trunk merge

25 files changed, 623 insertions, 92 deletions

diff --git a/nova/adminclient.py b/nova/adminclient.py
index 3cdd8347f..c614b274c 100644
--- a/nova/adminclient.py
+++ b/nova/adminclient.py
@@ -21,6 +21,7 @@ Nova User API client library.
 
 import base64
 import boto
+import boto.exception
 import httplib
 
 from boto.ec2.regioninfo import RegionInfo
@@ -288,10 +289,14 @@ class NovaAdminClient(object):
 
     def get_user(self, name):
         """Grab a single user by name."""
-        user = self.apiconn.get_object('DescribeUser', {'Name': name},
-                                       UserInfo)
-        if user.username != None:
-            return user
+        try:
+            return self.apiconn.get_object('DescribeUser',
+                                           {'Name': name},
+                                           UserInfo)
+        except boto.exception.BotoServerError, e:
+            if e.status == 400 and e.error_code == 'NotFound':
+                return None
+            raise
 
     def has_user(self, username):
         """Determine if user exists."""
@@ -376,6 +381,13 @@ class NovaAdminClient(object):
                   'MemberUsers': member_users}
         return self.apiconn.get_object('RegisterProject', params, ProjectInfo)
 
+    def modify_project(self, projectname, manager_user=None, description=None):
+        """Modifies an existing project."""
+        params = {'Name': projectname,
+                  'ManagerUser': manager_user,
+                  'Description': description}
+        return self.apiconn.get_status('ModifyProject', params)
+
     def delete_project(self, projectname):
         """Permanently deletes the specified project."""
         return self.apiconn.get_object('DeregisterProject',
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index e25943a13..ddcdc673c 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -171,7 +171,7 @@ class Authenticate(wsgi.Middleware):
                     req.path)
         # Be explicit for what exceptions are 403, the rest bubble as 500
         except (exception.NotFound, exception.NotAuthorized) as ex:
-            LOG.audit(_("Authentication Failure: %s"), ex.args[0])
+            LOG.audit(_("Authentication Failure: %s"), unicode(ex))
             raise webob.exc.HTTPForbidden()
 
         # Authenticated!
@@ -316,30 +316,31 @@ class Executor(wsgi.Application):
         try:
             result = api_request.invoke(context)
         except exception.InstanceNotFound as ex:
-            LOG.info(_('InstanceNotFound raised: %s'), ex.args[0],
+            LOG.info(_('InstanceNotFound raised: %s'), unicode(ex),
                      context=context)
             ec2_id = cloud.id_to_ec2_id(ex.instance_id)
             message = _('Instance %s not found') % ec2_id
             return self._error(req, context, type(ex).__name__, message)
         except exception.VolumeNotFound as ex:
-            LOG.info(_('VolumeNotFound raised: %s'), ex.args[0],
+            LOG.info(_('VolumeNotFound raised: %s'), unicode(ex),
                      context=context)
             ec2_id = cloud.id_to_ec2_id(ex.volume_id, 'vol-%08x')
             message = _('Volume %s not found') % ec2_id
             return self._error(req, context, type(ex).__name__, message)
         except exception.NotFound as ex:
-            LOG.info(_('NotFound raised: %s'), ex.args[0], context=context)
-            return self._error(req, context, type(ex).__name__, ex.args[0])
+            LOG.info(_('NotFound raised: %s'), unicode(ex), context=context)
+            return self._error(req, context, type(ex).__name__, unicode(ex))
         except exception.ApiError as ex:
-            LOG.exception(_('ApiError raised: %s'), ex.args[0],
+            LOG.exception(_('ApiError raised: %s'), unicode(ex),
                           context=context)
             if ex.code:
-                return self._error(req, context, ex.code, ex.args[0])
+                return self._error(req, context, ex.code, unicode(ex))
             else:
-                return self._error(req, context, type(ex).__name__, ex.args[0])
+                return self._error(req, context, type(ex).__name__,
+                                   unicode(ex))
         except Exception as ex:
             extra = {'environment': req.environ}
-            LOG.exception(_('Unexpected error raised: %s'), ex.args[0],
+            LOG.exception(_('Unexpected error raised: %s'), unicode(ex),
                           extra=extra, context=context)
             return self._error(req,
                                context,
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index d7e899d12..735951082 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -184,6 +184,17 @@ class AdminController(object):
                 description=None,
                 member_users=None))
 
+    def modify_project(self, context, name, manager_user, description=None,
+                       **kwargs):
+        """Modifies a project"""
+        msg = _("Modify project: %(name)s managed by"
+                " %(manager_user)s") % locals()
+        LOG.audit(msg, context=context)
+        manager.AuthManager().modify_project(name,
+                                             manager_user=manager_user,
+                                             description=description)
+        return True
+
     def deregister_project(self, context, name):
         """Permanently deletes a project."""
         LOG.audit(_("Delete project: %s"), name, context=context)
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 00d044e95..c80e1168a 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -512,8 +512,11 @@ class CloudController(object):
     def get_console_output(self, context, instance_id, **kwargs):
         LOG.audit(_("Get console output for instance %s"), instance_id,
                   context=context)
-        # instance_id is passed in as a list of instances
-        ec2_id = instance_id[0]
+        # instance_id may be passed in as a list of instances
+        if type(instance_id) == list:
+            ec2_id = instance_id[0]
+        else:
+            ec2_id = instance_id
         instance_id = ec2_id_to_id(ec2_id)
         output = self.compute_api.get_console_output(
                 context, instance_id=instance_id)
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index 69a4d66c0..8aeb69693 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -52,8 +52,8 @@ class FaultWrapper(wsgi.Middleware):
         try:
             return req.get_response(self.application)
         except Exception as ex:
-            LOG.exception(_("Caught error: %s"), str(ex))
-            exc = webob.exc.HTTPInternalServerError(explanation=str(ex))
+            LOG.exception(_("Caught error: %s"), unicode(ex))
+            exc = webob.exc.HTTPInternalServerError(explanation=unicode(ex))
             return faults.Fault(exc)
 
 
diff --git a/nova/compute/instance_types.py b/nova/compute/instance_types.py
index 196d6a8df..309313fd0 100644
--- a/nova/compute/instance_types.py
+++ b/nova/compute/instance_types.py
@@ -38,8 +38,8 @@ def get_by_type(instance_type):
     if instance_type is None:
         return FLAGS.default_instance_type
     if instance_type not in INSTANCE_TYPES:
-        raise exception.ApiError(_("Unknown instance type: %s"),
-                                 instance_type)
+        raise exception.ApiError(_("Unknown instance type: %s") % \
+                                 instance_type, "Invalid")
     return instance_type
 
