Backport libMaxMinddb (new GeoIP) support to 2.9.x

[dune73]

Without this being backported to the 2.9 branch, ModSecurity on Apache has no longer any GeoIP support.

[spartantri]

This will be very welcome. :)

[dune73]

Thank you @zimmerle.

[dune73]

Can you give us a timeline for 2.9.3?

[zimmerle]

Hi @dune73,

There is a milestone for the version 2.9.3 here:
https://github.com/SpiderLabs/ModSecurity/milestone/10

We don't have an ETA for the release yet.

[zimmerle]

Is that anyone from the community that is willing to help with the development of this backport?

The implementation for v3 is here:
https://github.com/SpiderLabs/ModSecurity/blob/v3/master/src/utils/geo_lookup.cc

The logic is available only and only if ModSecurity was compiled with maxmind support.

MaxMind and GeoIp can co-exist. In that case, the choice [run time] is based on the specified database.

If you need, count with my support during the development.

[zimmerle]

@spartantri, @franbuehler, @ossie-git, @dobin, @thhofer, @Cheesman97 can you describe the use case that you have for that specific functionality?

[dune73]

A standard use case is to protect certain parts of an application (-> path tree, typically the admin interface) via GeoIP and ModSecurity. This reduces your attack surface tremendously.

Other people assign different CRS anomaly thresholds based on GeoIP.

It is also very helpful to display the GeoIP country code next to the IP address in the combined access log. This works without a real format change as the position for 'logname' has been abandoned twenty years ago and it is unused every since. Putting the country code there with the help of an environment variable is very simple if you have GeoIP.

[zimmerle]

While this is not ready yet on 2.x, there are other modules on Apache that may help you to block/process based on GeoIP, including one from maxmind - https://github.com/maxmind/mod_maxminddb

[emphazer]

any progress here?

[zimmerle]

Hi @emphazer,

Yes, there is this user Marc Stern who had a solution:

"

As you know, the geo-localisation databases used by ModSecurity are no 
more updated.
Maxmind, the databases provider, developed a new DB format and provides 
its own module (mod_maxminddb).
mod_maxminddb was lacking a feature to integrate it smoothly with 
ModSecurity: settings the IP address from inside a rule. I introduced 
this feature some time ago and I'm happy to announce that this patch was 
merged in Maxmind's code and is thus officially part of the module.
You can now set an environment variable in a rule - in (real) phase 1 - 
and mod_maxminddb will use this IP address as source.
Note that, for most uses, mod_remote_ip is an easier solution.

*Marc Stern*
Approach Belgium <https://www.approach.be>;
Axis Park - Rue Edouard Belin 7 - 1435 Mont-Saint-Guibert - Belgium
Follow us: <https://www.linkedin.com/company/16513/>; 
<https://twitter.com/ApproachBe>;
/*Inspiring the cyber-security community*/

"

https://sourceforge.net/p/mod-security/mailman/message/36408909/