merged trunk

20 files changed, 959 insertions, 91 deletions

diff --git a/Authors b/Authors
index 4ee0643cf..9aad104a7 100644
--- a/Authors
+++ b/Authors
@@ -40,6 +40,7 @@ Ken Pepple <ken.pepple@gmail.com>
 Kevin L. Mitchell <kevin.mitchell@rackspace.com>
 Koji Iida <iida.koji@lab.ntt.co.jp>
 Lorin Hochstein <lorin@isi.edu>
+Mark Washenberger <mark.washenberger@rackspace.com>
 Masanori Itoh <itoumsn@nttdata.co.jp>
 Matt Dietz <matt.dietz@rackspace.com>
 Michael Gundlach <michael.gundlach@rackspace.com>
diff --git a/bin/nova-manage b/bin/nova-manage
index 2b42dfff5..a4d820209 100755
--- a/bin/nova-manage
+++ b/bin/nova-manage
@@ -446,10 +446,15 @@ class FixedIpCommands(object):
     def list(self, host=None):
         """Lists all fixed ips (optionally by host) arguments: [host]"""
         ctxt = context.get_admin_context()
-        if host == None:
-            fixed_ips = db.fixed_ip_get_all(ctxt)
-        else:
-            fixed_ips = db.fixed_ip_get_all_by_host(ctxt, host)
+
+        try:
+            if host == None:
+                fixed_ips = db.fixed_ip_get_all(ctxt)
+            else:
+                fixed_ips = db.fixed_ip_get_all_by_host(ctxt, host)
+        except exception.NotFound as ex:
+            print "error: %s" % ex
+            sys.exit(2)
 
         print "%-18s\t%-15s\t%-17s\t%-15s\t%s" % (_('network'),
                                                   _('IP address'),
@@ -466,9 +471,9 @@ class FixedIpCommands(object):
                 host = instance['host']
                 mac_address = instance['mac_address']
             print "%-18s\t%-15s\t%-17s\t%-15s\t%s" % (
-                                  fixed_ip['network']['cidr'],
-                                  fixed_ip['address'],
-                                  mac_address, hostname, host)
+                    fixed_ip['network']['cidr'],
+                    fixed_ip['address'],
+                    mac_address, hostname, host)
 
 
 class FloatingIpCommands(object):
@@ -716,6 +721,49 @@ class DbCommands(object):
         print migration.db_version()
 
 
+class InstanceCommands(object):
+    """Class for managing instances."""
+
+    def list(self, host=None, instance=None):
+        """Show a list of all instances"""
+        print "%-10s %-15s %-10s %-10s %-19s %-12s %-12s %-12s" \
+              "  %-10s %-10s %-10s %-5s" % (
+            _('instance'),
+            _('node'),
+            _('type'),
+            _('state'),
+            _('launched'),
+            _('image'),
+            _('kernel'),
+            _('ramdisk'),
+            _('project'),
+            _('user'),
+            _('zone'),
+            _('index'))
+
+        if host == None:
+            instances = db.instance_get_all(context.get_admin_context())
+        else:
+            instances = db.instance_get_all_by_host(
+                           context.get_admin_context(), host)
+
+        for instance in instances:
+            print "%-10s %-15s %-10s %-10s %-19s %-12s %-12s %-12s" \
+                  "  %-10s %-10s %-10s %-5d" % (
+                instance['hostname'],
+                instance['host'],
+                instance['instance_type'],
+                instance['state_description'],
+                instance['launched_at'],
+                instance['image_id'],
+                instance['kernel_id'],
+                instance['ramdisk_id'],
+                instance['project_id'],
+                instance['user_id'],
+                instance['availability_zone'],
+                instance['launch_index'])
+
+
 class VolumeCommands(object):
     """Methods for dealing with a cloud in an odd state"""
 
@@ -1002,7 +1050,8 @@ CATEGORIES = [
     ('volume', VolumeCommands),
     ('instance_type', InstanceTypeCommands),
     ('image', ImageCommands),
-    ('flavor', InstanceTypeCommands)]
+    ('flavor', InstanceTypeCommands),
+    ('instance', InstanceCommands)]
 
 
 def lazy_match(name, key_value_tuples):
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 40a9da0e7..e257e44e7 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -959,7 +959,7 @@ class CloudController(object):
             raise exception.NotFound(_('Image %s not found') % image_id)
         internal_id = image['id']
         del(image['id'])
-        raise Exception(image)
+
         image['properties']['is_public'] = (operation_type == 'add')
         return self.image_service.update(context, internal_id, image)
 
diff --git a/nova/api/openstack/flavors.py b/nova/api/openstack/flavors.py
index f3d040ba3..1c440b3a9 100644
--- a/nova/api/openstack/flavors.py
+++ b/nova/api/openstack/flavors.py
@@ -36,7 +36,7 @@ class Controller(wsgi.Controller):
 
     def index(self, req):
         """Return all flavors in brief."""
-        return dict(flavors=[dict(id=flavor['id'], name=flavor['name'])
+        return dict(flavors=[dict(id=flavor['flavorid'], name=flavor['name'])
                              for flavor in self.detail(req)['flavors']])
 
     def detail(self, req):
@@ -48,6 +48,7 @@ class Controller(wsgi.Controller):
         """Return data about the given flavor id."""
         ctxt = req.environ['nova.context']
         values = db.instance_type_get_by_flavor_id(ctxt, id)
+        values['id'] = values['flavorid']
         return dict(flavor=values)
         raise faults.Fault(exc.HTTPNotFound())
 
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index dc28a0782..3ecd4fb01 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -13,9 +13,11 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import base64
 import hashlib
 import json
 import traceback
+from xml.dom import minidom
 
 from webob import exc
 
@@ -141,15 +143,19 @@ class Controller(wsgi.Controller):
 
     def create(self, req):
         """ Creates a new server for a given user """
-        env = self._deserialize(req.body, req.get_content_type())
+        env = self._deserialize_create(req)
         if not env:
             return faults.Fault(exc.HTTPUnprocessableEntity())
 
         context = req.environ['nova.context']
+
+        key_name = None
+        key_data = None
         key_pairs = auth_manager.AuthManager.get_key_pairs(context)
-        if not key_pairs:
-            raise exception.NotFound(_("No keypairs defined"))
-        key_pair = key_pairs[0]
+        if key_pairs:
+            key_pair = key_pairs[0]
+            key_name = key_pair['name']
+            key_data = key_pair['public_key']
 
         image_id = common.get_image_id_from_image_hash(self._image_service,
             context, env['server']['imageId'])
@@ -166,18 +172,24 @@ class Controller(wsgi.Controller):
             for k, v in env['server']['metadata'].items():
                 metadata.append({'key': k, 'value': v})
 
