[PoC] Geoblocking experiments

cmake/objects.cmake

@@ -22,6 +22,7 @@ set(LIBDDWAF_SOURCE
     ${libddwaf_SOURCE_DIR}/src/platform.cpp
     ${libddwaf_SOURCE_DIR}/src/uuid.cpp
     ${libddwaf_SOURCE_DIR}/src/action_mapper.cpp
+    ${libddwaf_SOURCE_DIR}/src/country_codes.cpp
     ${libddwaf_SOURCE_DIR}/src/exclusion/input_filter.cpp
     ${libddwaf_SOURCE_DIR}/src/exclusion/object_filter.cpp
     ${libddwaf_SOURCE_DIR}/src/exclusion/rule_filter.cpp
@@ -41,6 +42,8 @@ set(LIBDDWAF_SOURCE
     ${libddwaf_SOURCE_DIR}/src/matcher/is_xss.cpp
     ${libddwaf_SOURCE_DIR}/src/matcher/ip_match.cpp
     ${libddwaf_SOURCE_DIR}/src/matcher/exact_match.cpp
+    ${libddwaf_SOURCE_DIR}/src/matcher/geo_match_mmdb.cpp
+    ${libddwaf_SOURCE_DIR}/src/matcher/geo_match_radix.cpp
     ${libddwaf_SOURCE_DIR}/src/transformer/lowercase.cpp
     ${libddwaf_SOURCE_DIR}/src/transformer/compress_whitespace.cpp
     ${libddwaf_SOURCE_DIR}/src/transformer/normalize_path.cpp
@@ -87,6 +90,8 @@ set(LIBDDWAF_SOURCE
     ${libddwaf_SOURCE_DIR}/src/vendor/re2/unicode_groups.cc
     ${libddwaf_SOURCE_DIR}/src/vendor/re2/util/rune.cc
     ${libddwaf_SOURCE_DIR}/src/vendor/re2/util/strutil.cc
+    ${libddwaf_SOURCE_DIR}/src/vendor/maxminddb/data-pool.c
+    ${libddwaf_SOURCE_DIR}/src/vendor/maxminddb/maxminddb.c
 )
 
 set(LIBDDWAF_PUBLIC_INCLUDES ${libddwaf_SOURCE_DIR}/include)

