From 7f6f94370ec04ce48e7a19880a74ba0c25f7bfb5 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Thu, 2 Oct 2025 17:47:10 +0200
Subject: geoip: T7926: Refactor geoip handling

* Move core logic to separate vyos.geoip module
* Use a sqlite database for storing and querying address ranges by country
* Remove downloaded geoip ranges once loaded into sqlite db
* No longer rebuild geoip sets on each commit unless necessary
* Allows for extensibility using other geoip data vendors
---
 data/templates/firewall/nftables-geoip-update.j2 | 24 ++++++++++++------------
 data/templates/firewall/nftables-policy.j2       |  8 ++++----
 data/templates/firewall/nftables.j2              |  8 ++++----
 3 files changed, 20 insertions(+), 20 deletions(-)

(limited to 'data')

diff --git a/data/templates/firewall/nftables-geoip-update.j2 b/data/templates/firewall/nftables-geoip-update.j2
index d8f80d1f5..c51e4aafc 100644
--- a/data/templates/firewall/nftables-geoip-update.j2
+++ b/data/templates/firewall/nftables-geoip-update.j2
@@ -1,12 +1,12 @@
 #!/usr/sbin/nft -f
 
-{% if ipv4_sets is vyos_defined %}
-{%     for setname, ip_list in ipv4_sets.items() %}
+{% if firewall_sets.v4 is vyos_defined %}
+{%     for setname, ip_list in firewall_sets.v4.items() %}
 flush set ip vyos_filter {{ setname }}
 {%     endfor %}
 
 table ip vyos_filter {
-{%     for setname, ip_list in ipv4_sets.items() %}
+{%     for setname, ip_list in firewall_sets.v4.items() %}
     set {{ setname }} {
         type ipv4_addr
         flags interval
@@ -16,13 +16,13 @@ table ip vyos_filter {
 }
 {% endif %}
 
-{% if ipv6_sets is vyos_defined %}
-{%     for setname, ip_list in ipv6_sets.items() %}
+{% if firewall_sets.v6 is vyos_defined %}
+{%     for setname, ip_list in firewall_sets.v6.items() %}
 flush set ip6 vyos_filter {{ setname }}
 {%     endfor %}
 
 table ip6 vyos_filter {
-{%     for setname, ip_list in ipv6_sets.items() %}
+{%     for setname, ip_list in firewall_sets.v6.items() %}
     set {{ setname }} {
         type ipv6_addr
         flags interval
@@ -33,13 +33,13 @@ table ip6 vyos_filter {
 {% endif %}
 
 
-{% if ipv4_sets_policy is vyos_defined %}
-{%     for setname, ip_list in ipv4_sets_policy.items() %}
+{% if policy_sets.v4 is vyos_defined %}
+{%     for setname, ip_list in policy_sets.v4.items() %}
 flush set ip vyos_mangle {{ setname }}
 {%     endfor %}
 
 table ip vyos_mangle {
-{%     for setname, ip_list in ipv4_sets_policy.items() %}
+{%     for setname, ip_list in policy_sets.v4.items() %}
     set {{ setname }} {
         type ipv4_addr
         flags interval
@@ -49,13 +49,13 @@ table ip vyos_mangle {
 }
 {% endif %}
 
-{% if ipv6_sets_policy is vyos_defined %}
-{%     for setname, ip_list in ipv6_sets_policy.items() %}
+{% if policy_sets.v6 is vyos_defined %}
+{%     for setname, ip_list in policy_sets.v6.items() %}
 flush set ip6 vyos_mangle {{ setname }}
 {%     endfor %}
 
 table ip6 vyos_mangle {
-{%     for setname, ip_list in ipv6_sets_policy.items() %}
+{%     for setname, ip_list in policy_sets.v6.items() %}
     set {{ setname }} {
         type ipv6_addr
         flags interval
diff --git a/data/templates/firewall/nftables-policy.j2 b/data/templates/firewall/nftables-policy.j2
index 00d0e8a62..68f79e656 100644
--- a/data/templates/firewall/nftables-policy.j2
+++ b/data/templates/firewall/nftables-policy.j2
@@ -34,8 +34,8 @@ table ip vyos_mangle {
     }
 {%     endfor %}
 
-{%     if geoip_updated.name is vyos_defined %}
-{%         for setname in geoip_updated.name %}
+{%     if geoip_sets.name is vyos_defined %}
+{%         for setname in geoip_sets.name %}
     set {{ setname }} {
         type ipv4_addr
         flags interval
@@ -74,8 +74,8 @@ table ip6 vyos_mangle {
 {%         endif %}
     }
 {%     endfor %}
-{%     if geoip_updated.ipv6_name is vyos_defined %}
-{%         for setname in geoip_updated.ipv6_name %}
+{%     if geoip_sets.ipv6_name is vyos_defined %}
+{%         for setname in geoip_sets.ipv6_name %}
     set {{ setname }} {
         type ipv6_addr
         flags interval
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2
index f810496f9..903fae330 100755
--- a/data/templates/firewall/nftables.j2
+++ b/data/templates/firewall/nftables.j2
@@ -172,8 +172,8 @@ table ip vyos_filter {
         flags interval
     }
 {%     endfor %}
-{%     if geoip_updated.name is vyos_defined %}
-{%         for setname in geoip_updated.name %}
+{%     if geoip_sets.name is vyos_defined %}
+{%         for setname in geoip_sets.name %}
     set {{ setname }} {
         type ipv4_addr
         flags interval
@@ -359,8 +359,8 @@ table ip6 vyos_filter {
         flags interval
     }
 {%     endfor %}
-{%     if geoip_updated.ipv6_name is vyos_defined %}
-{%         for setname in geoip_updated.ipv6_name %}
+{%     if geoip_sets.ipv6_name is vyos_defined %}
+{%         for setname in geoip_sets.ipv6_name %}
     set {{ setname }} {
         type ipv6_addr
         flags interval
-- 
cgit v1.2.3