--- loncom/interface/domainprefs.pm	2021/01/01 14:45:38	1.375
+++ loncom/interface/domainprefs.pm	2021/04/29 17:45:22	1.382
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.375 2021/01/01 14:45:38 raeburn Exp $
+# $Id: domainprefs.pm,v 1.382 2021/04/29 17:45:22 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -311,16 +311,16 @@ sub handler {
                       print => \&print_defaults,
                       modify => \&modify_defaults,
                     },
-        'wafproxy' =>  
-                    { text => 'Web Application Firewall/Reverse Proxy',  
+        'wafproxy' =>
+                    { text => 'Web Application Firewall/Reverse Proxy',
                       help => 'Domain_Configuration_WAF_Proxy',
-                      header => [{col1 => 'Domain server',
-                                  col2 => 'Alias for WAF/Reverse Proxy',
+                      header => [{col1 => 'Domain(s)',
+                                  col2 => 'Servers and WAF/Reverse Proxy alias(es)',
                                  },
-                                 {col1 => 'Setting',
-                                  col2 => 'Value',}],
+                                 {col1 => 'Domain(s)',
+                                  col2 => 'WAF Configuration',}],
                       print => \&print_wafproxy,
-                      modify => \&modify_wafproxy, 
+                      modify => \&modify_wafproxy,
                     },
         'passwords' =>
                     { text => 'Passwords (Internal authentication)',
@@ -855,6 +855,8 @@ sub print_config_box {
         $output .= &lti_javascript($settings);
     } elsif ($action eq 'proctoring') {
         $output .= &proctoring_javascript($settings);
+    } elsif ($action eq 'wafproxy') {
+        $output .= &wafproxy_javascript($dom);
     }
     $output .=
          '<table class="LC_nested_outer">
@@ -2844,6 +2846,121 @@ function toggleLTITools(form,setting,ite
 ENDSCRIPT
 }
 
+sub wafproxy_javascript {
+    my ($dom) = @_;
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function updateWAF() {
+    if (document.getElementById('wafproxy_remoteip')) {
+        var wafremote = 0;
+        if (document.display.wafproxy_remoteip.options[document.display.wafproxy_remoteip.selectedIndex].value == 'h') {
+            wafremote = 1;
+        }
+        var fields = new Array('header','trust');
+        for (var i=0; i<fields.length; i++) {
+            if (document.getElementById('wafproxy_'+fields[i])) {
+                if (wafremote == 1) {
+                    document.getElementById('wafproxy_'+fields[i]).style.display = 'table-row';
+                }
+                else {
+                    document.getElementById('wafproxy_'+fields[i]).style.display = 'none';
+                }
+            }
+        }
+        if (document.getElementById('wafproxyranges_$dom')) {
+            if (wafremote == 1) {
+                document.getElementById('wafproxyranges_$dom').style.display = 'inline-block';
+            } else {
+                for (var i=0; i<document.display.wafproxy_vpnaccess.length; i++) {
+                    if (document.display.wafproxy_vpnaccess[i].checked) {
+                        if (document.display.wafproxy_vpnaccess[i].value == 0) {
+                            document.getElementById('wafproxyranges_$dom').style.display = 'none';
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return;
+}
+
+function checkWAF() {
+    if (document.getElementById('wafproxy_remoteip')) {
+        var wafvpn = 0;
+        for (var i=0; i<document.display.wafproxy_vpnaccess.length; i++) {
+            if (document.display.wafproxy_vpnaccess[i].checked) {
+                if (document.display.wafproxy_vpnaccess[i].value == 1) {
+                    wafvpn = 1;
+                }
+                break;
+            }
+        }
+        var vpn = new Array('vpnint','vpnext');
+        for (var i=0; i<vpn.length; i++) {
+            if (document.getElementById('wafproxy_show_'+vpn[i])) {
+                if (wafvpn == 1) {
+                    document.getElementById('wafproxy_show_'+vpn[i]).style.display = 'table-row';
+                }
+                else {
+                    document.getElementById('wafproxy_show_'+vpn[i]).style.display = 'none';
+                }
+            }
+        }
+        if (document.getElementById('wafproxyranges_$dom')) {
+            if (wafvpn == 1) {