-        instances = self.compute_api.create(
-            context,
-            instance_types.get_by_flavor_id(env['server']['flavorId']),
-            image_id,
-            kernel_id=kernel_id,
-            ramdisk_id=ramdisk_id,
-            display_name=env['server']['name'],
-            display_description=env['server']['name'],
-            key_name=key_pair['name'],
-            key_data=key_pair['public_key'],
-            metadata=metadata,
-            onset_files=env.get('onset_files', []))
+        personality = env['server'].get('personality', [])
+        injected_files = self._get_injected_files(personality)
+
+        try:
+            instances = self.compute_api.create(
+                context,
+                instance_types.get_by_flavor_id(env['server']['flavorId']),
+                image_id,
+                kernel_id=kernel_id,
+                ramdisk_id=ramdisk_id,
+                display_name=env['server']['name'],
+                display_description=env['server']['name'],
+                key_name=key_name,
+                key_data=key_data,
+                metadata=metadata,
+                injected_files=injected_files)
+        except QuotaError as error:
+            self._handle_quota_error(error)
 
         server = _translate_keys(instances[0])
         password = "%s%s" % (server['server']['name'][:4],
@@ -187,6 +199,61 @@ class Controller(wsgi.Controller):
                                             password)
         return server
 
+    def _deserialize_create(self, request):
+        """
+        Deserialize a create request
+
+        Overrides normal behavior in the case of xml content
+        """
+        if request.content_type == "application/xml":
+            deserializer = ServerCreateRequestXMLDeserializer()
+            return deserializer.deserialize(request.body)
+        else:
+            return self._deserialize(request.body, request.get_content_type())
+
+    def _get_injected_files(self, personality):
+        """
+        Create a list of injected files from the personality attribute
+
+        At this time, injected_files must be formatted as a list of
+        (file_path, file_content) pairs for compatibility with the
+        underlying compute service.
+        """
+        injected_files = []
+        for item in personality:
+            try:
+                path = item['path']
+                contents = item['contents']
+            except KeyError as key:
+                expl = _('Bad personality format: missing %s') % key
+                raise exc.HTTPBadRequest(explanation=expl)
+            except TypeError:
+                expl = _('Bad personality format')
+                raise exc.HTTPBadRequest(explanation=expl)
+            try:
+                contents = base64.b64decode(contents)
+            except TypeError:
+                expl = _('Personality content for %s cannot be decoded') % path
+                raise exc.HTTPBadRequest(explanation=expl)
+            injected_files.append((path, contents))
+        return injected_files
+
+    def _handle_quota_errors(self, error):
+        """
+        Reraise quota errors as api-specific http exceptions
+        """
+        if error.code == "OnsetFileLimitExceeded":
+            expl = _("Personality file limit exceeded")
+            raise exc.HTTPBadRequest(explanation=expl)
+        if error.code == "OnsetFilePathLimitExceeded":
+            expl = _("Personality file path too long")
+            raise exc.HTTPBadRequest(explanation=expl)
+        if error.code == "OnsetFileContentLimitExceeded":
+            expl = _("Personality file content too long")
+            raise exc.HTTPBadRequest(explanation=expl)
+        # if the original error is okay, just reraise it
+        raise error
+
     def update(self, req, id):
         """ Updates the server name or password """
         if len(req.body) == 0:
@@ -476,3 +543,79 @@ class Controller(wsgi.Controller):
                 _("Ramdisk not found for image %(image_id)s") % locals())
 
         return kernel_id, ramdisk_id
+
+
+class ServerCreateRequestXMLDeserializer(object):
+    """
+    Deserializer to handle xml-formatted server create requests.
+
+    Handles standard server attributes as well as optional metadata
+    and personality attributes
+    """
+
+    def deserialize(self, string):
+        """Deserialize an xml-formatted server create request"""
+        dom = minidom.parseString(string)
+        server = self._extract_server(dom)
+        return {'server': server}
+
+    def _extract_server(self, node):
+        """Marshal the server attribute of a parsed request"""
+        server = {}
+        server_node = self._find_first_child_named(node, 'server')
+        for attr in ["name", "imageId", "flavorId"]:
+            server[attr] = server_node.getAttribute(attr)
+        metadata = self._extract_metadata(server_node)
+        if metadata is not None:
+            server["metadata"] = metadata
+        personality = self._extract_personality(server_node)
+        if personality is not None:
+            server["personality"] = personality
+        return server
+
+    def _extract_metadata(self, server_node):
+        """Marshal the metadata attribute of a parsed request"""
+        metadata_node = self._find_first_child_named(server_node, "metadata")
+        if metadata_node is None:
+            return None
+        metadata = {}
+        for meta_node in self._find_children_named(metadata_node, "meta"):
+            key = meta_node.getAttribute("key")
+            metadata[key] = self._extract_text(meta_node)
+        return metadata
+
+    def _extract_personality(self, server_node):
+        """Marshal the personality attribute of a parsed request"""
+        personality_node = \
+                self._find_first_child_named(server_node, "personality")
+        if personality_node is None:
+            return None
+        personality = []
+        for file_node in self._find_children_named(personality_node, "file"):
+            item = {}
+            if file_node.hasAttribute("path"):
+                item["path"] = file_node.getAttribute("path")
+            item["contents"] = self._extract_text(file_node)
+            personality.append(item)
+        return personality
+
+    def _find_first_child_named(self, parent, name):
+        """Search a nodes children for the first child with a given name"""
+        for node in parent.childNodes:
+            if node.nodeName == name:
+                return node
+        return None
+
+    def _find_children_named(self, parent, name):
+        """Return all of a nodes children who have the given name"""
+        for node in parent.childNodes:
+            if node.nodeName == name:
+                yield node
+
+    def _extract_text(self, node):
+        """Get the text field contained by the given node"""
+        if len(node.childNodes) == 1:
+            child = node.childNodes[0]
+            if child.nodeType == child.TEXT_NODE:
+                return child.nodeValue
+        return ""
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 61f8b2a6a..32577af82 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -80,13 +80,32 @@ class API(base.Base):
                         topic,
                         {"method": "get_network_topic", "args": {'fake': 1}})
 
+    def _check_injected_file_quota(self, context, injected_files):
+        """
+        Enforce quota limits on injected files
+
+        Raises a QuotaError if any limit is exceeded
+        """
+        if injected_files is None:
+            return
+        limit = quota.allowed_injected_files(context)
+        if len(injected_files) > limit:
+            raise quota.QuotaError(code="OnsetFileLimitExceeded")
+        path_limit = quota.allowed_injected_file_path_bytes(context)
+        content_limit = quota.allowed_injected_file_content_bytes(context)
+        for path, content in injected_files:
+            if len(path) > path_limit:
+                raise quota.QuotaError(code="OnsetFilePathLimitExceeded")
+            if len(content) > content_limit:
+                raise quota.QuotaError(code="OnsetFileContentLimitExceeded")
+
     def create(self, context, instance_type,
                image_id, kernel_id=None, ramdisk_id=None,
                min_count=1, max_count=1,
                display_name='', display_description='',
                key_name=None, key_data=None, security_group='default',
                availability_zone=None, user_data=None, metadata=[],
-               onset_files=None):
+               injected_files=None):
         """Create the number of instances requested if quota and
         other arguments check out ok."""
 
