geoip: T8049: Add MaxMind database support

2 files changed, 36 insertions, 9 deletions

diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 18c250d08..02c9b2e3e 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -491,6 +491,12 @@ def verify(firewall):
                 for ifname in interfaces:
                     verify_hardware_offload(ifname)
 
+    if dict_search_args(firewall, 'global_options', 'geoip', 'provider') == 'maxmind':
+        geoip_options = dict_search_args(firewall, 'global_options', 'geoip')
+        required_keys = ['maxmind_account_id', 'maxmind_license_key']
+        if not all(key in geoip_options for key in required_keys):
+            raise ConfigError('MaxMind GeoIP provider requires maxmind-account-id and maxmind-license-key')
+
     if dict_search('global_options.state_policy', firewall) is not None:
         # Generate list of chains where conntrack is disabled
         conntrack_disabled_list = []
diff --git a/src/helpers/geoip-update.py b/src/helpers/geoip-update.py
index a6838c62d..8a414267e 100755
--- a/src/helpers/geoip-update.py
+++ b/src/helpers/geoip-update.py
@@ -19,9 +19,11 @@ import sys
 
 from vyos.configquery import ConfigTreeQuery
 from vyos.geoip import geoip_download_dbip
+from vyos.geoip import geoip_download_maxmind
 from vyos.geoip import db_initialise
 from vyos.geoip import db_is_initialised
 from vyos.geoip import db_import_dbip_ranges
+from vyos.geoip import db_import_maxmind_ranges
 from vyos.geoip import geoip_update
 
 def get_config(config=None):
@@ -31,6 +33,8 @@ def get_config(config=None):
         conf = ConfigTreeQuery()
 
     return (
+        conf.get_config_dict(['firewall', 'global-options', 'geoip'], key_mangling=('-', '_'), get_first_key=True,
+                                    no_tag_node_value_mangle=True, with_defaults=True),
         conf.get_config_dict(['firewall'], key_mangling=('-', '_'), get_first_key=True,
                                     no_tag_node_value_mangle=True) if conf.exists(['firewall']) else None,
         conf.get_config_dict(['policy'], key_mangling=('-', '_'), get_first_key=True,
@@ -47,19 +51,36 @@ if __name__ == '__main__':
         db_import_dbip_ranges(delete_file=True)
         sys.exit(0)
 
+    options, firewall, policy = get_config()
+
     if not db_is_initialised():
         db_initialise()
 
-    print('Dowloading latest DB-IP database...')
-    if not geoip_download_dbip():
-        print('Failed to download, aborting.')
-        sys.exit(1)
+    if options['provider'] == 'db-ip':
+        print('Dowloading latest DB-IP database...')
+        if not geoip_download_dbip():
+            print('Failed to download, aborting.')
+            sys.exit(1)
 
-    print('Extracting database...')
-    if not db_import_dbip_ranges(delete_file=True):
-        print('Failed to extract, aborting.')
-        sys.exit(1)
+        print('Extracting database...')
+        if not db_import_dbip_ranges(delete_file=True):
+            print('Failed to extract, aborting.')
+            sys.exit(1)
+
+    elif options['provider'] == 'maxmind':
+        account_id = options['maxmind_account_id']
+        license_key = options['maxmind_license_key']
+        lite = 'maxmind_lite' in options
+
+        print('Dowloading latest MaxMind database...')
+        if not geoip_download_maxmind(account_id, license_key, lite):
+            print('Failed to download, aborting.')
+            sys.exit(1)
+
+        print('Extracting database...')
+        if not db_import_maxmind_ranges(delete_file=True):
+            print('Failed to extract, aborting.')
+            sys.exit(1)
 
-    firewall, policy = get_config()
     if not geoip_update(firewall=firewall, policy=policy):
         sys.exit(1)