+                document.getElementById('wafproxyranges_$dom').style.display = 'inline-block';
+            }
+            else if (document.display.wafproxy_remoteip.options[document.display.wafproxy_remoteip.selectedIndex].value != 'h') {
+                document.getElementById('wafproxyranges_$dom').style.display = 'none';
+            }
+        }
+    }
+    return;
+}
+
+function toggleWAF() {
+    if (document.getElementById('wafproxy_table')) {
+        var wafproxy = 0;
+        for (var i=0; i<document.display.wafproxy_${dom}.length; i++) {
+             if (document.display.wafproxy_${dom}[i].checked) {
+                 if (document.display.wafproxy_${dom}[i].value == 1) {
+                     wafproxy = 1;
+                     break;
+                }
+            }
+        }
+        if (wafproxy == 1) {
+            document.getElementById('wafproxy_table').style.display='inline';
+        }
+        else {
+           document.getElementById('wafproxy_table').style.display='none';
+        }
+        if (document.getElementById('wafproxyrow_${dom}')) {
+            if (wafproxy == 1) {
+                document.getElementById('wafproxyrow_${dom}').style.display = 'table-row';
+            }
+            else {
+                document.getElementById('wafproxyrow_${dom}').style.display = 'none';
+            }
+        }
+        if (document.getElementById('nowafproxyrow_$dom')) {
+            if (wafproxy == 1) {
+                document.getElementById('nowafproxyrow_${dom}').style.display = 'none';
+            }
+            else {
+                document.getElementById('nowafproxyrow_${dom}').style.display = 'table-row';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
 sub proctoring_javascript {
     my ($settings) = @_;
     my (%ordered,$total,%jstext);
@@ -3781,18 +3898,17 @@ sub print_contacts {
                                                    \%choices,$rownum);
         $datatable .= $reports;
     } elsif ($position eq 'lower') {
-        $css_class = $rownum%2?' class="LC_odd_row"':'';
-        my ($threshold,$sysmail,%excluded,%weights);
+        my (%current,%excluded,%weights);
         my ($defaults,$names) = &Apache::loncommon::lon_status_items();
         if ($lonstatus{'threshold'} =~ /^\d+$/) {
-            $threshold = $lonstatus{'threshold'};
+            $current{'errorthreshold'} = $lonstatus{'threshold'};
         } else {
-            $threshold = $defaults->{'threshold'};
+            $current{'errorthreshold'} = $defaults->{'threshold'};
         }
         if ($lonstatus{'sysmail'} =~ /^\d+$/) {
-            $sysmail = $lonstatus{'sysmail'};
+            $current{'errorsysmail'} = $lonstatus{'sysmail'};
         } else {
-            $sysmail = $defaults->{'sysmail'};
+            $current{'errorsysmail'} = $defaults->{'sysmail'};
         }
         if (ref($lonstatus{'weights'}) eq 'HASH') {
             foreach my $type ('E','W','N','U') {
@@ -3812,13 +3928,16 @@ sub print_contacts {
                 map {$excluded{$_} = 1; } @{$lonstatus{'excluded'}};
             }
         }
-        $datatable .= '<tr'.$css_class.'>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      $titles->{'errorthreshold'}.
-                      '</span></td><td class="LC_left_item">'.
-                      '<input type="text" name="errorthreshold" value="'.
-                      $threshold.'" size="5" /></td></tr>';
-        $rownum ++;
+        foreach my $item ('errorthreshold','errorsysmail') { 
+            $css_class = $rownum%2?' class="LC_odd_row"':'';
+            $datatable .= '<tr'.$css_class.'>'.
+                          '<td class="LC_left_item"><span class="LC_nobreak">'.
+                          $titles->{$item}.
+                          '</span></td><td class="LC_left_item">'.
+                          '<input type="text" name="'.$item.'" value="'.
+                          $current{$item}.'" size="5" /></td></tr>';
+            $rownum ++;
+        }
         $css_class = $rownum%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'>'.
                       '<td class="LC_left_item">'.
@@ -3864,14 +3983,6 @@ sub print_contacts {
         }
         $datatable .= '</tr></table></td></tr>';
         $rownum ++;
-        $css_class = $rownum%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      $titles->{'errorsysmail'}.
-                      '</span></td><td class="LC_left_item">'.
-                      '<input type="text" name="errorsysmail" value="'.