 
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index 0f9bf301f..f4418af26 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -37,7 +37,6 @@ terminating it.
 import datetime
 import random
 import string
-import logging
 import socket
 import functools
 
@@ -231,22 +230,25 @@ class ComputeManager(manager.Manager):
         instance_ref = self.db.instance_get(context, instance_id)
         LOG.audit(_("Terminating instance %s"), instance_id, context=context)
 
-        if not FLAGS.stub_network:
-            address = self.db.instance_get_floating_address(context,
-                                                            instance_ref['id'])
-            if address:
-                LOG.debug(_("Disassociating address %s"), address,
+        fixed_ip = instance_ref.get('fixed_ip')
+        if not FLAGS.stub_network and fixed_ip:
+            floating_ips = fixed_ip.get('floating_ips') or []
+            for floating_ip in floating_ips:
+                address = floating_ip['address']
+                LOG.debug("Disassociating address %s", address,
                           context=context)
                 # NOTE(vish): Right now we don't really care if the ip is
                 #             disassociated.  We may need to worry about
                 #             checking this later.
+                network_topic = self.db.queue_get_for(context,
+                                                      FLAGS.network_topic,
+                                                      floating_ip['host'])
                 rpc.cast(context,
-                         self.get_network_topic(context),
+                         network_topic,
                          {"method": "disassociate_floating_ip",
                           "args": {"floating_address": address}})
 
-            address = self.db.instance_get_fixed_address(context,
-                                                         instance_ref['id'])
+            address = fixed_ip['address']
             if address:
                 LOG.debug(_("Deallocating address %s"), address,
                           context=context)
@@ -256,7 +258,7 @@ class ComputeManager(manager.Manager):
                 self.network_manager.deallocate_fixed_ip(context.elevated(),
                                                          address)
 
-        volumes = instance_ref.get('volumes', []) or []
+        volumes = instance_ref.get('volumes') or []
         for volume in volumes:
             self.detach_volume(context, instance_id, volume['id'])
         if instance_ref['state'] == power_state.SHUTOFF:
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index ec36c481e..f568d3470 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -19,6 +19,7 @@
 Implementation of SQLAlchemy backend.
 """
 
+import datetime
 import warnings
 
 from nova import db
@@ -578,7 +579,7 @@ def fixed_ip_disassociate_all_by_timeout(_context, host, time):
                              'AND instance_id IS NOT NULL '
                              'AND allocated = 0',
                     {'host': host,
-                     'time': time.isoformat()})
+                     'time': time})
     return result.rowcount
 
 
@@ -670,8 +671,14 @@ def instance_data_get_for_project(context, project_id):
 def instance_destroy(context, instance_id):
     session = get_session()
     with session.begin():
-        instance_ref = instance_get(context, instance_id, session=session)
-        instance_ref.delete(session=session)
+        session.execute('update instances set deleted=1,'
+                        'deleted_at=:at where id=:id',
+                        {'id': instance_id,
+                         'at': datetime.datetime.utcnow()})
+        session.execute('update security_group_instance_association '
+                        'set deleted=1,deleted_at=:at where instance_id=:id',
+                        {'id': instance_id,
+                         'at': datetime.datetime.utcnow()})
 
 
 @require_context
@@ -1583,6 +1590,11 @@ def security_group_destroy(context, security_group_id):
         # TODO(vish): do we have to use sql here?
         session.execute('update security_groups set deleted=1 where id=:id',
                         {'id': security_group_id})
+        session.execute('update security_group_instance_association '
+                        'set deleted=1,deleted_at=:at '
+                        'where security_group_id=:id',
+                        {'id': security_group_id,
+                         'at': datetime.datetime.utcnow()})
         session.execute('update security_group_rules set deleted=1 '
                         'where group_id=:id',
                         {'id': security_group_id})
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/001_austin.py b/nova/db/sqlalchemy/migrate_repo/versions/001_austin.py
index a312a7190..366944591 100644
--- a/nova/db/sqlalchemy/migrate_repo/versions/001_austin.py
+++ b/nova/db/sqlalchemy/migrate_repo/versions/001_austin.py
@@ -134,6 +134,9 @@ instances = Table('instances', meta,
         Column('ramdisk_id',
                String(length=255, convert_unicode=False, assert_unicode=None,
                       unicode_error=None, _warn_on_bytestring=False)),
+        Column('server_name',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
         Column('launch_index', Integer()),
         Column('key_name',
                String(length=255, convert_unicode=False, assert_unicode=None,
@@ -178,23 +181,6 @@ instances = Table('instances', meta,
         )
 
