Re: [mod-security-users] GEO:COUNTRY_CODE returns an empty string

[Felipe C. <FC...@tr...>]

Oh, Thank you for the report, Juan. I saw that it has a workaround. I will have a solid fix for it as soon as possible.

Br.,

Felipe "Zimmerle" Costa

Security Researcher, Lead Developer ModSecurity

m: +55 81.98706.5547



[signature_480191669]

www.trustwave.com<http://www.trustwave.com/>



Recognized by industry analysts as a leader in managed security services.<https://www.trustwave.com/company/about-us/accolades/>


________________________________
From: Juan Pablo Tosso <jt...@co...>
Sent: Monday, March 11, 2019 10:34 AM
To: Felipe Costa
Cc: mod...@li...
Subject: Re: [mod-security-users] GEO:COUNTRY_CODE returns an empty string

Hello Felipe and thank you for your answer, it was actually related to issue #2033, the database was not working after reload.

You can "fix" it by removing geoip v1 from the configuration recipe.


On Mon, Mar 11, 2019, 10:30 AM Felipe Costa <FC...@tr...<mailto:FC...@tr...>> wrote:
Hi Juan,

Please, make sure that the IP is on the database with a country code record. The code is ready to fulfill the variable name and it is being tested here:

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/variable-GEO.json#L627<https://scanmail.trustwave.com/?c=4062&d=keSG3CFIBPXWKTDyOxn2sw4H-9wVvywY4VDnk2bRcQ&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2fblob%2fv3%2fmaster%2ftest%2ftest-cases%2fregression%2fvariable-GEO%2ejson%23L627>

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/variable-GEO.json#L161<https://scanmail.trustwave.com/?c=4062&d=keSG3CFIBPXWKTDyOxn2sw4H-9wVvywY4QC4kjyLJA&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2fblob%2fv3%2fmaster%2ftest%2ftest-cases%2fregression%2fvariable-GEO%2ejson%23L161>

There are utilities like geoiplookup that allow you to query the IP address from the command line.

Br.,

Felipe "Zimmerle" Costa

Security Researcher, Lead Developer ModSecurity

m: +55 81.98706.5547



[signature_480191669]

www.trustwave.com<http://www.trustwave.com/>



Recognized by industry analysts as a leader in managed security services.<https://www.trustwave.com/company/about-us/accolades/>


________________________________
From: Juan Pablo Tosso <jt...@co...>
Sent: Monday, March 4, 2019 10:36 PM
To: mod...@li...<mailto:mod...@li...>
Subject: [mod-security-users] GEO:COUNTRY_CODE returns an empty string

Hello, I have been trying to use geoip without success, I've tried with legacy format and new format, and updated databases.

This is the current code:
SecGeoLookupDb /mnt/nginx/defaults/geoip/geoip.mmdb
SecRule GEO:COUNTRY_CODE "CL" "id:111,deny,log,logdata:'test',phase:1"

I'm using modsecurity 3 in it's master branch with the nginx connector (master) and Nginx 1.15.9

I have also tried to print the value with tx but I receive a null value.

Thank you