Merge from trunk

7 files changed, 392 insertions, 33 deletions

diff --git a/nova/tests/api_unittest.py b/nova/tests/api_unittest.py
index c040cdad3..7ab27e000 100644
--- a/nova/tests/api_unittest.py
+++ b/nova/tests/api_unittest.py
@@ -91,6 +91,9 @@ class ApiEc2TestCase(test.BaseTestCase):
         self.host = '127.0.0.1'
 
         self.app = api.API()
+
+    def expect_http(self, host=None, is_secure=False):
+        """Returns a new EC2 connection"""
         self.ec2 = boto.connect_ec2(
                 aws_access_key_id='fake',
                 aws_secret_access_key='fake',
@@ -100,9 +103,6 @@ class ApiEc2TestCase(test.BaseTestCase):
                 path='/services/Cloud')
 
         self.mox.StubOutWithMock(self.ec2, 'new_http_connection')
-
-    def expect_http(self, host=None, is_secure=False):
-        """Returns a new EC2 connection"""
         http = FakeHttplibConnection(
                 self.app, '%s:8773' % (self.host), False)
         # pylint: disable-msg=E1103
@@ -138,3 +138,185 @@ class ApiEc2TestCase(test.BaseTestCase):
         self.assertEquals(len(results), 1)
         self.manager.delete_project(project)
         self.manager.delete_user(user)
+
+    def test_get_all_security_groups(self):
+        """Test that we can retrieve security groups"""
+        self.expect_http()
+        self.mox.ReplayAll()
+        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
+        project = self.manager.create_project('fake', 'fake', 'fake')
+
+        rv = self.ec2.get_all_security_groups()
+
+        self.assertEquals(len(rv), 1)
+        self.assertEquals(rv[0].name, 'default')
+
+        self.manager.delete_project(project)
+        self.manager.delete_user(user)
+
+    def test_create_delete_security_group(self):
+        """Test that we can create a security group"""
+        self.expect_http()
+        self.mox.ReplayAll()
+        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
+        project = self.manager.create_project('fake', 'fake', 'fake')
+
+        # At the moment, you need both of these to actually be netadmin
+        self.manager.add_role('fake', 'netadmin')
+        project.add_role('fake', 'netadmin')
+
+        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
+                                      for x in range(random.randint(4, 8)))
+
+        self.ec2.create_security_group(security_group_name, 'test group')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        rv = self.ec2.get_all_security_groups()
+        self.assertEquals(len(rv), 2)
+        self.assertTrue(security_group_name in [group.name for group in rv])
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        self.ec2.delete_security_group(security_group_name)
+
+        self.manager.delete_project(project)
+        self.manager.delete_user(user)
+
+    def test_authorize_revoke_security_group_cidr(self):
+        """
+        Test that we can add and remove CIDR based rules
+        to a security group
+        """
+        self.expect_http()
+        self.mox.ReplayAll()
+        user = self.manager.create_user('fake', 'fake', 'fake')
+        project = self.manager.create_project('fake', 'fake', 'fake')
+
+        # At the moment, you need both of these to actually be netadmin
+        self.manager.add_role('fake', 'netadmin')
+        project.add_role('fake', 'netadmin')
+
+        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
+                                      for x in range(random.randint(4, 8)))
+
+        group = self.ec2.create_security_group(security_group_name, 'test group')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+        group.connection = self.ec2
+
+        group.authorize('tcp', 80, 81, '0.0.0.0/0')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        rv = self.ec2.get_all_security_groups()
+        # I don't bother checkng that we actually find it here,
