merge from upstream and fix leaks in console tests

50 files changed, 2322 insertions, 207 deletions

diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 3fe44ba99..4b971c3d8 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -25,7 +25,6 @@ datastore.
 import base64
 import datetime
 import IPy
-import re
 import os
 
 from nova import compute
@@ -35,7 +34,6 @@ from nova import db
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova import quota
 from nova import network
 from nova import rpc
 from nova import utils
@@ -44,6 +42,7 @@ from nova.compute import instance_types
 
 
 FLAGS = flags.FLAGS
+flags.DECLARE('service_down_time', 'nova.scheduler.driver')
 
 LOG = logging.getLogger("nova.api.cloud")
 
@@ -145,6 +144,12 @@ class CloudController(object):
                      {"method": "refresh_security_group",
                       "args": {"security_group_id": security_group.id}})
 
+    def _get_availability_zone_by_host(self, context, host):
+        services = db.service_get_all_by_host(context, host)
+        if len(services) > 0:
+            return services[0]['availability_zone']
+        return 'unknown zone'
+
     def get_metadata(self, address):
         ctxt = context.get_admin_context()
         instance_ref = self.compute_api.get_all(ctxt, fixed_ip=address)
@@ -157,6 +162,8 @@ class CloudController(object):
         else:
             keys = ''
         hostname = instance_ref['hostname']
+        host = instance_ref['host']
+        availability_zone = self._get_availability_zone_by_host(ctxt, host)
         floating_ip = db.instance_get_floating_address(ctxt,
                                                        instance_ref['id'])
         ec2_id = id_to_ec2_id(instance_ref['id'])
@@ -179,8 +186,7 @@ class CloudController(object):
                 'local-hostname': hostname,
                 'local-ipv4': address,
                 'kernel-id': instance_ref['kernel_id'],
-                # TODO(vish): real zone
-                'placement': {'availability-zone': 'nova'},
+                'placement': {'availability-zone': availability_zone},
                 'public-hostname': hostname,
                 'public-ipv4': floating_ip or '',
                 'public-keys': keys,
@@ -204,15 +210,33 @@ class CloudController(object):
             return self._describe_availability_zones(context, **kwargs)
 
     def _describe_availability_zones(self, context, **kwargs):
-        return {'availabilityZoneInfo': [{'zoneName': 'nova',
-                                          'zoneState': 'available'}]}
+        enabled_services = db.service_get_all(context)
+        disabled_services = db.service_get_all(context, True)
+        available_zones = []
+        for zone in [service.availability_zone for service
+                     in enabled_services]:
+            if not zone in available_zones:
+                available_zones.append(zone)
+        not_available_zones = []
+        for zone in [service.availability_zone for service in disabled_services
+                     if not service['availability_zone'] in available_zones]:
+            if not zone in not_available_zones:
+                not_available_zones.append(zone)
+        result = []
+        for zone in available_zones:
+            result.append({'zoneName': zone,
+                           'zoneState': "available"})
+        for zone in not_available_zones:
+            result.append({'zoneName': zone,
+                           'zoneState': "not available"})
+        return {'availabilityZoneInfo': result}
 
     def _describe_availability_zones_verbose(self, context, **kwargs):
         rv = {'availabilityZoneInfo': [{'zoneName': 'nova',
                                         'zoneState': 'available'}]}
 
         services = db.service_get_all(context)
-        now = db.get_time()
+        now = datetime.datetime.utcnow()
         hosts = []
         for host in [service['host'] for service in services]:
             if not host in hosts:
@@ -252,6 +276,7 @@ class CloudController(object):
                                                             FLAGS.cc_host,
                                                             FLAGS.cc_port,
                                                             FLAGS.ec2_suffix)}]
+        return {'regionInfo': regions}
 
     def describe_snapshots(self,
                            context,
@@ -411,8 +436,8 @@ class CloudController(object):
 
         criteria = self._revoke_rule_args_to_dict(context, **kwargs)
         if criteria == None:
-            raise exception.ApiError(_("No rule for the specified "
-                                       "parameters."))
+            raise exception.ApiError(_("Not enough parameters to build a "
+                                       "valid rule."))
 
         for rule in security_group.rules:
             match = True
@@ -421,7 +446,8 @@ class CloudController(object):
                     match = False
             if match:
                 db.security_group_rule_destroy(context, rule['id'])
-                self._trigger_refresh_security_group(context, security_group)
+                self.compute_api.trigger_security_group_rules_refresh(context,
+                                                          security_group['id'])
                 return True
         raise exception.ApiError(_("No rule for the specified parameters."))
 
@@ -438,6 +464,9 @@ class CloudController(object):
                                                        group_name)
 
         values = self._revoke_rule_args_to_dict(context, **kwargs)
+        if values is None:
+            raise exception.ApiError(_("Not enough parameters to build a "
+                                       "valid rule."))
         values['parent_group_id'] = security_group.id
 
         if self._security_group_rule_exists(security_group, values):
@@ -446,7 +475,8 @@ class CloudController(object):
 
         security_group_rule = db.security_group_rule_create(context, values)
 
-        self._trigger_refresh_security_group(context, security_group)
+        self.compute_api.trigger_security_group_rules_refresh(context,
+                                                          security_group['id'])
 
         return True
 
@@ -508,6 +538,11 @@ class CloudController(object):
                 "Timestamp": now,
                 "output": base64.b64encode(output)}
 
+    def get_ajax_console(self, context, instance_id, **kwargs):
+        ec2_id = instance_id[0]
+        internal_id = ec2_id_to_id(ec2_id)
+        return self.compute_api.get_ajax_console(context, internal_id)
+
     def describe_volumes(self, context, volume_id=None, **kwargs):
         volumes = self.volume_api.get_all(context)
         # NOTE(vish): volume_id is an optional list of volume ids to filter by.
@@ -558,7 +593,7 @@ class CloudController(object):
         # TODO(vish): Instance should be None at db layer instead of
         #             trying to lazy load, but for now we turn it into
         #             a dict to avoid an error.
-        return {'volumeSet': [self._format_volume(context, dict(volume_ref))]}
+        return {'volumeSet': [self._format_volume(context, dict(volume))]}
 
     def delete_volume(self, context, volume_id, **kwargs):
         self.volume_api.delete(context, volume_id=volume_id)
@@ -608,19 +643,28 @@ class CloudController(object):
         return [{label: x} for x in lst]
 
     def describe_instances(self, context, **kwargs):
-        return self._format_describe_instances(context)
+        return self._format_describe_instances(context, **kwargs)
 
-    def _format_describe_instances(self, context):
-        return {'reservationSet': self._format_instances(context)}
+    def _format_describe_instances(self, context, **kwargs):
+        return {'reservationSet': self._format_instances(context, **kwargs)}
 
     def _format_run_instances(self, context, reservation_id):
         i = self._format_instances(context, reservation_id=reservation_id)
         assert len(i) == 1
         return i[0]
 
-    def _format_instances(self, context, **kwargs):
+    def _format_instances(self, context, instance_id=None, **kwargs):
+        # TODO(termie): this method is poorly named as its name does not imply
+        #               that it will be making a variety of database calls
+        #               rather than simply formatting a bunch of instances that
+        #               were handed to it
         reservations = {}
-        instances = self.compute_api.get_all(context, **kwargs)
+        # NOTE(vish): instance_id is an optional list of ids to filter by
+        if instance_id:
+            instance_id = [ec2_id_to_id(x) for x in instance_id]
+            instances = [self.compute_api.get(context, x) for x in instance_id]
+        else:
+            instances = self.compute_api.get_all(context, **kwargs)
         for instance in instances:
             if not context.user.is_admin():
                 if instance['image_id'] == FLAGS.vpn_image_id:
@@ -654,6 +698,9 @@ class CloudController(object):
             i['amiLaunchIndex'] = instance['launch_index']
             i['displayName'] = instance['display_name']
             i['displayDescription'] = instance['display_description']
+            host = instance['host']
+            zone = self._get_availability_zone_by_host(context, host)
+            i['placement'] = {'availabilityZone': zone}
             if instance['reservation_id'] not in reservations:
                 r = {}
                 r['reservationId'] = instance['reservation_id']
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index ad203c51f..f96e2af91 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -31,10 +31,11 @@ from nova import utils
 from nova import wsgi
 from nova.api.openstack import faults
 from nova.api.openstack import backup_schedules
+from nova.api.openstack import consoles
 from nova.api.openstack import flavors
 from nova.api.openstack import images
 from nova.api.openstack import servers
-from nova.api.openstack import sharedipgroups
+from nova.api.openstack import shared_ip_groups
 
 
 LOG = logging.getLogger('nova.api.openstack')
@@ -47,6 +48,10 @@ flags.DEFINE_string('os_api_ratelimiting',
     'nova.api.openstack.ratelimiting.RateLimitingMiddleware',
     'Default ratelimiting implementation for the Openstack API')
 
+flags.DEFINE_string('os_krm_mapping_file',
+    'krm_mapping.json',
+    'Location of OpenStack Flavor/OS:EC2 Kernel/Ramdisk/Machine JSON file.')
+
 flags.DEFINE_bool('allow_admin_api',
     False,
     'When True, this API service will accept admin operations.')
@@ -100,12 +105,18 @@ class APIRouter(wsgi.Router):
                         parent_resource=dict(member_name='server',
                         collection_name='servers'))
 
+        mapper.resource("console", "consoles",
+                        controller=consoles.Controller(),
+                        parent_resource=dict(member_name='server',
+                        collection_name='servers'))
+
         mapper.resource("image", "images", controller=images.Controller(),
                         collection={'detail': 'GET'})
         mapper.resource("flavor", "flavors", controller=flavors.Controller(),
                         collection={'detail': 'GET'})
-        mapper.resource("sharedipgroup", "sharedipgroups",
-                        controller=sharedipgroups.Controller())
+        mapper.resource("shared_ip_group", "shared_ip_groups",
+                        collection={'detail': 'GET'},
+                        controller=shared_ip_groups.Controller())
 
         super(APIRouter, self).__init__(mapper)
 
diff --git a/nova/api/openstack/backup_schedules.py b/nova/api/openstack/backup_schedules.py
index fcc07bdd3..197125d86 100644
--- a/nova/api/openstack/backup_schedules.py
+++ b/nova/api/openstack/backup_schedules.py
@@ -15,7 +15,9 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import logging
 import time
+
 from webob import exc
 
 from nova import wsgi
@@ -46,8 +48,8 @@ class Controller(wsgi.Controller):
     def create(self, req, server_id):
         """ No actual update method required, since the existing API allows
         both create and update through a POST """
-        return faults.Fault(exc.HTTPNotFound())
+        return faults.Fault(exc.HTTPNotImplemented())
 
     def delete(self, req, server_id, id):
         """ Deletes an existing backup schedule """
-        return faults.Fault(exc.HTTPNotFound())
+        return faults.Fault(exc.HTTPNotImplemented())
diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index ac0572c96..037ed47a0 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -15,6 +15,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from nova import exception
+
 
 def limited(items, req):
     """Return a slice of items according to requested offset and limit.
@@ -34,3 +36,25 @@ def limited(items, req):
     limit = min(1000, limit)
     range_end = offset + limit
     return items[offset:range_end]
+
+
+def get_image_id_from_image_hash(image_service, context, image_hash):
+    """Given an Image ID Hash, return an objectstore Image ID.
+
+    image_service - reference to objectstore compatible image service.
+    context - security context for image service requests.
+    image_hash - hash of the image ID.
+    """
+
+    # FIX(sandy): This is terribly inefficient. It pulls all images
+    # from objectstore in order to find the match. ObjectStore
+    # should have a numeric counterpart to the string ID.
+    try:
+        items = image_service.detail(context)
+    except NotImplementedError:
+        items = image_service.index(context)
+    for image in items:
+        image_id = image['imageId']
+        if abs(hash(image_id)) == int(image_hash):
+            return image_id
+    raise exception.NotFound(image_hash)
diff --git a/nova/api/openstack/consoles.py b/nova/api/openstack/consoles.py
new file mode 100644
index 000000000..9ebdbe710
--- /dev/null
+++ b/nova/api/openstack/consoles.py
@@ -0,0 +1,96 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from webob import exc
+
+from nova import console
+from nova import exception
+from nova import wsgi
+from nova.api.openstack import faults
+
+
+def _translate_keys(cons):
+    """Coerces a console instance into proper dictionary format """
+    pool = cons['pool']
+    info = {'id': cons['id'],
+            'console_type': pool['console_type']}
+    return dict(console=info)
+
+
+def _translate_detail_keys(cons):
+    """Coerces a console instance into proper dictionary format with
+    correctly mapped attributes """
+    pool = cons['pool']
+    info = {'id': cons['id'],
+            'console_type': pool['console_type'],
+            'password': cons['password'],
+            'port': cons['port'],
+            'host': pool['public_hostname']}
+    return dict(console=info)
+
+
+class Controller(wsgi.Controller):
+    """The Consoles Controller for the Openstack API"""
+
+    _serialization_metadata = {
+        'application/xml': {
+            'attributes': {
+                'console': []}}}
+
+    def __init__(self):
+        self.console_api = console.API()
+        super(Controller, self).__init__()
+
+    def index(self, req, server_id):
+        """Returns a list of consoles for this instance"""
+        consoles = self.console_api.get_consoles(
+                                    req.environ['nova.context'],
+                                    int(server_id))
+        return dict(consoles=[_translate_keys(console)
+                              for console in consoles])
+
+    def create(self, req, server_id):
+        """Creates a new console"""
+        #info = self._deserialize(req.body, req)
+        self.console_api.create_console(
+                                req.environ['nova.context'],
+                                int(server_id))
+
+    def show(self, req, server_id, id):
+        """Shows in-depth information on a specific console"""
+        try:
+            console = self.console_api.get_console(
+                                        req.environ['nova.context'],
+                                        int(server_id),
+                                        int(id))
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+        return _translate_detail_keys(console)
+
+    def update(self, req, server_id, id):
+        """You can't update a console"""
+        raise faults.Fault(exc.HTTPNotImplemented())
+
+    def delete(self, req, server_id, id):
+        """Deletes a console"""
+        try:
+            self.console_api.delete_console(req.environ['nova.context'],
+                                            int(server_id),
+                                            int(id))
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+        return exc.HTTPAccepted()
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index 0b239aab8..a5f55a489 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -15,6 +15,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import logging
+
 from webob import exc
 
 from nova import compute
@@ -26,6 +28,7 @@ from nova.api.openstack import common
 from nova.api.openstack import faults
 import nova.image.service
 
+
 FLAGS = flags.FLAGS
 
 
@@ -88,6 +91,12 @@ def _filter_keys(item, keys):
     return dict((k, v) for k, v in item.iteritems() if k in keys)
 
 
+def _convert_image_id_to_hash(image):
+    image_id = abs(hash(image['imageId']))
+    image['imageId'] = image_id
+    image['id'] = image_id
+
+
 class Controller(wsgi.Controller):
 
     _serialization_metadata = {
@@ -112,6 +121,9 @@ class Controller(wsgi.Controller):
             items = self._service.detail(req.environ['nova.context'])
         except NotImplementedError:
             items = self._service.index(req.environ['nova.context'])
+        for image in items:
+            _convert_image_id_to_hash(image)
+
         items = common.limited(items, req)
         items = [_translate_keys(item) for item in items]
         items = [_translate_status(item) for item in items]
@@ -119,7 +131,12 @@ class Controller(wsgi.Controller):
 
     def show(self, req, id):
         """Return data about the given image id"""
-        return dict(image=self._service.show(req.environ['nova.context'], id))
+        image_id = common.get_image_id_from_image_hash(self._service,
+                    req.environ['nova.context'], id)
+
+        image = self._service.show(req.environ['nova.context'], image_id)
+        _convert_image_id_to_hash(image)
+        return dict(image=image)
 
     def delete(self, req, id):
         # Only public images are supported for now.
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 3f0fdc575..29af82533 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -15,14 +15,17 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import json
 import traceback
 
 from webob import exc
 
 from nova import compute
 from nova import exception
+from nova import flags
 from nova import log as logging
 from nova import wsgi
+from nova import utils
 from nova.api.openstack import common
 from nova.api.openstack import faults
 from nova.auth import manager as auth_manager
@@ -35,6 +38,9 @@ LOG = logging.getLogger('server')
 LOG.setLevel(logging.DEBUG)
 
 
+FLAGS = flags.FLAGS
+
+
 def _translate_detail_keys(inst):
     """ Coerces into dictionary format, mapping everything to Rackspace-like
     attributes for return"""
@@ -44,7 +50,7 @@ def _translate_detail_keys(inst):
         power_state.RUNNING: 'active',
         power_state.BLOCKED: 'active',
         power_state.SUSPENDED: 'suspended',
-        power_state.PAUSED: 'error',
+        power_state.PAUSED: 'paused',
         power_state.SHUTDOWN: 'active',
         power_state.SHUTOFF: 'active',
         power_state.CRASHED: 'error'}
@@ -81,6 +87,7 @@ class Controller(wsgi.Controller):
 
     def __init__(self):
         self.compute_api = compute.API()
+        self._image_service = utils.import_object(FLAGS.image_service)
         super(Controller, self).__init__()
 
     def index(self, req):
@@ -117,6 +124,18 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPNotFound())
         return exc.HTTPAccepted()
 
