gossan-intel 0.3.3

Global Passive and Active Intel pillar for Gossan, part of the security research ecosystem
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112

//! ASN source (ipinfo.io (free tier) or MaxMind fallback).

use async_trait::async_trait;
use serde::Deserialize;

use crate::enrichment::{AsnInfo, GeoInfo, IntelEnrichment};
use crate::sources::IntelSource;

const BASE_URL: &str = "https://ipinfo.io";

/// ASN / GeoIP source.
pub struct AsnSource {
    client: reqwest::Client,
    token: Option<String>,
}

impl AsnSource {
    /// Create a new ASN source.
    pub fn new(client: reqwest::Client, token: Option<String>) -> Self {
        Self { client, token }
    }
}

#[async_trait]
impl IntelSource for AsnSource {
    fn name(&self) -> &'static str {
        "asn"
    }

    async fn query_ip(&self, ip: &str) -> anyhow::Result<IntelEnrichment> {
        let mut url = url::Url::parse(BASE_URL)?;
        {
            let mut segs = url.path_segments_mut().map_err(|_| anyhow::anyhow!("invalid base URL"))?;
            segs.push(ip);
            segs.push("json");
        }
        if let Some(ref token) = self.token {
            url.query_pairs_mut().append_pair("token", token);
        }
        let resp = self.client.get(url).send().await?.error_for_status()?;
        // ipinfo.io payloads are <16 KiB; 64 KiB is generous headroom
        // while bounding malformed/hostile responses.
        let body: IpInfoResp = gossan_core::net::bounded_json(resp, 64 * 1024).await?;

        let mut enrichment = IntelEnrichment::new("asn", "ip", ip);
        enrichment.asn = Some(AsnInfo {
            asn: body.asn.clone().unwrap_or_default(),
            org: body.org.clone(),
            domain: None,
        });
        enrichment.geo = Some(GeoInfo {
            country: body.country.clone(),
            city: body.city.clone(),
            region: body.region.clone(),
        });

        enrichment
            .raw
            .insert("loc".to_string(), serde_json::to_value(body.loc)?);

        Ok(enrichment)
    }

    async fn query_domain(&self, domain: &str) -> anyhow::Result<IntelEnrichment> {
        // ipinfo.io supports domain lookup as well
        let mut url = url::Url::parse(BASE_URL)?;
        {
            let mut segs = url.path_segments_mut().map_err(|_| anyhow::anyhow!("invalid base URL"))?;
            segs.push(domain);
            segs.push("json");
        }
        if let Some(ref token) = self.token {
            url.query_pairs_mut().append_pair("token", token);
        }
        let resp = self.client.get(url).send().await?.error_for_status()?;
        // ipinfo.io payloads are <16 KiB; 64 KiB is generous headroom
        // while bounding malformed/hostile responses.
        let body: IpInfoResp = gossan_core::net::bounded_json(resp, 64 * 1024).await?;

        let mut enrichment = IntelEnrichment::new("asn", "domain", domain);
        enrichment.asn = Some(AsnInfo {
            asn: body.asn.clone().unwrap_or_default(),
            org: body.org.clone(),
            domain: None,
        });
        enrichment.geo = Some(GeoInfo {
            country: body.country.clone(),
            city: body.city.clone(),
            region: body.region.clone(),
        });

        Ok(enrichment)
    }
}

#[derive(Debug, Deserialize)]
struct IpInfoResp {
    #[serde(default)]
    ip: String,
    #[serde(default)]
    city: Option<String>,
    #[serde(default)]
    region: Option<String>,
    #[serde(default)]
    country: Option<String>,
    #[serde(default)]
    loc: Option<String>,
    #[serde(default)]
    org: Option<String>,
    #[serde(default)]
    asn: Option<String>,
}