+        # because the create/delete unit test further up should
+        # be good enough for that.
+        for group in rv:
+            if group.name == security_group_name:
+                self.assertEquals(len(group.rules), 1)
+                self.assertEquals(int(group.rules[0].from_port), 80)
+                self.assertEquals(int(group.rules[0].to_port), 81)
+                self.assertEquals(len(group.rules[0].grants), 1)
+                self.assertEquals(str(group.rules[0].grants[0]),  '0.0.0.0/0')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+        group.connection = self.ec2
+
+        group.revoke('tcp', 80, 81, '0.0.0.0/0')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        self.ec2.delete_security_group(security_group_name)
+
+        self.expect_http()
+        self.mox.ReplayAll()
+        group.connection = self.ec2
+
+        rv = self.ec2.get_all_security_groups()
+
+        self.assertEqual(len(rv), 1)
+        self.assertEqual(rv[0].name, 'default')
+
+        self.manager.delete_project(project)
+        self.manager.delete_user(user)
+
+        return
+
+    def test_authorize_revoke_security_group_foreign_group(self):
+        """
+        Test that we can grant and revoke another security group access
+        to a security group
+        """
+        self.expect_http()
+        self.mox.ReplayAll()
+        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
+        project = self.manager.create_project('fake', 'fake', 'fake')
+
+        # At the moment, you need both of these to actually be netadmin
+        self.manager.add_role('fake', 'netadmin')
+        project.add_role('fake', 'netadmin')
+
+        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
+                                      for x in range(random.randint(4, 8)))
+        other_security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
+                                          for x in range(random.randint(4, 8)))
+
+        group = self.ec2.create_security_group(security_group_name, 'test group')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        other_group = self.ec2.create_security_group(other_security_group_name,
+                                                     'some other group')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+        group.connection = self.ec2
+
+        group.authorize(src_group=other_group)
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        rv = self.ec2.get_all_security_groups()
+
+        # I don't bother checkng that we actually find it here,
+        # because the create/delete unit test further up should
+        # be good enough for that.
+        for group in rv:
+            if group.name == security_group_name:
+                self.assertEquals(len(group.rules), 1)
+                self.assertEquals(len(group.rules[0].grants), 1)
+                self.assertEquals(str(group.rules[0].grants[0]),
+                                  '%s-%s' % (other_security_group_name, 'fake'))
+
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        rv = self.ec2.get_all_security_groups()
+
+        for group in rv:
+            if group.name == security_group_name:
+                self.expect_http()
+                self.mox.ReplayAll()
+                group.connection = self.ec2
+                group.revoke(src_group=other_group)
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        self.ec2.delete_security_group(security_group_name)
+
+        self.manager.delete_project(project)
+        self.manager.delete_user(user)
+
+        return
diff --git a/nova/tests/cloud_unittest.py b/nova/tests/cloud_unittest.py
index 8e5881edb..ff466135d 100644
--- a/nova/tests/cloud_unittest.py
+++ b/nova/tests/cloud_unittest.py
@@ -64,18 +64,17 @@ class CloudTestCase(test.TrialTestCase):
         self.cloud = cloud.CloudController()
 
