geoip.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * Copyright 2013 Daniel Borkmann.
   4  * Subject to the GPL, version 2.
   5  */
   6
   7 #include <stdio.h>
   8 #include <stdlib.h>
   9 #include <string.h>
  10 #include <GeoIP.h>
  11 #include <GeoIPCity.h>
  12 #include <netinet/in.h>
  13 #include <netdb.h>
  14 #include <sys/types.h>
  15 #include <sys/stat.h>
  16 #include <fcntl.h>
  17 #include <unistd.h>
  18
  19 #include "built_in.h"
  20 #include "die.h"
  21 #include "ioops.h"
  22 #include "str.h"
  23 #include "xmalloc.h"
  24 #include "zlib.h"
  25 #include "geoip.h"
  26
  27 struct file {
  28         const char *desc, *local;
  29         const char *remote, *possible_prefix;
  30 };
  31
  32 #define PRE     "/download/geoip/database"
  33 static const struct file files[] = {
  34         [GEOIP_CITY_EDITION_REV1] = {
  35                         .desc = "City IPv4",
  36                         .local = ETCDIRE_STRING "/city4.dat",
  37                         .remote = "/GeoLiteCity.dat.gz",
  38                         .possible_prefix = PRE,
  39                 },
  40         [GEOIP_CITY_EDITION_REV1_V6] = {
  41                         .desc = "City IPv6",
  42                         .local = ETCDIRE_STRING "/city6.dat",
  43                         .remote = "/GeoLiteCityv6.dat.gz",
  44                         .possible_prefix = PRE "/GeoLiteCityv6-beta",
  45                 },
  46         [GEOIP_COUNTRY_EDITION] = {
  47                         .desc = "Country IPv4",
  48                         .local = ETCDIRE_STRING "/country4.dat",
  49                         .remote = "/GeoIP.dat.gz",
  50                         .possible_prefix = PRE "/GeoLiteCountry",
  51                 },
  52         [GEOIP_COUNTRY_EDITION_V6] = {
  53                         .desc = "Country IPv6",
  54                         .local = ETCDIRE_STRING "/country6.dat",
  55                         .remote = "/GeoIPv6.dat.gz",
  56                         .possible_prefix = PRE,
  57                 },
  58         [GEOIP_ASNUM_EDITION] = {
  59                         .desc = "AS Numbers IPv4",
  60                         .local = ETCDIRE_STRING "/asname4.dat",
  61                         .remote = "/GeoIPASNum.dat.gz",
  62                         .possible_prefix = PRE "/asnum",
  63                 },
  64         [GEOIP_ASNUM_EDITION_V6] = {
  65                         .desc = "AS Numbers IPv6",
  66                         .local = ETCDIRE_STRING "/asname6.dat",
  67                         .remote = "/GeoIPASNumv6.dat.gz",
  68                         .possible_prefix = PRE "/asnum",
  69                 },
  70 };
  71
  72 static GeoIP *gi4_asname = NULL, *gi6_asname = NULL;
  73 static GeoIP *gi4_country = NULL, *gi6_country = NULL;
  74 static GeoIP *gi4_city = NULL, *gi6_city = NULL;
  75
  76 static GeoIPRecord empty = { NULL };
  77
  78 static char *servers[16] = { NULL };
  79
  80 #define CITYV4          (1 << 0)
  81 #define CITYV6          (1 << 1)
  82 #define COUNTRYV4       (1 << 2)
  83 #define COUNTRYV6       (1 << 3)
  84 #define ASNAMV4         (1 << 4)
  85 #define ASNAMV6         (1 << 5)
  86
  87 #define HAVEALL         (CITYV4 | CITYV6 | COUNTRYV4 | COUNTRYV6 | ASNAMV4 | ASNAMV6)
  88
  89 static int geoip_db_present = 0;
  90
  91 int geoip_working(void)
  92 {
  93         return geoip_db_present == HAVEALL;
  94 }
  95
  96 static int geoip_get_remote_fd(const char *server, const char *port)
  97 {
  98         int ret, fd = -1;
  99         struct addrinfo hints, *ahead, *ai;
 100
 101         bug_on(!server || !port);
 102
 103         memset(&hints, 0, sizeof(hints));
 104
 105         hints.ai_family = PF_UNSPEC;
 106         hints.ai_socktype = SOCK_STREAM;
