Merge trunk and make work with provider fw rules (setup alongside basic_rules).

6 files changed, 56 insertions, 15 deletions

diff --git a/nova/virt/hyperv.py b/nova/virt/hyperv.py
index 5afa3221d..29d18dac5 100644
--- a/nova/virt/hyperv.py
+++ b/nova/virt/hyperv.py
@@ -191,7 +191,7 @@ class HyperVConnection(object):
         vcpus = long(instance['vcpus'])
         procsetting.VirtualQuantity = vcpus
         procsetting.Reservation = vcpus
-        procsetting.Limit = vcpus
+        procsetting.Limit = 100000  # static assignment to 100%
 
         (job, ret_val) = vs_man_svc.ModifyVirtualSystemResources(
                 vm.path_(), [procsetting.GetText_(1)])
diff --git a/nova/virt/images.py b/nova/virt/images.py
index 9c987e14d..7a6fef330 100644
--- a/nova/virt/images.py
+++ b/nova/virt/images.py
@@ -111,5 +111,8 @@ def _image_path(path):
 
 
 def image_url(image):
+    if FLAGS.image_service == "nova.image.glance.GlanceImageService":
+        return "http://%s:%s/images/%s" % (FLAGS.glance_host,
+            FLAGS.glance_port, image)
     return "http://%s:%s/_images/%s/image" % (FLAGS.s3_host, FLAGS.s3_port,
                                               image)
diff --git a/nova/virt/libvirt.xml.template b/nova/virt/libvirt.xml.template
index 8139c3620..88bfbc668 100644
--- a/nova/virt/libvirt.xml.template
+++ b/nova/virt/libvirt.xml.template
@@ -75,11 +75,13 @@
             <!--   <model type='virtio'/>  CANT RUN virtio network right now -->
             <filterref filter="nova-instance-${name}">
                 <parameter name="IP" value="${ip_address}" />
-                <parameter name="DHCPSERVER" value="${dhcp_server}" />
-                <parameter name="RASERVER" value="${ra_server}" />
+                <parameter name="DHCPSERVER" value="${dhcp_server}" />           
 #if $getVar('extra_params', False)
                 ${extra_params}
 #end if
+#if $getVar('ra_server', False)
+                <parameter name="RASERVER" value="${ra_server}" />
+#end if
             </filterref>
         </interface>
 
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index cac6a4440..2f99a0bb1 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -673,8 +673,7 @@ class LibvirtConnection(object):
         # Assume that the gateway also acts as the dhcp server.
         dhcp_server = network['gateway']
         ra_server = network['ra_server']
-        if not ra_server:
-            ra_server = 'fd00::'
+
         if FLAGS.allow_project_net_traffic:
             if FLAGS.use_ipv6:
                 net, mask = _get_net_and_mask(network['cidr'])
@@ -713,11 +712,13 @@ class LibvirtConnection(object):
                     'mac_address': instance['mac_address'],
                     'ip_address': ip_address,
                     'dhcp_server': dhcp_server,
-                    'ra_server': ra_server,
                     'extra_params': extra_params,
                     'rescue': rescue,
                     'local': instance_type['local_gb'],
                     'driver_type': driver_type}
+
+        if ra_server:
+            xml_info['ra_server'] = ra_server + "/128"
         if not rescue:
             if instance['kernel_id']:
                 xml_info['kernel'] = xml_info['basepath'] + "/kernel"
@@ -919,6 +920,11 @@ class FirewallDriver(object):
         """
         raise NotImplementedError()
 
+    def _ra_server_for_instance(self, instance):
+        network = db.network_get_by_instance(context.get_admin_context(),
+                                             instance['id'])
+        return network['ra_server']
+
 
 class NWFilterFirewall(FirewallDriver):
     """
@@ -969,8 +975,13 @@ class NWFilterFirewall(FirewallDriver):
     def __init__(self, get_connection, **kwargs):
         self._libvirt_get_connection = get_connection
         self.static_filters_configured = False
+        self.intermediate_filters_configured = False
         self.handle_security_groups = False
 
+    def apply_instance_filter(self, instance):
+        """No-op. Everything is done in prepare_instance_filter"""
+        pass
+
     def _get_connection(self):
         return self._libvirt_get_connection()
     _conn = property(_get_connection)
@@ -1018,11 +1029,21 @@ class NWFilterFirewall(FirewallDriver):
         logging.info('ensuring static filters')
         self._ensure_static_filters()
 
