diff --git a/misp_modules/modules/expansion/geoip_country.cfg b/misp_modules/modules/expansion/geoip_country.cfg deleted file mode 100644 index 95037e5..0000000 --- a/misp_modules/modules/expansion/geoip_country.cfg +++ /dev/null @@ -1,3 +0,0 @@ -[GEOIP] -database = /opt/misp-modules/var/GeoIP.dat - diff --git a/misp_modules/modules/expansion/geoip_country.py b/misp_modules/modules/expansion/geoip_country.py index 1709d91..11130df 100644 --- a/misp_modules/modules/expansion/geoip_country.py +++ b/misp_modules/modules/expansion/geoip_country.py @@ -1,9 +1,7 @@ import json -import pygeoip +import geoip2.database import sys -import os import logging -import configparser log = logging.getLogger('geoip_country') log.setLevel(logging.DEBUG) @@ -15,27 +13,22 @@ log.addHandler(ch) misperrors = {'error': 'Error'} mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['freetext']} - +moduleconfig = ['local_geolite_db'] # possible module-types: 'expansion', 'hover' or both -moduleinfo = {'version': '0.1', 'author': 'Andreas Muehlemann', +moduleinfo = {'version': '0.2', 'author': 'Andreas Muehlemann', 'description': 'Query a local copy of Maxminds Geolite database', 'module-type': ['expansion', 'hover']} -try: - # get current db from http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz - config = configparser.ConfigParser() - config.read(os.path.join(os.path.dirname(os.path.abspath(__file__)), 'geoip_country.cfg')) - gi = pygeoip.GeoIP(config.get('GEOIP', 'database')) - enabled = True -except Exception: - enabled = False - def handler(q=False): if q is False: return False request = json.loads(q) + if not request.get('config') or not request['config'].get('local_geolite_db'): + return {'error': 'Please specify the path of your local copy of Maxminds Geolite database'} + path_to_geolite = request['config']['local_geolite_db'] + if request.get('ip-dst'): toquery = request['ip-dst'] elif request.get('ip-src'): @@ -45,15 +38,18 @@ def handler(q=False): else: return False - log.debug(toquery) - try: - answer = gi.country_code_by_addr(toquery) - except Exception: - misperrors['error'] = "GeoIP resolving error" + reader = geoip2.database.Reader(path_to_geolite) + except FileNotFoundError: + return {'error': f'Unable to locate the GeoLite database you specified ({path_to_geolite}).'} + log.debug(toquery) + try: + answer = reader.country(toquery) + except Exception as e: + misperrors['error'] = f"GeoIP resolving error: {e}" return misperrors - r = {'results': [{'types': mispattributes['output'], 'values': [str(answer)]}]} + r = {'results': [{'types': mispattributes['output'], 'values': [answer.country.iso_code]}]} return r