Hi<br />
<br />
I preliminary version is available at :<br />
https://github.com/alfh/ipfire-2.x/tree/feature_firewalllogcountry<br />
<br />
Currently I am struggling at getting the new functionality available in
the menu, so I am asking if anyone has a tip on how to do that ?<br />
I&#39;ve tried to edit the file :<br />
--- a/config/menu/70-log.menu<br />
+++ b/config/menu/70-log.menu<br />
@@ -33,6 +33,11 @@<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&#39;title&#39; =&gt;
&quot;$Lang::tr{&#39;firewall logs port&#39;}&quot;,<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&#39;enabled&#39; =&gt;
1<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;};<br />
+ &nbsp; &nbsp;$sublogs-&gt;{&#39;43.firewallcountry&#39;} =
{&#39;caption&#39; =&gt; $Lang::tr{&#39;firewall logs country&#39;},<br />
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&#39;uri&#39; =&gt;
&#39;/cgi-bin/logs.cgi/firewalllogcountry.dat&#39;,<br />
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&#39;title&#39; =&gt;
&quot;$Lang::tr{&#39;firewall logs country&#39;}&quot;,<br />
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&#39;enabled&#39; =&gt; 1<br />
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;};<br />
<br />
but that does not seem to be enough.<br />
<br />
Regards<br />
Alf<br />
<br />
<br />
Den ons, februar 12, 2014, 20:41 skrev Michael Tremer:<br />
&gt; Hi,<br />
&gt;<br />
&gt; On Wed, 2014-02-12 at 18:21 +0100, Alf H&oslash;gemark wrote:<br />
&gt;&gt; Hi<br />
&gt;&gt;<br />
&gt;&gt; Based on the existing firewalllogip.dat and firewalllogport.dat,
I want<br />
&gt;&gt; a similair function to show<br />
&gt;&gt; which countries gets blocked, to see which country is mainly
targeting<br />
&gt;&gt; my servers.<br />
&gt;&gt;<br />
&gt;&gt; I&#39;ve made a preliminary prototype, you can see it here :<br />
&gt;&gt;
https://github.com/alfh/ipfire-2.x/commit/a99ee9ce4fcdc9e41bfdfd7bd169324d1a0dcee0<br
/>
&gt;&gt;<br />
&gt;&gt; This works on my existing 2.13 Core75.<br />
&gt;&gt; There is no right menu, it is just a preliminary prototype as of
now.<br />
&gt;&gt;<br />
&gt;&gt;<br />
&gt;&gt; What I basically have done, is to copy firewalllogip.dat and<br />
&gt;&gt; showrequestfromip.dat, and modified them<br />
&gt;&gt; so they work on &quot;country for ip address&quot; rather than
inidividual ip<br />
&gt;&gt; address.<br />
&gt;&gt;<br />
&gt;&gt; This raises a few questions in my mind :<br />
&gt;&gt;<br />
&gt;&gt; 1.<br />
&gt;&gt; Code duplication. By just copying the firewalllogip.dat, I
duplicate a<br />
&gt;&gt; lot of code.<br />
&gt;&gt; To me, this also seems to be the case already, where
firewalllogip.dat<br />
&gt;&gt; and firewalllogport.dat containing<br />
&gt;&gt; a lot of duplicated code.<br />
&gt;&gt; Any ideas how to avoid this ?<br />
&gt;&gt; Has it been discussed to try to minimze the existing code
duplication in<br />
&gt;&gt; the cgi-bin files ?<br />
&gt;<br />
&gt; You may create a perl file that will be included which provides<br />
&gt; functions for both scripts.<br />
&gt;<br />
&gt;&gt; 2.<br />
&gt;&gt; Do think &quot;local ip addresses&quot; should turn up in
firewalllogcounty.dat ?<br />
&gt;<br />
&gt; No.<br />
&gt;<br />
&gt;&gt; Here is the main part of my code :<br />
&gt;&gt; my $gi = Geo::IP::PurePerl-&gt;new();<br />
&gt;&gt; ....<br />
&gt;&gt;<br />
&gt;&gt; if($_ =~ /SRC\=([\d\.]+)/){<br />
&gt;&gt; my $srcaddr=$1;<br />
&gt;&gt; my $ccode = $gi-&gt;country_code_by_name($srcaddr);<br />
&gt;&gt; my $fcode;<br />
&gt;&gt;<br />
&gt;&gt; # TODO: should local IP adresses be include as unknown, or
excluded<br />
&gt;&gt; from the statistics totally ?<br />
&gt;&gt; # TODO: it would be nice to be able to group local IPs into
&quot;red&quot;,<br />
&gt;&gt; &quot;green&quot;, &quot;blue&quot; etc<br />
&gt;&gt; if( $ccode eq &quot;&quot;) {<br />
&gt;&gt; $ccode = &quot;unknown&quot;;<br />
&gt;&gt; }<br />
&gt;&gt; else {<br />
&gt;&gt; $tabjc{$ccode} = $tabjc{$ccode} + 1 ;<br />
&gt;&gt; if(($tabjc{$ccode} == 1) &amp;&amp; ($lines &lt; $pienumber)) {
$lines =<br />
&gt;&gt; $lines + 1; }<br />
&gt;&gt; $linesjc++;<br />
&gt;&gt; }<br />
&gt;&gt; }<br />
&gt;&gt;<br />
&gt;&gt; As you can see, I now decide to not include the local ip
addresses.<br />
&gt;&gt; I also currently do not differentiate between local ip addresses
and ip<br />
&gt;&gt; addresses where country code is actually unknown.<br />
&gt;&gt; I&#39;ll have to check if Geo::IP has some functionality to tell
me if the<br />
&gt;&gt; address is part of &quot;non routable addresses&quot;, like
192.168.x.y.<br />
&gt;<br />
&gt; There certainly is a perl module (like this<br />
&gt;
http://search.cpan.org/~neely/Data-Validate-IP-0.11/lib/Data/Validate/IP.pm),<br
/>
&gt; but we also have got some simple checks in setddns.pl for example.<br />
&gt;<br />
&gt;&gt; 3.<br />
&gt;&gt; Is there functionality existing in ipfire cgi-bin code to check
if an ip<br />
&gt;&gt; address is part of the netmask of the &quot;green&quot;,
&quot;red&quot;, &quot;blue&quot;, &quot;yellow&quot;<br />
&gt;&gt; interface ?<br />
&gt;&gt; If so, I think I would like to treat them like
&quot;countries&quot;.<br />
&gt;<br />
&gt; Yes. Have a look at /var/ipfire/general-functions.pl<br />
&gt;<br />
&gt;&gt; 4.<br />
&gt;&gt; Do other people find this functionality useful ?<br />
&gt;<br />
&gt; Why not?<br />
&gt;<br />
&gt;&gt;<br />
&gt;&gt; Regards<br />
&gt;&gt; Alf<br />
&gt;&gt;<br />
&gt;&gt; _______________________________________________<br />
&gt;&gt; Development mailing list<br />
&gt;&gt; Development@lists.ipfire.org<br />
&gt;&gt; http://lists.ipfire.org/mailman/listinfo/development<br />
&gt;<br />
&gt;