src/country_codes.cpp

@@ -0,0 +1,59 @@
+// Unless explicitly stated otherwise all files in this repository are
+// dual-licensed under the Apache-2.0 License or BSD-3-Clause License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2021 Datadog, Inc.
+
+#include "country_codes.hpp"
+
+#include <unordered_map>
+
+namespace ddwaf {
+namespace {
+const std::unordered_map<std::string_view, uint8_t> country_codes{{"AD", 1}, {"AE", 2}, {"AF", 3},
+    {"AG", 4}, {"AI", 5}, {"AL", 6}, {"AM", 7}, {"AO", 8}, {"AQ", 9}, {"AR", 10}, {"AS", 11},
+    {"AT", 12}, {"AU", 13}, {"AW", 14}, {"AX", 15}, {"AZ", 16}, {"BA", 17}, {"BB", 18}, {"BD", 19},
+    {"BE", 20}, {"BF", 21}, {"BG", 22}, {"BH", 23}, {"BI", 24}, {"BJ", 25}, {"BL", 26}, {"BM", 27},
+    {"BN", 28}, {"BO", 29}, {"BQ", 30}, {"BR", 31}, {"BS", 32}, {"BT", 33}, {"BW", 34}, {"BY", 35},
+    {"BZ", 36}, {"CA", 37}, {"CC", 38}, {"CD", 39}, {"CF", 40}, {"CG", 41}, {"CH", 42}, {"CI", 43},
+    {"CK", 44}, {"CL", 45}, {"CM", 46}, {"CN", 47}, {"CO", 48}, {"CR", 49}, {"CU", 50}, {"CV", 51},
+    {"CW", 52}, {"CX", 53}, {"CY", 54}, {"CZ", 55}, {"DE", 56}, {"DJ", 57}, {"DK", 58}, {"DM", 59},
+    {"DO", 60}, {"DZ", 61}, {"EC", 62}, {"EE", 63}, {"EG", 64}, {"EH", 65}, {"ER", 66}, {"ES", 67},
+    {"ET", 68}, {"FI", 69}, {"FJ", 70}, {"FK", 71}, {"FM", 72}, {"FO", 73}, {"FR", 74}, {"GA", 75},
+    {"GB", 76}, {"GD", 77}, {"GE", 78}, {"GF", 79}, {"GG", 80}, {"GH", 81}, {"GI", 82}, {"GL", 83},
+    {"GM", 84}, {"GN", 85}, {"GP", 86}, {"GQ", 87}, {"GR", 88}, {"GS", 89}, {"GT", 90}, {"GU", 91},
+    {"GW", 92}, {"GY", 93}, {"HK", 94}, {"HN", 95}, {"HR", 96}, {"HT", 97}, {"HU", 98}, {"ID", 99},
+    {"IE", 100}, {"IL", 101}, {"IM", 102}, {"IN", 103}, {"IQ", 104}, {"IR", 105}, {"IS", 106},
+    {"IT", 107}, {"JE", 108}, {"JM", 109}, {"JO", 110}, {"JP", 111}, {"KE", 112}, {"KG", 113},
+    {"KH", 114}, {"KI", 115}, {"KM", 116}, {"KN", 117}, {"KP", 118}, {"KR", 119}, {"KW", 120},
+    {"KY", 121}, {"KZ", 122}, {"LA", 123}, {"LB", 124}, {"LC", 125}, {"LI", 126}, {"LK", 127},
+    {"LR", 128}, {"LS", 129}, {"LT", 130}, {"LU", 131}, {"LV", 132}, {"LY", 133}, {"MA", 134},
+    {"MC", 135}, {"MD", 136}, {"ME", 137}, {"MF", 138}, {"MG", 139}, {"MH", 140}, {"MK", 141},
+    {"ML", 142}, {"MM", 143}, {"MN", 144}, {"MO", 145}, {"MP", 146}, {"MQ", 147}, {"MR", 148},
+    {"MS", 149}, {"MT", 150}, {"MU", 151}, {"MV", 152}, {"MW", 153}, {"MX", 154}, {"MY", 155},
+    {"MZ", 156}, {"NA", 157}, {"NC", 158}, {"NE", 159}, {"NF", 160}, {"NG", 161}, {"NI", 162},
+    {"NL", 163}, {"NO", 164}, {"NP", 165}, {"NR", 166}, {"NU", 167}, {"NZ", 168}, {"OM", 169},
+    {"PA", 170}, {"PE", 171}, {"PF", 172}, {"PG", 173}, {"PH", 174}, {"PK", 175}, {"PL", 176},
+    {"PM", 177}, {"PN", 178}, {"PR", 179}, {"PS", 180}, {"PT", 181}, {"PW", 182}, {"PY", 183},
+    {"QA", 184}, {"RE", 185}, {"RO", 186}, {"RS", 187}, {"RU", 188}, {"RW", 189}, {"SA", 190},
+    {"SB", 191}, {"SC", 192}, {"SD", 193}, {"SE", 194}, {"SG", 195}, {"SH", 196}, {"SI", 197},
+    {"SJ", 198}, {"SK", 199}, {"SL", 200}, {"SM", 201}, {"SN", 202}, {"SO", 203}, {"SR", 204},
+    {"SS", 205}, {"ST", 206}, {"SV", 207}, {"SX", 208}, {"SY", 209}, {"SZ", 210}, {"TC", 211},
+    {"TD", 212}, {"TF", 213}, {"TG", 214}, {"TH", 215}, {"TJ", 216}, {"TK", 217}, {"TL", 218},
+    {"TM", 219}, {"TN", 220}, {"TO", 221}, {"TR", 222}, {"TT", 223}, {"TV", 224}, {"TW", 225},
+    {"TZ", 226}, {"UA", 227}, {"UG", 228}, {"US", 229}, {"UY", 230}, {"UZ", 231}, {"VA", 232},
+    {"VC", 233}, {"VE", 234}, {"VG", 235}, {"VI", 236}, {"VN", 237}, {"VU", 238}, {"WF", 239},
+    {"WS", 240}, {"XK", 241}, {"YE", 242}, {"YT", 243}, {"ZA", 244}, {"ZM", 245}, {"ZW", 246}};
+
+}
+
+uint8_t country_code_to_index(std::string_view code)
+{
+    auto it = country_codes.find(code);
+    if (it == country_codes.end()) {
+        [[unlikely]] return 0;
+    }
+    return it->second;
+}
+
+} // namespace ddwaf

