chapinb / chickadee-rs

Yet another GeoIP enrichment tool

Chickadee-rs

A rust implementation of chickadee

⚠️ WORK IN PROGRESS ⚠️

This is under development. Please do not use.

Installation

This crate is not yet available on crates.io. You can install it with cargo install --git https://github.com/chapinb/chickadee-rs

Usage

This is a command line application that extracts a collection of IP addresses from a source and enriches them with the ip-api.com API.

More APIs to come in the future.

Examples

• One IP: chickadee --ips 1.1.1.1
• Select a few columns: chickadee --ips 1.1.1.1 --columns query,city,country
• Multiple IPs: chickadee --ips "1.1.1.1,2.2.2.2 3.3.3.3 4.4.4.4"
  • Note: as long as they are delimited, they are likely to be detected and resolved.
• A plain text file containing IPs: chickadee --ips firewall.log
• A gzip file containing IPs: chickadee --ips cloudtrail.log.gz

Development

After checking out this repository, run the following commands from the root:

• Install cargo-checkmate: cargo install cargo-checkmate
• Pre-commit install: pre-commit install --install-hooks
• Pre-commit checks: pre-commit run --all
• Rust tests: cargo checkmate

Open a merge request for each new feature, keeping the commits and overall diffs as small as possible. Only submit one new feature per merge request.

Testing

You can run tests with cargo test. You may want to use cargo watch -x test to continuously run tests as you work.

CI

The CI will automatically run 2 tests, seen in detail in .github/workflows:

1. cargo checkmate
2. cargo run -- ... with 3 scenarios
   1. A single IP, with a set of columns
   2. A file of IPs, with a set of columns
   3. A single IP with all columns

Sending SBOM to dependency track

Run the ./tools/post-bom.sh script from the same directory as this README with the args:

1. API Endpoint, ie. http://localhost:8081
2. API Key
3. UUID of the project in dependency track

Running profiling

1. Install perf
2. Install flamegraph, cargo install flamegraph
3. Build the binary in debug mode, cargo build
4. Run the tool with the args, flamegraph -- target/debug/chickadee --ips test_data/test.ips.txt --columns query,lat,lon

chickadee-rs's Issues

Implement a Resolver for VirusTotal

Hi Chapin, I wrote this resolver for the VirusTotal API which I am looking to integrate into Chickadee

use reqwest::Client;
use serde_json::Value;

//hardcoded api key; implement alternative
const VIRUS_TOTAL_API_KEY: &str = "YOUR API KEY HERE";

async fn lookup_ip(ip: &str) -> Result<(), reqwest::Error> {
    let client = Client::new();

    let url = format!("https://www.virustotal.com/api/v3/ip_addresses/{}", ip);

    //create request headers from API key
    let mut headers = HeaderMap::new();
    headers.insert(
        "x-apikey",
        HeaderValue::from_str(VIRUS_TOTAL_API_KEY).expect("Invalid API key"),
    );

    //send async request
    let mut response = client
        .get(&url)
        .headers(headers)
        .send()
        .await?;

    //parse response body as json
    let response_body: Value = response.json().await?;

    println!("Response: {:?}", response_body);

    Ok(())
}

#[tokio::main]
async fn main() {
    //implement cli arg here
    let ip_address = "204.77.151.204";
    
    if let Err(err) = lookup_ip(ip_address).await {
        eprintln!("Error: {}", err);
    }
}

/*to do:
parse output
impl arg for choosing resolver
*/

Add pre-commit

Add pre-commit to this repository with common and rust-specific checks.

See https://github.com/chapinb/secure-development-for-all for samples