+    def _get_kernel_ramdisk_from_image(self, image_id):
+        mapping_filename = FLAGS.os_krm_mapping_file
+
+        with open(mapping_filename) as f:
+            mapping = json.load(f)
+            if image_id in mapping:
+                return mapping[image_id]
+
+        raise exception.NotFound(
+            _("No entry for image '%s' in mapping file '%s'") %
+                (image_id, mapping_filename))
+
     def create(self, req):
         """ Creates a new server for a given user """
         env = self._deserialize(req.body, req)
@@ -125,10 +144,15 @@ class Controller(wsgi.Controller):
 
         key_pair = auth_manager.AuthManager.get_key_pairs(
             req.environ['nova.context'])[0]
+        image_id = common.get_image_id_from_image_hash(self._image_service,
+            req.environ['nova.context'], env['server']['imageId'])
+        kernel_id, ramdisk_id = self._get_kernel_ramdisk_from_image(image_id)
         instances = self.compute_api.create(
             req.environ['nova.context'],
             instance_types.get_by_flavor_id(env['server']['flavorId']),
-            env['server']['imageId'],
+            image_id,
+            kernel_id=kernel_id,
+            ramdisk_id=ramdisk_id,
             display_name=env['server']['name'],
             display_description=env['server']['name'],
             key_name=key_pair['name'],
@@ -158,6 +182,7 @@ class Controller(wsgi.Controller):
         """ Multi-purpose method used to reboot, rebuild, and
         resize a server """
         input_dict = self._deserialize(req.body, req)
+        #TODO(sandy): rebuild/resize not supported.
         try:
             reboot_type = input_dict['reboot']['type']
         except Exception:
@@ -258,6 +283,15 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    def get_ajax_console(self, req, id):
+        """ Returns a url to an instance's ajaxterm console. """
+        try:
+            self.compute_api.get_ajax_console(req.environ['nova.context'],
+                int(id))
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+        return exc.HTTPAccepted()
+
     def diagnostics(self, req, id):
         """Permit Admins to retrieve server diagnostics."""
         ctxt = req.environ["nova.context"]
diff --git a/nova/api/openstack/sharedipgroups.py b/nova/api/openstack/shared_ip_groups.py
index 845f5bead..bd3cc23a8 100644
--- a/nova/api/openstack/sharedipgroups.py
+++ b/nova/api/openstack/shared_ip_groups.py
@@ -15,6 +15,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import logging
+
 from webob import exc
 
 from nova import wsgi
@@ -29,7 +31,7 @@ def _translate_keys(inst):
 def _translate_detail_keys(inst):
     """ Coerces a shared IP group instance into proper dictionary format with
     correctly mapped attributes """
-    return dict(sharedIpGroup=inst)
+    return dict(sharedIpGroups=inst)
 
 
 class Controller(wsgi.Controller):
@@ -54,12 +56,12 @@ class Controller(wsgi.Controller):
 
     def delete(self, req, id):
         """ Deletes a Shared IP Group """
-        raise faults.Fault(exc.HTTPNotFound())
+        raise faults.Fault(exc.HTTPNotImplemented())
 
-    def detail(self, req, id):
+    def detail(self, req):
         """ Returns a complete list of Shared IP Groups """
         return _translate_detail_keys({})
 
     def create(self, req):
         """ Creates a new Shared IP group """
-        raise faults.Fault(exc.HTTPNotFound())
+        raise faults.Fault(exc.HTTPNotImplemented())
diff --git a/nova/auth/ldapdriver.py b/nova/auth/ldapdriver.py
index c8de20028..bc53e0ec6 100644
--- a/nova/auth/ldapdriver.py
+++ b/nova/auth/ldapdriver.py
@@ -119,8 +119,7 @@ class LdapDriver(object):
 
     def get_project(self, pid):
         """Retrieve project by id"""
-        dn = 'cn=%s,%s' % (pid,
-                           FLAGS.ldap_project_subtree)
+        dn = self.__project_to_dn(pid)
         attr = self.__find_object(dn, LdapDriver.project_pattern)
         return self.__to_project(attr)
 
@@ -228,7 +227,8 @@ class LdapDriver(object):
             ('description', [description]),
             (LdapDriver.project_attribute, [manager_dn]),
             ('member', members)]
-        self.conn.add_s('cn=%s,%s' % (name, FLAGS.ldap_project_subtree), attr)
+        dn = self.__project_to_dn(name, search=False)
+        self.conn.add_s(dn, attr)
         return self.__to_project(dict(attr))
 
     def modify_project(self, project_id, manager_uid=None, description=None):
@@ -246,23 +246,22 @@ class LdapDriver(object):
                          manager_dn))
         if description:
             attr.append((self.ldap.MOD_REPLACE, 'description', description))
-        self.conn.modify_s('cn=%s,%s' % (project_id,
-                                         FLAGS.ldap_project_subtree),
-                           attr)
+        dn = self.__project_to_dn(project_id)
+        self.conn.modify_s(dn, attr)
 
     def add_to_project(self, uid, project_id):
         """Add user to project"""
-        dn = 'cn=%s,%s' % (project_id, FLAGS.ldap_project_subtree)
+        dn = self.__project_to_dn(project_id)
         return self.__add_to_group(uid, dn)
 
     def remove_from_project(self, uid, project_id):
         """Remove user from project"""
-        dn = 'cn=%s,%s' % (project_id, FLAGS.ldap_project_subtree)
+        dn = self.__project_to_dn(project_id)
         return self.__remove_from_group(uid, dn)
 
     def is_in_project(self, uid, project_id):
         """Check if user is in project"""
-        dn = 'cn=%s,%s' % (project_id, FLAGS.ldap_project_subtree)
+        dn = self.__project_to_dn(project_id)
         return self.__is_in_group(uid, dn)
 
     def has_role(self, uid, role, project_id=None):
@@ -302,7 +301,7 @@ class LdapDriver(object):
                     roles.append(role)
             return roles
         else:
-            project_dn = 'cn=%s,%s' % (project_id, FLAGS.ldap_project_subtree)
+            project_dn = self.__project_to_dn(project_id)
             query = ('(&(&(objectclass=groupOfNames)(!%s))(member=%s))' %
                      (LdapDriver.project_pattern, self.__uid_to_dn(uid)))
             roles = self.__find_objects(project_dn, query)
@@ -335,7 +334,7 @@ class LdapDriver(object):
 
     def delete_project(self, project_id):
         """Delete a project"""
-        project_dn = 'cn=%s,%s' % (project_id, FLAGS.ldap_project_subtree)
+        project_dn = self.__project_to_dn(project_id)
         self.__delete_roles(project_dn)
         self.__delete_group(project_dn)
 
@@ -367,9 +366,10 @@ class LdapDriver(object):
 
     def __get_ldap_user(self, uid):
         """Retrieve LDAP user entry by id"""
-        attr = self.__find_object(self.__uid_to_dn(uid),
-                                  '(objectclass=novaUser)')
-        return attr
+        dn = FLAGS.ldap_user_subtree
+        query = ('(&(%s=%s)(objectclass=novaUser))' %
+                 (FLAGS.ldap_user_id_attribute, uid))
+        return self.__find_object(dn, query)
 
     def __find_object(self, dn, query=None, scope=None):
         """Find an object by dn and query"""
@@ -420,15 +420,13 @@ class LdapDriver(object):
         query = '(objectclass=groupOfNames)'
         return self.__find_object(dn, query) is not None
 
-    @staticmethod
-    def __role_to_dn(role, project_id=None):
+    def __role_to_dn(self, role, project_id=None):
         """Convert role to corresponding dn"""
         if project_id is None:
             return FLAGS.__getitem__("ldap_%s" % role).value
         else:
-            return 'cn=%s,cn=%s,%s' % (role,
-                                       project_id,
-                                       FLAGS.ldap_project_subtree)
+            project_dn = self.__project_to_dn(project_id)
+            return 'cn=%s,%s' % (role, project_dn)
 
     def __create_group(self, group_dn, name, uid,
                        description, member_uids=None):
@@ -534,6 +532,42 @@ class LdapDriver(object):
         for role_dn in self.__find_role_dns(project_dn):
             self.__delete_group(role_dn)
 
+    def __to_project(self, attr):
+        """Convert ldap attributes to Project object"""
+        if attr is None:
+            return None
+        member_dns = attr.get('member', [])
+        return {
+            'id': attr['cn'][0],
+            'name': attr['cn'][0],
+            'project_manager_id':
+                self.__dn_to_uid(attr[LdapDriver.project_attribute][0]),
+            'description': attr.get('description', [None])[0],
+            'member_ids': [self.__dn_to_uid(x) for x in member_dns]}
+
+    def __uid_to_dn(self, uid, search=True):
+        """Convert uid to dn"""
+        # By default return a generated DN
+        userdn = (FLAGS.ldap_user_id_attribute + '=%s,%s'
+                  % (uid, FLAGS.ldap_user_subtree))
+        if search:
+            query = ('%s=%s' % (FLAGS.ldap_user_id_attribute, uid))
+            user = self.__find_dns(FLAGS.ldap_user_subtree, query)
+            if len(user) > 0:
+                userdn = user[0]
+        return userdn
+
+    def __project_to_dn(self, pid, search=True):
+        """Convert pid to dn"""
+        # By default return a generated DN
+        projectdn = ('cn=%s,%s' % (pid, FLAGS.ldap_project_subtree))
+        if search:
+            query = ('(&(cn=%s)%s)' % (pid, LdapDriver.project_pattern))
+            project = self.__find_dns(FLAGS.ldap_project_subtree, query)
+            if len(project) > 0:
+                projectdn = project[0]
+        return projectdn
+
     @staticmethod
     def __to_user(attr):
         """Convert ldap attributes to User object"""
@@ -550,30 +584,11 @@ class LdapDriver(object):
         else:
             return None
 
-    def __to_project(self, attr):
-        """Convert ldap attributes to Project object"""
-        if attr is None:
-            return None
-        member_dns = attr.get('member', [])
-        return {
-            'id': attr['cn'][0],
-            'name': attr['cn'][0],
-            'project_manager_id':
-                self.__dn_to_uid(attr[LdapDriver.project_attribute][0]),
-            'description': attr.get('description', [None])[0],
-            'member_ids': [self.__dn_to_uid(x) for x in member_dns]}
-
     @staticmethod
     def __dn_to_uid(dn):
         """Convert user dn to uid"""
         return dn.split(',')[0].split('=')[1]
 
-    @staticmethod
-    def __uid_to_dn(uid):
-        """Convert uid to dn"""
-        return (FLAGS.ldap_user_id_attribute + '=%s,%s'
-                % (uid, FLAGS.ldap_user_subtree))
-
 
 class FakeLdapDriver(LdapDriver):
     """Fake Ldap Auth driver"""
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index 5685ae5e2..6fb9b522f 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -684,8 +684,7 @@ class AuthManager(object):
         else:
             regions = {'nova': FLAGS.cc_host}
         for region, host in regions.iteritems():
-            rc = self.__generate_rc(user.access,
-                                    user.secret,
+            rc = self.__generate_rc(user,
                                     pid,
                                     use_dmz,
                                     host)
@@ -725,7 +724,7 @@ class AuthManager(object):
         return self.__generate_rc(user.access, user.secret, pid, use_dmz)
 
     @staticmethod
-    def __generate_rc(access, secret, pid, use_dmz=True, host=None):
+    def __generate_rc(user, pid, use_dmz=True, host=None):
         """Generate rc file for user"""
         if use_dmz:
             cc_host = FLAGS.cc_dmz
@@ -738,14 +737,19 @@ class AuthManager(object):
             s3_host = host
             cc_host = host
         rc = open(FLAGS.credentials_template).read()
-        rc = rc % {'access': access,
+        rc = rc % {'access': user.access,
                    'project': pid,
-                   'secret': secret,
+                   'secret': user.secret,
                    'ec2': '%s://%s:%s%s' % (FLAGS.ec2_prefix,
                                             cc_host,
                                             FLAGS.cc_port,
                                             FLAGS.ec2_suffix),
                    's3': 'http://%s:%s' % (s3_host, FLAGS.s3_port),
+                   'os': '%s://%s:%s%s' % (FLAGS.os_prefix,
+                                            cc_host,
+                                            FLAGS.osapi_port,
+                                            FLAGS.os_suffix),
+                   'user': user.name,
                    'nova': FLAGS.ca_file,
                    'cert': FLAGS.credential_cert_file,
                    'key': FLAGS.credential_key_file}
diff --git a/nova/auth/novarc.template b/nova/auth/novarc.template
index 1b8ecb173..c53a4acdc 100644
--- a/nova/auth/novarc.template
+++ b/nova/auth/novarc.template
@@ -10,3 +10,7 @@ export NOVA_CERT=${NOVA_KEY_DIR}/%(nova)s
 export EUCALYPTUS_CERT=${NOVA_CERT} # euca-bundle-image seems to require this set
 alias ec2-bundle-image="ec2-bundle-image --cert ${EC2_CERT} --privatekey ${EC2_PRIVATE_KEY} --user 42 --ec2cert ${NOVA_CERT}"
 alias ec2-upload-bundle="ec2-upload-bundle -a ${EC2_ACCESS_KEY} -s ${EC2_SECRET_KEY} --url ${S3_URL} --ec2cert ${NOVA_CERT}"
+export CLOUD_SERVERS_API_KEY="%(access)s"
+export CLOUD_SERVERS_USERNAME="%(user)s"
+export CLOUD_SERVERS_URL="%(os)s"
+
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 630754395..896c2a7a6 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -110,6 +110,8 @@ class API(base.Base):
                 ramdisk_id = None
                 LOG.debug(_("Creating a raw instance"))
             # Make sure we have access to kernel and ramdisk (if not raw)
+            logging.debug("Using Kernel=%s, Ramdisk=%s" %
+                           (kernel_id, ramdisk_id))
             if kernel_id:
                 self.image_service.show(context, kernel_id)
             if ramdisk_id:
@@ -173,7 +175,8 @@ class API(base.Base):
 
             # Set sane defaults if not specified
             updates = dict(hostname=self.hostname_factory(instance_id))
-            if 'display_name' not in instance:
+            if (not hasattr(instance, 'display_name') or
+                    instance.display_name == None):
                 updates['display_name'] = "Server %s" % instance_id
 
             instance = self.update(context, instance_id, **updates)
@@ -185,7 +188,11 @@ class API(base.Base):
                      FLAGS.scheduler_topic,
                      {"method": "run_instance",
                       "args": {"topic": FLAGS.compute_topic,
-                               "instance_id": instance_id}})
+                               "instance_id": instance_id,
+                               "availability_zone": availability_zone}})
+
+        for group_id in security_groups:
+            self.trigger_security_group_members_refresh(elevated, group_id)
 
         return [dict(x.iteritems()) for x in instances]
 
@@ -206,6 +213,60 @@ class API(base.Base):
                       'project_id': context.project_id}
             db.security_group_create(context, values)
 
+    def trigger_security_group_rules_refresh(self, context, security_group_id):
+        """Called when a rule is added to or removed from a security_group"""
+
+        security_group = self.db.security_group_get(context, security_group_id)
+
+        hosts = set()
+        for instance in security_group['instances']:
+            if instance['host'] is not None:
+                hosts.add(instance['host'])
+
+        for host in hosts:
+            rpc.cast(context,
+                     self.db.queue_get_for(context, FLAGS.compute_topic, host),
+                     {"method": "refresh_security_group_rules",
+                      "args": {"security_group_id": security_group.id}})
+
+    def trigger_security_group_members_refresh(self, context, group_id):
+        """Called when a security group gains a new or loses a member
+
+        Sends an update request to each compute node for whom this is
+        relevant."""
+
+        # First, we get the security group rules that reference this group as
+        # the grantee..
+        security_group_rules = \
+                self.db.security_group_rule_get_by_security_group_grantee(
+                                                                     context,
+                                                                     group_id)
+
+        # ..then we distill the security groups to which they belong..
+        security_groups = set()
+        for rule in security_group_rules:
+            security_groups.add(rule['parent_group_id'])
+
+        # ..then we find the instances that are members of these groups..
+        instances = set()
+        for security_group in security_groups:
+            for instance in security_group['instances']:
+                instances.add(instance['id'])
+
+        # ...then we find the hosts where they live...
+        hosts = set()
+        for instance in instances:
+            if instance['host']:
+                hosts.add(instance['host'])
+
+        # ...and finally we tell these nodes to refresh their view of this
+        # particular security group.
+        for host in hosts:
+            rpc.cast(context,
+                     self.db.queue_get_for(context, FLAGS.compute_topic, host),
+                     {"method": "refresh_security_group_members",
+                      "args": {"security_group_id": group_id}})
+
     def update(self, context, instance_id, **kwargs):
         """Updates the instance in the datastore.
 
