Protector::check_dos_attack()

Complexity

Conditions	34
Paths	196

Size

Total Lines	163
Code Lines	98

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
    public function check_dos_attack($uid = 0, $can_ban = false)
    {
        global $xoopsDB;

        if ($this->_done_dos) {
            return true;
        }

        $ip      = \Xmf\IPAddress::fromRequest();
        if (false === $ip->asReadable()) {

The condition false === $ip->asReadable() is always false.

            return true;
        }
        $uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';

        $ip4sql  = $xoopsDB->quote($ip->asReadable());
        $uri4sql = $xoopsDB->quote($uri);

        // gargage collection
        $result = $xoopsDB->queryF(
            'DELETE FROM ' . $xoopsDB->prefix($this->mydirname . '_access')
            . ' WHERE expire < UNIX_TIMESTAMP()'
        );

        // for older versions before updating this module
        if ($result === false) {
            $this->_done_dos = true;

            return true;
        }

        // sql for recording access log (INSERT should be placed after SELECT)
        $sql4insertlog = 'INSERT INTO ' . $xoopsDB->prefix($this->mydirname . '_access')
                         . " SET ip={$ip4sql}, request_uri={$uri4sql},"
                         . " expire=UNIX_TIMESTAMP()+'" . (int)$this->_conf['dos_expire'] . "'";

        // bandwidth limitation
        if (isset($this->_conf['bwlimit_count']) && $this->_conf['bwlimit_count'] >= 10) {
            $sql = 'SELECT COUNT(*) FROM ' . $xoopsDB->prefix($this->mydirname . '_access');
            $result = $xoopsDB->query($sql);
            if ($xoopsDB->isResultSet($result)) {
                list($bw_count) = $xoopsDB->fetchRow($result);
                if ($bw_count > $this->_conf['bwlimit_count']) {
                    $this->write_file_bwlimit(time() + $this->_conf['dos_expire']);
                }
            }
        }

        // F5 attack check (High load & same URI)

        $sql = 'SELECT COUNT(*) FROM ' . $xoopsDB->prefix($this->mydirname . '_access') . " WHERE ip={$ip4sql} AND request_uri={$uri4sql}";
        $result = $xoopsDB->query($sql);
        if (!$xoopsDB->isResultSet($result)) {
            throw new \RuntimeException(
                \sprintf(_DB_QUERY_ERROR, $sql) . $xoopsDB->error(), E_USER_ERROR
            );
        }
        list($f5_count) = $xoopsDB->fetchRow($result);
        if ($f5_count > $this->_conf['dos_f5count']) {

            // delayed insert
            $xoopsDB->queryF($sql4insertlog);

            // extends the expires of the IP with 5 minutes at least (pending)
            // $result = $xoopsDB->queryF( "UPDATE ".$xoopsDB->prefix($this->mydirname.'_access')." SET expire=UNIX_TIMESTAMP()+300 WHERE ip='$ip4sql' AND expire<UNIX_TIMESTAMP()+300" ) ;

            // call the filter first
            $ret = $this->call_filter('f5attack_overrun');

The assignment to $ret is dead and can be removed.

            // actions for F5 Attack
            $this->_done_dos       = true;
            $this->last_error_type = 'DoS';
            switch ($this->_conf['dos_f5action']) {
                default :
                case 'exit' :
                    $this->output_log($this->last_error_type, $uid, true, 16);
                    exit;

Using exit here is not recommended.

                case 'none' :
                    $this->output_log($this->last_error_type, $uid, true, 16);

                    return true;
                case 'biptime0' :
                    if ($can_ban) {
                        $this->register_bad_ips(time() + $this->_conf['banip_time0']);
                    }
                    break;
                case 'bip' :
                    if ($can_ban) {
                        $this->register_bad_ips();
                    }
                    break;
                case 'hta' :
                    if ($can_ban) {
                        $this->deny_by_htaccess();
                    }
                    break;
                case 'sleep' :
                    sleep(5);
                    break;
            }

            return false;
        }

        // Check its Agent
        if (trim($this->_conf['dos_crsafe']) != '' && isset($_SERVER['HTTP_USER_AGENT']) && preg_match($this->_conf['dos_crsafe'], $_SERVER['HTTP_USER_AGENT'])) {
            // welcomed crawler
            $this->_done_dos = true;

            return true;
        }

        // Crawler check (High load & different URI)
        $sql = 'SELECT COUNT(*) FROM ' . $xoopsDB->prefix($this->mydirname . '_access') . " WHERE ip={$ip4sql}";
        $result = $xoopsDB->query($sql);
        if (!$xoopsDB->isResultSet($result)) {
            return false;
        }
        list($crawler_count) = $xoopsDB->fetchRow($result);

        // delayed insert
        $xoopsDB->queryF($sql4insertlog);

        if ($crawler_count > $this->_conf['dos_crcount']) {

            // call the filter first
            $ret = $this->call_filter('crawler_overrun');

            // actions for bad Crawler
            $this->_done_dos       = true;
            $this->last_error_type = 'CRAWLER';
            switch ($this->_conf['dos_craction']) {
                default :
                case 'exit' :
                    $this->output_log($this->last_error_type, $uid, true, 16);
                    exit;

Using exit here is not recommended.

                case 'none' :
                    $this->output_log($this->last_error_type, $uid, true, 16);

                    return true;
                case 'biptime0' :
                    if ($can_ban) {
                        $this->register_bad_ips(time() + $this->_conf['banip_time0']);
                    }
                    break;
                case 'bip' :
                    if ($can_ban) {
                        $this->register_bad_ips();
                    }
                    break;
                case 'hta' :
                    if ($can_ban) {
                        $this->deny_by_htaccess();
                    }
                    break;
                case 'sleep' :
                    sleep(5);
                    break;
            }

            return false;
        }

        return true;
    }