         # set up a service
-        self.compute = utils.import_class(FLAGS.compute_manager)()
+        self.compute = utils.import_object(FLAGS.compute_manager)
         self.compute_consumer = rpc.AdapterConsumer(connection=self.conn,
                                                     topic=FLAGS.compute_topic,
                                                     proxy=self.compute)
         self.compute_consumer.attach_to_eventlet()
-        self.network = utils.import_class(FLAGS.network_manager)()
+        self.network = utils.import_object(FLAGS.network_manager)
         self.network_consumer = rpc.AdapterConsumer(connection=self.conn,
                                                     topic=FLAGS.network_topic,
                                                     proxy=self.network)
         self.network_consumer.attach_to_eventlet()
 
-
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('proj', 'admin', 'proj')
diff --git a/nova/tests/compute_unittest.py b/nova/tests/compute_unittest.py
index 1e2bb113b..5a7f170f3 100644
--- a/nova/tests/compute_unittest.py
+++ b/nova/tests/compute_unittest.py
@@ -40,7 +40,8 @@ class ComputeTestCase(test.TrialTestCase):
     def setUp(self):  # pylint: disable-msg=C0103
         logging.getLogger().setLevel(logging.DEBUG)
         super(ComputeTestCase, self).setUp()
-        self.flags(connection_type='fake')
+        self.flags(connection_type='fake',
+                   network_manager='nova.network.manager.FlatManager')
         self.compute = utils.import_object(FLAGS.compute_manager)
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('fake', 'fake', 'fake')
diff --git a/nova/tests/network_unittest.py b/nova/tests/network_unittest.py
index 59b0a36e4..3afb4d19e 100644
--- a/nova/tests/network_unittest.py
+++ b/nova/tests/network_unittest.py
@@ -52,13 +52,14 @@ class NetworkTestCase(test.TrialTestCase):
         self.context = context.APIRequestContext(project=None, user=self.user)
         for i in range(5):
             name = 'project%s' % i
-            self.projects.append(self.manager.create_project(name,
-                                                             'netuser',
-                                                             name))
+            project = self.manager.create_project(name, 'netuser', name)
+            self.projects.append(project)
             # create the necessary network data for the project
-            user_context = context.get_admin_context(user=self.user)
-
-            self.network.set_network_host(user_context, self.projects[i].id)
+            user_context = context.APIRequestContext(project=self.projects[i],
+                                                     user=self.user)
+            network_ref = self.network.get_network(user_context)
+            self.network.set_network_host(context.get_admin_context(),
+                                          network_ref['id'])
         instance_ref = self._create_instance(0)
         self.instance_id = instance_ref['id']
         instance_ref = self._create_instance(1)
@@ -99,7 +100,7 @@ class NetworkTestCase(test.TrialTestCase):
         """Makes sure that we can allocaate a public ip"""
         # TODO(vish): better way of adding floating ips
         self.context.project = self.projects[0]
-        pubnet = IPy.IP(flags.FLAGS.public_range)
+        pubnet = IPy.IP(flags.FLAGS.floating_range)
         address = str(pubnet[0])
         try:
             db.floating_ip_get_by_address(None, address)
@@ -109,6 +110,7 @@ class NetworkTestCase(test.TrialTestCase):
         float_addr = self.network.allocate_floating_ip(self.context,
                                                        self.projects[0].id)
         fix_addr = self._create_address(0)
+        lease_ip(fix_addr)
         self.assertEqual(float_addr, str(pubnet[0]))
         self.network.associate_floating_ip(self.context, float_addr, fix_addr)
         address = db.instance_get_floating_address(None, self.instance_id)
@@ -118,6 +120,7 @@ class NetworkTestCase(test.TrialTestCase):
         self.assertEqual(address, None)
         self.network.deallocate_floating_ip(self.context, float_addr)
         self.network.deallocate_fixed_ip(self.context, fix_addr)
+        release_ip(fix_addr)
 
     def test_allocate_deallocate_fixed_ip(self):
         """Makes sure that we can allocate and deallocate a fixed ip"""
@@ -190,8 +193,10 @@ class NetworkTestCase(test.TrialTestCase):
             release_ip(address3)
         for instance_id in instance_ids:
             db.instance_destroy(None, instance_id)
-        release_ip(first)
+        self.context.project = self.projects[0]
+        self.network.deallocate_fixed_ip(self.context, first)
         self._deallocate_address(0, first)
+        release_ip(first)
 
     def test_vpn_ip_and_port_looks_valid(self):
         """Ensure the vpn ip and port are reasonable"""
@@ -207,10 +212,13 @@ class NetworkTestCase(test.TrialTestCase):
         for i in range(networks_left):
             project = self.manager.create_project('many%s' % i, self.user)
             projects.append(project)
+            db.project_get_network(None, project.id)
+        project = self.manager.create_project('last', self.user)
+        projects.append(project)
         self.assertRaises(db.NoMoreNetworks,
-                          self.manager.create_project,
-                          'boom',
-                          self.user)
+                          db.project_get_network,
+                          None,
+                          project.id)
         for project in projects:
             self.manager.delete_project(project)
 