@@ -358,7 +419,26 @@ class API(base.Base):
         rpc.cast(context,
                  self.db.queue_get_for(context, FLAGS.compute_topic, host),
                  {"method": "unrescue_instance",
-                  "args": {"instance_id": instance_id}})
+                  "args": {"instance_id": instance['id']}})
+
+    def get_ajax_console(self, context, instance_id):
+        """Get a url to an AJAX Console"""
+
+        instance = self.get(context, instance_id)
+
+        output = rpc.call(context,
+                          '%s.%s' % (FLAGS.compute_topic,
+                                     instance['host']),
+                          {'method': 'get_ajax_console',
+                           'args': {'instance_id': instance['id']}})
+
+        rpc.cast(context, '%s' % FLAGS.ajax_console_proxy_topic,
+                 {'method': 'authorize_ajax_console',
+                  'args': {'token': output['token'], 'host': output['host'],
+                  'port': output['port']}})
+
+        return {'url': '%s?token=%s' % (FLAGS.ajax_console_proxy_url,
+                output['token'])}
 
     def lock(self, context, instance_id):
         """
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index 29133b76d..6b2fc4adb 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -35,6 +35,8 @@ terminating it.
 """
 
 import datetime
+import logging
+import socket
 import functools
 
 from nova import exception
@@ -52,6 +54,9 @@ flags.DEFINE_string('compute_driver', 'nova.virt.connection.get_connection',
                     'Driver to use for controlling virtualization')
 flags.DEFINE_string('stub_network', False,
                     'Stub network related code')
+flags.DEFINE_string('console_host', socket.gethostname(),
+                    'Console proxy host to use to connect to instances on'
+                    'this host.')
 
 LOG = logging.getLogger('nova.compute.manager')
 
@@ -122,6 +127,15 @@ class ComputeManager(manager.Manager):
             state = power_state.NOSTATE
         self.db.instance_set_state(context, instance_id, state)
 
+    def get_console_topic(self, context, **_kwargs):
+        """Retrieves the console host for a project on this host
+           Currently this is just set in the flags for each compute
+           host."""
+        #TODO(mdragon): perhaps make this variable by console_type?
+        return self.db.queue_get_for(context,
+                                     FLAGS.console_topic,
+                                     FLAGS.console_host)
+
     def get_network_topic(self, context, **_kwargs):
         """Retrieves the network host for a project on this host"""
         # TODO(vish): This method should be memoized. This will make
@@ -136,10 +150,20 @@ class ComputeManager(manager.Manager):
                                      FLAGS.network_topic,
                                      host)
 
+    def get_console_pool_info(self, context, console_type):
+        return self.driver.get_console_pool_info(console_type)
+
+    @exception.wrap_exception
+    def refresh_security_group_rules(self, context,
+                                     security_group_id, **_kwargs):
+        """This call passes straight through to the virtualization driver."""
+        return self.driver.refresh_security_group_rules(security_group_id)
+
     @exception.wrap_exception
-    def refresh_security_group(self, context, security_group_id, **_kwargs):
-        """This call passes stright through to the virtualization driver."""
-        self.driver.refresh_security_group(security_group_id)
+    def refresh_security_group_members(self, context,
+                                       security_group_id, **_kwargs):
+        """This call passes straight through to the virtualization driver."""
+        return self.driver.refresh_security_group_members(security_group_id)
 
     @exception.wrap_exception
     def run_instance(self, context, instance_id, **_kwargs):
@@ -447,6 +471,14 @@ class ComputeManager(manager.Manager):
         return self.driver.get_console_output(instance_ref)
 
     @exception.wrap_exception
+    def get_ajax_console(self, context, instance_id):
+        """Return connection information for an ajax console"""
+        context = context.elevated()
+        logging.debug(_("instance %s: getting ajax console"), instance_id)
+        instance_ref = self.db.instance_get(context, instance_id)
+
+        return self.driver.get_ajax_console(instance_ref)
+
     @checks_instance_lock
     def attach_volume(self, context, instance_id, volume_id, mountpoint):
         """Attach a volume to an instance."""
diff --git a/nova/console/__init__.py b/nova/console/__init__.py
new file mode 100644
index 000000000..dfc72cd61
--- /dev/null
+++ b/nova/console/__init__.py
@@ -0,0 +1,13 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+"""
+:mod:`nova.console` -- Console Prxy to set up VM console access (i.e. with xvp)
+=====================================================
+
+.. automodule:: nova.console
+   :platform: Unix
+   :synopsis: Wrapper around console proxies such as xvp to set up
+              multitenant VM console access
+.. moduleauthor:: Monsyne Dragon <mdragon@rackspace.com>
+"""
+from nova.console.api import API
diff --git a/nova/console/api.py b/nova/console/api.py
new file mode 100644
index 000000000..3850d2c44
--- /dev/null
+++ b/nova/console/api.py
@@ -0,0 +1,75 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Handles ConsoleProxy API requests
+"""
+
+from nova import exception
+from nova.db import base
+
+
+from nova import flags
+from nova import rpc
+
+
+FLAGS = flags.FLAGS
+
+
+class API(base.Base):
+    """API for spining up or down console proxy connections"""
+
+    def __init__(self, **kwargs):
+        super(API, self).__init__(**kwargs)
+
+    def get_consoles(self, context, instance_id):
+        return self.db.console_get_all_by_instance(context, instance_id)
+
+    def get_console(self, context, instance_id, console_id):
+        return self.db.console_get(context, console_id, instance_id)
+
+    def delete_console(self, context, instance_id, console_id):
+        console = self.db.console_get(context,
+                                      console_id,
+                                      instance_id)
+        pool = console['pool']
+        rpc.cast(context,
+                 self.db.queue_get_for(context,
+                                       FLAGS.console_topic,
+                                       pool['host']),
+                 {"method": "remove_console",
+                  "args": {"console_id": console['id']}})
+
+    def create_console(self, context, instance_id):
+        instance = self.db.instance_get(context, instance_id)
+        #NOTE(mdragon): If we wanted to return this the console info
+        #               here, as we would need to do a call.
+        #               They can just do an index later to fetch
+        #               console info. I am not sure which is better
+        #               here.
+        rpc.cast(context,
+                 self._get_console_topic(context, instance['host']),
+                 {"method": "add_console",
+                  "args": {"instance_id": instance_id}})
+
+    def _get_console_topic(self, context, instance_host):
+        topic = self.db.queue_get_for(context,
+                                      FLAGS.compute_topic,
+                                      instance_host)
+        return rpc.call(context,
+                        topic,
+                        {"method": "get_console_topic", "args": {'fake': 1}})
diff --git a/nova/console/fake.py b/nova/console/fake.py
new file mode 100644
index 000000000..7a90d5221
--- /dev/null
+++ b/nova/console/fake.py
@@ -0,0 +1,58 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Fake ConsoleProxy driver for tests.
+"""
+
+from nova import exception
+
+
+class FakeConsoleProxy(object):
+    """Fake ConsoleProxy driver."""
+
+    @property
+    def console_type(self):
+        return "fake"
+
+    def setup_console(self, context, console):
+        """Sets up actual proxies"""
+        pass
+
+    def teardown_console(self, context, console):
+        """Tears down actual proxies"""
+        pass
+
+    def init_host(self):
+        """Start up any config'ed consoles on start"""
+        pass
+
+    def generate_password(self, length=8):
+        """Returns random console password"""
+        return "fakepass"
+
+    def get_port(self, context):
+        """get available port for consoles that need one"""
+        return 5999
+
+    def fix_pool_password(self, password):
+        """Trim password to length, and any other massaging"""
+        return password
+
+    def fix_console_password(self, password):
+        """Trim password to length, and any other massaging"""
+        return password
diff --git a/nova/console/manager.py b/nova/console/manager.py
new file mode 100644
index 000000000..c55ca8e8f
--- /dev/null
+++ b/nova/console/manager.py
@@ -0,0 +1,127 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Console Proxy Service
+"""
+
+import functools
+import logging
+import socket
+
+from nova import exception
+from nova import flags
+from nova import manager
+from nova import rpc
+from nova import utils
+
+FLAGS = flags.FLAGS
+flags.DEFINE_string('console_driver',
+                    'nova.console.xvp.XVPConsoleProxy',
+                    'Driver to use for the console proxy')
+flags.DEFINE_boolean('stub_compute', False,
+                     'Stub calls to compute worker for tests')
+flags.DEFINE_string('console_public_hostname',
+                    socket.gethostname(),
+                    'Publicly visable name for this console host')
+
+
+class ConsoleProxyManager(manager.Manager):
+
+    """ Sets up and tears down any proxy connections needed for accessing
+        instance consoles securely"""
+
+    def __init__(self, console_driver=None, *args, **kwargs):
+        if not console_driver:
+            console_driver = FLAGS.console_driver
+        self.driver = utils.import_object(console_driver)
+        super(ConsoleProxyManager, self).__init__(*args, **kwargs)
+        self.driver.host = self.host
+
+    def init_host(self):
+        self.driver.init_host()
+
+    @exception.wrap_exception
+    def add_console(self, context, instance_id, password=None,
+                    port=None, **kwargs):
+        instance = self.db.instance_get(context, instance_id)
+        host = instance['host']
+        name = instance['name']
+        pool = self.get_pool_for_instance_host(context, host)
+        try:
+            console = self.db.console_get_by_pool_instance(context,
+                                                      pool['id'],
+                                                      instance_id)
+        except exception.NotFound:
+            logging.debug("Adding console")
+            if not password:
+                password = self.driver.generate_password()
+            if not port:
+                port = self.driver.get_port(context)
+            console_data = {'instance_name': name,
+                            'instance_id': instance_id,
+                            'password': password,
+                            'pool_id': pool['id']}
+            if port:
+                console_data['port'] = port
+            console = self.db.console_create(context, console_data)
+            self.driver.setup_console(context, console)
+        return console['id']
+
+    @exception.wrap_exception
+    def remove_console(self, context, console_id, **_kwargs):
+        try:
+            console = self.db.console_get(context, console_id)
+        except exception.NotFound:
+            logging.debug(_('Tried to remove non-existant console '
+                            '%(console_id)s.') %
+                            {'console_id': console_id})
+            return
+        self.db.console_delete(context, console_id)
+        self.driver.teardown_console(context, console)
+
+    def get_pool_for_instance_host(self, context, instance_host):
+        context = context.elevated()
+        console_type = self.driver.console_type
+        try:
+            pool = self.db.console_pool_get_by_host_type(context,
+                                                         instance_host,
+                                                         self.host,
+                                                         console_type)
+        except exception.NotFound:
+            #NOTE(mdragon): Right now, the only place this info exists is the
+            #               compute worker's flagfile, at least for
+            #               xenserver. Thus we ned to ask.
+            if FLAGS.stub_compute:
+                pool_info = {'address': '127.0.0.1',
+                             'username': 'test',
+                             'password': '1234pass'}
+            else:
+                pool_info = rpc.call(context,
+                                 self.db.queue_get_for(context,
+                                                   FLAGS.compute_topic,
+                                                   instance_host),
+                       {"method": "get_console_pool_info",
+                        "args": {"console_type": console_type}})
+            pool_info['password'] = self.driver.fix_pool_password(
+                                                    pool_info['password'])
+            pool_info['host'] = self.host
+            pool_info['public_hostname'] = FLAGS.console_public_hostname
+            pool_info['console_type'] = self.driver.console_type
+            pool_info['compute_host'] = instance_host
+            pool = self.db.console_pool_create(context, pool_info)
+        return pool
diff --git a/nova/console/xvp.conf.template b/nova/console/xvp.conf.template
new file mode 100644
index 000000000..695ddbe96
--- /dev/null
+++ b/nova/console/xvp.conf.template
@@ -0,0 +1,16 @@
+# One time password use with time window
+OTP ALLOW IPCHECK HTTP 60
+#if $multiplex_port
+MULTIPLEX $multiplex_port 
+#end if
+
+#for $pool in $pools
+POOL $pool.address
+  DOMAIN $pool.address
+  MANAGER root $pool.password 
+  HOST $pool.address
+    VM - dummy 0123456789ABCDEF
+  #for $console in $pool.consoles
+    VM #if $multiplex_port then '-' else $console.port # $console.instance_name $pass_encode($console.password)
+  #end for 
+#end for 
diff --git a/nova/console/xvp.py b/nova/console/xvp.py
new file mode 100644
index 000000000..2a76223da
--- /dev/null
+++ b/nova/console/xvp.py
@@ -0,0 +1,194 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+XVP (Xenserver VNC Proxy) driver.
+"""
+
+import fcntl
+import logging
+import os
+import signal
+import subprocess
+
+from Cheetah.Template import Template
+
+from nova import context
+from nova import db
+from nova import exception
+from nova import flags
+from nova import utils
+
+flags.DEFINE_string('console_xvp_conf_template',
+                    utils.abspath('console/xvp.conf.template'),
+                    'XVP conf template')
+flags.DEFINE_string('console_xvp_conf',
+                    '/etc/xvp.conf',
+                    'generated XVP conf file')
+flags.DEFINE_string('console_xvp_pid',
+                    '/var/run/xvp.pid',
+                    'XVP master process pid file')
+flags.DEFINE_string('console_xvp_log',
+                    '/var/log/xvp.log',
+                    'XVP log file')
+flags.DEFINE_integer('console_xvp_multiplex_port',
+                     5900,
+                     "port for XVP to multiplex VNC connections on")
+FLAGS = flags.FLAGS
+
+
+class XVPConsoleProxy(object):
+    """Sets up XVP config, and manages xvp daemon"""
+
+    def __init__(self):
+        self.xvpconf_template = open(FLAGS.console_xvp_conf_template).read()
+        self.host = FLAGS.host  # default, set by manager.
+        super(XVPConsoleProxy, self).__init__()
+
+    @property
+    def console_type(self):
+        return "vnc+xvp"
+
+    def get_port(self, context):
+        """get available port for consoles that need one"""
+        #TODO(mdragon): implement port selection for non multiplex ports,
+        #               we are not using that, but someone else may want
+        #               it.
+        return FLAGS.console_xvp_multiplex_port
+
+    def setup_console(self, context, console):
+        """Sets up actual proxies"""
+        self._rebuild_xvp_conf(context.elevated())
+
+    def teardown_console(self, context, console):
+        """Tears down actual proxies"""
+        self._rebuild_xvp_conf(context.elevated())
+
+    def init_host(self):
+        """Start up any config'ed consoles on start"""
+        ctxt = context.get_admin_context()
+        self._rebuild_xvp_conf(ctxt)
+
+    def fix_pool_password(self, password):
+        """Trim password to length, and encode"""
+        return self._xvp_encrypt(password, is_pool_password=True)
+
+    def fix_console_password(self, password):
+        """Trim password to length, and encode"""
+        return self._xvp_encrypt(password)
+
+    def generate_password(self, length=8):
+        """Returns random console password"""
+        return os.urandom(length * 2).encode('base64')[:length]
+
+    def _rebuild_xvp_conf(self, context):
+        logging.debug("Rebuilding xvp conf")
+        pools = [pool for pool in
+                 db.console_pool_get_all_by_host_type(context, self.host,
+                                                       self.console_type)
+                  if pool['consoles']]
+        if not pools:
+            logging.debug("No console pools!")
+            self._xvp_stop()
+            return
+        conf_data = {'multiplex_port': FLAGS.console_xvp_multiplex_port,
+                     'pools': pools,
+                     'pass_encode': self.fix_console_password}
+        config = str(Template(self.xvpconf_template, searchList=[conf_data]))
+        self._write_conf(config)
+        self._xvp_restart()
+
+    def _write_conf(self, config):
+        logging.debug('Re-wrote %s' % FLAGS.console_xvp_conf)
+        with open(FLAGS.console_xvp_conf, 'w') as cfile:
+            cfile.write(config)
+
+    def _xvp_stop(self):
+        logging.debug("Stopping xvp")
+        pid = self._xvp_pid()
+        if not pid:
+            return
+        try:
+            os.kill(pid, signal.SIGTERM)
+        except OSError:
+            #if it's already not running, no problem.
+            pass
+
+    def _xvp_start(self):
+        if self._xvp_check_running():
+            return
+        logging.debug("Starting xvp")
+        try:
+            utils.execute('xvp -p %s -c %s -l %s' %
+                          (FLAGS.console_xvp_pid,
+                           FLAGS.console_xvp_conf,
+                           FLAGS.console_xvp_log))
+        except exception.ProcessExecutionError, err:
+            logging.error("Error starting xvp: %s" % err)
+
+    def _xvp_restart(self):
+        logging.debug("Restarting xvp")
+        if not self._xvp_check_running():
+            logging.debug("xvp not running...")
+            self._xvp_start()
+        else:
+            pid = self._xvp_pid()
+            os.kill(pid, signal.SIGUSR1)
+
+    def _xvp_pid(self):
+        try:
+            with open(FLAGS.console_xvp_pid, 'r') as pidfile:
+                pid = int(pidfile.read())
+        except IOError:
+            return None
+        except ValueError:
+            return None
+        return pid
+
+    def _xvp_check_running(self):
+        pid = self._xvp_pid()
+        if not pid:
+            return False
+        try:
+            os.kill(pid, 0)
+        except OSError:
+            return False
+        return True
+
+    def _xvp_encrypt(self, password, is_pool_password=False):
+        """Call xvp to obfuscate passwords for config file.
+
+        Args:
+            - password: the password to encode, max 8 char for vm passwords,
+                        and 16 chars for pool passwords. passwords will
+                        be trimmed to max len before encoding.
+            - is_pool_password: True if this this is the XenServer api password
+                                False if it's a VM console password
+              (xvp uses different keys and max lengths for pool passwords)
+
+        Note that xvp's obfuscation should not be considered 'real' encryption.
+        It simply DES encrypts the passwords with static keys plainly viewable
+        in the xvp source code."""
+        maxlen = 8
+        flag = '-e'
+        if is_pool_password:
+            maxlen = 16
+            flag = '-x'
+        #xvp will blow up on passwords that are too long (mdragon)
+        password = password[:maxlen]
+        out, err = utils.execute('xvp %s' % flag, process_input=password)
+        return out.strip()
diff --git a/nova/db/api.py b/nova/db/api.py
index 0fa5eb1e8..1f81ef145 100644
--- a/nova/db/api.py
+++ b/nova/db/api.py
@@ -81,11 +81,21 @@ def service_get(context, service_id):
     return IMPL.service_get(context, service_id)
 
 
+def service_get_all(context, disabled=False):
+    """Get all service."""
+    return IMPL.service_get_all(context, None, disabled)
+
+
 def service_get_all_by_topic(context, topic):
-    """Get all compute services for a given topic."""
+    """Get all services for a given topic."""
     return IMPL.service_get_all_by_topic(context, topic)
 
 
+def service_get_all_by_host(context, host):
+    """Get all services for a given host."""
+    return IMPL.service_get_all_by_host(context, host)
+
+
 def service_get_all_compute_sorted(context):
     """Get all compute services sorted by instance count.
 