 107         hints.ai_protocol = IPPROTO_TCP;
 108         hints.ai_flags = AI_NUMERICSERV;
 109
 110         ret = getaddrinfo(server, port, &hints, &ahead);
 111         if (ret != 0)
 112                 return -EIO;
 113
 114         for (ai = ahead; ai != NULL && fd < 0; ai = ai->ai_next) {
 115                 fd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
 116                 if (fd < 0)
 117                         continue;
 118
 119                 ret = connect(fd, ai->ai_addr, ai->ai_addrlen);
 120                 if (ret < 0) {
 121                         close(fd);
 122                         fd = -1;
 123                         continue;
 124                 }
 125
 126                 break;
 127         }
 128
 129         freeaddrinfo(ahead);
 130
 131         return fd;
 132 }
 133
 134 static void geoip_inflate(int which)
 135 {
 136         int ret, ret2 = 1;
 137         gzFile fpi;
 138         FILE *fpo;
 139         char zfile[128], raw[4096];
 140
 141         slprintf(zfile, sizeof(zfile), "%s.gz", files[which].local);
 142         fpi = gzopen(zfile, "rb");
 143         if (fpi == NULL)
 144                 panic("No %s file!\n", zfile);
 145
 146         fpo = fopen(files[which].local, "wb");
 147         if (fpo == NULL)
 148                 panic("Cannot create %s!\n", files[which].local);
 149
 150         while ((ret = gzread(fpi, raw, sizeof(raw))) && ret2)
 151                 ret2 = fwrite(raw, ret, 1, fpo);
 152
 153         gzclose(fpi);
 154         fclose(fpo);
 155 }
 156
 157 static int geoip_get_database(const char *host, int which)
 158 {
 159         int found, sock, fd, i, good, retry = 0;
 160         ssize_t ret, len, rtotlen = 0, totlen = 0;
 161         char raw[4096], *ptr, zfile[128];
 162         size_t lenl = strlen("Content-Length: ");
 163         size_t lent = strlen("HTTP/1.1 200 OK");
 164         size_t lenc = strlen("\r\n\r\n");
 165         const char *http_req_fmt = "GET %s%s HTTP/1.1\n"
 166                                    "Connection: close\n"
 167                                    "Host: %s\r\n\r\n";
 168 again:
 169         found = good = 0;
 170         ptr = NULL;
 171         len = 0;
 172
 173         sock = geoip_get_remote_fd(host, "80");
 174         if (sock < 0)
 175                 return -EIO;
 176
 177         slprintf(raw, sizeof(raw), http_req_fmt,
 178                  retry ? files[which].possible_prefix : "",
 179                  files[which].remote, host);
 180
 181         ret = write(sock, raw, strlen(raw));
 182         if (ret <= 0) {
 183                 close(sock);
 184                 return -EIO;
 185         }
 186
 187         slprintf(zfile, sizeof(zfile), "%s.gz", files[which].local);
 188         fd = open_or_die_m(zfile, O_WRONLY | O_CREAT | O_TRUNC, DEFFILEMODE);
 189
 190         memset(raw, 0, sizeof(raw));
 191         ret = read(sock, raw, sizeof(raw));
 192         if (ret <= 0) {
 193                 close(fd);
 194                 close(sock);
 195                 return -EIO;
 196         }
 197
 198         raw[sizeof(raw) - 1] = 0;
 199
 200         for (i = 0; i < ret; i++) {
 201                 if (!strncmp(raw + i, "Content-Length: ", min_t(size_t, ret - i, lenl))) {
 202                         ptr = raw + i + lenl;
 203                         rtotlen = strtoul(ptr, NULL, 10);
 204                 }
 205
 206                 if (!strncmp(raw + i, "HTTP/1.1 200 OK", min_t(size_t, ret - i, lent)))
 207                         good = 1;
 208
 209                 if (!strncmp(raw + i, "\r\n\r\n", min_t(size_t, ret - i, lenc))) {
 210                         ptr = raw + i + lenc;
 211                         len = ret - i - lenc;
 212                         found = 1;
