Merge trunk

27 files changed, 683 insertions, 104 deletions

diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index ddcdc673c..1a06b3f01 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -21,7 +21,6 @@ Starting point for routing EC2 requests.
 """
 
 import datetime
-import routes
 import webob
 import webob.dec
 import webob.exc
@@ -233,7 +232,7 @@ class Authorizer(wsgi.Middleware):
         super(Authorizer, self).__init__(application)
         self.action_roles = {
             'CloudController': {
-                'DescribeAvailabilityzones': ['all'],
+                'DescribeAvailabilityZones': ['all'],
                 'DescribeRegions': ['all'],
                 'DescribeSnapshots': ['all'],
                 'DescribeKeyPairs': ['all'],
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 00d044e95..6919cd8d2 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -327,7 +327,9 @@ class CloudController(object):
         if not group_name is None:
             groups = [g for g in groups if g.name in group_name]
 
-        return {'securityGroupInfo': groups}
+        return {'securityGroupInfo':
+                list(sorted(groups,
+                            key=lambda k: (k['ownerId'], k['groupName'])))}
 
     def _format_security_group(self, context, group):
         g = {}
@@ -512,8 +514,11 @@ class CloudController(object):
     def get_console_output(self, context, instance_id, **kwargs):
         LOG.audit(_("Get console output for instance %s"), instance_id,
                   context=context)
-        # instance_id is passed in as a list of instances
-        ec2_id = instance_id[0]
+        # instance_id may be passed in as a list of instances
+        if type(instance_id) == list:
+            ec2_id = instance_id[0]
+        else:
+            ec2_id = instance_id
         instance_id = ec2_id_to_id(ec2_id)
         output = self.compute_api.get_console_output(
                 context, instance_id=instance_id)
@@ -836,11 +841,26 @@ class CloudController(object):
             self.compute_api.update(context, instance_id=instance_id, **kwargs)
         return True
 
+    def _format_image(self, context, image):
+        """Convert from format defined by BaseImageService to S3 format."""
+        i = {}
+        i['imageId'] = image.get('id')
+        i['kernelId'] = image.get('kernel_id')
+        i['ramdiskId'] = image.get('ramdisk_id')
+        i['imageOwnerId'] = image.get('owner_id')
+        i['imageLocation'] = image.get('location')
+        i['imageState'] = image.get('status')
+        i['type'] = image.get('type')
+        i['isPublic'] = image.get('is_public')
+        i['architecture'] = image.get('architecture')
+        return i
+
     def describe_images(self, context, image_id=None, **kwargs):
-        # Note: image_id is a list!
+        # NOTE: image_id is a list!
         images = self.image_service.index(context)
         if image_id:
-            images = filter(lambda x: x['imageId'] in image_id, images)
+            images = filter(lambda x: x['id'] in image_id, images)
+        images = [self._format_image(context, i) for i in images]
         return {'imagesSet': images}
 
     def deregister_image(self, context, image_id, **kwargs):
@@ -863,6 +883,9 @@ class CloudController(object):
                                      % attribute)
         try:
             image = self.image_service.show(context, image_id)
+            image = self._format_image(context,
+                                       self.image_service.show(context,
+                                                               image_id))
         except IndexError:
             raise exception.ApiError(_('invalid id: %s') % image_id)
         result = {'image_id': image_id, 'launchPermission': []}
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 486542eb7..e7d2f29ef 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -67,10 +67,10 @@ class API(base.Base):
         """Get the network topic for an instance."""
         try:
             instance = self.get(context, instance_id)
-        except exception.NotFound as e:
+        except exception.NotFound:
             LOG.warning(_("Instance %d was not found in get_network_topic"),
                         instance_id)
-            raise e
+            raise
 
         host = instance['host']
         if not host:
@@ -103,9 +103,9 @@ class API(base.Base):
         if not is_vpn:
             image = self.image_service.show(context, image_id)
             if kernel_id is None:
-                kernel_id = image.get('kernelId', None)
+                kernel_id = image.get('kernel_id', None)
             if ramdisk_id is None:
-                ramdisk_id = image.get('ramdiskId', None)
+                ramdisk_id = image.get('ramdisk_id', None)
             # No kernel and ramdisk for raw images
             if kernel_id == str(FLAGS.null_kernel):
                 kernel_id = None
@@ -303,10 +303,10 @@ class API(base.Base):
         LOG.debug(_("Going to try to terminate %s"), instance_id)
         try:
             instance = self.get(context, instance_id)
-        except exception.NotFound as e:
+        except exception.NotFound:
             LOG.warning(_("Instance %d was not found during terminate"),
                         instance_id)
-            raise e
+            raise
 
         if (instance['state_description'] == 'terminating'):
             LOG.warning(_("Instance %d is already being terminated"),
diff --git a/nova/compute/instance_types.py b/nova/compute/instance_types.py
index 196d6a8df..309313fd0 100644
--- a/nova/compute/instance_types.py
+++ b/nova/compute/instance_types.py
@@ -38,8 +38,8 @@ def get_by_type(instance_type):
     if instance_type is None:
         return FLAGS.default_instance_type
     if instance_type not in INSTANCE_TYPES:
-        raise exception.ApiError(_("Unknown instance type: %s"),
-                                 instance_type)
+        raise exception.ApiError(_("Unknown instance type: %s") % \
+                                 instance_type, "Invalid")
     return instance_type
 
 
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index 63fecb611..d3d8a617e 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -127,7 +127,7 @@ class ComputeManager(manager.Manager):
             info = self.driver.get_info(instance_ref['name'])
             state = info['state']
         except exception.NotFound:
-            state = power_state.NOSTATE
+            state = power_state.FAILED
         self.db.instance_set_state(context, instance_id, state)
 
     def get_console_topic(self, context, **_kwargs):
diff --git a/nova/compute/power_state.py b/nova/compute/power_state.py
index 37039d2ec..adfc2dff0 100644
--- a/nova/compute/power_state.py
+++ b/nova/compute/power_state.py
@@ -27,6 +27,7 @@ SHUTDOWN = 0x04
 SHUTOFF = 0x05
 CRASHED = 0x06
 SUSPENDED = 0x07
+FAILED = 0x08
 
 
 def name(code):
@@ -38,5 +39,6 @@ def name(code):
         SHUTDOWN: 'shutdown',
         SHUTOFF: 'shutdown',
         CRASHED: 'crashed',
-        SUSPENDED: 'suspended'}
+        SUSPENDED: 'suspended',
+        FAILED: 'failed to spawn'}
     return d[code]
diff --git a/nova/context.py b/nova/context.py
index f2669c9f1..0256bf448 100644
--- a/nova/context.py
+++ b/nova/context.py
@@ -28,7 +28,6 @@ from nova import utils
 
 
 class RequestContext(object):
-
     def __init__(self, user, project, is_admin=None, read_deleted=False,
                  remote_address=None, timestamp=None, request_id=None):
         if hasattr(user, 'id'):
@@ -53,7 +52,7 @@ class RequestContext(object):
         self.read_deleted = read_deleted
         self.remote_address = remote_address
         if not timestamp:
-            timestamp = datetime.datetime.utcnow()
+            timestamp = utils.utcnow()
         if isinstance(timestamp, str) or isinstance(timestamp, unicode):
             timestamp = utils.parse_isotime(timestamp)
         self.timestamp = timestamp
@@ -101,7 +100,7 @@ class RequestContext(object):
         return cls(**values)
 
     def elevated(self, read_deleted=False):
-        """Return a version of this context with admin flag set"""
+        """Return a version of this context with admin flag set."""
         return RequestContext(self.user_id,
                               self.project_id,
                               True,
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index 78efaa245..e2523e251 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -19,6 +19,7 @@
 Implementation of SQLAlchemy backend.
 """
 