 
-iscsi_targets = Table('iscsi_targets', meta,
-        Column('created_at', DateTime(timezone=False)),
-        Column('updated_at', DateTime(timezone=False)),
-        Column('deleted_at', DateTime(timezone=False)),
-        Column('deleted', Boolean(create_constraint=True, name=None)),
-        Column('id', Integer(),  primary_key=True, nullable=False),
-        Column('target_num', Integer()),
-        Column('host',
-               String(length=255, convert_unicode=False, assert_unicode=None,
-                      unicode_error=None, _warn_on_bytestring=False)),
-        Column('volume_id',
-               Integer(),
-               ForeignKey('volumes.id'),
-               nullable=True),
-        )
-
-
 key_pairs = Table('key_pairs', meta,
         Column('created_at', DateTime(timezone=False)),
         Column('updated_at', DateTime(timezone=False)),
@@ -523,7 +509,7 @@ def upgrade(migrate_engine):
     meta.bind = migrate_engine
 
     for table in (auth_tokens, export_devices, fixed_ips, floating_ips,
-                  instances, iscsi_targets, key_pairs, networks,
+                  instances, key_pairs, networks,
                   projects, quotas, security_groups, security_group_inst_assoc,
                   security_group_rules, services, users,
                   user_project_association, user_project_role_association,
@@ -539,7 +525,7 @@ def upgrade(migrate_engine):
 def downgrade(migrate_engine):
     # Operations to reverse the above upgrade go here.
     for table in (auth_tokens, export_devices, fixed_ips, floating_ips,
-                  instances, iscsi_targets, key_pairs, networks,
+                  instances, key_pairs, networks,
                   projects, quotas, security_groups, security_group_inst_assoc,
                   security_group_rules, services, users,
                   user_project_association, user_project_role_association,
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/002_bexar.py b/nova/db/sqlalchemy/migrate_repo/versions/002_bexar.py
index bd3a3e6f8..699b837f8 100644
--- a/nova/db/sqlalchemy/migrate_repo/versions/002_bexar.py
+++ b/nova/db/sqlalchemy/migrate_repo/versions/002_bexar.py
@@ -41,6 +41,10 @@ networks = Table('networks', meta,
         Column('id', Integer(),  primary_key=True, nullable=False),
         )
 
+volumes = Table('volumes', meta,
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        )
+
 
 #
 # New Tables
@@ -131,6 +135,23 @@ instance_actions = Table('instance_actions', meta,
         )
 
 
+iscsi_targets = Table('iscsi_targets', meta,
+        Column('created_at', DateTime(timezone=False)),
+        Column('updated_at', DateTime(timezone=False)),
+        Column('deleted_at', DateTime(timezone=False)),
+        Column('deleted', Boolean(create_constraint=True, name=None)),
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        Column('target_num', Integer()),
+        Column('host',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+        Column('volume_id',
+               Integer(),
+               ForeignKey('volumes.id'),
+               nullable=True),
+        )
+
+
 #
 # Tables to alter
 #
@@ -188,7 +209,8 @@ def upgrade(migrate_engine):
     # Upgrade operations go here. Don't create your own engine;
     # bind migrate_engine to your metadata
     meta.bind = migrate_engine
-    for table in (certificates, consoles, console_pools, instance_actions):
+    for table in (certificates, consoles, console_pools, instance_actions,
+                  iscsi_targets):
         try:
             table.create()
         except Exception:
diff --git a/nova/db/sqlalchemy/migration.py b/nova/db/sqlalchemy/migration.py
index 33d14827b..2a13c5466 100644
--- a/nova/db/sqlalchemy/migration.py
+++ b/nova/db/sqlalchemy/migration.py
@@ -46,12 +46,15 @@ def db_version():
         meta.reflect(bind=engine)
         try:
             for table in ('auth_tokens', 'export_devices', 'fixed_ips',
-                          'floating_ips', 'instances', 'iscsi_targets',
+                          'floating_ips', 'instances',
                           'key_pairs', 'networks', 'projects', 'quotas',
-                          'security_group_rules',
-                          'security_group_instance_association', 'services',
+                          'security_group_instance_association',
+                          'security_group_rules', 'security_groups',
+                          'services',
                           'users', 'user_project_association',
-                          'user_project_role_association', 'volumes'):
+                          'user_project_role_association',
+                          'user_role_association',
+                          'volumes'):
                 assert table in meta.tables
             return db_version_control(1)
         except AssertionError:
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index c54ebe3ba..7efb36c0e 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -311,10 +311,14 @@ class SecurityGroup(BASE, NovaBase):
                              secondary="security_group_instance_association",
                              primaryjoin='and_('
         'SecurityGroup.id == '
-            'SecurityGroupInstanceAssociation.security_group_id,'
+        'SecurityGroupInstanceAssociation.security_group_id,'
+        'SecurityGroupInstanceAssociation.deleted == False,'
         'SecurityGroup.deleted == False)',
                              secondaryjoin='and_('
         'SecurityGroupInstanceAssociation.instance_id == Instance.id,'
+        # (anthony) the condition below shouldn't be necessary now that the
+        # association is being marked as deleted.  However, removing this
+        # may cause existing deployments to choke, so I'm leaving it
         'Instance.deleted == False)',
                              backref='security_groups')
 
diff --git a/nova/flags.py b/nova/flags.py
index 43bc174d2..1d8eba94f 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -208,7 +208,7 @@ def _get_my_ip():
         (addr, port) = csock.getsockname()
         csock.close()
         return addr
-    except socket.gaierror as ex:
+    except socket.error as ex:
         return "127.0.0.1"
 
 
diff --git a/nova/log.py b/nova/log.py
index e1c9f46f4..b541488bd 100644
--- a/nova/log.py
+++ b/nova/log.py
@@ -31,6 +31,7 @@ import cStringIO
 import json
 import logging
 import logging.handlers
+import sys
 import traceback
 
 from nova import flags
@@ -191,6 +192,12 @@ class NovaLogger(logging.Logger):
             kwargs.pop('exc_info')
             self.error(message, **kwargs)
 
+
+def handle_exception(type, value, tb):
+    logging.root.critical(str(value), exc_info=(type, value, tb))
+
+
+sys.excepthook = handle_exception
 logging.setLoggerClass(NovaLogger)
 
