--- doc/loncapafiles/webserver.piml	2002/04/14 20:34:32	1.8
+++ doc/loncapafiles/webserver.piml	2020/01/06 15:55:06	1.43.2.4
@@ -1,9 +1,8 @@
 <!DOCTYPE piml PUBLIC "-//TUX/DTD piml 1.0 Final//EN" 
 	"http://lpml.sourceforge.net/DTD/piml.dtd">
 <!-- webserver.piml -->
-<!-- Scott Harrison -->
 
-<!-- $Id: webserver.piml,v 1.8 2002/04/14 20:34:32 harris41 Exp $ -->
+<!-- $Id: webserver.piml,v 1.43.2.4 2020/01/06 15:55:06 raeburn Exp $ -->
 
 <!--
 
@@ -46,112 +45,271 @@ http://www.lon-capa.org/
 <files>
 <file>
 <target dist='default'>/etc/httpd/conf/httpd.conf</target>
-<note>This is always expected for any version of Apache</note>
+<target dist='suse9.2 suse9.3 sles9'>/etc/httpd/httpd.conf</target>
+<target dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2'>/etc/apache2/default-server.conf</target>
+<target dist='debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12'>/etc/apache2/sites-available/loncapa</target>
+<target dist='ubuntu14 ubuntu16 ubuntu18 ubuntu20'>/etc/apache2/conf-available/loncapa</target>
+<note>This is for Apache 1.X for Red Hat 4ES, Fedora 2, 3 and 4, SusSE 9.2 and 9.3, and SLES 9 distributions. This is for Apache 2.X for Fedora 5, Red Hat 5, CentOS 5, Scientific Linux 5, Oracle Linux 5, SuSE 10.1, SLES 10, Debian 5, Ubuntu LTS 8 and later distributions</note>
 <dependencies dist='default'>
 /etc/httpd/conf/httpd.conf
 </dependencies>
-<perlscript mode='fg'>
+<dependencies dist='suse9.2 suse9.3 sles9'>
+/etc/httpd/httpd.conf
+</dependencies>
+<dependencies dist='debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12'>
+/etc/apache2/sites-available/loncapa
+</dependencies>
+<dependencies dist='ubuntu14 ubuntu16 ubuntu18 ubuntu20'>
+/etc/apache2/conf-available/loncapa
+</dependencies>
+<dependencies dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2'>
+/etc/apache2/default-server.conf
+</dependencies>
+<perlscript mode='fg' dist="default">
+# Generated from doc/loncapafiles/webserver.piml
+use Socket;
+use Sys::Hostname::FQDN();
 unless (-e "<TARGET />") {
-	print 'ERROR! httpd.conf should exist! Are you missing the Apache '.
-		'software package';
+  print '**** ERROR! <TARGET /> should exist! Are you missing the Apache '.
+    'software package?';
+  exit(1);
 }
 else {
+  # Append loncapa_apache.conf inclusion to httpd.conf 
+  # (or sites-available/loncapa or conf-available/loncapa) if not present.
   $flag=0;
-  open IN, "&lt;<TARGET />";
-  while (&lt;IN&gt;) { if (/^\s*Include\s+conf\/srm.conf/) { $flag=1; } }
-  close IN;
-  unless ($flag==1) {
-	open OUT,"&gt;&gt;<TARGET />";
-	print OUT 'Include conf/srm.conf'."\n";
-	close OUT;
+  open(IN,'&lt;<TARGET />');
+  while (&lt;IN&gt;) { 
+    if (/^\s*Include\s+conf\/loncapa_apache.conf/) {
+      $flag=1; 
+    }
   }
-  $flag=0;
-  open IN, "&lt;<TARGET />";
-  while (&lt;IN&gt;) { if (/^\s*Include\s+conf\/access.conf/) { $flag=1; } }
-  close IN;
+  close(IN);
   unless ($flag==1) {
-	open OUT,"&gt;&gt;<TARGET />";
-	print OUT 'Include conf/access.conf'."\n";
-	close OUT;
+    open(OUT,'&gt;&gt;<TARGET />');
+    print(OUT 'Include conf/loncapa_apache.conf'."\n");
+    close(OUT);
   }
+  # Remove loncapa.conf inclusion from httpd.conf 
+  # (or sites-available/loncapa or conf-available/loncapa) if present.
