class-firewall-log.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall 4.9

ninjafirewall / lib / class-firewall-log.php

ninjafirewall / lib Last commit date

class-firewall-log.php

174 lines

1	<?php
2	/*
3	+=====================================================================+
4	\| _ _ _ _ _____ _ _ _ \|
5	\| \| \ \| (_)_ __ (_) __ _\| ___(_)_ __ _____ ____ _\| \| \| \|
6	\| \| \\| \| \| '_ \ \| \|/ _` \| \|_ \| \| '__/ _ \ \ /\ / / _` \| \| \| \|
7	\| \| \|\ \| \| \| \| \|\| \| (_\| \| _\| \| \| \| \| __/\ V V / (_\| \| \| \| \|
8	\| \|_\| \_\|_\|_\| \|_\|/ \|\__,_\|_\| \|_\|_\| \___\| \_/\_/ \__,_\|_\|_\| \|
9	\| \|__/ \|
10	\| (c) NinTechNet Limited ~ https://nintechnet.com/ \|
11	+=====================================================================+
12	*/
13
14	if ( class_exists('NinjaFirewall_log') ) {
15	return;
16	}
17
18	class NinjaFirewall_log {
19
20	/**
21	* Write event to the firewall log and return the incident ID.
22	*/
23	public static function write( $loginfo, $logdata, $loglevel, $ruleid, $nfw_options, $log ) {
24
25	/**
26	* Create a random incident number.
27	*/
28	$incidentID = mt_rand( 1000000, 9000000 );
29
30	/**
31	* INFO or sanitize: don't block.
32	*/
33	if ( $loglevel == NFWLOG_INFO ) {
34	$http_ret_code = '200';
35
36	} else {
37	/**
38	* Debugging : don't block but set loglevel to NFWLOG_DEBUG
39	* (it will display 'DEBUG_ON' in log).
40	*/
41	if (! empty( $nfw_options['debug'] ) ) {
42	$loglevel = NFWLOG_DEBUG;
43	$http_ret_code = '200';
44
45	} else {
46	$http_ret_code = $nfw_options['ret_code'];
47	}
48	}
49
50	/**
51	* Prepare the line to write to the log.
52	* Note: NFW_MAXPAYLOAD can be defined in the .htninja script.
53	*/
54	if ( defined('NFW_MAXPAYLOAD') ) {
55	$max_payload = ( int ) NFW_MAXPAYLOAD;
56	} else {
57	$max_payload = 200;
58	}
59	if ( strlen( $logdata ) > $max_payload ) {
60	$logdata = mb_substr( $logdata, 0, $max_payload, 'utf-8' ) .'...';
61	}
62	$res = '';
63	$string = str_split( $logdata );
64	foreach ( $string as $char ) {
65	/**
66	* Allow only ASCII printable characters.
67	*/
68	if ( ord( $char ) < 32 \|\| ord( $char ) > 126 ) {
69	$res .= '%'. bin2hex( $char );
70	} else {
71	$res .= $char;
72	}
73	}
74
75	$cur_month = date('Y-m');
76	$stat_file = "$log/stats_{$cur_month}.php";
77	$log_file = "$log/firewall_{$cur_month}.php";
78
79	/**
80	* Update stats.
81	*/
82	if ( is_file( $stat_file ) ) {
83	$stats = file_get_contents( $stat_file, FILE_IGNORE_NEW_LINES \| FILE_SKIP_EMPTY_LINES );
84	$stats = str_replace('<?php exit; ?>', '', $stats );
85	} else {
86	$stats = '0:0:0:0:0:0:0:0:0:0';
87	}
88	$stat_arr = explode(':', $stats .':');
89	++$stat_arr[ $loglevel ];
90
91	@ file_put_contents(
92	$stat_file,
93	"<?php exit; ?>{$stat_arr[0]}:{$stat_arr[1]}:{$stat_arr[2]}:{$stat_arr[3]}:{$stat_arr[4]}:" .
94	"{$stat_arr[5]}:{$stat_arr[6]}:{$stat_arr[7]}:{$stat_arr[8]}:{$stat_arr[9]}",
95	LOCK_EX
96	);
97
98	/**
99	* Create the log if it doesn't exist.
100	*/
101	if (! is_file( $log_file ) ) {
102	$tmp = "<?php exit; ?>\n";
103	} else {
104	$tmp = '';
105	}
106
107	/**
108	* If we reach this part during a brute-force attack,
109	* NFW_REMOTE_ADDR hasn't been initialized yet.
110	*/
111	if (! defined('NFW_REMOTE_ADDR') ) {
112	define('NFW_REMOTE_ADDR', $_SERVER['REMOTE_ADDR'] );
113	}
114
115	/**
116	* Encoding: NFW_LOG_ENCODING can be defined in the .htninja script (b64\|hex).
117	* Default: hex.
118	*/
119	if ( defined('NFW_LOG_ENCODING') ) {
120	if ( NFW_LOG_ENCODING == 'b64') {
121	$encoding = 'b64:'. base64_encode( $res );
122	} elseif ( NFW_LOG_ENCODING == 'none') {
123	$encoding = $res;
124	} else {
125	$unp = unpack('H*', $res );
126	$encoding = 'hex:'. array_shift( $unp );
127	}
128	} else {
129	$unp = unpack('H*', $res );
130	$encoding = 'hex:'. array_shift( $unp );
131	}
132
133	/**
134	* Only used by the plugin (post-detection).
135	*/
136	if ( $loglevel == NFWLOG_POSTDETECT ) {
137	$SCRIPT_NAME = '-';
138	$REQUEST_METHOD = 'N/A';
139	$REMOTE_ADDR = '0.0.0.0';
140	$loglevel = NFWLOG_INFO;
141	} else {
142	$SCRIPT_NAME = isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : $_SERVER['SCRIPT_NAME'];
143	$REQUEST_METHOD = $_SERVER['REQUEST_METHOD'];
144	$REMOTE_ADDR = NFW_REMOTE_ADDR;
145	}
146
147	$elapse = nfw_fc_metrics('stop');
148
149	$log_line = $tmp . '[' . time() . '] ' . "[$elapse] " .
150	"[{$_SERVER['SERVER_NAME']}] [#$incidentID] [$ruleid] [$loglevel] " .
151	'[' . NinjaFirewall_IP::anonymize_ip( $REMOTE_ADDR, $nfw_options ) . '] ' .
152	"[$http_ret_code] [$REQUEST_METHOD] [$SCRIPT_NAME] [$loginfo] [$encoding]";
153
154	@ file_put_contents( $log_file, "$log_line\n", FILE_APPEND \| LOCK_EX );
155
156	/**
157	* `nfw_custom_user_log()` can be defined in the .htninja configuration file
158	* to allow the user to retrieve the log line.
159	*/
160	if ( function_exists('nfw_custom_user_log') ) {
161	nfw_custom_user_log( $log_line );
162	}
163
164	/**
165	* Return the incident ID that will be displayed to the user.
166	*/
167	return $incidentID;
168	}
169
170	}
171
172	// =====================================================================
173	// EOF
174