-                      $sysmail.'" size="5" /></td></tr>';
-        $rownum ++;
     } elsif ($position eq 'bottom') {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
         my (@posstypes,%usertypeshash);
@@ -6161,7 +6272,7 @@ sub print_coursedefaults {
         my $currcanclone = 'none';
         my $onclick;
         my @cloneoptions = ('none','domain');
-        my %clonetitles = (
+        my %clonetitles = &Apache::lonlocal::texthash (
                              none     => 'No additional course requesters',
                              domain   => "Any course requester in course's domain",
                              instcode => 'Course requests for official courses ...',
@@ -7184,32 +7295,43 @@ sub print_wafproxy {
     my $itemcount = 0;
     my $datatable;
     my %servers = &Apache::lonnet::internet_dom_servers($dom);
-    my (%othercontrol,%otherdoms,%aliases,%values,$setdom);
+    my (%othercontrol,%otherdoms,%aliases,%values,$setdom,$showdom);
     my %lt = &wafproxy_titles();
     foreach my $server (sort(keys(%servers))) {
         my $serverhome = &Apache::lonnet::get_server_homeID($servers{$server});
+        next if ($serverhome eq '');
         my $serverdom;
         if ($serverhome ne $server) {
             $serverdom = &Apache::lonnet::host_domain($serverhome);
-            $othercontrol{$server} = $serverdom;
+            if (($serverdom ne '') && (&Apache::lonnet::domain($serverdom) ne '')) {
+                $othercontrol{$server} = $serverdom;
+            }
         } else {
             $serverdom = &Apache::lonnet::host_domain($server);
+            next if (($serverdom eq '') || (&Apache::lonnet::domain($serverdom) eq ''));
             if ($serverdom ne $dom) {
                 $othercontrol{$server} = $serverdom;
             } else {
                 $setdom = 1;
                 if (ref($settings) eq 'HASH') {
-                    %{$values{$dom}} = ();
                     if (ref($settings->{'alias'}) eq 'HASH') {
                         $aliases{$dom} = $settings->{'alias'};
-                    }
-                    foreach my $item ('ipheader','trusted','exempt') {
-                        $values{$dom}{$item} = $settings->{$item};
+                        if ($aliases{$dom} ne '') {
+                            $showdom = 1;
+                        }
                     }
                 }
             }
         }
     }
+    if ($setdom) {
+        %{$values{$dom}} = ();
+        if (ref($settings) eq 'HASH') {
+            foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
+                $values{$dom}{$item} = $settings->{$item};
+            }
+        }
+    }
     if (keys(%othercontrol)) {
         %otherdoms = reverse(%othercontrol);
         foreach my $domain (keys(%otherdoms)) {
@@ -7218,7 +7340,7 @@ sub print_wafproxy {
             if (ref($config{$domain}) eq 'HASH') {
                 if (ref($config{$domain}{'wafproxy'}) eq 'HASH') {
                     $aliases{$domain} = $config{$domain}{'wafproxy'}{'alias'};
-                    foreach my $item ('ipheader','trusted','exempt') {
+                    foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
                         $values{$domain}{$item} = $config{$domain}{'wafproxy'}{$item};
                     }
                 }
@@ -7227,61 +7349,166 @@ sub print_wafproxy {
     }
     if ($position eq 'top') {
         my %servers = &Apache::lonnet::internet_dom_servers($dom);
+        my %aliasinfo;
         foreach my $server (sort(keys(%servers))) {
-            $itemcount ++; 
-            $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
-            $datatable .= '<tr'.$css_class.'>'.
-                          '<td>'.&mt('Hostname').':&nbsp;'.
-                                &Apache::lonnet::hostname($server).'</td>'.
-                          '<td class="LC_right_item">';
+            $itemcount ++;
+            my $dom_in_effect;
+            my $aliasrows = '<tr>'.
+                            '<td class="LC_left_item">'.&mt('Hostname').':&nbsp;'.
+                            &Apache::lonnet::hostname($server).'</td>';
             if ($othercontrol{$server}) {
+                $dom_in_effect = $othercontrol{$server};
                 my $current;
                 if (ref($aliases{$othercontrol{$server}}) eq 'HASH') {
                     $current = $aliases{$othercontrol{$server}{$server}};
                 }
                 if ($current) {
-                    $datatable .= $current;
+                    $aliasrows .= $current;
                 } else {
-                    $datatable .= &mt('None in effect');
+                    $aliasrows .= &mt('None in effect');
                 }
-                $datatable .= '<br /><span class="LC_small">('.
+                $aliasrows .= '<td class="LC_left_item"><span class="LC_small">('.
                               &mt('WAF/Reverse Proxy controlled by domain: [_1]',
-                                  '<b>'.$othercontrol{$server}.'</b>').'</span>';
+                                  '<b>'.$othercontrol{$server}.'</b>').'</span></td>';
             } else {
+                $dom_in_effect = $dom;
                 my $current;
                 if (ref($aliases{$dom}) eq 'HASH') {
                     if ($aliases{$dom}{$server}) {
                         $current = $aliases{$dom}{$server};
                     }
                 }
-                $datatable .= '<input type="text" name="wafproxy_alias_'.$server.'" '.
-                              'value="'.$current.'" size="30" />';
+                $aliasrows .= '<td class="LC_left_item">'.&mt('WAF/Reverse Proxy Alias').':&nbsp;'.
+                              '<input type="text" name="wafproxy_alias_'.$server.'" '.
