Merge "Add Nova quantum security group proxy"

13 files changed, 1317 insertions, 86 deletions

diff --git a/nova/api/openstack/compute/contrib/security_groups.py b/nova/api/openstack/compute/contrib/security_groups.py
index 3f48176cc..092e89b9b 100644
--- a/nova/api/openstack/compute/contrib/security_groups.py
+++ b/nova/api/openstack/compute/contrib/security_groups.py
@@ -16,8 +16,10 @@
 
 """The security groups extension."""
 
+import json
 import webob
 from webob import exc
+from xml.dom import minidom
 
 from nova.api.openstack import common
 from nova.api.openstack import extensions
@@ -28,6 +30,7 @@ from nova.compute import api as compute_api
 from nova import db
 from nova import exception
 from nova.network.security_group import openstack_driver
+from nova.network.security_group import quantum_driver
 from nova.openstack.common import log as logging
 from nova import utils
 from nova.virt import netutils
@@ -194,8 +197,8 @@ class SecurityGroupControllerBase(object):
         if rule['group_id']:
             source_group = self.security_group_api.get(context,
                                                        id=rule['group_id'])
-            sg_rule['group'] = {'name': source_group.name,
-                             'tenant_id': source_group.project_id}
+            sg_rule['group'] = {'name': source_group.get('name'),
+                             'tenant_id': source_group.get('project_id')}
         else:
             sg_rule['ip_range'] = {'cidr': rule['cidr']}
         return sg_rule
@@ -466,11 +469,46 @@ class SecurityGroupsOutputController(wsgi.Controller):
 
     def _extend_servers(self, req, servers):
         key = "security_groups"
-        for server in servers:
-            instance = req.get_db_instance(server['id'])
-            groups = instance.get(key)
-            if groups:
-                server[key] = [{"name": group["name"]} for group in groups]
+        if not openstack_driver.is_quantum_security_groups():
+            for server in servers:
+                instance = req.get_db_instance(server['id'])
+                groups = instance.get(key)
+                if groups:
+                    server[key] = [{"name": group["name"]} for group in groups]
+        else:
+            # If method is a POST we get the security groups intended for an
+            # instance from the request. The reason for this is if using
+            # quantum security groups the requested security groups for the
+            # instance are not in the db and have not been sent to quantum yet.
+            instance_sgs = []
+            if req.method != 'POST':
+                for server in servers:
+                    instance_sgs = (
+                        self.security_group_api.get_instance_security_groups(
+                            req, server['id']))
+            else:
+                try:
+                    # try converting to json
+                    req_obj = json.loads(req.body)
+                    # Add security group to server, if no security group was in
+                    # request add default since that is the group it is part of
+                    instance_sgs = req_obj['server'].get(
+                        key, [{'name': 'default'}])
+                except ValueError:
+                    root = minidom.parseString(req.body)
+                    sg_root = root.getElementsByTagName(key)
+                    if sg_root:
+                        security_groups = sg_root[0].getElementsByTagName(
+                            'security_group')
+                        for security_group in security_groups:
+                            instance_sgs.append(
+                                {'name': security_group.getAttribute('name')})
+                    if not instance_sgs:
+                        instance_sgs = [{'name': 'default'}]
+
+            if instance_sgs:
+                for server in servers:
+                    server[key] = instance_sgs
 
     def _show(self, req, resp_obj):
         if not softauth(req.environ['nova.context']):
@@ -587,3 +625,8 @@ class NativeSecurityGroupExceptions(object):
 class NativeNovaSecurityGroupAPI(compute_api.SecurityGroupAPI,
                                  NativeSecurityGroupExceptions):
     pass
+
+
+class NativeQuantumSecurityGroupAPI(quantum_driver.SecurityGroupAPI,
+                                    NativeSecurityGroupExceptions):
+    pass
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 90b1e9176..cc07a998a 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -2747,6 +2747,10 @@ class SecurityGroupAPI(base.Base, security_group_base.SecurityGroupBase):
     Sub-set of the Compute API related to managing security groups
     and security group rules
     """
+
+    # The nova seurity group api does not use a uuid for the id.
+    id_is_uuid = False
+
     def __init__(self, **kwargs):
         super(SecurityGroupAPI, self).__init__(**kwargs)
         self.security_group_rpcapi = compute_rpcapi.SecurityGroupAPI()
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index ed95ff8df..afeb9f02e 100755
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -57,6 +57,7 @@ from nova.image import glance
 from nova import manager
 from nova import network
 from nova.network import model as network_model
+from nova.network.security_group import openstack_driver
 from nova.openstack.common import excutils
 from nova.openstack.common import jsonutils
 from nova.openstack.common import lockutils
@@ -332,7 +333,8 @@ class ComputeManager(manager.SchedulerDependentManager):
         self.compute_rpcapi = compute_rpcapi.ComputeAPI()
         self.scheduler_rpcapi = scheduler_rpcapi.SchedulerAPI()
         self.conductor_api = conductor.API()
-
+        self.is_quantum_security_groups = (
+            openstack_driver.is_quantum_security_groups())
         super(ComputeManager, self).__init__(service_name="compute",
                                              *args, **kwargs)
 
@@ -716,6 +718,13 @@ class ComputeManager(manager.SchedulerDependentManager):
         """Launch a new instance with specified options."""
         context = context.elevated()
 
+        # If quantum security groups pass requested security
+        # groups to allocate_for_instance()
+        if request_spec and self.is_quantum_security_groups:
+            security_groups = request_spec.get('security_group')
+        else:
+            security_groups = []
+
         try:
             self._check_instance_exists(context, instance)
             image_meta = self._check_image_size(context, instance)
@@ -747,7 +756,7 @@ class ComputeManager(manager.SchedulerDependentManager):
                     macs = self.driver.macs_for_instance(instance)
 
                     network_info = self._allocate_network(context, instance,
-                            requested_networks, macs)
+                            requested_networks, macs, security_groups)
 
                     self._instance_update(
                             context, instance['uuid'],
@@ -982,7 +991,8 @@ class ComputeManager(manager.SchedulerDependentManager):
                               expected_task_state=(task_states.SCHEDULING,
                                                    None))
 
-    def _allocate_network(self, context, instance, requested_networks, macs):
+    def _allocate_network(self, context, instance, requested_networks, macs,
+                          security_groups):
         """Allocate networks for an instance and return the network info."""
         instance = self._instance_update(context, instance['uuid'],
                                          vm_state=vm_states.BUILDING,
@@ -994,7 +1004,9 @@ class ComputeManager(manager.SchedulerDependentManager):
             network_info = self.network_api.allocate_for_instance(
                                 context, instance, vpn=is_vpn,
                                 requested_networks=requested_networks,
-                                macs=macs, conductor_api=self.conductor_api)
+                                macs=macs,
+                                conductor_api=self.conductor_api,
+                                security_groups=security_groups)
         except Exception:
             LOG.exception(_('Instance failed network setup'),
                           instance=instance)
diff --git a/nova/exception.py b/nova/exception.py
index fd0122835..13e007ecf 100644
--- a/nova/exception.py
+++ b/nova/exception.py
@@ -736,6 +736,16 @@ class SecurityGroupDefaultRuleNotFound(Invalid):
     message = _("Security group default rule (%rule_id)s not found.")
 
 
+class SecurityGroupCannotBeApplied(Invalid):
+    message = _("Network requires port_security_enabled and subnet associated"
+                " in order to apply security groups.")
+
+
+class NoUniqueMatch(NovaException):
+    message = _("No Unique Match Found.")
+    code = 409
+
+
 class MigrationNotFound(NotFound):
     message = _("Migration %(migration_id)s could not be found.")
 
diff --git a/nova/network/api.py b/nova/network/api.py
index f89cfb8de..4f0a2bffa 100644
--- a/nova/network/api.py
+++ b/nova/network/api.py
@@ -244,7 +244,7 @@ class API(base.Base):
     @refresh_cache
     def allocate_for_instance(self, context, instance, vpn,
                               requested_networks, macs=None,
-                              conductor_api=None):
+                              conductor_api=None, security_groups=None):
         """Allocates all network structures for an instance.
 
