GeoIP Blocked IPs not being logged

GeoIP Blocked IPs not being logged

[Rob Brewer]

[-- Attachment #1: Type: text/plain, Size: 1093 bytes --]

Hi

After adding a few country codes with the GeoIP Configuration page, Geo 
blocked IPs no longer appear in the Firewall Logs.

This might be the intended operation but for me I would like to log these 
blocked IPs and have added a logging rule to /usr/lib/firewall/rules.pl

This is my patch for rules.pl which I have tested on my live IPFire and is 
working OK.

diff -u build/usr/lib/firewall/rules.pl.orig build/usr/lib/firewall/rules.pl
--- build/usr/lib/firewall/rules.pl.orig        2019-02-04 
20:59:34.677143496 +0000
+++ build/usr/lib/firewall/rules.pl     2019-02-04 21:01:59.445137411 +0000
@@ -609,6 +609,8 @@
        # is enabled.
        foreach my $location (@locations) {
                if(exists $geoipsettings{$location} && 
$geoipsettings{$location} eq "on") {
+      # add logging for geoip rwb 4/2/19
+                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc 
$location -j LOG --log-prefix 'GEOIPBLOCK-$location '");
                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc 
$location -j DROP");
                }
        }


Regards

Rob

Re: GeoIP Blocked IPs not being logged

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1737 bytes --]

Hello Rob,

Thank you for submitting this patch.

There are several issues with this patch:

* It has been line-wrapped and therefore does not apply

* It is actually intended behaviour of the GeoIP filter to not log those. Many systems are flooded with log messages and this filter is supposed to skim some things out entirely.

However, I do not think that this is a bad idea, but it should be configurable on the firewall options page.

-Michael

> On 4 Feb 2019, at 21:08, Rob Brewer <ipfire-devel(a)grantura.co.uk> wrote:
> 
> Hi
> 
> After adding a few country codes with the GeoIP Configuration page, Geo 
> blocked IPs no longer appear in the Firewall Logs.
> 
> This might be the intended operation but for me I would like to log these 
> blocked IPs and have added a logging rule to /usr/lib/firewall/rules.pl
> 
> This is my patch for rules.pl which I have tested on my live IPFire and is 
> working OK.
> 
> diff -u build/usr/lib/firewall/rules.pl.orig build/usr/lib/firewall/rules.pl
> --- build/usr/lib/firewall/rules.pl.orig        2019-02-04 
> 20:59:34.677143496 +0000
> +++ build/usr/lib/firewall/rules.pl     2019-02-04 21:01:59.445137411 +0000
> @@ -609,6 +609,8 @@
>        # is enabled.
>        foreach my $location (@locations) {
>                if(exists $geoipsettings{$location} && 
> $geoipsettings{$location} eq "on") {
> +      # add logging for geoip rwb 4/2/19
> +                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc 
> $location -j LOG --log-prefix 'GEOIPBLOCK-$location '");
>                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc 
> $location -j DROP");
>                }
>        }
> 
> 
> Regards
> 
> Rob
> 
> 

Re: GeoIP Blocked IPs not being logged

[Rob Brewer]

[-- Attachment #1: Type: text/plain, Size: 1428 bytes --]

Hi Michael

Michael Tremer wrote:

> Hello Rob,
> 
> Thank you for submitting this patch.
> 
> There are several issues with this patch:
> 
> * It has been line-wrapped and therefore does not apply
> 
Apologies I'll try again without wrapping:

--- build/usr/lib/firewall/rules.pl.orig        2019-02-04 20:59:34.677143496 +0000
+++ build/usr/lib/firewall/rules.pl     2019-02-04 21:01:59.445137411 +0000
@@ -609,6 +609,8 @@
        # is enabled.
        foreach my $location (@locations) {
                if(exists $geoipsettings{$location} && $geoipsettings{$location} eq "on") {
+      # add logging for geoip rwb 4/2/19
+                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc $location -j LOG --log-prefix 'GEOIPBLOCK-$location '");
                        run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc $location -j DROP");
                }
        }


> * It is actually intended behaviour of the GeoIP filter to not log those.
> Many systems are flooded with log messages and this filter is supposed to
> skim some things out entirely.
> 
I understand your thinking but it does mess up reporting the logs as I do to Dshield.


> However, I do not think that this is a bad idea, but it should be
> configurable on the firewall options page.
> 
Yes I was thinking that this could be easily select-able with an if statement around the LOG line if required.


Rob  

Re: GeoIP Blocked IPs not being logged

[Rob Brewer]

[-- Attachment #1: Type: text/plain, Size: 548 bytes --]

Hi Michael

Rob Brewer wrote:

>> However, I do not think that this is a bad idea, but it should be
>> configurable on the firewall options page.
>>
> Yes I was thinking that this could be easily select-able with an if
> statement around the LOG line if required.
> 
OK I've been working on your suggestion and have added an additional  
checkbox to the GeoIP Block of  geoip-block.cgi to enable/disable logging.

