-
Notifications
You must be signed in to change notification settings - Fork 798
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Protect: Add IP block and allow list toggles #38265
Conversation
Thank you for your PR! When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:
This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖 The e2e test report can be found here. Please note that it can take a few minutes after the e2e tests checks are complete for the report to be available. Once your PR is ready for review, check one last time that all required checks appearing at the bottom of this PR are passing or skipped. Jetpack plugin: The Jetpack plugin has different release cadences depending on the platform:
If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack. Protect plugin:
If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack. |
51c4a90
to
fc5342e
Compare
// Only attempt to update the WAF if the module is supported and enabled. | ||
if ( Waf_Runner::is_supported_environment() && Waf_Runner::is_enabled() ) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm wondering if #38326 makes this change unnecessary, I will double check.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, just merged the change and it appears to no longer be an issue! I'll revert this now.
Suggestion – Now that the waf package supports separate toggling of the allow/block list, there's opportunity here to simplify our code and remove the duplication of the allow list. We could get rid of the i.e.
|
<Col> | ||
<div className={ styles[ 'toggle-wrapper' ] }> | ||
{ wafSupported && automaticRulesSettings } | ||
{ bruteForceProtectionSettings } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor – can we move the ipAllowList
out of bruteForceProtectionSettings
and have it rendered here? Will improve readability as the allow list is contextually applicable at this higher level.
i.e.
{ wafSupported && automaticRulesSettings }
{ bruteForceProtectionSettings }
{ ipAllowListSettings }
{ wafSupported && ipBlockListSettings }
<> | ||
<Text mb={ 1 }> | ||
{ __( | ||
"IP addresses added to this list will never be blocked by Jetpack's brute force protection.", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suggestion – can we keep the description for the allow list, i.e. "IP addresses added to this list will never be blocked by Jetpack's security features."
Code looks great, tests great as well! What do you think about swapping the order of the allow/block list? My thinking being, the block list is more related to the firewall features, and the allow list is a final exception to any of the features on the page, so it might be suited at the bottom. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good and tests well! LGTM 👍 👍
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM! 🚢
Description
Updates the Protect Firewall UI to allow the IP block and allow lists to be toggled independently.
Proposed changes:
jetpack_waf_ip_allow_list_enabled
/jetpack_waf_ip_block_list_enabled
settings, replacingjetpack_waf_ip_list
Other information:
Jetpack product discussion
Does this pull request change what data or activity we track or use?
Testing instructions:
Waf_Runner::is_unsupported_environment
to false and verify that the BFP allow list still functionsScreenshots
Enabled:
![Screen Shot 2024-07-17 at 08 55 18](https://cdn.statically.io/img/private-user-images.githubusercontent.com/43220201/349571775-68e73596-247e-4401-95d0-7d5bad14fb13.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM1NDI2NzIsIm5iZiI6MTcyMzU0MjM3MiwicGF0aCI6Ii80MzIyMDIwMS8zNDk1NzE3NzUtNjhlNzM1OTYtMjQ3ZS00NDAxLTk1ZDAtN2Q1YmFkMTRmYjEzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODEzVDA5NDYxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVmYmQ1Y2Y5MWI3MTI0NzUyMGRhYjNkODdkNTg1NDdlNWEwZGJhNmVmYzczMzM1MzRiMzViYzBkODRiMzE5MjEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.K1bUoqjXl7jIoqjKSyc0JyqW1LWc7BY3JNP_VcqWxfA)
Disabled:
![Screen Shot 2024-07-17 at 08 57 01](https://cdn.statically.io/img/private-user-images.githubusercontent.com/43220201/349572444-d8d709d0-c39c-4a4b-b51b-eceda504e9df.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM1NDI2NzIsIm5iZiI6MTcyMzU0MjM3MiwicGF0aCI6Ii80MzIyMDIwMS8zNDk1NzI0NDQtZDhkNzA5ZDAtYzM5Yy00YTRiLWI1MWItZWNlZGE1MDRlOWRmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODEzVDA5NDYxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWEwMzlmMzBiMTg2MmI4ZDFlOTc2NTBiZjYxY2Q3M2U3NDhlZDVkZTM2Nzg2MDdiYWE5MzI0MzhhZGQwNWQ4MTUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.2cMiVtl3JyFjmvaQycGZ9V8h2FIHtTQfbGAVPWBfLg0)
WAF Disabled:
![Screen Shot 2024-07-17 at 08 58 07](https://cdn.statically.io/img/private-user-images.githubusercontent.com/43220201/349572803-9c778b34-b766-41d9-8b26-28722da11d99.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM1NDI2NzIsIm5iZiI6MTcyMzU0MjM3MiwicGF0aCI6Ii80MzIyMDIwMS8zNDk1NzI4MDMtOWM3NzhiMzQtYjc2Ni00MWQ5LThiMjYtMjg3MjJkYTExZDk5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODEzVDA5NDYxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTVlOTVkZDY0NmYzYjNhMmQ2YmNiOGExODdjNDRkZmE4MjA0ZjVjOWY0ZjczYzI5YTM4OGQwMzEzYTcyYzRhYzkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.tCFch5zD9uPKmC0UdpZPGo1Dc5ALrTWsPbTvUkL8NAA)
Unsupported Env:
![Screen Shot 2024-07-17 at 09 04 33](https://cdn.statically.io/img/private-user-images.githubusercontent.com/43220201/349575113-8789b213-2f12-449c-acb1-86f9acdd04d9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM1NDI2NzIsIm5iZiI6MTcyMzU0MjM3MiwicGF0aCI6Ii80MzIyMDIwMS8zNDk1NzUxMTMtODc4OWIyMTMtMmYxMi00NDljLWFjYjEtODZmOWFjZGQwNGQ5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODEzVDA5NDYxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTg4MjU2MGM5MmRiYzlmMzk2ZTRiNjhlYTY2MTljOGJjZDNiNTM5ZGNmZmIzYmY2MmM3MDllODk4ZGRmN2MxYzEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.u4sDdU31v-rgToWK_gPCI86XG35qzgndE4575EB3J0U)