@@ -772,6 +782,13 @@ def security_group_rule_get_by_security_group(context, security_group_id):
                                                           security_group_id)
 
 
+def security_group_rule_get_by_security_group_grantee(context,
+                                                      security_group_id):
+    """Get all rules that grant access to the given security group."""
+    return IMPL.security_group_rule_get_by_security_group_grantee(context,
+                                                             security_group_id)
+
+
 def security_group_rule_destroy(context, security_group_rule_id):
     """Deletes a security group rule."""
     return IMPL.security_group_rule_destroy(context, security_group_rule_id)
@@ -894,3 +911,57 @@ def host_get_networks(context, host):
 
     """
     return IMPL.host_get_networks(context, host)
+
+
+##################
+
+
+def console_pool_create(context, values):
+    """Create console pool."""
+    return IMPL.console_pool_create(context, values)
+
+
+def console_pool_get(context, pool_id):
+    """Get a console pool."""
+    return IMPL.console_pool_get(context, pool_id)
+
+
+def console_pool_get_by_host_type(context, compute_host, proxy_host,
+                                  console_type):
+    """Fetch a console pool for a given proxy host, compute host, and type."""
+    return IMPL.console_pool_get_by_host_type(context,
+                                              compute_host,
+                                              proxy_host,
+                                              console_type)
+
+
+def console_pool_get_all_by_host_type(context, host, console_type):
+    """Fetch all pools for given proxy host and type."""
+    return IMPL.console_pool_get_all_by_host_type(context,
+                                                  host,
+                                                  console_type)
+
+
+def console_create(context, values):
+    """Create a console."""
+    return IMPL.console_create(context, values)
+
+
+def console_delete(context, console_id):
+    """Delete a console."""
+    return IMPL.console_delete(context, console_id)
+
+
+def console_get_by_pool_instance(context, pool_id, instance_id):
+    """Get console entry for a given instance and pool."""
+    return IMPL.console_get_by_pool_instance(context, pool_id, instance_id)
+
+
+def console_get_all_by_instance(context, instance_id):
+    """Get consoles for a given instance."""
+    return IMPL.console_get_all_by_instance(context, instance_id)
+
+
+def console_get(context, console_id, instance_id=None):
+    """Get a specific console (possibly on a given instance)."""
+    return IMPL.console_get(context, console_id, instance_id)
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index 892f98526..516727487 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -135,6 +135,18 @@ def service_get(context, service_id, session=None):
 
 
 @require_admin_context
+def service_get_all(context, session=None, disabled=False):
+    if not session:
+        session = get_session()
+
+    result = session.query(models.Service).\
+                   filter_by(deleted=can_read_deleted(context)).\
+                   filter_by(disabled=disabled).\
+                   all()
+    return result
+
+
+@require_admin_context
 def service_get_all_by_topic(context, topic):
     session = get_session()
     return session.query(models.Service).\
@@ -145,6 +157,15 @@ def service_get_all_by_topic(context, topic):
 
 
 @require_admin_context
+def service_get_all_by_host(context, host):
+    session = get_session()
+    return session.query(models.Service).\
+                   filter_by(deleted=False).\
+                   filter_by(host=host).\
+                   all()
+
+
+@require_admin_context
 def _service_get_all_topic_subquery(context, session, topic, subq, label):
     sort_value = getattr(subq.c, label)
     return session.query(models.Service, func.coalesce(sort_value, 0)).\
@@ -650,7 +671,7 @@ def instance_get(context, instance_id, session=None):
     if is_admin_context(context):
         result = session.query(models.Instance).\
                          options(joinedload_all('fixed_ip.floating_ips')).\
-                         options(joinedload('security_groups')).\
+                         options(joinedload_all('security_groups.rules')).\
                          options(joinedload('volumes')).\
                          filter_by(id=instance_id).\
                          filter_by(deleted=can_read_deleted(context)).\
@@ -658,7 +679,7 @@ def instance_get(context, instance_id, session=None):
     elif is_user_context(context):
         result = session.query(models.Instance).\
                          options(joinedload_all('fixed_ip.floating_ips')).\
-                         options(joinedload('security_groups')).\
+                         options(joinedload_all('security_groups.rules')).\
                          options(joinedload('volumes')).\
                          filter_by(project_id=context.project_id).\
                          filter_by(id=instance_id).\
@@ -745,12 +766,14 @@ def instance_get_by_id(context, instance_id):
         result = session.query(models.Instance).\
                          options(joinedload_all('fixed_ip.floating_ips')).\
                          options(joinedload('security_groups')).\
+                         options(joinedload_all('fixed_ip.floating_ips')).\
                          filter_by(id=instance_id).\
                          filter_by(deleted=can_read_deleted(context)).\
                          first()
     elif is_user_context(context):
         result = session.query(models.Instance).\
                          options(joinedload('security_groups')).\
+                         options(joinedload_all('fixed_ip.floating_ips')).\
                          filter_by(project_id=context.project_id).\
                          filter_by(id=instance_id).\
                          filter_by(deleted=False).\
@@ -1580,6 +1603,44 @@ def security_group_rule_get(context, security_group_rule_id, session=None):
 
 
 @require_context
+def security_group_rule_get_by_security_group(context, security_group_id,
+                                              session=None):
+    if not session:
+        session = get_session()
+    if is_admin_context(context):
+        result = session.query(models.SecurityGroupIngressRule).\
+                         filter_by(deleted=can_read_deleted(context)).\
+                         filter_by(parent_group_id=security_group_id).\
+                         all()
+    else:
+        # TODO(vish): Join to group and check for project_id
+        result = session.query(models.SecurityGroupIngressRule).\
+                         filter_by(deleted=False).\
+                         filter_by(parent_group_id=security_group_id).\
+                         all()
+    return result
+
+
+@require_context
+def security_group_rule_get_by_security_group_grantee(context,
+                                                      security_group_id,
+                                                      session=None):
+    if not session:
+        session = get_session()
+    if is_admin_context(context):
+        result = session.query(models.SecurityGroupIngressRule).\
+                         filter_by(deleted=can_read_deleted(context)).\
+                         filter_by(group_id=security_group_id).\
+                         all()
+    else:
+        result = session.query(models.SecurityGroupIngressRule).\
+                         filter_by(deleted=False).\
+                         filter_by(group_id=security_group_id).\
+                         all()
+    return result
+
+
+@require_context
 def security_group_rule_create(context, values):
     security_group_rule_ref = models.SecurityGroupIngressRule()
     security_group_rule_ref.update(values)
@@ -1814,3 +1875,111 @@ def host_get_networks(context, host):
                        filter_by(deleted=False).\
                        filter_by(host=host).\
                        all()
+
+
+##################
+
+
+def console_pool_create(context, values):
+    pool = models.ConsolePool()
+    pool.update(values)
+    pool.save()
+    return pool
+
+
+def console_pool_get(context, pool_id):
+    session = get_session()
+    result = session.query(models.ConsolePool).\
+                     filter_by(deleted=False).\
+                     filter_by(id=pool_id).\
+                     first()
+    if not result:
+        raise exception.NotFound(_("No console pool with id %(pool_id)s") %
+                                 {'pool_id': pool_id})
+
+    return result
+
+
+def console_pool_get_by_host_type(context, compute_host, host,
+                                  console_type):
+    session = get_session()
+    result = session.query(models.ConsolePool).\
+                   filter_by(host=host).\
+                   filter_by(console_type=console_type).\
+                   filter_by(compute_host=compute_host).\
+                   filter_by(deleted=False).\
+                   options(joinedload('consoles')).\
+                   first()
+    if not result:
+        raise exception.NotFound(_('No console pool of type %(type)s '
+                                   'for compute host %(compute_host)s '
+                                   'on proxy host %(host)s') %
+                                   {'type': console_type,
+                                    'compute_host': compute_host,
+                                    'host': host})
+    return result
+
+
+def console_pool_get_all_by_host_type(context, host, console_type):
+    session = get_session()
+    return session.query(models.ConsolePool).\
+                   filter_by(host=host).\
+                   filter_by(console_type=console_type).\
+                   filter_by(deleted=False).\
+                   options(joinedload('consoles')).\
+                   all()
+
+
+def console_create(context, values):
+    console = models.Console()
+    console.update(values)
+    console.save()
+    return console
+
+
+def console_delete(context, console_id):
+    session = get_session()
+    with session.begin():
+        # consoles are meant to be transient. (mdragon)
+        session.execute('delete from consoles '
+                        'where id=:id', {'id': console_id})
+
+
+def console_get_by_pool_instance(context, pool_id, instance_id):
+    session = get_session()
+    result = session.query(models.Console).\
+                   filter_by(pool_id=pool_id).\
+                   filter_by(instance_id=instance_id).\
+                   options(joinedload('pool')).\
+                   first()
+    if not result:
+        raise exception.NotFound(_('No console for instance %(instance_id)s '
+                                 'in pool %(pool_id)s') %
+                                 {'instance_id': instance_id,
+                                  'pool_id': pool_id})
+    return result
+
+
+def console_get_all_by_instance(context, instance_id):
+    session = get_session()
+    results = session.query(models.Console).\
+                   filter_by(instance_id=instance_id).\
+                   options(joinedload('pool')).\
+                   all()
+    return results
+
+
+def console_get(context, console_id, instance_id=None):
+    session = get_session()
+    query = session.query(models.Console).\
+                    filter_by(id=console_id)
+    if instance_id:
+        query = query.filter_by(instance_id=instance_id)
+    result = query.options(joinedload('pool')).first()
+    if not result:
+        idesc = (_("on instance %s") % instance_id)  if instance_id else ""
+        raise exception.NotFound(_("No console with id %(console_id)s"
+                                   " %(instance)s") %
+                                  {'instance': idesc,
+                                  'console_id': console_id})
+    return result
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index d730a0ebc..0e56ea7e6 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -155,6 +155,7 @@ class Service(BASE, NovaBase):
     topic = Column(String(255))
     report_count = Column(Integer, nullable=False, default=0)
     disabled = Column(Boolean, default=False)
+    availability_zone = Column(String(255), default='nova')
 
 
 class Certificate(BASE, NovaBase):
@@ -546,6 +547,31 @@ class FloatingIp(BASE, NovaBase):
     host = Column(String(255))  # , ForeignKey('hosts.id'))
 
 
+class ConsolePool(BASE, NovaBase):
+    """Represents pool of consoles on the same physical node."""
+    __tablename__ = 'console_pools'
+    id = Column(Integer, primary_key=True)
+    address = Column(String(255))
+    username = Column(String(255))
+    password = Column(String(255))
+    console_type = Column(String(255))
+    public_hostname = Column(String(255))
+    host = Column(String(255))
+    compute_host = Column(String(255))
+
+
+class Console(BASE, NovaBase):
+    """Represents a console session for an instance."""
+    __tablename__ = 'consoles'
+    id = Column(Integer, primary_key=True)
+    instance_name = Column(String(255))
+    instance_id = Column(Integer)
+    password = Column(String(255))
+    port = Column(Integer, nullable=True)
+    pool_id = Column(Integer, ForeignKey('console_pools.id'))
+    pool = relationship(ConsolePool, backref=backref('consoles'))
+
+
 def register_models():
     """Register Models and create metadata.
 
@@ -558,7 +584,7 @@ def register_models():
               Volume, ExportDevice, IscsiTarget, FixedIp, FloatingIp,
               Network, SecurityGroup, SecurityGroupIngressRule,
               SecurityGroupInstanceAssociation, AuthToken, User,
-              Project, Certificate)  # , Image, Host
+              Project, Certificate, ConsolePool, Console)  # , Image, Host
     engine = create_engine(FLAGS.sql_connection, echo=False)
     for model in models:
         model.metadata.create_all(engine)
diff --git a/nova/flags.py b/nova/flags.py
index f5c2d4233..ef66c3f3a 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -200,10 +200,22 @@ def DECLARE(name, module_string, flag_values=FLAGS):
                 "%s not defined by %s" % (name, module_string))
 
 
+def _get_my_ip():
+    """Returns the actual ip of the local machine."""
+    try:
+        csock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        csock.connect(('8.8.8.8', 80))
+        (addr, port) = csock.getsockname()
+        csock.close()
+        return addr
+    except socket.gaierror as ex:
+        return "127.0.0.1"
+
+
 # __GLOBAL FLAGS ONLY__
 # Define any app-specific flags in their own files, docs at:
-# http://code.google.com/p/python-gflags/source/browse/trunk/gflags.py#39
-
+# http://code.google.com/p/python-gflags/source/browse/trunk/gflags.py#a9
+DEFINE_string('my_ip', _get_my_ip(), 'host ip address')
 DEFINE_list('region_list',
             [],
             'list of region=url pairs separated by commas')
@@ -211,16 +223,25 @@ DEFINE_string('connection_type', 'libvirt', 'libvirt, xenapi or fake')
 DEFINE_string('aws_access_key_id', 'admin', 'AWS Access ID')
 DEFINE_string('aws_secret_access_key', 'admin', 'AWS Access Key')
 DEFINE_integer('glance_port', 9292, 'glance port')
-DEFINE_string('glance_host', '127.0.0.1', 'glance host')
+DEFINE_string('glance_host', '$my_ip', 'glance host')
 DEFINE_integer('s3_port', 3333, 's3 port')
-DEFINE_string('s3_host', '127.0.0.1', 's3 host (for infrastructure)')
-DEFINE_string('s3_dmz', '127.0.0.1', 's3 dmz ip (for instances)')
+DEFINE_string('s3_host', '$my_ip', 's3 host (for infrastructure)')
+DEFINE_string('s3_dmz', '$my_ip', 's3 dmz ip (for instances)')
 DEFINE_string('compute_topic', 'compute', 'the topic compute nodes listen on')
+DEFINE_string('console_topic', 'console',
+              'the topic console proxy nodes listen on')
 DEFINE_string('scheduler_topic', 'scheduler',
               'the topic scheduler nodes listen on')
 DEFINE_string('volume_topic', 'volume', 'the topic volume nodes listen on')
 DEFINE_string('network_topic', 'network', 'the topic network nodes listen on')
-
+DEFINE_string('ajax_console_proxy_topic', 'ajax_proxy',
+              'the topic ajax proxy nodes listen on')
+DEFINE_string('ajax_console_proxy_url',
+              'http://127.0.0.1:8000',
+              'location of ajax console proxy, \
+               in the form "http://127.0.0.1:8000"')
+DEFINE_string('ajax_console_proxy_port',
+               8000, 'port that ajax_console_proxy binds')
 DEFINE_bool('verbose', False, 'show debug output')
 DEFINE_boolean('fake_rabbit', False, 'use a fake rabbit')
 DEFINE_bool('fake_network', False,
@@ -234,10 +255,13 @@ DEFINE_integer('rabbit_retry_interval', 10, 'rabbit connection retry interval')
 DEFINE_integer('rabbit_max_retries', 12, 'rabbit connection attempts')
 DEFINE_string('control_exchange', 'nova', 'the main exchange to connect to')
 DEFINE_string('ec2_prefix', 'http', 'prefix for ec2')
-DEFINE_string('cc_host', '127.0.0.1', 'ip of api server')
-DEFINE_string('cc_dmz', '127.0.0.1', 'internal ip of api server')
+DEFINE_string('os_prefix', 'http', 'prefix for openstack')
+DEFINE_string('cc_host', '$my_ip', 'ip of api server')
+DEFINE_string('cc_dmz', '$my_ip', 'internal ip of api server')
 DEFINE_integer('cc_port', 8773, 'cloud controller port')
+DEFINE_integer('osapi_port', 8774, 'OpenStack API port')
 DEFINE_string('ec2_suffix', '/services/Cloud', 'suffix for ec2')
+DEFINE_string('os_suffix', '/v1.0/', 'suffix for openstack')
 
