|
 |
cb8e9e |
From d51815d7d0b065e447e5f51f26f1f724d2a3406f Mon Sep 17 00:00:00 2001
|
|
|
cb8e9e |
From: anand <anekkunt@redhat.com>
|
|
|
cb8e9e |
Date: Sat, 22 Aug 2015 01:09:53 +0530
|
|
|
cb8e9e |
Subject: [PATCH 326/330] firewall/spec: Create glusterfs firewall service if firewalld installed.
|
|
|
cb8e9e |
|
|
|
cb8e9e |
It creates glusterfs firewall service during installation.
|
|
|
cb8e9e |
|
|
|
cb8e9e |
glusterfs service : It contains all default ports which needs to be opened.
|
|
|
cb8e9e |
During installation glusterfs.xml is copied into firewall service directory(/usr/lib/firewalld/services/).
|
|
|
cb8e9e |
|
|
|
cb8e9e |
Note:
|
|
|
cb8e9e |
1.For bricks: It opens the 512 ports, if brick is running out side this range(>49664) then admin need to open the port
|
|
|
cb8e9e |
for that brick.
|
|
|
cb8e9e |
2.By default this service is not enabled in any of zone.
|
|
|
cb8e9e |
|
|
|
cb8e9e |
To enable this service(glusterfs) in firewall:
|
|
|
cb8e9e |
|
|
|
cb8e9e |
1. Get active zone(s) in node
|
|
|
cb8e9e |
firewall-cmd --get-active-zones
|
|
|
cb8e9e |
|
|
|
cb8e9e |
2. Enable this service(glusterfs) to zone(s)
|
|
|
cb8e9e |
firewall-cmd --zone=<zone_name> --add-service=glusterfs --To apply runtime
|
|
|
cb8e9e |
firewall-cmd --permanent --zone=<zone_name> --add-service=glusterfs --To apply permanent
|
|
|
cb8e9e |
|
|
|
cb8e9e |
Note:
|
|
|
cb8e9e |
we can also use firewall-config which gives GUI to configure firewall.
|
|
|
cb8e9e |
|
|
|
cb8e9e |
Backportof:
|
|
|
cb8e9e |
>>http://review.gluster.org/#/c/11989/19
|
|
|
cb8e9e |
>>Change-Id: Id97fe620c560fd10599511d751aed11a99ba4da5
|
|
|
cb8e9e |
>>BUG: 1253967
|
|
|
cb8e9e |
|
|
|
cb8e9e |
Change-Id: I8fde5d908098d490aa4ab39877aab8dc44ebeacc
|
|
|
cb8e9e |
BUG: 1253774
|
|
|
cb8e9e |
Signed-off-by: anand <anekkunt@redhat.com>
|
|
|
cb8e9e |
Reviewed-on: https://code.engineering.redhat.com/gerrit/57564
|
|
|
cb8e9e |
Reviewed-by: Kaushal Madappa <kaushal@redhat.com>
|
|
|
cb8e9e |
Reviewed-by: Atin Mukherjee <amukherj@redhat.com>
|
|
|
cb8e9e |
Tested-by: Atin Mukherjee <amukherj@redhat.com>
|
|
|
cb8e9e |
---
|
|
|
cb8e9e |
configure.ac | 18 ++++++++++++++++++
|
|
|
cb8e9e |
extras/Makefile.am | 2 +-
|
|
|
cb8e9e |
extras/firewalld/Makefile.am | 6 ++++++
|
|
|
cb8e9e |
extras/firewalld/glusterfs.xml | 13 +++++++++++++
|
|
|
cb8e9e |
glusterfs.spec.in | 36 ++++++++++++++++++++++++++++++++++++
|
|
|
cb8e9e |
5 files changed, 74 insertions(+), 1 deletions(-)
|
|
|
cb8e9e |
create mode 100644 extras/firewalld/Makefile.am
|
|
|
cb8e9e |
create mode 100644 extras/firewalld/glusterfs.xml
|
|
|