+import datetime
 import warnings
 
 from nova import db
@@ -578,7 +579,7 @@ def fixed_ip_disassociate_all_by_timeout(_context, host, time):
                              'AND instance_id IS NOT NULL '
                              'AND allocated = 0',
                     {'host': host,
-                     'time': time.isoformat()})
+                     'time': time})
     return result.rowcount
 
 
@@ -670,8 +671,14 @@ def instance_data_get_for_project(context, project_id):
 def instance_destroy(context, instance_id):
     session = get_session()
     with session.begin():
-        instance_ref = instance_get(context, instance_id, session=session)
-        instance_ref.delete(session=session)
+        session.execute('update instances set deleted=1,'
+                        'deleted_at=:at where id=:id',
+                        {'id': instance_id,
+                         'at': datetime.datetime.utcnow()})
+        session.execute('update security_group_instance_association '
+                        'set deleted=1,deleted_at=:at where instance_id=:id',
+                        {'id': instance_id,
+                         'at': datetime.datetime.utcnow()})
 
 
 @require_context
@@ -712,6 +719,7 @@ def instance_get_all(context):
     return session.query(models.Instance).\
                    options(joinedload_all('fixed_ip.floating_ips')).\
                    options(joinedload('security_groups')).\
+                   options(joinedload_all('fixed_ip.network')).\
                    filter_by(deleted=can_read_deleted(context)).\
                    all()
 
@@ -722,6 +730,7 @@ def instance_get_all_by_user(context, user_id):
     return session.query(models.Instance).\
                    options(joinedload_all('fixed_ip.floating_ips')).\
                    options(joinedload('security_groups')).\
+                   options(joinedload_all('fixed_ip.network')).\
                    filter_by(deleted=can_read_deleted(context)).\
                    filter_by(user_id=user_id).\
                    all()
@@ -733,6 +742,7 @@ def instance_get_all_by_host(context, host):
     return session.query(models.Instance).\
                    options(joinedload_all('fixed_ip.floating_ips')).\
                    options(joinedload('security_groups')).\
+                   options(joinedload_all('fixed_ip.network')).\
                    filter_by(host=host).\
                    filter_by(deleted=can_read_deleted(context)).\
                    all()
@@ -746,6 +756,7 @@ def instance_get_all_by_project(context, project_id):
     return session.query(models.Instance).\
                    options(joinedload_all('fixed_ip.floating_ips')).\
                    options(joinedload('security_groups')).\
+                   options(joinedload_all('fixed_ip.network')).\
                    filter_by(project_id=project_id).\
                    filter_by(deleted=can_read_deleted(context)).\
                    all()
@@ -759,6 +770,7 @@ def instance_get_all_by_reservation(context, reservation_id):
         return session.query(models.Instance).\
                        options(joinedload_all('fixed_ip.floating_ips')).\
                        options(joinedload('security_groups')).\
+                       options(joinedload_all('fixed_ip.network')).\
                        filter_by(reservation_id=reservation_id).\
                        filter_by(deleted=can_read_deleted(context)).\
                        all()
@@ -766,6 +778,7 @@ def instance_get_all_by_reservation(context, reservation_id):
         return session.query(models.Instance).\
                        options(joinedload_all('fixed_ip.floating_ips')).\
                        options(joinedload('security_groups')).\
+                       options(joinedload_all('fixed_ip.network')).\
                        filter_by(project_id=context.project_id).\
                        filter_by(reservation_id=reservation_id).\
                        filter_by(deleted=False).\
@@ -1583,6 +1596,11 @@ def security_group_destroy(context, security_group_id):
         # TODO(vish): do we have to use sql here?
         session.execute('update security_groups set deleted=1 where id=:id',
                         {'id': security_group_id})
+        session.execute('update security_group_instance_association '
+                        'set deleted=1,deleted_at=:at '
+                        'where security_group_id=:id',
+                        {'id': security_group_id,
+                         'at': datetime.datetime.utcnow()})
         session.execute('update security_group_rules set deleted=1 '
                         'where group_id=:id',
                         {'id': security_group_id})
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index 94dc03c5c..6d9326344 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -311,10 +311,14 @@ class SecurityGroup(BASE, NovaBase):
                              secondary="security_group_instance_association",
                              primaryjoin='and_('
         'SecurityGroup.id == '
-            'SecurityGroupInstanceAssociation.security_group_id,'
+        'SecurityGroupInstanceAssociation.security_group_id,'
+        'SecurityGroupInstanceAssociation.deleted == False,'
         'SecurityGroup.deleted == False)',
                              secondaryjoin='and_('
         'SecurityGroupInstanceAssociation.instance_id == Instance.id,'
+        # (anthony) the condition below shouldn't be necessary now that the
+        # association is being marked as deleted.  However, removing this
+        # may cause existing deployments to choke, so I'm leaving it
         'Instance.deleted == False)',
                              backref='security_groups')
 
diff --git a/nova/db/sqlalchemy/session.py b/nova/db/sqlalchemy/session.py
index dc885f138..4a9a28f43 100644
--- a/nova/db/sqlalchemy/session.py
+++ b/nova/db/sqlalchemy/session.py
@@ -20,6 +20,7 @@ Session Handling for SQLAlchemy backend
 """
 
 from sqlalchemy import create_engine
+from sqlalchemy import pool
 from sqlalchemy.orm import sessionmaker
 
 from nova import exception
@@ -37,9 +38,14 @@ def get_session(autocommit=True, expire_on_commit=False):
     global _MAKER
     if not _MAKER:
         if not _ENGINE:
+            kwargs = {'pool_recycle': FLAGS.sql_idle_timeout,
+                      'echo': False}
+
+            if FLAGS.sql_connection.startswith('sqlite'):
+                kwargs['poolclass'] = pool.NullPool
+
             _ENGINE = create_engine(FLAGS.sql_connection,
-                                    pool_recycle=FLAGS.sql_idle_timeout,
-                                    echo=False)
+                                    **kwargs)
         _MAKER = (sessionmaker(bind=_ENGINE,
                                 autocommit=autocommit,
                                 expire_on_commit=expire_on_commit))
diff --git a/nova/flags.py b/nova/flags.py
index 43bc174d2..3ba3fe6fa 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -208,7 +208,7 @@ def _get_my_ip():
         (addr, port) = csock.getsockname()
         csock.close()
         return addr
-    except socket.gaierror as ex:
+    except socket.error as ex:
         return "127.0.0.1"
 
