From 2bbfbdd783fe46d584d91b6014ef6c86520a9097 Mon Sep 17 00:00:00 2001 From: Martin Fuchs Date: Fri, 13 Jun 2014 11:31:52 +0200 Subject: allow multiple CAS-servers, correct checks --- config/squid3/33/squid.inc | 20 ++++++++------------ config/squid3/33/squid_reverse.inc | 23 ++++++++++++++++++----- config/squid3/33/squid_reverse.xml | 4 ++-- config/squid3/33/squid_reverse_general.xml | 4 ++-- 4 files changed, 30 insertions(+), 21 deletions(-) (limited to 'config/squid3/33') diff --git a/config/squid3/33/squid.inc b/config/squid3/33/squid.inc index a97746e2..d006c0db 100755 --- a/config/squid3/33/squid.inc +++ b/config/squid3/33/squid.inc @@ -615,9 +615,8 @@ function squid_validate_reverse($post, $input_errors) { if(!empty($post['reverse_ip'])) { $reverse_ip = explode(";", ($post['reverse_ip'])); foreach ($reverse_ip as $reip) { - if (!is_ipaddr($reip)) - $input_errors[] = 'You must enter a valid IP address in the \'User-defined reverse-proxy IPs\' field'; - break; + if (!is_ipaddr(trim($reip))) + $input_errors[] = 'You must enter a valid IP address in the \'User-defined reverse-proxy IPs\' field'.' -> \''.$reip.'\' is invalid.'; }} $fqdn = trim($post['reverse_external_fqdn']); @@ -639,15 +638,12 @@ function squid_validate_reverse($post, $input_errors) { $input_errors[] = "You have to enable reverse HTTPS before enabling OWA support."; } -/* - if (!is_cert($post['reverse_int_ca'])) - $input_errors[] = 'A valid certificate for the external interface must be selected'; -*/ - - $rowa = trim($post['reverse_owa_ip']); - if (!empty($rowa) && !is_ipaddr($rowa)) - $input_errors[] = 'The field \'OWA frontend IP address\' must contain a valid IP address'; - + if(!empty($post['reverse_owa_ip'])) { + $reverse_owa_ip = explode(";", ($post['reverse_owa_ip'])); + foreach ($reverse_owa_ip as $reowaip) { + if (!is_ipaddr(trim($reowaip))) + $input_errors[] = 'You must enter a valid IP address in the \'CAS-Array / OWA frontend IP address\' field'.' -> \''.$reowaip.'\' is invalid.'; + }} $contents = $post['reverse_cache_peer']; if(!empty($contents)) { diff --git a/config/squid3/33/squid_reverse.inc b/config/squid3/33/squid_reverse.inc index 6ae209b2..69d461e4 100755 --- a/config/squid3/33/squid_reverse.inc +++ b/config/squid3/33/squid_reverse.inc @@ -100,14 +100,22 @@ function squid_resync_reverse() { //PEERS if (($settings['reverse_owa'] == 'on') && (!empty($settings['reverse_owa_ip']))) - $conf .= "cache_peer {$settings['reverse_owa_ip']} parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_pfs\n"; - + + if(!empty($settings['reverse_owa_ip'])) { + $reverse_owa_ip = explode(";", ($settings['reverse_owa_ip'])); + $casnr = 0; + foreach ($reverse_owa_ip as $reowaip) { + $casnr++; + $conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_{$casnr}_pfs\n"; + } + } + $active_peers=array(); if (is_array($reverse_peers)) foreach ($reverse_peers as $rp){ if ($rp['enable'] =="on" && $rp['name'] !="" && $rp['ip'] !="" && $rp['port'] !=""){ $conf_peer = "#{$rp['description']}\n"; - $conf_peer .= "cache_peer {$rp['ip']} parent {$rp['port']} 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin "; + $conf_peer .