cb8e9e |
|
|
|
cb8e9e |
diff --git a/configure.ac b/configure.ac
|
|
|
cb8e9e |
index a93c1cd..dfe105f 100644
|
|
|
cb8e9e |
--- a/configure.ac
|
|
|
cb8e9e |
+++ b/configure.ac
|
|
|
cb8e9e |
@@ -211,6 +211,7 @@ AC_CONFIG_FILES([Makefile
|
|
|
cb8e9e |
extras/ocf/volume
|
|
|
cb8e9e |
extras/LinuxRPM/Makefile
|
|
|
cb8e9e |
extras/geo-rep/Makefile
|
|
|
cb8e9e |
+ extras/firewalld/Makefile
|
|
|
cb8e9e |
extras/hook-scripts/add-brick/Makefile
|
|
|
cb8e9e |
extras/hook-scripts/add-brick/pre/Makefile
|
|
|
cb8e9e |
extras/hook-scripts/add-brick/post/Makefile
|
|
|
cb8e9e |
@@ -731,6 +732,22 @@ AC_SUBST(ZLIB_CFLAGS)
|
|
|
cb8e9e |
AC_SUBST(ZLIB_LIBS)
|
|
|
cb8e9e |
# end CDC xlator secion
|
|
|
cb8e9e |
|
|
|
cb8e9e |
+#start firewalld section
|
|
|
cb8e9e |
+BUILD_FIREWALLD="no"
|
|
|
cb8e9e |
+AC_ARG_ENABLE([firewalld],
|
|
|
cb8e9e |
+ AC_HELP_STRING([--enable-firewalld],
|
|
|
cb8e9e |
+ [enable installation configuration for firewalld]),
|
|
|
cb8e9e |
+ [BUILD_FIREWALLD="${enableval}"], [BUILD_FIREWALLD="no"])
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
+if test "x${BUILD_FIREWALLD}" = "xyes"; then
|
|
|
cb8e9e |
+ if !(which firewalld 1>/dev/null 2>&1) ; then
|
|
|
cb8e9e |
+ BUILD_FIREWALLD="no (firewalld not installed)"
|
|
|
cb8e9e |
+ fi
|
|
|
cb8e9e |
+fi
|
|
|
cb8e9e |
+AM_CONDITIONAL([USE_FIREWALLD],test ["x${BUILD_FIREWALLD}" = "xyes"])
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
+#endof firewald section
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
# Data tiering requires sqlite
|
|
|
cb8e9e |
AC_ARG_ENABLE([tiering],
|
|
|
cb8e9e |
AC_HELP_STRING([--disable-tiering],
|
|
|
cb8e9e |
@@ -1343,4 +1360,5 @@ echo "Encryption xlator : $BUILD_CRYPT_XLATOR"
|
|
|
cb8e9e |
echo "Unit Tests : $BUILD_UNITTEST"
|
|
|
cb8e9e |
echo "POSIX ACLs : $BUILD_POSIX_ACLS"
|
|
|
cb8e9e |
echo "Data Classification : $BUILD_GFDB"
|
|
|
cb8e9e |
+echo "firewalld-config : $BUILD_FIREWALLD"
|
|
|
cb8e9e |
echo
|
|
|
cb8e9e |
diff --git a/extras/Makefile.am b/extras/Makefile.am
|
|
|
cb8e9e |
index ba2bef3..da99ecc 100644
|
|
|
cb8e9e |
--- a/extras/Makefile.am
|
|
|
cb8e9e |
+++ b/extras/Makefile.am
|
|
|
cb8e9e |
@@ -5,7 +5,7 @@ EditorModedir = $(docdir)
|
|
|
cb8e9e |
EditorMode_DATA = glusterfs-mode.el glusterfs.vim
|
|
|
cb8e9e |
|
|
|
cb8e9e |
SUBDIRS = init.d systemd benchmarking hook-scripts $(OCF_SUBDIR) LinuxRPM \
|
|
|
cb8e9e |
- $(GEOREP_EXTRAS_SUBDIR) ganesha snap_scheduler
|
|
|
cb8e9e |
+ $(GEOREP_EXTRAS_SUBDIR) ganesha snap_scheduler firewalld
|
|
|
cb8e9e |
|
|
|
cb8e9e |
confdir = $(sysconfdir)/glusterfs
|
|
|
cb8e9e |