 
@@ -286,8 +286,8 @@ DEFINE_string('state_path', os.path.join(os.path.dirname(__file__), '../'),
 DEFINE_string('sql_connection',
               'sqlite:///$state_path/nova.sqlite',
               'connection string for sql database')
-DEFINE_string('sql_idle_timeout',
-              '3600',
+DEFINE_integer('sql_idle_timeout',
+              3600,
               'timeout for idle sql database connections')
 DEFINE_integer('sql_max_retries', 12, 'sql connection attempts')
 DEFINE_integer('sql_retry_interval', 10, 'sql connection retry interval')
diff --git a/nova/image/s3.py b/nova/image/s3.py
index 08a40f191..14135a1ee 100644
--- a/nova/image/s3.py
+++ b/nova/image/s3.py
@@ -36,6 +36,22 @@ from nova.image import service
 FLAGS = flags.FLAGS
 
 
+def map_s3_to_base(image):
+    """Convert from S3 format to format defined by BaseImageService."""
+    i = {}
+    i['id'] = image.get('imageId')
+    i['name'] = image.get('imageId')
+    i['kernel_id'] = image.get('kernelId')
+    i['ramdisk_id'] = image.get('ramdiskId')
+    i['location'] = image.get('imageLocation')
+    i['owner_id'] = image.get('imageOwnerId')
+    i['status'] = image.get('imageState')
+    i['type'] = image.get('type')
+    i['is_public'] = image.get('isPublic')
+    i['architecture'] = image.get('architecture')
+    return i
+
+
 class S3ImageService(service.BaseImageService):
 
     def modify(self, context, image_id, operation):
@@ -65,26 +81,20 @@ class S3ImageService(service.BaseImageService):
                                  'image_id': image_id}))
         return image_id
 
-    def _fix_image_id(self, images):
-        """S3 has imageId but OpenStack wants id"""
-        for image in images:
-            if 'imageId' in image:
-                image['id'] = image['imageId']
-        return images
-
     def index(self, context):
         """Return a list of all images that a user can see."""
         response = self._conn(context).make_request(
             method='GET',
             bucket='_images')
-        return self._fix_image_id(json.loads(response.read()))
+        images = json.loads(response.read())
+        return [map_s3_to_base(i) for i in images]
 
     def show(self, context, image_id):
         """return a image object if the context has permissions"""
         if FLAGS.connection_type == 'fake':
             return {'imageId': 'bar'}
         result = self.index(context)
-        result = [i for i in result if i['imageId'] == image_id]
+        result = [i for i in result if i['id'] == image_id]
         if not result:
             raise exception.NotFound(_('Image %s could not be found')
                                      % image_id)
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index cdd1f666a..c1cbff7d8 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -20,6 +20,7 @@ Implements vlans, bridges, and iptables rules using linux utilities.
 import os
 
 from nova import db
+from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import utils
@@ -37,6 +38,9 @@ FLAGS = flags.FLAGS
 flags.DEFINE_string('dhcpbridge_flagfile',
                     '/etc/nova/nova-dhcpbridge.conf',
                     'location of flagfile for dhcpbridge')
+flags.DEFINE_string('dhcp_domain',
+                    'novalocal',
+                    'domain to use for building the hostnames')
 
 flags.DEFINE_string('networks_path', '$state_path/networks',
                     'Location to keep network config files')
@@ -50,6 +54,8 @@ flags.DEFINE_string('routing_source_ip', '$my_ip',
                     'Public IP of network host')
 flags.DEFINE_bool('use_nova_chains', False,
                   'use the nova_ routing chains instead of default')
+flags.DEFINE_string('input_chain', 'INPUT',
+                    'chain to add nova_input to')
 
 flags.DEFINE_string('dns_server', None,
                     'if set, uses specific dns server for dnsmasq')
@@ -152,6 +158,8 @@ def ensure_floating_forward(floating_ip, fixed_ip):
     """Ensure floating ip forwarding rule"""
     _confirm_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
                            % (floating_ip, fixed_ip))
+    _confirm_rule("OUTPUT", "-t nat -d %s -j DNAT --to %s"
+                           % (floating_ip, fixed_ip))
     _confirm_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
                            % (fixed_ip, floating_ip))
 
@@ -160,6 +168,8 @@ def remove_floating_forward(floating_ip, fixed_ip):
     """Remove forwarding for floating ip"""
     _remove_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
                           % (floating_ip, fixed_ip))
+    _remove_rule("OUTPUT", "-t nat -d %s -j DNAT --to %s"
+                          % (floating_ip, fixed_ip))
     _remove_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
                           % (fixed_ip, floating_ip))
 
@@ -177,32 +187,77 @@ def ensure_vlan(vlan_num):
         LOG.debug(_("Starting VLAN inteface %s"), interface)
         _execute("sudo vconfig set_name_type VLAN_PLUS_VID_NO_PAD")
         _execute("sudo vconfig add %s %s" % (FLAGS.vlan_interface, vlan_num))
-        _execute("sudo ifconfig %s up" % interface)
+        _execute("sudo ip link set %s up" % interface)
     return interface
 