@@ -124,6 +143,8 @@ class API(base.Base):
                 LOG.warn(msg)
                 raise quota.QuotaError(msg, "MetadataLimitExceeded")
 
+        self._check_injected_file_quota(context, injected_files)
+
         image = self.image_service.show(context, image_id)
 
         os_type = None
@@ -225,7 +246,7 @@ class API(base.Base):
                       "args": {"topic": FLAGS.compute_topic,
                                "instance_id": instance_id,
                                "availability_zone": availability_zone,
-                               "onset_files": onset_files}})
+                               "injected_files": injected_files}})
 
         for group_id in security_groups:
             self.trigger_security_group_members_refresh(elevated, group_id)
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index 0cab10fc3..92deca813 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -34,7 +34,6 @@ terminating it.
                   :func:`nova.utils.import_object`
 """
 
-import base64
 import datetime
 import os
 import random
@@ -180,7 +179,7 @@ class ComputeManager(manager.Manager):
         """Launch a new instance with specified options."""
         context = context.elevated()
         instance_ref = self.db.instance_get(context, instance_id)
-        instance_ref.onset_files = kwargs.get('onset_files', [])
+        instance_ref.injected_files = kwargs.get('injected_files', [])
         if instance_ref['name'] in self.driver.list_instances():
             raise exception.Error(_("Instance has already been created"))
         LOG.audit(_("instance %s: starting..."), instance_id,
@@ -359,15 +358,10 @@ class ComputeManager(manager.Manager):
             LOG.warn(_('trying to inject a file into a non-running '
                     'instance: %(instance_id)s (state: %(instance_state)s '
                     'expected: %(expected_state)s)') % locals())
-        # Files/paths *should* be base64-encoded at this point, but
-        # double-check to make sure.
-        b64_path = utils.ensure_b64_encoding(path)
-        b64_contents = utils.ensure_b64_encoding(file_contents)
-        plain_path = base64.b64decode(b64_path)
         nm = instance_ref['name']
-        msg = _('instance %(nm)s: injecting file to %(plain_path)s') % locals()
+        msg = _('instance %(nm)s: injecting file to %(path)s') % locals()
         LOG.audit(msg)
-        self.driver.inject_file(instance_ref, b64_path, b64_contents)
+        self.driver.inject_file(instance_ref, path, file_contents)
 
     @exception.wrap_exception
     @checks_instance_lock
diff --git a/nova/console/manager.py b/nova/console/manager.py
index 57c75cf4f..bfa571ea9 100644
--- a/nova/console/manager.py
+++ b/nova/console/manager.py
@@ -69,7 +69,7 @@ class ConsoleProxyManager(manager.Manager):
         except exception.NotFound:
             logging.debug(_("Adding console"))
             if not password:
-                password = self.driver.generate_password()
+                password = utils.generate_password(8)
             if not port:
                 port = self.driver.get_port(context)
             console_data = {'instance_name': name,
diff --git a/nova/console/xvp.py b/nova/console/xvp.py
index 68d8c8565..0cedfbb13 100644
--- a/nova/console/xvp.py
+++ b/nova/console/xvp.py
@@ -91,10 +91,6 @@ class XVPConsoleProxy(object):
         """Trim password to length, and encode"""
         return self._xvp_encrypt(password)
 
-    def generate_password(self, length=8):
-        """Returns random console password"""
-        return os.urandom(length * 2).encode('base64')[:length]
-
     def _rebuild_xvp_conf(self, context):
         logging.debug(_("Rebuilding xvp conf"))
         pools = [pool for pool in
diff --git a/nova/db/api.py b/nova/db/api.py
index 0aa846d61..3cb0e5811 100644
--- a/nova/db/api.py
+++ b/nova/db/api.py
@@ -353,6 +353,11 @@ def fixed_ip_get_all(context):
     return IMPL.fixed_ip_get_all(context)
 
 
+def fixed_ip_get_all_by_host(context, host):
+    """Get all defined fixed ips used by a host."""
+    return IMPL.fixed_ip_get_all_by_host(context, host)
+
+
 def fixed_ip_get_by_address(context, address):
     """Get a fixed ip by address or raise if it does not exist."""
     return IMPL.fixed_ip_get_by_address(context, address)
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index 56998ce05..44540617f 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -672,6 +672,22 @@ def fixed_ip_get_all(context, session=None):
     return result
 
 
+@require_admin_context
+def fixed_ip_get_all_by_host(context, host=None):
+    session = get_session()
+
+    result = session.query(models.FixedIp).\
+                    join(models.FixedIp.instance).\
+                    filter_by(state=1).\
+                    filter_by(host=host).\
+                    all()
+
+    if not result:
+        raise exception.NotFound(_('No fixed ips for this host defined'))
+
+    return result
+
+
 @require_context
 def fixed_ip_get_by_address(context, address, session=None):
     if not session:
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index 162f6fded..1845e85eb 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -161,7 +161,7 @@ class Certificate(BASE, NovaBase):
 class Instance(BASE, NovaBase):
     """Represents a guest vm."""
     __tablename__ = 'instances'
-    onset_files = []
+    injected_files = []
 
     id = Column(Integer, primary_key=True, autoincrement=True)
 
diff --git a/nova/quota.py b/nova/quota.py
index 6b52a97fa..2b24c0b5b 100644
--- a/nova/quota.py
+++ b/nova/quota.py
@@ -37,6 +37,12 @@ flags.DEFINE_integer('quota_floating_ips', 10,
                      'number of floating ips allowed per project')
 flags.DEFINE_integer('quota_metadata_items', 128,
                      'number of metadata items allowed per instance')
+flags.DEFINE_integer('quota_max_injected_files', 5,
+                     'number of injected files allowed')
+flags.DEFINE_integer('quota_max_injected_file_content_bytes', 10 * 1024,
+                     'number of bytes allowed per injected file')
+flags.DEFINE_integer('quota_max_injected_file_path_bytes', 255,
+                     'number of bytes allowed per injected file path')
 
 
 def get_quota(context, project_id):
@@ -46,6 +52,7 @@ def get_quota(context, project_id):
             'gigabytes': FLAGS.quota_gigabytes,
             'floating_ips': FLAGS.quota_floating_ips,
             'metadata_items': FLAGS.quota_metadata_items}
+
     try:
         quota = db.quota_get(context, project_id)
         for key in rval.keys():
@@ -106,6 +113,21 @@ def allowed_metadata_items(context, num_metadata_items):
     return min(num_metadata_items, num_allowed_metadata_items)
 