src/country_codes.hpp

@@ -0,0 +1,15 @@
+// Unless explicitly stated otherwise all files in this repository are
+// dual-licensed under the Apache-2.0 License or BSD-3-Clause License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2021 Datadog, Inc.
+
+#pragma once
+
+#include <string_view>
+
+namespace ddwaf {
+
+uint8_t country_code_to_index(std::string_view code);
+
+}

src/matcher/geo_match_mmdb.cpp

@@ -0,0 +1,99 @@
+// Unless explicitly stated otherwise all files in this repository are
+// dual-licensed under the Apache-2.0 License or BSD-3-Clause License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2021 Datadog, Inc.
+
+#include <array>
+#include <cstring>
+#include <string_view>
+
+#include "log.hpp"
+#include "matcher/geo_match_mmdb.hpp"
+
+namespace ddwaf::matcher {
+
+namespace {
+
+std::string get_country_from_entry(MMDB_entry_data_list_s *entry)
+{
+    // Hardcoded expected lookup:
+    //  {
+    //    "country":
+    //     {
+    //       "iso_code":
+    //         "GB" <utf8_string>
+    //     }
+    //  }
+
+    if (entry->entry_data.type != MMDB_DATA_TYPE_MAP || entry->entry_data.data_size == 0) {
+        return {};
+    }
+
+    entry = entry->next;
+    if (MMDB_DATA_TYPE_UTF8_STRING != entry->entry_data.type) {
+        return {};
+    }
+
+    std::string_view key{
+        entry->entry_data.utf8_string, static_cast<std::size_t>(entry->entry_data.data_size)};
+    if (key != "country") {
+        return {};
+    }
+
+    entry = entry->next;
+    if (entry->entry_data.type != MMDB_DATA_TYPE_MAP || entry->entry_data.data_size == 0) {
+        return {};
+    }
+
+    entry = entry->next;
+    key = std::string_view{
+        entry->entry_data.utf8_string, static_cast<std::size_t>(entry->entry_data.data_size)};
+    if (key != "iso_code") {
+        return {};
+    }
+
+    entry = entry->next;
+    if (MMDB_DATA_TYPE_UTF8_STRING != entry->entry_data.type) {
+        return {};
+    }
+
+    return {entry->entry_data.utf8_string, static_cast<std::size_t>(entry->entry_data.data_size)};
+}
+
+} // namespace
+
+std::pair<bool, std::string> geo_match_mmdb::match_impl(std::string_view str) const
+{
+    std::array<char, INET6_ADDRSTRLEN> ip_cstr{0};
+    if (str.empty() || str.size() > INET6_ADDRSTRLEN) {
+        return {false, {}};
+    }
+
+    memcpy(ip_cstr.data(), str.data(), str.size());
+
+    int gai_error;
+    int mmdb_error;
+    auto result = MMDB_lookup_string(&mmdb_, ip_cstr.data(), &gai_error, &mmdb_error);
+    if (!result.found_entry || gai_error != 0 || mmdb_error != MMDB_SUCCESS) {
+        return {false, {}};
+    }
+
+    MMDB_entry_data_list_s *entry_data_list = nullptr;
+    int status = MMDB_get_entry_data_list(&result.entry, &entry_data_list);
+    if (status != MMDB_SUCCESS || entry_data_list == nullptr) {
+        MMDB_free_entry_data_list(entry_data_list);
+        return {false, {}};
+    }
+
+    auto country = get_country_from_entry(entry_data_list);
+    DDWAF_DEBUG("Country found: {}", country);
+    MMDB_free_entry_data_list(entry_data_list);
+    if (countries_.contains(country)) {
+        return {true, std::string{country}};
+    }
+
+    return {false, {}};
+}
+
+} // namespace ddwaf::matcher