+                              'value="'.$current.'" size="30" /></td>';
+            }
+            $aliasrows .= '</tr>';
+            $aliasinfo{$dom_in_effect} .= $aliasrows;
+        }
+        if ($aliasinfo{$dom}) {
+            my ($onclick,$wafon,$wafoff,$showtable);
+            $onclick = ' onclick="javascript:toggleWAF();"';
+            $wafoff = ' checked="checked"';
+            $showtable = ' style="display:none";';
+            if ($showdom) {
+                $wafon = $wafoff;
+                $wafoff = '';
+                $showtable = ' style="display:inline;"';
+            }
+            $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+            $datatable = '<tr'.$css_class.'>'.
+                         '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'<br />'.
+                         '<span class="LC_nobreak">'.&mt('WAF in use?').'&nbsp;<label>'.
+                         '<input type="radio" name="wafproxy_'.$dom.'" value="1"'.$wafon.$onclick.' />'.
+                         &mt('Yes').'</label>'.('&nbsp;'x2).'<label>'.
+                         '<input type="radio" name="wafproxy_'.$dom.'" value="0"'.$wafoff.$onclick.' />'.
+                         &mt('No').'</label></span></td>'.
+                         '<td class="LC_left_item">'.
+                         '<table id="wafproxy_table"'.$showtable.'>'.$aliasinfo{$dom}.
+                         '</table></td></tr>';
+            $itemcount++;
+        }
+        if (keys(%othercontrol)) {
+            foreach my $key (sort(keys(%othercontrol))) {
+                $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+                $datatable = '<tr'.$css_class.'>'.
+                             '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$key.'</b>').'</td>'.
+                             '<td class="LC_left_item"><table>'.$aliasinfo{$key}.
+                             '</table></td></tr>';
+                $itemcount++;
             }
-            $datatable .= '</td></tr>';
         }
     } else {
         if ($setdom) {
             $itemcount ++;
             $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
-            $datatable .= '<tr'.$css_class.'>'.
+            my ($nowafstyle,$wafstyle,$curr_remotip,$currwafdisplay,$vpndircheck,$vpnaliascheck,
+                $currwafvpn,$wafrangestyle,$alltossl,$ssltossl);
+            $wafstyle = ' style="display:none;"';
+            $nowafstyle = ' style="display:table-row;"';
+            $currwafdisplay = ' style="display: none"';
+            $wafrangestyle = ' style="display: none"';
+            $curr_remotip = 'n';
+            $ssltossl = ' checked="checked"';
+            if ($showdom) {
+                $wafstyle = ' style="display:table-row;"';
+                $nowafstyle =  ' style="display:none;"';
+                if (keys(%{$values{$dom}})) {
+                    if ($values{$dom}{remoteip} =~ /^[nmh]$/) {
+                        $curr_remotip = $values{$dom}{remoteip};
+                    }
+                    if ($curr_remotip eq 'h') {
+                        $currwafdisplay = ' style="display:table-row"';
+                        $wafrangestyle = ' style="display:inline-block;"';
+                    }
+                    if ($values{$dom}{'sslopt'}) {
+                        $alltossl = ' checked="checked"';
+                        $ssltossl = '';
+                    }
+                }
+                if (($values{$dom}{'vpnint'} ne '') || ($values{$dom}{'vpnext'} ne '')) {
+                    $vpndircheck = ' checked="checked"';
+                    $currwafvpn = ' style="display:table-row;"';
+                    $wafrangestyle = ' style="display:inline-block;"';
+                } else {
+                    $vpnaliascheck = ' checked="checked"';
+                    $currwafvpn = ' style="display:none;"';
+                }
+            }
+            $datatable .= '<tr'.$css_class.' id="nowafproxyrow_'.$dom.'"'.$wafstyle.'>'.
+                          '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'</td>'.
+                          '<td class="LC_right_item">'.&mt('WAF not in use, nothing to set').'</td>'.
+                          '</tr>'.
+                          '<tr'.$css_class.' id="wafproxyrow_'.$dom.'"'.$wafstyle.'>'.
                           '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'<br /><br />'.
-                          &mt('Format for comma separated IP blocks').':<br />'.
-                          &mt('A.B.C.D/N or A.B.C.D - E.F.G.H').'</td>'.
-                          '<td class="LC_left_item"><table>';
-            foreach my $item ('ipheader','trusted','exempt') {
-                $datatable .= '<tr>'.
-                              '<td valign="top">'.$lt{$item}.':&nbsp;';
-                if ($item eq 'ipheader') {
-                    $datatable .= '<input type="text" value="'.$values{$dom}{$item}.'" '.