         TODO(someone): document the rest of these parameters.
diff --git a/nova/network/quantumv2/api.py b/nova/network/quantumv2/api.py
index 450445063..a177c1ac0 100644
--- a/nova/network/quantumv2/api.py
+++ b/nova/network/quantumv2/api.py
@@ -27,6 +27,7 @@ from nova import exception
 from nova.network import api as network_api
 from nova.network import model as network_model
 from nova.network import quantumv2
+from nova.network.security_group import openstack_driver
 from nova.openstack.common import excutils
 from nova.openstack.common import log as logging
 from nova.openstack.common import uuidutils
@@ -83,6 +84,7 @@ class API(base.Base):
     """API for interacting with the quantum 2.x API."""
 
     conductor_api = conductor.API()
+    security_group_api = openstack_driver.get_openstack_security_group_driver()
 
     def __init__(self):
         super(API, self).__init__()
@@ -175,9 +177,55 @@ class API(base.Base):
 
         nets = self._get_available_networks(context, instance['project_id'],
                                             net_ids)
+        security_groups = kwargs.get('security_groups', [])
+        security_group_ids = []
+
+        # TODO(arosen) Should optimize more to do direct query for security
+        # group if len(security_groups) == 1
+        if len(security_groups):
+            search_opts = {'tenant_id': instance['project_id']}
+            user_security_groups = quantum.list_security_groups(
+                **search_opts).get('security_groups')
+
+        for security_group in security_groups:
+            name_match = None
+            uuid_match = None
+            for user_security_group in user_security_groups:
+                if user_security_group['name'] == security_group:
+                    if name_match:
+                        msg = (_("Multiple security groups found matching"
+                                 " '%s'. Use an ID to be more specific."),
+                                 security_group)
+                        raise exception.NoUniqueMatch(msg)
+                    name_match = user_security_group['id']
+                if user_security_group['id'] == security_group:
+                    uuid_match = user_security_group['id']
+
+            # If a user names the security group the same as
+            # another's security groups uuid, the name takes priority.
+            if not name_match and not uuid_match:
+                raise exception.SecurityGroupNotFound(
+                    security_group_id=security_group)
+                security_group_ids.append(name_match)
+            elif name_match:
+                security_group_ids.append(name_match)
+            elif uuid_match:
+                security_group_ids.append(uuid_match)
+
         touched_port_ids = []
         created_port_ids = []
         for network in nets:
+            # If security groups are requested on an instance then the
+            # network must has a subnet associated with it. Some plugins
+            # implement the port-security extension which requires
+            # 'port_security_enabled' to be True for security groups.
+            # That is why True is returned if 'port_security_enabled'
+            # is not found.
+            if (security_groups and not (
+                    network['subnets']
+                    and network.get('port_security_enabled', True))):
+
+                raise exception.SecurityGroupCannotBeApplied()
             network_id = network['id']
             zone = 'compute:%s' % instance['availability_zone']
             port_req_body = {'port': {'device_id': instance['uuid'],
@@ -194,6 +242,9 @@ class API(base.Base):
                     port_req_body['port']['network_id'] = network_id
                     port_req_body['port']['admin_state_up'] = True
                     port_req_body['port']['tenant_id'] = instance['project_id']
+                    if security_group_ids:
+                        port_req_body['port']['security_groups'] = (
+                            security_group_ids)
                     if available_macs is not None:
                         if not available_macs:
                             raise exception.PortNotFree(
diff --git a/nova/network/security_group/openstack_driver.py b/nova/network/security_group/openstack_driver.py
index 91ce69891..46f3f3491 100644
--- a/nova/network/security_group/openstack_driver.py
+++ b/nova/network/security_group/openstack_driver.py
@@ -35,12 +35,25 @@ CONF.register_opts(security_group_opts)
 
 NOVA_DRIVER = ('nova.api.openstack.compute.contrib.security_groups.'
                'NativeNovaSecurityGroupAPI')
+QUANTUM_DRIVER = ('nova.api.openstack.compute.contrib.security_groups.'
+                  'NativeQuantumSecurityGroupAPI')
 
 
 def get_openstack_security_group_driver():
     if CONF.security_group_api.lower() == 'nova':
         return importutils.import_object(NOVA_DRIVER)
+    elif CONF.security_group_api.lower() == 'quantum':
+        return importutils.import_object(QUANTUM_DRIVER)
+    else:
+        return importutils.import_object(CONF.security_group_api)
 