 
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index cdd1f666a..df54606db 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -20,6 +20,7 @@ Implements vlans, bridges, and iptables rules using linux utilities.
 import os
 
 from nova import db
+from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import utils
@@ -37,6 +38,9 @@ FLAGS = flags.FLAGS
 flags.DEFINE_string('dhcpbridge_flagfile',
                     '/etc/nova/nova-dhcpbridge.conf',
                     'location of flagfile for dhcpbridge')
+flags.DEFINE_string('dhcp_domain',
+                    'novalocal',
+                    'domain to use for building the hostnames')
 
 flags.DEFINE_string('networks_path', '$state_path/networks',
                     'Location to keep network config files')
@@ -177,32 +181,77 @@ def ensure_vlan(vlan_num):
         LOG.debug(_("Starting VLAN inteface %s"), interface)
         _execute("sudo vconfig set_name_type VLAN_PLUS_VID_NO_PAD")
         _execute("sudo vconfig add %s %s" % (FLAGS.vlan_interface, vlan_num))
-        _execute("sudo ifconfig %s up" % interface)
+        _execute("sudo ip link set %s up" % interface)
     return interface
 
 
 def ensure_bridge(bridge, interface, net_attrs=None):
-    """Create a bridge unless it already exists"""
+    """Create a bridge unless it already exists.
+
+    :param interface: the interface to create the bridge on.
+    :param net_attrs: dictionary with  attributes used to create the bridge.
+
+    If net_attrs is set, it will add the net_attrs['gateway'] to the bridge
+    using net_attrs['broadcast'] and net_attrs['cidr'].  It will also add
+    the ip_v6 address specified in net_attrs['cidr_v6'] if use_ipv6 is set.
+
+    The code will attempt to move any ips that already exist on the interface
+    onto the bridge and reset the default gateway if necessary.
+    """
     if not _device_exists(bridge):
         LOG.debug(_("Starting Bridge interface for %s"), interface)
         _execute("sudo brctl addbr %s" % bridge)
         _execute("sudo brctl setfd %s 0" % bridge)
         # _execute("sudo brctl setageing %s 10" % bridge)
         _execute("sudo brctl stp %s off" % bridge)
-        if interface:
-            _execute("sudo brctl addif %s %s" % (bridge, interface))
+        _execute("sudo ip link set %s up" % bridge)
     if net_attrs:
-        _execute("sudo ifconfig %s %s broadcast %s netmask %s up" % \
-                (bridge,
-                 net_attrs['gateway'],
-                 net_attrs['broadcast'],
-                 net_attrs['netmask']))
+        # NOTE(vish): The ip for dnsmasq has to be the first address on the
+        #             bridge for it to respond to reqests properly
+        suffix = net_attrs['cidr'].rpartition('/')[2]
+        out, err = _execute("sudo ip addr add %s/%s brd %s dev %s" %
+                            (net_attrs['gateway'],
+                             suffix,
+                             net_attrs['broadcast'],
+                             bridge),
+                            check_exit_code=False)
+        if err and err != "RTNETLINK answers: File exists\n":
+            raise exception.Error("Failed to add ip: %s" % err)
         if(FLAGS.use_ipv6):
             _execute("sudo ip -f inet6 addr change %s dev %s" %
                      (net_attrs['cidr_v6'], bridge))
-            _execute("sudo ifconfig %s up" % bridge)
-    else:
-        _execute("sudo ifconfig %s up" % bridge)
+        # NOTE(vish): If the public interface is the same as the
+        #             bridge, then the bridge has to be in promiscuous
+        #             to forward packets properly.
+        if(FLAGS.public_interface == bridge):
+            _execute("sudo ip link set dev %s promisc on" % bridge)
+    if interface:
+        # NOTE(vish): This will break if there is already an ip on the
+        #             interface, so we move any ips to the bridge
+        gateway = None
+        out, err = _execute("sudo route -n")
+        for line in out.split("\n"):
+            fields = line.split()
+            if fields and fields[0] == "0.0.0.0" and fields[-1] == interface:
+                gateway = fields[1]
+        out, err = _execute("sudo ip addr show dev %s scope global" %
+                            interface)
+        for line in out.split("\n"):
+            fields = line.split()
+            if fields and fields[0] == "inet":
+                params = ' '.join(fields[1:-1])
+                _execute("sudo ip addr del %s dev %s" % (params, fields[-1]))
+                _execute("sudo ip addr add %s dev %s" % (params, bridge))
+        if gateway:
+            _execute("sudo route add 0.0.0.0 gw %s" % gateway)
+        out, err = _execute("sudo brctl addif %s %s" %
+                            (bridge, interface),
+                            check_exit_code=False)
+
+        if (err and err != "device %s is already a member of a bridge; can't "
+                           "enslave it to bridge %s.\n" % (interface, bridge)):
+            raise exception.Error("Failed to add interface: %s" % err)
+
     if FLAGS.use_nova_chains:
         (out, err) = _execute("sudo iptables -N nova_forward",
                               check_exit_code=False)
@@ -313,8 +362,9 @@ interface %s
 def _host_dhcp(fixed_ip_ref):
     """Return a host string for an address"""
     instance_ref = fixed_ip_ref['instance']
-    return "%s,%s.novalocal,%s" % (instance_ref['mac_address'],
+    return "%s,%s.%s,%s" % (instance_ref['mac_address'],
                                    instance_ref['hostname'],
+                                   FLAGS.dhcp_domain,
                                    fixed_ip_ref['address'])
 
 
@@ -329,7 +379,8 @@ def _execute(cmd, *args, **kwargs):
 
 def _device_exists(device):
     """Check if ethernet device exists"""
-    (_out, err) = _execute("ifconfig %s" % device, check_exit_code=False)
+    (_out, err) = _execute("ip link show dev %s" % device,
+                           check_exit_code=False)
     return not err
 
