merged trunk

8 files changed, 161 insertions, 29 deletions

diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index 923378352..de114bdeb 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -68,6 +68,12 @@ class ComputeManager(manager.Manager):
         self.volume_manager = utils.import_object(FLAGS.volume_manager)
         super(ComputeManager, self).__init__(*args, **kwargs)
 
+    def init_host(self):
+        """Do any initialization that needs to be run if this is a
+           standalone service.
+        """
+        self.driver.init_host()
+
     def _update_state(self, context, instance_id):
         """Update the state of an instance from the driver info."""
         # FIXME(ja): include other fields from state?
diff --git a/nova/tests/virt_unittest.py b/nova/tests/virt_unittest.py
index dc13d6c54..9ad009510 100644
--- a/nova/tests/virt_unittest.py
+++ b/nova/tests/virt_unittest.py
@@ -339,7 +339,7 @@ class NWFilterTestCase(test.TestCase):
                                        self.security_group.id)
         instance = db.instance_get(self.context, inst_id)
 
-        d = self.fw.setup_nwfilters_for_instance(instance)
+        self.fw.setup_base_nwfilters()
+        self.fw.setup_nwfilters_for_instance(instance)
         _ensure_all_called()
         self.teardown_security_group()
-        return d
diff --git a/nova/virt/fake.py b/nova/virt/fake.py
index 73e273edd..238acf798 100644
--- a/nova/virt/fake.py
+++ b/nova/virt/fake.py
@@ -76,6 +76,12 @@ class FakeConnection(object):
             cls._instance = cls()
         return cls._instance
 
+    def init_host(self):
+        """
+        Initialize anything that is necessary for the driver to function
+        """
+        return
+
     def list_instances(self):
         """
         Return the names of all the instances known to the virtualization
diff --git a/nova/virt/libvirt.rescue.qemu.xml.template.THIS b/nova/virt/libvirt.rescue.qemu.xml.template.THIS
new file mode 100644
index 000000000..a3b88106c
--- /dev/null
+++ b/nova/virt/libvirt.rescue.qemu.xml.template.THIS
@@ -0,0 +1,38 @@
+<domain type='%(type)s'>
+    <name>%(name)s</name>
+    <os>
+        <type>hvm</type>
+        <kernel>%(basepath)s/rescue-kernel</kernel>
+        <initrd>%(basepath)s/rescue-ramdisk</initrd>
+        <cmdline>root=/dev/vda1 console=ttyS0</cmdline>
+    </os>
+    <features>
+        <acpi/>
+    </features>
+    <memory>%(memory_kb)s</memory>
+    <vcpu>%(vcpus)s</vcpu>
+    <devices>
+        <disk type='file'>
+            <source file='%(basepath)s/rescue-disk'/>
+            <target dev='vda' bus='virtio'/>
+        </disk>
+        <disk type='file'>
+            <source file='%(basepath)s/disk'/>
+            <target dev='vdb' bus='virtio'/>
+        </disk>
+        <interface type='bridge'>
+            <source bridge='%(bridge_name)s'/>
+            <mac address='%(mac_address)s'/>
+            <!--   <model type='virtio'/>  CANT RUN virtio network right now -->
+            <filterref filter="nova-instance-%(name)s">
+                <parameter name="IP" value="%(ip_address)s" />
+                <parameter name="DHCPSERVER" value="%(dhcp_server)s" />
+                %(extra_params)s
+            </filterref>
+        </interface>
+        <serial type="file">
+            <source path='%(basepath)s/console.log'/>
+            <target port='1'/>
+        </serial>
+    </devices>
+</domain>
diff --git a/nova/virt/libvirt.rescue.uml.xml.template.THIS b/nova/virt/libvirt.rescue.uml.xml.template.THIS
new file mode 100644
index 000000000..a254692d4
--- /dev/null
+++ b/nova/virt/libvirt.rescue.uml.xml.template.THIS
@@ -0,0 +1,31 @@
+<domain type='%(type)s'>
+    <name>%(name)s</name>
+    <memory>%(memory_kb)s</memory>
+    <os>
+        <type>%(type)s</type>
+        <kernel>/usr/bin/linux</kernel>
+        <root>/dev/ubda1</root>
+    </os>
+    <devices>
+        <disk type='file'>
+            <source file='%(basepath)s/rescue-disk'/>
+            <target dev='ubd0' bus='uml'/>
+        </disk>
+        <disk type='file'>
+            <source file='%(basepath)s/disk'/>
+            <target dev='ubd1' bus='uml'/>
+        </disk>
+        <interface type='bridge'>
+            <source bridge='%(bridge_name)s'/>
+            <mac address='%(mac_address)s'/>
+            <filterref filter="nova-instance-%(name)s">
+                <parameter name="IP" value="%(ip_address)s" />
+                <parameter name="DHCPSERVER" value="%(dhcp_server)s" />
+                %(extra_params)s
+            </filterref>
+        </interface>
+        <console type="file">
+            <source path='%(basepath)s/console.log'/>
+        </console>
+    </devices>
+</domain>
diff --git a/nova/virt/libvirt.uml.xml.template.THIS b/nova/virt/libvirt.uml.xml.template.THIS
new file mode 100644
index 000000000..506f2ef72
--- /dev/null
+++ b/nova/virt/libvirt.uml.xml.template.THIS
@@ -0,0 +1,27 @@
+<domain type='%(type)s'>
+    <name>%(name)s</name>
+    <memory>%(memory_kb)s</memory>
+    <os>
+        <type>%(type)s</type>
+        <kernel>/usr/bin/linux</kernel>
+        <root>/dev/ubda1</root>
+    </os>
+    <devices>
+        <disk type='file'>
+            <source file='%(basepath)s/disk'/>
+            <target dev='ubd0' bus='uml'/>
+        </disk>
+        <interface type='bridge'>
+            <source bridge='%(bridge_name)s'/>
+            <mac address='%(mac_address)s'/>
+            <filterref filter="nova-instance-%(name)s">
+                <parameter name="IP" value="%(ip_address)s" />
+                <parameter name="DHCPSERVER" value="%(dhcp_server)s" />
+                %(extra_params)s
+            </filterref>
+        </interface>
+        <console type="file">
+            <source path='%(basepath)s/console.log'/>
+        </console>
+    </devices>
+</domain>
diff --git a/nova/virt/libvirt.xml.template b/nova/virt/libvirt.xml.template
index 13d087330..3fb2243da 100644
--- a/nova/virt/libvirt.xml.template
+++ b/nova/virt/libvirt.xml.template
@@ -66,6 +66,9 @@
             <filterref filter="nova-instance-${name}">
                 <parameter name="IP" value="${ip_address}" />
                 <parameter name="DHCPSERVER" value="${dhcp_server}" />
+#if $getVar('extra_params', False)
+                ${extra_params}
+#end if
             </filterref>
         </interface>
         <serial type="file">
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 708b41647..8d3a6a261 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -97,6 +97,11 @@ def get_connection(read_only):
     return LibvirtConnection(read_only)
 