 
+def allowed_injected_files(context):
+    """Return the number of injected files allowed"""
+    return FLAGS.quota_max_injected_files
+
+
+def allowed_injected_file_content_bytes(context):
+    """Return the number of bytes allowed per injected file content"""
+    return FLAGS.quota_max_injected_file_content_bytes
+
+
+def allowed_injected_file_path_bytes(context):
+    """Return the number of bytes allowed in an injected file path"""
+    return FLAGS.quota_max_injected_file_path_bytes
+
+
 class QuotaError(exception.ApiError):
     """Quota Exceeeded"""
     pass
diff --git a/nova/tests/api/openstack/fakes.py b/nova/tests/api/openstack/fakes.py
index 7cb974bb2..0bbb1c890 100644
--- a/nova/tests/api/openstack/fakes.py
+++ b/nova/tests/api/openstack/fakes.py
@@ -69,8 +69,6 @@ def fake_auth_init(self, application):
 @webob.dec.wsgify
 def fake_wsgi(self, req):
     req.environ['nova.context'] = context.RequestContext(1, 1)
-    if req.body:
-        req.environ['inst_dict'] = json.loads(req.body)
     return self.application
 
 
@@ -85,10 +83,17 @@ def wsgi_app(inner_application=None):
     return mapper
 
 
-def stub_out_key_pair_funcs(stubs):
+def stub_out_key_pair_funcs(stubs, have_key_pair=True):
     def key_pair(context, user_id):
         return [dict(name='key', public_key='public_key')]
-    stubs.Set(nova.db, 'key_pair_get_all_by_user', key_pair)
+
+    def no_key_pair(context, user_id):
+        return []
+
+    if have_key_pair:
+        stubs.Set(nova.db, 'key_pair_get_all_by_user', key_pair)
+    else:
+        stubs.Set(nova.db, 'key_pair_get_all_by_user', no_key_pair)
 
 
 def stub_out_image_service(stubs):
diff --git a/nova/tests/api/openstack/test_flavors.py b/nova/tests/api/openstack/test_flavors.py
index 8280a505f..30326dc50 100644
--- a/nova/tests/api/openstack/test_flavors.py
+++ b/nova/tests/api/openstack/test_flavors.py
@@ -15,6 +15,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import json
 import stubout
 import webob
 
@@ -50,3 +51,5 @@ class FlavorsTest(test.TestCase):
         req = webob.Request.blank('/v1.0/flavors/1')
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 200)
+        body = json.loads(res.body)
+        self.assertEqual(body['flavor']['id'], 1)
diff --git a/nova/tests/api/openstack/test_servers.py b/nova/tests/api/openstack/test_servers.py
index 5d7a208e9..03e00af2a 100644
--- a/nova/tests/api/openstack/test_servers.py
+++ b/nova/tests/api/openstack/test_servers.py
@@ -15,8 +15,11 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import base64
 import datetime
 import json
+import unittest
+from xml.dom import minidom
 
 import stubout
 import webob
@@ -216,7 +219,8 @@ class ServersTest(test.TestCase):
         servers = json.loads(res.body)['servers']
         self.assertEqual([s['id'] for s in servers], [1, 2])
 
-    def test_create_instance(self):
+    def _test_create_instance_helper(self):
+        """Shared implementation for tests below that create instance"""
         def instance_create(context, inst):
             return {'id': '1', 'display_name': 'server_test'}
 
@@ -271,6 +275,13 @@ class ServersTest(test.TestCase):
 
         self.assertEqual(res.status_int, 200)
 
+    def test_create_instance(self):
+        self._test_create_instance_helper()
+
+    def test_create_instance_no_key_pair(self):
+        fakes.stub_out_key_pair_funcs(self.stubs, have_key_pair=False)
+        self._test_create_instance_helper()
+
     def test_update_no_body(self):
         req = webob.Request.blank('/v1.0/servers/1')
         req.method = 'PUT'
@@ -599,5 +610,529 @@ class ServersTest(test.TestCase):
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 400)
 
