($ams['siteemail']) @@ -323,8 +377,6 @@ EOF; $serveradmin = $global_site_email; if($ams['primarysitehostname']) $primarysitehostname = $ams['primarysitehostname']; - if($ams['primarysitehostname']) - $additionalsitehostnames = $ams['primarysitehostname']; $sitename = str_replace(" ", "", $ams['sitename']); // Set local listening directive if($ams['ipaddress'] && $ams['port']) @@ -332,13 +384,12 @@ EOF; else $local_ip_port = $global_listen; // Is this item a load balancer - if(count($ams['row'])>1) { + if($backend_sites_count>1) { $balancer = true; $mod_proxy .= "<Proxy balancer://{$sitename}>\n"; - foreach($ams['row'] as $row) - $mod_proxy .= " BalancerMember {$row['webserveripaddr']}\n"; + $mod_proxy .= $balancer_members; $mod_proxy .= "</Proxy>\n"; - $backend_sites = " balancer://{$sitename}\n"; + $backend_sites = " balancer://{$sitename}/"; $sitename = ""; // we are not using sitename in this case } // Set SSL items @@ -361,6 +412,8 @@ EOF; if ($certificatechainfile) $mod_proxy .= " SSLCertificateChainFile /usr/local/etc/apache22/$certificatechainfile\n"; } + if($sslproxyengine) + $mod_proxy .= " {$sslproxyengine}\n"; if($additionalsitehostnames) $mod_proxy .= " ServerAlias $additionalsitehostnames\n"; if($serveradmin) @@ -508,6 +561,7 @@ ServerRoot "/usr/local" # prevent Apache from glomming onto all bound IP addresses. # Listen {$global_listen} +{$aliases} # # Dynamic Shared Object (DSO) Support diff --git a/config/apache_mod_security/apache_mod_security.xml b/config/apache_mod_security/apache_mod_security.xml index f2cba156..ada5a29c 100644 --- a/config/apache_mod_security/apache_mod_security.xml +++ b/config/apache_mod_security/apache_mod_security.xml @@ -194,38 +194,25 @@ <field> <fielddescr> <![CDATA[ - Additional site hostnames - <br/> - (not required) + Backend Web Servers and Additional Site Hostnames ]]> </fielddescr> - <fieldname>additionalsitehostnames</fieldname> + <fieldname>additionalparameters</fieldname> <type>rowhelper</type> <rowhelper> <rowhelperfield> - <fielddescr>Additional Site Hostname</fielddescr> - <fieldname>additionalsitehostnames</fieldname> - <description>Add each webserver hostname address here.</description> + <fielddescr>Web server backend URLs</fielddescr> + <fieldname>webserveripaddr</fieldname> + <description>Add each web server IP address here.</description> <type>input</type> - <size>53</size> + <size>40</size> </rowhelperfield> - </rowhelper> - </field> - <field> - <fielddescr> - <![CDATA[ - Backend web servers - ]]> - </fielddescr> - <fieldname>webservers</fieldname> - <type>rowhelper</type> - <rowhelper> <rowhelperfield> - <fielddescr>Web server backend URL</fielddescr> - <fieldname>webserveripaddr</fieldname> - <description>Add each web server IP address here.</description> + <fielddescr>Additional Site Hostnames (not required)</fielddescr> + <fieldname>additionalsitehostnames</fieldname> + <description>Add each webserver hostname address here.</description> <type>input</type> - <size>53</size> + <size>40</size> </rowhelperfield> </rowhelper> </field> diff --git a/config/apache_mod_security/apache_mod_security_settings.xml b/config/apache_mod_security/apache_mod_security_settings.xml index 4bbc4ea2..479e7509 100644 --- a/config/apache_mod_security/apache_mod_security_settings.xml +++ b/config/apache_mod_security/apache_mod_security_settings.xml @@ -77,7 +77,7 @@ <type>input</type> </field> <field> - <fielddescr>Bind to IP Address</fielddescr> + <fielddescr>Default Bind to IP Address</fielddescr> <fieldname>globalbindtoipaddr</fieldname> <description> <![CDATA[ @@ -89,7 +89,7 @@ <type>input</type> </field> <field> - <fielddescr>Bind to port</fielddescr> + <fielddescr>Default Bind to port</fielddescr> <fieldname>globalbindtoport</fieldname> <description> <![CDATA[ @@ -101,6 +101,33 @@ <type>input</type> </field> <field> + <fielddescr> + <![CDATA[ + Additional Addresses<br/> + Do not edit. This field will be automatically populated from Site Proxies settings. + ]]> + </fielddescr> + <fieldname>additionaladdresses</fieldname> + <description></description> + <type>rowhelper</type> + <rowhelper> + <rowhelperfield> + <fielddescr>IP Address</fielddescr> + <fieldname>ipaddress</fieldname> + <description></description> + <type>input</type> + <size>45</size> + </rowhelperfield> + <rowhelperfield> + <fielddescr>Port</fielddescr> + <fieldname>ipport</fieldname> + <description></description> + <type>input</type> + <size>10</size> + </rowhelperfield> + </rowhelper> + </field> + <field> <fielddescr>Use mod_mem_cache</fielddescr> <fieldname>mod_mem_cache</fieldname> <description> |