conn-add-geodata.bro

##! Add countries for the originator and responder of a connection
##! to the connection logs.

module Conn;

export {
	redef record Conn::Info += {
		## Country code for the originator of the connection based 
		## on a GeoIP lookup.
		orig_cc: string &optional &log;
		## Country code for the responser of the connection based 
		## on a GeoIP lookup.
		resp_cc: string &optional &log;
	};
}

event connection_state_remove(c: connection) 
	{
	local orig_loc = lookup_location(c$id$orig_h);
	if ( orig_loc?$country_code )
		c$conn$orig_cc = orig_loc$country_code;

	local resp_loc = lookup_location(c$id$resp_h);
	if ( resp_loc?$country_code )
		c$conn$resp_cc = resp_loc$country_code;
	}