Comment 4 for bug 1867198

I reviewed libnginx-mod-http-geoip2/nginx 1.18.0-6ubuntu4 (aka
http-geoip2 3.3 upstream) as checked into hirsute. This shouldn't
be considered a full audit but rather a quick gauge of maintainability.

libnginx-mod-http-geoip2 is an nginx module registers variables on the
connection based on the precompiled MaxMind database, for use by by
other elements with nginx.

- No CVE history found for this nginx module.
- The only additional dependency here is on the libmaxminddb library.
- pre/post inst/rm scripts attempt to handle the module configuration
  for nginx.
- No init scripts.
- No systemd units.
- No dbus services.
- No binaries, setuid or otherwise.
- No sudo fragments.
- No polkit files.
- No udev rules.
- There does not appear to be any unit or functional tests, and
  autopkgtests do not appear to exercise the module.
- No cron jobs.
- No build warnings or errors on the module compilation. No lintian
  warnings.

- No Processes spawned.
- Most memory/string management is around handling config options as
  well as copying values from the MindMap db. As such, it's got a bunch
  of magic constants that get added and subtracted to things, so it's
  not super clear that it's allocating sizes correctly. But at least
  return values are checked for errors.
- The only File IO is to open and lookup entries in the static MaxMind
  database, and is specified through the module configuration file.
- Logging is handled through the standard ngninx module logging
  interface, and uses format strings correctly.
- No environment variable usage.
- No use of privileged functions.
- No use of cryptography / random number sources etc?
- No use of temp files.
- Networking is handled by nginx proper, the only bits related to
  networking are getting the ipv4/ipv6 connection information from the
  request, and looks okay.
- No use of WebKit.
- No use of PolicyKit.

- No Coverity of cppcheck results reported for the module.

The module is relatively small and well contained. Issues like
https://github.com/leev/ngx_http_geoip2_module/issues/90 are mildly
concerning, but the only thing really under an attacker control is the
ipv4 or ipv6 address being looked up, so the threat surface is small.

Security team ACK for promoting libnginx-mod-http-geoip2 to main.
One question I have is whether this MIR is limited strictly to
libnginx-mod-http-geoip2, or is libnginx-mod-stream-geoip2 covered
as well? If the latter, nothing different turned up while examining it
in the course of looking at libnginx-mod-http-geoip2.