 
 def ensure_bridge(bridge, interface, net_attrs=None):
-    """Create a bridge unless it already exists"""
+    """Create a bridge unless it already exists.
+
+    :param interface: the interface to create the bridge on.
+    :param net_attrs: dictionary with  attributes used to create the bridge.
+
+    If net_attrs is set, it will add the net_attrs['gateway'] to the bridge
+    using net_attrs['broadcast'] and net_attrs['cidr'].  It will also add
+    the ip_v6 address specified in net_attrs['cidr_v6'] if use_ipv6 is set.
+
+    The code will attempt to move any ips that already exist on the interface
+    onto the bridge and reset the default gateway if necessary.
+    """
     if not _device_exists(bridge):
         LOG.debug(_("Starting Bridge interface for %s"), interface)
         _execute("sudo brctl addbr %s" % bridge)
         _execute("sudo brctl setfd %s 0" % bridge)
         # _execute("sudo brctl setageing %s 10" % bridge)
         _execute("sudo brctl stp %s off" % bridge)
-        if interface:
-            _execute("sudo brctl addif %s %s" % (bridge, interface))
+        _execute("sudo ip link set %s up" % bridge)
     if net_attrs:
-        _execute("sudo ifconfig %s %s broadcast %s netmask %s up" % \
-                (bridge,
-                 net_attrs['gateway'],
-                 net_attrs['broadcast'],
-                 net_attrs['netmask']))
+        # NOTE(vish): The ip for dnsmasq has to be the first address on the
+        #             bridge for it to respond to reqests properly
+        suffix = net_attrs['cidr'].rpartition('/')[2]
+        out, err = _execute("sudo ip addr add %s/%s brd %s dev %s" %
+                            (net_attrs['gateway'],
+                             suffix,
+                             net_attrs['broadcast'],
+                             bridge),
+                            check_exit_code=False)
+        if err and err != "RTNETLINK answers: File exists\n":
+            raise exception.Error("Failed to add ip: %s" % err)
         if(FLAGS.use_ipv6):
             _execute("sudo ip -f inet6 addr change %s dev %s" %
                      (net_attrs['cidr_v6'], bridge))
-            _execute("sudo ifconfig %s up" % bridge)
-    else:
-        _execute("sudo ifconfig %s up" % bridge)
+        # NOTE(vish): If the public interface is the same as the
+        #             bridge, then the bridge has to be in promiscuous
+        #             to forward packets properly.
+        if(FLAGS.public_interface == bridge):
+            _execute("sudo ip link set dev %s promisc on" % bridge)
+    if interface:
+        # NOTE(vish): This will break if there is already an ip on the
+        #             interface, so we move any ips to the bridge
+        gateway = None
+        out, err = _execute("sudo route -n")
+        for line in out.split("\n"):
+            fields = line.split()
+            if fields and fields[0] == "0.0.0.0" and fields[-1] == interface:
+                gateway = fields[1]
+        out, err = _execute("sudo ip addr show dev %s scope global" %
+                            interface)
+        for line in out.split("\n"):
+            fields = line.split()
+            if fields and fields[0] == "inet":
+                params = ' '.join(fields[1:-1])
+                _execute("sudo ip addr del %s dev %s" % (params, fields[-1]))
+                _execute("sudo ip addr add %s dev %s" % (params, bridge))
+        if gateway:
+            _execute("sudo route add 0.0.0.0 gw %s" % gateway)
+        out, err = _execute("sudo brctl addif %s %s" %
+                            (bridge, interface),
+                            check_exit_code=False)
+
+        if (err and err != "device %s is already a member of a bridge; can't "
+                           "enslave it to bridge %s.\n" % (interface, bridge)):
+            raise exception.Error("Failed to add interface: %s" % err)
+
     if FLAGS.use_nova_chains:
         (out, err) = _execute("sudo iptables -N nova_forward",
                               check_exit_code=False)
@@ -313,8 +368,9 @@ interface %s
 def _host_dhcp(fixed_ip_ref):
     """Return a host string for an address"""
     instance_ref = fixed_ip_ref['instance']
-    return "%s,%s.novalocal,%s" % (instance_ref['mac_address'],
+    return "%s,%s.%s,%s" % (instance_ref['mac_address'],
                                    instance_ref['hostname'],
+                                   FLAGS.dhcp_domain,
                                    fixed_ip_ref['address'])
 
 
@@ -329,7 +385,8 @@ def _execute(cmd, *args, **kwargs):
 
 def _device_exists(device):
     """Check if ethernet device exists"""
-    (_out, err) = _execute("ifconfig %s" % device, check_exit_code=False)
+    (_out, err) = _execute("ip link show dev %s" % device,
+                           check_exit_code=False)
     return not err
 
 
@@ -359,6 +416,7 @@ def _dnsmasq_cmd(net):
            ' --strict-order',
            ' --bind-interfaces',
            ' --conf-file=',
+           ' --domain=%s' % FLAGS.dhcp_domain,
            ' --pid-file=%s' % _dhcp_file(net['bridge'], 'pid'),
            ' --listen-address=%s' % net['gateway'],
            ' --except-interface=lo',
diff --git a/nova/network/manager.py b/nova/network/manager.py
index fbcbea131..8eb9f041b 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -118,6 +118,10 @@ class NetworkManager(manager.Manager):
         super(NetworkManager, self).__init__(*args, **kwargs)
 
     def init_host(self):
+        """Do any initialization that needs to be run if this is a
+        standalone service.
+        """
+        self.driver.init_host()
         # Set up networking for the projects for which we're already
         # the designated network host.
         ctxt = context.get_admin_context()
@@ -395,7 +399,6 @@ class FlatDHCPManager(FlatManager):
         standalone service.
         """
         super(FlatDHCPManager, self).init_host()
-        self.driver.init_host()
         self.driver.metadata_forward()
 
     def setup_compute_network(self, context, instance_id):
@@ -465,7 +468,6 @@ class VlanManager(NetworkManager):
         standalone service.
         """
         super(VlanManager, self).init_host()
-        self.driver.init_host()
         self.driver.metadata_forward()
 
     def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
diff --git a/nova/rpc.py b/nova/rpc.py
index 01fc6d44b..2b1f7298b 100644
--- a/nova/rpc.py
+++ b/nova/rpc.py
@@ -46,7 +46,7 @@ LOG = logging.getLogger('nova.rpc')
 class Connection(carrot_connection.BrokerConnection):
     """Connection instance object"""
     @classmethod
-    def instance(cls, new=False):
+    def instance(cls, new=True):
         """Returns the instance"""
         if new or not hasattr(cls, '_instance'):
             params = dict(hostname=FLAGS.rabbit_host,
@@ -246,7 +246,7 @@ def msg_reply(msg_id, reply=None, failure=None):
         LOG.error(_("Returning exception %s to caller"), message)
         LOG.error(tb)
         failure = (failure[0].__name__, str(failure[1]), tb)
-    conn = Connection.instance(True)
+    conn = Connection.instance()
     publisher = DirectPublisher(connection=conn, msg_id=msg_id)
     try:
         publisher.send({'result': reply, 'failure': failure})
@@ -319,7 +319,7 @@ def call(context, topic, msg):
                 self.result = data['result']
 
     wait_msg = WaitMessage()
-    conn = Connection.instance(True)
+    conn = Connection.instance()
     consumer = DirectConsumer(connection=conn, msg_id=msg_id)
     consumer.register_callback(wait_msg)
 
diff --git a/nova/tests/test_api.py b/nova/tests/test_api.py
index 2569e262b..fa27825cd 100644
--- a/nova/tests/test_api.py
+++ b/nova/tests/test_api.py
@@ -248,16 +248,14 @@ class ApiEc2TestCase(test.TestCase):
         self.mox.ReplayAll()
 
         rv = self.ec2.get_all_security_groups()
-        # I don't bother checkng that we actually find it here,
-        # because the create/delete unit test further up should
-        # be good enough for that.
-        for group in rv:
-            if group.name == security_group_name:
-                self.assertEquals(len(group.rules), 1)
-                self.assertEquals(int(group.rules[0].from_port), 80)
-                self.assertEquals(int(group.rules[0].to_port), 81)
-                self.assertEquals(len(group.rules[0].grants), 1)
-                self.assertEquals(str(group.rules[0].grants[0]), '0.0.0.0/0')
+
+        group = [grp for grp in rv if grp.name == security_group_name][0]
+
+        self.assertEquals(len(group.rules), 1)
+        self.assertEquals(int(group.rules[0].from_port), 80)
+        self.assertEquals(int(group.rules[0].to_port), 81)
+        self.assertEquals(len(group.rules[0].grants), 1)
+        self.assertEquals(str(group.rules[0].grants[0]), '0.0.0.0/0')
 
         self.expect_http()
         self.mox.ReplayAll()
@@ -314,16 +312,13 @@ class ApiEc2TestCase(test.TestCase):
         self.mox.ReplayAll()
 