 
@@ -359,6 +410,7 @@ def _dnsmasq_cmd(net):
            ' --strict-order',
            ' --bind-interfaces',
            ' --conf-file=',
+           ' --domain=%s' % FLAGS.dhcp_domain,
            ' --pid-file=%s' % _dhcp_file(net['bridge'], 'pid'),
            ' --listen-address=%s' % net['gateway'],
            ' --except-interface=lo',
diff --git a/nova/network/manager.py b/nova/network/manager.py
index fbcbea131..8eb9f041b 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -118,6 +118,10 @@ class NetworkManager(manager.Manager):
         super(NetworkManager, self).__init__(*args, **kwargs)
 
     def init_host(self):
+        """Do any initialization that needs to be run if this is a
+        standalone service.
+        """
+        self.driver.init_host()
         # Set up networking for the projects for which we're already
         # the designated network host.
         ctxt = context.get_admin_context()
@@ -395,7 +399,6 @@ class FlatDHCPManager(FlatManager):
         standalone service.
         """
         super(FlatDHCPManager, self).init_host()
-        self.driver.init_host()
         self.driver.metadata_forward()
 
     def setup_compute_network(self, context, instance_id):
@@ -465,7 +468,6 @@ class VlanManager(NetworkManager):
         standalone service.
         """
         super(VlanManager, self).init_host()
-        self.driver.init_host()
         self.driver.metadata_forward()
 
     def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
diff --git a/nova/scheduler/simple.py b/nova/scheduler/simple.py
index baf4966d4..0191ceb3d 100644
--- a/nova/scheduler/simple.py
+++ b/nova/scheduler/simple.py
@@ -43,7 +43,9 @@ class SimpleScheduler(chance.ChanceScheduler):
     def schedule_run_instance(self, context, instance_id, *_args, **_kwargs):
         """Picks a host that is up and has the fewest running instances."""
         instance_ref = db.instance_get(context, instance_id)
-        if instance_ref['availability_zone'] and context.is_admin:
+        if (instance_ref['availability_zone']
+            and ':' in instance_ref['availability_zone']
+            and context.is_admin):
             zone, _x, host = instance_ref['availability_zone'].partition(':')
             service = db.service_get_by_args(context.elevated(), host,
                                              'nova-compute')
@@ -75,7 +77,9 @@ class SimpleScheduler(chance.ChanceScheduler):
     def schedule_create_volume(self, context, volume_id, *_args, **_kwargs):
         """Picks a host that is up and has the fewest volumes."""
         volume_ref = db.volume_get(context, volume_id)
-        if (':' in volume_ref['availability_zone']) and context.is_admin:
+        if (volume_ref['availability_zone']
+            and ':' in volume_ref['availability_zone']
+            and context.is_admin):
             zone, _x, host = volume_ref['availability_zone'].partition(':')
             service = db.service_get_by_args(context.elevated(), host,
                                              'nova-volume')
diff --git a/nova/tests/db/nova.austin.sqlite b/nova/tests/db/nova.austin.sqlite
new file mode 100644
index 000000000..ad1326bce
--- /dev/null
+++ b/nova/tests/db/nova.austin.sqlite
diff --git a/nova/tests/test_compute.py b/nova/tests/test_compute.py
index 09f6ee94a..2aa0690e7 100644
--- a/nova/tests/test_compute.py
+++ b/nova/tests/test_compute.py
@@ -49,7 +49,7 @@ class ComputeTestCase(test.TestCase):
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('fake', 'fake', 'fake')
         self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.get_admin_context()
+        self.context = context.RequestContext('fake', 'fake', False)
 
     def tearDown(self):
         self.manager.delete_user(self.user)
@@ -69,6 +69,13 @@ class ComputeTestCase(test.TestCase):
         inst['ami_launch_index'] = 0
         return db.instance_create(self.context, inst)['id']
 
+    def _create_group(self):
+        values = {'name': 'testgroup',
+                  'description': 'testgroup',
+                  'user_id': self.user.id,
+                  'project_id': self.project.id}
+        return db.security_group_create(self.context, values)
+
     def test_create_instance_defaults_display_name(self):
         """Verify that an instance cannot be created without a display_name."""
         cases = [dict(), dict(display_name=None)]
@@ -82,21 +89,53 @@ class ComputeTestCase(test.TestCase):
 
     def test_create_instance_associates_security_groups(self):
         """Make sure create associates security groups"""
-        values = {'name': 'default',
-                  'description': 'default',
-                  'user_id': self.user.id,
-                  'project_id': self.project.id}
-        group = db.security_group_create(self.context, values)
+        group = self._create_group()
         ref = self.compute_api.create(
                 self.context,
                 instance_type=FLAGS.default_instance_type,
                 image_id=None,
-                security_group=['default'])
+                security_group=['testgroup'])
         try:
             self.assertEqual(len(db.security_group_get_by_instance(
-                self.context, ref[0]['id'])), 1)
+                             self.context, ref[0]['id'])), 1)
+            group = db.security_group_get(self.context, group['id'])
+            self.assert_(len(group.instances) == 1)
+        finally:
+            db.security_group_destroy(self.context, group['id'])
+            db.instance_destroy(self.context, ref[0]['id'])
+
+    def test_destroy_instance_disassociates_security_groups(self):
+        """Make sure destroying disassociates security groups"""
+        group = self._create_group()
+
+        ref = self.compute_api.create(
+                self.context,
+                instance_type=FLAGS.default_instance_type,
+                image_id=None,
+                security_group=['testgroup'])
+        try:
+            db.instance_destroy(self.context, ref[0]['id'])
+            group = db.security_group_get(self.context, group['id'])
+            self.assert_(len(group.instances) == 0)
         finally:
             db.security_group_destroy(self.context, group['id'])
+
+    def test_destroy_security_group_disassociates_instances(self):
+        """Make sure destroying security groups disassociates instances"""
+        group = self._create_group()
+
+        ref = self.compute_api.create(
+                self.context,
+                instance_type=FLAGS.default_instance_type,
+                image_id=None,
+                security_group=['testgroup'])
+
+        try:
+            db.security_group_destroy(self.context, group['id'])
+            group = db.security_group_get(context.get_admin_context(
+                                          read_deleted=True), group['id'])
+            self.assert_(len(group.instances) == 0)
+        finally:
             db.instance_destroy(self.context, ref[0]['id'])
 
     def test_run_terminate(self):
diff --git a/nova/utils.py b/nova/utils.py
index 5f5225289..8d7ff1f64 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -152,6 +152,42 @@ def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
     return result
 