+
+class TestServerCreateRequestXMLDeserializer(unittest.TestCase):
+
+    def setUp(self):
+        self.deserializer = servers.ServerCreateRequestXMLDeserializer()
+
+    def test_minimal_request(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1"/>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"server": {
+                "name": "new-server-test",
+                "imageId": "1",
+                "flavorId": "1",
+                }}
+        self.assertEquals(request, expected)
+
+    def test_request_with_empty_metadata(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata/>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"server": {
+                "name": "new-server-test",
+                "imageId": "1",
+                "flavorId": "1",
+                "metadata": {},
+                }}
+        self.assertEquals(request, expected)
+
+    def test_request_with_empty_personality(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <personality/>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"server": {
+                "name": "new-server-test",
+                "imageId": "1",
+                "flavorId": "1",
+                "personality": [],
+                }}
+        self.assertEquals(request, expected)
+
+    def test_request_with_empty_metadata_and_personality(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata/>
+    <personality/>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"server": {
+                "name": "new-server-test",
+                "imageId": "1",
+                "flavorId": "1",
+                "metadata": {},
+                "personality": [],
+                }}
+        self.assertEquals(request, expected)
+
+    def test_request_with_empty_metadata_and_personality_reversed(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <personality/>
+    <metadata/>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"server": {
+                "name": "new-server-test",
+                "imageId": "1",
+                "flavorId": "1",
+                "metadata": {},
+                "personality": [],
+                }}
+        self.assertEquals(request, expected)
+
+    def test_request_with_one_personality(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <personality>
+        <file path="/etc/conf">aabbccdd</file>
+    </personality>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = [{"path": "/etc/conf", "contents": "aabbccdd"}]
+        self.assertEquals(request["server"]["personality"], expected)
+
+    def test_request_with_two_personalities(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+<personality><file path="/etc/conf">aabbccdd</file>
+<file path="/etc/sudoers">abcd</file></personality></server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = [{"path": "/etc/conf", "contents": "aabbccdd"},
+                    {"path": "/etc/sudoers", "contents": "abcd"}]
+        self.assertEquals(request["server"]["personality"], expected)
+
+    def test_request_second_personality_node_ignored(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <personality>
+        <file path="/etc/conf">aabbccdd</file>
+    </personality>
+    <personality>
+        <file path="/etc/ignoreme">anything</file>
+    </personality>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = [{"path": "/etc/conf", "contents": "aabbccdd"}]
+        self.assertEquals(request["server"]["personality"], expected)
+
+    def test_request_with_one_personality_missing_path(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+<personality><file>aabbccdd</file></personality></server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = [{"contents": "aabbccdd"}]
+        self.assertEquals(request["server"]["personality"], expected)
+
+    def test_request_with_one_personality_empty_contents(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+<personality><file path="/etc/conf"></file></personality></server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = [{"path": "/etc/conf", "contents": ""}]
+        self.assertEquals(request["server"]["personality"], expected)
+
+    def test_request_with_one_personality_empty_contents_variation(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+<personality><file path="/etc/conf"/></personality></server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = [{"path": "/etc/conf", "contents": ""}]
+        self.assertEquals(request["server"]["personality"], expected)
+
+    def test_request_with_one_metadata(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta key="alpha">beta</meta>
+    </metadata>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"alpha": "beta"}
+        self.assertEquals(request["server"]["metadata"], expected)
+
+    def test_request_with_two_metadata(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta key="alpha">beta</meta>
+        <meta key="foo">bar</meta>
+    </metadata>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"alpha": "beta", "foo": "bar"}
+        self.assertEquals(request["server"]["metadata"], expected)
+
+    def test_request_with_metadata_missing_value(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta key="alpha"></meta>
+    </metadata>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"alpha": ""}
+        self.assertEquals(request["server"]["metadata"], expected)
+
+    def test_request_with_two_metadata_missing_value(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta key="alpha"/>
+        <meta key="delta"/>
+    </metadata>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"alpha": "", "delta": ""}
+        self.assertEquals(request["server"]["metadata"], expected)
+
+    def test_request_with_metadata_missing_key(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta>beta</meta>
+    </metadata>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"": "beta"}
+        self.assertEquals(request["server"]["metadata"], expected)
+
+    def test_request_with_two_metadata_missing_key(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta>beta</meta>
+        <meta>gamma</meta>
+    </metadata>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"": "gamma"}
+        self.assertEquals(request["server"]["metadata"], expected)
+
+    def test_request_with_metadata_duplicate_key(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta key="foo">bar</meta>
+        <meta key="foo">baz</meta>
+    </metadata>
+</server>"""
+        request = self.deserializer.deserialize(serial_request)
+        expected = {"foo": "baz"}
+        self.assertEquals(request["server"]["metadata"], expected)
+
+    def test_canonical_request_from_docs(self):
+        serial_request = """
+<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"
+ name="new-server-test" imageId="1" flavorId="1">
+    <metadata>
+        <meta key="My Server Name">Apache1</meta>
+    </metadata>
+    <personality>
+        <file path="/etc/banner.txt">\
+ICAgICAgDQoiQSBjbG91ZCBkb2VzIG5vdCBrbm93IHdoeSBp\
+dCBtb3ZlcyBpbiBqdXN0IHN1Y2ggYSBkaXJlY3Rpb24gYW5k\
+IGF0IHN1Y2ggYSBzcGVlZC4uLkl0IGZlZWxzIGFuIGltcHVs\
+c2lvbi4uLnRoaXMgaXMgdGhlIHBsYWNlIHRvIGdvIG5vdy4g\
+QnV0IHRoZSBza3kga25vd3MgdGhlIHJlYXNvbnMgYW5kIHRo\
+ZSBwYXR0ZXJucyBiZWhpbmQgYWxsIGNsb3VkcywgYW5kIHlv\
+dSB3aWxsIGtub3csIHRvbywgd2hlbiB5b3UgbGlmdCB5b3Vy\
+c2VsZiBoaWdoIGVub3VnaCB0byBzZWUgYmV5b25kIGhvcml6\
+b25zLiINCg0KLVJpY2hhcmQgQmFjaA==</file>
+    </personality>
+</server>"""
+        expected = {"server": {
+            "name": "new-server-test",
+            "imageId": "1",
+            "flavorId": "1",
+            "metadata": {
+                "My Server Name": "Apache1",
+            },
+            "personality": [
+                {
+                    "path": "/etc/banner.txt",
+                    "contents": """\
+ICAgICAgDQoiQSBjbG91ZCBkb2VzIG5vdCBrbm93IHdoeSBp\
+dCBtb3ZlcyBpbiBqdXN0IHN1Y2ggYSBkaXJlY3Rpb24gYW5k\
+IGF0IHN1Y2ggYSBzcGVlZC4uLkl0IGZlZWxzIGFuIGltcHVs\
+c2lvbi4uLnRoaXMgaXMgdGhlIHBsYWNlIHRvIGdvIG5vdy4g\
+QnV0IHRoZSBza3kga25vd3MgdGhlIHJlYXNvbnMgYW5kIHRo\
+ZSBwYXR0ZXJucyBiZWhpbmQgYWxsIGNsb3VkcywgYW5kIHlv\
+dSB3aWxsIGtub3csIHRvbywgd2hlbiB5b3UgbGlmdCB5b3Vy\
+c2VsZiBoaWdoIGVub3VnaCB0byBzZWUgYmV5b25kIGhvcml6\
+b25zLiINCg0KLVJpY2hhcmQgQmFjaA==""",
+                },
+            ],
+        }}
+        request = self.deserializer.deserialize(serial_request)
+        self.assertEqual(request, expected)
+
+
+class TestServerInstanceCreation(test.TestCase):
+
+    def setUp(self):
+        super(TestServerInstanceCreation, self).setUp()
+        self.stubs = stubout.StubOutForTesting()
+        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthDatabase.data = {}
+        fakes.stub_out_auth(self.stubs)
+        fakes.stub_out_key_pair_funcs(self.stubs)
+        self.allow_admin = FLAGS.allow_admin_api
+
+    def tearDown(self):
+        self.stubs.UnsetAll()
+        FLAGS.allow_admin_api = self.allow_admin
+        super(TestServerInstanceCreation, self).tearDown()
+
+    def _setup_mock_compute_api_for_personality(self):
+
+        class MockComputeAPI(object):
+
+            def __init__(self):
+                self.injected_files = None
+
+            def create(self, *args, **kwargs):
+                if 'injected_files' in kwargs:
+                    self.injected_files = kwargs['injected_files']
+                else:
+                    self.injected_files = None
+                return [{'id': '1234', 'display_name': 'fakeinstance'}]
+
+            def set_admin_password(self, *args, **kwargs):
+                pass
+
+        def make_stub_method(canned_return):
+            def stub_method(*args, **kwargs):
+                return canned_return
+            return stub_method
+
+        compute_api = MockComputeAPI()
+        self.stubs.Set(nova.compute, 'API', make_stub_method(compute_api))
+        self.stubs.Set(nova.api.openstack.servers.Controller,
+            '_get_kernel_ramdisk_from_image', make_stub_method((1, 1)))
+        self.stubs.Set(nova.api.openstack.common,
+            'get_image_id_from_image_hash', make_stub_method(2))
+        return compute_api
+
+    def _create_personality_request_dict(self, personality_files):
+        server = {}
+        server['name'] = 'new-server-test'
+        server['imageId'] = 1
+        server['flavorId'] = 1
+        if personality_files is not None:
+            personalities = []
+            for path, contents in personality_files:
+                personalities.append({'path': path, 'contents': contents})
+            server['personality'] = personalities
+        return {'server': server}
+
+    def _get_create_request_json(self, body_dict):
+        req = webob.Request.blank('/v1.0/servers')
+        req.content_type = 'application/json'
+        req.method = 'POST'
+        req.body = json.dumps(body_dict)
+        return req
+
+    def _run_create_instance_with_mock_compute_api(self, request):
+        compute_api = self._setup_mock_compute_api_for_personality()
+        response = request.get_response(fakes.wsgi_app())
+        return compute_api, response
+
+    def _format_xml_request_body(self, body_dict):
+        server = body_dict['server']
+        body_parts = []
+        body_parts.extend([
+            '<?xml version="1.0" encoding="UTF-8"?>',
+            '<server xmlns="http://docs.rackspacecloud.com/servers/api/v1.0"',
+            ' name="%s" imageId="%s" flavorId="%s">' % (
+                    server['name'], server['imageId'], server['flavorId'])])
+        if 'metadata' in server:
+            metadata = server['metadata']
+            body_parts.append('<metadata>')
+            for item in metadata.iteritems():
+                body_parts.append('<meta key="%s">%s</meta>' % item)
+            body_parts.append('</metadata>')
+        if 'personality' in server:
+            personalities = server['personality']
+            body_parts.append('<personality>')
+            for file in personalities:
+                item = (file['path'], file['contents'])
+                body_parts.append('<file path="%s">%s</file>' % item)
+            body_parts.append('</personality>')
+        body_parts.append('</server>')
+        return ''.join(body_parts)
+
+    def _get_create_request_xml(self, body_dict):
+        req = webob.Request.blank('/v1.0/servers')
+        req.content_type = 'application/xml'
+        req.accept = 'application/xml'
+        req.method = 'POST'
+        req.body = self._format_xml_request_body(body_dict)
+        return req
+
+    def _create_instance_with_personality_json(self, personality):
+        body_dict = self._create_personality_request_dict(personality)
+        request = self._get_create_request_json(body_dict)
+        compute_api, response = \
+            self._run_create_instance_with_mock_compute_api(request)
+        return request, response, compute_api.injected_files
+
+    def _create_instance_with_personality_xml(self, personality):
+        body_dict = self._create_personality_request_dict(personality)
+        request = self._get_create_request_xml(body_dict)
+        compute_api, response = \
+            self._run_create_instance_with_mock_compute_api(request)
+        return request, response, compute_api.injected_files
+
+    def test_create_instance_with_no_personality(self):
+        request, response, injected_files = \
+                self._create_instance_with_personality_json(personality=None)
+        self.assertEquals(response.status_int, 200)
+        self.assertEquals(injected_files, [])
+
+    def test_create_instance_with_no_personality_xml(self):
+        request, response, injected_files = \
+                self._create_instance_with_personality_xml(personality=None)
+        self.assertEquals(response.status_int, 200)
+        self.assertEquals(injected_files, [])
+
+    def test_create_instance_with_personality(self):
+        path = '/my/file/path'
+        contents = '#!/bin/bash\necho "Hello, World!"\n'
+        b64contents = base64.b64encode(contents)
+        personality = [(path, b64contents)]
+        request, response, injected_files = \
+            self._create_instance_with_personality_json(personality)
+        self.assertEquals(response.status_int, 200)
+        self.assertEquals(injected_files, [(path, contents)])
+
+    def test_create_instance_with_personality_xml(self):
+        path = '/my/file/path'
+        contents = '#!/bin/bash\necho "Hello, World!"\n'
+        b64contents = base64.b64encode(contents)
+        personality = [(path, b64contents)]
+        request, response, injected_files = \
+            self._create_instance_with_personality_xml(personality)
+        self.assertEquals(response.status_int, 200)
+        self.assertEquals(injected_files, [(path, contents)])
+
+    def test_create_instance_with_personality_no_path(self):
+        personality = [('/remove/this/path',
+            base64.b64encode('my\n\file\ncontents'))]
+        body_dict = self._create_personality_request_dict(personality)
+        del body_dict['server']['personality'][0]['path']
+        request = self._get_create_request_json(body_dict)
+        compute_api, response = \
+            self._run_create_instance_with_mock_compute_api(request)
+        self.assertEquals(response.status_int, 400)
+        self.assertEquals(compute_api.injected_files, None)
+
+    def _test_create_instance_with_personality_no_path_xml(self):
+        personality = [('/remove/this/path',
+            base64.b64encode('my\n\file\ncontents'))]
+        body_dict = self._create_personality_request_dict(personality)
+        request = self._get_create_request_xml(body_dict)
+        request.body = request.body.replace(' path="/remove/this/path"', '')
+        compute_api, response = \
+            self._run_create_instance_with_mock_compute_api(request)
+        self.assertEquals(response.status_int, 400)
+        self.assertEquals(compute_api.injected_files, None)
+
+    def test_create_instance_with_personality_no_contents(self):
+        personality = [('/test/path',
+            base64.b64encode('remove\nthese\ncontents'))]
+        body_dict = self._create_personality_request_dict(personality)
+        del body_dict['server']['personality'][0]['contents']
+        request = self._get_create_request_json(body_dict)
+        compute_api, response = \
+            self._run_create_instance_with_mock_compute_api(request)
+        self.assertEquals(response.status_int, 400)
+        self.assertEquals(compute_api.injected_files, None)
+
+    def test_create_instance_with_personality_not_a_list(self):
+        personality = [('/test/path', base64.b64encode('test\ncontents\n'))]
+        body_dict = self._create_personality_request_dict(personality)
+        body_dict['server']['personality'] = \
+            body_dict['server']['personality'][0]
+        request = self._get_create_request_json(body_dict)
+        compute_api, response = \
+            self._run_create_instance_with_mock_compute_api(request)
+        self.assertEquals(response.status_int, 400)
+        self.assertEquals(compute_api.injected_files, None)
+
+    def test_create_instance_with_personality_with_non_b64_content(self):
+        path = '/my/file/path'
+        contents = '#!/bin/bash\necho "Oh no!"\n'
+        personality = [(path, contents)]
+        request, response, injected_files = \
+            self._create_instance_with_personality_json(personality)
+        self.assertEquals(response.status_int, 400)
+        self.assertEquals(injected_files, None)
+
+    def test_create_instance_with_three_personalities(self):
+        files = [
+            ('/etc/sudoers', 'ALL ALL=NOPASSWD: ALL\n'),
+            ('/etc/motd', 'Enjoy your root access!\n'),
+            ('/etc/dovecot.conf', 'dovecot\nconfig\nstuff\n'),
+            ]
+        personality = []
+        for path, content in files:
+            personality.append((path, base64.b64encode(content)))
+        request, response, injected_files = \
+            self._create_instance_with_personality_json(personality)
+        self.assertEquals(response.status_int, 200)
+        self.assertEquals(injected_files, files)
+
+    def test_create_instance_personality_empty_content(self):
+        path = '/my/file/path'
+        contents = ''
+        personality = [(path, contents)]
+        request, response, injected_files = \
+            self._create_instance_with_personality_json(personality)
+        self.assertEquals(response.status_int, 200)
+        self.assertEquals(injected_files, [(path, contents)])
+
+    def test_create_instance_admin_pass_json(self):
+        request, response, dummy = \
+            self._create_instance_with_personality_json(None)
+        self.assertEquals(response.status_int, 200)
+        response = json.loads(response.body)
+        self.assertTrue('adminPass' in response['server'])
+        self.assertTrue(response['server']['adminPass'].startswith('fake'))
+
+    def test_create_instance_admin_pass_xml(self):
+        request, response, dummy = \
+            self._create_instance_with_personality_xml(None)
+        self.assertEquals(response.status_int, 200)
+        dom = minidom.parseString(response.body)
+        server = dom.childNodes[0]
+        self.assertEquals(server.nodeName, 'server')
+        self.assertTrue(server.getAttribute('adminPass').startswith('fake'))
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/nova/tests/test_quota.py b/nova/tests/test_quota.py
index 45b544753..c65bc459d 100644
--- a/nova/tests/test_quota.py
+++ b/nova/tests/test_quota.py
@@ -33,6 +33,12 @@ FLAGS = flags.FLAGS
 
