From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: Feedback wanted on feature to show blocked IPs per country
Date: Wed, 12 Feb 2014 20:41:38 +0100
Message-ID: <1392234098.5657.11.camel@rice-oxley.tremer.info>
In-Reply-To: <52FBADAE.7060501@i100.no>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4044733827891062510=="
List-Id: <development.lists.ipfire.org>

--===============4044733827891062510==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

On Wed, 2014-02-12 at 18:21 +0100, Alf H=C3=B8gemark wrote:
> Hi
>=20
> Based on the existing firewalllogip.dat and firewalllogport.dat, I want=20
> a similair function to show
> which countries gets blocked, to see which country is mainly targeting=20
> my servers.
>=20
> I've made a preliminary prototype, you can see it here :
> https://github.com/alfh/ipfire-2.x/commit/a99ee9ce4fcdc9e41bfdfd7bd169324d1=
a0dcee0
>=20
> This works on my existing 2.13 Core75.
> There is no right menu, it is just a preliminary prototype as of now.
>=20
>=20
> What I basically have done, is to copy firewalllogip.dat and=20
> showrequestfromip.dat, and modified them
> so they work on "country for ip address" rather than inidividual ip address.
>=20
> This raises a few questions in my mind :
>=20
> 1.
> Code duplication. By just copying the firewalllogip.dat, I duplicate a=20
> lot of code.
> To me, this also seems to be the case already, where firewalllogip.dat=20
> and firewalllogport.dat containing
> a lot of duplicated code.
> Any ideas how to avoid this ?
> Has it been discussed to try to minimze the existing code duplication in=20
> the cgi-bin files ?

You may create a perl file that will be included which provides
functions for both scripts.

> 2.
> Do think "local ip addresses" should turn up in firewalllogcounty.dat ?

No.

> Here is the main part of my code :
> my $gi =3D Geo::IP::PurePerl->new();
> ....
>=20
>    if($_ =3D~  /SRC\=3D([\d\.]+)/){
>      my $srcaddr=3D$1;
>      my $ccode =3D $gi->country_code_by_name($srcaddr);
>      my $fcode;
>=20
>      # TODO: should local IP adresses be include as unknown, or excluded=20
> from the statistics totally ?
>      # TODO: it would be nice to be able to group local IPs into "red",=20
> "green", "blue" etc
>      if( $ccode eq "") {
>          $ccode =3D "unknown";
>      }
>      else {
>         $tabjc{$ccode} =3D $tabjc{$ccode} + 1 ;
>         if(($tabjc{$ccode} =3D=3D 1) && ($lines < $pienumber)) { $lines =3D=
=20
> $lines + 1; }
>         $linesjc++;
>      }
>    }
>=20
> As you can see, I now decide to not include the local ip addresses.
> I also currently do not differentiate between local ip addresses and ip=20
> addresses where country code is actually unknown.
> I'll have to check if Geo::IP has some functionality to tell me if the=20
> address is part of "non routable addresses", like 192.168.x.y.

There certainly is a perl module (like this
http://search.cpan.org/~neely/Data-Validate-IP-0.11/lib/Data/Validate/IP.pm),
but we also have got some simple checks in setddns.pl for example.

> 3.
> Is there functionality existing in ipfire cgi-bin code to check if an ip=20
> address is part of the netmask of the "green", "red", "blue", "yellow"
> interface ?
> If so, I think I would like to treat them like "countries".

Yes. Have a look at /var/ipfire/general-functions.pl

> 4.
> Do other people find this functionality useful ?

Why not?

>=20
> Regards
> Alf
>=20
> _______________________________________________
> Development mailing list
> Development(a)lists.ipfire.org
> http://lists.ipfire.org/mailman/listinfo/development


--===============4044733827891062510==--