 
 def get_security_group_handler():
     return importutils.import_object(CONF.security_group_handler)
+
+
+def is_quantum_security_groups():
+    if CONF.security_group_api.lower() == "quantum":
+        return True
+    else:
+        return False
diff --git a/nova/network/security_group/quantum_driver.py b/nova/network/security_group/quantum_driver.py
new file mode 100644
index 000000000..918c839e9
--- /dev/null
+++ b/nova/network/security_group/quantum_driver.py
@@ -0,0 +1,398 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2013 Nicira, Inc.
+# All Rights Reserved
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+# @author: Aaron Rosen, Nicira Networks, Inc.
+
+from oslo.config import cfg
+from quantumclient.common import exceptions as q_exc
+from quantumclient.quantum import v2_0 as quantumv20
+from webob import exc
+
+from nova.compute import api as compute_api
+from nova import context
+from nova import exception
+from nova.network import quantumv2
+from nova.network.security_group import security_group_base
+from nova.openstack.common import log as logging
+from nova.openstack.common import uuidutils
+
+
+from nova import utils
+
+
+wrap_check_security_groups_policy = compute_api.policy_decorator(
+    scope='compute:security_groups')
+
+CONF = cfg.CONF
+LOG = logging.getLogger(__name__)
+
+
+class SecurityGroupAPI(security_group_base.SecurityGroupBase):
+
+    id_is_uuid = True
+
+    def create_security_group(self, context, name, description):
+        quantum = quantumv2.get_client(context)
+        body = self._make_quantum_security_group_dict(name, description)
+        try:
+            security_group = quantum.create_security_group(
+                body).get('security_group')
+        except q_exc.QuantumClientException as e:
+            LOG.exception(_("Quantum Error creating security group %s"),
+                          name)
+            if e.status_code == 401:
+                # TODO(arosen) Cannot raise generic response from quantum here
+                # as this error code could be related to bad input or over
+                # quota
+                raise exc.HTTPBadRequest()
+            raise e
+        return self._convert_to_nova_security_group_format(security_group)
+
+    def _convert_to_nova_security_group_format(self, security_group):
+        nova_group = {}
+        nova_group['id'] = security_group['id']
+        nova_group['description'] = security_group['description']
+        nova_group['name'] = security_group['name']
+        nova_group['project_id'] = security_group['tenant_id']
+        nova_group['rules'] = []
+        for rule in security_group.get('security_group_rules', []):
+            if rule['direction'] == 'ingress':
+                nova_group['rules'].append(
+                    self._convert_to_nova_security_group_rule_format(rule))
+
+        return nova_group
+
+    def _convert_to_nova_security_group_rule_format(self, rule):
+        nova_rule = {}
+        nova_rule['id'] = rule['id']
+        nova_rule['parent_group_id'] = rule['security_group_id']
+        nova_rule['protocol'] = rule['protocol']
+        if rule['port_range_min'] is None:
+            nova_rule['from_port'] = -1
+        else:
+            nova_rule['from_port'] = rule['port_range_min']
+
+        if rule['port_range_max'] is None:
+            nova_rule['to_port'] = -1
+        else:
+            nova_rule['to_port'] = rule['port_range_max']
+        nova_rule['group_id'] = rule['source_group_id']
+        nova_rule['cidr'] = rule['source_ip_prefix']
+        return nova_rule
+
+    def get(self, context, name=None, id=None, map_exception=False):
+        quantum = quantumv2.get_client(context)
+        try:
+            group = quantum.show_security_group(id).get('security_group')
+        except q_exc.QuantumClientException as e:
+            if e.status_code == 404:
+                LOG.exception(_("Quantum Error getting security group %s"),
+                              name)
+                self.raise_not_found(e.message)
+            else:
+                LOG.error(_("Quantum Error: %s"), e)
+                raise e
+
+        return self._convert_to_nova_security_group_format(group)
+
+    def list(self, context, names=None, ids=None, project=None,
+             search_opts=None):
+        """Returns list of security group rules owned by tenant."""
+        quantum = quantumv2.get_client(context)
+        try:
+            security_groups = quantum.list_security_groups().get(
+                'security_groups')
+        except q_exc.QuantumClientException as e:
+            LOG.exception(_("Quantum Error getting security groups"))
+            raise e
+        converted_rules = []
+        for security_group in security_groups:
+            converted_rules.append(
+                self._convert_to_nova_security_group_format(security_group))
+        return converted_rules
+
+    def validate_id(self, id):
+        if not uuidutils.is_uuid_like(id):
+            msg = _("Security group id should be uuid")
+            self.raise_invalid_property(msg)
+        return id
+
+    def destroy(self, context, security_group):
+        """This function deletes a security group."""
+
+        quantum = quantumv2.get_client(context)
+        try:
+            quantum.delete_security_group(security_group['id'])
+        except q_exc.QuantumClientException as e:
+            if e.status_code == 404:
+                self.raise_not_found(e.message)
+            elif e.status_code == 409:
+                self.raise_invalid_property(e.message)
+            else:
+                LOG.error(_("Quantum Error: %s"), e)
+                raise e
+
+    def add_rules(self, context, id, name, vals):
+        """Add security group rule(s) to security group.
+
+        Note: the Nova security group API doesn't support adding muliple
+        security group rules at once but the EC2 one does. Therefore,
+        this function is writen to support both. Multiple rules are
+        installed to a security group in quantum using bulk support."""
+
+        quantum = quantumv2.get_client(context)
+        body = self._make_quantum_security_group_rules_list(vals)
+        try:
+            rules = quantum.create_security_group_rule(
+                body).get('security_group_rules')
+        except q_exc.QuantumClientException as e:
+            if e.status_code == 409:
+                LOG.exception(_("Quantum Error getting security group %s"),
+                              name)
+                self.raise_not_found(e.message)
+            else:
+                LOG.exception(_("Quantum Error:"))
+                raise e
+        converted_rules = []
+        for rule in rules:
+            converted_rules.append(
+                self._convert_to_nova_security_group_rule_format(rule))
+        return converted_rules
+
+    def _make_quantum_security_group_dict(self, name, description):
+        return {'security_group': {'name': name,
+                                   'description': description}}
+
+    def _make_quantum_security_group_rules_list(self, rules):
+        new_rules = []
+        for rule in rules:
+            new_rule = {}
+            # nova only supports ingress rules so all rules are ingress.
+            new_rule['direction'] = "ingress"
+            new_rule['protocol'] = rule.get('protocol')
+
+            # FIXME(arosen) Nova does not expose ethertype on security group
+            # rules. Therefore, in the case of self referential rules we
+            # should probably assume they want to allow both IPv4 and IPv6.
+            # Unfortunately, this would require adding two rules in quantum.
+            # The reason we do not do this is because when the user using the
+            # nova api wants to remove the rule we'd have to have some way to
+            # know that we should delete both of these rules in quantum.
+            # For now, self referential rules only support IPv4.
+            if not rule.get('cidr'):
+                new_rule['ethertype'] = 'IPv4'
+            else:
+                new_rule['ethertype'] = utils.get_ip_version(rule.get('cidr'))
+            new_rule['source_ip_prefix'] = rule.get('cidr')
+            new_rule['security_group_id'] = rule.get('parent_group_id')
+            new_rule['source_group_id'] = rule.get('group_id')
+            if rule['from_port'] != -1:
+                new_rule['port_range_min'] = rule['from_port']
+            if rule['to_port'] != -1:
+                new_rule['port_range_max'] = rule['to_port']
+            new_rules.append(new_rule)
+        return {'security_group_rules': new_rules}
+
+    def create_security_group_rule(self, context, security_group, new_rule):
+        return self.add_rules(context, new_rule['parent_group_id'],
+                              security_group['name'], [new_rule])[0]
+
+    def remove_rules(self, context, security_group, rule_ids):
+        quantum = quantumv2.get_client(context)
+        rule_ids = set(rule_ids)
+        try:
+            # The ec2 api allows one to delete multiple security group rules
+            # at once. Since there is no bulk delete for quantum the best
+            # thing we can do is delete the rules one by one and hope this
+            # works.... :/
+            for rule_id in range(0, len(rule_ids)):
+                quantum.delete_security_group_rule(rule_ids.pop())
+        except q_exc.QuantumClientException as e:
+            LOG.exception(_("Quantum Error unable to delete %s"),
+                          rule_ids)
+            raise e
+
+    def get_rule(self, context, id):
+        quantum = quantumv2.get_client(context)
+        try:
+            rule = quantum.show_security_group_rule(
+                id).get('security_group_rule')
+        except q_exc.QuantumClientException as e:
+            if e.status_code == 404:
+                LOG.exception(_("Quantum Error getting security group rule "
+                                "%s.") % id)
+                self.raise_not_found(e.message)
+            else:
+                LOG.error(_("Quantum Error: %s"), e)
+                raise e
+        return self._convert_to_nova_security_group_rule_format(rule)
+
+    def get_instance_security_groups(self, req, instance_id):
+        dict_security_groups = {}
+        security_group_name_map = {}
+        admin_context = context.get_admin_context()
+
+        quantum = quantumv2.get_client(admin_context)
+        params = {'device_id': instance_id}
+        ports = quantum.list_ports(**params)
+        security_groups = quantum.list_security_groups().get('security_groups')
+
+        for security_group in security_groups:
+            name = security_group.get('name')
+            # Since the name is optional for quantum security groups
+            if not name:
+                name = security_group['id']
+            security_group_name_map[security_group['id']] = name
+
+        for port in ports['ports']:
+            for security_group in port.get('security_groups', []):
+                try:
+                    dict_security_groups[security_group] = (
+                        security_group_name_map[security_group])
+                except KeyError:
+                    # If this should only happen due to a race condition
+                    # if the security group on a port was deleted after the
+                    # ports were returned. We pass since this security group
+                    # is no longer on the port.
+                    pass
+        ret = []
+        for security_group in dict_security_groups.values():
+            ret.append({'name': security_group})
+        return ret
+
+    def _has_security_group_requirements(self, port):
+        port_security_enabled = port.get('port_security_enabled')
+        has_ip = port.get('fixed_ips')
+        if port_security_enabled and has_ip:
+            return True
+        else:
+            return False
+
+    @wrap_check_security_groups_policy
+    def add_to_instance(self, context, instance, security_group_name):
+        """Add security group to the instance."""
+
+        quantum = quantumv2.get_client(context)
+        try:
+            security_group_id = quantumv20.find_resourceid_by_name_or_id(
+                quantum, 'security_group', security_group_name)
+        except q_exc.QuantumClientException as e:
+            if e.status_code == 404:
+                msg = ("Security group %s is not found for project %s" %
+                       (security_group_name, context.project_id))
+                self.raise_not_found(msg)
+            else:
+                LOG.exception(_("Quantum Error:"))
+                raise e
+        params = {'device_id': instance['uuid']}
+        try:
+            ports = quantum.list_ports(**params).get('ports')
+        except q_exc.QuantumClientException as e:
+                LOG.exception(_("Quantum Error:"))
+                raise e
+
+        if not ports:
+            msg = ("instance_id %s could not be found as device id on"
+                   " any ports" % instance['uuid'])
+            self.raise_not_found(msg)
+
+        for port in ports:
+            if not self._has_security_group_requirements(port):
+                LOG.warn(_("Cannot add security group %(name)s to %(instance)s"
+                           " since the port %(port_id)s does not meet security"
+                           " requirements"), {'name': security_group_name,
+                         'instance': instance['uuid'], 'port_id': port['id']})
+                raise exception.SecurityGroupCannotBeApplied()
+            if 'security_groups' not in port:
+                port['security_groups'] = []
+            port['security_groups'].append(security_group_id)
+            updated_port = {'security_groups': port['security_groups']}
+            try:
+                LOG.info(_("Adding security group %(security_group_id)s to "
+                           "port %(port_id)s"),
+                         {'security_group_id': security_group_id,
+                          'port_id': port['id']})
+                quantum.update_port(port['id'], {'port': updated_port})
+            except Exception:
+                LOG.exception(_("Quantum Error:"))
+                raise
+
+    @wrap_check_security_groups_policy
+    def remove_from_instance(self, context, instance, security_group_name):
+        """Remove the security group associated with the instance."""
+        quantum = quantumv2.get_client(context)
+        try:
+            security_group_id = quantumv20.find_resourceid_by_name_or_id(
+                quantum, 'security_group', security_group_name)
+        except q_exc.QuantumClientException as e:
+            if e.status_code == 404:
+                msg = ("Security group %s is not found for project %s" %
+                       (security_group_name, context.project_id))
+                self.raise_not_found(msg)
+            else:
+                LOG.exception(_("Quantum Error:"))
+                raise e
+        params = {'device_id': instance['uuid']}
+        try:
+            ports = quantum.list_ports(**params).get('ports')
+        except q_exc.QuantumClientException as e:
+                LOG.exception(_("Quantum Error:"))
+                raise e
+
+        if not ports:
+            msg = ("instance_id %s could not be found as device id on"
+                   " any ports" % instance['uuid'])
+            self.raise_not_found(msg)
+
+        found_security_group = False
+        for port in ports:
+            try:
+                port.get('security_groups', []).remove(security_group_id)
+            except ValueError:
+                # When removing a security group from an instance the security
+                # group should be on both ports since it was added this way if
+                # done through the nova api. In case it is not a 404 is only
+                # raised if the security group is not found on any of the
+                # ports on the instance.
+                continue
+
+            updated_port = {'security_groups': port['security_groups']}
+            try:
+                LOG.info(_("Adding security group %(security_group_id)s to "
+                           "port %(port_id)s"),
+                         {'security_group_id': security_group_id,
+                          'port_id': port['id']})
+                quantum.update_port(port['id'], {'port': updated_port})
+                found_security_group = True
+            except Exception:
+                LOG.exception(_("Quantum Error:"))
+                raise e
+        if not found_security_group:
+            msg = (_("Security group %(security_group_name)s not assocaited "
+                     "with the instance %(instance)s"),
+                   {'security_group_name': security_group_name,
+                    'instance': instance['uuid']})
+            self.raise_not_found(msg)
+
+    def rule_exists(self, security_group, new_rule):
+        # Handled by quantum
+        pass
+
+    def populate_security_groups(self, instance, security_groups):
+        # Setting to emply list since we do not want to populate this field
+        # in the nova database if using the quantum driver
+        instance['security_groups'] = []
diff --git a/nova/network/security_group/security_group_base.py b/nova/network/security_group/security_group_base.py
index e6abf988a..499f808b1 100644
--- a/nova/network/security_group/security_group_base.py
+++ b/nova/network/security_group/security_group_base.py
@@ -191,3 +191,6 @@ class SecurityGroupBase(object):
 
