Re: GEO:COUNTRY_CODE returns an empty string

Hi Juan,

Please, make sure that the IP is on the database with a country code record. The code is ready to fulfill the variable name and it is being tested here:

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/variable-GEO.json#L627

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/variable-GEO.json#L161

There are utilities like geoiplookup that allow you to query the IP address from the command line.

Br.,

Felipe "Zimmerle" Costa

Security Researcher, Lead Developer ModSecurity

m: +55 81.98706.5547



[signature_480191669]

www.trustwave.com<http://www.trustwave.com/>



Recognized by industry analysts as a leader in managed security services.<https://www.trustwave.com/company/about-us/accolades/>


________________________________
From: Juan Pablo Tosso <[email protected]>
Sent: Monday, March 4, 2019 10:36 PM
To: [email protected]
Subject: [mod-security-users] GEO:COUNTRY_CODE returns an empty string

Hello, I have been trying to use geoip without success, I've tried with legacy format and new format, and updated databases.

This is the current code:
SecGeoLookupDb /mnt/nginx/defaults/geoip/geoip.mmdb
SecRule GEO:COUNTRY_CODE "CL" "id:111,deny,log,logdata:'test',phase:1"

I'm using modsecurity 3 in it's master branch with the nginx connector (master) and Nginx 1.15.9

I have also tried to print the value with tx but I receive a null value.

Thank you

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/