-                                  'name="wafproxy_'.$item.'" />';
- 
-                } else {
-                    $datatable .= '<textarea name="wafproxy_'.$item.'" rows="3" cols="80">'.
-                                  $values{$dom}{$item}.'</textarea>';
-                }
-                $datatable .= '</td></tr>';
-            }
-            $datatable .= '</table></td></tr>';
+                          '<div id="wafproxyranges_'.$dom.'">'.&mt('Format for comma separated IP ranges').':<br />'.
+                          &mt('A.B.C.D/N or A.B.C.D-E.F.G.H').'</div></td>'.
+                          '<td class="LC_left_item"><table>'.
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'remoteip'}.':&nbsp;'.
+                          '<select name="wafproxy_remoteip" id="wafproxy_remoteip" onchange="javascript:updateWAF();">';
+            my %ip_methods = &remoteip_methods();
+            foreach my $option ('m','h','n') {
+                my $sel;
+                if ($option eq $curr_remotip) {
+                   $sel = ' selected="selected"';
+                }
+                $datatable .= '<option value="'.$option.'"'.$sel.'>'.
+                              $ip_methods{$option}.'</option>';
+            }
+            $datatable .= '</select></td></tr>'."\n".
+                          '<tr id="wafproxy_header"'.$currwafdisplay.'><td>'.
+                          $lt{'ipheader'}.':&nbsp;'.
+                          '<input type="text" value="'.$values{$dom}{'ipheader'}.'" '.
+                          'name="wafproxy_ipheader" />'.
+                          '</td></tr>'."\n".
+                          '<tr id="wafproxy_trust"'.$currwafdisplay.'><td>'.
+                          $lt{'trusted'}.':<br />'.
+                          '<textarea name="wafproxy_trusted" rows="3" cols="80">'.
+                          $values{$dom}{'trusted'}.'</textarea>'.
+                          '</td></tr>'."\n".
+                          '<tr><td><hr /></td></tr>'."\n".
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'vpnaccess'}.':<br /><span class="LC_nobreak">'.
+                          '<label><input type="radio" name="wafproxy_vpnaccess"'.$vpndircheck.' value="1" onclick="javascript:checkWAF();" />'.
+                          $lt{'vpndirect'}.'</label>'.('&nbsp;'x2).
+                          '<label><input type="radio" name="wafproxy_vpnaccess"'.$vpnaliascheck.' value="0" onclick="javascript:checkWAF();" />'.
+                          $lt{'vpnaliased'}.'</label></span></td></tr>';
+            foreach my $item ('vpnint','vpnext') {
+                $datatable .= '<tr id="wafproxy_show_'.$item.'"'.$currwafvpn.'>'.
+                              '<td valign="top">'.$lt{$item}.':<br />'.
+                              '<textarea name="wafproxy_'.$item.'" rows="3" cols="80">'.
+                              $values{$dom}{$item}.'</textarea>'.
+                              '</td></tr>'."\n";
+            }
+            $datatable .= '<tr><td><hr /></td></tr>'."\n".
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'sslopt'}.':<br /><span class="LC_nobreak">'.
+                          '<label><input type="radio" name="wafproxy_sslopt"'.$alltossl.' value="1" />'.
+                          $lt{'alltossl'}.'</label>'.('&nbsp;'x2).
+                          '<label><input type="radio" name="wafproxy_sslopt"'.$ssltossl.' value="0" />'.
+                          $lt{'ssltossl'}.'</label></span></td></tr>'."\n".
+                          '</table></td></tr>';
         }
         if (keys(%otherdoms)) {
             foreach my $domain (sort(keys(%otherdoms))) {
@@ -7290,15 +7517,21 @@ sub print_wafproxy {
                 $datatable .= '<tr'.$css_class.'>'.
                               '<td class="LC_left_item">'.&mt('Domain: [_1]',$domain).'</td>'.
                               '<td class="LC_left_item"><table>';
-                foreach my $item ('ipheader','trusted','exempt') {
+                foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
                     my $showval = &mt('None');
+                    if ($item eq 'ssl') {
+                        $showval = $lt{'ssltossl'};
+                    }
                     if ($values{$domain}{$item}) {
-                        $showval = $values{$domain}{$item}; 
+                        $showval = $values{$domain}{$item};
+                        if ($item eq 'ssl') {
+                            $showval = $lt{'alltossl'};
+                        }
                     }
                     $datatable .= '<tr>'.