     def remove_from_instance(self, context, instance, security_group_name):
         raise NotImplementedError()
+
+    def rule_exists(self, security_group, new_rule):
+        raise NotImplementedError()
diff --git a/nova/tests/api/openstack/compute/contrib/test_quantum_security_groups.py b/nova/tests/api/openstack/compute/contrib/test_quantum_security_groups.py
new file mode 100644
index 000000000..e32fadbb8
--- /dev/null
+++ b/nova/tests/api/openstack/compute/contrib/test_quantum_security_groups.py
@@ -0,0 +1,639 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2013 Nicira, Inc.
+# All Rights Reserved
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+# @author: Aaron Rosen, Nicira Networks, Inc.
+
+import uuid
+
+from lxml import etree
+from oslo.config import cfg
+import webob
+
+from nova.api.openstack.compute.contrib import security_groups
+from nova.api.openstack import xmlutil
+from nova import compute
+from nova import context
+import nova.db
+from nova import exception
+from nova.network import quantumv2
+from nova.network.quantumv2 import api as quantum_api
+from nova.openstack.common import jsonutils
+from nova import test
+from nova.tests.api.openstack.compute.contrib import test_security_groups
+from nova.tests.api.openstack import fakes
+from quantumclient.common import exceptions as q_exc
+
+
+class TestQuantumSecurityGroupsTestCase(test.TestCase):
+    def setUp(self):
+        super(TestQuantumSecurityGroupsTestCase, self).setUp()
+        cfg.CONF.set_override('security_group_api', 'quantum')
+        self.original_client = quantumv2.get_client
+        quantumv2.get_client = get_client
+
+    def tearDown(self):
+        quantumv2.get_client = self.original_client
+        get_client()._reset()
+        super(TestQuantumSecurityGroupsTestCase, self).tearDown()
+
+
+class TestQuantumSecurityGroups(
+        test_security_groups.TestSecurityGroups,
+        TestQuantumSecurityGroupsTestCase):
+
+    def _create_sg_template(self, **kwargs):
+        sg = test_security_groups.security_group_template(**kwargs)
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups')
+        return self.controller.create(req, {'security_group': sg})
+
+    def _create_network(self):
+        body = {'network': {'name': 'net1'}}
+        quantum = get_client()
+        net = quantum.create_network(body)
+        body = {'subnet': {'network_id': net['network']['id'],
+                           'cidr': '10.0.0.0/24'}}
+        quantum.create_subnet(body)
+        return net
+
+    def _create_port(self, **kwargs):
+        body = {'port': {}}
+        fields = ['security_groups', 'device_id', 'network_id',
+                  'port_security_enabled']
+        for field in fields:
+            if field in kwargs:
+                body['port'][field] = kwargs[field]
+        quantum = get_client()
+        return quantum.create_port(body)
+
+    def test_create_security_group_with_no_description(self):
+        # Quantum's security group descirption field is optional.
+        pass
+
+    def test_create_security_group_with_blank_name(self):
+        # Quantum's security group name field is optional.
+        pass
+
+    def test_create_security_group_with_whitespace_name(self):
+        # Quantum allows security group name to be whitespace.
+        pass
+
+    def test_create_security_group_with_blank_description(self):
+        # Quantum's security group descirption field is optional.
+        pass
+
+    def test_create_security_group_with_whitespace_description(self):
+        # Quantum allows description to be whitespace.
+        pass
+
+    def test_create_security_group_with_duplicate_name(self):
+        # Quantum allows duplicate names for security groups.
+        pass
+
+    def test_create_security_group_non_string_name(self):
+        # Quantum allows security group name to be non string.
+        pass
+
+    def test_create_security_group_non_string_description(self):
+        # Quantum allows non string description.
+        pass
+
+    def test_create_security_group_quota_limit(self):
+        # Enforced by Quantum server.
+        pass
+
+    def test_get_security_group_list(self):
+        self._create_sg_template().get('security_group')
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups')
+        list_dict = self.controller.index(req)
+        self.assertEquals(len(list_dict['security_groups']), 2)
+
+    def test_get_security_group_list_all_tenants(self):
+        pass
+
+    def test_get_security_group_by_instance(self):
+        pass
+
+    def test_get_security_group_by_instance_non_existing(self):
+        pass
+
+    def test_get_security_group_by_id(self):
+        sg = self._create_sg_template().get('security_group')
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups/%s'
+                                      % sg['id'])
+        res_dict = self.controller.show(req, sg['id'])
+        expected = {'security_group': sg}
+        self.assertEquals(res_dict, expected)
+
+    def test_delete_security_group_by_id(self):
+        sg = self._create_sg_template().get('security_group')
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups/%s' %
+                                      sg['id'])
+        self.controller.delete(req, sg['id'])
+
+    def test_delete_security_group_in_use(self):
+        sg = self._create_sg_template().get('security_group')
+        self._create_network()
+        fake_instance = {'project_id': 'fake_tenant',
+                         'availability_zone': 'zone_one',
+                         'security_groups': [],
+                         'uuid': str(uuid.uuid4()),
+                         'display_name': 'test_instance'}
+        quantum = quantum_api.API()
+        quantum.allocate_for_instance(context.get_admin_context(),
+                                      fake_instance,
+                                      security_groups=[sg['id']])
+
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups/%s'
+                                      % sg['id'])
+        self.assertRaises(webob.exc.HTTPBadRequest, self.controller.delete,
+                          req, sg['id'])
+
+    def test_associate_non_running_instance(self):
+        # Quantum does not care if the instance is running or not. When the
+        # instances is detected by quantum it will push down the security
+        # group policy to it.
+        pass
+
+    def test_associate_already_associated_security_group_to_instance(self):
+        # Quantum security groups does not raise an error if you update a
+        # port adding a security group to it that was already associated
+        # to the port. This is because PUT semantics are used.
+        pass
+
+    def test_associate(self):
+        sg = self._create_sg_template().get('security_group')
+        net = self._create_network()
+        self._create_port(
+            network_id=net['network']['id'], security_groups=[sg['id']],
+            device_id=test_security_groups.FAKE_UUID)
+
+        self.stubs.Set(nova.db, 'instance_get',
+                       test_security_groups.return_server)
+        self.stubs.Set(nova.db, 'instance_get_by_uuid',
+                       test_security_groups.return_server_by_uuid)
+        body = dict(addSecurityGroup=dict(name="test"))
+
+        req = fakes.HTTPRequest.blank('/v2/fake/servers/1/action')
+        self.manager._addSecurityGroup(req, '1', body)
+
+    def test_disassociate_by_non_existing_security_group_name(self):
+        self.stubs.Set(nova.db, 'instance_get',
+                       test_security_groups.return_server)
+        body = dict(removeSecurityGroup=dict(name='non-existing'))
+
+        req = fakes.HTTPRequest.blank('/v2/fake/servers/1/action')
+        self.assertRaises(webob.exc.HTTPNotFound,
+                          self.manager._removeSecurityGroup, req, '1', body)
+
+    def test_disassociate_non_running_instance(self):
+        # Quantum does not care if the instance is running or not. When the
+        # instances is detected by quantum it will push down the security
+        # group policy to it.
+        pass
+
+    def test_disassociate_already_associated_security_group_to_instance(self):
+        # Quantum security groups does not raise an error if you update a
+        # port adding a security group to it that was already associated
+        # to the port. This is because PUT semantics are used.
+        pass
+
+    def test_disassociate(self):
+        sg = self._create_sg_template().get('security_group')
+        net = self._create_network()
+        self._create_port(
+            network_id=net['network']['id'], security_groups=[sg['id']],
+            device_id=test_security_groups.FAKE_UUID)
+
+        self.stubs.Set(nova.db, 'instance_get',
+                       test_security_groups.return_server)
+        self.stubs.Set(nova.db, 'instance_get_by_uuid',
+                       test_security_groups.return_server_by_uuid)
+        body = dict(removeSecurityGroup=dict(name="test"))
+
+        req = fakes.HTTPRequest.blank('/v2/fake/servers/1/action')
+        self.manager._removeSecurityGroup(req, '1', body)
+
+
+class TestQuantumSecurityGroupRulesTestCase(TestQuantumSecurityGroupsTestCase):
+    def setUp(self):
+        super(TestQuantumSecurityGroupRulesTestCase, self).setUp()
+        id1 = '11111111-1111-1111-1111-111111111111'
+        sg_template1 = test_security_groups.security_group_template(
+            security_group_rules=[], id=id1)
+        id2 = '22222222-2222-2222-2222-222222222222'
+        sg_template2 = test_security_groups.security_group_template(
+            security_group_rules=[], id=id2)
+        quantum = get_client()
+        quantum._fake_security_groups[id1] = sg_template1
+        quantum._fake_security_groups[id2] = sg_template2
+
+    def tearDown(self):
+        quantumv2.get_client = self.original_client
+        get_client()._reset()
+        super(TestQuantumSecurityGroupsTestCase, self).tearDown()
+
+
+class TestQuantumSecurityGroupRules(
+        test_security_groups.TestSecurityGroupRules,
+        TestQuantumSecurityGroupRulesTestCase):
+
+    def test_create_add_existing_rules_by_cidr(self):
+        # Enforced by quantum
+        pass
+
+    def test_create_add_existing_rules_by_group_id(self):
+        # Enforced by quantum
+        pass
+
+    def test_delete(self):
+        rule = test_security_groups.security_group_rule_template(
+            parent_group_id=self.sg2['id'])
+
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
+        res_dict = self.controller.create(req, {'security_group_rule': rule})
+        security_group_rule = res_dict['security_group_rule']
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules/%s'
+                                      % security_group_rule['id'])
+        self.controller.delete(req, security_group_rule['id'])
+
+    def test_create_rule_quota_limit(self):
+        # Enforced by quantum
+        pass
+
+
+class TestQuantumSecurityGroupsXMLDeserializer(
+        test_security_groups.TestSecurityGroupXMLDeserializer,
+        TestQuantumSecurityGroupsTestCase):
+    pass
+
+
+class TestQuantumSecurityGroupsXMLSerializer(
+        test_security_groups.TestSecurityGroupXMLSerializer,
+        TestQuantumSecurityGroupsTestCase):
+    pass
+
+
+class TestQuantumSecurityGroupsOutputTest(TestQuantumSecurityGroupsTestCase):
+    content_type = 'application/json'
+
+    def setUp(self):
+        super(TestQuantumSecurityGroupsOutputTest, self).setUp()
+        fakes.stub_out_nw_api(self.stubs)
+        self.controller = security_groups.SecurityGroupController()
+        self.stubs.Set(compute.api.API, 'get',
+                       test_security_groups.fake_compute_get)
+        self.stubs.Set(compute.api.API, 'create',
+                       test_security_groups.fake_compute_create)
+        self.flags(
+            osapi_compute_extension=[
+                'nova.api.openstack.compute.contrib.select_extensions'],
+            osapi_compute_ext_list=['Security_groups'])
+
+    def _make_request(self, url, body=None):
+        req = webob.Request.blank(url)
+        if body:
+            req.method = 'POST'
+            req.body = self._encode_body(body)
+        req.content_type = self.content_type
+        req.headers['Accept'] = self.content_type
+        res = req.get_response(fakes.wsgi_app(init_only=('servers',)))
+        return res
+
+    def _encode_body(self, body):
+        return jsonutils.dumps(body)
+
+    def _get_server(self, body):
+        return jsonutils.loads(body).get('server')
+
+    def _get_servers(self, body):
+        return jsonutils.loads(body).get('servers')
+
+    def _get_groups(self, server):
+        return server.get('security_groups')
+
+    def test_create(self):
+        url = '/v2/fake/servers'
+        image_uuid = 'c905cedb-7281-47e4-8a62-f26bc5fc4c77'
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups')
+        security_groups = [{'name': 'fake-2-0'}, {'name': 'fake-2-1'}]
+        for security_group in security_groups:
+            sg = test_security_groups.security_group_template(