 DEFINE_string('default_project', 'openstack', 'default project for openstack')
 DEFINE_string('default_image', 'ami-11111',
@@ -269,6 +293,8 @@ DEFINE_integer('sql_retry_interval', 10, 'sql connection retry interval')
 
 DEFINE_string('compute_manager', 'nova.compute.manager.ComputeManager',
               'Manager for compute')
+DEFINE_string('console_manager', 'nova.console.manager.ConsoleProxyManager',
+              'Manager for console proxy')
 DEFINE_string('network_manager', 'nova.network.manager.VlanManager',
               'Manager for network')
 DEFINE_string('volume_manager', 'nova.volume.manager.VolumeManager',
@@ -283,6 +309,5 @@ DEFINE_string('image_service', 'nova.image.s3.S3ImageService',
 DEFINE_string('host', socket.gethostname(),
               'name of this node')
 
-# UNUSED
 DEFINE_string('node_availability_zone', 'nova',
               'availability zone of this node')
diff --git a/nova/log.py b/nova/log.py
index 6f5377e87..c1428c051 100644
--- a/nova/log.py
+++ b/nova/log.py
@@ -34,24 +34,19 @@ import logging.handlers
 import traceback
 
 from nova import flags
-# TODO(todd): fix after version.py merge
-# from nova import version
+from nova import version
 
 
 FLAGS = flags.FLAGS
 
-# TODO(todd): fix after version.py merge
-# '(%(name)s %(nova_version)s): %(levelname)s '
 flags.DEFINE_string('logging_context_format_string',
-                    '(%(name)s): %(levelname)s '
+                    '(%(name)s %(nova_version)s): %(levelname)s '
                     '[%(request_id)s %(user)s '
                     '%(project)s] %(message)s',
                     'format string to use for log messages')
 
-# TODO(todd): fix after version.py merge
-# '(%(name)s %(nova_version)s): %(levelname)s [N/A] '
 flags.DEFINE_string('logging_default_format_string',
-                    '(%(name)s): %(levelname)s [N/A] '
+                    '(%(name)s %(nova_version)s): %(levelname)s [N/A] '
                     '%(message)s',
                     'format string to use for log messages')
 
@@ -162,8 +157,7 @@ class NovaLogger(logging.Logger):
             extra = {}
         if context:
             extra.update(_dictify_context(context))
-        # TODO(todd): fix after version.py merge
-        #extra.update({"nova_version": version.string_with_vcs()})
+        extra.update({"nova_version": version.version_string_with_vcs()})
         logging.Logger._log(self, level, msg, args, exc_info, extra)
 
     def addHandler(self, handler):
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index c525d5dc8..3743fc7e8 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -46,7 +46,7 @@ flags.DEFINE_string('vlan_interface', 'eth0',
                     'network device for vlans')
 flags.DEFINE_string('dhcpbridge', _bin_file('nova-dhcpbridge'),
                         'location of nova-dhcpbridge')
-flags.DEFINE_string('routing_source_ip', utils.get_my_ip(),
+flags.DEFINE_string('routing_source_ip', '$my_ip',
                     'Public IP of network host')
 flags.DEFINE_bool('use_nova_chains', False,
                   'use the nova_ routing chains instead of default')
@@ -209,6 +209,8 @@ def ensure_bridge(bridge, interface, net_attrs=None):
 
     _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
     _confirm_rule("FORWARD", "--out-interface %s -j ACCEPT" % bridge)
+    _execute("sudo iptables -N nova-local", check_exit_code=False)
+    _confirm_rule("FORWARD", "-j nova-local")
 
 
 def get_dhcp_hosts(context, network_id):
diff --git a/nova/network/manager.py b/nova/network/manager.py
index fd286f210..c75ecc671 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -74,7 +74,7 @@ flags.DEFINE_string('flat_network_dhcp_start', '10.0.0.2',
                     'Dhcp start for FlatDhcp')
 flags.DEFINE_integer('vlan_start', 100, 'First VLAN for private networks')
 flags.DEFINE_integer('num_networks', 1000, 'Number of networks to support')
-flags.DEFINE_string('vpn_ip', utils.get_my_ip(),
+flags.DEFINE_string('vpn_ip', '$my_ip',
                     'Public IP for the cloudpipe VPN servers')
 flags.DEFINE_integer('vpn_start', 1000, 'First Vpn port for private networks')
 flags.DEFINE_integer('network_size', 256,
diff --git a/nova/scheduler/zone.py b/nova/scheduler/zone.py
new file mode 100644
index 000000000..49786cd32
--- /dev/null
+++ b/nova/scheduler/zone.py
@@ -0,0 +1,56 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Availability Zone Scheduler implementation
+"""
+
+import random
+
+from nova.scheduler import driver
+from nova import db
+
+
+class ZoneScheduler(driver.Scheduler):
+    """Implements Scheduler as a random node selector."""
+
+    def hosts_up_with_zone(self, context, topic, zone):
+        """Return the list of hosts that have a running service
+        for topic and availability zone (if defined).
+        """
+
+        if zone is None:
+            return self.hosts_up(context, topic)
+
+        services = db.service_get_all_by_topic(context, topic)
+        return [service.host
+                for service in services
+                if self.service_is_up(service)
+                and service.availability_zone == zone]
+
+    def schedule(self, context, topic, *_args, **_kwargs):
+        """Picks a host that is up at random in selected
+        availability zone (if defined).
+        """
+
+        zone = _kwargs.get('availability_zone')
+        hosts = self.hosts_up_with_zone(context, topic, zone)
+        if not hosts:
+            raise driver.NoValidHost(_("No hosts found"))
+        return hosts[int(random.random() * len(hosts))]
diff --git a/nova/service.py b/nova/service.py
index 864a42469..8b2a22ce0 100644
--- a/nova/service.py
+++ b/nova/service.py
@@ -38,7 +38,6 @@ from nova import log as logging
 from nova import flags
 from nova import rpc
 from nova import utils
-from nova.db.sqlalchemy import models
 
 
 FLAGS = flags.FLAGS
@@ -114,11 +113,13 @@ class Service(object):
             self.timers.append(periodic)
 
     def _create_service_ref(self, context):
+        zone = FLAGS.node_availability_zone
         service_ref = db.service_create(context,
                                         {'host': self.host,
                                          'binary': self.binary,
                                          'topic': self.topic,
-                                         'report_count': 0})
+                                         'report_count': 0,
+                                         'availability_zone': zone})
         self.service_id = service_ref['id']
 
     def __getattr__(self, key):
@@ -209,6 +210,10 @@ class Service(object):
                 logging.exception(_("model server went away"))
 
                 try:
+                    # NOTE(vish): This is late-loaded to make sure that the
+                    #             database is not created before flags have
+                    #             been loaded.
+                    from nova.db.sqlalchemy import models
                     models.register_models()
                 except OperationalError:
                     logging.exception(_("Data store %s is unreachable."
diff --git a/nova/tests/api/openstack/fakes.py b/nova/tests/api/openstack/fakes.py
index 291a0e468..194304e79 100644
--- a/nova/tests/api/openstack/fakes.py
+++ b/nova/tests/api/openstack/fakes.py
@@ -107,7 +107,7 @@ def stub_out_rate_limiting(stubs):
 def stub_out_networking(stubs):
     def get_my_ip():
         return '127.0.0.1'
-    stubs.Set(nova.utils, 'get_my_ip', get_my_ip)
+    stubs.Set(nova.flags, '_get_my_ip', get_my_ip)
 
 
 def stub_out_compute_api_snapshot(stubs):
diff --git a/nova/tests/api/openstack/test_images.py b/nova/tests/api/openstack/test_images.py
index f5be9c94f..00ca739a5 100644
--- a/nova/tests/api/openstack/test_images.py
+++ b/nova/tests/api/openstack/test_images.py
@@ -172,6 +172,7 @@ class ImageControllerWithGlanceServiceTest(unittest.TestCase):
 
     IMAGE_FIXTURES = [
         {'id': '23g2ogk23k4hhkk4k42l',
+         'imageId': '23g2ogk23k4hhkk4k42l',
          'name': 'public image #1',
          'created_at': str(datetime.datetime.utcnow()),
          'updated_at': str(datetime.datetime.utcnow()),
@@ -181,6 +182,7 @@ class ImageControllerWithGlanceServiceTest(unittest.TestCase):
          'status': 'available',
          'image_type': 'kernel'},
         {'id': 'slkduhfas73kkaskgdas',
+         'imageId': 'slkduhfas73kkaskgdas',
          'name': 'public image #2',
          'created_at': str(datetime.datetime.utcnow()),
          'updated_at': str(datetime.datetime.utcnow()),
diff --git a/nova/tests/api/openstack/test_servers.py b/nova/tests/api/openstack/test_servers.py
index 966dd3a12..bb598ddeb 100644
--- a/nova/tests/api/openstack/test_servers.py
+++ b/nova/tests/api/openstack/test_servers.py
@@ -134,6 +134,12 @@ class ServersTest(unittest.TestCase):
         def queue_get_for(context, *args):
             return 'network_topic'
 
+        def kernel_ramdisk_mapping(*args, **kwargs):
+            return (1, 1)
+
+        def image_id_from_hash(*args, **kwargs):
+            return 2
+
         self.stubs.Set(nova.db.api, 'project_get_network', project_get_network)
         self.stubs.Set(nova.db.api, 'instance_create', instance_create)
         self.stubs.Set(nova.rpc, 'cast', fake_method)
@@ -143,6 +149,10 @@ class ServersTest(unittest.TestCase):
         self.stubs.Set(nova.db.api, 'queue_get_for', queue_get_for)
         self.stubs.Set(nova.network.manager.VlanManager, 'allocate_fixed_ip',
             fake_method)
+        self.stubs.Set(nova.api.openstack.servers.Controller,
+            "_get_kernel_ramdisk_from_image", kernel_ramdisk_mapping)
+        self.stubs.Set(nova.api.openstack.common,
+            "get_image_id_from_image_hash", image_id_from_hash)
 
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
diff --git a/nova/tests/api/openstack/test_sharedipgroups.py b/nova/tests/api/openstack/test_shared_ip_groups.py
index d199951d8..c2fc3a203 100644
--- a/nova/tests/api/openstack/test_sharedipgroups.py
+++ b/nova/tests/api/openstack/test_shared_ip_groups.py
@@ -19,7 +19,7 @@ import unittest
 
 import stubout
 
-from nova.api.openstack import sharedipgroups
+from nova.api.openstack import shared_ip_groups
 
 
 class SharedIpGroupsTest(unittest.TestCase):
diff --git a/nova/tests/test_cloud.py b/nova/tests/test_cloud.py
index 48042a9ab..ec2a36fe8 100644
--- a/nova/tests/test_cloud.py
+++ b/nova/tests/test_cloud.py
@@ -51,6 +51,8 @@ IMAGES_PATH = os.path.join(OSS_TEMPDIR, 'images')
 os.makedirs(IMAGES_PATH)
 
 
+# TODO(termie): these tests are rather fragile, they should at the lest be
+#               wiping database state after each run
 class CloudTestCase(test.TestCase):
     def setUp(self):
         super(CloudTestCase, self).setUp()
@@ -134,6 +136,52 @@ class CloudTestCase(test.TestCase):
         db.volume_destroy(self.context, vol1['id'])
         db.volume_destroy(self.context, vol2['id'])
 
+    def test_describe_availability_zones(self):
+        """Makes sure describe_availability_zones works and filters results."""
+        service1 = db.service_create(self.context, {'host': 'host1_zones',
+                                         'binary': "nova-compute",
+                                         'topic': 'compute',
+                                         'report_count': 0,
+                                         'availability_zone': "zone1"})
+        service2 = db.service_create(self.context, {'host': 'host2_zones',
+                                         'binary': "nova-compute",
+                                         'topic': 'compute',
+                                         'report_count': 0,
+                                         'availability_zone': "zone2"})
+        result = self.cloud.describe_availability_zones(self.context)
+        self.assertEqual(len(result['availabilityZoneInfo']), 3)
+        db.service_destroy(self.context, service1['id'])
+        db.service_destroy(self.context, service2['id'])
+
+    def test_describe_instances(self):
+        """Makes sure describe_instances works and filters results."""
+        inst1 = db.instance_create(self.context, {'reservation_id': 'a',
+                                                  'host': 'host1'})
+        inst2 = db.instance_create(self.context, {'reservation_id': 'a',
+                                                  'host': 'host2'})
+        comp1 = db.service_create(self.context, {'host': 'host1',
+                                                 'availability_zone': 'zone1',
+                                                 'topic': "compute"})
+        comp2 = db.service_create(self.context, {'host': 'host2',
+                                                 'availability_zone': 'zone2',
+                                                 'topic': "compute"})
+        result = self.cloud.describe_instances(self.context)
+        result = result['reservationSet'][0]
+        self.assertEqual(len(result['instancesSet']), 2)
+        instance_id = cloud.id_to_ec2_id(inst2['id'])
+        result = self.cloud.describe_instances(self.context,
+                                             instance_id=[instance_id])
+        result = result['reservationSet'][0]
+        self.assertEqual(len(result['instancesSet']), 1)
+        self.assertEqual(result['instancesSet'][0]['instanceId'],
+                         instance_id)
+        self.assertEqual(result['instancesSet'][0]
+                         ['placement']['availabilityZone'], 'zone2')
+        db.instance_destroy(self.context, inst1['id'])
+        db.instance_destroy(self.context, inst2['id'])
+        db.service_destroy(self.context, comp1['id'])
+        db.service_destroy(self.context, comp2['id'])
+
     def test_console_output(self):
         image_id = FLAGS.default_image
         instance_type = FLAGS.default_instance_type
@@ -151,6 +199,19 @@ class CloudTestCase(test.TestCase):
         greenthread.sleep(0.3)
         rv = self.cloud.terminate_instances(self.context, [instance_id])
 
+    def test_ajax_console(self):
+        kwargs = {'image_id': image_id}
+        rv = yield self.cloud.run_instances(self.context, **kwargs)
+        instance_id = rv['instancesSet'][0]['instanceId']
+        output = yield self.cloud.get_console_output(context=self.context,
+                                                     instance_id=[instance_id])
+        self.assertEquals(b64decode(output['output']),
+                          'http://fakeajaxconsole.com/?token=FAKETOKEN')
+        # TODO(soren): We need this until we can stop polling in the rpc code
+        #              for unit tests.
+        greenthread.sleep(0.3)
+        rv = yield self.cloud.terminate_instances(self.context, [instance_id])
+
     def test_key_generation(self):
         result = self._create_key('test')
         private_key = result['private_key']
@@ -212,7 +273,21 @@ class CloudTestCase(test.TestCase):
                 LOG.debug(_("Terminating instance %s"), instance_id)
                 rv = self.compute.terminate_instance(instance_id)
 
+    def test_describe_instances(self):
+        """Makes sure describe_instances works."""
+        instance1 = db.instance_create(self.context, {'host': 'host2'})
+        comp1 = db.service_create(self.context, {'host': 'host2',
+                                                 'availability_zone': 'zone1',
+                                                 'topic': "compute"})
+        result = self.cloud.describe_instances(self.context)
+        self.assertEqual(result['reservationSet'][0]
+                         ['instancesSet'][0]
+                         ['placement']['availabilityZone'], 'zone1')
+        db.instance_destroy(self.context, instance1['id'])
+        db.service_destroy(self.context, comp1['id'])
+
     def test_instance_update_state(self):
+        # TODO(termie): what is this code even testing?
         def instance(num):
             return {
                 'reservation_id': 'r-1',
@@ -231,7 +306,8 @@ class CloudTestCase(test.TestCase):
                 'state': 0x01,
                 'user_data': ''}
         rv = self.cloud._format_describe_instances(self.context)
-        self.assert_(len(rv['reservationSet']) == 0)
+        logging.error(str(rv))
+        self.assertEqual(len(rv['reservationSet']), 0)
 
         # simulate launch of 5 instances
         # self.cloud.instances['pending'] = {}
diff --git a/nova/tests/test_compute.py b/nova/tests/test_compute.py
index b1cb8889b..53070ef3c 100644
--- a/nova/tests/test_compute.py
+++ b/nova/tests/test_compute.py
@@ -173,6 +173,16 @@ class ComputeTestCase(test.TestCase):
         self.assert_(console)
         self.compute.terminate_instance(self.context, instance_id)
 