 
 class QuotaTestCase(test.TestCase):
+
+    class StubImageService(object):
+
+        def show(self, *args, **kwargs):
+            return {"properties": {}}
+
     def setUp(self):
         super(QuotaTestCase, self).setUp()
         self.flags(connection_type='fake',
@@ -193,3 +199,67 @@ class QuotaTestCase(test.TestCase):
                                             instance_type='m1.small',
                                             image_id='fake',
                                             metadata=metadata)
+
+    def test_allowed_injected_files(self):
+        self.assertEqual(
+                quota.allowed_injected_files(self.context),
+                FLAGS.quota_max_injected_files)
+
+    def _create_with_injected_files(self, files):
+        api = compute.API(image_service=self.StubImageService())
+        api.create(self.context, min_count=1, max_count=1,
+                instance_type='m1.small', image_id='fake',
+                injected_files=files)
+
+    def test_no_injected_files(self):
+        api = compute.API(image_service=self.StubImageService())
+        api.create(self.context, instance_type='m1.small', image_id='fake')
+
+    def test_max_injected_files(self):
+        files = []
+        for i in xrange(FLAGS.quota_max_injected_files):
+            files.append(('/my/path%d' % i, 'config = test\n'))
+        self._create_with_injected_files(files)  # no QuotaError
+
+    def test_too_many_injected_files(self):
+        files = []
+        for i in xrange(FLAGS.quota_max_injected_files + 1):
+            files.append(('/my/path%d' % i, 'my\ncontent%d\n' % i))
+        self.assertRaises(quota.QuotaError,
+                          self._create_with_injected_files, files)
+
+    def test_allowed_injected_file_content_bytes(self):
+        self.assertEqual(
+                quota.allowed_injected_file_content_bytes(self.context),
+                FLAGS.quota_max_injected_file_content_bytes)
+
+    def test_max_injected_file_content_bytes(self):
+        max = FLAGS.quota_max_injected_file_content_bytes
+        content = ''.join(['a' for i in xrange(max)])
+        files = [('/test/path', content)]
+        self._create_with_injected_files(files)  # no QuotaError
+
+    def test_too_many_injected_file_content_bytes(self):
+        max = FLAGS.quota_max_injected_file_content_bytes
+        content = ''.join(['a' for i in xrange(max + 1)])
+        files = [('/test/path', content)]
+        self.assertRaises(quota.QuotaError,
+                          self._create_with_injected_files, files)
+
+    def test_allowed_injected_file_path_bytes(self):
+        self.assertEqual(
+                quota.allowed_injected_file_path_bytes(self.context),
+                FLAGS.quota_max_injected_file_path_bytes)
+
+    def test_max_injected_file_path_bytes(self):
+        max = FLAGS.quota_max_injected_file_path_bytes
+        path = ''.join(['a' for i in xrange(max)])
+        files = [(path, 'config = quotatest')]
+        self._create_with_injected_files(files)  # no QuotaError
+
+    def test_too_many_injected_file_path_bytes(self):
+        max = FLAGS.quota_max_injected_file_path_bytes
+        path = ''.join(['a' for i in xrange(max + 1)])
+        files = [(path, 'config = quotatest')]
+        self.assertRaises(quota.QuotaError,
+                          self._create_with_injected_files, files)
diff --git a/nova/utils.py b/nova/utils.py
index 87e726394..24b8da9ea 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -262,13 +262,25 @@ def generate_mac():
     return ':'.join(map(lambda x: "%02x" % x, mac))
 