@@ -223,7 +231,9 @@ class NetworkTestCase(test.TrialTestCase):
 
         address2 = self._create_address(0)
         self.assertEqual(address, address2)
+        lease_ip(address)
         self.network.deallocate_fixed_ip(self.context, address2)
+        release_ip(address)
 
     def test_available_ips(self):
         """Make sure the number of available ips for the network is correct
diff --git a/nova/tests/objectstore_unittest.py b/nova/tests/objectstore_unittest.py
index eb2ee0406..872f1ab23 100644
--- a/nova/tests/objectstore_unittest.py
+++ b/nova/tests/objectstore_unittest.py
@@ -210,7 +210,7 @@ class S3APITestCase(test.TrialTestCase):
         """Setup users, projects, and start a test server."""
         super(S3APITestCase, self).setUp()
 
-        FLAGS.auth_driver = 'nova.auth.ldapdriver.FakeLdapDriver',
+        FLAGS.auth_driver = 'nova.auth.ldapdriver.FakeLdapDriver'
         FLAGS.buckets_path = os.path.join(OSS_TEMPDIR, 'buckets')
 
         self.auth_manager = manager.AuthManager()
diff --git a/nova/tests/scheduler_unittest.py b/nova/tests/scheduler_unittest.py
index 53a8be144..80100fc2f 100644
--- a/nova/tests/scheduler_unittest.py
+++ b/nova/tests/scheduler_unittest.py
@@ -75,6 +75,7 @@ class SimpleDriverTestCase(test.TrialTestCase):
         self.flags(connection_type='fake',
                    max_cores=4,
                    max_gigabytes=4,
+                   network_manager='nova.network.manager.FlatManager',
                    volume_driver='nova.volume.driver.FakeAOEDriver',
                    scheduler_driver='nova.scheduler.simple.SimpleScheduler')
         self.scheduler = manager.SchedulerManager()
diff --git a/nova/tests/virt_unittest.py b/nova/tests/virt_unittest.py
index 730928f39..edcdba425 100644
--- a/nova/tests/virt_unittest.py
+++ b/nova/tests/virt_unittest.py
@@ -14,53 +14,78 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from xml.etree.ElementTree import fromstring as parseXml
+from xml.etree.ElementTree import fromstring as xml_to_tree
+from xml.dom.minidom import parseString as xml_to_dom
 
+from nova import db
 from nova import flags
 from nova import test
+from nova import utils
+from nova.api import context
+from nova.api.ec2 import cloud
 from nova.auth import manager
-# Needed to get FLAGS.instances_path defined:
-from nova.compute import manager as compute_manager
 from nova.virt import libvirt_conn
 
 FLAGS = flags.FLAGS
+flags.DECLARE('instances_path', 'nova.compute.manager')
 
 class LibvirtConnTestCase(test.TrialTestCase):
     def setUp(self):
+        super(LibvirtConnTestCase, self).setUp()
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
         self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.network = utils.import_object(FLAGS.network_manager)
         FLAGS.instances_path = ''
 
     def test_get_uri_and_template(self):
-        instance = { 'name'           : 'i-cafebabe',
-                     'id'             : 'i-cafebabe',
+        ip = '10.11.12.13'
+
+        instance = { 'internal_id'    : 1,
                      'memory_kb'      : '1024000',
                      'basepath'       : '/some/path',
                      'bridge_name'    : 'br100',
                      'mac_address'    : '02:12:34:46:56:67',
                      'vcpus'          : 2,
                      'project_id'     : 'fake',
-                     'ip_address'     : '10.11.12.13',
                      'bridge'         : 'br101',
                      'instance_type'  : 'm1.small'}
 