         rv = self.ec2.get_all_security_groups()
-        # I don't bother checkng that we actually find it here,
-        # because the create/delete unit test further up should
-        # be good enough for that.
-        for group in rv:
-            if group.name == security_group_name:
-                self.assertEquals(len(group.rules), 1)
-                self.assertEquals(int(group.rules[0].from_port), 80)
-                self.assertEquals(int(group.rules[0].to_port), 81)
-                self.assertEquals(len(group.rules[0].grants), 1)
-                self.assertEquals(str(group.rules[0].grants[0]), '::/0')
+
+        group = [grp for grp in rv if grp.name == security_group_name][0]
+        self.assertEquals(len(group.rules), 1)
+        self.assertEquals(int(group.rules[0].from_port), 80)
+        self.assertEquals(int(group.rules[0].to_port), 81)
+        self.assertEquals(len(group.rules[0].grants), 1)
+        self.assertEquals(str(group.rules[0].grants[0]), '::/0')
 
         self.expect_http()
         self.mox.ReplayAll()
diff --git a/nova/tests/test_compute.py b/nova/tests/test_compute.py
index 09f6ee94a..2aa0690e7 100644
--- a/nova/tests/test_compute.py
+++ b/nova/tests/test_compute.py
@@ -49,7 +49,7 @@ class ComputeTestCase(test.TestCase):
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('fake', 'fake', 'fake')
         self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.get_admin_context()
+        self.context = context.RequestContext('fake', 'fake', False)
 
     def tearDown(self):
         self.manager.delete_user(self.user)
@@ -69,6 +69,13 @@ class ComputeTestCase(test.TestCase):
         inst['ami_launch_index'] = 0
         return db.instance_create(self.context, inst)['id']
 
+    def _create_group(self):
+        values = {'name': 'testgroup',
+                  'description': 'testgroup',
+                  'user_id': self.user.id,
+                  'project_id': self.project.id}
+        return db.security_group_create(self.context, values)
+
     def test_create_instance_defaults_display_name(self):
         """Verify that an instance cannot be created without a display_name."""
         cases = [dict(), dict(display_name=None)]
@@ -82,21 +89,53 @@ class ComputeTestCase(test.TestCase):
 
     def test_create_instance_associates_security_groups(self):
         """Make sure create associates security groups"""
-        values = {'name': 'default',
-                  'description': 'default',
-                  'user_id': self.user.id,
-                  'project_id': self.project.id}
-        group = db.security_group_create(self.context, values)
+        group = self._create_group()
         ref = self.compute_api.create(
                 self.context,
                 instance_type=FLAGS.default_instance_type,
                 image_id=None,
-                security_group=['default'])
+                security_group=['testgroup'])
         try:
             self.assertEqual(len(db.security_group_get_by_instance(
-                self.context, ref[0]['id'])), 1)
+                             self.context, ref[0]['id'])), 1)
+            group = db.security_group_get(self.context, group['id'])
+            self.assert_(len(group.instances) == 1)
+        finally:
+            db.security_group_destroy(self.context, group['id'])
+            db.instance_destroy(self.context, ref[0]['id'])
+
+    def test_destroy_instance_disassociates_security_groups(self):
+        """Make sure destroying disassociates security groups"""
+        group = self._create_group()
+
+        ref = self.compute_api.create(
+                self.context,
+                instance_type=FLAGS.default_instance_type,
+                image_id=None,
+                security_group=['testgroup'])
+        try:
+            db.instance_destroy(self.context, ref[0]['id'])
+            group = db.security_group_get(self.context, group['id'])
+            self.assert_(len(group.instances) == 0)
         finally:
             db.security_group_destroy(self.context, group['id'])
+
+    def test_destroy_security_group_disassociates_instances(self):
+        """Make sure destroying security groups disassociates instances"""
+        group = self._create_group()
+
+        ref = self.compute_api.create(
+                self.context,
+                instance_type=FLAGS.default_instance_type,
+                image_id=None,
+                security_group=['testgroup'])
+
+        try:
+            db.security_group_destroy(self.context, group['id'])
+            group = db.security_group_get(context.get_admin_context(
+                                          read_deleted=True), group['id'])
+            self.assert_(len(group.instances) == 0)
+        finally:
             db.instance_destroy(self.context, ref[0]['id'])
 
     def test_run_terminate(self):
diff --git a/nova/tests/test_xenapi.py b/nova/tests/test_xenapi.py
index 9f5b266f3..d5660c5d1 100644
--- a/nova/tests/test_xenapi.py
+++ b/nova/tests/test_xenapi.py
@@ -243,7 +243,8 @@ class XenAPIVMTestCase(test.TestCase):
         # Check that the VM is running according to XenAPI.
         self.assertEquals(vm['power_state'], 'Running')
 
-    def _test_spawn(self, image_id, kernel_id, ramdisk_id):
+    def _test_spawn(self, image_id, kernel_id, ramdisk_id,
+                    instance_type="m1.large"):
         stubs.stubout_session(self.stubs, stubs.FakeSessionForVMTests)
         values = {'name': 1,
                   'id': 1,
@@ -252,7 +253,7 @@ class XenAPIVMTestCase(test.TestCase):
                   'image_id': image_id,
                   'kernel_id': kernel_id,
                   'ramdisk_id': ramdisk_id,
-                  'instance_type': 'm1.large',
+                  'instance_type': instance_type,
                   'mac_address': 'aa:bb:cc:dd:ee:ff',
                   }
         conn = xenapi_conn.get_connection(False)
@@ -260,6 +261,12 @@ class XenAPIVMTestCase(test.TestCase):
         conn.spawn(instance)
         self.check_vm_record(conn)
 
+    def test_spawn_not_enough_memory(self):
+        FLAGS.xenapi_image_service = 'glance'
+        self.assertRaises(Exception,
+                          self._test_spawn,
+                          1, 2, 3, "m1.xlarge")
+
     def test_spawn_raw_objectstore(self):
         FLAGS.xenapi_image_service = 'objectstore'
         self._test_spawn(1, None, None)
diff --git a/nova/utils.py b/nova/utils.py
index 5f5225289..ba71ebf39 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -25,7 +25,6 @@ import inspect
 import json
 import os
 import random
-import subprocess
 import socket
 import struct
 import sys
@@ -36,6 +35,7 @@ import netaddr
 
 from eventlet import event
 from eventlet import greenthread
+from eventlet.green import subprocess
 
 from nova import exception
 from nova.exception import ProcessExecutionError
@@ -152,6 +152,42 @@ def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
     return result
 
 
+def ssh_execute(ssh, cmd, process_input=None,
+                addl_env=None, check_exit_code=True):
+    LOG.debug(_("Running cmd (SSH): %s"), cmd)
+    if addl_env:
+        raise exception.Error("Environment not supported over SSH")
+
+    if process_input:
+        # This is (probably) fixable if we need it...
+        raise exception.Error("process_input not supported over SSH")
+
+    stdin_stream, stdout_stream, stderr_stream = ssh.exec_command(cmd)
+    channel = stdout_stream.channel
+
+    #stdin.write('process_input would go here')
+    #stdin.flush()
+
+    # NOTE(justinsb): This seems suspicious...
+    # ...other SSH clients have buffering issues with this approach
+    stdout = stdout_stream.read()
+    stderr = stderr_stream.read()
+    stdin_stream.close()
+
+    exit_status = channel.recv_exit_status()
+
+    # exit_status == -1 if no exit code was returned
+    if exit_status != -1:
+        LOG.debug(_("Result was %s") % exit_status)
+        if check_exit_code and exit_status != 0:
+            raise exception.ProcessExecutionError(exit_code=exit_status,
+                                                  stdout=stdout,
+                                                  stderr=stderr,
+                                                  cmd=cmd)
+
+    return (stdout, stderr)
+
+
 def abspath(s):
     return os.path.join(os.path.dirname(__file__), s)
 
diff --git a/nova/version.py b/nova/version.py
index 7b27acb6a..c3ecc2245 100644
--- a/nova/version.py
+++ b/nova/version.py
@@ -21,7 +21,7 @@ except ImportError:
                     'revision_id': 'LOCALREVISION',
                     'revno': 0}
 