+        logging.info('ensuring intermediate filters')
+        self._ensure_intermediate_filters()
+
         instance_filter_name = self._instance_filter_name(instance)
         self._define_filter(self._filter_container(instance_filter_name,
                                                    ['nova-base']))
 
     def _ensure_static_filters(self):
+        """Static filters are filters that have no need to be IP aware.
+
+        There is no configuration or tuneability of these filters, so they
+        can be set up once and forgotten about.
+
+        """
+
         if self.static_filters_configured:
             return
 
@@ -1043,6 +1064,22 @@ class NWFilterFirewall(FirewallDriver):
 
         self.static_filters_configured = True
 
+    def _ensure_intermediate_filters(self):
+        """Intermediate filters are filters that are configurable nova-wide.
+
+        Unlike static filters, they must be set up and maintainted based
+        on the network topology of nova.  They are still required to be setup
+        before any instance can be launched.
+
+        """
+
+        if self.intermediate_filters_configured:
+            return
+
+        self.refresh_provider_fw_rules()
+
+        self.intermediate_filters_configured = True
+
     def _filter_container(self, name, filters):
         xml = '''<filter name='%s' chain='root'>%s</filter>''' % (
                  name,
@@ -1129,7 +1166,9 @@ class NWFilterFirewall(FirewallDriver):
                                              'nova-base-ipv6',
                                              'nova-allow-dhcp-server']
         if FLAGS.use_ipv6:
-            instance_secgroup_filter_children += ['nova-allow-ra-server']
+            ra_server = self._ra_server_for_instance(instance)
+            if ra_server:
+                instance_secgroup_filter_children += ['nova-allow-ra-server']
 
         ctxt = context.get_admin_context()
 
@@ -1158,10 +1197,6 @@ class NWFilterFirewall(FirewallDriver):
 
         return
 
-    def apply_instance_filter(self, instance):
-        """No-op. Everything is done in prepare_instance_filter"""
-        pass
-
     def refresh_security_group_rules(self, security_group_id):
         return self._define_filter(
                    self.security_group_to_nwfilter_xml(security_group_id))
@@ -1416,8 +1451,9 @@ class IptablesFirewallDriver(FirewallDriver):
             elif(ip_version == 6):
                 # Allow RA responses
                 ra_server = self._ra_server_for_instance(instance)
-                our_rules += ['-A %s -s %s -p icmpv6 '
-                                '-j ACCEPT' % (chain_name, ra_server)]
+                if ra_server:
+                    our_rules += ['-A %s -s %s -p icmpv6 -j ACCEPT' %
+                                  (chain_name, ra_server + "/128")]
                 #Allow project network traffic
                 if (FLAGS.allow_project_net_traffic):
                     cidrv6 = self._project_cidrv6_for_instance(instance)
diff --git a/nova/virt/xenapi/vm_utils.py b/nova/virt/xenapi/vm_utils.py
index 4afd28dd8..4bbd522c1 100644
--- a/nova/virt/xenapi/vm_utils.py
+++ b/nova/virt/xenapi/vm_utils.py
@@ -640,7 +640,7 @@ def with_vdi_attached_here(session, vdi, read_only, f):
         session.get_xenapi().VBD.plug(vbd)
         LOG.debug(_('Plugging VBD %s done.'), vbd)
         orig_dev = session.get_xenapi().VBD.get_device(vbd)
-        LOG.debug(_('VBD %s plugged as %s'), vbd, orig_dev)
+        LOG.debug(_('VBD %(vbd)s plugged as %(orig_dev)s') % locals())
         dev = remap_vbd_dev(orig_dev)
         if dev != orig_dev:
             LOG.debug(_('VBD %(vbd)s plugged into wrong dev, '
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index 628a171fa..e84ce20c4 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -149,7 +149,7 @@ class VMOps(object):
             if isinstance(instance_or_vm, (int, long)):
                 ctx = context.get_admin_context()
                 try:
-                    instance_obj = db.instance_get_by_id(ctx, instance_or_vm)
+                    instance_obj = db.instance_get(ctx, instance_or_vm)
                     instance_name = instance_obj.name
                 except exception.NotFound:
                     # The unit tests screw this up, as they use an integer for