+        instance_ref = db.instance_create(None, instance)
+        user_context = context.APIRequestContext(project=self.project,
+                                                 user=self.user)
+        network_ref = self.network.get_network(user_context)
+        self.network.set_network_host(context.get_admin_context(),
+                                      network_ref['id'])
+
+        fixed_ip = { 'address'    : ip,
+                     'network_id' : network_ref['id'] }
+
+        fixed_ip_ref = db.fixed_ip_create(None, fixed_ip)
+        db.fixed_ip_update(None, ip, { 'allocated'   : True,
+                                          'instance_id' : instance_ref['id'] })
+
         type_uri_map = { 'qemu' : ('qemu:///system',
-                              [(lambda t: t.find('.').tag, 'domain'),
-                               (lambda t: t.find('.').get('type'), 'qemu'),
+                              [(lambda t: t.find('.').get('type'), 'qemu'),
                                (lambda t: t.find('./os/type').text, 'hvm'),
                                (lambda t: t.find('./devices/emulator'), None)]),
                          'kvm' : ('qemu:///system',
-                              [(lambda t: t.find('.').tag, 'domain'),
-                               (lambda t: t.find('.').get('type'), 'kvm'),
+                              [(lambda t: t.find('.').get('type'), 'kvm'),
                                (lambda t: t.find('./os/type').text, 'hvm'),
                                (lambda t: t.find('./devices/emulator'), None)]),
                          'uml' : ('uml:///system',
-                              [(lambda t: t.find('.').tag, 'domain'),
-                               (lambda t: t.find('.').get('type'), 'uml'),
+                              [(lambda t: t.find('.').get('type'), 'uml'),
                                (lambda t: t.find('./os/type').text, 'uml')]),
                        }
 
+        common_checks = [(lambda t: t.find('.').tag, 'domain'),
+                         (lambda t: \
+                             t.find('./devices/interface/filterref/parameter') \
+                              .get('name'), 'IP'),
+                         (lambda t: \
+                             t.find('./devices/interface/filterref/parameter') \
+                              .get('value'), '10.11.12.13')]
+
         for (libvirt_type,(expected_uri, checks)) in type_uri_map.iteritems():
             FLAGS.libvirt_type = libvirt_type
             conn = libvirt_conn.LibvirtConnection(True)
@@ -68,13 +93,18 @@ class LibvirtConnTestCase(test.TrialTestCase):
             uri, template = conn.get_uri_and_template()
             self.assertEquals(uri, expected_uri)
 
-            xml = conn.to_xml(instance)
-            tree = parseXml(xml)
+            xml = conn.to_xml(instance_ref)
+            tree = xml_to_tree(xml)
             for i, (check, expected_result) in enumerate(checks):
                 self.assertEqual(check(tree),
                                  expected_result,
                                  '%s failed check %d' % (xml, i))
 
+            for i, (check, expected_result) in enumerate(common_checks):
+                self.assertEqual(check(tree),
+                                 expected_result,
+                                 '%s failed common check %d' % (xml, i))
+
         # Deliberately not just assigning this string to FLAGS.libvirt_uri and
         # checking against that later on. This way we make sure the
         # implementation doesn't fiddle around with the FLAGS.
@@ -88,5 +118,141 @@ class LibvirtConnTestCase(test.TrialTestCase):
 