 
+def ssh_execute(ssh, cmd, process_input=None,
+                addl_env=None, check_exit_code=True):
+    LOG.debug(_("Running cmd (SSH): %s"), cmd)
+    if addl_env:
+        raise exception.Error("Environment not supported over SSH")
+
+    if process_input:
+        # This is (probably) fixable if we need it...
+        raise exception.Error("process_input not supported over SSH")
+
+    stdin_stream, stdout_stream, stderr_stream = ssh.exec_command(cmd)
+    channel = stdout_stream.channel
+
+    #stdin.write('process_input would go here')
+    #stdin.flush()
+
+    # NOTE(justinsb): This seems suspicious...
+    # ...other SSH clients have buffering issues with this approach
+    stdout = stdout_stream.read()
+    stderr = stderr_stream.read()
+    stdin_stream.close()
+
+    exit_status = channel.recv_exit_status()
+
+    # exit_status == -1 if no exit code was returned
+    if exit_status != -1:
+        LOG.debug(_("Result was %s") % exit_status)
+        if check_exit_code and exit_status != 0:
+            raise exception.ProcessExecutionError(exit_code=exit_status,
+                                                  stdout=stdout,
+                                                  stderr=stderr,
+                                                  cmd=cmd)
+
+    return (stdout, stderr)
+
+
 def abspath(s):
     return os.path.join(os.path.dirname(__file__), s)
 
diff --git a/nova/version.py b/nova/version.py
index 7b27acb6a..c3ecc2245 100644
--- a/nova/version.py
+++ b/nova/version.py
@@ -21,7 +21,7 @@ except ImportError:
                     'revision_id': 'LOCALREVISION',
                     'revno': 0}
 
-NOVA_VERSION = ['2011', '1']
+NOVA_VERSION = ['2011', '2']
 YEAR, COUNT = NOVA_VERSION
 
 FINAL = False   # This becomes true at Release Candidate time
diff --git a/nova/volume/api.py b/nova/volume/api.py
index 0bcd8a3b0..478c83486 100644
--- a/nova/volume/api.py
+++ b/nova/volume/api.py
@@ -45,7 +45,7 @@ class API(base.Base):
             LOG.warn(_("Quota exceeeded for %(pid)s, tried to create"
                     " %(size)sG volume") % locals())
             raise quota.QuotaError(_("Volume quota exceeded. You cannot "
-                    "create a volume of size %s") % size)
+                                     "create a volume of size %sG") % size)
 
         options = {
             'size': size,
diff --git a/nova/volume/driver.py b/nova/volume/driver.py
index da7307733..82f4c2f54 100644
--- a/nova/volume/driver.py
+++ b/nova/volume/driver.py
@@ -294,8 +294,10 @@ class ISCSIDriver(VolumeDriver):
         self._execute("sudo ietadm --op delete --tid=%s" %
                       iscsi_target)
 
-    def _get_name_and_portal(self, volume_name, host):
+    def _get_name_and_portal(self, volume):
         """Gets iscsi name and portal from volume name and host."""
+        volume_name = volume['name']
+        host = volume['host']
         (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
                                     "sendtargets -p %s" % host)
         for target in out.splitlines():
@@ -307,8 +309,7 @@ class ISCSIDriver(VolumeDriver):
 
     def discover_volume(self, volume):
         """Discover volume on a remote host."""
-        iscsi_name, iscsi_portal = self._get_name_and_portal(volume['name'],
-                                                             volume['host'])
+        iscsi_name, iscsi_portal = self._get_name_and_portal(volume)
         self._execute("sudo iscsiadm -m node -T %s -p %s --login" %
                       (iscsi_name, iscsi_portal))
         self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
@@ -319,8 +320,7 @@ class ISCSIDriver(VolumeDriver):
 
     def undiscover_volume(self, volume):
         """Undiscover volume on a remote host."""
-        iscsi_name, iscsi_portal = self._get_name_and_portal(volume['name'],
-                                                             volume['host'])
+        iscsi_name, iscsi_portal = self._get_name_and_portal(volume)
         self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
                       "-n node.startup -v manual" %
                       (iscsi_name, iscsi_portal))
diff --git a/nova/volume/manager.py b/nova/volume/manager.py
index 6f8e25e19..6e70ec881 100644
--- a/nova/volume/manager.py
+++ b/nova/volume/manager.py
@@ -87,7 +87,7 @@ class VolumeManager(manager.Manager):
             if volume['status'] in ['available', 'in-use']:
                 self.driver.ensure_export(ctxt, volume)
             else:
-                LOG.info(_("volume %s: skipping export"), volume_ref['name'])
+                LOG.info(_("volume %s: skipping export"), volume['name'])
 
