GeoIP2 ?

[porjo]

I made the mistake of trying to use Maxmind's newer GeoIP2 database format, only to find the debug log full of No geo data for "x.x.x.x" (country -16282110). errors.

It would be good to:

• make it clear in the documentation that ModSecurity only supports the legacy GeoIP format
• include support for the newer GeoIP2 format (if possible)

Thanks

[csanders-git]

By documentation are you suggesting the inline documentation or in the reference manual or both ?

[porjo]

I had in mind the reference manual entry for SecGeoLookupDb

[csanders-git]

@porjo good stuff, I updated the reference manual :). I'll take a look at adding support for v2 to libmodsecurity also, unless you are interested in this project.

[linux4me]

On the Maxmind site there is an announcement that says:

We will be discontinuing updates to the GeoLite Legacy databases as of April 1, 2018. You will still be able to download the April 2018 release until January 2, 2019. GeoLite Legacy users will need to update their integrations in order to switch to the free GeoLite2 or commercial GeoIP databases by April 2018.

Is an update to ModSecurity to use GeoIP2 in the works?

[csanders-git]

Thanks @linux4me. This came up in the CRS meeting. Starting January 2nd without support in libmodsec for GeoIP2, the geoLookup operator will not work on any version of ModSecurity. Ideally CRS would like 2 months to issue a minor release that indicates that the feature is broken on ModSecv2 and only supported on ModSecv3.

This would put this request on the modsec team to have this available before October 2018. Is this feasible?

[zimmerle]

On v3/master already.