 
-def generate_password(length=20):
-    """Generate a random sequence of letters and digits
-    to be used as a password. Note that this is not intended
-    to represent the ultimate in security.
+# Default symbols to use for passwords. Avoids visually confusing characters.
+# ~6 bits per symbol
+DEFAULT_PASSWORD_SYMBOLS = ("23456789"  # Removed: 0,1
+                            "ABCDEFGHJKLMNPQRSTUVWXYZ"  # Removed: I, O
+                            "abcdefghijkmnopqrstuvwxyz")  # Removed: l
+
+
+# ~5 bits per symbol
+EASIER_PASSWORD_SYMBOLS = ("23456789"  # Removed: 0, 1
+                           "ABCDEFGHJKLMNPQRSTUVWXYZ")  # Removed: I, O
+
+
+def generate_password(length=20, symbols=DEFAULT_PASSWORD_SYMBOLS):
+    """Generate a random password from the supplied symbols.
+
+    Believed to be reasonably secure (with a reasonable password length!)
     """
-    chrs = string.letters + string.digits
-    return "".join([random.choice(chrs) for i in xrange(length)])
+    r = random.SystemRandom()
+    return "".join([r.choice(symbols) for _i in xrange(length)])
 
 
 def last_octet(address):
@@ -518,6 +530,9 @@ def synchronized(name):
     def wrap(f):
         @functools.wraps(f)
         def inner(*args, **kwargs):
+            LOG.debug(_("Attempting to grab %(lock)s for method "
+                        "%(method)s..." % {"lock": name,
+                                           "method": f.__name__}))
             lock = lockfile.FileLock(os.path.join(FLAGS.lock_path,
                                                   'nova-%s.lock' % name))
             with lock:
@@ -526,18 +541,6 @@ def synchronized(name):
     return wrap
 