     def create_volume(self, context, volume_id):
         """Creates and exports the volume."""
diff --git a/nova/volume/san.py b/nova/volume/san.py
new file mode 100644
index 000000000..26d6125e7
--- /dev/null
+++ b/nova/volume/san.py
@@ -0,0 +1,335 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Justin Santa Barbara
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Drivers for san-stored volumes.
+The unique thing about a SAN is that we don't expect that we can run the volume
+ controller on the SAN hardware.  We expect to access it over SSH or some API.
+"""
+
+import os
+import paramiko
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova.utils import ssh_execute
+from nova.volume.driver import ISCSIDriver
+
+LOG = logging.getLogger("nova.volume.driver")
+FLAGS = flags.FLAGS
+flags.DEFINE_boolean('san_thin_provision', 'true',
+                     'Use thin provisioning for SAN volumes?')
+flags.DEFINE_string('san_ip', '',
+                    'IP address of SAN controller')
+flags.DEFINE_string('san_login', 'admin',
+                    'Username for SAN controller')
+flags.DEFINE_string('san_password', '',
+                    'Password for SAN controller')
+flags.DEFINE_string('san_privatekey', '',
+                    'Filename of private key to use for SSH authentication')
+
+
+class SanISCSIDriver(ISCSIDriver):
+    """ Base class for SAN-style storage volumes
+        (storage providers we access over SSH)"""
+    #Override because SAN ip != host ip
+    def _get_name_and_portal(self, volume):
+        """Gets iscsi name and portal from volume name and host."""
+        volume_name = volume['name']
+
+        # TODO(justinsb): store in volume, remerge with generic iSCSI code
+        host = FLAGS.san_ip
+
+        (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
+                                    "sendtargets -p %s" % host)
+
+        location = None
+        find_iscsi_name = self._build_iscsi_target_name(volume)
+        for target in out.splitlines():
+            if find_iscsi_name in target:
+                (location, _sep, iscsi_name) = target.partition(" ")
+                break
+        if not location:
+            raise exception.Error(_("Could not find iSCSI export "
+                                    " for volume %s") %
+                                  volume_name)
+
+        iscsi_portal = location.split(",")[0]
+        LOG.debug("iscsi_name=%s, iscsi_portal=%s" %
+                  (iscsi_name, iscsi_portal))
+        return (iscsi_name, iscsi_portal)
+
+    def _build_iscsi_target_name(self, volume):
+        return "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
+
+    # discover_volume is still OK
+    # undiscover_volume is still OK
+
+    def _connect_to_ssh(self):
+        ssh = paramiko.SSHClient()
+        #TODO(justinsb): We need a better SSH key policy
+        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        if FLAGS.san_password:
+            ssh.connect(FLAGS.san_ip,
+                        username=FLAGS.san_login,
+                        password=FLAGS.san_password)
+        elif FLAGS.san_privatekey:
+            privatekeyfile = os.path.expanduser(FLAGS.san_privatekey)
+            # It sucks that paramiko doesn't support DSA keys
+            privatekey = paramiko.RSAKey.from_private_key_file(privatekeyfile)
+            ssh.connect(FLAGS.san_ip,
+                        username=FLAGS.san_login,
+                        pkey=privatekey)
+        else:
+            raise exception.Error("Specify san_password or san_privatekey")
+        return ssh
+
+    def _run_ssh(self, command, check_exit_code=True):
+        #TODO(justinsb): SSH connection caching (?)
+        ssh = self._connect_to_ssh()
+
+        #TODO(justinsb): Reintroduce the retry hack
+        ret = ssh_execute(ssh, command, check_exit_code=check_exit_code)
+
+        ssh.close()
+
+        return ret
+
+    def ensure_export(self, context, volume):
+        """Synchronously recreates an export for a logical volume."""
+        pass
+
+    def create_export(self, context, volume):
+        """Exports the volume."""
+        pass
+
+    def remove_export(self, context, volume):
+        """Removes an export for a logical volume."""
+        pass
+
+    def check_for_setup_error(self):
+        """Returns an error if prerequisites aren't met"""
+        if not (FLAGS.san_password or FLAGS.san_privatekey):
+            raise exception.Error("Specify san_password or san_privatekey")
+
+        if not (FLAGS.san_ip):
+            raise exception.Error("san_ip must be set")
+
+
+def _collect_lines(data):
+    """ Split lines from data into an array, trimming them """
+    matches = []
+    for line in data.splitlines():
+        match = line.strip()
+        matches.append(match)
+
+    return matches
+
+
+def _get_prefixed_values(data, prefix):
+    """Collect lines which start with prefix; with trimming"""
+    matches = []
+    for line in data.splitlines():
+        line = line.strip()
+        if line.startswith(prefix):
+            match = line[len(prefix):]
+            match = match.strip()
+            matches.append(match)
+
+    return matches
+
+
+class SolarisISCSIDriver(SanISCSIDriver):
+    """Executes commands relating to Solaris-hosted ISCSI volumes.
+    Basic setup for a Solaris iSCSI server:
+    pkg install storage-server SUNWiscsit
+    svcadm enable stmf
+    svcadm enable -r svc:/network/iscsi/target:default
+    pfexec itadm create-tpg e1000g0 ${MYIP}
+    pfexec itadm create-target -t e1000g0
+
+    Then grant the user that will be logging on lots of permissions.
+    I'm not sure exactly which though:
+    zfs allow justinsb create,mount,destroy rpool
+    usermod -P'File System Management' justinsb
+    usermod -P'Primary Administrator' justinsb
+
+    Also make sure you can login using san_login & san_password/san_privatekey
+    """
+
+    def _view_exists(self, luid):
+        cmd = "pfexec /usr/sbin/stmfadm list-view -l %s" % (luid)
+        (out, _err) = self._run_ssh(cmd,
+                                    check_exit_code=False)
+        if "no views found" in out:
+            return False
+
+        if "View Entry:" in out:
+            return True
+
