OPNWAF - Exchange Template - catch-all HTTPS Redirect

[Zwiebelhacker]

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.
When using the OPNWAF Exchange Server template with the global “Redirect HTTP to HTTPS” option enabled, the root path / is not redirected to HTTPS.

For example:

http://webmail.example.com/

returns:

HTTP/1.1 403 Forbidden
Server: Apache

The generated HTTP virtual host contains redirects for the Exchange-specific paths /owa, /ecp and /Microsoft-Server-ActiveSync, but no catch-all redirect for /.

The generated configuration currently looks similar to:

<VirtualHost *:80>
    ServerName webmail.example.com
    Options -FollowSymLinks
    Options -Indexes
    Options -ExecCGI
    LogLevel warn
    ProxyRequests Off

    # Start ExchangeHttps
    Header always set X-Frame-Options SAMEORIGIN
    Header set Server Apache
    RequestHeader unset Expect early
    Header unset X-AspNet-Version
    Header unset X-OWA-Version
    Header unset X-Powered-By

    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^/owa(.*) https://webmail.example.com/owa$1 [R,L]
    RewriteRule ^/ecp(.*) https://webmail.example.com/ecp$1 [R,L]
    RewriteRule ^/Microsoft-Server-ActiveSync(.*) https://webmail.example.com/Microsoft-Server-ActiveSync$1 [R,L]

    # End ExchangeHttps
</VirtualHost>

Because / is neither redirected nor proxied, the request is handled directly by the OPNWAF Apache instance. Exchange/IIS never receives the request and therefore cannot perform its usual / → /owa redirect.

This appears inconsistent with the global “Redirect HTTP to HTTPS” option, which states:

“Enables a permanent redirect (301 Moved Permanently) from HTTP to HTTPS. This will bind the default HTTP port additionally for all virtual hosts.”

Describe the solution you'd like
I would like the OPNWAF Exchange Server HTTP template to apply a catch-all HTTP→HTTPS redirect to all paths, including /, when the global “Redirect HTTP to HTTPS” option is enabled.

For example, the generated configuration could contain a rule equivalent to:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://webmail.example.com/$1 [R=301,L]

This would result in the following flow:

http://webmail.example.com/
        ↓
      301
        ↓
https://webmail.example.com/
        ↓
      IIS
        ↓
      /owa

This would also make the Exchange template consistent with the documented behavior of the global HTTP→HTTPS redirect option.

Describe alternatives you've considered
One alternative would be to configure a separate redirect virtual host for the same hostname.

However, this seems unnecessarily complex and could potentially conflict with the existing Exchange virtual host configuration. I believe the redirect should preferably be handled directly by the Exchange HTTP template.

Another alternative would be to manually modify the generated gateway_vhosts.conf, but this is not suitable because the file is generated by OPNWAF and manual changes would likely be overwritten on configuration changes or reloads.

Best Regards
https://forum.opnsense.org/index.php?topic=52740.0