Re: GEO:COUNTRY_CODE returns an empty string

Hello Felipe and thank you for your answer, it was actually related to
issue #2033, the database was not working after reload.

You can "fix" it by removing geoip v1 from the configuration recipe.


On Mon, Mar 11, 2019, 10:30 AM Felipe Costa <[email protected]> wrote:

> Hi Juan,
>
> Please, make sure that the IP is on the database with a country code
> record. The code is ready to fulfill the variable name and it is being
> tested here:
>
>
> https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/variable-GEO.json#L627
>
>
> https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/variable-GEO.json#L161
>
> There are utilities like geoiplookup that allow you to query the IP
> address from the command line.
>
> Br.,
>
> *Felipe "Zimmerle" Costa*
>
> Security Researcher, Lead Developer ModSecurity
>
> m: +55 81.98706.5547
>
>
>
> [image: signature_480191669]
>
> *www.trustwave.com <http://www.trustwave.com/>*
>
>
>
> *Recognized by industry analysts as a leader in managed security services.
> <https://www.trustwave.com/company/about-us/accolades/>*
>
> ------------------------------
> *From:* Juan Pablo Tosso <[email protected]>
> *Sent:* Monday, March 4, 2019 10:36 PM
> *To:* [email protected]
> *Subject:* [mod-security-users] GEO:COUNTRY_CODE returns an empty string
>
> Hello, I have been trying to use geoip without success, I've tried with
> legacy format and new format, and updated databases.
>
> This is the current code:
> SecGeoLookupDb /mnt/nginx/defaults/geoip/geoip.mmdb
> SecRule GEO:COUNTRY_CODE "CL" "id:111,deny,log,logdata:'test',phase:1"
>
> I'm using modsecurity 3 in it's master branch with the nginx connector
> (master) and Nginx 1.15.9
>
> I have also tried to print the value with tx but I receive a null value.
>
> Thank you
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/