Strongly consider implementing a custom BadBehavior fork rewrite in OOP

I e-mailed the BB creator (Michael) to see what his thoughts about converting BB into OOP-based code so that that other implementation plugins could override or change things as they needed to.

@error: Hey very glad to have your feedback here. I'd love to work with you to help make things better not just for the Drupal integration, but for all the plugins. Yeah the biggest thing I'm running into is the database code. If I wanted to change the db column names or change the date to use a UNIX timestamp, it's either ugly string replacements or not possible with the current code.

Things like getting the current IP address could be swapped since we have functions like ip_address() in Drupal that might be more robust that the default function in the Bad Behavior class.

I totally get that you want to keep it fast. That's one of the primary reasons Drupal has avoided OOP as long as possible. But things like our Database layer needing to work differently on engines is just not possible any other way.

I'm still working through exactly how to replicate the execution of the current script, but here's my progress so far. Includes a basic DrupalBadBehavior implementation that shows how we could override some of the methods in the base BadBehavior class. Still very much a work in progress...

// This requires PHP 5.
define('BAD_BEHAVIOR_VERSION', '3.0');

/**
 * Base class for implementation.
 */
abstract class BadBehavior {
  protected $settings = array();
  protected $headers;
  protected $ip_address;
  protected $request_method;
  protected $request_uri;
  protected $server_protocol;
  protected $request_entity;
  protected $user_agent;
  protected $is_browser = FALSE;
  protected $is_blocked = FALSE;

  function __construct(array $options = array()) {
    $this->settings += $options + $this->readSettings() + $this->defaultSettings();
  }

  public function readSettings() {
    return array();
  }

  protected function defaultSettings() {
    return array(
      'display_stats' => TRUE,
      'strict' => FALSE,
      'verbose' => FALSE,
      'logging' => TRUE,
      'httpbl_key' => '',
      'httpbl_threat' => 25,
      'httpbl_maxage' => 30,
      'offsite_forms' => FALSE,
      'mail' => 'bad.bots@ioerror.us',
    );
  }

  /**
   * Get a setting.
   */
  abstract public function getSetting($setting, $default = NULL);

  /**
   * Set a setting.
   */
  abstract public function setSetting($setting, $value);

  /**
   * Get the relative path of the website.
   */
  abstract public function getRelativePath();

  /**
   * Create a log entry.
   */
  abstract public function log(array $log);

  /**
   * Get the IP address of the current request.
   */
  public function getIPAddress() {
    return preg_replace("/^::ffff:/", "", $_SERVER['REMOTE_ADDR']);
  }

  /**
   * Get an array of all the current HTTP request's headers.
   */
  public function getHeaders() {
    if (function_exists('getallheaders')) {
      $headers = getallheaders();
    }
    else {
      $headers = array();
      foreach ($_SERVER as $name => $value) {
        if (substr($name, 0, 5) == 'HTTP_') {
          $name = str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))));
          $headers[$name] = $value;
        }
      }
    }
    return $headers;
  }

  /**
   * Determine if an IP address resides in a CIDR netblock or netblocks.
   */
  public function matchCIDR($addr, $cidr) {
    $match = FALSE;

    if (is_array($cidr)) {
      foreach ($cidr as $cidrlet) {
        if ($this->matchCIDR($addr, $cidrlet)) {
          $output = TRUE;
          break;
        }
      }
    } else {
      @list($ip, $mask) = explode('/', $cidr);
      if (!$mask) $mask = 32;
      $mask = pow(2,32) - pow(2, (32 - $mask));
      $match = ((ip2long($addr) & $mask) == (ip2long($ip) & $mask));
    }

    return $match;
  }

  /**
   * Start Bad Behavior data collecting, screening, and blocking.
   */
  public function run() {
    // Collect data.
    $this->loadRequestData();

    // Perform screening.
    $this->screenRequest();

    // If screening returns TRUE, the request is blocked and logged.
    if ($this->is_blocked && !defined('BB2_TEST')) {
      $this->blockRequest();
    }
    else {
      $this->approveRequest();
    }
  }

  /**
   * Load the data required to analyize the request for bad behavior.
   */
  public function loadRequestData() {
    $this->headers = $this->getHeaders();
    $this->ip_address = $this->getIPAddress();
    $this->request_method = $_SERVER['REQUEST_METHOD'];
    $this->request_uri = $_SERVER['REQUEST_URI'];
    $this->server_protocol = $_SERVER['SERVER_PROTOCOL'];
    $this->request_entity = NULL;
    $this->user_agent = $_SERVER['HTTP_USER_AGENT'];
  }

  /**
   * Screen the current request for bad behavior.
   *
   * @return
   *   TRUE if the request should be blocked, FALSE otherwise.
   */
  public function screenRequest() {
    return FALSE;
  }

  /**
   * Perform actions for bad requests.
   */
  public function blockRequest() {
    // Do something bad.
    $this->log(array('message' => 'Request blocked', 'time' => time()));
  }

  /**
   * Perform actions for good requests.
   */
  public function approveRequest() {
    // Do something good.
    $this->log(array('message' => 'Request approved', 'time' => time()));
  }
}

/**
 * Drupal-specific implementation.
 */
class DrupalBadBehavior extends BadBehavior {
  public function getSetting($setting, $default = NULL) {
    return variable_get($setting, $default);
  }

  public function setSetting($setting, $value) {
    return variable_set($setting, $value);
  }

  public function getRelativePath() {
    return base_path();
  }

  public function getIPAddress() {
    return ip_address();
  }

  public function run() {
    // Do not continue if the user has the bypass permission.
    if (!user_access('bypass bad behavior protection')) {
      parent::run();
    }
  }

  public function log(array $log) {
    $log += array('severity' => WATCHDOG_NOTICE);
    var_export($log);
    watchdog('badbehavior', $log['message'], array(), $log['severity']);
  }

  public function blockRequest() {
    // Add the IP address to Drupal's built in IP blocking.
    parent::blockRequest();
  }
}

// The whole shebang would be run with:
$BadBehavior = new DrupalBadBehavior();
$BadBehavior->run();