I updated to the latest stream release last night. I rely upon geoip blocking at the vyos level for some of my services, yet it appears be be broken in this release.
Current Behavior:
Geo-ip no longer updates itself, after a reboot everything setup with geoip rules in the firewall default to blocked, even if they’re specifically allowed.
If I try to upgrade via the ops mode, I get permissions errors while it tries to write the download. It cannot write to the /usr/share/vyos-geoip/ directory as the permissions are set incorrectly in the ephemeral boot image.
Workaround attempt 1, set the permissions with sudo su to allow write by all to /usr/share/vyos-geoip/
Result: write database step completes yet then I encounter a second error: Failed to extract, aborting. The database never gets processed and all geoip rules are still blocking specific geoip allows.
Workaround attempt 2, run geoip update as root via sudo
Result: Works, blocks/allows defined in firewall work again, YET it takes a manual fix every time the system boots.
Expected Behavior:
Same as previous versions
The system would automatically download the geoip database during firewall commits
geoip update as non root would function to completion.
geoip database would persistent reboots.
Being I don’t code, I assume this is because if the geoip dataset is needed it re-downloads during the boot? I can’t find anything in /config/ directory related to persistence of the geoip downloads..
Impact:
Although I have a workaround, if VYOS ever reboots I now must login to fix the issue manually using the workaround attempt 2 above. If there’s an unexpected reboot, I may end up with traffic that’s allowed via geoip being blocked (this is how I realized there was an issue, my exposed geoip controlled services stopped working.
I have a few choices, I can go to rolling if this is already fixed, or find a better workaround with automation, yet I’m not exactly sure how to design this clearly. I’d love some feedback on the best option, I’ve been running VYOS in my lab for many years now, and hope for many more, yet this goes beyond my understand of the underlying mechanisms. I’d appreciate any help that can be offered!
I haven’t tested it yet, waiting for a time to reboot, yet it does run properly as root, just not sure what context the scripts run as, hopeful it’s also root, assuming so, as it’s owned by root. Thanks for your time and dedication!
I know that the Stream is suppose to be for labs, and it’s only SEMI-stable, yet this is regression that I could see affecting a lot of people, as the geoip as been part of the builds for quite some time.
I don’t expect that there will be a re-release, and I understand, it’s a point-in-time snapshot. I can live with it, yet I suppose what can be taken from this is there are some unit tests that perhaps need adjustment ;).
The only way to get the geoip update to complete successfully is to run it as root. I have a backup script that I run once a day that runs as root, so I’m adding this command, but it would be nice to be able to run it as a non-root user.