+                name=security_group['name'])
+            self.controller.create(req, {'security_group': sg})
+
+        server = dict(name='server_test', imageRef=image_uuid, flavorRef=2,
+                      security_groups=security_groups)
+        res = self._make_request(url, {'server': server})
+        self.assertEqual(res.status_int, 202)
+        server = self._get_server(res.body)
+        for i, group in enumerate(self._get_groups(server)):
+            name = 'fake-2-%s' % i
+            self.assertEqual(group.get('name'), name)
+
+    def test_show(self):
+        url = '/v2/fake/servers'
+        image_uuid = 'c905cedb-7281-47e4-8a62-f26bc5fc4c77'
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups')
+        security_groups = [{'name': 'fake-2-0'}, {'name': 'fake-2-1'}]
+        for security_group in security_groups:
+            sg = test_security_groups.security_group_template(
+                name=security_group['name'])
+            self.controller.create(req, {'security_group': sg})
+        server = dict(name='server_test', imageRef=image_uuid, flavorRef=2,
+                      security_groups=security_groups)
+
+        res = self._make_request(url, {'server': server})
+        self.assertEqual(res.status_int, 202)
+        server = self._get_server(res.body)
+        for i, group in enumerate(self._get_groups(server)):
+            name = 'fake-2-%s' % i
+            self.assertEqual(group.get('name'), name)
+
+    def test_detail(self):
+        url = '/v2/fake/servers/detail'
+        res = self._make_request(url)
+
+        self.assertEqual(res.status_int, 200)
+        for i, server in enumerate(self._get_servers(res.body)):
+            for j, group in enumerate(self._get_groups(server)):
+                name = 'fake-%s-%s' % (i, j)
+                self.assertEqual(group.get('name'), name)
+
+    def test_no_instance_passthrough_404(self):
+
+        def fake_compute_get(*args, **kwargs):
+            raise exception.InstanceNotFound(instance_id='fake')
+
+        self.stubs.Set(compute.api.API, 'get', fake_compute_get)
+        url = '/v2/fake/servers/70f6db34-de8d-4fbd-aafb-4065bdfa6115'
+        res = self._make_request(url)
+
+        self.assertEqual(res.status_int, 404)
+
+
+class TestQuantumSecurityGroupsOutputXMLTest(
+        TestQuantumSecurityGroupsOutputTest):
+
+    content_type = 'application/xml'
+
+    class MinimalCreateServerTemplate(xmlutil.TemplateBuilder):
+        def construct(self):
+            root = xmlutil.TemplateElement('server', selector='server')
+            root.set('name')
+            root.set('id')
+            root.set('imageRef')
+            root.set('flavorRef')
+            elem = xmlutil.SubTemplateElement(root, 'security_groups')
+            sg = xmlutil.SubTemplateElement(elem, 'security_group',
+                                            selector='security_groups')
+            sg.set('name')
+            return xmlutil.MasterTemplate(root, 1,
+                                          nsmap={None: xmlutil.XMLNS_V11})
+
+    def _encode_body(self, body):
+        serializer = self.MinimalCreateServerTemplate()
+        return serializer.serialize(body)
+
+    def _get_server(self, body):
+        return etree.XML(body)
+
+    def _get_servers(self, body):
+        return etree.XML(body).getchildren()
+
+    def _get_groups(self, server):
+        # NOTE(vish): we are adding security groups without an extension
+        #             namespace so we don't break people using the existing
+        #             functionality, but that means we need to use find with
+        #             the existing server namespace.
+        namespace = server.nsmap[None]
+        return server.find('{%s}security_groups' % namespace).getchildren()
+
+
+def get_client(context=None, admin=False):
+    return MockClient()
+
+
+class MockClient(object):
+
+    # Needs to be global to survive multiple calls to get_client.
+    _fake_security_groups = {}
+    _fake_ports = {}
+    _fake_networks = {}
+    _fake_subnets = {}
+    _fake_security_group_rules = {}
+
+    def __init__(self):
+        # add default security group
+        if not len(self._fake_security_groups):
+            ret = {'name': 'default', 'description': 'default',
+                   'tenant_id': 'fake_tenant', 'security_group_rules': [],
+                   'id': str(uuid.uuid4())}
+            self._fake_security_groups[ret['id']] = ret
+
+    def _reset(self):
+        self._fake_security_groups.clear()
+        self._fake_ports.clear()
+        self._fake_networks.clear()
+        self._fake_subnets.clear()
+        self._fake_security_group_rules.clear()
+
+    def create_security_group(self, body=None):
+        s = body.get('security_group')
+        if len(s.get('name')) > 255 or len(s.get('description')) > 255:
+            msg = 'Security Group name great than 255'
+            raise q_exc.QuantumClientException(message=msg, status_code=401)
+        ret = {'name': s.get('name'), 'description': s.get('description'),
+               'tenant_id': 'fake_tenant', 'security_group_rules': [],
+               'id': str(uuid.uuid4())}
+
+        self._fake_security_groups[ret['id']] = ret
+        return {'security_group': ret}
+
+    def create_network(self, body):
+        n = body.get('network')
+        ret = {'status': 'ACTIVE', 'subnets': [], 'name': n.get('name'),
+               'admin_state_up': n.get('admin_state_up', True),
+               'tenant_id': 'fake_tenant',
+               'port_security_enabled': n.get('port_security_enabled', True),
+               'id': str(uuid.uuid4())}
+        self._fake_networks[ret['id']] = ret
+        return {'network': ret}
+
+    def create_subnet(self, body):
+        s = body.get('subnet')
+        try:
+            net = self._fake_networks[s.get('network_id')]
+        except KeyError:
+            msg = 'Network %s not found' % s.get('network_id')
+            raise q_exc.QuantumClientException(message=msg, status_code=404)
+        ret = {'name': s.get('name'), 'network_id': s.get('network_id'),
+               'tenant_id': 'fake_tenant', 'cidr': s.get('cidr'),
+               'id': str(uuid.uuid4()), 'gateway_ip': '10.0.0.1'}
+        net['subnets'].append(ret['id'])
+        self._fake_networks[net['id']] = net
+        self._fake_subnets[ret['id']] = ret
+        return {'subnet': ret}
+
+    def create_port(self, body):
+        p = body.get('port')
+        ret = {'status': 'ACTIVE', 'id': str(uuid.uuid4()),
+               'mac_address': p.get('mac_address', 'fa:16:3e:b8:f5:fb'),
+               'port_security_enabled': p.get('port_security_enabled'),
+               'device_owner': str(uuid.uuid4())}
+
+        fields = ['network_id', 'security_groups', 'admin_state_up']
+        for field in fields:
+            ret[field] = p.get(field)
+
+        network = self._fake_networks[p['network_id']]
+        if not ret['port_security_enabled']:
+            ret['port_security_enabled'] = network['port_security_enabled']
+        if network['subnets']:
+            ret['fixed_ips'] = [{'subnet_id': network['subnets'][0],
+                                 'ip_address': '10.0.0.1'}]
+        if not ret['security_groups']:
+            for security_group in self._fake_security_groups.values():
+                if security_group['name'] == 'default':
+                    ret['security_groups'] = [security_group['id']]
+                    break
+        self._fake_ports[ret['id']] = ret
+        return {'port': ret}
+
+    def create_security_group_rule(self, body):
+        # does not handle bulk case so just picks rule[0]
+        r = body.get('security_group_rules')[0]
+        fields = ['direction', 'protocol', 'port_range_min', 'port_range_max',
+                  'ethertype', 'source_ip_prefix', 'tenant_id',
+                  'security_group_id', 'source_group_id']
+        ret = {}
+        for field in fields:
+            ret[field] = r.get(field)
+        ret['id'] = str(uuid.uuid4())
+        self._fake_security_group_rules[ret['id']] = ret
+        return {'security_group_rules': [ret]}
+
+    def show_security_group(self, security_group, **_params):
+        try:
+            return {'security_group':
+                    self._fake_security_groups[security_group]}
+        except KeyError:
+            msg = 'Security Group %s not found' % security_group
+            raise q_exc.QuantumClientException(message=msg, status_code=404)
+
+    def show_security_group_rule(self, security_group_rule, **_params):
+        try:
+            return {'security_group_rule':
+                    self._fake_security_group_rules[security_group_rule]}
+        except KeyError:
+            msg = 'Security Group rule %s not found' % security_group_rule
+            raise q_exc.QuantumClientException(message=msg, status_code=404)
+
+    def show_network(self, network, **_params):
+        try:
+            return {'network':
+                    self._fake_networks[network]}
+        except KeyError:
+            msg = 'Network %s not found' % network
+            raise q_exc.QuantumClientException(message=msg, status_code=404)
+
+    def show_port(self, port, **_params):
+        try:
+            return {'port':
+                    self._fake_ports[port]}
+        except KeyError:
+            msg = 'Port %s not found' % port
+            raise q_exc.QuantumClientException(message=msg, status_code=404)
+
+    def show_subnet(self, subnet, **_params):
+        try:
+            return {'subnet':
+                    self._fake_subnets[subnet]}
+        except KeyError:
+            msg = 'Port %s not found' % subnet
+            raise q_exc.QuantumClientException(message=msg, status_code=404)
+
+    def list_security_groups(self, **_params):
+        ret = []
+        for security_group in self._fake_security_groups.values():
+            if _params.get('name'):
+                if security_group.get('name') == _params['name']:
+                    ret.append(security_group)
+            else:
+                ret.append(security_group)
+        return {'security_groups': ret}
+
+    def list_networks(self, **_params):
+        return {'networks':
+                [network for network in self._fake_networks.values()]}
+
+    def list_ports(self, **_params):
+        return {'ports':
+                [port for port in self._fake_ports.values()]}
+
+    def list_subnets(self, **_params):
+        return {'subnets':
+                [subnet for subnet in self._fake_subnets.values()]}
+
+    def delete_security_group(self, security_group):
+        self.show_security_group(security_group)
+        ports = self.list_ports()
+        for port in ports.get('ports'):
+            for sg_port in port['security_groups']:
+                if sg_port == security_group:
+                    msg = ('Unable to delete Security group %s in use'
+                           % security_group)
+                    raise q_exc.QuantumClientException(message=msg,
+                                                       status_code=409)
+        del self._fake_security_groups[security_group]
+
+    def delete_security_group_rule(self, security_group_rule):
+        self.show_security_group_rule(security_group_rule)
+        del self._fake_security_group_rules[security_group_rule]
+
+    def delete_network(self, network):
+        self.show_network(network)
+        self._check_ports_on_network(network)
+        for subnet in self._fake_subnets.values():
+            if subnet['network_id'] == network:
+                del self._fake_subnets[subnet['id']]
+        del self._fake_networks[network]
+
+    def delete_subnet(self, subnet):
+        subnet = self.show_subnet(subnet).get('subnet')
+        self._check_ports_on_network(subnet['network_id'])
+        del self._fake_subnet[subnet]
+
+    def delete_port(self, port):
+        self.show_port(port)
+        del self._fake_ports[port]
+
+    def update_port(self, port, body=None):
+        self.show_port(port)
+        self._fake_ports[port].update(body['port'])
+        return {'port': self._fake_ports[port]}
+
+    def list_extensions(self, **_parms):
+        return {'extensions': []}
+
+    def _check_ports_on_network(self, network):
+        ports = self.list_ports()
+        for port in ports:
+            if port['network_id'] == network:
+                msg = ('Unable to complete operation on network %s. There is '
+                       'one or more ports still in use on the network'
+                       % network)
+            raise q_exc.QuantumClientException(message=msg, status_code=409)
diff --git a/nova/tests/api/openstack/compute/contrib/test_security_groups.py b/nova/tests/api/openstack/compute/contrib/test_security_groups.py
index 1b254c2a7..5058f17ac 100644
--- a/nova/tests/api/openstack/compute/contrib/test_security_groups.py
+++ b/nova/tests/api/openstack/compute/contrib/test_security_groups.py
@@ -118,6 +118,14 @@ class TestSecurityGroups(test.TestCase):
             security_groups.ServerSecurityGroupController())
         self.manager = security_groups.SecurityGroupActionController()
 
