ddos_protection.php

<?php
// ddos_protection.php
// Author: SourceCode347 (with fix for ban file creation to avoid first-visit error)

// === Configuration ===
$ddos_config = [
    'limit' => 10,            // Maximum number of requests
    'window' => 60,           // Time window (in seconds)
    'ban_attempts' => 30,     // Number of failed attempts before banning
    'ban_duration' => 86400,  // Ban duration (24 hours = 86400 seconds)
    'base_dir' => dirname(__FILE__) . '/', // Directory of this script
    'ban_file' => dirname(__FILE__) . '/banned_ips.log', // Banned IPs file
];

// Enable error logging
ini_set('log_errors', 1);
ini_set('error_log', dirname(__FILE__) . '/php_errors.log');

// Get user's IP address
function ddos_get_client_ip() {
    $ip = isset($_SERVER['REMOTE_ADDR']) ? filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP) : '';
    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $forwarded_ips = array_map('trim', explode(',', filter_var($_SERVER['HTTP_X_FORWARDED_FOR'], FILTER_SANITIZE_STRING)));
        $ip = filter_var($forwarded_ips[0], FILTER_VALIDATE_IP) ?: $ip;
    } elseif (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        $ip = filter_var($_SERVER['HTTP_CF_CONNECTING_IP'], FILTER_VALIDATE_IP) ?: $ip;
    }
    if (empty($ip)) {
        error_log('DDoS Protection: No valid IP detected. REMOTE_ADDR: ' . ($_SERVER['REMOTE_ADDR'] ?? 'none') . ', X_FORWARDED_FOR: ' . ($_SERVER['HTTP_X_FORWARDED_FOR'] ?? 'none') . ', CF_CONNECTING_IP: ' . ($_SERVER['HTTP_CF_CONNECTING_IP'] ?? 'none'));
    }
    return $ip;
}

// Check if the base directory is writable
function ddos_ensure_base_dir($base_dir) {
    if (!is_writable($base_dir)) {
        error_log('DDoS Protection: Directory not writable: ' . $base_dir . ' (Permissions: ' . substr(sprintf('%o', fileperms($base_dir)), -4) . ', Owner: ' . posix_getpwuid(fileowner($base_dir))['name'] . ')');
        return false;
    }
    return true;
}

// Ensure ban file exists and is writable (use touch for reliable creation)
function ddos_ensure_ban_file($ban_file) {
    if (!file_exists($ban_file)) {
        // Use touch to create the file
        if (!touch($ban_file)) {
            error_log('DDoS Protection: Failed to touch ban file: ' . $ban_file . ' (Error: ' . (error_get_last()['message'] ?? 'Unknown') . ')');
            // Fallback: Try file_put_contents with an empty line
            if (!file_put_contents($ban_file, "\n", LOCK_EX)) {
                error_log('DDoS Protection: Fallback failed to create ban file: ' . $ban_file . ' (Error: ' . (error_get_last()['message'] ?? 'Unknown') . ')');
                return false; // Don't exit, allow script to continue
            }
            error_log('DDoS Protection: Ban file created via fallback: ' . $ban_file);
        } else {
            error_log('DDoS Protection: Ban file created via touch: ' . $ban_file);
        }
        // Set permissions
        chmod($ban_file, 0664);
    }
    if (!is_writable($ban_file)) {
        error_log('DDoS Protection: Ban file not writable: ' . $ban_file . ' (Permissions: ' . substr(sprintf('%o', fileperms($ban_file)), -4) . ')');
        return false;
    }
    return true;
}

// Check if the IP is banned
function is_ip_banned($ip, $ban_file, $ban_duration) {
    if (!file_exists($ban_file)) {
        return false; // No ban file, no bans
    }
    if (!is_readable($ban_file)) {
        error_log('DDoS Protection: Ban file not readable: ' . $ban_file);
        return false;
    }

    $banned = file($ban_file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    if ($banned === false) {
        error_log('DDoS Protection: Failed to read ban file: ' . $ban_file);
        return false;
    }

    foreach ($banned as $line) {
        $parts = explode('|', $line);
        if (count($parts) !== 2) {
            error_log('DDoS Protection: Malformed line in ban file: ' . $line);
            continue;
        }
        list($banned_ip, $ban_time) = $parts;
        if ($banned_ip === $ip && ((int)$ban_time + $ban_duration) > time()) {
            return true;
        }
    }
    return false;
}

// Clean up expired bans
function clean_expired_bans($ban_file, $ban_duration) {
    if (!file_exists($ban_file)) {
        return; // No ban file, nothing to clean
    }
    if (!ddos_ensure_ban_file($ban_file)) {
        error_log('DDoS Protection: Cannot clean ban file due to creation/write issues: ' . $ban_file);
        return;
    }

