Bfp whitelists.ag

lib/CleantalkSP/SpbctWP/Firewall/BFP.php

@@ -2,8 +2,10 @@
 
 namespace CleantalkSP\SpbctWP\Firewall;
 
+use CleantalkSP\SpbctWP\DB;
 use CleantalkSP\SpbctWP\Helpers\Helper;
 use CleantalkSP\Security\Firewall\Result;
+use CleantalkSP\SpbctWP\Helpers\IP;
 
 class BFP extends FirewallModule
 {
@@ -17,6 +19,7 @@ class BFP extends FirewallModule
 
     protected $chance_to_clean = 100; // Chance to clean log table from old entries. In percents.
     public static $is_checked = false;
+    protected $use_fw_personal_whitelists = false;
 
     /**
      * @psalm-suppress PossiblyUnusedProperty
@@ -33,6 +36,7 @@ public function __construct($params = array())
     {
         $params['count_period'] = $params['count_period'] ?: $this->count_period;
         $params['block_period'] = $params['block_period'] ?: $this->block_period;
+        $this->use_fw_personal_whitelists = !empty($params['use_fw_personal_whitelists']) ?: $this->use_fw_personal_whitelists;
 
         parent::__construct($params);
     }
@@ -47,6 +51,11 @@ public function check()
 
         if ( ( $this->is_login_page && ! $this->is_logged_in ) || ( defined('XMLRPC_REQUEST') && XMLRPC_REQUEST ) ) {
             foreach ( $this->ip_array as $_ip_origin => $current_ip ) {
+                if ($this->use_fw_personal_whitelists && $this->isPersonalWhitelisted($current_ip)) {
+                    //probably we should log this case
+                    continue;
+                }
+
                 $rand                      = rand(1, 100000);
                 $md5_ip = md5($current_ip);
                 $query                     = "SELECT md5_ip as blocked
@@ -181,4 +190,53 @@ private function clearTable()
             }
         }
     }
+
+    /**
+     * Check if the IP is whitelisted in the personal FW whitelist.
+     * @param $current_ip
+     * @return bool
+     */
+    private function isPersonalWhitelisted($current_ip)
+    {
+        global $spbc;
+        $result = false;
+        $fw = new FW(
+            array(
+                'data_table__personal_countries' => SPBC_TBL_FIREWALL_DATA__COUNTRIES,
+                'log_table'                      => SPBC_TBL_FIREWALL_LOG,
+                'state'                          => $spbc,
+                'api_key'                        => $spbc->api_key,
+            )
+        );
+        $fw->setDb(new DB());
+        try {
+            $version = IP::validate($current_ip);
+            if ( $version === 'v6' ) {
+                //IPV6 handling logic
+                $db_results = $fw->ipv6GetResultsFromDb($current_ip);
+            } elseif ($version === 'v4') {
+                //IPV4 handling logic
+                $db_results = $fw->ipv4GetResultsFromDb($current_ip);
+            } else {
+                throw new \Exception('IP address record is invalid.');
+            }
+        } catch (\Exception $e) {
+            error_log('Security by CleanTalk. Firewall IP handling error: ' . $e->getMessage());
+        }
+        if (isset($db_results) && is_array($db_results)) {
+            foreach ($db_results as $_key => $result) {
+                if (
+                    isset($result['is_personal']) &&
+                    $result['is_personal'] === '1' &&
+                    isset($result['status']) &&
+                    $result['status'] === '1'
+                ) {
+                    $result = true;
+                    break;
+                }
+            }
+        }
+
+        return $result;
+    }
 }

lib/CleantalkSP/SpbctWP/Firewall/FW.php

@@ -144,7 +144,7 @@ public function check()
      * @param $ip
      * @return array|null|object
      */
-    protected function ipv4GetResultsFromDb($ip)
+    public function ipv4GetResultsFromDb($ip)
     {
         $current_ipv4 = sprintf('%u', ip2long($ip));
         $needles = IP::getNetworkNeedles([$current_ipv4]);
@@ -183,7 +183,7 @@ protected function ipv4GetResultsFromDb($ip)
      * @return array
      * @throws \Exception
      */
-    protected function ipv6GetResultsFromDb($ip)
+    public function ipv6GetResultsFromDb($ip)
     {
         $needles = IP::getNetworkNeedles(IP::getFourIPv4FromIP($ip));
         $data_table__common_v6 = SPBC_TBL_FIREWALL_DATA_V6;

security-malware-firewall.php

@@ -585,6 +585,7 @@ function spbc_authenticate__check_brute_force()
             'bf_limit'      => $spbc->settings['bfp__allowed_wrong_auths'],
             'block_period'  => $spbc->settings['bfp__block_period__5_fails'],
             'count_period'  => $spbc->settings['bfp__count_interval'],
+            'use_fw_personal_whitelists'  => true, //we can also manage it with settings
         )
     );