From d5d189f340203f8ad96ab9ae29058a421b68cd23 Mon Sep 17 00:00:00 2001
From: Serge Koenigsmann <sko@inmedias.it>
Date: Thu, 27 Feb 2025 14:41:13 +0100
Subject: [PATCH] initial version

but working
---
 .python-version |  1 +
 README.md       | 12 ++++++++++++
 pyproject.toml  |  7 +++++++
 resolver.py     | 29 +++++++++++++++++++++++++++++
 resolver.spec   | 38 ++++++++++++++++++++++++++++++++++++++
 5 files changed, 87 insertions(+)
 create mode 100644 .python-version
 create mode 100644 README.md
 create mode 100644 pyproject.toml
 create mode 100644 resolver.py
 create mode 100644 resolver.spec

diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..24ee5b1
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.13
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..f01ba00
--- /dev/null
+++ b/README.md
@@ -0,0 +1,12 @@
+# logfile Country resolver
+
+## Use like 
+
+```bash
+cat access_crowdsec.log | stdbuf -o0 grep "/search" | grep -v "Safari/" | stdbuf -o0 /tmp/resolver | stdbuf -o0 egrep "Russia|Belarus|^SA|^AS|^AF"  > block_20250227.txt
+cscli decisions delete --all; cat block_20250227.txt | cut -d"|" -f3 | perl -ne 's/(\d+)\.(\d+)\..*/$1.$2/; print ' | uniq | perl -ne 'chomp;print $_,".0.0/16\n"' | cscli decisions import -i - --format values -d48h -R toomuch_AS_SA_AF
+
+```
+
+## packaging
+`pyinstaller --onefile resolv.py`
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 0000000..8263f52
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,7 @@
+[project]
+name = "filter-geo"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.13"
+dependencies = []
diff --git a/resolver.py b/resolver.py
new file mode 100644
index 0000000..02c96df
--- /dev/null
+++ b/resolver.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+# coding: utf-8
+
+import geoip2.database
+import sys
+from collections import defaultdict
+
+reader = geoip2.database.Reader("./dbip-country-lite-2025-02.mmdb")
+
+try:
+    with sys.stdin as file:
+        for rec in file:
+            try:
+                parts = rec.strip().split(" ")
+                ip = parts[0]
+                from_country = None
+                from_continent = None
+                try:
+                    from_continent = reader.country(ip).continent.code
+                    from_country = reader.country(ip).country.name
+                except geoip2.errors.AddressNotFoundError:
+                    from_country = "Unknown"
+                print("{}|{}|{}".format(from_continent, from_country, "|".join(parts)))
+            except:
+                pass
+except KeyboardInterrupt:
+    exit(0)
+except:
+    raise
diff --git a/resolver.spec b/resolver.spec
new file mode 100644
index 0000000..2b5a9e8
--- /dev/null
+++ b/resolver.spec
@@ -0,0 +1,38 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+
+a = Analysis(
+    ['resolver.py'],
+    pathex=[],
+    binaries=[],
+    datas=[],
+    hiddenimports=[],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    optimize=0,
+)
+pyz = PYZ(a.pure)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name='resolver',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=True,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)