 213                         break;
 214                 }
 215         }
 216
 217         if (!found || ptr >= raw + ret || len < 0 || rtotlen == 0 || good == 0) {
 218                 close(fd);
 219                 close(sock);
 220
 221                 if (retry == 0) {
 222                         retry = 1;
 223                         goto again;
 224                 }
 225
 226                 return -ENOENT;
 227         }
 228
 229         do {
 230                 write_or_die(fd, ptr, len);
 231                 totlen += len;
 232                 printf("\r%s [%.2f%%, %zd/%zd, %s]", files[which].desc,
 233                        100.f * totlen / rtotlen, totlen, rtotlen, host);
 234                 fflush(stdout);
 235
 236                 memset(raw, 0, sizeof(raw));
 237                 ret = read(sock, raw, sizeof(raw));
 238
 239                 ptr = raw;
 240                 len = ret;
 241         } while (ret > 0);
 242
 243         printf("\n");
 244
 245         close(fd);
 246         close(sock);
 247
 248         if (totlen != rtotlen) {
 249                 unlink(files[which].local);
 250                 return -EIO;
 251         }
 252
 253         geoip_inflate(which);
 254         unlink(zfile);
 255
 256         return 0;
 257 }
 258
 259 static GeoIPRecord *geoip4_get_record(struct sockaddr_in *sa)
 260 {
 261         bug_on(gi4_city == NULL);
 262
 263         return GeoIP_record_by_ipnum(gi4_city, ntohl(sa->sin_addr.s_addr)) ? : &empty;
 264 }
 265
 266 static GeoIPRecord *geoip6_get_record(struct sockaddr_in6 *sa)
 267 {
 268         bug_on(gi6_city == NULL);
 269
 270         return GeoIP_record_by_ipnum_v6(gi6_city, sa->sin6_addr) ? : &empty;
 271 }
 272
 273 const char *geoip4_as_name(struct sockaddr_in *sa)
 274 {
 275         bug_on(gi4_asname == NULL);
 276
 277         return GeoIP_name_by_ipnum(gi4_asname, ntohl(sa->sin_addr.s_addr));
 278 }
 279
 280 const char *geoip6_as_name(struct sockaddr_in6 *sa)
 281 {
 282         bug_on(gi6_asname == NULL);
 283
 284         return GeoIP_name_by_ipnum_v6(gi6_asname, sa->sin6_addr);
 285 }
 286
 287 float geoip4_longitude(struct sockaddr_in *sa)
 288 {
 289         return geoip4_get_record(sa)->longitude;
 290 }
 291
 292 float geoip4_latitude(struct sockaddr_in *sa)
 293 {
 294         return geoip4_get_record(sa)->latitude;
 295 }
 296
 297 float geoip6_longitude(struct sockaddr_in6 *sa)
 298 {
 299         return geoip6_get_record(sa)->longitude;
 300 }
 301
 302 float geoip6_latitude(struct sockaddr_in6 *sa)
 303 {
 304         return geoip6_get_record(sa)->latitude;
 305 }
 306
 307 const char *geoip4_city_name(struct sockaddr_in *sa)
 308 {
 309         return geoip4_get_record(sa)->city;
 310 }
 311
 312 const char *geoip6_city_name(struct sockaddr_in6 *sa)
 313 {
 314         return geoip6_get_record(sa)->city;
 315 }
 316
 317 const char *geoip4_region_name(struct sockaddr_in *sa)
 318 {
 319         return geoip4_get_record(sa)->region;
 320 }
 321
 322 const char *geoip6_region_name(struct sockaddr_in6 *sa)
 323 {
 324         return geoip6_get_record(sa)->region;
 325 }
 326
 327 const char *geoip4_country_name(struct sockaddr_in *sa)
 328 {
 329         bug_on(gi4_country == NULL);
 330
 331         return GeoIP_country_name_by_ipnum(gi4_country, ntohl(sa->sin_addr.s_addr));
 332 }
 333
 334 const char *geoip6_country_name(struct sockaddr_in6 *sa)
 335 {
 336         bug_on(gi6_country == NULL);
 337
 338         return GeoIP_country_name_by_ipnum_v6(gi6_country, sa->sin6_addr);
 339 }
 340
 341 static int fdout, fderr;
 342
 343 /* GeoIP people were too stupid to come to the idea that you could set
 344  * errno appropriately and return NULL instead of printing stuff from
 345  * the library directly that noone can turn off.
