From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alf =?utf-8?q?H=C3=B8gemark?= <alf@i100.no>
To: development@lists.ipfire.org
Subject: Feedback wanted on feature to show blocked IPs per country
Date: Wed, 12 Feb 2014 18:21:50 +0100
Message-ID: <52FBADAE.7060501@i100.no>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6312282528697565856=="
List-Id: <development.lists.ipfire.org>

--===============6312282528697565856==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi

Based on the existing firewalllogip.dat and firewalllogport.dat, I want=20
a similair function to show
which countries gets blocked, to see which country is mainly targeting=20
my servers.

I've made a preliminary prototype, you can see it here :
https://github.com/alfh/ipfire-2.x/commit/a99ee9ce4fcdc9e41bfdfd7bd169324d1a0=
dcee0

This works on my existing 2.13 Core75.
There is no right menu, it is just a preliminary prototype as of now.


What I basically have done, is to copy firewalllogip.dat and=20
showrequestfromip.dat, and modified them
so they work on "country for ip address" rather than inidividual ip address.

This raises a few questions in my mind :

1.
Code duplication. By just copying the firewalllogip.dat, I duplicate a=20
lot of code.
To me, this also seems to be the case already, where firewalllogip.dat=20
and firewalllogport.dat containing
a lot of duplicated code.
Any ideas how to avoid this ?
Has it been discussed to try to minimze the existing code duplication in=20
the cgi-bin files ?

2.
Do think "local ip addresses" should turn up in firewalllogcounty.dat ?


Here is the main part of my code :
my $gi =3D Geo::IP::PurePerl->new();
....

   if($_ =3D~  /SRC\=3D([\d\.]+)/){
     my $srcaddr=3D$1;
     my $ccode =3D $gi->country_code_by_name($srcaddr);
     my $fcode;

     # TODO: should local IP adresses be include as unknown, or excluded=20
from the statistics totally ?
     # TODO: it would be nice to be able to group local IPs into "red",=20
"green", "blue" etc
     if( $ccode eq "") {
         $ccode =3D "unknown";
     }
     else {
        $tabjc{$ccode} =3D $tabjc{$ccode} + 1 ;
        if(($tabjc{$ccode} =3D=3D 1) && ($lines < $pienumber)) { $lines =3D=20
$lines + 1; }
        $linesjc++;
     }
   }

As you can see, I now decide to not include the local ip addresses.
I also currently do not differentiate between local ip addresses and ip=20
addresses where country code is actually unknown.
I'll have to check if Geo::IP has some functionality to tell me if the=20
address is part of "non routable addresses", like 192.168.x.y.

3.
Is there functionality existing in ipfire cgi-bin code to check if an ip=20
address is part of the netmask of the "green", "red", "blue", "yellow"
interface ?
If so, I think I would like to treat them like "countries".

4.
Do other people find this functionality useful ?

Regards
Alf


--===============6312282528697565856==--