   $flag=0;
-  my $eflag=0;
-  open IN, "&lt;<TARGET />";
-  while (&lt;IN&gt;) { 
+  open(IN,'&lt;<TARGET />');
+  while (&lt;IN&gt;) {
     if (/^\s*Include\s+conf\/loncapa.conf/) {
-      $flag=1; 
+      $flag=1;
     }
   }
-  close IN;
-  unless ($flag==1) {
-	open OUT,"&gt;&gt;<TARGET />";
-	print OUT 'Include conf/loncapa.conf'."\n";
-	close OUT;
+  close(IN);
+  $in='';
+  if ($flag==1) {
+    open(IN,'&lt;<TARGET />');
+    while(&lt;IN&gt;) {
+      $in.=$_ unless /^\s*Include\s+conf\/loncapa.conf/;
+    }
+    close(IN);
+    open(OUT,'&gt;<TARGET />');
+    print(OUT $in."\n");
+    close(OUT);
   }
-}
-</perlscript>
-</file>
-<file>
-<target dist='default'>/etc/httpd/conf/access.conf</target>
-<note>This may or may not exist on a system depending on the version of
-Apache</note>
-<dependencies dist='default'>
-/etc/httpd/conf/access.conf
-</dependencies>
-<perlscript mode='fg'>
-unless (-e "<TARGET />") {
-	print &lt;&lt;END;
-WARNING! access.conf is not currently present on your system.
-This is either due to 
-* you are missing the Apache software package,
-* you have a newer version of Apache that does not
-  ordinarily install an access.conf
-* configuration files are installed in a directory location
-  different than for <TARGET />
-For backwards compatibility,
-<TARGET /> is being generated.
-END
-}
-my $flag=0;
-open IN, "&lt;<TARGET />";
-while (&lt;IN&gt;) { if (/^\s*Include\s+conf\/loncapa.conf/) { $flag=1; } }
-close IN;
-unless ($flag==1) {
-open OUT,"&gt;&gt;<TARGET />";
-print OUT 'Include conf/loncapa.conf'."\n";
-close OUT;
-}
-</perlscript>
-</file>
-<file>
-<target dist='default'>/etc/httpd/conf/srm.conf</target>
-<note>This may or may not exist on a system depending on the version of
-Apache</note>
-<dependencies dist='default'>
-/etc/httpd/conf/srm.conf
-</dependencies>
-<perlscript mode='fg'>
-unless (-e "<TARGET />") {
-	print &lt;&lt;END;
-WARNING! srm.conf is not currently present on your system.
-This is either due to 
-* you are missing the Apache software package,
-* you have a newer version of Apache that does not
-  ordinarily install an srm.conf
-* configuration files are installed in a directory location
-  different than for <TARGET />
-For backwards compatibility,
-<TARGET /> is being generated.
-END
-}
-my $flag=0;
-open IN, "&lt;<TARGET />";
-while (&lt;IN&gt;) { if (/^\s*Include\s+conf\/loncapa.conf/) { $flag=1; } }
-close IN;
-unless ($flag==1) {
-open OUT,"&gt;&gt;<TARGET />";
-print OUT 'Include conf/loncapa.conf'."\n";
-close OUT;
+
+# Checking for overlapping ScriptAlias and DocumentRoot definitions.
+  $scriptalias_flag=0;
+  $documentroot_flag=0;
+  my $scriptalias;
+  my $documentroot;
+  open(IN,'&lt;<TARGET />');
+  while (&lt;IN&gt;) {
+    if (m!^\s*ScriptAlias\s+/cgi-bin/\s+(.*)$!) {
+      $scriptalias = $1;
+      if ($scriptalias !~ m!home/httpd/cgi-bin!) {
+        $scriptalias_flag = 1;
+      }
+    }
+    if (m!^\s*DocumentRoot\s+(.*)$!) {
+      $documentroot = $1;
+      if ($documentroot !~ m!home/httpd/html!) {
+        $documentroot_flag = 1;
+      }
+    }
+  }
+  close(IN);
+  if ($scriptalias_flag==1) {
+      my $conffile = '/etc/httpd/conf/httpd.conf';
+      if ('<DIST />' eq 'suse9.2' || '<DIST />' eq 'suse9.3' 
+          || '<DIST />' eq 'sles9') {
+          $conffile =  '/etc/httpd/httpd.conf';
+      } elsif ('<DIST />' =~ /^(suse|sles)/) {
+          $conffile = '/etc/apache2/default-server.conf';
+      } elsif ('<DIST />' =~ /^(debian|ubuntu)/) {
+          $conffile = '/etc/apache2/sites-available/loncapa';
+      }
+      print('**** ERROR **** '.$conffile.' has an overlapping definition of '.