+        raise exception.Error("Cannot parse list-view output: %s" % (out))
+
+    def _get_target_groups(self):
+        """Gets list of target groups from host."""
+        (out, _err) = self._run_ssh("pfexec /usr/sbin/stmfadm list-tg")
+        matches = _get_prefixed_values(out, 'Target group: ')
+        LOG.debug("target_groups=%s" % matches)
+        return matches
+
+    def _target_group_exists(self, target_group_name):
+        return target_group_name not in self._get_target_groups()
+
+    def _get_target_group_members(self, target_group_name):
+        (out, _err) = self._run_ssh("pfexec /usr/sbin/stmfadm list-tg -v %s" %
+                                    (target_group_name))
+        matches = _get_prefixed_values(out, 'Member: ')
+        LOG.debug("members of %s=%s" % (target_group_name, matches))
+        return matches
+
+    def _is_target_group_member(self, target_group_name, iscsi_target_name):
+        return iscsi_target_name in (
+            self._get_target_group_members(target_group_name))
+
+    def _get_iscsi_targets(self):
+        cmd = ("pfexec /usr/sbin/itadm list-target | "
+               "awk '{print $1}' | grep -v ^TARGET")
+        (out, _err) = self._run_ssh(cmd)
+        matches = _collect_lines(out)
+        LOG.debug("_get_iscsi_targets=%s" % (matches))
+        return matches
+
+    def _iscsi_target_exists(self, iscsi_target_name):
+        return iscsi_target_name in self._get_iscsi_targets()
+
+    def _build_zfs_poolname(self, volume):
+        #TODO(justinsb): rpool should be configurable
+        zfs_poolname = 'rpool/%s' % (volume['name'])
+        return zfs_poolname
+
+    def create_volume(self, volume):
+        """Creates a volume."""
+        if int(volume['size']) == 0:
+            sizestr = '100M'
+        else:
+            sizestr = '%sG' % volume['size']
+
+        zfs_poolname = self._build_zfs_poolname(volume)
+
+        thin_provision_arg = '-s' if FLAGS.san_thin_provision else ''
+        # Create a zfs volume
+        self._run_ssh("pfexec /usr/sbin/zfs create %s -V %s %s" %
+                      (thin_provision_arg,
+                       sizestr,
+                       zfs_poolname))
+
+    def _get_luid(self, volume):
+        zfs_poolname = self._build_zfs_poolname(volume)
+
+        cmd = ("pfexec /usr/sbin/sbdadm list-lu | "
+               "grep -w %s | awk '{print $1}'" %
+               (zfs_poolname))
+
+        (stdout, _stderr) = self._run_ssh(cmd)
+
+        luid = stdout.strip()
+        return luid
+
+    def _is_lu_created(self, volume):
+        luid = self._get_luid(volume)
+        return luid
+
+    def delete_volume(self, volume):
+        """Deletes a volume."""
+        zfs_poolname = self._build_zfs_poolname(volume)
+        self._run_ssh("pfexec /usr/sbin/zfs destroy %s" %
+                      (zfs_poolname))
+
+    def local_path(self, volume):
+        # TODO(justinsb): Is this needed here?
+        escaped_group = FLAGS.volume_group.replace('-', '--')
+        escaped_name = volume['name'].replace('-', '--')
+        return "/dev/mapper/%s-%s" % (escaped_group, escaped_name)
+
+    def ensure_export(self, context, volume):
+        """Synchronously recreates an export for a logical volume."""
+        #TODO(justinsb): On bootup, this is called for every volume.
+        # It then runs ~5 SSH commands for each volume,
+        # most of which fetch the same info each time
+        # This makes initial start stupid-slow
+        self._do_export(volume, force_create=False)
+
+    def create_export(self, context, volume):
+        self._do_export(volume, force_create=True)
+
+    def _do_export(self, volume, force_create):
+        # Create a Logical Unit (LU) backed by the zfs volume
+        zfs_poolname = self._build_zfs_poolname(volume)
+
+        if force_create or not self._is_lu_created(volume):
+            cmd = ("pfexec /usr/sbin/sbdadm create-lu /dev/zvol/rdsk/%s" %
+                   (zfs_poolname))
+            self._run_ssh(cmd)
+
+        luid = self._get_luid(volume)
+        iscsi_name = self._build_iscsi_target_name(volume)
+        target_group_name = 'tg-%s' % volume['name']
+
+        # Create a iSCSI target, mapped to just this volume
+        if force_create or not self._target_group_exists(target_group_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm create-tg %s" %
+                          (target_group_name))
+
+        # Yes, we add the initiatior before we create it!
+        # Otherwise, it complains that the target is already active
+        if force_create or not self._is_target_group_member(target_group_name,
+                                                            iscsi_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm add-tg-member -g %s %s" %
+                          (target_group_name, iscsi_name))
+        if force_create or not self._iscsi_target_exists(iscsi_name):
+            self._run_ssh("pfexec /usr/sbin/itadm create-target -n %s" %
+                          (iscsi_name))
+        if force_create or not self._view_exists(luid):
+            self._run_ssh("pfexec /usr/sbin/stmfadm add-view -t %s %s" %
+                          (target_group_name, luid))
+
+    def remove_export(self, context, volume):
+        """Removes an export for a logical volume."""
+
+        # This is the reverse of _do_export
+        luid = self._get_luid(volume)
+        iscsi_name = self._build_iscsi_target_name(volume)
+        target_group_name = 'tg-%s' % volume['name']
+
+        if self._view_exists(luid):
+            self._run_ssh("pfexec /usr/sbin/stmfadm remove-view -l %s -a" %
+                          (luid))
+
+        if self._iscsi_target_exists(iscsi_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm offline-target %s" %
+                          (iscsi_name))
+            self._run_ssh("pfexec /usr/sbin/itadm delete-target %s" %
+                          (iscsi_name))
+
+        # We don't delete the tg-member; we delete the whole tg!
+
+        if self._target_group_exists(target_group_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm delete-tg %s" %
+                          (target_group_name))
+
+        if self._is_lu_created(volume):
+            self._run_ssh("pfexec /usr/sbin/sbdadm delete-lu %s" %
+                          (luid))