-NOVA_VERSION = ['2011', '1']
+NOVA_VERSION = ['2011', '2']
 YEAR, COUNT = NOVA_VERSION
 
 FINAL = False   # This becomes true at Release Candidate time
diff --git a/nova/virt/xenapi/fake.py b/nova/virt/xenapi/fake.py
index e8352771c..018d0dcd3 100644
--- a/nova/virt/xenapi/fake.py
+++ b/nova/virt/xenapi/fake.py
@@ -286,6 +286,10 @@ class SessionBase(object):
         rec['currently_attached'] = False
         rec['device'] = ''
 
+    def host_compute_free_memory(self, _1, ref):
+        #Always return 12GB available
+        return 12 * 1024 * 1024 * 1024
+
     def xenapi_request(self, methodname, params):
         if methodname.startswith('login'):
             self._login(methodname, params)
diff --git a/nova/virt/xenapi/vm_utils.py b/nova/virt/xenapi/vm_utils.py
index 4bbd522c1..574ef0944 100644
--- a/nova/virt/xenapi/vm_utils.py
+++ b/nova/virt/xenapi/vm_utils.py
@@ -139,6 +139,16 @@ class VMHelper(HelperBase):
         return vm_ref
 
     @classmethod
+    def ensure_free_mem(cls, session, instance):
+        instance_type = instance_types.INSTANCE_TYPES[instance.instance_type]
+        mem = long(instance_type['memory_mb']) * 1024 * 1024
+        #get free memory from host
+        host = session.get_xenapi_host()
+        host_free_mem = long(session.get_xenapi().host.
+                             compute_free_memory(host))
+        return host_free_mem >= mem
+
+    @classmethod
     def create_vbd(cls, session, vm_ref, vdi_ref, userdevice, bootable):
         """Create a VBD record.  Returns a Deferred that gives the new
         VBD reference."""
@@ -440,6 +450,14 @@ class VMHelper(HelperBase):
                 return None
 
     @classmethod
+    def lookup_kernel_ramdisk(cls, session, vm):
+        vm_rec = session.get_xenapi().VM.get_record(vm)
+        if 'PV_kernel' in vm_rec and 'PV_ramdisk' in vm_rec:
+            return (vm_rec['PV_kernel'], vm_rec['PV_ramdisk'])
+        else:
+            return (None, None)
+
+    @classmethod
     def compile_info(cls, record):
         """Fill record with VM status information"""
         LOG.info(_("(VM_UTILS) xenserver vm state -> |%s|"),
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index e84ce20c4..98f8ab46e 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -66,7 +66,15 @@ class VMOps(object):
         if vm is not None:
             raise exception.Duplicate(_('Attempted to create'
             ' non-unique name %s') % instance.name)
-
+        #ensure enough free memory is available
+        if not VMHelper.ensure_free_mem(self._session, instance):
+                name = instance['name']
+                LOG.exception(_('instance %(name)s: not enough free memory')
+                              % locals())
+                db.instance_set_state(context.get_admin_context(),
+                                      instance['id'],
+                                      power_state.SHUTDOWN)
+                return
         bridge = db.network_get_by_instance(context.get_admin_context(),
                                             instance['id'])['bridge']
         network_ref = \
@@ -161,7 +169,8 @@ class VMOps(object):
                 instance_name = instance_or_vm.name
         vm = VMHelper.lookup(self._session, instance_name)
         if vm is None:
-            raise Exception(_('Instance not present %s') % instance_name)
+            raise exception.NotFound(
+                            _('Instance not present %s') % instance_name)
         return vm
 
     def snapshot(self, instance, image_id):
@@ -286,8 +295,23 @@ class VMOps(object):
     def _destroy_vm(self, instance, vm):
         """Destroys a VM record """
         try:
-            task = self._session.call_xenapi('Async.VM.destroy', vm)
-            self._session.wait_for_task(instance.id, task)
+            kernel = None
+            ramdisk = None
+            if instance.kernel_id or instance.ramdisk_id:
+                (kernel, ramdisk) = VMHelper.lookup_kernel_ramdisk(
+                                    self._session, vm)
+            task1 = self._session.call_xenapi('Async.VM.destroy', vm)
+            LOG.debug(_("Removing kernel/ramdisk files"))
+            fn = "remove_kernel_ramdisk"
+            args = {}
+            if kernel:
+                args['kernel-file'] = kernel
+            if ramdisk:
+                args['ramdisk-file'] = ramdisk
+            task2 = self._session.async_call_plugin('glance', fn, args)
+            self._session.wait_for_task(instance.id, task1)
+            self._session.wait_for_task(instance.id, task2)
+            LOG.debug(_("kernel/ramdisk files removed"))
         except self.XenAPI.Failure, exc:
             LOG.exception(exc)
 
diff --git a/nova/volume/api.py b/nova/volume/api.py
index 0bcd8a3b0..478c83486 100644
--- a/nova/volume/api.py
+++ b/nova/volume/api.py
@@ -45,7 +45,7 @@ class API(base.Base):
             LOG.warn(_("Quota exceeeded for %(pid)s, tried to create"
                     " %(size)sG volume") % locals())
             raise quota.QuotaError(_("Volume quota exceeded. You cannot "
-                    "create a volume of size %s") % size)
+                                     "create a volume of size %sG") % size)
 
         options = {
             'size': size,
diff --git a/nova/volume/driver.py b/nova/volume/driver.py
index da7307733..82f4c2f54 100644
--- a/nova/volume/driver.py
+++ b/nova/volume/driver.py
@@ -294,8 +294,10 @@ class ISCSIDriver(VolumeDriver):
         self._execute("sudo ietadm --op delete --tid=%s" %
                       iscsi_target)
 