 
-def ensure_b64_encoding(val):
-    """Safety method to ensure that values expected to be base64-encoded
-    actually are. If they are, the value is returned unchanged. Otherwise,
-    the encoded value is returned.
-    """
-    try:
-        dummy = base64.decode(val)
-        return val
-    except TypeError:
-        return base64.b64encode(val)
-
-
 def get_from_path(items, path):
     """ Returns a list of items matching the specified path.  Takes an
     XPath-like expression e.g. prop1/prop2/prop3, and for each item in items,
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 7994e9547..0a85da541 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -502,7 +502,7 @@ class LibvirtConnection(object):
                 cmd = 'netcat', '0.0.0.0', port, '-w', '1'
                 try:
                     stdout, stderr = utils.execute(*cmd, process_input='')
-                except ProcessExecutionError:
+                except exception.ProcessExecutionError:
                     return port
             raise Exception(_('Unable to find an open port'))
 
@@ -984,32 +984,33 @@ class LibvirtConnection(object):
 
         xml = self._conn.getCapabilities()
         xml = libxml2.parseDoc(xml)
-        nodes = xml.xpathEval('//cpu')
+        nodes = xml.xpathEval('//host/cpu')
         if len(nodes) != 1:
             raise exception.Invalid(_("Invalid xml. '<cpu>' must be 1,"
                                       "but %d\n") % len(nodes)
                                       + xml.serialize())
 
         cpu_info = dict()
-        cpu_info['arch'] = xml.xpathEval('//cpu/arch')[0].getContent()
-        cpu_info['model'] = xml.xpathEval('//cpu/model')[0].getContent()
-        cpu_info['vendor'] = xml.xpathEval('//cpu/vendor')[0].getContent()
+        cpu_info['arch'] = xml.xpathEval('//host/cpu/arch')[0].getContent()
+        cpu_info['model'] = xml.xpathEval('//host/cpu/model')[0].getContent()
+        cpu_info['vendor'] = xml.xpathEval('//host/cpu/vendor')[0].getContent()
 
-        topology_node = xml.xpathEval('//cpu/topology')[0].get_properties()
+        topology_node = xml.xpathEval('//host/cpu/topology')[0]\
+                        .get_properties()
         topology = dict()
-        while topology_node != None:
+        while topology_node:
             name = topology_node.get_name()
             topology[name] = topology_node.getContent()
             topology_node = topology_node.get_next()
 
         keys = ['cores', 'sockets', 'threads']
         tkeys = topology.keys()
-        if list(set(tkeys)) != list(set(keys)):
+        if set(tkeys) != set(keys):
             ks = ', '.join(keys)
             raise exception.Invalid(_("Invalid xml: topology(%(topology)s) "
                                       "must have %(ks)s") % locals())
 
-        feature_nodes = xml.xpathEval('//cpu/feature')
+        feature_nodes = xml.xpathEval('//host/cpu/feature')
         features = list()
         for nodes in feature_nodes:
             features.append(nodes.get_properties().getContent())
@@ -1597,6 +1598,8 @@ class IptablesFirewallDriver(FirewallDriver):
 
         self.iptables.ipv4['filter'].add_chain('sg-fallback')
         self.iptables.ipv4['filter'].add_rule('sg-fallback', '-j DROP')
+        self.iptables.ipv6['filter'].add_chain('sg-fallback')
+        self.iptables.ipv6['filter'].add_rule('sg-fallback', '-j DROP')
 
     def setup_basic_filtering(self, instance):
         """Use NWFilter from libvirt for this."""
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index fcb290d03..488a61e8e 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -19,6 +19,7 @@
 Management class for VM-related functions (spawn, reboot, etc).
 """
 
+import base64
 import json
 import M2Crypto
 import os
@@ -136,19 +137,20 @@ class VMOps(object):
         LOG.info(_('Spawning VM %(instance_name)s created %(vm_ref)s.')
                  % locals())
 
-        def _inject_onset_files():
-            onset_files = instance.onset_files
-            if onset_files:
+        def _inject_files():
+            injected_files = instance.injected_files
+            if injected_files:
                 # Check if this is a JSON-encoded string and convert if needed.
-                if isinstance(onset_files, basestring):
+                if isinstance(injected_files, basestring):
                     try:
-                        onset_files = json.loads(onset_files)
+                        injected_files = json.loads(injected_files)
                     except ValueError:
-                        LOG.exception(_("Invalid value for onset_files: '%s'")
-                                % onset_files)
-                        onset_files = []
+                        LOG.exception(
+                            _("Invalid value for injected_files: '%s'")
+                                % injected_files)
+                        injected_files = []
                 # Inject any files, if specified
-                for path, contents in instance.onset_files:
+                for path, contents in instance.injected_files:
                     LOG.debug(_("Injecting file path: '%s'") % path)
                     self.inject_file(instance, path, contents)
         # NOTE(armando): Do we really need to do this in virt?
@@ -164,7 +166,7 @@ class VMOps(object):
                 if state == power_state.RUNNING:
                     LOG.debug(_('Instance %s: booted'), instance_name)
                     timer.stop()
-                    _inject_onset_files()
+                    _inject_files()
                     return True
             except Exception, exc:
                 LOG.warn(exc)
@@ -408,17 +410,16 @@ class VMOps(object):
             raise RuntimeError(resp_dict['message'])
         return resp_dict['message']
 
-    def inject_file(self, instance, b64_path, b64_contents):
+    def inject_file(self, instance, path, contents):
         """Write a file to the VM instance. The path to which it is to be
-        written and the contents of the file need to be supplied; both should
+        written and the contents of the file need to be supplied; both will
         be base64-encoded to prevent errors with non-ASCII characters being
         transmitted. If the agent does not support file injection, or the user
         has disabled it, a NotImplementedError will be raised.
         """
-        # Files/paths *should* be base64-encoded at this point, but
-        # double-check to make sure.
-        b64_path = utils.ensure_b64_encoding(b64_path)
-        b64_contents = utils.ensure_b64_encoding(b64_contents)
+        # Files/paths must be base64-encoded for transmission to agent
+        b64_path = base64.b64encode(path)
+        b64_contents = base64.b64encode(contents)
 
         # Need to uniquely identify this request.
         transaction_id = str(uuid.uuid4())