= "cache_peer {$rp['ip']} parent {$rp['port']} 0 proxy-only no-query no-digest originserver login=PASSTHRU connection-auth=on round-robin "; if($rp['protocol'] == 'HTTPS') $conf_peer .= "ssl sslflags=DONT_VERIFY_PEER front-end-https=auto "; $conf_peer .= "name=rvp_{$rp['name']}\n\n"; @@ -210,8 +218,13 @@ function squid_resync_reverse() { //ACCESS if ($settings['reverse_owa'] == 'on' && !empty($settings['reverse_owa_ip']) && $settings['reverse_https'] =="on") { - $conf .= "cache_peer_access OWA_HOST_pfs allow OWA_URI_pfs\n"; - $conf .= "cache_peer_access OWA_HOST_pfs deny allsrc\n"; + + for($cascnt=1;$cascnt<$casnr+1;$cascnt++) + { + $conf .= "cache_peer_access OWA_HOST_{$cascnt}_pfs allow OWA_URI_pfs\n"; + $conf .= "cache_peer_access OWA_HOST_{$cascnt}_pfs deny allsrc\n"; + } + $conf .= "never_direct allow OWA_URI_pfs\n"; $conf .= "http_access allow OWA_URI_pfs\n"; } diff --git a/config/squid3/33/squid_reverse.xml b/config/squid3/33/squid_reverse.xml index 28d8cbcf..b0f6a614 100755 --- a/config/squid3/33/squid_reverse.xml +++ b/config/squid3/33/squid_reverse.xml @@ -219,9 +219,9 @@ CAS-Array / OWA frontend IP address reverse_owa_ip - This is the internal IP Address of the CAS-Array / OWA frontend server. + These are the internal IPs of the CAS-Array (OWA frontend servers). Separate by semi-colons (;). input - 15 + 70 Enable ActiveSync diff --git a/config/squid3/33/squid_reverse_general.xml b/config/squid3/33/squid_reverse_general.xml index 029072a6..9bff5d8e 100755 --- a/config/squid3/33/squid_reverse_general.xml +++ b/config/squid3/33/squid_reverse_general.xml @@ -207,9 +207,9 @@ CAS-Array / OWA frontend IP address reverse_owa_ip - This is the internal IP Address of the CAS-Array / OWA frontend server. + These are the internal IPs of the CAS-Array (OWA frontend servers). Separate by semi-colons (;). input - 15 + 70 Enable ActiveSync -- cgit v1.2.3 From 15dd9887e6c3c4c2d78dddca38a6fda7f997ab88 Mon Sep 17 00:00:00 2001 From: Martin Fuchs Date: Fri, 13 Jun 2014 14:53:51 +0200 Subject: fixed reverse owa OWA does not work with round-robin --- config/squid3/33/squid_reverse.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'config/squid3/33') diff --git a/config/squid3/33/squid_reverse.inc b/config/squid3/33/squid_reverse.inc index 69d461e4..c2463102 100755 --- a/config/squid3/33/squid_reverse.inc +++ b/config/squid3/33/squid_reverse.inc @@ -106,7 +106,7 @@ function squid_resync_reverse() { $casnr = 0; foreach ($reverse_owa_ip as $reowaip) { $casnr++; - $conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_{$casnr}_pfs\n"; + $conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_{$casnr}_pfs\n"; } } -- cgit v1.2.3 From a1538e7d5450ca85fa2a2536086e0203b84beef6 Mon Sep 17 00:00:00 2001 From: Martin Fuchs Date: Tue, 17 Jun 2014 08:51:48 +0200 Subject: enable AutoDiscover HTTP --- config/squid3/33/squid_reverse.inc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'config/squid3/33') diff --git a/config/squid3/33/squid_reverse.inc b/config/squid3/33/squid_reverse.inc index c2463102..5226e819 100755 --- a/config/squid3/33/squid_reverse.inc +++ b/config/squid3/33/squid_reverse.inc @@ -106,7 +106,8 @@ function squid_resync_reverse() { $casnr = 0; foreach ($reverse_owa_ip as $reowaip) { $casnr++; - $conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_{$casnr}_pfs\n"; + $conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_443_{$casnr}_pfs\n"; + $conf .