fix: Fixed Geoip with the supported python library + fixed Geolite db path management

misp_modules/modules/expansion/geoip_country.cfg

@@ -1,3 +0,0 @@
-[GEOIP]
-database = /opt/misp-modules/var/GeoIP.dat
-

misp_modules/modules/expansion/geoip_country.py

@@ -1,9 +1,7 @@
 import json
-import pygeoip
+import geoip2.database
 import sys
-import os
 import logging
-import configparser
 
 log = logging.getLogger('geoip_country')
 log.setLevel(logging.DEBUG)
@@ -15,27 +13,22 @@ log.addHandler(ch)
 
 misperrors = {'error': 'Error'}
 mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['freetext']}
-
+moduleconfig = ['local_geolite_db']
 # possible module-types: 'expansion', 'hover' or both
-moduleinfo = {'version': '0.1', 'author': 'Andreas Muehlemann',
+moduleinfo = {'version': '0.2', 'author': 'Andreas Muehlemann',
               'description': 'Query a local copy of Maxminds Geolite database',
               'module-type': ['expansion', 'hover']}
 
-try:
-    # get current db from http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
-    config = configparser.ConfigParser()
-    config.read(os.path.join(os.path.dirname(os.path.abspath(__file__)), 'geoip_country.cfg'))
-    gi = pygeoip.GeoIP(config.get('GEOIP', 'database'))
-    enabled = True
-except Exception:
-    enabled = False
-
 
 def handler(q=False):
     if q is False:
         return False
     request = json.loads(q)
 
+    if not request.get('config') or not request['config'].get('local_geolite_db'):
+        return {'error': 'Please specify the path of your local copy of Maxminds Geolite database'}
+    path_to_geolite = request['config']['local_geolite_db']
+
     if request.get('ip-dst'):
         toquery = request['ip-dst']
     elif request.get('ip-src'):
@@ -45,15 +38,18 @@ def handler(q=False):
     else:
         return False
 
-    log.debug(toquery)
-
     try:
-        answer = gi.country_code_by_addr(toquery)
-    except Exception:
-        misperrors['error'] = "GeoIP resolving error"
+        reader = geoip2.database.Reader(path_to_geolite)
+    except FileNotFoundError:
+        return {'error': f'Unable to locate the GeoLite database you specified ({path_to_geolite}).'}
+    log.debug(toquery)
+    try:
+        answer = reader.country(toquery)
+    except Exception as e:
+        misperrors['error'] = f"GeoIP resolving error: {e}"
         return misperrors
 
-    r = {'results': [{'types': mispattributes['output'], 'values': [str(answer)]}]}
+    r = {'results': [{'types': mispattributes['output'], 'values': [answer.country.iso_code]}]}
 
     return r