                                   '<td>'.$lt{$item}.':&nbsp;'.$showval.'</td></tr>';
                 }
-                $datatable .= '</table></td></tr>'; 
+                $datatable .= '</table></td></tr>';
             }
         }
     }
@@ -7308,9 +7541,25 @@ sub print_wafproxy {
 
 sub wafproxy_titles {
     return &Apache::lonlocal::texthash(
-               exempt => 'Exempt IP range(s)',
-               trusted => 'Trusted IP range(s)',
-               ipheader => 'Custom request header',
+               remoteip   => "Method for determining user's IP",
+               ipheader   => 'Request header containing remote IP',
+               trusted    => 'Trusted IP range(s)',
+               vpnaccess  => 'Access from institutional VPN',
+               vpndirect  => 'via regular hostname (no WAF)',
+               vpnaliased => 'via aliased hostname (WAF)',
+               vpnint     => 'Internal IP Range(s) for VPN sessions',
+               vpnext     => 'IP Range(s) for backend WAF connections',
+               sslopt     => 'Forwarding http/https',
+               alltossl   => 'WAF forwards both http and https requests to https',
+               ssltossl   => 'WAF forwards http requests to http and https to https',
+           );
+}
+
+sub remoteip_methods {
+    return &Apache::lonlocal::texthash(
+              m => 'Use Apache mod_remoteip',
+              h => 'Use headers parsed by LON-CAPA',
+              n => 'Not in use',
            );
 }
 
@@ -8349,8 +8598,8 @@ sub contact_titles {
                    'updatesmail'     => 'E-mail from nightly check of LON-CAPA module integrity/updates',
                    'idconflictsmail' => 'E-mail from bi-nightly check for multiple users sharing same student/employee ID',
                    'hostipmail'      => 'E-mail from nightly check of hostname/IP network changes',
-                   'errorthreshold'  => 'Error/warning threshold for status e-mail',
-                   'errorsysmail'    => 'Error threshold for e-mail to core group',
+                   'errorthreshold'  => 'Error count threshold for status e-mail to admin(s)',
+                   'errorsysmail'    => 'Error count threshold for e-mail to developer group',
                    'errorweights'    => 'Weights used to compute error count',
                    'errorexcluded'   => 'Servers with unsent updates excluded from count',
                  );
@@ -9400,7 +9649,7 @@ sub print_defaults {
                     $datatable .= '</select>&nbsp;'.&mt('Internal ID:').'&nbsp;<b>'.$item.'</b>&nbsp;'.
                                   '<input type="checkbox" name="inststatus_delete" value="'.$item.'" />'.
                                   &mt('delete').'</span></td>'.
-                                  '<td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.&mt('Name displayed:').
+                                  '<td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.&mt('Name displayed').':'.
                                   '<input type="text" size="20" name="inststatus_title_'.$item.'" value="'.$title.'" />'.
                                   '</span></td></tr>';
                 }
@@ -9420,7 +9669,7 @@ sub print_defaults {
                               '<input type="text" size="10" name="addinststatus" value="" />'.
                               '&nbsp;'.&mt('(new)').
                               '</span></td><td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.
-                              &mt('Name displayed:').
+                              &mt('Name displayed').':'.
                               '<input type="text" size="20" name="addinststatus_title" value="" /></span></td>'.
                               '</tr>'."\n";
                 $rownum ++;
@@ -10429,7 +10678,7 @@ ENDSCRIPT
 sub initialize_categories {
     my ($itemcount) = @_;
     my ($datatable,$css_class,$chgstr);
-    my %default_names = (
+    my %default_names = &Apache::lonlocal::texthash (
                       instcode    => 'Official courses (with institutional codes)',
                       communities => 'Communities',
                       placement   => 'Placement Tests',
@@ -15204,7 +15453,7 @@ sub modify_contacts {
                 $contacts_hash{'contacts'}{'lonstatus'}{$item} = \@excluded;
             }
         } elsif ($item eq 'weights') {
-            foreach my $type ('E','W','N') {
+            foreach my $type ('E','W','N','U') {
                 $env{'form.error'.$item.'_'.$type} =~ s/^\s+|\s+$//g;
                 if ($env{'form.error'.$item.'_'.$type} =~ /^\d+$/) {
                     unless ($env{'form.error'.$item.'_'.$type} == $lonstatus_defs->{$type}) {
@@ -16371,7 +16620,7 @@ sub modify_passwords {
                                 $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
                             }
                         } else {
-                            $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA usedfor verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