-    def _get_name_and_portal(self, volume_name, host):
+    def _get_name_and_portal(self, volume):
         """Gets iscsi name and portal from volume name and host."""
+        volume_name = volume['name']
+        host = volume['host']
         (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
                                     "sendtargets -p %s" % host)
         for target in out.splitlines():
@@ -307,8 +309,7 @@ class ISCSIDriver(VolumeDriver):
 
     def discover_volume(self, volume):
         """Discover volume on a remote host."""
-        iscsi_name, iscsi_portal = self._get_name_and_portal(volume['name'],
-                                                             volume['host'])
+        iscsi_name, iscsi_portal = self._get_name_and_portal(volume)
         self._execute("sudo iscsiadm -m node -T %s -p %s --login" %
                       (iscsi_name, iscsi_portal))
         self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
@@ -319,8 +320,7 @@ class ISCSIDriver(VolumeDriver):
 
     def undiscover_volume(self, volume):
         """Undiscover volume on a remote host."""
-        iscsi_name, iscsi_portal = self._get_name_and_portal(volume['name'],
-                                                             volume['host'])
+        iscsi_name, iscsi_portal = self._get_name_and_portal(volume)
         self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
                       "-n node.startup -v manual" %
                       (iscsi_name, iscsi_portal))
diff --git a/nova/volume/manager.py b/nova/volume/manager.py
index 6f8e25e19..d2f02e4e0 100644
--- a/nova/volume/manager.py
+++ b/nova/volume/manager.py
@@ -87,7 +87,7 @@ class VolumeManager(manager.Manager):
             if volume['status'] in ['available', 'in-use']:
                 self.driver.ensure_export(ctxt, volume)
             else:
-                LOG.info(_("volume %s: skipping export"), volume_ref['name'])
+                LOG.info(_("volume %s: skipping export"), volume['name'])
 
     def create_volume(self, context, volume_id):
         """Creates and exports the volume."""
@@ -111,10 +111,10 @@ class VolumeManager(manager.Manager):
 
             LOG.debug(_("volume %s: creating export"), volume_ref['name'])
             self.driver.create_export(context, volume_ref)
-        except Exception as e:
+        except Exception:
             self.db.volume_update(context,
                                   volume_ref['id'], {'status': 'error'})
-            raise e
+            raise
 
         now = datetime.datetime.utcnow()
         self.db.volume_update(context,
@@ -137,11 +137,11 @@ class VolumeManager(manager.Manager):
             self.driver.remove_export(context, volume_ref)
             LOG.debug(_("volume %s: deleting"), volume_ref['name'])
             self.driver.delete_volume(volume_ref)
-        except Exception as e:
+        except Exception:
             self.db.volume_update(context,
                                   volume_ref['id'],
                                   {'status': 'error_deleting'})
-            raise e
+            raise
 