+            'ScriptAlias (it is incorrectly set to '.$scriptalias.').'."\n".
+            'This conflicts with loncapa_apache.conf.'."\n");
+  }
+  if ($documentroot_flag==1) {
+      print('**** ERROR **** '.$conffile.' has an overlapping definition of '.
+            'DocumentRoot (it is incorrectly set to '.$documentroot.').'."\n".
+            'This conflicts with loncapa_apache.conf.'."\n");
+  }
+
+# Checking for rewrites of http:// to https://
+    my $rewrite_dir = '/etc/httpd/conf/rewrites';
+    my $curr_rewrite = '/etc/httpd/conf/loncapa_rewrite.conf';
+    if ('<DIST />' eq 'suse9.2' || '<DIST />' eq 'suse9.3'
+        || '<DIST />' eq 'sles9') {
+        $rewrite_dir = '/etc/httpd/rewrites/';
+        $curr_rewrite = '/etc/httpd/loncapa_rewrite.conf';
+    } elsif ('<DIST />' =~ /^(suse|sles|debian|ubuntu)/) {
+        $rewrite_dir = '/etc/apache2/rewrites';
+        $curr_rewrite = '/etc/apache2/loncapa_rewrite.conf';
+    }
+    my $rewrite_off = $rewrite_dir.'/loncapa_rewrite_off.conf';
+    my $rewrite_on = $rewrite_dir.'/loncapa_rewrite_on.conf';
+    if (!-e $curr_rewrite) { 
+        system("cp $rewrite_off $curr_rewrite");
+        chmod(0644, $curr_rewrite);
+    } else {
+        my ($not_rewrite_on,$not_rewrite_off,$rewrite_state);
+        if (open(PIPE, "diff --brief $rewrite_off $curr_rewrite |")) {
+            my $diffres = &lt;PIPE&gt; ;
+            close(PIPE);
+            chomp($diffres);
+            if ($diffres) {
+                $not_rewrite_off = 1;
+            } else {
+                $rewrite_state = 'off';
+            }
+        }
+        if (open(PIPE, "diff --brief $rewrite_on $curr_rewrite |")) {
+            my $diffres = &lt;PIPE&gt; ;
+            close(PIPE);
+            chomp($diffres);
+            if ($diffres) {
+                $not_rewrite_on = 1;
+            } else {
+                $rewrite_state = 'on';
+            }
+        }
+        if ($not_rewrite_off && $not_rewrite_on) {
+            print('**** WARNING **** '."\n".$curr_rewrite.' does not match '.
+            'either:'."\n".$rewrite_on.' - the file used to enable rewriting '.
+            'of requests for http:// to https:// '."\n".'or:'."\n".$rewrite_off.
+            ' - the file used to disable such rewriting'."\n\n".
+            'This may be because '. $curr_rewrite.' has been '. 
+            'previously customized,'."\n".'or it may be because of a change '.  