+                            $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
                         }
                         if ($confighash{'passwords'}{'resetremove'}) {
                             $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" web form not shown').'</li>';
@@ -19587,26 +19836,33 @@ sub modify_wafproxy {
             my $serverdom = &Apache::lonnet::host_domain($server);
             if ($serverdom eq $dom) {
                 $canset{$server} = 1;
-                if (ref($domconfig{'wafproxy'}) eq 'HASH') {
-                    %{$values{$dom}} = ();
-                    if (ref($domconfig{'wafproxy'}{'alias'}) eq 'HASH') {
-                        %curralias = %{$domconfig{'wafproxy'}{'alias'}};
-                    }
-                    foreach my $item ('ipheader','trusted','exempt') {
-                        $currvalue{$item} = $domconfig{'wafproxy'}{$item};
-                    }
-                }
             }
         }
     }
+    if (ref($domconfig{'wafproxy'}) eq 'HASH') {
+        %{$values{$dom}} = ();
+        if (ref($domconfig{'wafproxy'}{'alias'}) eq 'HASH') {
+            %curralias = %{$domconfig{'wafproxy'}{'alias'}};
+        }
+        foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+            $currvalue{$item} = $domconfig{'wafproxy'}{$item};
+        }
+    }
     my $output;
     if (keys(%canset)) {
         %{$wafproxy{'alias'}} = ();
         foreach my $key (sort(keys(%canset))) {
-            $wafproxy{'alias'}{$key} = $env{'form.wafproxy_alias_'.$key};
-            $wafproxy{'alias'}{$key} =~ s/^\s+|\s+$//g;
-            if ($wafproxy{'alias'}{$key} ne $curralias{$key}) {
-                $changes{'alias'} = 1;
+            if ($env{'form.wafproxy_'.$dom}) {
+                $wafproxy{'alias'}{$key} = $env{'form.wafproxy_alias_'.$key};
+                $wafproxy{'alias'}{$key} =~ s/^\s+|\s+$//g;
+                if ($wafproxy{'alias'}{$key} ne $curralias{$key}) {
+                    $changes{'alias'} = 1;
+                }
+            } else {
+                $wafproxy{'alias'}{$key} = '';
+                if ($curralias{$key}) {
+                    $changes{'alias'} = 1;
+                }
             }
             if ($wafproxy{'alias'}{$key} eq '') {
                 if ($curralias{$key}) {
@@ -19621,21 +19877,43 @@ sub modify_wafproxy {
         # Localization for values in %warn occus in &mt() calls separately.
         my %warn = (
                      trusted => 'trusted IP range(s)',
-                     exempt => 'exempt IP range(s)', 
+                     vpnint => 'internal IP range(s) for VPN sessions(s)',
+                     vpnext => 'IP range(s) for backend WAF connections',
                    );
-        foreach my $item ('ipheader','trusted','exempt') {
+        foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
             my $possible = $env{'form.wafproxy_'.$item};
             $possible =~ s/^\s+|\s+$//g;
             if ($possible ne '') {
-                if ($item eq 'ipheader') {
-                    $wafproxy{$item} = $possible;
+                if ($item eq 'remoteip') {
+                    if ($possible =~ /^[mhn]$/) {
+                        $wafproxy{$item} = $possible;
+                    }
+                } elsif ($item eq 'ipheader') {
+                    if ($wafproxy{'remoteip'} eq 'h') {
+                        $wafproxy{$item} = $possible;
+                    }
+                } elsif ($item eq 'sslopt') {
+                    if ($possible =~ /^0|1$/) {
+                        $wafproxy{$item} = $possible;
+                    }
                 } else {
                     my (@ok,$count);
-                    $possible =~ s/[\r\n]+/\s/g;
-                    $possible =~ s/\s*-\s*/-/g;
-                    $possible =~ s/\s+/,/g;
+                    if (($item eq 'vpnint') || ($item eq 'vpnext')) {
+                        unless ($env{'form.wafproxy_vpnaccess'}) {
+                            $possible = '';
+                        }
+                    } elsif ($item eq 'trusted') {
+                        unless ($wafproxy{'remoteip'} eq 'h') {
+                            $possible = '';
+                        }
+                    }
+                    unless ($possible eq '') {
+                        $possible =~ s/[\r\n]+/\s/g;
+                        $possible =~ s/\s*-\s*/-/g;
+                        $possible =~ s/\s+/,/g;
+                    }
                     $count = 0;
-                    if ($possible) {
+                    if ($possible ne '') {
                         foreach my $poss (split(/\,/,$possible)) {
                             $count ++;
                             if (&validate_ip_pattern($poss)) {
@@ -19652,15 +19930,22 @@ sub modify_wafproxy {
                                      $diff,$warn{$item}).