 
+def _get_net_and_mask(cidr):
+    net = IPy.IP(cidr)
+    return str(net.net()), str(net.netmask())
+
+
 class LibvirtConnection(object):
 
     def __init__(self, read_only):
@@ -106,6 +111,9 @@ class LibvirtConnection(object):
         self._wrapped_conn = None
         self.read_only = read_only
 
+    def init_host(self):
+        NWFilterFirewall(self._conn).setup_base_nwfilters()
+
     @property
     def _conn(self):
         if not self._wrapped_conn or not self._test_connection():
@@ -500,6 +508,15 @@ class LibvirtConnection(object):
                                                    instance['id'])
         # Assume that the gateway also acts as the dhcp server.
         dhcp_server = network['gateway']
+
+        if FLAGS.allow_project_net_traffic:
+            net, mask = _get_net_and_mask(network['cidr'])
+            extra_params = ("<parameter name=\"PROJNET\" value=\"%s\" />\n"
+                            "<parameter name=\"PROJMASK\" value=\"%s\" />\n"
+                           ) % (net, mask)
+        else:
+            extra_params = "\n"
+
         xml_info = {'type': FLAGS.libvirt_type,
                     'name': instance['name'],
                     'basepath': os.path.join(FLAGS.instances_path,
@@ -510,6 +527,7 @@ class LibvirtConnection(object):
                     'mac_address': instance['mac_address'],
                     'ip_address': ip_address,
                     'dhcp_server': dhcp_server,
+                    'extra_params': extra_params,
                     'rescue': rescue}
         if not rescue:
             if instance['kernel_id']:
@@ -717,6 +735,14 @@ class NWFilterFirewall(object):
                               </rule>
                             </filter>'''
 