+    def test_ajax_console(self):
+        """Make sure we can get console output from instance"""
+        instance_id = self._create_instance()
+        self.compute.run_instance(self.context, instance_id)
+
+        console = self.compute.get_ajax_console(self.context,
+                                                instance_id)
+        self.assert_(console)
+        self.compute.terminate_instance(self.context, instance_id)
+
     def test_run_instance_existing(self):
         """Ensure failure when running an instance that already exists"""
         instance_id = self._create_instance()
diff --git a/nova/tests/test_console.py b/nova/tests/test_console.py
new file mode 100644
index 000000000..69e2109e6
--- /dev/null
+++ b/nova/tests/test_console.py
@@ -0,0 +1,133 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Tests For Console proxy.
+"""
+
+import datetime
+import logging
+
+from nova import context
+from nova import db
+from nova import exception
+from nova import flags
+from nova import test
+from nova import utils
+from nova.auth import manager
+from nova.console import manager as console_manager
+
+FLAGS = flags.FLAGS
+
+
+class ConsoleTestCase(test.TestCase):
+    """Test case for console proxy"""
+    def setUp(self):
+        logging.getLogger().setLevel(logging.DEBUG)
+        super(ConsoleTestCase, self).setUp()
+        self.flags(console_driver='nova.console.fake.FakeConsoleProxy',
+                   stub_compute=True)
+        self.console = utils.import_object(FLAGS.console_manager)
+        self.manager = manager.AuthManager()
+        self.user = self.manager.create_user('fake', 'fake', 'fake')
+        self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.context = context.get_admin_context()
+        self.host = 'test_compute_host'
+
+    def tearDown(self):
+        self.manager.delete_user(self.user)
+        self.manager.delete_project(self.project)
+        super(ConsoleTestCase, self).tearDown()
+
+    def _create_instance(self):
+        """Create a test instance"""
+        inst = {}
+        #inst['host'] = self.host
+        #inst['name'] = 'instance-1234'
+        inst['image_id'] = 'ami-test'
+        inst['reservation_id'] = 'r-fakeres'
+        inst['launch_time'] = '10'
+        inst['user_id'] = self.user.id
+        inst['project_id'] = self.project.id
+        inst['instance_type'] = 'm1.tiny'
+        inst['mac_address'] = utils.generate_mac()
+        inst['ami_launch_index'] = 0
+        return db.instance_create(self.context, inst)['id']
+
+    def test_get_pool_for_instance_host(self):
+        pool = self.console.get_pool_for_instance_host(self.context, self.host)
+        self.assertEqual(pool['compute_host'], self.host)
+
+    def test_get_pool_creates_new_pool_if_needed(self):
+        self.assertRaises(exception.NotFound,
+                          db.console_pool_get_by_host_type,
+                          self.context,
+                          self.host,
+                          self.console.host,
+                          self.console.driver.console_type)
+        pool = self.console.get_pool_for_instance_host(self.context,
+                                                       self.host)
+        pool2 = db.console_pool_get_by_host_type(self.context,
+                              self.host,
+                              self.console.host,
+                              self.console.driver.console_type)
+        self.assertEqual(pool['id'], pool2['id'])
+
+    def test_get_pool_does_not_create_new_pool_if_exists(self):
+        pool_info = {'address': '127.0.0.1',
+                     'username': 'test',
+                     'password': '1234pass',
+                     'host': self.console.host,
+                     'console_type': self.console.driver.console_type,
+                     'compute_host': 'sometesthostname'}
+        new_pool = db.console_pool_create(self.context, pool_info)
+        pool = self.console.get_pool_for_instance_host(self.context,
+                                                       'sometesthostname')
+        self.assertEqual(pool['id'], new_pool['id'])
+
+    def test_add_console(self):
+        instance_id = self._create_instance()
+        self.console.add_console(self.context, instance_id)
+        instance = db.instance_get(self.context, instance_id)
+        pool = db.console_pool_get_by_host_type(self.context,
+                                                instance['host'],
+                                                self.console.host,
+                                            self.console.driver.console_type)
+
+        console_instances = [con['instance_id'] for con in pool.consoles]
+        self.assert_(instance_id in console_instances)
+        db.instance_destroy(self.context, instance_id)
+
+    def test_add_console_does_not_duplicate(self):
+        instance_id = self._create_instance()
+        cons1 = self.console.add_console(self.context, instance_id)
+        cons2 = self.console.add_console(self.context, instance_id)
+        self.assertEqual(cons1, cons2)
+        db.instance_destroy(self.context, instance_id)
+
+    def test_remove_console(self):
+        instance_id = self._create_instance()
+        console_id = self.console.add_console(self.context, instance_id)
+        self.console.remove_console(self.context, console_id)
+
+        self.assertRaises(exception.NotFound,
+                          db.console_get,
+                          self.context,
+                          console_id)
+        db.instance_destroy(self.context, instance_id)
+
diff --git a/nova/tests/test_scheduler.py b/nova/tests/test_scheduler.py
index a9937d797..9d458244b 100644
--- a/nova/tests/test_scheduler.py
+++ b/nova/tests/test_scheduler.py
@@ -21,6 +21,7 @@ Tests For Scheduler
 
 import datetime
 
+from mox import IgnoreArg
 from nova import context
 from nova import db
 from nova import flags
@@ -76,6 +77,59 @@ class SchedulerTestCase(test.TestCase):
         scheduler.named_method(ctxt, 'topic', num=7)
 
 
+class ZoneSchedulerTestCase(test.TestCase):
+    """Test case for zone scheduler"""
+    def setUp(self):
+        super(ZoneSchedulerTestCase, self).setUp()
+        self.flags(scheduler_driver='nova.scheduler.zone.ZoneScheduler')
+
+    def _create_service_model(self, **kwargs):
+        service = db.sqlalchemy.models.Service()
+        service.host = kwargs['host']
+        service.disabled = False
+        service.deleted = False
+        service.report_count = 0
+        service.binary = 'nova-compute'
+        service.topic = 'compute'
+        service.id = kwargs['id']
+        service.availability_zone = kwargs['zone']
+        service.created_at = datetime.datetime.utcnow()
+        return service
+
+    def test_with_two_zones(self):
+        scheduler = manager.SchedulerManager()
+        ctxt = context.get_admin_context()
+        service_list = [self._create_service_model(id=1,
+                                                   host='host1',
+                                                   zone='zone1'),
+                        self._create_service_model(id=2,
+                                                   host='host2',
+                                                   zone='zone2'),
+                        self._create_service_model(id=3,
+                                                   host='host3',
+                                                   zone='zone2'),
+                        self._create_service_model(id=4,
+                                                   host='host4',
+                                                   zone='zone2'),
+                        self._create_service_model(id=5,
+                                                   host='host5',
+                                                   zone='zone2')]
+        self.mox.StubOutWithMock(db, 'service_get_all_by_topic')
+        arg = IgnoreArg()
+        db.service_get_all_by_topic(arg, arg).AndReturn(service_list)
+        self.mox.StubOutWithMock(rpc, 'cast', use_mock_anything=True)
+        rpc.cast(ctxt,
+                 'compute.host1',
+                 {'method': 'run_instance',
+                  'args': {'instance_id': 'i-ffffffff',
+                           'availability_zone': 'zone1'}})
+        self.mox.ReplayAll()
+        scheduler.run_instance(ctxt,
+                               'compute',
+                               instance_id='i-ffffffff',
+                               availability_zone='zone1')
+
+
 class SimpleDriverTestCase(test.TestCase):
     """Test case for simple driver"""
     def setUp(self):
diff --git a/nova/tests/test_service.py b/nova/tests/test_service.py
index 9f1a181a0..a67c8d1e8 100644
--- a/nova/tests/test_service.py
+++ b/nova/tests/test_service.py
@@ -133,7 +133,8 @@ class ServiceTestCase(test.TestCase):
         service_create = {'host': host,
                           'binary': binary,
                           'topic': topic,
-                          'report_count': 0}
+                          'report_count': 0,
+                          'availability_zone': 'nova'}
         service_ref = {'host': host,
                        'binary': binary,
                        'report_count': 0,
@@ -161,11 +162,13 @@ class ServiceTestCase(test.TestCase):
         service_create = {'host': host,
                           'binary': binary,
                           'topic': topic,
-                          'report_count': 0}
+                          'report_count': 0,
+                          'availability_zone': 'nova'}
         service_ref = {'host': host,
                           'binary': binary,
                           'topic': topic,
                           'report_count': 0,
+                          'availability_zone': 'nova',
                           'id': 1}
 
         service.db.service_get_by_args(mox.IgnoreArg(),
@@ -193,11 +196,13 @@ class ServiceTestCase(test.TestCase):
         service_create = {'host': host,
                           'binary': binary,
                           'topic': topic,
-                          'report_count': 0}
+                          'report_count': 0,
+                          'availability_zone': 'nova'}
         service_ref = {'host': host,
                           'binary': binary,
                           'topic': topic,
                           'report_count': 0,
+                          'availability_zone': 'nova',
                           'id': 1}
 
         service.db.service_get_by_args(mox.IgnoreArg(),
@@ -224,11 +229,13 @@ class ServiceTestCase(test.TestCase):
         service_create = {'host': host,
                           'binary': binary,
                           'topic': topic,
-                          'report_count': 0}
+                          'report_count': 0,
+                          'availability_zone': 'nova'}
         service_ref = {'host': host,
                           'binary': binary,
                           'topic': topic,
                           'report_count': 0,
+                          'availability_zone': 'nova',
                           'id': 1}
 
         service.db.service_get_by_args(mox.IgnoreArg(),
diff --git a/nova/tests/test_virt.py b/nova/tests/test_virt.py
index 4aa489d08..afdc89ba2 100644
--- a/nova/tests/test_virt.py
+++ b/nova/tests/test_virt.py
@@ -208,8 +208,141 @@ class LibvirtConnTestCase(test.TestCase):
         self.manager.delete_user(self.user)
 
 
-class NWFilterTestCase(test.TestCase):
+class IptablesFirewallTestCase(test.TestCase):
+    def setUp(self):
+        super(IptablesFirewallTestCase, self).setUp()
 
+        self.manager = manager.AuthManager()
+        self.user = self.manager.create_user('fake', 'fake', 'fake',
+                                             admin=True)
+        self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.context = context.RequestContext('fake', 'fake')
+        self.network = utils.import_object(FLAGS.network_manager)
+        self.fw = libvirt_conn.IptablesFirewallDriver()
+
+    def tearDown(self):
+        self.manager.delete_project(self.project)
+        self.manager.delete_user(self.user)
+        super(IptablesFirewallTestCase, self).tearDown()
+
+    def _p(self, *args, **kwargs):
+        if 'iptables-restore' in args:
+            print ' '.join(args), kwargs['stdin']
+        if 'iptables-save' in args:
+            return
+
+    in_rules = [
+      '# Generated by iptables-save v1.4.4 on Mon Dec  6 11:54:13 2010',
+      '*filter',
+      ':INPUT ACCEPT [969615:281627771]',
+      ':FORWARD ACCEPT [0:0]',
+      ':OUTPUT ACCEPT [915599:63811649]',
+      ':nova-block-ipv4 - [0:0]',
+      '-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT ',
+      '-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT ',
+      '-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT ',
+      '-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT ',
+      '-A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED'
+      ',ESTABLISHED -j ACCEPT ',
+      '-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT ',
+      '-A FORWARD -i virbr0 -o virbr0 -j ACCEPT ',
+      '-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable ',
+      '-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable ',
+      'COMMIT',
+      '# Completed on Mon Dec  6 11:54:13 2010',
+    ]
+
+    def test_static_filters(self):
+        self.fw.execute = self._p
+        instance_ref = db.instance_create(self.context,
+                                          {'user_id': 'fake',
+                                          'project_id': 'fake'})
+        ip = '10.11.12.13'
+
+        network_ref = db.project_get_network(self.context,
+                                             'fake')
+
+        fixed_ip = {'address': ip,
+                    'network_id': network_ref['id']}
+
+        admin_ctxt = context.get_admin_context()
+        db.fixed_ip_create(admin_ctxt, fixed_ip)
+        db.fixed_ip_update(admin_ctxt, ip, {'allocated': True,
+                                            'instance_id': instance_ref['id']})
+
+        secgroup = db.security_group_create(admin_ctxt,
+                                            {'user_id': 'fake',
+                                             'project_id': 'fake',
+                                             'name': 'testgroup',
+                                             'description': 'test group'})
+
+        db.security_group_rule_create(admin_ctxt,
+                                      {'parent_group_id': secgroup['id'],
+                                       'protocol': 'icmp',
+                                       'from_port': -1,
+                                       'to_port': -1,
+                                       'cidr': '192.168.11.0/24'})
+
+        db.security_group_rule_create(admin_ctxt,
+                                      {'parent_group_id': secgroup['id'],
+                                       'protocol': 'icmp',
+                                       'from_port': 8,
+                                       'to_port': -1,
+                                       'cidr': '192.168.11.0/24'})
+
+        db.security_group_rule_create(admin_ctxt,
+                                      {'parent_group_id': secgroup['id'],
+                                       'protocol': 'tcp',
+                                       'from_port': 80,
+                                       'to_port': 81,
+                                       'cidr': '192.168.10.0/24'})
+
+        db.instance_add_security_group(admin_ctxt, instance_ref['id'],
+                                       secgroup['id'])
+        instance_ref = db.instance_get(admin_ctxt, instance_ref['id'])
+
+        self.fw.add_instance(instance_ref)
+
+        out_rules = self.fw.modify_rules(self.in_rules)
+
+        in_rules = filter(lambda l: not l.startswith('#'), self.in_rules)
+        for rule in in_rules:
+            if not 'nova' in rule:
+                self.assertTrue(rule in out_rules,
+                                'Rule went missing: %s' % rule)
+
+        instance_chain = None
+        for rule in out_rules:
+            # This is pretty crude, but it'll do for now
+            if '-d 10.11.12.13 -j' in rule:
+                instance_chain = rule.split(' ')[-1]
+                break
+        self.assertTrue(instance_chain, "The instance chain wasn't added")
+
+        security_group_chain = None
+        for rule in out_rules:
+            # This is pretty crude, but it'll do for now
+            if '-A %s -j' % instance_chain in rule:
+                security_group_chain = rule.split(' ')[-1]
+                break
+        self.assertTrue(security_group_chain,
+                        "The security group chain wasn't added")
+
+        self.assertTrue('-A %s -p icmp -s 192.168.11.0/24 -j ACCEPT' % \
+                               security_group_chain in out_rules,
+                        "ICMP acceptance rule wasn't added")
+
+        self.assertTrue('-A %s -p icmp -s 192.168.11.0/24 -m icmp --icmp-type'
+                        ' 8 -j ACCEPT' % security_group_chain in out_rules,
+                        "ICMP Echo Request acceptance rule wasn't added")
+
+        self.assertTrue('-A %s -p tcp -s 192.168.10.0/24 -m multiport '
+                        '--dports 80:81 -j ACCEPT' % security_group_chain \
+                            in out_rules,
+                        "TCP port 80/81 acceptance rule wasn't added")
+
+
+class NWFilterTestCase(test.TestCase):
     def setUp(self):
         super(NWFilterTestCase, self).setUp()
 
@@ -224,7 +357,8 @@ class NWFilterTestCase(test.TestCase):
 
         self.fake_libvirt_connection = Mock()
 
-        self.fw = libvirt_conn.NWFilterFirewall(self.fake_libvirt_connection)
+        self.fw = libvirt_conn.NWFilterFirewall(
+                                         lambda: self.fake_libvirt_connection)
 
     def tearDown(self):
         self.manager.delete_project(self.project)
@@ -337,7 +471,7 @@ class NWFilterTestCase(test.TestCase):
                                        self.security_group.id)
         instance = db.instance_get(self.context, inst_id)
 
-        self.fw.setup_base_nwfilters()
-        self.fw.setup_nwfilters_for_instance(instance)
+        self.fw.setup_basic_filtering(instance)
+        self.fw.prepare_instance_filter(instance)
         _ensure_all_called()
         self.teardown_security_group()
diff --git a/nova/tests/xenapi/stubs.py b/nova/tests/xenapi/stubs.py
index 55f751f11..292bd9ba9 100644
--- a/nova/tests/xenapi/stubs.py
+++ b/nova/tests/xenapi/stubs.py
@@ -41,9 +41,33 @@ def stubout_instance_snapshot(stubs):
             rv = done.wait()
             return rv
 
+        def fake_loop(self):
+            pass
+
         stubs.Set(xenapi_conn.XenAPISession, 'wait_for_task',
                   fake_wait_for_task)
 
+        stubs.Set(xenapi_conn.XenAPISession, '_stop_loop', fake_loop)
+
+        from nova.virt.xenapi.fake import create_vdi
+        name_label = "instance-%s" % instance_id
+        #TODO: create fake SR record
+        sr_ref = "fakesr"
+        vdi_ref = create_vdi(name_label=name_label, read_only=False,
+                             sr_ref=sr_ref, sharable=False)
+        vdi_rec = session.get_xenapi().VDI.get_record(vdi_ref)
+        vdi_uuid = vdi_rec['uuid']
+        return vdi_uuid
+
+    stubs.Set(vm_utils.VMHelper, 'fetch_image', fake_fetch_image)
+
+    def fake_parse_xmlrpc_value(val):
+        return val
+
+    stubs.Set(xenapi_conn, '_parse_xmlrpc_value', fake_parse_xmlrpc_value)
+
+    def fake_wait_for_vhd_coalesce(session, instance_id, sr_ref, vdi_ref,
+                              original_parent_uuid):
         from nova.virt.xenapi.fake import create_vdi
         name_label = "instance-%s" % instance_id
         #TODO: create fake SR record
diff --git a/nova/utils.py b/nova/utils.py
index ca1543953..3fefc80fc 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -154,6 +154,11 @@ def abspath(s):
     return os.path.join(os.path.dirname(__file__), s)
 
 
+def novadir():
+    import nova
+    return os.path.abspath(nova.__file__).split('nova/__init__.pyc')[0]
+
+
 def default_flagfile(filename='nova.conf'):
     for arg in sys.argv:
         if arg.find('flagfile') != -1:
@@ -196,19 +201,6 @@ def last_octet(address):
     return int(address.split(".")[-1])
 
