Firewall for TYPO3 0.4.0
Updates the firewall engine to phirewall 0.8 and adds a database event log, a backend statistics view with dashboard widgets, a TYPO3 Context aspect, opt-in form flood protection, and a fully restructured manual.
Warning
Behavioral change from the phirewall 0.8 engine: Fail2Ban now blocks every request its filter matches, not only the one that reaches the threshold. If a rule in your config/system/phirewall.php filters on something a legitimate request can carry (for example every POST to a login path), move it to an Allow2Ban rule with the same filter, which counts the matches but lets them pass until the threshold. Rules that match only clearly malicious traffic (scanner paths) need no change and now block on sight. Rules driven by RequestContext::recordFailure() (an empty filter) are unaffected. See the "Upgrade from 0.3" note in the Installation chapter.
Highlights
- phirewall 0.8 engine. New Fail2Ban block-on-match semantics (see the warning above) and Allow2Ban rules with an optional filter. Fail2Ban matches below the threshold are recorded as the new
fail2ban_matchedevent. - Form flood protection (opt-in). A form finisher for
EXT:formreports every submission to the firewall and bans a client that submits faster than a configured Allow2Ban threshold. The rule identifier is configurable per form, so each form can have its own counter. - Firewall Context aspect. An opt-in middleware exposes the firewall decision through the TYPO3 Context API (
getAspect('firewall')) so application code can read the decision and record fail2ban/allow2ban signals. - Event log and statistics. Firewall events are logged to the database (with retention pruning and IP anonymization), a backend statistics view charts them, and dashboard widgets show blocked attackers and an events chart.
- Backend module improvements. The blocked-keys view gained search, sorting and remaining ban time, and the statistics show recent blocked requests with their firing rule.
- Configuration robustness. The configuration file is layered over the extension defaults, a broken
phirewall.phpfalls back to the default config, and counter rules on the non-persistentInMemoryCachenow log a warning. The client IP defaults to TYPO3'sGeneralUtility::getIndpEnv('REMOTE_ADDR')(proxy-aware). - Rewritten manual. The documentation is restructured into a full page tree with installation, configuration, middleware, storage, presets, backend module, statistics, examples, a TYPO3 FAQ, form protection, and a problem-first common-attacks guide.
What's Changed
Engine & behavioral
- Require flowd/phirewall ^0.7.0 and bump to 0.4.0 by @sascha-egerer in #29
- Require phirewall 0.8 and log fail2ban matches by @sascha-egerer in #57
- Replace deprecated KeyExtractors::ip() and set the client IP resolver in all examples by @sascha-egerer in #33
- Default the IP resolver to GeneralUtility::getIndpEnv('REMOTE_ADDR') by @sascha-egerer in #35
- Layer the configuration file over the extension defaults by @sascha-egerer in #48
- Fall back to the default config when loading phirewall.php fails by @sascha-egerer in #44
- Warn when counter rules run on the InMemoryCache store by @sascha-egerer in #55
Features
- Expose the firewall decision as a TYPO3 Context aspect by @KamiYang and @sascha-egerer in #56
- Add opt-in form flood protection by @KamiYang and @sascha-egerer in #58
- Log firewall events to the database with retention pruning by @sascha-egerer in #39
- Add a statistics module view with an event chart by @sascha-egerer in #40
- Add dashboard widgets for blocked attackers and events by @sascha-egerer in #41
- Improve the blocked keys view with search, sorting and remaining ban time by @sascha-egerer in #42
- Show the recent blocked requests with their firing rule in the statistics by @sascha-egerer in #43
- Localize the backend module flash messages by @sascha-egerer in #34
Documentation
- Restructure the documentation into a full page tree by @sascha-egerer in #38
- Document installation, bundled packages, and the 0.3 upgrade by @sascha-egerer in #45
- Document the configuration file contract and the automatic defaults by @sascha-egerer in #46
- Document the middleware scope and the trusted proxy handling by @sascha-egerer in #47
- Document the store options with configuration examples by @sascha-egerer in #49
- Document the preset packages and a CMS scanner path rule by @sascha-egerer in #50
- Document the backend module and its three views by @sascha-egerer in #51
- Document the event log, statistics view and dashboard widgets by @sascha-egerer in #52
- Rework the examples page into task-oriented recipes by @sascha-egerer in #53
- Add a TYPO3-specific FAQ page by @sascha-egerer in #54
- Add a problem-first common-attacks guide by @sascha-egerer in #59
Internal & packaging
- Bump dev-main branch-alias to 0.4.x-dev by @KamiYang in #27
- Fix docs project metadata in guides.xml by @sascha-egerer in #30
- Align the TYPO3 version constraint with composer.json by @sascha-egerer in #31
- Enable the unit test CI job with a supported version matrix by @sascha-egerer in #32
- Add functional tests for the backend module controller by @sascha-egerer in #36
- Enable the functional test CI job by @sascha-egerer in #37
Full Changelog: 0.3.0...0.4.0