+        # This needs to be done here to set fake_id because the derived
+        # class needs to be called first if it wants to set
+        # 'security_group_api' and this setUp method needs to be called.
+        if self.controller.security_group_api.id_is_uuid:
+            self.fake_id = '11111111-1111-1111-1111-111111111111'
+        else:
+            self.fake_id = '11111111'
+
     def _assert_no_security_groups_reserved(self, context):
         """Check that no reservations are leaked during tests."""
         result = quota.QUOTAS.get_project_quotas(context, context.project_id)
@@ -392,9 +400,10 @@ class TestSecurityGroups(test.TestCase):
                           req, 'invalid')
 
     def test_get_security_group_by_non_existing_id(self):
-        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups/111111111')
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups/%s' %
+                                      self.fake_id)
         self.assertRaises(webob.exc.HTTPNotFound, self.controller.delete,
-                          req, '111111111')
+                          req, self.fake_id)
 
     def test_delete_security_group_by_id(self):
         sg = security_group_template(id=1, rules=[])
@@ -424,9 +433,10 @@ class TestSecurityGroups(test.TestCase):
                           req, 'invalid')
 
     def test_delete_security_group_by_non_existing_id(self):
-        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups/11111111')
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-groups/%s'
+                                      % self.fake_id)
         self.assertRaises(webob.exc.HTTPNotFound, self.controller.delete,
-                          req, '11111111')
+                          req, self.fake_id)
 
     def test_delete_security_group_in_use(self):
         sg = security_group_template(id=1, rules=[])
@@ -639,12 +649,23 @@ class TestSecurityGroupRules(test.TestCase):
     def setUp(self):
         super(TestSecurityGroupRules, self).setUp()
 