    $banned = file($ban_file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    if ($banned === false) {
        error_log('DDoS Protection: Failed to read ban file for cleanup: ' . $ban_file);
        return;
    }

    $new_banned = [];
    $now = time();

    foreach ($banned as $line) {
        $parts = explode('|', $line);
        if (count($parts) !== 2) {
            error_log('DDoS Protection: Malformed line in ban file during cleanup: ' . $line);
            continue;
        }
        list($banned_ip, $ban_time) = $parts;
        if (((int)$ban_time + $ban_duration) > $now) {
            $new_banned[] = $line;
        }
    }

    if (!file_put_contents($ban_file, implode("\n", $new_banned) . "\n", LOCK_EX)) {
        error_log('DDoS Protection: Failed to write to ban file during cleanup: ' . $ban_file);
    } else {
        error_log('DDoS Protection: Ban file cleanup completed: ' . $ban_file);
    }
}

// Get user's IP address
$ip = ddos_get_client_ip();
if (empty($ip)) {
    error_log('DDoS Protection: Exiting due to invalid IP');
    exit('Invalid IP address');
}

$now = time();
$file = $ddos_config['base_dir'] . 'dp_' . md5($ip) . '.txt';

// Ensure base directory is writable
if (!ddos_ensure_base_dir($ddos_config['base_dir'])) {
    error_log('DDoS Protection: Exiting due to directory issues');
    exit('Server configuration error');
}

// Ensure ban file exists (but don't exit if it fails)
if (!ddos_ensure_ban_file($ddos_config['ban_file'])) {
    error_log('DDoS Protection: Ban file setup failed, continuing without ban file');
    // Proceed without exiting, as ban file isn't needed until banning
}

// If the IP is banned, reject the request
if (is_ip_banned($ip, $ddos_config['ban_file'], $ddos_config['ban_duration'])) {
    error_log('DDoS Protection: Banned IP detected - IP: ' . $ip);
    header('HTTP/1.1 403 Forbidden');
    exit('Your IP is banned for 24 hours due to excessive requests.');
}

// Clean up expired bans
clean_expired_bans($ddos_config['ban_file'], $ddos_config['ban_duration']);

// If no file exists for the IP, create one
if (!file_exists($file)) {
    if (!file_put_contents($file, "$now|1|0", LOCK_EX)) {
        error_log('DDoS Protection: Failed to create file for IP: ' . $file);
        exit('Server configuration error');
    }
} else {
    $data = file_get_contents($file);
    if ($data === false) {
        error_log('DDoS Protection: Failed to read file: ' . $file);
        exit('Server configuration error');
    }
    $parts = explode('|', $data);
    if (count($parts) !== 3) {
        error_log('DDoS Protection: Malformed data in file: ' . $file);
        file_put_contents($file, "$now|1|0", LOCK_EX); // Reset corrupted file
    } else {
        list($start, $count, $failures) = $parts;

        if (($now - (int)$start) > $ddos_config['window']) {
            // Time window expired, reset counter
            if (!file_put_contents($file, "$now|1|0", LOCK_EX)) {
                error_log('DDoS Protection: Failed to reset file: ' . $file);
                exit('Server configuration error');
            }
        } else {
            $count = (int)$count + 1;
            if ($count > $ddos_config['limit']) {
                $failures = (int)$failures + 1;

                // Persist the updated count and failures before handling response
                if (!file_put_contents($file, "$start|$count|$failures", LOCK_EX)) {
                    error_log('DDoS Protection: Failed to update file during excess: ' . $file);
                    exit('Server configuration error');
                }

                // If failure limit is reached, add to ban list
                if ($failures >= $ddos_config['ban_attempts']) {
                    if (file_exists($ddos_config['ban_file']) && !file_put_contents($ddos_config['ban_file'], "$ip|$now\n", FILE_APPEND | LOCK_EX)) {
                        error_log('DDoS Protection: Failed to write to ban file: ' . $ddos_config['ban_file']);
                    } else {
                        error_log('DDoS Protection: IP banned - IP: ' . $ip);
                        // Clean up the temp file after banning
                        @unlink($file);
                        header('HTTP/1.1 403 Forbidden');
                        exit('Your IP has been banned for 24 hours due to excessive requests.');
                    }
                }

                // Exceeded request limit - reject with 429
                error_log('DDoS Protection: Rate limit exceeded - IP: ' . $ip);
                header('HTTP/1.1 429 Too Many Requests');
                header('Retry-After: ' . ($ddos_config['window'] - ($now - (int)$start)));
                exit('Too many requests. Please slow down.');
            } else {
                // Update request counter
                if (!file_put_contents($file, "$start|$count|$failures", LOCK_EX)) {
                    error_log('DDoS Protection: Failed to update file: ' . $file);
                    exit('Server configuration error');
                }
            }
        }
    }
}
?>