(patch: geoip-block.cgi)

I have also reworked rules.pl to enable geoip-block logging from geo-
block.cgi.

(patch: rules2.pl)

Rob
 

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: geoip-block.cgi --]
[-- Type: text/x-patch, Size: 2077 bytes --]

--- /home/rwb/IPFire/ipfire-2.x/build/srv/web/ipfire/cgi-bin/geoip-block.cgi	2019-01-31 19:17:48.948676928 +0000
+++ /home/rwb/IPFire/ipfire-2.x/build/srv/web/ipfire/cgi-bin/geoip-block.cgi.dev	2019-02-10 15:24:57.191920078 +0000
@@ -59,6 +59,13 @@
 	} else {
 		$settings{'GEOIPBLOCK_ENABLED'} = "off";
 	}
+        
+	#  check if logging is required
+	if (exists $cgiparams{'LOG_ENABLED'}) {
+		$settings{'LOG_ENABLED'} = "on";
+	} else {
+		$settings{'LOG_ENABLED'} = "off";
+	}        
 
 	# Loop through our locations array to prevent from
 	# non existing countries or code.
@@ -91,22 +98,41 @@
 }
 
 # Checkbox pre-selection.
-my $checked;
+my (%checked,%selected);
 if ($settings{'GEOIPBLOCK_ENABLED'} eq "on") {
-	$checked = "checked='checked'";
-}
+	$checked{'GEOIPBLOCK_ENABLED'}{$settings{'GEOIPBLOCK_ENABLE'}} = "checked='checked'";
+	}
+        
+if ($settings{'LOG_ENABLED'} eq "on") {
+	$checked{'LOG_ENABLED'}{$settings{'LOG_ENABLE'}} = "checked='checked'";
+	}
+
+$checked{'GEOIPBLOCK_ENABLED'}{'off'} = '';
+$checked{'GEOIPBLOCK_ENABLED'}{'on'} = '';
+$checked{'GEOIPBLOCK_ENABLED'}{$settings{'GEOIPBLOCK_ENABLED'}} = "checked='checked'";	
+	
+	
+$checked{'LOG_ENABLED'}{'off'} = '';
+$checked{'LOG_ENABLED'}{'on'} = '';
+$checked{'LOG_ENABLED'}{$settings{'LOG_ENABLED'}} = "checked='checked'";
 
 # Print box to enable/disable geoipblock.
 print"<form method='POST' action='$ENV{'SCRIPT_NAME'}'>\n";
 
 &Header::openbox('100%', 'center', $Lang::tr{'geoipblock'});
+
+# Log enabled checkbox added to enable geoip rules logging
 print <<END;
 	<table width='95%'>
 		<tr>
 			<td width='25%' class='base'>$Lang::tr{'geoipblock enable feature'}
-			<td><input type='checkbox' name='GEOIPBLOCK_ENABLED' $checked></td>
+			<td><input type='checkbox' name='GEOIPBLOCK_ENABLED' $checked{'GEOIPBLOCK_ENABLED'}{'on'}></td>
 		</tr>
 		<tr>
+			<td width='25%' class='base'>$Lang::tr{'log enabled'}
+			<td><input type='checkbox' name='LOG_ENABLED' $checked{'LOG_ENABLED'}{'on'}></td>
+                </tr>
+		<tr>
 			<td colspan='2'><br></td>
 		</tr>
 	</table>


[-- Attachment #3: rules2.pl --]
[-- Type: application/x-perl, Size: 716 bytes --]

Re: GeoIP Blocked IPs not being logged

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 978 bytes --]

Hey Rob,

Please only attach patches inline. That way, people can comment on them directly.

If I now write things like:

  In the first file, line 12, something is not right there…

then nobody knows what I am referring to.

Best,
-Michael

> On 10 Feb 2019, at 16:07, Rob Brewer <ipfire-devel(a)grantura.co.uk> wrote:
> 
> Hi Michael
> 
> Rob Brewer wrote:
> 
>>> However, I do not think that this is a bad idea, but it should be
>>> configurable on the firewall options page.
>>> 
>> Yes I was thinking that this could be easily select-able with an if
>> statement around the LOG line if required.
>> 
> OK I've been working on your suggestion and have added an additional  
> checkbox to the GeoIP Block of  geoip-block.cgi to enable/disable logging.
> 
> (patch: geoip-block.cgi)
> 
> I have also reworked rules.pl to enable geoip-block logging from geo-
> block.cgi.
> 
> (patch: rules2.pl)
> 
> Rob
> <geoip-block.cgi><rules2.pl>