[Kimchi-devel] [RESEND PATCH V5 1/1] spec: Open 8000 and 8001 port by default

[Aline Manera]

On 12/31/2013 12:21 AM, taget at linux.vnet.ibm.com wrote:
> From: Eli Qiao <taget at linux.vnet.ibm.com>
>
> Use firewalld to manager firewall rules on RHEL7, fedora and ubuntu.
> Add static rules in iptables to on RHEL6.
>
> Signed-off-by: Eli Qiao <taget at linux.vnet.ibm.com>
> ---
>   contrib/DEBIAN/control.in     |    3 ++-
>   contrib/DEBIAN/postinst       |    2 ++
>   contrib/DEBIAN/postrm         |    2 ++
>   contrib/kimchi.spec.fedora.in |   24 +++++++++++++++++++++---
>   contrib/kimchi.spec.suse.in   |   10 ++++++++--
>   src/Makefile.am               |    1 +
>   src/firewalld.xml             |    7 +++++++
>   7 files changed, 43 insertions(+), 6 deletions(-)
>   create mode 100644 src/firewalld.xml
>
> diff --git a/contrib/DEBIAN/control.in b/contrib/DEBIAN/control.in
> index 380584c..c0ea1f1 100644
> --- a/contrib/DEBIAN/control.in
> +++ b/contrib/DEBIAN/control.in
> @@ -17,7 +17,8 @@ Depends: python-cherrypy3 (>= 3.2.0),
>            python-psutil (>= 0.6.0),
>            python-ethtool,
>            sosreport,
> -         python-ipaddr
> +         python-ipaddr,
> +         firewalld
>   Build-Depends:
>   Maintainer: Aline Manera <alinefm at br.ibm.com>
>   Description: Kimchi web server
> diff --git a/contrib/DEBIAN/postinst b/contrib/DEBIAN/postinst
> index c1fc22e..06233e0 100755
> --- a/contrib/DEBIAN/postinst
> +++ b/contrib/DEBIAN/postinst
> @@ -19,3 +19,5 @@
>   # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
>
>   service kimchid start
> +firewall-cmd --reload
> +firewall-cmd --add-service kimchid
> diff --git a/contrib/DEBIAN/postrm b/contrib/DEBIAN/postrm
> index ef90b49..3c70584 100755
> --- a/contrib/DEBIAN/postrm
> +++ b/contrib/DEBIAN/postrm
> @@ -26,3 +26,5 @@ case "$1" in
>           rm -rf /var/log/kimchi /var/run/kimchi.pid /usr/share/kimchi/
>       ;;
>   esac
> +
> +/usr/bin/firewall-cmd --remove-service kimchid

Don't need full path

> diff --git a/contrib/kimchi.spec.fedora.in b/contrib/kimchi.spec.fedora.in
> index 577516c..f3c4e35 100644
> --- a/contrib/kimchi.spec.fedora.in
> +++ b/contrib/kimchi.spec.fedora.in
> @@ -34,6 +34,7 @@ BuildRequires:    python-unittest2
>
>   %if 0%{?with_systemd}
>   Requires:	systemd
> +Requires:	firewalld
>   Requires(post): systemd
>   Requires(preun): systemd
>   Requires(postun): systemd
> @@ -63,6 +64,7 @@ make DESTDIR=%{buildroot} install
>   %if 0%{?with_systemd}
>   # Install the systemd scripts
>   install -Dm 0644 contrib/kimchid.service.fedora %{buildroot}%{_unitdir}/kimchid.service
> +install -Dm 0640 src/firewalld.xml %{buildroot}%{_prefix}/lib/firewalld/services/kimchid.xml
>   %endif
>
>   %if 0%{?rhel} == 6
> @@ -81,18 +83,33 @@ if [ $1 -eq 1 ] ; then
>       /bin/systemctl daemon-reload >/dev/null 2>&1 || :
>   fi
>
> -%if 0%{?rhel} == 6
> -start kimchid


This is specific for RHEL6.
You should keep it as it is and add a new if statement (with_systemd) to 
firewall rules

> -%else
> +%if 0%{?with_systemd}
>   service kimchid start
> +# Add firewalld rules to open 8000 and 8001 port
> +firewall-cmd --reload
> +firewall-cmd --add-service kimchid
> +%else
> +start kimchid
> +# Add default iptable rules to open 8000 and 8001 port
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +service iptables save
>   %endif
>
>   %preun
> +
>   if [ $1 -eq 0 ] ; then
>       # Package removal, not upgrade
>       /bin/systemctl --no-reload disable kimchid.service > /dev/null 2>&1 || :
>       /bin/systemctl stop kimchid.service > /dev/null 2>&1 || :
> +    %if 0%{?with_systemd}
> +        firewall-cmd --remove-service kimchid || :
> +    %else
> +        iptables -D INPUT -p tcp --dport 8000 -j ACCEPT || :
> +        iptables -D INPUT -p tcp --dport 8001 -j ACCEPT || :
> +    %endif
>   fi
> +
>   exit 0
>
>
> @@ -154,6 +171,7 @@ rm -rf $RPM_BUILD_ROOT
>
>   %if 0%{?with_systemd}
>   %{_unitdir}/kimchid.service
> +%{_prefix}/lib/firewalld/services/kimchid.xml
>   %endif
>   %if 0%{?rhel} == 6
>   /etc/init/kimchid.conf
> diff --git a/contrib/kimchi.spec.suse.in b/contrib/kimchi.spec.suse.in
> index 12d02ec..913bedd 100644
> --- a/contrib/kimchi.spec.suse.in
> +++ b/contrib/kimchi.spec.suse.in
> @@ -46,10 +46,16 @@ install -Dm 0755 contrib/kimchid.sysvinit %{buildroot}%{_initrddir}/kimchid
>   %post
>   service kimchid start
>   chkconfig kimchid on
> -
> +# Add iptables rules to open 8000 and 8001 port
> +iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
> +service iptables save
>   %preun
>   service kimchid stop
> -
> +# Remove iptables rules to open 8000 and 8001 port
> +iptables -D INPUT -p tcp --dport 8000 -j ACCEPT
> +iptables -D INPUT -p tcp --dport 8001 -j ACCEPT
> +service iptables save
>   %clean
>   rm -rf $RPM_BUILD_ROOT
>
> diff --git a/src/Makefile.am b/src/Makefile.am
> index 7d29e28..7514870 100644
> --- a/src/Makefile.am
> +++ b/src/Makefile.am
> @@ -24,6 +24,7 @@ SUBDIRS = kimchi distros.d
>
>   EXTRA_DIST = kimchid.in \
>   	kimchi.conf.in \
> +	firewalld.xml \
>   	$(NULL)
>
>   bin_SCRIPTS = kimchid
> diff --git a/src/firewalld.xml b/src/firewalld.xml
> new file mode 100644
> index 0000000..7472e20
> --- /dev/null
> +++ b/src/firewalld.xml
> @@ -0,0 +1,7 @@
> +<?xml version="1.0" encoding="utf-8"?>
> +<service>
> +  <short>kimchid</short>
> +  <description>Kimchid is a daemon service for kimchi which is a HTML5 based management tool for KVM. It is designed to make it as easy as possible to get started with KVM and create your first guest.</description>
> +  <port protocol="tcp" port="8000"/>
> +  <port protocol="tcp" port="8001"/>
> +</service>