= "cache_peer {$reowaip} parent 80 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on name=OWA_HOST_80_{$casnr}_pfs\n"; } } @@ -191,6 +192,7 @@ function squid_resync_reverse() { if (($settings['reverse_owa'] == 'on') && (!empty($settings['reverse_owa_ip'])) && ($settings['reverse_owa_autodiscover'] == 'on')) { $reverse_external_domain = strstr($settings['reverse_external_fqdn'], '.'); $conf .= "acl OWA_URI_pfs url_regex -i ^https://autodiscover{$reverse_external_domain}/AutoDiscover/AutoDiscover.xml\n"; + $conf .= "acl OWA_URI_pfs url_regex -i ^http://autodiscover{$reverse_external_domain}/AutoDiscover/AutoDiscover.xml\n"; } } //$conf .= "ssl_unclean_shutdown on"; @@ -221,8 +223,10 @@ function squid_resync_reverse() { for($cascnt=1;$cascnt<$casnr+1;$cascnt++) { - $conf .= "cache_peer_access OWA_HOST_{$cascnt}_pfs allow OWA_URI_pfs\n"; - $conf .= "cache_peer_access OWA_HOST_{$cascnt}_pfs deny allsrc\n"; + $conf .= "cache_peer_access OWA_HOST_443_{$cascnt}_pfs allow OWA_URI_pfs\n"; + $conf .= "cache_peer_access OWA_HOST_80_{$cascnt}_pfs allow OWA_URI_pfs\n"; + $conf .= "cache_peer_access OWA_HOST_443_{$cascnt}_pfs deny allsrc\n"; + $conf .= "cache_peer_access OWA_HOST_80_{$cascnt}_pfs deny allsrc\n"; } $conf .= "never_direct allow OWA_URI_pfs\n"; -- cgit v1.2.3 From a579dfb326bb24443f0d7da0dbcde27a527cb9aa Mon Sep 17 00:00:00 2001 From: Martin Fuchs Date: Tue, 17 Jun 2014 20:07:19 +0200 Subject: add autodiscover url for self-hosted domains as tested in microsoft-connectivity-analyzer --- config/squid3/33/squid_reverse.inc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'config/squid3/33') diff --git a/config/squid3/33/squid_reverse.inc b/config/squid3/33/squid_reverse.inc index 5226e819..a6b81c0b 100755 --- a/config/squid3/33/squid_reverse.inc +++ b/config/squid3/33/squid_reverse.inc @@ -191,8 +191,10 @@ function squid_resync_reverse() { if (($settings['reverse_owa'] == 'on') && (!empty($settings['reverse_owa_ip'])) && ($settings['reverse_owa_autodiscover'] == 'on')) { $reverse_external_domain = strstr($settings['reverse_external_fqdn'], '.'); - $conf .= "acl OWA_URI_pfs url_regex -i ^https://autodiscover{$reverse_external_domain}/AutoDiscover/AutoDiscover.xml\n"; + $conf .= "acl OWA_URI_pfs url_regex -i ^http://{$settings['reverse_external_fqdn']}/AutoDiscover/AutoDiscover.xml\n"; + $conf .= "acl OWA_URI_pfs url_regex -i ^https://{$settings['reverse_external_fqdn']}/AutoDiscover/AutoDiscover.xml\n"; $conf .= "acl OWA_URI_pfs url_regex -i ^http://autodiscover{$reverse_external_domain}/AutoDiscover/AutoDiscover.xml\n"; + $conf .= "acl OWA_URI_pfs url_regex -i ^https://autodiscover{$reverse_external_domain}/AutoDiscover/AutoDiscover.xml\n"; } } //$conf .= "ssl_unclean_shutdown on"; -- cgit v1.2.3