[Kimchi-devel] [PATCH V9 1/1] spec: Open 8000 and 8001 port by default

[taget at linux.vnet.ibm.com]

From: Eli Qiao <taget at linux.vnet.ibm.com>

Use firewalld to manager firewall rules on RHEL7, fedora and ubuntu.
Add static rules in iptables to on RHEL6.

Signed-off-by: Eli Qiao <taget at linux.vnet.ibm.com>
---
 Makefile.am                   |  3 +++
 contrib/DEBIAN/control.in     |  3 ++-
 contrib/DEBIAN/postinst       |  8 ++++++++
 contrib/DEBIAN/postrm         |  7 +++++++
 contrib/kimchi.spec.fedora.in | 26 ++++++++++++++++++++++++++
 src/Makefile.am               |  1 +
 src/firewalld.xml             |  7 +++++++
 7 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 src/firewalld.xml

diff --git a/Makefile.am b/Makefile.am
index 04ad696..13cbe13 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -85,8 +85,11 @@ all-local:
 install-deb: install
 	cp -R $(top_srcdir)/contrib/DEBIAN $(DESTDIR)/
 	$(MKDIR_P) $(DESTDIR)/etc/init
+	$(MKDIR_P) $(DESTDIR)/usr/lib/firewalld/services
 	cp -R $(top_srcdir)/contrib/kimchid-upstart.conf.debian \
 		$(DESTDIR)/etc/init/kimchid.conf
+	cp -R $(top_srcdir)/src/firewalld.xml \
+		$(DESTDIR)/usr/lib/firewalld/services/kimchid.xml
 
 
 deb: contrib/make-deb.sh
diff --git a/contrib/DEBIAN/control.in b/contrib/DEBIAN/control.in
index eecfb27..64ac2f4 100644
--- a/contrib/DEBIAN/control.in
+++ b/contrib/DEBIAN/control.in
@@ -18,7 +18,8 @@ Depends: python-cherrypy3 (>= 3.2.0),
          python-ethtool,
          sosreport,
          python-ipaddr,
-         open-iscsi
+         open-iscsi,
+         firewalld
 Build-Depends:
 Maintainer: Aline Manera <alinefm at br.ibm.com>
 Description: Kimchi web server
diff --git a/contrib/DEBIAN/postinst b/contrib/DEBIAN/postinst
index c1fc22e..5f7e2ff 100755
--- a/contrib/DEBIAN/postinst
+++ b/contrib/DEBIAN/postinst
@@ -19,3 +19,11 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
 service kimchid start
+set +e
+service firewalld status >/dev/null 2>&1
+if [ $? -ne 0 ]; then
+    service firewalld start >/dev/null 2>&1
+fi
+firewall-cmd --reload  >/dev/null 2>&1
+firewall-cmd --add-service kimchid  >/dev/null 2>&1
+set -e
diff --git a/contrib/DEBIAN/postrm b/contrib/DEBIAN/postrm
index ef90b49..9f1d895 100755
--- a/contrib/DEBIAN/postrm
+++ b/contrib/DEBIAN/postrm
@@ -26,3 +26,10 @@ case "$1" in
         rm -rf /var/log/kimchi /var/run/kimchi.pid /usr/share/kimchi/
     ;;
 esac
+
+set +e
+service firewalld status >/dev/null 2>&1
+if [ $? -eq 0 ]; then
+    firewall-cmd --remove-service kimchid >/dev/null 2>&1
+fi
+set -e
diff --git a/contrib/kimchi.spec.fedora.in b/contrib/kimchi.spec.fedora.in
index 75435b3..24485bd 100644
--- a/contrib/kimchi.spec.fedora.in
+++ b/contrib/kimchi.spec.fedora.in
@@ -35,6 +35,7 @@ BuildRequires:    python-unittest2
 
 %if 0%{?with_systemd}
 Requires:	systemd
+Requires:	firewalld
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
@@ -64,6 +65,7 @@ make DESTDIR=%{buildroot} install
 %if 0%{?with_systemd}
 # Install the systemd scripts
 install -Dm 0644 contrib/kimchid.service.fedora %{buildroot}%{_unitdir}/kimchid.service
+install -Dm 0640 src/firewalld.xml %{buildroot}%{_prefix}/lib/firewalld/services/kimchid.xml
 %endif
 
 %if 0%{?rhel} == 6
@@ -88,12 +90,35 @@ start kimchid
 service kimchid start
 %endif
 
+%if 0%{?with_systemd}
+service firewalld status >/dev/null 2>&1
+if [ $? -ne 0 ]; then
+    service firewalld start >/dev/null 2>&1
+fi
+# Add firewalld rules to open 8000 and 8001 port
+firewall-cmd --reload >/dev/null 2>&1
+firewall-cmd --add-service kimchid >/dev/null 2>&1
+%else
+# Add default iptable rules to open 8000 and 8001 port
+iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
+iptables -I INPUT -p tcp --dport 8001 -j ACCEPT
+service iptables save >/dev/null 2>&1
+%endif
+
 %preun
+
 if [ $1 -eq 0 ] ; then
     # Package removal, not upgrade
     /bin/systemctl --no-reload disable kimchid.service > /dev/null 2>&1 || :
     /bin/systemctl stop kimchid.service > /dev/null 2>&1 || :
+    %if 0%{?with_systemd}
+        firewall-cmd --remove-service kimchid >/dev/null 2>&1 || :
+    %else
+        iptables -D INPUT -p tcp --dport 8000 -j ACCEPT || :
+        iptables -D INPUT -p tcp --dport 8001 -j ACCEPT || :
+    %endif
 fi
+
 exit 0
 
 
@@ -156,6 +181,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %if 0%{?with_systemd}
 %{_unitdir}/kimchid.service
+%{_prefix}/lib/firewalld/services/kimchid.xml
 %endif
 %if 0%{?rhel} == 6
 /etc/init/kimchid.conf
diff --git a/src/Makefile.am b/src/Makefile.am
index 7d29e28..7514870 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -24,6 +24,7 @@ SUBDIRS = kimchi distros.d
 
 EXTRA_DIST = kimchid.in \
 	kimchi.conf.in \
+	firewalld.xml \
 	$(NULL)
 
 bin_SCRIPTS = kimchid
diff --git a/src/firewalld.xml b/src/firewalld.xml
new file mode 100644
index 0000000..7472e20
--- /dev/null
+++ b/src/firewalld.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<service>
+  <short>kimchid</short>
+  <description>Kimchid is a daemon service for kimchi which is a HTML5 based management tool for KVM. It is designed to make it as easy as possible to get started with KVM and create your first guest.</description>
+  <port protocol="tcp" port="8000"/>
+  <port protocol="tcp" port="8001"/>
+</service>
-- 
1.8.3.1