                                  '</li>');
                         }
-                        if ($wafproxy{$item} ne $currvalue{$item}) {
-                            $changes{$item} = 1; 
-                        }
                     }
                 }
-            } else {
-                if ($currvalue{$item}) {
+                if ($wafproxy{$item} ne $currvalue{$item}) {
                     $changes{$item} = 1;
                 }
+            } elsif ($currvalue{$item}) {
+                $changes{$item} = 1;
+            } 
+        }
+    } else {
+        if (keys(%curralias)) {
+            $changes{'alias'} = 1;
+        } 
+        if (keys(%currvalue)) {
+            foreach my $key (keys(%currvalue)) {
+                $changes{$key} = 1;
             }
         }
     }
@@ -19673,7 +19958,7 @@ sub modify_wafproxy {
         if ($putresult eq 'ok') {
             my $cachetime = 24*60*60;
             my (%domdefaults,$updatedomdefs);
-            foreach my $item ('ipheader','trusted','exempt') {
+            foreach my $item ('ipheader','trusted','vpnint','vpnext','sslopt') {
                 if ($changes{$item}) {
                     unless ($updatedomdefs) {
                         %domdefaults = &Apache::lonnet::get_domain_defaults($dom);
@@ -19710,7 +19995,7 @@ sub modify_wafproxy {
                 }
             }
             $output = &mt('Changes were made to Web Application Firewall/Reverse Proxy').'<ul>';
-            foreach my $item ('alias','ipheader','trusted','exempt') {
+            foreach my $item ('alias','remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
                 if ($changes{$item}) {
                     if ($item eq 'alias') {
                         my $numaliased = 0;
@@ -19733,26 +20018,52 @@ sub modify_wafproxy {
                             $output .= '<li>'.&mt('Aliases deleted for hostnames').'</li>';
                         }
                     } else {
-                        if ($item eq 'ipheader') {
+                        if ($item eq 'remoteip') {
+                            my %ip_methods = &remoteip_methods();
+                            if ($wafproxy{$item} =~ /^[mh]$/) {
+                                $output .= '<li>'.&mt("Method for determining user's IP set to: [_1]",
+                                                      $ip_methods{$wafproxy{$item}}).'</li>';
+                            } else {
+                                if (($env{'form.wafproxy_'.$dom}) && (ref($wafproxy{'alias'}) eq 'HASH')) {
+                                    $output .= '<li>'.&mt("No method in use to get user's real IP (will report IP used by WAF).").
+                                               '</li>';
+                                } else {
+                                    $output .= '<li>'.&mt('WAF/Reverse Proxy not in use').'</li>';
+                                }
+                            }
+                        } elsif ($item eq 'ipheader') {
                             if ($wafproxy{$item}) {
-                                $output .= '<li>'.&mt('Custom request header set to [_1]',
+                                $output .= '<li>'.&mt('Request header with remote IP set to: [_1]',
                                                       $wafproxy{$item}).'</li>';
                             } else {
-                                $output .= '<li>'.&mt('Custom request header deleted').'</li>';
+                                $output .= '<li>'.&mt('Request header with remote IP deleted').'</li>';
                             }
                         } elsif ($item eq 'trusted') {
                             if ($wafproxy{$item}) {
-                                $output .= '<li>'.&mt('Trusted IP range(s) set to [_1]',
+                                $output .= '<li>'.&mt('Trusted IP range(s) set to: [_1]',
                                                       $wafproxy{$item}).'</li>';
                             } else {
                                 $output .= '<li>'.&mt('Trusted IP range(s) deleted').'</li>';
                             }
-                        } elsif ($item eq 'exempt') {
+                        } elsif ($item eq 'vpnint') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('Internal IP Range(s) for VPN sessions set to: [_1]',
+                                                       $wafproxy{$item}).'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('Internal IP Range(s) for VPN sessions deleted').'</li>';
+                            }
+                        } elsif ($item eq 'vpnext') {
                             if ($wafproxy{$item}) {
-                                $output .= '<li>'.&mt('Exempt IP range(s) set to [_1]',
+                                $output .= '<li>'.&mt('IP Range(s) for backend WAF connections set to: [_1]',
                                                        $wafproxy{$item}).'</li>';
                             } else {
-                                $output .= '<li>'.&mt('Exempt IP range(s) deleted').'</li>';
+                                $output .= '<li>'.&mt('IP Range(s) for backend WAF connections deleted').'</li>';
+                            }
+                        } elsif ($item eq 'sslopt') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('WAF/Reverse Proxy expected to forward requests to https on LON-CAPA node, regardless of original protocol in web browser (http or https).').'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('WAF/Reverse Proxy expected to preserve original protocol in web browser (either http or https) when forwarding to LON-CAPA node.').'</li>';
                             }
                         }
                     }
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
misconfiguration and was unable to complete
your request.</p>
<p>Please contact the server administrator at 
 root@localhost to inform them of the time this error occurred,
 and the actions you performed just before this error.</p>
<p>More information about this error may be available
in the server error log.</p>
</body></html>