conf_DATA = glusterfs-logrotate gluster-rsyslog-7.2.conf gluster-rsyslog-5.8.conf \
|
|
|
cb8e9e |
diff --git a/extras/firewalld/Makefile.am b/extras/firewalld/Makefile.am
|
|
|
cb8e9e |
new file mode 100644
|
|
|
cb8e9e |
index 0000000..a5c11b0
|
|
|
cb8e9e |
--- /dev/null
|
|
|
cb8e9e |
+++ b/extras/firewalld/Makefile.am
|
|
|
cb8e9e |
@@ -0,0 +1,6 @@
|
|
|
cb8e9e |
+EXTRA_DIST = glusterfs.xml
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
+if USE_FIREWALLD
|
|
|
cb8e9e |
+staticdir = /usr/lib/firewalld/services/
|
|
|
cb8e9e |
+static_DATA = glusterfs.xml
|
|
|
cb8e9e |
+endif
|
|
|
cb8e9e |
diff --git a/extras/firewalld/glusterfs.xml b/extras/firewalld/glusterfs.xml
|
|
|
cb8e9e |
new file mode 100644
|
|
|
cb8e9e |
index 0000000..f8efd90
|
|
|
cb8e9e |
--- /dev/null
|
|
|
cb8e9e |
+++ b/extras/firewalld/glusterfs.xml
|
|
|
cb8e9e |
@@ -0,0 +1,13 @@
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
+<service>
|
|
|
cb8e9e |
+<short>glusterfs-static</short>
|
|
|
cb8e9e |
+<description>Default ports for gluster-distributed storage</description>
|
|
|
cb8e9e |
+<port protocol="tcp" port="24007"/>
|
|
|
cb8e9e |
+<port protocol="tcp" port="24008"/>
|
|
|
cb8e9e |
+<port protocol="tcp" port="38465"/>
|
|
|
cb8e9e |
+<port protocol="tcp" port="38466"/>
|
|
|
cb8e9e |
+<port protocol="tcp" port="38467"/>
|
|
|
cb8e9e |
+<port protocol="tcp" port="38468"/>
|
|
|
cb8e9e |
+<port protocol="tcp" port="38469"/>
|
|
|
cb8e9e |
+<port protocol="tcp" port="49152-49664"/>
|
|
|
cb8e9e |
+</service>
|
|
|
cb8e9e |
diff --git a/glusterfs.spec.in b/glusterfs.spec.in
|
|
|
cb8e9e |
index 78bd311..f9e0447 100644
|
|
|
cb8e9e |
--- a/glusterfs.spec.in
|
|
|
cb8e9e |
+++ b/glusterfs.spec.in
|
|
|
cb8e9e |
@@ -103,6 +103,10 @@
|
|
|
cb8e9e |
%global _with_systemd true
|
|
|
cb8e9e |
%endif
|
|
|
cb8e9e |
|
|
|
cb8e9e |
+%if ( 0%{?fedora} ) || ( 0%{?rhel} && 0%{?rhel} >= 7 )
|
|
|
cb8e9e |
+%global _with_firewalld --enable-firewalld
|
|
|
cb8e9e |
+%endif
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
%if 0%{?_tmpfilesdir:1}
|
|
|
cb8e9e |
%define _with_tmpfilesdir --with-tmpfilesdir=%{_tmpfilesdir}
|
|
|
cb8e9e |
%else
|
|
|
cb8e9e |
@@ -243,6 +247,10 @@ BuildRequires: glib2-devel
|
|
|
cb8e9e |
BuildRequires: libattr-devel
|
|
|
cb8e9e |
%endif
|
|
|
cb8e9e |
|
|
|
cb8e9e |
+%if (0%{?_with_firewalld:1})
|
|
|
cb8e9e |
+BuildRequires: firewalld
|
|
|
cb8e9e |
+%endif
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
Obsoletes: hekafs
|
|
|
cb8e9e |
Obsoletes: %{name}-common < %{version}-%{release}
|
|
|
cb8e9e |
Obsoletes: %{name}-core < %{version}-%{release}
|
|
|