 
     def tearDown(self):
+        super(LibvirtConnTestCase, self).tearDown()
+        self.manager.delete_project(self.project)
+        self.manager.delete_user(self.user)
+
+class NWFilterTestCase(test.TrialTestCase):
+    def setUp(self):
+        super(NWFilterTestCase, self).setUp()
+
+        class Mock(object):
+            pass
+
+        self.manager = manager.AuthManager()
+        self.user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
+        self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.context = context.APIRequestContext(self.user, self.project)
+
+        self.fake_libvirt_connection = Mock()
+
+        self.fw = libvirt_conn.NWFilterFirewall(self.fake_libvirt_connection)
+
+    def tearDown(self):
         self.manager.delete_project(self.project)
         self.manager.delete_user(self.user)
+
+
+    def test_cidr_rule_nwfilter_xml(self):
+        cloud_controller = cloud.CloudController()
+        cloud_controller.create_security_group(self.context,
+                                               'testgroup',
+                                               'test group description')
+        cloud_controller.authorize_security_group_ingress(self.context,
+                                                          'testgroup',
+                                                          from_port='80',
+                                                          to_port='81',
+                                                          ip_protocol='tcp',
+                                                          cidr_ip='0.0.0.0/0')
+
+
+        security_group = db.security_group_get_by_name(self.context,
+                                                       'fake',
+                                                       'testgroup')
+
+        xml = self.fw.security_group_to_nwfilter_xml(security_group.id)
+
+        dom = xml_to_dom(xml)
+        self.assertEqual(dom.firstChild.tagName, 'filter')
+
+        rules = dom.getElementsByTagName('rule')
+        self.assertEqual(len(rules), 1)
+
+        # It's supposed to allow inbound traffic.
+        self.assertEqual(rules[0].getAttribute('action'), 'accept')
+        self.assertEqual(rules[0].getAttribute('direction'), 'in')
+
+        # Must be lower priority than the base filter (which blocks everything)
+        self.assertTrue(int(rules[0].getAttribute('priority')) < 1000)
+
+        ip_conditions = rules[0].getElementsByTagName('tcp')
+        self.assertEqual(len(ip_conditions), 1)
+        self.assertEqual(ip_conditions[0].getAttribute('srcipaddr'), '0.0.0.0')
+        self.assertEqual(ip_conditions[0].getAttribute('srcipmask'), '0.0.0.0')
+        self.assertEqual(ip_conditions[0].getAttribute('dstportstart'), '80')
+        self.assertEqual(ip_conditions[0].getAttribute('dstportend'), '81')
+
+
+        self.teardown_security_group()
+
+    def teardown_security_group(self):
+        cloud_controller = cloud.CloudController()
+        cloud_controller.delete_security_group(self.context, 'testgroup')
+
+
+    def setup_and_return_security_group(self):
+        cloud_controller = cloud.CloudController()
+        cloud_controller.create_security_group(self.context,
+                                               'testgroup',
+                                               'test group description')
+        cloud_controller.authorize_security_group_ingress(self.context,
+                                                          'testgroup',
+                                                          from_port='80',
+                                                          to_port='81',
+                                                          ip_protocol='tcp',
+                                                          cidr_ip='0.0.0.0/0')
+
+        return db.security_group_get_by_name(self.context, 'fake', 'testgroup')
+
+    def test_creates_base_rule_first(self):
+        # These come pre-defined by libvirt
+        self.defined_filters = ['no-mac-spoofing',
+                                'no-ip-spoofing',
+                                'no-arp-spoofing',
+                                'allow-dhcp-server']
+
+        self.recursive_depends = {}
+        for f in self.defined_filters:
+            self.recursive_depends[f] = []
+
+        def _filterDefineXMLMock(xml):
+            dom = xml_to_dom(xml)
+            name = dom.firstChild.getAttribute('name')
+            self.recursive_depends[name] = []
+            for f in dom.getElementsByTagName('filterref'):
+                ref = f.getAttribute('filter')
+                self.assertTrue(ref in self.defined_filters,
+                                ('%s referenced filter that does ' +
+                                'not yet exist: %s') % (name, ref))
+                dependencies = [ref] + self.recursive_depends[ref]
+                self.recursive_depends[name] += dependencies
+
+            self.defined_filters.append(name)
+            return True
+
+        self.fake_libvirt_connection.nwfilterDefineXML = _filterDefineXMLMock
+
+        instance_ref = db.instance_create(self.context,
+                                          {'user_id': 'fake',
+                                          'project_id': 'fake'})
+        inst_id = instance_ref['id']
+
+        def _ensure_all_called(_):
+            instance_filter = 'nova-instance-%s' % instance_ref['name']
+            secgroup_filter = 'nova-secgroup-%s' % self.security_group['id']
+            for required in [secgroup_filter, 'allow-dhcp-server',
+                             'no-arp-spoofing', 'no-ip-spoofing',
+                             'no-mac-spoofing']:
+                self.assertTrue(required in self.recursive_depends[instance_filter],
+                            "Instance's filter does not include %s" % required)
+
+        self.security_group = self.setup_and_return_security_group()
+
+        db.instance_add_security_group(self.context, inst_id, self.security_group.id)
+        instance = db.instance_get(self.context, inst_id)
+
+        d = self.fw.setup_nwfilters_for_instance(instance)
+        d.addCallback(_ensure_all_called)
+        d.addCallback(lambda _:self.teardown_security_group())
+
+        return d