+            'to the files in '.$rewrite_dir."\n");
+            if (open(my $fh,'&lt;',$curr_rewrite)) {
+                while(&lt;$fh&gt;) {
+                    if (/^\s*RewriteEngine\s+(on|off)\s*$/i) {
+                        if ($1 eq 'on') {
+                            $rewrite_state = 'on';
+                        } else {
+                            $rewrite_state = 'off';
+                        }
+                        last;
+                    }
+                }
+            }
+        }
+        if ($rewrite_state eq 'on') {
+        # Checking for rewrites of https:// to http://
+            my ($gotrules,$rulestr,$ssldir);
+            if ('<DIST />' eq 'suse9.2' || '<DIST />' eq 'suse9.3'
+                || '<DIST />' eq 'sles9') {
+                $ssldir = '/etc/apache/vhosts.d';
+            } elsif ('<DIST />' =~ /^(suse|sles)/) {
+                $ssldir = '/etc/apache2/vhosts.d';
+            } elsif ('<DIST />' =~ /^(debian|ubuntu)/) {
+                $ssldir = '/etc/apache2/sites-available';
+            } else {
+                $ssldir = '/etc/httpd/conf.d';
+            }
+            my $hostname = Sys::Hostname::FQDN::fqdn();
+            my $hostip = Socket::inet_ntoa(scalar(gethostbyname($hostname)) || 'localhost');
+            my @expected = ('RewriteCond %{REQUEST_URI} ^/adm/wrapper/ext/(?!https:\/\/)',
+                            'RewriteCond %{QUERY_STRING} (^|&(|amp;))usehttp=1($|&)',
+                            'RewriteRule ^/adm/wrapper/ext/(?!https:\/\/) http://%{HTTP_HOST}%{REQUEST_URI} [R,L,NE]',
+                            'RewriteCond %{REMOTE_ADDR} 127.0.0.1',
+                            'RewriteRule (.*) - [L]');
+            if (($hostip ne '') && ($hostip ne '127.0.0.1')) {
+                push(@expected,('RewriteCond %{REMOTE_ADDR} '.$hostip,
+                                'RewriteRule (.*) - [L]'));
+            }
+            push(@expected,('RewriteCond %{REQUEST_URI} ^/public/.*/syllabus$',
+                            'RewriteCond %{QUERY_STRING} (^|&(|amp;))usehttp=1($|&)',
+                            'RewriteRule ^/public/.*/syllabus$ http://%{HTTP_HOST}%{REQUEST_URI} [R,L,NE]'));
+            if (-d $ssldir) {
+                my @rewrites;
+                if (opendir(my $dir,$ssldir)) {
+                    my @sslconf_files;
+                    foreach my $file (!grep(/^\.$/,readdir($dir))) {
+                        if (open(my $fh,'&lt;',"$ssldir/$file")) {
+                            while (&lt;$fh&gt;) {
+                                if (/^\s*&lt;VirtualHost\s+[^:]*\:443&gt;\s*$/) {
+                                    push(@sslconf_files,$file);
+                                    last;
+                                }
+                            }
+                            close($fh);
+                        }
+                    }
+                    if (@sslconf_files) {
+                        my @rewrites;
+                        foreach my $file (@sslconf_files) {
+                            if (open(my $fh,'&lt;',"$ssldir/$file")) {
+                                my ($rewrite,$num) = (0,0);
+                                while (&lt;$fh&gt;) {
+                                    if ($rewrite) {
+                                        if (/\s*&lt;\/IfModule&gt;/) {
+                                            $rewrite = 0;
+                                            $num ++;
+                                        } else {
+                                            chomp();
+                                            s/^(\s+|\s+)$//g;
+                                            push(@{$rewrites[$num]},$_);
+                                        }
+                                    } elsif (/^\s*&lt;IfModule\s+mod_rewrite.c&gt;/) {
+                                        $rewrite = 1;
+                                    }
+                                }
+                                close($fh);
+                            }
+                        }
+                    }
+                    closedir($dir);
+                }
+                if (@rewrites) {
+                    foreach my $item (@rewrites) {
+                        if (ref($item) eq 'ARRAY') {
+                            my $found = 0;
+                            foreach my $item (@rewrites) {
+                                foreach my $match (@expected) {
+                                    if ($match eq $item) {
+                                        $found ++;
+                                        last;
+                                    }
+                                }
+                            }
+                            if ($found &gt;= @expected) {
+                                $gotrules = 1;
+                            }
+                        }
+                    }
+                }
+            }
+            unless ($gotrules) {
+                print('**** WARNING **** '."\n".$curr_rewrite.' is currently set so rewrites '.
+                      'of http to https are enabled for most URLs.'."\n".
+                      'Unless your Apache configuration includes Strict-Transport-Security '.
+                      '(with max-age > 0), it is recommended to also set rewrites from https to http '.
+                      'for specific URLs in a file in '.$ssldir.' by including the following:'."\n".
+                      "&lt;IfModule mod_rewrite.c&gt;\n".'  '.
+                      join("\n  ",@expected)."\n".
+                      "&lt;/IfModule&gt;\n");
+            }
+        }
+    }
 }
 </perlscript>
 </file>