cb8e9e |
@@ -639,6 +647,7 @@ export LDFLAGS
|
|
|
cb8e9e |
%{?_without_epoll} \
|
|
|
cb8e9e |
%{?_without_fusermount} \
|
|
|
cb8e9e |
%{?_without_georeplication} \
|
|
|
cb8e9e |
+ %{?_with_firewalld} \
|
|
|
cb8e9e |
%{?_without_ocf} \
|
|
|
cb8e9e |
%{?_without_qemu_block} \
|
|
|
cb8e9e |
%{?_without_rdma} \
|
|
|
cb8e9e |
@@ -896,6 +905,15 @@ if [ -e /etc/ld.so.conf.d/glusterfs.conf ]; then
|
|
|
cb8e9e |
rm -f /etc/ld.so.conf.d/glusterfs.conf
|
|
|
cb8e9e |
/sbin/ldconfig
|
|
|
cb8e9e |
fi
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
+%if (0%{?_with_firewalld:1})
|
|
|
cb8e9e |
+#reload service files if firewalld running
|
|
|
cb8e9e |
+if $(systemctl is-active firewalld 1>/dev/null 2>&1;; then
|
|
|
cb8e9e |
+ #firewalld-filesystem is not available for rhel7, so command used for reload.
|
|
|
cb8e9e |
+ firewall-cmd --reload
|
|
|
cb8e9e |
+fi
|
|
|
cb8e9e |
+%endif
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
pidof -c -o %PPID -x glusterd &> /dev/null
|
|
|
cb8e9e |
if [ $? -eq 0 ]; then
|
|
|
cb8e9e |
kill -9 `pgrep -f gsyncd.py` &> /dev/null
|
|
|
cb8e9e |
@@ -956,6 +974,17 @@ fi
|
|
|
cb8e9e |
%postun api
|
|
|
cb8e9e |
/sbin/ldconfig
|
|
|
cb8e9e |
|
|
|
cb8e9e |
+%if ( 0%{?_build_server} )
|
|
|
cb8e9e |
+%postun server
|
|
|
cb8e9e |
+%if (0%{?_with_firewalld:1})
|
|
|
cb8e9e |
+#reload service files if firewalld running
|
|
|
cb8e9e |
+if $(systemctl is-active firewalld 1>/dev/null 2>&1;; then
|
|
|
cb8e9e |
+ firewall-cmd --reload
|
|
|
cb8e9e |
+fi
|
|
|
cb8e9e |
+%endif
|
|
|
cb8e9e |
+%endif
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
%postun libs
|
|
|
cb8e9e |
/sbin/ldconfig
|
|
|
cb8e9e |
|
|
|
cb8e9e |
@@ -1339,6 +1368,10 @@ fi
|
|
|
cb8e9e |
%{_libexecdir}/glusterfs/peer_add_secret_pub
|
|
|
cb8e9e |
%endif
|
|
|
cb8e9e |
|
|
|
cb8e9e |
+%if ( 0%{?_with_firewalld:1} )
|
|
|
cb8e9e |
+/usr/lib/firewalld/services/glusterfs.xml
|
|
|
cb8e9e |
+%endif
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
|
|
|
cb8e9e |
##-----------------------------------------------------------------------------
|
|
|
cb8e9e |
## All %pretrans should be placed here and keep them sorted
|
|
|
cb8e9e |
@@ -1931,6 +1964,9 @@ end
|
|
|
cb8e9e |
|
|
|
cb8e9e |
%changelog
|
|
|
cb8e9e |
|
|
|
cb8e9e |
+* Tue Aug 25 2015 Anand Nekkunti <anekkunt@redhat.com>
|
|
|
cb8e9e |
+- adding glusterfs-firewalld service (#1253774)
|
|
|
cb8e9e |
+
|
|
|
cb8e9e |
* Fri Jun 19 2015 Bala.FA <barumuga@redhat.com>
|
|
|
cb8e9e |
- exclude libgfdb.pc conditionally for rhel-5 (#1233486)
|
|
|
cb8e9e |
|
|
|
cb8e9e |
--
|
|
|
cb8e9e |
1.7.1
|
|
|
cb8e9e |
|