+    nova_vpn_filter = '''<filter name='nova-vpn' chain='root'>
+                           <uuid>2086015e-cf03-11df-8c5d-080027c27973</uuid>
+                           <filterref filter='allow-dhcp-server'/>
+                           <filterref filter='nova-allow-dhcp-server'/>
+                           <filterref filter='nova-base-ipv4'/>
+                           <filterref filter='nova-base-ipv6'/>
+                         </filter>'''
+
     def nova_base_ipv4_filter(self):
         retval = "<filter name='nova-base-ipv4' chain='ipv4'>"
         for protocol in ['tcp', 'udp', 'icmp']:
@@ -741,12 +767,12 @@ class NWFilterFirewall(object):
         retval += '</filter>'
         return retval
 
-    def nova_project_filter(self, project, net, mask):
-        retval = "<filter name='nova-project-%s' chain='ipv4'>" % project
+    def nova_project_filter(self):
+        retval = "<filter name='nova-project' chain='ipv4'>"
         for protocol in ['tcp', 'udp', 'icmp']:
             retval += """<rule action='accept' direction='in' priority='200'>
-                           <%s srcipaddr='%s' srcipmask='%s' />
-                         </rule>""" % (protocol, net, mask)
+                           <%s srcipaddr='$PROJNET' srcipmask='$PROJMASK' />
+                         </rule>""" % protocol
         retval += '</filter>'
         return retval
 
@@ -757,10 +783,14 @@ class NWFilterFirewall(object):
         # execute in a native thread and block current greenthread until done
         tpool.execute(self._conn.nwfilterDefineXML, xml)
 
-    @staticmethod
-    def _get_net_and_mask(cidr):
-        net = IPy.IP(cidr)
-        return str(net.net()), str(net.netmask())
+    def setup_base_nwfilters(self):
+        self._define_filter(self.nova_base_ipv4_filter)
+        self._define_filter(self.nova_base_ipv6_filter)
+        self._define_filter(self.nova_dhcp_filter)
+        self._define_filter(self.nova_base_filter)
+        self._define_filter(self.nova_vpn_filter)
+        if FLAGS.allow_project_net_traffic:
+            self._define_filter(self.nova_project_filter)
 
     def setup_nwfilters_for_instance(self, instance):
         """
@@ -769,31 +799,22 @@ class NWFilterFirewall(object):
         the base filter are all in place.
         """
 
-        self._define_filter(self.nova_base_ipv4_filter)
-        self._define_filter(self.nova_base_ipv6_filter)
-        self._define_filter(self.nova_dhcp_filter)
-        self._define_filter(self.nova_base_filter)
+        nwfilter_xml = ("<filter name='nova-instance-%s' chain='root'>\n"
+                       ) % instance['name']
 
-        nwfilter_xml = "<filter name='nova-instance-%s' chain='root'>\n" \
-                       "  <filterref filter='nova-base' />\n" % \
-                       instance['name']
+        if instance['image_id'] == FLAGS.vpn_image_id:
+            nwfilter_xml += "  <filterref filter='nova-vpn' />\n"
+        else:
+            nwfilter_xml += "  <filterref filter='nova-base' />\n"
 
         if FLAGS.allow_project_net_traffic:
-            network_ref = db.project_get_network(context.get_admin_context(),
-                                                 instance['project_id'])
-            net, mask = self._get_net_and_mask(network_ref['cidr'])
-            project_filter = self.nova_project_filter(instance['project_id'],
-                                                      net, mask)
-            self._define_filter(project_filter)
-
-            nwfilter_xml += "  <filterref filter='nova-project-%s' />\n" % \
-                            instance['project_id']
+            nwfilter_xml += "  <filterref filter='nova-project' />\n"
 
         for security_group in instance.security_groups:
             self.ensure_security_group_filter(security_group['id'])
 
-            nwfilter_xml += "  <filterref filter='nova-secgroup-%d' />\n" % \
-                            security_group['id']
+            nwfilter_xml += ("  <filterref filter='nova-secgroup-%d' />\n"
+                            ) % security_group['id']
         nwfilter_xml += "</filter>"
 
         self._define_filter(nwfilter_xml)
@@ -809,7 +830,7 @@ class NWFilterFirewall(object):
         for rule in security_group.rules:
             rule_xml += "<rule action='accept' direction='in' priority='300'>"
             if rule.cidr:
-                net, mask = self._get_net_and_mask(rule.cidr)
+                net, mask = _get_net_and_mask(rule.cidr)
                 rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
                             (rule.protocol, net, mask)
                 if rule.protocol in ['tcp', 'udp']: