Merge lp:~midokura/nova/network-service into lp:~ntt-pf-lab/nova/network-service

[Ryu Ishimoto]

Moved security group/firewall logic out of compute into the plugin. Still needs a lot more refactoring and testing.

Moved security group/firewall logic out of compute into the plugin. Still needs a lot more refactoring and testing.

=== renamed file 'bin/nova-net-flat-vlan-manage' => 'bin/nova-net-flat-vlan-manage.THIS'
=== added file 'bin/nova-network-manage'
--- bin/nova-network-manage	1970-01-01 00:00:00 +0000
+++ bin/nova-network-manage	2011-04-18 00:30:54 +0000
@@ -0,0 +1,289 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Midokura KK
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+# Interactive shell based on Django:
+#
+# Copyright (c) 2005, the Lawrence Journal-World
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+#     1. Redistributions of source code must retain the above copyright notice,
+#        this list of conditions and the following disclaimer.
+#
+#     2. Redistributions in binary form must reproduce the above copyright
+#        notice, this list of conditions and the following disclaimer in the
+#        documentation and/or other materials provided with the distribution.
+#
+#     3. Neither the name of Django nor the names of its contributors may be
+#        used to endorse or promote products derived from this software without
+#        specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""
+  CLI interface for nova flat vlan network management.
+"""
+
+import gettext
+import os
+import sys
+
+import IPy
+
+import novaclient
+from novaclient import base
+
+# If ../nova/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+gettext.install('nova', unicode=1)
+
+from nova import context
+from nova import db as nova_db
+from nova import exception
+from nova import flags as nova_flags
+from nova import log as logging
+from nova import utils
+
+from nova.network.flat_vlan import db
+
+from nova.network.flat_vlan import client as net_client
+from nova.network.flat_vlan.db import migration
+
+NOVA_FLAGS = nova_flags.FLAGS
+
+## OS_CLIENT = net_client.NetOpenStack(os.environ['NOVA_USERNAME'],
+##                                     os.environ['NOVA_API_KEY'],
+##                                     os.environ['NOVA_URL'])
+OS_CLIENT = net_client.NetOpenStack('ryu',
+                                    'b3573cfc-9c21-4345-a601-8f17a04d43a1',
+                                    'http://localhost:8774/v1.0')
+
+class NetworkCommands(object):
+    """Class for managing network."""
+
+    def _print_networks(self, networks):
+        """Prints network info to terminal.
+
+        Args:
+           networks: a list of networks.
+        """
+        print "%-18s\t%-15s\t%-15s\t%-15s" % (_('network'),
+                                              _('netmask'),
+                                              _('start address'),
+                                              'DNS')
+        for network in networks:
+             print "%-18s\t%-15s\t%-15s\t%-15s" % (network.cidr,
+                                network.netmask,
+                                network.dhcp_start,
+                                network.dns)
+        
+    def create(self, cidr, num_networks, network_size, vlan_start, vpn_start,
+               cidr_v6, label='public'):
+        """Creates networks.
+
+        Args:
+           cidr: ipv4 ip range
+           num_networks: number of networks to create
+           network_size: number of IPs to create for each network.
+           vlan_start: VLAN starting ID number.
+           vpn_start: VPN starting port number.
+           cidr_v6: ipv6 IP range.
+           label: network label.
+        """
+        if not cidr:
+            raise TypeError(_('Fixed range in the form of 10.0.0.0/8 is '
+                              'required to create networks.'))
+        OS_CLIENT.networks.create_with_fixed_ips(cidr, num_networks,
+                                                 network_size, vlan_start,
+                                                 vpn_start, cidr_v6, label)
+    def list(self):
+        """List all created networks
+        """
+        networks = OS_CLIENT.networks.list()
+        self._print_networks(networks)
+    
+    def delete(self, fixed_range):
+        """Deletes the network with fixed_range.
+
+        Args:
+           fixed_range: CIDR of the network to delete.
+        """
+        OS_CLIENT.networks.delete_by_cidr(fixed_range)
+
+class FixedIpCommands(object):
+    """Management commands for Fixed IPs."""
+
+    def _print_fixed_ips(self, ips):
+        """Prints IPs.
+
+        Args:
+           ips: IP address list.
+        """
+        #TODO need to get host information from instances.
+        print "%-18s\t%-15s\t%-17s\t%-15s\t%s" % (_('network'),
+                                                  _('IP address'),
+                                                  _('MAC address'),
+                                                  _('hostname'),
+                                                  _('host'))     
+        for ip in ips:
+            print ip.address
+            print "%-18s\t%-15s\t%-17s\t%-15s\t%s" % (
+                ip.network['cidr'],
+                ip.address,
+                ip.ethernet_card['mac_address'],
+                "", "")
+           
+    def list(self):
+        """List all created fixed IPs.
+        """
+        ips = OS_CLIENT.fixed_ips.list()
+        self._print_fixed_ips(ips)
+
+class FloatingIpCommands(object):
+    """Class for managing floating ip."""
+
+    def create(self, host, cidr):
+        """Creates floating ips for host by range
+        arguments: host ip_range"""
+        ips = OS_CLIENT.floating_ips.create_by_cidr(host, cidr)
+        
+
+    def delete(self, cidr):
+        """Deletes floating ips by range
+        arguments: range"""
+        ips = OS_CLIENT.floating_ips.delete_by_cidr(cidr)
+
+    def list(self, host=None):
+        """Lists all floating ips (optionally by host)
+        arguments: [host]"""
+        floating_ips = OS_CLIENT.floating_ips.list()
+        for floating_ip in floating_ips:
+            if floating_ip.fixed_ip and floating_ip.fixed_ip.ethernet_card:
+                
+                print "%s\t%s\t%s" % (floating_ip.host,
+                                      floating_ip.address,
+                                      "")
+
+class DbCommands(object):
+    """Class for managing the database."""
+
+    def __init__(self):
+        pass
+
+    def sync(self, version=None):
+        """Sync the database up to the most recent version."""
+        return migration.db_sync(version)
+
+    def version(self):
+        """Print the current database version."""
+        print migration.db_version()
+
+CATEGORIES = [
+    ('network', NetworkCommands),
+    ('fixed', FixedIpCommands),
+    ('floating', FloatingIpCommands),
+    ('db', DbCommands)]
+
+def lazy_match(name, key_value_tuples):
+    """Finds all objects that have a key that case insensitively contains
+    [name] key_value_tuples is a list of tuples of the form (key, value)
+    returns a list of tuples of the form (key, value)"""
+    result = []
+    for (k, v) in key_value_tuples:
+        if k.lower().find(name.lower()) == 0:
+            result.append((k, v))
+    if len(result) == 0:
+        print "%s does not match any options:" % name
+        for k, _v in key_value_tuples:
+            print "\t%s" % k
+        sys.exit(2)
+    if len(result) > 1:
+        print "%s matched multiple options:" % name
+        for k, _v in result:
+            print "\t%s" % k
+        sys.exit(2)
+    return result
+
+def methods_of(obj):
+    """Get all callable methods of an object that don't start with underscore
+    returns a list of tuples of the form (method_name, method)"""
+    result = []
+    for i in dir(obj):
+        if callable(getattr(obj, i)) and not i.startswith('_'):
+            result.append((i, getattr(obj, i)))
+    return result
+
+
+def main():
+    """Parse options and call the appropriate class/method."""
+    utils.default_flagfile()
+    argv = NOVA_FLAGS(sys.argv)
+    logging.setup()
+
+    script_name = argv.pop(0)
+    if len(argv) < 1:
+        print script_name + " category action [<args>]"
+        print "Available categories:"
+        for k, _ in CATEGORIES:
+            print "\t%s" % k
+        sys.exit(2)
+    category = argv.pop(0)
+    matches = lazy_match(category, CATEGORIES)
+    # instantiate the command group object
+    category, fn = matches[0]
+    command_object = fn()
+    actions = methods_of(command_object)
+    if len(argv) < 1:
+        print script_name + " category action [<args>]"
+        print "Available actions for %s category:" % category
+        for k, _v in actions:
+            print "\t%s" % k
+        sys.exit(2)
+    action = argv.pop(0)
+    matches = lazy_match(action, actions)
+    action, fn = matches[0]
+    # call the action with the remaining arguments
+    try:
+        fn(*argv)
+        sys.exit(0)
+    except TypeError:
+        print "Possible wrong number of arguments supplied"
+        print "%s %s: %s" % (category, action, fn.__doc__)
+        raise
+
+if __name__ == '__main__':
+    main()

=== modified file 'nova/api/ec2/cloud.py'
--- nova/api/ec2/cloud.py	2011-04-12 10:57:56 +0000
+++ nova/api/ec2/cloud.py	2011-04-18 00:30:54 +0000
@@ -75,6 +75,11 @@
     db.key_pair_create(context, key)
     return {'private_key': private_key, 'fingerprint': fingerprint}
 
+def _get_net_api_service(context, project_id):
+    """Gets network API service for a given project.
+    """
+    net_factory = net_service.get_service_factory(context, project_id)
+    return net_factory.get_api_service()
 
 class CloudController(object):
     """ CloudController provides the critical dispatch between
@@ -116,7 +121,7 @@
             # TODO(vish): Do this with M2Crypto instead
             utils.runthis(_("Generating root CA: %s"), "sh", genrootca_sh_path)
             os.chdir(start)
-
+        
     def _get_mpi_data(self, context, project_id):
         result = {}
         for instance in self.compute_api.get_all(context,
@@ -161,9 +166,7 @@
         vnic_ids = db.virtual_nics_get_by_instance(ctxt, instance_ref['id'])
         floating_ip = None
         if vnic_ids:
-            net_factory = net_service.get_service_factory(ctxt,
-                                          instance_ref['project_id'])
-            net_api = net_factory.get_api_service()
+            net_api = _get_net_api_service(ctxt, instance_ref['project_id'])
             net = net_api.get_vnic_network_info(ctxt, vnic_ids[0])
             if net and net['IPs'] and net['IPs'][0]['floating_ips']:
                 floating_ip = net['IPs'][0]['floating_ips'][0]
@@ -339,49 +342,57 @@
 
     def describe_security_groups(self, context, group_name=None, **kwargs):
         self.compute_api.ensure_default_security_group(context)
+        net_api = _get_net_api_service(context, context.project_id)
+
         if group_name:
             groups = []
             for name in group_name:
-                group = db.security_group_get_by_name(context,
-                                                      context.project_id,
-                                                      name)
+                group = net_api.get_security_group_by_name(context, name,
+                                                           context.project_id)
                 groups.append(group)
         elif context.is_admin:
-            groups = db.security_group_get_all(context)
+            groups = net_api.get_security_groups(context)
         else:
-            groups = db.security_group_get_by_project(context,
-                                                      context.project_id)
-        groups = [self._format_security_group(context, g) for g in groups]
+            groups = net_api.get_security_groups(context,
+                                                 tenant_id=context.project_id)
+        groups = [self._format_security_group(context, g, net_api) for g in
+                  groups]
 
         return {'securityGroupInfo':
                 list(sorted(groups,
                             key=lambda k: (k['ownerId'], k['groupName'])))}
 
-    def _format_security_group(self, context, group):
+    def _format_security_group_rule(self, context, rule, net_api):
+        r = {}
+        r['ipProtocol'] = rule['protocol']
+        r['fromPort'] = rule['from_port']
+        r['toPort'] = rule['to_port']
+        r['groups'] = []
+        r['ipRanges'] = []
+        if rule['group_id']:
+            source_group = net_api.get_security_group(context, rule['group_id'],
+                                                      context.project_id)
+            r['groups'] += [{'groupName': source_group['name'],
+                             'userId': source_group['tenant_id']}]
+        else:
+            r['ipRanges'] += [{'cidrIp': rule['cidr']}]
+        return r
+
+    def _format_security_group(self, context, group, net_api):
         g = {}
-        g['groupDescription'] = group.description
-        g['groupName'] = group.name
-        g['ownerId'] = group.project_id
+        g['groupDescription'] = group['description']
+        g['groupName'] = group['name']
+        g['ownerId'] = group['tenant_id']
         g['ipPermissions'] = []
-        for rule in group.rules:
-            r = {}
-            r['ipProtocol'] = rule.protocol
-            r['fromPort'] = rule.from_port
-            r['toPort'] = rule.to_port
-            r['groups'] = []
-            r['ipRanges'] = []
-            if rule.group_id:
-                source_group = db.security_group_get(context, rule.group_id)
-                r['groups'] += [{'groupName': source_group.name,
-                                 'userId': source_group.project_id}]
-            else:
-                r['ipRanges'] += [{'cidrIp': rule.cidr}]
-            g['ipPermissions'] += [r]
+        if 'rules' in group:
+            for rule in group['rules']:
+                g['ipPermissions'] += [self._format_security_group_rule(
+                    context, rule, net_api)]
         return g
 
-    def _revoke_rule_args_to_dict(self, context, to_port=None, from_port=None,
-                                  ip_protocol=None, cidr_ip=None, user_id=None,
-                                  source_security_group_name=None,
+    def _revoke_rule_args_to_dict(self, context, net_api, to_port=None,
+                                  from_port=None, ip_protocol=None, cidr_ip=None,
+                                  user_id=None, source_security_group_name=None,
                                   source_security_group_owner_id=None):
 
         values = {}
@@ -390,10 +401,9 @@
             source_project_id = self._get_source_project_id(context,
                 source_security_group_owner_id)
 
-            source_security_group = \
-                    db.security_group_get_by_name(context.elevated(),
-                                                  source_project_id,
-                                                  source_security_group_name)
+            source_security_group = net_api.get_security_group_by_name(
+                context.elevated(), source_security_group_name,
+                source_project_id)
             values['group_id'] = source_security_group['id']
         elif cidr_ip:
             # If this fails, it throws an exception. This is what we want.
@@ -425,11 +435,11 @@
 
         return values
 
-    def _security_group_rule_exists(self, security_group, values):
+    def _security_group_rule_exists(self, rules, values):
         """Indicates whether the specified rule values are already
            defined in the given security group.
         """
-        for rule in security_group.rules:
+        for rule in rules:
             if 'group_id' in values:
                 if rule['group_id'] == values['group_id']:
                     return True
@@ -447,22 +457,21 @@
         LOG.audit(_("Revoke security group ingress %s"), group_name,
                   context=context)
         self.compute_api.ensure_default_security_group(context)
-        security_group = db.security_group_get_by_name(context,
-                                                       context.project_id,
-                                                       group_name)
-
-        criteria = self._revoke_rule_args_to_dict(context, **kwargs)
+        net_api = _get_net_api_service(context, context.project_id)
+        criteria = self._revoke_rule_args_to_dict(context, net_api, **kwargs)
         if criteria == None:
             raise exception.ApiError(_("Not enough parameters to build a "
                                        "valid rule."))
-
-        for rule in security_group.rules:
+        
+        security_group = net_api.get_security_group_by_name(context, group_name,
+                                                            context.project_id)
+        for rule in security_group['rules']:
             match = True
             for (k, v) in criteria.iteritems():
-                if getattr(rule, k, False) != v:
+                if (not k in rule) or rule[k] != v:
                     match = False
             if match:
-                db.security_group_rule_destroy(context, rule['id'])
+                net_api.delete_security_group_rule(context, rule['id'])
                 self.compute_api.trigger_security_group_rules_refresh(context,
                                                           security_group['id'])
                 return True
@@ -476,25 +485,26 @@
         LOG.audit(_("Authorize security group ingress %s"), group_name,
                   context=context)
         self.compute_api.ensure_default_security_group(context)
-        security_group = db.security_group_get_by_name(context,
-                                                       context.project_id,
-                                                       group_name)
-
-        values = self._revoke_rule_args_to_dict(context, **kwargs)
+        net_api = _get_net_api_service(context, context.project_id)
+        values = self._revoke_rule_args_to_dict(context, net_api, **kwargs)
         if values is None:
             raise exception.ApiError(_("Not enough parameters to build a "
                                        "valid rule."))
-        values['parent_group_id'] = security_group.id
-
-        if self._security_group_rule_exists(security_group, values):
+
+        security_group = net_api.get_security_group_by_name(context, group_name,
+                                                            context.project_id)       
+
+        if self._security_group_rule_exists(security_group['rules'], values):
             raise exception.ApiError(_('This rule already exists in group %s')
                                      % group_name)
 
-        security_group_rule = db.security_group_rule_create(context, values)
+        rule = net_api.create_security_group_rule(context, security_group['id'],
+                                                  **values)
+        LOG.audit(_("Created Security Group Rule: %s for group %s"),
+                  rule['id'], security_group['id'], context=context)
 
         self.compute_api.trigger_security_group_rules_refresh(context,
                                                           security_group['id'])
-
         return True
 
     def _get_source_project_id(self, context, source_security_group_owner_id):
@@ -517,24 +527,22 @@
     def create_security_group(self, context, group_name, group_description):
         LOG.audit(_("Create Security Group %s"), group_name, context=context)
         self.compute_api.ensure_default_security_group(context)
-        if db.security_group_exists(context, context.project_id, group_name):
-            raise exception.ApiError(_('group %s already exists') % group_name)
-
-        group = {'user_id': context.user_id,
-                 'project_id': context.project_id,
-                 'name': group_name,
-                 'description': group_description}
-        group_ref = db.security_group_create(context, group)
-
+        net_api = _get_net_api_service(context, context.project_id)
+        group = net_api.create_security_group(context, context.user_id,
+                                              context.project_id,
+                                              group_name,
+                                              group_description)
         return {'securityGroupSet': [self._format_security_group(context,
-                                                                 group_ref)]}
+                                                                 group,
+                                                                 net_api)]}
 
     def delete_security_group(self, context, group_name, **kwargs):
         LOG.audit(_("Delete security group %s"), group_name, context=context)
-        security_group = db.security_group_get_by_name(context,
-                                                       context.project_id,
-                                                       group_name)
-        db.security_group_destroy(context, security_group.id)
+        net_api = _get_net_api_service(context, context.project_id)
+        security_group = net_api.get_security_group_by_name(context,
+                                                            group_name,
+                                                            context.project_id)
+        net_api.delete_security_group(context, security_group['id'])
         return True
 
     def get_console_output(self, context, instance_id, **kwargs):
@@ -727,13 +735,11 @@
             fixed_addr = None
             floating_addr = None
             vnic_ids = db.virtual_nics_get_by_instance(context, instance['id'])
+            net_api = _get_net_api_service(context, instance['project_id'])
+            net = None
             if vnic_ids:
-                net_factory = net_service.get_service_factory(context,
-                                              context.project_id)
-                net_api_service = net_factory.get_api_service()
                 # For now just get one VNIC info
-                net = net_api_service.get_vnic_network_info(context,
-                                                            vnic_ids[0])
+                net = net_api.get_vnic_network_info(context, vnic_ids[0])
                 # Assume only one IP for now.
                 if net['IPs']:
                     ip_info = net['IPs'][0]
@@ -769,12 +775,13 @@
                 r = {}
                 r['reservationId'] = instance['reservation_id']
                 r['ownerId'] = instance['project_id']
-                security_group_names = []
-                if instance.get('security_groups'):
-                    for security_group in instance['security_groups']:
+
+                if net and net['security_groups']:
+                    security_group_names = []
+                    for security_group in net['security_groups']:
                         security_group_names.append(security_group['name'])
-                r['groupSet'] = self._convert_to_set(security_group_names,
-                                                     'groupId')
+                    r['groupSet'] = self._convert_to_set(security_group_names,
+                                                         'groupId')
                 r['instancesSet'] = []
                 reservations[instance['reservation_id']] = r
             reservations[instance['reservation_id']]['instancesSet'].append(i)
@@ -786,10 +793,7 @@
 
     def format_addresses(self, context):
         addresses = []
-
-        net_factory = net_service.get_service_factory(context,
-                                                      context.project_id)
-        net_api = net_factory.get_api_service()
+        net_api = _get_net_api_service(context, context.project_id)
         project_id = context.project_id if not context.is_admin else None
         ip_info_list = net_api.get_addresses(context, project_id)
 
@@ -815,15 +819,12 @@
 
     def allocate_address(self, context, **kwargs):
         LOG.audit(_("Allocate address"), context=context)
-
-        net_factory = net_service.get_service_factory(context,
-                                                      context.project_id)
-        net_api_service = net_factory.get_api_service()
+        net_api = _get_net_api_service(context, context.project_id)
         ip_quota = quota.get_quota(context, context.project_id)['floating_ips']
         try:
-            public_ip = net_api_service.allocate_address(context,
-                                                         context.project_id,
-                                                         ip_quota)
+            public_ip = net_api.allocate_address(context,
+                                                 context.project_id,
+                                                 ip_quota)
         except quota.QuotaError, ex:
             LOG.warn(_("Quota exceeded for %s, tried to allocate "
                            "address"),
@@ -834,11 +835,8 @@
 
     def release_address(self, context, public_ip, **kwargs):
         LOG.audit(_("Release address %s"), public_ip, context=context)
-        net_factory = net_service.get_service_factory(context,
-                                                      context.project_id)
-        net_api_service = net_factory.get_api_service()
-
-        net_api_service.deallocate_address(context, public_ip)
+        net_api = _get_net_api_service(context, context.project_id)
+        net_api.deallocate_address(context, public_ip)
         return {'releaseResponse': ["Address released."]}
 
     def associate_address(self, context, instance_id, public_ip, **kwargs):
@@ -846,18 +844,14 @@
                 " instance %(instance_id)s") % locals(), context=context)
         instance_id = ec2utils.ec2_id_to_id(instance_id)
         vnic_ids = db.virtual_nics_get_by_instance(context, instance_id)
-        net_factory = net_service.get_service_factory(context,
-                                                      context.project_id)
-        net_api_service = net_factory.get_api_service()
-        net_api_service.associate_address(context, vnic_ids[0], public_ip)
+        net_api = _get_net_api_service(context, context.project_id)
+        net_api.associate_address(context, vnic_ids[0], public_ip)
         return {'associateResponse': ["Address associated."]}
 
     def disassociate_address(self, context, public_ip, **kwargs):
         LOG.audit(_("Disassociate address %s"), public_ip, context=context)
-        net_factory = net_service.get_service_factory(context,
-                                                      context.project_id)
-        net_api_service = net_factory.get_api_service()
-        net_api_service.disassociate_address(context, public_ip)
+        net_api = _get_net_api_service(context, context.project_id)
+        net_api.disassociate_address(context, public_ip)
         return {'disassociateResponse': ["Address disassociated."]}
 
     def run_instances(self, context, **kwargs):

=== modified file 'nova/auth/manager.py'
--- nova/auth/manager.py	2011-04-07 06:34:15 +0000
+++ nova/auth/manager.py	2011-04-18 00:30:54 +0000
@@ -590,7 +590,7 @@
         project_id = Project.safe_id(project)
         net_factory = net_service.get_service_factory(ctxt, project_id)
         net_api = net_factory.get_api_service()
-        net = net_api.get_project_network_info(ctxt, project_id)
+        net = net_api.get_tenant_network_info(ctxt, project_id)
         if net:
             return (net['vpn_public_address'], net['vpn_public_port'])
         else:

=== modified file 'nova/compute/api.py'
--- nova/compute/api.py	2011-04-12 10:57:56 +0000
+++ nova/compute/api.py	2011-04-18 00:30:54 +0000
@@ -28,7 +28,6 @@
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova import network
 from nova import quota
 from nova import rpc
 from nova import utils
@@ -45,10 +44,18 @@
 FLAGS = flags.FLAGS
 flags.DECLARE('vncproxy_topic', 'nova.vnc')
 
+_DEFAULT_SECURITY_GROUP_NAME = 'default'
+_DEFAULT_SECURITY_GROUP_DESCRIPTION = 'default'
+
 def generate_default_hostname(instance_id):
     """Default function to generate a hostname given an instance reference."""
     return str(instance_id)
 
+def _get_net_api_service(context, project_id):
+    """Gets network API service for a given project.
+    """
+    net_factory = net_service.get_service_factory(context, project_id)
+    return net_factory.get_api_service()
 
 class API(base.Base):
     """API for interacting with the compute manager."""
@@ -174,6 +181,8 @@
         if ramdisk_id:
             self.image_service.show(context, ramdisk_id)
 
+        net_api = _get_net_api_service(context, context.project_id)
+
         if security_group is None:
             security_group = ['default']
         if not type(security_group) is list:
@@ -182,9 +191,9 @@
         security_groups = []
         self.ensure_default_security_group(context)
         for security_group_name in security_group:
-            group = db.security_group_get_by_name(context,
-                                                  context.project_id,
-                                                  security_group_name)
+            group = net_api.get_security_group_by_name(context,
+                                                       security_group_name,
+                                                       context.project_id)
             security_groups.append(group['id'])
 
         if key_data is None and key_name:
@@ -228,22 +237,16 @@
             if vnic_list:
                 vnics = vnic_list.pop(0)
             else:
-                net_factory = net_service.get_service_factory(context,
-                                  context.project_id)
-                net_api_service = net_factory.get_api_service()
-                vnics = [net_api_service.create_vnic(context)]
+                vnics = [net_api.create_vnic(context)]
+
             # Associate these vnics to the instance.
             for vnic_id in vnics:
                 self.db.instance_add_virtual_nic(context, instance_id,
                                                  vnic_id)
-
-            elevated = context.elevated()
-            if not security_groups:
-                security_groups = []
-            for security_group_id in security_groups:
-                self.db.instance_add_security_group(elevated,
-                                                    instance_id,
-                                                    security_group_id)
+                for security_group_id in security_groups:
+                    net_api.associate_vnic_and_security_group(
+                        elevated, vnic_id, security_group_id,
+                        context.project_id)
 
             # Set sane defaults if not specified
             updates = dict(hostname=self.hostname_factory(instance_id))
@@ -288,31 +291,31 @@
         :param context: the security context
 
         """
-        try:
-            db.security_group_get_by_name(context, context.project_id,
-                                          'default')
-        except exception.NotFound:
-            values = {'name': 'default',
-                      'description': 'default',
-                      'user_id': context.user_id,
-                      'project_id': context.project_id}
-            db.security_group_create(context, values)
+        net_api = _get_net_api_service(context, context.project_id)
+        group = net_api.get_security_group_by_name(
+            context, _DEFAULT_SECURITY_GROUP_NAME, context.project_id)
+        if not group:
+            net_api.create_security_group(
+                context, context.user_id, context.project_id,
+                _DEFAULT_SECURITY_GROUP_NAME,
+                _DEFAULT_SECURITY_GROUP_DESCRIPTION)
 
     def trigger_security_group_rules_refresh(self, context, security_group_id):
         """Called when a rule is added to or removed from a security_group"""
 
-        security_group = self.db.security_group_get(context, security_group_id)
-
+        net_api = _get_net_api_service(context, context.project_id)
+        security_group = net_api.get_security_group(context, security_group_id)
         hosts = set()
-        for instance in security_group['instances']:
-            if instance['host'] is not None:
+        for vnic_id in security_group['vnic_ids']:
+            instance = self.db.instance_get_by_virtual_nic(context, vnic_id)
+            if instance and instance['host']:
                 hosts.add(instance['host'])
 
         for host in hosts:
             rpc.cast(context,
                      self.db.queue_get_for(context, FLAGS.compute_topic, host),
                      {"method": "refresh_security_group_rules",
-                      "args": {"security_group_id": security_group.id}})
+                      "args": {"security_group_id": security_group_id}})
 
     def trigger_security_group_members_refresh(self, context, group_id):
         """Called when a security group gains a new or loses a member
@@ -425,10 +428,8 @@
                 context, reservation_id)
 
         if fixed_ip is not None:
-            net_factory = net_service.get_service_factory(context,
-                                                          project_id)
-            net_api_service = net_factory.get_api_service()
-            vnic_id = net_api_service.get_vnic_by_ip(context, fixed_ip)
+            net_api = _get_net_api_service(context, project_id)
+            vnic_id = net_api.get_vnic_by_ip(context, fixed_ip)
             return self.db.instance_get_by_virtual_nic(context, vnic_id)
 
         if project_id or not context.is_admin:

=== added file 'nova/network/flat_vlan/api/openstack/ethernet_cards.py'
--- nova/network/flat_vlan/api/openstack/ethernet_cards.py	1970-01-01 00:00:00 +0000
+++ nova/network/flat_vlan/api/openstack/ethernet_cards.py	2011-04-18 00:30:54 +0000
@@ -0,0 +1,67 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2011 NTT.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+from webob import exc
+
+from nova.api.openstack import common as nova_common
+from nova import exception
+from nova import wsgi
+from nova.api.openstack import faults
+from nova.network.flat_vlan import common
+from nova.network.flat_vlan import db
+from nova.network.flat_vlan import manager
+
+class Controller(wsgi.Controller):
+    """ The Virtual NICs API controller for the OpenStack API """
+    
+    def __init__(self):
+        super(Controller, self).__init__()
+
+    def index(self, req):
+        """Return all ethernet cards in brief"""
+        items = db.api.ethernet_card_get_all(req.environ['nova.context'])
+        items = nova_common.limited(items, req)
+        items = [common.filter_keys(item, ('id', 'mac_address')) 
+                 for item in items]
+        return dict(ethernet_cards=items)        
+    
+    def create(self, req):
+        """ Creates a new ethernet card. """
+        ethernet_card = manager.ethernet_card_create_with_random_mac(
+                            req.environ['nova.context'])
+        return dict(id=ethernet_card.id)
+ 
+    def update(self, req, id):
+        """Update an ethernet card"""
+        return exc.HTTPNoContent()
+    
+    def show(self, req, id):
+        """ Gets the ethernet card with ID given """
+        try:
+            ethernet_card = db.api.ethernet_card_get(
+                                req.environ['nova.context'], id)
+            return dict(id=ethernet_card.id,
+                        mac_address=ethernet_card.mac_address)
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+
+    def delete(self, req, id):
+        """ Destroys an ethernet card """
+        try:
+            db.api.ethernet_card_delete(req.environ['nova.context'], id)
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+        return exc.HTTPAccepted()

=== removed file 'nova/network/flat_vlan/api/openstack/virtual_nics.py'
--- nova/network/flat_vlan/api/openstack/virtual_nics.py	2011-03-31 07:15:23 +0000
+++ nova/network/flat_vlan/api/openstack/virtual_nics.py	1970-01-01 00:00:00 +0000
@@ -1,68 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright (c) 2011 NTT.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-from webob import exc
-
-from nova.api.openstack import common as nova_common
-from nova import exception
-from nova import wsgi
-from nova.api.openstack import faults
-from nova.db import base
-from nova.network.flat_vlan import common
-from nova.network.flat_vlan import db
-from nova.network.flat_vlan import manager
-
-class Controller(wsgi.Controller):
-    """ The Virtual NICs API controller for the OpenStack API """
-    
-    def __init__(self):
-        super(Controller, self).__init__()
-
-    def index(self, req):
-        """Return all ethernet cards in brief"""
-        items = db.api.ethernet_card_get_all(req.environ['nova.context'])
-        items = nova_common.limited(items, req)
-        items = [common.filter_keys(item, ('id', 'mac_address')) 
-                 for item in items]
-        return dict(ethernet_cards=items)        
-    
-    def create(self, req):
-        """ Creates a new ethernet card. """
-        ethernet_card = manager.ethernet_card_create_with_random_mac(
-                            req.environ['nova.context'])
-        return dict(id=ethernet_card.id)
- 
-    def update(self, req, id):
-        """Update an ethernet card"""
-        return exc.HTTPNoContent()
-    
-    def show(self, req, id):
-        """ Gets the ethernet card with ID given """
-        try:
-            ethernet_card = db.api.ethernet_card_get(
-                                req.environ['nova.context'], id)
-            return dict(id=ethernet_card.id,
-                        mac_address=ethernet_card.mac_address)
-        except exception.NotFound:
-            return faults.Fault(exc.HTTPNotFound())
-
-    def delete(self, req, id):
-        """ Destroys an ethernet card """
-        try:
-            db.api.ethernet_card_delete(req.environ['nova.context'], id)
-        except exception.NotFound:
-            return faults.Fault(exc.HTTPNotFound())
-        return exc.HTTPAccepted()

=== modified file 'nova/network/flat_vlan/api/service.py'
--- nova/network/flat_vlan/api/service.py	2011-04-12 06:44:35 +0000
+++ nova/network/flat_vlan/api/service.py	2011-04-18 00:30:54 +0000
@@ -25,6 +25,7 @@
 from nova.network.flat_vlan import flags
 from nova.network.flat_vlan import manager
 from nova.network.flat_vlan import db
+from nova.network.flat_vlan.api.openstack import ethernet_cards
 from nova.network.flat_vlan.api.openstack import fixed_ips
 from nova.network.flat_vlan.api.openstack import floating_ips
 from nova.network.flat_vlan.api.openstack import networks
@@ -32,7 +33,9 @@
 FLAGS = flags.FlagAccessor()
 
 class NetworkApiService(object):
-    """Network API Service for this plugin."""
+    """Network API Service for this plugin.  This should be eventually
+    refactored into separate API services, such as OpenStack API routes,
+    Security Group, Network IP management, etc."""
 
     interface.implements(service.INetworkApiService)
 
@@ -43,6 +46,10 @@
            route_map: NetworkServiceRouteMap object to add the routes to.
         """
         # Set up fixed IPs
+        route_map.resource("ethernet_cards", "/ethernet_cards",
+                           controller=ethernet_cards.Controller())
+
+        # Set up fixed IPs
         route_map.resource("fixed_ips", "/fixed_ips",
                            controller=fixed_ips.Controller())
 
@@ -133,6 +140,18 @@
                   fixed_ip: Fixed IPv4 IP address
                   floating_ips: A list of floating IPv4 IP addresses
                   ip_v6: IPv6 address
+              security_groups: A list of security group dictionary.
+                  id: unique identifier of the security group.
+                  name: Name of the security group.
+                  description: Security group description
+                  tenant_id: The tenant to which the security group belongs to.
+                  rules: A list of ingress rules for this security group.
+                      parent_group_id: Parent security group ID.
+                      protocol: Protocol for the rule.
+                      from_port: The source port for the rule.
+                      to_port: The destination port for the rule.
+                      cidr: CIDR for the rule.
+                      security_group_id: The security group ID. 
         """
         ethernet_card = db.ethernet_card_get(context, vnic_id)
         if not ethernet_card:
@@ -140,18 +159,16 @@
 
         net = dict(ipv6_enabled=FLAGS.net_flat_vlan_use_ipv6,
                    mac_address=ethernet_card.mac_address,
-                   IPs=[])
-
-        if not ethernet_card.fixed_ips:
-            return net
+                   IPs=[], security_groups=[])
 
         for fixed_ip in ethernet_card.fixed_ips:
             ip_info = dict()
             ip_info['fixed_ip'] = fixed_ip.address
 
             self._fill_dict_with_network_info(ip_info, fixed_ip.network)
-            ip_info['ip_v6'] = utils.to_global_ipv6(fixed_ip.network.cidr_v6,
-                                                    ethernet_card.mac_address)
+            if FLAGS.net_flat_vlan_use_ipv6 and fixed_ip.network.cidr_v6:
+                ip_info['ip_v6'] = utils.to_global_ipv6(
+                    fixed_ip.network.cidr_v6, ethernet_card.mac_address)
 
             ip_info['floating_ips'] = []
             for floating_ip in fixed_ip.floating_ips:
@@ -159,14 +176,22 @@
 
             net['IPs'].append(ip_info)
 
+        for security_group in ethernet_card.security_groups:
+            group_dict = self._convert_to_security_group_dict(security_group)
+            group_dict['rules'] = []
+            for rule in security_group.rules:
+                 group_dict['rules'].append(
+                     self._convert_to_security_group_rule_dict(rule))
+            net['security_groups'].append(group_dict)
+                
         return net
 
-    def get_project_network_info(self, context, project_id):
-        """Gets network related information for the project.
+    def get_tenant_network_info(self, context, tenant_id):
+        """Gets network related information for the tenant.
 
         Args:
            context: Nova context object.
-           project_id: project ID to get the data for.
+           tenant_id: tenant ID to get the data for.
 
         Returns:
            A dictionary with the following keys:
@@ -184,7 +209,7 @@
               netmask_v6: network mask for IPv6 if applicable
               gateway_v6: network gateway for IPv6 if applicable
         """
-        network = db.network_get_by_project(context, project_id)
+        network = db.network_get_by_tenant(context, tenant_id)
         if not network:
             return None
 
@@ -192,32 +217,32 @@
         self._fill_dict_with_network_info(net, network)
         return net
 
-    def get_addresses(self, context, project_id=None):
+    def get_addresses(self, context, tenant_id=None):
         """Gets all the floating IPs, their mapped fixed IPs and
         ethernet card ID.
 
         Args:
            context: Nova context object.
-           project_id: Project ID to filter the IPs by.(optional)
+           tenant_id: Project ID to filter the IPs by.(optional)
 
         Returns:
            A list of dictionary with keys:
                floating_ip: Public IP
                fixed_ip: Private IP
-               project_id: Project ID for the floating IP.
+               tenant_id: Project ID for the floating IP.
                vnic_id: VNIC ID
                mac_address: MAC address
         """
-        if project_id:
-            floating_ips = db.floating_ip_get_all_by_project(context,
-                                                             project_id)
+        if tenant_id:
+            floating_ips = db.floating_ip_get_all_by_tenant(context,
+                                                            tenant_id)
         else:
             floating_ips = db.floating_ip_get_all(context)
 
         addresses = []
         for floating_ip in floating_ips:
             ip_info = dict(floating_ip=floating_ip.address,
-                           project_id=floating_ip.project_id,
+                           tenant_id=floating_ip.tenant_id,
                            fixed_ip=None,
                            vnic_id=None,
                            mac_address=None)
@@ -231,12 +256,12 @@
             addresses.append(ip_info)
         return addresses
 
-    def allocate_address(self, context, project_id, ip_quota):
-        """Gets the number of floating IPs associated with a project.
+    def allocate_address(self, context, tenant_id, ip_quota):
+        """Gets the number of floating IPs associated with a tenant.
 
         Args:
             context: Nova context object needed to access the DB.
-            project_id: Project to allocate the address from.
+            tenant_id: Tenant to allocate the address from.
             ip_quota: Quota for IP addresses.
 
         Returns:
@@ -245,12 +270,12 @@
         Raises:
             quota.QuotaError: Over the quota limit.
         """
-        used_floating_ips = db.floating_ip_count_by_project(context,
-                                project_id)
+        used_floating_ips = db.floating_ip_count_by_tenant(context,
+                                tenant_id)
         allowed_floating_ips = min(1, ip_quota - used_floating_ips)
         if allowed_floating_ips < 1:
-            raise quota.QuotaError(_("Quota exceeeded for %s, tried to allocate"
-                           " address"), project_id)
+            raise quota.QuotaError("Quota exceeeded for %s, tried to allocate"
+                           " address", tenant_id)
 
         # Let the network service handle this because the DB update requires the
         # network service host name.
@@ -258,12 +283,12 @@
                         FLAGS.net_flat_vlan_network_topic,
                         {"method": "get_host"})
 
-        ip = db.floating_ip_allocate_address(context, host, project_id)
+        ip = db.floating_ip_allocate_address(context, host, tenant_id)
         return ip.address
 
     def deallocate_address(self, context, floating_address):
         """Deallocates the public IP address by removing it from any
-        project.
+        tenant.
 
         Args:
            context: nova context object needed to access the DB.
@@ -310,3 +335,233 @@
                  {"method": "deactivate_public_ip",
                   "args": {"floating_address": floating_ip['address'],
                            "fixed_address": fixed_ip['address']}})
+
+    def _convert_to_security_group_dict(self, security_group):
+        """Creates a dictionary from security group model.
+
+        Args:
+            security_group: SecurityGroup model.
+
+        Returns:
+            A dictionary of keys that map to SecurityGroup attributes.
+        """
+        return dict(id=security_group.id, name=security_group.name,
+                    description=security_group.description,
+                    user_id=security_group.user_id,
+                    tenant_id=security_group.tenant_id)
+
+    def _convert_to_security_group_rule_dict(self, security_group_rule):
+        """Creates a dictionary from security group rule model.
+
+        Args:
+            security_group_rule: SecurityGroupIngressRule model.
+
+        Returns:
+            A dictionary of keys that map to SecurityGroupIngressRule
+            attributes.
+        """
+        return dict(id=security_group_rule.id,
+                    parent_group_id=security_group_rule.parent_group_id,
+                    protocol=security_group_rule.protocol,
+                    from_port=security_group_rule.from_port,
+                    to_port=security_group_rule.to_port,
+                    cidr=security_group_rule.cidr,
+                    group_id=security_group_rule.group_id)
+
+    def _convert_to_security_group_dict_detailed(self, group):
+        """Converts a SecurityGroup model into a dictionary, including
+        EthernetCards IDs and rules.
+
+        Args:
+             group: SecurityGroup object.
+
+        Returns:
+             A dictionary of security group, rules ane ethernet card info.
+        """
+        group_dict = self._convert_to_security_group_dict(group)
+        group_dict['rules'] = [self._convert_to_security_group_rule_dict(rule)
+                               for rule in group.rules]
+        group_dict['vnic_ids'] = [str(ethernet_card.id) for ethernet_card in
+                                  group.ethernet_cards]
+        return group_dict
+        
+    def create_security_group(self, context, user_id, tenant_id, name,
+                              description):
+        """Creates a new security group record if it does not exist.
+
+        Args:
+            context: Nova context
+            user_id: The user ID to associate the group with.
+            tenant_id: The tenant in which security group associates.
+            name: Name for the security group.
+            description: Description of the security group.
+
+        Returns:
+            A dictionary of security group information with keys:
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+
+        Raises:
+            nova.exception.ApiError: Group already exists.
+        """
+        if db.security_group_exists(context, tenant_id, name):
+            raise exception.ApiError('group %s already exists' % name)
+
+        values = {'user_id': user_id,
+                 'tenant_id': tenant_id,
+                 'name': name,
+                 'description': description}
+        group = db.security_group_create(context, values)
+        return self._convert_to_security_group_dict(group)
+
+    def get_security_group(self, context, id, tenant_id=None):
+        """Gets a security group with a unique identifier of the group.
+
+        Args:
+            context: Nova context object.
+            id: Security group ID.
+            tenant_id: Tenant to get the security group for.
+ 
+        Returns:
+           security group info in dictionary with the following keys:
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+               rules: A list of dictionary of security group rules:
+                   parent_group_id: Parent security group ID.
+                   protocol: Protocol for the rule.
+                   from_port: The source port for the rule.
+                   to_port: The destination port for the rule.
+                   cidr: CIDR or the rule.
+                   security_group_id: The security group ID.
+               vnic_ids: A list of virtual NIC IDs.    
+        """
+        group = db.security_group_get(context, id, tenant_id)
+        return self._convert_to_security_group_dict_detailed(
+            group) if group else None
+
+    def get_security_group_by_name(self, context, name, tenant_id):
+        """Gets a security group with a given name of the tenant.
+        This is expected to return something all the time, since for
+        EC2 compatibility, VMs cannot be created without one.
+
+        Args:
+            context: Nova context object.
+            name: The name of the security group to search.
+            tenant_id: Tenant to get the security group of.
+        Returns:
+           security group info in dictionary with the following keys:
+
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+               rules: A list of dictionary of security group rules:
+                   parent_group_id: Parent security group ID.
+                   protocol: Protocol for the rule.
+                   from_port: The source port for the rule.
+                   to_port: The destination port for the rule.
+                   cidr: CIDR or the rule.
+                   security_group_id: The security group ID.
+               vnic_ids: A list of virtual NIC IDs. 
+            None if it does not exist.
+        """
+        group = db.security_group_get_by_name(context, tenant_id, name)
+        return self._convert_to_security_group_dict_detailed(
+            group) if group else None
+
+    def get_security_groups(self, context, tenant_id=None):
+        """Gets a list of security groups, filtered by tenant_id if specified.
+        
+        Args:
+            context: Nova context object.
+            tenant_id: Tenant to get the security group for.
+ 
+        Returns:
+           A list of security groups in dictionary with the following keys:
+
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+        """
+        if tenant_id:
+            groups = db.security_group_get_by_tenant(context, tenant_id)
+        else:
+            groups = db.security_group_get_all(context)
+
+        group_list = []
+        for group in groups:
+            group_list.append(self._convert_to_security_group_dict(group))
+        return group_list
+    
+    def delete_security_group(self, context, id):
+        """Deletes a security group.
+
+        Args:
+            context: Nova context object.
+            id: ID of the security group to delete.
+        """
+        db.security_group_destroy(context, id)
+
+    def create_security_group_rule(self, context, parent_group_id, cidr=None,
+                                   from_port=None, to_port=None, protocol=None,
+                                   group_id=None):
+        """Creates a new security group ingress rule.
+
+        Args:
+            context: Nova context object.
+            parent_group_id: Security group this rule belongs to.
+            cidr: CIDR of the rule.
+            from_port: The source port.
+            to_port: The destination port.
+            protocol: The network protocol for the rule.
+            group_id: The target security group ID.
+
+        Returns:
+            The new security group rule info as a dictionary:
+                Keys:
+                    parent_group_id: Parent security group ID.
+                    protocol: Protocol for the rule.
+                    from_port: The source port for the rule.
+                    to_port: The destination port for the rule.
+                    cidr: CIDR for the rule.
+                    security_group_id: The security group ID.         
+        """
+        values = {'parent_group_id': parent_group_id,
+                  'cidr': cidr,
+                  'from_port': from_port,
+                  'to_port': to_port,
+                  'protocol': protocol,
+                  'group_id': group_id}
+        rule = db.security_group_rule_create(context, values)
+        return self._convert_to_security_group_rule_dict(rule)
+
+    def delete_security_group_rule(self, context, id):
+        """Deletes a security group rule with the given ID.
+
+        Args:
+            context: Nova context object.
+            id: ID of the security group rule to delete.
+        """
+        db.security_group_rule_destroy(context, id)
+
+    def associate_vnic_and_security_group(self, context, vnic_id,
+                                          security_group_id, tenant_id):
+        """Associates a VNIC to a security group.
+
+        Args:
+            context: Nova context object.
+            vnic_id: Virtual NIC ID.
+            security_group_id: ID of the security group to associate.
+            tenant_id: The tenant that security group should belong to.
+        """
+        groups = db.security_group_get_by_ethernet_card(context, vnic_id)
+        for group in groups:
+            if group.id == security_group_id:
+                return
+        db.ethernet_card_add_security_group(context, vnic_id,
+                                            security_group_id, tenant_id)

=== modified file 'nova/network/flat_vlan/compute.py'
--- nova/network/flat_vlan/compute.py	2011-04-12 06:44:35 +0000
+++ nova/network/flat_vlan/compute.py	2011-04-18 00:30:54 +0000
@@ -37,6 +37,7 @@
     _vnics_to_taps = {}
     _net_driver = utils.import_object(FLAGS.net_flat_vlan_network_driver)
     _filter_driver = utils.import_object(FLAGS.net_flat_vlan_filter_driver)
+    _firewall_driver = utils.import_object(FLAGS.net_flat_vlan_firewall_driver)
     _network_topic = FLAGS.net_flat_vlan_network_topic
     _use_vlan = FLAGS.net_flat_vlan_use_vlan
     _use_dhcp = FLAGS.net_flat_vlan_use_dhcp
@@ -62,8 +63,8 @@
            The host of the network service.
         """
         if self._use_vlan:
-            network_ref = db.network_get_by_project(context,
-                                                    context.project_id)
+            network_ref = db.network_get_by_tenant(context,
+                                                   context.project_id)
         else:
             network_ref = db.network_get_by_bridge(context,
                                                    self._network_bridge)
@@ -93,7 +94,7 @@
         return self._host
 
     def _get_network_topic(self, context, **kwargs):
-        """Retrieves the network host for a project on this host
+        """Retrieves the network host for a tenant on this host
 
         Args:
            context: Nova context
@@ -218,3 +219,85 @@
         net['tap'] = tap
 
         return dict(net)
+
+    def prepare_vnic_filter(self, context, vnic_id, is_vpn, allow_traffic,
+                            conn):
+        """Prepares filters for VNIC.
+
+        Args:
+            contxt: Nova context object
+            vnic_id: VNIC ID
+            is_vpn: True if setting VPN.
+            allow_traffic: True if traffic can flow.
+            conn: connection to hypervisor.
+        """
+        net = self._api.get_vnic_network_info(context, vnic_id)
+        self._firewall_driver.prepare_vnic_filter(vnic_id, net, is_vpn,
+                                                  allow_traffic, conn)
+
+    def unfilter_vnic(self, vnic_id):
+        """Removes filters for vnic.
+
+        Args:
+           vnic_id: VNIC ID.
+        """
+        self._firewall_driver.unfilter_vnic(vnic_id,
+                                            FLAGS.net_flat_vlan_use_ipv6)
+
+    def apply_vnic_filter(self, vnic_id):
+        """Applies the filter for VNIC.  Currently unused.
+
+        Args:
+            vnic_id: VNIC ID
+        """
+        self._firewall_driver.apply_vnic_filter(vnic_id)
+
+    def refresh_security_group_rules(self, context, security_group_id,
+                                     tenant_id, allow_traffic, conn):
+        """Refreshes the security group rules.
+
+        Args:
+            context: Nova context object.
+            security_group_id: Security group ID.
+            tenant_id: ID of the tenant.
+            allow_traffic: True if ok to allow traffic.
+            conn: hyperviser connection.
+        """
+        group = self._api.get_security_group(context, security_group_id,
+                                             tenant_id)
+        self._firewall_driver.refresh_security_group_rules(
+            security_group_id, group['rules'],
+            FLAGS.net_flat_vlan_use_ipv6, allow_traffic, conn)
+
+    def refresh_security_group_members(self, security_group_id):
+        """Refreshes security group members.
+
+        Args:
+            security_group_id: Security group ID.
+        """
+        self._firewall_driver.refresh_security_group_members(
+            security_group_id)
+
+    def setup_basic_filtering(self, context, vnic_id, allow_traffic, conn):
+        """Sets up basic filtering for VNIC.
+
+        Args:
+            context: Nova context object.
+            vnic_id: VNIC to set the filters for.
+            allow_traffic: True if ok to allow traffic.
+            conn: hyperviser connection.
+        """
+        net = self._api.get_vnic_network_info(context, vnic_id)
+        self._firewall_driver.setup_basic_filtering(vnic_id, net,
+                                                    allow_traffic, conn)
+
+    def vnic_filter_exists(self, vnic_id, conn):
+        """Checks whether filters for VNIC exists.
+
+        Args:
+            vnic_id: VNIC ID to chekc.
+            conn: hypervisor conneciotn.
+        """
+        return self._firewall_driver.vnic_filter_exists(vnic_id, conn)
+        
+

=== modified file 'nova/network/flat_vlan/db/api.py'
--- nova/network/flat_vlan/db/api.py	2011-04-07 11:20:06 +0000
+++ nova/network/flat_vlan/db/api.py	2011-04-18 00:30:54 +0000
@@ -109,8 +109,8 @@
     return IMPL.dao_factory.get_dao().\
         network_get_all(read_deleted=can_read_deleted)
 
-def network_get_by_project(context, project_id, associate=True):
-    """Return the network associated with the project.
+def network_get_by_tenant(context, tenant_id, associate=True):
+    """Return the network associated with the tenant.
 
     If associate is true, it will attempt to associate a new
     network if one is not found, otherwise it returns None.
@@ -119,7 +119,7 @@
     if associate and not nova_api.is_admin_context(context):
         raise exception.NotAuthorized()
     return IMPL.dao_factory.get_dao().\
-        network_get_by_project(project_id, associate)
+        network_get_by_tenant(tenant_id, associate)
 
 def network_update(context, network_id, values):
     """Update network."""
@@ -137,31 +137,31 @@
         network_delete_safe(network_id)
 
 @nova_api.require_admin_context
-def network_associate(context, project_id):
-    """Associate a free network to a project."""
+def network_associate(context, tenant_id):
+    """Associate a free network to a tenant."""
     return IMPL.dao_factory.get_dao().\
-        network_associate(project_id)
+        network_associate(tenant_id)
 
-def floating_ip_allocate_address(context, host, project_id):
+def floating_ip_allocate_address(context, host, tenant_id):
     """Allocate free floating ip and return the address.
 
     Raises if one is not available.
 
     """
-    nova_api.authorize_project_context(context, project_id)
+    nova_api.authorize_project_context(context, tenant_id)
     return IMPL.dao_factory.get_dao().\
-        floating_ip_allocate_address(host, project_id)
+        floating_ip_allocate_address(host, tenant_id)
 
 def floating_ip_create(context, values):
     """Create a floating ip from the values dictionary."""
     return IMPL.dao_factory.get_dao().\
         floating_ip_create(values)
 
-def floating_ip_count_by_project(context, project_id):
-    """Count floating ips used by project."""
-    nova_api.authorize_project_context(context, project_id)
+def floating_ip_count_by_tenant(context, tenant_id):
+    """Count floating ips used by tenant."""
+    nova_api.authorize_project_context(context, tenant_id)
     return IMPL.dao_factory.get_dao().\
-        floating_ip_count_by_project(project_id)
+        floating_ip_count_by_tenant(tenant_id)
 
 def floating_ip_deallocate(context, address):
     """Deallocate an floating ip by address"""
@@ -211,11 +211,11 @@
     return IMPL.dao_factory.get_dao().\
         floating_ip_get_all_by_host(host)
 
-def floating_ip_get_all_by_project(context, project_id):
-    """Get all floating ips by project."""
-    nova_api.authorize_project_context(context, project_id)
+def floating_ip_get_all_by_tenant(context, tenant_id):
+    """Get all floating ips by tenant."""
+    nova_api.authorize_project_context(context, tenant_id)
     return IMPL.dao_factory.get_dao().\
-        floating_ip_get_all_by_project(project_id)
+        floating_ip_get_all_by_tenant(tenant_id)
 
 def floating_ip_get_by_address(context, address):
     """Get a floating ip by address or raise if it doesn't exist."""
@@ -272,7 +272,7 @@
 def fixed_ip_disassociate(context, fixed_ip_id):
     """Removes reference to ethernet card from IP."""
     return IMPL.dao_factory.get_dao().\
-        fixed_ip_disassociate(fixed_id_ip)
+        fixed_ip_disassociate(fixed_ip_id)
 
 def fixed_ip_associate(context, fixed_ip_id, ethernet_card_id):
     """Associates an IP address to an ethernet card."""
@@ -290,3 +290,95 @@
     """Disassociates fixed IP by timeout."""
     return IMPL.dao_factory.get_dao().\
         fixed_ip_disassociate_all_by_timeout(host, time)
+
+def security_group_get_all(context):
+    """Get all security groups."""
+    can_read_deleted = nova_api.can_read_deleted(context)
+    return IMPL.dao_factory.get_dao().\
+           security_group_get_all(can_read_deleted)
+
+def security_group_get(context, security_group_id, tenant_id):
+    """Get security group by its id."""
+    is_admin = nova_api.is_admin_context(context)
+    can_read_deleted = nova_api.can_read_deleted(context)
+    if not is_admin and not tenant_id:
+        raise exception.NotAuthorized()
+
+    return IMPL.dao_factory.get_dao().\
+           security_group_get(security_group_id, tenant_id,
+                              is_admin=is_admin,
+                              read_deleted=can_read_deleted)
+
+def security_group_get_by_name(context, tenant_id, group_name):
+    """Returns a security group with the specified name of a tenant."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_get_by_name(tenant_id, group_name)
+
+def security_group_get_by_tenant(context, tenant_id):
+    """Get all security groups belonging to a tenant."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_get_by_tenant(tenant_id)
+
+def security_group_get_by_ethernet_card(context, ethernet_card_id):
+    """Get security groups to which the ethernet_card is assigned."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_get_by_ethernet_card(ethernet_card_id)
+
+def security_group_exists(context, tenant_id, group_name):
+    """Indicates if a group name exists for a tenant."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_exists(tenant_id, group_name)
+
+def security_group_create(context, values):
+    """Create a new security group."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_create(values)
+
+def security_group_rule_create(context, values):
+    """Create a new security group."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_rule_create(values)
+
+def security_group_rule_get_by_security_group(context, security_group_id):
+    """Get all rules for a a given security group."""
+    is_admin = nova_api.is_admin_context(context)
+    can_read_deleted = nova_api.can_read_deleted(context)
+    return IMPL.dao_factory.get_dao().\
+           security_group_rule_get_by_security_group(
+               security_group_id, is_admin=is_admin,
+               read_deleted=can_read_deleted)
+
+def security_group_rule_get_by_security_group_grantee(context,
+                                                      security_group_id):
+    """Get all rules that grant access to the given security group."""
+    is_admin = nova_api.is_admin_context(context)
+    can_read_deleted = nova_api.can_read_deleted(context)
+    return IMPL.dao_factory.get_dao().\
+           security_group_rule_get_by_security_group_grantee(
+               security_group_id, is_admin=is_admin,
+               read_deletd=can_read_deleted)
+
+def security_group_rule_destroy(context, security_group_rule_id):
+    """Deletes a security group rule."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_rule_destroy(security_group_rule_id)
+
+def ethernet_card_add_security_group(context, ethernet_card_id,
+                                     security_group_id, tenant_id):
+    """Associate the given security group with the given ethernet card."""
+    is_admin = nova_api.is_admin_context(context)
+    return IMPL.dao_factory.get_dao().\
+           ethernet_card_add_security_group(ethernet_card_id,
+                                            security_group_id,
+                                            tenant_id,
+                                            is_admin=is_admin)
+
+def security_group_destroy(context, security_group_id):
+    """Deletes a security group."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_destroy(security_group_id)
+
+def security_group_destroy_all(context):
+    """Deletes a security group."""
+    return IMPL.dao_factory.get_dao().\
+           security_group_destroy_all()

=== added file 'nova/network/flat_vlan/db/migration.py'
--- nova/network/flat_vlan/db/migration.py	1970-01-01 00:00:00 +0000
+++ nova/network/flat_vlan/db/migration.py	2011-04-18 00:30:54 +0000
@@ -0,0 +1,36 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Midokura KK
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""Database setup and migration commands."""
+
+from nova import utils
+from nova.network.flat_vlan import flags
+
+FLAGS = flags.FlagAccessor() 
+
+IMPL = utils.LazyPluggable(
+    FLAGS.get('net_flat_vlan_db_backend'),
+    sqlalchemy='nova.network.flat_vlan.db.sqlalchemy.migration')
+
+
+def db_sync(version=None):
+    """Migrate the database to `version` or the most recent version."""
+    return IMPL.db_sync(version=version)
+
+
+def db_version():
+    """Display the current database version."""
+    return IMPL.db_version()

=== modified file 'nova/network/flat_vlan/db/sqlalchemy/migrate_repo/versions/001_diablo.py'
--- nova/network/flat_vlan/db/sqlalchemy/migrate_repo/versions/001_diablo.py	2011-04-04 09:52:18 +0000
+++ nova/network/flat_vlan/db/sqlalchemy/migrate_repo/versions/001_diablo.py	2011-04-18 00:30:54 +0000
@@ -56,7 +56,7 @@
                Integer(),
                ForeignKey('fixed_ips.id'),
                nullable=True),
-        Column('project_id',
+        Column('tenant_id',
                String(length=255, convert_unicode=False, assert_unicode=None,
                       unicode_error=None, _warn_on_bytestring=False)),
         Column('host',
@@ -112,16 +112,75 @@
         Column('label',
                String(length=255, convert_unicode=False, assert_unicode=None,
                       unicode_error=None, _warn_on_bytestring=False)),
-        Column('project_id',
+        Column('tenant_id',
                String(length=255, convert_unicode=False, assert_unicode=None,
                       unicode_error=None, _warn_on_bytestring=False)),
         Column('host', String(255)),
         )
 
+security_groups = Table('security_groups', meta,
+        Column('created_at', DateTime(timezone=False)),
+        Column('updated_at', DateTime(timezone=False)),
+        Column('deleted_at', DateTime(timezone=False)),
+        Column('deleted', Boolean(create_constraint=True, name=None)),
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        Column('name',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+        Column('description',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+
+        Column('user_id',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+        Column('tenant_id',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+        )
+
+security_group_ethernet_card_assoc = Table(
+        'security_group_ethernet_card_association', meta,
+        Column('created_at', DateTime(timezone=False)),
+        Column('updated_at', DateTime(timezone=False)),
+        Column('deleted_at', DateTime(timezone=False)),
+        Column('deleted', Boolean(create_constraint=True, name=None)),
+        Column('id', Integer(), primary_key=True, nullable=False),
+        Column('security_group_id',
+               Integer(),
+               ForeignKey('security_groups.id')),
+        Column('ethernet_card_id', Integer(), ForeignKey('ethernet_cards.id')),
+        )
+
+
+security_group_rules = Table('security_group_rules', meta,
+        Column('created_at', DateTime(timezone=False)),
+        Column('updated_at', DateTime(timezone=False)),
+        Column('deleted_at', DateTime(timezone=False)),
+        Column('deleted', Boolean(create_constraint=True, name=None)),
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        Column('parent_group_id',
+               Integer(),
+               ForeignKey('security_groups.id')),
+        Column('protocol',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+        Column('from_port', Integer()),
+        Column('to_port', Integer()),
+        Column('cidr',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+        Column('group_id',
+               Integer(),
+               ForeignKey('security_groups.id')),
+        )
+
 def upgrade(migrate_engine):
     meta.bind = migrate_engine
 
-    for table in (ethernet_cards, networks, fixed_ips, floating_ips):
+    for table in (ethernet_cards, networks, fixed_ips, floating_ips,
+                  security_groups, security_group_rules,
+                  security_group_ethernet_card_assoc):
         try:    
             table.create()
         except Exception:
@@ -132,7 +191,9 @@
 def downgrade(migrate_engine):
     meta.bind = migrate_engine
 
-    for table in (floating_ips, fixed_ips, networks, ethernet_cards):
+    for table in (security_group_ethernet_card_assoc,
+                  security_group_rules, security_groups,
+                  floating_ips, fixed_ips, networks, ethernet_cards):
         try:    
             table.drop()
         except Exception:

=== added file 'nova/network/flat_vlan/db/sqlalchemy/migration.py'
--- nova/network/flat_vlan/db/sqlalchemy/migration.py	1970-01-01 00:00:00 +0000
+++ nova/network/flat_vlan/db/sqlalchemy/migration.py	2011-04-18 00:30:54 +0000
@@ -0,0 +1,81 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Midokura KK
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import os
+import sys
+
+from nova.network.flat_vlan import flags
+
+import sqlalchemy
+from migrate.versioning import api as versioning_api
+
+try:
+    from migrate.versioning import exceptions as versioning_exceptions
+except ImportError:
+    try:
+        # python-migration changed location of exceptions after 1.6.3
+        # See LP Bug #717467
+        from migrate import exceptions as versioning_exceptions
+    except ImportError:
+        sys.exit(_("python-migrate is not installed. Exiting."))
+
+FLAGS = flags.FlagAccessor()
+
+
+def db_sync(version=None):
+    db_version()
+    repo_path = _find_migrate_repo()
+    return versioning_api.upgrade(FLAGS.net_flat_vlan_sql_connection, 
+                                  repo_path, version)
+
+
+def db_version():
+    repo_path = _find_migrate_repo()
+    try:
+        return versioning_api.db_version(FLAGS.net_flat_vlan_sql_connection, 
+                                         repo_path)
+    except versioning_exceptions.DatabaseNotControlledError:
+        # If we aren't version controlled we may already have the database
+        # in the state from before we started version control, check for that
+        # and set up version_control appropriately
+        meta = sqlalchemy.MetaData()
+        engine = sqlalchemy.create_engine(FLAGS.net_flat_vlan_sql_connection, 
+                                          echo=False)
+        meta.reflect(bind=engine)
+        try:
+            for table in ('ethernet_cards', 'fixed_ips', 'floating_ips',
+                          'networks'):
+                assert table in meta.tables
+            return db_version_control(1)
+        except AssertionError:
+            return db_version_control(0)
+
+
+def db_version_control(version=None):
+    repo_path = _find_migrate_repo()
+    versioning_api.version_control(FLAGS.net_flat_vlan_sql_connection, 
+                                   repo_path, version)
+    return version
+
+
+def _find_migrate_repo():
+    """Get the path for the migrate repository."""
+    path = os.path.join(os.path.abspath(os.path.dirname(__file__)),
+                        'migrate_repo')
+    assert os.path.exists(path)
+    return path
+

=== modified file 'nova/network/flat_vlan/db/sqlalchemy/models.py'
--- nova/network/flat_vlan/db/sqlalchemy/models.py	2011-04-07 11:20:06 +0000
+++ nova/network/flat_vlan/db/sqlalchemy/models.py	2011-04-18 00:30:54 +0000
@@ -17,6 +17,8 @@
 """
 SQLAlchemy models for flat vlan network service data.
 """
+import datetime
+
 from sqlalchemy import or_
 from sqlalchemy.orm import relationship, backref
 from sqlalchemy.orm import joinedload, joinedload_all
@@ -24,6 +26,7 @@
 from sqlalchemy import ForeignKey
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.declarative import declarative_base
+from sqlalchemy.sql.expression import literal_column
 
 from nova import exception
 from nova.db import api as nova_db
@@ -61,7 +64,7 @@
     gateway_v6 = Column(String(255))
     netmask_v6 = Column(String(255))
     label = Column(String(255))
-    project_id = Column(String(255))
+    tenant_id = Column(String(255))
     host = Column(String(255))  # , ForeignKey('hosts.id'))
 
 
@@ -91,10 +94,63 @@
                             primaryjoin='and_('
                                 'FloatingIp.fixed_ip_id == FixedIp.id,'
                                 'FloatingIp.deleted == False)')
-    project_id = Column(String(255))
+    tenant_id = Column(String(255))
     host = Column(String(255))  # , ForeignKey('hosts.id'))
 
 
+class SecurityGroup(BASE, NovaBase):
+    """Represents a security group."""
+    __tablename__ = 'security_groups'
+    id = Column(Integer, primary_key=True)
+
+    name = Column(String(255))
+    description = Column(String(255))
+    user_id = Column(String(255))
+    tenant_id = Column(String(255))
+
+    ethernet_cards = relationship(
+        EthernetCard, secondary="security_group_ethernet_card_association",
+        primaryjoin='and_('
+        'SecurityGroup.id == '
+        'SecurityGroupEthernetCardAssociation.security_group_id,'
+        'SecurityGroupEthernetCardAssociation.deleted == False,'
+        'SecurityGroup.deleted == False)',
+                             secondaryjoin='and_('
+        'SecurityGroupEthernetCardAssociation.ethernet_card_id '
+        '== EthernetCard.id,'
+        # (anthony) the condition below shouldn't be necessary now that the
+        # association is being marked as deleted.  However, removing this
+        # may cause existing deployments to choke, so I'm leaving it
+        'EthernetCard.deleted == False)',
+                             backref='security_groups')
+
+class SecurityGroupEthernetCardAssociation(BASE, NovaBase):
+    __tablename__ = 'security_group_ethernet_card_association'
+    id = Column(Integer, primary_key=True)
+    security_group_id = Column(Integer, ForeignKey('security_groups.id'))
+    ethernet_card_id = Column(Integer, ForeignKey('ethernet_cards.id'))
+
+class SecurityGroupIngressRule(BASE, NovaBase):
+    """Represents a rule in a security group."""
+    __tablename__ = 'security_group_rules'
+    id = Column(Integer, primary_key=True)
+
+    parent_group_id = Column(Integer, ForeignKey('security_groups.id'))
+    parent_group = relationship("SecurityGroup", backref="rules",
+                                foreign_keys=parent_group_id,
+                                primaryjoin='and_('
+        'SecurityGroupIngressRule.parent_group_id == SecurityGroup.id,'
+        'SecurityGroupIngressRule.deleted == False)')
+
+    protocol = Column(String(5))  # "tcp", "udp", or "icmp"
+    from_port = Column(Integer)
+    to_port = Column(Integer)
+    cidr = Column(String(255))
+
+    # Note: This is not the parent SecurityGroup. It's SecurityGroup we're
+    # granting access for.
+    group_id = Column(Integer, ForeignKey('security_groups.id'))
+
 class DataAccess(object):
     """The base class to implement Data Access Objects.
     """
@@ -121,7 +177,7 @@
             first()
 
         if not result:
-            raise exception.NotFound(_("No ethernet_card with id %s") % id)
+            raise exception.NotFound("No ethernet_card with id %s" % id)
 
         return result
 
@@ -161,7 +217,7 @@
             first()
 
         if not result:
-            raise exception.NotFound(_("No network with id %s") % id)
+            raise exception.NotFound("No network with id %s" % id)
 
         return result
 
@@ -172,7 +228,7 @@
             first()
 
         if not result:
-            raise exception.NotFound(_('No network for bridge %s') % bridge)
+            raise exception.NotFound('No network for bridge %s' % bridge)
 
         return result
 
@@ -184,7 +240,7 @@
             filter_by(deleted=False).\
             first()
         if not rv:
-            raise exception.NotFound(_('No network for ethernet card %s') %
+            raise exception.NotFound('No network for ethernet card %s' %
                                      ethernet_card_id)
         return rv
 
@@ -254,14 +310,14 @@
             first()
 
         if not result:
-            raise exception.NotFound(_("No Fixed IP with id %s") % id)
+            raise exception.NotFound("No Fixed IP with id %s" % id)
 
         return result
 
     def fixed_ip_get_all(self):
         result = self._session.query(self.fixed_ip_dto_class).all()
         if not result:
-            raise exception.NotFound(_('No fixed ips defined'))
+            raise exception.NotFound('No fixed ips defined')
 
         return result
 
@@ -283,7 +339,7 @@
             options(joinedload('ethernet_card')).\
             first()
         if not result:
-            raise exception.NotFound(_('No fixed ip for address %s') % address)
+            raise exception.NotFound('No fixed ip for address %s' % address)
 
         return result
 
@@ -321,18 +377,18 @@
 
     floating_ip_dto_class = FloatingIp
 
-    def floating_ip_count_by_project(self, project_id):
+    def floating_ip_count_by_tenant(self, tenant_id):
         return self._session.query(self.floating_ip_dto_class).\
-            filter_by(project_id=project_id).\
+            filter_by(tenant_id=tenant_id).\
             filter_by(deleted=False).\
             count()
 
-    def floating_ip_allocate_address(self, host, project_id):
+    def floating_ip_allocate_address(self, host, tenant_id):
         with self._session.begin():
             floating_ip_ref = self._session.query(self.floating_ip_dto_class).\
                               filter_by(host=host).\
                               filter_by(fixed_ip_id=None).\
-                              filter_by(project_id=None).\
+                              filter_by(tenant_id=None).\
                               filter_by(deleted=False).\
                               with_lockmode('update').\
                               first()
@@ -340,7 +396,7 @@
             #             then this has concurrency issues
             if not floating_ip_ref:
                 raise nova_db.NoMoreAddresses()
-            floating_ip_ref['project_id'] = project_id
+            floating_ip_ref['tenant_id'] = tenant_id
             self._session.add(floating_ip_ref)
         return floating_ip_ref
 
@@ -348,7 +404,7 @@
         with self._session.begin():
             floating_ip_ref = self.floating_ip_get_by_address(
                 address, read_deleted=False)
-            floating_ip_ref['project_id'] = None
+            floating_ip_ref['tenant_id'] = None
             floating_ip_ref.save(session=self._session)
 
     def floating_ip_destroy(self, address):
@@ -376,10 +432,10 @@
             filter_by(deleted=False).\
             all()
 
-    def floating_ip_get_all_by_project(self, project_id):
+    def floating_ip_get_all_by_tenant(self, tenant_id):
         return self._session.query(self.floating_ip_dto_class).\
             options(joinedload_all('fixed_ip.ethernet_card')).\
-            filter_by(project_id=project_id).\
+            filter_by(tenant_id=tenant_id).\
             filter_by(deleted=False).\
             all()
 
@@ -412,10 +468,6 @@
             floating_ip_ref = self.floating_ip_get_by_address(
                 address, read_deleted=False)
             fixed_ip_ref = floating_ip_ref.fixed_ip
-            if fixed_ip_ref:
-                fixed_ip_address = fixed_ip_ref['address']
-            else:
-                fixed_ip_address = None
             floating_ip_ref.fixed_ip = None
             floating_ip_ref.save(session=self._session)
         return fixed_ip_ref
@@ -427,14 +479,187 @@
                    filter_by(deleted=False).\
                    all()
 
+class SecurityGroupDataAccess(DataAccess):
+    """A Data Access object to access security groups.
+    """
+
+    security_group_dto_class = SecurityGroup
+
+    def security_group_get_all(self, read_deleted=False):
+        return self._session.query(self.security_group_dto_class).\
+                    filter_by(deleted=read_deleted).\
+                    options(joinedload_all('rules')).\
+                    all()
+
+    def security_group_get(self, security_group_id, tenant_id, is_admin=False,
+                           read_deleted=False):
+        if is_admin:
+            result = self._session.query(self.security_group_dto_class).\
+                     filter_by(deleted=read_deleted,).\
+                     filter_by(id=security_group_id).\
+                     options(joinedload_all('rules')).\
+                     first()
+        else:
+            result = self._session.query(self.security_group_dto_class).\
+                    filter_by(deleted=False).\
+                    filter_by(id=security_group_id).\
+                    filter_by(tenant_id=tenant_id).\
+                    options(joinedload_all('rules')).\
+                    first()
+        if not result:
+            raise exception.NotFound("No security group with id %s" %
+                                     security_group_id)
+        return result
+
+    def security_group_get_by_name(self, tenant_id, group_name):
+        result = self._session.query(self.security_group_dto_class).\
+                 filter_by(tenant_id=tenant_id).\
+                 filter_by(name=group_name).\
+                 filter_by(deleted=False).\
+                 options(joinedload_all('rules')).\
+                 options(joinedload_all('ethernet_cards')).\
+                 first()
+        if not result:
+            raise exception.NotFound(
+                'No security group named %(group_name)s'
+                ' for tenant: %(tenant_id)s' % locals())
+        return result
+
+    def security_group_get_by_tenant(self, tenant_id):
+        return self._session.query(self.security_group_dto_class).\
+               filter_by(tenant_id=tenant_id).\
+               filter_by(deleted=False).\
+               options(joinedload_all('rules')).\
+               all()
+
+    def security_group_get_by_ethernet_card(self, ethernet_card_id):
+        return self._session.query(self.security_group_dto_class).\
+               filter_by(deleted=False).\
+               options(joinedload_all('rules')).\
+               join(self.security_group_dto_class.ethernet_cards).\
+               filter_by(id=ethernet_card_id).\
+               filter_by(deleted=False).\
+               all()
+    
+    def security_group_exists(self, tenant_id, group_name):
+        try:
+            group = self.security_group_get_by_name(tenant_id, group_name)
+            return group != None
+        except exception.NotFound:
+            return False
+
+    def security_group_create(self, values):
+        security_group_ref = self.security_group_dto_class()
+        # FIXME(devcamcar): Unless I do this, rules fails with lazy load
+        # exception once save() is called.  This will get cleaned up in next orm
+        # pass.
+        security_group_ref.rules
+        security_group_ref.update(values)
+        security_group_ref.save(session=self._session)
+        return security_group_ref
+    
+class SecurityGroupEthernetCardAssociationDataAccess(
+    EthernetCardDataAccess, SecurityGroupDataAccess):
+    """A Data Access object to access security group ethernet card association.
+    """
+    security_group_dto_class = SecurityGroup
+    ethernet_card_dto_class = EthernetCard
+
+    def ethernet_card_add_security_group(self, ethernet_card_id,
+                                         security_group_id, tenant_id,
+                                         is_admin=False):
+        """Associate the given security group with the given ethernet card"""
+        with self._session.begin():
+            ethernet_card_ref = self.ethernet_card_get(ethernet_card_id)
+            security_group_ref = self.security_group_get(security_group_id,
+                                                         tenant_id,
+                                                         is_admin=is_admin)
+            ethernet_card_ref.security_groups += [security_group_ref]
+        ethernet_card_ref.save(session=self._session)
+
+
+class SecurityGroupIngressRuleDataAccess(DataAccess):
+    """A Data Access object to access security groups.
+    """
+    
+    security_group_ingress_rule_dto_class = SecurityGroupIngressRule
+
+    def security_group_rule_get(self, security_group_rule_id, is_admin=False,
+                                read_deleted=False):
+        if is_admin:
+            result = self._session.query(
+                self.security_group_ingress_rule_dto_class).\
+                filter_by(deleted=read_deleted).\
+                filter_by(id=security_group_rule_id).\
+                first()
+        else:
+            # TODO(vish): Join to group and check for tenant_id
+            result = self._session.query(
+                self.security_group_ingress_rule_dto_class).\
+                filter_by(deleted=False).\
+                filter_by(id=security_group_rule_id).\
+                first()
+        if not result:
+            raise exception.NotFound("No secuity group rule with id %s" %
+                                     security_group_rule_id)
+        return result
+
+    def security_group_rule_get_by_security_group(self, security_group_id,
+                                                  is_admin=False,
+                                                  read_deleted=False):
+        if is_admin:
+            result = self._session.query(
+                self.security_group_ingress_rule_dto_class).\
+                filter_by(deleted=read_deleted).\
+                filter_by(parent_group_id=security_group_id).\
+                all()
+        else:
+            # TODO(vish): Join to group and check for tenant_id
+            result = self._session.query(
+                self.security_group_ingress_rule_dto_class).\
+                filter_by(deleted=False).\
+                filter_by(parent_group_id=security_group_id).\
+                all()
+        return result
+
+    def security_group_rule_get_by_security_group_grantee(self,
+                                                          security_group_id,
+                                                          is_admin=False,
+                                                          read_deleted=False):
+        if is_admin:
+            result = self._session.query(
+                self.security_group_ingress_rule_dto_class).\
+                filter_by(deleted=read_deleted).\
+                filter_by(group_id=security_group_id).\
+                all()
+        else:
+            result = self._session.query(
+                self.security_group_ingress_rule_dto_class ).\
+                filter_by(deleted=False).\
+                filter_by(group_id=security_group_id).\
+                all()
+        return result
+
+    def security_group_rule_create(self, values):
+        security_group_rule_ref = self.security_group_ingress_rule_dto_class()
+        security_group_rule_ref.update(values)
+        security_group_rule_ref.save(session=self._session)
+        return security_group_rule_ref
+
+    def security_group_rule_destroy(self, security_group_rule_id):
+        with self._session.begin():
+            security_group_rule = self.security_group_rule_get(
+                security_group_rule_id)
+            security_group_rule.delete(session=self._session)
 
 # ----------------------
 # Data Access Objects.
 # ----------------------
 
 class FlatVlanNetworkDataAccess(
-    EthernetCardDataAccess, NetworkDataAccess, FixedIpDataAccess,
-    FloatingIpDataAccess):
+    NetworkDataAccess, FixedIpDataAccess, FloatingIpDataAccess,
+    SecurityGroupEthernetCardAssociationDataAccess,
+    SecurityGroupIngressRuleDataAccess):
     """A Data Access Object to access all data for the Flat VLAN network
     service.
 
@@ -449,22 +674,29 @@
 
     floating_ip_dto_class = FloatingIp
 
-    def network_get_by_project(self, project_id, associate=True):
+    security_group_dto_class = SecurityGroup
+
+    security_group_ingress_rule_dto_class = SecurityGroupIngressRule
+
+    security_group_ethernet_card_association_dto_class = \
+        SecurityGroupEthernetCardAssociation
+
+    def network_get_by_tenant(self, tenant_id, associate=True):
         result = self._session.query(self.network_dto_class).\
-            filter_by(project_id=project_id).\
+            filter_by(tenant_id=tenant_id).\
             filter_by(deleted=False).\
             first()
         if not result:
             if not associate:
                 return None
             try:
-                return self.network_associate(project_id)
+                return self.network_associate(tenant_id)
             except IntegrityError:
                 # NOTE(vish): We hit this if there is a race and two
                 #             processes are attempting to allocate the
                 #             network at the same time
                 result = self._session.query(self.network_dto_class).\
-                    filter_by(project_id=project_id).\
+                    filter_by(tenant_id=tenant_id).\
                     filter_by(deleted=False).\
                     first()
         return result
@@ -474,22 +706,22 @@
             filter_by(cidr=cidr).first()
 
         if not result:
-            raise exception.NotFound(_('Network with cidr %s does not exist') %
+            raise exception.NotFound('Network with cidr %s does not exist' %
                                      cidr)
         return result
 
-    def network_associate(self, project_id):
+    def network_associate(self, tenant_id):
         with self._session.begin():
             network_ref = self._session.query(self.network_dto_class).\
                 filter_by(deleted=False).\
-                filter_by(project_id=None).\
+                filter_by(tenant_id=None).\
                 with_lockmode('update').\
                 first()
             # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
             #             then this has concurrency issues
             if not network_ref:
-                raise nova_api.NoMoreNetworks()
-            network_ref['project_id'] = project_id
+                raise nova_db.NoMoreNetworks()
+            network_ref['tenant_id'] = tenant_id
             self._session.add(network_ref)
         return network_ref
 
@@ -542,3 +774,33 @@
                 ip_ref.ethernet_card = self.ethernet_card_get(ethernet_card_id)
                 self._session.add(ip_ref)
             return ip_ref
+
+    def security_group_destroy(self, security_group_id):
+        with self._session.begin():
+            self._session.query(self.security_group_dto_class).\
+                    filter_by(id=security_group_id).\
+                    update({'deleted': 1,
+                            'deleted_at': datetime.datetime.utcnow(),
+                            'updated_at': literal_column('updated_at')})
+            self._session.query(
+                self.security_group_ethernet_card_association_dto_class).\
+                    filter_by(security_group_id=security_group_id).\
+                    update({'deleted': 1,
+                            'deleted_at': datetime.datetime.utcnow(),
+                            'updated_at': literal_column('updated_at')})
+            self._session.query(self.security_group_ingress_rule_dto_class).\
+                    filter_by(group_id=security_group_id).\
+                    update({'deleted': 1,
+                            'deleted_at': datetime.datetime.utcnow(),
+                            'updated_at': literal_column('updated_at')})
+
+    def security_group_destroy_all(self):
+        with self._session.begin():
+            self._session.query(self.security_group_dto_class).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
+            self._session.query(self.security_group_ingress_rule_dto_class).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})

=== added file 'nova/network/flat_vlan/firewall.py'
--- nova/network/flat_vlan/firewall.py	1970-01-01 00:00:00 +0000
+++ nova/network/flat_vlan/firewall.py	2011-04-18 00:30:54 +0000
@@ -0,0 +1,581 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Midokura KK
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License
+from eventlet import tpool
+import IPy
+import libvirt
+
+from nova import log as logging
+from nova import utils
+
+LOG = logging.getLogger('nova.network.flat_vlan.firewall')
+
+def _get_ip_version(cidr):
+    net = IPy.IP(cidr)
+    return int(net.version())
+
+def _get_net_and_mask(cidr):
+    net = IPy.IP(cidr)
+    return str(net.net()), str(net.netmask())
+
+def _get_net_and_prefixlen(cidr):
+    net = IPy.IP(cidr)
+    return str(net.net()), str(net.prefixlen())
+
+class FirewallDriver(object):
+
+    def prepare_vnic_filter(self, vnic_id, net_info, is_vpn, allow_traffic,
+			    conn):
+        """Prepare filters for the vnic.
+
+        At this point, the instance of the vnic isn't running yet."""
+        raise NotImplementedError()
+
+    def unfilter_vnic(self, vnic_id, ipv6_enabled):
+        """Stop filtering vnic"""
+        raise NotImplementedError()
+
+    def apply_vnic_filter(self, vnic_id):
+        """Apply vnic filter.
+
+        Once this method returns, the vnic should be firewalled
+        appropriately. This method should as far as possible be a
+        no-op. It's vastly preferred to get everything set up in
+        prepare_vnic_filter.
+        """
+        raise NotImplementedError()
+
+    def refresh_security_group_rules(self, security_group_id, rules,
+				     ipv6_enabled, allow_traffic,
+				     conn):
+        """Refresh security group rules from data store
+
+        Gets called when a rule has been added to or removed from
+        the security group."""
+        raise NotImplementedError()
+
+    def refresh_security_group_members(self, security_group_id):
+        """Refresh security group members from data store
+
+        Gets called when an instance gets added to or removed from
+        the security group."""
+        raise NotImplementedError()
+
+    def setup_basic_filtering(self, vnic_id, net_info, allow_traffic,
+			      conn):
+        """Create rules to block spoofing and allow dhcp.
+
+        This gets called when spawning an instance, before
+        :method:`prepare_vnic_filter`.
+
+        """
+        raise NotImplementedError()
+
+    def vnic_filter_exists(self, vnic_id, conn):
+        """Check nova-vnic-vnic-xxx exists"""
+        raise NotImplementedError()
+
+class NWFilterFirewall(FirewallDriver):
+    """
+    This class implements a network filtering mechanism versatile
+    enough for EC2 style Security Group filtering by leveraging
+    libvirt's nwfilter.
+
+    First, all vnics get a filter ("nova-base-filter") applied.
+    This filter provides some basic security such as protection against
+    MAC spoofing, IP spoofing, and ARP spoofing.
+
+    This filter drops all incoming ipv4 and ipv6 connections.
+    Outgoing connections are never blocked.
+
+    Second, every security group maps to a nwfilter filter(*).
+    NWFilters can be updated at runtime and changes are applied
+    immediately, so changes to security groups can be applied at
+    runtime (as mandated by the spec).
+
+    Security group rules are named "nova-secgroup-<id>" where <id>
+    is the internal id of the security group. They're applied only on
+    hosts that have instances in the security group in question.
+
+    Updates to security groups are done by updating the data model
+    (in response to API calls) followed by a request sent to all
+    the nodes with instances in the security group to refresh the
+    security group.
+
+    Each vnic has its own NWFilter, which references the above
+    mentioned security group NWFilters. This was done because
+    interfaces can only reference one filter while filters can
+    reference multiple other filters. This has the added benefit of
+    actually being able to add and remove security groups from a
+    vnic at run time. This functionality is not exposed anywhere,
+    though.
+
+    Outstanding questions:
+
+    The name is unique, so would there be any good reason to sync
+    the uuid across the nodes (by assigning it from the datamodel)?
+
+
+    (*) This sentence brought to you by the redundancy department of
+        redundancy.
+
+    """
+
+    def __init__(self, **kwargs):
+        self.static_filters_configured = False
+        self.handle_security_groups = False
+
+    def apply_vnic_filter(self, _vnic_id):
+        """No-op. Everything is done in prepare_vnic_filter"""
+        pass
+
+    def nova_dhcp_filter(self):
+        """The standard allow-dhcp-server filter is an <ip> one, so it uses
+           ebtables to allow traffic through. Without a corresponding rule in
+           iptables, it'll get blocked anyway."""
+
+        return '''<filter name='nova-allow-dhcp-server' chain='ipv4'>
+                    <uuid>891e4787-e5c0-d59b-cbd6-41bc3c6b36fc</uuid>
+                    <rule action='accept' direction='out'
+                          priority='100'>
+                      <udp srcipaddr='0.0.0.0'
+                           dstipaddr='255.255.255.255'
+                           srcportstart='68'
+                           dstportstart='67'/>
+                    </rule>
+                    <rule action='accept' direction='in'
+                          priority='100'>
+                      <udp srcipaddr='$DHCPSERVER'
+                           srcportstart='67'
+                           dstportstart='68'/>
+                    </rule>
+                  </filter>'''
+
+    def nova_ra_filter(self):
+        return '''<filter name='nova-allow-ra-server' chain='root'>
+                            <uuid>d707fa71-4fb5-4b27-9ab7-ba5ca19c8804</uuid>
+                              <rule action='accept' direction='inout'
+                                    priority='100'>
+                                <icmpv6 srcipaddr='$RASERVER'/>
+                              </rule>
+                            </filter>'''
+
+    def setup_basic_filtering(self, vnic_id, net_info, allow_traffic,
+			      conn):
+        """Set up basic filtering (MAC, IP, and ARP spoofing protection)"""
+        logging.info('called setup_basic_filtering in nwfilter')
+
+        if self.handle_security_groups:
+            # No point in setting up a filter set that we'll be overriding
+            # anyway.
+            return
+
+        logging.info('ensuring static filters')
+        self._ensure_static_filters(vnic_id, net_info, allow_traffic, conn)
+	
+        vnic_filter_name = self._vnic_filter_name(vnic_id)
+        self._define_filter(self._filter_container(vnic_filter_name,
+                                                   ['nova-base']),
+			    conn)
+
+    def _ensure_static_filters(self, vnic_id, net_info, allow_traffic,
+			       conn):
+        if self.static_filters_configured:
+            return
+
+        self._define_filter(self._filter_container('nova-base',
+                                                   ['no-mac-spoofing',
+                                                    'no-ip-spoofing',
+                                                    'no-arp-spoofing',
+                                                    'allow-dhcp-server']),
+			    conn)
+        self._define_filter(self.nova_base_ipv4_filter, conn)
+        self._define_filter(self.nova_base_ipv6_filter, conn)
+        self._define_filter(self.nova_dhcp_filter, conn)
+        self._define_filter(self.nova_ra_filter, conn)
+        self._define_filter(self.nova_vpn_filter, conn)
+        if allow_traffic:
+            self._define_filter(self.nova_project_filter, conn)
+            if net_info['ipv6_enabled']:
+                self._define_filter(self.nova_project_filter_v6, conn)
+
+        self.static_filters_configured = True
+
+    def _filter_container(self, name, filters):
+        xml = '''<filter name='%s' chain='root'>%s</filter>''' % (
+                 name,
+                 ''.join(["<filterref filter='%s'/>" % (f,) for f in filters]))
+        return xml
+
+    nova_vpn_filter = '''<filter name='nova-vpn' chain='root'>
+                           <uuid>2086015e-cf03-11df-8c5d-080027c27973</uuid>
+                           <filterref filter='allow-dhcp-server'/>
+                           <filterref filter='nova-allow-dhcp-server'/>
+                           <filterref filter='nova-base-ipv4'/>
+                           <filterref filter='nova-base-ipv6'/>
+                         </filter>'''
+
+    def nova_base_ipv4_filter(self):
+        retval = "<filter name='nova-base-ipv4' chain='ipv4'>"
+        for protocol in ['tcp', 'udp', 'icmp']:
+            for direction, action, priority in [('out', 'accept', 399),
+                                                ('in', 'drop', 400)]:
+                retval += """<rule action='%s' direction='%s' priority='%d'>
+                               <%s />
+                             </rule>""" % (action, direction,
+                                              priority, protocol)
+        retval += '</filter>'
+        return retval
+
+    def nova_base_ipv6_filter(self):
+        retval = "<filter name='nova-base-ipv6' chain='ipv6'>"
+        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
+            for direction, action, priority in [('out', 'accept', 399),
+                                                ('in', 'drop', 400)]:
+                retval += """<rule action='%s' direction='%s' priority='%d'>
+                               <%s />
+                             </rule>""" % (action, direction,
+                                              priority, protocol)
+        retval += '</filter>'
+        return retval
+
+    def nova_project_filter(self):
+        retval = "<filter name='nova-project' chain='ipv4'>"
+        for protocol in ['tcp', 'udp', 'icmp']:
+            retval += """<rule action='accept' direction='in' priority='200'>
+                           <%s srcipaddr='$PROJNET' srcipmask='$PROJMASK' />
+                         </rule>""" % protocol
+        retval += '</filter>'
+        return retval
+
+    def nova_project_filter_v6(self):
+        retval = "<filter name='nova-project-v6' chain='ipv6'>"
+        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
+            retval += """<rule action='accept' direction='inout'
+                                                   priority='200'>
+                           <%s srcipaddr='$PROJNETV6'
+                               srcipmask='$PROJMASKV6' />
+                         </rule>""" % (protocol)
+        retval += '</filter>'
+        return retval
+
+    def _define_filter(self, xml, conn):
+        if callable(xml):
+            xml = xml()
+        # execute in a native thread and block current greenthread until done
+        tpool.execute(conn().nwfilterDefineXML, xml)
+
+    def unfilter_vnic(self, _vnic_id, _ipv6_enabled):
+        # Nothing to do
+        pass
+
+    def prepare_vnic_filter(self, vnic_id, net_info, is_vpn, allow_traffic,
+			    conn):
+        """
+        Creates an NWFilter for the given instance. In the process,
+        it makes sure the filters for the security groups as well as
+        the base filter are all in place.
+        """
+        if is_vpn:
+            base_filter = 'nova-vpn'
+        else:
+            base_filter = 'nova-base'
+
+        vnic_secgroup_filter_name = \
+            '%s-secgroup' % (self._vnic_filter_name(vnic_id))
+
+        vnic_secgroup_filter_children = ['nova-base-ipv4',
+					 'nova-base-ipv6',
+					 'nova-allow-dhcp-server']
+	for security_group in net_info['security_groups']:
+
+            self.refresh_security_group_rules(security_group['id'],
+					      security_group['rules'],
+					      net_info['ipv6_enabled'],
+					      allow_traffic,
+					      conn)
+
+            vnic_secgroup_filter_children += [('nova-secgroup-%s' %
+					       security_group['id'])]
+
+            self._define_filter(
+                self._filter_container(vnic_secgroup_filter_name,
+				       vnic_secgroup_filter_children),
+		conn)
+
+	vnic_filter_name = self._vnic_filter_name(vnic_id)
+	vnic_filter_children = [base_filter, vnic_secgroup_filter_name]
+	if net_info['ipv6_enabled'] and net_info['gateway_v6']:
+	    vnic_secgroup_filter_children += ['nova-allow-ra-server']
+
+	if allow_traffic:
+	    vnic_filter_children += ['nova-project']
+	    if net_info['ipv6_enabled']:
+	        vnic_filter_children += ['nova-project-v6']
+
+	self._define_filter(self._filter_container(vnic_filter_name,
+						   vnic_filter_children),
+			    conn)
+        return
+
+    def refresh_security_group_rules(self, security_group_id, rules,
+				     ipv6_enabled, _allow_traffic,
+				     conn):
+        return self._define_filter(
+                   self.security_group_to_nwfilter_xml(security_group_id, rules,
+						       ipv6_enabled),
+		   conn)
+
+    def security_group_to_nwfilter_xml(self, security_group_id, rules,
+				       ipv6_enabled):
+        rule_xml = ""
+        v6protocol = {'tcp': 'tcp-ipv6', 'udp': 'udp-ipv6', 'icmp': 'icmpv6'}
+        for rule in rules:
+            rule_xml += "<rule action='accept' direction='in' priority='300'>"
+            if rule['cidr']:
+                version = _get_ip_version(rule['cidr'])
+                if(ipv6_enabled and version == 6):
+                    net, prefixlen = _get_net_and_prefixlen(rule['cidr'])
+                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
+                                (v6protocol[rule['protocol']], net, prefixlen)
+                else:
+                    net, mask = _get_net_and_mask(rule['cidr'])
+                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
+                                (rule['protocol'], net, mask)
+                if rule['protocol'] in ['tcp', 'udp']:
+                    rule_xml += "dstportstart='%s' dstportend='%s' " % \
+                                (rule['from_port'], rule['to_port'])
+                elif rule['protocol'] == 'icmp':
+                    LOG.info('rule.protocol: %r, rule.from_port: %r, '
+                             'rule.to_port: %r', rule['protocol'],
+                             rule['from_port'], rule['to_port'])
+                    if rule['from_port'] != -1:
+                        rule_xml += "type='%s' " % rule['from_port']
+                    if rule['to_port'] != -1:
+                        rule_xml += "code='%s' " % rule['to_port']
+
+                rule_xml += '/>\n'
+            rule_xml += "</rule>\n"
+        xml = "<filter name='nova-secgroup-%s' " % security_group_id
+        if(ipv6_enabled):
+            xml += "chain='root'>%s</filter>" % rule_xml
+        else:
+            xml += "chain='ipv4'>%s</filter>" % rule_xml
+        return xml
+
+    def _vnic_filter_name(self, vnic_id):
+        return 'nova-vnic-%s' % vnic_id
+
+    def vnic_filter_exists(self, vnic_id, conn):
+        vnic_filter_name = self._vnic_filter_name(vnic_id)
+        try:
+            conn().nwfilterLookupByName(vnic_filter_name)
+        except libvirt.libvirtError:
+            name = vnic_id 
+            LOG.debug(_('The nwfilter(%(vnic_filter_name)s) for'
+                        '%(name)s is not found.') % locals())
+            return False
+        return True
+
+class IptablesFirewallDriver(FirewallDriver):
+    def __init__(self, execute=None, **kwargs):
+        from nova.network.flat_vlan.driver.linux import filter
+        self.iptables = filter.iptables_manager
+        self.vnics = {}
+        self.nwfilter = NWFilterFirewall()
+
+        self.iptables.ipv4['filter'].add_chain('sg-fallback')
+        self.iptables.ipv4['filter'].add_rule('sg-fallback', '-j DROP')
+        self.iptables.ipv6['filter'].add_chain('sg-fallback')
+        self.iptables.ipv6['filter'].add_rule('sg-fallback', '-j DROP')
+
+    def setup_basic_filtering(self, vnic_id, net_info, allow_traffic,
+			      conn):
+        """Use NWFilter from libvirt for this."""
+        return self.nwfilter.setup_basic_filtering(vnic_id, net_info,
+						   allow_traffic, conn)
+
+    def apply_vnic_filter(self, _vnic_id):
+        """No-op. Everything is done in prepare_vnic_filter"""
+        pass
+
+    def unfilter_vnic(self, vnic_id, ipv6_enabled):
+        if self.vnics.pop(vnic_id, None):
+            self._remove_filters_for_vnic(vnic_id, ipv6_enabled)
+            self.iptables.apply()
+        else:
+            LOG.info('Attempted to unfilter vnic %s which is not '
+                     'filtered', vnic_id)
+
+    def prepare_vnic_filter(self, vnic_id, net_info, _is_vpn, allow_traffic,
+			    _conn):
+        self.vnics[vnic_id] = net_info
+        self._add_filters_for_vnic(vnic_id, net_info, allow_traffic)
+        self.iptables.apply()
+
+    def _add_filters_for_vnic(self, vnic_id, net_info, allow_traffic):
+        chain_name = self._vnic_chain_name(vnic_id)
+
+        self.iptables.ipv4['filter'].add_chain(chain_name)
+        ipv4_address = net_info['IPs'][0]['fixed_ip']
+        self.iptables.ipv4['filter'].add_rule('local',
+                                              '-d %s -j $%s' %
+                                              (ipv4_address, chain_name))
+
+        if net_info['ipv6_enabled']:
+            self.iptables.ipv6['filter'].add_chain(chain_name)
+            ipv6_address = net_info['IPs'][0]['ip_v6']
+            self.iptables.ipv6['filter'].add_rule('local',
+                                                  '-d %s -j $%s' %
+                                                  (ipv6_address,
+                                                   chain_name))
+
+        ipv4_rules, ipv6_rules = self._vnic_rules(net_info, allow_traffic)
+
+        for rule in ipv4_rules:
+            self.iptables.ipv4['filter'].add_rule(chain_name, rule)
+
+        if net_info['ipv6_enabled']:
+            for rule in ipv6_rules:
+                self.iptables.ipv6['filter'].add_rule(chain_name, rule)
+
+    def _remove_filters_for_vnic(self, vnic_id, ipv6_enabled):
+    
+            chain_name = self._vnic_chain_name(vnic_id)
+
+            self.iptables.ipv4['filter'].remove_chain(chain_name)
+            if ipv6_enabled:
+	        self.iptables.ipv6['filter'].remove_chain(chain_name)
+
+    def _vnic_rules(self, net_info, allow_traffic):
+
+        ipv4_rules = []
+        ipv6_rules = []
+
+        # Always drop invalid packets
+        ipv4_rules += ['-m state --state ' 'INVALID -j DROP']
+        ipv6_rules += ['-m state --state ' 'INVALID -j DROP']
+
+        # Allow established connections
+        ipv4_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
+        ipv6_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
+
+        if net_info['IPs'][0]['gateway']:
+            ipv4_rules += ['-s %s -p udp --sport 67 --dport 68 '
+                           '-j ACCEPT' % (net_info['IPs'][0]['gateway'],)]
+
+        #Allow project network traffic
+        if allow_traffic:
+            if net_info['IPs'][0]['cidr']:
+                ipv4_rules += ['-s %s -j ACCEPT' %
+                               (net_info['IPs'][0]['cidr'],)]
+
+        if net_info['ipv6_enabled']:
+            # Allow RA responses
+            if net_info['IPs'][0]['gateway_v6']:
+                 ipv6_rules += ['-s %s/128 -p icmpv6 -j ACCEPT' %
+                                (net_info['IPs'][0]['gateway_v6'],)]
+
+                 #Allow project network traffic
+                 if allow_traffic:
+                     if net_info['IPs'][0]['cidr_v6']:
+                         ipv6_rules += ['-s %s -j ACCEPT' %
+                                        (net_info['IPs'][0]['cidr_v6'],)]
+
+	security_groups = net_info['security_groups']
+
+        # then, security group chains and rules
+        for security_group in security_groups:
+
+            for rule in security_group['rules']:
+                logging.info('%r', rule)
+
+                if not rule.cidr:
+                    # Eventually, a mechanism to grant access for security
+                    # groups will turn up here. It'll use ipsets.
+                    continue
+
+                version = _get_ip_version(rule.cidr)
+                if version == 4:
+                    rules = ipv4_rules
+                else:
+                    rules = ipv6_rules
+
+                protocol = rule.protocol
+                if version == 6 and rule.protocol == 'icmp':
+                    protocol = 'icmpv6'
+
+                args = ['-p', protocol, '-s', rule.cidr]
+
+                if rule.protocol in ['udp', 'tcp']:
+                    if rule.from_port == rule.to_port:
+                        args += ['--dport', '%s' % (rule.from_port,)]
+                    else:
+                        args += ['-m', 'multiport',
+                                 '--dports', '%s:%s' % (rule.from_port,
+                                                        rule.to_port)]
+                elif rule.protocol == 'icmp':
+                    icmp_type = rule.from_port
+                    icmp_code = rule.to_port
+
+                    if icmp_type == -1:
+                        icmp_type_arg = None
+                    else:
+                        icmp_type_arg = '%s' % icmp_type
+                        if not icmp_code == -1:
+                            icmp_type_arg += '/%s' % icmp_code
+
+                    if icmp_type_arg:
+                        if version == 4:
+                            args += ['-m', 'icmp', '--icmp-type',
+                                     icmp_type_arg]
+                        elif version == 6:
+                            args += ['-m', 'icmp6', '--icmpv6-type',
+                                     icmp_type_arg]
+
+                args += ['-j ACCEPT']
+                rules += [' '.join(args)]
+
+        ipv4_rules += ['-j $sg-fallback']
+        ipv6_rules += ['-j $sg-fallback']
+
+        return ipv4_rules, ipv6_rules
+
+    def vnic_filter_exists(self, vnic_id, conn):
+        """Check nova-vnic_id exists"""
+        return self.nwfilter.vnic_filter_exists(vnic_id, conn)
+
+    def refresh_security_group_members(self, _security_group):
+        pass
+
+    def refresh_security_group_rules(self, _security_group_id, _rules,
+				     _ipv6_enabled, allow_traffic,
+				     _conn):
+        self._do_refresh_security_group_rules(allow_traffic)
+        self.iptables.apply()
+
+    @utils.synchronized('iptables', external=True)
+    def _do_refresh_security_group_rules(self, allow_traffic):
+        for vnic_id, net_info in self.vnics.items():
+            self._remove_filters_for_vnic(vnic_id, net_info['ipv6_enabled'])
+            self._add_filters_for_vnic(vnic_id, net_info, allow_traffic)
+
+    def _security_group_chain_name(self, security_group_id):
+        return 'nova-sg-%s' % (security_group_id,)
+
+    def _vnic_chain_name(self, vnic_id):
+        return 'vnic-%s' % (vnic_id,)
+

=== modified file 'nova/network/flat_vlan/flags.py'
--- nova/network/flat_vlan/flags.py	2011-04-04 09:52:18 +0000
+++ nova/network/flat_vlan/flags.py	2011-04-18 00:30:54 +0000
@@ -100,6 +100,9 @@
                     'Fixed IP address block')
 flags.DEFINE_string('net_flat_vlan_fixed_range_v6', 'fd00::/48', 
                     'Fixed IPv6 address block')
+flags.DEFINE_string('net_flat_vlan_firewall_driver',
+                    'nova.network.flat_vlan.firewall.IptablesFirewallDriver',
+                    'Firewall driver (defaults to iptables)')
 
 # Sanity check.  VLAN must use DHCP.
 if (flags.FLAGS.net_flat_vlan_use_vlan and

=== modified file 'nova/network/flat_vlan/manager.py'
--- nova/network/flat_vlan/manager.py	2011-04-04 09:52:18 +0000
+++ nova/network/flat_vlan/manager.py	2011-04-18 00:30:54 +0000
@@ -52,15 +52,15 @@
     # Check that num_networks + vlan_start is not > 4094, fixes lp708025
     if vlan_start:
         if num_networks + vlan_start > 4094:
-            raise ValueError(_('The sum between the number of networks and'
-                               ' the vlan start cannot be greater'
-                               ' than 4094'))
+            raise ValueError('The sum between the number of networks and'
+                             ' the vlan start cannot be greater'
+                             ' than 4094')
 
     fixed_net = IPy.IP(cidr)
     if fixed_net.len() < num_networks * network_size:
-        raise ValueError(_('The network range is not big enough to fit '
+        raise ValueError('The network range is not big enough to fit '
               '%(num_networks)s. Network size is %(network_size)s' %
-              locals()))
+              locals())
 
     fixed_net_v6 = IPy.IP(cidr_v6)
     network_size_v6 = 1 << 64
@@ -112,8 +112,8 @@
             pass
 
         if network_ref is not None:
-            raise ValueError(_('Network with cidr %s already exists' %
-                               cidr))
+            raise ValueError('Network with cidr %s already exists' %
+                             cidr)
 
         network_ref = api.network_create_safe(context, net)
         if network_ref:
@@ -122,10 +122,10 @@
 
     return networks
 
-def allocate_ip_by_project(context, ethernet_card_id, is_vpn):
+def allocate_ip_by_tenant(context, ethernet_card_id, is_vpn):
     """Gets an IP from the pool."""
     ctxt = context.elevated()
-    network_ref = api.network_get_by_project(ctxt, context.project_id)
+    network_ref = api.network_get_by_tenant(ctxt, context.project_id)
 
     if is_vpn:
         ip_ref = api.fixed_ip_get_by_address(ctxt, 
@@ -139,7 +139,7 @@
     api.fixed_ip_update(context, ip_ref['id'], {'allocated': True})
     return ip_ref 
 
-def bind_ip_to_ethernet_card_by_project(context, ethernet_card_id, is_vpn):
+def bind_ip_to_ethernet_card_by_tenant(context, ethernet_card_id, is_vpn):
     """Assigns IP to ethernet card."""
     
     # Get the ethernet card
@@ -152,7 +152,7 @@
                                                    ethernet_card_id)
     # Check to see if this ethernet card does not have IP allocated.
     if not ip_address:
-        ip_address = allocate_ip_by_project(context, ethernet_card_id, is_vpn)
+        ip_address = allocate_ip_by_tenant(context, ethernet_card_id, is_vpn)
 
     return ip_address
 

=== modified file 'nova/network/flat_vlan/network.py'
--- nova/network/flat_vlan/network.py	2011-04-10 16:27:55 +0000
+++ nova/network/flat_vlan/network.py	2011-04-18 00:30:54 +0000
@@ -17,9 +17,9 @@
 
 import collections
 import datetime
-import os
 
 from nova import context
+from nova import exception
 from nova import log as logging
 from nova import manager as nova_manager
 from nova import rpc
@@ -76,7 +76,7 @@
 
         if FLAGS.net_flat_vlan_use_vlan or FLAGS.net_flat_vlan_use_dhcp:
             self.filter_driver.init_host()
-            # Set up networking for the projects for which we're already
+            # Set up networking for the tenants for which we're already
             # the designated network host.
             floating_ips = self.db.floating_ip_get_all_by_host(ctxt,
                                                                self.host)
@@ -106,7 +106,7 @@
                                                                self.host,
                                                                time)
             if num:
-                LOG.debug(_("Dissassociated %s stale fixed ip(s)"), num)
+                LOG.debug("Dissassociated %s stale fixed ip(s)", num)
 
     def _set_vlan_host(self, context, network_id):
         """Sets up VLAN networking service host.
@@ -236,7 +236,7 @@
         """
         for vnic_id in vnic_ids:
             if FLAGS.net_flat_vlan_use_vlan:
-                ip_address = manager.bind_ip_to_ethernet_card_by_project(
+                ip_address = manager.bind_ip_to_ethernet_card_by_tenant(
                                                                     context,
                                                                     vnic_id,
                                                                     is_vpn)
@@ -265,9 +265,11 @@
            mac: MAC address to lease the IP address against.
            address: IP address to lease.
         """
-        LOG.debug(_("Leasing IP %s"), address, context=context)
+        LOG.debug("Leasing IP %s", address, context=context)
         fixed_ip_ref = self.db.fixed_ip_get_by_address(context, address)
         ethernet_card = fixed_ip_ref['ethernet_card']
+
+        # TODO: Figure out a way to not use instance
         instance = nova_db_api.instance_get_by_virtual_nic(context,
                                                            ethernet_card['id'])
         if not instance:
@@ -326,13 +328,13 @@
            mac: MAC address to release the IP against.
            address: IP address to release
         """
-        LOG.debug(_("Releasing IP %s"), address, context=context)
+        LOG.debug("Releasing IP %s", address, context=context)
         fixed_ip_ref = self.db.fixed_ip_get_by_address(context, address)
         ethernet_card = fixed_ip_ref['ethernet_card']
         instance = nova_db_api.instance_get_by_virtual_nic(context,
                                                            ethernet_card['id'])
         if not instance:
-            raise exception.Error(_("IP %s released that isn't associated") %
+            raise exception.Error("IP %s released that isn't associated" %
                                   address)
 
         if nova_db_api.is_user_context(context):
@@ -340,11 +342,11 @@
             nova_db_api.authorize_project_context(context, instance.project_id)
 
         if ethernet_card['mac_address'] != mac:
-            raise exception.Error(_("IP %(address)s leased to bad"
-                    " mac %s vs %s") % (ethernet_card['mac_address'], mac))
+            raise exception.Error("IP %(address)s leased to bad"
+                    " mac %s vs %s" % (ethernet_card['mac_address'], mac))
 
         if not fixed_ip_ref['leased']:
-            LOG.warn(_("IP %s released that was not leased"), address,
+            LOG.warn("IP %s released that was not leased", address,
                      context=context)
         self.db.fixed_ip_update(context,
                                 fixed_ip_ref['address'],
@@ -355,7 +357,7 @@
             #             means there will stale entries in the conf file
             #             the code below will update the file if necessary
             if FLAGS.net_flat_vlan_update_dhcp_on_disassociate:
-                network_ref = fixed_ip['network']
+                network_ref = fixed_ip_ref['network']
                 hosts = self._get_dhcp_hosts(context, network_ref['id'])
                 self.dhcp_driver.update_dhcp(network_ref['bridge'],
                                              network_ref['gateway'],
@@ -405,7 +407,7 @@
         """Get the list of hosts for an interface."""
         ctxt = context.get_admin_context()
         if FLAGS.fake_rabbit:
-            LOG_DHCP.debug(_("initializing leases"))
+            LOG_DHCP.debug("initializing leases")
             return NetworkService().get_dhcp_host_leases(ctxt, interface)
         else:
             return rpc.cast(ctxt,
@@ -419,7 +421,7 @@
         """Set the IP that was assigned by the DHCP server."""
         ctxt = context.get_admin_context()
         if FLAGS.fake_rabbit:
-            LOG_DHCP.debug(_("leasing ip"))
+            LOG_DHCP.debug("leasing ip")
             return NetworkService().lease_fixed_ip(ctxt, mac, ip_address)
         else:
             rpc.cast(ctxt,
@@ -432,7 +434,7 @@
     @classmethod
     def old_lease(cls, mac, ip_address, hostname, interface):
         """Update just as add lease."""
-        LOG_DHCP.debug(_("Adopted old lease or got a change of mac/hostname"))
+        LOG_DHCP.debug("Adopted old lease or got a change of mac/hostname")
         cls.add_lease(mac, ip_address, hostname, interface)
 
     @classmethod
@@ -440,7 +442,7 @@
         """Called when a lease expires."""
         ctxt = context.get_admin_context()
         if FLAGS.fake_rabbit:
-            LOG_DHCP.debug(_("releasing ip"))
+            LOG_DHCP.debug("releasing ip")
             NetworkService().release_fixed_ip(ctxt, mac, ip_address)
         else:
             rpc.cast(ctxt,

=== modified file 'nova/network/service.py'
--- nova/network/service.py	2011-04-08 03:00:41 +0000
+++ nova/network/service.py	2011-04-18 00:30:54 +0000
@@ -50,7 +50,9 @@
         """
 
 class INetworkApiService(interface.Interface):
-    """A Network API service object."""
+    """A Network API service object.  This should be eventually
+    refactored into separate API services, such as OpenStack API routes,
+    Security Group, VNIC management, Network IP management, etc."""
 
     def set_os_routes(net_mapper):
         """Sets up OpenStack API routes.
@@ -104,14 +106,26 @@
                   fixed_ip: Fixed IPv4 IP address
                   floating_ips: A list of Floating IPv4 IP addresses
                   ip_v6: IPv6 address
+              security_groups: A list of security group dictionary.
+                  id: unique identifier of the security group.
+                  name: Name of the security group.
+                  description: Security group description
+                  tenant_id: The tenant to which the security group belongs to.
+                  rules: A list of ingress rules for this security group.
+                      parent_group_id: Parent security group ID.
+                      protocol: Protocol for the rule.
+                      from_port: The source port for the rule.
+                      to_port: The destination port for the rule.
+                      cidr: CIDR for the rule.
+                      security_group_id: The security group ID.                     
         """
 
-    def get_project_network_info(context, project_id):
-        """Gets network related information for the project.
+    def get_tenant_network_info(context, tenant_id):
+        """Gets network related information for the tenant.
 
         Args:
            context: Nova context object.
-           project_id: project ID to get the data for.
+           tenant_id: tenant ID to get the data for.
 
         Returns:
            A dictionary with the following keys:
@@ -130,29 +144,29 @@
               gateway_v6: network gateway for IPv6 if applicable
         """
 
-    def get_addresses(context, project_id=None):
+    def get_addresses(context, tenant_id=None):
         """Gets all the floating IPs, their mapped fixed IPs and
         ethernet card ID.
 
         Args:
            context: Nova context object.
-           project_id: Project ID to filter the IPs by.(optional)
+           tenant_id: Tenant ID to filter the IPs by.(optional)
 
         Returns:
            A list of dictionary with keys:
                floating_ip: Public IP
                fixed_ip: Private IP
-               project_id: Project ID of the floating IP.
+               tenant_id: Tenant ID of the floating IP.
                vnic_id: VNIC ID
                mac_address: MAC address
         """
 
-    def allocate_address(context, project_id, ip_quota):
-        """Gets the number of floating IPs associated with a project.
+    def allocate_address(context, tenant_id, ip_quota):
+        """Gets the number of floating IPs associated with a tenant.
 
         Args:
             context: Nova context object needed to access the DB.
-            project_id: Project to allocate the address from.
+            tenant_id: Tenant to allocate the address from.
             ip_quota: Quota for IP addresses.
 
         Returns:
@@ -162,15 +176,15 @@
             quota.QuotaError: Over the quota limit.
         """
 
-    def deallocate_address(self, context, floating_address):
+    def deallocate_address(context, floating_address):
         """Deallocates the public IP address by removing it from any
-        project.
+        tenant.
 
         Args:
            context: nova context object needed to access the DB.
            address: Public IP address to deallocate.
         """
-    def associate_address(self, context, vnic_id, floating_address):
+    def associate_address(context, vnic_id, floating_address):
         """Associates a floating address to the fixed IP address of the vnic.
 
         Args:
@@ -179,7 +193,7 @@
            floating_address: public IP address to assign to the VNIC.
         """
 
-    def disassociate_address(self, context, floating_address):
+    def disassociate_address(context, floating_address):
         """Diassociates public IP.
 
         Args:
@@ -187,6 +201,149 @@
            floating_address: public IP address
         """
 
+    def create_security_group(context, user_id, tenant_id, name, description):
+        """Creates a new security group record if it does not exist.
+
+        Args:
+            context: Nova context
+            user_id: The user ID to associate the group with.
+            tenant_id: The tenant in which security group associates.
+            name: Name for the security group.
+            description: Description of the security group.
+
+        Returns:
+            A dictionary of security group information with keys:
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+
+        Raises:
+            nova.exception.ApiError: Group already exists.
+        """
+
+    def get_security_group(context, id, tenant_id=None):
+        """Gets a security group with a unique identifier of the group.
+
+        Args:
+            context: Nova context object.
+            id: Security group ID.
+            tenant_id: Tenant to get the security group for.
+ 
+        Returns:
+           security group info in dictionary with the following keys:
+
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+                   rules: A list of dictionary of security group rules:
+                   parent_group_id: Parent security group ID.
+                   protocol: Protocol for the rule.
+                   from_port: The source port for the rule.
+                   to_port: The destination port for the rule.
+                   cidr: CIDR or the rule.
+                   security_group_id: The security group ID.
+               vnic_ids: A list of virtual NIC IDs. 
+        """
+        
+    def get_security_groups(context, tenant_id=None):
+        """Gets a list of security groups, filtered by tenant_id if specified.
+        
+        Args:
+            context: Nova context object.
+            tenant_id: Tenant to get the security group for.
+ 
+        Returns:
+           A list of security groups in dictionary with the following keys:
+
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+        """
+
+    def get_security_group_by_name(context, name, tenant_id):
+        """Gets a security group with a given name of the tenant.
+        This is expected to return something all the time, since for
+        EC2 compatibility, VMs cannot be created without one.
+
+        Args:
+            context: Nova context object.
+            name: The name of the security group to search.
+            tenant_id: Tenant to get the security group of.
+
+        Returns:
+           security group info in dictionary with the following keys:
+
+               id: unique identifier of the security group.
+               name: Name of the security group.
+               description: Security group description
+               tenant_id: The tenant to which the security group belongs to.
+               rules: A list of dictionary of security group rules:
+                   parent_group_id: Parent security group ID.
+                   protocol: Protocol for the rule.
+                   from_port: The source port for the rule.
+                   to_port: The destination port for the rule.
+                   cidr: CIDR or the rule.
+                   security_group_id: The security group ID.
+               vnic_ids: A list of virtual NIC IDs. 
+           None if it does not exist.    
+       """
+
+    def delete_security_group(context, id):
+        """Deletes a security group.
+
+        Args:
+            context: Nova context object.
+            id: ID of the security group to delete.
+        """
+
+    def create_security_group_rule(context, parent_group_id, cidr=None,
+                                   from_port=None, to_port=None, protocol=None,
+                                   group_id=None):
+        """Creates a new security group ingress rule.
+
+        Args:
+            context: Nova context object.
+            parent_group_id: Security group this rule belongs to.
+            cidr: CIDR of the rule.
+            from_port: The source port.
+            to_port: The destination port.
+            protocol: The network protocol for the rule.
+            group_id: The target security group ID.
+
+        Returns:
+            The new security group rule info as a dictionary:
+                Keys:
+                    parent_group_id: Parent security group ID.
+                    protocol: Protocol for the rule.
+                    from_port: The source port for the rule.
+                    to_port: The destination port for the rule.
+                    cidr: CIDR for the rule.
+                    security_group_id: The security group ID.         
+        """        
+
+    def delete_security_group_rule(context, id):
+        """Deletes a security group rule with the given ID.
+
+        Args:
+            context: Nova context object.
+            id: ID of the security group rule to delete.
+        """
+
+    def associate_vnic_and_security_group(context, vnic_id,
+                                          security_group_id,
+                                          tenant_id):
+        """Associates a VNIC to a security group.
+
+        Args:
+            context: Nova context object.
+            vnic_id: Virtual NIC ID.
+            security_group_id: ID of the security group to associate.
+            tenant_id: Tenant that securiy group should belong to.
+        """
+
 class INetworkAgentService(interface.Interface):
     """An OpenStack network agent service object."""
 
@@ -237,6 +394,67 @@
            ip_address, bridge, gateway_v6, and netmast_v6
         """
 
+    def prepare_vnic_filter(context, vnic_id, is_vpn, allow_traffic, conn):
+        """Prepares filters for VNIC.
+
+        Args:
+            contxt: Nova context object
+            vnic_id: VNIC ID
+            is_vpn: True if setting VPN.
+            allow_traffic: True if traffic can flow.
+            conn: connection to hypervisor.
+        """
+    def unfilter_vnic(vnic_id):
+        """Removes filters for vnic.
+
+        Args:
+           vnic_id: VNIC ID.
+        """
+        
+    def apply_vnic_filter(vnic_id):
+        """Applies the filter for VNIC.  Currently unused.
+
+        Args:
+            vnic_id: VNIC ID
+        """
+
+    def refresh_security_group_rules(context, security_group_id,
+                                     tenant_id, allow_traffic, conn):
+        """Refreshes the security group rules.
+
+        Args:
+            context: Nova context object.
+            security_group_id: Security group ID.
+            tenant_id: ID of the tenant.
+            allow_traffic: True if ok to allow traffic.
+            conn: hyperviser connection.
+        """
+
+    def refresh_security_group_members(security_group_id):
+        """Refreshes security group members.
+
+        Args:
+            security_group_id: Security group ID.
+        """
+        
+    def setup_basic_filtering(context, vnic_id, allow_traffic, conn):
+        """Sets up basic filtering for VNIC.
+
+        Args:
+            context: Nova context object.
+            vnic_id: VNIC to set the filters for.
+            allow_traffic: True if ok to allow traffic.
+            conn: hyperviser connection.
+        """
+
+    def vnic_filter_exists(vnic_id, conn):
+        """Checks whether filters for VNIC exists.
+
+        Args:
+            vnic_id: VNIC ID to chekc.
+            conn: hypervisor conneciotn.
+        """
+        
 class NetworkServiceRouteMap(object):
     """Wrapper class for route mapper."""
 

=== modified file 'nova/virt/libvirt_conn.py'
--- nova/virt/libvirt_conn.py	2011-04-12 10:57:56 +0000
+++ nova/virt/libvirt_conn.py	2011-04-18 00:30:54 +0000
@@ -49,7 +49,6 @@
 from xml.etree import ElementTree
 
 from eventlet import greenthread
-from eventlet import tpool
 
 import IPy
 
@@ -102,9 +101,6 @@
 flags.DEFINE_string('ajaxterm_portrange',
                     '10000-12000',
                     'Range of ports that ajaxterm should randomly try to bind')
-flags.DEFINE_string('firewall_driver',
-                    'nova.virt.libvirt_conn.IptablesFirewallDriver',
-                    'Firewall driver (defaults to iptables)')
 flags.DEFINE_string('cpuinfo_xml_template',
                     utils.abspath('virt/cpuinfo.xml.template'),
                     'CpuInfo XML Template (Used only live migration now)')
@@ -217,9 +213,6 @@
         self._wrapped_conn = None
         self.read_only = read_only
 
-        fw_class = utils.import_class(FLAGS.firewall_driver)
-        self.firewall_driver = fw_class(get_connection=self._get_connection)
-
     def init_host(self, host):
         # Adopt existing VM's running here
         ctxt = context.get_admin_context()
@@ -241,8 +234,13 @@
                 continue
 
             vnics = db.virtual_nics_get_by_instance(ctxt, instance['id'])
+            is_vpn = (instance['image_id'] == FLAGS.vpn_image_id)
+            net_agent = self._get_net_agent(ctxt, instance['project_id'])
             for vnic_id in vnics:
-                self.firewall_driver.prepare_vnic_filter(vnic_id, instance)
+                net_agent.prepare_vnic_filter(
+                    context.get_admin_context(), vnic_id, is_vpn,
+                    FLAGS.allow_project_net_traffic,
+                    self._get_connection)
 
     def _get_connection(self):
         if not self._wrapped_conn or not self._test_connection():
@@ -384,8 +382,14 @@
                                       power_state.SHUTOFF)
                 break
 
-        self.firewall_driver.unfilter_instance(instance)
-
+        vnics = db.virtual_nics_get_by_instance(context.get_admin_context(),
+                                                instance['id'])
+        net_agent = self._get_net_agent(context, instance['project_id'])
+        for vnic_id in vnics:
+            net_agent.prepare_vnic_filter(context.get_admin_context(),
+                                          vnic_id,
+                                          self._get_connection)
+    
         if cleanup:
             self._cleanup(instance)
 
@@ -534,25 +538,36 @@
     def reboot(self, instance):
         self.destroy(instance, False)
         xml = self.to_xml(instance)
-        self.firewall_driver.setup_basic_filtering(instance)
-        self.firewall_driver.prepare_instance_filter(instance)
+
+        ctxt = context.get_admin_context()
+        vnics = db.virtual_nics_get_by_instance(ctxt, instance['id'])
+        net_agent = self._get_net_agent(ctxt, instance['project_id'])
+        is_vpn = (instance['image_id'] == FLAGS.vpn_image_id)
+        for vnic_id in vnics:
+            net_agent.setup_basic_filtering(
+                ctxt, vnic_id, FLAGS.allow_project_net_traffic,
+                self._get_connection)
+            net_agent.prepare_vnic_filter(ctxt, vnic_id, is_vpn,
+                                          FLAGS.allow_project_net_traffic,
+                                          self._get_connection)
+
         self._create_new_domain(xml)
-        self.firewall_driver.apply_instance_filter(instance)
+
+        for vnic_id in vnics:
+            net_agent.apply_vnic_filter(vnic_id)
 
         timer = utils.LoopingCall(f=None)
 
         def _wait_for_reboot():
             try:
                 state = self.get_info(instance['name'])['state']
-                db.instance_set_state(context.get_admin_context(),
-                                      instance['id'], state)
+                db.instance_set_state(ctxt, instance['id'], state)
                 if state == power_state.RUNNING:
                     LOG.debug(_('instance %s: rebooted'), instance['name'])
                     timer.stop()
             except Exception, exn:
                 LOG.exception(_('_wait_for_reboot failed: %s'), exn)
-                db.instance_set_state(context.get_admin_context(),
-                                      instance['id'],
+                db.instance_set_state(ctxt, instance['id'],
                                       power_state.SHUTDOWN)
                 timer.stop()
 
@@ -620,24 +635,29 @@
     @exception.wrap_exception
     def spawn(self, instance, network_info=None):
         xml = self.to_xml(instance, network_info)
-        db.instance_set_state(context.get_admin_context(),
+        ctxt = context.get_admin_context()
+        db.instance_set_state(ctxt,
                               instance['id'],
                               power_state.NOSTATE,
                               'launching')
 
-        vnics = db.api.virtual_nics_get_by_instance(
-                           context.get_admin_context(),
-                           instance['id'])
+        vnics = db.api.virtual_nics_get_by_instance(ctxt,
+                                                    instance['id'])
+        net_agent = self._get_net_agent(ctxt, instance['project_id'])
+        is_vpn = (instance['image_id'] == FLAGS.vpn_image_id)
         for vnic_id in vnics:
-            self.firewall_driver.setup_basic_filtering_for_vnic(vnic_id,
-                                                                instance)
-            self.firewall_driver.prepare_vnic_filter(vnic_id, instance)
+            net_agent.setup_basic_filtering(
+                ctxt, vnic_id, FLAGS.allow_project_net_traffic,
+                self._get_connection)
+            net_agent.prepare_vnic_filter(ctxt, vnic_id, is_vpn,
+                                          FLAGS.allow_project_net_traffic,
+                                          self._get_connection)
 
         self._create_image(instance, xml, network_info)
         domain = self._create_new_domain(xml)
         LOG.debug(_("instance %s: is running"), instance['name'])
         for vnic_id in vnics:
-            self.firewall_driver.apply_vnic_filter(vnic_id)
+            net_agent.apply_vnic_filter(vnic_id)
 
         if FLAGS.start_guests_on_host_boot:
             LOG.debug(_("instance %s: setting autostart ON") %
@@ -1383,10 +1403,17 @@
                  'password': 'fakepassword'}
 
     def refresh_security_group_rules(self, security_group_id):
-        self.firewall_driver.refresh_security_group_rules(security_group_id)
+        ctxt = context.get_admin_context()
+        net_agent = self._get_net_agent(ctxt, ctxt.project_id)
+        net_agent.refresh_security_group_rules(ctxt, security_group_id,
+                                               ctxt.project_id,
+                                               FLAGS.allow_project_net_traffic,
+                                               self.get_connection)
 
     def refresh_security_group_members(self, security_group_id):
-        self.firewall_driver.refresh_security_group_members(security_group_id)
+        ctxt = context.get_admin_context()
+        net_agent = self._get_net_agent(ctxt, ctxt.project_id)
+        net_agent.refresh_security_group_members(security_group_id)
 
     def update_available_resource(self, ctxt, host):
         """Updates compute manager resource info on ComputeNode table.
@@ -1472,7 +1499,7 @@
 
         Concretely, the below method must be called.
         - setup_basic_filtering (for nova-basic, etc.)
-        - prepare_instance_filter(for nova-instance-instance-xxx, etc.)
+        - prepare_vnic_filter(for nova-instance-instance-xxx, etc.)
 
         to_xml may have to be called since it defines PROJNET, PROJMASK.
         but libvirt migrates those value through migrateToURI(),
@@ -1489,16 +1516,23 @@
         if not time:
             time = greenthread
 
-        # If any instances never launch at destination host,
-        # basic-filtering must be set here.
-        self.firewall_driver.setup_basic_filtering(instance_ref)
-        # setting up n)ova-instance-instance-xx mainly.
-        self.firewall_driver.prepare_instance_filter(instance_ref)
+        ctxt = context.get_admin_context()
+        vnics = db.api.virtual_nics_get_by_instance(ctxt, instance_ref['id'])
+        net_agent = self._get_net_agent(ctxt, instance_ref['project_id'])
+        is_vpn = (instance_ref['image_id'] == FLAGS.vpn_image_id)
+        for vnic_id in vnics:
+            net_agent.setup_basic_filtering(ctxt, vnic_id,
+                                            FLAGS.allow_project_net_traffic,
+                                            self._get_connection)
+            net_agent.prepare_vnic_filter(ctxt, vnic_id, is_vpn,
+                                          FLAGS.allow_project_net_traffic,
+                                          self._get_connection)
 
         # wait for completion
         timeout_count = range(FLAGS.live_migration_retry_count)
         while timeout_count:
-            if self.firewall_driver.instance_filter_exists(instance_ref):
+            if net_agent.vnic_filter_exists(vnic_id,
+                                            self._get_connection):
                 break
             timeout_count.pop()
             if len(timeout_count) == 0:
@@ -1586,809 +1620,8 @@
 
     def unfilter_instance(self, instance_ref):
         """See comments of same method in firewall_driver."""
-        self.firewall_driver.unfilter_instance(instance_ref)
-
-
-class FirewallDriver(object):
-    def prepare_instance_filter(self, instance, network_info=None):
-        """Prepare filters for the instance.
-
-        At this point, the instance isn't running yet."""
-        raise NotImplementedError()
-
-    def unfilter_instance(self, instance):
-        """Stop filtering instance"""
-        raise NotImplementedError()
-
-    def apply_instance_filter(self, instance):
-        """Apply instance filter.
-
-        Once this method returns, the instance should be firewalled
-        appropriately. This method should as far as possible be a
-        no-op. It's vastly preferred to get everything set up in
-        prepare_instance_filter.
-        """
-        raise NotImplementedError()
-
-    def refresh_security_group_rules(self, security_group_id):
-        """Refresh security group rules from data store
-
-        Gets called when a rule has been added to or removed from
-        the security group."""
-        raise NotImplementedError()
-
-    def refresh_security_group_members(self, security_group_id):
-        """Refresh security group members from data store
-
-        Gets called when an instance gets added to or removed from
-        the security group."""
-        raise NotImplementedError()
-
-    def setup_basic_filtering(self, instance, network_info=None):
-        """Create rules to block spoofing and allow dhcp.
-
-        This gets called when spawning an instance, before
-        :method:`prepare_instance_filter`.
-
-        """
-        raise NotImplementedError()
-
-    def instance_filter_exists(self, instance):
-        """Check nova-instance-instance-xxx exists"""
-        raise NotImplementedError()
-
-    def vnic_filter_exists(self, vnic_id):
-        """Check nova-instance-vnic_id exists"""
-        raise NotImplementedError()
-
-class NWFilterFirewall(FirewallDriver):
-    """
-    This class implements a network filtering mechanism versatile
-    enough for EC2 style Security Group filtering by leveraging
-    libvirt's nwfilter.
-
-    First, all instances get a filter ("nova-base-filter") applied.
-    This filter provides some basic security such as protection against
-    MAC spoofing, IP spoofing, and ARP spoofing.
-
-    This filter drops all incoming ipv4 and ipv6 connections.
-    Outgoing connections are never blocked.
-
-    Second, every security group maps to a nwfilter filter(*).
-    NWFilters can be updated at runtime and changes are applied
-    immediately, so changes to security groups can be applied at
-    runtime (as mandated by the spec).
-
-    Security group rules are named "nova-secgroup-<id>" where <id>
-    is the internal id of the security group. They're applied only on
-    hosts that have instances in the security group in question.
-
-    Updates to security groups are done by updating the data model
-    (in response to API calls) followed by a request sent to all
-    the nodes with instances in the security group to refresh the
-    security group.
-
-    Each instance has its own NWFilter, which references the above
-    mentioned security group NWFilters. This was done because
-    interfaces can only reference one filter while filters can
-    reference multiple other filters. This has the added benefit of
-    actually being able to add and remove security groups from an
-    instance at run time. This functionality is not exposed anywhere,
-    though.
-
-    Outstanding questions:
-
-    The name is unique, so would there be any good reason to sync
-    the uuid across the nodes (by assigning it from the datamodel)?
-
-
-    (*) This sentence brought to you by the redundancy department of
-        redundancy.
-
-    """
-
-    def __init__(self, get_connection, **kwargs):
-        self._libvirt_get_connection = get_connection
-        self.static_filters_configured = False
-        self.handle_security_groups = False
-
-    def apply_instance_filter(self, instance):
-        """No-op. Everything is done in prepare_instance_filter"""
-        pass
-
-    def apply_vnic_filter(self, vnic_id):
-        """No-op. Everything is done in prepare_vnic_filter"""
-        pass
-
-    def _get_connection(self):
-        return self._libvirt_get_connection()
-    _conn = property(_get_connection)
-
-    def nova_dhcp_filter(self):
-        """The standard allow-dhcp-server filter is an <ip> one, so it uses
-           ebtables to allow traffic through. Without a corresponding rule in
-           iptables, it'll get blocked anyway."""
-
-        return '''<filter name='nova-allow-dhcp-server' chain='ipv4'>
-                    <uuid>891e4787-e5c0-d59b-cbd6-41bc3c6b36fc</uuid>
-                    <rule action='accept' direction='out'
-                          priority='100'>
-                      <udp srcipaddr='0.0.0.0'
-                           dstipaddr='255.255.255.255'
-                           srcportstart='68'
-                           dstportstart='67'/>
-                    </rule>
-                    <rule action='accept' direction='in'
-                          priority='100'>
-                      <udp srcipaddr='$DHCPSERVER'
-                           srcportstart='67'
-                           dstportstart='68'/>
-                    </rule>
-                  </filter>'''
-
-    def nova_ra_filter(self):
-        return '''<filter name='nova-allow-ra-server' chain='root'>
-                            <uuid>d707fa71-4fb5-4b27-9ab7-ba5ca19c8804</uuid>
-                              <rule action='accept' direction='inout'
-                                    priority='100'>
-                                <icmpv6 srcipaddr='$RASERVER'/>
-                              </rule>
-                            </filter>'''
-
-    def setup_basic_filtering(self, instance, network_info=None):
-        """Set up basic filtering (MAC, IP, and ARP spoofing protection)"""
-        logging.info('called setup_basic_filtering in nwfilter')
-
-        if self.handle_security_groups:
-            # No point in setting up a filter set that we'll be overriding
-            # anyway.
-            return
-
-        logging.info('ensuring static filters')
-        self._ensure_static_filters()
-
-        for (network, mapping) in network_info:
-            nic_id = mapping['mac'].replace(':', '')
-            instance_filter_name = self._instance_filter_name(instance, nic_id)
-            self._define_filter(self._filter_container(instance_filter_name,
-                                                       ['nova-base']))
-
-    def setup_basic_filtering_for_vnic(self, vnic_id, instance):
-        """Set up basic filtering (MAC, IP, and ARP spoofing protection)"""
-        logging.info('called setup_basic_filtering_for_vnic in nwfilter')
-
-        if self.handle_security_groups:
-            # No point in setting up a filter set that we'll be overriding
-            # anyway.
-            return
-
-        net_agent = self._net_agent_for_project(instance['project_id'])
-        ctxt = context.get_admin_context()
-        net_info = net_agent.get_network_info(ctxt, vnic_id)
-
-        logging.info('ensuring static filters')
-        self._ensure_static_filters_for_vnic(net_info)
-
-        vnic_filter_name = self._vnic_filter_name(vnic_id)
-        self._define_filter(self._filter_container(vnic_filter_name,
-                                                   ['nova-base']))
-    def _net_agent_for_project(self, project_id):
-        ctxt = context.get_admin_context()
-        net_factory = net_service.get_service_factory(ctxt, project_id)
-        return net_factory.get_net_agent()
-
-    def _ensure_static_filters_for_vnic(self, net_info):
-        if self.static_filters_configured:
-            return
-
-        self._define_filter(self._filter_container('nova-base',
-                                                   ['no-mac-spoofing',
-                                                    'no-ip-spoofing',
-                                                    'no-arp-spoofing',
-                                                    'allow-dhcp-server']))
-        self._define_filter(self.nova_base_ipv4_filter)
-        self._define_filter(self.nova_base_ipv6_filter)
-        self._define_filter(self.nova_dhcp_filter)
-        self._define_filter(self.nova_ra_filter)
-        self._define_filter(self.nova_vpn_filter)
-        if FLAGS.allow_project_net_traffic:
-            self._define_filter(self.nova_project_filter)
-            if net_info['ipv6_enabled']:
-                self._define_filter(self.nova_project_filter_v6)
-
-        self.static_filters_configured = True
-
-
-    def _ensure_static_filters(self):
-        if self.static_filters_configured:
-            return
-
-        self._define_filter(self._filter_container('nova-base',
-                                                   ['no-mac-spoofing',
-                                                    'no-ip-spoofing',
-                                                    'no-arp-spoofing',
-                                                    'allow-dhcp-server']))
-        self._define_filter(self.nova_base_ipv4_filter)
-        self._define_filter(self.nova_base_ipv6_filter)
-        self._define_filter(self.nova_dhcp_filter)
-        self._define_filter(self.nova_ra_filter)
-        self._define_filter(self.nova_vpn_filter)
-        if FLAGS.allow_project_net_traffic:
-            self._define_filter(self.nova_project_filter)
-            if FLAGS.use_ipv6:
-                self._define_filter(self.nova_project_filter_v6)
-
-        self.static_filters_configured = True
-
-    def _filter_container(self, name, filters):
-        xml = '''<filter name='%s' chain='root'>%s</filter>''' % (
-                 name,
-                 ''.join(["<filterref filter='%s'/>" % (f,) for f in filters]))
-        return xml
-
-    nova_vpn_filter = '''<filter name='nova-vpn' chain='root'>
-                           <uuid>2086015e-cf03-11df-8c5d-080027c27973</uuid>
-                           <filterref filter='allow-dhcp-server'/>
-                           <filterref filter='nova-allow-dhcp-server'/>
-                           <filterref filter='nova-base-ipv4'/>
-                           <filterref filter='nova-base-ipv6'/>
-                         </filter>'''
-
-    def nova_base_ipv4_filter(self):
-        retval = "<filter name='nova-base-ipv4' chain='ipv4'>"
-        for protocol in ['tcp', 'udp', 'icmp']:
-            for direction, action, priority in [('out', 'accept', 399),
-                                                ('in', 'drop', 400)]:
-                retval += """<rule action='%s' direction='%s' priority='%d'>
-                               <%s />
-                             </rule>""" % (action, direction,
-                                              priority, protocol)
-        retval += '</filter>'
-        return retval
-
-    def nova_base_ipv6_filter(self):
-        retval = "<filter name='nova-base-ipv6' chain='ipv6'>"
-        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
-            for direction, action, priority in [('out', 'accept', 399),
-                                                ('in', 'drop', 400)]:
-                retval += """<rule action='%s' direction='%s' priority='%d'>
-                               <%s />
-                             </rule>""" % (action, direction,
-                                              priority, protocol)
-        retval += '</filter>'
-        return retval
-
-    def nova_project_filter(self):
-        retval = "<filter name='nova-project' chain='ipv4'>"
-        for protocol in ['tcp', 'udp', 'icmp']:
-            retval += """<rule action='accept' direction='in' priority='200'>
-                           <%s srcipaddr='$PROJNET' srcipmask='$PROJMASK' />
-                         </rule>""" % protocol
-        retval += '</filter>'
-        return retval
-
-    def nova_project_filter_v6(self):
-        retval = "<filter name='nova-project-v6' chain='ipv6'>"
-        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
-            retval += """<rule action='accept' direction='inout'
-                                                   priority='200'>
-                           <%s srcipaddr='$PROJNETV6'
-                               srcipmask='$PROJMASKV6' />
-                         </rule>""" % (protocol)
-        retval += '</filter>'
-        return retval
-
-    def _define_filter(self, xml):
-        if callable(xml):
-            xml = xml()
-        # execute in a native thread and block current greenthread until done
-        tpool.execute(self._conn.nwfilterDefineXML, xml)
-
-    def unfilter_instance(self, instance):
-        # Nothing to do
-        pass
-
-    def prepare_instance_filter(self, instance, network_info=None):
-        """
-        Creates an NWFilter for the given instance. In the process,
-        it makes sure the filters for the security groups as well as
-        the base filter are all in place.
-        """
-        if instance['image_id'] == FLAGS.vpn_image_id:
-            base_filter = 'nova-vpn'
-        else:
-            base_filter = 'nova-base'
-
-        ctxt = context.get_admin_context()
-
-        instance_secgroup_filter_name = \
-            '%s-secgroup' % (self._instance_filter_name(instance))
-            #% (instance_filter_name,)
-
-        instance_secgroup_filter_children = ['nova-base-ipv4',
-                                             'nova-base-ipv6',
-                                             'nova-allow-dhcp-server']
-
-        for security_group in \
-                db.security_group_get_by_instance(ctxt, instance['id']):
-
-            self.refresh_security_group_rules(security_group['id'])
-
-            instance_secgroup_filter_children += [('nova-secgroup-%s' %
-                                                    security_group['id'])]
-
-            self._define_filter(
-                    self._filter_container(instance_secgroup_filter_name,
-                                           instance_secgroup_filter_children))
-
-        for (network, mapping) in network_info:
-            nic_id = mapping['mac'].replace(':', '')
-            instance_filter_name = self._instance_filter_name(instance, nic_id)
-            instance_filter_children = \
-                [base_filter, instance_secgroup_filter_name]
-
-            if FLAGS.use_ipv6:
-                gateway_v6 = network['gateway_v6']
-
-                if gateway_v6:
-                    instance_secgroup_filter_children += \
-                        ['nova-allow-ra-server']
-
-            if FLAGS.allow_project_net_traffic:
-                instance_filter_children += ['nova-project']
-                if FLAGS.use_ipv6:
-                    instance_filter_children += ['nova-project-v6']
-
-            self._define_filter(
-                    self._filter_container(instance_filter_name,
-                                           instance_filter_children))
-
-        return
-
-    def refresh_security_group_rules(self, security_group_id):
-        return self._define_filter(
-                   self.security_group_to_nwfilter_xml(security_group_id))
-
-    def security_group_to_nwfilter_xml(self, security_group_id):
-        security_group = db.security_group_get(context.get_admin_context(),
-                                               security_group_id)
-        rule_xml = ""
-        v6protocol = {'tcp': 'tcp-ipv6', 'udp': 'udp-ipv6', 'icmp': 'icmpv6'}
-        for rule in security_group.rules:
-            rule_xml += "<rule action='accept' direction='in' priority='300'>"
-            if rule.cidr:
-                version = _get_ip_version(rule.cidr)
-                if(FLAGS.use_ipv6 and version == 6):
-                    net, prefixlen = _get_net_and_prefixlen(rule.cidr)
-                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
-                                (v6protocol[rule.protocol], net, prefixlen)
-                else:
-                    net, mask = _get_net_and_mask(rule.cidr)
-                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
-                                (rule.protocol, net, mask)
-                if rule.protocol in ['tcp', 'udp']:
-                    rule_xml += "dstportstart='%s' dstportend='%s' " % \
-                                (rule.from_port, rule.to_port)
-                elif rule.protocol == 'icmp':
-                    LOG.info('rule.protocol: %r, rule.from_port: %r, '
-                             'rule.to_port: %r', rule.protocol,
-                             rule.from_port, rule.to_port)
-                    if rule.from_port != -1:
-                        rule_xml += "type='%s' " % rule.from_port
-                    if rule.to_port != -1:
-                        rule_xml += "code='%s' " % rule.to_port
-
-                rule_xml += '/>\n'
-            rule_xml += "</rule>\n"
-        xml = "<filter name='nova-secgroup-%s' " % security_group_id
-        if(FLAGS.use_ipv6):
-            xml += "chain='root'>%s</filter>" % rule_xml
-        else:
-            xml += "chain='ipv4'>%s</filter>" % rule_xml
-        return xml
-
-    def _instance_filter_name(self, instance, nic_id=None):
-        if not nic_id:
-            return 'nova-instance-%s' % (instance['name'])
-        return 'nova-instance-%s-%s' % (instance['name'], nic_id)
-
-    def _vnic_filter_name(self, vnic_id):
-        return 'nova-vnic-%s' % vnic_id
-
-    def vnic_filter_exists(self, vnic_id):
-        vnic_filter_name = self._vnic_filter_name(vnic_id)
-        try:
-            self._conn.nwfilterLookupByName(vnic_filter_name)
-        except libvirt.libvirtError:
-            name = vnic_id 
-            LOG.debug(_('The nwfilter(%(instance_filter_name)s) for'
-                        '%(name)s is not found.') % locals())
-            return False
-        return True
-
-    def instance_filter_exists(self, instance):
-        """Check nova-instance-instance-xxx exists"""
-        network_info = _get_network_info(instance)
-        for (network, mapping) in network_info:
-            nic_id = mapping['mac'].replace(':', '')
-            instance_filter_name = self._instance_filter_name(instance, nic_id)
-            try:
-                self._conn.nwfilterLookupByName(instance_filter_name)
-            except libvirt.libvirtError:
-                name = instance.name
-                LOG.debug(_('The nwfilter(%(instance_filter_name)s) for'
-                            '%(name)s is not found.') % locals())
-                return False
-        return True
-
-
-class IptablesFirewallDriver(FirewallDriver):
-    def __init__(self, execute=None, **kwargs):
-        from nova.network.flat_vlan.driver.linux import filter
-        self.iptables = filter.iptables_manager
-        self.instances = {}
-        self.vnics = {}
-        self.nwfilter = NWFilterFirewall(kwargs['get_connection'])
-
-        self.iptables.ipv4['filter'].add_chain('sg-fallback')
-        self.iptables.ipv4['filter'].add_rule('sg-fallback', '-j DROP')
-        self.iptables.ipv6['filter'].add_chain('sg-fallback')
-        self.iptables.ipv6['filter'].add_rule('sg-fallback', '-j DROP')
-
-    def setup_basic_filtering(self, instance, network_info=None):
-        """Use NWFilter from libvirt for this."""
-        return self.nwfilter.setup_basic_filtering(instance, network_info)
-
-    def setup_basic_filtering_for_vnic(self, vnic_id, instance):
-        """Use NWFilter from libvirt for this."""
-        return self.nwfilter.setup_basic_filtering_for_vnic(vnic_id, instance)
-
-    def apply_instance_filter(self, instance):
-        """No-op. Everything is done in prepare_instance_filter"""
-        pass
-
-    def apply_vnic_filter(self, vnic_id):
-        """No-op. Everything is done in prepare_vnic_filter"""
-        pass
-
-    def unfilter_instance(self, instance):
-        if self.instances.pop(instance['id'], None):
-            self.remove_filters_for_instance(instance)
-            self.iptables.apply()
-        else:
-            LOG.info(_('Attempted to unfilter instance %s which is not '
-                     'filtered'), instance['id'])
-
-    def prepare_instance_filter(self, instance, network_info=None):
-        self.instances[instance['id']] = instance
-        self.add_filters_for_instance(instance, network_info)
-        self.iptables.apply()
-
-    def prepare_vnic_filter(self, vnic_id, instance):
-        self.vnics[vnic_id] = vnic_id
-        self.add_filters_for_vnic(vnic_id, instance)
-        self.iptables.apply()
-
-    def add_filters_for_vnic(self, vnic_id, instance):
-        ctxt = context.get_admin_context()
-        net_agent = self._net_agent_for_project(instance['project_id'])
-        net_info = net_agent.get_network_info(ctxt, vnic_id)
-        chain_name = self._vnic_chain_name(vnic_id)
-
-        self.iptables.ipv4['filter'].add_chain(chain_name)
-        ipv4_address = net_info['IPs'][0]['fixed_ip']
-        self.iptables.ipv4['filter'].add_rule('local',
-                                              '-d %s -j $%s' %
-                                              (ipv4_address, chain_name))
-
-        if net_info['ipv6_enabled']:
-            self.iptables.ipv6['filter'].add_chain(chain_name)
-            ipv6_address = net_info['IPs'][0]['ip_v6']
-            self.iptables.ipv6['filter'].add_rule('local',
-                                                  '-d %s -j $%s' %
-                                                  (ipv6_address,
-                                                   chain_name))
-
-        ipv4_rules, ipv6_rules = self.vnic_rules(vnic_id, net_info,
-                                                 instance)
-
-        for rule in ipv4_rules:
-            self.iptables.ipv4['filter'].add_rule(chain_name, rule)
-
-        if net_info['ipv6_enabled']:
-            for rule in ipv6_rules:
-                self.iptables.ipv6['filter'].add_rule(chain_name, rule)
-
-    def add_filters_for_instance(self, instance, network_info=None):
-
-        chain_name = self._instance_chain_name(instance)
-
-        self.iptables.ipv4['filter'].add_chain(chain_name)
-
-        ips_v4 = [ip['ip'] for (_, mapping) in network_info
-                            for ip in mapping['ips']]
-
-        for ipv4_address in ips_v4:
-            self.iptables.ipv4['filter'].add_rule('local',
-                                                  '-d %s -j $%s' %
-                                                  (ipv4_address, chain_name))
-
-        if FLAGS.use_ipv6:
-            self.iptables.ipv6['filter'].add_chain(chain_name)
-            ips_v6 = [ip['ip'] for (_, mapping) in network_info
-                                 for ip in mapping['ip6s']]
-
-            for ipv6_address in ips_v6:
-                self.iptables.ipv6['filter'].add_rule('local',
-                                                      '-d %s -j $%s' %
-                                                      (ipv6_address,
-                                                       chain_name))
-
-        ipv4_rules, ipv6_rules = self.instance_rules(instance, network_info)
-
-        for rule in ipv4_rules:
-            self.iptables.ipv4['filter'].add_rule(chain_name, rule)
-
-        if FLAGS.use_ipv6:
-            for rule in ipv6_rules:
-                self.iptables.ipv6['filter'].add_rule(chain_name, rule)
-
-    def remove_filters_for_instance(self, instance):
-        ctxt = context.get_admin_context()
-        net_agent = self._net_agent_for_project(instance['project_id'])
-        vnics = self._vnics_for_instance(instance)
+        ctxt = context.get_admin_context()
+        vnics = db.api.virtual_nics_get_by_instance(ctxt, instance_ref['id'])
+        net_agent = self._get_net_agent(ctxt, instance_ref['project_id'])
         for vnic_id in vnics:
-
-            net_info = net_agent.get_network_info(ctxt, vnic_id)
-            chain_name = self._vnic_chain_name(vnic_id)
-
-            self.iptables.ipv4['filter'].remove_chain(chain_name)
-            if net_info['ipv6_enabled']:
-                self.iptables.ipv6['filter'].remove_chain(chain_name)
-
-    def instance_rules(self, instance, network_info=None):
-
-        ctxt = context.get_admin_context()
-
-        ipv4_rules = []
-        ipv6_rules = []
-
-        # Always drop invalid packets
-        ipv4_rules += ['-m state --state ' 'INVALID -j DROP']
-        ipv6_rules += ['-m state --state ' 'INVALID -j DROP']
-
-        # Allow established connections
-        ipv4_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
-        ipv6_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
-
-        dhcp_servers = [network['gateway'] for (network, _m) in network_info]
-
-        for dhcp_server in dhcp_servers:
-            ipv4_rules.append('-s %s -p udp --sport 67 --dport 68 '
-                              '-j ACCEPT' % (dhcp_server,))
-
-        #Allow project network traffic
-        if FLAGS.allow_project_net_traffic:
-            cidrs = [network['cidr'] for (network, _m) in network_info]
-            for cidr in cidrs:
-                ipv4_rules.append('-s %s -j ACCEPT' % (cidr,))
-
-        # We wrap these in FLAGS.use_ipv6 because they might cause
-        # a DB lookup. The other ones are just list operations, so
-        # they're not worth the clutter.
-        if FLAGS.use_ipv6:
-            # Allow RA responses
-            gateways_v6 = [network['gateway_v6'] for (network, _) in
-                           network_info]
-            for gateway_v6 in gateways_v6:
-                ipv6_rules.append(
-                        '-s %s/128 -p icmpv6 -j ACCEPT' % (gateway_v6,))
-
-            #Allow project network traffic
-            if FLAGS.allow_project_net_traffic:
-                cidrv6s = [network['cidr_v6'] for (network, _m)
-                          in network_info]
-
-                for cidrv6 in cidrv6s:
-                    ipv6_rules.append('-s %s -j ACCEPT' % (cidrv6,))
-
-        security_groups = db.security_group_get_by_instance(ctxt,
-                                                            instance['id'])
-
-        # then, security group chains and rules
-        for security_group in security_groups:
-            rules = db.security_group_rule_get_by_security_group(ctxt,
-                                                          security_group['id'])
-
-            for rule in rules:
-                logging.info('%r', rule)
-
-                if not rule.cidr:
-                    # Eventually, a mechanism to grant access for security
-                    # groups will turn up here. It'll use ipsets.
-                    continue
-
-                version = _get_ip_version(rule.cidr)
-                if version == 4:
-                    rules = ipv4_rules
-                else:
-                    rules = ipv6_rules
-
-                protocol = rule.protocol
-                if version == 6 and rule.protocol == 'icmp':
-                    protocol = 'icmpv6'
-
-                args = ['-p', protocol, '-s', rule.cidr]
-
-                if rule.protocol in ['udp', 'tcp']:
-                    if rule.from_port == rule.to_port:
-                        args += ['--dport', '%s' % (rule.from_port,)]
-                    else:
-                        args += ['-m', 'multiport',
-                                 '--dports', '%s:%s' % (rule.from_port,
-                                                        rule.to_port)]
-                elif rule.protocol == 'icmp':
-                    icmp_type = rule.from_port
-                    icmp_code = rule.to_port
-
-                    if icmp_type == -1:
-                        icmp_type_arg = None
-                    else:
-                        icmp_type_arg = '%s' % icmp_type
-                        if not icmp_code == -1:
-                            icmp_type_arg += '/%s' % icmp_code
-
-                    if icmp_type_arg:
-                        if version == 4:
-                            args += ['-m', 'icmp', '--icmp-type',
-                                     icmp_type_arg]
-                        elif version == 6:
-                            args += ['-m', 'icmp6', '--icmpv6-type',
-                                     icmp_type_arg]
-
-                args += ['-j ACCEPT']
-                rules += [' '.join(args)]
-
-        ipv4_rules += ['-j $sg-fallback']
-        ipv6_rules += ['-j $sg-fallback']
-
-    def vnic_rules(self, vnic_id, net_info, instance):
-        ctxt = context.get_admin_context()
-
-        ipv4_rules = []
-        ipv6_rules = []
-
-        # Always drop invalid packets
-        ipv4_rules += ['-m state --state ' 'INVALID -j DROP']
-        ipv6_rules += ['-m state --state ' 'INVALID -j DROP']
-
-        # Allow established connections
-        ipv4_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
-        ipv6_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
-
-        if net_info['IPs'][0]['gateway']:
-            ipv4_rules += ['-s %s -p udp --sport 67 --dport 68 '
-                           '-j ACCEPT' % (net_info['IPs'][0]['gateway'],)]
-
-        #Allow project network traffic
-        if FLAGS.allow_project_net_traffic:
-            if net_info['IPs'][0]['cidr']:
-                ipv4_rules += ['-s %s -j ACCEPT' %
-                               (net_info['IPs'][0]['cidr'],)]
-
-        # We wrap these in FLAGS.use_ipv6 because they might cause
-        # a DB lookup. The other ones are just list operations, so
-        # they're not worth the clutter.
-        if net_info['ipv6_enabled']:
-            # Allow RA responses
-            if net_info['IPs'][0]['gateway_v6']:
-                 ipv6_rules += ['-s %s/128 -p icmpv6 -j ACCEPT' %
-                                (net_info['IPs'][0]['gateway_v6'],)]
-
-                 #Allow project network traffic
-                 if FLAGS.allow_project_net_traffic:
-                     if net_info['IPs'][0]['cidr_v6']:
-                         ipv6_rules += ['-s %s -j ACCEPT' %
-                                        (net_info['IPs'][0]['cidr_v6'],)]
-
-        security_groups = db.security_group_get_by_instance(ctxt,
-                                                            instance['id'])
-
-        # then, security group chains and rules
-        for security_group in security_groups:
-            rules = db.security_group_rule_get_by_security_group(ctxt,
-                                                          security_group['id'])
-
-            for rule in rules:
-                logging.info('%r', rule)
-
-                if not rule.cidr:
-                    # Eventually, a mechanism to grant access for security
-                    # groups will turn up here. It'll use ipsets.
-                    continue
-
-                version = _get_ip_version(rule.cidr)
-                if version == 4:
-                    rules = ipv4_rules
-                else:
-                    rules = ipv6_rules
-
-                protocol = rule.protocol
-                if version == 6 and rule.protocol == 'icmp':
-                    protocol = 'icmpv6'
-
-                args = ['-p', protocol, '-s', rule.cidr]
-
-                if rule.protocol in ['udp', 'tcp']:
-                    if rule.from_port == rule.to_port:
-                        args += ['--dport', '%s' % (rule.from_port,)]
-                    else:
-                        args += ['-m', 'multiport',
-                                 '--dports', '%s:%s' % (rule.from_port,
-                                                        rule.to_port)]
-                elif rule.protocol == 'icmp':
-                    icmp_type = rule.from_port
-                    icmp_code = rule.to_port
-
-                    if icmp_type == -1:
-                        icmp_type_arg = None
-                    else:
-                        icmp_type_arg = '%s' % icmp_type
-                        if not icmp_code == -1:
-                            icmp_type_arg += '/%s' % icmp_code
-
-                    if icmp_type_arg:
-                        if version == 4:
-                            args += ['-m', 'icmp', '--icmp-type',
-                                     icmp_type_arg]
-                        elif version == 6:
-                            args += ['-m', 'icmp6', '--icmpv6-type',
-                                     icmp_type_arg]
-
-                args += ['-j ACCEPT']
-                rules += [' '.join(args)]
-
-        ipv4_rules += ['-j $sg-fallback']
-        ipv6_rules += ['-j $sg-fallback']
-
-        return ipv4_rules, ipv6_rules
-
-    def vnic_filter_exists(self, vnic_id):
-        """Check nova-vnic_id exists"""
-        return self.nwfilter.vnic_filter_exists(vnic_id)
-
-    def instance_filter_exists(self, instance):
-        """Check nova-instance-instance-xxx exists"""
-        return self.nwfilter.instance_filter_exists(instance)
-
-    def refresh_security_group_members(self, security_group):
-        pass
-
-    def refresh_security_group_rules(self, security_group):
-        self.do_refresh_security_group_rules(security_group)
-        self.iptables.apply()
-
-    def _vnics_for_instance(self, instance):
-        return db.virtual_nics_get_by_instance(context.get_admin_context(),
-                                               instance['id'])
-
-    def _net_agent_for_project(self, project_id):
-        ctxt = context.get_admin_context()
-        net_factory = net_service.get_service_factory(ctxt, project_id)
-        return net_factory.get_net_agent()
-
-    @utils.synchronized('iptables', external=True)
-    def do_refresh_security_group_rules(self, security_group):
-        for instance in self.instances.values():
-            self.remove_filters_for_instance(instance)
-            self.add_filters_for_instance(instance)
-
-    def _security_group_chain_name(self, security_group_id):
-        return 'nova-sg-%s' % (security_group_id,)
-
-    def _instance_chain_name(self, instance):
-        return 'inst-%s' % (instance['id'],)
-
-    def _vnic_chain_name(self, vnic_id):
-        return 'vnic-%s' % (vnic_id,)
-
+            net_agent.unfilter_vnic(vnic_id)