 
-def get_my_ip():
-    """Returns the actual ip of the local machine."""
-    try:
-        csock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-        csock.connect(('8.8.8.8', 80))
-        (addr, port) = csock.getsockname()
-        csock.close()
-        return addr
-    except socket.gaierror as ex:
-        LOG.warn(_("Couldn't get IP, using 127.0.0.1 %s"), ex)
-        return "127.0.0.1"
-
-
 def utcnow():
     """Overridable version of datetime.datetime.utcnow."""
     if utcnow.override_time:
diff --git a/nova/version.py b/nova/version.py
new file mode 100644
index 000000000..7b27acb6a
--- /dev/null
+++ b/nova/version.py
@@ -0,0 +1,46 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+#    Copyright 2011 OpenStack LLC
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+try:
+    from nova.vcsversion import version_info
+except ImportError:
+    version_info = {'branch_nick': u'LOCALBRANCH',
+                    'revision_id': 'LOCALREVISION',
+                    'revno': 0}
+
+NOVA_VERSION = ['2011', '1']
+YEAR, COUNT = NOVA_VERSION
+
+FINAL = False   # This becomes true at Release Candidate time
+
+
+def canonical_version_string():
+    return '.'.join([YEAR, COUNT])
+
+
+def version_string():
+    if FINAL:
+        return canonical_version_string()
+    else:
+        return '%s-dev' % (canonical_version_string(),)
+
+
+def vcs_version_string():
+    return "%s:%s" % (version_info['branch_nick'], version_info['revision_id'])
+
+
+def version_string_with_vcs():
+    return "%s-%s" % (canonical_version_string(), vcs_version_string())
diff --git a/nova/virt/fake.py b/nova/virt/fake.py
index 32541f5b4..9186d885e 100644
--- a/nova/virt/fake.py
+++ b/nova/virt/fake.py
@@ -289,6 +289,14 @@ class FakeConnection(object):
     def get_console_output(self, instance):
         return 'FAKE CONSOLE OUTPUT'
 
+    def get_ajax_console(self, instance):
+        return 'http://fakeajaxconsole.com/?token=FAKETOKEN'
+
+    def get_console_pool_info(self, console_type):
+        return  {'address': '127.0.0.1',
+                 'username': 'fakeuser',
+                 'password': 'fakepassword'}
+
 
 class FakeInstance(object):
 
diff --git a/nova/virt/hyperv.py b/nova/virt/hyperv.py
index d71387ac0..30dc1c79b 100644
--- a/nova/virt/hyperv.py
+++ b/nova/virt/hyperv.py
@@ -92,7 +92,7 @@ REQ_POWER_STATE = {
     'Reboot': 10,
     'Reset': 11,
     'Paused': 32768,
-    'Suspended': 32769
+    'Suspended': 32769,
 }
 
 
diff --git a/nova/virt/libvirt.xml.template b/nova/virt/libvirt.xml.template
index 3fb2243da..2eb7d9488 100644
--- a/nova/virt/libvirt.xml.template
+++ b/nova/virt/libvirt.xml.template
@@ -71,9 +71,22 @@
 #end if
             </filterref>
         </interface>
+
+        <!-- The order is significant here.  File must be defined first -->
         <serial type="file">
             <source path='${basepath}/console.log'/>
             <target port='1'/>
         </serial>
+
+        <console type='pty' tty='/dev/pts/2'>
+            <source path='/dev/pts/2'/>
+            <target port='0'/>
+        </console>
+
+        <serial type='pty'>
+            <source path='/dev/pts/2'/>
+            <target port='0'/>
+        </serial>
+
     </devices>
 </domain>
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 764ef6600..bd863b3a2 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -38,6 +38,11 @@ Supports KVM, QEMU, UML, and XEN.
 
 import os
 import shutil
+import random
+import subprocess
+import uuid
+from xml.dom import minidom
+
 
 from eventlet import greenthread
 from eventlet import event
@@ -86,6 +91,12 @@ flags.DEFINE_string('libvirt_uri',
 flags.DEFINE_bool('allow_project_net_traffic',
                   True,
                   'Whether to allow in project network traffic')
+flags.DEFINE_string('ajaxterm_portrange',
+                    '10000-12000',
+                    'Range of ports that ajaxterm should randomly try to bind')
+flags.DEFINE_string('firewall_driver',
+                    'nova.virt.libvirt_conn.IptablesFirewallDriver',
+                    'Firewall driver (defaults to iptables)')
 
 
 def get_connection(read_only):
@@ -125,16 +136,24 @@ class LibvirtConnection(object):
         self._wrapped_conn = None
         self.read_only = read_only
 
+        self.nwfilter = NWFilterFirewall(self._get_connection)
+
+        if not FLAGS.firewall_driver:
+            self.firewall_driver = self.nwfilter
+            self.nwfilter.handle_security_groups = True
+        else:
+            self.firewall_driver = utils.import_object(FLAGS.firewall_driver)
+
     def init_host(self):
-        NWFilterFirewall(self._conn).setup_base_nwfilters()
+        pass
 
-    @property
-    def _conn(self):
+    def _get_connection(self):
         if not self._wrapped_conn or not self._test_connection():
             LOG.debug(_('Connecting to libvirt: %s'), self.libvirt_uri)
             self._wrapped_conn = self._connect(self.libvirt_uri,
                                                self.read_only)
         return self._wrapped_conn
+    _conn = property(_get_connection)
 
     def _test_connection(self):
         try:
@@ -224,11 +243,24 @@ class LibvirtConnection(object):
     def attach_volume(self, instance_name, device_path, mountpoint):
         virt_dom = self._conn.lookupByName(instance_name)
         mount_device = mountpoint.rpartition("/")[2]
-        xml = """<disk type='block'>
-                     <driver name='qemu' type='raw'/>
-                     <source dev='%s'/>
-                     <target dev='%s' bus='virtio'/>
-                 </disk>""" % (device_path, mount_device)
+        if device_path.startswith('/dev/'):
+            xml = """<disk type='block'>
+                         <driver name='qemu' type='raw'/>
+                         <source dev='%s'/>
+                         <target dev='%s' bus='virtio'/>
+                     </disk>""" % (device_path, mount_device)
+        elif ':' in device_path:
+            (protocol, name) = device_path.split(':')
+            xml = """<disk type='network'>
+                         <driver name='qemu' type='raw'/>
+                         <source protocol='%s' name='%s'/>
+                         <target dev='%s' bus='virtio'/>
+                     </disk>""" % (protocol,
+                                   name,
+                                   mount_device)
+        else:
+            raise exception.Invalid(_("Invalid device path %s") % device_path)
+
         virt_dom.attachDevice(xml)
 
     def _get_disk_xml(self, xml, device):
@@ -351,10 +383,13 @@ class LibvirtConnection(object):
                               instance['id'],
                               power_state.NOSTATE,
                               'launching')
-        NWFilterFirewall(self._conn).setup_nwfilters_for_instance(instance)
+
+        self.nwfilter.setup_basic_filtering(instance)
+        self.firewall_driver.prepare_instance_filter(instance)
         self._create_image(instance, xml)
         self._conn.createXML(xml, 0)
         LOG.debug(_("instance %s: is running"), instance['name'])
+        self.firewall_driver.apply_instance_filter(instance)
 
         timer = utils.LoopingCall(f=None)
 
@@ -419,6 +454,43 @@ class LibvirtConnection(object):
 
         return self._dump_file(fpath)
 
+    @exception.wrap_exception
+    def get_ajax_console(self, instance):
+        def get_open_port():
+            start_port, end_port = FLAGS.ajaxterm_portrange.split("-")
+            for i in xrange(0, 100):  # don't loop forever
+                port = random.randint(int(start_port), int(end_port))
+                # netcat will exit with 0 only if the port is in use,
+                # so a nonzero return value implies it is unused
+                cmd = 'netcat 0.0.0.0 %s -w 1 </dev/null || echo free' % (port)
+                stdout, stderr = utils.execute(cmd)
+                if stdout.strip() == 'free':
+                    return port
+            raise Exception(_('Unable to find an open port'))
+
+        def get_pty_for_instance(instance_name):
+            virt_dom = self._conn.lookupByName(instance_name)
+            xml = virt_dom.XMLDesc(0)
+            dom = minidom.parseString(xml)
+
+            for serial in dom.getElementsByTagName('serial'):
+                if serial.getAttribute('type') == 'pty':
+                    source = serial.getElementsByTagName('source')[0]
+                    return source.getAttribute('path')
+
+        port = get_open_port()
+        token = str(uuid.uuid4())
+        host = instance['host']
+
+        ajaxterm_cmd = 'sudo socat - %s' \
+                       % get_pty_for_instance(instance['name'])
+
+        cmd = '%s/tools/ajaxterm/ajaxterm.py --command "%s" -t %s -p %s' \
+              % (utils.novadir(), ajaxterm_cmd, token, port)
+
+        subprocess.Popen(cmd, shell=True)
+        return {'token': token, 'host': host, 'port': port}
+
     def _create_image(self, inst, libvirt_xml, prefix='', disk_images=None):
         # syntactic nicety
         basepath = lambda fname = '', prefix = prefix: os.path.join(
@@ -693,18 +765,63 @@ class LibvirtConnection(object):
         domain = self._conn.lookupByName(instance_name)
         return domain.interfaceStats(interface)
 
-    def refresh_security_group(self, security_group_id):
-        fw = NWFilterFirewall(self._conn)
-        fw.ensure_security_group_filter(security_group_id)
+    def get_console_pool_info(self, console_type):
+        #TODO(mdragon): console proxy should be implemented for libvirt,
+        #               in case someone wants to use it with kvm or
+        #               such. For now return fake data.
+        return  {'address': '127.0.0.1',
+                 'username': 'fakeuser',
+                 'password': 'fakepassword'}
+
+    def refresh_security_group_rules(self, security_group_id):
+        self.firewall_driver.refresh_security_group_rules(security_group_id)
+
+    def refresh_security_group_members(self, security_group_id):
+        self.firewall_driver.refresh_security_group_members(security_group_id)
+
 
+class FirewallDriver(object):
+    def prepare_instance_filter(self, instance):
+        """Prepare filters for the instance.
 
-class NWFilterFirewall(object):
+        At this point, the instance isn't running yet."""
+        raise NotImplementedError()
+
+    def apply_instance_filter(self, instance):
+        """Apply instance filter.
+
+        Once this method returns, the instance should be firewalled
+        appropriately. This method should as far as possible be a
+        no-op. It's vastly preferred to get everything set up in
+        prepare_instance_filter.
+        """
+        raise NotImplementedError()
+
+    def refresh_security_group_rules(self, security_group_id):
+        """Refresh security group rules from data store
+
+        Gets called when a rule has been added to or removed from
+        the security group."""
+        raise NotImplementedError()
+
+    def refresh_security_group_members(self, security_group_id):
+        """Refresh security group members from data store
+
+        Gets called when an instance gets added to or removed from
+        the security group."""
+        raise NotImplementedError()
+
+
+class NWFilterFirewall(FirewallDriver):
     """
     This class implements a network filtering mechanism versatile
     enough for EC2 style Security Group filtering by leveraging
     libvirt's nwfilter.
 
     First, all instances get a filter ("nova-base-filter") applied.
+    This filter provides some basic security such as protection against
+    MAC spoofing, IP spoofing, and ARP spoofing.
+
     This filter drops all incoming ipv4 and ipv6 connections.
     Outgoing connections are never blocked.
 
@@ -738,38 +855,79 @@ class NWFilterFirewall(object):
 
     (*) This sentence brought to you by the redundancy department of
         redundancy.
+
     """
 
     def __init__(self, get_connection):
-        self._conn = get_connection
-
-    nova_base_filter = '''<filter name='nova-base' chain='root'>
-                            <uuid>26717364-50cf-42d1-8185-29bf893ab110</uuid>
-                            <filterref filter='no-mac-spoofing'/>
-                            <filterref filter='no-ip-spoofing'/>
-                            <filterref filter='no-arp-spoofing'/>
-                            <filterref filter='allow-dhcp-server'/>
-                            <filterref filter='nova-allow-dhcp-server'/>
-                            <filterref filter='nova-base-ipv4'/>
-                            <filterref filter='nova-base-ipv6'/>
-                          </filter>'''
-
-    nova_dhcp_filter = '''<filter name='nova-allow-dhcp-server' chain='ipv4'>
-                            <uuid>891e4787-e5c0-d59b-cbd6-41bc3c6b36fc</uuid>
-                              <rule action='accept' direction='out'
-                                    priority='100'>
-                                <udp srcipaddr='0.0.0.0'
-                                     dstipaddr='255.255.255.255'
-                                     srcportstart='68'
-                                     dstportstart='67'/>
-                              </rule>
-                              <rule action='accept' direction='in'
-                                    priority='100'>
-                                <udp srcipaddr='$DHCPSERVER'
-                                     srcportstart='67'
-                                     dstportstart='68'/>
-                              </rule>
-                            </filter>'''
+        self._libvirt_get_connection = get_connection
+        self.static_filters_configured = False
+        self.handle_security_groups = False
+
+    def _get_connection(self):
+        return self._libvirt_get_connection()
+    _conn = property(_get_connection)
+
+    def nova_dhcp_filter(self):
+        """The standard allow-dhcp-server filter is an <ip> one, so it uses
+           ebtables to allow traffic through. Without a corresponding rule in
+           iptables, it'll get blocked anyway."""
+
+        return '''<filter name='nova-allow-dhcp-server' chain='ipv4'>
+                    <uuid>891e4787-e5c0-d59b-cbd6-41bc3c6b36fc</uuid>
+                    <rule action='accept' direction='out'
+                          priority='100'>
+                      <udp srcipaddr='0.0.0.0'
+                           dstipaddr='255.255.255.255'
+                           srcportstart='68'
+                           dstportstart='67'/>
+                    </rule>
+                    <rule action='accept' direction='in'
+                          priority='100'>
+                      <udp srcipaddr='$DHCPSERVER'
+                           srcportstart='67'
+                           dstportstart='68'/>
+                    </rule>
+                  </filter>'''
+
+    def setup_basic_filtering(self, instance):
+        """Set up basic filtering (MAC, IP, and ARP spoofing protection)"""
+        logging.info('called setup_basic_filtering in nwfilter')
+
+        if self.handle_security_groups:
+            # No point in setting up a filter set that we'll be overriding
+            # anyway.
+            return
+
+        logging.info('ensuring static filters')
+        self._ensure_static_filters()
+
+        instance_filter_name = self._instance_filter_name(instance)
+        self._define_filter(self._filter_container(instance_filter_name,
+                                                   ['nova-base']))
+
+    def _ensure_static_filters(self):
+        if self.static_filters_configured:
+            return
+
+        self._define_filter(self._filter_container('nova-base',
+                                                   ['no-mac-spoofing',
+                                                    'no-ip-spoofing',
+                                                    'no-arp-spoofing',
+                                                    'allow-dhcp-server']))
+        self._define_filter(self.nova_base_ipv4_filter)
+        self._define_filter(self.nova_base_ipv6_filter)
+        self._define_filter(self.nova_dhcp_filter)
+        self._define_filter(self.nova_vpn_filter)
+        if FLAGS.allow_project_net_traffic:
+            self._define_filter(self.nova_project_filter)
+
+        self.static_filters_configured = True
+
+    def _filter_container(self, name, filters):
+        xml = '''<filter name='%s' chain='root'>%s</filter>''' % (
+                 name,
+                 ''.join(["<filterref filter='%s'/>" % (f,) for f in filters]))
+        return xml
 
     nova_vpn_filter = '''<filter name='nova-vpn' chain='root'>
                            <uuid>2086015e-cf03-11df-8c5d-080027c27973</uuid>
@@ -783,7 +941,7 @@ class NWFilterFirewall(object):
         retval = "<filter name='nova-base-ipv4' chain='ipv4'>"
         for protocol in ['tcp', 'udp', 'icmp']:
             for direction, action, priority in [('out', 'accept', 399),
-                                                ('inout', 'drop', 400)]:
+                                                ('in', 'drop', 400)]:
                 retval += """<rule action='%s' direction='%s' priority='%d'>
                                <%s />
                              </rule>""" % (action, direction,
@@ -795,7 +953,7 @@ class NWFilterFirewall(object):
         retval = "<filter name='nova-base-ipv6' chain='ipv6'>"
         for protocol in ['tcp', 'udp', 'icmp']:
             for direction, action, priority in [('out', 'accept', 399),
-                                                ('inout', 'drop', 400)]:
+                                                ('in', 'drop', 400)]:
                 retval += """<rule action='%s' direction='%s' priority='%d'>
                                <%s-ipv6 />
                              </rule>""" % (action, direction,
@@ -819,43 +977,49 @@ class NWFilterFirewall(object):
         # execute in a native thread and block current greenthread until done
         tpool.execute(self._conn.nwfilterDefineXML, xml)
 