src/matcher/geo_match_mmdb.hpp

@@ -0,0 +1,50 @@
+// Unless explicitly stated otherwise all files in this repository are
+// dual-licensed under the Apache-2.0 License or BSD-3-Clause License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2021 Datadog, Inc.
+
+#pragma once
+
+#include <stdexcept>
+#include <unordered_set>
+
+#include "matcher/base.hpp"
+#include "maxminddb/maxminddb.h"
+
+namespace ddwaf::matcher {
+
+class geo_match_mmdb : public base_impl<geo_match_mmdb> {
+public:
+    geo_match_mmdb() = default;
+    explicit geo_match_mmdb(
+        std::unordered_set<std::string> countries, const std::string &path = "ip-metadata.mmdb")
+        : countries_(std::move(countries))
+    {
+        int res = MMDB_open(path.c_str(), MMDB_MODE_MMAP, &mmdb_);
+        if (res != MMDB_SUCCESS) {
+            throw std::runtime_error("failed to instantiate mmdb: " + path);
+        }
+    }
+
+    ~geo_match_mmdb() override { MMDB_close(&mmdb_); }
+
+    geo_match_mmdb(const geo_match_mmdb &) = delete;
+    geo_match_mmdb(geo_match_mmdb &&) = default;
+    geo_match_mmdb &operator=(const geo_match_mmdb &) = delete;
+    geo_match_mmdb &operator=(geo_match_mmdb &&) = default;
+
+protected:
+    static constexpr std::string_view to_string_impl() { return ""; }
+    static constexpr std::string_view name_impl() { return "geo_match_mmdb"; }
+    static constexpr DDWAF_OBJ_TYPE supported_type_impl() { return DDWAF_OBJ_STRING; }
+
+    [[nodiscard]] std::pair<bool, std::string> match_impl(std::string_view str) const;
+
+    MMDB_s mmdb_{};
+    std::unordered_set<std::string> countries_{};
+
+    friend class base_impl<geo_match_mmdb>;
+};
+
+} // namespace ddwaf::matcher

src/matcher/geo_match_radix.cpp

@@ -0,0 +1,92 @@
+// Unless explicitly stated otherwise all files in this repository are
+// dual-licensed under the Apache-2.0 License or BSD-3-Clause License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2021 Datadog, Inc.
+
+#include <chrono>
+#include <cstring>
+#include <stdexcept>
+#include <string_view>
+
+#include "country_codes.hpp"
+#include "matcher/geo_match_radix.hpp"
+
+namespace ddwaf::matcher {
+
+geo_match_radix::geo_match_radix(std::unordered_set<std::string_view> countries,
+    const std::vector<std::pair<std::string_view, std::string_view>> &ip_list)
+    : rtree_(radix_new(radix_tree_bits), radix_free)
+{
+    if (!rtree_) {
+        throw std::runtime_error("failed to instantiate radix tree");
+    }
+
+    countries_.reserve(countries.size());
+    for (auto &code : countries) {
+        auto index = country_code_to_index(code);
+        if (index == 0) {
+            continue;
+        }
+        countries_.emplace(index);
+    }
+
+    for (auto [str, code] : ip_list) {
+        // Parse and populate each IP/network
+        ipaddr ip{};
+        if (ddwaf::parse_cidr(str, ip)) {
+            auto index = country_code_to_index(code);
+            if (index == 0) {
+                continue;
+            }
+
+            prefix_t prefix;
+            // NOLINTNEXTLINE(hicpp-no-array-decay,cppcoreguidelines-pro-bounds-array-to-pointer-decay)
+            radix_prefix_init(FAMILY_IPv6, ip.data, ip.mask, &prefix);
+            auto *node = radix_put_if_absent(rtree_.get(), &prefix, 0);
+            if (node == nullptr) {
+                continue;
+            }
+            node->iso_code = index;
+        }
+    }
+}
+
+[[nodiscard]] bool geo_match_radix::match_ip(const ipaddr &ip) const
+{
+    // Initialize the radix structure to check if the IP exist
+    prefix_t radix_ip;
+    // NOLINTNEXTLINE(hicpp-no-array-decay,cppcoreguidelines-pro-bounds-array-to-pointer-decay,
+    // cppcoreguidelines-pro-type-const-cast)
+    radix_prefix_init(FAMILY_IPv6, const_cast<uint8_t *>(ip.data), radix_tree_bits, &radix_ip);
+
+    // Run the check
+    auto *node = radix_matching_do(rtree_.get(), &radix_ip);
+    if (node == nullptr) {
+        return false;
+    }
+
+    return countries_.contains(node->iso_code);
+}
+
+std::pair<bool, std::string> geo_match_radix::match_impl(std::string_view str) const
+{
+    if (!rtree_ || str.empty() || str.data() == nullptr) {
+        return {false, {}};
+    }
+
+    ddwaf::ipaddr ip{};
+    if (!ddwaf::parse_ip(str, ip)) {
+        return {false, {}};
+    }
+    // Convert the IPv4 to IPv6
+    ddwaf::ipv4_to_ipv6(ip);
+
+    if (!match_ip(ip)) {
+        return {false, {}};
+    }
+
+    return {true, std::string{str}};
+}
+
+} // namespace ddwaf::matcher