 346  */
 347
 348 static void geoip_open_prepare(void)
 349 {
 350         fflush(stdout);
 351         fdout = dup_or_die(1);
 352
 353         fflush(stderr);
 354         fderr = dup_or_die(2);
 355
 356         close(1);
 357         close(2);
 358 }
 359
 360 static void geoip_open_restore(void)
 361 {
 362         dup2_or_die(fdout, 1);
 363         dup2_or_die(fderr, 2);
 364
 365         close(fdout);
 366         close(fderr);
 367 }
 368
 369 static GeoIP *geoip_open_type(int type, int flags)
 370 {
 371         GeoIP *ret;
 372
 373         geoip_open_prepare();
 374         ret = GeoIP_open_type(type, flags);
 375         geoip_open_restore();
 376
 377         return ret;
 378 }
 379
 380 static GeoIP *geoip_open(const char *filename, int flags)
 381 {
 382         GeoIP *ret;
 383
 384         geoip_open_prepare();
 385         ret = GeoIP_open(filename, flags);
 386         geoip_open_restore();
 387
 388         return ret;
 389 }
 390
 391 static void init_geoip_city_open4(int enforce)
 392 {
 393         gi4_city = geoip_open(files[GEOIP_CITY_EDITION_REV1].local, GEOIP_MMAP_CACHE);
 394         if (gi4_city == NULL) {
 395                 gi4_city = geoip_open_type(GEOIP_CITY_EDITION_REV1, GEOIP_MMAP_CACHE);
 396                 if (gi4_city == NULL)
 397                         if (enforce)
 398                                 panic("Cannot open GeoIP4 city database, try --update!\n");
 399         }
 400
 401         if (gi4_city) {
 402                 GeoIP_set_charset(gi4_city, GEOIP_CHARSET_UTF8);
 403                 geoip_db_present |= CITYV4;
 404         }
 405 }
 406
 407 static void init_geoip_city_open6(int enforce)
 408 {
 409         gi6_city = geoip_open(files[GEOIP_CITY_EDITION_REV1_V6].local, GEOIP_MMAP_CACHE);
 410         if (gi6_city == NULL) {
 411                 gi6_city = geoip_open_type(GEOIP_CITY_EDITION_REV1_V6, GEOIP_MMAP_CACHE);
 412                 if (gi6_city == NULL)
 413                         if (enforce)
 414                                 panic("Cannot open GeoIP6 city database, try --update!\n");
 415         }
 416
 417         if (gi6_city) {
 418                 GeoIP_set_charset(gi6_city, GEOIP_CHARSET_UTF8);
 419                 geoip_db_present |= CITYV6;
 420         }
 421 }
 422
 423 static void init_geoip_city(int enforce)
 424 {
 425         init_geoip_city_open4(enforce);
 426         init_geoip_city_open6(enforce);
 427 }
 428
 429 static void destroy_geoip_city(void)
 430 {
 431         GeoIP_delete(gi4_city);
 432         GeoIP_delete(gi6_city);
 433 }
 434
 435 static void init_geoip_country_open4(int enforce)
 436 {
 437         gi4_country = geoip_open(files[GEOIP_COUNTRY_EDITION].local, GEOIP_MMAP_CACHE);
 438         if (gi4_country == NULL) {
 439                 gi4_country = geoip_open_type(GEOIP_COUNTRY_EDITION, GEOIP_MMAP_CACHE);
 440                 if (gi4_country == NULL)
 441                         if (enforce)
 442                                 panic("Cannot open GeoIP4 country database, try --update!\n");
 443         }
 444
 445         if (gi4_country) {
 446                 GeoIP_set_charset(gi4_country, GEOIP_CHARSET_UTF8);
 447                 geoip_db_present |= COUNTRYV4;
 448         }
 449 }
 450
 451 static void init_geoip_country_open6(int enforce)
 452 {
 453         gi6_country = geoip_open(files[GEOIP_COUNTRY_EDITION_V6].local, GEOIP_MMAP_CACHE);
 454         if (gi6_country == NULL) {
 455                 gi6_country = geoip_open_type(GEOIP_COUNTRY_EDITION_V6, GEOIP_MMAP_CACHE);
 456                 if (gi6_country == NULL)
 457                         if (enforce)
 458                                 panic("Cannot open GeoIP6 country database, try --update!\n");
 459         }
 460
 461         if (gi6_country) {
 462                 GeoIP_set_charset(gi6_country, GEOIP_CHARSET_UTF8);
 463                 geoip_db_present |= COUNTRYV6;
 464         }
 465 }
 466
 467 static void init_geoip_country(int enforce)
 468 {
 469         init_geoip_country_open4(enforce);
 470         init_geoip_country_open6(enforce);
 471 }
 472
 473 static void destroy_geoip_country(void)
 474 {