-    def setup_base_nwfilters(self):
-        self._define_filter(self.nova_base_ipv4_filter)
-        self._define_filter(self.nova_base_ipv6_filter)
-        self._define_filter(self.nova_dhcp_filter)
-        self._define_filter(self.nova_base_filter)
-        self._define_filter(self.nova_vpn_filter)
-        if FLAGS.allow_project_net_traffic:
-            self._define_filter(self.nova_project_filter)
-
-    def setup_nwfilters_for_instance(self, instance):
+    def prepare_instance_filter(self, instance):
         """
         Creates an NWFilter for the given instance. In the process,
         it makes sure the filters for the security groups as well as
         the base filter are all in place.
         """
 
-        nwfilter_xml = ("<filter name='nova-instance-%s' "
-                        "chain='root'>\n") % instance['name']
-
         if instance['image_id'] == FLAGS.vpn_image_id:
-            nwfilter_xml += "  <filterref filter='nova-vpn' />\n"
+            base_filter = 'nova-vpn'
         else:
-            nwfilter_xml += "  <filterref filter='nova-base' />\n"
+            base_filter = 'nova-base'
+
+        instance_filter_name = self._instance_filter_name(instance)
+        instance_secgroup_filter_name = '%s-secgroup' % (instance_filter_name,)
+        instance_filter_children = [base_filter, instance_secgroup_filter_name]
+        instance_secgroup_filter_children = ['nova-base-ipv4',
+                                             'nova-base-ipv6',
+                                             'nova-allow-dhcp-server']
+
+        ctxt = context.get_admin_context()
 
         if FLAGS.allow_project_net_traffic:
-            nwfilter_xml += "  <filterref filter='nova-project' />\n"
+            instance_filter_children += ['nova-project']
+
+        for security_group in db.security_group_get_by_instance(ctxt,
+                                                               instance['id']):
 
-        for security_group in instance.security_groups:
-            self.ensure_security_group_filter(security_group['id'])
+            self.refresh_security_group_rules(security_group['id'])
 
-            nwfilter_xml += ("  <filterref filter='nova-secgroup-%d' "
-                             "/>\n") % security_group['id']
-        nwfilter_xml += "</filter>"
+            instance_secgroup_filter_children += [('nova-secgroup-%s' %
+                                                         security_group['id'])]
 
-        self._define_filter(nwfilter_xml)
+        self._define_filter(
+                    self._filter_container(instance_secgroup_filter_name,
+                                           instance_secgroup_filter_children))
 
-    def ensure_security_group_filter(self, security_group_id):
+        self._define_filter(
+                    self._filter_container(instance_filter_name,
+                                           instance_filter_children))
+
+        return
+
+    def refresh_security_group_rules(self, security_group_id):
         return self._define_filter(
                    self.security_group_to_nwfilter_xml(security_group_id))
 
@@ -886,3 +1050,162 @@ class NWFilterFirewall(object):
         xml = "<filter name='nova-secgroup-%s' chain='ipv4'>%s</filter>" % \
               (security_group_id, rule_xml,)
         return xml
+
+    def _instance_filter_name(self, instance):
+        return 'nova-instance-%s' % instance['name']
+
+
+class IptablesFirewallDriver(FirewallDriver):
+    def __init__(self, execute=None):
+        self.execute = execute or utils.execute
+        self.instances = set()
+
+    def apply_instance_filter(self, instance):
+        """No-op. Everything is done in prepare_instance_filter"""
+        pass
+
+    def remove_instance(self, instance):
+        self.instances.remove(instance)
+
+    def add_instance(self, instance):
+        self.instances.add(instance)
+
+    def prepare_instance_filter(self, instance):
+        self.add_instance(instance)
+        self.apply_ruleset()
+
+    def apply_ruleset(self):
+        current_filter, _ = self.execute('sudo iptables-save -t filter')
+        current_lines = current_filter.split('\n')
+        new_filter = self.modify_rules(current_lines)
+        self.execute('sudo iptables-restore',
+                     process_input='\n'.join(new_filter))
+
+    def modify_rules(self, current_lines):
+        ctxt = context.get_admin_context()
+        # Remove any trace of nova rules.
+        new_filter = filter(lambda l: 'nova-' not in l, current_lines)
+
+        seen_chains = False
+        for rules_index in range(len(new_filter)):
+            if not seen_chains:
+                if new_filter[rules_index].startswith(':'):
+                    seen_chains = True
+            elif seen_chains == 1:
+                if not new_filter[rules_index].startswith(':'):
+                    break
+
+        our_chains = [':nova-ipv4-fallback - [0:0]']
+        our_rules = ['-A nova-ipv4-fallback -j DROP']
+
+        our_chains += [':nova-local - [0:0]']
+        our_rules += ['-A FORWARD -j nova-local']
+
+        security_groups = set()
+        # Add our chains
+        # First, we add instance chains and rules
+        for instance in self.instances:
+            chain_name = self._instance_chain_name(instance)
+            ip_address = self._ip_for_instance(instance)
+
+            our_chains += [':%s - [0:0]' % chain_name]
+
+            # Jump to the per-instance chain
+            our_rules += ['-A nova-local -d %s -j %s' % (ip_address,
+                                                         chain_name)]
+
+            # Always drop invalid packets
+            our_rules += ['-A %s -m state --state '
+                          'INVALID -j DROP' % (chain_name,)]
+
+            # Allow established connections
+            our_rules += ['-A %s -m state --state '
+                          'ESTABLISHED,RELATED -j ACCEPT' % (chain_name,)]
+
+            # Jump to each security group chain in turn
+            for security_group in \
+                            db.security_group_get_by_instance(ctxt,
+                                                              instance['id']):
+                security_groups.add(security_group)
+
+                sg_chain_name = self._security_group_chain_name(security_group)
+
+                our_rules += ['-A %s -j %s' % (chain_name, sg_chain_name)]
+
+            # Allow DHCP responses
+            dhcp_server = self._dhcp_server_for_instance(instance)
+            our_rules += ['-A %s -s %s -p udp --sport 67 --dport 68' %
+                                                     (chain_name, dhcp_server)]
+
+            # If nothing matches, jump to the fallback chain
+            our_rules += ['-A %s -j nova-ipv4-fallback' % (chain_name,)]
+
+        # then, security group chains and rules
+        for security_group in security_groups:
+            chain_name = self._security_group_chain_name(security_group)
+            our_chains += [':%s - [0:0]' % chain_name]
+
+            rules = \
+              db.security_group_rule_get_by_security_group(ctxt,
+                                                          security_group['id'])
+
+            for rule in rules:
+                logging.info('%r', rule)
+                args = ['-A', chain_name, '-p', rule.protocol]
+
+                if rule.cidr:
+                    args += ['-s', rule.cidr]
+                else:
+                    # Eventually, a mechanism to grant access for security
+                    # groups will turn up here. It'll use ipsets.
+                    continue
+
+                if rule.protocol in ['udp', 'tcp']:
+                    if rule.from_port == rule.to_port:
+                        args += ['--dport', '%s' % (rule.from_port,)]
+                    else:
+                        args += ['-m', 'multiport',
+                                 '--dports', '%s:%s' % (rule.from_port,
+                                                        rule.to_port)]
+                elif rule.protocol == 'icmp':
+                    icmp_type = rule.from_port
+                    icmp_code = rule.to_port
+
+                    if icmp_type == -1:
+                        icmp_type_arg = None
+                    else:
+                        icmp_type_arg = '%s' % icmp_type
+                        if not icmp_code == -1:
+                            icmp_type_arg += '/%s' % icmp_code
+
+                    if icmp_type_arg:
+                        args += ['-m', 'icmp', '--icmp-type', icmp_type_arg]
+
+                args += ['-j ACCEPT']
+                our_rules += [' '.join(args)]
+
+        new_filter[rules_index:rules_index] = our_rules
+        new_filter[rules_index:rules_index] = our_chains
+        logging.info('new_filter: %s', '\n'.join(new_filter))
+        return new_filter
+
+    def refresh_security_group_members(self, security_group):
+        pass
+
+    def refresh_security_group_rules(self, security_group):
+        self.apply_ruleset()
+
+    def _security_group_chain_name(self, security_group):
+        return 'nova-sg-%s' % (security_group['id'],)
+
+    def _instance_chain_name(self, instance):
+        return 'nova-inst-%s' % (instance['id'],)
+
+    def _ip_for_instance(self, instance):
+        return db.instance_get_fixed_address(context.get_admin_context(),
+                                             instance['id'])
+
+    def _dhcp_server_for_instance(self, instance):
+        network = db.project_get_network(context.get_admin_context(),
+                                         instance['project_id'])
+        return network['gateway']
diff --git a/nova/virt/xenapi/vm_utils.py b/nova/virt/xenapi/vm_utils.py
index 1e9448a26..a91c8ea27 100644
--- a/nova/virt/xenapi/vm_utils.py
+++ b/nova/virt/xenapi/vm_utils.py
@@ -357,7 +357,9 @@ class VMHelper(HelperBase):
                     if i >= 3 and i <= 11:
                         ref = node.childNodes
                         # Name and Value
-                        diags[ref[0].firstChild.data] = ref[6].firstChild.data
+                        if len(ref) > 6:
+                            diags[ref[0].firstChild.data] = \
+                                ref[6].firstChild.data
             return diags
         except cls.XenAPI.Failure as e:
             return {"Unable to retrieve diagnostics": e}
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index e20930fe8..7aebb502f 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -252,7 +252,7 @@ class VMOps(object):
             raise Exception(_("suspend: instance not present %s") %
                                                      instance_name)
         task = self._session.call_xenapi('Async.VM.suspend', vm)
-        self._wait_with_callback(task, callback)
+        self._wait_with_callback(instance.id, task, callback)
 
     def resume(self, instance, callback):
         """resume the specified instance"""
@@ -262,7 +262,7 @@ class VMOps(object):
             raise Exception(_("resume: instance not present %s") %
                                                     instance_name)
         task = self._session.call_xenapi('Async.VM.resume', vm, False, True)
-        self._wait_with_callback(task, callback)
+        self._wait_with_callback(instance.id, task, callback)
 
     def get_info(self, instance_id):
         """Return data about VM instance"""
@@ -284,6 +284,11 @@ class VMOps(object):
         # TODO: implement this to fix pylint!
         return 'FAKE CONSOLE OUTPUT of instance'
 
+    def get_ajax_console(self, instance):
+        """Return link to instance's ajax console"""
+        # TODO: implement this!
+        return 'http://fakeajaxconsole/fake_url'
+
     def list_from_xenstore(self, vm, path):
         """Runs the xenstore-ls command to get a listing of all records
         from 'path' downward. Returns a dict with the sub-paths as keys,
diff --git a/nova/virt/xenapi_conn.py b/nova/virt/xenapi_conn.py
index 3aaaf09ed..45d0738a5 100644
--- a/nova/virt/xenapi_conn.py
+++ b/nova/virt/xenapi_conn.py
@@ -52,6 +52,7 @@ reactor thread if the VM.get_by_name_label or VM.get_record calls block.
 """
 
 import sys
+import urlparse
 import xmlrpclib
 
 from eventlet import event
@@ -180,6 +181,10 @@ class XenAPIConnection(object):
         """Return snapshot of console"""
         return self._vmops.get_console_output(instance)
 
+    def get_ajax_console(self, instance):
+        """Return link to instance's ajax console"""
+        return self._vmops.get_ajax_console(instance)
+
     def attach_volume(self, instance_name, device_path, mountpoint):
         """Attach volume storage to VM instance"""
         return self._volumeops.attach_volume(instance_name,
@@ -190,6 +195,12 @@ class XenAPIConnection(object):
         """Detach volume storage to VM instance"""
         return self._volumeops.detach_volume(instance_name, mountpoint)
 
+    def get_console_pool_info(self, console_type):
+        xs_url = urlparse.urlparse(FLAGS.xenapi_connection_url)
+        return  {'address': xs_url.netloc,
+                 'username': FLAGS.xenapi_connection_username,
+                 'password': FLAGS.xenapi_connection_password}
+
 
 class XenAPISession(object):
     """The session to invoke XenAPI SDK calls"""
@@ -198,6 +209,7 @@ class XenAPISession(object):
         self.XenAPI = self.get_imported_xenapi()
         self._session = self._create_session(url)
         self._session.login_with_password(user, pw)
+        self.loop = None
 
     def get_imported_xenapi(self):
         """Stubout point. This can be replaced with a mock xenapi module."""
@@ -234,14 +246,20 @@ class XenAPISession(object):
 
     def wait_for_task(self, id, task):
         """Return the result of the given task. The task is polled
-        until it completes."""
+        until it completes. Not re-entrant."""
         done = event.Event()
-        loop = utils.LoopingCall(self._poll_task, id, task, done)
-        loop.start(FLAGS.xenapi_task_poll_interval, now=True)
+        self.loop = utils.LoopingCall(self._poll_task, id, task, done)
+        self.loop.start(FLAGS.xenapi_task_poll_interval, now=True)
         rv = done.wait()
-        loop.stop()
+        self.loop.stop()
         return rv
 
+    def _stop_loop(self):
+        """Stop polling for task to finish."""
+        #NOTE(sandy-walsh) Had to break this call out to support unit tests.
+        if self.loop:
+            self.loop.stop()
+
     def _create_session(self, url):
         """Stubout point. This can be replaced with a mock session."""
         return self.XenAPI.Session(url)
@@ -278,6 +296,7 @@ class XenAPISession(object):
         except self.XenAPI.Failure, exc:
             LOG.warn(exc)
             done.send_exception(*sys.exc_info())
+        self._stop_loop()
 
     def _unwrap_plugin_exceptions(self, func, *args, **kwargs):
         """Parse exception details"""
diff --git a/nova/volume/driver.py b/nova/volume/driver.py
index 477e0abf4..44bfeaf0c 100644
--- a/nova/volume/driver.py
+++ b/nova/volume/driver.py
@@ -20,7 +20,6 @@ Drivers for volumes.
 
 """
 
-import os
 import time
 
 from nova import exception
@@ -50,6 +49,8 @@ flags.DEFINE_string('iscsi_target_prefix', 'iqn.2010-10.org.openstack:',
                     'prefix for iscsi volumes')
 flags.DEFINE_string('iscsi_ip_prefix', '127.0',
                     'discover volumes on the ip that starts with this prefix')
+flags.DEFINE_string('rbd_pool', 'rbd',
+                    'the rbd pool in which volumes are stored')
 
 
 class VolumeDriver(object):
@@ -80,7 +81,9 @@ class VolumeDriver(object):
 
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
-        if not os.path.isdir("/dev/%s" % FLAGS.volume_group):
+        out, err = self._execute("sudo vgs --noheadings -o name")
+        volume_groups = out.split()
+        if not FLAGS.volume_group in volume_groups:
             raise exception.Error(_("volume group %s doesn't exist")
                                   % FLAGS.volume_group)
 
@@ -313,3 +316,58 @@ class FakeISCSIDriver(ISCSIDriver):
         """Execute that simply logs the command."""
         LOG.debug(_("FAKE ISCSI: %s"), cmd)
         return (None, None)
+
+
+class RBDDriver(VolumeDriver):
+    """Implements RADOS block device (RBD) volume commands"""
+
+    def check_for_setup_error(self):
+        """Returns an error if prerequisites aren't met"""
+        (stdout, stderr) = self._execute("rados lspools")
+        pools = stdout.split("\n")
+        if not FLAGS.rbd_pool in pools:
+            raise exception.Error(_("rbd has no pool %s") %
+                                  FLAGS.rbd_pool)
+
+    def create_volume(self, volume):
+        """Creates a logical volume."""
+        if int(volume['size']) == 0:
+            size = 100
+        else:
+            size = int(volume['size']) * 1024
+        self._try_execute("rbd --pool %s --size %d create %s" %
+                          (FLAGS.rbd_pool,
+                           size,
+                           volume['name']))
+
+    def delete_volume(self, volume):
+        """Deletes a logical volume."""
+        self._try_execute("rbd --pool %s rm %s" %
+                          (FLAGS.rbd_pool,
+                           volume['name']))
+
+    def local_path(self, volume):
+        """Returns the path of the rbd volume."""
+        # This is the same as the remote path
+        # since qemu accesses it directly.
+        return self.discover_volume(volume)
+
+    def ensure_export(self, context, volume):
+        """Synchronously recreates an export for a logical volume."""
+        pass
+
+    def create_export(self, context, volume):
+        """Exports the volume"""
+        pass
+
+    def remove_export(self, context, volume):
+        """Removes an export for a logical volume"""
+        pass
+
+    def discover_volume(self, volume):
+        """Discover volume on a remote host"""
+        return "rbd:%s/%s" % (FLAGS.rbd_pool, volume['name'])
+
+    def undiscover_volume(self, volume):
+        """Undiscover volume on a remote host"""
+        pass
diff --git a/nova/wsgi.py b/nova/wsgi.py
index a147bda7f..00b351253 100644
--- a/nova/wsgi.py
+++ b/nova/wsgi.py
@@ -57,7 +57,7 @@ class Server(object):
 
     def start(self, application, port, host='0.0.0.0', backlog=128):
         """Run a WSGI server with the given application."""
-        logging.audit("Starting %s on %s:%s", sys.argv[0], host, port)
+        logging.audit(_("Starting %s on %s:%s"), sys.argv[0], host, port)
         socket = eventlet.listen((host, port), backlog=backlog)
         self.pool.spawn_n(self._run, application, socket)