         self.db.volume_destroy(context, volume_id)
         LOG.debug(_("volume %s: deleted successfully"), volume_ref['name'])
diff --git a/nova/volume/san.py b/nova/volume/san.py
new file mode 100644
index 000000000..26d6125e7
--- /dev/null
+++ b/nova/volume/san.py
@@ -0,0 +1,335 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Justin Santa Barbara
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Drivers for san-stored volumes.
+The unique thing about a SAN is that we don't expect that we can run the volume
+ controller on the SAN hardware.  We expect to access it over SSH or some API.
+"""
+
+import os
+import paramiko
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova.utils import ssh_execute
+from nova.volume.driver import ISCSIDriver
+
+LOG = logging.getLogger("nova.volume.driver")
+FLAGS = flags.FLAGS
+flags.DEFINE_boolean('san_thin_provision', 'true',
+                     'Use thin provisioning for SAN volumes?')
+flags.DEFINE_string('san_ip', '',
+                    'IP address of SAN controller')
+flags.DEFINE_string('san_login', 'admin',
+                    'Username for SAN controller')
+flags.DEFINE_string('san_password', '',
+                    'Password for SAN controller')
+flags.DEFINE_string('san_privatekey', '',
+                    'Filename of private key to use for SSH authentication')
+
+
+class SanISCSIDriver(ISCSIDriver):
+    """ Base class for SAN-style storage volumes
+        (storage providers we access over SSH)"""
+    #Override because SAN ip != host ip
+    def _get_name_and_portal(self, volume):
+        """Gets iscsi name and portal from volume name and host."""
+        volume_name = volume['name']
+
+        # TODO(justinsb): store in volume, remerge with generic iSCSI code
+        host = FLAGS.san_ip
+
+        (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
+                                    "sendtargets -p %s" % host)
+
+        location = None
+        find_iscsi_name = self._build_iscsi_target_name(volume)
+        for target in out.splitlines():
+            if find_iscsi_name in target:
+                (location, _sep, iscsi_name) = target.partition(" ")
+                break
+        if not location:
+            raise exception.Error(_("Could not find iSCSI export "
+                                    " for volume %s") %
+                                  volume_name)
+
+        iscsi_portal = location.split(",")[0]
+        LOG.debug("iscsi_name=%s, iscsi_portal=%s" %
+                  (iscsi_name, iscsi_portal))
+        return (iscsi_name, iscsi_portal)
+
+    def _build_iscsi_target_name(self, volume):
+        return "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
+
+    # discover_volume is still OK
+    # undiscover_volume is still OK
+
+    def _connect_to_ssh(self):
+        ssh = paramiko.SSHClient()
+        #TODO(justinsb): We need a better SSH key policy
+        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        if FLAGS.san_password:
+            ssh.connect(FLAGS.san_ip,
+                        username=FLAGS.san_login,
+                        password=FLAGS.san_password)
+        elif FLAGS.san_privatekey:
+            privatekeyfile = os.path.expanduser(FLAGS.san_privatekey)
+            # It sucks that paramiko doesn't support DSA keys
+            privatekey = paramiko.RSAKey.from_private_key_file(privatekeyfile)
+            ssh.connect(FLAGS.san_ip,
+                        username=FLAGS.san_login,
+                        pkey=privatekey)
+        else:
+            raise exception.Error("Specify san_password or san_privatekey")
+        return ssh
+
+    def _run_ssh(self, command, check_exit_code=True):
+        #TODO(justinsb): SSH connection caching (?)
+        ssh = self._connect_to_ssh()
+
+        #TODO(justinsb): Reintroduce the retry hack
+        ret = ssh_execute(ssh, command, check_exit_code=check_exit_code)
+
+        ssh.close()
+
+        return ret
+
+    def ensure_export(self, context, volume):
+        """Synchronously recreates an export for a logical volume."""
+        pass
+
+    def create_export(self, context, volume):
+        """Exports the volume."""
+        pass
+
+    def remove_export(self, context, volume):
+        """Removes an export for a logical volume."""
+        pass
+
+    def check_for_setup_error(self):
+        """Returns an error if prerequisites aren't met"""
+        if not (FLAGS.san_password or FLAGS.san_privatekey):
+            raise exception.Error("Specify san_password or san_privatekey")
+
+        if not (FLAGS.san_ip):
+            raise exception.Error("san_ip must be set")
+
+
+def _collect_lines(data):
+    """ Split lines from data into an array, trimming them """
+    matches = []
+    for line in data.splitlines():
+        match = line.strip()
+        matches.append(match)
+
+    return matches
+
+
+def _get_prefixed_values(data, prefix):
+    """Collect lines which start with prefix; with trimming"""
+    matches = []
+    for line in data.splitlines():
+        line = line.strip()
+        if line.startswith(prefix):
+            match = line[len(prefix):]
+            match = match.strip()
+            matches.append(match)
+
+    return matches
+
+
+class SolarisISCSIDriver(SanISCSIDriver):
+    """Executes commands relating to Solaris-hosted ISCSI volumes.
+    Basic setup for a Solaris iSCSI server:
+    pkg install storage-server SUNWiscsit
+    svcadm enable stmf
+    svcadm enable -r svc:/network/iscsi/target:default
+    pfexec itadm create-tpg e1000g0 ${MYIP}
+    pfexec itadm create-target -t e1000g0
+
+    Then grant the user that will be logging on lots of permissions.
+    I'm not sure exactly which though:
+    zfs allow justinsb create,mount,destroy rpool
+    usermod -P'File System Management' justinsb
+    usermod -P'Primary Administrator' justinsb
+
+    Also make sure you can login using san_login & san_password/san_privatekey
+    """
+
+    def _view_exists(self, luid):
+        cmd = "pfexec /usr/sbin/stmfadm list-view -l %s" % (luid)
+        (out, _err) = self._run_ssh(cmd,
+                                    check_exit_code=False)
+        if "no views found" in out:
+            return False
+
+        if "View Entry:" in out:
+            return True
+
+        raise exception.Error("Cannot parse list-view output: %s" % (out))
+
+    def _get_target_groups(self):
+        """Gets list of target groups from host."""
+        (out, _err) = self._run_ssh("pfexec /usr/sbin/stmfadm list-tg")
+        matches = _get_prefixed_values(out, 'Target group: ')
+        LOG.debug("target_groups=%s" % matches)
+        return matches
+
+    def _target_group_exists(self, target_group_name):
+        return target_group_name not in self._get_target_groups()
+
+    def _get_target_group_members(self, target_group_name):
+        (out, _err) = self._run_ssh("pfexec /usr/sbin/stmfadm list-tg -v %s" %
+                                    (target_group_name))
+        matches = _get_prefixed_values(out, 'Member: ')
+        LOG.debug("members of %s=%s" % (target_group_name, matches))
+        return matches
+
+    def _is_target_group_member(self, target_group_name, iscsi_target_name):
+        return iscsi_target_name in (
+            self._get_target_group_members(target_group_name))
+
+    def _get_iscsi_targets(self):
+        cmd = ("pfexec /usr/sbin/itadm list-target | "
+               "awk '{print $1}' | grep -v ^TARGET")
+        (out, _err) = self._run_ssh(cmd)
+        matches = _collect_lines(out)
+        LOG.debug("_get_iscsi_targets=%s" % (matches))
+        return matches
+
+    def _iscsi_target_exists(self, iscsi_target_name):
+        return iscsi_target_name in self._get_iscsi_targets()
+
+    def _build_zfs_poolname(self, volume):
+        #TODO(justinsb): rpool should be configurable
+        zfs_poolname = 'rpool/%s' % (volume['name'])
+        return zfs_poolname
+
+    def create_volume(self, volume):
+        """Creates a volume."""
+        if int(volume['size']) == 0:
+            sizestr = '100M'
+        else:
+            sizestr = '%sG' % volume['size']
+
+        zfs_poolname = self._build_zfs_poolname(volume)
+
+        thin_provision_arg = '-s' if FLAGS.san_thin_provision else ''
+        # Create a zfs volume
+        self._run_ssh("pfexec /usr/sbin/zfs create %s -V %s %s" %
+                      (thin_provision_arg,
+                       sizestr,
+                       zfs_poolname))
+
+    def _get_luid(self, volume):
+        zfs_poolname = self._build_zfs_poolname(volume)
+
+        cmd = ("pfexec /usr/sbin/sbdadm list-lu | "
+               "grep -w %s | awk '{print $1}'" %
+               (zfs_poolname))
+
+        (stdout, _stderr) = self._run_ssh(cmd)
+
+        luid = stdout.strip()
+        return luid
+
+    def _is_lu_created(self, volume):
+        luid = self._get_luid(volume)
+        return luid
+
+    def delete_volume(self, volume):
+        """Deletes a volume."""
+        zfs_poolname = self._build_zfs_poolname(volume)
+        self._run_ssh("pfexec /usr/sbin/zfs destroy %s" %
+                      (zfs_poolname))
+
+    def local_path(self, volume):
+        # TODO(justinsb): Is this needed here?
+        escaped_group = FLAGS.volume_group.replace('-', '--')
+        escaped_name = volume['name'].replace('-', '--')
+        return "/dev/mapper/%s-%s" % (escaped_group, escaped_name)
+
+    def ensure_export(self, context, volume):
+        """Synchronously recreates an export for a logical volume."""
+        #TODO(justinsb): On bootup, this is called for every volume.
+        # It then runs ~5 SSH commands for each volume,
+        # most of which fetch the same info each time
+        # This makes initial start stupid-slow
+        self._do_export(volume, force_create=False)
+
+    def create_export(self, context, volume):
+        self._do_export(volume, force_create=True)
+
+    def _do_export(self, volume, force_create):
+        # Create a Logical Unit (LU) backed by the zfs volume
+        zfs_poolname = self._build_zfs_poolname(volume)
+
+        if force_create or not self._is_lu_created(volume):
+            cmd = ("pfexec /usr/sbin/sbdadm create-lu /dev/zvol/rdsk/%s" %
+                   (zfs_poolname))
+            self._run_ssh(cmd)
+
+        luid = self._get_luid(volume)
+        iscsi_name = self._build_iscsi_target_name(volume)
+        target_group_name = 'tg-%s' % volume['name']
+
+        # Create a iSCSI target, mapped to just this volume
+        if force_create or not self._target_group_exists(target_group_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm create-tg %s" %
+                          (target_group_name))
+
+        # Yes, we add the initiatior before we create it!
+        # Otherwise, it complains that the target is already active
+        if force_create or not self._is_target_group_member(target_group_name,
+                                                            iscsi_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm add-tg-member -g %s %s" %
+                          (target_group_name, iscsi_name))
+        if force_create or not self._iscsi_target_exists(iscsi_name):
+            self._run_ssh("pfexec /usr/sbin/itadm create-target -n %s" %
+                          (iscsi_name))
+        if force_create or not self._view_exists(luid):
+            self._run_ssh("pfexec /usr/sbin/stmfadm add-view -t %s %s" %
+                          (target_group_name, luid))
+
+    def remove_export(self, context, volume):
+        """Removes an export for a logical volume."""
+
+        # This is the reverse of _do_export
+        luid = self._get_luid(volume)
+        iscsi_name = self._build_iscsi_target_name(volume)
+        target_group_name = 'tg-%s' % volume['name']
+
+        if self._view_exists(luid):
+            self._run_ssh("pfexec /usr/sbin/stmfadm remove-view -l %s -a" %
+                          (luid))
+
+        if self._iscsi_target_exists(iscsi_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm offline-target %s" %
+                          (iscsi_name))
+            self._run_ssh("pfexec /usr/sbin/itadm delete-target %s" %
+                          (iscsi_name))
+
+        # We don't delete the tg-member; we delete the whole tg!
+
+        if self._target_group_exists(target_group_name):
+            self._run_ssh("pfexec /usr/sbin/stmfadm delete-tg %s" %
+                          (target_group_name))
+
+        if self._is_lu_created(volume):
+            self._run_ssh("pfexec /usr/sbin/sbdadm delete-lu %s" %
+                          (luid))