-        sg1 = security_group_template(id=1)
-        sg2 = security_group_template(id=2,
-                                      name='authorize_revoke',
-                                      description='authorize-revoke testing')
-        db1 = security_group_db(sg1)
-        db2 = security_group_db(sg2)
+        self.controller = security_groups.SecurityGroupController()
+        if self.controller.security_group_api.id_is_uuid:
+            id1 = '11111111-1111-1111-1111-111111111111'
+            id2 = '22222222-2222-2222-2222-222222222222'
+            self.invalid_id = '33333333-3333-3333-3333-333333333333'
+        else:
+            id1 = 1
+            id2 = 2
+            self.invalid_id = '33333333'
+
+        self.sg1 = security_group_template(id=id1)
+        self.sg2 = security_group_template(
+            id=id2, name='authorize_revoke',
+            description='authorize-revoke testing')
+
+        db1 = security_group_db(self.sg1)
+        db2 = security_group_db(self.sg2)
 
         def return_security_group(context, group_id):
             if group_id == db1['id']:
@@ -661,41 +682,47 @@ class TestSecurityGroupRules(test.TestCase):
         self.controller = security_groups.SecurityGroupRulesController()
 
     def test_create_by_cidr(self):
-        rule = security_group_rule_template(cidr='10.2.3.124/24')
+        rule = security_group_rule_template(cidr='10.2.3.124/24',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
-
         security_group_rule = res_dict['security_group_rule']
         self.assertNotEquals(security_group_rule['id'], 0)
-        self.assertEquals(security_group_rule['parent_group_id'], 2)
+        self.assertEquals(security_group_rule['parent_group_id'],
+                          self.sg2['id'])
         self.assertEquals(security_group_rule['ip_range']['cidr'],
                           "10.2.3.124/24")
 
     def test_create_by_group_id(self):
-        rule = security_group_rule_template(group_id=1)
+        rule = security_group_rule_template(group_id=self.sg1['id'],
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
 
         security_group_rule = res_dict['security_group_rule']
         self.assertNotEquals(security_group_rule['id'], 0)
-        self.assertEquals(security_group_rule['parent_group_id'], 2)
+        self.assertEquals(security_group_rule['parent_group_id'],
+                          self.sg2['id'])
 
     def test_create_by_same_group_id(self):
-        rule1 = security_group_rule_template(group_id=1, from_port=80,
-                                             to_port=80)
+        rule1 = security_group_rule_template(group_id=self.sg1['id'],
+                                             from_port=80, to_port=80,
+                                             parent_group_id=self.sg2['id'])
         self.parent_security_group['rules'] = [security_group_rule_db(rule1)]
 
-        rule2 = security_group_rule_template(group_id=1, from_port=81,
-                                             to_port=81)
+        rule2 = security_group_rule_template(group_id=self.sg1['id'],
+                                             from_port=81, to_port=81,
+                                             parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule2})
 
         security_group_rule = res_dict['security_group_rule']
         self.assertNotEquals(security_group_rule['id'], 0)
-        self.assertEquals(security_group_rule['parent_group_id'], 2)
+        self.assertEquals(security_group_rule['parent_group_id'],
+                          self.sg2['id'])
         self.assertEquals(security_group_rule['from_port'], 81)
         self.assertEquals(security_group_rule['to_port'], 81)
 
@@ -705,13 +732,13 @@ class TestSecurityGroupRules(test.TestCase):
                         "ip_protocol": "tcp",
                         "from_port": "22",
                         "to_port": "22",
-                        "parent_group_id": 2,
+                        "parent_group_id": self.sg2['id'],
                         "cidr": "10.2.3.124/2433"}}
         rule = security_group_rule_template(
                 ip_protocol="tcp",
                 from_port=22,
                 to_port=22,
-                parent_group_id=2,
+                parent_group_id=self.sg2['id'],
                 cidr="10.2.3.124/2433")
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
@@ -722,7 +749,7 @@ class TestSecurityGroupRules(test.TestCase):
                 ip_protocol="tcp",
                 from_port=75534,
                 to_port=22,
-                parent_group_id=2,
+                parent_group_id=self.sg2['id'],
                 cidr="10.2.3.124/24")
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
@@ -734,14 +761,15 @@ class TestSecurityGroupRules(test.TestCase):
                 ip_protocol="icmp",
                 from_port=1,
                 to_port=256,
-                parent_group_id=2,
+                parent_group_id=self.sg2['id'],
                 cidr="10.2.3.124/24")
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_add_existing_rules_by_cidr(self):
-        rule = security_group_rule_template(cidr='10.0.0.0/24')
+        rule = security_group_rule_template(cidr='10.0.0.0/24',
+                                            parent_group_id=self.sg2['id'])
 
         self.parent_security_group['rules'] = [security_group_rule_db(rule)]
 
@@ -778,7 +806,7 @@ class TestSecurityGroupRules(test.TestCase):
 
     def test_create_with_non_existing_parent_group_id(self):
         rule = security_group_rule_template(group_id='invalid',
-                                            parent_group_id='1111111111111')
+                                            parent_group_id=self.invalid_id)
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPNotFound, self.controller.create,
@@ -786,14 +814,16 @@ class TestSecurityGroupRules(test.TestCase):
 
     def test_create_with_invalid_protocol(self):
         rule = security_group_rule_template(ip_protocol='invalid-protocol',
-                                            cidr='10.2.2.0/24')
+                                            cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_with_no_protocol(self):
-        rule = security_group_rule_template(cidr='10.2.2.0/24')
+        rule = security_group_rule_template(cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
         del rule['ip_protocol']
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
@@ -802,7 +832,8 @@ class TestSecurityGroupRules(test.TestCase):
 
     def test_create_with_invalid_from_port(self):
         rule = security_group_rule_template(from_port='666666',
-                                            cidr='10.2.2.0/24')
+                                            cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
@@ -810,7 +841,8 @@ class TestSecurityGroupRules(test.TestCase):
 
     def test_create_with_invalid_to_port(self):
         rule = security_group_rule_template(to_port='666666',
-                                            cidr='10.2.2.0/24')
+                                            cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
@@ -818,7 +850,8 @@ class TestSecurityGroupRules(test.TestCase):
 
     def test_create_with_non_numerical_from_port(self):
         rule = security_group_rule_template(from_port='invalid',
-                                            cidr='10.2.2.0/24')
+                                            cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
@@ -826,14 +859,16 @@ class TestSecurityGroupRules(test.TestCase):
 
     def test_create_with_non_numerical_to_port(self):
         rule = security_group_rule_template(to_port='invalid',
-                                            cidr='10.2.2.0/24')
+                                            cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_with_no_from_port(self):
-        rule = security_group_rule_template(cidr='10.2.2.0/24')
+        rule = security_group_rule_template(cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
         del rule['from_port']
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
@@ -841,7 +876,8 @@ class TestSecurityGroupRules(test.TestCase):
                           req, {'security_group_rule': rule})
 
     def test_create_with_no_to_port(self):
-        rule = security_group_rule_template(cidr='10.2.2.0/24')
+        rule = security_group_rule_template(cidr='10.2.2.0/24',
+                                            parent_group_id=self.sg2['id'])
         del rule['to_port']
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
@@ -849,14 +885,15 @@ class TestSecurityGroupRules(test.TestCase):
                           req, {'security_group_rule': rule})
 
     def test_create_with_invalid_cidr(self):
-        rule = security_group_rule_template(cidr='10.2.2222.0/24')
+        rule = security_group_rule_template(cidr='10.2.2222.0/24',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_with_no_cidr_group(self):
-        rule = security_group_rule_template()
+        rule = security_group_rule_template(parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
@@ -869,54 +906,59 @@ class TestSecurityGroupRules(test.TestCase):
                           "0.0.0.0/0")
 
     def test_create_with_invalid_group_id(self):
-        rule = security_group_rule_template(group_id='invalid')
+        rule = security_group_rule_template(group_id='invalid',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_with_empty_group_id(self):
-        rule = security_group_rule_template(group_id='')
+        rule = security_group_rule_template(group_id='',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_with_nonexist_group_id(self):
-        rule = security_group_rule_template(group_id='222222')
+        rule = security_group_rule_template(group_id=self.invalid_id,
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_with_same_group_parent_id_and_group_id(self):
-        rule = security_group_rule_template(group_id=1, parent_group_id=1)
-
+        rule = security_group_rule_template(group_id=self.sg1['id'],
+                                            parent_group_id=self.sg1['id'])
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
         security_group_rule = res_dict['security_group_rule']
         self.assertNotEquals(security_group_rule['id'], 0)
-        self.assertEquals(security_group_rule['parent_group_id'], 1)
-        self.assertEquals(security_group_rule['id'], 1)
+        self.assertEquals(security_group_rule['parent_group_id'],
+                          self.sg1['id'])
+        self.assertEquals(security_group_rule['group']['name'],
+                          self.sg1['name'])
 
     def _test_create_with_no_ports_and_no_group(self, proto):
-        rule = {'ip_protocol': proto, 'parent_group_id': '2'}
+        rule = {'ip_protocol': proto, 'parent_group_id': self.sg2['id']}
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         self.assertRaises(webob.exc.HTTPBadRequest, self.controller.create,
                           req, {'security_group_rule': rule})
 
     def _test_create_with_no_ports(self, proto):
-        rule = {'ip_protocol': proto, 'parent_group_id': '2', 'group_id': '1'}
+        rule = {'ip_protocol': proto, 'parent_group_id': self.sg2['id'],
+                 'group_id': self.sg1['id']}
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
-
         security_group_rule = res_dict['security_group_rule']
         expected_rule = {
             'from_port': 1, 'group': {'tenant_id': '123', 'name': 'test'},
-            'ip_protocol': proto, 'to_port': 65535, 'parent_group_id': 2,
-            'ip_range': {}, 'id': 1
+            'ip_protocol': proto, 'to_port': 65535, 'parent_group_id':
+             self.sg2['id'], 'ip_range': {}, 'id': security_group_rule['id']
         }
         if proto == 'icmp':
             expected_rule['to_port'] = -1
@@ -935,10 +977,10 @@ class TestSecurityGroupRules(test.TestCase):
         self._test_create_with_no_ports_and_no_group('udp')
         self._test_create_with_no_ports('udp')
 