 475         GeoIP_delete(gi4_country);
 476         GeoIP_delete(gi6_country);
 477 }
 478
 479 static void init_geoip_asname_open4(int enforce)
 480 {
 481         gi4_asname = geoip_open(files[GEOIP_ASNUM_EDITION].local, GEOIP_MMAP_CACHE);
 482         if (gi4_asname == NULL) {
 483                 gi4_asname = geoip_open_type(GEOIP_ASNUM_EDITION, GEOIP_MMAP_CACHE);
 484                 if (gi4_asname == NULL)
 485                         if (enforce)
 486                                 panic("Cannot open GeoIP4 AS database, try --update!\n");
 487         }
 488
 489         if (gi4_asname) {
 490                 GeoIP_set_charset(gi4_asname, GEOIP_CHARSET_UTF8);
 491                 geoip_db_present |= ASNAMV4;
 492         }
 493 }
 494
 495 static void init_geoip_asname_open6(int enforce)
 496 {
 497         gi6_asname = geoip_open(files[GEOIP_ASNUM_EDITION_V6].local, GEOIP_MMAP_CACHE);
 498         if (gi6_asname == NULL) {
 499                 gi6_asname = geoip_open_type(GEOIP_ASNUM_EDITION_V6, GEOIP_MMAP_CACHE);
 500                 if (gi6_asname == NULL)
 501                         if (enforce)
 502                                 panic("Cannot open GeoIP6 AS database, try --update!\n");
 503         }
 504
 505         if (gi6_asname) {
 506                 GeoIP_set_charset(gi6_asname, GEOIP_CHARSET_UTF8);
 507                 geoip_db_present |= ASNAMV6;
 508         }
 509 }
 510
 511 static void init_geoip_asname(int enforce)
 512 {
 513         init_geoip_asname_open4(enforce);
 514         init_geoip_asname_open6(enforce);
 515 }
 516
 517 static void destroy_geoip_asname(void)
 518 {
 519         GeoIP_delete(gi4_asname);
 520         GeoIP_delete(gi6_asname);
 521 }
 522
 523 static void init_mirrors(void)
 524 {
 525         size_t i = 0;
 526         FILE *fp;
 527         char buff[256];
 528
 529         fp = fopen(ETCDIRE_STRING "/geoip.conf", "r");
 530         if (!fp)
 531                 panic("Cannot open geoip.conf!\n");
 532
 533         fmemset(buff, 0, sizeof(buff));
 534         while (fgets(buff, sizeof(buff), fp) != NULL &&
 535                i < array_size(servers)) {
 536                 buff[sizeof(buff) - 1] = 0;
 537                 buff[strlen(buff) - 1] = 0;
 538
 539                 if (buff[0] == '#') {
 540                         fmemset(buff, 0, sizeof(buff));
 541                         continue;
 542                 }
 543
 544                 servers[i++] = xstrdup(buff);
 545                 fmemset(buff, 0, sizeof(buff));
 546         }
 547
 548         fclose(fp);
 549 }
 550
 551 static void destroy_mirrors(void)
 552 {
 553         size_t i;
 554
 555         for (i = 0; i < array_size(servers); ++i)
 556                 free(servers[i]);
 557 }
 558
 559 void init_geoip(int enforce)
 560 {
 561         init_geoip_city(enforce);
 562         init_geoip_country(enforce);
 563         init_geoip_asname(enforce);
 564 }
 565
 566 void update_geoip(void)
 567 {
 568         size_t i, j;
 569         int ret, good = 0;
 570
 571         init_mirrors();
 572
 573         for (i = 0; i < array_size(files); ++i) {
 574                 if (files[i].local && files[i].remote) {
 575                         good = 0;
 576
 577                         for (j = 0; j < array_size(servers); ++j) {
 578                                 if (servers[j] == NULL)
 579                                         continue;
 580                                 ret = geoip_get_database(servers[j], i);
 581                                 if (!ret) {
 582                                         good = 1;
 583                                         break;
 584                                 }
 585                         }
 586
 587                         if (good == 0)
 588                                 panic("Cannot get %s from mirrors!\n",
 589                                       files[i].remote);
 590                 }
 591         }
 592
 593         destroy_mirrors();
 594 }
 595
 596 void destroy_geoip(void)
 597 {
 598         destroy_geoip_city();
 599         destroy_geoip_country();
 600         destroy_geoip_asname();
 601
 602         geoip_db_present = 0;
 603 }