-    def _test_create_with_ports(self, id_val, proto, from_port, to_port):
+    def _test_create_with_ports(self, proto, from_port, to_port):
         rule = {
             'ip_protocol': proto, 'from_port': from_port, 'to_port': to_port,
-            'parent_group_id': '2', 'group_id': '1'
+            'parent_group_id': self.sg2['id'], 'group_id': self.sg1['id']
         }
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
@@ -947,32 +989,32 @@ class TestSecurityGroupRules(test.TestCase):
         expected_rule = {
             'from_port': from_port,
             'group': {'tenant_id': '123', 'name': 'test'},
-            'ip_protocol': proto, 'to_port': to_port, 'parent_group_id': 2,
-            'ip_range': {}, 'id': id_val
+            'ip_protocol': proto, 'to_port': to_port, 'parent_group_id':
+             self.sg2['id'], 'ip_range': {}, 'id': security_group_rule['id']
         }
         self.assertTrue(security_group_rule['ip_protocol'] == proto)
-        self.assertTrue(security_group_rule['id'] == id_val)
         self.assertTrue(security_group_rule['from_port'] == from_port)
         self.assertTrue(security_group_rule['to_port'] == to_port)
         self.assertTrue(security_group_rule == expected_rule)
 
     def test_create_with_ports_icmp(self):
-        self._test_create_with_ports(1, 'icmp', 0, 1)
-        self._test_create_with_ports(2, 'icmp', 0, 0)
-        self._test_create_with_ports(3, 'icmp', 1, 0)
+        self._test_create_with_ports('icmp', 0, 1)
+        self._test_create_with_ports('icmp', 0, 0)
+        self._test_create_with_ports('icmp', 1, 0)
 
     def test_create_with_ports_tcp(self):
-        self._test_create_with_ports(1, 'tcp', 1, 1)
-        self._test_create_with_ports(2, 'tcp', 1, 65535)
-        self._test_create_with_ports(3, 'tcp', 65535, 65535)
+        self._test_create_with_ports('tcp', 1, 1)
+        self._test_create_with_ports('tcp', 1, 65535)
+        self._test_create_with_ports('tcp', 65535, 65535)
 
     def test_create_with_ports_udp(self):
-        self._test_create_with_ports(1, 'udp', 1, 1)
-        self._test_create_with_ports(2, 'udp', 1, 65535)
-        self._test_create_with_ports(3, 'udp', 65535, 65535)
+        self._test_create_with_ports('udp', 1, 1)
+        self._test_create_with_ports('udp', 1, 65535)
+        self._test_create_with_ports('udp', 65535, 65535)
 
     def test_delete(self):
-        rule = security_group_rule_template(id=10)
+        rule = security_group_rule_template(id=self.sg2['id'],
+                                            parent_group_id=self.sg2['id'])
 
         def security_group_rule_get(context, id):
             return security_group_rule_db(rule)
@@ -985,8 +1027,9 @@ class TestSecurityGroupRules(test.TestCase):
         self.stubs.Set(nova.db, 'security_group_rule_destroy',
                        security_group_rule_destroy)
 
-        req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules/10')
-        self.controller.delete(req, '10')
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules/%s'
+                                      % self.sg2['id'])
+        self.controller.delete(req, self.sg2['id'])
 
     def test_delete_invalid_rule_id(self):
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules' +
@@ -995,30 +1038,32 @@ class TestSecurityGroupRules(test.TestCase):
                           req, 'invalid')
 
     def test_delete_non_existing_rule_id(self):
-        req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules' +
-                                      '/22222222222222')
+        req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules/%s'
+                                      % self.invalid_id)
         self.assertRaises(webob.exc.HTTPNotFound, self.controller.delete,
-                          req, '22222222222222')
+                          req, self.invalid_id)
 
     def test_create_rule_quota_limit(self):
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         for num in range(100, 100 + CONF.quota_security_group_rules):
             rule = {
                 'ip_protocol': 'tcp', 'from_port': num,
-                'to_port': num, 'parent_group_id': '2', 'group_id': '1'
+                'to_port': num, 'parent_group_id': self.sg2['id'],
+                'group_id': self.sg1['id']
             }
             self.controller.create(req, {'security_group_rule': rule})
 
         rule = {
             'ip_protocol': 'tcp', 'from_port': '121', 'to_port': '121',
-            'parent_group_id': '2', 'group_id': '1'
+            'parent_group_id': self.sg2['id'], 'group_id': self.sg1['id']
         }
         self.assertRaises(exception.SecurityGroupLimitExceeded,
                           self.controller.create,
                           req, {'security_group_rule': rule})
 
     def test_create_rule_cidr_allow_all(self):
-        rule = security_group_rule_template(cidr='0.0.0.0/0')
+        rule = security_group_rule_template(cidr='0.0.0.0/0',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
@@ -1031,7 +1076,8 @@ class TestSecurityGroupRules(test.TestCase):
                           "0.0.0.0/0")
 
     def test_create_rule_cidr_allow_some(self):
-        rule = security_group_rule_template(cidr='15.0.0.0/8')
+        rule = security_group_rule_template(cidr='15.0.0.0/8',
+                                            parent_group_id=self.sg2['id'])
 
         req = fakes.HTTPRequest.blank('/v2/fake/os-security-group-rules')
         res_dict = self.controller.create(req, {'security_group_rule': rule})
@@ -1340,6 +1386,7 @@ class SecurityGroupsOutputTest(test.TestCase):
 
     def setUp(self):
         super(SecurityGroupsOutputTest, self).setUp()
+        self.controller = security_groups.SecurityGroupController()
         fakes.stub_out_nw_api(self.stubs)
         self.stubs.Set(compute.api.API, 'get', fake_compute_get)
         self.stubs.Set(compute.api.API, 'get_all', fake_compute_get_all)
diff --git a/nova/tests/compute/test_compute.py b/nova/tests/compute/test_compute.py
index 542a7e162..e19470db5 100644
--- a/nova/tests/compute/test_compute.py
+++ b/nova/tests/compute/test_compute.py
@@ -1662,7 +1662,8 @@ class ComputeTestCase(BaseTestCase):
             mox.IgnoreArg(),
             requested_networks=None,
             vpn=False, macs=macs,
-            conductor_api=self.compute.conductor_api).AndReturn(
+            conductor_api=self.compute.conductor_api,
+            security_groups=[]).AndReturn(
                 fake_network.fake_get_instance_nw_info(self.stubs, 1, 1,
                                                        spectacular=True))
         self.mox.StubOutWithMock(self.compute.driver, "macs_for_instance")
@@ -1681,7 +1682,8 @@ class ComputeTestCase(BaseTestCase):
                 mox.IgnoreArg(),
                 requested_networks=None,
                 vpn=False, macs=None,
-                conductor_api=self.compute.conductor_api
+                conductor_api=self.compute.conductor_api,
+                security_groups=[]
                 ).AndRaise(rpc_common.RemoteError())
 
         fake_network.unset_stub_network_methods(self.stubs)
diff --git a/nova/utils.py b/nova/utils.py
index 2dcedb5d5..2c7d0b427 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -983,6 +983,15 @@ def is_valid_cidr(address):
     return True
 
 
+def get_ip_version(network):
+    """Returns the IP version of a network (IPv4 or IPv6). Raises
+    AddrFormatError if invalid network."""
+    if netaddr.IPNetwork(network).version == 6:
+        return "IPv6"
+    elif netaddr.IPNetwork(network).version == 4:
+        return "IPv4"
+
+
 def monkey_patch():
     """If the Flags.monkey_patch set as True,
     this function patches a decorator